RHEL Tech

Install SUN QFS in Solaris 10

noreply@blogger.com (Mugu) — Mon, 18 Jun 2012 16:45:00 +0000

Install SUN QFS in Solaris and Create new Filesystem

Release:

Oracle Solaris 10_X86

SUN QFS 5.2

Solution:

1) Copy the SUN QFS iso image file from cd to /opt filesystem

2) Mount the iso image using the below command

# lofiadm -a /opt/SUN_QFS_5.2.iso

/dev/lofi/1

# mount –F hsfs /dev/lofi/1 /mnt/

3) Install the QFS package using the pkgadd command’

# cd /mnt/x64/2.10/

# pkgadd -d . SUNWqfsr SUNWqfsu

Note: The above command asks some confirmation like license agreement, give yes to all. Finally we got output like “Installation of was successful”

4) By default the QFS package installed in /opt filesystem. So we need to manually add this to the PATH variable to use QFS command.

# vi /.profile

PATH=$PATH:/opt/SUNWsamfs/bin:/opt/SUNWsamfs/sbin

export PATH

5) Copy the default mcf file to the /etc/opt/SUNWsamfs directory

# cd /etc/opt/SUNWsamfs

# cp /opt/SUNWsamfs/examples/mcf .

6) Create the Slices in second disk to create QFS filesystem.

# format –e

Searching for disks...done

AVAILABLE DISK SELECTIONS:

0. c0t0d0

/pci@0,0/pci8086,3408@1/pci103c,3245@0/sd@0,0

1. c2t0d0

/pci@0,0/pci8086,340c@5/pci103c,3243@0/sd@0,0

Specify disk (enter its number): 1

selecting c2t0d0

[disk formatted]

FORMAT MENU:

disk - select a disk

type - select (define) a disk type

partition - select (define) a partition table

current - describe the current disk

format - format and analyze the disk

fdisk - run the fdisk program

repair - repair a defective sector

label - write label to the disk

analyze - surface analysis

defect - defect list management

backup - search for backup labels

verify - read and display labels

inquiry - show vendor, product and revision

scsi - independent SCSI mode selects

cache - enable, disable or query SCSI disk cache

volname - set 8-character volume name

! - execute , then return

Quit

format> p

PARTITION MENU:

0 - change `0' partition

1 - change `1' partition

2 - change `2' partition

3 - change `3' partition

4 - change `4' partition

5 - change `5' partition

6 - change `6' partition

7 - change `7' partition

8 - change '8' partition

9 - change `9' partition

select - select a predefined table

modify - modify a predefined partition table

name - name the current table

print - display the current table

label - write partition map and label to the disk

! - execute , then return

Quit

partition> 0

Enter partition id tag[usr]:

Enter partition permission flags[wm]:

Enter new starting Sector[34]:

Enter partition size[20971520b, 20971553e, 10240mb, 10gb, 0tb]: 10gb

Note: Create the next slice from the last sector of the first slice. We can get that value by listing all the partitions using “p” option.

partition> 4

Enter partition id tag[usr]:

Enter partition permission flags[wm]:

Enter new starting Sector[20971554]: 20971554

Enter partition size[629145600b, 650117153e, 307200mb, 300gb, 0tb]: 300gb

partition> 5

Enter partition id tag[usr]:

Enter partition permission flags[wm]:

Enter new starting Sector[650117154]: 650117154

Enter partition size[629145600b, 1279262753e, 307200mb, 300gb, 0tb]: 300gb

partition> l

[0] SMI Label

[1] EFI Label

Specify Label type[1]:

Ready to label disk, continue? y

partition> q

format> q

7) Edit the mcf file

# vi /etc/opt/SUNWsamfs/mcf

qfs1000 10 ma qfs1000 on

/dev/dsk/c0t0d0s7 11 mm qfs1000 on

/dev/dsk/c2t0d0s5 12 mr qfs1000 on

/dev/dsk/c2t0d0s6 13 mr qfs1000 on

Note: Here Select equipment type according to your environment. Otherwise you got an error message. In my configuration file the metadata information are stored in the first disk and the filesystem created in the second disk.

ms Defines a file system that stores both data and metadata on the same device (an md device).

ma Defines a file system that stores metadata on a separate device (an mm device). The data in an ma file system can be stored on md, or mr devices.

md Defines a striped or round-robin device that uses dual allocation for storing file data. See also Dual and Single Allocation Schemes.

mm Defines a metadata device for storing inode and other metadata information. You can specify multiple metadata devices. Metadata (including inodes, directories, allocation maps, and so on) on ma file systems is located on metadata devices, separated from the file data devices. By default, metadata is allocated using round-robin allocation if you have multiple metadata devices.

mr Defines a round-robin or striped data device that uses single allocation for storing file data. See also Dual and Single Allocation Schemes.

8) Issue “samd config” command to update the configuration changes to the sam-fsd daemon.

# samd config

9) Now create the QFS filesystem

# sammkfs qfs1000

10) Mount the QFS filesystem using the below command

# mkdir /qfs1000

# mount –F samfs qfs1000 /qfs1000

11) For the permanent mount add the below entry in the vfstab file

# vi /etc/vfstab

qfs1000 - /qfs1000 samfs - yes -

12) Once restart the server and confirm, whether QFS filesystem auto mounted or not

# reboot

Mount Windows Share in Linux

noreply@blogger.com (Mugu) — Mon, 27 Feb 2012 21:34:00 +0000

Mount Windows Share in Linux

Release:

RedHat Enterprise Linux

SUSE Linux

AIX 5.3

Windows Server 2003

Problem:

Need to mount the windows share in the Linux Server using the CIFS.

Solution:

In RHEL:

Mount Windows partition in RHEL using the below command

# mount -t cifs -o username=administrator,password='XXXXXX' //172.16.1.50/files /mnt

By default windows share mounted with the full permission (777) in Linux. If u want to change the default permission use the “dir_mode” and “file_mode” options to set directory and file permission.

