Studying for RHSCA and RHCE
Autor: Lutieri G. B. | Publicado: 2012-01-03T21:34:00-02:00

My recent posts were about things that I was playing around and are related to topics that are covered in RHSCA and RHCE exams. 

I'm preparing myself to take this exams in february/2012 and I need some place to store my notes. Here you will find small tips, tricks, common switches, commands, etc. This is all stuff that I need to know in order to succeed the exams. And it's also stuff that I know I have to play with and write down to help memory retain the information.

let the show begin....


Querying RPMs
rpm -qi xxx -&gt; query info. same as yum info xxx
rpm -q --scripts xxx -&gt; query scripts
rpm -ql xxx -&gt; list of files inside the rpm.


any of the above can also have the -p switch. this will consider the xxx as a local rpm file. not an installed package

rom -qf /sbin/service -&gt; will show which packege contains the /sbin/service file 
rpm -qa -&gt; query all installed packages

Extract files from rpm:
rpm2cpio xxx | cpio -idmv&nbsp;
if you run rpm -qlp xxx and see the one file that you want you can extract it running the following:

rpm2cpio xxx | cpio -idmv&nbsp;./etc/apt/sources.list.d/rpmforge-extras.list

Please don't forget the dot in front of the filename. otherwise no files will be extracted.

Querying installed packages

If you want to know if a package is installed use:

yum list "*http*"
It will list the Installed Packages and also the Available Packages. Yum list only search for the packages name. Yum search searches also in the description of the package.

Installing RPMs
yum localinstall xxx.rpm works just like rpm -ivh xxx.rpm but will also solve the dependencies if necessary.


Creating RPMs

yum install rpm-build make -y
mkdir -p /usr/src/lutieri/{BUILD,RPMS,SOURCES,SPECS,SRPMS,tmp}
cd /usr/src/lutieri/
mkdir sample
cd sample/
touch first_file second_file keys config_file
cd ..
tar -cf sample.tar.gz sample/
mv sample.tar.gz SOURCES/

create a spec file in SPECS: run vim foo.spec -&gt; vim will load a template for you :-D

rpmbuild  -v -bb SPECS/sample.specOR

rpmbuild -v -bb --sign SPECS/sample.spec
the former example works if you have the rpmmacros set correctly. then the package will be built and signed.

Instead of creating all those directories, create the .spec file and run with rpmbuild. it will create all the directory structure in ~/rpmbuild/. then move the .spec to ~/rpmbuild/SPECS and the tar to ~/rpmbuild/SOURCES and run rpmbuild again against the .spec.

OR 

Install rpmdevtools and run rpmdev-setuptree. This will also create the folder structure in the home directory


in the SPEC file , under the sessino %files you should specify every file that this package is responsible for.
%files
%defattr(-,root,root,-)
%dir /root/package
%attr(755,root,root) /root/package/script.sh
Instead of use cp to copy files to a specific location, use install -D

Signing a package

gpg-agent --daemon
gpg2 --gen-keys
gpg2 --list-keys
gpg2 --export -a lutieri2 &gt; RPM-GPG-KEY-lutieri2
su -
rpm --import /home/lutieri/RPM-GPG-KEY-lutieri2
exit
vim ~/.rpmmacros
%_signature gpg
%_gpg_name lutieri2
rpm --addsign rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm
rpm --resign rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm
rpm --checksig rpmbuild/RPMS/i386/lutieri-1.1-0.i386.rpm
Run man rpm and search for macro.. this will show you what goes inside the .rpmmacros files.


all the keys imported into RPM DB are considered packages. take a look:
rpm -q gpg-pubkey --qf "%{name} - %{version} - %{release} -&gt; %{summary}\n"
gpg-pubkey - c105b9de - 4e0fd3a3 -&gt; gpg(CentOS-6 Key (CentOS 6 Official Signing Key) )
gpg-pubkey - 8cee003f - 4f03b71a -&gt; gpg(lutieri )
gpg-pubkey - cf7fe955 - 4f03bacf -&gt; gpg(lutieri2 )

rpm -qa gpg-pub*
gpg-pubkey-cf7fe955-4f03bacf
gpg-pubkey-8cee003f-4f03b71a
gpg-pubkey-c105b9de-4e0fd3a3
thus, to remove lutieri2 key. issue:


rpm -e gpg-pubkey-cf7fe955-4f03bacf




Create a repository:

yum install -y createrepo
mkdir /opt/myrepo
mv *.rpm /opt/myrepo
createrepo /opt/myrepo
vim /etc/yum.repos.d/lutieri.repo
[lutieri]
Baseurl=file:///opt/myrepo
name=lutierirepo
enabled=1
man yum.conf shows you the options that goes in the .repo files.

