GEO'S VIEWS

Disable Gmail spam filter

2013-08-22T18:41:00.001+05:30

When using Gmail App its a common problem in whcih legitimate mails/forwarded mail etc are going to SPAM folder. By this when using email clients, as anything caught by Gmail as SPAM is never downloaded and seen by the client.

In Gmail there is no setting to turn it off the only option is creating email filter to pass mails to inbox: You can do the folling steps:

Log into Gmail . Go to Settings>>Filters, and click on "Create a new filter." In the "Has the words" field, enter "is:spam"

After clicking on "Create filter with this search," continue to the next step by clicking "OK." You can Ignore the warning.

Choose the "Never send it to Spam" option, then click on "Create filter."

This filter will allow all emails to hit the Inbox; Gmail's spam filter is rendered useless by this process, so your email client will have to take care of the incoming junk mail.

Reference

Setting Up Percona-xtrabackup

2013-01-31T14:05:00.004+05:30

Percona XtraBackup is the world's only open-source, free MySQL hot backup software that performs non-blocking backups for InnoDB and XtraDB databases. With Percona XtraBackup, you can achieve the following benefits:

Backups that complete quickly and reliably
Uninterrupted transaction processing during backups
Savings on disk space and network bandwidth
Automatic backup verification
Higher uptime due to faster restore time

Ref:

Installation:

wget http://www.percona.com/redir/downloads/XtraBackup/XtraBackup-2.0.3/binary/Linux/x86_64/percona-xtrabackup-2.0.3-470.tar.gz

tar -zxvf percona-xtrabackup-2.0.3-470.tar.gz

cd percona-xtrabackup-2.0.3/bin

sudo cp * /usr/bin

Setting Up Percona-mysql-server

2013-01-31T14:04:00.000+05:30

Percona apt Repository is not included in Base Ubuntu. So need to install it

sudo gpg --keyserver hkp://keys.gnupg.net --recv-keys 1C4CBDCDCD2EFD2A
sudo gpg -a --export CD2EFD2A | sudo apt-key add -

Add this to /etc/apt/sources.list, replacing VERSION with the name of your distribution:

deb http://repo.percona.com/apt precise main
deb-src http://repo.percona.com/apt precise main
apt-get update
apt-get install percona-server-server-5.5 percona-server-client-5.5

Ref:http://www.percona.com/doc/percona-server/5.5/installation/apt_repo.html
Ref:http://www.percona.com/doc/percona-server/5.5/installation.html

We can generate initial mysql configuration file (my.cnf) through the following link
https://tools.percona.com/wizard

VirtualBox Clone Root HD / Ubuntu / Network issue

2013-01-31T14:02:00.006+05:30

When you clone a root Ubuntu disk in VirtualBox, one thing that gets messed up is the network card definition. This is because Ubuntu (as it should) uses UDEV IDs for the network device. When you boot your new disk, the network device ID has changed, so it creates a new eth1 device. Unfortunately, this conflicts with the VirtualBox network setup. What to do?

Boot the box (no network)

Edit the /etc/udev/rules.d/70-persistent-net.rules

Delete the eth0 line and modify the eth1 line to be eth0

--------- Example OLD -----------

# This file was automatically generated by the /lib/udev/write_net_rules# program, run by the persistent-net-generator.rules rules file.## You can modify it, as long as you keep each rule on a single# line, and change only the value of the NAME= key.

# PCI device 0x8086:0x100e (e1000) <-------------------- br="" delete="" lines="" these="" two="">SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:d8:8d:15", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

# PCI device 0x8086:0x100e (e1000) ---Modify the next line and change eth1 to be eth0
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:89:84:98", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

----------------------------------------

--------- Example NEW -----------

# This file was automatically generated by the /lib/udev/write_net_rules# program, run by the persistent-net-generator.rules rules file.## You can modify it, as long as you keep each rule on a single# line, and change only the value of the NAME= key.

# PCI device 0x8086:0x100e (e1000)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:89:84:98", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

----------------------------------------
Reference:

Image cache issue in drupal with nginx

2013-01-31T14:00:00.002+05:30

Resolved it by adding the following in nginx virtual host file:

    location ^~ /sites/default/files/imagecache/ {
            index index.php index.html;

            if (!-e $request_filename) {
                rewrite ^/(.*)$ /index.php?q=$1 last;
                break;
            }
        }

The above assumes that your imagecache files are to be stored in sites/default/files/imagecache
Instead of nginx serving the static content (the jpeg or png or whatever) to the browser it will instead rewrite the path to (invisibly): index.php?q=sites/default/files...
This allows imagecache to run its manipulations on the file.
Just make sure you alter the location directive to match whatever path your imagecache files are in (relative to site root) and you should be fine.

Reference:

How To Delete/Remove Blocked IP From DenyHosts

2012-08-16T10:18:00.003+05:30

1. First you need to stop Denyhosts service, by following command.

[root@geopc ~]# /etc/init.d/denyhosts stop

2. Next open file /etc/hosts.deny with below command.

[root@geopc ~]# vi /etc/hosts.deny

3. Delete blocked IP address, then save and close above file.

4. Now go to directory called /usr/share/denyhosts/data or /var/lib/denyhosts/

[root@geopc ~]# cd /usr/share/denyhosts/data

5. Next you need to delete blocked IP from all below following files with help of vi editor.

[root@geopc ~]# vi hosts
[root@geopc ~]# vi hosts-restricted
[root@geopc ~]# vi hosts-root
[root@geopc ~]# vi hosts-valid
[root@geopc ~]# vi users-hosts

6. Once you removed your blocked IP from all above files, then start Denyhosts service.

[root@geopc data]# /etc/init.d/denyhosts start

Connecting to a MySQL server from a different server

2012-07-26T09:57:00.000+05:30

Connecting to a MySQL server from a different domain

Step # 1: Login Using SSH (if server is outside your data center)

First, login over ssh to remote MySQL database server:

Step # 2: Edit my.cnf File

Once connected you need to edit the MySQL server configuration file my.cnf using a text editor such as vi.

