Pages

Showing posts with label System Admin. Show all posts
Showing posts with label System Admin. Show all posts

Tuesday, 26 August 2014

Tomcat SSL requirement from client

    <Connector port="443"
               keystoreFile="/root/certificates/keystore.store"
               keystorePass="<keystorePass>"
               SSLEnabled="true"
               maxThreads="150"
               scheme="https"
               secure="true"
               connectionTimeout="2000"
               clientAuth="true"
               sslProtocol="TLS"
               address="172.16.95.162"
               restrictedUserAgents="^.*MS Web Services Client Protocol.*$"/>

clientAuth - Set to true if you want the SSL stack to require a valid certificate chain from the client before accepting a connection. Set to want if you want the SSL stack to request a client Certificate, but not fail if one isn't presented. A false value (which is the default) will not require a certificate chain unless the client requests a resource protected by a security constraint that uses CLIENT-CERT authentication.







Monday, 23 June 2014

Rebuild initrd in Redhat Linux

Reference (Rebuild initrd and boot sequence): http://advancelinux.blogspot.ca/2013/06/how-to-rebuild-initrd-or-initramfs-in.html
 

What is initrd?

 The initial RAM disk (initrd) is an initial root file system that is mounted prior to when the real root file system is available. The initrd is bound to the kernel and loaded as part of the kernel boot procedure.

When do we need to rebuild initrd?
  • If adding new hardware to a system that may be used very early in the boot process.
  • If changing configuration files that may be used very early in the boot process
  • If changing the options on a kernel module.

How to rebuild initrd?

mkinitrd -f -v /boot/initrd-$(uname -r).img $(uname -r)

mkinitrd -f -v /boot/initrd-2.6.18-164.el5.img 2.6.18-164.el5

Kernel and initrd path in grub.conf

[root@localhost grub]# pwd
/boot/grub
[root@localhost grub]# cat grub.conf
# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title Red Hat Enterprise Linux Server (2.6.18-348.el5)
        root (hd0,0)
        kernel /vmlinuz-2.6.18-348.el5 ro root=/dev/VolGroup00/LogVol00 rhgb quiet crashkernel=128M@16M
        initrd /initrd-2.6.18-348.el5.img

Tuesday, 27 May 2014

File System Failures

http://www.cyberciti.biz/tips/surviving-a-linux-filesystem-failures.html 

 

Surviving a Linux Filesystem Failures

by on November 8, 2005 · 26 comments· LAST UPDATED November 15, 2007
When you use term filesystem failure, you mean corrupted filesystem data structures (or objects such as inode, directories, superblock etc. This can be caused by any one of the following reason:
* Mistakes by Linux/UNIX Sys admin
* Buggy device driver or utilities (especially third party utilities)
* Power outage (very rarer on production system) due to UPS failure
* Kernel bugs (that is why you don't run latest kernel on production Linux/UNIX system, most of time you need to use stable kernel release)
Due to filesystem failure:
  • File system will refuse to mount
  • Entire system get hangs
  • Even if filesystem mount operation result into success, users may notice strange behavior when mounted such as system reboot, gibberish characters in directory listings etc
So how the hell you are gonna Surviving a Filesystem Failures? Most of time fsck (front end to ext2/ext3 utility) can fix the problem, first simply run e2fsck - to check a Linux ext2/ext3 file system (assuming /home [/dev/sda3 partition] filesystem for demo purpose), first unmount /dev/sda3 then type following command :
# e2fsck -f /dev/sda3
Where,
  • -f : Force checking even if the file system seems clean.
Please note that If the superblock is not found, e2fsck will terminate with a fatal error. However Linux maintains multiple redundant copies of the superblock in every file system, so you can use -b {alternative-superblock} option to get rid of this problem. The location of the backup superblock is dependent on the filesystem's blocksize:
  • For filesystems with 1k blocksizes, a backup superblock can be found at block 8193
  • For filesystems with 2k blocksizes, at block 16384
  • For 4k blocksizes, at block 32768.
Tip you can also try any one of the following command(s) to determine alternative-superblock locations:
# mke2fs -n /dev/sda3
OR
# dumpe2fs /dev/sda3|grep -i superblock
To repair file system by alternative-superblock use command as follows:
# e2fsck -f -b 8193 /dev/sda3
However it is highly recommended that you make backup before you run fsck command on system, use dd command to create a backup (provided that you have spare space under /disk2)
# dd if=/dev/sda2 of=/disk2/backup-sda2.img
If you are using Sun Solaris UNIX, see howto: Restoring a Bad Superblock.
Please note that things started to get complicated if hard disk participates in software RAID array. Take a look at Software-RAID HOWTO - Error Recovery. This article/tip is part of Understanding UNIX/Linux file system series, Continue reading rest of the Understanding Linux file system series (this is part III):
  • Part I - Understanding Linux superblock
  • Part II - Understanding Linux superblock
  • Part III - An example of Surviving a Linux Filesystem Failures
  • Part IV - Understanding filesystem Inodes
  • Part V - Understanding filesystem directories
  • Part VI - Understanding UNIX/Linux symbolic (soft) and hard links
  • Part VII - Why isn't it possible to create hard links across file system boundaries?

