Using one Rsyslog instance for multiple ports

Ever cared to or needed to have one Rsyslog v5 instance listening on multiple ports while either re-directing or something else with those feeds? Rsyslog documentation allows for this with RuleSets.  If you have Rsyslog v7.6 or newer there is a cool config builder which can help but for those who don't roll your own rpms you can visit the link below.


http://www.rsyslog.com/doc/v5-stable/concepts/multi_ruleset.html

I was able to use this to keep the number of rsyslog instances to a minimum while providing multiple data source routings.  Cheers!

Re-naming Network Interfaces on Red Hat 6

If you've ever needed to use a certain network interface on a linux (specifically RHEL6 here) you'll notice there are several different ways to do it.  A search of the interwebs will give you numerous avenues but I'm going to outline the one here which worked for me. We'll use ifcfg-em1 and ifcfg-em2 for these examples and assume you have console access.

Symptoms: one of your nics has died and the software on the server is dependent on the interface name. i.e. Oracle RAC

First you will need to reboot afterwards, there was no way around it for myself.  Give yourself that luxury instead of thinking you can just do a <code> service network restart </code> to finish it. Start by creating backups of ifcfg-em1 and ifcfg-em2. Rename ifcfg-em1 to ifcfg-em3 and then ifcfg-em2 to ifcfg-em1.

Next create a file if it does not exist already of "/etc/udev/rules.d/70-persistent-net.rules".  If it does not exist you can attempt to create it using the automated tool of "/lib/udev/write_net_rules all_interfaces".  This method did not work for me and I had to create the file manually which did work.  *Note you are swapping the MAC addresses here and putting what you WANT em1 and em2 to be.

</etc/udev/rules.d/70-persistent-net.rules>
 # PCI device 0x14e4:0x163a (bnx2) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:11:22:33:44:55", ATTR{type}=="1", KERNEL=="em*", NAME="em1"

# PCI device 0x14e4:0x163a (bnx2) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:11:22:33:44:44", ATTR{type}=="1", KERNEL=="em*", NAME="em2"
</etc/udev/rules.d/70-persistent-net.rules>

Once you've confirmed those two things are done reboot the server and it'll come back up proper. Took a lot of searching to get all this set up correctly.  Hope this helps someone else.

Breaking a Bonded interface on RHEL

Today I had to break a bonded interface on a server running RHEL 5.  The bond was not a port channel but rather a fail-over setup.  The end result was to have only eth0 still up but if possible not bring down the box to do it.  Here's how I did it and a link to the original site I pulled it from.  You can also look in the documentation on the box if you don't have the interwebs available at the time.

RHEL Network Bonding

For more reference to use there values you can check, in your linux box :  /usr/share/doc/kernel-doc-2.6.18/Documentation/networking/bonding.txt 

>>>> 3.  How to Gracefully Break the Bonded Network Interface?

In Sample Configuration is we have bond0 configure for two interface name eth0 and eth1, and bond running configuration looks as 

# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0  Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr: 53:44:00:43:91:04
Slave Interface: eth1
MII Status: up
Link Failure Count: 0
Permanent HW addr: 52:33:00:6d:0e:70

The process to break the bonded interface is :

a.  Online remove one slave network interface which will be assigned with a new IP address from the bonding device. In this example, we are going to remove the eth1 from bond0. Execute the following command as root:

# ifenslave -d bond0 eth1
Or
# echo -eth1 > /sys/class/net/bond0/bonding/slaves

After issue the command above , You will see the eth1 device has been remove from bond0 # cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0 
Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr:  53:44:00:43:91:04

b. Create a new network configuration for eth1 via graphic tool or text tool and then using following command to start eth1 again. Make sure the physical link has been changed correctly to match the new network configuration of eth1.

# ifup eth1
During the above 2 steps, the network of bond0 will work fine without any break up.

c. Create the same network configuration as bond0 for eth0 

 – just copy the content of /etc/sysconfig/network-scripts/ifcfg-bondX to  /etc/sysconfig/network-scripts/ifcfg-eth0, except the interface name and HW MAC address.

d. Remove the eth0 from bond0, destory the bond0 device and start eth0 immediately.

Please note this disruptive operation, The network of bond0/eth0 will break shortly during this step. # ifenslave -d bond0 eth0; ifdown bond0; ifup eth0
# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0 
Bonding Mode: load balancing (round-robin)
MII Status: down
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
now ifconfig will show the configuration for only eth0 and eth1, no bonding interface appears.

e. Remove all bonding setting of bond0 in /etc/modprobe.conf and remove the ifcfg-bond0 in /etc/sysconfig/network-script directory. Then issue following command to remove the bond0 device from memory completely.

# echo -bond0 > /sys/class/net/bonding_masters

Updating iDRAC firmware from linux

Here are ways to update the firmware on Dell iDRAC6 remote access cards.

Both methods require downloading the BIOS from Dell and extracting it from the bundle. For example, this is the 1.70.21 firmware:
mkdir /tmp/dell
cd /tmp/dell
wget http://ftp.dell.com/esm/IDRAC6_FRMW_LX_R299265.BIN

Grab this and extract like this:
cd /tmp/dell
sh IDRAC6_FRMW_LX_R299265.BIN --extract ./idrac6-1.70.21
The firmware image is now in /tmp/dell/idrac6-1.70.21/payload/firmimg.d6

If using the CMC to update the firmware upload the extracted firmimg file, NOT THE BIN!

