Tag Archives: exported

Audit Files And Directories

title: “Audit Files And Directories”
date: 2016-03-24T15:06:19
slug: audit-files-and-directories

Audit files

auditctl -w /etc/passwd -p rwxa

With :

-w path ; this parameter will insert a watch for the file system object at path. On the example above, auditd will wacth /etc/passwd file
-p ; this parameter describes the permission access type that a file system watch will trigger on
rwxa ; are the attributes which bind to -p parameter above. r is read, w is write, x is execute and a is attribute
If ‘-p xxx’ is not specivied, all kinds of access are logged

Audit directories

To audit directories, we will use a similar command. Let’s take a look at the command below :

auditctl -w /production/

The above command will watch any access to the /production folder.

Update CoreOS

title: “Update CoreOS”
date: 2016-03-24T13:45:37
slug: update-coreos

vi /etc/coreos/update.conf

and add after the line “GROUP=”

SERVER=https://customer.update.core-os.net/v1/update/

systemctl restart update-engine

Force Update in Background

$ update\_engine\_client -check\_for\_update
[0123/220706:INFO:update\_engine\_client.cc(245)] Initiating update check and install.

Force Update in Foreground

If you want to see what’s going on behind the scenes, you can watch the ouput in the foreground:

$ update\_engine\_client -update
[0123/222449:INFO:update\_engine\_client.cc(245)] Initiating update check and install.
[0123/222449:INFO:update\_engine\_client.cc(250)] Waiting for update to complete.
LAST\_CHECKED\_TIME=0
PROGRESS=0.000000
CURRENT\_OP=UPDATE\_STATUS\_IDLE
NEW\_VERSION=0.0.0.0
NEW\_SIZE=0
[0123/222454:ERROR:update\_engine\_client.cc(189)] Update failed.

Be aware that the “failed update” means that there isn’t a newer version to install.

docker commands

title: “docker commands”
date: 2016-03-24T12:52:14
slug: docker-commands

Show running docker instances with ID

docker ps

Show running docker instances with ID (History)

docker ps -a

Show the last running container

docker ps -l

Start an Docker Instance (from ‘docker ps -a’)

docker run 4dcecf77c564

Committing a docker instance:

 docker commit a589d9df44ec coreos/apache

while a589d9df44ec is the ID listed with “docker ps” Stop docker instance

docker stop 4ecbf72df071

Alle Container löschen

docker rm `docker ps -qa`

Einen Befehl in einem Container ausführen

docker exec -it db bash

List Images

docker images

stdout eines Containers anzeigen

docker logs 9f5aafa2536b

Ports eines Containers anzeigen

docker port 1a109a55a86d

Prozesse in einem Container anzeigen

docker top

Statusinformationen eines Containers anzeigen

docker inspect 1a109a55a86d

Remove a Container from the bridge

docker network disconnect bridge <containername>

Create an own bridged network

docker network create -d bridge my-bridge-network

List Networks

docker network ls

Details/Inspect a network

docker network inspect my-bridge-network

Attach network to a container

docker network connect my-bridge-network web

Attach Data Volume to a container

docker run --name ubuntu -v /webmount -it ubuntu /bin/bash

Attach Host Directory to a container

docker run --name ubuntu -v /home/webapp:/webmount -it ubuntu /bin/bash

Start an ubuntu docker instance , install and configure Apache

title: “Start an ubuntu docker instance , install and configure Apache”
date: 2016-03-24T12:50:08
slug: start-an-ubuntu-docker-instance-install-and-configure-apache

Start an Ubuntu instance (simple shell)

docker run -t -i ubuntu /bin/bash

The -t and -i flags allocate a pseudo-tty and keep stdin open even if not attached.

Update Repository anstall Apache

apt-get update && apt-get install apache2

Network Configuration CoreOS

title: “Network Configuration CoreOS”
date: 2016-03-24T12:21:58
slug: network-configuration-coreos

Network configuration is stored in:

/etc/systemd/network

Create a bridge:

vi 5.netdev

[NetDev]
Name=docker0
Kind=bridge

Configure ens3 as bridge interface

vi 10-ens3.network

[Match]
Name=ens3

[Network]
Bridge=docker0

Configure Bridge Interface

vi 15-br.network

[Match]
Name=docker0

[Network]
Address=10.86.0.27/23
Gateway=10.86.0.250
[Route]
Gateway=10.86.0.1
Destination=10.0.0.0/8
[Route]
Gateway=10.86.0.1
Destination=172.16.0.0/12
[Route]
Gateway=10.86.0.1
Destination=192.168.0.0/16

