KoRoVaMiLK# linux microblog // blog.agate.pw

slightly less than a blog.. somewhere around a technical sketchpad

[korovamilky]

Yet another surprise from Cloudatcost

Cloudatcost (www.cloudatcost.com - @cloudatcost), the canadian cheap & flat cloud VPS provider (partner of @Fibernetics) seems to have really serious problems on the devops side. I already talked here about their infamous backdoor user (“wikus”) on their Debian 8 x64 VPS  images (this seems to be solved by now). Today I found out that they also seem to have a faulty Reverse DNS update call that they either don’t want or are unable to fix. 

TL;DR: You want your IP to have a proper Reverse DNS entry pointing to your Flly Qualified Domain Name. You make this change in your Panel. The function is buggy, RDNS won't work. You open a ticket. The ticket is already 6 days old, but is still not assigned. Step to reproduce: 

1. Login to your panel page (https://panel.cloudatcost.com)

2. Click on “Modify”, then on “Reverse DNS”.

3. Use the popup frame to set the DNS PTR entry for the IP that Clouadatcost assigned to your VPS to point to your FQDN (say “devopsfail.wontfix.org”). 

4. Wait the given 10 minutes for the update to take place (you may also wait a day, ten days or so... it probably won’t change EVER). 

5. Open your terminal and perform a reverse lookup for your given IP Address and check if it gives you back the requested FQDN entered on step #3. One of my servers points to a cloudpro internal ID cloudatcost.com hostname. Another VPS I have points to someone else’s mailserver FQDN (!).

Further investigations (DOM inspection of the function call) led me to suspect they may have made a mess with VPS root passwords and then the function fails because of mismatching passwords. 

I will update this post when (and if) they will care to fix the issue (or consider my tickets). 

#20160218 UPDATE: They finally managed to work on my ticket: “this should be fixed today, there is an issue with the panel setting. thanks for your patience.”. Then, after a couple of hours, ticket was closed by Cloudatcost Co-Founder Gerald Camacho (what an honor!): 

Now the IP are correctly resolved to the names I entered in the panel, BUT... as I was trying to set properly one of them (I made some tests, so in one case it was not the actual FQDN I’d intend to use in production), it turned out that the “fix” didn’t fix: no frther changes really take place anymore (already waited for the whole weekend). They probably set the DNS PTR by hand.

Going to open another ticket now...

[korovamilky]

Backdoor default user on Debian 8 VPS at Cloudatcost

Cloudatcost (www.cloudatcost.com - @cloudatcost), the canadian cheap & flat cloud VPS provider (partner of @Fibernetics) ships a backdoor user ("wikus") with shell and password set on their Debian 8 x86_64 images.

Backdoor default user at cloudatcost.com Debian8 images

I found this “easter egg” on 21th January 2016 by a routine check on system integrity after I created a new Debian instance using my cloudatcost account.

Please note that ALL Debian 8 instances created on Cloudatcost with such image are, by default, also listening on ssh standard port for such user.

I tried to contact them a week ago but it seems they do not care. 

wow just noticed that @cloudatcost new #Debian 8 images come with a preinstalled backdoor user #wikus https://t.co/zAaDV5fyNd

— Marco (@korovamilky)

January 21, 2016

@cloudatcost have you nothing to declare regarding the #backdoor user "wikus" found on the Debian 8 installations?

— Marco (@korovamilky)

January 21, 2016

*** 05/02/2016 *** UPDATE *** I've got sort of a response on this topic in a ticket regarding failed Debian 8 builds.

View screenshot on imgur.com

Am I Satisfied? Not really.

[korovamilky]

Check if your system is vulnerable to Bash Code Injection (CVE-2014-6271)

As per CVE-2014-6271, a flaw in bash that permits malicious shell code injection was found. Here is a code snippet to check if your linux server is vulnerable:

env x='() { :;}; echo *VULNERABLE*' bash -c "echo this is a test"

Example output if system is vulnerable:

*VULNERABLE* this is a test

Output with patched bash will instead look as follows:

this is a test

source: https://access.redhat.com/articles/1200223

[korovamilky]

Install logtop on CentOS 7

Logtop is an handy log analyzer that can show realtime statistics from any given text file. Common usage example is redirecting the output of your log files to it, in order to get the top visitors of your webpages, or the top hosts requesting pages through your proxy server... all of this in a realtime top list.