If you are just updating one machine, then the simplest way to perform the update is to use the Dell bmcfwul tool locally. This is supplied in the dell_ie_nitrogen package, and is installed to /usr/libexec/dell_dup/dell_ie_nitrogen/bmcfwul.

Install the new firmware like this:
/usr/libexec/dell_dup/dell_ie_nitrogen/bmcfwul -input=/tmp/dell/idrac6-1.70.21/payload/firmimg.d6
If you have several machines to update, the most convenient way to perform the update is with tftp.

First, copy the firmware image to the tftp server, and put it in /tftproot, or wherever the root of your tftp server is located:
scp /tmp/dell/idrac6-1.70.21/payload/firmimg.d6 $ip_of_tftp_server:/tftproot

Then, trigger a firmware upgrade on the machines remotely using either racadm or ssh:
racadm -r host.to.update -u root -p calvin fwupdate -g -u -a $ip_of_tftp_server
or
ssh host.to.update racadm fwupdate -g -u -a $ip_of_tftp_server

http://yo61.com/updating-dell-idrac6-firmware-linux.html

More on Sticky bits and ACLs

I'm going through the tedious task of hardening our Linux servers for an upcoming FSO visit as well as tweaking our existing kickstart for future builds.  A LOT of documentation goes into our kickstarts so we can pick things out and know what has been set and in response to which IAVA requirement.  I wanted a really clear example on how to properly use sticky bits and setfacl so to apply appropriate permissions when new files are created within a directory.  No point in setting the permissions on the current files if new ones can be created and bust the stig right?

The group ownership can be inherited by new files and folders created in your folder /path/to/parent by setting the setgid bit using chmod g+s like this:

chmod g+s /path/to/parent

Now, all new files and folder created under /path/to/parent will have the same group assigned as is set on /path/to/parent.

POSIX file permissions are not inherited; they are given by the creating process and combined with its current umask value.
However, you can use POSIX ACLs to achieve this. Set the default ACL on a directory:

setfacl -d -m u::rwX,g::rwX,o::- /path/to/parent

This will apply setfacl to the /path/to/parent directory, -modifying the -default ACLs – those that will be applied to newly created items. (Uppercase X means only directories will receive the +x bit.)

(If needed, you can add a u:someuser:rwX or g:someuser:rwX – preferably a group – to the ACLs.)

---

Note that, at least with ext3/ext4, you must mount the filesystem with the acl option, otherwise new ACLs cannot be set and existing ones will be ignored.

mount -o remount,acl /

Edit /etc/fstab to set this permanently.

Linux: sed command usage #1

I'm getting better with sed all the time but today was a challenging little booger.  I wanted to change /etc/pam.d/su from

cat /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so

to

cat /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth           required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so

Notice the absense of the comment on line 6?  If you used sed -i 's/\#auth/auth/' <file> it would only look at the first line and then quit.  If you used sed -i 's/\#auth/auth/g' it'd change all of them.  I wanted to change just ONE out of the whole file.  The trick?  To specify a LINE for sed to work on.

sed -i '6s/\#auth/auth/' /etc/pam.d/su

Finally!  Looked for a while to find the answer.  The key is using the line number at the beginning of the search string here.  This link helped me get going in the right direction, http://www.linuxquestions.org/questions/linux-software-2/sed-display-text-on-specific-line-of-text-file-397405/. but it didn't give me EXACTLY what I wanted. However it helped me figure out how to specify a line.  I knew I could do it after I was able to print the line I wanted to work on.  SUCCESS!!

Need to make a Linux Kickstart iso?

I work with Linux on a daily basis.  I'm also fortunate to have a good grasp on how to build servers and most of my co-workers, aside from a few, have trusted me to make most of the servers.  It's a pain having to use a windows server just to mount the ISO to get the process started.  Also if you're working from a longer distance away the size of that ISO burdens your connection. Behold the necessary steps to make a tiny ISO of just what you need to get the process started!

http://mikent.wordpress.com/2012/04/12/how-to-create-a-kickstart-iso-boot-disk-for-redhat/

How to create a kickstart ISO boot disk for RedHat

1) logon as root
2) create a directory name bootdisk/RHEL
mkdir -p bootdisk/RHEL
3) copy the directory isolinux from your RedHat DVD or other location containing RedHat binaries in bootdisk/RHEL
example: cp -R /mnt/isolinux/* ~/bootdisk/RHEL/
4) change direcotry to ~/bootdisk/RHEL/
cd ~/bootdisk/RHEL/
5) create (or copy) your ks.cfg  (it will be discussed  later in another post how to create a kickstart file) in ~/bootdisk/RHEL/
example: cp ks.cfg ~/bootdisk/RHEL/
6) Now, you can create the ISO boot disk as follow (make sure you run the command from ~/bootdisk/RHEL/) :
mkisofs -r -T -J -V “RedHat KSBoot” -b isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -v -o linuxboot.iso .
7) Burn your iso linuxboot.iso into a blank cd-rom or mount it as it is on a Virtual Machine for example
8) At linux boot prompt, type the following command:
linux ks=cdrom:/ks.cfg
if you need to install using a specific IP address using a specific Ks boot device, type the following:
linux ks=cdrom:/ks.cfg append ip=<IPaddress> netmask=<netmask> ksdevice=<NICx>
example: linux ks=cdrom:/ks.cfg append ip=10.10.10.10 netmask=255.255.255.0 ksdevice=eth0
9) your are done!