SK's Tech Blog

Installing Java in Ubuntu 9.04

2009-11-02T01:36:00.005+05:30

I was trying to install the latest java version for firefox in Ubuntu 9.04. Current sun-java version available from Jaunty archives is jre1.6u14, while the latest in java site (as of now) is jre1.6u16
Go to this link: http://java.sun.com/javase/downloads/index.jsp and downloaded latest jdk as of today it is jdk-6u16.

Open terminal and cd to the download directory.

$ chmod u+x jdk-6u16-linux-i586.bin
$ sudo mkdir /usr/java
$ sudo mv jdk-6u16-linux-i586.bin /usr/java
$ cd /usr/java
$ sudo ./jdk-6u16-linux-i586.bin

Accept the license agreement and proceed installing. This will install java in the directory /usr/java/jdk1.6.0_16/

Now we have to point the system to new installed path. Do this:

$ sudo update-alternatives --install /usr/bin/java java /usr/java/jdk1.6.0_16/jre/bin/java 2;$ sudo update-alternatives --config java

Output will be:

There are 3 alternatives which provide `java'.

Selection Alternative
------------------------------ -----------------
+ 1 /usr/lib/jvm/java-6-sun/jre/bin/java
2 /usr/java/jre1.6.0_15/bin/java
* 3 /usr/java/jdk1.6.0_16/jre/bin/java

Press enter to keep the default[*], or type selection number:

I selected 3. Now we will have to point the new java plugin path in firefox.

$ cd /usr/lib/firefox-addons/plugins/ ; sudo ln -s /usr/java/jdk1.6.0_16/jre/plugin/i386/ns7/libjavaplugin_oji.so;$ cd /usr/lib/firefox/plugins/ ; sudo ln -s /usr/java/jdk1.6.0_16/jre/plugin/i386/ns7/libjavaplugin_oji.so

Note that firefox saw the latest plugin only after i linked it to both the directories. Then the new version started working.

Installing USB modem ZTE AC2726 in Ubuntu 9.04 Jaunty

2009-09-14T22:00:00.001+05:30

Recently i successfully installed ZTE AC-2726 modem that came with reliance wireless broadband connection. Below are the steps:

Insert the modem in USB interface and see if that gets detected.

$ lsusb
Bus 005 Device 002: ID 19d2:fff5

I noticed in /var/log/messsages that the device is detected as usb storage. To make it detected as modem we will use usb-modeswitch package. It is a Switching tool for controlling "flip flop" USB devices.

Download usb_switch package from here and install.
$ sudo dpkg -i usb-modeswitch_1.0.2-1_i386.deb

Unplug and plugin the modem back.

$ lsusb
Bus 005 Device 004: ID 19d2:fff1 <- Notice the change in product id

$ sudo modprobe usbserial vendor=0x19d2 product=0xfff1

You can see in the logs that the modem is detected correctly now. To detect & configure the dialer config run:

$ sudo wvdialconf

Check and add the missing entries in wvdial conf as found below:
$ sudo vi /etc/wvdial.conf
Phone = #777
Password = <Your Password>
Username = <Your Login Name>
Baud = 460800
Stupid Mode = 1
New PPPD = 1
Tonline = 0

Note: Give a valid username & password in the corresponding lines above and uncomment them (Hint: remove ";" from the beginning of the line).

$ sudo wvdial

The connection started working. Note that you can also configure gnome-ppp or kpp to connect.

Asterisk Updates

2009-09-11T01:03:00.001+05:30

In my asterisk server i installed all updates available from the repos. After rebooting the server, all my iax2 extensions stopped working.

I also found that there is one more interface virbr0 up with ip address 192.168.122.1. I stopped dnsmasq service which was listening on this ip. Then disabled dnsmasq (chkconfig dnsmasq off). Rebooted the box. Still the interface was present.

Since there is no use of this service in my server i removed dnsmaq along with all the dependencies. Did this:
# rpm -e dnsmasq libvirt-0.3.3-14.el5_3.1.i386 NetworkManager-0.7.0-4.el5_3.i386 NetworkManager-glib-0.7.0-4.el5_3.i386 libvirt-python-0.3.3-14.el5_3.1.i386

The Virtual Interface went away but still iax2 extensions were not working. Then, found the following error in /var/log/asterisk/full
ERROR[2659] chan_iax2.c: Call rejected, CallToken Support required. If unexpected, resolve by placing address x.x.x.x in the calltokenignore list or setting user yyyy requirecalltoken=no

This is due to the security enhancement done in asterisk recently. IAX2 is now secured by call tokens which my iax2 doesn't support still. So i went ahead disabling this feature for now:

vi /etc/asterisk/iax.conf
Added calltokenoptional = 0.0.0.0/0.0.0.0 to the end. Then did: /usr/sbin/amportal restart

All iax2 extensions started working again. May be i should start looking for upgrading my clients to support call tokens for improved security.

References:
http://www.venturevoip.com/allnews.php?count=99999
http://downloads.asterisk.org/pub/security/AST-2009-006.html
Details are available in this pdf: http://svn.digium.com/svn/asterisk/branches/1.4/doc/IAX2-security.pdf

Reports work in AsteriskNow 1.5

2009-05-07T00:29:00.001+05:30

I suppose you have already installed AsteriskNow 1.5 and you would have found that reports don't work out of the box. It always says "No data". Apparently the system is not logging the calls and we have to enable this with some additional configuration. Below are the steps for that:

Login to your asterisk server as root and type yum install asterisk-addons-mysql. Select Y when it asks for installation. Once this is done you can see that all calls that go through your server are tracked and reported. But the Admin web interface displays the following error: reporting an error "Asterisk Manager Connection Failure" (If you don't get that error then below step is not required).

To fix the error go to web interface, Choose Administrators under Basic section. Select admin user and give the password (same as what you have in amportal.conf and manager.conf files). Apply changes. That's it.

After that the system will starts tracking all the calls getting through it.

AsteriskNow 1.5 + installation and configuartion

2009-04-06T23:54:00.003+05:30

AsteriskNow 1.5 was recently released. I already had a box with 1.0.2 version and thought of giving the new version a try. Downloaded the ISO from the site and burned it to a CD. The new version is built on CentOS 5.3. I installed the new version in the same system overwriting 1.0.2. Note that the installation did not detect the old version nor did it give me any option for upgrade. Since my server was not in production i went ahead removing all the partitions and reinstalled the new version. If you have a production box backup the configuration files or install the new version in a test system and then copy the existing setup/accounts. You have been warned.

I installed AsteriskNow with the default partitions schema ( it creates all partitions under a single LVM). Once installation is complete, remove the CD and click reboot. After the OS boots it asks to configure the following:

Authentication, Firewall, Network, System Services

Authentication - Configure any extra authentication such as ldap.
Firewall - You can enable firewall (remember to allow all required ports like sip, iax & zap) if needed.
Network - Configure you network interfaces. This config sets the IP address of all interfaces in the system. Note that eth0 alone is enabled by default. Other interfaces must be enabled manually(Edit /etc/sysconfig/network-interfaces/ifcfg-ethx and set ONBOOT=yes).
System Services - Disabled any unwanted services.

After the above is done exit the wizard to login to the box. You will also have to restart the network service to enable all interfaces after login to the system as root. Immediately after the first login i ran a update

# yum update.

This installed a new version of kernel(2.6.18-128.1.6.el5), asterisk and dahdi modules. So i rebooted the box.(Default kernel is 2.6.18-128.1.1.el5).

After the system reboots, open the web interface in your favourite browser: http://<your-asterisk-server-ip>. When you click the FreePBX Administration link it asks you to enter the password. Asterisk 1.5 by default has two administrator user accounts with default password as specified below.
Username admin, Password - admin
Username freepbx, Password - fpbx

We will now change the default password of both admin accounts and secure the system. First let us change the admin user's password. In the web interface select Administrators tab in the Basic section. Click the admin user (in the top right) and give the new password of your choice. We are done.

Note: I did the following changes from root login in the asterisk box. The web interface prompts you to reload the config after every change you do. You can reload the config after all the changes are done.

To change freepbx user's password you have to change the entries in two files (we will backup the original files) and also change the mysql password.

# cd /etc/
# cp amportal.conf amportal.conf.orig
# vi amportal.conf
AMPDBPASS=<new password>

# cd /etc/asterisk
# cp cdr_mysql.conf cdr_mysql.conf.orig
# vi cdr_mysql.conf
password=<new password>

Now we will change the password for mysql:

# mysql -p  (Just press enter in the password Prompt)
mysql > SET PASSWORD FOR freepbx@localhost=PASSWORD('new password');

The web interface reports the following errors at this point (Yes, these errors are there in the fresh installation itself).

Notice Memory Limit Changed - To fix this edit /etc/php.ini and change memory_limit=100M. (You have to restart httpd after this).

Default Asterisk Manager Password Used:

You have to change this in two files

# cd /etc/
# vi amportal.conf
AMPMGRPASS=<new password>

# cd  /etc/asterisk
# cp manager.conf manager.conf.orig
# vi manager.conf
secret = <new password> (Must be same as what you gave for AMPMGRPASS in amportal.conf).

No email address for online update checks - Go to General Settings Tab under Basic and give an email address in the Update Email: text box. (I have given my email id here).

Could not reload FOP server - For this we will first install the newest FOP version and then setup httpd to run as asterisk user (By default httpd runs as apache user).

