LINUX AND VMWARE STUFF: Linux General

Showing posts with label Linux General. Show all posts

Showing posts with label Linux General. Show all posts

Monday, October 15, 2018

How to generate sosreport in different directory instead of default directory

Kalaiselvan Nachimuthu Monday, October 15, 2018 0

Sosreport is a tool that collects configuration details, system information, diagnostic information and system logs from Linux server. Sosreport generates an archive report from the running system. The archive may be stored locally or centrally for recording or tracking purposes.

Normally sosreport will be saved under /tmp (RHEL6) /var/tmp (RHEL7) directory on linux server. Some time we need to save the sosreport to some other temporary directory because of space issue.

Below steps are used to generate sosreport in different directory.

RHEL 5.6 and earlier

We need to set the temporary path environment before running sosreport.

[root@nsk ~]# env TMP=/path/to/target/directory sosreport

RHEL 5.7 and above

We have to use option --tmp-dir with sosreport to redirect the sosreport path

[root@nsk ~]# sosreport --tmp-dir /path/to/target/directory

Sosreport may have hung because of a specific plugin. We can list all available sosreport plugin modules by below command

[root@nsk ~]# sosreport -l

Identify which plugin is hanging on by below command

[root@nsk ~]# sosreport -vvvv

If a plugin times out or last plugin does not finish, rerun the sosreport and skip that plugin

[root@nsk ~]# sosreport -v -n plugin_name --tmp-dir /path/to/target/directory

Tags # Linux General Continue Reading

Friday, October 5, 2018

Digging audit log with ausearch tool in RHEL 7

Kalaiselvan Nachimuthu Friday, October 05, 2018 0

ausearch is a tool to search audit daemon logs based upon the events based on different search criteria.

Audit system stores log entries in the /var/log/audit/audit.log file; if log rotation is enabled, rotated audit.log files are stored in the same directory.

Each event consists of three records, which share the same time stamp. Each record consists of several name=value pairs separated by a white space or a comma.

type=SYSCALL msg=audit(1510471123.129:36): arch=c000003e syscall=175 success=yes exit=0 a0=1901a20 a1=1c5d a2=41a2d8 a3=18fe400 items=0 ppid=7 24 pid=725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmo d" subj=system_u:system_r:insmod_t:s0 key=(null)
type=PROCTITLE msg=audit(1510471123.129:36): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D0069707461626C655F6D616E676C65
type=NETFILTER_CFG msg=audit(1510471123.276:37): table=nat family=2 entries=0

Here, ausearch utility allows us to search Audit log files for specific events. Also it is used to read the audit log timestamp to user readable timestamp by using -i (--interpret) option.

Example:

1.Search for hostname with given hostname specific.

[root@nsk ~]# ausearch -i -hn nsk.testingserver.internal
----
type=USER_AUTH msg=audit(10/04/2018 12:32:02.610:75) : pid=1617 uid=root auid=unset ses=unset subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_permit acct=gdm exe=/usr/libexec/gdm-session-worker hostname=nsk.testingserver.internal addr=? terminal=/dev/tty1 res=success'
----

2. Search only the first event that matches the search pattern.

[root@nsk ~]# ausearch -i -hn nsk.testingserver.internal --just-one
----
type=USER_AUTH msg=audit(10/04/2018 12:32:02.610:75) : pid=1617 uid=root auid=unset ses=unset subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_permit acct=gdm exe=/usr/libexec/gdm-session-worker hostname=nsk.testingserver.internal addr=? terminal=/dev/tty1 res=success'
[root@nsk ~]#

3. Search for all logged actions performed by user nsk, using the user's login ID (auid).

[root@nsk log]# ausearch -ua 1001 -i
----
type=LOGIN msg=audit(12/04/2017 11:39:18.052:156) : pid=1433 uid=root subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=unset auid=nsk tty=(none) old-ses=4294967295 ses=2 res=yes
----
type=USER_ROLE_CHANGE msg=audit(12/04/2017 11:39:18.991:157) : pid=1433 uid=root auid=nsk ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe=/usr/sbin/sshd hostname=nsk addr=fe80::f24d:eb49:d219:6b0 terminal=ssh res=success'

4. Search for an event matching the given Process ID.

[root@nsk ~]# ausearch -i -p 2162
----
type=CRYPTO_SESSION msg=audit(10/05/2018 13:07:54.052:118) : pid=2162 uid=root auid=unset ses=unset subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 mac=hmac-sha2-256 pfs=curve25519-sha256@libssh.org spid=2163 suid=sshd rport=50935 laddr=10.0.2.15 lport=22 exe=/usr/sbin/sshd hostname=? addr=10.0.2.2 terminal=? res=success'
----

