Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: linux

  • Xenserver: How To Create A Custom Kickstart Template via the CLI

    100-Frankenstein-Smiley-Free-Halloween-Vector-Clipart-IllustrationIf you are reading this post, then you should know that I have been spending a lot of time as of late trying to learn XenServer, and I am doing my best to get Xenserver to do my evil bidding.

    When I first took a look at XenServer I was dissapointed to find that you cannot PXE boot a VM unless you use the “Other Install Media” Template. However, when you use this template you are not building a fully paravirtualized vm, and you loose some functionality on your vm (like hot adding a virtual disk).

    So lets say you want to kickstart a Centos 5 64-bit vm. Traditionally in XenServer,  you need to create a new vm based on the “Centos 5 (64-bit)” template and then point your vm to your kickstart media and ks config file. Being that this is a manual process, and I am trying to automate building virtual machines, I started searching for a better way to make Xenserver do what I wanted… I think I may have accomplished my goal.

    So the first thing I did was create a new vm via cli. This step spits out a UUID for your new vm.

    #xe vm-install template=CentOS\ 5\ (64-bit) new-name-label=Centos5.4_Kickstart

    Now setup your boot params to point your new vm to your kickstart config file

    #xe vm-param-set uuid=0415bc6c-6129-9bc2-26d7-e15625cf85a1 PV-args="ks=http://<my_kickstart_server>/kickstart/ks/centos5-u4_x86_64.cfg ksdevice=eth0"

    Then tell your new vm where to find its install DVD.

    #xe vm-param-set uuid=6aaf7e10-59e4-9895-9c7b-6eee32eab9f1 other-config:install-repository=http://<my_kickstart_server>/centos5-u4-x86_64/disc1/

    Now figure out the UUID of your Kickstart VLAN

    #xe network-list

    Create a VIF (virtual interface) on your kickstart vlan.

    #xe vif-create vm-uuid=0415bc6c-6129-9bc2-26d7-e15625cf85a1 network-uuid=f5a61f5b-f17c-ac40-0995-c41c3a5a3ea3 device=0

    Now on the next step i cheated – I used XenCenter to quick create a vm based on my new template.

    Now when I create a new vm from this template, it startes to kickstart on boot. My next steps are to create multiple templates, each based on my different kickstart images/configs. Then figure out how to set their ips and hostnames.

    Hopefully that post is coming soon.

     

  • X11 No Worky – Worky

    Christmas Ape from Space

     

     

     

     

     

     

    Yikes, was banging my head against a wall trying to get X11 forwarding working on my RHEL 6.1 box. Every time I ssh’d in and attempted to pop an X window back to my fedora desktop, I was greeted with the error message below.

    # Error: no display specified

    Ok, I thought to myself — X11 forwarding is not enabled in sshd — let’s go fix it. However, when I checked /etc/ssh/sshd_config, I found that X11 forwarding was enabled. See the config item below, these needs to exist, and not set to no.

    X11Forwarding yes

    Ok so let’s check what the display variable is set to. So I ran the command below, which returned absolutely nothing, which meant that it’s not set to anything at all.

    # echo $DISPLAY

    So I check my local box and check to make sure that forwarding is enabled. Which it is

    #grep X11 /etc/ssh/ssh_config
    ForwardX11 yes

    After I bit of research on google – I found a bugzilla that suggested I make sure that the following rpm was installed – xorg-x11-xauth.x86_64.  It wasn’t..

    yum install xorg-x11-xauth.x86_64

    Then logout and back in again. You will be now be greeted by the line below.

    /usr/bin/xauth:  creating new authority file /root/.Xauthority

    Now check your display variable.

    # echo $DISPLAY
    localhost:10.0

    Ah, much better.

     

     

     

  • RHEL6 – How to Setup an Anonymous FTP Server


     tow-truck-driver-cartoon-character-final-coghillToday on the fatmin we are going to setup an ftp server on RHEL6 that accepts anonymous uploads. We are going to do so with SELinux support and will be making modifications to iptables as well. Sounds fun, right?