# cd /root
# wget http://www.asternic.org/files/op_panel-0.29.tar.gz
# cd /var/www/html/panel
# cp op_server.pl op_server.pl.orig
# cp operator_panel.swf operator_panel.swf.orig
# tar zxfv /root/op_panel-0.29.tar.gz
# cp op_panel-0.29/flash/operator_panel.swf .
# cp op_panel-0.29/op_server.pl .
# cd /var/lib/asterisk/bin/
# ./retrieve_conf

# cd /etc/httpd/conf
# cp httpd.conf httpd.conf.orig
# vi httpd.conf
Find the line User apache and change it to User asterisk. Save the file and exit.
# service httpd restart

After this click on Apply Configuration Changes in the web interface. Then the webinterface reports about module upgrade. Goto Module admin tab and click Check for upgrade online. Click Upgrade all and then click Process. Press Confirm. All modules will upgrade automatically.

Now there won't be any errors or other warnings in the web interaface. You can create extensions, inbound/outbound settings as required.

I found fixes from the following links:
http://www.freepbx.org/forum/freepbx/users/freepbx-panel-flashing-red-and-green
http://www.asternic.org/
http://www.freepbx.org/support/documentation/faq/changing-the-asterisk-manager-password

Selectively relay emails using postfix

2009-04-01T00:55:00.001+05:30

Several machines in my internal network run automated jobs and send out emails. All emails were getting delivered without problems and one fine day my public IP got listed in RBLs and the mail servers, using those RBLs, stopped accepting mails from mine.

I have now set my main network router to restrict outgoing port 25 so that my public ip doesn't get black listed again. This means Internal machines cannot send mails to any of the domains outside my network. I needed a mechanism to route all my emails through my external mail server which has a proper mx record. My external email server, that is outside my network, allows users to relay emails only after successful auth on port 465 (SSL). I configured postfix for this.

Note that since Postfix does not deliver mails via port 465 i used stunnel for smtps connection between my Postfix box, acting as smtps client here, and the external mail server.

Let us first start with installing postfix. We will also see how to route emails from sendmail through postfix.

Note: In the below config example.com is the local domain of postfix box and example1.com is the external domain.

# yum install postfix

We will first configure stunnel to forward all connections to the external mail server.

 # vi /etc/stunnel/stunnel.conf
client = yes
[rev-smtps]
accept = 127.0.0.1:2525
connect = <externalmailserver>:465

The above configuration makes stunnel to listen on localhost's port 2525 and forward everything from that port to mail server's 465. Certificates are accepted automatically.

Let us start stunnel.

# stunnel /etc/stunnel/stunnel.conf (You can put this line in /etc/rc.local so that the service starts automatically after the machine is reboots).

Now try connecting to the port '2525' with
# telnet localhost 2525

You will see the greeting from the remote SMTP server. Now we will configure postfix to authenticate with the remote email server and route all such connections through stunnel.

 # vi /etc/postfix/main.cf
smtp_sasl_auth_enable = yes  # Enables auth through ssl
smtp_sasl_security_options=
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd # specifies the password file
transport_maps = hash:/etc/postfix/transport # this will tell postfix to selectively forward or relay emails.
relay_domains = $mydestination, example1.com # list of all domains the server will accept to deliver email for.
inet_interfaces = $myhostname, localhost # Interfaces in which postfix listens on
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, example.com # Local delivery domains
home_mailbox = Mailbox

Save the file.

We can configure different email servers for each domain with postfix's transport file.

# vi /etc/postfix/transport
example1.com smtp:127.0.0.1:2525
any-other-domain.com smtp:127.0.0.1:2525 # You can mention any other domains here if your external email allows relaying mails.

Above config will forward all mails destined to example1.com and any-other-domain.com through the stunnel server which will inturn connect us to the external email server.

# vi /etc/postfix/sasl_passwd
[127.0.0.1]:2525 username@example1.com:password

Note that you can give only one username:password combination for one email server (127.0.0.1:2525 in this case).

Save this file.

Create maps so that postfix reads the new configuration.

# postmap /etc/postfix/sasl_passwd
# postmap /etc/postfix/transport

In all my Internal servers i have sendmail. Now i have to tell sendmail to route emails through the postfix box. I did this:

# vi /etc/mail/mailtertable
example.com smtp:[x.x.x.x]    # substitute the ip address of your postfix server instead of x.x.x.x
example1.com smtp:[x.x.x.x]    # substitute the ip address of your postfix server instead of x.x.x.x
any-other-domain.com smtp:[x.x.x.x]    # substitute the ip address of your postfix server instead of x.x.x.x

You will also have to add mx entries for example.com in your DNS.

With the above config, this is what would happen:
1. Any mail sent from internal servers (incl the postfix server itself) to user@example.com will be delivered to postfix's corresponding user mailbox.
2. Any mail sent from internal servers (incl the postfix server itself) to user@example1.com (or any-other-domain.com) will be forwarded to the external mail server's 465 port after authenticating as user@exampe1.com user.
3. Any mail from poxfix box to user@localhost or user@hostname-of-the-postfix-box will be delivered locally.

Note that any mail sent to other domains through this postfix server will be rejected.

Tomcat Failover Setup with Apache2+modjk

2009-03-22T00:44:00.002+05:30

Tomcat works fairly well under heavy loads. For critical services we will need some type of backup/failover mechanism. This tutorial is for those who want to configure apache to failover between two tomcat instances. When the first tomcat service fails, apache-httpd automatically routes the requests to second tomcat.

This tutorial shows how to configure failover load balancing between two tomcat instances in the same server (i have also shown how to do this for tomcat instances in two different servers). For this i am assuming you know how to install multiple tomcat instances in the same machine. This is only slightly different from load balancing between two tomcat instances as you see below in the sample workers.properties file.


#
# workers.properties
#
# Below Entry Specifies the load balance factor when used with a load balancing worker.
# Note: ----> lbfactor must be > 0,  Low lbfactor means less work done by the worker.
# worker.tomcat1.lbfactor=100

# In Unix, we use forward slashes:
ps=/

# list the workers by name

# Workers that are member of lb should not be in the list.
worker.list = failover

# ------------------------
# Tomcat1 Primary 
# ------------------------
worker.tomcat1.port=8009        # You can specify your tomcat instance's ajp port here
worker.tomcat1.host=localhost # Specify any hostname/IP here if tomcat is running in a remote server
worker.tomcat1.type=ajp13
worker.tomcat1.lbfactor=1
worker.tomcat1.connection_pool_timeout=600
worker.tomcat1.socket_timeout=600
worker.tomcat1.redirect=tomcat2

# ------------------------
# Tomcat2 Failover
# ------------------------
worker.tomcat2.port=9009        # You can specify your tomcat instance's ajp port here
worker.tomcat2.host=localhost # Specify any hostname/IP here if tomcat is running in a remote server
worker.tomcat2.type=ajp13
worker.tomcat2.lbfactor=1
worker.tomcat2.connection_pool_timeout=600
worker.tomcat2.socket_timeout=600
worker.tomcat2.activation=disabled # Requests are sent to the disabled worker only if first worker fails

# ------------------------
# Failover worker
# ------------------------
#
# The loadbalancer (type lb) worker performs weighted round-robin
# load balancing with sticky sessions.
# Note:
# ----> If a worker dies, the load balancer will check its state
# once in a while. Until then all work is redirected to peer
# worker.
worker.failover.type=lb
worker.failover.balance_workers=tomcat1,tomcat2
worker.failover.sticky_session=False
worker.failover.sticky_session_force=False

# END workers.properties

Load Balancing tomcat with Apache and mod jk

2009-03-22T00:36:00.001+05:30

Tomcat works fairly under heavy loads. But many a times we would like to distribute the requests to more than one server to minimize response time and there by improving the user experience. This tutorial shows how to configure load balancing (distribute the load) between two tomcat instances in the same system (i have also shown how to do this for tomcat instances in two different servers). For this i am assuming you know how to install multiple tomcat instances in the same machine and also know how to connect apache with tomcat using mod_jk.

All we will do here is to add a new worker to the worker.properties file we already saw in the previous tutorials with Apache httpd 2.x, tomcat 6.x and tomcat-connector 1.2.27.

Below is the content of workers.properties file.


#
#workers.properties
#
# Below Entry Specifies the load balance factor when used with a load balancing worker.
# Note: ----> lbfactor must be > 0, Low lbfactor means less work done by the worker.
# worker.tomcat1.lbfactor=100 

# In Unix, we use forward slashes:
ps=/

# list the workers by name

# Workers that are member of lb should not be in the list.
worker.list = loadbalancer   

# ------------------------
# First worker
# ------------------------
worker.tomcat1.port=8009      # Give the ajp port of the first tomcat instance here
worker.tomcat1.host=localhost # You can mention any other hostname or IP here
worker.tomcat1.type=ajp13
worker.tomcat1.lbfactor=100    
worker.tomcat1.connection_pool_timeout=600
worker.tomcat1.socket_timeout=600
worker.tomcat1.recovery_options=16

# ------------------------
# Second worker
# ------------------------
worker.tomcat2.port=9009      # Give the ajp port of the first tomcat instance here
worker.tomcat2.host=localhost # You can mention any other hostname or IP here
worker.tomcat2.type=ajp13
worker.tomcat2.lbfactor=100
worker.tomcat2.connection_pool_timeout=600
worker.tomcat2.socket_timeout=600
worker.tomcat2.recovery_options=16

# ------------------------
# Load Balancer worker
# ------------------------
#
# The loadbalancer (type lb) worker performs weighted round-robin
# load balancing with sticky sessions.
# Note:
# ----> If a worker dies, the load balancer will check its state
#once in a while. Until then all work is redirected to peer
# worker.
worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=tomcat1, tomcat2
worker.loadbalancer.sticky_session=False
worker.loadbalancer.sticky_session_force=False

# END workers.properties

Note: You can have as many tomcat instances(workers) as you want in the same box as long as your box can withstand the load.