Thursday, 13 February 2014

SSH Login with password

Host A / User A ---login---> Host B / User B

Generating public / private rsa key pair

a@A:~> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/a/.ssh/id_rsa): 
Created directory '/home/a/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/a/.ssh/id_rsa.
Your public key has been saved in /home/a/.ssh/id_rsa.pub.
The key fingerprint is:
3e:4f:05:79:3a:9f:96:7c:3b:ad:e9:58:37:bc:37:e4 a@A

Copy the public key from A:id_rsa.pub to B:authorized_keys 

a@A:~> cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys'
b@B's password: 
 

SSH Login without password

a@A:~> ssh b@B hostname
B 

route and route table

[root@localhost ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.95.0     *               255.255.255.0   U     1      0        0 eth0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         172.16.95.1     0.0.0.0         UG    0      0        0 eth0


The server is sitting on the subnet 172.16.95.0. Add a route to the route table. The route will be rolled back next reboot. 

The gw has to be the ip directly reachable from your subset.
[root@localhost ~]# route add -net 192.168.102.0 netmask 255.255.255.0 gw 172.16.95.2


[root@localhost ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.102.0   172.16.95.2     255.255.255.0   UG    0      0        0 eth0
172.16.95.0     *               255.255.255.0   U     1      0        0 eth0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         172.16.95.1     0.0.0.0         UG    0      0        0 eth0

[root@localhost ~]# route del -net 192.168.102.0 netmask 255.255.255.0 eth0
[root@localhost ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.95.0     *               255.255.255.0   U     1      0        0 eth0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         172.16.95.1     0.0.0.0         UG    0      0        0 eth0


Add the route permanently, network restart is needed.
[root@localhost ~]# echo "192.168.102.0/24 via 172.16.95.2" >> /etc/sysconfig/ne
twork-scripts/route-eth0

[root@localhost ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.102.0   172.16.95.2     255.255.255.0   UG    0      0        0 eth0
172.16.95.0     *               255.255.255.0   U     1      0        0 eth0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         172.16.95.1     0.0.0.0         UG    0      0        0 eth0

Wednesday, 12 February 2014

SNMP and its linux command

SNMP basic components and its functions:

    The SNMP architecture consists of
    The SNMP Manager
    A managed device
    An SNMP Agent
    Management Information Databases (otherwise known as Management Information Bases or MIBs)

    The SNMP Manager - (Usually the Network Management System - NMS) communicates with the multiple SNMP Agents implemented in the network.

    A managed device - or the network element is a part of the network that requires some form of monitoring and management e.g. routers, switches, servers, workstations, printers, UPSs, etc..

