MAL - Memória Auxiliar do Lutieri

Studying for RHSCA and RHCE

2012-01-03T21:34:00.058-02:00

My recent posts were about things that I was playing around and are related to topics that are covered in RHSCA and RHCE exams.

I'm preparing myself to take this exams in february/2012 and I need some place to store my notes. Here you will find small tips, tricks, common switches, commands, etc. This is all stuff that I need to know in order to succeed the exams. And it's also stuff that I know I have to play with and write down to help memory retain the information.

let the show begin....

Querying RPMs

rpm -qi xxx -> query info. same as yum info xxx
rpm -q --scripts xxx -> query scripts
rpm -ql xxx -> list of files inside the rpm.

any of the above can also have the -p switch. this will consider the xxx as a local rpm file. not an installed package

rom -qf /sbin/service -> will show which packege contains the /sbin/service file
rpm -qa -> query all installed packages

Extract files from rpm:

rpm2cpio xxx | cpio -idmv

if you run rpm -qlp xxx and see the one file that you want you can extract it running the following:

rpm2cpio xxx | cpio -idmv ./etc/apt/sources.list.d/rpmforge-extras.list

Please don't forget the dot in front of the filename. otherwise no files will be extracted.

Querying installed packages

If you want to know if a package is installed use:

yum list "*http*"

It will list the Installed Packages and also the Available Packages. Yum list only search for the packages name. Yum search searches also in the description of the package.

Installing RPMs

yum localinstall xxx.rpm works just like rpm -ivh xxx.rpm but will also solve the dependencies if necessary.

Creating RPMs

yum install rpm-build make -y
mkdir -p /usr/src/lutieri/{BUILD,RPMS,SOURCES,SPECS,SRPMS,tmp}
cd /usr/src/lutieri/
mkdir sample
cd sample/
touch first_file second_file keys config_file
cd ..
tar -cf sample.tar.gz sample/
mv sample.tar.gz SOURCES/

create a spec file in SPECS: run vim foo.spec -> vim will load a template for you :-D

rpmbuild -v -bb SPECS/sample.spec

rpmbuild -v -bb --sign SPECS/sample.spec

the former example works if you have the rpmmacros set correctly. then the package will be built and signed.

Instead of creating all those directories, create the .spec file and run with rpmbuild. it will create all the directory structure in ~/rpmbuild/. then move the .spec to ~/rpmbuild/SPECS and the tar to ~/rpmbuild/SOURCES and run rpmbuild again against the .spec.

OR

Install rpmdevtools and run rpmdev-setuptree. This will also create the folder structure in the home directory

in the SPEC file , under the sessino %files you should specify every file that this package is responsible for.

%files
%defattr(-,root,root,-)
%dir /root/package
%attr(755,root,root) /root/package/script.sh

Instead of use cp to copy files to a specific location, use install -D

Signing a package

gpg-agent --daemon
gpg2 --gen-keys
gpg2 --list-keys
gpg2 --export -a lutieri2 > RPM-GPG-KEY-lutieri2
su -
rpm --import /home/lutieri/RPM-GPG-KEY-lutieri2
exit
vim ~/.rpmmacros
%_signature gpg
%_gpg_name lutieri2
rpm --addsign rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm
rpm --resign rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm
rpm --checksig rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm

Run man rpm and search for macro.. this will show you what goes inside the .rpmmacros files.

all the keys imported into RPM DB are considered packages. take a look:

rpm -q gpg-pubkey --qf "%{name} - %{version} - %{release} -> %{summary}\n"
gpg-pubkey - c105b9de - 4e0fd3a3 -> gpg(CentOS-6 Key (CentOS 6 Official Signing Key) )
gpg-pubkey - 8cee003f - 4f03b71a -> gpg(lutieri )
gpg-pubkey - cf7fe955 - 4f03bacf -> gpg(lutieri2 )

rpm -qa gpg-pub*
gpg-pubkey-cf7fe955-4f03bacf
gpg-pubkey-8cee003f-4f03b71a
gpg-pubkey-c105b9de-4e0fd3a3

thus, to remove lutieri2 key. issue:

rpm -e gpg-pubkey-cf7fe955-4f03bacf

Create a repository:

yum install -y createrepo
mkdir /opt/myrepo
mv *.rpm /opt/myrepo
createrepo /opt/myrepo
vim /etc/yum.repos.d/lutieri.repo
[lutieri]
Baseurl=file:///opt/myrepo
name=lutierirepo
enabled=1

man yum.conf shows you the options that goes in the .repo files.

If later on you add new RPMs to the directory run the following to update de metadata:

createrepo -update /opt/myrepo

--------------------------------------------------

Network

on ifcfg-* files, the option NM_CONTROLLED="NO" will not allow network manager to manage this interface

Bonding:

vim /etc/modprobe.d/bonding.conf
alias bond0 bonding

To find out what options are necessary in the master interface do the follwing
find /usr/share/doc/kernel-doc* -iname "bond*"

less /usr/share/doc/kernel-doc-2.6.32/Documentation/networking/bonding.txt

miimon is required as well as mode. Mode 1=rr, 2=active/passive 3=broadcast

Master:

vim /etc/sysconfig/network-scripts/ifcfg-bond0

TYPE=Ethernet
DEVICE=bond0
BOOTPROTO=none
IPADDR=1.1.1.1
NETMASK=255.255.255.0
USERCTL=yes
IPV6INIT=no
ONBOOT=yes
BONDING_OPTS="miimon=100 mode=0"

Slaves:

vim /etc/sysconfig/network-scripts/ifcfg-eth0

TYPE=Ethernet
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes

If you wanna see if the options in BONDING_OPTS were applied, take a look in

[root@zeus ~]# cat /sys/class/net/bond0/bonding/miimon
100
[root@zeus ~]# cat /sys/class/net/bond0/bonding/mode
balance-rr 0

--------------------------------------------------
File Systems

palimpsest

it's a graphic utility to manage disks.

TIP:

fdisk -cul /dev/?d?

it lists all disk devices.

LUKS - Linux Unified Key Setup
make sure you have the partition unmount

Format the partition to be encrypted:

cryptsetup luksFormat /dev/sdb1

Open the FS and give it a name:

cryptsetup luksOpen /dev/sdb1 hiddenData

Format it to use:

mkfs.ext4 /dev/mapper/hiddenData

Use it:

mkdir /mnt/hiddenData
mount /dev/mapper/hiddenData /mnt/hiddenData
touch /mnt/hiddenData/file1