# mount -t cifs -o username=administrator,password='XXXXXX',dir_mode=0755,file_mode=0755 //172.16.1.50/files /mnt

Where,

/mnt – mount point name

//172.16.1.50/files – share folder name with server IP address

In SUSE Linux:

Mount windows partition in SUSE Linux using the below command

# mount -t smbfs -o username=administrator,password='XXXXXX' //172.16.1.50/files /mnt

In AIX:

Mount the windows partition in AIX using the below command

# mount -v cifs -n serverip/username/password -o wrkgrp=domain,fmode=755 /sharename /localmountpoint

Example:

# mount -v cifs -n 172.16.1.50/administrator/XXXXXX -o wrkgrp=domainname,fmode=755 /files /mnt

Reverse Proxy in apache

noreply@blogger.com (Mugu) — Tue, 17 Jan 2012 18:18:00 +0000

Reverse Proxy Configuration in apache

Introduction:

A reverse proxy is a gateway for servers, it can be used whenever multiple web servers must be accessible via a single public IP address. The web servers listen on different ports in the same machine, with the same local IP address or, possibly, on different machines and different local IP addresses altogether. The reverse proxy analyses each incoming call and delivers it to the right server within the local area network.

Release:

RedHat Enterprise Linux

Apache 2.x

Problem:

Configure Apache webserver as a reverse proxy server

Solution:

1) Install the required rpm

# yum install httpd

2) Enable the proxy related modules in the httpd,conf file

# vi /etc/httpd/conf/httpd.conf

LoadModule proxy_module modules/mod_proxy.so

LoadModule proxy_http_module modules/mod_proxy_http.so

3) Add the below entries to the http configuration file.

# vi /etc/httpd/conf/httpd.conf

<IfModule mod_proxy.c>

ProxyRequests Off

<Proxy *>

Order deny,allow

Allow from all

</Proxy>

ProxyPreserveHost On

ProxyVia On

SSLProxyEngine on

ProxyPass /webdav http://ServerIP:8080/webdav

ProxyPassReverse /webdav http://ServerIP:8080/webdav

</IfModule>

Note: In the above sample all the request comes to /webdav URL redirect to the another tomcat server. For example Apache server IP is 10.0.0.1 and the tomcat server IP is 10.0.0.2, then the request like http://10.0.0.2/webdav will be redirect to http://10.0.0.2:8080/webdav

4) To enable logging for the reverse proxy, add the below lines in the configuration file

# vi /etc/httpd/conf/httpd.conf

<IfModule mod_proxy.c>

CustomLog logs/access_proxy.log combined

ErrorLog logs/error_proxy.log

</IfModule>

5) Restart the httpd service

# /etc/init.d/httpd restart

webdav configuration in apache

noreply@blogger.com (Mugu) — Wed, 04 Jan 2012 21:58:00 +0000

Sample Webdav Configuration in Apache

Introduction:

WebDAV stands for "Web-based Distributed Authoring and Versioning". It is a set of extensions to the HTTP protocol which allows users to collaboratively edit and manage files on remote web servers.

Release:

RedHat Enterprise Linux 5.x

Apache 2.x

Problem:

Need to enable the webdav (Web-based Distributed Authoring and Versioning) in apache web server.

Solution:

1) Install the required rpms

# yum install httpd

2) Enable the webdav related modules in the httpd,conf file

# vi /etc/httpd/conf/httpd.conf

LoadModule dav_module modules/mod_dav.so

LoadModule dav_fs_module modules/mod_dav_fs.so

3) Create a directory to publish over web server

# mkdir /var/www/webdav

4) Create one new configuration file for the webdav

# vi /etc/httpd/conf.d/webdav.conf

<IfModule mod_dav.c>

LimitXMLRequestBody 131072

Alias /webdav "/var/www/webdav"

<Directory /var/www/webdav>

Dav On

Options +Indexes

IndexOptions FancyIndexing

AddDefaultCharset UTF-8

Order allow,deny

Allow from all

</Directory>

</IfModule>

5) If want to enable authentication for the webdav means, add the below lines in the webdav.conf file and also create the user database

# vi /etc/httpd/conf.d/webdav.conf

AuthType Basic

AuthName "WebDAV Server"

AuthUserFile /etc/httpd/webdav.users.db

Require valid-user

6) Create the user database using the below command

# htpasswd -c /etc/httpd/webdav.users.db testuser

7) Restart the httpd service

# service httpd restart

8) Access the webdav from the client using the below URL

http://ServerIPAddress/webdav

Online LUN Detection in RHEL

noreply@blogger.com (Mugu) — Tue, 20 Dec 2011 17:52:00 +0000

Online LUN Detection in RedHat Enterprise Linux

Release:

RedHat Enterprise Linux

Problem:

Detect Newly assigned LUN in RHEL without reboot the server

Solution:

1) Install the required packages

# yum install sysfsutils sg3_utils

2) We need the below parameters to rescan the scsi bus

H – HBA Number

C – Channel on the HBA

T – SCSI target id

L – LUN id

3) We can get the above said parameters using the different command, for me I am using “systool” and “sg_map” command

# systool -c fc_host -v

Class Device = "host3"

Class Device path = "/sys/class/fc_host/host3"

port_name = "0x2100001b32882e82"

Note : In the above sample output class device path is “host3”. So 3 is the HBA number, if dual channel HBA means like the above host4 also will displayed. Here port name is the HBA's wwn id.

# systool -c fc_transport -v

Class Device = "0:0"

Class Device path = "/sys/class/fc_transport/target3:0:0"

port_name = "0x200400a0b84889b5"

Note: In the above command output, class device path is “3:0:0”, that is in the order of “HBA number:channel on HBA:SCSI Target id” (H:C:T). Here port name is the storage's wwpn id.

# sg_map -x

/dev/sg0 0 0 0 0 0

/dev/sg1 0 0 1 0 0

/dev/sg2 0 1 0 0 0 /dev/sda

/dev/sg3 3 0 0 0 0

/dev/sg4 3 0 0 31 0

/dev/sg5 3 0 1 0 0 /dev/sdb

/dev/sg6 3 0 1 1 0 /dev/sdc

/dev/sg7 3 0 2 0 0 /dev/sdd

/dev/sg8 3 0 2 1 0 /dev/sde

Note: In the above command output, first four digits as represents “H C T L” also known as Host, Bus, Target, Lun (H B T L). From this we can identify how many luns are already mapped.

4) Now rescan the SCSI bus using the said parameters

# echo “C T L” > /sys/class/scsi_host/HostH/scan

Note: If u are having dual channel HBA card means scan both the HBA numbers using the above command .

5) Now check with the fdisk command, whether the LUN is detected or not. If not means use the below command

# echo “1” > /sys/class/fc_host/hostH/issue_lip

Note: The above command instruct the driver to rediscover the remote ports. LIP (Loop Initialization Protocol).

6) Now confirm with the fdisk command and use the LUN as usual.

GZIP Compression in Apache

noreply@blogger.com (Mugu) — Sat, 10 Dec 2011 05:08:00 +0000

GZIP Compression in Apache Webserver

Introduction:

The mod_deflate module provides the DEFLATE output filter that allows output from your server to be compressed before being sent to the client over the network.

