Archive for March 18th, 2012

Setup Password protect Directory via shell

1. Create a file name .htaccess in the folder that you want to password protect with the content below.

AuthType Basic
AuthUserFile /home/username/pass
AuthName “Members Area”
require valid-user

2. In shell, type

/usr/local/apache/bin/htpasswd -c /home/username/pass your_desire_username

You will be prompt for a new password.

3. Enter the password and confirm it.

Once you enter your password, file with name .htpasswd will be created at /home/username directory and now the website folder has been password protected.

4. To add additional users,

/usr/local/apache/bin/htpasswd /home/username/pass your_desire_username

5. To remove users edit /home/username/pass and remove the line contains the username.

Install CSF on VPS (OpenVZ)

Install CSF
———-

cd /usr/src
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

Edit /etc/csf/csf.conf file. Search and change ETH_DEVICE as below since there is no eth0 in a VPS.

ETH_DEVICE = “”

to

ETH_DEVICE = “venet+”

Check if Iptable modules are added in the /etc/vz/vz.conf file, if not you can add on the /etc/vz/vz.conf or add the modules individually for the required vps.

vi /etc/vz/conf/VEID.conf

IPTABLES=”iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc”

restart VPS

Setup reverse dns on named (bind)

1.Find where the named configuration files are:

cat /etc/sysconfig/named | grep ROOTD

You can see an uncommented line as below.

ROOTDIR=/var/named/chroot

This means the root directory will be  /var/named/chroot. The named configuration file will be stored inside /var/named/chroot/etc/named.conf

Zone files will be stored in the directory /var/named/chroot/var/named

 

If it is commented like below the root directory will be /etc

#ROOTDIR=/var/named/chroot

This means the root directory will be  / . The named configuration file will be stored inside /etc/named.conf

Zone files will be stored in the directory /var/named

 

2.Assume we need to setup RDNS for the IP, say 11.22.33.44,  to the domain server.domain.com.

Create the zone file /var/named/chroot/var/named/33.22.11.in-addr.arp

zone file is named – first 3 octet of the IP in reverse order, the 4th octect will be added in the zone file as below):

$TTL 86400
@ IN SOA ns4.domain.com. root.ns4.domain.com. (
2009091454 ; serial
28800 ; refresh
14400 ; retry
1814400 ; expire
86400 ; default_tt
)
IN NS ns4.domain.com.
IN NS ns1.domain.com.
11       IN PTR ns1.domain.com.

 

3.Now you need to mention this in the named.conf file. For this you can add an include file inside named.conf.

include “/etc/reverse.conf”;

Now add the following isnide the include file

vi /var/named/chroot/etc/reverse.conf

zone “33.22.11.in-addr.arpa” {type master; file “/var/named/33.22.11.in-addr.arpa”; };

 

4.Restart named and have a test.

VPS Migration

Install vzdump command if it is not installed in the Node.

1.Download

#wget http://download.openvz.org/contrib/utils/vzdump/vzdump-1.2-4.noarch.rpm

There will be some dependency errors while installing vzdump. Please install those also also using rpm.

How to take dump of a vps?

>> vzdump vid

While using the vzdump command I got the below given error :

Can’t locate PVE/VZDump.pm in @INC (@INC contains: /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/5.8.8 .) at /usr/sbin/vzdump line 27.
BEGIN failed–compilation aborted at /usr/sbin/vzdump line 27.

Solution :

ln -s /usr/share/perl5/PVE/ /usr/lib/perl5/5.8.8/PVE

After that take the dump of the vps again using the command vzdump vid. The dump will get created in the /vz/dump partition.

When it gets completed we need to scp the vps dump to the Node were we wants to restore it.

How to restore a vps?

>> vzrestore vzdump-777.tar 160, where 160 is the VID of the vps to which we are going to restore.

After migration the VPS was not listing in the Hypervm.

>> Stop the vps which was migrated.
>> Move the conf file of the vps from /etc/vz/conf
>> Move the vps data also from /vz/private to avoid conflicts.
>> Create vps from hypervm
>> Move back the data and conf of the vps.
>> Restart the vps
>> Migrated vps will appear in the Hypervm.
================================

kernel parameters & Sysctl

There are lot of kernel parameters and those parameters can be viewed from /proc/sys/ directory. Modification of values of these parameters will persit only until the next reboot of the system.

We can modify these kernel parameter values manually. i.e. by echoing new values to files in /proc/sys/ [Each parameters have a file in /proc/sys/ directory].

sysctl provides CLI interface for editing/viewing these parameters. It has various options too.

I am going to exaplain little more about kernel parameters with an example.

hostname is a kernel parameter which stores hostname of the system. Its location is "/proc/sys/kernel/hostname"

The value for this parameter is loaded to kernel by rc.sysinit file during the boot process.

[root@ ~]# cat /etc/rc.sysinit

#!/bin/bash

#

# /etc/rc.d/rc.sysinit - run once at boot time

#

# Taken in part from Miquel van Smoorenburg's bcheckrc.

#

 

HOSTNAME=$(/bin/hostname)

Note :I truncated the remaining portion of this file since currently we are only intrested in HOSTNAME

So while booting the OS we pass the value of hostname to kernel through rc.sysinit file and hence changing the hostname through /etc/sysconfig/network file needs rebooting the OS to take into effect.

Alternatively we can change the hostname without any reboot by following method.

