MySQL Replication - A brief Note

Replication enables data from one MySQL database server (called the master) to be replicated to one or more MySQL database servers (slaves). Replication is asynchronous - your replication slaves do not need to be connected permanently to receive updates from the master, which means that updates can occur over long-distance connections and even temporary solutions such as a dial-up service. Depending on the configuration, you can replicate all databases, selected databases, or even selected tables within a database. With the help of Replication we can assure the scalability of Data. Because once the Master server went off-line,the slave will act as the master and start serving data. The Data will be replicated into slave server in a frequent intervals. Replication in MySQL features support for one-way, asynchronous replication, in which one server acts as the master, while one or more other servers act as slaves

The mail advantages of MySQL Replication are as follows

1.Scale-out solutions 
spreading the load among multiple slaves to improve performance. In this environment, all writes and updates must take place on the master server. Reads, however, may take place on one or more slaves. This model can improve the performance of writes (since the master is dedicated to updates), while dramatically increasing read speed across an increasing number of slaves.

2.Data security
Because data is replicated to the slave, and the slave can pause the replication process, it is possible to run backup services on the slave without corrupting the corresponding master data.

3.Analytics 
Live data can be created on the master, while the analysis of the information can take place on the slave without affecting the performance of the master.

4.Long-distance data distributionIf a branch office would like to work with a copy of your main data, you can use replication to create a local copy of the data for their use without requiring permanent access to the master.

How to Find APACHE under Attack

Apache is the worlds largest using WEB SERVER. According tonetcraft survey 49.73% of the market is owned by this wonderful product. This was free under GPL. The attackers are trying to hack the websites,whichever may be the server. So a Web Administrator should be vigilant about his Apache server.

Here I would like to tell how an administrator find whether his Apache server is Under Attack.

1.First checkout the load of the server

top -u apache (Here apache means the web server user)

Tasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie
Cpu(s): 3.8%us, 0.7%sy, 0.0%ni, 94.3%id, 1.1%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 1027224k total, 927296k used, 99928k free, 46428k buffers
Swap: 3004112k total, 0k used, 3004112k free, 410736k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 
5573 apache 20 0 20696 3284 584 S 0 0.3 0:00.00 apache2 
5575 apache 20 0 20696 3284 584 S 0 0.3 0:00.00 apache2 
5576 apache 20 0 20696 3284 584 S 0 0.3 0:00.00 apache2 
5577 apache 20 0 20696 3284 584 S 0 0.3 0:00.00 apache2 
5578 apache 20 0 20696 3284 584 S 0 0.3 0:00.00 apache2 

This is the normal stage of Apache. If the CPU usage is increasing,take care you are in trouble

2.Check the number of running Apache processes

ps -ef | grep apache | wc -l

If you get a number below 50,no problem. Other wise something nasty is happening

3.Check how many listening connection to port 80

ps -ef | grep apache | wc -l

If the number goes beyong 100,an attacker closely watching your servers

4.Check your listening foriegn IPs

netstat -tn

You can see that the same IP or IPrange is listening on your Web port (80). If you made a DNS lookup to those IPs You can found that all those IPS are come from a DHCP pool,it means ATTACK.

What is GLUE Record

A glue record is an A record that is created as part of a delegation. If a zone is delegated to a name server whose hostname is a Descendant of that particular zone, then a glue record for that hostname must be included in the delegation.

Encrypt the Mail Attachment.

Now a days internet is considered to be the most unsecured area of data transfer. Most people will send emails with attachment of their confidential matters,agreements etc. Anybody can read once you hack the email. But if attach with an encrypted key,you can open only with the help of a password,which you give at the time of encryption. I am briefing,how to encrypt a file.

Infrastructure

OS: Ubuntu 8.04
Application : gpgv

#gpg -c 

This time it will ask for the password twice,give it. And you are done. Now you can
see a filename called Filename.gpg. You can send it through internet comfortably.

For Decrypting do the following

#gpg Filename.gpg

Again it will ask for the password. Give ,OK file is decrypted.

How your Linux Boots ?

This is the Normal boot process of a Linux Operating System in to your computer. Boot process takes place in 4 scenes with 4 main characters.