Lock it after use:

umount /mnt/hiddenData
cryptsetup luksClose /dev/mapper/hiddenData

Make it the mounting persistent after reboot:

vim /etc/crypttab
hiddenData /dev/sda2 none

none means you will have to type the password during boot. any other value is interpreted as a file that contains the password for the FS

vim /etc/fstab
/dev/mapper/hiddenData /mnt/hiddenData ext4 defaults 0 0

To avoid being prompted for a password you can create a key, save it in a file and use this key to open the device:

vim /etc/key
type anything in there

chmod 400 /etc/key
cryptsetup luksAddKey /dev/vda5 /etc/key
cryptsetup luksDump /dev/vda5

vim /etc/crypttab
hiddenData /dev/sda2 /etc/key

------------------

iSCSI

doc under: /usr/share/doc/iscsi*/README

# yum install -y iscsi-initiator-utils

# iscsiadm -m discovery -t st -p 192.168.56.101
192.168.56.101:3260,1 iqn.2006-01.com.openfiler:tsn.cc35969be1c0

# iscsiadm -m node -T iqn.2006-01.com.openfiler:tsn.cc35969be1c0 -p 192.168.56.101 -l
Logging in to [iface: default, target: iqn.2006-01.com.openfiler:tsn.cc35969be1c0, portal: 192.168.56.101,3260] (multiple)
Login to [iface: default, target: iqn.2006-01.com.openfiler:tsn.cc35969be1c0, portal: 192.168.56.101,3260] successful.

take a look in /var/log/messages and see what block devices appear OR run

# find /sys/devices/platform/host* -name "block*"
/sys/devices/platform/host4/session1/target4:0:0/4:0:0:0/block
# ls /sys/devices/platform/host4/session1/target4\:0\:0/4\:0\:0\:0/block/
sdc

service iscsi status

will also show you, in the very bottom line, what devices iscsi is attached to.

Make it persistent after reboots:

vim /etc/fstab
/dev/sdc1 /mnt/openfiler ext4 _netdev 0 0

Cleaning the DBs:

Removing known portals:

[root@zeus ~]# iscsiadm -m discoverydb
192.168.56.102:3260 via sendtargets
192.168.56.101:3260 via sendtargets
[root@zeus ~]# iscsiadm -m discovery -o delete -p 192.168.56.102
[root@zeus ~]# iscsiadm -m discovery -o delete -p 192.168.56.101
[root@zeus ~]# iscsiadm -m discovery
[root@zeus ~]#

----------------------------------

After managing partitions you should reload the partition table partprobe used to be a good choice but seems to be deprecated right now. partx ou kpartx seems to be the new options.

partx -a /dev/sda

will add new partitions to the system. double check running cat /proc/partitions

partx -d /dev/sda

will remove all inactive partitions from the system.

Please use fdisk -cu.. these switches will disable DOS-compatible mode and show sectors instead of cylinders

-------

LVM

Creating PVs

[root@zeus ~]# fdisk -l /dev/sdc
Disk /dev/sdc: 1073 MB, 1073741824 bytes
34 heads, 61 sectors/track, 1011 cylinders
Units = cylinders of 2074 * 512 = 1061888 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0000dfdc
   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1               1          95       98484+  8e  Linux LVM
/dev/sdc2              96         426      343247   83  Linux
[root@zeus ~]# pvcreate /dev/sdc1
  Physical volume "/dev/sdc1" successfully created
[root@zeus ~]# pvcreate /dev/sdc2
  Physical volume "/dev/sdc2" successfully created
[root@zeus ~]#

The man page for pvcreate says a partition should be type 8e but it does not complain about /dev/sdc2 though. let's move on..

Creating a VG

[root@zeus ~]# vgcreate mp3 /dev/sdc1
  Volume group "mp3" successfully created
[root@zeus ~]# vgdisplay -v mp3
    Using volume group(s) on command line
    Finding volume group "mp3"
  --- Volume group ---
  VG Name               mp3
  System ID
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  1
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                0
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               92.00 MiB
  PE Size               4.00 MiB
  Total PE              23
  Alloc PE / Size       0 / 0
  Free  PE / Size       23 / 92.00 MiB
  VG UUID               tc1JKq-TBBw-zYax-51ET-2A5t-hK0t-wsWXTO

  --- Physical volumes ---
  PV Name               /dev/sdc1
  PV UUID               XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI
  PV Status             allocatable
  Total PE / Free PE    23 / 23

Note that -v switch brings up the PV that are part of the VG.

Creating LVs

[root@zeus ~]# lvcreate -L 50M mp3 -n rock_and_roll
  Rounding up size to full physical extent 52.00 MiB
  Logical volume "rock_and_roll" created
[root@zeus ~]# lvcreate -L 10M mp3 -n soul
  Rounding up size to full physical extent 12.00 MiB
  Logical volume "soul" created
[root@zeus ~]# lvs
  LV            VG      Attr   LSize  Origin Snap%  Move Log Copy%  Convert
  rock_and_roll mp3     -wi-a- 52.00m
  soul          mp3     -wi-a- 12.00m

Observing the VG

[root@zeus ~]# vgdisplay -v mp3
    Using volume group(s) on command line
    Finding volume group "mp3"
  --- Volume group ---
  VG Name               mp3
  System ID
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  3
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               92.00 MiB
  PE Size               4.00 MiB
  Total PE              23
  Alloc PE / Size       16 / 64.00 MiB
  Free  PE / Size       7 / 28.00 MiB
  VG UUID               tc1JKq-TBBw-zYax-51ET-2A5t-hK0t-wsWXTO

  --- Logical volume ---
  LV Name                /dev/mp3/rock_and_roll
  VG Name                mp3
  LV UUID                EQ73g4-TFPw-6WTg-ufWp-RAXq-MVVU-fHSh9T
  LV Write Access        read/write
  LV Status              available
  # open                 0
  LV Size                52.00 MiB
  Current LE             13
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:2

  --- Logical volume ---
  LV Name                /dev/mp3/soul
  VG Name                mp3
  LV UUID                nchsYN-2eSX-Z3Bw-WV5w-2xxV-5oQM-8Vh8xj
  LV Write Access        read/write
  LV Status              available
  # open                 0
  LV Size                12.00 MiB
  Current LE             3
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:3

  --- Physical volumes ---
  PV Name               /dev/sdc1
  PV UUID               XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI
  PV Status             allocatable
  Total PE / Free PE    23 / 7

Rename a LV:

[root@zeus ~]# lvcreate -L 10M mp3
  Rounding up size to full physical extent 12.00 MiB
  Logical volume "lvol0" created
[root@zeus ~]# lvs
  LV            VG      Attr   LSize  Origin Snap%  Move Log Copy%  Convert
  lvol0         mp3     -wi-a- 12.00m
  rock_and_roll mp3     -wi-a- 52.00m
  soul          mp3     -wi-a- 12.00m
[root@zeus ~]# lvrename /dev/mp3/lvol0 /dev/mp3/celtic
  Renamed "lvol0" to "celtic" in volume group "mp3"
[root@zeus ~]# lvs
  LV            VG      Attr   LSize  Origin Snap%  Move Log Copy%  Convert
  celtic        mp3     -wi-a- 12.00m
  rock_and_roll mp3     -wi-a- 52.00m
  soul          mp3     -wi-a- 12.00m

Resizing LVs

[root@zeus ~]# lvresize -L 15M /dev/mp3/celtic
4  Rounding up size to full physical extent 16.00 MiB
  Extending logical volume celtic to 16.00 MiB
  Logical volume celtic successfully resized
[root@zeus ~]# lvresize -L 12M /dev/mp3/celtic
  WARNING: Reducing active logical volume to 12.00 MiB
  THIS MAY DESTROY YOUR DATA (filesystem etc.)
Do you really want to reduce celtic? [y/n]: y
  Reducing logical volume celtic to 12.00 MiB
  Logical volume celtic successfully resized