If you are using Debian Linux file is located at /etc/mysql/my.cnf location
If you are using Red Hat Linux/Fedora/Centos Linux file is located at /etc/my.cnf location
If you are using FreeBSD you need to create a file /var/db/mysql/my.cnf

Edit /etc/my.cnf, run:
# vi /etc/my.cnf

Step # 3: Once file opened, locate line that read as follows

[mysqld]

Make sure line skip-networking is commented (or remove line) and add following line

bind-address=YOUR-SERVER-IP

For example, if your MySQL server IP is 65.55.55.2 then entire block should be look like as follows:

[mysqld]
user            = mysql
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
port            = 3306
basedir         = /usr
datadir         = /var/lib/mysql
tmpdir          = /tmp
language        = /usr/share/mysql/English
bind-address    = 65.55.55.2
# skip-networking
....
..
....

Where,

bind-address : IP address to bind to.
skip-networking : Don’t listen for TCP/IP connections at all. All interaction with mysqld must be made via Unix sockets. This option is highly recommended for systems where only local requests are allowed. Since you need to allow remote connection this line should be removed from my.cnf or put it in comment state.

Step# 4 Save and Close the file

If you are using Debian / Ubuntu Linux, type the following command to restart the mysql server:
# /etc/init.d/mysql restart
If you are using RHEL / CentOS / Fedora / Scientific Linux, type the following command to restart the mysql server:
# /etc/init.d/mysqld restart
If you are using FreeBSD, type the following command to restart the mysql server:

# /usr/local/etc/rc.d/mysql-server stop
# /usr/local/etc/rc.d/mysql-server start

OR
# /usr/local/etc/rc.d/mysql-server restart

Step # 5 Grant access to remote IP address

Connect to mysql server:
$ mysql -u root -p mysql

Grant access to a new database

If you want to add a new database called foo for user bar and remote IP 202.54.10.20 then you need to type the following commands at mysql> prompt:

mysql> CREATE DATABASE foo;
mysql> GRANT ALL ON foo.* TO bar@'202.51.10.20' IDENTIFIED BY 'PASSWORD';

How Do I Grant Access To An Existing Database?

Let us assume that you are always making connection from remote IP called 202.54.10.20 for database called webdb for user webadmin, To grant access to this IP address type the following command At mysql> prompt for existing database, enter:

mysql> update db set Host='202.54.10.20' where Db='webdb';
mysql> update user set Host='202.54.10.20' where user='webadmin';

Step # 6: Logout of MySQL

Type exit command to logout mysql:mysql> exit

Step # 7: Open port 3306

You need to open TCP port 3306 using iptables or BSD pf firewall.

A sample iptables rule to open Linux iptables firewall

/sbin/iptables -A INPUT -i eth0 -p tcp --destination-port 3306 -j ACCEPT

OR only allow remote connection from your web server located at 10.5.1.3:

/sbin/iptables -A INPUT -i eth0 -s 10.5.1.3 -p tcp --destination-port 3306 -j ACCEPT

OR only allow remote connection from your lan subnet 192.168.1.0/24:

/sbin/iptables -A INPUT -i eth0 -s 192.168.1.0/24 -p tcp --destination-port 3306 -j ACCEPT

Finally save all rules (RHEL / CentOS specific command):
# service iptables save

A sample FreeBSD / OpenBSD pf rule ( /etc/pf.conf)

pass in on $ext_if proto tcp from any to any port 3306

OR allow only access from your web server located at 10.5.1.3:

pass in on $ext_if proto tcp from 10.5.1.3 to any port 3306  flags S/SA synproxy state

Step # 8: Test it

From your remote system or your desktop type the following command:
$ mysql -u webadmin –h 65.55.55.2 –p
Where,

-u webadmin: webadmin is MySQL username
-h IP or hostname: 65.55.55.2 is MySQL server IP address or hostname (FQDN)
-p : Prompt for password

You can also use the telnet or nc command to connect to port 3306 for testing purpose:
$ echo X | telnet -e X 65.55.55.2 3306
OR
$ nc -z -w1 65.55.55.2 3306
Sample outputs:

Connection to 65.55.55.2 3306 port [tcp/mysql] succeeded!

Access Your MySQL Server Remotely Over SSH

2012-04-18T10:30:00.000+05:30

Access Your MySQL Server Remotely Over SSH

So you’ve got MySQL on your web server, but it’s only opened to local ports by default for security reasons. If you want to access your database from a client tool like the MySQL Query Browser, normally you’d have to open up access from your local IP address… but that’s not nearly as secure.

So instead, we’ll just use port-forwarding through an SSH tunnel, so your MySQL client thinks it’s connecting to your localhost machine, but it’s really connecting to the other server through the tunnel.

You will need the following software:

Putty:
You can download putty from the url: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Run the downloaded putty.exe file. You will get a window like this and enter the Hostname or IP Address.

For eg:
Hostname or IP Address: 10.5.7.51

Now click open

You will get a session and for saving that session right click on windows and take Change Settings as shown below:

Below Saved Sessions enter any name for eg: mysql-ssh and click on save.

Now again take putty and click on whichever connection name you wish to use for the secure tunnel.

Click "Load"
Go to Connection > SSH > Tunnels

Enter MySQL connection information

The "Source port" is the local port your MySQL Administrator will connect to instead of the remote (server) port it normally would. This can be any port and we can use .
The "Desitination" is the address and port of your actual MySQL Server. But since your SSH connection will be considered "local" to your MySQL Server, you should use either "127.0.0.1" or "localhost" depending on what works best. Then specify your mysql port so that Destination will be as follows:

127.0.0.1:3306

Make sure the information in "Source port" and "Destination" are correct, that the "Local" radio button is selected and click "Add".

You should now see the new tunnel information displayed as shown.

Go back to the main Putty screen and save the connection.

Now you can open ssh session by entering the user name and password.

Once you’ve got the ssh tunnel going, you can open up any mysql client and enter in the details for your remote server.

Since your connection will now be through the secure tunnel created by Putty, your "Server Host" will now be local so use "127.0.0.1".

The "Port" should be set to the same port you set for Source port earlier.

Once the connection settings are correct, click "OK" and you should then be able to succesfully connect to your MySQL server except now, through a secure tunnel!

