Smokeping setup

Go to this Url for guide on how to install smokeping to Centos 5.5
The pages was for centos 5.5 i386
If you are installing it to centos 5.5 x86_64
just change the
rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
to
rpm -Uhv http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

http://www.how2centos.com/installing-smokeping-on-centos-5-5/

This is the official pages for the smokeping
http://oss.oetiker.ch/smokeping/

and here is the official simple guide
http://oss.oetiker.ch/smokeping/doc/index.en.html

Unix useful command

Check memory
free -m

Check all running application pid and stat
ps -aux

Check running services
chkconfig --list
chkconfig <services> --level <1-5> <on/off>

shell script for replace, add, and delete

#! /bin/sh

echo "what you want to do"
echo "1:user change department"
echo "2:user change PC"
echo "3:add PC"
echo "4.delete PC"
read ANSWER

if [ $ANSWER = "1" ]; then
        echo "Enter User name"
        read USER1
        echo "Enter PC number"
        read PC1
        echo "Enter previous department name"
        read OLD1
        echo "Enter new department name"
        read NEW1

        sed -i '/'"$PC1"'/d' $OLD1
        echo "172.30.10."$PC1"  #"$USER1 >> $NEW1
        echo "Success"



elif [ $ANSWER = "2" ]; then
        echo "Enter previous PC number"
        read PC2
        echo "Enter new PC number"
        read NEW2
        echo "Enter department name"
        read DEPARTMENT2

        sed 's/'"$PC2"'/'"$NEW2"'/' $DEPARTMENT2 > $DEPARTMENT2".temp"
        cat $DEPARTMENT2".temp" > $DEPARTMENT2
        rm -rf $DEPARTMENT2".temp"

elif [ $ANSWER = "3" ]; then
        echo "Enter user name"
        read USER
        echo "Enter PC number"
        read PC3
        echo "Enter department name"
        read DEPARTMENT3

        echo "172.30.10."$PC3"  #"$USER >> $DEPARTMENT3

elif [ $ANSWER = "4" ]; then
        echo "Enter PC number"
        read PC4
        echo "Enter department name"
        read DEPARTMENT4

        sed -i '/'"$PC4"'/d' $DEPARTMENT4


else
        echo "you had enter an invalid number"

fi

scan music file

This will teach how to scan all music file under a folder and send out the result to your email as attachment

First you will need to install (for Centos5)
- sharutils
- mailt

For Centos6, just install
- sharutils


Below is the script:


#! /bin/sh

find /users -iname "*.mp3" > /var/log/music.txt
find /users -iname "*.wma" >> /var/log/music.txt
find /users -iname "*.mp4" >> /var/log/music.txt

find /export -iname "*.mp3" >> /var/log/music.txt
find /export -iname "*.wma" >> /var/log/music.txt
find /export -iname "*.mp4" >> /var/log/music.txt

uuencode /var/log/music.txt /var/log/music.txt | mail -s "[My-Domain] music file" sat.support@my.offgamers.com


the send out email attachment usage is

uuencode "file location" "file location" | mail -s "subject" "email address"

incremental backup

setup ssh-keygen

At Pdu-Backup, set ssh-keygen so that pdu-backup can access to other server without entering password

1. enter ssh-keygen at the terminal. press enter for all the message prompt. This will generate public key and private key.
2. cd to .ssh/. Normally it will under root document (/root/.ssh/)
3. Here you will see 3 file which is id_rsa, id-rsa.pub and known_hosts. id_rsa will be your private key while id_rsa.pub is your public key. Copy id_rsa.pub into the remote computer which you need for auto login, like this:

scp /root/.ssh/id_rsa.pub my_destination_server:~/ 

1. ssh to the remote computer and cd to folder where you copied the id_rsa.pub just now. Let say /root/ Check whether it has the folder /root/.ssh or not, create .ssh folder if it's not. Make sure the .ssh folder is having a mode of 700. Then only copy over the id_rsa.pub file into it. Use this command

cat /root/id_rsa.pub >> /root/.ssh/authorized_keys

* make sure authorized_keys is 600 mode, else it wont work

* extra note, you can limit SSH users via /etc/ssh/sshd_config 

Script

Here is an example for the script
#! /bin/sh

BSERVER=172.30.10.218
EXCLUDES=/export/exclude-list/pdu-profile-exclude
BACKUPDIR=`date -d ”-1 day” +”%A”`
 OPTS=”-v –force –ignore-errors –delete-excluded –exclude-from=$EXCLUDES –delete –backup –backup-dir=/export/pdu-profile/$BACKUPDIR -a”