Ftps with apache keys

2009-01-12T00:08:00.001+05:30

FTPS (ftp with SSL) is different from Sftp, in that the later is a mostly part of ssh service. All permissions that a user has through SSH, like viewing files under other directories like /etc, will also be available through sftp. Using sftp one can download a copy of the /etc/passwd file. To safeguard this you have to enable chroot for sftp users and they will be restricted to their home directory. I found the configuration of chrooted sftp difficult. Since i had a ftp server running in the same box, with chrooted users, it made lot of sense to me to use ftps. I just had to add certificates' location and rest of the configuration was there after all.

In my other post i wrote about using Apache-tomcat SSL keys in Apache-httpd server. This post explains how to use apache-httpd SSL keys in vsftpd.

I assume that you have a working copy of vsftpd. If not please install and configure vsftpd as per your requirement. Here is what you have to do to enable ftps (ftp through SSL).

Store all your apache SSL keys in a location accessible to vsftpd. I kept them under /root/vsftpd_keys/. There will be minimum two files (private and public key). In my case i had 3 private key (exported.key), public key (mydomain.com.crt) and two intermediate keys (cross_intermediate.crt, gd_intermediate.crt).

First we have to combine public and intermediate keys into one file:
# cd /root/vsftpd_keys/
# cat mydomain.com.crt cross_intermediate.crt intermediate.crt > vsftpd_domain_inter_comb3.crt

Note: 1. You have to concatenate the files in the same order specified above.
2. It is fine to join just the domain & intermediate certs if your certificate chain doesn't need/have cross_intermediate.

Edit the vsftpd.conf file (Usually /etc/vsftpd/vsftpd.conf) and add the following to the end of the file:

userlist_enable=YES
ssl_enable=YES
allow_anon_ssl=YES
force_local_data_ssl=NO
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/root/vsftpd_keys/vsftpd_domain_inter_comb3.crt
rsa_private_key_file=/root/vsftpd_keys/exported.key
pasv_enable=YES
pasv_address= <your ip here> (Note: When the system is behind NAT firewall you have to give the firewall's NATed IP here).
pasv_min_port=1500
pasv_max_port=1505

The above configuration requires incoming ports 1500 to 1505 to be open in the firewall, if you have one.

Exporting tomcat keys to Apache httpd

2009-01-07T00:49:00.001+05:30

Apache Tomcat SSL keys created with keytool are, by default, in der format. These keys cannot be used in Apache httpd since httpd, be default, expects the keys in pem(X509) format. Using the below steps you can export the tomcat's keys to apache httpd format and use it for apache.

I assume that you already have a working copy of tomcat with SSL. You need a copy of the tomcat's keystore file and the keystore password.

Let us start....

First copy the existing tomcat's keystore file to a new directory so that we don't break anything that is working.

# mkdir /root/SSL_export/
# cp <path/to/tomcat/keystore/file> /root/SSL_export/tomcat.keystore
# cd /root/SSL_export/
# keytool -list -keystore tomcat.keystore
Enter keystore password:

The above command will print all the keys in the keystore.

Now we will export the key in DER format
# keytool -export -alias tomcat -keystore tomcat.keystore -file exported-der.crt
Enter keystore password:
Output will be: Certificate stored in file

The certificate will be stored in exported-der.crt

Verify the certificate with this command:
# openssl x509 -noout -text -in exported-der.crt -inform der
Output will be: The whole certificate saying - who issued it and other info like your company name etc.

Now Convert the key to PEM format so that apache can understand it:
# openssl x509 -out exported-pem.crt -outform pem -in exported-der.crt -inform der

The exported key will be in the file exported-pem.crt.

We have exported the public key and now are going to export the private key.

Download these files:
# wget http://richfreedman.googlepages.com/ExportPrivateKey.java
# wget http://www.source-code.biz/snippets/java/Base64Coder.java.txt
# mv Base64Coder.java.txt Base64Coder.java
# javac ExportPrivateKey.java Base64Coder.java

Below command will save the exported private key in the file it is redirected to.
# java ExportPrivateKey tomcat.keystore tomcat G10BalPass > exported-pkcs8.key

We have to change it to RSA format so that apache can recognise it.
# openssl pkcs8 -inform PEM -nocrypt -in exported-pkcs8.key -out exported.key

Private key is now exported to the file exported.key.
Download the intermediate certificate from your certificate authority and keep it in the same location.

Now we should configure apache accordingly:
# cd /etc/httpd/conf.d/
# cp ssl.conf ssl.conf.orig
# vi ssl.conf (Change the following line only after commenting the old lines):
SSLCertificateFile /root/SSL_export/exported-pem.crt
SSLCertificateKeyFile /root/SSL_export/exported.key
SSLCertificateChainFile /root/SSL_export/<intermediate.crt>

Restart apache. You must be able to browse https://yourdomain.com/

Apache and Tomcat with modjk using tar

2008-12-27T01:22:00.001+05:30

I have already put together a tutorial to connect Apache HTTP with Apache tomcat. In that i had installed httpd with rpm. This tutorial explains the steps to connect apache(http) with tomcat using modjk ;only that this time i am going to explain how to do everything from tar bundles. Here i am not going to explain how to install tomcat. Another tutorial on that is here: http://techsk.blogspot.com/2008/04/installing-tomcat.html.

In the below tutorial i will be installing apache in the default directory (/usr/local/apache2) you can change that location in your server to any other by adding --prefix=<your-install-directory> in the configuration step before calling make. Also i am installing Apache HTTP with SSL support.

When i get some time i will put together the steps for enabling SSL in apache and for using tomcat's SSL keys in Apache.

Here we go:

First download httpd:
# cd /usr/local/src/
# wget http://apache.mirrors.redwire.net/httpd/httpd-2.2.10.tar.gz
# wget http://www.apache.org/dist/httpd/httpd-2.2.10.tar.gz.md5
# md5sum httpd-2.2.10.tar.gz (was equal to the downloaded sum)
# tar zxfv httpd-2.2.10.tar.gz
# cd httpd-2.2.10

Below command will configure (prepare) apache installation with most of the shared modules. Type ./configure --help to see what they are
# ./configure --enable-so --enable-mods-shared=most --enable-ssl (Hint: --prefix=</path/to/install/directory>)
# make
# make install
# cd /usr/local/src/
# wget http://www.trieuvan.com/apache/tomcat/tomcat-connectors/jk/source/jk-1.2.27/tomcat-connectors-1.2.27-src.tar.gz
# wget http://www.apache.org/dist/tomcat/tomcat-connectors/jk/source/jk-1.2.27/tomcat-connectors-1.2.27-src.tar.gz.md5
# md5sum tomcat-connectors-1.2.27-src.tar.gz (was equal to the downloaded sum).
# tar zxfv tomcat-connectors-1.2.27-src.tar.gz
# cd tomcat-connectors-1.2.27-src/native/
# ./configure --with-apxs=/usr/local/apache2/bin/apxs
# make
# make install

That is it for the installation. Now we will configure apache for connecting it with tomcat
# cd /usr/local/apache2/conf/
# cp httpd.conf httpd.conf_18Nov08
# vi httpd.conf
Add the following code below the LoadModule section.


# Load mod_jk
# 
LoadModule jk_module modules/mod_jk.so

# Configure mod_jk
#
JkWorkersFile conf/workers.properties
JkLogFile logs/mod_jk.log
JkLogLevel info

JkMount *.jsp test   <- This must be the worker name you give in workers.properties. This will at(many) times go into your Virtual Host configuration.

Uncomment the line: Include conf/extra/httpd-ssl.conf
Save and Exit.
# cd /usr/local/apache2/conf/
# vi workers.properties (create new file and paste the below code)


# workers.properties
#

# In Unix, we use forward slashes:
ps=/

# list the workers by name

worker.list=test

# ------------------------
# First tomcat server
# ------------------------
worker.test.port=8009
worker.test.host=localhost
worker.test.type=ajp13

#
# END workers.properties
#

Save and exit.

Start Apache.
# /usr/local/apache2/bin/apachectl start

Now you will be able to browse all jsp pages through apache. Apache will silently be connecting with tomcat through modjk to serve those.

Blogged with the Flock Browser

Connecting Apache with tomcat using modjk

2008-12-27T00:30:00.001+05:30

Apache HTTP and Tomcat are web servers meant for different purposes. While Apache HTTP can be used to serve static (html) and dynamic (cgi/perl) contents , tomcat is used to serve Java pages (jsp/servlets). We can link both Apache HTTP & Apache Tomcat using modjk (connector):

What can you do by linking them both?

1. Effectively serve both static (html) and dynamic (jsp/servlet) pages.
2. Load balance/Cluster between two or more tomcat services.

There may be more ....

I did the installation in CentOS 4.4 (32bit). I installed Apache http (rpm) using yum. I assume that you have already installed Tomcat.

Below is the tutorial:

# yum install httpd httpd-devel (httpd-devel is needed to install any module in httpd)
# wget http://apache.siamwebhosting.com/tomcat/tomcat-connectors/jk/source/jk-1.2.26/tomcat-connectors-1.2.26-src.tar.gz (download any latest version).
# wget http://www.apache.org/dist/tomcat/tomcat-connectors/jk/source/jk-1.2.26/tomcat-connectors-1.2.26-src.tar.gz.md5 (md5 check sum for the above).