The mod_deflate module does not have a lower bound for file size, so it attempts to compress files that are too small to benefit from compression. This results in files smaller than approximately 120 bytes becoming larger when processed by mod_deflate.

Release:

RedHat Enterprise Linux

Apache Webserver 2.x

Problem:

Need to enable the gzip compression in the apache webaserver using the mod_deflate module.

Solution:

1) Make sure that mod_deflate module is loaded in the configuration file

2) Mention what type of files gets compressed in the http configuration file

BrowserMatch ^Mozilla/4 gzip-only-text/html

BrowserMatch ^Mozilla/4\.0[678] no-gzip

BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html

3) Add the exception using the blow syntax

SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary

SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary

Note: The above two lines mention that don't compress the image files (gif,jpe and png) and the pdf files. Like the above syntax we can exclude any other format.

4) If u want to enable the seperate log for the gzip compression use the blow entries in the http configuration file.

<IfModule mod_deflate.c>

DeflateFilterNote Input inputstream

DeflateFilterNote Output outputstream

DeflateFilterNote Ratio ratiostream

LogFormat '"%r" %{outputstream}n/%{inputstream}n (%{ratiostream}n%%)' deflate

</IfModule>

Note: In the log, how much the pages are compressed information available.

5) Restart the http service to take the changes effect.

# service httpd restart

Webalizer Configuration in Linux

noreply@blogger.com (Mugu) — Thu, 01 Dec 2011 04:49:00 +0000

Webalizer Configuration for apache in Linux

Introduction:

The Webalizer is a GPL application that generates web pages of analysis, from access log. It is simple to configure and easy to run.

Release:

RedHat Enterprise Linux

Problem:

Need to monitor the webserver hits using webalizer.

Solution:

1) Install the webalizer rpm

# yum install webalizer

2) Mention the webserver log path in the webalizer configuration file

# vi /etc/webalizer.conf

LogFile /etc/httpd/logs/access_log.2.gz

OutputDir /opt/webalizer_apache

Incremental yes

IncrementalName webalizer.current

Note: For my webserver i used logrotate to rotate all my logs. So i mentioned the rotated log file to update the hits. We can mention any webserver access log file (if you didn't have logrotate "/etc/httpd/logs/access_log" will be your default log location of apache webserver). "Incremental" keyword allows to rotate the logs.

3) Logrorate script used by me is

# vi /etc/logrotate.d/apache

/etc/httpd/logs/*log {

missingok

daily

rotate 20

compress

notifempty

sharedscripts

postrotate

/bin/kill -HUP `cat /etc/httpd/logs/httpd.pid 2>/dev/null` 2> /dev/null || true

endscript

}

Note: If you want to know more about logrotate refer http://linuxnextgen.blogspot.com/2011/04/logrotate-in-linux.html.

4) Log rotate will rotate the logs in every day morning. So i put one cron entry to update the webserver hits in the daily basics.

# crontab -e

4 30 * * * /usr/local/bin/webalizer -c /etc/webalizer.conf

5) In that output directory “index.html” file will be there using that we can browse webserver hits history

6) Or we can add the webalizer output directory to the webserver “Document Root” by creating one symbolic link.

# ln -s /opt/webalizer_apache /var/www/html/webalizer_apache

Note: Here “/var/www/html” is my “Document Root” in apache web server.

7) Now we can access the webalizer page from the webserver itself by using the below URL

http://ServerIPAddress/webalizer_apache

db documentation using schemaspy in linux

noreply@blogger.com (Mugu) — Fri, 11 Nov 2011 04:17:00 +0000

SchemaSpy in Linux

Introduction:

SchemaSpy is a Java-based tool that analyzes the metadata of a schema in a database and generates a visual representation of it in a browser-displayable format. It lets you click through the hierarchy of database tables via child and parent table relationships as represented by both HTML links and entity-relationship diagrams.

Release:

RedHat Enterprise Linux

MSSQL 2005

Problem:

Need to create database documentation using SchemaSpy utility.

Dependencies:

1) JVM 1.5 or above

2) Graphviz (graph visualization software)

3) JTDS 1.2.5

4) HTTP Server (Optional)

Solution:

1) Download the JVM from the below URL

http://www.oracle.com/technetwork/java/javase/downloads/index.html

2) Give the executable permission and install the downloaded java

# chmod +x jdk-1_5_0_22-linux-amd64.bin

# ./jdk-1_5_0_22-linux-amd64.bin

3) Then download the graphviz package from the below URL

http://www.graphviz.org/Download_linux_rhel.php

4) Install the downloaded the rpm using rpm or yum

# yum install graphviz

5) Downlad the JTDS from the below link

http://sourceforge.net/projects/jtds/files/

6) JTDS is used to connect the MSSQL database. JTDS does not need any special installation.

7) Download the SchemaSpy from the below link

http://sourceforge.net/projects/schemaspy/files/

8) Before running the schemaspy make sure that, the “dot” program should be in your PATH. If not present then we need to mention the path of that command using “-gv” option.

9) Now execute the below command to create the relationship diagrams

# /opt/jdk1.5.0_22/bin/java -jar /asp/data/schemaSpy_5.0.0.jar -t mssql05-jtds -u user -p password -db database -host IPAddress -port 1433 -o /opt/test_schema/ -s schemaname -dp /opt/jtds/jtds-1.2.5.jar

Where,

-t → Type of database (e.g. ora, db2, etc.). Defaults is ora

-u → Valid database user id with read access.

-p → Password associated with that user. Defaults to no password.

-db → Name of database to connect to

-host → database server ip or hostname

-port → tcp port used to connect the database

-o → Directory to write the generated HTML/graphs

-s → Database schema

-dp → Looks for drivers here before looking in driverPath

10) The above command takes some time that depends upon your schema size and generate the graphs in the given output directory (in my case /opt/test_schema/).

11) In that output directory “index.html” file will be there using that we can browse everything.

12) If we have http server installed in the same server means we can include this directory to the “Document Root” by creating on symbolic link.

# ln -s /opt/test_schema/ /var/www/html/test_schema

Note: Here “/var/www/html” is my “Document Root” in apache web server.

13) Now we can access the schemaspy graphs through the webserver.

http://ServerIPAddress/test_schema

Install Expect in Linux

noreply@blogger.com (Mugu) — Wed, 09 Nov 2011 04:41:00 +0000

Install Expect in Linux

Introduction:

As per wiki "Expect is a Unix automation and testing tool for interactive applications such as telnet, ftp, fsck, rlogin, ssh, and others".