[ -d /export/emptydir ] || mkdir /export/emptydir
rsync –delete -a /export/emptydir/ /export/pdu-profile/$BACKUPDIR/
rmdir /export/emptydir

echo “Start time `date +%c`” » /var/log/SAT-backup/pdu-profile

rsync $OPTS $BSERVER:/ /export/pdu-profile/current/

echo “End time `date +%c`” » /var/log/SAT-backup/pdu-profile
echo ” ” » /var/log/SAT-backup/pdu-profile

Cron job

Here you will need to setup your own cronjob for auto run the script for daily run

1. enter crontab -e to edit the cronjob
2. * * * * * job –> this is an default cronjob
3. I had setup our Pdu-backup cronjob for 5 script:
   • 0 20 * * * /export/Script/pdu-ldap-script
   • 0 21 * * * /export/Script/pdu-db-script
   • 0 22 * * * /export/Script/pdu-web-script
   • 0 23 * * * /export/Script/pdu-cayman1-script
   • 0 0 * * * /export/Script/pdu-profile-script
4. This will make everday 8pm will execute pdu-ldap-script, 9pm execute pdu-db-script and so on
5. crontab -l (see cronjob bind to user)

Backup Result

• According to the script coding, it will rsync current folder in pdu-backup with the remote server. This will make current folder is always a full backup of the remote server and will update everyday.
• while rsync today backup with the current folder, all old, edited, deleted file will be move to date folder assign by $BACKUPDIR in the script. For example, Tuesday night do rsync, the current folder will update to latest full backup folder while the edited, old, deleted file will be moved to folder name Monday. Remind that Monday folder only contain the edited, old, deleted file and not full backup. Current folder is always remain the full backup of the remote server.
• The backup file will be keep for 7 day and put accordingly from Monday - Sunday. Once reach Monday, the previous Monday folder will be remove and re-create a new for the latest backup use.
• A log file will be saved for every script for date and time it start and end. It will be saved inside /var/log/SAT-backup/ folder

Iptables

Check if the server had install Iptables or not

rpm -q iptables

If Haven't install, install it by using

yum install iptables

Rules

This is the standard rule for all the server

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

iptables -P INPUT DROP

save the iptables rules so that each time iptables start will refer back to this rule

/etc/init.d/iptables save

remember to save every time you finalize your rules
start/restart the iptables after save

/etc/init.d/iptables start

Check open port

Use nmap to check open port, install it via yum or use other server which have nmap installed to check open port by

nmap "destination"

example

nmap 172.30.10.230

you can use this link to check each description for each port
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

HowTo

add specific port into Iptables. This will add rule to the end of the selected chain

iptables -A [CHAIN] -p tcp --dport [port number] -j [ACCEPT/DROP]

example

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j DROP

This will allow port 443 connection to come in and the 2nd rule will block http connection to go out

add port to a specific rule number. So if the rule number is 1, the rule inserted will be taking no.1 and push default no.1 rule to no.2

iptables -I [CHAIN] [rule number] -p tcp --dport [port number] -j [ACCEPT/DROP] 

example

iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

This will make allow connection to come in from port 22 as the first rule

delete specific rules

iptables -D [CHAIN] [rule number]

list out all the rules

iptables -L

Centos - Bind9 setup

package: Bind
              Bind-chroot

After install, copy

named.conf from /usr/share/doc/bind-9.3.6/sample/etc/named.conf

to

/var/named/chroot/etc/

In order for rndc to connect to a named service, there must be a controls statement in the BIND server's /etc/named.conf file.

The controls statement, shown in the following example, allows rndc to connect from the localhost.

controls {

inet 127.0.0.1 allow { localhost; }

keys { <key-name>; };

};

This statement tells named to listen on the default TCP port 953 of the loopback address and allow rndc commands coming from the localhost, if the proper key is given. The <key-name> specifies a name in the key statement within the /etc/named.conf file. The next example illustrates a sample key statement.

key "<key-name>" {

algorithm hmac-md5;

secret "<key-value>";

};

The key is the most important statement in /etc/rndc.conf.

key "<key-name>" {

algorithm hmac-md5;

secret "<key-value>";

};

The <key-name> and <key-value> should be exactly the same as their settings in /etc/named.conf.

To match the keys specified in the target server's /etc/named.conf, add the following lines to /etc/rndc.conf.

options {

default-server localhost;

default-key "<key-name>";

};

ZONE

open named.conf and edit

vi /var/named/chroot/etc/named.conf

---------------------------------------------------------------------------------------------------------
        zone "gab.lan" {
                type master;
                file "gab.lan.zone";
        };
--------------------------------------------------------------------------------------------------------

save it and exit

then at /var/named/chroot/var/named/

create gab.lan.zone

open and edit it 

--------------------------------------------------------------------------------------------------------

$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
forum          IN      A       169.0.0.1.
wiki             IN      A       169.0.0.2.

ns               IN       A       169.0.0.0

--------------------------------------------------------------------------------------------------------

save and exit.