Scene 1
when the computer is switched on,it automatically invokes BIOS[a ROM chip embedded in the motherboard].The BIOS will start the processor and perform a POST[power on self test] to check whether the connected device are ready to use and are working properly. Once the POST is completes BIOS will jump to a specified location in the RAM and check for the booting device.The boot sector is always the first sector of the hard disk and BIOS will load the MBR into the memory.

Scene 2
Here the boot loader takes the control of the booting process.LILO or GRUB are the boot loaders commonly available. It will help the user to select various boot options.Depending on the boot option selected the kernel is loaded.

scene 3

After kernel is loaded the kernel will take the control of the booting process and it will initialize all the hardwares including I/O processors etc.kernel then creates a root device and mounts the partitions.

Scene 4
INIT is loaded

Prevent access from an IP address using .htaccess

htaccess is a powerful tool is used to manipulated the webroot and apache configurations as well. The Rewrite rules can be written in .htaccess file. .htaccess file normally located in the webroot.

#Open the Apache configuration file.

vi /etc/httpd/conf/httpd.conf (Redhat Based,Centos Distros)
vi /etc/apache2/apache2.conf (Debian Based,Ubuntu Distros)

# Uncomment the Following Line

LoadModule rewrite_module modules/mod_rewrite.so

we need to change the AllowOverride directive also from


Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Satisfy all


to


Options FollowSymLinks
AllowOverride All
Order deny,allow
Deny from all
Satisfy all


Perfect !!! You have enabled the .htaccess support in your apache webserver.

Now go to your webroot. Normally its /var/www/html/domain.com. Create an htaccess file

touch .htaccess

vi .htaccess

Copy paste the following in to .htaccess file

order allow,deny
deny from 123.45.6.7
deny from 012.34.5.
allow from all

Save And Exit

Viola !!! You have blocked the above IPs from watching your site. Same like you can restrict an IP range also. Do the following if you would like to block a range

order allow,deny
deny from 123.45.6
deny from 012.34.
allow from all

You can block an ISP through the above method. Changes will look like following

order allow,deny
deny from some-evil-isp.com
deny from subdomain.another-evil-isp.com
allow from all

The above will all traffic from the specified Internet Service Providers IPs

Block Bad Bots using htaccess

Bots are software applications that run automated tasks over the Internet. But there is some bad bots which will run on your web root and pass your information to outside public. This should be prevented. In this article I am stating how to search for a bad bot and prevent it.

Enable the htaccess as described in the previous post

Open the htaccess

vi .htaccess

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^BadBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^EvilScraper [OR]
RewriteCond %{HTTP_USER_AGENT} ^FakeUser
RewriteRule ^(.*)$ http://go.away/

Save and exit
So, what does this code do? It's simple: the above lines tell your webserver to check for any bot whose user-agent string starts with "BadBot". When it sees a bot that matches, it redirects them to a non-existent site called "go.away". And
also it will check for 3 types of bots and if found one among them the control will be directed to some site.

Checking Load of server in Frequent intervals

One of the major problem in linux server is rising of load to high. This can be happened due to various reason. This script will check the load of machine in frequent intervals and inform the administrator through email. This will also send the current server status.


#mkdir -p /opt/scripts
#cd /opt/scripts
#touch server_load.sh
#chmod 755 server_load.sh

Copy paste the following into the server_load.sh

#!/bin/bash
EMAIL="yourname@yourdomain.com"
SUBJECT="Alert $(hostname) load average is $L05"
TEMPFILE="/tmp/$(hostname)"
echo "Load average Crossed allowed limit." >> $TEMPFILE
echo "Hostname: $(hostname)" >> $TEMPFILE
echo "Local Date & Time : $(date)" >> $TEMPFILE
echo "| Uptime status: |" >> $TEMPFILE
echo "-----------------------------------------------------" >> $TEMPFILE
/usr/bin/uptime >> $TEMPFILE
echo "-----------------------------------------------------" >> $TEMPFILE
echo "| Top 20 CPU consuming processes: |" >> $TEMPFILE
ps aux | head -1 >> $TEMPFILE
ps aux --no-headers | sort -rn | head -20 >> $TEMPFILE
echo "| Top 10 memory-consuming processes: |" >> $TEMPFILE
ps aux --no-headers| sort -rn | head >> $TEMPFILE
echo "----------------------------------------------------" >> $TEMPFILE
echo "| Memory and Swap status: |" >> $TEMPFILE
/usr/bin/free -m >> $TEMPFILE
echo "----------------------------------------------------" >> $TEMPFILE
echo "| Active network connection: |" >> $TEMPFILE
echo "----------------------------------------------------" >> $TEMPFILE
/bin/netstat -tnup | grep ESTA >> $TEMPFILE
echo "----------------------------------------------------" >> $TEMPFILE
echo "| Disk Space information: |" >> $TEMPFILE
echo "----------------------------------------------------" >> $TEMPFILE
/bin/df -h >> $TEMPFILE
echo "-----------------THE END----------------------------" >> $TEMPFILE

