Linux Learners

Basic Azure Kubernetes concepts ( AKS Networking)

2020-11-18T20:41:00.003-08:00

AKS Networking :

Link : https://docs.microsoft.com/en-us/azure/aks/concepts-network

AKS, you can deploy a cluster that uses one of the following two network models:

· Kubenet networking - The network resources are typically created and configured as the AKS cluster is deployed.

· Azure Container Networking Interface (CNI) networking - The AKS cluster is connected to existing virtual network resources and configurations.

Kubenet :

Kubenet (basic) networking

The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes get an IP address from the Azure virtual network subnet. Pods receive an IP address from a logically different address space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network. The source IP address of the traffic is NAT'd to the node's primary IP address. , only the nodes receive a routable IP address, and the pods use NAT to communicate with other resources outside the AKS cluster. This approach greatly reduces the number of IP addresses that you need to reserve in your network space for pods to use.

Azure CNI (advanced) networking

With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space, and must be planned in advance. Each node has a configuration parameter for the maximum number of pods that it supports. The equivalent number of IP addresses per node are then reserved up front for that node. This approach requires more planning, as can otherwise lead to IP address exhaustion or the need to rebuild clusters in a larger subnet as your application demands grow.

https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni

To calculate the minimum subnet size including an additional node for upgrade operations: (number of nodes + 1) + ((number of nodes + 1) * maximum pods per node that you configure)

Example for a 50 node cluster: (51) + (51 * 30 (default)) = 1,581 (/21 or larger)

Example for a 50 node cluster that also includes provision to scale up an additional 10 nodes: (61) + (61 * 30 (default)) = 1,891 (/21 or larger)

Linux admin - rpm yum dnf package management

2020-10-23T21:33:00.006-07:00

1) How to download all packages with dependency irrespective for what is installed

#repoquery nfs-utils

#repotrack nfs-utils

2) Download package and dependencies

#yumdownloader --downloadonly --downloaddir=/tmp/pkg/ libevent-2.0.so.5 --resolve

Linux admin - User management

2020-03-30T22:29:00.003-07:00

System admin : daily commands - User management

How to reset password / avoid prompting

echo "password" | passwd --stdin username

How to create GPT/LVM partition on Red Hat Enterprise Linux (RHEL) 6

2016-07-02T09:04:00.000-07:00

Red Hat Enterprise Linux (RHEL) 6

Red Hat Enterprise Linux (RHEL) 5

Solution

In traditional MBR partition scheme, boot device cannot be exceeding more than 2TB. To avoid this limitation, we can use GPT (GUID partition table). ‘fdisk’ command does not support GPT partition . We have to use ’parted’ utility to create and manage GPT partitions. Below are some advantages of GPT

Ø Uses GUIDs (UUIDs) to identify partition types

Ø Provides a unique disk GUID and unique partition GUID for each partition - A good filesystem-independent way of referencing partitions and disks.

Ø More number of partitions

Ø Maximum addressable disk size is 2 ZiB.

Ø Stores a backup header and partition table at the end of the disk that aids in recovery in case the primary ones are damaged

STEPS:

1) Install the parted rpm , if it is not available.

#yum install parted

# rpm -qa parted

parted-2.1-29.el6.x86_64

2) Initialize the disk using parted utility

# parted /dev/sdb mklabel gpt

3) Created partition using mkpart

#parted /dev/sdb mkpart primary 1 322GB

4) For listing the partition details , we can use print option

#parted /dev/sdb print

5) For enabling LVM flag , we can use below command

#parted /dev/sdb set 1 lvm on

How to set up yum repository to use locally-mounted DVD with Red Hat Enterprise Linux (RHEL) 6

2013-10-05T07:48:00.003-07:00

How to create a yum repository using locally mounded DVD media – RHEL6

Yum is the package manager that is used in Redhat , Yum searches numerous repositories for packages and their dependencies so they may be installed together in an effort to alleviate dependency issues. Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6 uses Yum to fetch packages and install RPMs. We can use our installation media for creating yum repository. Below steps will explain to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 6.

1. Create a folder and mount RHEL 6 iso image to that folder.

# mount -o loop /vmstorage/rhel6.iso /repo/

Note: If we are directly using DVD Media, we can mount it without loop option.

# mount /dev/cdrom /repo/

2. Copy the media.repo file from the root of the mounted ISO to /etc/yum.repos.d/ and set the appropriate permission.

# cp /repo/media.repo /etc/yum.repos.d/rheldvd.repo

# chmod 644 /etc/yum.repos.d/rheldvd.repo

3. Edit the new repo file. Change the gpgcheck=0 setting to 1 and add the following 3 lines (make sure to replace "Server" with "Client" or "Workstation", depending on the type of RHEL DVD version in use):

enabled=1

baseurl=file:///repo/Server

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

After completing editiong , the new repo file could look like the following (the mediaid will be different depending on the version of RHEL):

[InstallMedia]

name=Red Hat Enterprise Linux 6.0

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=1

cost=500

enabled=1

baseurl=file:///repo/Server

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

We can run the the command ‘yum clean all’ once to clean up repository erros. . Also note that if the system is registered to Red Hat Network, yum can be run with the --noplugins option to prevent it from connecting to RHN.

# yum clean all

Loaded plugins: refresh-packagekit, rhnplugin

Cleaning up Everything

# yum clean all --noplugins

Cleaning up Everything

Note:

We can also configure repositories for addition addons like High Availability, LoadBalancer, ResilientStorage, and ScalableFileSystem. By editing the file as below.

# vi /etc/yum.repos.d/rheldvd.repo

[InstallMedia]

name=Red Hat Enterprise Linux 6.0

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=0

cost=500

enabled=1

baseurl=file:///repo/Server

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[LoadBalancer]

name=Red Hat Enterprise Linux 6.0 - LoadBalancer

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=0

cost=500

enabled=1

baseurl=file:///repo/LoadBalancer

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[ResilientStorage]

name=Red Hat Enterprise Linux 6.0 - ResilientStorage

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=0

cost=500

enabled=1

baseurl=file:///repo/ResilientStorage

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[HighAvailability]

name=Red Hat Enterprise Linux 6.0 - HighAvailability

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=0

cost=500

enabled=1

baseurl=file:///repo/HighAvailability

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[ScalableFileSystem]

name=Red Hat Enterprise Linux 6.0 - ScalableFileSystem

mediaid=1285193176.460470

metadata_expire=-1

gpgcheck=0

cost=500

enabled=1

baseurl=file:///repo/ScalableFileSystem

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

4. We can list the configured repositories using below command.

# yum repolist

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.

RHN support will be disabled.

repo id repo name

HighAvailability Red Hat Enterpr

InstallMedia Red Hat Enterpr

LoadBalancer Red Hat Enterpr

ResilientStorage Red Hat Enterpr

ScalableFileSystem Red Hat Enterpr

repolist: 3,448

Note:

Below are some basing yum commands.

1) Install a package:

# yum install httpd

2) Remove a package:

# yum remove httpd

3) Update a package:

# yum update httpd

4) Search for a package:

# yum search httpd

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.

RHN support will be disabled.

================================ Matched: httpd ================================

httpd-devel.i686 : Development interfaces for the Apache HTTP server

httpd-devel.x86_64 : Development interfaces for the Apache HTTP server

httpd-manual.noarch : Documentation for the Apache HTTP server

httpd-tools.x86_64 : Tools for use with the Apache HTTP Server

httpd.x86_64 : Apache HTTP Server

mod_dav_svn.x86_64 : Apache httpd module for Subversion server

mod_dnssd.x86_64 : An Apache HTTPD module which adds Zeroconf support

mod_ssl.x86_64 : SSL/TLS module for the Apache HTTP Server

5) Find information about a package:

# yum info httpd

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.

RHN support will be disabled.

Available Packages

Name : httpd

Arch : x86_64

Version : 2.2.15

Release : 5.el6

Size : 811 k

Repo : InstallMedia

Summary : Apache HTTP Server

URL : http://httpd.apache.org/

License : ASL 2.0

Description: The Apache HTTP Server is a powerful, efficient, and extensible

: web server.

6) List packages containing a certain term:

# yum list httpd

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.

RHN support will be disabled.

Available Packages

httpd.x86_64 2.2.15-5.el6 InstallMedia

7) Find what package provides a particular file:

# yum whatprovides 'path/filename'

Example:

# yum whatprovides /etc/httpd/conf/httpd.conf

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.

RHN support will be disabled.

httpd-2.2.15-5.el6.x86_64 : Apache HTTP Server

Repo : InstallMedia

Matched from:

Filename : /etc/httpd/conf/httpd.conf

httpd-2.2.15-5.el6.x86_64 : Apache HTTP Server

Repo : installed

Matched from:

Other : Provides-match: /etc/httpd/conf/httpd.conf

8) Update all installed packages with kernel package :

# yum -y update

9) To update a specific package:

# yum -y update openssh-server

**********************************

KVM Virtualization Creating virtual machine using command line (virt-install) in RHEL 6

2013-09-29T00:12:00.000-07:00

Virtualization means dividing single physical host to multiple virtual machines. The X86 computers: are designed to run just one operating system and application at a time. As a result, even small data centers have to deploy many servers. Virtualization software solves the problem by enabling several operating systems and applications to run on one physical server or “host.” Each self-contained “virtual machine” is isolated from the others, and uses as much of the host’s computing resources as it requires.KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V). It consists of a loadable kernel module, kvm.ko, that provides the core virtualization infrastructure and a processor specific module, kvm-intel.ko or kvm-amd.ko. KVM also requires a modified QEMU although work is underway to get the required changes upstream.Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.