Check if you have downloaded a genuine package
# md5sum tomcat-connectors-1.2.26-src.tar.gz (This must be equal to the sum downloaded with the second wget).

# tar zfxv tomcat-connectors-1.2.26-src.tar.gz
# cd tomcat-connectors-1.2.26-src
# cd native
# ./configure --with-apxs=/usr/sbin/apxs
# make
# make install

# cd /etc/httpd/conf/
# cp httpd.conf httpd.conf.orig (I always keep a copy of the original).
# vi httpd.conf

Add the following code below the LoadModule section.


# Load mod_jk
# 
LoadModule jk_module modules/mod_jk.so

# Configure mod_jk
#
JkWorkersFile conf/workers.properties
JkLogFile logs/mod_jk.log
JkLogLevel info

JkMount *.jsp test   <- This must be the worker name you give in workers.properties. This will at(many) times go into your Virtual Host configuration.

Save and Exit.

# cd /etc/httpd/conf/
# vi workers.properties (create new file and paste the below code)


# workers.properties
#

# In Unix, we use forward slashes:
ps=/

# list the workers by name

worker.list=test

# ------------------------
# First tomcat server
# ------------------------
worker.test.port=8009
worker.test.host=localhost
worker.test.type=ajp13

#
# END workers.properties
#

Restart apache. Now you can access tomcat through apache. Any request to jsp files will go to test-tomcat.

Blogged with the Flock Browser

After a long time!

2008-11-19T01:38:00.001+05:30

I was too busy to update my pages here. With most of the deadlines passed through, I hope to add more articles starting next week.

You can Expect something on serving dynamic pages from apache with apache + mod_jk + tomcat setup, failover setup for two tomcat instance with apache and mod_jk, LVM setup, Problems/errors and fixes in LVM, Striping in LVM.

I will also update my experiences about ISMS implementations in our company so that it will be helpful for others who need help.

Thanks for coming here.

Dual MySQL services in single server

2008-08-04T01:16:00.001+05:30

Requirement:
To install one more mysql instance (server) and make it run on another port. The second instance must use a different data directory (ofcourse!). I assume that you have a working copy of mysql in the server which may be listening on any port (default: 3306) and storing data any where (default: /var/lib/mysql).

Steps:

# cd /usr/local/src/
downloaded mysql from here: http://dev.mysql.com/get/Downloads/MySQL-5.1/mysql-5.1.26-rc.tar.gz/from/pick#mirrors

# tar zxfv mysql-5.1.26-rc.tar.gz
# cd mysql-5.1.26-rc
See what options are available with ./configure --help

Below are options we need to consider:
--bindir=DIR           user executables [EPREFIX/bin]
--sbindir=DIR          system admin executables [EPREFIX/sbin]
--libexecdir=DIR       program executables [EPREFIX/libexec]
--datadir=DIR          read-only architecture-independent data [PREFIX/share]
--sysconfdir=DIR       read-only single-machine data [PREFIX/etc]
--sharedstatedir=DIR   modifiable architecture-independent data [PREFIX/com]
--localstatedir=DIR    modifiable single-machine data [PREFIX/var]
--libdir=DIR           object code libraries [EPREFIX/lib]
--includedir=DIR       C header files [PREFIX/include]
--oldincludedir=DIR    C header files for non-gcc [/usr/include] - installation will take some libs from here.
--infodir=DIR          info documentation [PREFIX/info]
--mandir=DIR           man documentation [PREFIX/man]

Note that all are created by default under PREFIX/EPREFIX. By default EPREFIX=PREFIX.

Some more options to look into:
--with-tcp-port=port-number (default 3306)
--with-mysqld-user=username - no default

--with-unix-socket-path=SOCKET
    Where to put the unix-domain socket. SOCKET must be an absolute file name.

--with-plugins=PLUGIN[,PLUGIN..]
                          Plugins to include in mysqld. (default is: none)
                          Must be a configuration name or a comma separated list of plugins.
                          Available configurations are: none max max-no-ndb all.
                          Available plugins are: partition daemon_example
                          ftexample archive blackhole csv example federated
                          heap innobase myisam myisammrg ndbcluster.

Also use this: CFLAGS="-O3" CXX=gcc CXXFLAGS="-O3 -felide-constructors -fno-exceptions -fno-rtti

I will be using /data/mysql for this instance's settings and data. The new instance should listen on port 33060. Let us start the config now:

# ./configure --prefix=/data/mysql --with-unix-socket-path=/data/mysql/mysql.sock --with-tcp-port=33060 --with-plugins=all
# make
# make install

This will take about 15 minutes

# cp support-files/my-medium.cnf /data/mysql/my.cnf (If you want to config anything).
# cd /data/mysql/
# chown -R mysql .
# chown -R mysql .
# ls (there won't be var directory in that). We have to create it with the below command which creates all necessary databases.

# ./bin/mysql_install_db --user=mysql

Start the server:
# /data/mysql/bin/mysqld_safe &

And test it:
# mysql -P 33060 -p

It worked.

You can setup other accounts, change root password etc after this. Refer the below manual for all other options.

http://dev.mysql.com/doc/refman/5.1/en/quick-install.html

how to run a cronjob on last Friday of every month

2008-06-01T01:33:00.001+05:30

A crontab entry in linux looks like this:
10 10 * * 7 /path/to/your/script

This says to run /path/to/your/script at 10:10am on Sunday.

The first five fields are:
minute (0-59)
hour (0-23)
day of the month(1-31)
month of the year (1-12)
day of the week (0-7 with 0 &7 = Sunday, 1 = Monday etc.,)

For running a script on last Friday of every month you would typically put entry as:
10 10 28-31 * 5 /path/to/your/script

But the above will run your script on 28,29,30 & 31 of every month and on each Friday (weekly). The thing is, cron would execute the script if either day of the week or day of the month matches.

To run your script only on every last Friday/weekday of a month use the below entry:
10 10 * * 5 [ $(date +"\%m") -ne $(date -d 7days +"\%m") ] && /path/to/your/script

The above entry is executed every week. It has two parts:

First part:
$(date +"\%m") -ne $(date -d 7days +"\%m") - Checks if the month today is not equal to month next week (7days from now - same day). If they are equal then current
day (Friday in our case) is not the 'last Friday' if not it is the last
Friday.

Second Part: your actual script /path/to/your/script

We have glued both parts with &&. This will effect the execution of second part ie., second part is executed only when the first part is true (Months returned from both date commands should not be equal).

Also note that there is a \ before %m in the entry. Cron cannot understand % sign and so we have to escape it with \.

References:
http://www.unix.com/answers-frequently-asked-questions/13527-cron-crontab.html
http://www.unix.com/unix-advanced-expert-users/11562-can-cron-do.html
http://forums.macosxhints.com/archive/index.php/t-34624.html

Enabling https (SSL) in Tomcat

2008-05-29T00:38:00.001+05:30

For enabling ssl in tomcat you need to buy signed certificate/s from a Certificate Authority (some hosting companies also sell SSL certificates). The work doesn't end with that. After buying a certificate you have to create a certificate request, which your CA will sign and authorize.

Below are the steps i followed to enable SSL in tomcat.

Note: Remember to replace the full path of the filename. Usually i create these files a new subdirectory.

Creating Certificate Request

$ keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.key

The above command generates a key store file (tomcat.key) with RSA algorithm and aliased as tomcat. A keystore is nothing but a file which has your key and the CA's signature. The above command gets all the following information from you, so please keep them handy
Keystore password: <any thing you want>
First & Last Name: <your name/any authorized person's name>
Organizational Unit: <Dept in your company>
Organization Name: <Your company name>
Your City:
State:
Country Code: <eg: US>

Following command actually creates the csr
$ keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore tomcat.key

Depending on whom you bought the certificate from, you may have to copy the contents of the certreq.csr from your CA's site or your CA will send it as email attachment.

Keys from CA:

You will get the keys (issued) from CA. You may also have to download two more key's (root & intermediate) from your CA's website. First add root cert, then add intermediate followed by your site's certificate. Below are the steps:

First import root cert.
$ keytool -import -alias root -keystore tomcat.key -trustcacerts -file <root.crt>

Then the intermediate cert
$ keytool -import -alias intermed -keystore tomcat.key -trustcacerts -file <intermediate.crt>

Finally your site's cert
$ keytool -import -alias tomcat -keystore tomcat.key -trustcacerts -file <yourdomain.com.crt>

yourdomain.com.crt is the cert file issued by CA for your domain.

How to list the imported Certificates?

$ keytool -list -keystore tomcat.key

The above keystore file is now ready. Let us know configure tomcat to use this key file.

If you have already installed tomcat, edit the server.xml of the tomcat instance you want to turn on https. Search for the below lines:

<Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />

The above lines are commented by default. Remove the comment signs  after them.

Add the below line anywhere in between them:
keystoreFile="/path/to/keystore/tomcat.key" keystorePass="changeit"

Restart the tomcat service. We are done.

Now you must be able to browse https://localhost:8443 from the same machine where tomcat is installed. You can view the certificate and cross check it.

Blogged with the Flock Browser

How to configure 2 or more tomcat instances in the same server

2008-04-03T00:58:00.000+05:30

We have already seen how to install tomcat in Linux.

Now let us create one more instance. As you may already know we cannot have two services listening on the same ip & port. So, for the second instance of the tomcat we have to change the port settings.

This tutorial is in continuation of my first post on installing tomcat. You can read it here. I assume that you already have one tomcat instance up and running (as a special user 'myuser').