Extending/Reducing VGs

[root@zeus ~]# vgs
  VG      #PV #LV #SN Attr   VSize  VFree
  mp3       1   3   0 wz--n- 92.00m 16.00m
  vg_zeus   1   2   0 wz--n-  7.51g     0
[root@zeus ~]# vgextend mp3 /dev/sdc2
  Volume group "mp3" successfully extended
[root@zeus ~]# vgs
  VG      #PV #LV #SN Attr   VSize   VFree
  mp3       2   3   0 wz--n- 424.00m 348.00m

[root@zeus ~]# vgreduce mp3 /dev/sdc2
  Removed "/dev/sdc2" from volume group "mp3"
[root@zeus ~]#

Moving extents from one disk to another

Make sure you VG has more than one disk. In this case I have sdc1 and sdc2 and will move the extents from sdc1 to sdc2

[root@zeus ~]# pvmove /dev/sdc1 /dev/sdc2
  /dev/sdc1: Moved: 0.0%
  /dev/sdc1: Moved: 21.1%
  /dev/sdc1: Moved: 31.6%
  /dev/sdc1: Moved: 47.4%
  /dev/sdc1: Moved: 57.9%
  /dev/sdc1: Moved: 68.4%
  /dev/sdc1: Moved: 78.9%
  /dev/sdc1: Moved: 84.2%
  /dev/sdc1: Moved: 100.0%

If now you take a look at sdc1 no extents are found in this partition (disc)

[root@zeus ~]# pvdisplay -v /dev/sdc1
    Using physical volume(s) on command line
  --- Physical volume ---
  PV Name               /dev/sdc1
  VG Name               mp3
  PV Size               96.18 MiB / not usable 4.18 MiB
  Allocatable           yes
  PE Size               4.00 MiB
  Total PE              23
  Free PE               23
  Allocated PE          0
  PV UUID               XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI

Taking Snapshots

lvcreate -s -L50M -n rock_snapshot /dev/mp3/rock_and_roll
mount the snapshot, copy the frozen data and delete it.
lvremove /dev/mp3/rock_snapshot

-------------------------------------------------------------

FileSystems

ACLs:

dumpe2fs /dev/xxx | grep Defaults will show which are the default mouting options. acl, user_xattr must be listed to have acl support in first place.

tune2fs -o acl,user_xattr /dev/xxx

can be issued to set the defaults mounting options.

tune2fs -o ^acl,^user_xattr /dev/xxx

can be issued to clear the defaults mounting options.

These options are overwritten by /etc/fstab or options in the mount command line.
BTW, if you set the defaults mount options and mount the volume you won't be able to see the acl option listed in the output of mount. This can cause some confusion but acl will be enabled anyway.

----------------

Authentication

To enable LDAP authentication run

authconfig-tui

vi /etc/openldap/ldap.conf OR vi /etc/ldap.conf
URI ldap://127.0.0.1/
BASE dc=lutierigabriel
vim /etc/nsswitch.conf
add ldap to group, shadow, passwd

system-config-authentication

-------------------

kickstart

some options:

zerombr
clearpart --all

always use /root/anaconda-ks.cfg as a template.
-------------------

NFS

Firewall

TCP/2049
UDP/111,32769
TCP/32803,892
All ports but 111 and 2049 has to be specified in /etc/sysconfig/nfs

yum install -y nfs-utils nfs4-acl-tools
chkconfig nfs on; chkconfig nfslock on; chkconfig rpcbind on
vim /etc/exports
/mnt *(ro,sync)

exportfs -avr -> reexport all directories

Adjusting SELinux ( this will allow directories to be exported as RO and RW:

getsebool -a | grep nfs
setsebool -P nfs_export_all_ro=1 nfs_export_all_rw=1

mounting a NFS share:

mount localhost:/mnt /nfs

Verifying the exported directories on the server side:

# cat /var/lib/nfs/etab
/mnt    *(ro,sync,wdelay,hide,nocrossmnt,secure,root_squash,no_all_squash,no_subtree_check,secure_locks,acl,anonuid=65534,anongid=65534)

Verifying the mount NFS share on the cliente side:

nfsstat -m

Persistent NFS mounts:

vim /etc/fstab
rhel01:/opt/company_data /opt/company_data nfs4 rw,sync 0 0

Client side mounting option

soft -> means that if a timeout occurs the process will give up and try again later. the device will become unavailable meanwhile
hard -> in the same situation as state above, the process will never give up on mounting/accessing the device. it will hang there 'til it gets mounted.
intr -> usually used along the hard option. means the besides hard it can be interrupted. usually better have hard, intr than soft.

-------------------------------

automount

how to automount home directories:

/etc/auto.master
/home/guests /etc/auto.guests

/etec/auto.guests
* -rw,soft,intr instructor.example.com:/home/guests/&

service autofs reload

ls /home/guests/user1 -> will mount the user1 folder from the instructor box

-----------

SetUID and SetGID

setuid allows users to execute a file with privileges of the file's owner

chmod u+s file
chmod 4755 file
find / -perm -4000

SetGID
chmod g+s file
chmod 2755 file
find / -perm -2000

Sticky bit (set on directories, only owner and root can delete contentes in the dir)
chmod +t sticky/
chmod 1755 sticky/
find / -perm -1000

-------

Virtualization (only available in 64 bits OS)

yum install qemu-kvm qemu-img

virsh list
virshlist --all

virsh shutdown X
virsh start NAME
virt-viewer X

virsh autostart --disable X
virsh autostart X

virt-viewer X

Create a guess VM:

virt-install –-name Client03 –-ram 512 –-disk path=/var/lib/libvirt/images/client03.img,size=8 –-network network=default –-cdrom /dev/cdrom

it's recommended to use /var/lib/libvirt/images to hold the virtual disks. to use other directory you should configure SELinux to allow it.

Can also create via GUI with virt-manager.

Useful commands

virsh connect localhost
virsh start guest1-rhel6-64
virsh stop guest1-rhel6-64
virsh list -all
virsh console
virsh autostart X

virsh net-list
virsh net-start X

------------------

SELinux

Make sure you have setroubleshoot-server so you will get nicer SELinux messages.

Check how SELinux is running:
[root@zeus ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted [root@zeus ~]# getenforce Enforcing [root@zeus ~]# setenforce permissive [root@zeus ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: enforcing Policy version: 24 Policy from config file: targeted [root@zeus ~]# setenforce enforcing [root@zeus ~]# getenforce Enforcing

you can also edit /etc/selinux/config. Regardless of the method you should reboot the system. When you change the mode the files must be relabed (their contexts will change) this is done on the boot process.