Virtual machine can be created using ‘virt-install’ command. ‘virt-install, is a command line tool for provisioning new virtual machines using the "libvirt" hypervisor management library. The tool supports text based & graphical installations, using serial console, SDL graphics or a VNC client/server pair. The guest can be configured to use one or more virtual disks, network interfaces, audio devices, and physical host devices (USB, PCI). Installation of VMs using the ‘virt-install’ tool is very easy. This tool can run in interactive or non-interactive mode. We are using ‘virt-install’ to create a RHEL 6.1 x64 VM named vmachine1 with one virtual CPU, 1 GB memory and 8 GB of disk space:

Creating VM using command line

1) Open terminal and run below command to start installation.

# virt-install --network bridge:br0 --name vmmachine1 --ram=1024 --vcpus=1 --disk path=/vmstorage/vm1.img,size=8 --cdrom=/vmstorage/rhel6.iso

Starting install...

Allocating 'vm1.img' | 8.0 GB 00:00

Creating domain... | 0 B 00:00

OS will be installed. Below message will come if we are closed the console and installation will run in background.

Domain installation still in progress. You can reconnect to the console to complete the installation process.

Note:

1) --cdrom=/vmstorage/rhel6.iso

Path for the installation media. File or device use as a virtual CD-ROM device for fully virtualizedguests. It can be path to an ISO image, or to a CDROM device. It can also be a URL from which to fetch/access a minimal boot ISO image.

2) --network bridge:br0

Connect to a bridge device in the host called "br0". Use this option if the host has static networking config & the guest requires full outbound and inbound connectivity to/from the LAN. Also use this if live migration will be used with this guest.

3) --name vmmachine1

Name of the Virtual machine.

4) --ram=1024

This is the amount of memory in the VM in MBs.If the hypervisor does not have enough free memory, it is usual for it to automatically take memory away from the host operating system to satisfy this allocation.

5) --vcpus=1

Number of virtual CPUs in the virtual machine.

6) --disk path=/vmstorage/vm1.img,size=8

This is the image file for the VM, the size is specified in GBs.

Creating VM using command line interactive mode

1) Open terminal and run below command to start installation

# virt-install –prompt

What is the name of your virtual machine? vmachine1

How much RAM should be allocated (in megabytes)? 512

What would you like to use as the disk (file path)? /vmstorage/vmmachine1

How large would you like the disk (/vmstorage/vmmachine1) to be (in gigabytes)? 8

What is the install CD-ROM/ISO or URL? /vmstorage/rhel6.iso

Starting install...

Allocating 'vmmachine1' | 8.0 GB 00:00

It will install to OS automatically.

How to check Virtualization technology is enabled or not in Redhat

2013-09-28T23:57:00.006-07:00

HOW to check Virtualization in RHEL

Virtualization
allows multiple OS instance to run concurrently on a system. KVM (Kernel-based
Virtual Machine) is a full virtualization solution for Linux on AMD64 and
Intel 64 hardware that is built into the standard Red Hat Enterprise
Linux 6 kernel. For supporting Virtualization an Intel processor with the
Intel VT-x and Intel 64 extensions for x86-based systems, or an AMD processor
with the AMD-V and the AMD64 extensions is required.

To
verify the Virtualization technology we can use below method. In this example
we are using Intel Processor, so it will show as vmx.

#
grep -E 'svm|vmx' /proc/cpuinfo

flags           : fpu vme de pse tsc msr pae mce cx8
apic mtrr pge mca cmov pat                                                                                        
pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm
constant_tsc                                                                                        
arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl vmx est tm2                                                                   
                     ssse3 cx16
xtpr pdcm sse4_1 xsave lahf_lm tpr_shadow vnmi flexpriority

flags           : fpu vme de pse tsc msr pae mce cx8
apic mtrr pge mca cmov pat                                                                                    
    pse36 clflush dts acpi mmx
fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc                                                                                        
arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl vmx
est tm2                                                                                         ssse3
cx16 xtpr pdcm sse4_1 xsave lahf_lm tpr_shadow vnmi flexpriority

Note: 

In case of AMD Processors, it will shoe as svm.
We need to Verify that Virtualization Technology (VT) is enabled in our
server‟s BIOS. Reboot your server and press F2 during POST to go into the BIOS,
the select “Processors Settings”, and verify “Virtualization Technology” is
“Enabled”. Save and Exit and let the server boot up.( BIOS menu option will be
vary depend on Server )

2 In case of KVM, we need to verify that kvm module is
loaded . If it is not loaded install required packages.

#
lsmod | grep kvm

kvm_intel              45674  9

kvm                   291811  1 kvm_intel

Note: In the case of AMD , it will show as kvm_amd

Installing SNMP Service in RHEL 6

2013-09-28T11:08:00.001-07:00

Installing SNMP Service in RHEL 6

SNMP ( Simple Network Management Protocol (SNMP) agent ) will help us to monitor the system from management utilities. SNMP exposes management data in the form of variables on the managed systems, which describe the system configuration. These variables can then be queried (and sometimes set) by managing applications.

Configure yum repository using RHEL 6 media

1) Create and configure yum configuration file as below using vi editor.

# vi /etc/yum.repos.d/repo.repo
[repo]

Name= RHEL 6

baseurl=file:///repo

enabled=1

gpgcheck=0

2) Create a mount point and mount the RHEL 6 media [mount point name is specified in the yum configuration file]

# mkdir /repo

# mount /dev/cdrom /repo/

mount: block device /dev/sr1 is write-protected, mounting read-only

Configuring SNMP service

1) Install the SNMP packages as listed below.
# yum install net-snmp-utils net-snmp-libs net-snmp
# rpm -qa| grep snmp
net-snmp-utils-5.5-31.el6.x86_64
net-snmp-libs-5.5-31.el6.x86_64
net-snmp-5.5-31.el6.x86_64
2) Start the services and make sure that it is running.
# service snmpd start
Starting snmpd: [ OK ]

# service snmptrapd start
Starting snmptrapd: [ OK ]
# service snmpd status

snmpd (pid 4035) is running...

# service snmptrapd status

snmptrapd (pid 4049) is running...
3) Configure the service to start automatically with system boot.
# chkconfig snmpd on

# chkconfig snmptrapd on
# chkconfig --list | grep snmp
snmpd           0:off   1:off   2:on    3:on    4:on    5:on    6:off
snmptrapd       0:off   1:off   2:on    3:on    4:on    5:on    6:off

4) Edit the SNMP configuration file and add entries as per customer requirement. Below is as a example.
# vi /etc/snmp/snmpd.conf
rwcommunity STRING
5) Reload the services.
# service snmpd reload
Reloading snmpd:                                           [ OK ]

# service snmptrapd reload

Stopping snmptrapd: [ OK ]

Starting snmptrapd: [ OK ]

Note:

We can check the snmp service functionality using the snmpwalk utility.

# snmpwalk -v2c -c STRING 10.30.32.207 system

SNMPv2-MIB::sysDescr.0 = STRING: Linux node1.erc.com 2.6.32-131.0.15.el6.x86_64 #1 SMP Tue May 10 15:42:40 EDT 2011 x86_64

SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (48233) 0:08:02.33

SNMPv2-MIB::sysContact.0 = STRING: Root <root@localhost> (configure /etc/snmp/snmp.local.conf)

SNMPv2-MIB::sysName.0 = STRING: node1.erc.com

SAMBA Server configuration with LDAP backend in RHEL 6

2013-06-28T06:44:00.003-07:00

How to configure samba server with LDAP backed in RHEL6

Now a day’s every organizations is desirable to have a single user identity to access all the resources. For example, to access Samba shares users have to authenticate and it will be helpful if their Samba password is the same as their LDAP login password. By default Samba is using tdbsam backend is recommended for larger number of users. Larger organizations should require Active Directory or LDAP integration due to scalability and possible network infrastructure concerns.

Here we are configuring samba server with LDAP Backend. Samba user password is stored in the LDAP data base. In this scenario Both LDAP and Samba server is configured in the same host. We are also enabled the ldap password sync option, When the user changes his password, it will update the samba account information also (When the user changes his password, update SambaNTPassword, SambaLMPassword, and the password fields.)

Configuration

1 ) Installing packages

Install packages required for LDAP and Samba server configuration using yum.

# yum install openldap openldap-clients openldap-servers openldap nss-pam-ldapd

# yum install samba-common samba samba-client

2) Configure basic LDAP server

RHEL 6 ( Openldap-2.4 ) does not read configuration from /etc/openldap/slapd.conf file as in RHEL 5 ( Openldap-2.3). Instead, it uses configuration database from /etc/openldap/slapd.d/ directory. We can configure server in two ways. Either by editing directives inside /etc/openldap/slapd.d/ database or we can convert existing slapd.conf file to new format. In this scenario we are using second step.

In this configuration, Our domain is dc=tac,dc=com. For configuring LDAP server we can follow below steps

1) Make sure that slapd service is stopped.

# service slapd stop

2) Create a sample slapd.conf file, By default one sample file will be created as slapd.conf.bak after installing openldap-server package.

# cp /etc/openldap/slapd.conf.bak /etc/openldap/slapd.example.conf

3) Generate the encrypted password for the LDAP root user using slappasswd

# slappasswd

New password:

Re-enter new password:

{SSHA}3ekEm83pdQbYgja5thdSF7VzcWdqIenT

4) Edit sample configuration file as with necessary configuration as below. Since we are using sample configuration file, some existing lines to be edited and some new lines are to be added for configuring server for storing Samba information. Below is the sample configuration file. (Commented lines are not included)

# vi /etc/openldap/slapd.example.conf

include /etc/openldap/schema/corba.schema

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/duaconf.schema

include /etc/openldap/schema/dyngroup.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/java.schema

include /etc/openldap/schema/misc.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/openldap.schema

include /etc/openldap/schema/ppolicy.schema

include /etc/openldap/schema/collective.schema

include /etc/openldap/schema/samba.schema

allow bind_v2

pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args

access to attrs=userPassword

by self write

by anonymous auth

by * none

access to attrs=sambaNTPassword

by self write

by anonymous auth

by * none

access to *

by self write

by * read

database bdb

suffix "dc=tac,dc=com"

checkpoint 1024 15

rootdn "cn=Manager,dc=tac,dc=com"

rootpw {SSHA}3ekEm83pdQbYgja5thdSF7VzcWdqIenT

directory /var/lib/ldap

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub,approx

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub

database monitor

access to *

by dn.exact="cn=Manager,dc=my-domain,dc=com" read

by * none

5) Next step is removing all previous content of LDAP database and reinitialize it. For clearing configuration we can use below command.