SSH Key Generation and its Fingerprint Verification

2012-04-05T12:05:00.002+05:30

SSH Key Generation and its Fingerprint.

Generate a new SSH key.

To generate a new SSH key, enter the code below. We want the default settings so when asked to enter a file in which to save the key, just press enter.

$ ssh-keygen -t rsa -C "your_email@youremail.com"

Creates a new ssh key using the provided email
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/your_user_directory/.ssh/id_rsa):

Now you need to enter a passphrase.

To view the fingerprint of the ssh host key

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key

Apache Tomcat Installation and SSL Configuration

2012-04-05T12:04:00.002+05:30

You can see/download latest versions of tomcat from the url: http://tomcat.apache.org/whichversion.html

To download and install Apache Tomcat version 7.0.26

cd /opt
wget http://apache.petsads.us/tomcat/tomcat-7/v7.0.26/bin/apache-tomcat-7.0.26.tar.gz
tar -xvf apache-tomcat-7.0.26.tar.gz /opt

Now set variables in server.

vi /root/.bashrc

Copy and paste below lines:

> export CATALINA_HOME=/opt/apache-tomcat-7.0.26

> export TOMCAT_HOME=$CATALINA_HOME

> export PATH=$CATALINA_HOME/bin:$PATH

Logout and Login to server.

**Configure SSL for tomcat**

Use below command to create the keystore and while creating use hostname for "first and last name"

keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/keystore

Edit server.xml file and uncommented/edited these lines:

Note: change password as while you are creating the keystore

Restart tomcat

catalina.sh stop
catalina.sh start

Some useful commands to Manage/Monitor Servers

2012-04-05T11:48:00.001+05:30

These commands are mainly for rpm based linux servers like CentOS etc.. May be some commands works in ubuntu servers etc...

Command to find out total established connections, closing connection, TIME_WAIT and much more.

netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n

Sample Output:

1 established
1 Foreign
5 LISTEN
16 TIME_WAIT
19 ESTABLISHED

Dig out more information about a specific ip address

netstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n

2 LISTEN
4 FIN_WAIT1
4 ESTABLISHED
7 TIME_WAIT

To print list of all unique IP address connected to server, enter:

netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq

To print total of all unique IP address, enter:

netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l

Find Out If Box is Under DoS Attack or Not

If you think your Linux box is under attack, print out a list of open connections on your box and sorts them by according to IP address, enter:

netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n

Command to list the connections to port 80:

netstat -alntp | grep :80

To check the number of connections to port 80:

netstat -alntp | grep :80 | wc -l

Command To Find Out Top 10 CPU Consuming Process

ps -auxf | sort -nr -k 3 | head -10

Command To Find Out The Top 10 Memory Consuming Process

ps -auxf | sort -nr -k 4 | head -10

An useful command to list connections to a particular port with its proccess id.

For eg: Port 8080

lsof -w -n -i tcp:8080

Command to remove a running process.
For eg: a proccess with PID 8457

kill -9 8457

Linux Screen Command

Steps

- Create a screen using the command

screen -S geopc

- Close the shell without logout

- Open a new shell and type

screen -ls

Sample Output:

There are screens on:
16921.joemon (Dead ???)
3981.name (Attached)
5002.geopc (Attached)
Remove dead screens with 'screen -wipe'.
3 Sockets in /tmp/screens/S-root.

- You can login to that screen using the command screen -r 'screen name'

screen -r 5002.geopc

To attach a scree that is already attached with the following command:

screen -x -R

You can add your commands as comments!... :)

Setting up Apache Tomcat to work with Apache Server

2012-04-05T11:37:00.000+05:30

We are using **mod_jk** Tomcat-Apache plug-in that handles the communication between Tomcat and Apache.

Install the GNU compilers gcc and g++, make utility to maintain groups of programs and httpd-devel package with the following command in rpm based linux.

yum install gcc* gcc-c++ make automake httpd-devel

Installation and configuration

Ensure Apache HTTP Server is not running

/etc/init.d/httpd stop

Download and extract Tomcat Connector to the following under /root

cd /root/
wget http://mirrors.kahuki.com/apache//tomcat/tomcat-connectors/jk/tomcat-connectors-1.2.32-src.tar.gz
tar -xvf tomcat-connectors-1.2.32-src.tar.gz
cd /root/tomcat-connectors-1.2.32-src/native/

Build and install with the following command

./configure --with-apxs=/usr/sbin/apxs; make; make install

Change permission of loaded module mod_jk.so

chmod 755 /usr/lib64/httpd/modules/mod_jk.so

Create mod_jk.conf file in apache httpd server.

vi /etc/httpd/conf.d/mod_jk.conf

Copy and paste below lines.

LoadModule jk_module "/usr/lib64/httpd/modules/mod_jk.so"

JkWorkersFile "/opt/apache-tomcat-6.0.20/conf/jk/workers.properties"
JkLogFile "/opt/apache-tomcat-6.0.20/logs/mod_jk.log"

JkLogLevel emerg

Open workers.properties file in apache tomcat.

vi /opt/tomcat/conf/jk/workers.properties

Add ajp13 to workers.list so that the following line becomes:

worker.list=jk-status, ajp13

In mod_jk.conf and ssl.conf use mod_jk's JkMount directive to assign specific URLs to Tomcat. For example the following directives will send all requests beginning with /idp to the "ajp13" worker.

Open mod_jk.conf in apache server.

vi /etc/httpd/conf.d/mod_jk.conf

Copy and paste below lines at the end of file.

JkMount /idp ajp13
JkMount /idp/* ajp13

Now open ssl.conf file to setup redirection for secure connection

vi /etc/httpd/conf.d/ssl.conf

Configure mod_ssl by adding the following lines near the end, just before the closing .

JkMount /idp ajp13
JkMount /idp/* ajp13

Restart tomcat and apache

catalina.sh stop
catalina.sh start
/etc/init.d/httpd restart

Thats all!...

The main advantage of this is you need to open only port of apache in firewall.