Configure static Nameserver

vi resolved.conf

[Resolve]
DNS=8.8.8.8
#FallbackDNS=
#LLMNR=yes

Elastic Search

title: “Elastic Search”
date: 2016-03-13T14:44:42
slug: elastic-search

Step 5: For installing Sense into Kibana:

kibana plugin --install elastic/sense

Traffic Monitoring mittels MRTG

title: “Traffic Monitoring mittels MRTG”
date: 2016-03-01T16:59:16
slug: traffic-monitoring-mittels-mrtg

install net-snmp package on your linux box

snmpwalk -c public -v 2c 10.13.17.11 1.3.6.1.2.1.2.2.1.2

us-lssi-usmgt1:/usr/src/mrtg-2.17.4 # snmpwalk -c public -v 2c 10.13.17.11 1.3.6.1.2.1.2.2.1.2
IF-MIB::ifDescr.1 = STRING: Serial-Mgmt
IF-MIB::ifDescr.2 = STRING: Ethernet-Mgmt
IF-MIB::ifDescr.3 = STRING: 1/1
IF-MIB::ifDescr.4 = STRING: 1/2
IF-MIB::ifDescr.5 = STRING: 3/1
IF-MIB::ifDescr.6 = STRING: 3/2
IF-MIB::ifDescr.7 = STRING: 3/3
IF-MIB::ifDescr.8 = STRING: 3/4
IF-MIB::ifDescr.9 = STRING: 3/5
IF-MIB::ifDescr.10 = STRING: 3/6
IF-MIB::ifDescr.11 = STRING: 3/7
IF-MIB::ifDescr.12 = STRING: 3/8
IF-MIB::ifDescr.13 = STRING: 3/9
IF-MIB::ifDescr.14 = STRING: 3/10
IF-MIB::ifDescr.15 = STRING: 3/11
IF-MIB::ifDescr.16 = STRING: 3/12
IF-MIB::ifDescr.17 = STRING: 3/13
IF-MIB::ifDescr.18 = STRING: 3/14
IF-MIB::ifDescr.19 = STRING: 3/15
IF-MIB::ifDescr.20 = STRING: 3/16

Get Interface ID from List in our case 5 as Port 3/1 is connected

Get all Interface statistik
snmpwalk -c public -v 2c 10.13.17.11 .1.3.6.1.2.1.2.2
Get (IN) Bytes from IF 5
snmpwalk -c public 10.13.17.11 -v 2c .1.3.6.1.2.1.2.2.1.10.5
IF-MIB::ifInOctets.5 = Counter32: 3930996263

Get (Out) Bytes from IF 5
snmpwalk -c public 10.13.17.11 -v 2c .1.3.6.1.2.1.2.2.1.16.5
IF-MIB::ifOutOctets.5 = Counter32: 1490879552

/root/mrtg.cfg
HtmlDir: /srv/www/htdocs/mrtg
ImageDir: /srv/www/htdocs/mrtg
LogDir: /tmp
ThreshDir: /tmp

Interval: 5
Options[r1]: gauge
Target[r1]: 1.3.6.1.2.1.2.2.1.10.5&1.3.6.1.2.1.2.2.1.16.5:public@10.13.17.11
MaxBytes[r1]: 1250000
Title[r1]: Traffic Analysis
PageTop[r1]:

Stats for Internet connection

Graphen erzeugen:
env LANG=C /usr/local/mrtg-2/bin/mrtg /root/mrtg.cfg

Minimal mrtg.cfg

——————–

HtmlDir: /var/www/mrtg
ImageDir: /var/www/mrtg
LogDir: /var/lib/mrtg
ThreshDir: /var/lib/mrtg
Target[server-eth0]: 2ublic@localhost
MaxBytes[server-eth0]: 1250000
Title[server-eth0]: eth0 ether traffic
PageTop[server-eth0]: eth0 ether traffic
Options[server-eth0]: growright
Legend1[server-eth0]: Ether Traffic in
Legend2[server-eth0]: Ether Traffic out
LegendI[server-eth0]: Traffic in
LegendO[server-eth0]: Traffic out

mod_jk

title: “mod_jk”
date: 2016-02-24T19:20:43
slug: mod_jk

nstalling mod_jk on apache httpd in CentOS 6.x/7.x

5 months ago • 0

CentOS again. Today I’m going to show you how to install and configure mod_jk in apache httpd using a server with CentOS. Currently this tutorial was tested on Centos 6.x and 7.x so you should run out of troubles if you stick with one of those versions.