From man page "Expect is a program that "talks" to other interactive programs according to a script".

Release:

RedHat Enterprise Linux

Problem:

Need to install the "expect" package in RHEL Server for scripting.

Solution:

1) Download the ecpect package from the below link

http://sourceforge.net/projects/expect/

2) Install the required dependecy packages "Tcl/Tk" language toolkit

# yum install tcl

3) Install the "expect" package using the below commands

# tar -zxvf expectx.xx.tar.gz

# ./configure

# make

# make install

Disable and Enable IPV6 in RHEL

noreply@blogger.com (Mugu) — Wed, 10 Aug 2011 06:17:00 +0000

Disable and Enable IPV6 in RHEL

Release:

RedHat Enterprise Linux 5

Problem:

Need to disable the IPV6 in RedHat Enterprise Linux

Solution:

Disable IPV6 in RHEL:

1) Add the below line in the modprobe.conf file

# vi /etc/modprobe.conf

alias net-pf-10 off

alias ipv6 off # Add this for RHEL before 5.4

options ipv6 disable=1 # Add this for 5.4 and later

Note : If any entry available like “alias net-pf-10 ipv6”, delete that entry.

2) Also add the below entry in the network file to prevent error

# vi /etc/sysconfig/network

NETWORKING_IPV6=no

3) Reboot the server to disable the IPV6

# shutdown -r now

Enable IPV6 in RHEL:

4) Add the below entry in the modprobe.conf file

# vi /etc/modprobe.conf

alias net-pf-10 ipv6

Note : Remove if any entry like “alias net-pf-10 off or alias ipv6 off or options ipv6 disable=1” in the modprobe.conf file.

5) Change the “ NETWORKING_IPV6” parameter value to yes in the netwok file.

# vi /etc/sysconfig/network

NETWORKING_IPV6=yes

6) Restart the server to enable the IPV6 support

# shutdown -r now

bonding in suse linux

noreply@blogger.com (Mugu) — Mon, 18 Jul 2011 07:25:00 +0000

Bonding in SUSE Enterprise Linux

Release:

SUSE Enterprise Linux 10

Problem:

Configure the bond0 interface with the interface eth0 and eth1

Solution:

1) Create a bond0 interface file in the /etc/sysconfig/network directory.

# vi /etc/sysconfig/network/ifcfg-bond0

BONDING_MASTER='yes'

BONDING_MODULE_OPTS='mode=1 miimon=100 use_carrier=0'

BOOTPROTO='static'

IPADDR='192.168.10.19'

NETMASK='255.255.255.0'

STARTMODE='onboot'

USERCONTROL='no'

BONDING_SLAVE0='bus-pci-0000:03:00.0'

BONDING_SLAVE1='bus-pci-0000:03:00.1'

Note: “BONDING_SLAVE” value is available in the ethernet configuration file as a parameter “_nm_name” and also “mode=1” indicates active-backup policy ( mode=0 indicates Round-robin policy).

2) configure both the ethernet interface eth0 and eth1 like below

# vi /etc/sysconfig/network/ifcfg-eth-id-xx:xx:xx:xx:xx:xx

BOOTPROTO='none'

STARTMODE='off'

USERCONTROL='no'

3) Restart the network service

# service network restart

4) To check the status of the bond0 interface use the below command

# cat /proc/net/bonding/bond0

Manually Load Driver in initrd on SUSE

noreply@blogger.com (Mugu) — Thu, 07 Jul 2011 06:09:00 +0000

Manually Load Driver in initrd on SUSE Server

Release:

SUSE Linux Enterprise Server 10 SP2

Problem:

Need to manually add the hba card (fibre card) driver in initrd image

Solution:

1) Load the required driver temporarily using the modprobe command

# modprobe -v qla2xxx

2) Check weather the driver module is loaded or not by using lsmod

# lsmod | grep qla

3) Add the new driver module entry in the kernel file

# vi /etc/sysconfig/kernel

INITRD_MODULES="ata_piix mptsas processor thermal fan jbd ext3 edd qla2xxx"

4) Now recreate the initrd image using the below command.

# mkinitrd -k /boot/vmlinux-2.6.16.60-0.21-smp.gz -i /boot/initrd-2.6.16.60-0.21-smp

5) Reboot the server and check weather the driver is loaded or not.

# init 6

# lsmod | grep qla

Implement Virtual Users for FTP authentication

noreply@blogger.com (Mugu) — Sat, 11 Jun 2011 06:57:00 +0000

Implement Virtual Users for VSFTPD Server authentication

Release:

Redhat Enterprise Linux 5.x

Berkeley DB 4.7.25

Problem:

Create an virtual user database and authenticate ftp server (vsftpd service) using that virtual users.

Solution:

1) First configure the VSFTPD server and make the vsftpd service running

2) Install the required RPMs

# yum install db4-utils

3) Download the Berkeley DB from the below URL

http://www.oracle.com/technetwork/database/berkeleydb/downloads/index-082944.html

4) Install the Berkeley DB program on the sevrer

# cd /tmp

# tar -xvf db-4.7.25.tar.tar

# cd db-4.7.25/build_unix/

# ../dist/configure

# make

# make install

Create the Virtual User database:

5) Create text file with the virtual user's username and password information like below one.

# vi login.txt

testuser

12345

user1

12345

6) Create the database file using the “db_load” command.

# db_load -T -t hash -f login.txt /etc/vsftpd/login.db

7) Optionally change the permission of the db file.

# chmod 600 /etc/vsftpd/login.db

8) Edit the PAM configuration file to use the created db file.

# vi /etc/pam.d/vsftpd

session include system-auth

auth required pam_userdb.so db=/etc/vsftpd/login

account required pam_userdb.so db=/etc/vsftpd/login

session required pam_loginuid.so

9) Create a location for the virtual users

# useradd -d /var/ftp/virtualuser virtual

10) Edit the configuration file to use the virtual users

# vi /etc/vsftpd/vsftpd.conf

guest_enable=YES

guest_username=virtual

Note: If you add the above two lines means all the virtual users are redirect to the “/var/ftp/virtualuser” directory. Otherwise if you want to use chroot for every user means, that also possible. Add the below entries for every user login to their respective directory.

# vi /etc/vsftpd/vsftpd.conf

virtual_use_local_privs=YES

write_enable=YES

user_sub_token=$USER

local_root=/home/vftp/$USER

chroot_local_user=YES

hide_ids=YES

guest_enable=YES

11) Restart the ftp service on the server.