Apache Maven Installation and Configuration

2012-04-05T11:30:00.000+05:30

Apache Maven Installation and Configuration

You can see/download latest versions of tomcat from the url: http://maven.apache.org/download.html

To download and install Apache Maven-2.2.1

cd /opt
wget http://apache.mirrors.redwire.net//maven/binaries/apache-maven-2.2.1-bin.tar.gz
tar -xvf apache-maven-2.2.1-bin.tar.gz

Now set variables in server.

vi /root/.bashrc

Copy and paste below lines:

> export MVN_HOME=/opt/apache-maven-2.2.1

> export PATH=$MVN_HOME/bin:$PATH

Logout and Login to server.

Installation of JAVA

2012-04-05T10:53:00.002+05:30

Java

You can down load Java from the url: http://www.oracle.com/technetwork/java/javase/downloads/jdk-6u31-download-1501634.html

or for a linux with 62 bit OS

wget http://download.oracle.com/otn-pub/java/jdk/6u31-b04/jdk-6u31-linux-x64.bin

Now install java as follows:

mkdir cd /usr/java/
mv jdk-6u31-linux-x64.bin /usr/java/
cd /usr/java
chmod +x jdk-6u31-linux-x64.bin
./jdk-6u31-linux-x64.bin

Now set java variables in server.

vi /root/.bashrc

Copy and paste below lines:

> export JAVA_HOME=/usr/java/jdk1.6.0_29
> export PATH=$JAVA_HOME/bin:$PATH

Logout and Login again.

html to pdf conversion in Linux

2012-04-05T10:50:00.000+05:30

To convert html page or an url to pdf, we can use wkhtmltopdf on a linux machine.

Downloaded the relevant static binary v0.10.0 from here: http://code.google.com/p/wkhtmltopdf/downloads/list

via ssh on my shared host typed the following:

wget {relavant url to binary from link above}
tar -xvf {filename of above wget'd file}

For eg: for a 64 bit OS

wget http://wkhtmltopdf.googlecode.com/files/wkhtmltopdf-0.9.9-static-amd64.tar.bz2
tar -jxvf wkhtmltopdf-0.9.9-static-amd64.tar.bz2
cp -rv wkhtmltopdf-amd64 /usr/local/bin/

Now you can convert pages as follows:

wkhtmltopdf-amd64 http://www.google.com google.pdf

Managing .git file size

2012-03-06T11:42:00.001+05:30

Managing .git file size

While using the main problem we will be facing is large size of .git folder inside your repository. Follow below commands from your repository for the best way to cut down the size with out effecting the commit history:

# git reflog expire --expire=0 –all
# git repack –ad
# git prune
# git gc

Reflog is a mechanism to record when the tip of branches are updated. This command is to manage the information recorded in it. The subcommand "expire" is used to prune older reflog entries. Entries older than expire time, or entries older than expire-unreachable time and not reachable from the current tip, are removed from the reflog.

Repack is used to combine all objects that do not currently reside in a "pack", into a pack. It can also be used to re-organize existing packs into a single, more efficient pack.A pack is a collection of objects, individually compressed, with delta compression applied, stored in a single file, with an associated index file.Packs are used to reduce the load on mirror systems, backup engines, disk storage, etc.

Prune - Prune all unreachable objects from the object database.

GC Cleanup unnecessary files and optimize the local repository.

Downgrading PHP Versions in Linux

2012-02-22T10:56:00.000+05:30

Downgrading PHP Versions in Centos/Redhat using Yum.

First you need to install allow downgrade option for Yum using the command:
# yum install yum-allowdowngrade

Configure yum.conf to include the following line “showdupesfromrepos=1” and the location of file is /etc/yum.conf
# vi /etc/yum.conf
Add the below line to this file.
showdupesfromrepos=1

Remove the current php package using the command:
# yum remove php*

Now List avaliable php packages using the command:
# yum list php

Now install the required version of php and required modules as follows (as an eg for php version 5.3.10):

# yum --allow-downgrade install php-5.3*
# yum --allow-downgrade install php-mbstring-5.3.10 php-mysql-5.3.10
# yum --allow-downgrade install php-gd-5.3.10
# yum --allow-downgrade install php-cli-5.3.10
# yum --allow-downgrade install php-mcrypt-5.3.10 php-standard-5.3.10 php-wddx-5.3.10 php-reader-5.3.10

I refered this link: http://almamunbd.blogspot.com/2010/01/downgrading-php-53-to-php-52-using-yum.html

Alfresco (catalina.sh) Not starting at startup in Linux Server.

2011-12-27T11:51:00.001+05:30

Our company using Alfresco and it has been installed through SVN. We are using the command catalina.sh start to start the alfresco. Our alfresco server is CentOS release 5.5 .

We need to manually start the alfresco on every reboot and it is very tedious.

To fix this issue we need to place the command (/opt/apache-tomcat-6.0.20/bin/catalina.sh start ) and the environment variables in system startup file (/etc/rc.d/rc.local) .

In our case we follow these steps:

vi /root/alfrescostart.sh

Copy and paste the below lines:
####################################################################################

export JAVA_OPTS="-Xmx1024M -XX:MaxPermSize=512M -Dcom.sun.management.jmxremote -Dalfresco.home=."
export JAVA_HOME=/usr/java/jdk1.6.0_29
export MVN_HOME=/opt/apache-maven-2.2.1
export ANT_HOME=/opt/apache-ant-1.8.2
export CATALINA_HOME=/opt/apache-tomcat-6.0.20
export TOMCAT_HOME=$CATALINA_HOME
export APP_TOMCAT_HOME=$CATALINA_HOME
export PATH=$JAVA_HOME/bin:$CATALINA_HOME/bin:$MVN_HOME/bin:$ANT_HOME/bin:$PATH
#Command to Start the catalina at startup
/opt/apache-tomcat-6.0.20/bin/catalina.sh start

####################################################################################

chmod +x /root/alfrescostart.sh

Add the line “/root/alfrescostart.sh” line in /etc/rc.d/rc.local

Thats all!....

Drupal Integration with CAS for SSO

2011-12-15T12:11:00.001+05:30

Drupal Integration with CAS for SSO

Step 1:

Requirements
============
PHP 5 with the following modules:
curl, openssl, dom, zlib, and xml

Download phpCAS from https://wiki.jasig.org/display/CASC/phpCAS
phpCAS version 1.0.0 or later.