# rm -rf /etc/openldap/slapd.d/*

6) For Clearing database , we can use below command .

#rm -rf /var/lib/ldap/*

7 ) Initialize the new database using below command.

#cp /usr/share/doc/openldap-servers-*/DB_CONFIG.examle /var/lib/ldap/DB_CONFIG

# echo "" | slapadd -f /etc/openldap/slapd.example.conf

8 ) Create the new configuration by converting configuration file.

# slaptest -f /etc/openldap/slapd.example.conf -F /etc/openldap/slapd.d/

config file testing succeeded

9) Initialize LDAP DIT with below contents using LDIF file. We are adding our domain and group information.

First step is creating LDIF file and next step to add LDIF to LDAP database.

#vi /tac.ldif

dn: dc=tac,dc=com

dc: tac

description: tac domain

o: tac

objectclass: dcObject

objectclass: organization

dn: cn=Manager,dc=tac,dc=com

cn: Manager

objectclass: organizationalRole

dn: ou=groups,dc=tac,dc=com

objectclass: organizationalUnit

objectclass: top

ou: groups

dn: ou=users,dc=tac,dc=com

objectclass: organizationalUnit

objectclass: top

ou: users

10) Add information to LDAP database using slapadd.

# slapadd -l /tac.ldif

#################### 100.00% eta none elapsed none fast!

Closing DB...

11) Set permission for LDAP database.

# chown -R ldap:ldap /var/lib/ldap

# chown -R ldap:ldap /etc/openldap/slapd.d

3) Configure Samba Server

1) We have configured a LDAP server which can store information. For configuring Samba, we need to Edit samba configuration file with below contents. The default file is automatically created after installing samba-common package. We can edit content using vi.

# vi /etc/samba/smb.conf

[global]

workgroup = tac

netbios name = samba-ldapsam

log file = /var/log/samba/log.%m

server string = Samba Server Version %v

max log size = 50

security = user

passdb backend = ldapsam:ldap://10.30.32.207/

ldap suffix = dc=tac,dc=com

ldap user suffix = ou=users

ldap group suffix = ou=groups

ldap admin dn = cn=Manager,dc=tac,dc=com

ldap ssl = no

ldap passwd sync = yes

ldap delete dn = no

[sambashare]

writeable = yes

browseable = yes

path = /sambashare

Note: In this scenario our share is /sambashare. It is already exists and permissions are also configured.

2) For enabling Samba to access the LDAP server, we need to store the LDAP admin password in the Samba secrets.tdb database. This can be done by below command.

# smbpasswd -w hcl123

Setting stored password for "cn=Manager,dc=tac,dc=com" in secrets.tdb

4) Add User and confirm the functionality.

We already configured our Samba server as LDAP password backend. For checking the functionality we will add one new user and to LDAP and enable samba account for this user.

1 ) Create a LDIF file for adding user information, as below.

# vi /tac.user.ldif

dn: cn=user1,ou=groups,dc=tac,dc=com

objectClass: posixGroup

objectClass: top

cn: user1

userPassword: {crypt}x

gidNumber: 1000

memberUid: user1

dn: uid=user1,ou=users,dc=tac,dc=com

uid: user1

cn: user1

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

shadowLastChange: 12102

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 1000

gidNumber: 1000

homeDirectory: /home/user1

userPassword: {crypt}$1$gZddl80v$YJFih6/ftT5IcnCcdVmH41

2) Stop the LDAP Server and add user information to LDAP Serer using slapadd command.

# service slapd stop

Stopping slapd: [ OK ]

# slapadd -l /tac.user.ldif

#################### 100.00% eta none elapsed none fast!

Closing DB...

3) Set permission for LDAP database.

# chown -R ldap:ldap /var/lib/ldap

# chown -R ldap:ldap /etc/openldap/slapd.d

4) After adding information, Server to be configured as to use LDAP Server for user information. This can be done by authconfig-tui command. Provide Server address and Domain information.

# authconfig-tui

Configuration will be saved in /etc/openldap/ldap.conf.

# cat /etc/openldap/ldap.conf

# LDAP Defaults

URI ldap://10.30.32.207/

BASE dc=tac,dc=com

TLS_CACERTDIR /etc/openldap/cacerts

5) Confirm that user information is available from LDAP server.

# id user1

uid=1000(user1) gid=1000(user1) groups=1000(user1)

6) Enable samba account for the user, using sambpasswd command . User information will be saved in the lap database.

# smbpasswd -a user1

New SMB password:

Retype new SMB password:

7) We can check the in the ldapdatabase for confirming the status. objectclass sambaSamAccount will be added for the user.

# slapcat | more

dn: uid=user1,ou=users,dc=tac,dc=com

uid: user1

cn: user1

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: sambaSamAccount

shadowLastChange: 12102

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 1000

gidNumber: 1000

homeDirectory: /home/user1

structuralObjectClass: account

entryUUID: 34d50750-f96e-1031-9486-b1be24691512

creatorsName: cn=Manager,dc=tac,dc=com

createTimestamp: 20130123060226Z

sambaSID: S-1-5-21-2466905231-2075122609-3831295105-1001

displayName: user1

sambaNTPassword: 687199F5BABEA39C7263895289830138

sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000

00000000

sambaAcctFlags: [U ]

sambaPwdLastSet: 1358921621

userPassword:: e1NTSEF9SXlIOHpXTWJkN3VhQXZBNjBoaTAvZ2twdlRxM051UU4=

entryCSN: 20130123061341.374328Z#000000#000#000000

modifiersName: cn=Manager,dc=tac,dc=com

modifyTimestamp: 20130123061341Z

5 ) Test the Samba server

For testing the server, access the share using smbclient utility and confirm that share is accessible and files are listing.

[root@stageserver sambashare1]# smbclient -U user1 //10.30.32.207/sambashare

Enter user1's password:

Domain=[TAC] OS=[Unix] Server=[Samba 3.5.4-68.el6]

smb: \> ls

. D 0 Wed Jan 23 13:36:24 2013

.. DR 0 Wed Jan 23 12:45:58 2013

2 0 Wed Jan 23 13:36:24 2013

3 0 Wed Jan 23 13:36:24 2013

1 0 Wed Jan 23 13:36:24 2013

5456 0 Wed Jan 23 13:36:24 2013

New folder D 0 Wed Jan 23 12:46:41 2013

59049 blocks of size 524288. 28374 blocks available

smb: \>

How to rebuild initrd or initramfs in Redhat Linux

2013-06-08T04:46:00.002-07:00

The initial RAM disk (initrd) is an initial root file system that is mounted prior to when the real root file system is available. It is necessary to rebuild the Initrd images in following scenarios to include the proper kernel modules, files, and configuration directives

If adding new hardware to a system that may be used very early in the boot process.
If changing configuration files that may be used very early in the boot process
If changing the options on a kernel module.

The initial RAM disk (initrd) is an initial root file system that is mounted prior to when the real root file system is available. The initrd is bound to the kernel and loaded as part of the kernel boot procedure. The kernel then mounts this initrd as part of the two-stage boot process to load the modules to make the real file systems available and get at the real root file system.

initrd provides the capability to load a RAM disk by the boot loader. This RAM disk can then be mounted as the root filesystem and programs can be run from it. Afterwards, a new root file system can be mounted from a different device. The previous root (from initrd) is then moved to a directory and can be subsequently unmounted.

Rebuilding the initrd (RHEL 3, 4, 5)

mkinitrd utility can be used to recreate the initrd image . mkinitrd creates an initial image used by the kernel for preloading the block device modules (such as IDE, SCSI or RAID) which are needed to access the root filesystem. mkinitrd automatically loads filesystem modules (such as ext3 and jbd), IDE modules, all scsi_hostadapter entries in /etc/modprobe.conf, and raid modules if the systems root partition is on raid, which makes it simple to build and use kernels using modular device drivers.

Steps:

1. It is recommended you make a backup copy of the initrd in case the new version has an unexpected problem:

# cp /boot/initrd-$(uname -r).img /boot/initrd-$(uname -r).img.bak

2. Rebuild the Initrd image using mkinitrd command

# mkinitrd -f -v /boot/initrd-$(uname -r).img $(uname -r)

Creating initramfs

[root@tacnet boot]#

Note

The -v verbose flag causes mkinitrd to display the names of all the modules it is including in the initial ramdisk. The -f option will force an overwrite of any existing initial ramdisk image at the path you have specified. If you are in a kernel version different to the initrd you are building (including if you are in Rescue Mode) you must specify the full kernel version, without architecture

# mkinitrd -f -v /boot/initrd-2.6.18-164.el5.img 2.6.18-164.el5

Rebuilding the initramfs (RHEL 6)

dracut utility can be used in RHEL 6 to rebuild the initrams image ,It creates an initial image used by the kernel for preloading the block device modules (such as IDE, SCSI or RAID) which are needed to access the root filesystem.

It is recommended you make a backup copy of the initrd in case the new version has an unexpected problem:

# cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.bak

Now rebuild the initramfs for the current kernel version:

# dracut -f

Note:

If you are in a kernel version different to the initrd we are building (including if you are in Rescue Mode) We must specify the full kernel version, including architecture:

# dracut -f initramfs-2.6.32-71.el6.x86_64.img 2.6.32-71.el6.x86_64

Boot from Backup Initrd in case of error

If any error occurred with the new inird/initramfs image, we can boot from the backup initrd image by using below steps.