Login as or su as myuser:
# su - myuser
$ cd ~

$ unzip /your/download/directory/apache-tomcat-x.x.x.zip (or)

if downloaded gzip file then
$ tar zxfv /your/download/directory/apache-tomcat-x.x.x.tar.gz

$ mv apache-tomcat-x.x.x test-tomcat1
$ cd ~/test-tomcat1/conf

Changing the default ports:
$ cp server.xml server.xml.orig
$ vi server.xml

Change the shutdown port 8006 (as shown in below line):

server port="8006" shutdown="SHUTDOWN"

to:
server port="9006" shutdown="SHUTDOWN"

Change non-ssl http 1.1 Connector port on 8080 (as shown in below line):

Connector port="8080" maxHttpHeaderSize="8192" maxThreads="150" ...

to:
Connector port="9080" maxHttpHeaderSize="8192" maxThreads="150" ...

Ajp connector port 8009 (as shown in below line):
connector port="8009" enablelookups="false" redirectport="8443" protocol="AJP/1.3"

to:
connector port="9009" enablelookups="false" redirectport="9443" protocol="AJP/1.3"

If you have enabled proxied http connector port 8082 (found in line below):
Connector port="8082" maxThreads="150" minSpareThreads="25" ...

Change it to:
Connector port="9082" maxThreads="150" minSpareThreads="25" ...

If you have enabled https port 8443 (found in lines below):

connector
port="8443" maxhttpheadersize="8192"
keystorefile="/home/tomcat/keystore/tomcat.key" scheme="https"
secure="true" clientauth="false" sslprotocol="TLS"

Change it to:
connector
port="9443" maxhttpheadersize="8192"
keystorefile="/home/myuser/keystore/domain.key" scheme="https"
secure="true" clientauth="false" sslprotocol="TLS"

Now give executable permission to the scripts:
$ cd ~/test-tomcat1/bin/
$ chmod u+x *.sh

Create a directory for your Servlet's log files:
$ mkdir ~/myservlet1

And add aliases:

$alias tomcat1-down=~/test-tomcat/bin/shutdown.sh
$ alias tomcat1-up=cd ~/myservlet1; ~/test-tomcat/bin/startup.sh

Remember to put alias entries in ~/.bashrc so that they are persistent.

Startup tomcat:
$ tomcat1-up

Open your browser. You must be able to view both tomcat test pages by now.
Page1: http://localhost:8080/
Page2: http://localhost:9080/

Installing tomcat in Linux

2008-04-01T00:48:00.007+05:30

We will need Java to install tomcat. You can download it here. I used JDK 6 Update 5.

I am not going into the details of installing jdk. Make a note of where you install it. My jdk location is: /usr/java/jdk1.6.0_5

Download tomcat from here. I used 6.0.16

By default tomcat listens on port 8080, so you will not need super user permissions. If you are using any port <1024>
# passwd myuser

su - myuser

$ unzip /your/download/directory/apache-tomcat-x.x.x.zip (or)

if downloaded gzip file then
$ tar zxfv /your/download/directory/apache-tomcat-x.x.x.tar.gz

This creates a directory apache-tomcat-x.x.x. It is always a good practice to rename the directory and give it some meaning full name:
$ mv apache-tomcat-x.x.x test-tomcat

Set JAVA_HOME
$ export JAVA_HOME=/usr/java/jdk1.6.0_5/bin

Optionally set CATALINA_HOME (If you are running only one instance).
$ export CATALINA_HOME=/opt/test-tomcat

Remember to put the above entries in user's .bash_profile.

Starting tomcat:

$ cd ~/test-tomcat/bin/
$ chmod u+x *.sh ( so that the sh scripts can be executed)
$ cd ~/myservlet/ (where you store all config files needed by your servlet)
$ ~/test-tomcat/bin/startup.sh

Note: Normally any output/log file generated by your Servlet will be created in the directory where you started tomcat from. I generally use a directory named after my servlet. For this tutorial i am using used ~/myservlet as the directory.

If your servlet isn't generating logs of its own then you can view the logs in ~/test-tomcat/logs/ directory. This directory has many files. Two files are particularly important.
1. catalina.out is the main log file (watch out this grows faster in a big site with more hits & logging).
2. There are also individual files for each day (eg format: catalina-yyyy-mm-dd.log).

As i said above, tomcat service listens on port 8080 and serves webpages/ servlets through it. It also listens on following default ports:

8005 - Shutdown port (you can telnet to this port from localhost and shutdown the tomcat service by issuing SHUTDOWN in the telnet session. Afaik, You cannot enable this for remote connections).

8009 - AJP connector port (used to connect this tomcat instance with other tomcat or apache instances. Apache communicates with tomcat through this port).

8443 - SSL port (disabled by default).

To make life easier add aliases for shutting down and starting the tomcat instances:
$alias tomcat-down=~/test-tomcat/bin/shutdown.sh

$ alias tomcat-up= cd ~/myservlet ; ~/test-tomcat/bin/startup.sh

Remember to put alias entries in ~./bashrc. Also note that the above alias entry will work only if tomcat is installed in that user's home directory.

Using the same LUN in multiple servers

2008-03-11T01:40:00.001+05:30

Setting up SAN and sharing a single LUN to multiple servers.

When i first started working in SAN all i knew was that i can create LUNs (a slice of space in the storage) and use them in the servers as drives. What i didn't know was that i cannot (and should not) access the same LUN from multiple servers simultaneously (I learned it the hard way).

Usually I test things before putting them in production. In my first attempt i created a LUN and made it as a part of two Storage Groups, each with one server.

Well, i could see the 'test' LUN in both servers and mount it in those machines simultaneously. Tried to write some data in the LUN from server1 and view it from server2. It did not show up.I could not even list the files written in server1 from server2 or vice versa. It is actually not a problem with SAN or server. The problem was with my setup. While i can assign the same LUN to multiple storage groups, one LUN must NOT be accessed from both servers simultaneously. We ended up losing data here.

But why?

Because, there is no way for a server to know about the disk blocks changed by the other server. Since LUNs are presented to servers as scsi drives servers cannot cordinate changes in disk blocks without special programs. We need clustered file systems for this. A clustered file system is a file system which is simultaneously mounted on multiple servers. There are several file system clustering softwares such as GFS, OCFS, Veritas CVM, luster etc.

We will now see how to configure GFS.

The below described installation was done with the following setup:
SAN Storage box
SAN Fibre switch - Brocade
4 servers - Each connected with 1 HBA card and connected to SAN directly. I had 4 RAID groups each with one server. 2 servers( cluster nodes) were running with Centos 4.4 and the other two with 4.3
Create 1 LUN in the SAN and assign it to all Raid groups.

Note: I used dlm as cluster locking method. More on that later.

To know more about setting up the hardware click here
Official documentation of setting up GFS can be found here

Below are few things to be done before implementing GFS:

You will be doing the whole setup as root.

Make sure clocks on the GFS nodes are synchronized (I used ntp for this).

You will need one fencing device for the cluster to work. I used Brocade Fabric Switch for fencing. GFS will not work without fencing.

Always make sure that the kernel you use has gfs modules. Some kernels don't. All you have to do is to install a kernel with gfs support and boot the server with that kernel (i used 2.6.9-55.0.2.ELsmp)

We will use one server (server node) for deploying the config across other nodes. Enable password less login from this server to other nodes in the cluster.

You will need GUI mode in the server node for doing cluster configuration. I have given a sample text configuration file also for those who don't have GUI access. The file can be used as is (ofcourse after substituting your values)

All the nodes & fencing device in the cluster must be in the same subnet. Else you may have to configure multicast.

FQDN names of all nodes must be resolvable. Else put appropriate entries in /etc/hosts

Also keep the following details handy

Number of file systems ( 1 in my case). More can be added later.
File-system name (sk)
Journals ( I used 4)
GFS nodes ( 4 )
Storage devices and partitions

You can easily install Cluster Suite & gfs from the csgfs repo, as explained below (run these commands as root in all nodes and the server).


# cd /etc/yum.repos.d/
# wget http://mirror.centos.org/centos/4/csgfs/CentOS-csgfs.repo
# rpm --import /usr/share/doc/centos-release-4/RPM-GPG-KEY

# yum install rgmanager system-config-cluster magma magma-plugins cman cman-kernel dlm dlm-kernel fence gulm iddev GFS GFS-kernel gnbd gnbd-kernel lvm2-cluster GFS-kernheaders gnbd-kernheaders

Note: If you want the server to run with smp kernel install the appropriate rpms (eg: cman-kernel-smp)

Boot the server with the new kernel (that has gfs support). Repeat this in all cluster nodes and server node.

Configuration Steps:
Step1: Defining & creating the cluster config

In the server node type:
# system-config-cluster

Choose File->New
Give cluster name
Choose DLM as locking method
Click ok to accept the configuration.

Then you will see the cluster you just created.

Step 2: Adding a fence device

Click on Fence devices and Add a Fence Device. A window named Fence Device Configuration opens up. Choose the device you have for fencing (mine is Brocade Switch).
Fill Name, IP adress, Login & Password for the device.
Click ok to accept the changes.

Step 3: Adding a node to the cluster
In the cluster window choose cluster nodes and click on add a cluster node
Give the FQDN of the server node. Leave the quoram vote blank. Click ok.

Step 4: Adding fencing for the node
Choose the node you just added.
Click on Manage fencing for this node. This will open a new window called Fence Configuration.
Now choose add a fence level. No need to enter anything.
Click Close (make sure that the fence level is added for that node. You will see the details if you click on the node name).

Repeat the steps 3 & 4 for all other nodes. Substitute the other node names instead of server node name in Step 3.