# service vsftpd restart

12) Now from the client try to login using that virtual username and password

$ ftp ftpserver

Connected to ftpserver.

220 (vsFTPd 2.0.5)

530 Please login with USER and PASS.

KERBEROS_V4 rejected as an authentication type

Name (sbssdb5:query1): testuser

331 Please specify the password.

Password: 12345

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

Ftp>

Deploy Documentum Using Apache Tomcat

noreply@blogger.com (Mugu) — Thu, 02 Jun 2011 04:07:00 +0000

Deploy Documentum Using Apache Tomcat in RHEL

Release:

Redhat Enterprise Linux 5.x

Apache Tomcat 6.0.14

Problem:

Need to deploy Documentum using apache tomcat in RHEL

Solution:

1) Download the Apache tomcat from the below link

http://archive.apache.org/dist/tomcat/tomcat-6/

2) Copy tomcat to the server and extract the zip folder

# cd /documentum

# tar -zxvf apache-tomcat-6.0.14.tar.gz

# ln -s apache-tomcat-6.0.14 tomcat

Note: Here tomcat dump copied to the “/documentum” directory. Also here one soft link created for the future purpose.

3) Mention the java and jre home path in tomcat also mention the “PermSize” details also.

# vi /documentum/tomcat/bin/catalina.sh

JAVA_HOME=/usr/java/jdk1.6.0_24

JRE_HOME=/usr/java/jdk1.6.0_24/jre

JAVA_OPTS="$JAVA_OPTS -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Xms1024m -Xmx3072m -XX:PermSize=256m -XX:MaxPermSize=512m"

Note: Here “Xms” means that initial heap size and “Xmx” means that maximum heap size.

4) To access the tomcat Manager url add the below entries in the “tomcat-users.xml” file

# vi /documentum/tomcat/conf/tomcat-users.xml

Note: For accessing tomcat manager ( http://IPADDRESS:8080/manager ) use the above authentication “username=tomcat” and “password=tomcat”

5) Also enable pooling option to access the documentum URL from the web.xml file

# vi /documentum/tomcat/conf/web.xml

6) Deploy the webtop and DA war files. Copy both the war files to the webapps directory

# cp Webtop.war DA.war /documentum/tomcat/webapps

7) Star the Apache Tomcat server using the below command.

# /documentum/tomcat/bin/startup.sh

Note : To stop the tomcat use “/documentum/tomcat/bin/shutdown.sh”

8) Edit the dfc.properties file to mention the repository

# /documentum/tomcat/webapps/webtop/WEB-INF/classes/dfc.properties

dfc.session.max_count=1000

dfc.docbroker.host[0]=server.example.com

dfc.globalregistry.repository=Global

dfc.globalregistry.username=dm_bof_registry

dfc.globalregistry.password=MmKZP8KOlvrE6ndUolyl6Q\=\=

Note: Here “server.example.com” is the server hostname and the “Global” is the repository name.

Windows AD authentication for Linux

noreply@blogger.com (Mugu) — Sun, 22 May 2011 13:08:00 +0000

Windows AD authentication for Linux Clients

Release:

RedHat Enterprise Linux 5

Windows Enterprise Server 2003 R2

Problem:

Need to login linux client using the windows active directory authentication using kerberos and samba winbind.

Solution:

Assumption:

Domain Name : TESTDOM.COM

AD Server IP Address : 192.168.1.60

AD Server Hostname : WIN2K3

Linux Client IP Address : 192.168.1.26

Linux Clinet Hostname : CLIENT

1) Install the required RPMs

# yum install krb5-libs pam_krb5 krb5-workstation samba-common samba-client

2) Add the domain server entry in the host file

# vi /etc/hosts

192.168.1.60 win2k3.testdom.com win2k3

192.168.1.26 client.testdom.com client

3) Mention the name server ipaddress in the resolv.conf file

# vi /etc/resolv.conf

nameserver 192.168.1.60

Configure Kerberos for AD Integration:

4) Modify the /etc/krb5.conf file, to enable the Domain controller authentication in Linux.

# vi /etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = WIN2K3.TESTDOM.COM

dns_lookup_realm = true

dns_lookup_kdc = true

[realms]

TESTDOM.COM = {

kdc = win2k3.testdom.com

admin_server = win2k3.testdom.com:749

default_domain = testdom.com

}

[domain_realm]

.testdom.com = TESTDOM.COM

testdom.com = TESTDOM.COM

[kdc]

profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}

5) PAM needs to be configured to use Active Directory authentication. Edit the system-auth file like below

# vi /etc/pam.d/system-auth

auth required pam_env.so

auth sufficient pam_unix.so nullok try_first_pass

auth requisite pam_succeed_if.so uid >= 500 quiet

auth sufficient pam_winbind.so use_first_pass

auth required pam_deny.so

account required pam_unix.so broken_shadow

account sufficient pam_succeed_if.so uid < 500 quiet

account [default=bad success=ok user_unknown=ignore] pam_winbind.so

account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3

password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

password sufficient pam_winbind.so use_authtok

password required pam_deny.so

session optional pam_keyinit.so revoke

session optional pam_mkhomedir.so skel=/etc/skel/ umask=0077

session required pam_limits.so

session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session required pam_unix.so

Create Users and Group from DC:

6) Add the below entries in /etc/samba/smb.conf file, will cause the winbind service to enumerate users and groups from the domain controller.

# vi /etc/samba/smb.conf

workgroup = TESTDOM

password server = win2k3.testdom.com

server string = Samba Server Version %v

realm = TESTDOM.COM

security = ads

idmap uid = 16777216-33554431

idmap gid = 16777216-33554431

winbind separator = #

winbind enum groups = yes

winbind enum users = yes

template homedir = /home/%U

template shell = /bin/bash

winbind use default domain = true

winbind offline logon = false

Where,

idmap uid - the range of numeric uid's that winbind will use to enumerate domain users with on your system. You should select a range that does not conflict with uid numbers already in use on the system.

idmap gid - the range of numeric gid's that winbind will use to enumerate domain groups on your system.

winbind enum groups and winbind enum users - whether winbind should "create" the domain's groups/users on the system or not.

winbind separator - the character winbind will use to separate the domain name from the user or group name The template homedir statement is used to generate the home directory path for domain users.

realm - is used to describe a Kerberos-based security architecture

template homedir = /home/%U – here %u substituted with the user's Windows NT user name

template shell = /bin/bash – login shell for that user

7) Change the user information and authentication type to winbind using the “authconfig-tui” command

# authconfig-tui

Then Select “Next” and Select “ok”.