We can create a separate entry in separate entry in /boot/grub/grub.conf for the backup initial ramdisk image, to conveniently choose the old version at boot time without needing to restore the backup. This example configuration allows selection of either the new or old initial ramdisk image from the grub menu:

title Red Hat Enterprise Linux 5 (2.6.18-274.el5)

root (hd0,0)

kernel /vmlinuz-2.6.18-274.el5 ro root=LABEL=/

initrd /initrd-2.6.18-274.el5.img

title Red Hat Enterprise Linux 5 w/ old initrd (2.6.18-274.el5)

root (hd0,0)

kernel /vmlinuz-2.6.18-274.el5 ro root=LABEL=/

initrd /initrd-2.6.18-274.el5.img.bak

If first step is not done , we can enter edit-mode in grub and choose the old initrd by below steps .

a. If grub is secured with a password, press p and enter the password

b. Use the arrow keys to highlight the entry for the kernel you wish to boot

c. Press e for edit

d. Highlight the initrd line and press e again

e. Change the path for the initrd to the backup copy you made (such as /initrd-2.6.18-274.el5.img.bak)

f. Press Enter to temporarily save the changes you have made

g. Press b for boot

Note: This procedure did not actually make any persistent change. The next boot will continue to use the original grub.conf configuration unless it is updated.

How initrd works

initrd provides the capability to load a RAM disk by the bootloader. This RAM disk can then be mounted as the root fileystem and programs can be run from it. Afterwards, a new root file system can be mounted from a different device. Theprevious root (from initrd) is then moved to a directory andcan be subsequently unmounted. initrd is mainly designed to allow system startup to occur in two phases, where the kernel comes up with a minimum set of compiled-in drivers, and where additional modules are loaded from initrd.

When using initrd, the system typically boots as follows:

1. The boot loader loads the kernel and the initial RAM disk

2. The kernel converts initrd into a "normal" RAM disk and frees the memory used by initrd

3. initrd is mounted read-write as root

4. /linuxrc is executed (this can be any valid executable, including shell scripts; it is run with uid 0 and can do

basically everything init can do)

5. linuxrc mounts the "real" root file system

6. linuxrc places the root file system at the root directory using the pivot_root system call

7. The usual boot sequence (e.g. invocation of /sbin/init) is performed on the root file system

8) The initrd file system is removed

What is initrd image in Linux

2013-06-08T04:44:00.000-07:00

How initrd works

When using initrd, the system typically boots as follows:

1. The boot loader loads the kernel and the initial RAM disk

2. The kernel converts initrd into a "normal" RAM disk and frees the memory used by initrd

3. initrd is mounted read-write as root

4. /linuxrc is executed (this can be any valid executable, including shell scripts; it is run with uid 0 and can do

basically everything init can do)

5. linuxrc mounts the "real" root file system

6. linuxrc places the root file system at the root directory using the pivot_root system call

7. The usual boot sequence (e.g. invocation of /sbin/init) is performed on the root file system

8) The initrd file system is removed

Note

That changing the root directory does not involve unmounting it. It is therefore possible to leave processes running on initrd during that procedure. Also note that file systems mounted under initrd continue to be accessible.

What is cache memory in RHEL & Why is so much of my memory used by cache

2013-03-27T11:29:00.002-07:00

What is cache memory in RHEL & Why is so much of my memory used by cache

Red Hat Enterprise Linux 4

Red Hat Enterprise Linux 5

Red Hat Enterprise Linux 6

The performance improvement of processors has always outperformed that of the other components in a computer system such as processor cache, bus, RAM, disk, and so on. Slower access to memory and disk restricts overall system performance, so system performance is not enhanced by processor speed improvement. The cache mechanism resolves this problem by caching frequently used data in faster memory. It reduces the chances of having to access slower memory. Current computer systems use this technique in almost all I/O components such as hard disk drive cache, disk controller cache, file system cache, cache handled by each application, and so on.

To understand why cache memory can become so high, and why this is not an issue, we must understand how IO works on Linux. When a user process reads or writes a file, it is actually modifying a copy of that file in main memory. The kernel creates that copy from the disk and writes back changes to it when necessary. The memory taken up by these copies is called cached memory.

Cached memory will be consumed whenever a user process initiates a read or write. The kernel will look for a copy of the part of the file the user is acting on, and, if no such copy exists, it will allocate one new page of cache memory and fill it with the appropriate contents read out from the disk. If the user only reads the file, this page will be marked as a " clean " cache page. However, as soon as the user writes the file, the page will be marked “ dirty". A kernel thread which appears in ps called pdflush will wake up periodically and copy all of the pages marked dirty back to the disk, then mark them as clean again. Note that the page is only re-marked as clean, the page is not freed when it is written back, but is kept around in case something wants to do further IO on the part of the file it caches.

Cache pages are only freed again when the kernel needs memory for something else. Since having the cache page already read from disk can speed up IO, and since getting rid of a clean cache page is just as easy as allocating a free page, and since a free page is doing nothing to help the system perform and function, there is no reason to turn a cache page into a free page. If memory fills up with cache pages, the next time the kernel needs memory it will simply evict the least recently used clean cache pages and repurpose them.

Default disk group in Veritas volume manager 6 ,RHEL

2013-03-20T08:38:00.004-07:00

How to set a default disk group in Veritas volume manager 6

Setup

Veritas volume manager 6

Red Hat Enterprise Linux Server release 6.1 64 bit

Solution

To eliminate the need to use the "-g" option with commands, we can create default disk group in veritas .

Note : Following error will come if we use commands without specifying disk group using –g

[root@node1 ~]# vxassist make testvol 10m

VxVM vxassist ERROR V-5-1-15324 Specify a disk group with -g <diskgroup> or configure a default disk group. Refer to the vxdctl(1m) man page for more details on configuring a default disk group

Steps:

1) To check the default disk group , we can use following command

[root@node1 ~]# vxdg defaultdg

nodg

nodg indicates that no default disk group has been defined. To define default disk groups follow below steps.

2) To list the existing dgs , we can us following commands , in this example 2 disk groups are available.

[root@node1 ~]# vxdg list

NAME STATE ID

redhat enabled,cds 1334291153.23.node1.redhat.com

appdg enabled,cds 1334329790.34.node1.redhat.com

3) we are going to use disk group ‘redhat’ as defaultdg . To define a default disk group enter the following commands

[root@node1 ~]# vxdctl defaultdg redhat

4) To list default diskgroup use following commands. Disk group ‘redhat’ sould show as default.

[root@node1 ~]# vxdg defaultdg

redhat

5) These settings can be verified using vxdctl list command

[root@node1 ~]# vxdctl list

Volboot file

version: 3/1

seqno: 0.4

cluster protocol version: 110

hostid: node1.redhat.com

defaultdg: redhat

hostguid: {f699bef2-79d9-11e1-b4a1-dd6a867775df}

[root@node1 ~]#

6 ) Now we can create volume in defaultdg without using –g switch , following is the example

[root@node1 ~]# vxassist make testvol 10m

7 ) To list created volume , we can use following command

[root@node1 ~]# vxlist volume

TY VOLUME DISKGROUP SIZE STATUS LAYOUT LINKAGE

vol testvol redhat 10.00m healthy concat -

Verits Volume Manager in RHEL6 - Adding disk and Managing volume

2013-03-16T10:42:00.002-07:00

Provisioning storage in VERITAS Volume Manager 6 on RHEL 6

Introduction to volume manager :

Volume manager is software which is used to following purpose:-

Increase the storage capacity online
Increase the data availability online
Increase the performance online

Advantages of Veritas Volume Manager

Its Supports hydrogenous environment
Its supports peta bytes
4000 sub disks per 1 vmdisk
Man page size of the volume can be up to 255tb
Online file system management
Fast file system recovery
Fast file system Reboot

OS And Release

VERITAS Volume Manager 6

Red Hat Enterprise Linux Server release 6.1 64 bit

Solution

VxVM is already installed on the machine and below procedure will describe adding disk to VERITAS volume manager and provisioning storage for usage. In this scenario attached disks are local SCSI disks.

Procedure:

1) List the available disk using vxdisk command.

[root@node1 /]# vxdisk list

DEVICE TYPE DISK GROUP STATUS

sda auto:none - - online invalid

sdb auto:LVM - - LVM

sdc auto:none - - online invalid

sdd auto:none - - online invalid

sde auto:none - - online invalid

sdf auto:none - - online invalid

sdg auto:none - - online invalid

[root@node1 /]#

Note:

online invalid in the STATUS line indicates that a disk has yet to be added or initialized for VxVM control.

2) Initialize the disks using vxdisksetup command.

[root@node1 /]# vxdisksetup -i sdc

[root@node1 /]# vxdisksetup -i sdd

3) Verify that disks are got initialized using vxdisk command.

[root@node1 /]# vxdisk list

DEVICE TYPE DISK GROUP STATUS

sda auto:none - - online invalid

sdb auto:LVM - - LVM

sdc auto:cdsdisk - - online

sdd auto:cdsdisk - - online

sde auto:none - - online invalid

sdf auto:none - - online invalid

[root@node1 /]#

Note:

Disks that are listed as online are initialized and the part of VxVM.

4) Add the desired disk to disk group using vxdg command. In this scenario we are creating disk group named ITOCDG and adding disk sdc to diskgroup.

[root@node1 /]# vxdg init ITOCDG disk1=sdc

[root@node1 /]# vxdisk list

DEVICE TYPE DISK GROUP STATUS

sda auto:none - - online invalid

sdb auto:LVM - - LVM

sdc auto:cdsdisk disk1 ITOCDG online

sdd auto:cdsdisk - - online

sde auto:none - - online invalid

sdf auto:none - - online invalid

[root@node1 /]#

Note :

we can use vxdg with adddisk switch to add new disks to disk group.