then make a soft link to /var/named

ln -s /var/named/chroot/var/named/gab.lan.zone /var/named/gab.lan.zone

then start the services

/etc/init.d/named start

then you can check the status by using

/etc/init.d/named status

Use dig to check if it is running

dig wiki.gab.lan

if it is setup correct, it will show something like this

------------------------------------------------------------------------------------------------------

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> wiki.gab.lan
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;wiki.gab.lan.            IN      A

;; ANSWER SECTION:
wiki.gab.lan.     10800   IN      A       169.0.0.2

;; AUTHORITY SECTION:

gab.lan.          10800   IN      NS      gab.lan.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:18:35 2011
;; MSG SIZE  rcvd: 80

-----------------------------------------------------------------------------------------------------

Highlight out

please highlight out this part from named.conf

----------------------------------------------------------------------------------------------------------

// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
 * If all you want is a caching-only nameserver, then you need only define this view:
 */
#       match-clients           { localhost; };
#       match-destinations      { localhost; };
#       recursion yes;
        # all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * ONLY be served to localhost clients:
         */
#       include "/etc/named.rfc1912.zones";
#};
#view "internal"
#{
/* This view will contain zones you want to serve only to "internal" clients
   that connect via your directly attached LAN interfaces - "localnets" .
 */
#       match-clients           { localnets; };
#       match-destinations      { localnets; };
#       recursion yes;
        // all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        // include "named.rfc1912.zones";
        // you should not serve your rfc1912 names to non-localhost clients.
        // These are your "authoritative" internal zones, and would probably
        // also be included in the "localhost_resolver" view above :

#       zone "my.internal.zone" {
#               type master;
#               file "my.internal.zone.db";
#       };
#       zone "my.slave.internal.zone" {
#               type slave;
#               file "slaves/my.slave.internal.zone.db";
#               masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
#               // put slave zones in the slaves/ directory so named can update them
#       };
#       zone "my.ddns.internal.zone" {
#               type master;
#               allow-update { key ddns_key; };
#               file "slaves/my.ddns.internal.zone.db";
#               // put dynamically updateable zones in the slaves/ directory so named can update them
#       };
#};
#key ddns_key
#{
#       algorithm hmac-md5;
#       secret "use /usr/sbin/dns-keygen to generate TSIG keys";
#};
#view    "external"
#{
#/* This view will contain zones you want to serve only to "external" clients
# * that have addresses that are not on your directly attached LAN interface subnets:
# */
#       match-clients           { any; };
#       match-destinations      { any; };
#
#       recursion no;
#       // you'd probably want to deny recursion to external clients, so you don't
#        // end up providing free DNS service to all takers
#
#       allow-query-cache { none; };
#       // Disable lookups for any cached data and root hints
#
#       // all views must contain the root hints zone:
#       include "/etc/named.root.hints";
#
#       // These are your "authoritative" external zones, and would probably
#        // contain entries for just your web and mail servers:
#
#       zone "my.external.zone" {
#               type master;
#               file "my.external.zone.db";
#       };
#};
 

-----------------------------------------------------------------------------------------------------------------

Change the current Linux DNS point back to yourself at

system-config-network

Reverse Zone

at named.conf, add this zone into it

---------------------------------------------------------------------------------------------------------------

        zone "0.0.169.in-addr.arpa." {
                type master;
                file "db.0.0.169";
        };

---------------------------------------------------------------------------------------------------------------

then at /var/named/chroot/var/named

create a db.0.0.169

open and edit it like this

-------------------------------------------------------------------------------------------------------------- 

$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
1                 IN      PTR    forum.gab.lan.

2                 IN      PTR    wiki.gab.lan.
 

--------------------------------------------------------------------------------------------------------------

save it and reload the services

/etc/init.d/named reload

then try to use dig to see success or not

dig -x 169.0.0.1

and you should get something like this

--------------------------------------------------------------------------------------------------------------; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> -x 169.0.0.1
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16382
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.169.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:

1.0.0.169.in-addr.arpa. 10800 IN    PTR     forum.gab.lan.0.0.169.in-addr.arpa.

;; AUTHORITY SECTION:

0.0.169.in-addr.arpa. 10800   IN      NS      gab.lan.0.0.169.in-addr.arpa.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:37:06 2011
;; MSG SIZE  rcvd: 96

---------------------------------------------------------------------------------------------------------------

Master - Slave

At slave server install and etup bind
open named.conf and add this zone

--------------------------------------------------------------------------------------------------------------
zone "gab.lan" {
     type slave;
     master {192.168.0.0;};
};
--------------------------------------------------------------------------------------------------------------

DNS Round Robin (DNSRR) load balancing

to balance 2 server or more together, just need to add another A entry for that server
example

www     IN     A     192.160.0.1
www     IN     A     192.168.0.2