It is possible to disable enforcing mode, will only audit:

setenforcing 0

Check the boolean values or getsebool -a | grep http:

 sestatus -b | grep http
allow_httpd_anon_write                      off
allow_httpd_mod_auth_ntlm_winbind           off
allow_httpd_mod_auth_pam                    off
allow_httpd_sys_script_anon_write           off
httpd_builtin_scripting                     on
httpd_can_check_spam                        off
httpd_can_network_connect                   off
httpd_can_network_connect_cobbler           off
httpd_can_network_connect_db                off
httpd_can_network_memcache                  off
httpd_can_network_relay                     off
httpd_can_sendmail                          off
httpd_dbus_avahi                            on
httpd_enable_cgi                            on
httpd_enable_ftp_server                     off
httpd_enable_homedirs                       off

While I was reading about SELinux I found something very useful that I didn't know until now. Well, during the reading the author says to issue a commando called semanage that will explain each of the boolean options. However, I don't have semanage on my system and don't know which package provides it. So, the following command told me what package I should install to have semanage.

yum whatprovides *bin/semanage

Here we go, from the output it's clear to me that policycoreutils-python-2.0.83-19.1.el6.i686 has the binary that I was looking for.

Ok. moving on... so, to see what each boolean value does, issue:

[root@zeus ~]# semanage boolean -l | grep http
httpd_can_network_relay        -> off   Allow httpd to act as a relay
httpd_can_network_connect_db   -> off   Allow HTTPD scripts and modules to connect to databases over the network.
httpd_use_gpg                  -> off   Allow httpd to run gpg in gpg-web domain
httpd_enable_cgi               -> on    Allow httpd cgi support
allow_httpd_mod_auth_pam       -> off   Allow Apache to use mod_auth_pam

Changing boolean values:

setsebool -P httpd_enable_homedirs=1

Context is formed of:
User : role : domain

Users are usually one of these:

unconfined_u: Unprotected user
system_u: System user
user_u: Normal user

Roles are usually one of these:

object_r: File

system_r: Users and processes

Domains (AKA type) are usually one of these:

unconfined_r: Unprotected file or process

httpd_t: used for httpd process.
....

Roles do NOT have influence under files so object_r is used as a generic role for any file.

Checking files' context:

# ls -Z
-rw-------. root  root system_u:object_r:admin_home_t:s0 anaconda-ks.cfg
-rwxr-xr-x. root  root unconfined_u:object_r:admin_home_t:s0 a.out

Checking processes' context:

 ps -eZ |  grep httpd
unconfined_u:system_r:httpd_t:s0 14784 ?       00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 14786 ?       00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 14787 ?       00:00:00 httpd

Changing contexts (domains) http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Confined_Services/sect-Managing_Confined_Services-Targeted_policy-Unconfined_processes.html

[root@zeus ~]# touch myfile
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile
[root@zeus ~]# chcon -vu system_u myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfile
[root@zeus ~]# chcon -vt etc_t myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:etc_t:s0       myfile
[root@zeus ~]# chcon -vr system_r myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:system_r:etc_t:s0       myfile

[root@zeus ~]# touch myfile2
[root@zeus ~]# ls -Z myfile2
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile2
[root@zeus ~]# chcon --reference myfile myfile2
[root@zeus ~]# ls -Z myfile2
-rw-r--r--. root root system_u:system_r:etc_t:s0       myfile2

[root@zeus ~]# restorecon myfile
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfile

Changing ports for services:

[root@zeus ~]# semanage port -l | grep http
http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

[root@zeus ~]# semanage port -a -t http_port_t -p tcp 81

[root@zeus ~]# semanage port -l | grep http
http_port_t                    tcp      81, 80, 443, 488, 8008, 8009, 8443

Every time you change a context it will be restored in the next file system relabel (next reboot).
To make changes permanentely run:

semanage fcontext -a -t httpd_sys_content_t file1

TIP:
some daemons have man pages talking about the contexts and booleans used by them. take a look:

[root@zeus ~]# apropos _selinux
ftpd_selinux         (8)  - Security-Enhanced Linux policy for ftp daemons
httpd_selinux        (8)  - Security Enhanced Linux Policy for the httpd daemon
init_selinuxmnt      (3)  - initialize the global variable selinux_mnt
is_selinux_enabled   (3)  - check whether SELinux is enabled
kerberos_selinux     (8)  - Security Enhanced Linux Policy for Kerberos
named_selinux        (8)  - Security Enhanced Linux Policy for the Internet Name server (named) daemon
nfs_selinux          (8)  - Security Enhanced Linux Policy for NFS
pam_selinux          (8)  - PAM module to set the default security context
rsync_selinux        (8)  - Security Enhanced Linux Policy for the rsync daemon
samba_selinux        (8)  - Security Enhanced Linux Policy for Samba
ypbind_selinux       (8)  - Security Enhanced Linux Policy for NIS

semanage fcontext -a -t httpd_sys_content_t "/newweb(/.*)?"
restorecon -R -v /newweb

-------------

Firewall

iptables -p icmp -h

show all the possible icmp types :-)

POSTROUTING -> SNAT --to-source x.x.x.x OR MASQUERADE

----------
Rsyslog

/etc/rsyslog.conf

forwarding message to other host:

 Remote machine
       There are three ways to forward message: the traditional UDP transport, which is extremely lossy but standard, the plain TCP based trans-
       port which loses messages only during certain situations but is widely available and the RELP transport which does not lose messages  but
       is currently available only as part of rsyslogd 3.15.0 and above.

       To  forward  messages  to another host via UDP, prepend the hostname with the at sign ("@").  To forward it via plain tcp, prepend two at
       signs ("@@"). To forward via RELP, prepend the string ":omrelp:" in front of the hostname.

       Example:
              *.* @192.168.0.1

------

Apache

Test/Parse the config file:

service httpd configteste

VirtualHost

NameVirtualHost 192.168.56.200:80


<VirtualHost 192.168.56.200:80>
serverName site1.asdf.com
DocumentRoot "/var/www/site1"
</VirtualHost>


<VirtualHost 192.168.56.200:80>
Servername site2.asdf.com
DocumentRoot "/var/www/site2"
</VirtualHost>

Password protected

<Directory "/var/www/html/protected">
        AuthType        basic
        AuthName "You are out"
        AuthUserFile    "/var/www/html/protected/.users"
        Require user lutieri
        Options Indexes

        Order deny,allow
</Directory>

CGI Scripts

ScriptAlias /bin "/var/www/site1/bin"

<Directory "/var/www/site1/bin/">
options ExecCGI Indexes
</Directory>

Addhandler cgi-script .lgb

The script will need to produce HTML output. Usually means that the first line in your script needs to print out which mime type the script will produce. I.E:

#!/bin/bash

echo "Content-type: text/html\n\n";
echo "Hello, World.";

Except that I found out that printing a blank line instead of content-type... also works great.

----------

Postfix

alternatives --config mta

-----------

Bind

[root@zeus ~]# cat /var/named/dynamic/asdf.com
$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
site1   A       192.168.56.201
site2   A       192.168.56.202

Master zone

[root@zeus ~]# cat /etc/named.conf
---SNIP---

zone "asdf.com"  IN {
        type master;
        file "dynamic/asdf.com";
};
---SNIP---

Forward zone:

the directive Forwarders can also be used in the global context.

zone "asdf.com"  IN {
        type forward;
        forwarders {  66.33.206.206; };
};

--------------

Samba

If you create a directory and would like to share it, run:

chcon -t samba_share_t /path

Allowing home directories to be shared:

[root@zeus ~]# setsebool -P samba_enable_home_dirs on
[root@zeus ~]# getsebool samba_enable_home_dirs
samba_enable_home_dirs --> on
[root@zeus ~]# semanage boolean -l | grep  samba_enable_home_dirs
samba_enable_home_dirs         -> on    Allow samba to share users home directories.