Save the config file (default: /etc/cluster/cluster.config). You will now get a Send to cluster button. Click that button to copy the config file in all the cluster nodes (this will be done through scp; that is why we configured the server to login to nodes without password).

Below is a sample config file: $cat /etc/cluster/cluster.conf

<cluster alias="Test" config_version="1" name="Test">
 <fence_daemon post_fail_delay="0" post_join_delay="3"/>
 <clusternodes>
         <clusternode name="server1.examplenet" votes="1">
                 <fence>
                         <method name="1"/>
                 </fence>
         </clusternode>
         <clusternode name="server2.example.net" votes="1">
                 <fence>
                         <method name="1"/>
                 </fence>
         </clusternode>
 </clusternodes>
 <cman expected_votes="1" two_node="1"/>
 <fencedevices>
         <fencedevice agent="fence_brocade" ipaddr="x.x.x.x" login="user" name="Switch" passwd="test"/>
 </fencedevices>
 <rm>
         <failoverdomains/>
         <resources/>
 </rm>
</cluster>

You can also create your own file in text mode and copy it to the nodes. Enter other nodes info in the config file between the tags as found in the above example.

Step 5: Check if you have all needed modules

Verify that the configuration is copied to all the servers and then proceed.

Reboot all the nodes with gfs kernel and check whether they have gfs & dlm enabled. Below are the steps and output from my server node:

# lsmod|grep gfs
gfs                   290652  0
lock_harness            8992  2 gfs,lock_dlm
cman                  124896  3 gfs,lock_dlm,dlm

# lsmod|grep dlm
lock_dlm               44640  0
lock_harness            8992  2 gfs,lock_dlm
dlm                   116580  1 lock_dlm
cman                  124896  3 gfs,lock_dlm,dlm

If nothing shows up, please follow the below steps:

# modprobe gfs
# modprobe lock_dlm
# modprobe dlm

To make the modules persistent, put the below lines in /etc/rc.modules

# echo modprobe dlm >> /etc/rc.modules
# echo modprobe lock_dlm >> /etc/rc.modules
# echo modprobe gfs >> /etc/rc.modules
# chmod +x /etc/rc.modules

Also turn on all these cluster services with chkconfig: ccsd, cman, fenced, clvmd , gfs, rgmanager, clvmd (only if you are planning to cluster LVMs).

Proceed to Step 6 only if step 5 is Successful ie., if all modules get detected after a fresh reboot of the server.

Step 6: Making a GFS partition or LVM (Do this only if Step 5 was successful)

Now we are going to create a clustered File system(GFS) partition in the server and use it in all nodes.

In the server, create a partition inside the LUN drive (now shown as scsi drive in the server). It can be a normal partition or LVM. Below are the steps to create a clustered LVM ( in my system the LUN disk was scanned as sdb; Verify & substitute your's in the below config).

# fdisk /dev/sdb
Create one partition.

Choose either of the two options.

Step 6: Option 1

# pvcreate /dev/sdb1
# vgcreate VG /dev/sdb1
# vgchange -aey VG  (To make it as clustered VG)

# lvcreate -L1023G -n LV1 VG  ( Remember to substitute the size of your disk )
# gfs_mkfs -p lock_dlm -t Test:sk -j 8 /dev/VG/LV1

Step 6: Option 2
For a normal partition command would be:
# gfs_mkfs -p lock_dlm -t Test:sk -j 8 /dev/sdb1

Note: I have used Test:sk; you can substitute your clustername:fname here.

Above gfs_mkfs command creates the gfs file system in our test LV, LV1.

Step 6a: Activating clustered LVMs (Optional - Skip this if you are using an ordinary partition).

Since we used a clusted LVM you have to modify the following two lines in the /etc/lvm/lvm.conf file. Do this in all nodes and server node:


locking_type = 2 (by default it is 1)
locking_library = "liblvm2clusterlock.so"

After this restarting clvmd will show up all logical volumes inclusive of clustered LVMs. Note: You have to restart clvmd in all nodes. Rebooting all the nodes & server may solve the problems many times.

Step 8: Mounting the GFS parition/LVM in all nodes

Issue this command in all cluster nodes and server node.

For normal partition:
# mount -t gfs /dev/sdb1 /mnt

For CLVMs:
# mount -t gfs /dev/VG/LV1 /mnt

You can now write a data in /mnt and access it from the other server without problems.

To make the mounting points permanent after next reboot, put the below entry in /etc/fstab of all nodes and server:

For Normal Paritions:
/dev/sdb1 /MyData gfs defaults 0 0

For CLVMs:
/dev/VG/LV1 /MyData gfs defaults 0 0

GFS module in CentOS RPM

2008-03-11T01:16:00.004+05:30

How to check if the kernel you have in the server has gfs modules?

When i was installing gfs support in one of my servers i wanted to check whether the kernel i used was having gfs modules. Without that i cannot make gfs work. It was simple to find out.

After installing the kernel and gfs rpms, just list the files under the kernel modules directory:


# cd /lib/modules/2.6.9-55.0.2.ELsmp
# ls kernel/fs/
autofs4  cramfs    ext3  freevxfs  gfs_locking  hfsplus  jffs2  msdos  nfs_common  nls    udf
cifs     exportfs  fat   gfs       hfs          jbd      lockd  nfs    nfsd        smbfs  vfat

You can even list the files in gfs and gfs_locking directories


# ls kernel/fs/gfs
gfs.ko

# ls kernel/fs/gfs_locking/
lock_dlm  lock_gulm  lock_harness  lock_nolock

It will be tricky if you want other modules like xfs. You need to find a kernel RPM that has both xfs & gfs module rpms or if you have time to play you can compile them all yourselves.

Intro to SAN config

2008-02-26T00:33:00.006+05:30

I am trying to explain the terms used while configuring SAN. You can use the below details as reference for creating/reconfiguring LUNs in a SAN Storage.

The Model i worked on is EMC CX-320C. It had two DAEs (Disk Arrary Enclosures). DAE1 was populated with FC Drives and DAE2 was populated with SATAII. You must be able to figure out the options in other Storages easily.

EMC has an web interface for configuring the drives, RAID levels and to prepare them for storing data. It is called Navisphere Manager.

In the EMC's interface you will see a list of things - Hosts connected to the SAN, physical interfaces, SPA, SPB details ( drives in that ), RAID Groups and Storage Groups. Initially there wont be any RAID/Storage Group.

First we have to configure the drives into specific RAID (0/2/5) groups and then add them to a Storage group.

RAID Group: (RG)
A collection of drives operating in a RAID. When creating a new RAID group you have to specify the following:
1. RAID group id (Unique).
2. Number of disks you are going to add (you can select the drives from specific DAE).
3. RAID Type - HotSpare, Disk, Unbound (more on this later). If selecting more than 3 drives RAID 0,3,5 will show up.

Best practices while creating RGs:
1. Do not combine the different disk types into single RG. Combining them will make the RAID array to operate in lowest speed available.eg: Create separate RGs for FC drives and SATAII drives. Combining them will make FC drives to operate in SATAII's speed.
2. Remember to have one drive as global hot spare for the whole array/DAE so that it will kick in when one of the drives in the array fails.
3. RAID0 is for highest performance (no redundancy) while RAID5 is for high redundancy (ofcourse has performance hit).
4. Do not combine drives from 2 DAEs to a single RG even if they are of same type and speed.

LUN:

After Creating a RAID group you will create LUNs. LUNs are nothing but partitions presented as (scsi) drives to servers. LUNs are always a part of the RAID group. You cannot assign a RG as whole to a Storage Group, instead you will assign individual LUN/s to SG/s.

If you have specified 'unbound' as RAID type while creating RG, you can specify the RAID type when creating a LUN. Remember all LUNs in a RG must of same RAID Type.

Storage Group:

Storage Group is a collection of all info: LUNs, Hosts, SAN Copy connections etc., (we have all these three and there may be more that i am not aware of). A unique name must be given for every storage group.

Create a Storage group as you desire and add LUNs and hosts to it. You can either select LUNs & connect hosts from the Storage group or add LUN to a Storage Group from a RG.

Note the following:
1. You can add one LUN to multiple storage groups. But remember that only one server from the SGs must access the LUN. If you want more than one server to access a single LUN simultaneously then that LUN must be configured as a file system cluster (eg: gfs).
2. You can add a host to only one SG. Adding the same host to another SG will remove the host from the old SG.
3. There can be as many LUNs in a SG.

Vsftpd and iptables

2007-09-07T12:40:00.000+05:30

In one of our servers we were running vsftpd service. iptables was setup to allow ports 21 and 20(data). Still after the user logs in, the connection dies when trying to enter passive mode.

Entry: /sbin/modprobe ip_conntrack_ftp

was already there in /etc/rc.local

still the module was not loaded by default, Since iptables unloas all modules automatically everytime it starts.

Change the below lines to change this behavior:

ip_conntrack_ftp 76273 0 ip_conntrack 45573 1 ip_conntrack_ftp IPTABLES_MODULES_UNLOAD="no" # Makes all modules to be persistent

Restart the service and check whether the conntrack module is loaded

# service iptables restart # lsmod|grep ip_conntrack

Worked liked charm. Now i could login to the ftp service and enter passive mode.

EMC SAN and GFS

2007-08-05T00:36:00.001+05:30

Currently i am working on configuring gfs, with 3 servers using the same LUN from a EMC SAN storage. Will be posting the configuration steps shortly.

Configuring pop3-secure(SSL)- Dual MTA Contd...

2007-05-19T12:00:00.001+05:30

Continuing my previous post.

