Cioby's site

Creating and managing virtual switches on ESX servers

cioby.service@gmail.com (Cristian Ciobanu) — Mon, 01 Aug 2011 09:52:40 PDT

Introduction

Virtual switches also known as vSwitches are logical switches built into the ESX infrastructure which allows you to connect virtual machines at layer 2 and provide traffic management for virtual machines. A vSwitch has 56 logical ports by default and can be extended up to 4088 ports in vSphere 4. You can create and manage vSwitches through the vSphere Client or through the VMware ESX Service Console using the esxcfg-vswitch command. A vSwitch can be created without any NICs mapped to it, or with one or more NICs mapped to it. If the vSwitch does not have any NICs attached to it is called an internal vSwitch, because it allows communication only within the ESX host. A single ESX host can support up to 127 virtual switches.

How to backup and restore databases in MySQL

cioby.service@gmail.com (Cristian Ciobanu) — Mon, 30 May 2011 23:45:50 PDT

Introduction

Making backups for your MySQL databases is really important, in cases of disasters, data loss, database migration or replication. There are situations when a user with full privileges to a specific database can issue by mistake a DROP DATABASE statement and delete its contents. As a database administrator you should ensure you have regular backups for all databases which can be used for later restoration. There are several tools out there to make database backups and restores but here we'll talk only about the command line tools provided by MySQL.

Understanding file permissions and ownership on Linux

cioby.service@gmail.com (Cristian Ciobanu) — Thu, 05 May 2011 02:03:18 PDT

Introduction

The Linux filesystem is based on a hierarchical directory structure where the root mount point is defined by the '/' symbol. In fact everything is a collection of files (files, directories, partitions, pipes, sockets, and hardware devices). Directories are used as containers that list other files. Most Linux distributions follow the Filesystem Hierarchy Standard (FHS) for organizing the filesystem structure. Permissions are used to control who can read, write and execute the contents of a file, and ownership indicates to which username and group a file belongs. If you are working as a system administrator, assigning incorrect permissions or ownership can have serious consequences in terms of security. In this article I will explain the theory and show you how to manipulate them using some practical examples.

Configuring a Cisco router or switch as a DHCP server

cioby.service@gmail.com (Cristian Ciobanu) — Thu, 14 Apr 2011 05:28:53 PDT

Introduction

Dynamic Host Configuration Protocol (DHCP) is a client/server protocol which allows you to allocate network configuration parameters like IP addresses, subnet masks, DNS servers, default gateways and many more to end devices. This protocol uses the UDP ports 67 and 68 as defined in RFC 2131. Nowadays allmost network devices support DHCP including workstations, printers, IP phones, handheld devices etc. Using dynamic IP address assigment you can minimize errors which can appear on manual configuration and also reduce the administrative overhead. Cisco embedded the DHCP server functionality beginning with IOS Version 12.0(1)T. By default, the Cisco IOS DHCP server and relay agent features are enabled but are not configured.

Creating and managing VMFS volumes on ESX hosts

cioby.service@gmail.com (Cristian Ciobanu) — Tue, 29 Mar 2011 11:13:32 PDT

Introduction

VMFS (Virtual Machine File System) is a proprietary high-performance cluster file system used on Vmware ESX servers to store virtual machines, ISO files and templates. VMFS comes in 3 versions. The last version VMFS-3 has introduced an important enhacement by adding directory structure in the filesystem. It has also some limitations regarding the file size which depends on the block size. So for a block size of 1MB you can have a maximum file size of 256GB. The maximum values for the block size and file size are 8MB respectively 2TB. ESX 3.x and higher allows up to 32 ESX hosts to be shared on a VMFS file system. Since VMFS is a journaling filesystem when a crash occurs, it does not run a full fsck on the volume, but merely checks the journal. A VMFS volume is used as a datastore to hold all of the files needed by virtual machines. In this article we will discuss only the command line management tools for VMFS although you can do this by using the vSphere client.

Using CDP (Cisco Discovery Protocol)

cioby.service@gmail.com (Cristian Ciobanu) — Tue, 22 Mar 2011 22:01:05 PDT

Introduction

Cisco Discovery Protocol (CDP) is a Cisco proprietary protocol which is used to collect information about neighboring routers and switches. It operates at Layer2 (data link layer) and comes in two versions CDPv1 (initial release) available since IOS version 10.3 and CDPv2 available from IOS Version 12.0(3)T. CDP is very useful when you need to gather information about the network topology like IP addresses, device capabilities, platform and also offers a quick way for troubleshooting and documenting the network. CDP is enabled by default on all available interfaces. CDP traffic between devices is not encrypted so this can be a real security issue. As best practice is recommended that CDP should be disabled mainly on devices that connects to external networks.