[root@node1 /]# vxdg -g ITOCDG adddisk disk2=sdd

[root@node1 /]# vxdisk list

DEVICE TYPE DISK GROUP STATUS

sda auto:none - - online invalid

sdb auto:LVM - - LVM

sdc auto:cdsdisk disk1 ITOCDG online

sdd auto:cdsdisk disk2 ITOCDG online

sde auto:none - - online invalid

sdf auto:none - - online invalid

[root@node1 /]#

5) To list disk group properties we can use following command.

[root@node1 /]# vxdg list ITOCDG

Group: ITOCDG

dgid: 1334435551.48.node1.redhat.com

import-id: 1024.47

flags: cds

version: 170

alignment: 8192 (bytes)

ssb: on

autotagging: on

detach-policy: global

dg-fail-policy: obsolete

copies: nconfig=default nlog=default

config: seqno=0.1030 permlen=51360 free=51356 templen=2 loglen=4096

config disk sdc copy 1 len=51360 state=clean online

config disk sdd copy 1 len=51360 state=clean online

log disk sdc copy 1 len=4096

log disk sdd copy 1 len=4096

[root@node1 /]#

6) Create volume on the disk group with desired size. In this example we are creating volume VOL1 with size 100MB

[root@node1 /]# vxassist -g ITOCDG make VOL1 100m

7) To list volume details we can use vxlist volume command

[root@node1 /]# vxlist volume

TY VOLUME DISKGROUP SIZE STATUS LAYOUT LINKAGE

vol VOL1 ITOCDG 100.00m healthy concat -

8) Create file system on the volume using mkfs command, in this example we are creating VXFS file system

[root@node1 /]# mkfs -t vxfs /dev/vx/rdsk/ITOCDG/VOL1

version 9 layout

204800 sectors, 102400 blocks of size 1024, log size 1024 blocks

rcq size 1024 blocks

largefiles supported

Note :

/dev/vx/rdsk/ITOCDG/VOL1 is the device file for volume VOL1. For verifying file system we can use fstyp command.

[root@node1 /]# fstyp /dev/vx/dsk/ITOCDG/VOL1

9) Create a mount point and mount the file system using mount command.

[root@node1 /]# mkdir /veritas1

[root@node1 /]# mount -t vxfs /dev/vx/dsk/ITOCDG/VOL1 /veritas1/

10) Verify the mounted file system using mount command or df command

[root@node1 /]# mount

/dev/mapper/vg_node1-lv_root on / type ext4 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

none on /dev/odm type vxodmfs (rw,smartsync)

/dev/sr0 on /repo type iso9660 (ro)

/dev/sr1 on /media/201204090917 type iso9660 (ro,nosuid,nodev,uhelper=udisks,uid=0,gid=0,iocharset=utf8 ,mode=0400,dmode=0500)

/dev/vx/dsk/ITOCDG/VOL1 on /veritas1 type vxfs (rw, delaylog, largefiles,ioerror=mwdisable)

Note:

df displays the amount of disk space available on the file system .

[root@node1 /]# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/vg_node1-lv_root

8.5G 4.5G 3.6G 57% /

tmpfs 499M 208K 499M 1% /dev/shm

/dev/sda1 485M 32M 429M 7% /boot

/dev/sr0 3.4G 3.4G 0 100% /repo

/dev/sr1 927M 927M 0 100% /media/201204090917

/dev/vx/dsk/ITOCDG/VOL1

100M 3.2M 91M 4% /veritas1

[root@node1 /]#

Linux Boot Process

2012-11-25T01:34:00.002-08:00

Booting
Booting is the process of loading operating System from secondary storage to primary memory.

Below are the basic stages of the boot process:

When a system is first booted, or is reset, the processor executes code at a well-known location. In a personal computer (PC), this location is in the basic input/output system (BIOS), which is stored in flash memory on the motherboard. The central processing unit (CPU) in an embedded system invokes the reset vector to start a program at a known address in flash/ROM. In either case, the result is the same. Because PCs offer so much flexibility, the BIOS must determine which devices are candidates for boot. We'll look at this in more detail later.
When a boot device is found, the first-stage boot loader is loaded into RAM and executed. This boot loader is less than 512 bytes in length (a single sector), and its job is to load the second-stage boot loader.
When the second-stage boot loader is in RAM and executing, a splash screen is commonly displayed, and Linux and an optional initial RAM disk (temporary root file system) are loaded into memory. When the images are loaded, the second-stage boot loader passes control to the kernel image and the kernel is decompressed and initialized. At this stage, the second-stage boot loader checks the system hardware, enumerates the attached hardware devices, mounts the root device, and then loads the necessary kernel modules. When complete, the first user-space program (init) starts, and high-level system initialization is performed.

The system loads and runs a boot loader. The specifics of this process depend on the system architecture. For example:

BIOS-based x86 systems run a first-stage boot loader from the MBR of the primary hard disk that, in turn, loads an additional boot loader, GRUB.
UEFI-based x86 systems mount an EFI System Partition that contains a version of the GRUB boot loader. The EFI boot manager loads and runs GRUB as an EFI application.

The boot loader loads the kernel into memory, which in turn loads any necessary modules and mounts the root partition read-only.
The kernel transfers control of the boot process to the /sbin/init program.
The /sbin/init program loads all services and user-space tools, and mounts all partitions listed in /etc/fstab.
The user is presented with a login screen for the freshly booted Linux system.

1. BIOS

BIOS stands for Basic Input/Output System
Performs some system integrity checks
Searches, loads, and executes the boot loader program.
It looks for boot loader in floppy, cd-rom, or hard drive. You can press a key (typically F12 of F2, but it depends on your system) during the BIOS startup to change the boot sequence.
Once the boot loader program is detected and loaded into the memory, BIOS gives the control to it.
So, in simple terms BIOS loads and executes the MBR boot loader.

2. MBR

MBR stands for Master Boot Record.
It is located in the 1st sector of the bootable disk. Typically /dev/hda, or /dev/sda
MBR is less than 512 bytes in size. This has three components 1) primary boot loader info in 1st 446 bytes 2) partition table info in next 64 bytes 3) mbr validation check in last 2 bytes.
It contains information about GRUB (or LILO in old systems).
So, in simple terms MBR loads and executes the GRUB boot loader.

3. GRUB

GRUB stands for Grand Unified Bootloader.
If you have multiple kernel images installed on your system, you can choose which one to be executed.
GRUB displays a splash screen, waits for few seconds, if you don’t enter anything, it loads the default kernel image as specified in the grub configuration file.
GRUB has the knowledge of the filesystem (the older Linux loader LILO didn’t understand filesystem).
Grub configuration file is /boot/grub/grub.conf (/etc/grub.conf is a link to this). The following is sample grub.conf of CentOS.

#boot=/dev/sda

default=0

timeout=5

splashimage=(hd0,0)/boot/grub/splash.xpm.gz

hiddenmenu

title CentOS (2.6.18-194.el5PAE)

root (hd0,0)

kernel /boot/vmlinuz-2.6.18-194.el5PAE ro root=LABEL=/

initrd /boot/initrd-2.6.18-194.el5PAE.img

As you notice from the above info, it contains kernel and initrd image.
So, in simple terms GRUB just loads and executes Kernel and initrd images.

4. Kernel

Mounts the root file system as specified in the “root=” in grub.conf
Kernel executes the /sbin/init program
Since init was the 1st program to be executed by Linux Kernel, it has the process id (PID) of 1. Do a ‘ps -ef | grep init’ and check the pid.
initrd stands for Initial RAM Disk.
initrd is used by kernel as temporary root file system until kernel is booted and the real root file system is mounted. It also contains necessary drivers compiled inside, which helps it to access the hard drive partitions, and other hardware.

5. Init

Looks at the /etc/inittab file to decide the Linux run level.
Following are the available run levels

0 – halt
1 – Single user mode
2 – Multiuser, without NFS
3 – Full multiuser mode
4 – unused
5 – X11
6 – reboot

Init identifies the default initlevel from /etc/inittab and uses that to load all appropriate program.
Execute ‘grep initdefault /etc/inittab’ on your system to identify the default run level
If you want to get into trouble, you can set the default run level to 0 or 6. Since you know what 0 and 6 means, probably you might not do that.
Typically you would set the default run level to either 3 or 5.

6. Runlevel programs

When the Linux system is booting up, you might see various services getting started. For example, it might say “starting sendmail …. OK”. Those are the runlevel programs, executed from the run level directory as defined by your run level.
Depending on your default init level setting, the system will execute the programs from one of the following directories.

Run level 0 – /etc/rc.d/rc0.d/
Run level 1 – /etc/rc.d/rc1.d/
Run level 2 – /etc/rc.d/rc2.d/
Run level 3 – /etc/rc.d/rc3.d/
Run level 4 – /etc/rc.d/rc4.d/
Run level 5 – /etc/rc.d/rc5.d/
Run level 6 – /etc/rc.d/rc6.d/

Please note that there are also symbolic links available for these directory under /etc directly. So, /etc/rc0.d is linked to /etc/rc.d/rc0.d.
Under the /etc/rc.d/rc*.d/ directories, you would see programs that start with S and K.
Programs starts with S are used during startup. S for startup.
Programs starts with K are used during shutdown. K for kill.
There are numbers right next to S and K in the program names. Those are the sequence number in which the programs should be started or killed.
For example, S12syslog is to start the syslog deamon, which has the sequence number of 12. S80sendmail is to start the sendmail daemon, which has the sequence number of 80. So, syslog program will be started before sendmail.

vmlinuz Overview

2012-11-08T08:11:00.000-08:00

vmlinuz history

vmlinuz is a
compressed Linux kernel, and it is bootable. Bootable means that it is capable
of loading the operating system into memory so that the computer becomes usable
and application programs can be run. A kernel is a program that constitutes the
central core of a computer operating system.
It is the first thing that is loaded into memory (which physically
consists of RAM chips) when a computer
is booted up (i.e., started), and it remains in memory for the entire time that
the computer is in operation.