    Installation:

    First and formost we need to install vsftpd

    # yum -y install vsftpd && service vsftpd start && chkconfig vsftpd on

    Our anonymous upload directory will be /var/ftp/anon, and we need to change group ownership to the ftp group and then change permissions so that the members of that group can write to it. Note that no one other than root can read or execute anything under /var/ftp/anon.

    # chgrp ftp /var/ftp/anon
    # chmod 730 /var/ftp/anon
    # ls -ld /var/ftp/anon
    drwx-wx—. 3 root ftp 4096 Oct 19 13:34 /v1

    SELinux Support:

    Next we need to configure SELinux support and assign the correct context to the /v1 directory and its future contents. Note -a is add -t is type.

    # semanage fcontext -a -t public_content_rw_t ‘/var/ftp/anon(/.*)’

    Now lets go ahead and apply the new context. Note -vv is verbose, -F force and R is recursive

    # restorecon -vvFR /var/ftp/anon

    Now we need to get and set the allow_ftpd_anon_write boolean

    # setsebool -P allow_ftpd_anon_write=1

    Now lets check to make sure the setting “stuck”.

    # getsebool -a | grep allow_ftpd_anon_write
    allow_ftpd_anon_write –> on

    Configure Vsftpd:

    Now vi /etc/vsftpd/vsftpd.conf and ensure that the following configuration values are set and un-commented. Note that I had to add the last line to my config file.

    anonymous_enable=YES

    anon_upload_enable=YES

    chown_uploads=YES

    chown_username=daemon

    anon_umask=077

    Configure iptables:

    Add the following to /etc/sysconfig/iptables-config. In my case I only needed to add the ip_nat_ftp part to the line

    IPTABLES_MODULES=”nf_conntrack_ftp ip_nat_ftp”

    Now you are going to want to make sure that these two lines exist in /etc/sysconfig/iptables.

    -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -p tcp –dport 21 -j ACCEPT

    Now restart iptables

    Addendum:

    Note that I ran into issues with the semanage command below.

    # semanage fcontext -a -t public_content_rw_t ‘/var/ftp/anon(/.*)’

    It seems that the context assigned to the /var/ftp/anon directory was not changing correctly from public_content_t to public_content_rw_t.

    # ls -Zd /var/ftp
    drwxrwxrwx. root root system_u:object_r:public_content_t:s0 /var/ftp

    However when I checked the file_contexts file all looked correct.

    # cat /etc/selinux/targeted/contexts/files/file_contexts.local/var/ftp/anon(/.*)    system_u:object_r:public_content_rw_t:s0

    So I ran the chon command seen below and did not run the restorecon command. This worked as afterwards the context on the directory /var/ftp/anon was correct.

    # chcon -R -t public_content_rw_t /var/ftp/anon

     

  • RHEL6 – How to Setup a Caching-Only DNS Server


     26868_1First off lets get this straight, all DNS Servers cache. However, some DNS Servers intended to only provide the caching function. Which is what we are going to configure today.

    A Caching-only DNS server does not contain zone information or a zone database. Its cache only contains information based on the results of queries that it has already performed. In this case, the cache takes the place of the zone database file for the lookups that you are already doing.

    Here’s how its done

    First step you need to install bind via yum.

    # yum install bind && chkconfig bind

    Now configure named to start at boot and start it up

    # chkconfig named on && service named start

    Then modify /etc/named.conf and change these two lines

    listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 { ::1; };

    to this

    listen-on port 53 { any; };
    listen-on-v6 port 53 { any; };

    then change this the dnssec-validation line to no as seen below.

    dnssec-validation no;

    Then configure named to accept lookups from its local network by changing the line below

    allow-query     { localhost; };

    To what you see below, note that 10.1.224.0 is my local network

    allow-query     { localhost; 10.1.224.0/24; };

    Now don’t forget to insert a forwarders entry to forward requests to your local dns server. Look in your resolv.conf for this info.

    forwarders { 10.100.4.16; };

    Then modify your /etc/resolv.conf so that your machine uses itself for name lookups, you do this by adding the line below as the first nameserver.

    nameserver localhost

    Now start named and do an nslookup, the server and address should point back to local host.