-P make the change to the boolean persistent across reboots.

OR

semanage boolean -m --on samba_enable_home_dirs

-----------

Vsftpd

Allow anonymoys upload

setsebool ftp_home_dir 1
chcon -t public_content_rw_t /var/ftp/pub
setsebool allow_ftpd_anon_write 1
chgrp -R ftp: /var/ftp/dropbox
chmod g=wx /var/ftp/dropbox

cat /etc/vsftpd/vstfpd.conf

anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES

asdf

VNC

server side:
/etc/sysconfig/vncservers

client side:
vncviewer -via server9 localhost:2

this will make a ssh tunnel to server9 and tunnel the vnc connection.

Playing with ACLs on File Systems

2011-10-02T19:29:00.001-03:00

Enabling ACLs:

# mount -oremount,acl /

Before:

[root@zeus ~]# ll
total 20
-rw-------. 1 root root 1134 Oct 2 14:13 anaconda-ks.cfg
-rw-r--r--. 1 root root 8408 Oct 2 14:13 install.log
-rw-r--r--. 1 root root 3164 Oct 2 14:12 install.log.syslog
[root@zeus ~]# getfacl install.log
# file: install.log
# owner: root
# group: root
user::rw-
group::r--
other::r--

Giving user01 rwx permissions on install.log

[root@zeus ~]# setfacl -m u:user01:rwx install.log

After:

[root@zeus ~]# ll
total 24
-rw-------. 1 root root 1134 Oct 2 14:13 anaconda-ks.cfg
-rw-rwxr--+ 1 root root 8408 Oct 2 14:13 install.log
-rw-r--r--. 1 root root 3164 Oct 2 14:12 install.log.syslog
[root@zeus ~]# getfacl install.log
# file: install.log
# owner: root
# group: root
user::rw-
user:user01:rwx
group::r--
mask::rwx
other::r--

Removing the previous gaven permission:

[root@zeus ~]# setfacl -x u:user01 install.log
[root@zeus ~]# getfacl install.log
# file: install.log
# owner: root
# group: root
user::rw-
group::r--
mask::r--
other::r--

Assigning and removing multiple entries:

[user01@zeus ~]$ setfacl -m u:root:rw-,u:games:r-- a
[user01@zeus ~]$ getfacl a
# file: a
# owner: user01
# group: user01
user::rw-
user:root:rw-
user:games:r--
group::rw-
mask::rw-
other::r--
[user01@zeus ~]$ setfacl -b a
[user01@zeus ~]$ getfacl a
# file: a
# owner: user01
# group: user01
user::rw-
group::rw-
other::r--

Managing File Systems

2011-10-02T14:47:00.002-03:00

Volumes metadata:

# blkid
/dev/sda1: LABEL="Bootinho" UUID="7aa20f0f-49f4-4601-bd30-9067519bb6c5" TYPE="ext4"
/dev/sda2: UUID="sWPlWO-lcYm-SLk2-E5Ho-0a6T-kdBt-YZG79V" TYPE="LVM2_member"
/dev/mapper/vg_zeus-lv_root: UUID="0b494d0c-b2c2-4dbc-a73f-392bd4860ed4" TYPE="ext4"
/dev/mapper/vg_zeus-lv_swap: UUID="e6602180-14f2-4f22-811a-f9fedc7d0387" TYPE="swap"

Labeling a volume:

[root@zeus ~]# e2label /dev/sda1 Bootinho

[root@zeus ~]# tune2fs -L booootinho /dev/sda1
tune2fs 1.41.12 (17-May-2010)
[root@zeus ~]# e2label /dev/sda1
booootinho
[root@zeus ~]#

Querying a volume's label

[root@zeus ~]# e2label /dev/sda1
Bootinho

Finding volumes with a specific name

[root@zeus ~]# findfs LABEL=Bootinho
/dev/sda1

Mount using volume's label

[root@zeus ~]# mount LABEL=Bootinho /boot/

Reparing an ext2/ext3/ext4 file system

[root@zeus ~]# umount /boot/
[root@zeus ~]# e2fsck -f /dev/sda1
e2fsck 1.41.12 (17-May-2010)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
booootinho: 38/128016 files (2.6% non-contiguous), 43796/512000 blocks

Resizing an ext2/ext3/ext4 file system

[root@zeus ~]# resize2fs -p /dev/sda1
resize2fs 1.41.12 (17-May-2010)
The filesystem is already 512000 blocks long. Nothing to do!

LUN Scanning on linux

2011-09-19T16:14:00.003-03:00

COPIED FROM
http://support.dell.com/support/edocs/stor-sys/124t/en/124tvs16/install.html#enabling_lun_linux

References:
http://tldp.org/HOWTO/SCSI-2.4-HOWTO/mlproc.html

To verify the detection of a tape drive, administrators should check for its entry in /proc/scsi/scsi. Current versions of Linux may not scan the logical storage unit (LUN) ID of every device. This can result in some PowerVault devices not being identified or listed in the /proc/scsi/scsi output. Administrators can follow these steps to enable support for such devices.

Type cat/proc/scsi/scsi. The output will look similar to the following:
Attached devices:
Host: scsi3 Channel: 00 Id: 00 Lun: 00
Vendor: Quantum Model: DLT VS160 Rev: 3100
Type: Sequential-Access ANSI SCSI revision: 03

Identify the host adapter, channel number, target ID number, and LUN number for the first LUN of the device to be configured. In this example, the Certance Ultrium 2 (a drive in the PowerVault 124T) is shown at the address, or nexus, 3 0 0 0 — which means host adapter 3, channel number 0, ID 0, and LUN 0. The PowerVault 124T always has the tape drive at LUN 0 and the robot at LUN 1.
For each LUN that needs to be discovered by Linux, issue the following command: echo "scsi add-single-device H C I L">/proc/scsi/scsi
H C I L refers to the nexus described in step 2. So, with the PowerVault 124T robot configured at LUN 1, type:
echo "scsi add-single-device 3 0 0 1">/proc/scsi/scsi The echo command will force a scan of each device at the given nexus.
Type cat /proc/scsi/scsi again to verify that all devices are now listed. The output will look similar to the following:
Attached devices:
Host: scsi3 Channel: 00 Id: 00 Lun: 00
   Vendor:   Quantum Model: DLT VS160   Rev: 3100
   Type:     Sequential-Access           ANSI SCSI revision: 03 Attached devices:
Host: scsi3 Channel: 00 Id: 00 Lun: 01
   Vendor:   DELL Model: PV-124T   Rev: V31
   Type:     Sequential-Access           ANSI SCSI revision: 03
Administrators should add the echo command to the Linux boot scripts because the device information is not persistent and must be created each time the system boots up. One example file that can be used for storing the commands is /etc/rc.local. Note that configuring additional devices on a server or a storage area network (SAN) can cause the devices to be reordered, which requires administrators to modify the commands. If the Fibre Channel adapter supports Persistent Bindings or an equivalent function, it can be enabled to reduce the chance of devices being reordered upon discovery.