5. Search the /var/log/audit/audit.log file for successful login attempts

[root@nsk log]# ausearch --message USER_LOGIN --success yes --interpret
----
type=USER_LOGIN msg=audit(11/12/2017 13:04:08.279:110) : pid=662 uid=root auid=root ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=login id=root exe=/usr/bin/login hostname=nsk addr=? terminal=tty1 res=success'
----
type=USER_LOGIN msg=audit(11/12/2017 13:05:46.297:107) : pid=1242 uid=root auid=root ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c
0.c1023 msg='op=login id=root exe=/usr/sbin/sshd hostname=10.0.2.2 addr=10.0.2.2 terminal=/dev/pts/0 res=success'
----

6. Search for all account and group activities.

[root@nsk log]# ausearch -m ADD_USER -m DEL_USER -m ADD_GROUP -m DEL_GROUP -i
----
type=ADD_GROUP msg=audit(11/15/2017 22:05:29.396:169) : pid=15764 uid=root auid=root ses=2 subj=unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c1023 msg='op=add-group id=dovecot exe=/usr/sbin/groupadd hostname=? addr=? terminal=? res=success'
----
type=ADD_USER msg=audit(11/15/2017 22:05:29.431:171) : pid=15769 uid=root auid=root ses=2 subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 msg='op=add-user id=dovecot exe=/usr/sbin/useradd hostname=? addr=? terminal=? res=success'

7. Search for all failed PROCTITLE from yesterday up until now

[root@nsk log]# ausearch --start yesterday --end now -m PROCTITLE -sv no -i
----
type=PROCTITLE msg=audit(10/03/2018 18:00:02.623:71) : proctitle=/usr/sbin/httpd -DFOREGROUND
type=SYSCALL msg=audit(10/03/2018 18:00:02.623:71) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x560fb5acc008 a1=O_RDONLY a2=0x1b6 a3=0x24 items=0 ppid=1 pid=1145 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(10/03/2018 18:00:02.623:71) : avc: denied { read } for pid=1145 comm=httpd name=php-mapi.cfg dev="dm-0" ino=19498435 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:zarafa_etc_t:s0 tclass=file

Please refer man ausearch for more option.

Tags # Linux General Continue Reading

Thursday, October 4, 2018

How to read/convert Audit log timestamp in RHEL7

Kalaiselvan Nachimuthu Thursday, October 04, 2018 0

By default, audit log would be like below.

type=SYSCALL msg=audit(1510471123.129:36): arch=c000003e syscall=175 success=yes exit=0 a0=1901a20 a1=1c5d a2=41a2d8 a3=18fe400 items=0 ppid=7 24 pid=725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmo d" subj=system_u:system_r:insmod_t:s0 key=(null)
type=PROCTITLE msg=audit(1510471123.129:36): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D0069707461626C655F6D616E676C65 type=NETFILTER_CFG msg=audit(1510471123.276:37): table=nat family=2 entries=0

Below commands are used to convert the auditlog timestamp to user readable timestamp.

1. AUSEARCH :

ausearch utility allows us to search Audit log files for specific events. Also it is used to read the audit log epoch timestamp to user readable timestamp.By default, ausearch searches the /var/log/audit/audit.log file. We can specify a different file using the ausearch options -if file_name command

[root@nsk log]# ausearch -i | grep -i CONFIG
type=CONFIG_CHANGE msg=audit(11/12/2017 12:48:40.357:5) : audit_backlog_limit=8192 old=64 auid=unset ses=unset subj=system_u:system_r:unconfined_service_t:s0 res=yes
type=CONFIG_CHANGE msg=audit(11/12/2017 12:48:40.357:6) : audit_failure=1 old=1 auid=unset ses=unset subj=system_u:system_r:unconfined_service_t:s0 res=yes

-i, --interpret : Interpret numeric entities into text

2. DATE :

A) Date command with %s is used to convert normal time to epoch time.
%s : seconds since 1970-01-01 00:00:00 UTC

Display the current time in the given FORMAT, or set the system date
[root@nsk audit]# date +%s
1538570770
[root@nsk audit]# date +%s
1538570773

B) Date command with -d@ is used to convert epoch time to normal time.
[root@nsk audit]# date -d@1538570776
Wed Oct 3 18:16:16 IST 2018
[root@nsk audit]#

C) If we want to convert the specific system time to epoch time.
[root@nsk audit]# date --date="Wed Oct 3 18:16:16 IST 2018" +%s
1538570776

3. PERL : Perl was originally a language optimized for scanning arbitrary text files, extracting information from those text files, and printing reports based on that information

[root@nsk audit]# perl -pe 's/(\d+)/localtime/e' audit.log | more
type=DAEMON_START msg=audit(Sun Nov Wed Oct 3 20:22:26 2018 12:48:40 2017.186:6974): op=start ver=2.7.6 format=raw kernel=3.10.0-693.el7.x86_64 auid=4294967295 pid=606 uid=0 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(Sun Nov Wed Oct 3 20:22:26 2018 12:48:40 2017.357:5): audit_backlog_limit=8192 old=64 auid=4294967295 ses=429496 7295 subj=system_u:system_r:unconfined_service_t:s0 res=1