There are several locations you can install the phpCAS library.

1. Module directory installation. This means installing the library folder
under the moduels directory, so that the file
sites//modules/cas/CAS/CAS.php exists.

2. System wide installation. See the phpCAS installation guide, currently at
https://wiki.jasig.org/display/CASC/phpCAS+installation+guide

3. Libraries API installation. Install and enable the Libraries API module,
available at http://drupal.org/project/libraries. Then extract phpCAS so
that sites//libraries/CAS/CAS.php exists. For example:
$ cd sites/all/libraries
$ curl http://downloads.jasig.org/cas-clients/php/current.tgz | tar xz
$ mv CAS-* CAS

Step 2:

Download respective CAS Module from the link: http://drupal.org/project/cas

Place the cas folder in your Drupal modules directory.

Step 3:

Configuring CAS

Navigate to the CAS module configuration page at
Admin >> Users >> CAS Settings (D6)
Admin >> Configuration >> People >> CAS settings (D7)
Library (phpCAS)

If phpCAS has been successfully installed, the version number of phpCAS will be displayed. Otherwise information is provided to help you install and configure phpCAS.
CAS Server

Enter in the CAS server location. For example, if the CAS server is at https://www.example.com/cas, enter
Hostname or IP Address: www.example.com
Port: 443
URI: /cas

For extra security, you may also provide the PEM Certificate of the Certificate Authority which issued the certificate of the CAS server.
Login Form

These settings control how users may log into CAS using the user login form, either as displayed in a block or at user/login. Many installations will choose "Add link to login forms" or "Make CAS login default on login forms."

Additionally, the phrases used on the login forms may be customized for your particular brand.
User Accounts

Each CAS user must have a Drupal account before they can log in. By default, the administrator must create the account and then assign the CAS username to the account.

Selecting "Automatically create Drupal accounts" allows the administrator to skip pre-creating Drupal accounts and instead have Drupal accounts automatically be created when a CAS user first logs in.

By default, the Drupal account will be created with a bare minimum of information:
Name: CAS username
E-mail: empty
Roles: authenticated user
Password: A random string which is not displayed to the user

The e-mail address field may be populated if the e-mail addresses follow a predictable pattern based upon the CAS username — for example username@example.com.

Additional roles may also be assigned to all CAS users. These roles will be reassigned every time a CAS user logs in. Deselecting an option will not take away that role from any existing user.

The "Users cannot change email address" and "Users cannot change password" options control the user edit form when a user has logged in with CAS.
Redirection

The "Check with the CAS server to see if the user is already logged in?" option implements the Gateway feature of the CAS protocol. When a user visit the site, they will be redirected to the CAS Server with the parameter gateway=true. If the user is already authenticated with the CAS server, they will be automatically logged in. If not, they will be silently redirected back to the Drupal site without being prompted for their password. This check is performed only once for users with cookies enabled. Beware: there might be some negative interactions with this feature and various caching configurations.

The "Require CAS login for" options prompt for CAS authentication for anonymous users when visiting the specified pages. Users already authenticated with Drupal, even if they did not log in with CAS, will not be redirected to the CAS login server.

For example, when configuring CAS with OpenScholar, one could add site/register to the list of pages to require CAS login for.
Login/Logout Destinations

You may configure a special page for users to be redirected to the first time they log in to the CAS site. For example, you may wish to write an introductory page which all users should be required to see once. Or as above you may wish for users to be redirected to site/register in an OpenScholar installation.

A logout destination may be provided if you want your users to be directed to a certain page when they log out of CAS. This is not the CAS server's URL, but rather a page on your site you would like the users to be directed to by the CAS server.

Users are redirected to the "Change password URL," if provided, when they visit user/password ("Request a new password").

Users are redirected to the "Registration URL," if provided, when they visit user/register ("Create a new account").

Note:

In Drupal 6.16 or Version below 6.22. CAS will not work properly. You will get an error in server error log as follows:

PHP Fatal error: Call to undefined function user_login_destination() in ../modules/cas/cas.module

To fix this error:

Add a customized form module in ../sites/all/modules/
For eg: ../sites/all/modules/sample_forms.module

Now paste the below lines in sample_forms.module
#######################################################
function user_login_destination() {
$destination = drupal_get_destination();
return $destination == 'destination=user%2Flogin' ? 'destination=user' : $destination;
}
#######################################################

MySQL Replication cluster

2011-11-23T17:27:00.001+05:30

MySQL Replication cluster

This guide is designed to help do the initial setup on a MySQL cluster in which multiple MySQL servers all serve the same content through the use of the replication function. We have successfully deployed this solution for multiple clients and it is a very good option for those needing a more powerful mysql solution.

Be sure your mysql servers are running the same version before starting this guide, yes, is possible to have a few combinations of master-slave versions, for more information about this you can check:

http://dev.mysql.com/doc/refman/4.1/en/replication-compatibility.html

1 - Write down which is the setup you are going to do, which server is master and which server/s will be slave.

2 - Select your username/password for replications accounts. You can have one per server if you want, or one for all the mysql network.

3 - mysql> GRANT REPLICATION SLAVE ON *.*

TO 'USERNAME'@'IPFROMTHESLAVE' IDENTIFIED BY 'PASSWORD';

Username: mysql username
IPfromtheslave: ip from the mysql server that will be the one replicating the master db.
PASSWORD: the password for the replicator account.

Just a few side notes.

a) None of the passwords need to be root passwords.
b) Is not recomend to use only 1 user for replication in all the network.

