Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: linux

  • RHEL6 – Quick and Dirty NFS How To

    Cobra1So if you are reading this you many not be aware of the fact that I already put up a post on NFS on RHEL6 (you can find it here). However that post is basically just a redirect to another blog post that I ran into on the subject. And despite the fact that its very well written, and has no apparent spelling mistakes, or inapropriate comments about NFS, I felt the need to draft my own post. At this point I really cannot seem to remember anything technical if I don't put up a blog post on the subject. After all I have been doing so for over 4 years, so why stop now.

    Anyway, now that I got all that out of the way, lets sit down on brass tacks.

    First lets create a directory to be shared on our NFS Server

    # mkdir -p /shared/nfs

    Now lets change the unix perms so that its wide open

    # chmod 777 /shared/nfs

    Now lets add our new nfs share to /etc/exports/. In this example I am sharing it out to my local /24 network.

    /shared/nfs     10.1.224.0/24(rw,sync)

     Now restart NFS service

    # service nfs restart

    Now verify that you are now sharing via NFS with showmount

    # showmount -e localhost

    Export list for localhost:
    /shared/nfs 10.1.224.0/24

    If you are running iptables on your nfs host you are going to need to do a bit more to get nfs to work

    If you go by the book, you are going to need to run to open several ports, the commands below will open up what you need.

    # iptables -I INPUT -m multiport -p tcp –dport 111,662,875,892,2049,32803 -j ACCEPT

    # iptables -I INPUT -m multiport -p udp –dport 111,662,875,892,2049,32769 -j ACCEPT

    The fast and cheap way is to just allow all from your nfs client

    # iptables -I INPUT -s 10.1.224.55 -j ACCEPT

    Now lets go over to the host that we intend to mount our nfs filesystem on and run our showmount command again

    # showmount -e 10.1.224.34
    Export list for 10.1.224.34:
    /shared/nfs 10.1.224.0/24

    Now manually mount your share as seen below

    mount -t nfs 10.1.224.34:/shared/nfs /mnt

    Now add your share to /etc/fstab so that its mounted persistently across reboots.

    10.1.224.34:/shared/nfs /mnt                    nfs     defaults        0 0

    Just to be sure that everything is correct, unmount /mnt and mount /mnt. This way you will catch any errors in your fstab. Probably not a bad idea to touch a file under your new nfs mount too, just to make sure that its writeable.

  • RHEL6 – Getting Up Close and Personal With Rsyslog

    LogRsyslog has replaced Syslog as the default logging daemon in RHEL6. Rsyslog was designed to complete with syslog-ng and has several enhancements over plain old syslog. This includes but is not limited to more granularity with timestamps, direct database logging,   TCP support, and  relay server names in host fields which makes it easier to track the path a message has taken.

    Below we are going to take a look at a few simple rsyslog configuration items.

    Configure Rsyslog to Accept Remote Logs.

    Within /etc/rsyslog.conf, comment out either the TCP or UDP syslog reception lines below. TCP is more reliable, however UDP is more widely supported.

    # Provides UDP syslog reception
    #$ModLoad imudp.so
    #$UDPServerRun 514

    # Provides TCP syslog reception
    #$ModLoad imtcp.so
    #$InputTCPServerRun 514

    Configure a Server to Send Logs to a Remote Host.

    To send all messages of info priority or higher to a remote host via udp, use the following format. Note that 10.1.224.34 is the remote server that I want to send logs to.

    *.info    @10.1.224.34

    To send the same priorities to the remote host via TCP, use two "@@"

    *.info    @@10.1.224.34

    Note that you can specify the port number on which to send by using IP:PORT. When no port is specified the default port of 514 is used.

    Note that depending on your configuration you may need to alter your IPtables configuration on your sending and/or receiving server. In my case I needed to allow UDP on port 514 on my remote syslog server. To accomplish this I used system-config-firewall-tui which added the following line to /etc/sysconfig/iptables.

    -A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT

    Which shows up as what you see below in the output of 'iptables -L'

    ACCEPT     udp  –  anywhere             anywhere            state NEW udp dpt:syslog

    Testing Your Configuration

    Ok lets send a test to our remote syslog server. Note that rsyslog has been restarted on both hosts.

    # logger "testing to remote rsyslog server"

    Checking the messages file on the remote host we can see that the test message has arrived.

    Aug 13 14:55:26 vfatmin02 root: testing to remote rsyslog server

     

  • RHEL6 – Quick and Easy Samba Configuration Guide

    Space ghostAccording to Samba.org , "Samba is an Open Source/Free Software suite that provides seamless file and print services to SMB/CIFS clients." Bottom line, samba allows you to share files and directories via Linux and access them on a Windows machine.

    Lets walk through a senario where are ultimate goal is to get samba configured quickly and easily. We are not shooting for best practices here.  That being said., lets say you are asked to create a CIFS share with the following information. The share that we create must be writable by members of the sambausers group. Other users can only have read access.