#Store the Current Load into a variable
L05="$(uptime|awk '{print $(NF-2)}'|cut -d. -f1)"

#Checking whether it goes beyond the limit

if test $L05 -gt 0
then
mail -s "$SUBJECT $L05" "$EMAIL" < $TEMPFILE fi #Remove the Temporary file.
rm -f $TEMPFILE

Create CronJob for this
#vi /etc/crontab
#The following script will run in every minute.
*/1 * * * * root /opt/scripts/server_load.sh

Network Failover

Failover is the process of switching to a backup component, element, or operation while recovery from a disruption is undertaken. Failover procedures determine the continuity of a network operation. Failover mechanisms can be devised so that they take place immediately or shortly after a disruption occurs. Many systems use automatic failover and data replication for instant recovery. Preemptive failover can also be used if an imminent disruption is detected.Failover requires the availability of a backup system to eventually take overservice. The type of failover model required dictates the backup state of readiness(Figure 2.2). There are three basic types of failover model. Each has implications onthe amount of information that must be available to the backup system at the time of failover:

• Hot or immediate failover requires a running duplicate of the production system as a backup to provide immediate recovery. Consequently, it is the more complex end expensive to implement. The backup system, referred to as a hot standby, must constantly be updated with current state information about the activity of the primary system, so that it is ready to take over operation quickly when needed. This is why this type of failover is sometimes referred to as a
stateful failover. Applications residing on the backup system must be designed to use this state information when activated. For these reasons, hot standby systems are often identical to the primary system. They are sometimes designed to load share with the primary system, processing a portion of the live traffic.

• Cold failover, on the other hand, is the least complex to implement but likely results in some disruption until the backup is able to initiate service. A cold standby backup element will maintain no information about the state of the primary system and must begin processing as if it were a new system. The backup must be initialized upon failover, consuming additional time. For these reasons, a cold failover model is usually the least expensive to implement.

• Warm failover uses a backup system that is not provided with state information on the primary system until a failover takes place. Although the backup may already be initialized, configuration of the backup with the information may be required, adding time to the failover process. In some variants of this model, the standby can perform other types of tasks until it is required to take over the primary system’s responsibilities. This model is less expensive than
the hot standby model because it reduces standby costs and may not necessarily require a backup system identical to the primary system

Manage your Server Farm with CapistranO

Capistrano is an open source tool for running scripts on multiple servers; its main use is deploying web applications. It automates the process of making a new version of an application available on one or more web servers, including supporting tasks such as changing databases. Capistrano is written in the Ruby language and is distributed using the RubyGems distribution channel. It is an outgrowth of the Ruby on Rails web application framework, but has also been used to deploy web applications written using other frameworks, including ones written in PHP. The usage on the bash command line is easy to learn. When used with the Ruby on Rails Framework many default Capistrano recipes can be used, e.g. to deploy current changes to the web application or roll back to the previous deployment state.

Installation

#apt-get install ruby1.8 ruby1.8-dev rubygems1.8 libruby-extras libruby1.8-extras
(Ubuntu / Debian)

#yum install ruby1.8 ruby1.8-dev rubygems1.8 libruby-extras libruby1.8-extras 
(Centos / Redhat)

Check the Ruby Details

#ruby -v
ruby 1.8.7 

OK,Lets move to install Capistrano Boy

#gem install -y capistrano echoe

Capistrano makes a few assumptions about your servers. In order to use Capistrano, you will need to comply with these assumptions:

• You are using SSH to access your remote machines. Telnet and FTP are not supported.
• Your remote servers have a POSIX-compatible shell installed. The shell must be called “sh” and must reside in the default system path.
• If you are using passwords to access your servers, they must all have the same password. Because this is not generally a good idea, the preferred way of accessing your
• servers is with a public key. Make sure you’ve got a good passphrase on your key.