Installing and configuring vsftpd FTP server on Linux

cioby.service@gmail.com (Cristian Ciobanu) — Fri, 18 Mar 2011 10:00:23 PDT

Introduction

FTP (File Transfer Protocol) is a well-known network protocol used to transfer files between servers on the Internet or local networks. The FTP protocol is based on a client-server architecture and allows an FTP client to connect to an FTP server and download or upload files. From a networking perspective, two main types of FTP exists active and passive. In active FTP, the FTP server initiates a data transfer connection back to the client. For passive FTP, the connection is initiated from the FTP client. The vsftpd (Very Secure FTP Daemon) program is a fairly popular FTP server and is being used by major FTP sites and by default comes with many Linux distributions. The vsftpd software was designed to be fast, stable, and secure.

Configuring master-master replication in MySQL

cioby.service@gmail.com (Cristian Ciobanu) — Wed, 09 Mar 2011 00:02:35 PST

Introduction

Replication is used in MySQL to propagate data between two or more database servers. One common setup for replication is to have one master server and one or more slave servers which will receives updates from the master. This is known as a master-slave replication. In our scenario we will implement a master-master replication topology. This kind of setup is used mostly for high availability environments in which both master servers will replicate updates to each other. Any operations performed on one of the masters such as inserts, updates, deletes will be automatically replicated to the other master server. This setup has an advantage namely that if one of the masters drops down the other one will take its role without losing any data. In case of the master-slave setup if the master drops down you must manually enable the slave server to become master until the issue is solved.{jcomments on}

How to configure local logging on Cisco IOS

cioby.service@gmail.com (Cristian Ciobanu) — Wed, 23 Feb 2011 12:07:57 PST

Introduction

Device logs often offer valuable information when troubleshooting a network issue. Interface status, security alerts, environmental conditions, CPU process hog, and many other events on the router or switch can be captured and analyzed later by studying the logs. By default, all log messages on a Cisco router or switch are sent to the console port. Only users that are physically connected to the console port may view these messages. If you are connected to a Cisco device via Telnet or SSH and want to see console messages, you can enter the command terminal monitor in privileged exec mode. Cisco devices support five types of logging:

console logging - all messages are sent to the console port (default)
terminal logging - similar with the console logging but the messages are displayed on the VTY lines of the device.
buffered logging - stores the log messages using a circular buffer in the device's RAM
host logging (syslog) - forwards log messages to an external syslog server
SNMP logging - uses SNMP traps to send log messages to an external SNMP server

Scheduling tasks using crontab in Linux

cioby.service@gmail.com (Cristian Ciobanu) — Mon, 14 Feb 2011 12:53:00 PST

Introduction

Cron is a Linux/UNIX service that allows users to run scripts or programs automatically at a specified time and is commonly used to automate system maintenance or administration. It starts when the system boots and runs in the background as long as the system is up. The cron daemon is similar to the Task Scheduler application from Windows. It’s often useful to have a script or command executed without any human intervention. For example, you might want to have a script that creates regular backups of your files and folders and stores them in a specified location. For this cron is the perfect tool to do the job.

Enabling SSH on Cisco routers and switches

cioby.service@gmail.com (Cristian Ciobanu) — Mon, 31 Jan 2011 12:54:04 PST

Introduction

Some IOS images on Cisco devices use telnet as default login method for the vty lines. Using telnet is not safe because all traffic including usernames and passwords is transmitted in clear text. This way anybody using a protocol analyzer can gain access to the data. Lately telnet access method has been replaced by SSH which offers increased security by encrypting all traffic between source and destination. SSH protocol comes in two versions SSH1 and SSH2. Communication between the client and server is encrypted in both versions. You should implement SSH version 2 when possible because it uses a more enhanced security encryption algorithm. SSH1 became available in Cisco's IOS, starting with release 12.1(1)T. In order to use SSH2 you need a IOS version 12.3(4)T or newer.

Changing the Service Console IP Address on ESX servers

cioby.service@gmail.com (Cristian Ciobanu) — Wed, 19 Jan 2011 12:23:38 PST

Introduction

Normally, the IP address for the service console is set at the first installation of an ESX server. There are situations in which you need to change the IP address, for example if the server is moved into a different location or VLAN. VMware provides a set of tools that can be ran from the physical host’s console and are helpful in these situations. It's recommended to make this changes from the physical console and not over SSH, Telnet, or vCenter unless you have multiple service consoles configured, as it will result in a disconnection of the session.