Introduction

So, what’s mod_jk? mod_jk is an apache httpd module used to make apache tomcat applications interact with a httpd server. In simple words, mod_jk allows us to connect an instance of tomcat with the apache httpd web server. This is useful for example if you have your httpd serving different kind of webapps (php, RoR, etc) and you want to publish a java app running on a tomcat instance. In this case, httpd run in port 80 and tomcat (usually) in port 8080, so we need to connect somehow the tomcat instance with httpd so our users can interact with our java app directly from port 80. In this case, the httpd server is giving us access to for example an internal network where your tomcat instances live. See the next diagram for a visual explanation:

Why not use mod_proxy?

This is indeed a good question. From a stackoverflow question/answer:

mod_proxy:

Pros:
No need for a separate module compilation and maintenance. mod_proxy, mod_proxy_http, mod_proxy_ajp and mod_proxy_balancer comes as part of standar Apache 2.2+ distribution.
Ability to use http/https or AJP protocols, even with the same balancer.
Cons:
mod_proxy_ajp does not support larke 8k+ packet sizes.
Basic load balancer.
Does not support Domain model clustering.

mod_jk:

Pros:
Advanced load balancer.
Advanced node failure detection.
Support for large AJP packet sizes.
Cons:
Need to build and mantain a separate module.

So, the discussion is there, no final answer. A good article covering this topic is: “Deciding between mod_jk, mod_proxy_http and mod_proxy_ajp” from Tomcat Experts.

Installation

The installation process for mod_jk is really simple but we’re going to need to compile the module first. Before doing any compile work, ensure you have both httpd and tomcat installed. Now:

yum install httpd-devel apr apr-devel apr-util apr-util-devel gcc gcc-c++ make autoconf libtool

| | |
| — | — |
|

1
|

yum install httpd-devel apr apr-devel apr-util apr-util-devel gcc gcc-c++ make autoconf libtool
|

Now, go to the official mod_jk website and download the latest version: http://tomcat.apache.org/download-connectors.cgi (1.2.41 at the published date of the post):

mkdir -p /opt/mod_jk/
cd /opt/mod_jk
wget http://www.eu.apache.org/dist/tomcat/tomcat-connectors/jk/tomcat-connectors-1.2.41-src.tar.gz
tar -xvzf tomcat-connectors-1.2.41-src.tar.gz
cd tomcat-connectors-1.2.41-src/native

| | |
| — | — |
|

1
2
3
4
5
|

In the native folder (check the last step in the code above) we’re going to configure-make-make install the connector:

./configure –with-apxs=/usr/sbin/apxs
make
libtool –finish /usr/lib64/httpd/modules
make install

| | |
| — | — |
|

1
2
3
4
|

./configure –with-apxs=/usr/sbin/apxs
make
libtool –finish /usr/lib64/httpd/modules
make install
|

If all goes well you’re going to have the mod_jk.so installed on your /etc/httpd/modules folder.

Configuration

First, lets enable the AJP connection on your tomcat server, in your server.xml configuration file:

vim $TOMCAT_HOME/conf/server.xml

| | |
| — | — |
|

1
|

vim $TOMCAT_HOME/conf/server.xml
|

Add under the tag:

<!– Define an AJP 1.3 Connector on port 8009 –>

| | |
| — | — |
|

1
2
|

<!– Define an AJP 1.3 Connector on port 8009 –>

|

And modify the Engine tag so its looks like:

| | |
| — | — |
|

1
|

Observation 1: for each tomcat instance linked to your httpd server, you need to define a different jvmRoute parameter. For example, for a second instance you could use:

| | |
| — | — |
|

1
|

Now, lets go with the httpd configuration. First, create a mod_jk.conf file in your conf.d folder:

vim /etc/httpd/conf.d/mod_jk.conf

| | |
| — | — |
|

1
|

vim /etc/httpd/conf.d/mod_jk.conf
|

And populate the file with the following:

LoadModule jk_module “/etc/httpd/modules/mod_jk.so”

JkWorkersFile /etc/httpd/conf/workers.properties

Where to put jk shared memory

JkShmFile /var/run/httpd/mod_jk.shm

Where to put jk logs

JkLogFile /var/log/httpd/mod_jk.log

Set the jk log level [debug/error/info]

JkLogLevel info

Select the timestamp log format

JkLogStampFormat “[%a %b %d %H:%M:%S %Y] “

JkRequestLogFormat “%w %V %T”

JkEnvVar SSL_CLIENT_V_START worker1

| | |
| — | — |
|

1
2
3
4
5
6
7
8
9
10
11
12
13
|

LoadModule jk_module “/etc/httpd/modules/mod_jk.so”