If later on you add new RPMs to the directory run the following to update de metadata:createrepo -update /opt/myrepo&nbsp;

--------------------------------------------------

Network

on ifcfg-* files, the option NM_CONTROLLED="NO" will not allow network manager to manage this interface 

Bonding:
vim&nbsp;/etc/modprobe.d/bonding.conf
alias bond0 bonding

To find out what options are necessary in the master interface do the follwing
find /usr/share/doc/kernel-doc* -iname "bond*"

less&nbsp;/usr/share/doc/kernel-doc-2.6.32/Documentation/networking/bonding.txt

miimon is required as well as mode. Mode 1=rr, 2=active/passive 3=broadcast

Master:
vim /etc/sysconfig/network-scripts/ifcfg-bond0

TYPE=Ethernet
DEVICE=bond0
BOOTPROTO=none
IPADDR=1.1.1.1
NETMASK=255.255.255.0
USERCTL=yes
IPV6INIT=no
ONBOOT=yes
BONDING_OPTS="miimon=100 mode=0"




Slaves:
vim /etc/sysconfig/network-scripts/ifcfg-eth0

TYPE=Ethernet
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes




If you wanna see if the options in BONDING_OPTS were applied, take a look in
[root@zeus ~]# cat /sys/class/net/bond0/bonding/miimon
100
[root@zeus ~]# cat /sys/class/net/bond0/bonding/mode
balance-rr 0



--------------------------------------------------
File Systems

palimpsest 
it's a graphic utility to manage disks. 

TIP:

fdisk -cul /dev/?d?
it lists all disk devices.



LUKS -&nbsp;Linux Unified Key Setup
make sure you have the partition unmount

Format the partition to be encrypted:
cryptsetup luksFormat /dev/sdb1
Open the FS and give it a name:
cryptsetup luksOpen /dev/sdb1 hiddenData
Format it to use:
mkfs.ext4 /dev/mapper/hiddenData
Use it:
mkdir /mnt/hiddenData
mount /dev/mapper/hiddenData /mnt/hiddenData
touch /mnt/hiddenData/file1
Lock it after use:
umount /mnt/hiddenData
cryptsetup luksClose /dev/mapper/hiddenData
Make it the mounting persistent after reboot:
vim /etc/crypttab
hiddenData &nbsp; &nbsp; /dev/sda2&nbsp; none
none means you will have to type the password during boot. any other value is interpreted as a file that contains the password for the FS
vim /etc/fstab
/dev/mapper/hiddenData /mnt/hiddenData &nbsp;ext4 defaults 0 0&nbsp;

To avoid being prompted for a password you can create a key, save it in a file and use this key to open the device:

vim /etc/key
type anything in there

chmod 400 /etc/key 
cryptsetup luksAddKey /dev/vda5 /etc/key 
cryptsetup luksDump /dev/vda5


vim /etc/crypttab
hiddenData &nbsp; &nbsp; &nbsp;/dev/sda2 /etc/key
------------------

iSCSI


doc under: /usr/share/doc/iscsi*/README

# yum install -y&nbsp;iscsi-initiator-utils

# iscsiadm -m discovery -t st -p 192.168.56.101
192.168.56.101:3260,1 iqn.2006-01.com.openfiler:tsn.cc35969be1c0
Login in the target
# iscsiadm -m node -T &nbsp;iqn.2006-01.com.openfiler:tsn.cc35969be1c0 &nbsp;-p 192.168.56.101 -l
Logging in to [iface: default, target: iqn.2006-01.com.openfiler:tsn.cc35969be1c0, portal: 192.168.56.101,3260] (multiple)
Login to [iface: default, target: iqn.2006-01.com.openfiler:tsn.cc35969be1c0, portal: 192.168.56.101,3260] successful.
take a look in /var/log/messages and see what block devices appear OR run
# find /sys/devices/platform/host* -name "block*"
/sys/devices/platform/host4/session1/target4:0:0/4:0:0:0/block
# ls /sys/devices/platform/host4/session1/target4\:0\:0/4\:0\:0\:0/block/
sdc


service iscsi status 
will also show you, in the very bottom line, what devices iscsi is attached to.

