TechieReaders

cloud-init change default user -AWS

2020-07-14T04:01:00.000-07:00

If you are using custom AMI, you may want to use non-standard user instead of using default cloud-user. Replace cloud-user with any other user which you have probably already created for your AMI.

modify /etc/cloud/cloud.cfg


system_info:
  default_user:
    name: cloud-user
    lock_passwd: true
    gecos: Cloud User
    groups: [wheel, adm, systemd-journal]
    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
    shell: /bin/bash
  distro: rhel
  paths:
    cloud_dir: /var/lib/cloud
    templates_dir: /etc/cloud/templates
  ssh_svcname: sshd

End it with folloowing command to rerun user related changes with new instance launch / reboot.

cloud-init clean

Postfix- Relay mails via office365.com

2020-07-06T04:54:00.000-07:00

Following configuration will help you setup office365.com mail delivery using postfix.
Install required packages.

yum install cyrus-sasl-sql cyrus-sasl-plain cyrus-sasl-lib -y

append following in /etc/postfix/main.cf

relayhost = [smtp.office365.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_generic_maps = hash:/etc/postfix/generic
smtp_tls_security_level = may
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

update generic file with sender email address, else office365.com server will reject your mails.

/etc/postfix/generic
@localdomain.local      your_office365_email_id

/etc/postfix/sasl_passwd
smtp.office365.com your_office365_email_id:your_password

restart service

postmap /etc/postfix/generic
postmap /etc/postfix/sasl_passwd
service postfix restart

Postfix- Relay mails via outlook.com

2020-06-29T04:51:00.000-07:00

Following configuration will help you setup outlook.com mail delivery using postfix.
Install required packages.

yum install cyrus-sasl-sql cyrus-sasl-plain cyrus-sasl-lib -y

append following in /etc/postfix/main.cf

relayhost = [smtp-mail.outlook.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_generic_maps = hash:/etc/postfix/generic
smtp_tls_security_level = may
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

update generic file with sender email address, else outlook.com server will reject your mails.

/etc/postfix/generic
@localdomain.local      your_id@outlook.com

/etc/postfix/sasl_passwd
smtp-mail.outlook.com your_id@outlook.com:your_password

restart service

postmap /etc/postfix/generic
postmap /etc/postfix/sasl_passwd
service postfix restart

Postfix- Relayhost with plain auth

2020-06-22T04:35:00.000-07:00

If you wish to relay mails through your isp smtp server or any other, which requires plain/any auth, following config will help you.
Assuming that you have fresh postfix installed.

Install Dependency
yum install cyrus-sasl-plain -y

Postfix Configuration
add below lines in /etc/postfix/main.cf

relayhost = RELAY_SMTP_SERVER:PORT
smtp_sasl_auth_enable   = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
myorigin = MY-MAIL-SERVER

Enable Smtp Auth for relayhost

cat /etc/postfix/sasl_passwd

RELAY_SMTP_SERVER EMAIL_ADDRESS:PASSWORD

postmap /etc/postfix/sasl_passwd
service postfix reload

udev renamed network interface eth0 to ...

2020-06-15T05:43:00.000-07:00

udev renamed network interface eth0 to eth1 / eth2 (dmesg | grep eth)

Above message you'll hardly find while working on physical machine.
I have not faced this message on Citrix Xenserver, probably xenserver tools takes care of this.

This is what I faced while cloning one of VM on KVM. After cloning one of CentOS VM network wasn't working.

To resolve this, all you need is to remove / comment following lines from one of /etc/udev/rules.d/ files

Here I found eth0 entry in 70-persistent-net.rules


SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:fe:18:e6", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:c2:b2:d3", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

Once above lines removed / commented, you'll be able to configure interface as eth0.
You can also change eth1 / eth2 to eth0 for the relevant mac address.

SSH / SCP key authentication

2020-06-09T05:38:00.000-07:00

Many time bash scrip demands scp. OR you may not wish to enter password every time you access remote server.

Generate key for local system.

ssh-keygen -t rsa

Copy key to remote server.

ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.1.1

Now you can ssh / scp without entering password.
For old system not equipped with ssh-copy-id

ssh-keygen -t rsa
scp ~/.ssh/id_rsa.pub root@192.168.1.1:
ssh root@192.168.1.1 ‘cat id_rsa.pub >> .ssh/authorized_keys’

NTP Client on CentOS / Fedora

2020-06-02T05:36:00.000-07:00

NTP Client configuration.
It is very easy to configure NTP client on Linux machine.
Just two steps required to sync clock.

yum install ntp
ntpdate -u 1.pool.ntp.org

You can configure cron job to run 2nd step on schedule OR you can put in /etc/rc.local

Puppet restart service on file change

2020-05-20T23:53:00.003-07:00

Following is sample puppet manifest to reload service after file change. This may come handy if you want to reload service once config file is updated.


class cmk_cache {
case $::kernel {
'Linux': {

	service { 'xinetd':
	ensure  => 'running',
	enable  => true,
		}

	# add a notify to the file resource
	file { '/etc/xinetd.d/check_mk':
	notify  => Service['xinetd'],  # this sets up the relationship
	source => "puppet:///modules/cmk_cache/check_mk",
		}
}
}
}

Here we are refreshing / restarting xinetd service once check_mk xinetd file is updated.