    # nslookup fatmin.com
    Server:         127.0.0.1
    Address:        127.0.0.1#53

    Non-authoritative answer:
    Name:   fatmin.com
    Address: 64.202.189.170

  • RHEL6 – Simple Iptables How To

    Firewall supportYour mother and I were talking last night about how important it is to properly configure Iptables, and how despite that fact, many just choose to disable it. So today we are going to discuss iptables.

    Overview:

    By far the easiest way to setup a simple firewall using Iptables is to use system-config-firewall, or system-config-firewall-tui. I prefer this method as iptables can be a bit confusing on the command line and in its config file (/etc/sysconfig/iptables) is not exactly user friendly. At the very least you can create a basic set of rules and then customize by hand. Lets take a look at the file in its default form on my RHEL 6 box.

    But before we do that, lets review a couple of terms that we need to know.

    1. INPUT – are inbound packets
    2. OUTPUT are outbound packets
    3. FORWARD – packets from another machine that the firewall should forward (like to a vm on the host).
    4. ACCEPT – the packet is accepted
    5. DROP – the packet is dropped as if it never existed
    6. REJECT – the packed is rejected and and error message is returned to sender
    7. RULE – the basic building block — tells the firewall what to do with a packet
    8. CHAIN – a list of all rules which will be checked in order from first to last
    9. POLICY – the default action, like accept, drip, reject, forward

    Now that you have memorized the list above, here is my /etc/sysconfig/iptables.

    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
    -A INPUT -j REJECT –reject-with icmp-host-prohibited
    -A FORWARD -j REJECT –reject-with icmp-host-prohibited.

    Now lets run system-config-firewall tui and enable apache and ftp, plus we want to configure our box to respond to ICMP ping requests. This process is pretty self explanitory once you start.

    Once that is done lets view /etc/sysconfig/iptables again.

    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -p icmp -m icmp –icmp-type echo-request -j REJECT –reject-with icmp-host-prohibited
    -A INPUT -p icmp -m icmp –icmp-type echo-reply -j REJECT –reject-with icmp-host-prohibited
    -A INPUT -p icmp -m icmp –icmp-type destination-unreachable -j REJECT –reject-with icmp-host-prohibited
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 21 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 443 -j ACCEPT
    -A INPUT -j REJECT –reject-with icmp-host-prohibited
    -A FORWARD -j REJECT –reject-with icmp-host-prohibited
    COMMIT

    Iptables Command:

    The iptables command can be used in several different ways.

    List the current rules in use, similar to viewing the /etc/sysconfig/iptables file

    #iptables -L

    To set a default policy use iptables -P, in the example below we are setting the default INPUT policy to DROP.

    #iptables -P INPUT DROP

    Now lets say we want to delete all our existing rules, note that i did not say policy

    #iptables -F

    To add a rule use iptables -a, for example lets say you have a default policy of INPUT DROP but we want to accept all established and related packets. Note that -m must be used when adding rules to a chain as it forces modprobe to load any necessary modules.

    #iptables -A INPUT -m state –state ESTABLISHED, RELATED

    Now lets say that we want to reject all packets from 192.168.10.10. Note -j specifies the action that the rule is to take — in the case below, REJECT

    #iptables -A INPUT -s 192.168.10.10 -j REJECT

    Now lets say we want to ACCEPT all ICMP traffic from our local subnet. The -p is protocol

    #iptables -A INPUT -p ICMP -s 192.168.1.0/24 -j ACCEPT

    Please note that under RHEL you can use following commands to save firewall rules.Make sure that you do this before you restart iptables.

    #service iptables save

  • RHEL6 — Troubleshooting SELinux Violations

    Sad_face1Dear Reader: Welcome to my third and not final installment on SELinux. The first two can be read here and here. They are exciting reads and are sure to have you on the edge of your seat.

    Anyway, the best way to implement SELinux sucessfully is to know how to troubleshoot when things aren’t going your way. If you panic at the first sign of trouble, you are just going to end up turning off SELinux and not reap the rich rewards that it will bring you in life. Now that I have convinced you to run SELinux lets get started.