NOTE: This procedure must be run each time the server is booted. Also, if backup application services are running (for example, they automatically start when the OS loads), they must be disabled and re-enabled after the above procedure.

The other way to enable LUN support is to recompile the kernel and enable LUN scanning in the Adaptec driver, but it requires advanced knowledge of Linux and will not be covered here. However, it will allow the server to always boot and see the device without any manual procedures.

This procedure also applies when a new Volume (LUN) is created in a storage system and is correctly mapped to the host. In this case is necessary to ReScan the target to update the LUNs in the OS.

In the former case partprobe can be issued to update the partition table.

keywords: medium changer, linux, 124, TL2000, TL4000, tape device

mounting RAID devices on boot

2011-09-11T16:38:00.002-03:00

if you already have a software RAID configured with mdadm it won't reassemble automatically on each boot. in order to have it reassembling do the following:

mdadm --detail --scan > /etc/mdadm.conf

That's pretty much it!

Other useful commands:

Creating a RAID:

mdadm -Cv /dev/md1 -level=1 -n2 /dev/sdb1 /dev/sdc1

watching the building/rebuild status

cat /proc/mdstat

Check the RAID state:

mdadm -D /dev/md1

Simulates a failed drive:

mdadm /dev/md1 -f /dev/sdc1

Add a new drive (partition) to replaced the failed one:

mdadm --manage /dev/md1 -a /dev/sdb2

To reuse the failed drive one have to remove it and add it again to the array:

mdadm --manage /dev/md1 -r /dev/sdc1
mdadm --manage /dev/dm1 -a /dev/sdc1

Stopping a RAID:

mdadm -S /dev/md1

To "remount" a stopped or un-assembled RAID:

mdadm --assemble /dev/md1 /dev/sdb1 /dev/sdc1

mdadm --assemble --scan

one more time the gentoo wiki has thousands of good info regarding software-based RAID:
http://en.gentoo-wiki.com/wiki/RAID/Software

Add horizontal/vertical line to a char in Excel

2011-04-07T10:20:00.000-03:00

There are two methos:

Using dummy series or using dummy error bars.

http://peltiertech.com/Excel/Charts/AddLineHorzSeries.html

Tools for network analysis/traffic simulation for Linux

2011-03-27T19:30:00.001-03:00

I always forget the name of these guys:

Well known:

iptraf
darkstat
iperf
tcpstat
ntop

I never used before:

tcpflow
tcpslice
tcptrace
ngrep

Exchange 2k10: Installation Requirements

2010-10-15T11:39:00.004-03:00

Instead of ticking dozens of checkboxes heres is a few commands that would help installing all(almost?) the req. for Exchange 2k10.

Open Powershell with elevated rights using "Run As Administrator", and run below cmdlets to install prerequisites...

Import-Module ServerManager

Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart

Set-Service NetTcpPortSharing -StartupType Automatic

This will install all the features and reboot the machine.

Here there is a table with each set of requirements and commands necessary for the role you plan to install:

http://www.messagingtalk.org/exchange-2010-rc-quick-installation-guide

Even better, there are a couple of XML file containing all the requirements for different installations:

Look at DVD:\Scripts and you will find these files:

exchange-all.xml – all server roles
exchange-base.xml – only the requirements for Forest and Domain prep operations
exchange-cadb.xml – Central Admin Database role
exchange-cas.xml – Client Access Server role
exchange-eca.xml – Central Admin role
exchange-edge.xml – Edge Transport Server role
exchange-hub.xml – Hub Transport Server role
exchange-mbx.xml – Mailbox Server role
exchange-typical.xml – Typical Exchange server (Client Access, Hub Transport, and Mailbox Server roles)
exchange-um.xml – Unified Messaging role

run, for instance:

servermanagercmd -ip exchange-typical.xml

include -restart if you want it to restart automatically.

Source:
http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/0aefcc92-dc32-40cf-bf24-341d41974d0e

http://exchangeserverpro.com/installing-exchange-server-2010-pre-requisites-on-windows-server-2008

Copy music from ipod/iphone back to PC

2010-09-23T17:51:00.000-03:00

use:

http://www.getsharepod.com/

It's free!!

If you are like me and decided to control what goes in and comes out from you ipod, read: manual sync for all items is checked. Then you might need to get the apps installed back to iTunes at some point. For instance, if you will be upgrading the firmware. It's pretty simple:

iTunes - Store - Authorize this computer
iTunes - File - Transfer purchases from XXXXX iPhone

debugging with GDB

2010-05-03T20:09:00.002-03:00

Print value as hexa:

print/x variable

p/x variable

If you need more printing formats type: help x
basically:

s -> string
c -> char
t -> binary

if you coded something like this:

char * stream;

then you allocate enough memory to store you text and try to print out the contents with p *stream you will get just the first character, I guess this is because gdb sees stream as a char(1 byte long). To get the whole string one should use:

p/s (char[3])*p1.question.qname

p/s *p1.question.qname@3

These lines will print the first 3 chars of the string

OpenFire Ports

2010-01-13T20:26:00.002-02:00

Openfire uses ports 5222, 7777, 9090, 9091 for client connections, file transfer proxy, http web administration and the secured administration respectively.

Is this both TCP and UDP? anyone?

source:

http://www.tonybhimani.com/2007/12/31/openfire-jabberxmpp-server-on-centos-mini-howto/

time to be used in command line

2010-01-12T10:58:00.003-02:00

_`date "+%d-%m-%Y_%H-%M-%S"`

backup, time, date

Starting X on a differente VT

2010-01-06T20:09:00.002-02:00

That one was kind of tricky! The documentation is not explicit about that. But here is:

startx -- :1 vt2

The above command will start a new display(:1) in the second virtual terminal(accessed by pressing Ctrl+Alt+F2)

source: http://www.computing.net/answers/linux/how-to-boot-knoppix-as-root/28471.html

How to disable extra ttys

2010-01-06T18:58:00.004-02:00

For some reason new distros are no longer using /etc/inittab. /etc/event.d/ is used instead.

In order to disable a virtual terminal you can basically exclude or move to another directory the files representing the VT. tty1 for VT1(accessed by Ctrl+Alt+F1), so on and so forth.

source: http://crunchbanglinux.org/wiki/howto/disable_extra_ttys

How find out which windows DC you logged in

2009-12-05T23:09:00.002-02:00

So simple:

echo %LOGONSERVER%

systeminfo

To get a list os availble DC's in a specific domain:

nltest /dclist:domain.com

veriyfing that a domain controller can be located for a specific domain

nltest /dsgetdc:domain.com

More info:
How Domain Controllers Are Located in Windows

Descobrir SID de Grupos Windows

2009-11-23T14:44:00.005-02:00

Caso você não consiga utilizar a sintaxe dominio\grupo com o ntlm-auth ou qualquer outro binário que utilize esse formato. É possível utilizar o SID do objeto.