Below procedure shows the steps to configure pop3 with SSL.


cd /service/
svc -d qmail-pop3d/
cd /var/qmail/supervise/
mkdir qmail-pop3d-secure
mkdir qmail-pop3d-secure/log

vi qmail-pop3d-secure/run


#!/bin/sh exec /usr/local/bin/softlimit -m 20000000 \ /usr/local/bin/tcpserver -H -R -v -l 0 -c100 0 995 \ /usr/sbin/stunnel /var/qmail/control/pop3s.conf 2>&1

# cd /var/qmail/control

# vi pop3s.conf

cert = /var/qmail/control/servercert.pem
exec = /var/qmail/bin/qmail-popup
execargs = qmail-popup example.net /home/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir

# mkdir -p /var/log/qmail/qmail-pop3d-secure
# chown -R qmaill.root /var/log/qmail/qmail-pop3d-secure
# cd /var/qmail/supervise
# cp qmail-pop3d/log/run qmail-pop3d-secure/log/
# chmod 755 qmail-pop3d-secure/run

Dual MTA Qmail - Contd...

2007-05-11T23:01:00.000+05:30

OS: CentOS4.4(64bit)

For the inside queue(that scans and delivers mail) i followed the instructions from qmailrocks. Disk space, pre-installation check list & other instructions are here

Note: I installed vpopmail without mysql since the number of domains i manage is small. If you are going to have more than 10 domains consider using vpopmail with mysql backend. Remember to replace all example.net entries with your own domain. For hostnames enter the FQDN of your server.

After installing qmailrocks, make sure that mails to & from your domain works. The qmail installation from qmailrocks listens on port 25, alter it to listen on port 2000.

Last few lines in '/var/qmail/supervise/qmail-smtpd/run' looks like this

# tail -4 /var/qmail/supervise/qmail-smtpd/run


/usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" 127.0.0.1 2000 \
/var/qmail/bin/qmail-smtpd your.hostname.here \
/home/vpopmail/bin/vchkpw /usr/bin/true 2>&1

With the above setting, the QMR installation will serve us as a separate queue which will scan any mail that comes to it. Now we have everything setup to install our other queue.

Note: I used /var/qmail-inside as my qmail directory(for all incoming mails). You can choose any other directory you want. Also for this queue i patched qmail with jms's combined patch set 6cd

Below are the steps:


cd /usr/local/src
wget ftp://ftp.jp.qmail.org/qmail/qmail-1.03.tar.gz
wget http://qmail.jms1.net/patches/qmail-1.03-jms1.6cd.patch
wget http://untroubled.org/qmail-qfilter/qmail-qfilter-2.1.tar.gz
wget http://qmail.jms1.net/scripts/service-qmail-send-run
wget http://qmail.jms1.net/scripts/service-qmail-smtpd-run
tar zxfv qmail-1.03.tar.gz
mv qmail-1.03 qmail-inside
cd qmail-inside/

Edit conf-qmail and change the directory entry from /var/qmail to /var/qmail-inside


echo 211 > conf-split
echo 255 > conf-spawn
patch < /usr/local/src/qmail-1.03-jms1.6cd.patch make setup check

Next we have to copy create necessary control files for qmail. Copying all the control files from the /var/qmail/control will do. But we have remove some unwanted files too. virtualdomains file has the names of the virtual domains created with vpopmail. However, having this file means that the mail will be directly delivered to the vpopmail user rather than passing it to out other queue.


cd /var/qmail-inside/control/
cp /var/qmail/control/* /var/qmail-inside/control/
rm -f virtualdomains.lock locals.lock rcpthosts.lock clientcert.pem
rm -f virtualdomains

It is better to link some files directly from /var/qmail so that when there are new virtual domains we don't have to change the file each time we add a new virtual domain.


/var/qmail-inside/control
rm -f rcpthosts
ln -s /var/qmail/control/rcpthosts
rm -f plusdomain
ln -s /var/qmail/control/plusdomain

Now we are gonna created necessary aliases and cbd file.


cd /var/qmail-inside/alias  echo "postmaster" > .qmail-root
echo "postmaster@example.net" > .qmail-postmaster
echo "postmaster" > .qmail-mailer-daemon
cp .qmail-root .qmail-abuse
echo "127.0.0.1:allow,RELAYCLIENT=\"\"" > /etc/tcp.smtp.inside
tcprules /etc/tcp.smtp.inside.cdb /etc/tcp.smtp.inside.tmp < /etc/tcp.smtp.inside

Next step is to create all supervise and log directories


mkdir -p /var/qmail-inside/supervise/qmail-inside-send/log
mkdir -p /var/qmail-inside/supervise/qmail-smtpd-25/log
mkdir -p /var/qmail-inside/supervise/qmail-smtpd-465/log
chmod +t /var/qmail-inside/supervise/qmail-inside-send
chmod +t /var/qmail-inside/supervise/qmail-smtpd-25
chmod +t /var/qmail-inside/supervise/qmail-smtpd-465
mkdir -p /var/log/qmail-inside/qmail-inside-send
mkdir -p /var/log/qmail-inside/qmail-smtpd-25
mkdir -p /var/log/qmail-inside/qmail-smtpd-465
chown -R qmaill /var/log/qmail-inside/
chown vpopmail.qmail servercert.pem

Create run files for both smtpd instances:
vi /var/qmail-inside/supervise/qmail-smtpd-25/log/run


#!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s2500000 /var/log/qmail-inside/qmail-smtpd-25

vi /var/qmail-inside/supervise/qmail-inside-send/log/run


#!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t /var/log/qmail-inside/qmail-inside-send

Now we are going to create the supervise directories:


cd /var/qmail-inside/supervise
cp /usr/local/src/service-qmail-smtpd-run qmail-smtpd-25/
cp /usr/local/src/service-qmail-smtpd-run qmail-smtpd-465/
cp /usr/local/src/service-qmail-send-run qmail-inside-send/
cp qmail-smtpd-25/log/run qmail-smtpd-465/log/

vi qmail-smtpd-465/log/run

change the directory qmail-smtpd-25 to qmail-smtpd-465


chmod 755 qmail-smtpd-465/log/run qmail-smtpd-25/log/run\ qmail-inside-send/log/run
cd /var/qmail-inside/supervise/qmail-inside-send/
mv service-qmail-send-run run

Edit the file run: vi run

and change the following entries


VQ=/var/qmail to VQ=/var/qmail-inside

and save the file


chmod 755 run
cd ../qmail-smtpd-25/
mv service-qmail-smtpd-run run
vi run

Change the following:


VQ="/var/qmail-inside"
SMTP_CDB="/etc/tcp.smtp.inside.cdb"
GREETDELAY=30
IP=0

uncomment RBLSMTPD_PROG, RBL_BAD , save the file and make it executable.
# chmod 755 run

We have to install sslserver for enabling secured smtp connections(i configured it to listen on port 465).

Installing sslserver


cd /usr/local/src/
wget http://www.superscript.com/ucspi-ssl/ucspi-ssl-0.70.tar.gz
cd /package/
tar zxfv /usr/local/src/ucspi-ssl-0.70.tar.gz
cd host/superscript.com/net/ucspi-ssl-0.70
package/compile
package/rts  # output should be empty
package/install
cd /var/qmail-inside/supervise/qmail-smtpd-465/
mv service-qmail-smtpd-run run
vi run

change the following


VQ="/var/qmail-inside"
SMTP_CDB="/etc/tcp.smtp.cdb"
QUSER=vpopmail
IP=0
PORT=465
SSL=1
AUTH=1
REQUIRE_AUTH=1

Save the file


chmod 755 run
cd /var/qmail-inside/control/
echo ":127.0.0.1:2000" > smtproutes
cd /service/
ln -s /var/qmail-inside/supervise/qmail-smtpd-25/
ln -s /var/qmail-inside/supervise/qmail-inside-send/
ln -s /var/qmail-inside/supervise/qmail-smtpd-465/

ps -ef|grep qmail-inside

will show that the processes are started and running. Check the corresponding services logs and make sure that they don't throw errors.

If you followed the above steps word by word then, log files for the above services will be at: /var/log/qmail-inside/qmail-smtpd-25/current and /var/log/qmail-inside/qmail-smtpd-465/current

Errors and fixes:
When configuring your mail client to send mail you get auth failure. You have to use useid@example.net as username. Also make sure that SSLis enbaled and the port is set as 465.

Dual MTA with Qmail

2007-05-08T23:44:00.001+05:30

Recently i installed two qmails in a single server to handle mails from inner and outer domains. I will be posting a step by step tutorial of the same in the coming days.

Why dual MTA?

Basically i wanted two different queues to handle mails in different ways.
Queue 1) To get the mails(incoming) and pass it on to queue 2.
Queue 2) Will receive mails only from queue 1, runs virus scan, spamassassin and delivers mails to local or remote mail boxes(outgoing).

While i could have achieved the same functionality with single queue i doubted it may not suit my needs in the future. Say if the server can handle 250 mails and the queue is already full then we may see some delay in receiving mails from remote machines and/or may completely loose some mails. More over I don't have to change the incoming queue's setup and continue receiving mails until i needed. It provides me the flexibility to pass the message to different server/s altogether whenever needed.

How the setup will look like?

Queue 1: Two qmail-smtpd instances one listening on port 25 and the other listening on port 465(SSL).
port 25 - To receive mails from public domains such as yahoo/google.
port 465 - For internal users to send mails(auth + encryption).

Queue 2: qmail-smtpd listens on port 2000. Receives mail only from localhost(127.0.0.1). Calls qmailscanner and have it scanned with clamav & spamassassin. If it has virus the mail is quarantined. If tagged SPAM then the mail's subject is prepend with [SPAM] and delivered to user's mail box. If the user is local, the mail will be delivered to Junk directory.