Here,
-p : Print out the pattern space
-e : command (This command allows one to pipe input from a shell command into pattern space)
localtime : it is perl function, it is having 9 elements.
-d : Match 1 or more repetition of digits

Tags # Linux General Continue Reading

Friday, September 14, 2018

python: SELinux is preventing httpd from connectto access on the unix_stream_socket /var/lib/mysql/mysql.sock - Mariadb running on RHEL 7

Kalaiselvan Nachimuthu Friday, September 14, 2018 0

SELinux is preventing the httpd access by default.

Situation
While connecting mysql database from web, getting this error.
python: SELinux is preventing httpd from connectto access on the unix_stream_socket /var/lib/mysql/mysql.sock

Solution
Run below command to allow httpd in Selinux.

[root@nsk ~]# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-httpd.pp

[root@nsk ~]# semodule -i my-httpd.pp

Hope it helps.

Tags # Linux General Continue Reading

Tuesday, September 4, 2018

Error: Cannot retrieve metalink for repository: epel. Please verify its path and try again - SOLVED

Kalaiselvan Nachimuthu Tuesday, September 04, 2018 0

Situation : I have installed epel-release-latest-6.noarch.rpm on CentOS release 6.10 (Final) and trying to install
python-pip, but getting the below error.

[root@puppetlabs tmp]# rpm -ivh epel-release-latest-6.noarch.rpm
warning: epel-release-latest-6.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Preparing... ########################################### [100%]
1:epel-release ########################################### [100%]
[root@puppetlabs tmp]#
[root@puppetlabs tmp]# yum install python-pip
Loaded plugins: fastestmirror
Setting up Install Process
Loading mirror speeds from cached hostfile
Error: Cannot retrieve metalink for repository: epel. Please verify its path and try again

Solution:

Edit both /etc/yum.repos.d/epel.repo and /etc/yum.repos.d/epel-testing.repo files, commenting all entries
starting with mirrorlist= and uncomment all the entries starting with baseurl=

epel.repo base url is changed from http://download.fedoraproject.org/pub/epel/6/ to http://del-repos.extreme-ix.org/epel/6/x86_64/repodata/ update the same.
epel-testing.repo base url is changed from http://del-repos.extreme-ix.org/epel/testing/6/ to http://del-repos.extreme-ix.org/epel/testing/6 update the same.

Now run yum repolist command.

[root@puppetlabs yum.repos.d]# yum repolist
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: centos.mirror.far.fi
* extras: centos.mirror.far.fi
* updates: centos.mirror.far.fi
repo id repo name status
base CentOS-6 - Base 6,713
epel Extra Packages for Enterprise Linux 6 - x86_64 12,522
extras CentOS-6 - Extras 31
updates CentOS-6 - Updates 114
repolist: 19,380

Hope it helps.

Tags # Linux General Continue Reading

Monday, September 3, 2018

Export proxy variable in Linux by using command line

Kalaiselvan Nachimuthu Monday, September 03, 2018 0

Here Export Command is used to set Proxy Environment Variables in Linux Servers.

Syntax:

export "http_proxy=http://username:password@proxy.example.com:port_no/"
export "https_proxy=https://username:password@proxy.example.com:port_no/"

Note : If password contains Reserved charecters, need to replace with respective percent-encoding.

Reserved characters and Percent-encoding
! - %21
# - %23
$ - %24
& - %26
' - %27
( - %28
) - %29
* - %2A
+ - %2B
, - %2C
/ - %2F
: - %3A
; - %3B
= - %3D
? - %3F
@ - %40
[ - %5B
] - %5D

Check the proxy server settings by running env command.

[root@puppetlabs ~]# env | grep -i proxy

If we want to remove proxy variables. Run unset command.

[root@puppetlabs ~]# unset http_proxy
[root@puppetlabs ~]# unset https_proxy

Tags # Linux General Continue Reading

Tuesday, June 26, 2018

Solved : Sendmail stat=Service unavailable

Kalaiselvan Nachimuthu Tuesday, June 26, 2018 0

Situation : Maillog says Service unavailable

Jun 24 06:43:54 testserver sendmail[24622]: w5O4hsFN024620: to=<testuser@remotetest.com> ctladdr=<oratest@testserver.mail.com> (20001/20001), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=150623, relay=relayserver.com. [10.0.34.1], dsn=5.0.0, stat=Service unavailable

Solution:

Go to /etc/mail path

Step1 : generics-domains file should be below format.