Make it persistent after reboots:
vim /etc/fstab
/dev/sdc1 &nbsp; &nbsp;/mnt/openfiler &nbsp; ext4 _netdev 0 0


Cleaning the DBs:

Removing known portals:


[root@zeus ~]# iscsiadm -m discoverydb
192.168.56.102:3260 via sendtargets
192.168.56.101:3260 via sendtargets
[root@zeus ~]# iscsiadm -m discovery -o delete -p 192.168.56.102
[root@zeus ~]# iscsiadm -m discovery -o delete -p 192.168.56.101
[root@zeus ~]# iscsiadm -m discovery
[root@zeus ~]#





----------------------------------



After managing partitions you should reload the partition table partprobe used to be a good choice but seems to be deprecated right now. partx ou kpartx seems to be the new options.

partx -a /dev/sda&nbsp;will add new partitions to the system. double check running cat /proc/partitions


partx -d /dev/sda will remove all inactive partitions from the system.


Please use fdisk -cu.. these switches will disable DOS-compatible mode and show sectors instead of cylinders



-------

LVM


Creating PVs


[root@zeus ~]# fdisk -l /dev/sdc
Disk /dev/sdc: 1073 MB, 1073741824 bytes
34 heads, 61 sectors/track, 1011 cylinders
Units = cylinders of 2074 * 512 = 1061888 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0000dfdc
&nbsp; &nbsp;Device Boot &nbsp; &nbsp; &nbsp;Start &nbsp; &nbsp; &nbsp; &nbsp; End &nbsp; &nbsp; &nbsp;Blocks &nbsp; Id &nbsp;System
/dev/sdc1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;95 &nbsp; &nbsp; &nbsp; 98484+ &nbsp;8e &nbsp;Linux LVM
/dev/sdc2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;96 &nbsp; &nbsp; &nbsp; &nbsp; 426 &nbsp; &nbsp; &nbsp;343247 &nbsp; 83 &nbsp;Linux
[root@zeus ~]# pvcreate /dev/sdc1
&nbsp; Physical volume "/dev/sdc1" successfully created
[root@zeus ~]# pvcreate /dev/sdc2
&nbsp; Physical volume "/dev/sdc2" successfully created
[root@zeus ~]#The man page for pvcreate says a partition should be type 8e but it does not complain about /dev/sdc2 though. let's move on..


Creating a VG


[root@zeus ~]# vgcreate mp3 /dev/sdc1
&nbsp; Volume group "mp3" successfully created
[root@zeus ~]# vgdisplay -v mp3
    Using volume group(s) on command line
    Finding volume group "mp3"
  --- Volume group ---
  VG Name               mp3
  System ID
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  1
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                0
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               92.00 MiB
  PE Size               4.00 MiB
  Total PE              23
  Alloc PE / Size       0 / 0
  Free  PE / Size       23 / 92.00 MiB
  VG UUID               tc1JKq-TBBw-zYax-51ET-2A5t-hK0t-wsWXTO

  --- Physical volumes ---
  PV Name               /dev/sdc1
  PV UUID               XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI
  PV Status             allocatable
  Total PE / Free PE    23 / 23

Note that -v switch brings up the PV that are part of the VG.


Creating LVs

[root@zeus ~]# lvcreate -L 50M mp3 -n rock_and_roll
&nbsp; Rounding up size to full physical extent 52.00 MiB
&nbsp; Logical volume "rock_and_roll" created
[root@zeus ~]# lvcreate -L 10M mp3 -n soul
&nbsp; Rounding up size to full physical extent 12.00 MiB
&nbsp; Logical volume "soul" created
[root@zeus ~]# lvs
&nbsp; LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;VG &nbsp; &nbsp; &nbsp;Attr &nbsp; LSize &nbsp;Origin Snap% &nbsp;Move Log Copy% &nbsp;Convert
&nbsp; rock_and_roll mp3 &nbsp; &nbsp; -wi-a- 52.00m
&nbsp; soul &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3 &nbsp; &nbsp; -wi-a- 12.00m


Observing the VG

[root@zeus ~]# vgdisplay -v mp3
&nbsp; &nbsp; Using volume group(s) on command line
&nbsp; &nbsp; Finding volume group "mp3"
&nbsp; --- Volume group ---
&nbsp; VG Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mp3
&nbsp; System ID
&nbsp; Format &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lvm2
&nbsp; Metadata Areas &nbsp; &nbsp; &nbsp; &nbsp;1
&nbsp; Metadata Sequence No &nbsp;3
&nbsp; VG Access &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; read/write
&nbsp; VG Status &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; resizable
&nbsp; MAX LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0
&nbsp; Cur LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2
&nbsp; Open LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0
&nbsp; Max PV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0
&nbsp; Cur PV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1
&nbsp; Act PV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1
&nbsp; VG Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 92.00 MiB
&nbsp; PE Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4.00 MiB
&nbsp; Total PE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;23
&nbsp; Alloc PE / Size &nbsp; &nbsp; &nbsp; 16 / 64.00 MiB
&nbsp; Free &nbsp;PE / Size &nbsp; &nbsp; &nbsp; 7 / 28.00 MiB
&nbsp; VG UUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tc1JKq-TBBw-zYax-51ET-2A5t-hK0t-wsWXTO