Logtop requires git (to clone logtop source from github) plus the ncurses and uthash development packages. Since the package uthash-devel is not available in the base CentOS repository, you will also need to get EPEL repository rpm from:

http://download.fedoraproject.org/pub/epel/beta/7/x86_64/repoview/epel-release.html

and install it:

rpm -ivh epel-release-7-0.2.noarch

then import its rpm gpg key:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

Now you may install the dependencies:

yum install git ncurses-devel uthash-devel

Get logtop from github:

git clone https://github.com/JulienPalard/logtop.git

Dive into its directory and compile it:

cd logtop

make

make install

That's it!

Example usage: Apache top 10 requests:

tail -f /var/log/httpd/access_log | awk {'print $1; fflush();'} | logtop

Squid top users):

tail -f /var/log/squid/access.log | awk {'print $1; fflush();'} | logtop

Still on your proxy server, you may want to show the top requested urls:

tail -f /var/log/squid/access.log | awk {'print $7; fflush();'} | logtop

Logtop project page:

https://github.com/JulienPalard/logtop

[korovamilky]

Shell script for an up-to-date Ad-Free /etc/hosts

This is just another way to do it: an adware/spyware free /etc/hosts for your laptop or home network.

Enjoy!

#!/bin/bash # Update Ad-Free /etc/hosts file from public lists readonly TMP_FILE="/tmp/hosts" readonly HOSTS_FILE="/etc/hosts" # WINDOWS HOSTS FILE: %systemroot%\system32\drivers\etc\hosts touch ${TMP_FILE} for URL in http://adaway.org/hosts.txt \ http://winhelp2002.mvps.org/hosts.txt \ http://someonewhocares.org/hosts/hosts \ http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts\&showintro=0\&mimetype=plaintext do curl -s ${URL} | egrep "^127.0.0.1|^0.0.0.0" >> ${TMP_FILE} done # remember to add here your custom known hosts: echo "127.0.0.1 localhost 127.0.0.1 localhost.localdomain fe80::1%lo0 localhost 255.255.255.255 broadcasthost " > ${HOSTS_FILE} # use 0.0.0.0 instead of 127.0.0.1 (faster but not 100% compatible) awk '!/ localhost/'{'print "0.0.0.0 "$2'} ${TMP_FILE} | sort | uniq >> ${HOSTS_FILE} rm -f ${TMP_FILE} exit 0

[korovamilky]

Scan your network for vulnerable https (OpenSSL TLS Heartbeat Extension Bug - CVE-2014-0160)

We are going to locally build on a linux machine the Heartbleed checker wrote by https://github.com/FiloSottile (thank you!) in order to check for OpenSSL Heartbleed Bug CVE-2014-0160.

Fire up your shell terminal and install golang package via aptitude or yum.

yum install golang

Now create the go environment and get the Heartbleed checker:

export GOPATH=~/go export GOBIN=$GOPATH mkdir $GOPATH cd $GOPATH go get github.com/FiloSottile/Heartbleed

You should have something like the following structure:

# ls -l total 6268 -rwxr-xr-x 1 root root 6409872 Apr 8 15:52 Heartbleed drwxr-xr-x 3 root root 4096 Apr 8 15:52 pkg drwxr-xr-x 3 root root 4096 Apr 8 15:52 src

Check if Heartbleed executable works:

./Heartbleed tumblr.com:443 2014/04/08 15:55:44 tumblr.com:443 - SAFE

Looks good :-)

Now scan your network (eg. 10.11.12.0/24) for open HTTPS:

nmap -PN -p 443 --open -oG - 10.11.12.0/24 | awk '$NF~/https/{print $2}'

You should ha ve a list of IP like the following:

10.11.12.1 10.11.12.3 10.11.12.4 10.11.12.5 10.11.12.6 10.11.12.13 10.11.12.14 ...

Copy & paste this list in a file (eg. list_443.txt), in the same path of the Heartbleed executable (in my example: ~/go/list_443.txt).