[root@testserver mail]# cat generics-domains
testserver
testserver.mail.com
mail.com
testserver.mail.com

Step2 : genericstable file should be below format

[root@testserver mail]# cat /etc/mail/genericstable

@testserver.mail.com auth_mail_id@relaydomain.com
@mail.com auth_mail_id@relaydomain.com

Map the genericstable by running below command.

# makemap hash /etc/mail/genericstable < /etc/mail/genericstable

Here,
auth_mail_id@relaydomain.com    : Change to your relay server authentication mail id
@testserver.mail.com                      : Your smtp server name
testuser@remotetest.com                : Where you want to send mails
oratest@testserver.mail.com           : smtp server mail id

Now mail will be accepted by relay server.

Tags # Linux General Continue Reading

Thursday, June 14, 2018

Difference between NFSv2, NFSv3 and NFS4 and advantage of NFSv4

Kalaiselvan Nachimuthu Thursday, June 14, 2018 0

Difference between NFSv2, NFSv3 and NFS4 and advantage of NFSv4

Network File System (NFS), allows remote hosts to mount file systems over a network and interact with those file systems as though they are mounted locally. This enables system administrators to consolidate resources on to centralized servers on the network.

NFSv2:
    1. NFS version 2 (NFSv2) is older and widely supported. NFSv2 is not supported on RHEL7
    2. It can use both TCP and UDP protocol over an IP network(port 2049). But it use UDP running over an IP network to provide a stateless network connection between the client and server.
    3. UDP is stateless, if the server goes down unexpectedly, UDP clients continue to saturate the network with requests for the server. when a frame is lost with UDP, the entire RPC request must be re transmitted

NFSv3:
    1. NFS version 3 (NFSv3) supports safe asynchronous writes and is more robust at error handling than NFSv2; it also supports 64-bit file sizes and offsets, allowing clients to access more than 2Gb of file data.
    2. It can use both TCP and UDP protocol over an IP network(port 2049). But it use UDP running over an IP network to provide a stateless network connection between the client and server.
    3. UDP is stateless, if the server goes down unexpectedly, UDP clients continue to saturate the network with requests for the server. when a frame is lost with UDP, the entire RPC request must be re transmitted.

NFSv4:
    1. NFS version 4 (NFSv4) works through firewalls and on the Internet, no longer requires an rpcbind service, supports ACLs, and utilizes stateful operations.
    2. RHEL 6 supports NFSv2, NFSv3, and NFSv4 clients. When mounting a file system via NFS, RHEL uses NFSv4 by default, if the server supports it.
    3. It use TCP protocol. With TCP, only the lost frame needs to be resent. For these reasons, TCP is the preferred protocol when connecting to an NFS server.

Advantage of NFSv4:
    1. The mounting and locking protocols have been incorporated into the NFSv4 protocol
    2. The server also listens on the well-known TCP port 2049. As such, NFSv4 does not need to interact with rpcbind, lockd, and rpc.statd daemons. The rpc.mountd daemon is required on the NFS server to set up the exports.

Tags # Linux General Continue Reading

Wednesday, April 25, 2018

How to free the disk space from deleted files in which PIDs are still running?

Kalaiselvan Nachimuthu Wednesday, April 25, 2018 0

Sometimes we have removed large size of logfiles or files from linux server as part of housekeeping. But it will not release the disk space while running lsof command

[root@testserver ~]# lsof / | grep -i deleted
sh          3716       root    4w   REG 249,0 2269000 3342481 /var/log/cellos/mcelogd-mon.log (deleted)
sh          3716       root    5w   REG 249,0 2333681 3342525 /var/log/cellos/mcelogd-mon.trc (deleted)
tgtd        4144       root    4w   REG 249,0 26684869 3342480 /var/log/cellos/qd.log (deleted)
tgtd        4144       root    5w   REG 249,0 27453138 3342483 /var/log/cellos/qd.trc (deleted)
tgtd        4145       root    4w   REG 249,0 26684869 3342480 /var/log/cellos/qd.log (deleted)
tgtd        4145       root    5w   REG 249,0 27453138 3342483 /var/log/cellos/qd.trc (deleted)
iscsiuio    4592       root    4w   REG 249,0 26684869 3342480 /var/log/cellos/qd.log (deleted)
iscsiuio    4592       root    5w   REG 249,0 27453138 3342483 /var/log/cellos/qd.trc (deleted)

Normally we need to stop the logging service (syslog) before deleting the log files or stop the service which is related to the files.
Stopping log collection on running server is not good practice.

Then how to solve the issue?

Free the Disk Space

Find the PID of deleted process, go to /proc then nullify it.

