Saturday, October 4, 2014, 11:40 PM - - Riak Notes Posted by Administrator
This is a working draft, like lots of things in this site. For dev purposes firewalld was turned off.
Cluster VIP:172.16.1.213
TODO: VRRP failover setup for load balancer (keepalived) ALSO: It looks like I configured net.ipv4.ip_forward=1 in load balancer but failed to document it, check this when doing a new load balancer.
#####################Edge01 Configuration (loadbalancer 1)######################### //keepalived.conf ! Configuration File for keepalived
Friday, August 22, 2014, 09:42 PM - - Linux Notes Posted by Administrator
Here is a guide for setting up SFTP users who’s access is restricted to their home directory.
Add the following to the end of the /etc/ssh/sshd_config file:
Subsystem sftp internal-sftp
# This section must be placed at the very end of sshd_config Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no
This means that all users in the ‘sftponly’ group will be chroot’d to their home directory, where they only will be able to run internal SFTP processes.
Now you can create the group sftponly by running the following command:
$ groupadd sftponly
Set a user’s group:
$ usermod steve -g sftponly
To deny SSH shell access, run the following command:
$ usermod steve -s /bin/false
And set the user’s home directory:
$ usermod steve -d /folder
Finally, you probably need to restart SSH
$ service ssh restart
The SSH part should now be in order, but you should make sure that file permissions also are correct. If the chroot environment is in a user’s home directory both /home and /home/username must be owned by root and should have permissions along the lines of 755 or 750.
In other words, every folder leading up to and including the home folder must be owned by root, otherwise you will get the following error after logging in:
CentOS 7.- Using FirewallD instead of IPtables ..changes, changes and more changes.
Wednesday, July 30, 2014, 05:47 PM - - Linux Notes Posted by Administrator
Presentation
Firewalld is the new userland interface in RHEL 7. It replaces the iptables interface and connects to the netfilter kernel code. It mainly improves the security rules management by allowing configuration changes without stopping the current connections.
To know if Firewalld is running, type:
# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago
...
or alternatively:
# firewall-cmd --state
running
Note: If Firewalld is not running, the command displays not running.
If you’ve got several network interfaces in IPv4, you will have to activate ip_forwarding.
To do that, paste the following line in the /etc/sysctl.conf file:
net.ipv4.ip_forward=1
Then, activate the configuration:
# sysctl -p
Although Firewalld is the RHEL 7 way to deal with firewalls and provides many improvements, iptables can still be used.
Zone management
Also, a new concept of zone appears : all network interfaces can be located in the same default zone or divided into different ones according to the levels of trust defined.
To get the default zone, type:
# firewall-cmd --get-default-zone
public
To get the list of zones where you’ve got network interfaces assigned to, type:
# firewall-cmd --get-active-zones
public
interfaces: eth0
To get the list of all the available zones, type:
# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
To get all the details about the public zone, type:
# firewall-cmd --zone=public --list-all
public (default, active)
interfaces: eth0
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
To change the default zone to home permanently, type:
# firewall-cmd --set-default-zone=home
success
Network interfaces can be assigned to a zone in a temporary (until the next reboot or reload) or permanent way.
To assign the eth0 network interface temporary to the internal zone, type:
To assign the eth0 network interface permanently to the internal zone (a file called internal.xml is created in the /etc/firewalld/zones directory), type:
After assigning each network interface to a zone, it is now possible to add services to each zone.
To allow the http service permanently in the internal zone, type:
Note1: Type –remove-service=http to deny the http service.
Note2: The firewall-cmd –reload command is necessary to activate the change. Contrary to the –complete-reload option, current connections are not stopped.
To get the list of services in the default zone, type:
# firewall-cmd --list-services
dhcpv6-client ssh
Note: To get the list of the services in a particular zone, add the –zone= option.
Service firewall configuration
With the Firewalld package, the firewall configuration of the main services (ftp, httpd, etc) comes in the /usr/lib/firewalld/services directory. But it is still possible to add new ones in the /etc/firewalld/services directory. Also, if files exist at both locations for the same service, the file in the /etc/firewalld/services directory takes precedence.
For example, it is the case of the HAProxy service. There is no firewall configuration associated.
Create the /etc/firewalld/services/haproxy.xml and paste the following lines:
If your firewall is your network gateway and you don’t want everybody to know your internal addresses, you can set up two zones, one called internal, the other external, and configure masquerading on the external zone. This way, all packets will get your firewall ip address as source address.
To set up masquerading on the external zone, type:
# firewall-cmd --zone=external --add-masquerade
Note1: To remove masquerading, use the –remove-masquerade option.
Note2: To know if masquerading is active in a zone, use the –query-masquerade option.
Port forwarding
In addition to the masquerading, you can want to use port forwarding.
If you want all packets intended for port 22 to be now forwarded to port 3753, type:
Note1: To remove port forwarding, use the –remove-forward-port option.
Note2: To know if port forwarding is active in a zone, use the –query-forward-port option.
Also, if you want to define the destination ip address, type:
MySQL – Generating Row Number for Each Row Using Variables in Query. (Ranking query results)
Wednesday, July 2, 2014, 10:10 PM - - MySQL Notes Posted by Administrator
Ranking field for result sets.
MySQL does not have any system function like SQL Server’s row_number () to generate the row number for each row. However, it can be generated using the variable in the SELECT statement.
The following table has five rows.
CREATE TABLE mysql_testing(db_names VARCHAR(100)); INSERT INTO mysql_testing SELECT 'SQL Server' UNION ALL SELECT 'MySQL' UNION ALL SELECT 'Oracle' UNION ALL SELECT 'MongoDB' UNION ALL SELECT 'PostGreSQL';
Now you can generate the row number using a variable in two methods
Method 1 : Set a variable and use it in a SELECT statement
SET @row_number:=0; SELECT @row_number:=@row_number+1 AS row_number,db_names FROM mysql_testing ORDER BY db_names;
Method 2 : Use a variable as a table and cross join it with the source table
SELECT @row_number:=@row_number+1 AS rank,db_names FROM mysql_testing, (SELECT @row_number:=0) AS t ORDER BY db_names;
Both the above methods return the following result
row_number db_names 1 MongoDB 2 MySQL 3 Oracle 4 PostGreSQL 5 SQL Server
For step 2 /dev/ttyS0 worked (that's a zero), and NO Hardware Flow control made pressing enter work, restarted AP and I notice messages were appearing on screen, but hitting enter will not have any results, changing Hardware Flow Control to NO fixed it.
Avatar