    First install the package setroubleshoot, which will send SELinux messages to our messages file.

    yum -y install setroubleshoot-server.x86_64

    Now you can search the messages file for SELinux Violations. Use sealert -l UUID to find information on a specific incident, or sealert -a  /var/log/audit.log to search an entire log file for violations.

    In this specfic example, I created a test file and dropped it in /var/www/html, however I did not set the context to httpd_sys_content_t, then i attempted to view the file in a browser. Obviously access was denied. The output of sealert shows me the error and then tells me how to fix it.

    Summary:

    SELinux is preventing /usr/sbin/httpd “getattr” access to /var/www/html/file3.

    Detailed Description:

    SELinux denied access requested by httpd. /var/www/html/file3 may be a
    mislabeled. /var/www/html/file3 default SELinux type is httpd_sys_content_t, but
    its current type is admin_home_t. Changing this file back to the default type,
    may fix your problem.

    …TRUNCATED…

    Allowing Access:

    You can restore the default system context to this file by executing the
    restorecon command. restorecon ‘/var/www/html/file3’, if this file is a
    directory, you can recursively restore using restorecon -R
    ‘/var/www/html/file3’.

    Fix Command:

    /sbin/restorecon ‘/var/www/html/file3’

    Boom goes the dynomite! Problem solved.

  • RHEL6 – SELinux Modes and Contexts

    Anime,art,cartoon,chibi,darth,vader,darthvader-26d94e794e11142d417a277b8fbdc0eb_hSELinux, or Security-Enhanced Linux as its known by the guy who invented it, is a Linux feature that provides an additional level of security by setting rules for which processes can access which files, directories, ports, etc.

    Display and Modify SELinux Modes:

    You can use /etc/sysconfig/selinux to change the default SELinux mode at boot, and the setenforce command can be used to change the default level on the fly. Getenforce can be used to determine the current SELinux mode. 

    # getenforce
    Enforcing

    Display SELinux Contexts:

    Under SELinux, every file, process, directory, or port is assigned a special security label called a context.

    To view the contexts assigned to a file or directory use the '-Z' option. Coupled with and 'ls" or a 'ps" this is a formidable command.

    To view a list of all possible assigned contexts use semanage.

    # semanage fcontext -l

    Modify SELinux Contexts:

    For example, lets create two test files in /tmp called testfile1 and testfile2, and then lets check their contexts.

    # ls -lZ test*
    -rw-r–r–. root root unconfined_u:object_r:user_tmp_t:s0 testfile1
    -rw-r–r–. root root unconfined_u:object_r:user_tmp_t:s0 testfile2

    Now compare this to the default context assigned to apache content

    # ls -ldZ /var/www/html
    drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html

    So lets say that I want to move testfile1 to /var/www/html and make it accessable via a webbrowser; in order to do this I must assign the correct context to the file using the restorecon command.

    # restorecon -Rv /var/www/html

    The command above restores or even better, allows the testfiles to inherit the contexts assigned to the parent directory, which in this case is /var/www/html/

    Add SELinux Contexts:

    Now lets say that you need to add a directory and apply a context directly to that directory, instead of allowing a context to be inheritted. For example, lets say that I need to setup an apache virtual server under /virtual_server2, so lets first create the directory and a simple index.html

    # mkdir /virtual_server2
    # vi /virtual_server2/index.html
    # ls -Zd /virtual_server2
    drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /virtual_server2

    # ls -Zd /virtual_server2/index.html
    -rw-r–r–. root root unconfined_u:object_r:default_t:s0 /virtual_server2/index.html

    Now we need to set and apply the correct http content context to /virtual_server2 and its contents (say that 5 times fast)

    # semanage fcontext -a -f "" -t httpd_sys_content_t '/virtual_server2(/.*)?'

    # restorecon -RFvvv /virtual_server2/

    restorecon reset /virtual_server2 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
    restorecon reset /virtual_server2/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0

    Now that our context is correct apache should have no issue serving up our new content (once configured on the apache side)

    # ls -Zd /virtual_server2/
    drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /virtual_server2/