[root@testserver ~]# cd /proc/3716/fd
[root@testserver fd]# ls -al
total 0
dr-x------ 2 root root 0 Apr 9 17:08 .
dr-xr-xr-x 9 root root 0 Apr 9 17:08 ..
lrwx------ 1 root root 64 Apr 9 17:08 0 -> /dev/null
l-wx------ 1 root root 64 Apr 9 17:08 1 -> /var/log/exadatatmp/__imglog_stdout__.tFvWrjjEZTPOJWm3racIEPF5W9YQqMI3
lrwx------ 1 root root 64 Apr 9 17:08 10 -> /dev/null
lrwx------ 1 root root 64 Apr 9 17:08 11 -> /dev/null
l-wx------ 1 root root 64 Apr 9 17:08 2 -> /var/log/exadatatmp/__imglog_stderr__.tFvWrjjEZTPOJWm3racIEPF5W9YQqMI3
lr-x------ 1 root root 64 Apr 9 17:08 255 -> pipe:[21686]
l-wx------ 1 root root 64 Apr 9 17:08 4 -> /var/log/cellos/mcelogd-mon.log (deleted)
l-wx------ 1 root root 64 Apr 9 17:08 5 -> /var/log/cellos/mcelogd-mon.trc (deleted)

The process ID 3716 running on 4w (write mode).

[root@testserver fd]# ls -al 4
l-wx------ 1 root root 64 Apr 9 17:08 4 -> /var/log/cellos/mcelogd-mon.log (deleted)

We can release the space by nullify this file.

[root@testserver ~]# >/proc/3716/fd/4
[root@testserver ~]# lsof / | grep -i deleted | grep -i 3716
sh          3716       root    5w   REG 249,0        0 3342525 /var/log/cellos/mcelogd-mon.trc (deleted)

Alternate way, we can compress the file or we can kill the PID if not needed.

Tags # Linux General Continue Reading

Thursday, April 19, 2018

Facter command in Linux

Kalaiselvan Nachimuthu Thursday, April 19, 2018 0

Facter command is used to Collect and display facts about the current server. The library behind Facter is easy to expand, making Facter an easy way to collect information about a system information such as hardware details, network settings, virtualization type and kernel/OS information from within the shell or within Ruby. If no facts are specifically asked for, then all facts will be displayed.

If we want to use facter command, we need to install facter rpm.

Display all facts

[root@testserver manifests]# facter
architecture => x86_64
augeasversion => 1.1.0
bios_release_date => 01/06/2018
bios_vendor => Xen
bios_version => 4.4.4OVM
blockdevice_xvda_size => 53687091200
blockdevices => xvda
domain => puppet.test.com
facterversion => 2.4.4
filesystems => ext4,iso9660
fqdn => testserver.puppet.test.com
gid => root
hardwareisa => x86_64
....
....
uptime_days => 62
uptime_hours => 1491
uptime_seconds => 5368909
uuid => 0004FB00-0006-0000-7071-48CB71E70F8A
virtual => xenhvm

Display a single fact

[root@testserver ~]# facter interfaces
eth0,eth1,eth2,lo

Facts format as JSON

[root@testserver ~]# facter --json architecture kernel uptime timezone puppetversion bios_vendor
{
"timezone": "CAT",
"uptime": "62 days",
"architecture": "x86_64",
"kernel": "Linux",
"bios_vendor": "Xen",
"puppetversion": "3.8.1"

Facts format as YAML

[root@testserver ~]# facter --yaml architecture kernel uptime timezone puppetversion bios_vendor
---
bios_vendor: Xen
kernel: Linux
uptime: 62 days
timezone: CAT
architecture: x86_64
puppetversion: 3.8.1

Facter will produce output by below format.
a. JSON
b. YAML
c. Plaintext

Tags # Linux General Continue Reading

Thursday, April 12, 2018

How to change the default login shell by command line in linux server?

Kalaiselvan Nachimuthu Thursday, April 12, 2018 0

By using chsh command we can change the default login shell to other shell.

By using -l option we can list the available login shell on linux server.

[root@testserver ~]# chsh -l
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash
/bin/tcsh
/bin/csh
/bin/ksh

Then which user login shell need to change, we can change by below command. (If a shell is not given on the command line, chsh prompts for one)

[root@testserver ~]# chsh hygmtng7
Changing shell for hygmtng7.
New shell [/bin/ksh]: /bin/bash
Shell changed.

Before
[root@testserver ~]# cat /etc/passwd | grep -i hygmtng7
hygmtng7:x:20009:20009::/gmtng7/hyperion:/bin/ksh

After
[root@testserver ~]# cat /etc/passwd | grep -i hygmtng7
hygmtng7:x:20009:20009::/gmtng7/hyperion:/bin/bash

Tags # Linux General Continue Reading

Thursday, April 5, 2018

How to use --exclude option in du command

Kalaiselvan Nachimuthu Thursday, April 05, 2018 0

du command is used to estimate file space usage.

Sometime we need to exclude some folder or files while running du command.
For that we can use below option to achieve that.

[root@testserver /]# du -sh * --exclude=repository --exclude=oem1

The above command will exclude the repository & oem folder under / path.

