Category: Howtos

Limiting access iptables

Posted on by admin

This is a Script that I use to deploy and script iptables.

Sample handles ssh and mysql it’s easy to extend.

#!/bin/bash
#
# iptables example configuration script
#
# Flush all current rules from iptables
#
 iptables -F
#
# Allow SSH connections on tcp port 22
# This is essential when working on remote servers via SSH to prevent locking yourself out of the system
#
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# SSH  rules
iptables -A INPUT -i eth0 -p tcp -s 193.50.90.251 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 212.164.176.98 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT


# mysql rules
iptables -A INPUT -i eth0 -p tcp -s 193.50.90.251 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 212.164.176.98 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
#Allow frontend 1
iptables -A INPUT -i eth0 -p tcp -s 191.94.70.36 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
#Allow Frontend 2
iptables -A INPUT -i eth0 -p tcp -s 191.94.70.38 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT




#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
#
# Set access for localhost
#
 iptables -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Save settings
#
 /sbin/service iptables save
#
# List rules
#
 iptables -L -v

nJoy 🙂

Starting vnc on Display 0 ( local display ) from a remote ssh session

Posted on by admin

i.e. You wnet home need your desktop have ssh no vnc !! Here is the easy solution..

Install x11vnc.

$ DISPLAY=localhost:0 x11vnc &

connect to the display using vnc et voila !

BTW Teamviewer also USED TO WORK but no longer in ver 8 so thanks VNC for not being obsolete..

nJoy 🙂

 

Monitoring a bottleneck with strace

Posted on by admin

If let’s say Mysql is slow at performing a task you can check what is the bottleneck using strace to attach to the process.

<span style="color: #00ff00;">$ ps -ef|grep -i mysql</span>

Identify the process id then

<span style="color: #00ff00;">$ strace -cp &lt;pid&gt;</span>

Leave it 10 seconds or a minute then ^C. That will tell you where the process is spending its time, e.g. it could just be waiting for the disk if you seen read and write dominate.

Njoy 🙂

Start Teamviewer from an ssh session remotely

Posted on by admin

So you remote deskptop rebooted and teamviewer did not run on startup as it does not do in Linux for some strange reason:

Connect with ssh ( putty)

Then run

DISPLAY=`localhost`:0 teamviewer&

Njoy 🙂 !

Enable VMWare time sync from command line

Posted on by admin

Virtual machines and NTP do not go easily well together. Machines paused for extended periods tend to loose the ntp sync since the difference grows too much.

 

Also from VMware Docs the following info might be clarificatory:

  • Do not configure the virtual machine to synchronize to its own (virtual) hardware clock, not even as a fallback with a high stratum number. Some sample ntpd.conf files contain a section specifying the local clock as a potential time server, often marked with the comment “undisciplined local clock.” Delete any such server specification from your ntpd.conf file.
  • Include the option tinker panic 0 at the top of your ntp.conf file. By default, the NTP daemon sometimes panics and exits if the underlying clock appears to be behaving erratically. This option causes the daemon to keep running instead of panicking.
  • Follow standard best practices for NTP: Choose a set of servers to synchronize to that have accurate time and adequate redundancy. If you have many virtual or physical client machines to synchronize, set up some internal servers for them to use, so hat all your clients are not directly accessing an external low-stratum NTP server and overloading it with requests

And :

In ESX, the ESX NTP daemon runs in the service console. Because the service console is partially virtualized, with the VMkernel in direct control of the hardware, NTP running on the service console provides less precise time than in configurations where it runs directly on a host operating system. Therefore, if you are using native synchronization software in your virtual machines, it is somewhat preferable to synchronize them over the network from an NTP server that is running directly on its host kernel, not to the NTP server in the service console. In ESXi, there is no service console and the NTP daemon runs directly on the VMkernel, so it works well as a NTP server for virtual machines.

Quoted from : http://www.vmware.com/files/pdf/techpaper/Timekeeping-In-VirtualMachines.pdf

Easy way (And I think best solution is)

  1. Setup NTP client to ESX
  2. Install VMWARE tools on the Guests ( recommended anyways).
  3. In Linux ( cause that’s what we care about ) run vmware-toolbox-cmd timesync enable

To force a sync run hwclock command.

nJoy 🙂 !

 

 

One Liner to test php sending mail from a bash script

Posted on by admin

To check if your php installation can successfully send emails from a bash script try this :

 php -r ‘var_dump(mail(“david.saliba@testemail.com”, “test subject”, “test body”));’

Thanks Gareth !

nJoy 🙂 !

How to add a disk to LVM

Posted on by admin

Suppose the Disk is /dev/sdb, the second scsi disk,

   fdisk /dev/sdb
   create as many partitions as you need using command n
   Label them with command t as 8e for making it Linux LVM
   Write and Exit with the command w.

Format the partitions you require using mkfs command

   mkfs -t ext3 -c /dev/sdb1

LVM commands

   pvcreate /dev/sdb1
   vgextend VolGroup00 /dev/sdb1
   lvextend -L 15G /dev/VolGroup00/LogVol01 ;for extending LogVol to 15GB
   lvextend -L+1G /dev/VolGroup00/LogVol01 ;for adding one more GB to Logical Volume LogVol01
   lvextend -l +100%FREE /dev/VolGroup00/LogVol01


Next you shall need to resize the filesystem.


   resize2fs -l /dev/VolGroup00/LogVol01


Thats it finished Njoy  🙂 !