[root@ ~]# hostname

host1.server2.com

[root@ ~]# vi /etc/sysconfig/network # Edit the value for HOSTNAME to host2.server2.com

[root@ ~]# sysctl -w kernel.hostname="host2.server2.com"

[root@ ~]# bash

[root@ ~]# hostname

host2.server2.com

This can also be done via echoing new value to /proc/sys/kernel/hostname

Like this:

echo host2.server2.com > /proc/sys/kernel/hostname

Note : I mean this article only for make you undestatnd about the kernel parameters and its values. The simplest way for modifying the hostname is by using /bin/hostname

Parameters available for sysctl

variable

The name of a key to read from.  An example is kernel.ostype.  The ’/’ separator is also accepted in place of a ’.’.

variable=value

To set a key, use the form variable=value, where variable is the key and value is the value to set it to. If the value contains quotes or characters which are parsed by the shell, you may need to enclose the value in double quotes. This requires the -w parameter to use.

-n Use this option to disable printing of the key name when printing values.

-e Use this option to ignore errors about unknown keys.

-N Use this option to only print the names. It may be useful with shells that have programmable completion.

-q Use this option to not display the values set to stdout.

-w Use this option when you want to change a sysctl setting.

-p Load in sysctl settings from the file specified or /etc/sysctl.conf if none given. Specifying – as filename means reading data from standard input.

-a Display all values currently available.

-A Display all values currently available in table form.

Examples:

/sbin/sysctl -a

/sbin/sysctl -n kernel.hostname

/sbin/sysctl -w kernel.domainname=”example.com”

/sbin/sysctl -p /etc/sysctl.conf

We can add persistance to the kernel values by editing/adding values in /etc/sysctl.conf

[root@host13 ~]# cat /etc/sysctl.conf

# Kernel sysctl configuration file for Red Hat Linux

#

# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and

# sysctl.conf(5) for more details.

# Controls IP packet forwarding

net.ipv4.ip_forward = 0

# Controls source route verification

net.ipv4.conf.default.rp_filter = 1

# Do not accept source routing

net.ipv4.conf.default.accept_source_route = 0

# Controls the System Request debugging functionality of the kernel

kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.

# Useful for debugging multi-threaded applications.

kernel.core_uses_pid = 1

# Disable netfilter on bridges.

net.bridge.bridge-nf-call-ip6tables = 0

net.bridge.bridge-nf-call-iptables = 0

net.bridge.bridge-nf-call-arptables = 0

SSH Port Forwarding

SSH port forwarding, or TCP/IP connection tunneling, is a process whereby a TCP/IP connection that would otherwise be insecure is tunneled through a secure SSH link, thus protecting the tunneled connection from network attacks.

In other words, port forwarding, or tunneling, is a way to forward insecure TCP traffic through SSH Secure Shell.

There are two kinds of port forwarding:

1. Local port forwarding and

2. Remote port forwarding

They are also called outgoing and incoming tunnels, respectively.

Syntax:

Local port forwarding :

ssh SSHHOST -L LPORT:RHOST:RPORT

[You can use SSHHOST and RHOST as same or different]

Remote port forwarding :

ssh SSHHOST -R RPORT:LIP:LPORT

Example for local port forwarding:

Aim : Access a service (in this example SSH port tcp/22, but it could be anything like a web server on tcp/80) on machine “YY.YY.YY.YY”

From your shell type:

ssh root@XX.XX.XX.XX -L 10000:YY.YY.YY.YY:22

Then, from your local machine, you should be able to connect to YY.YY.YY.YY by

ssh root@localhost -p 10000

Example for Remote Port Forwarding:

Aim : Access a service in your home machine from your office (in this example SSH port tcp/22, but it could be anything like a web server on tcp/80)

From your machine at home type following:

ssh root@server1SSHHOST.COM -R 10000:192.168.1.19:22

Then SSH to the server “server1SSHHOST.COM” from your machine at office and type following.

ssh root@localhost -p 10000

Note : Don’t forget to open necessary ports on any firewall either at home or work.

CHECK_NRPE: Socket timeout after 10 seconds

checking the NRPE installations when we use this command …

# /usr/local/nagios/libexec/check_nrpe -H localhost

or

# /usr/local/nagios/libexec/check_nrpe -H <IP Address of remote machine>

e.g.

# /usr/local/nagios/libexec/check_nrpe -H 10.32.23.189

shows following error message…

CHECK_NRPE: Socket timeout after 10 seconds

So, I googled alot, after searching alot, I came across few of the solutions, (thanks for those who post it).

I am just clubbing those solution…

1. check that local NRPE (remote host) is working fine…

# /usr/local/nagios/libexec/check_nrpe -H localhost
NRPE v2.8

(So, u got the above output, means remote host NRPE installation is fine.)

2. Now, from the nagios server box, run the comand

# /usr/local/nagios/libexec/check_nrpe -H
CHECK_NRPE: Socket timeout after 10 seconds.

ok, u got the error ! hmmm…

3. Now, check that ur nagios server is allowing the incoming & outgoing connection via port 5666

# /sbin/iptables -A INPUT -p tcp  --dport 5666 -j ACCEPT
# /sbin/iptables -A OUTPUT -p tcp  --dport 5666 -j ACCEPT

4.After adding the rules, make sure to save your new IPTables rules by doing

# /sbin/iptables-save > /etc/sysconfig/iptables

that’s it !!!

Try again the command

# /usr/local/nagios/libexec/check_nrpe -H localhost

or

# /usr/local/nagios/libexec/check_nrpe -H <IP Address of remote machine>