    An SNMP Agent - is a program that is bundled within the managed device. Enabling this agent allows it to collect the Management Information Database from the device locally to make it available to the SNMP Manager on request. These Agents could be standard (e.g. Net-SNMP) or specific to a vendor. (e.g. HP Insight Agent). The agent listens at port 161. TODO: UDP or TCP?

    Management Information Base / database - The commonly shared database between the Agent and the Manager is called Management Information Base (MIB). In short, MIB files are the set of questions that the SNMP Manager can ask the Agent. The Agent collects these data locally and stores it, as defined in the MIB.

    The MIBs contain a standard set of statistical and control values defined for the managed devices on a network. The SNMP protocol also allows the extension of these standard values with values specific to a particular Agent through the use of private MIBs. So the SNMP Manager should be aware of these standard and private questions for every type of Agent.
     
     
     

Linux Command 

One can simply issue one snmpwalk request on the root node of the sub-tree and the command gets the value of every node in the sub-tree.

[root@localhost ~]# snmpwalk -v 2c 169.254.0.8 -c FortiManager | grep OID
...
SNMPv2-SMI::mib-2.47.1.2.1.1.3.1 = OID: SNMPv2-SMI::enterprises.12356
...
[root@localhost ~]# snmpwalk -v 2c 169.254.0.8 -c FortiManager SNMPv2-SMI::enterprises.12356
...
SNMPv2-SMI::enterprises.12356.101.4.1.6.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.7.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.8.0 = Gauge32: 9
SNMPv2-SMI::enterprises.12356.101.4.1.9.0 = Gauge32: 80
SNMPv2-SMI::enterprises.12356.101.4.1.10.0 = Gauge32: 254764
SNMPv2-SMI::enterprises.12356.101.4.1.11.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.12.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.13.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.14.0 = Gauge32: 0
...

[root@localhost ~]# snmpget -v 2c 169.254.0.8 -c FortiManager SNMPv2-SMI::enterprises.12356.101.4.1.8.0
SNMPv2-SMI::enterprises.12356.101.4.1.8.0 = Gauge32: 11


Thursday, 22 August 2013

Allow and instruct the web application to query an untrusted https URL

Https query from web application like JSON to the site that needs to add certification exception (the trust) manually. When the user use their own browser to launch a https query to a web site that its certificate is not supported by the standard authorities, the user will be prompted for a permission to accept the certificate as an exception.

For web application server to launch the query, there is no way to prompt the web application to accept the exception, and the default is to reject the untrusted certificate. The web server will complain that the certificate is not found from the keystore for the requested target.

javax.xml.ws.soap.SOAPFaultException
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target


Now, we have to tell the web server to trust the certificate from the target.
1> Query the target URL by web browser.
2> Download and save the certificate <xxx.pem> from the target.
3> Append the certificate to the keystore

1. cd /usr/java/jdk1.6.0_33/jre/lib/security

2. /usr/java/jdk1.6.0_33/bin/keytool -import -v -trustcacerts -alias <Create your own> -file <filepath/xxx.pem> -keypass changeit -keystore ./cacerts -storepass changeit







Tuesday, 13 August 2013

Mounting file system, fstab, mtab

Basic format: mount -t <filesystem type> old_dir new_dir

1> Mounting a directory to another directory to let them access the same content
mount --bind old_dir<directory has content> new_dir<directory designed to access the content>

2> Mounting a device <like CDROM> with no -t parameter, it will let the OS to guess
mount /dev/cdrom /cd

3> NFS
  • /etc/exports specifies the access control of the mounting directory.