Now you may launch the Heartbleed checker in a while loop as follows:

# while read LIST ; do ./Heartbleed ${LIST}:443 ; done < list_443.txt

Example output:

2014/04/08 16:01:31 10.11.12.1:443 - SAFE 2014/04/08 16:01:34 10.11.12.3:443 - SAFE 2014/04/08 16:04:52 ([]uint8) { 00000000 02 00 79 68 65 61 72 74 62 6c 65 65 64 2e 66 69 |..yheartbleed.fi| 00000010 6c 69 70 70 6f 2e 69 6f 59 45 4c 4c 4f 57 20 53 |lippo.ioYELLOW S| 00000020 55 42 4d 41 52 49 4e 45 76 d7 6e 8a 38 30 59 03 |UBMARINEv.n.80Y.| 00000030 2c 73 be a2 1e 73 d5 af 19 37 8d 77 03 03 03 03 |,s…s…7.w….| 00000040 72 60 d9 30 ca 7a d1 18 7f bd 5f f4 18 0f 6c d6 |r`.0.z…._…l.| 00000050 c5 6d 06 4e 1e cf 7d 3d d0 1b d8 70 16 7f 51 b2 |.m.N..}=…p..Q.| 00000060 91 dd db 85 2c d3 7c 50 40 46 04 ee d2 dd 13 14 |….,.|P@F……| 00000070 73 3f e2 bc cf ce 77 40 1f 28 da dc 82 f6 57 62 |s?….w@.(….Wb| 00000080 2b ac e8 01 59 9a 18 2a 7d e3 be d4 |+…Y..*}…| } 2014/04/08 16:04:52 10.11.12.4:8443 - VULNERABLE

Heads up and go patch your openssl!

source: https://github.com/FiloSottile/Heartbleed

UPDATE: you may want to thoroughly test your key services against https://www.ssllabs.com/ssltest

[korovamilky]

Serving Disk Usage Graphs with Bash and PHP

Lately I was asked to develop and integrate a realtime server disk usage graph to the dashboard of our monitoring application (OpenNMS). The bar graph color should also change when disk usage exceeds a defined  percentage threshold.

So I came up with some shell and php code that serve well the scope:

Now, let's go behind the scenes:

Since we have a quite mixed environment, I decided to stick to SNMP as mean for getting the data I need to obtain a list of $servername,$disk_usage_percentage (actually, we will need to get disk size and disk used space to calculate the %). A bash shell script (namely "get_usage.sh") runs at cron every 30 minutes and gets the above info for us, and also takes care of the needed calculation to output the percentage.

excerpt from get_usage.sh:

# declaring the server 2D array declare -A server_id # declaring SNMP community rocommunity="YOUR_SNMP_RO_COMMUNITY" # Example list of monitored servers # Note that these are 2 dimensional arrays (servername - IP Address) server_id[server01]=192.168.0.42 server_id[server02]=172.16.0.28 server_id[server03]=10.0.0.3 # function to get disk usage percentage # hrStorageUsed.1 and hrStorageSize.1 are OID that refers to the first storage disk # change this parameter to fit your needs # I ended up with 5 different getUsage_id functions, to cover my storage topology! :) getUsage_id() { diskUsage=$(snmpwalk -v 2c -c $rocommunity ${server_id[$HOST]} hrStorageUsed.1 | awk {'print $4'}) diskSize=$(snmpwalk -v 2c -c $rocommunity ${server_id[$HOST]} hrStorageSize.1 | awk {'print $4'}) ((usage = (diskUsage * 409600) / (diskSize * 4096))) return $usage } # initialize the output file > diskUsg.dat for HOST in "${!server_id[@]}" # enumerates all server hostnames do getUsage_id server_id[${HOST}]=${usage} # assign the usage to the servername echo "$HOST,${server_id[$HOST]}" >> diskUsg.dat # writing to output file, comma separated done exit 0

The resulting list will be a file that would look something like:

server01,82 server02,42 server03,98 ...

Time for some php!

The frame integrated in our dashboard view is a php page that reads the above $server,$disk_usage_percentage list and then uses phplot (http://phplot.sourceforge.net) to draw an horizontal bars graph out of it.

excerpt from diskUsage.php:

require_once 'phplot.php'; // get it from http://phplot.sourceforge.net // We want to autorefresh this page $page = $_SERVER['PHP_SELF']; $sec = "840"; // 14 minutes is enough for us (we get new data each 30 minutes) header("Refresh: $sec; url=$page"); // Define the input "server,disk_usage_percentage" file $myFile = "diskUsg.dat"; // Here we define the color thresholds: // 0 (red) for values >= 90% // 1 (yellow) is for >= 85% // 2 (green) is for < 85%. function pickcolor($img, $data_array, $row, $col) { $d = $data_array[$row][$col+1]; // col+1 skips the servername label if ($d >= 90) return 0; if ($d >= 85) return 1; return 2; } // Read the data from file and assign to an array if (file_exists($myFile)) { $fileContent = file($myFile); foreach($fileContent as $line_num => $line) { { $disk_data = explode(",", $line); $data[] = array(trim($disk_data[0]), trim($disk_data[1])); } } } // Here goes the phplot-related stuff $plot = new PHPlot_truecolor(600, 950); $plot->SetImageBorderType('plain'); $plot->SetPlotBorderType('full'); $plot->SetDrawPlotAreaBackground(False); $plot->SetPlotAreaWorld(0); $plot->SetYTickPos('none'); $plot->SetXTickPos('none'); $plot->SetXTickLabelPos('none'); // No X axis labels. The data values labels are sufficient. $plot->SetXDataLabelPos('plotin'); // we want to display the disk usage value $plot->SetDrawXGrid(TRUE); $plot->SetShading(5); $plot->SetDataValues($data); // we tell to use $data as actual data $plot->SetDataType('text-data-yx'); $plot->SetPlotType('bars'); // Remember the pickcolor function? $red='#F05A46'; // this is 0 $yellow='#FBBD00'; // this is 1 $green='#9EC262'; // and this is 2 // Here we assign the bar color $plot->SetCallback('data_color', 'pickcolor', $data); $plot->SetDataColors(array($red, $yellow, $green)); // We also want to display a legend $plot->SetLegend(array('Alarmstufe', 'Warnung', 'Normal')); // ja, that's Deutsch! :) // All set, let's draw the graph $plot->DrawGraph();

And this is how the whole dashboard will look like, as shown on our Big Monitoring LCD Wall™ :-)

[korovamilky]

Jail SSH users to SFTP only

.. or "confine untrusted users to their home directory (and give them no shell access as well)"

Let's create an unprivileged group for our purposes:

groupadd sftp-only

Then, create an unprivileged user ${USERNAME} and add it to that group:

adduser --ingroup sftp-only --shell /bin/false ${USERNAME}

If you need to "jail" an already existing user, just change its shell and group as follows:

usermod -s /bin/false -g sftp ${USERNAME}

Now edit /etc/ssh/sshd_config as follows (append at end of file):

Subsystem   sftp internal-sftp Match Group sftp-only     ChrootDirectory %h      ForceCommand internal-sftp     AllowTcpForwarding no

Now set owner and permissions to user's home directory, in order to avoid the creation of new files/directories:

chown root:root /home/${USERNAME} chmod 0755 /home/${USERNAME}

Done!

[korovamilky]

Change default runlevel in Fedora 19

..or "Where is inittab gone?"

As you may have noticed, Fedora is progressively switching to systemd (yes, that's also why you couldn't find init scripts like /etc/init.d/sshd or /etc/init.d/iptables), so now there is no more /etc/inittab to edit in order to select the desired runlevel of your system.

Here's the actual runlevel-to-systemd command table for you:

RUNLEVEL 5: Graphical, Multiuser (this is the default runlevel - desktop users)

ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target

  RUNLEVEL 3: NO GUI, Multiuser (this is the "server" choice)

ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target

Just as reference, here's the complete systemd runlevel list. For your mental sanity, please do not set runlevel other than the two I just described above :)

/lib/systemd/system/runlevel0.target -> poweroff.target /lib/systemd/system/runlevel1.target -> rescue.target /lib/systemd/system/runlevel2.target -> multi-user.target /lib/systemd/system/runlevel3.target -> multi-user.target /lib/systemd/system/runlevel4.target -> multi-user.target /lib/systemd/system/runlevel5.target -> graphical.target /lib/systemd/system/runlevel6.target -> reboot.target

[korovamilky]

Monitor a VMware vSphere server with Nagios3 on Debian Wheezy

I wrote down some notes about configuring Nagios to check the health status of a few VMware vSphere ESXi 5.1.0 servers. First of all, install the required packages on the Nagios server:

apt-get install libssl-dev perl-doc libxml-libxml-perl libxml2-dev uuid-dev

now get and install perl UUID package:

cd /usr/src wget http://search.cpan.org/CPAN/authors/id/J/JN/JNH/UUID-0.04.tar.gz tar -xzvf UUID-0.04.tar.gz -C /opt cd /opt/UUID-0.04 perl Makefile.PL

Then we need to download VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz (download the i386 version if your system is 32 bits) (note: you need to register in order to download it)

https://my.vmware.com/group/vmware/details?downloadGroup=VSP510-SDKPERL-510&productId=285

Download it on (or transfer it to) the Nagios server, then unpack and install:

tar zxvf VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.gz -C /opt/ cd /opt/vmware-vsphere-cli-distrib/

Even if you don’t sit behind a proxy, you must export these or it won’t work (damn!):

export http_proxy= export ftp_proxy= echo ubuntu > /etc/tmp-release ./vmware-install.pl