We are going to trigger some examples here. So my remote servers are 192.168.1.12 and 192.168.1.13 (You can Add any number here).

In the following example we are going to check the uptime of above servers.

Copy paste the following code into a text editor (Vim,Emacs).

task :health, :hosts => "192.168.1.12" , "192.168.1.13" do
run "uptime"
end

Save the file with name "capfile" without any extension.

Wakeup the code

#cap health

I found that some times while you apply this command shell returned an error "Command not found",then do the following

#vi ~/.bashrc

Copy paste the following at the end of the File

export PATH=$PATH:/var/lib/gems/1.8/bin

Then rebuild the bashrc

# source ~/.bashrc


Then Re-run the command,If you are against a password access server,it will ask for the password,enter it,other wise the result will be like following

[192.168.1.12] executing command
[192.168.1.13] executing command
** [out :: 192.168.1.12] 11:30:55 up 27 days, 22:40, 0 users, load average: 0.01, 0.01, 0.00
** [out :: 192.168.1.12] 11:30:55 up 37 days, 08:40, 0 users, load average: 0.05, 0.01, 0.08
command finished
We Can Do any command by the above said method,I hope you will be happy if you have a critical update on all of your 100 servers ...
Is int it ?

How to Find Server is Under DDOS

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of a person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers.

netstat -anp | grep "tcp\|udp" | awk {'print $5'} | cut -d: -f1 | uniq -c | sort -n


So what will be the output ?

1 0.0.0.0
1 208.80.152.2
1 208.80.152.2
1 208.80.152.3
1 209.85.135.103
1 209.85.135.113
1 74.125.43.113
2 208.80.152.2
2 208.80.152.3
2 208.80.152.3
3 0.0.0.0
3 208.80.152.2

Left column indicates the number of connection,from the IP address which shown in right column. This was taken from my local test machine. If you are under an attack,this number may vary. The number will be any number.

Beautifying Nagios

Nagios is a popular open source computer system and network monitoring software application. It watches hosts and services, alerting users when things go wrong and again when they get better. Nagios, originally created under the name NetSaint, was written and is currently maintained by Ethan Galstad, along with a group of developers actively maintaining both official and unofficial plugins. Nagios was originally designed to run under Linux, but also runs well on other Unix variants. There is lot of plugins available in nagios for various purposes. But so far nothing found to beautify nagios from traditional look. Now there is a beautiful theme available

to beautify the nagios. This will give you a new look for your monitoring master.

Assumptions.
You have installed and setup Nagios for your network.
You are the Nagios Administrator.

[nagios@server]# wget http://tomas.cat/blog/sites/default/files/nagios-nuvola-1.0.3.tar_.gz 

[nagios@server]# tar zxvf nagios-nuvola-1.0.3.tar_.gz 

[nagios@server]# cp -a nuvola/html/* /usr/share/nagios3/htdocs/

[nagios@server]# cp -a nuvola/html/stylesheets/* /etc/nagios3/stylesheets/.

Reload Nagios

[nagios@server]#/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg
[nagios@server]# /etc/init.d/nagios reload

Check out......How beautiful ........

ScreenShots of my Nagios server after Makeup

Qmail Tips & Tricks.

qmail is a mail transfer agent that runs on Unix. It was written, starting December 1995, by Daniel J. Bernstein as a more secure replacement for the popular Sendmail program. qmail's source code is released to the public domain, making qmail free software. Most Popular email services like Yahoo,Gmail are using qmail for their mail traffic. Here I am pasting some qmail tips,which helped me to override when I was blackout with my Qmail Box.

qmailctl - This command will show you a lot of information about your qmail server.

[root@mail.admin.org] qmailctl stat 
/service/qmail-send: up (pid 3030) 30 seconds
/service/qmail-send/log: up (pid 3025) 30 seconds
/service/qmail-smtpd: up (pid 3028) 30 seconds
/service/qmail-smtpd/log: up (pid 3029) 30 seconds
/service/qmail-pop3d: up (pid 3026) 30 seconds
/service/qmail-pop3d/log: up (pid 3027) 30 seconds
messages in queue: 0
messages in queue but not yet preprocessed: 0

The above output means your Qmail server is Ready to deliver / receive messages. The seconds figure should be same,for a clean server.