# ntlm_auth --username=teste --password=senha --require-membership-of=domain\\gg_hr
[2009/11/23 14:45:31, 0] utils/ntlm_auth.c:get_require_membership_sid(236)
Could not parse domain\group into seperate domain/name parts!

# wbinfo -n gg_hr

S-1-5-21-2153899196-3371015479-2672548576-1129 Domain Group (2)

ou ADSI Edit do windows objectSID

some vbscript for Nagios checks

2009-11-11T13:26:00.004-02:00

Detect if media is connected to a interface:



aStatusStr = Split("Disconnected,Connecting,Connected,Disconnecting," _
& "Hardware not present,Hardware disabled,Hardware malfunction," _
& "Media disconnected,Authenticating,Authentication succeeded," _
& "Authentication failed,Invalid address,Credentials required", ",")

strComputer = "."
Set oWMI = GetObject("winmgmts:" _
  & "{impersonationLevel=impersonate}!\\" & strComputer _
  & "\root\cimv2")

Set cItems = oWMI.ExecQuery("Select * from Win32_NetworkAdapter"_
         & " where AdapterTypeID = 0") ' 0 = Ethernet 802.3

For Each oItem in cItems
''if Instr(oItem.NetConnectionID, "LAN") > 0 then

if oItem.NetConnectionID <> "" then

  output = output & oItem.NetConnectionID & ": "_
           & aStatusStr(oItem.NetConnectionStatus) & " * "
    
End if
''End if
Next

Wsh.echo output
WScript.Quit(0)
''' Source: http://msdn.microsoft.com/en-us/library/aa394216%28VS.85%29.aspx

Detect which node is the Active and Passive in a Windows Cluster environment:



set WshShell = CreateObject( "WScript.Shell" )  

Set objNet = CreateObject("WScript.NetWork") 
                      
Dim strComputerName
strComputerName =  objNet.ComputerName


sExe = "cluster resource ""cluster ip address"""
with CreateObject("WScript.Shell")
  with .Exec(sExe)
    with .StdOut
      do until .AtEndofStream
        s = s & Replace(.ReadLine, vbcr, "") _
          & vbNewLine
      Loop
    end with ' StdOut
  end with ' Exec
end with ' Shell

'wsh.echo s 
Result = InStr(1, s, strComputerName, VBTEXTCOMPARE)


if Result <> 0 then
WScript.echo strComputerName & " is the ACTIVE"
Else
WScript.echo strComputerName & " is the PASSIVE"
end if

WScript.Quit(0)

Resizing physical disk and logical volumes

2009-11-04T17:32:00.005-02:00

This is a VM which had the HD resized. Now it's time to resize the LVM partition, actually you don't do that, you will resize the PV.


sles11_php:~ # fdisk -l /dev/sda

Disk /dev/sda: 16.1 GB, 16106127360 bytes
255 heads, 63 sectors/track, 1958 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x0005035d

  Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           2           9       64260   83  Linux
/dev/sda2              10          74      522112+  82  Linux swap / Solaris
/dev/sda3              75        1958    15133230   8e  Linux LVM

Here you can see sda3 now with 15Gb

Now it's time to resize the PV




sles11_php:~ # pvdisplay
 --- Physical volume ---
 PV Name               /dev/sda3
 VG Name               VGroot
 PV Size               9.43 GB / not usable 263.50 KB
 Allocatable           yes
 PE Size (KByte)       4096
 Total PE              2414
 Free PE               238
 Allocated PE          2176
 PV UUID               LGgBQf-sw8J-fbnu-1EHL-0z1G-J31k-eAJoXc

sles11_php:~ # pvscan
 PV /dev/sda3   VG VGroot   lvm2 [9.43 GB / 952.00 MB free]
 Total: 1 [9.43 GB] / in use: 1 [9.43 GB] / in no VG: 0 [0   ]

sles11_php:~ # pvresize /dev/sda3
 Physical volume "/dev/sda3" changed
 1 physical volume(s) resized / 0 physical volume(s) not resized

sles11_php:~ # pvdisplay
 --- Physical volume ---
 PV Name               /dev/sda3
 VG Name               VGroot
 PV Size               14.43 GB / not usable 2.36 MB
 Allocatable           yes
 PE Size (KByte)       4096
 Total PE              3694
 Free PE               1518
 Allocated PE          2176
 PV UUID               LGgBQf-sw8J-fbnu-1EHL-0z1G-J31k-eAJoXc

sles11_php:~ #


sles11_php:~ # vgdisplay
 --- Volume group ---
 VG Name               VGroot
 System ID
 Format                lvm2
 Metadata Areas        1
 Metadata Sequence No  8
 VG Access             read/write
 VG Status             resizable
 MAX LV                0
 Cur LV                6
 Open LV               6
 Max PV                0
 Cur PV                1
 Act PV                1
 VG Size               14.43 GB
 PE Size               4.00 MB
 Total PE              3694
 Alloc PE / Size       2176 / 8.50 GB
 Free  PE / Size       1518 / 5.93 GB
 VG UUID               CexmBK-uOq6-fnjo-qxFV-SIWW-04ZM-LENpdq

The VG didn't need any changes.



sles11_php:~ # lvresize -l +50%FREE /dev/VGroot/LVusr
 Extending logical volume LVusr to 5.46 GB
 Logical volume LVusr successfully resized



sles11_php:~ # df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VGroot-LVroot
                    1014M  357M  658M  36% /
udev                  248M  104K  247M   1% /dev
/dev/sda1              61M   16M   42M  28% /boot
/dev/mapper/VGroot-LVhome
                    1014M  4.3M 1010M   1% /home
/dev/mapper/VGroot-LVopt
                    1014M   60M  955M   6% /opt
/dev/mapper/VGroot-LVtmp
                    1014M  5.5M 1009M   1% /tmp
/dev/mapper/VGroot-LVusr
                     2.5G  2.4G  140M  95% /usr
/dev/mapper/VGroot-LVvar
                     2.0G  235M  1.8G  12% /var


sles11_php:~ # xfs_growfs  /usr/
meta-data=/dev/mapper/VGroot-LVusr isize=256    agcount=4, agsize=163840 blks
        =                       sectsz=512   attr=2
data     =                       bsize=4096   blocks=655360, imaxpct=25
        =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0
log      =internal               bsize=4096   blocks=2560, version=2
        =                       sectsz=512   sunit=0 blks, lazy-count=0
realtime =none                   extsz=4096   blocks=0, rtextents=0
data blocks changed from 655360 to 1432576



sles11_php:~ # df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VGroot-LVroot
                    1014M  357M  658M  36% /
udev                  248M  104K  247M   1% /dev
/dev/sda1              61M   16M   42M  28% /boot
/dev/mapper/VGroot-LVhome
                    1014M  4.3M 1010M   1% /home
/dev/mapper/VGroot-LVopt
                    1014M   60M  955M   6% /opt
/dev/mapper/VGroot-LVtmp
                    1014M  5.5M 1009M   1% /tmp
/dev/mapper/VGroot-LVusr
                     5.5G  2.4G  3.2G  44% /usr
/dev/mapper/VGroot-LVvar
                     2.0G  235M  1.8G  12% /var