/home vale(rw) vstout(rw) vlight(rw)
/usr/X11R6 vale(ro) vstout(ro) vlight(ro)
/usr/TeX vale(ro) vstout(ro) vlight(ro)
/ vale(rw,no_root_squash)
/home/ftp (ro) 
/var/myApp 172.16.95.17/255.255.255.255(rw,no_root_squash) 

Each line defines a directory and the hosts allowed to mount it. Wildcard is allowed (* ?).
Range of ip address / network mask can be used to specify the host. 
If no host is give, any host matches and is allowed to mount the directory.
  • CLI form to mount NFS volume. 
    mount -t nfs nfs_volume local_dir options
     
  • /etc/fstab entry of NFS
[root@localhost ~]# cat /etc/fstab
/dev/VolGroup00/LogVol00 /                       ext3    defaults        1 1
/dev/VolGroup00/LogVol01 /data                   ext3    defaults        1 2
LABEL=/boot1            /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0
LABEL=SWAP-sda6         swap                    swap    defaults        0 0
172.16.95.93:/var/myApp    /logserver-1/var/myApp     nfs     hard,intr       0 0

4> fstab and mtab
[root@localhost ~]# cat /etc/fstab
/dev/VolGroup00/LogVol00 /                       ext3    defaults        1 1
LABEL=/boot             /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0
/dev/VolGroup00/LogVol01 swap                    swap    defaults        0 0
/var/myApp /localserver-1/var/myApp none rw,bind 0 0

There are 3 ways of using fstab.
1> mount -a will cause all the filesystem listed on fstab to be mounted, except those noted as noauto. Adding the -F will make mount fork. Usually it is used by boot scripts.

2> To mount or umount the filesystem mentioned on the fstab, it is sufficed to give only the device or the mount point.

e.g In fstab, /tmp/a /tmp/b none rw,bind 0 0
mount /tmp/a or mount /tmp/b will suffice.

3>  Normally, only the superuser can mount  file  systems.   However, when  fstab  contains  the user option on a line, anybody can mount the corresponding system.

Tuesday, 25 June 2013

Network connection troubleshooting

Error message: eth0 interface on and off once a while
tail -f /var/log/messages:
dmesg | less: 
e100: eth0: e100_watchdog: link down
e100: eth0: e100_watchdog: link up, 100Mbps, full-duplex

[root@localhost ~]# ethtool eth0
Settings for eth0:
        Supported ports: [ TP MII ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: MII
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: g
        Wake-on: g
        Current message level: 0x00000007 (7)
        Link detected: yes

[root@localhost ~]# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:02:B3:4D:BD:6B 
          inet addr:172.16.95.27  Bcast:172.16.95.255  Mask:255.255.255.0
          inet6 addr: fe80::202:b3ff:fe4d:bd6b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:720866 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1243358 errors:19788 dropped:0 overruns:0 carrier:19788
          collisions:287 txqueuelen:1000
          RX bytes:61520720 (58.6 MiB)  TX bytes:1164775778 (1.0 GiB)

[root@localhost ~]# mii-tool -v eth0
eth0: negotiated 100baseTx-FD flow-control, link ok
  product info: Intel 82555 rev 4
  basic mode:   autonegotiation enabled
  basic status: autonegotiation complete, link ok
  capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD
  advertising:  100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
  link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control

Reset auto-negotiation
[root@localhost ~]#  mii-tool -r eth0

If all fail, replace the cable.


Some clients in the subnet has cached the IP with old MAC address, I want them to update the new value by doing a ARP broadcast, is it possible in Linux?

Yes, it's called "Unsolicited ARP" or "Gratuitous ARP". Check the manpage for arping for more details, but the syntax looks something like this:
arping -U 192.168.1.101
If you're spoofing an address, you may need to run this first:
echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind
Finally, because of its spoofing ability, sending Unsolicited ARP packets is sometimes considered a "hostile" activity, and may be ignored, or might lead to being blocked by some third-party firewalls.

Usage Example:

 The problem is I accidentally assign a new machine with an used IP, so they conflict the IP. I can't access the old machine using SSH. Now I remotely shutdown the wrong (new) machine, but I still cannot access the old machine, I suspect the router has cached MAC address in its ARP table.

Wednesday, 12 September 2012

File descriptor

List the file descriptor id for the known processes

ls /proc/<procid>/fd/ -l