    • Workgroup: Workgroup1
    • Linux Group: sambausers
    • CIFS Share Name: /share/samba

    Installing Samba

    Ok Lets get started by installing samba and configuring it to start at boot, then lets start it up.

    # yum install samba samba-doc samba-client

    # chkconfig smb on && service smb start

    Configuring Firewall

    There are two ways to do this. You can either do this via the command line, or do this via the system-config-firewall gui. In this instance I am going to do this the quick and dirty way, as our goal here is to get samba up and running quickly. So i launch system-config-firewall gui and select the box next t0 samba to enable access, then save and reload.

    Note that these are the lines that  are added to /etc/sysconfig/iptables.

    -A INPUT -m state –state NEW -m udp -p udp –dport 137 -j ACCEPT
    -A INPUT -m state –state NEW -m udp -p udp –dport 138 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 139 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 445 -j ACCEPT

    Create Users and Shares

    Now its time to add the Linux group sambausers. Note that the -r option below adds sambausers as a system group.

    # groupadd -r sambausers

    Now lets create a user named "myuser" and stick him in the sambausers group.

    # useradd -s /bin/nologin -G sambausers myuser

    Once thats done lets create a samba password for "myuser". Lets use "mypassword" as the samba password

    # smbpasswd -a myuser

    Now lets create our share and change group ownership to sambausers.

    # mkdir -p /share/samba

    # chgrp sambausers /share/samba

    Now set the setgid bit to ensure that all files created in /share/samba inherit the GID of sambausers.

    # chmod 2775 /share/samba

    Configure SELinux

    Set SELinux context, public_content_t on /share. This will allow you to share files anonymously.

    # semanage fcontext -a -t public_content_t '/share(/.*)?'

    Set SELInux context, samba_share_t on /share/samba. This allows samba to share this directory. By default SELinux is only configured to allow home directories to be shared via samba right out of the box.

    # semanage fcontext -a -t samba_share_t '/share/samba(/.*)?'

    Now apply the two semanage commands with restorecon.

    # restorecon -vvFR /shared

    Editing the SMB.conf

    Ok, now we need to actually configure samba. So modify or confirm the following in /etc/samba/smb.conf. Note that each and every one of the configuration items below is documented in the smb.conf

    First set the workgroup as seen below

    workgroup = workgroup1

    Then create the directive to share our directory of /share/samba.

    [samba]
            path = /share/samba
            write list = @sambausers
            read only = yes
            guest ok = no

    Testing our Configs

    Holy Crap, we finally made it. Now lets test with the smbclient command

    # smbclient -L localhost -U myuser

    This shows us that our share, called samba, does in fact exist.

    Sharename       Type      Comment
            ———       —-      ——-
            samba           Disk     

    Now lets connect.

    #smbclient //localhost/samba -U myuser

    Once connected lets put and touch a few files

    smb: \> mkdir testing

    smb: \> put /etc/hosts hosts

    Awesome, I can see the share, I can access it and I can create files. Mission accomplished.

     

  • SELinux – Invalid Regex in /etc/selinux/targeted/contexts/files/file_context

    EnikSo I have been doing my best to better understand SELinux as of late, and last night when I was practicing I ran into an issue that had me banging my head against by desk.

    Specifically I was playing around with the semanage command and working on defining a particular context to a directory that I had just created. However I was not exactly quite sure of the exact regex to use (or even if I needed to use a regex)

    The specific command that I ran was…

    #semanage fcontext -a -t httpd_sys_content_t /var/www2

    Now my concern was that this was not the correct command for me to run since www2 was a directory and I wanted to make sure that appropriate SELinux contexts were applied recursively as new files/directories were created. So I ran the following command that I found in my RHEL book.

    #semanage fcontext -a -t httpd_sys_content_t ‘/var/www2/html(*,/)’

    which spits out this….

    /etc/selinux/targeted/contexts/files/file_contexts.local:  line 13 has invalid regex /var/www2/html(*,/):  Invalid preceding regular expression

    Oops, wait I entered the command wrong. Its a period and the end not a comma, so I run the command again with a period this time and get the following error.

    # semanage fcontext -a -t httpd_sys_content_t ‘/var/www2/html(*./)’
    /etc/selinux/targeted/contexts/files/file_contexts.local:  line 13 has invalid regex /var/www2/html(*,/):  Invalid preceding regular expression
    /etc/selinux/targeted/contexts/files/file_contexts.local:  line 14 has invalid regex /var/www2/html(*./):  Invalid preceding regular expression

    Well crap, its still not correct. So I enter this command and get another error.

    #semanage fcontext -a -t httpd_sys_content_t “/var/www2/html(/.*)?“

    So at this point I start running all sorts of variations of the command with minor syntax changes each time, each time getting an error and each time getting more and more frustrated thinking that I am still not running the command correctly.

    However this is not actually the case.