Just select /usr/bin/ and ignore warnings If everything is ok (hope so), we may continue by getting the plugin “check_vmware_api.pl" from:

http://git.op5.org/git/?p=nagios/op5plugins.git;a=tree

I had to edit it to avoid problems with unsigned certificates (damn!):

$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;

Now copy the edited plugin check_vmware_api.pl to /usr/lib/nagios/plugins/check_esx and we are ready to start testing:

/usr/lib/nagios/plugins/check_esx -H ${YOUR_VMWARE_ESXi_IP_ADDRESS} -u ${YOUR_VMWARE_USERNAME} -p ${YOUR_VMWARE_USER_PASSWORD} -l runtime -s status CHECK_ESX OK - overall status=green

Great, it works! Once you successfully tested the plugin, you may create some Nagios template recipes for your vmware monitored servers: For example I can define an hostgroup for vmware in /etc/nagios3/conf.d/vmware-host_nagios2.cfg:

define hostgroup{ hostgroup_name vmware-esxi ; The name of the hostgroup alias VMware ESXi Servers ; Long name of the group members vmw01,vmw02 ; Comma separated list of hosts that belong to this group }

Assuming that all my vmware servers share the same read-only monitoring dedicated user (eg. “monitoring") with same password, we may define vmware’s username and password as variables in /etc/nagios3/resource.cfg as follows:

$USER9$=monitoring $USER10$=My_(Not_AnyM0re)_$ecret_Passw0rd

Now we can define a vmware dedicated service group and related check-commands in /etc/nagios3/conf.d/vmware-service_nagios2.cfg:

# generic service template definition (slightly modified) define service{ name vmware-service ; The 'name' of this service template hostgroup_name vmware-esxi ; The 'name' of the hostgroup active_checks_enabled 1 ; Active service checks are enabled passive_checks_enabled 1 ; Passive service checks are enabled accepted parallelize_check 1 ; Active service checks should be parallelized (disabling this can lead to major performance problems) obsess_over_service 1 ; We should obsess over this service (if necessary) check_freshness 0 ; Default is to NOT check service 'freshness' notifications_enabled 1 ; Service notifications are enabled event_handler_enabled 1 ; Service event handler is enabled flap_detection_enabled 1 ; Flap detection is enabled failure_prediction_enabled 1 ; Failure prediction is enabled process_perf_data 1 ; Process performance data retain_status_information 1 ; Retain status information across program restarts retain_nonstatus_information 1 ; Retain non-status information across program restarts notification_interval 0 ; Only send notifications on status change by default. is_volatile 0 check_period 24x7 normal_check_interval 5 retry_check_interval 1 max_check_attempts 4 notification_period 24x7 notification_options w,c ; just notify for warning and critical states contact_groups admins register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL SERVICE, JUST A TEMPLATE! ### I also like the pnp4nagios plugin :) action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=$SERVICEDESC$' class='tips' rel='/pnp4nagios/index.php/popup?host=$HOSTNAME$&srv=$SERVICEDESC$ } #### VMware ESXi 5 check commands: # check vmware esxi machine # check cpu define command{ command_name check_esx_cpu command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l cpu -s usage -w $ARG1$ -c $ARG2$ # we pass the vmware credentials as USER9 and USER10 variables, as defined in /etc/nagios3/resource.cfg } # check memory usage define command{ command_name check_esx_mem command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l mem -s usage -w $ARG1$ -c $ARG2$ } # check net usage define command{ command_name check_esx_net command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l net -s usage -w $ARG1$ -c $ARG2$ } # check runtime status define command{ command_name check_esx_runtime command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l runtime -s status } # check io read define command{ command_name check_esx_ioread command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l io -s read -w $ARG1$ -c $ARG2$ } # check io write define command{ command_name check_esx_iowrite command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER9$ -p $USER10$ -l io -s write -w $ARG1$ -c $ARG2$ }

Then we may use the above commands on a actual vmware host definition (ie. /etc/nagios3/conf.d/vmw01.cfg):