Hope it helps.

Tags # Linux General Continue Reading

Sunday, March 18, 2018

How to Add SSH Public Key to Remote Server(s) in a Single Command.

Kalaiselvan Nachimuthu Sunday, March 18, 2018 0

Below command is used to copy the key to single server.

# cat id_rsa.pub | ssh username@servername 'cat >> /home/user/.ssh/authorized_keys'

Below command is used to copy the key to multiple server. We can use for loop.

# for i in `cat serverlist`; do echo $i; cat id_rsa.pub | ssh username@servername 'cat >> /home/user/.ssh/authorized_keys'; done

Hope it helps.

Tags # Linux General Continue Reading

Monday, February 26, 2018

How to create VLAN interface by using comand line in RHEL7

Kalaiselvan Nachimuthu Monday, February 26, 2018 0

By using nmcli command we can craete the VLAN interface in RHEL7.

VLANs are isolated broadcast domains that run over a single physical network. They allow you to segment a local network and also to "stretch" a LAN over multiple physical locations. Most enterprises implement this on their network switching environment, but in some cases, the tagged VLANs reach your server.

For this case, our physical network interface is called enp0s3. The VLAN's ID is 501, and the IPv4 address is 192.168.1.10, with a subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1.

Create vlan
[root@nsk ~]# nmcli connection add type vlan dev enp0s3 id 501 ip4 192.168.1.10/24 gw4 192.168.1.1
Connection 'vlan' (a01bd6a3-a486-4c5b-83af-73d7344cc388) successfully added.

Activate the connection
[root@nsk ~]# nmcli connection up vlan
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

Check the Connection
[root@nsk ~]# nmcli connection show
NAME     UUID                                                                 TYPE                   DEVICE
enp0s3 191fbaab-7ac3-4616-9368-3b006cba3574     802-3-ethernet    enp0s3
vlan        a01bd6a3-a486-4c5b-83af-73d7344cc388     vlan                      enp0s3.501

[root@nsk ~]# nmcli device status
DEVICE         TYPE           STATE         CONNECTION
enp0s3          ethernet      connected    enp0s3
enp0s3.501   vlan              connected    vlan
lo                  loopback      unmanaged --

[root@nsk ~]# nmcli device show enp0s3.501
GENERAL.DEVICE                   :    enp0s3.501
GENERAL.TYPE                     :      vlan
GENERAL.HWADDR              :     08:00:27:93:16:4B
GENERAL.MTU                       :    1500
GENERAL.STATE                   :    100 (connected)
GENERAL.CONNECTION       : vlan
GENERAL.CON-PATH            :    /org/freedesktop/NetworkManager/ActiveConnection/3
IP4.ADDRESS[1]                    :      192.168.1.10/24
IP4.GATEWAY                       :      192.168.1.1
IP6.ADDRESS[1]                   :       fe80::ecb7:3969:728f:a67b/64
IP6.GATEWAY                        :       --
[root@nsk ~]#

The command line to create a VLAN with nmcli is very basic as it uses default values.

Below command will full option to create detailed VLAN interface.
[root@nsk ~]# nmcli con add help

Tags # Linux General Continue Reading

Saturday, February 17, 2018

How to change the Linux user's password in single command

Kalaiselvan Nachimuthu Saturday, February 17, 2018 0

Changing the Linux user's password in one command

Chpasswd reads a list of user name and password pairs from standard input and uses this information to update a group of existing users

chpasswd - update passwords in batch mode

Syntax - user_name:password

By default the supplied password must be in clear-text. Also the password age will be updated, if present.

#echo user:password | /usr/sbin/chpasswd

Tags # Linux General Continue Reading

Friday, February 16, 2018

Default Physical extent size in RHEL5, RHEL6 and RHEL7

Kalaiselvan Nachimuthu Friday, February 16, 2018 0

Default Physical extent size in RHEL5, RHEL6 and RHEL7

Each physical volume is divided chunks of data, known as physical extents, these extents have the same size as the logical extents for the volume group.

Making the PE too small wouldn't be recommended, as the maximum volume size is 65,536 PEs, so if you reduce this to 1MB, you end up with volumes not larger than 64GB.

RHEL 5 - 32 M
RHEL 6 - 4 MB (maximum we can create 256 GB file system)
RHEL 7 - 4 MB

Tags # Linux General Continue Reading

Saturday, February 10, 2018

Why does vncserver fails with "Starting VNC server: Fatal server error"

Kalaiselvan Nachimuthu Saturday, February 10, 2018 0

Issue:
vncserver service failed to start with below error
[orpmtn1o@Servername ~]$ vncserver

WARNING: The first attempt to start Xvnc failed, possibly because the font
catalog is not properly configured. Attempting to determine an appropriate
font path for this system and restart Xvnc using that font path ...
Could not start Xvnc.