How to reset root password in MySQL

cioby.service@gmail.com (Cristian Ciobanu) — Sat, 15 Jan 2011 00:31:52 PST

Introduction

By default some installations of MySQL server come with no password for the root account. If you have set a password and forgot it you have to use the following procedure to reset it. The procedure is available for mysql instances installed on Linux operating systems. The passwords in MySQL are stored on the user table from the mysql database and are encrypted using the mysql PASSWORD() function. The used encryption algorithm is one way and cannot be reversed.

In this procedure we won't recover the existing password for the root account but instead we will reset it by changing it with a new one.

Customize bash history in Linux

cioby.service@gmail.com (Cristian Ciobanu) — Sun, 09 Jan 2011 14:00:00 PST

Introduction

If you are a fan of the bash prompt and you have used Linux for some time it is quite likely that you have used the history command in your daily work. This command is used to recall previously entered commands at the bash prompt. This is an important feature of bash which could save you a lot of time for example if you type really long commands. By default the history option in bash is enabled. If somehow the option is not active you could turn it on by running the following command:

# set -o history

Creating and configuring VLANs on Cisco Catalyst switches

cioby.service@gmail.com (Cristian Ciobanu) — Sun, 02 Jan 2011 14:00:00 PST

Introduction

A VLAN (Virtual LAN) is a term derived from LAN (Local area network) and represents a logical grouping of hosts with the same set of requirements. All host in a VLAN communicate as if they were attached to the same broadcast domain, regardless of their physical location. By grouping several switch ports in different VLANs we are creating separate logical broadcast domains. All member ports of the same VLAN can communicate between them without using any Layer 3 routing. In order to allow communication between different VLANs we must use VLAN trunking or a layer 3 router. Using VLANs can provide the following benefits:

Customizing and colorizing Linux bash prompt

cioby.service@gmail.com (Cristian Ciobanu) — Sun, 26 Dec 2010 14:00:00 PST

Introduction

Sometimes you get bored with the way the bash prompt looks like and you want to customize it by adding some useful features or changing colors. The default Bash prompt usually ends with a dollar sign $. Bash itself will show its major and minor version (\s-\v\$), for example, bash-3.00$. Most Linux distributions redefine the prompt to include additional information, such as your current login and computer, which is useful when you’re moving between accounts and computers. In order to customize the bash prompt we need to modify the $PS1 and $PS2 environment variables by our desire.

Bash will use the value of the $PS1 variable for your main prompt. If you include variable names in the string, Bash will substitute the value of the variables into your prompt. Bash has a PS2 (prompt string 2) variable, which is the prompt for incomplete command lines such as when you use a multiline quotation. By default, this prompt is a greater-than sign (>).

Creating and using swap partitions on Linux

cioby.service@gmail.com (Cristian Ciobanu) — Sun, 19 Dec 2010 14:00:00 PST

Introduction

Swap space represents an area on the physical disk (usually a dedicated partition) which holds temporarily a process memory image. This area is often called virtual memory because it allows processes to use memory beyond the physical RAM available on your computer. Swapping and paging algorithms allow processes or portions of processes to move between physical memory and a mass storage device. This frees up space in physical memory.

As the swap space is stored on the disk the access times tend to be slow compared to the RAM. In Linux we can have two types of swap space: a dedicated partition on the physical disk or a swap file which resides among other files on the filesystem. Linux kernels newer that 2.4.10 allow 32 swap areas.

How to configure port security on Cisco Catalyst switches

cioby.service@gmail.com (Cristian Ciobanu) — Sun, 12 Dec 2010 14:00:00 PST

Introduction

In some environments, a network must be secured by controlling what stations can gain access to the network itself. Port security is a feature used on Cisco Catalyst switches which limits the MAC addresses allowed to appear on a specific port. In most cases network administrators use this to secure access to the physical network.

Using this feature only predefined static MAC addresses or limited number of dynamic MAC addresses can access the network. Suppose a user tries to connect to a port which has port security enabled and his MAC address does not appear on the list of allowed MAC addresses. In this case the port will be shut down or the packets arriving on that port will be dropped with a specific action. To resolve this issue the port must be re-enabled manually by the network administrator or automatically after a period of time if the errdisable cause is configured for automatic recovery (by default after 300 seconds).