[root@mail.admin.org]qmailctl queue
messages in queue: 0
messages in queue but not yet preprocessed: 0

This will shows the list of mails which were not delivered in the server.

[root@mail.admin.org]qmailctl queue | wc -l
Which will give the number of mails in the queue.

[root@mail.admin.org]qmailctl start
Starts mail service (smtp connection accepted, mail can go out)

[root@mail.admin.org]qmailctl stop
Stops mail service (smtp connections refused, nothing goes out).

[root@mail.admin.org]qmailctl pause
Temporarily stops mail service (connections accepted, nothing leaves).

To block a sender or entire domain to your Qmail Box. Because some times you need to block a user or entire domain from outside world to reach to your qmail

[root@mail.admin.org] vi /var/qmail/control/badmailfrom

Inside the " badmailfrom " file, the syntax might look something like this:

spam@spammerhell.org
@spammerhell.org

What do the above lines do?

The entry for "spam@spammerhell.org" would block all mail coming from "spam@spammerhell.org".

The entry for "@spammerhell.org" would block any and all mail coming from the domain "@spammerhell.org".

To be Continued.... 
Because Qmail Administration is an Ocean,I am just seeing it from the Shore. ..

Adding a VLAN in CISCO 2900

Creating a Virtual Lan is an advanced job in the case of networking. This needs experience in networking,Switching etc. But here i am stating how to add a new VLAN in the CISCO 2900 XL.

Assumptions
1.You have a basic knowledge in networking
2.You have the administrator access to switch
3.You should be aware on what you are doing !!!

CISCO2900>switchport mod access

CISCO2900>switchport mod access vlan5

CISCO2900>conf t

CISCO2900>int Fast 0/31

CISCO2900>description To Marketing LAN

CISCO2900>write

Disable USB in Grub

Now a days USB storage devices are common in the industry. This is very halmful in any unsecured network. Because this devices are considered to be the virus spreading agents. In corporates USB media is prevented because of above said reasons. So here a small tip to prevent USB storage in Linux machines through GRUB.

Scenario
OS : Debian / Ubuntu

Open the Grub configuration file

#vi /boot/grub/menu.lst

Add "nousb" at the end of the Kernel Line. Like the following

kernel /vmlinuz-2.6.18-128.1.1.el5 ro root=LABEL=/ console=tty0 console=ttyS1,19200n8 nousb

Secure GRUB with a strong Password !!!

#/sbin/shutdown -r now

So nobody can use USB storage unless you allowed to do so.

Block Coutry wise traffic using Iptables

Some countries are blacklisted in ecommerce area due to spam flooding and DoS attacks. Its not difficult to find the root of an IP address. So the following script will block country based traffic in to your web server. The data will be updated in every day through a cronjob.
You need to visit this SITE to download the zone file for which country you need to block.

#mkdir -p /opt/scripts

#vim /opt/scripts/ip_country_deny.sh

Copy Paste the following

#!/bin/bash
### Block all traffic from AFGHANISTAN (af) and CHINA (CN). Use ISO code ###
ISO="af cn"

### Set PATH ###
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep

### No editing below ###
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

cleanOldRules(){
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}

# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

# clean old rules
cleanOldRules

# create a new iptables list
$IPT -N $SPAMLIST

for c  in $ISO
do
# local zone file
tDB=$ZONEROOT/$c.zone

# get fresh zone file
$WGET -O $tDB $DLROOT/$c.zone

# country specific log message
SPAMDROPMSG="$c Country Drop"

# get
BADIPS=$(egrep -v "^#|^$" $tDB)
for ipblock in $BADIPS
do
   $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
   $IPT -A $SPAMLIST -s $ipblock -j DROP
done
done

# Drop everything
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

# call your other iptable script
# /path/to/other/iptables.sh

exit 0
#Script Ends Here....

Save and Exit

Setup a crontab for working in every day

#vim /etc/crontab

Add the following at the end of the file

03 03 * * * root /opt/scripts/ip_country_deny.sh

To start the script immediately

#/opt/scripts/ip_country_deny.sh

#iptable -L -n -v

Check out the wonderful output....