# Host vmw01 define host{ use vmware-host hostgroups vmware-esxi host_name vmw01 alias VMWare ESXi VMW01 address 10.10.10.23 ; you may want to put here your actual IP :) } # Define a service to “ping" the local machine define service{ use vmware-service host_name vmw01 service_description PING check_command check_ping!100.0,20%!500.0,60% } # VMWare # check cpu define service{ use vmware-service host_name vmw01 service_description ESXi CPU Load check_command check_esx_cpu!80!90 } # check memory usage define service{ use vmware-service host_name vmw01 service_description ESXi Memory usage check_command check_esx_mem!80!90 } # check net define service{ use vmware-service host_name vmw01 service_description ESXi Network usage check_command check_esx_net!102400!204800 } # check runtime status define service{ use vmware-service host_name vmw01 service_description ESXi Runtime status check_command check_esx_runtime } # check io read define service{ use vmware-service host_name vmw01 service_description ESXi IO read check_command check_esx_ioread!75!90 } # check io write define service{ use vmware-service host_name vmw01 service_description ESXi IO write check_command check_esx_iowrite!75!90 }

Reload the nagios service and enjoy:

/etc/init.d/nagios3 reload

  Endlich, I would like to point you to these helpful resources I got inspiration (and unvaluable help) from:

http://www.feub.net/2010/12/monitoring-vmware-esxi-and-vsphere-with-nagios/

http://www.op5.org/community/plugin-inventory/op5-projects/check-esx-plugin

http://www.op5.com/how-to/how-to-install-vmware-vsphere-sdk-perl-5-1/

http://www.sysadminslife.com/linux/vmware-vsphere-sdk-for-perl-api-unter-debian-squeeze-installieren/

[korovamilky]

Visualize your Nagios/Icinga monitored IT infrastructure with NagVis

NagVis (http://www.nagvis.org/) is a visualization addon for Nagios/Icinga that permits to visualize the monitored information as objects placed on maps. 

I decided to use mk-livestatus (see: http://mathias-kettner.com) as backend because it is reported to offer better performances than ndo.

The following procedure was tested on Debian Wheezy 7.0 x86_64 with a working Nagios3 standard configuration.

First of all, let's install the prerequisites:

apt-get install g++ make libc6-dev php-net-socket php5-sqlite sqlite3 graphviz

Now get and install mk-livestatus:

wget http://mathias-kettner.com/download/mk-livestatus-1.2.3i1.tar.gz tar zxvf mk-livestatus-1.2.3i1.tar.gz cd mk-livestatus-1.2.3i1 ./configure && make make install

Prepare the path for the mk-livestatus unix socket:

mkdir -p /var/lib/nagios/rw/ chown -R nagios:nagios /var/lib/nagios/rw

Enable mk-livestatus by appending the following to the end of /etc/nagios3/nagios.cfg:

#### mk-livestatus config broker_module=/usr/local/lib/mk-livestatus/livestatus.o /var/lib/nagios/rw/live event_broker_options=-1

Get and install NagVis:

wget http://downloads.sourceforge.net/project/nagvis/NagVis%201.7/nagvis-1.7.9.tar.gz tar zxvf nagvis-1.7.9.tar.gz -C /opt cd /opt/nagvis-1.7.9/ chmod +x install.sh ./install.sh

Note: If you are using Icinga instead of Nagios3, you should launch the installer as follows:

./install.sh -s icinga

Here are the relevant options I had to set (I found this not so clear in the official NagVis documentation):

nagios path: /etc/nagios3 path to NagVis base: /etc/nagios3/nagvis Do you want to use backend mklivestatus? [y]: y MKLivestatus socket: unix:/var/lib/nagios3/rw/live

Installation output: (I suggest you to copy and paste it somewhere for later reference)

+------------------------------------------------------------------------------+ | Installation complete | | | | You can safely remove this source directory. | | | | For later update/upgrade you may use this command to have a faster update: | | ./install.sh -n /etc/nagios3 -p /etc/nagios3/nagvis -l "/var/lib/nagios3/rw/live" -b mklivestatus -u www-data -g www-data -w /etc/apache2/conf.d -a y | | | What to do next? | | - Read the documentation | | - Maybe you want to edit the main configuration file? | | Its location is: /etc/nagios3/nagvis/etc/nagvis.ini.php | | - Configure NagVis via browser | | <http://localhost/nagvis/config.php> | | - Initial admin credentials: | | Username: admin | | Password: admin | +------------------------------------------------------------------------------+

Check /etc/nagios3/nagvis/etc/nagvis.ini.php, in particular the following section:

[backend_live_1] backendtype="mklivestatus" socket="unix:/var/lib/nagios3/rw/live"

Now let's Navigate to NagVis url:

http://${IPADDRESS_OF_YOUR_NAGIOS_SERVER}/nagvis

Login with the default admin/admin credentials - Don't forget to change them as soon as you access! If you have an error like this:

Problem (Backend: live_1): Unable to connect to livestatus socket. The socket /var/lib/nagios3/rw/live in backend live_1 does not exist. Maybe Nagios is not running or restarting.