Here is a list of tools you need to extend each partition's type:

http://tldp.org/HOWTO/LVM-HOWTO/extendlv.html

An excellent howto in LVM:
http://www.ibiblio.org/pub/Linux/docs/HOWTO/other-formats/html_single/LVM-HOWTO.html

Resizing a ext3 partition with progress bar :)

e2fsck -f -C 0 /dev/xxx

If you forget the -C 0(zero) option you can send a SIGUSR1 signal to the process, like this:

kill -SIGUSR1 e2fsc_PID

Now it's time to actually resize:

resize2fs -p /dev/xxx

samba binding only a specifig interface

2009-10-30T09:09:00.001-02:00

Tip: If your box has multiple NICs, you may not want Samba to broadcast its presence on both interfaces. To make it only use one IP add the following, in [global]:

interfaces = [interface_ip]/32 127.0.0.1/8
bind only interfaces = yes

Managing cached connections

2009-10-28T16:23:00.005-02:00

I'm developing a script to failover different links when one of them fails. After some tests I could see some strange behavior. After changing the routing table, flushing the route cache, removing the NAT rule and creating a new one to satisfy the new link, the packets were going out through the new interface(specified in the new route) but using the translated IP address of the old NAT rule.

After some research I found out that linux kernel keeps a kind of cache for all connections, maybe just the NATed ones?!

The nice thing is you can see this table:

cat /proc/net/ip_conntrack

The netfilter team also developed a tool to manage this table, flush, list, delete, add entries, etc.
It's called conntrack-tools. It's a replacement for the /proc interface. What you will need is to compile and install the following:

libnfnetlink
libnetfilter_conntrack
conntrack-tools

You can download all the sources from:
http://conntrack-tools.netfilter.org/downloads.html

After installed you can call the conntrack binary.
I.e.:

conntrack -L -d x.x.x.x

The above command list all entries with x.x.x.x destination IP.

conntrack -F

The above command flushes the whole table. That's exactly what I have to do in order in my fail-over scripts.

conntrack -L -m 11

If you're using the MARK target in any iptables rule you can check out if the packets are being marked correctly with the above command. This command list all the connections with mark=11(-j MARK --set-mark 11)

References:

http://linux.derkeiler.com/Mailing-Lists/Debian/2005-08/3411.html
http://lists.netfilter.org/pipermail/netfilter-devel/2002-October/009530.html
http://mailman.ds9a.nl/pipermail/lartc/2003q1/007249.html
http://linux.die.net/man/8/conntrack
http://www.mail-archive.com/netfilter-devel@lists.samba.org/msg01394.html
http://conntrack-tools.netfilter.org/downloads.html

customizing ls time output

2009-10-27T17:39:00.001-02:00

ls -l --time-style="+%d-%m-%Y %H:%M:%S" /var/log/xxxxxxx

It's the same syntax used by date command

Compilation stuff

2009-10-27T09:37:00.001-02:00

./configure
....
checking lex library... -lfl
checking whether yytext is a pointer... yes
checking for bison... bison -y
checking for pkg-config... yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for LIBNFNETLINK... no
configure: error: Cannot find libnfnetlink >= 1.0.0

However libnfnetlink was installed.

# ls /usr/local/lib/pkgconfig/
libnetfilter_conntrack.pc libnfnetlink.pc

# pkg-config --libs libnfnetlink
Package libnfnetlink was not found in the pkg-config search path.
Perhaps you should add the directory containing `libnfnetlink.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libnfnetlink' found

# PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ pkg-config --libs libnfnetlink
-L/usr/local/lib -lnfnetlink

Solution:
PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure

Download RPM's from yum repos

2009-10-26T00:38:00.001-02:00

Use:

yumdownloader packagename

yumdownloader is included in yum-utils package

Playing with ip command

2009-10-15T08:39:00.002-03:00

ip -o -s -s route show table cache

Existe um tabela chamada "cache" que nem preciso dizer que ela contém o cache :)

com a opção -s é exibido a idade(age), em segundos, daquela entrada, quantas vezes aquela regra foi usada(used), etc.

A opção -o é só pra mostra tudo em uma linha só. Fica mais fácil de fazer grep ou wc -l

A idade é zerada toda vez que aquela regra é usada e a o valor used é incrementado.

Não consegui determinar de quanto em quanto tempo essa tabela é esvaziada. Apenas determinei que de tempos em tempos ela é completamente zerada e reiniciada. Uma vez que eu acompanhei demorou algo em torno de 8 minutos, de uma outra vez 3:30min, depois 4 min cravados. Então o mais certo é: vai saber né?

o importante é lembrar que quando se alterar rotas ou rules é importante limpar essa tabela de cache com o comando:


ip route flush cache


ip r f c

Do contrário você vai morrer tentando e não vai entender o comportamento do seu linux roteando.

Vou só incluir alguns comando aqui de exemplo que serão úteis logo logo:

ip rule show

ip rule add from 192.168.0.0/24 table 10
ou
ip rule add from 192.168.0.0/24 table dez
ou
ip rule add from 192.168.0.0/24 lookup 10
ou
ip rule add from 192.168.0.0/24 table dez

Observações:
lookup ou table podem ser usado interchangeable.

o Nome ou número da tabela no arquivo /etc/iproute2/rt_tables também podem ser usados interchangeable.

ip rule from 10.1.1.0/22 lookup WAN
ip rule to 200.0.0.1/24 lookup ADSL

Usando marcas(lembrando que o pacote não é alterado de forma alguma, essa marcação quem toma conta é o kernel, como se fosse NAT, pois existem uma tabela, porém no NAT o pacote ainda é alterado, nesse caso não):

iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -j MARK --set-mark 10
ip rule add fwmark 10 table GVT

Se você realmente deseja alterar o pacote deve usar o alvo TOS do iptables(não testei):

iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -j TOS --set-tos 0x10

tente: iptables -j TOs -h para descobrir as opções do --set-tos

ip rule add tos 0x10 lookup 10

Quando você for listar as rules você verá que surge na tela 'lowdelay' ao invés do valor 0x10. Isso porque o ip traduz e/ou mapeia isso de acordo com o arquivo /etc/iproute2/rt_dsfield

ip route get 192.168.1.55

Will pretend sending a packet to this destination resolve and get back the route that will be used to reach the destination. It actually creates an entry into the cache table. Check it out with ip route show cache

As the manual says it's equivalent to send a ping and running ip route show cache.

Autoload modules in CentOS

2009-10-02T08:53:00.001-03:00

40.2. Persistent Module Loading

Kernel modules are usually loaded directly by the facility that requires them, which is given correct settings in the /etc/modprobe.conf file. However, it is sometimes necessary to explicitly force the loading of a module at boot time.

Red Hat Enterprise Linux checks for the existence of the /etc/rc.modules file at boot time, which contains various commands to load modules. The rc.modules should be used, and not rc.local because rc.modules is executed earlier in the boot process.

For example, the following commands configure loading of the foo module at boot time (as root):

# echo modprobe foo >> /etc/rc.modules
# chmod +x /etc/rc.modules

http://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-kernel-modules-persistant.html