&nbsp; --- Logical volume ---
&nbsp; LV Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/dev/mp3/rock_and_roll
&nbsp; VG Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3
&nbsp; LV UUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;EQ73g4-TFPw-6WTg-ufWp-RAXq-MVVU-fHSh9T
&nbsp; LV Write Access &nbsp; &nbsp; &nbsp; &nbsp;read/write
&nbsp; LV Status &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;available
&nbsp; # open &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0
&nbsp; LV Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;52.00 MiB
&nbsp; Current LE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 13
&nbsp; Segments &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1
&nbsp; Allocation &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inherit
&nbsp; Read ahead sectors &nbsp; &nbsp; auto
&nbsp; - currently set to &nbsp; &nbsp; 256
&nbsp; Block device &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 253:2

&nbsp; --- Logical volume ---
&nbsp; LV Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/dev/mp3/soul
&nbsp; VG Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3
&nbsp; LV UUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nchsYN-2eSX-Z3Bw-WV5w-2xxV-5oQM-8Vh8xj
&nbsp; LV Write Access &nbsp; &nbsp; &nbsp; &nbsp;read/write
&nbsp; LV Status &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;available
&nbsp; # open &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0
&nbsp; LV Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12.00 MiB
&nbsp; Current LE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 3
&nbsp; Segments &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1
&nbsp; Allocation &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inherit
&nbsp; Read ahead sectors &nbsp; &nbsp; auto
&nbsp; - currently set to &nbsp; &nbsp; 256
&nbsp; Block device &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 253:3

&nbsp; --- Physical volumes ---
&nbsp; PV Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /dev/sdc1
&nbsp; PV UUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI
&nbsp; PV Status &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; allocatable
&nbsp; Total PE / Free PE &nbsp; &nbsp;23 / 7


Rename a LV:
[root@zeus ~]# lvcreate -L 10M mp3
&nbsp; Rounding up size to full physical extent 12.00 MiB&nbsp; Logical volume "lvol0" created[root@zeus ~]# lvs&nbsp; LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;VG &nbsp; &nbsp; &nbsp;Attr &nbsp; LSize &nbsp;Origin Snap% &nbsp;Move Log Copy% &nbsp;Convert&nbsp; lvol0 &nbsp; &nbsp; &nbsp; &nbsp; mp3 &nbsp; &nbsp; -wi-a- 12.00m&nbsp; rock_and_roll mp3 &nbsp; &nbsp; -wi-a- 52.00m&nbsp; soul &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3 &nbsp; &nbsp; -wi-a- 12.00m[root@zeus ~]# lvrename /dev/mp3/lvol0 /dev/mp3/celtic&nbsp; Renamed "lvol0" to "celtic" in volume group "mp3"[root@zeus ~]# lvs&nbsp; LV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;VG &nbsp; &nbsp; &nbsp;Attr &nbsp; LSize &nbsp;Origin Snap% &nbsp;Move Log Copy% &nbsp;Convert&nbsp; celtic &nbsp; &nbsp; &nbsp; &nbsp;mp3 &nbsp; &nbsp; -wi-a- 12.00m&nbsp; rock_and_roll mp3 &nbsp; &nbsp; -wi-a- 52.00m&nbsp; soul &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3 &nbsp; &nbsp; -wi-a- 12.00m

Resizing LVs


[root@zeus ~]# lvresize -L 15M /dev/mp3/celtic
4 &nbsp;Rounding up size to full physical extent 16.00 MiB
&nbsp; Extending logical volume celtic to 16.00 MiB
&nbsp; Logical volume celtic successfully resized
[root@zeus ~]# lvresize -L 12M /dev/mp3/celtic
&nbsp; WARNING: Reducing active logical volume to 12.00 MiB
&nbsp; THIS MAY DESTROY YOUR DATA (filesystem etc.)
Do you really want to reduce celtic? [y/n]: y
&nbsp; Reducing logical volume celtic to 12.00 MiB
&nbsp; Logical volume celtic successfully resized