4) In the master server you need to Flush all the tables, this will prevent clients from writing the db so it will keep without change while we copy over.

mysql> FLUSH TABLES WITH READ LOCK;

5) Make sure that the [mysqld] section of the my.cnf file on the master host includes a log-bin option. The section should also have a server-id=master_id option, where master_id must be a positive integer value from 1 to 232 – 1. For example:

[mysqld]

log-bin=mysql-bin

server-id=1

6) Login using another ssh client to the master server and lets create a snapshot.

mkdir /home/slave_db
rsync -vrplogDtH /var/lib/mysql /home/slave_db

You may not want to replicate the mysql database if the slave server has a different set of user accounts from those that exist on the master. In this case, you should exclude it from the archive. When the rsync is finish, just login inside mysql and type:

SHOW MASTER STATUS;

Save this info in a txt file inside the slave_db folder that we will use them laster. After you finish doing this, you can reenable the activity on the master: UNLOCK TABLES;

7) Stop the server that is to be used as a slave server and add the following to its my.cnf file:

[mysqld]

server-id=slave_id

The slave_id value, like the master_id value, must be a positive integer value from 1 to 232 – 1. In addition, it is very important that the ID of the slave be different from the ID of the master. For example:

[mysqld]

server-id=2

Remember that server-id must be unique in all the mysql network.

8) Copy the files over from the slave_db folder to the remote location. You can do this doing the following command:

rsync -e ssh -avz /home/slave_db/ root@REMOTESERVER:/var/lib/mysql

Check that all the permitions and correctly in the /var/lib/mysql folder.Remember files must be own by mysql:mysql

9) Start Mysql and enter to it, write the following changing the values that are needed:

mysql> CHANGE MASTER TO

-> MASTER_HOST='master_host_name',

-> MASTER_USER='replication_user_name',

-> MASTER_PASSWORD='replication_password',

-> MASTER_LOG_FILE='recorded_log_file_name',

-> MASTER_LOG_POS=recorded_log_position;

10) type: START SLAVE;

Mirror Your Web Site With rsync

2011-11-23T17:22:00.000+05:30

This tutorial shows how you can mirror your web site from your main web server to a backup server that can take over if the main server fails. We use the tool rsync for this, and we make it run through a cron job that checks every x minutes if there is something to update on the mirror. Thus your backup server should usually be up to date if it has to take over.

rsync updates only files that have changed, so you do not need to transfer 5 GB of data whenever you run rsync. It only mirrors new/changed files, and it can also delete files from the mirror that have been deleted on the main server. In addition to that it can preserve permissions and ownerships of mirrored files and directories; to preserve the ownerships, we need to run rsync as root which is what we do here. If permissions and/or ownerships change on the main server, rsync will also change them on the backup server.

In this tutorial we will tunnel rsync through SSH which is more secure; it also means you do not have to open another port in your firewall for rsync - it is enough if port 22 (SSH) is open. The problem is that SSH requires a password for logging in which is not good if you want to run rsync as a cron job. The need for a password requires human interaction which is not what we want.

But fortunately there is a solution: the use of public keys. We create a pair of keys (on our backup server mirror.example.com), one of which is saved in a file on the remote system (server1.example.com). Afterwards we will not be prompted for a password anymore when we run rsync. This also includes cron jobs which is exactly what we want.

As you might have guessed already from what I have written so far, the concept is that we initiate the mirroring of server1.example.com directly from mirror.example.com; server1.example.com does not have to do anything to get mirrored.

I will use the following setup here:

* Main server: server1.example.com (server1) - IP address: 192.168.0.100
* Mirror/backup server: mirror.example.com (mirror) - IP address: 192.168.0.175
* The web site that is to be mirrored is in /var/www on server1.example.com.

rsync is for mirroring files and directories only; if you want to mirror your MySQL database, please take a look at these tutorials:

* How To Set Up Database Replication In MySQL
* How To Set Up A Load-Balanced MySQL Cluster

I want to say first that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

1 Install rsync

First we have to install rsync on both server1.example.com and mirror.example.com. For Debian systems, this looks like this:

server1/mirror:

(We do this as root!)

apt-get install rsync

On other Linux distributions you would use yum (Fedora/CentOS) or yast (SuSE) to install rsync.

2 Create An Unprivileged User On server1.example.com

Now we create an unprivileged user called someuser on server1.example.com that will be used by rsync on mirror.example.com to mirror the directory /var/www (of course, someuser must have read permissions on /var/www on server1.example.com).

server1:

(We do this as root!)

useradd -d /home/someuser -m -s /bin/bash someuser

This will create the user someuser with the home directory /home/someuser and the login shell /bin/bash (it is important that someuser has a valid login shell - something like /bin/false does not work!). Now give someuser a password:

passwd someuser

3 Test rsync

Next we test rsync on mirror.example.com. As root we do this:

mirror:

rsync -avz -e ssh someuser@server1.example.com:/var/www/ /var/www/

You should see something like this. Answer with yes:

The authenticity of host 'server1.example.com (192.168.0.100)' can't be established.
RSA key fingerprint is 32:e5:79:8e:5f:5a:25:a9:f1:0d:ef:be:5b:a6:a6:23.
Are you sure you want to continue connecting (yes/no)?

<-- yes Then enter someuser's password, and you should see that server1.example.com's /var/www directory is mirrored to /var/www on mirror.example.com. You can check that like this on both servers: server1/mirror: ls -la /var/www You should see that all files and directories have been mirrored to mirror.example.com, and the files and directories should have the same permissions/ownerships as on server1.example.com. 4 Create The Keys On mirror.example.com Now we create the private/public key pair on mirror.example.com: mirror: (We do this as root!) mkdir /root/rsync ssh-keygen -t dsa -b 2048 -f /root/rsync/mirror-rsync-key You will see something like this: Generating public/private dsa key pair. Enter passphrase (empty for no passphrase): [press enter here] Enter same passphrase again: [press enter here] Your identification has been saved in /root/cron/mirror-rsync-key. Your public key has been saved in /root/cron/mirror-rsync-key.pub. The key fingerprint is: 68:95:35:44:91:f1:45:a4:af:3f:69:2a:ea:c5:4e:d7 root@mirror It is important that you do not enter a passphrase otherwise the mirroring will not work without human interaction so simply hit enter! Next, we copy our public key to server1.example.com: mirror: (Still, we do this as root.) scp /root/rsync/mirror-rsync-key.pub someuser@server1.example.com:/home/someuser/ The public key mirror-rsync-key.pub should now be available in /home/someuser on server1.example.com. 5 Configure server1.example.com Now log in through SSH on server1.example.com as someuser (not root!) and do this: server1: (Please do this as someuser!) mkdir ~/.ssh chmod 700 ~/.ssh mv ~/mirror-rsync-key.pub ~/.ssh/ cd ~/.ssh touch authorized_keys chmod 600 authorized_keys cat mirror-rsync-key.pub >> authorized_keys