FIX - Qmail -- cannot start qmail-send is already running

2020-05-18T21:47:00.003-07:00

cannot start qmail-send is already running

Above error is usually caused when you restart qmailctl, & force start qmail-send. This happens because of qmail-send is not completely shutdown as qmail-remote is busy with remote mail delivery Or qmail-local is taking time to write local mail which is unlikely.

To quickly fix you can kill qmail-remote process & wait for it to restart.

Best option is to wait for qmail-remote to complete mail delivery, once delivery is completed qmail-send should start gracefully.

Upgrade Fedora 31 to 32 using shell / dnf

2020-05-18T21:47:00.001-07:00

Use following commands to upgrade fedora.

sudo dnf install dnf-plugin-system-upgrade
sudo dnf system-upgrade download --releasever=32
sudo dnf system-upgrade reboot

Upgrade Ubuntu ver using shell

2020-05-18T21:46:00.002-07:00

sudo apt update && sudo apt upgrade --yes
sudo apt install update-manager-core
sudo do-release-upgrade

if above command does not start upgrade, use below one to force it.

sudo do-release-upgrade -d

CentOS 8 upgrade php version

2020-05-18T21:46:00.000-07:00

List all supported php ver for installation using dnf command.

[root@cent8 ~]# dnf module list php
Last metadata expiration check: 0:03:17 ago on Mon 11 May 2020 10:23:49 AM IST.
CentOS-8 - AppStream
Name    Stream        Profiles                      Summary                 
php     7.2 [d][e]    common [d], devel, minimal    PHP scripting language
php     7.3           common, devel, minimal        PHP scripting language

enable php 7.3 for upgrade / installaiton

dnf module enable php:7.3

verify that php 7.3 is enabled for upgrade

[root@cent8 ~]# dnf module list php
Last metadata expiration check: 0:08:58 ago on Mon 11 May 2020 10:23:49 AM IST.
CentOS-8 - AppStream
Name     Stream      Profiles                      Summary                  
php      7.2 [d]     common [d], devel, minimal    PHP scripting language                          
php      7.3 [e]     common, devel, minimal        PHP scripting language

upgrade packages

dnf update

Lets Encrypt certificate installation

2020-05-18T21:44:00.002-07:00

Let's encrypt provides free ssl / tls certificate for 90 days, after 90 days you need to renew certificate.

Install git.

yum -y install git

apt-get install git

Install letsencrypt cert.

git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
cd /opt/letsencrypt
./letsencrypt-auto

Last command will install any remaining dependencies, and you will get prompt to enter / select website for which you want to generate certificate. This script will auto install certificate, once done restart apache for config to take effect.

Squid Proxy

2009-04-18T16:27:00.000-07:00

Squid is a caching proxy server.
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It runs on most available operating systems, including Windows and is licensed under the GNU GPL.
Read More

Squid is available with major linux distributions like CentOS, Fedora.

To install Squid

yum install squid

To configure Squid.

vi /etc/squid/squid.conf
visible_hostname test.squid

Restart Squid Service

service squid restart

Use your local squid proxy server ip address & port 3128 (squid default port) to configure in internet clients. While accessing internet you’ll get error Access Denied.

To allow internet access to your local lan.

vi /etc/squid/squid.conf
acl myuser src 192.168.1.0/255.255.255.0
http_access allow myuser

To allow all internet sites, blocking few e.g jobs, community.

acl myuser src 192.168.1.0/255.255.255.0
acl deniedsites url_regex “/etc/squid/denied” #list of the sites blocked
http_access deny myuser deniedsites #to block ban sites
http_access allow myuser

To disabled caching for specific sites, you might require to disable caching for few sites e.g intranet site.

acl MYSITES url_regex “/etc/squid/nocache”
no_cache deny MYSITES

Squid with ARP instead ip address.
You may be using DHCP with minimum lease time, in this case you require to filter sites using MAC ADD instead of ip address.

You need to compile Squid from source with --enable-arp-acl (use squid -v & add all existing configuration option.)

acl yahoomailuser arp “/etc/squid/yahoomailuser” #list of the user’s mac add
acl yahoomail url_regex “/etc/squid/yahoomail” #url allowed
http_access allow yahoomailuser yahoomail

Transparent proxy.

vi /etc/squid/squid.con
http_port 192.168.1.1:3128 transparent # squid local ip address

OR

http_port 3128 transparent

Transparent proxy is used when you do not wish to define proxy settings in clients terminal, for that you need to do port redirection using iptables over gateway.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128