_XSERVTransmkdir: Owner of /tmp/.X11-unix should be set to root

Xvnc TigerVNC 1.1.0 - built Sep 22 2014 07:15:59
Copyright (C) 1999-2011 TigerVNC Team and many others (see README.txt)
See http://www.tigervnc.org for information on TigerVNC.
Underlying X server release 11500000, The X.Org Foundation

Initializing built-in extension Generic Event Extension
Initializing built-in extension SHAPE
Initializing built-in extension MIT-SHM
Initializing built-in extension XInputExtension
Initializing built-in extension XTEST
Initializing built-in extension BIG-REQUESTS
Initializing built-in extension SYNC
Initializing built-in extension XKEYBOARD
Initializing built-in extension XC-MISC
Initializing built-in extension XFIXES
Initializing built-in extension RENDER
Initializing built-in extension RANDR
Initializing built-in extension DAMAGE
Initializing built-in extension MIT-SCREEN-SAVER
Initializing built-in extension DOUBLE-BUFFER
Initializing built-in extension RECORD
Initializing built-in extension DPMS
Initializing built-in extension X-Resource
Initializing built-in extension XVideo
Initializing built-in extension XVideo-MotionCompensation
Initializing built-in extension VNC-EXTENSION
Initializing built-in extension GLX

Sat Feb 10 01:18:59 2018
vncext: VNC extension running!
vncext: Listening for VNC connections on all interface(s), port 5901
vncext: created VNC server for screen 0
[dix] Could not init font path element catalogue:/etc/X11/fontpath.d, removing from list!
[dix] Could not init font path element built-ins, removing from list!
(EE)
Fatal server error:
(EE) could not open default font 'fixed'(EE)
_XSERVTransmkdir: Owner of /tmp/.X11-unix should be set to root

Xvnc TigerVNC 1.1.0 - built Sep 22 2014 07:15:59
Copyright (C) 1999-2011 TigerVNC Team and many others (see README.txt)
See http://www.tigervnc.org for information on TigerVNC.
Underlying X server release 11500000, The X.Org Foundation

Initializing built-in extension Generic Event Extension
Initializing built-in extension SHAPE
Initializing built-in extension MIT-SHM
Initializing built-in extension XInputExtension
Initializing built-in extension XTEST
Initializing built-in extension BIG-REQUESTS
Initializing built-in extension SYNC
Initializing built-in extension XKEYBOARD
Initializing built-in extension XC-MISC
Initializing built-in extension XFIXES
Initializing built-in extension RENDER
Initializing built-in extension RANDR
Initializing built-in extension DAMAGE
Initializing built-in extension MIT-SCREEN-SAVER
Initializing built-in extension DOUBLE-BUFFER
Initializing built-in extension RECORD
Initializing built-in extension DPMS
Initializing built-in extension X-Resource
Initializing built-in extension XVideo
Initializing built-in extension XVideo-MotionCompensation
Initializing built-in extension VNC-EXTENSION
Initializing built-in extension GLX

Sat Feb 10 01:19:02 2018
vncext: VNC extension running!
vncext: Listening for VNC connections on all interface(s), port 5901
vncext: created VNC server for screen 0
[dix] Could not init font path element /usr/share/X11/fonts/misc, removing from list!
[dix] Could not init font path element built-ins, removing from list!
(EE)
Fatal server error:
(EE) could not open default font 'fixed'(EE)

Resolution:
First install the below packages on server.

tigervnc-server
tigervnc-server-module
libXfont
pixman
xterm
xorg-x11-twm

Add the below lines under /etc/sysconfig/vncservers
VNCSERVERS="2:root"
VNCSERVERARGS[2]="-geometry 800x600 -nolisten tcp -nohttpd -localhost"

Next, stop the local firewall.
[root@Servername ~]# /etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]

Now Vncserver should work.
[orpmtn1o@Servername~]$ vncserver
New 'Servername.localhost.com:1 (orpmtn1o)' desktop is Servername.localhost.com:1
Creating default startup script /home/orpmtn1o/.vnc/xstartup
Starting applications specified in /home/orpmtn1o/.vnc/xstartup
Log file is /home/orpmtn1o/.vnc/Servername.localhost.com:1.log

Hope it helps.

Tags # Linux General Continue Reading

Thursday, February 1, 2018

User not allowed to access to (crontab) because of pam configuration - SOLVED

Kalaiselvan Nachimuthu Thursday, February 01, 2018 0

Situation:
While running the crontab command user getting the below error.
[root@testserver ~]# su - user13
[user13@testserver ~]$ crontab -l
Authentication token is no longer valid; new one required
You (user13) are not allowed to access to (crontab) because of pam configuration.

Solution:
First check the age before adding the user in /etc/security/access.conf
If it is expired, set the password.