The kernel
binary on the original UNIX as developed at Bell Labs was called unix. When a
new kernel containing support for virtual memory was
subsequently written at the University of California at Berkeley (UCB), the
kernel binary was renamed vmunix. 

Virtual
memory is the use of space on a hard disk drive (HDD) to simulate additional
RAM (random access memory) capacity. It was supported by the Linux kernel
almost from Linux's inception, in contrast to some other popular operating
systems in use at the time, such as MS-DOS.

Thus, it was
a natural progression for the Linux kernel to be called vmlinux. And because
the Linux kernel executable was made into a compressed file and compressed
files typically have a z or gz extension on Unix-like systems, the name of the
compressed kernel executable became vmlinuz. 

Setup a logon banner for ssh clients to see when they login

2012-03-13T05:04:00.001-07:00

Problem

Need to setup a logon banner for ssh clients to see when they login

Solution

Introduction

SSH (Secure Shell) is a protocol for creating a secure connection between two computers. The secure SSH connection provides authentication and encryption. In the SSH server, it is possible to configure logon or welcome banner with the use of the Banner directive in /etc/ssh/sshd_config file.The Banner directive is only available for ssh protocol version 2 and by default there are no banner configured.

Configutration

1. Create a banner file. (e.g. /etc/banner) using vi editor.

# vi /etc/banner

**********************************

******** WELCOME TO REDHAT *******

**********************************

Configure the ssh configuration file /etc/ssh/sshd_config file and add the line Banner /etc/banner to it.

# vi /etc/ssh/sshd_config

Banner /etc/banner

Restart sshd daemon for the changes to take effect

# service sshd restart

Example

If we are accessing server using ssh , message will appear as follows:

[root@mail ~]# ssh 10.30.32.206

**********************************

*********WELCOME TO REDHAT********

**********************************

root@10.30.32.206's password:

Raid configuration in RHEL 6

2012-02-02T02:19:00.000-08:00

Software Raid configuration in RHEL 6

Software RAID is RAID that is implemented at the software layer without the need for a dedicated hardware RAID controller on the system. Software RAID can be created on any storage block device independent of storage controllers. The Linux kernel contains a multi-disk (MD) driver that allows the RAID solution to be completely hardware independent. Performance of a software-based array depends on the server CPU performance and load. 'mdadm' utility is used in RHEL 6 for managing software raid, which will support RAID levels 0, 1, 4, 5, 6, and 10

Steps for creating raid

In this document we are creating software raid with raid level 1

Step 1

Create primary partitions on each member disks of the array raid array using 'fdisk' utility. Partition type can be set as fd ( linux raid )

Repeat the steps for all other members of the array /dev/sdc and /dev/sdd

Step 2

We can create raid array on the partitions using 'mdadm' utility .

If we want to change Raid level we can use –-level switch with following options

raid0 / 0 / stripe

raid1 / 1 / mirror

raid4 / 4

raid5 / 5

raid6 / 6

raid10 / 10

The ---raid-devices switch lets mdadm know how many devices will make up the RAID array. In our

example, we are using 2 devices so we specified the number 2 followed by the list of devices. However, if we

are using more devices, make sure to reflect the correct number and device list in syntax.

Step 3

To check the status of array we can use cat /proc/mdstat.

mdadm -–detail will give the array configuration details

Step 4

After creating the raid, we should make file system on top of raid. 'mkfs' command can be use to build file

system. mount the file system on the desired directory using mount command .

Mount the file system using mount command

Step 5

Add the new array to the /etc/mdadm.conf so that it will be automatically activated upon reboot. The startup

scripts will reference the mdadm.conf file upon boot and start any arrays listed within this file. If the array

is not listed in the /etc/mdadm.conf file, you will have to start the array manually.

Step 6

Update the /etc/fstab file to auto mount the RAID device upon subsequent system reboots, with following

entries.

Step 7

Reboot the machine and confirm that file system get mounted or not. We can use 'mount' command to list out mounted file system

iSCSI server configuration in RHEL6

2012-02-01T01:59:00.000-08:00

Configuring iSCSI target on RHEL 6

Introduction:

iSCSI is Internet SCSI (Small Computer System Interface), an Internet Protocol (IP)-based storage networking standard for linking data storage facilities by carrying SCSI commands over IP networks. iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. iSCSI makes block devices available via the network. We can mount block devices (disks) across an IP network to local system and then use them like any other block device. iSCSI is a client-server protocol. The server-side is referred to as the 'target,' while the client-side is referred to as the 'initiator.' Both the target and initiator are uniquely identified by a string called the iSCSI Qualified Name (iQN). Initiators come in two varieties: software and hardware. A software initiator is just a driver that handles all requests and pairs the network interfaces driver and the SCSI drivers together to make it work. Using a software initiator any system with an Ethernet card can act as an iSCSI initiator. A hardware initiator is an iSCSI HBA, which is basically just an ethernet card with a SCSI ASIC onboard. Here we are configuring software initiator in RHEL 6.

OS installation:

Install RHEL 6 on the server with basic server installation and configure yum server on the machine.

Network setup:

Configure network with ipaddress and make sure that clients are reachable to the server. By default iSCSI will listen to the port 3260, we have to add necessary rules in iptables to allow iSCSI. Ignore this step if firewall is disabled.

# iptables -I INPUT -p tcp -m tcp --dport 3260 -j ACCEPT

# service iptables save

# service iptables restart

Install and enable the iSCSI target service:

Install and enable the iSCSI target service with the following commands

# yum install scsi-target-utils

# chkconfig tgtd on

# service tgtd start

Allocate storage for the LUNs:

The iSCSI target service is not dependent on a particular type of exported LUN. The LUNs can be plain files, LVM volumes, or block devices. There is however a performance overhead if using the LVM and/or file system layers as compared to block devices. This example demonstrates the creation of a local partition /dec/sdc1 as iSCSI storage LUN

# fdisk -l /dev/sdc

Disk /dev/sdc: 3221 MB, 3221225472 bytes

255 heads, 63 sectors/track, 391 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0xc9a1606e

Device Boot Start End Blocks Id System

/dev/sdc1 1 391 3140676 83 Linux

Create the targets:

Targets can be created by adding an XML entry to the /etc/tgt/targets.conf file, using text editor. Following entries to be added.

#vi /etc/tgt/targets.conf

default-driver iscsi

backing-store /dev/sdc1

write-cache off

</target>

Note:

The target attribute requires an iSCSI Qualified Name (IQN),following is the general format:

iqn.yyyy-mm.reversed.domain.name:OptionalIdentifierText

yyyy-mm represents the 4-digit year and 2-digit month the device was started (for example: 2011-07)

reversed.domain.name is the hosts domain name in reverse. For example, server1.example.com, in an IQN, becomes com.example.server1;

OptionalIdentifierText is any text string, without spaces, that helps the administrator identifies which device.

Restart tgtd service:

Need to restart tgtd service after configuring iscsi target

# service tgtd restart

Stopping SCSI target daemon: [ OK ]

Starting SCSI target daemon: [ OK ]

Checking configuration:

To confirm the successful operation , query the iSCSI target setup using following command

# tgt-admin --show

Target 1: iqn.2008-09.com.example:server.target1

System information:

Driver: iscsi

State: ready

I_T nexus information:

LUN information:

LUN: 0

Type: controller

SCSI ID: IET 00010000

SCSI SN: beaf10

Size: 0 MB

Online: Yes

Removable media: No

Backing store type: rdwr

Backing store path: None

LUN: 1

Type: disk

SCSI ID: IET 00010001

SCSI SN: beaf11

Size: 3216 MB

Online: Yes

Removable media: No

Backing store type: rdwr

Backing store path: /dev/sdc1

Account information:

ACL information:

ALL

Client side configuration:

1 ) Install iscsi-initiator-utils package on the client using yum

# yum install iscsi-initiator-utils

2 )Discover the target LUN’s exported by server using following command. It will provide iqn name with of LUN associated with given ip address

# iscsiadm -m discovery -t sendtargets -p 10.30.32.206

Starting iscsid: [ OK ]

10.30.32.206:3260,1 iqn.2008-09.com.example:server.target1t

Note :

-p : it is indicates the address of target server.

3) To connect iSCSI target we can use following command , we need to mention server ip and iqn name.

# iscsiadm -m node -T iqn.2008-09.com.example:server.target1 –p 10.30.32.206 –login

Note :

-p : it is indicates the address of target server.

-T : This option specifies iqn of target server

Now iSCSI target is connected from ip 10.30.32.206.To find out the device associated with the iSCSI LUN. We have to check /var/log/message

# tail /var/log/messages

Dec 26 14:22:50 localhost kernel: scsi 3:0:0:0: Attached scsi generic sg4 type 12

Dec 26 14:22:50 localhost kernel: scsi 3:0:0:1: Direct-Access IET VIRTUAL-DISK 0001 PQ: 0 ANSI: 5

Dec 26 14:22:50 localhost kernel: sd 3:0:0:1: Attached scsi generic sg5 type 0

Dec 26 14:22:50 localhost kernel: sd 3:0:0:1: [sdd] 6281352 512-byte logical blocks: (3.21 GB/2.99 GiB)

Dec 26 14:22:50 localhost kernel: sd 3:0:0:1: [sdd] Write Protect is off

Dec 26 14:22:50 localhost kernel: sd 3:0:0:1: [sdd] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA

Dec 26 14:22:50 localhost kernel: sdd: sdd1

Dec 26 14:22:50 localhost kernel: sd 3:0:0:1: [sdd] Attached SCSI disk

Dec 26 14:22:50 localhost libvirtd: 14:22:50.833: error : udevGetSCSIType:747 : Failed to find SCSI device type 12

Dec 26 14:22:50 localhost iscsid: Connection1:0 to [target: iqn.2008-09.com.example:server.target1, portal: 10.30.32.206,3260] through [iface: default] is operational now

In this demo, iSCSI LUN is linked as /ded/sdd1

Creating file system:

we can create file system on /ded/sdd1 and use locally.