You probably don't have right permissions on /var/lib/nagios3/rw/live. Try to:

chown nagios:www-data /var/lib/nagios3/rw

(if you're not using Debian, change ownership to nagios:${THE_USER_GROUP_THAT_OWNS_APACHE}) and then

chmod g+s /var/lib/nagios3/rw/

(so that group ownership of the live socket would stick to the apache usergroup)

Example IT map:

[korovamilky]

Deny shell access to clients on a SSH Debian APT Repository.

So you've setup your company secured internal Debian APT repository server by allowing apt operations only via SSH with prior public key exchange. Great.

And what if your -say- unmanaged APT clients decide to ssh into your APT repository and start playing around messing things up? - Ok, we need to disable shell allocation, while still permitting normal APT operations.

Modifying the default user shell to something like /usr/sbin/nologin or /bin/false turned out to be not feasible (it would also deny apt-getting). So I came up with using the "no-pty" option inside the ~/.ssh/authorized_keys file.

As man sshd says, the no-pty option prevents tty allocation (a request to allocate a pty will fail) but permits clients to perform the normal APT operations (apt-get/aptitude update, install, remove).

So, simply edit your keys present in the Repo server ~/.ssh/authorized_keys file (where ~/ stands for the home directory of your unprivileged, repository-dedicated user - isn't?) as in the following example:

BEFORE:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvrjJ2b3CXy1bqktcFtvibUMpu50Uypu0BdRd/hV31pVvGVKxszaadRwIrrs5tone+TV/jCdEoxRxH3sKyySw2EvNwQqKUqxH6BB6ZtumGt04fRnVyCCIvatr6sYHLZL+oNnfoD4dYO0J+7XMuOQB+krRhF2/WRgaGUBn1Dnl7z3nbxhc6Z7OFWySrp6aJqt9RTOs1y049OPoVu2237UOeSqeTqQ0kgX3hIzdL0zfMir0CAzgtzHfOT2MsbkIMyMqgqHQRBynnNaqmljPbNKjmCvIrY8Vao/l1GqAaDlRJ6BKrrzhWEOGmjr5vh85dArJub5qWvoXnDldaA/dnr8Rt root@not-so-trusted

AFTER:

no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvrjJ2b3CXy1bqktcFtvibUMpu50Uypu0BdRd/hV31pVvGVKxszaadRwIrrs5tone+TV/jCdEoxRxH3sKyySw2EvNwQqKUqxH6BB6ZtumGt04fRnVyCCIvatr6sYHLZL+oNnfoD4dYO0J+7XMuOQB+krRhF2/WRgaGUBn1Dnl7z3nbxhc6Z7OFWySrp6aJqt9RTOs1y049OPoVu2237UOeSqeTqQ0kgX3hIzdL0zfMir0CAzgtzHfOT2MsbkIMyMqgqHQRBynnNaqmljPbNKjmCvIrY8Vao/l1GqAaDlRJ6BKrrzhWEOGmjr5vh85dArJub5qWvoXnDldaA/dnr8Rt root@not-so-trusted

[korovamilky]

Debian Wheezy and Foreman friends again

Latest Debian major release, Wheezy, ships by default with Ruby Sinatra 1.3.2 and you know what? Foreman will not play well with it! As an example, I couldn't provision new hosts (a generic error code 400 was thrown, plus lot of ruby complaints on the foreman-proxy log). Thanks to the amazing guys on #theforeman channel at irc.freenode.net I was pointed to the quick and dirty fix: downgrading Sinatra to the previous working version (1.3.1). Here we go: Uninstall default Sinatra (leave dependencies where they are)

dpkg --force-depends -r ruby-sinatra

Move to your Foreman folder:

cd /usr/share/foreman

Install Sinatra 1.3.1 from gems

gem install sinatra -v 1.3.1

Check:

gem query *** LOCAL GEMS *** bundler (1.2.2) [...] sinatra (1.3.1)

Done!