8) Restart the winbind service and also configure winbind to start automatically.

# service winbind restart

# chkconfig --level 35 winbind on

9) Join the Domain using the below command

# net ads join -U administrator

10) To test the enumeration function of the winbind use the below commands.

# wbinfo –u

# wbinfo –g

Logrotate in Linux

noreply@blogger.com (Mugu) — Thu, 28 Apr 2011 15:21:00 +0000

Logrotate in Linux

Release:

RedHat Enterprise Linux 5

SUSE Linux Enterprise Server 10

Problem:

Need to rotate the application log in the frequent interval

Solution:

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.

Install the required rpm

# yum install logrotate

Create a Configuration file like the below

# vi /etc/logrotate.d/ibmhttp

/IBM/HTTPServer/logs/access_log {

weekly

rotate 5

compress

missingok

notifempty

sharedscripts

postrotate

/bin/kill -HUP `cat /IBM/HTTPServer/logs/httpd.pid` 2> /dev/null || true

endscript

}

Where,

/IBM/HTTPServer/logs/access_log - Log file location

weekly - This is used to rotate log files weekly (eg: daily, weekly, monthly)

rotate 5 - This specifies the number of times to rotate a file before it is deleted. A count of 0 (zero) means no copies are retained. A count of 5 means five copies are retained.

compress - This is used to compress the rotated log file with gzip

missingok - If the log file is missing, go on to the next one without issuing an error message

notifempty - This does not rotate the log file if it is empty

sharedscripts - Normally, prerotate and postrotate scripts are run for each log which is rotated, meaning that a single script may be run multiple times for log file entries which match multiple files. If sharedscript is specified, the scripts are only run once, no matter how many logs match the wildcarded pattern. However, if none of the logs in the pattern require rotating, the scripts will not be run at all

postrotate to endscript - These are statements that enclose commands to be executed after a log file has been rotated. The postrotate and endscript keywords must appear on a line by themselves.

We can rotate the logs depends on the log size also, using the below option

size size - With this, the log file is rotated when the specified size is reached. Size may be specified in bytes (default), kilobytes (sizek), or megabytes (sizem).

Note: If size and time interval options are specified at same time, only size option take effect. it causes log files to be rotated without regard for the last rotation time. If both log size and timestamp of a log file need to be considered by logrotate, the minsize option should be used. logrotate will rotate log file when they grow bigger than minsize, but not before the additionally specified time interval.

The other options used in the logrotate scripts are listed below

/bin/kill -HUP `cat /IBM/HTTPServer/logs/httpd.pid` 2> /dev/null || true - Reload/HUP: Sending the HUP or restart signal to the parent causes it to kill off its children like in TERM, but the parent doesn't exit. It re-reads its configuration files, and re-opens any log files. Then it spawns a new set of children and continues serving hits.

/bin/kill -USR1 `cat /IBM/HTTPServer/logs/httpd.pid` 2> /dev/null || true - Graceful/USR1: The USR1 or graceful signal causes the parent process to advise the children to exit after their current request (or to exit immediately if they're not serving anything). The parent re-reads its configuration files and re-opens its log files. As each child dies off the parent replaces it with a child from the new generation of the configuration, which begins serving new requests immediately.

maxage count - Remove rotated logs older than days. The age is only checked if the logfile is to be rotated.

nocompress - Old versions of log files are not compressed with gzip.

nocopytruncate - Do not truncate the original log file in place after creating a copy (this overrides the copytruncate option).

copytruncate - Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one.

mail address - When a log is rotated out-of-existence, it is mailed to

Nagios Installation in Linux

noreply@blogger.com (Mugu) — Thu, 24 Mar 2011 18:28:00 +0000

Nagios Installation in Linux

Release:
RedHat Enterprise Linux

Problem:
Install Nagios system monitoring tool in RedHat Enterprise Server.

Solution:

Download the Nagios from the below link

http://www.nagios.org/download

Install the require RPMs

# yum install httpd php

# yum install gcc glibc gd gd-devel

Create a user account to install the nagios

# useradd nagios

# passwd nagios

Create a new group and add both nagios and apache users in that group

# groupadd nagcmd

# usermod -a -G nagcmd nagios

# usermod -a -G nagcmd apache

Compile and install the nagios

# tar zxvf nagios-xxx.tar.gz

# cd nagios-xxx

# ./configure –with-command-group=nagcmd

# make all

# make install

# make install-init

# make install-config

# make install-commandmode

Sample configuration files are available in the below directory

# cd /usr/local/nagios/etc

Customize the below file to send alerts to the mail id

# vi /usr/local/nagios/etc/objects/contacts.cfg

configure the web interface by using the below command

# make install-webconf

Create a login account to login into nagios web interface.

# htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

Note: Here “nagiosadmin” is the user account to login in the web interface.

Restart the httpd service

# service httpd restart

Compile and install the nagios plugins

# tar -zxvf nagois-plugins-xxx.tar.gz

# cd nagios-plugins-xxx

# ./configure –with-nagios-user=nagio –with-nagios-group=nagios

# make

# make install

Add the nagios service to the system service by using the below commands

# chkconfig –add nagios

# chkconfig nagios on

Verify the nagios configuration file and start the service

# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

# service nagios start

Access the nagios web interface by using the below URL.

http://localhost/nagios

NFS Server Configuration in AIX

noreply@blogger.com (Mugu) — Sun, 27 Feb 2011 13:21:00 +0000

NFS Server Configuration in AIX

Release:

AIX 5.3

Problem:

Need to configure the NFS server in AIX 5.3

Solution:

Server Side Configuration:

• First check the nfs server and client filesets are installed or not

# lslpp –L | grep bos.net*

bos.net.nfs.client 5.3.9.1 A F Network File System Client

bos.net.nfs.server 5.3.8.0 C F Network File System Server

• Create a NFS export directory using the mknfsexp command. It will automatically create the exported directory entry in /etc/exports file.

# mknfsexp -d /tmp/test2 -t rw

Note: In this example, the mknfsexp command exports the /tmp/test2 directory with read-write permission.

• Check the /etc/exports file to confirm /tmp/test2 directory is exported or not.

# cat /etc/exports

/tmp/test2 -rw

Note: The purpose of the /etc/exports file is, the server automatically exports the listed directories each time the NFS daemon is started.

• List all the exported directory in the server by using the below command

# showmount –e

export list for Server:

/tmp/test2 (everyone)

• Start the NFS and portmap daemon

# startsrc –g nfs

# startsrc –s

Client Side Configuration:

• Start the NFS and portmap daemon

# startsrc –g nfs

# startsrc –s portmap

• Mount the exported directory using the below command.