# mkfs.ext3 /dev/sdd1

# mkdir iSCSI

# mount /dev/sdd1 /iSCSI/

Adding entry in /etc/fstab:

Find out UUID of device using following command

# blkid /dev/sdd1

/dev/sdd1: UUID="9674832d-c995-4ac8-b6da-0d25efa088d0" TYPE="ext3"

Add the following entry in /etc/fstab using vi editor.

“UUID=9674832d-c995-4ac8-b6da-0d25efa088d0 /iSCSI ext3 _netdev 0 0”

[root@dhcpserver /]# cat /etc/fstab

# /etc/fstab

# Created by anaconda on Thu Jun 2 00:41:38 2011

# Accessible filesystems, by reference, are maintained under '/dev/disk'

# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

/dev/mapper/VolGroup-lv_root / ext4 defaults 1 1

UUID=9c732237-b39f-4024-a631-3c264e637179 /boot ext4 defaults 1 2

/dev/mapper/VolGroup-lv_swap swap swap defaults 0 0

tmpfs /dev/shm tmpfs defaults 0 0

devpts /dev/pts devpts gid=5,mode=620 0 0

sysfs /sys sysfs defaults 0 0

proc /proc proc defaults 0 0

UUID=9674832d-c995-4ac8-b6da-0d25efa088d0 /iSCSI ext3 _netdev 0 0

The added entry is highlighted in the above output.

Note:

We must use _netdev parameter while adding entry in /etc/fstab,Which is used to prevent the system from attempting to mount the file systems until the network has been enabled on the system.

Bonding in RHEL 6

2012-01-27T00:03:00.000-08:00

NIC Bonding in RHEL6

Solution

Red Hat Enterprise Linux allows administrators to bind multiple network interfaces together into a single channel using the bonding kernel module and a special network interface called a channel bonding interface. Channel bonding enables two or more network interfaces to act as one, simultaneously increasing the bandwidth and providing redundancy. The behavior of the bonded interfaces depends upon the mode, either hot standby or load balancing service.

Steps for configuring bonding

In this document we are configuring bond0 with interfaces eth0 and eth1

Step 1- Load Kernel module

For a channel bonding interface to be valid, the kernel module must be loaded. To ensure that the module is loaded when the channel bonding interface is brought up, create a new file as root named <bonding>.conf in the /etc/modprobe.d/ directory. Note that we can name this file anything but it should with ends with a .conf extension. Insert the following line in this new file alias bond<N> bonding

Replace <N> with the interface number, such as 0. If we want to configure configuring more than on bonding interface, For each configured channel bonding interface, there must be a corresponding entry in /etc/modprobe.d/<bonding>.conf file

In this example we are configuring bond0 and file name is bonding.conf

[root@praji2 modprobe.d]# cat /etc/modprobe.d/bonding.conf

alias bond0 bonding

Step2- create channel bonding interface

We need to create a channel bonding interface configuration file on /etc/sysconfig/network-scripts/ directory called ifcfg-bond<N> , replacing <N> with the number for the interface, such as 0 and specify the bonding parameters on the file. Here we are creating ifcfg-bond0 file with following contents

[root@praji2 network-scripts]# cat ifcfg-bond0

DEVICE=bond0

IPADDR=172.16.1.207

NETMASK=255.255.255.0

ONBOOT=yes

BOOTPROTO=none

USERCTL=no

BONDING_OPTS="mode=0 miimon=1000"

Step 3- Configure Network interfaces

After the channel bonding interface is created, the network interfaces to be bound together must be configured by adding the MASTER= and SLAVE= directives to their configuration files. The configuration files for each of the channel-bonded interfaces can be nearly identical. For example, if two Ethernet interfaces are being channel bonded, both eth0 and eth1 may look like the following example

Interface eth0 configuration

[root@praji2 network-scripts]# cat ifcfg-eth0

DEVICE=eth0

ONBOOT=yes

MASTER=bond0

SLAVE=yes

BOOTPROTO=none

USERCTL=no

TYPE=Ethernet

Interface eth1 configuration

[root@praji2 network-scripts]# cat ifcfg-eth1

DEVICE=eth1

ONBOOT=yes

MASTER=bond0

SLAVE=yes

BOOTPROTO=none

TYPE=Ethernet

USERCTL=no

After configuring the interfaces we have to bring up the bond by using command

[root@praji2 network-scripts]# ifconfig bond0 up

If the bonding is correctly configured we can view the configuration using ifconfig command

[root@praji2 network-scripts]# ifconfig

bond0 Link encap:Ethernet HWaddr 00:0C:29:69:31:C4

inet addr:172.16.1.207 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fe69:31c4/64 Scope:Link

UP BROADCAST RUNNING MASTER MULTICAST MTU:1500 Metric:1

RX packets:19676 errors:0 dropped:0 overruns:0 frame:0

TX packets:342 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:1623240 (1.5 MiB) TX bytes:42250 (41.2 KiB)

eth0 Link encap:Ethernet HWaddr 00:0C:29:69:31:C4

UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1

RX packets:10057 errors:0 dropped:0 overruns:0 frame:0

TX packets:171 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:832257 (812.7 KiB) TX bytes:22751 (22.2 KiB)

Interrupt:19 Base address:0x2000

eth1 Link encap:Ethernet HWaddr 00:0C:29:69:31:C4

UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1

RX packets:9620 errors:0 dropped:0 overruns:0 frame:0

TX packets:173 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:791043 (772.5 KiB) TX bytes:20207 (19.7 KiB)

Interrupt:19 Base address:0x2080

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:2 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:104 (104.0 b) TX bytes:104 (104.0 b)

To view all existing bonds we can run following command, it will list bond0

[root@praji2 network-scripts]# cat /sys/class/net/bonding_masters

bond0

To view the existing mode of bonding we can use following command

[root@praji2 network-scripts]# cat /sys/class/net/bond0/bonding/mode

balance-rr 0

For verifying bonding , we can use following command. It will list bonding details

[root@praji2 network-scripts]# cat /proc/net/bonding/bond0

Ethernet Channel Bonding Driver: v3.5.0 (November 4, 2008)

Bonding Mode: load balancing (round-robin)

MII Status: up

MII Polling Interval (ms): 1000

Up Delay (ms): 0

Down Delay (ms): 0

Slave Interface: eth0

MII Status: up

Link Failure Count: 0

Permanent HW addr: 00:0c:29:69:31:c4

Slave Interface: eth1

MII Status: up

Link Failure Count: 0

Permanent HW addr: 00:0c:29:69:31:ce

bonding modes

Several policies are available in bonding, this mode can be set using directive mode=<value>

The <value> can be one of:

balance-rr or 0 — Sets a round-robin policy for fault tolerance and load balancing. Transmissions are received and sent out sequentially on each bonded slave interface beginning with the first one available.

active-backup or 1 — Sets an active-backup policy for fault tolerance. Transmissions are received and sent out via the first available bonded slave interface. Another bonded slave interface is only used if the active bonded slave interface fails.

balance-xor or 2 — Sets an XOR (exclusive-or) policy for fault tolerance and load balancing. Using this method, the interface matches up the incoming request's MAC address with the MAC address for one of the slave NICs. Once this link is established, transmissions are sent out sequentially beginning with the first available interface.

broadcast or 3 — Sets a broadcast policy for fault tolerance. All transmissions are sent on all slave interfaces.

802.3ad or 4 — Sets an IEEE 802.3ad dynamic link aggregation policy. Creates aggregation groups that share the same speed and duplex settings. Transmits and receives on all slaves in the active aggregator. Requires a switch that is 802.3ad compliant.

balance-tlb or 5 — Sets a Transmit Load Balancing (TLB) policy for fault tolerance and load balancing. The outgoing traffic is distributed according to the current load on each slave interface. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed slave.

balance-alb or 6 — Sets an Active Load Balancing (ALB) policy for fault tolerance and load balancing. Includes transmit and receive load balancing for IPV4 traffic. Receive load balancing is achieved through ARP

************************************************

LDAP server configuration in RHEL 5

2012-01-26T19:47:00.000-08:00

LDAP server configuration in RHEL 5

Introduction

The Lightweight Directory Access Protocol (LDAP) is a set of open protocols used to access centrally stored information over a network .The main benefit of using LDAP is that information for an entire organization can be consolidated into a central repository. For example, rather than managing user lists for each group within an organization, LDAP can be used as a central directory accessible from anywhere on the network.

Setup details

Server Operating system : RHEL 5.4

Openldap server Version : 2.3.43

Server IP address : 192 .168.1.206

Client operating system : RHEL 5.4

Client ipaddress : 192 .168.1.205

LDAP server configuration

Install packages required for ldap server configuration using yum or rpm. In this example we are installing packages using yum and repository is RHEL 5.4 ISO image

Yum configuration

a) Create a mount-point for mounting ISO image and mount the image as follows

[root@ldapserver ~]# mkdir /repo

[root@ldapserver ~]# mount /dev/cdrom /repo/

mount: block device /dev/cdrom is write-protected, mounting read-only

b) Create yum configure file “ /etc/yum.repos.d/repo.repo ” with following contents. [File can be created using vi editor]

[root@ldapserevr ~]# vi /etc/yum.repos.d/repo.repo

[repo]

name=repo

baseurl=file:///repo/Server

enabled=1

gpgcheck=0

Installing package

Install packages needed for ldap server using yum

[root@ldapserver ~]# yum install -y openldap openldap-clients openldap-devel nss_ldap openldap-servers

Creating ldap admin ( root ) password

To use encrypted password in ldap we have to use lappasswd command, which will generate encrypted string of input text (When prompted, we have to type and then re-type a password. The program prints the resulting encrypted password to the shell prompt)

[root@ldapserver ~]# slappasswd

New password:hcl123

Re-enter new password:hcl123

{SSHA}TEN14DD+7cE+3Dci1uRzjFA0lE01E+tC

Edit “ /etc/openldap/slapd.conf ” file to configure ldap domain and server

The LDAP server's daemon is named slapd and its configuration file is named “ /etc/openldap/slapd.conf “. Update it with following content which will specify the ldap domain details.

database bdb

suffix "dc=erc,dc=internal"

rootdn "cn=Manager,dc=erc,dc=internal"

rootpw {SSHA}TEN14DD+7cE+3Dci1uRzjFA0lE01E+tC

Note:

The suffix line names the domain for which the LDAP server provides information and should be changed from dc=my-domain,dc=com to our domain name.