[korovamilky]

Enhance vim editor with pathogen

With pathogen.vim you can install plugins and runtime files for vim in a flash. It will be as simple as downloading them in the ~/.vim/bundle directory. Create directory tree:

mkdir -p ~/.vim/autoload ~/.vim/bundle

Download pathogen.vim:

curl -Sso ~/.vim/autoload/pathogen.vim https://raw.github.com/tpope/vim-pathogen/master/autoload/pathogen.vim

Edit your ~/.vimrc to add these lines:

" Enable pathogen " execute pathogen#infect() " OPTIONAL: You may also wish to have Vim jump to the last position when reopening a file " if has("autocmd") au BufReadPost * if line("'\"") > 0 && line("'\"") <= line("$") \| exe "normal! g'\"" | endif endif

From now on, when you wish to install new plugins, just jump to ~/.vim/bundle and extract (or git clone) them here. Example usage: Let's install vim-sensible plugin: "a universal set of defaults that (hopefully) everyone can agree on"

cd ~/.vim/bundle git clone git://github.com/tpope/vim-sensible.git

That's it! You may want to visit the projects' page at GitHub: http://github.com/tpope/vim-pathogen http://github.com/tpope/vim-sensible vim.pathogen on official vim website: http://www.vim.org/scripts/script.php?script_id=2332

[korovamilky]

Speed up OpenPGP key creation on remote server

Since creating an OpenPGP key requires some randomness (eg. move mouse, reading or writing from/to File System), the process of creating it on a remote connected host (via ssh) may take a lot of time or even get stuck. To collect the needed entropy you can connect to the server from another SSH connection and perform some I/O task like in the following examples:

ls –R /

(recursive listing of all files in the File System)

find /var/ /usr /lib /srv -type f -print0 | xargs -0 md5sum > /dev/null

..This saved my day! :)

[korovamilky]

Show active network interface and current IP address at TTY console login prompt

I have several virtual linux guests running on VirtualBox: a bunch of test machines to which I connect exclusively via ssh from my host terminal.

Virtualbox setting for their network adapter is usually set as bridged, in order to acquire the IP address from the DHCP server of the network I am connected to. 

I find it annoying to login on the console after every boot to check the current IP address, then logging out and connect via ssh.. that's why I came up with the following script. Essentially it appends ('echoes') the currently connected network interfaces (and relative IP) to the welcome message showed at tty console login prompt after boot (/etc/issue). Some little trick was needed to preserve the original content of /etc/issue and being pleasant to the eye.

Save it somewhere on your virtual machine filesystem (a good place could be /etc/init.d/), make it executable (chmod +x /etc/init.d/boot_prompt.sh) and then add a reference to its full path into /etc/rc.local just before the exit 0 line:

/etc/init.d/boot_prompt.sh exit 0

#!/bin/bash # Filename: boot_prompt.sh # Description: Shows connected interface(s) at boot and related ip address(es) on tty login prompt # Usage: Put it somewhere (ie. /etc/init.d/) and then add its full path entry to /etc/rc.d/rc.local # # Author: marco[dot]agate@gmail[dot]com # Version: 201304051644 DSTFILE="/etc/issue" KEEPLINE=$(head -n 1 ${DSTFILE}) IFACE_UP=$(/sbin/ifconfig | grep 'Bcast:' -B1 | grep -v inet | grep -v - -- | awk '{print $1}') echo ${KEEPLINE} | sed 's/\\\\/\\/g' > ${DSTFILE} echo >> $DSTFILE if [ -z "$IFACE_UP" ]; then echo "\n No active connection found." >> $DSTFILE else echo "Currently connected via:">> $DSTFILE for IFACE in $IFACE_UP; do IPADDR=$(/sbin/ifconfig $IFACE | grep 'Bcast:' | cut -d: -f2 | awk '{ print $1}') echo " $IFACE $IPADDR" >> $DSTFILE done fi echo >> $DSTFILE exit 0

Gist available here: https://gist.github.com/korovamilk/5320187

Screenshot of an example boot prompt:

[korovamilky]

Install F18 x86_64 from USB: Reduce ISO size to fit 4GB usb stick

No dvd at home, only a 4GB usb stick but in need to install Fedora on a laptop.. and then you realize that the iso image is slightly more than 4gb (ie. Fedora-18-x86_64-DVD.iso is about 4.3GB). Here it comes isomaster.

Just install it via yum: yum install isomaster

Launch it and select the path where your iso image is saved. Isomaster will open the iso and let you navigate inside the directories and the files contained by the image. Now you can delete unnecessary files until you have the desired size.

For example, if you plan to use Gnome as desktop environment, you may safely delete all KDE-related packages (navigate to the "Packages/k" directory, select all the packages starting with kde* and then hit DEL): you will end up with a 3.7GB iso that now you can burn into the 4GB usb stick via unetbootin.