# mount server:/tmp/test2 /mnt

Add SSH Service to Xinetd in RHEL

noreply@blogger.com (Mugu) — Sun, 13 Feb 2011 07:24:00 +0000

Add SSH Service to Xinetd in RHEL

Release:

RedHat Enterprise Linux

Problem:

Add the ssh service to xinted in RedHat Enterprise Linux Server.

Solution:

1) First need to check the services file, for weather ssh is defined on port 22 or not.

# grep ssh /etc/services

ssh 22/tcp # SSH Remote Login Protocol

ssh 22/udp # SSH Remote Login Protocol

Note: If not defined means add the above entries in the services file.

2) Create a file ssh inside /etc/xinetd.d directory for add ssh service into xinetd service.

# cd /etc/xinetd.d

# vi ssh

service ssh

{

socket_type = stream

protocol = tcp

wait = no

port = 22

user = root

server = /usr/sbin/sshd

server_args = -i

disable = no

}

Note: Here “Server” indicates, where your openssh installed location.

3) Now restart the xinetd service

# service xinetd restart

4) Now check with netstat command, weather port number is listening or not

# netstat -an | grep 22

tcp 0 0 :::22 :::* LISTEN

Note: Using this we can add any service (like ftp) to the internet service daemon (inetd).

Mount NTFS Partition in RHEL

noreply@blogger.com (Mugu) — Tue, 25 Jan 2011 04:34:00 +0000

Mount NTFS Partition in RHEL

Release:

RedHat Enterprise Linux 5

Problem:

Need to mount the Windows NTFS partition in RHEL 5

Solution:

1) Install the “kernel-module-ntfs” package. Download this package from the below link.

http://sourceforge.net/projects/linux-ntfs/files

Note: Download both rpm and ko file.

2) Load the ntfs module to the kernel, and confirm with lsmod command

# rpm –ivh kernel-module-ntfs-xxxxx.rpm

# insmod kernel-module-ntfs-xxxxx.ko

# lsmod | grep ntfs

3) Download the “ntfs-3g” and “fuse” packages from the below links.

http://www.tuxera.com/community/ntfs-3g-download/

http://sourceforge.net/projects/fuse/files

4) Install the ntfs-3g package by using the below commands

# tar –zxvf ntfs-3g-xxxx.tgz

# cd ntfs-3g-xxxx

# ./configure

# make

# make install

5) Install the fuse package by using the below commands

# tar –zxvf fuse-xxx.tar.gz

# cd fuse-xxx

# ./configure

# make

# make install

# modprobe fuse

6) Now mount the ntfs partition using the below command

# mount –t ntfs-3g /dev/sdb1 /mnt

Note: Here /dev/sdb1 is a windows NTFS partition. Also here usage of fuse version is depend upon the kernel version.

Configure VNC on XINETD with XDMCP

noreply@blogger.com (Mugu) — Thu, 13 Jan 2011 07:36:00 +0000

Configure VNC on XINETD with XDMCP

Release:

RedHat Enterprise Linux 5

Problem:

Need to configure VNC based on xinetd with XDMCP for GDM access

Solution:

1) 1) Install the required packages

# yum install vnc-server xinetd

2) 2) Enable the XDMCP by editing the custom.conf file

# vi /etc/gdm/custom.conf

[xdmcp]

Enable=true

MaxSessions=30

[security]

AllowRemoteRoot=true

DisallowTCP=false

Note: Here “AllowRemoteRoot=true” used to allow root access.

3) 3) Create a file with below content, in inside the /etc/xinetd.d directory

# vi /etc/xinetd.d/xvncserver

service vnc

{

disable = no

protocol = tcp

socket_type = stream

wait = no

user = nobody

server = /usr/bin/Xvnc

server_args = -inetd –query localhost –once –geometry 1024x768 –depth 16 securitytypes=none

}

4) 4) Define the vnc01 service by edit the /etc/services file

# vi /etc/services

vnc 5950/tcp

5) 5) Restart the xinetd and gdm services

# service xinetd restart

# gdm-restart

6) 6) Test using the vncviwer command

# vncviewer localhost:5950

7) To connect from the remote system use the below one

# vncviewer IPADDRESS:5950

Enable XDMCP in Linux

noreply@blogger.com (Mugu) — Wed, 05 Jan 2011 05:42:00 +0000

Enable XDMCP in Linux

Release:

RedHat Enterprise Linux 5

SUSE Linux 10

Problem:

Need to enable the xdmcp protocol in the Linux server for getting remote using XBrowser.

Solution:

In RHEL Server:

1) Install the gdm package

# yum install gdm

2) Enable the xdmcp protocol by adding the below entries in the custom.conf file.

# vi /etc/gdm/custom.conf

[security]

AllowRemoteRoot=true

DisallowTCP=false

[xdmcp]

Enable=true

Note: Here “AllowRemoteRoot=true” used to allow root access.

3) Restart the gdm service

# gdm-restart

4) Check weather xdmcp port is opened or not, using netstat command

# netstat –an | grep 177

udp 0 0 0.0.0.0:177 0.0.0.0:*

In SUSE Server:

5) Install the required 2 packages

# yum install gdm xorg-x11

6) Set the default display manager by editing the displaymanager file

# vi /etc/sysconfig/displaymanager

DISPLAYMANAGER="gdm"

DISPLAYMANAGER_REMOTE_ACCESS="yes"

7) Enable the xdmcp protocol by editing the gdm.conf file

# vi /etc/opt/gnome/gdm/gdm.conf

[security]

AllowRoot=true

AllowRemoteRoot=true

[xdmcp]

Enable=true

8) To make xdmcp listening on xdm by edit the xdm-config file

# vi /etc/X11/xdm/xdm-config

!DisplayManager.requestPort: 0

Note: Comment out this line for xdmcp listen on xdm

9) Restart the service and check with netstat

# rcxdm restart

# netstat –an | grep 177

udp 0 0 0.0.0.0:177 0.0.0.0:*

10) Verify from the Windows client using Xbrowser as root.