Also there were some specific needs for me. We had many aliases in the server and only certain people must be able to send mail to those aliases. While this can be done with mailing list software like ezmlm i thought of discovering more. When a unauthorized user sends a mail to particular alias it will send a mail to the moderator. I wanted the mail to be bounced back to the sender(ezmlm has that option) and also give my own message for the bounce(reason). I wrote my own perl script to achieve this and it was simple enough. Ezmlm is also installed in my server and serving other purposes.

Enough for tonight. I will be posting a step-by-step guide in couple of days.

Cleaning Up Data with Perl

2006-09-14T12:17:00.001+05:30

We had a peculiar problem. We got a plain text file of about 150G. The file had many records in it. Most of the records had control characters like ^M(equivalent to \n in Unix), ^@(0x000) & tabs. We tried to view the record and count the characters in each. But the word count for each record varied as there were special and control characters. Some records did not have \n at the end and were merged with the next record. Trying to open the file in vi was horrible. Only thing we knew was the record size. We tried to remove the control characters with sed and see what happens.

But sed hanged after processing 6G and took very long time ( 6 Hrs for 6G ). So i thought of doing this with perl. I posted the question in the perl forums and got a good solution. The solution was to read n characters(where n = each record size that we already knew), remove special characters from them and append \n to the end and write it in a new file. That worked fine! Below is the perl code i used:


#! /usr/bin/perl
# Script to Remove control characters from the BIG data file and print
the output -
# Note: Redirect the output to a new file while calling this from bash.
open(MYINPUTFILE, @ARGV[0]);
$/=\1000;
while(<MYINPUTFILE>){
s/[[:cntrl:]]/ /g;
print "$_\n";
}
close(MYINPUTFILE);

I got this solution from perl forum

PGP - Encryption, mails and files

2006-08-26T20:43:00.001+05:30

About Peculiar problem i encountered.

One of my colleagues wanted to send a pgp public key to the client. I thought it was for encrypting mails and created a key pair in Openpgp(Thunderbird) and sent the public key. But at last it turned out that the key was used to encrypt files and not mails.

We have to use gpg command in linux for encrypting/decypting files. I tried importing the public key(that i sent) to the gpg keyring in the machine that had encrypted files.
$gpg --import <public-key-file

and tried decrypting the file:
gpg -o output-file --decrypt encrypted_file

But it did not work. By no way i could decrypt the files. Then a thought stuck me that "Shouldn't i import the private key to decrypt the file rather than the public key". So, i tried the key management tool in
Openpgp(Thunderbird). In that i selected my key and exported it to a file. I compared that key file with my public key. I noticed that the file that i exported from Thunderbird had both private and public key
info. I copied the key file to the system having all the encrypted files. Then i imported the copied key
to the keyring with:
#gpg --import keyfile eg: gpg --import my.key.asc

This imported both the public key and secret key(private key). I could see the keys with:
#gpg --list-keys
#gpg --list-secret-keys

Then i used gpg to decrypt the files:
gpg gpg -o output-file --decrypt encrypted_file

This did the trick and i was able to decrypt all the files one by one.

Converting Mysql table to CSV

2006-08-23T20:15:00.001+05:30

Trying to export the data from mysql to csv will end up in creating the csv file in the mysql data directory (/var/lib/mysql). Use this method to covert the individual tables from mysql to CSV format

$mysql -u <username> -h <hostname> <databasename> -p -B -e "select * from table;" | sed 's/\t/","/g;s/^/"/;s/$/"/;s/\n//g' > test.csv

Note: The whole command above must essentially be in a single line

My New Tech Blog

2006-08-17T21:12:00.000+05:30

I had a tech blog at livejournal and making new post there was time consuming(had to login to livejournal to post new entries). Mails to journal id was allowed only for paid customers.

I have a different blog for my personal events here which allowed me to post the from anywhere by just sending a mail. I like this feature very much in blogger and am posting all the blogs i had in liverjournal to blogger(this blog). I will be using this new blog to post all my further findings/experiments in Linux and other technologies that interests me.

I am posting the blogs here from livejournal with the same date i posted there so as to remember things and days. So you will see back dated posts here.

Thanks! for reading this.

Find Files

2006-05-08T06:20:00.000+05:30

Commands to find files:

Files modified with in 24 hours and list them

find / -mtime 1 -exec ls -l {} \;

Same but copies to /tmp

find / -mtime 1 -exec cp {} /tmp \;

Other options:
-atime n Finding files that were accessed n days ago. You can also use the +n for finding files that were accessed over n days ago, or even -n for finding files that were accessed less than n days ago.
-mtime n Same as -atime but here we find files that were modified n days ago.
-ctime n Same as -atime and -mtime but here we find files that were changed n days ago.
-newer file Find files that have been modified more recently than file.

More help here

Changing hostname in Solaris

2005-06-24T04:27:00.000+05:30

Just edit the following files and substitute each occurrence of the old hostname with the new one.

Changing the following files entry will make hostname changes permanent.

/etc/hosts
/etc/nodename
/etc/hostname.xxn
(xxn = network interface, such as hme0)

You can change the entries in below files too. But they are all optional:
/etc/net/ticlts/hosts
/etc/net/ticots/hosts
/etc/net/ticotsord/hosts
/etc/inet/ipnodes
(if this file exists and if a hostname entry exists)

hostname newhostname will change the hostname instantly.

Some commands that may help

2005-05-03T12:56:00.000+05:30

Suppose you have a file named file.txt which has hunders of lines and you want to see lines 100-120

head -120 file.txt|tail -20

Find and replace text in vi: 1,$s/oldvalue/newvalue/g (or) :%s/oldvalue/newvalue/g

More help with vi here: http://www.ahinc.com/linux101/vi.htm

Error message

2005-04-17T06:22:00.000+05:30

While compiling packages, sometimes you get the error message like: undefined reference to 'errno'

To fix this add: #include at the beginning of error.h

And the compilation will go on smoothly, thereafter.

Centralised log server

2005-04-03T08:26:00.000+05:30

Here are fews links that will help collecting the logs from linux and windows clients to a centralised syslog server:

http://www.sans.org/rr/whitepapers/casestudies/713.php

http://ntsyslog.sourceforge.net/
http://www.kiwisyslog.com
http://www.netadmintools.com/art127.html

Samba Without Roaming profile

2005-01-03T09:50:00.000+05:30

When configuring samba server as PDC some times you may want to create users without roaming profile.

The solution is client side: gpedit.msc leads you to the policy editor
Computer Configuration\Administrative Templates\System\User Profiles
Enable both the "Prevent Roaming Profile changes from propagating to the server" setting and the "Only allow local user profiles" setting and it will do the trick.

More Additions

2004-11-17T08:43:00.000+05:30

How to run your own yum repository? Read this:
http://www.linux.com/article.pl?sid=04/07/22/1718242

Thread about A perfect yum.conf file here:
http://www.redhat.com/archives/fedora-list/2004-May/msg05704.html

Linux Encyclopedia:
http://stommel.tamu.edu/~baum/linuxlist/linuxlist/linuxlist.html

Some Tips:
http://linuxportal.pp.ru/modules.php?name=Sections&op=viewarticle&artid=388

Some tools here:
http://sabernet.home.comcast.net

Configuring SQUID GUARD:
http://www.aerospacesoftware.com/squidguard-howto.html

Blocking SPAM in qmail:
http://www.linuxquestions.org/questions/history/188474

Some new entries for Linux

2004-11-04T20:03:00.000+05:30

This has a A-Z list of all available softwares for linux:
http://stommel.tamu.edu/~baum/linuxlist/linuxlist/linuxlist.html

Some Advice for participating in user groups, or mail lists.
http://catb.org/~esr/faqs/smart-questions.html

How did windows became so insecure Read:
http://www.kernelthread.com/publications/security/uw.html

Designing some Simple Front Ends with Dialog/Xdialog:
http://linuxgazette.net/101/sunil.html

Using SMTP AUTH and STARTTLS with sendmail
http://www.joreybump.com/code/howto/smtpauth.html

Linux Vs Windows

2004-11-02T06:22:00.000+05:30

Here are some links comparing Linux vs Windows:
1. http://www.theregister.co.uk/security/security_report_windows_vs_linux/

2. http://www.securitypipeline.com/showArticle.jhtml?articleId=50500004

How did windows became so insecure read:
http://www.kernelthread.com/publications/security/uw.html

This is from novell abt the argument that windows is secured than Linux
http://www.novell.com/linux/truth/

"Why I hate Microsoft" intsresting link:
http://www.euronet.nl/users/frankvw/rants/microsoft/IhateMS.html

Some nice links for linux

2004-10-27T04:27:00.000+05:30

Here are few links that i read:

http://linux-ip.net/html/nat-stateless.html

http://linuxreviews.org/dictionary/NAT/#Masquerading

Now with iptables NAT i use iproute for routing. Its easy to configure.

This helped me a lot:
http://linux-ip.net/html/adv-multi-internet.html

Here you can learn some more(for best understand before doing):
http://lartc.org/howto/lartc.rpdb.multiple-links.html

I have done this too(but may not help you though just for reading:
http://www.ssi.bg/~ja/nano.txt

Don't miss to read the links inside the above links.

This one has a lot of help about security. Once surf this, you will go mad(like me) worrying about security(once done everything you will feel like heaven):
http://www.linuxquestions.org/questions/showthread.php?threadid=45261

I will add more as & when i find them

HTH some one