By doing this, we have appended the contents of mirror-rsync-key.pub to the file /home/someuser/.ssh/authorized_keys. /home/someuser/.ssh/authorized_keys should look similar to this:

server1:

(Still as someuser!)

vi /home/someuser/.ssh/authorized_keys

ssh-dss AAAAB3NzaC1kc3MAAA[...]lSUom root@
mirror

Now we want to allow connections only from mirror.example.com, and the connecting user should be allowed to use only rsync, so we add

command="/home/someuser/rsync/checkrsync",from="mirror.example.com",no-port-forwarding,no-X11-forwarding,no-pty

right at the beginning of /home/someuser/.ssh/authorized_keys:

server1:

(Still as someuser!)

vi /home/someuser/.ssh/authorized_keys

command="/home/someuser/rsync/checkrsync",from="mirror.example.com",no-port-forwarding,no-X11-forwarding,no-pty ssh-dss AAAAB3NzaC1kc3MAAA[...]lSUom root@
mirror

It is important that you use a FQDN like mirror.example.com instead of an IP address after from=, otherwise the automated mirroring will not work!

Now we create the script /home/someuser/rsync/checkrsync that rejects all commands except rsync.

server1:

(We still do this as someuser!)

mkdir ~/rsync
vi ~/rsync/checkrsync

#!/bin/sh

case "$SSH_ORIGINAL_COMMAND" in
*\&*)
echo "Rejected"
;;
*\(*)
echo "Rejected"
;;
*\{*)
echo "Rejected"
;;
*\;*)
echo "Rejected"
;;
*\<*)
echo "Rejected"
;;
*\`*)
echo "Rejected"
;;
rsync\ --server*)
$SSH_ORIGINAL_COMMAND
;;
*)
echo "Rejected"
;;
esac

chmod 700 ~/rsync/checkrsync

6 Test rsync On mirror.example.com

Now we must test on mirror.example.com if we can mirror server1.example.com without being prompted for someuser's password. We do this:

mirror:

(We do this as root!)

rsync -avz --delete --exclude=**/stats --exclude=**/error --exclude=**/files/pictures -e "ssh -i /root/rsync/mirror-rsync-key" someuser@server1.example.com:/var/www/ /var/www/

(The --delete option means that files that have been deleted on server1.example.com should also be deleted on mirror.example.com. The --exclude option means that these files/directories should not be mirrored; e.g. --exclude=**/error means "do not mirror /var/www/error". You can use multiple --exclude options. I have listed these options as examples; you can adjust the command to your needs. Have a look at
man rsync

for more information.)

You should now see that the mirroring takes place:

receiving file list ... done

sent 71 bytes received 643 bytes 476.00 bytes/sec
total size is 64657 speedup is 90.56

without being prompted for a password! This is what we wanted.

7 Create A Cron Job

We want to automate the mirroring, that is why we create a cron job for it on mirror.example.com. Run crontab -e as root:

mirror:

(We do this as root!)

crontab -e

and create a cron job like this:

*/5 * * * * /usr/bin/rsync -azq --delete --exclude=**/stats --exclude=**/error --exclude=**/files/pictures -e "ssh -i /root/rsync/mirror-rsync-key" someuser@server1.example.com:/var/www/ /var/www/

This would run rsync every 5 minutes; adjust it to your needs (see

man 5 crontab

). I use the full path to rsync here (/usr/bin/rsync) just to go sure that cron knows where to find rsync. Your rsync location might differ. Run

mirror:

(We do this as root!)

which rsync

to find out where yours is.

8 Links

* rsync: http://samba.anu.edu.au/rsync

Logout root automatically when inactive

2011-11-23T17:12:00.000+05:30

Logout root automatically when inactive

Generraly, administrators will stay login as “root” or forget to logout after finishing their work and leave their terminals unattended.

The answer to solve this problem is to make the bash shell automatically logout after not being used for a period of time. For that, you must set the special variable named “TMOUT” to the time in seconds of no input before logout.

Edit your profile file (vi /etc/profile) and add the following line somewhere after the line that read “HISTSIZE=” on this file:

Code:

TMOUT=7200

The value we enter for the variable “TMOUT=” is in seconds and represents 2 hours (60 * 60 = 3600 * 2 = 7200 seconds). It is important to note that if you decide to put the above line in your /etc/profile file, then the automatic logout after two hours of inactivity will apply for all users on the system. So, instead, if your prefer to control which users will be automatically logged out and which ones are not, you can set this variable in their individual .bashrc file.

After this parameter has been set on your system, you must logout and login again (as root) for the change to take effect.

Linux Shell Script to reboot DSL or ADSL router.

2011-11-23T17:10:00.000+05:30

Linux Shell Script to reboot DSL or ADSL router

If you need to reboot the router then you need to use web interface or telnet interface. Both methods take time, especially if you are playing with ACL, NAT or router firewall or you just wanna reboot the router from your Linux desktop. I have created simple script using expect tool to reboot router. Make sure you have expect command installed. Use rpm or apt-get command to install expect tool.
Shell script

Create a script as follows (tested on Beetel ADSL 220x router):

#!/usr/bin/expect -f

set timeout 20

# router user name
set name "admin"

# router password
set pass "PASSWORD"

# router IP address
set routerip "192.168.1.254"

# Read command as arg to this script
set routercmd [lindex $argv 0]

# start telnet
spawn telnet $routerip

# send username & password
expect "Login:"
send -- "$name\r"
expect "Password:"
send -- "$pass\r"

# get out of ISP's Stupid menu program, go to shell
expect " -> "
send -- "sh\r"

# execute command
expect "# "
send -- "$routercmd\r"
# exit
send -- "^D"

Save script and setup executable permission on it:
$ chmod +x router.exp

How do I run this script?