Extending/Reducing VGs
[root@zeus ~]# vgs
&nbsp; VG &nbsp; &nbsp; &nbsp;#PV #LV #SN Attr &nbsp; VSize &nbsp;VFree
&nbsp; mp3 &nbsp; &nbsp; &nbsp; 1 &nbsp; 3 &nbsp; 0 wz--n- 92.00m 16.00m
&nbsp; vg_zeus &nbsp; 1 &nbsp; 2 &nbsp; 0 wz--n- &nbsp;7.51g &nbsp; &nbsp; 0
[root@zeus ~]# vgextend mp3 /dev/sdc2
&nbsp; Volume group "mp3" successfully extended
[root@zeus ~]# vgs
&nbsp; VG &nbsp; &nbsp; &nbsp;#PV #LV #SN Attr &nbsp; VSize &nbsp; VFree
&nbsp; mp3 &nbsp; &nbsp; &nbsp; 2 &nbsp; 3 &nbsp; 0 wz--n- 424.00m 348.00m
[root@zeus ~]# vgreduce mp3 /dev/sdc2
&nbsp; Removed "/dev/sdc2" from volume group "mp3"
[root@zeus ~]#

Moving extents from one disk to another

Make sure you VG has more than one disk. In this case I have sdc1 and sdc2 and will move the extents from sdc1 to sdc2
[root@zeus ~]# pvmove /dev/sdc1 /dev/sdc2
&nbsp; /dev/sdc1: Moved: 0.0%
&nbsp; /dev/sdc1: Moved: 21.1%
&nbsp; /dev/sdc1: Moved: 31.6%
&nbsp; /dev/sdc1: Moved: 47.4%
&nbsp; /dev/sdc1: Moved: 57.9%
&nbsp; /dev/sdc1: Moved: 68.4%
&nbsp; /dev/sdc1: Moved: 78.9%
&nbsp; /dev/sdc1: Moved: 84.2%
&nbsp; /dev/sdc1: Moved: 100.0%

If now you take a look at sdc1 no extents are found in this partition (disc)[root@zeus ~]# pvdisplay -v /dev/sdc1&nbsp; &nbsp; Using physical volume(s) on command line&nbsp; --- Physical volume ---&nbsp; PV Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /dev/sdc1&nbsp; VG Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mp3&nbsp; PV Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 96.18 MiB / not usable 4.18 MiB&nbsp; Allocatable &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; yes&nbsp; PE Size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4.00 MiB&nbsp; Total PE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;23&nbsp; Free PE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 23&nbsp; Allocated PE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; PV UUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XUKAwo-eZRI-Gq12-7oUb-4w8w-25rN-t64cBI

Taking Snapshots

lvcreate -s -L50M -n rock_snapshot /dev/mp3/rock_and_roll
mount the snapshot, copy the frozen data and delete it.
lvremove /dev/mp3/rock_snapshot


-------------------------------------------------------------

FileSystems

ACLs:

dumpe2fs /dev/xxx | grep Defaults will show which are the default mouting options. acl, user_xattr must be listed to have acl support in first place.

tune2fs -o acl,user_xattr /dev/xxxcan be issued to set the defaults mounting options.

tune2fs&nbsp;-o ^acl,^user_xattr /dev/xxxcan be issued to clear the defaults mounting options.

These options are overwritten by /etc/fstab or options in the mount command line.
BTW, if you set the defaults mount options and mount the volume you won't be able to see the acl option listed in the output of mount. This can cause some confusion but acl will be enabled anyway.

----------------

Authentication

To enable LDAP authentication run

authconfig-tui
or

vi /etc/openldap/ldap.conf OR vi /etc/ldap.conf
URI ldap://127.0.0.1/
BASE dc=lutierigabriel
vim /etc/nsswitch.conf
add ldap to group, shadow, passwdor

system-config-authentication

-------------------

kickstart

some options:

zerombr
clearpart --all 

always use /root/anaconda-ks.cfg as a template. 
-------------------

NFS

Firewall

TCP/2049
UDP/111,32769
TCP/32803,892
&nbsp;All ports but 111 and 2049 has to be specified in /etc/sysconfig/nfs 

yum install -y nfs-utils&nbsp;&nbsp;nfs4-acl-tools
chkconfig nfs on; chkconfig nfslock on; chkconfig rpcbind on
vim /etc/exports
/mnt &nbsp; &nbsp;*(ro,sync)
exportfs -avr -&gt; reexport all directories
Adjusting SELinux ( this will allow directories to be exported as RO and RW:


getsebool -a | grep nfs
setsebool -P nfs_export_all_ro=1 nfs_export_all_rw=1


mounting a NFS share:

mount localhost:/mnt /nfs
Verifying the exported directories on the server side:


# cat /var/lib/nfs/etab
/mnt &nbsp; &nbsp;*(ro,sync,wdelay,hide,nocrossmnt,secure,root_squash,no_all_squash,no_subtree_check,secure_locks,acl,anonuid=65534,anongid=65534)


Verifying the mount NFS share on the cliente side:


nfsstat -m

Persistent NFS mounts:


vim /etc/fstab
rhel01:/opt/company_data &nbsp; &nbsp; /opt/company_data &nbsp; &nbsp; nfs4 &nbsp; rw,sync &nbsp;0 0

Client side mounting option 

soft -&gt; means that if a timeout occurs the process will give up and try again later. the device will become unavailable meanwhile
hard -&gt; in the same situation as state above, the process will never give up on mounting/accessing the device. it will hang there 'til it gets mounted.
intr -&gt; usually used along the hard option. means the besides hard it can be interrupted. usually better have hard, intr than soft.

-------------------------------

automount

how to automount home directories:

/etc/auto.master
/home/guests &nbsp; &nbsp; /etc/auto.guests


/etec/auto.guests
* &nbsp; -rw,soft,intr &nbsp; instructor.example.com:/home/guests/&amp;


service autofs reload

ls /home/guests/user1 -&gt; will mount the user1 folder from the instructor box 

&nbsp;-----------

SetUID and SetGID

setuid allows users to execute a file with privileges of the file's owner

chmod u+s file
chmod 4755 file
find / -perm -4000

SetGID
chmod&nbsp;g+s file
chmod 2755 file
find / -perm -2000

Sticky bit (set on directories, only owner and root can delete contentes in the dir)
chmod +t sticky/
chmod 1755 sticky/
find / -perm -1000


-------

Virtualization (only available in 64 bits OS)


yum install qemu-kvm qemu-img

virsh list
virshlist --all

virsh shutdown X
virsh start NAME
virt-viewer X

virsh autostart --disable X
&nbsp;virsh autostart X

virt-viewer X

Create a guess VM:

virt-install –-name Client03 –-ram 512 –-disk path=/var/lib/libvirt/images/client03.img,size=8 –-network network=default –-cdrom /dev/cdrom


it's recommended to use /var/lib/libvirt/images to hold the virtual disks. to use other directory you should configure SELinux to allow it.



Can also create via GUI with virt-manager.

Useful commands


virsh connect localhost
virsh start guest1-rhel6-64
virsh stop guest1-rhel6-64
virsh list -all
virsh console
virsh autostart&nbsp; X
virsh net-list
virsh net-start X------------------

SELinux

Make sure you have setroubleshoot-server so you will get nicer SELinux messages.


Check how SELinux is running:
[root@zeus ~]# sestatus SELinux status:                 enabled SELinuxfs mount:                /selinux Current mode:                   enforcing Mode from config file:          enforcing Policy version:                 24 Policy from config file:        targeted [root@zeus ~]# getenforce Enforcing [root@zeus ~]# setenforce permissive [root@zeus ~]# sestatus SELinux status:                 enabled SELinuxfs mount:                /selinux Current mode:                   permissive Mode from config file:          enforcing Policy version:                 24 Policy from config file:        targeted [root@zeus ~]# setenforce enforcing [root@zeus ~]# getenforce Enforcing
you can also edit /etc/selinux/config. Regardless of the method you should reboot the system. When you change the mode the files must be relabed (their contexts will change) this is done on the boot process.

It is possible to disable enforcing mode, will only audit:

setenforcing 0
Check the boolean values or&nbsp;getsebool -a | grep http:
&nbsp;sestatus -b | grep http
allow_httpd_anon_write &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
allow_httpd_mod_auth_ntlm_winbind &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
allow_httpd_mod_auth_pam &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
allow_httpd_sys_script_anon_write &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
httpd_builtin_scripting &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; on
httpd_can_check_spam &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
httpd_can_network_connect &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
httpd_can_network_connect_cobbler &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
httpd_can_network_connect_db &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
httpd_can_network_memcache &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
httpd_can_network_relay &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
httpd_can_sendmail &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;off
httpd_dbus_avahi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;on
httpd_enable_cgi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;on
httpd_enable_ftp_server &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off
httpd_enable_homedirs &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; off


While I was reading about SELinux I found something very useful that I didn't know until now. Well, during the reading the author says to issue a commando called semanage that will explain each of the boolean options. However, I don't have semanage on my system and don't know which package provides it. So, the following command told me what package I should install to have semanage.

yum whatprovides *bin/semanage
Here we go, from the output it's clear to me that&nbsp;policycoreutils-python-2.0.83-19.1.el6.i686 has the binary that I was looking for.