The rootdn entry is the Distinguished Name (DN) for a user who is unrestricted by access controls or administrative limits parameters set for operations on the LDAP directory.

Remove comment from rootpw line and replace the default value of password on rootpw line with an encrypted password string which we have generated using slappasswd

Configuring database

a) Locate DB_CONFIG.example file and copy file to “ /var/lib/ldap/ “ directory as DB_CONFIG (By default the file will be available at “ /etc/openldap/ “ directory)

[root@ldapserver /]# find / -name DB_CONFI*

/etc/openldap/DB_CONFIG.example

[root@ldapserver ~]# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

b) We have to run updatedb command to update database

[root@ldapserver lib]# updatedb

c) Make sure that /var/lib/ldap directory is owned by ldap user

[root@ldapserver openldap]# chown -R ldap:ldap /var/lib/ldap

[root@ldapserver openldap]# ls -ld /var/lib/ldap/

drwx------ 2 ldap ldap 4096 Dec 4 20:52 /var/lib/ldap/

Starting ldap server

Start ldap service and make sure that service is enabled during startup

[root@ldapserver Server]# service ldap start

Checking configuration files for slapd: config file testing succeeded

[ OK ]

Starting slapd: [ OK ]

[root@ldapserver Server]# chkconfig ldap on

Testing ldap configuration using ldapsearch command

We can view the LDAP database entries all at once with the ldapsearch command; this is a good test to make sure you have all the correct functionality.

[root@ldapserver Server]# ldapsearch -x -b "dc=erc,dc=internal" "(objectclass=*)"

# extended LDIF

# LDAPv3

# base <dc=erc,dc=internal> with scope subtree

# filter: (objectclass=*)

# requesting: ALL

# search result

search: 2

result: 32 No such object

# numResponses: 1

Creating DIT for our domain erc.internal using ldif file

The contents of an entire directory can be defined using LDIF. Using LDIF is an efficient method of directory creation when there are many entries to add to the directory. The usual rules for LDIF files apply to the configuration information: Comment lines beginning with a '#' character are ignored. If a line begins with a single space, it is considered a continuation of the previous line (even if the previous line is a comment) and the single leading space is removed. Different entries are separated by blank lines.

Creating Organizational units (OU’s)

a) Create a LDIF file for Root OU ( ERCINTERNAL) named “ erc_root_ou.ldif ” . The ldif file can be created using vi editor and content should be as follows.

[root@ldapserver /]# vi /erc_root_ou.ldif

dn: dc=erc,dc=internal

dc: erc

objectClass: dcObject

objectClass: organizationalUnit

ou: ERCINTERNAL

b) Add OU details to ldap server using ldapadd command. Which will prompt for root password , we have to provide password given in “ slapd.conf ” file .

[root@ldapserver ~]# ldapadd -D "cn=Manager,dc=erc,dc=internal" -W -x -f /erc_root_ou.ldif

Enter LDAP Password:hcl123

adding new entry "dc=erc,dc=internal"

c) Create other ou’s to our domain using ldif file. In this scenario we are creating four OU’s named mis ,usd , people, and users . Create ldif file named “ ou.ldif “ for adding organizational information to ldap server, content must me as follows. (ldif file can be create using vi editor)

[root@ldapserver /]# vi /ou.ldif

dn: ou=mis,dc=erc,dc=internal

ou: mis

objectclass: organizationalUnit

dn: ou=usd,dc=erc,dc=internal

ou: usd

objectclass: organizationalUnit

dn: ou=people,dc=erc,dc=internal

ou: people

objectClass: organizationalUnit

dn: ou=users,dc=erc,dc=internal

ou: users

objectClass: organizationalUnit

d) Add OU’s to DIT using ldapadd command, we have to give password specified in “ slapd.conf “ file while prompting for password.

[root@ldapserver /]# ldapadd -D "cn=Manager,dc=erc,dc=internal" -W -x -f /ou.ldif

Enter LDAP Password:hcl123

adding new entry "ou=mis,dc=erc,dc=internal"

adding new entry "ou=usd,dc=erc,dc=internal"

adding new entry "ou=people,dc=erc,dc=internal"

adding new entry "ou=users,dc=erc,dc=internal"

Migrating Local users to ldap Server

Local user information can be migrated to ldap server using scripts provided by PADL Software and which gives number of tools that can be used to migrate /etc/passwd file into LDAP. In RHEL 5 these scrip available at following path “ /usr/share/openldap/migration/ ”

a) Edit “ migrate_common.ph “ and add domain information

The password conversion script is named “ migrate_common.ph “. Edit the file and replace all instances of the string “padl” with our domain name. Lines to be edited as follows [Editing can be done by using vi ]

$DEFAULT_MAIL_DOMAIN = "erc.internal";

$DEFAULT_BASE = "dc=erc,dc=internal";

b) Add local users using useradd command enable the account by setting password.

[root@ldapserver ~]# useradd ldapuser1

[root@ldapserver ~]# passwd ldapuser1

Changing password for user ldapuser1.

New UNIX password:hcl@123

Retype new UNIX password:hcl@123

passwd: all authentication tokens updated successfully.

c) Select a particular user and create ldif file using “ migrate_passwd.pl ” tool

[root@ldapserver ~]# grep ldapuser1 /etc/passwd > /user1.txt

[root@ldapserver~]# cd /usr/share/openldap/migration/

[root@ldapserver migration]# ./migrate_passwd.pl /user1.txt user1.ldif

d) To view the content of user migrating file we can use cat command.

[root@ldapserver migration]# cat user1.ldif

dn: uid=ldapuser1,ou=People,dc=erc,dc=internal

uid: ldapuser1

cn: ldapuser1

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}$1$q4n2AgUc$DmbHizNsdXZ0fmPf7150N1

shadowLastChange: 15312

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 501

gidNumber: 501

homeDirectory: /home/ldapuser1

e) Add the user to ldapserver using ldapadd command

[root@ldapserver migration]# ldapadd -D "cn=Manager,dc=erc,dc=internal" -W -x -f user1.ldif

Enter LDAP Password:hcl123

adding new entry "uid=ldapuser1,ou=People,dc=erc,dc=internal"

Client side configuration

a) Install packages required for ldap user authentication using yum

[root@ldapclient ~]# yum install -y openldap openldap-clients openldap-devel nss_ldap authconfig

b) We can use authconfig-tui tool to configure ldap authentication. Following window will appear and select option LDAP as shown in figure.

[root@ldapclient ~]# authconfig-tui

c) Provide ldap server address and Base DN details on the next screen as in figure and click OK.

d) LDAP clients are configured using the “ /etc/openldap/ldap.conf “ file. We need to make sure that the file refers to the LDAP server's IP address for our domain erc.internal. The file should look as follows

[root@ldapclient ~]# cat /etc/openldap/ldap.conf

# LDAP Defaults

# See ldap.conf(5) for details

# This file should be world readable but not world writable.

#BASE dc=example, dc=com

#URI ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT 12

#TIMELIMIT 15

#DEREF never

URI ldap://10.30.32.206

BASE dc=erc,dc=internal

TLS_CACERTDIR /etc/openldap/cacerts

e) Verify “ nsswitch.conf ” file for getting the order in which the Linux operating system searches login databases for login information. “ /etc/nsswitch.conf “ file is used to configure which services are to be used to determine information such as hostnames, password files, and group files .Entries are like following.

[root@ldapclient ~]# cat /etc/nsswitch.conf

passwd: files ldap

shadow: files ldap

group: files ldap

netgroup: files ldap

automount: files ldap

f) use getent passwd command to list entire users including ldapusers

[root@ldapserver ~]# getent passwd

Additional Information

The following resources offer additional information on LDAP

Client Applications

o man ldapadd — Describes how to add entries to an LDAP directory.

o man ldapdelete — Describes how to delete entries within an LDAP directory.

o man ldapmodify — Describes how to modify entries within an LDAP directory.

o man ldapsearch — Describes how to search for entries within an LDAP directory.

o man ldappasswd — Describes how to set or change the password of an LDAP user.

o man ldapcompare — Desribes how to use the ldapcompare tool.

o man ldapwhoami — Describes how to use the ldapwhoami tool.

o man ldapmodrdn — Describes how to modify the RDNs of entries.

Server Applications

o man slapd — Describes command line options for the LDAP server.

o man slurpd — Describes command line options for the LDAP replication server.

Administrative Applications

o man slapadd — Describes command line options used to add entries to a slapd database.

o man slapcat — Describes command line options used to generate an LDIF file from a slapddatabase.

o man slapindex — Describes command line options used to regenerate an index based upon the contents of a slapd database.

o man slappasswd — Describes command line options used to generate user passwords for LDAP directories.

Configuration Files

o man ldap.conf — Describes the format and options available within the configuration file for LDAP clients.

o man slapd.conf — Describes the format and options available within the configuration file referenced by both the LDAP server applications (slapd and slurpd) and the LDAP administrative tools (slapadd, slapcat, and slapindex).