You need to pass command to script to execute on a router. For example to display router uptime, interface information and to reboot router you need to type command as follows:
$ ./router.exp uptime
$ ./router.exp ifconfig
$ ./router.exp reboot

Since my ISP router offers menu as soon as login above script may not work on generic router such as Cisco or linksys router. Therefore, you may need to modify above script to work with your router. If you are a new to expect then use autoexpect command to generate script. It watches you interacting with another program and creates an Expect script that reproduces your interactions For straightline scripts, autoexpect saves substantial time over writing scripts by hand. Even if you are an Expect expert, you will find it convenient to use autoexpect to automate the more mindless parts of interactions. It is much easier to cut/paste hunks of autoexpect scripts together than to write them from scratch. Moreover, if you are a beginner, you may be able to get away with learning nothing more about Expect than how to call autoexpect. Just type autoexecpt:
$ autoexpectautoexpect started, file is script.exp

Next type telnet command (telnet to the router):
$ telnet 192.168.1.254
Output:

Login: USER
Password: Password

Now type commands on the router:
$ ifconfig
$ exit
You are done, type exit to stop autoexepct command:
$ exit
Output:

autoexpect done, file is script.exp

Just type ./script.exp to run ifconfig command:
$ ./script.exp

You can now modify script.exp to reboot or to run other commands. It is a real lifesaver.

How to Prevent DDoS Attack

2011-11-23T17:07:00.000+05:30

How to Prevent DDoS Attack

All web servers been connected to the Internet subjected to DoS (Denial of Service) or DDoS (Distrubuted Denial of Service) attacks in some kind or another, where hackers or attackers launch large amount connections consistently and persistently to the server, and in advanced stage, distributed from multiple IP addresses or sources, in the hope to bring down the server or use up all network bandwidth and system resources to deny web pages serving or website not responding to legitimate visitors.

You can detect the ddos using the following command

netstat -anp|grep tcp|awk '{print $5}'| cut -d : -f1|sort|uniq -c|sort -n

It will shows the number of connections from all IPs to the server.

There are plenty of ways to prevent, stop, fight and kill off DDoS attack, such as using firewall. A low cost, and probably free method is by using software based firewall or filtering service. (D)DoS-Deflate is a free open source Unix/Linux script by MediaLayer that automatically mitigate (D)DoS attacks. It claims to be the best, free, open source solution to protect servers against some of the most excruciating DDoS attacks.

(D)DoS-Deflate script basically monitors and tracks the IP addresses are sending and establishing large amount of TCP network connections such as mass emailing, DoS pings, HTTP requests) by using netstat command, which is the symptom of a denial of service attack. When it detects number of connections from a single node that exceeds certain preset limit, the script will automatically uses APF or IPTABLES to ban and block the IPs. Depending on the configuration, the banned IP addresses would be unbanned using APF or IPTABLES (only works on APF v 0.96 or better).

Installation and setup of (D)DOS-Deflate on the server is extremely easy. Simply login as root by open SSH secure shell access to the server, and run the the following commands one by one:

wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh

To uninstall the (D)DOS-Deflate, run the following commands one by one instead:

wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
chmod 0700 uninstall.ddos
./uninstall.ddos

The configuration file for (D)DOS-Deflate is ddos.conf, and by default it will have the following values:

Code:
FREQ=1
NO_OF_CONNECTIONS=50
APF_BAN=1
KILL=1
EMAIL_TO=”root”
BAN_PERIOD=600

Users can change any of these settings to suit the different need or usage pattern of different servers. It’s also possible to whitelist and permanently unblock (never ban) IP addresses by listing them in /usr/local/ddos/ignore.ip.list file. If you plan to execute and run the script interactively, users can set KILL=0 so that any bad IPs detected are not banned.

How to increase the memory limit of php

2011-11-23T17:04:00.001+05:30

How to increase the memory limit of php

If you have seen an error like “Fatal Error: PHP Allowed Memory Size Exhausted” in apache logs or in your browser, this means that PHP has exhausted the maximum memory limit. This post will show 3 different ways on how you can increase the php memory limit and also explain when you should use them.

First, let’s see where is this limit coming from. Normally you will see from the error message what is the actual limit, as this will look like:

"PHP Fatal error: Allowed memory size of X bytes exhausted (tried to allocate Y) in whatever.php"

The default value might differ depending on what php version and linux distribution you are running, but normally this will be set to either 8M or 16M. For example on my debian etch, running on php 5.2 this is set by default at 16M.

In order to identify the current value on your system, look inside your php.ini and search for memory_limit:
memory_limit = 16M ; Maximum amount of memory a script may consume (16MB)

There are three ways to change this value, the obvious way - changing the global value from php.ini, but also an individual method to change it just for a script, or folder.

1. Changing memory_limit globally from php.ini

This is the simplest and most obvious method. You just edit your php.ini and change the memory_limit to whatever you need. For ex:

memory_limit = 32M

You will require access to make changes to php.ini on the system. This change is global and will be used by all php scripts running on the system. Once you change this value, you will need to restart the web server in order for it to become active.

Keep in mind that this limit has its logic and don’t increase it artificially, as poorly written php scripts might overkill your system without proper limits.
Note: if you know what you are doing and want to remove the memory limit, you would set this value to -1.

2. Changing memory_limit using .htaccess for a single folder/vhost

Changing the global memory_limit might not be a good idea, and you might be better changing this only inside one folder (normally one application or virtual host) that needs this value changed for its functionality. To do this you have to add to the respective location .htaccess something like:

php_value memory_limit 64M

This change will be local only, and can be useful for webmasters that don’t have control on the system php.ini. This change would not require a reload and will become active immediately.

3. Changing memory_limit inside a single php script.

For even more control you can set this directive inside a single php script. To do so you would use in your code:

ini_set('memory_limit', '64M');

The advantage of this method is that you have more control and set this value just where you know it is really needed. Also it can be done without having access to the system php.ini, and will become active immediately.

Note: in order to be able to use these PHP resource limits, your PHP version must have been compiled with the –enable-memory-limit configure option. Normally most packed versions will have this, but just in case if this doesn't work for you as expected, check on how php was compiled first.