Ok. moving on... so, to see what each boolean value does, issue:

[root@zeus ~]# semanage boolean -l | grep http
httpd_can_network_relay &nbsp; &nbsp; &nbsp; &nbsp;-&gt; off &nbsp; Allow httpd to act as a relay
httpd_can_network_connect_db &nbsp; -&gt; off &nbsp; Allow HTTPD scripts and modules to connect to databases over the network.
httpd_use_gpg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&gt; off &nbsp; Allow httpd to run gpg in gpg-web domain
httpd_enable_cgi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&gt; on &nbsp; &nbsp;Allow httpd cgi support
allow_httpd_mod_auth_pam &nbsp; &nbsp; &nbsp; -&gt; off &nbsp; Allow Apache to use mod_auth_pam


Changing boolean values:

setsebool -P httpd_enable_homedirs=1



Context is formed of:
User : &nbsp;role &nbsp;: &nbsp;domain

Users are usually one of these:

unconfined_u: Unprotected user
system_u: System user
user_u: Normal user

Roles are usually one of these:object_r: File&nbsp;system_r: Users and processes&nbsp;
Domains (AKA type) are usually one of these:unconfined_r: Unprotected file or process&nbsp;
httpd_t: used for httpd process.
....


Roles do NOT have influence under files so object_r is used as a generic role for any file.

Checking files' context:
# ls -Z
-rw-------. root &nbsp;root system_u:object_r:admin_home_t:s0 anaconda-ks.cfg
-rwxr-xr-x. root &nbsp;root unconfined_u:object_r:admin_home_t:s0 a.out

Checking processes' context:&nbsp;ps -eZ | &nbsp;grep httpd
unconfined_u:system_r:httpd_t:s0 14784 ? &nbsp; &nbsp; &nbsp; 00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 14786 ? &nbsp; &nbsp; &nbsp; 00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 14787 ? &nbsp; &nbsp; &nbsp; 00:00:00 httpd





Changing contexts (domains) http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Confined_Services/sect-Managing_Confined_Services-Targeted_policy-Unconfined_processes.html



[root@zeus ~]# touch myfile
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile
[root@zeus ~]# chcon -vu system_u myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfile
[root@zeus ~]# chcon -vt etc_t myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:etc_t:s0 &nbsp; &nbsp; &nbsp; myfile
[root@zeus ~]# chcon -vr system_r myfile
changing security context of `myfile'
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:system_r:etc_t:s0 &nbsp; &nbsp; &nbsp; myfile[root@zeus ~]# touch myfile2
[root@zeus ~]# ls -Z myfile2
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile2
[root@zeus ~]# chcon --reference myfile myfile2
[root@zeus ~]# ls -Z myfile2
-rw-r--r--. root root system_u:system_r:etc_t:s0       myfile2

[root@zeus ~]# restorecon myfile
[root@zeus ~]# ls -Z myfile
-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfile



Changing ports for services:
[root@zeus ~]# semanage port -l | grep http
http_port_t &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp;80, 443, 488, 8008, 8009, 8443

[root@zeus ~]# semanage port -a -t http_port_t -p tcp 81

[root@zeus ~]# semanage port -l | grep http
http_port_t &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp;81, 80, 443, 488, 8008, 8009, 8443


Every time you change a context it will be restored in the next file system relabel (next reboot).
To make changes permanentely run:

semanage fcontext -a -t httpd_sys_content_t file1
TIP:
some daemons have man pages talking about the contexts and booleans used by them. take a look:

[root@zeus ~]# apropos _selinux
ftpd_selinux         (8)  - Security-Enhanced Linux policy for ftp daemons
httpd_selinux        (8)  - Security Enhanced Linux Policy for the httpd daemon
init_selinuxmnt      (3)  - initialize the global variable selinux_mnt
is_selinux_enabled   (3)  - check whether SELinux is enabled
kerberos_selinux     (8)  - Security Enhanced Linux Policy for Kerberos
named_selinux        (8)  - Security Enhanced Linux Policy for the Internet Name server (named) daemon
nfs_selinux          (8)  - Security Enhanced Linux Policy for NFS
pam_selinux          (8)  - PAM module to set the default security context
rsync_selinux        (8)  - Security Enhanced Linux Policy for the rsync daemon
samba_selinux        (8)  - Security Enhanced Linux Policy for Samba
ypbind_selinux       (8)  - Security Enhanced Linux Policy for NIS

semanage fcontext -a -t httpd_sys_content_t "/newweb(/.*)?"
restorecon -R -v /newweb
-------------