    After I take a step back and cool off I actually take the time to read the error message which is pointing me t the file, file_contexts.local. Which upon further inspection actually contains each and every regex that I just ran regardless of the fact that the regex was correct.

    # cat /etc/selinux/targeted/contexts/files/file_contexts.local | grep www2
    /var/www2    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html(/,*)?    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html(/,*)    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html    system_u:object_r:httpd_sys_content_t:s0
    /var/www2(/.*)?    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html(*,/)    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html(*./)    system_u:object_r:httpd_sys_content_t:s0
    /var/www2/html(/.*)?    system_u:object_r:httpd_sys_content_t:s0

    In a nutshell.. the semanage command added each and context to file/directory mapping despite the fact that my regex was not correct, and then it gave me an error. So each time I ran the command with the an invalid regex, another entry was added and the error message grew. One would think that it would detect the regex error first and not add it to the file.

    Anwyway the fix was to identify all the bad lines in the file from the error message and run the following command against each entry.

    #semanage fcontext -d “/var/www2/html(*,/)?”

    Once I cleaned out the file of the offending entries I was able to run the command one last time, this time using the correct syntax and was error free

  • RHEL6 – Using Semanage and Restorecon to Modify SELinux File Contexts

    Potty TrainingOk, how to keep this simple? Lets see…

    Semanage:

    Ok, semanage, when used with the fcontext argument, is used to define SELinux file contexts for file. It basically adds the new definition to the file,  /etc/selinux/targeted/contexts/files/file_contexts.

    For example lets say that I create a new file called /root/foobar.

    Using the command below I can see the default context that is assigned to a file created in /root

    # ls -lZ foobar
    -rw-r–r–. root root unconfined_u:object_r:admin_home_t:s0 foobar

    Now lets say that I want to change the context of this file to public_content_t.  The first step to accomplish this is to define its new context.

    # semanage fcontext -a -t public_content_t /root/foobar

    Restorecon:

    Now that the context type is defined we need to actually modify the current context of our file. So now you run restorecon against the file to actually make the change. Note: use -v for verbose.

    # restorecon -v /root/foobar

    restorecon reset /root/foobar context unconfined_u:object_r:admin_home_t:s0->unconfined_u:object_r:public_content_t:s0

    Chcon:

    There is also a command called chcon, that can also be used to change the defined context for a file. However I advise against using it as changes made using chcon will not survive a filesystem relabel. What is a filesystem relabel? Well according to wiki.centos.org, a relabel is defined below.

    “Sometimes it is necessary to relabel the complete filesystem although this should only be necessary when enabling SELinux after it has been disabled or when changing the SELinux policy from the default targeted policy to strict.”

     

  • RHEL6 – Display and Modify SELinux Modes

    There are three basic commands that you can use to display and modify SELinux modes. They are as follows

    • getenforce

    • setenforce

    • sestatus

    The first two are installed as part of the package, libselinux-utils. The sestatus is installed as part of policycoreutils.

    Setenforce will enable or disable SELinux temporarily. Use 0 to disable and 1 to enable as shown below.

    #setenforce 0
    #setenforce 1

    If you need need your change to be persistent across reboots edit /etc/selinux/config.

    # This file controls the state of SELinux on the system.
    # SELINUX= can take one of these three values:
    #       enforcing - SELinux security policy is enforced.
    #       permissive - SELinux prints warnings instead of enforcing.
    #       disabled - SELinux is fully disabled.
    SELINUX=enforcing
    # SELINUXTYPE= type of policy in use. Possible values are:
    #       targeted - Only targeted network daemons are protected.
    #       strict - Full SELinux protection.
    SELINUXTYPE=targeted

    Getenforce is used to query your SELinux Status as seen below

    [root@vpaquin01 selinux]# getenforce 
    Enforcing

    Sestatus give you the same information as getenforce but in a bit more detail

    [root@vpaquin01 selinux]# /usr/sbin/sestatus
    SELinux status:                 enabled
    SELinuxfs mount:                /selinux
    Current mode:                   enforcing
    Mode from config file:          enforcing
    Policy version:                 24
    Policy from config file:        targeted


  • RHCE Exam Objectives

    TCBND00ZWant to become an Red Hat Certified Engineer and ride around in trains all the live-long day. Well, you best get to studying and the exam is notoriously hard with a very agressive time limit. Bottom line, you walk in the door and sit down at the desk you better have a good idea of whats on the test, and your better be prepared to work fast.

    Anyway, below is the link to the exam outline, courtesy of Redhat.

    http://www.redhat.com/training/courses/ex300/examobjective

    One item of note, if you want cannot become a RHCE until you are a RHCSA, however you can pass the RHCE and then take the RHCSA. You do not have to pass them in order.

    Link below to the RHCSA exam outline, also from Redhat.

    http://www.redhat.com/training/courses/ex200/examobjective

    The links above will open in a new page, and are guaranteed to bring you pain and suffering.