Update notification through email RHEL / Centos

As everybody know,the system should be update. So an administrator should be vigilant on the new updates and patches from the vendor. But how do we know there is a patch available in the remote server. Here a way to get notified when an update is available.

#vim /etc/yum/yum-updatesd.conf



[main]
# how often to check for new updates (in seconds)
run_interval = 3600
# how often to allow checking on request (in seconds)
updaterefresh = 600

# how to send notifications (valid: dbus, email, syslog)
emit_via = email
# who to send the email
email_to = admin@adminguru.co.nr

# who send the notifications
email_from = updates@backup.server.com
#
# should we listen via dbus to give out update information/check for
# new updates
dbus_listener = yes

# automatically install updates
do_update = no
# automatically download updates
do_download = no
# automatically download deps of updates
do_download_deps = no

Save and Exit

Restart the Yum updater

#/etc/init.d/yum-updatesd restart

You will be notified when an update is available. Sample Email is as follows.
Hi,
This is the automatic update system on server.backup.com.

There are 2 package updates available. Please run the system updater.

Packages available for update:

    kernel-2.6.18-92.el5
    kopete                       

Thank You,
Your Computer

Apache RealTime Monitoring MOD_STATUS

There is number of tools available to monitor apache in realtime. Like Nagios,Cacti etc. But those tools are little difficult to configure for the first time (Experts Please excuse :-) ). Here I would like to introduce couple of simple tools which help the Webserver admin to monitor his Apache webserver in real time through Web and Console.

Mod_Status

Status Module is a builtin module for apache for a default installation. First checkout whether this module is compiled with your Apache.

[root@apache.org] cat /etc/httpd/conf/httpd.conf | grep status_module

LoadModule status_module modules/mod_status.so

Make sure this line was not comment out. OK,Lets take the backup of your current configuration file

[root@apache.org]cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf_backup

[root@apache.org]vim /etc/httpd/conf/httpd.conf

Goto Last Line and Paste the following


SetHandler server-status
Order Deny,Allow
Allow from all
<\Location >


Search for the Line "ExtendedStatus". Normally this line is commented out. Uncomment it.

Save and Exit

Take your browser. http://your.domain.com/server-status

Take a look at the values,Its Realtime values from the Apache. To view this page continuously,I mean refreshing automatically

http://your.domain.com/server-status?refresh=N
(This N is any number).

Apache Real Time monitoring APACHETOP

Apache top is another tool for apache real time monitoring. This is just like the TOP command in *nix based systems. Here this can show a lot of informations from the Apache Web Server.

[root@apache.org]mkdir -p /opt/src 

[root@apache.org]cd /opt/src

[root@apache.org]wget http://www.webta.org/apachetop/apachetop-0.12.6.tar.gz 

[root@apache.org]tar -zxf apachetop-0.12.6.tar.gz

[root@apache.org]cd apachetop-0.12.6 

[root@apache.org]./configure --with-logfile=/var/log/httpd/access_log

[root@apache.org]make 

[root@apache.org]make install

OK,Lets trigger it....

[root@apache.org] apachetop

Following Screenshot says it all. This was taken from my local test machine.



Try apachetop --help for more available switches

Apache Error - No space left on device: Couldn't create accept lock or Cannot create SSLMutex

Some times you people may face this following error in your Apache Server. The error is as follows while trying to restart.after a configuration changes or something like that

[emerg] (28)No space left on device: Couldn't create accept lock

OR

[crit] (28)No space left on device: mod_rewrite: could not create rewrite_log_lock Configuration Failed

OR

[Wed Dec 07 00:00:09 2005] [error] (28)No space left on device: Cannot create SSLMutex

This is happened due to someking of memory leaking. Normally people do the following to fix this.

1.Checking the harddisk space usage

2.To explicetely different Lockfiles using the LockFile-directive

3.non-default AcceptMutex (flock) which then solved the acceptlock-issue and ended in the rewrite_log_lock-issue.