Firewall

&nbsp;iptables -p icmp -hshow all the possible icmp types :-)

POSTROUTING -&gt; SNAT --to-source x.x.x.x OR MASQUERADE

----------
Rsyslog

/etc/rsyslog.conf

forwarding message to other host:

&nbsp;Remote machine
&nbsp; &nbsp; &nbsp; &nbsp;There are three ways to forward message: the traditional UDP transport, which is extremely lossy but standard, the plain TCP based trans-
&nbsp; &nbsp; &nbsp; &nbsp;port which loses messages only during certain situations but is widely available and the RELP transport which does not lose messages &nbsp;but
&nbsp; &nbsp; &nbsp; &nbsp;is currently available only as part of rsyslogd 3.15.0 and above.

&nbsp; &nbsp; &nbsp; &nbsp;To &nbsp;forward &nbsp;messages &nbsp;to another host via UDP, prepend the hostname with the at sign ("@"). &nbsp;To forward it via plain tcp, prepend two at
&nbsp; &nbsp; &nbsp; &nbsp;signs ("@@"). To forward via RELP, prepend the string ":omrelp:" in front of the hostname.

&nbsp; &nbsp; &nbsp; &nbsp;Example:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; *.* @192.168.0.1

------

Apache

Test/Parse the config file:

service httpd configtesteVirtualHost

NameVirtualHost 192.168.56.200:80


&lt;VirtualHost 192.168.56.200:80&gt;
serverName site1.asdf.com
DocumentRoot "/var/www/site1"
&lt;/VirtualHost&gt;


&lt;VirtualHost 192.168.56.200:80&gt;
Servername site2.asdf.com
DocumentRoot "/var/www/site2"
&lt;/VirtualHost&gt;
Password protected


&lt;Directory "/var/www/html/protected"&gt;
        AuthType        basic
        AuthName "You are out"
        AuthUserFile    "/var/www/html/protected/.users"
        Require user lutieri
        Options Indexes

        Order deny,allow
&lt;/Directory&gt;

CGI Scripts


ScriptAlias /bin "/var/www/site1/bin"

OR

&lt;Directory "/var/www/site1/bin/"&gt;
options ExecCGI Indexes
&lt;/Directory&gt;

Addhandler cgi-script .lgb

The script will need to produce HTML output. Usually means that the first line in your script needs to print out which mime type the script will produce. I.E:


#!/bin/bash

echo "Content-type: text/html\n\n";
echo "Hello, World.";


Except that I found out that printing a blank line instead of content-type... also works great.



----------


Postfix


alternatives --config mta
-----------

Bind


[root@zeus ~]# cat /var/named/dynamic/asdf.com
$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
site1   A       192.168.56.201
site2   A       192.168.56.202


Master zone


[root@zeus ~]# cat /etc/named.conf
---SNIP---

zone "asdf.com"  IN {
        type master;
        file "dynamic/asdf.com";
};
---SNIP---

Forward zone:

the directive Forwarders can also be used in the global context.

zone "asdf.com"  IN {
        type forward;
        forwarders {  66.33.206.206; };
};

--------------

Samba

If you create a directory and would like to share it, run:

&nbsp;chcon -t samba_share_t /pathAllowing home directories to be shared:

[root@zeus ~]# setsebool -P samba_enable_home_dirs on
[root@zeus ~]# getsebool samba_enable_home_dirs
samba_enable_home_dirs --&gt; on
[root@zeus ~]# semanage boolean -l | grep  samba_enable_home_dirs
samba_enable_home_dirs         -&gt; on    Allow samba to share users home directories.
-P make the change to the boolean persistent across reboots.

OR

&nbsp;semanage boolean -m --on &nbsp;samba_enable_home_dirs

-----------


Vsftpd

Allow anonymoys upload
setsebool&nbsp;ftp_home_dir 1
chcon &nbsp;-t public_content_rw_t /var/ftp/pub
setsebool  allow_ftpd_anon_write 1
chgrp -R ftp: /var/ftp/dropbox
chmod g=wx /var/ftp/dropbox

cat /etc/vsftpd/vstfpd.conf
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES

asdf

VNC


server side:
/etc/sysconfig/vncservers

client side:
vncviewer -via server9 localhost:2

this will make a ssh tunnel to server9 and tunnel the vnc connection.