Install NVIDIA Drivers in XEN Kernel

noreply@blogger.com (Mugu) — Sat, 25 Dec 2010 08:26:00 +0000

Install NVIDIA Drivers in XEN Kernel

Release:

RedHat Enterprise Linux

Problem:

Need to install Nvidia drivers in XEN Kernel

Solution:

1)Boot the Server to Runlevel 3

# init 3

2)Now copy the Nvidia driver to /tmp directory

# cp /mnt/NVIDIA-Linux-xxx-pkg2.run /tmp

3)Now extract the bin file and add modify to use the XEN kernel

# cd /tmp

# ./NVIDIA-Linux-xxx-pkg2.run extract-only

# cd NVIDIA-Linux-xxx-pkg2/usr/src/nv

# IGNORE_XEN_PRESENCE=y make SYSSRC=/lib/modules/`uname -r`/build module

Note: Will get lot of Warnings, but end with NVIDIA: left KBUILD

4)Now load the new driver to the xen kernel library

# cp -i nvidia.ko /lib/modules/`uname -r`/kernel/drivers/video/nvidia

# depmod -a

# modprobe nvidia

5)Now check with lsmod weather nvidia driver is loaded or not

# lsmod | grep nvidia

6)Reboot the server and boot the server with nonxen kernel

# shutdown -r now

7)Now install the nvidia driver

# cd /tmp

# sh NVIDIA-Linux-xxx-pkg2.run

8)Allow system to rewrite the “xorg.conf” file

9)Now reboot the server and boot to the xen kernel and check.

Add Verisign Trail Certificate to Tomcat Server

noreply@blogger.com (Mugu) — Thu, 16 Dec 2010 05:34:00 +0000

Add Verisign Trail Certificate to Tomcat Server

Release:

Apache Tomcat 5.5

Windows Enterprise Server 2003

JDK 1.3.1 or later

Problem:

Need to add Verisign Trial Certificate to Apache Tomcat Server

Solution:

Creating the CSR file:

Create a certificate keystore and private key by executing the below command

C:\Program Files\Java\jre1.5.0_12\bin>keytool -genkey -alias tomcat -keyalg RSA -keystore C:\keystore -keysize 2048

Enter keystore password: sbs@123

What is your first and last name?

[Unknown]: YOUR DOMAIN NAME

What is the name of your organizational unit?

[Unknown]: YOUR ORGANIZATION NAME

What is the name of your organization?

[Unknown]: YOUR ORGANIZATION NAME

What is the name of your City or Locality?

[Unknown]: CHENNAI

What is the name of your State or Province?

[Unknown]: TAMILNADU

What is the two-letter country code for this unit?

[Unknown]: IN

Is CN= DOMAIN NAME, OU= ORGANIZATION NAME, O= ORGANIZATION NAME, L=CHENNAI, ST=TAMILNADU, C=IN correct?

[no]: YES

Enter key password for

(RETURN if same as keystore password): sbs@123

Create a CSR (Certificate Signing Request) using the below command

C:\Program Files\Java\jre1.5.0_12\bin>keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore c:\keystore

Enter keystore password: sbs@123

Note: The above command create a file in C drive in a name “certreq.csr”.

Enroll the CSR file:

To verify the CSR go to the below link and check the status

https://ssl-tools.verisign.com/checker/

First time to start the enrollment go to the below link and create an account. If you have a login id, login to your account and submit the CSR to Verisign.

https://www.verisign.com/ssl/buy-ssl-certificates/index.html

Install CA Certificate:

After submitting your CSR, Verisign will send one mail with the original certificate.

Copy the Primary Intermediate CA from the below link and save it in a notepad as “primary_inter.cer”, also import this to keystore

http://www.verisign.com/support/verisign-intermediate-ca/Trial_Secure_Server_Root/index.html

C:\Program Files\Java\jre1.5.0_12\bin>keytool -import -trustcacerts -alias root -keystore c:\keystore -file c:\primary_inter.cer

Copy the Secondary Intermediate CA from the below link and save it in a notepad as “secondary_inter.cer”, also import this to keystore

http://www.verisign.com/support/verisign-intermediate-ca/trial-secure-server-intermediate/index.html

C:\Program Files\Java\jre1.5.0_12\bin>keytool -import -trustcacerts -alias intermediate t -keystore c:\keystore -file c:\secondary_inter.cer

Install the SSL Certificate:

Copy and paste the Verisign send certificate to a notepad and save the file as “cert.cer”, also import the SSL Certificates

C:\Program Files\Java\jre1.5.0_12\bin>keytool -import –alias tomcat -keystore c:\keystore -trustcacerts -file c:\cert.cer

Edit server.xml to enable SSL in tomcat 5.5:

Open the server.xml using the notepad ( location: C:\Program Files\Apache Software Foundation\Tomcat 5.5\conf ) and edit the below

port="80" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" redirectPort="443" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" />

maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="c:\keystore" keystorePass="sbs@123"/>

Now restart the Tomcat application from “Services” ( Run → services.msc ) and check the application.

Configure SFTP Server using chroot jail in Linux

noreply@blogger.com (Mugu) — Thu, 09 Dec 2010 19:22:00 +0000

Configure SFTP Server using chroot jail in Linux

Release:

RedHat Enterprise Linux

Openssh 5.6P1

Problem:

Configure the sftp-server on a per-user-basis (restrict users to their individual home directory) using chroot() jail in RedHat Enterprise Linux

Solution:

1) Install the OpenSSH latest version that must support the chroot() function

2) Configure Openssh to use its internal sftp subsystem by editing the sshd_config file

# vi /etc/ssh/sshd_config

Replace

Subsystem sftp /usr/local/libexec/sftp-server

Subsystem sftp internal-sftp

3) Now configure the chroot() by using match rule, add the below entries in the end of the sshd_config file

# vi /etc/ssh/sshd_config

Match group sftponly

ChrootDirectory /home/%u

X11Forwarding no

AllowTcpForwarding no

ForceCommand internal-sftp

Note: Here %u represents username, that means all the users in the sftponly group home directories are chrooted. Also chroot directory must be owned by root.

4) Add one new group named as sftponly

# groupadd sftponly

5) Create a new user to use retricted sftp. First create a user's home directory after that add the user

# mkdir /home/test

# useradd -g sftponly test

# usermod -d / test

Note: In here, create a home directory as a root user, while adding the user one warning comes like this, "useradd: warning: the home directory already exists"

6) Now test the configuration from client side

[root@server Desktop]# sftp test@192.168.1.7

Connecting to 192.168.1.7...

test@192.168.1.7's password:

sftp> ls

sftp> cd IN

sftp> ls

sftp> mput 1.png

Uploading 1.png to /IN/1.png

1.png 100% 90KB 90.4KB/s 00:00

sftp> ls

1.png

sftp> bye

7) Test the SFTP-Server function from the windows client use the “WinSCP” or “Filezilla”