4.Reboot

The fourth option will only work,because this is due to the following reason

There were myriads of semaphore-arrays left, owned by my apache-user. Removing this semaphores immediately solved the problem

Do the following as ROOT

[root@apache.org] ipcs -s | grep apache | perl -e 'while () { @a=split(/\s+/); print `ipcrm sem $a[1]`}' -- (If You Love Perl)

[root@apache.org] ipcs -s | grep apache | awk ' { print $2 } ' | xargs ipcrm sem (If you Love Sh)

Have a great Day with Apache !!!

Update Twitter from a Linux Shell

Everybody knows now about TWITTER. It is a free social networking and micro-blogging service that enables its users to send and read messages known as tweets. Tweets are text-based posts of up to 140 characters displayed on the author's profile page and delivered to the author's subscribers who are known as followers. Senders can restrict delivery to those in their circle of friends or, by default, allow open access. Users can send and receive tweets via the Twitter website, Short Message Service (SMS) or external applications. While the service costs nothing to use, accessing it through SMS may incur phone service provider fees.
There is a lot of APIs available to update twitter now like TwitterFox (Firefox Addon) TweetDeck. But now how can I update twitter from my Linux terminal ? Here follows the answer. This is simple using CURL.

curl -u user:password -d status=”Your status message” http://twitter.com/statuses/update.xml

Wher user is your twitter username and password is your twitter password .

If curl is not installed do the following

apt-get install curl (Debian / Ubuntu)
yum install curl (Fedora / RHEL / Centos)

So keep in touch with twitter if you are in Datacentre .....

Search Google from Linux commandline

Nothing to say about google. You can search google for a result even from your linux command line.

curl -A Mozilla http://www.google.com/search?q=Linux|html2text -width 80

You need to install CURL and HTML2TEXT in your box.

apt-get install curl html2text (Debian / Ubuntu)
yum install curl html2text (Fedora / Centos / RHEL)

OpenSSH Security Tips

OpenSSH is tool used for connecting and managing remote linux machines. And this should be secured. I am here by telling some security tips to make the SSH server perfect.

1.The following iptable rule will drop incoming connections which make more than 5 connection attempts upon port 22 within 60 seconds

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j DROP

2.Disable Empty Passwords

Open the file /etc/sshd/sshd_config and

PermitEmptyPasswords no

3.TCPWrappers

open --> vi /etc/hosts.deny
sshd:ALL

then

open --> vi /etc/hosts.allo

sshd:192.168.1.32 192.168.1.21 (Change to your desired IP)

4.Change the SSH Port

The Idea behind this , suppose we change the port 22 to something other say Oracle 1521 , the attackers thinks that this is an Oracle server and will try oracle hacking tools :)

Port 300

5.Force Logout for Idle Sessions
ClientAliveInterval 300
ClientAliveCountMax 0

Multitail - For viewing multiple logs simultaneoulsy

Tail is a command in unix like systems for viewing log files. We can view only one log at a time , for viewing multiple log files we can use multitail.

1.Installation

yum install multitail (For Redhat , Centos )

apt-get install multitail (Ubuntu ,Debian )

2.Usage

multitail -f /var/log/httpd/error_log /var/log/httpd/access_log

3.Also you can run a command and watch its output

multitail -f /var/log/iptable.log "ping server.com"

4.You can see 3 files in 2 columns

multitail -s 2 /var/log/qmail_pop.log /var/log/qmail_send.log /var/log/spamassassin.log 

Enjoy !!!

Knowing Apache Logs

LOG is the main friend of an Apache Administrator. We can see error_log , access_logs under LOG directory in Apache web server. It contain many things. Here I am briefly explaining what all the fields mean in a single line of Apache Log. CLF or Common Log Format is the core of logging in Apache. A module called mod_log_config is responsible for all these logging activities.

The CLF log file contains a separate line for each request. A line is composed of several tokens separated by spaces:

host ident authuser date request status bytes

host : The fully qualified domain name of the client, or its IP address

ident : If the IdentityCheck directive is enabled and the client machine runs
identd, then this is the identity information reported by the client

authuser :If the requested URL required a successful Basic HTTP authentication,
then the user name is the value of this token.

date : The date and time of the request. The date field can be [day/month/year:hour:minute:second zone]

request : The request line from the client, enclosed in double quotes (“).

status : The three-digit HTTP status code returned to the client.

bytes : The number of bytes in the object returned to the client, excluding all
HTTP headers.