[root@testserver ~]# chage -l user13
Last password change                                              : Sep 06, 2017
Password expires                                                            : Dec 05, 2017
Password inactive                                                           : never
Account expires                                                              : never
Minimum number of days between password change    : 1
Maximum number of days between password change   : 90
Number of days of warning before password expires     : 7

Set the password
[root@testserver ~]# passwd user13
Enter new password:
Re-type new password:
passwd: all authentication tokens updated successfully.

[root@testserver ~]# chage -l user13
Last password change                                                     : Jan 31, 2018
Password expires                                                             : May 01, 2018
Password inactive                                                      : never
Account expires                                                     : never
Minimum number of days between password change     : 1
Maximum number of days between password change    : 90
Number of days of warning before password expires      : 7

Then now add the user in /etc/security/access.conf file above -: ALL : ALL line.
+ : user13 : cron crond crontab

[root@testserver ~]# su - user13
[user13@testserver ~]$ crontab -l
no crontab for user13
[user13@testserver ~]$ exit

Hope it is help.

Tags # Linux General Continue Reading

Monday, January 22, 2018

ss command in RHEL7 and examples

Kalaiselvan Nachimuthu Monday, January 22, 2018 0

ss command in RHEL7

NAME
ss - another utility to investigate sockets

ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.
When no option is used ss displays a list of open non-listening sockets (e.g. TCP/UNIX/UDP) that have established connection.

[root@nsk ~]# ss -tpna | grep -i 25
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1198,fd=13))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1198,fd=14))

Here,
-t, --tcp Display TCP sockets
-p, --processes Show process using socket
-n, --numeric Do not try to resolve service names
-a, --all Display both listening and non-listening (for TCP this means established connections) sockets

SS command example:

Display all TCP sockets
[root@nsk ~]# ss -t -a
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:ssh *:*
LISTEN 0 100 127.0.0.1:smtp *:*
ESTAB 0 0 10.0.2.15:ssh 10.0.2.2:56004
ESTAB 0 0 10.0.2.15:ssh 10.0.2.2:55714
LISTEN 0 128 :::ssh :::*
LISTEN 0 100 ::1:smtp :::*
[root@nsk ~]#

Display all TCP sockets with process SELinux security contexts
[root@nsk ~]# ss -t -a -Z
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:ssh *:* users:(("sshd",pid=966,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=3))
LISTEN 0 100 127.0.0.1:smtp *:* users:(("master",pid=1198,proc_ctx=system_u:system_r:postfix_master_t:s0,fd=13))
ESTAB 0 0 10.0.2.15:ssh 10.0.2.2:56004 users:(("sshd",pid=1329,proc_ctx=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023,fd=3))
ESTAB 0 0 10.0.2.15:ssh 10.0.2.2:55714 users:(("sshd",pid=1263,proc_ctx=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023,fd=3))
LISTEN 0 128 :::ssh :::* users:(("sshd",pid=966,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=4))
LISTEN 0 100 ::1:smtp :::* users:(("master",pid=1198,proc_ctx=system_u:system_r:postfix_master_t:s0,fd=14))

Display all UDP sockets
[root@nsk ~]# ss -u -a
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 10.0.2.15:42417 198.55.111.50:ntp
ESTAB 0 0 10.0.2.15:39451 66.135.44.92:ntp
ESTAB 0 0 10.0.2.15:50903 198.60.22.240:ntp
ESTAB 0 0 10.0.2.15:51175 198.58.105.63:ntp
UNCONN 0 0 *:bootpc *:*
UNCONN 0 0 *:42307 *:*
UNCONN 0 0 127.0.0.1:323 *:*
UNCONN 0 0 :::42236 :::*
UNCONN 0 0 ::1:323 :::*

Display all established ssh connections.
[root@nsk ~]# ss -o state established '( dport = :ssh or sport = :ssh )'
Netid Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp 0 0 10.0.2.15:ssh 10.0.2.2:56004 timer:(keepalive,117min,0)
tcp 0 0 10.0.2.15:ssh 10.0.2.2:55714 timer:(keepalive,110min,0)

For more infor, please refer man ss.

Tags # Linux General Continue Reading

Friday, January 12, 2018

Which command is used to run sudo commands without password

Kalaiselvan Nachimuthu Friday, January 12, 2018 0

Command used to run sudo commands without password

NAME
sudo - execute a command as another user

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.

But here option s is used to run the privileged commands without password.

[nsk@testserver ~]$ sudo -s /etc/init.d/nslcd restart
Stopping nslcd: [ OK ]
Starting nslcd: [ OK ]
[nsk@testserver ~]$

Here,
-s [command] The -s (shell) option runs the shell specified by the SHELL environment variable if it is set or the shell as specified in the password database. If a command is specified, it is passed to the shell for execution via the shell’s -c option. If no command is specified, an interactive shell is executed.

Tags # Linux General Continue Reading