JkWorkersFile /etc/httpd/conf/workers.properties
# Where to put jk shared memory
JkShmFile     /var/run/httpd/mod_jk.shm
# Where to put jk logs
JkLogFile     /var/log/httpd/mod_jk.log
# Set the jk log level [debug/error/info]
JkLogLevel    info
# Select the timestamp log format
JkLogStampFormat “[%a %b %d %H:%M:%S %Y] “
#JkRequestLogFormat “%w %V %T”
#JkEnvVar SSL_CLIENT_V_START worker1
|

Before continuing, create the folder to store the shared memory of the module:

mkdir -p /var/run/mod_jk
chown apache:apache /var/run/mod_jk

| | |
| — | — |
|

1
2
|

mkdir -p /var/run/mod_jk
chown apache:apache /var/run/mod_jk
|

Now, create the workers.properties file: (look at the JkWorkersFile property on mod_jk.conf file):

vim /etc/httpd/conf/worker.properties

| | |
| — | — |
|

1
|

vim /etc/httpd/conf/worker.properties
|

With the next content:

workers.apache_log=/var/log/httpd
worker.list=app1Worker
worker.stat1.type=status

worker.app1Worker.type=ajp13
worker.app1Worker.host=app1.myhost.com #put your app host here
worker.app1Worker.port=8009

| | |
| — | — |
|

1
2
3
4
5
6
7
|

workers.apache_log=/var/log/httpd
worker.list=app1Worker
worker.stat1.type=status

worker.app1Worker.type=ajp13
worker.app1Worker.host=app1.myhost.com #put your app host here
worker.app1Worker.port=8009
|

For every app server from tomcat to httpd you’re going to have a specific worker. Don’t forget to define the worker first in the worker.list property. For example, lets assume we’re going to add another app from tomcat:

workers.apache_log=/var/log/httpd
worker.list=app1Worker,app2Worker
worker.stat1.type=status

worker.app1Worker.type=ajp13
worker.app1Worker.host=app1.myhost.com #put your app host here
worker.app1Worker.port=8009

worker.app2Worker.type=ajp13
worker.app2Worker.host=app2.myhost.com #put your app host here
worker.app2Worker.port=8009

| | |
| — | — |
|

1
2
3
4
5
6
7
8
9
10
11
|

workers.apache_log=/var/log/httpd
worker.list=app1Worker,app2Worker
worker.stat1.type=status

worker.app1Worker.type=ajp13
worker.app1Worker.host=app1.myhost.com #put your app host here
worker.app1Worker.port=8009

worker.app2Worker.type=ajp13
worker.app2Worker.host=app2.myhost.com #put your app host here
worker.app2Worker.port=8009
|

Well, everything looks good now. The final step is to configure the VirtualHost for every app on httpd:

vim /etc/httpd/conf.d/app1.conf

| | |
| — | — |
|

1
|

vim /etc/httpd/conf.d/app1.conf
|

It’s a good practice to maintain your VirtualHosts in separated files. Now, in your recently created app1.conf file:

ServerName app1.myhost.com
ServerAdmin admin@myhost.com
LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-agent}i\”” combined
CustomLog /var/log/httpd/app1_access.log combined
ErrorLog /var/log/httpd/app1_error.log

JkMount /* app1Worker

| | |
| — | — |
|

1
2
3
4
5
6
7
8
9
10
|

We are connecting httpd with tomcat using the JkMount directive in the VirtualHost configuration. If for example you’are adding a VirtualHost for your second app use the app2Worker configured previously and so on for other apps.

Final steps and conclusion

If you followed all the previous steps, you should be able to interact with your tomcat app directly from http://app1.myhost.com which is handled by httpd. Beautiful!

In this tutorial, we learned how to use mod_jk to connect different tomcat instances with the httpd web server. The procedure is straighforward but involves some compile tasks and a few configurations on each server. If you have any dobts don’t hesitate to initiate a converstion in the comments sections.

yum groupinstall “Development Tools”

title: “yum groupinstall “Development Tools””
date: 2016-02-24T19:00:49
slug: yum-groupinstall-development-tools

yum groupinstall "Development Tools"

open a port in firewall

title: “open a port in firewall”
date: 2016-02-12T15:23:47
slug: open-a-port-in-firewall

firewall-cmd --zone=public --add-port=5666/tcp --permanent
firewall-cmd --reload

Permanent (-P)

/usr/sbin/setsebool -P httpd\_can\_network\_connect 1