Heartbleed (CVE-2014-0160, CVE-2014-0346) - Affected Products From Major Vendors

Consolidated list of responses from Major Vendors

VMware - http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2076225

Citrix - http://support.citrix.com/article/CTX140605

Red Hat - https://access.redhat.com/site/solutions/781793

I will add more as and when I find the links/KB.

Finding Glue Records For A Domain

Glue records are very important for DNS infra. Here is how to check glue records for a DNS domain.

Use Dig  - http://www.adminsehow.com/2010/05/how-to-check-domain-ns-glue-records-using-dig/

(Or)

Be a lazy bitch like me :P  - https://mebsd.com/glue#disqus_thread

Hope it useful for someone

Sophos UTM320 To IPsec With AWS VPC

Here are some pointers using Sophos UTM320 firewall to set up IPsec VPN to AWS VPC.

1) Select 'Dynamic Routing'  when you create customer gateway.  Otherwise,  you won't be able to get configuration file from AWS for your UTM. AWS dynamic routing use BGP.
2) If you firewall WAN interface is not directly facing to Internet,  you need to modify interface IP correctly in downloaded configuration file before importing. 
3) If you can't get connection even after importing configuration and VPN shows 'up' status, check BGP setting in your UTM.  In my case, it simply failed to import BGP portion from configuration file. I had to configure BGP in UTM manually. 
4) Of course,  do add firewall rule to allow traffic between your local network and VPC. 

You may add more to the list....  :-D

RHCS Cluster Fencing With vSphere/vCenter 5.5

Red Hat's latest KB list only up to vSphere 5.1 in term of cluster fencing support. (as of this blog was written)

As customer's requirement,  I have tested cluster fencing on RHEL6.3 with vSphere 5.5 environment.

Guess what!

'fence_vmware_soap' works perfectly with vSphere 5.5. 

I have inform people from Red Hat so that they can speed up the process of adding vSphere5.5 into support matrix.

Happy Clustering!

Best SSH Client On Windows OS

One of my customers suggested me to try using MobaXterm when he saw me using Putty,    WinSCP and Xming server on Windows OS.  I gave it a try and have to admit that MobaXterm seems to be  the best utility for remote administration. 

Why? Here are some highlighted features that makes my life way easier than before. 

- Integrated sftp client and Xserver for SSH
- Tabbed terminal Windows
- Multi-exec mode (similar to clustered SSH)
- Credential saving
- Easier & neater copy & paste in terminal
- All-in-one (ssh/telnet/rdp/vnc/serial console and etc...)

Try out by yourself for complete list of features.  You can download it free from below site. 

http://mobaxterm.mobatek.net

Hope it useful for someone out there....

To Delete Bank Account Info From AWS Account

Creating AWS account requires you to fill in a valid bank account. Normally I use my own bank account. After testing is done, I will not used that AWS account any more and delete my bank account from unused account.

https://www.amazon.com/gp/css/account/cards/view.html

Hope it useful for someone.

Puttygen's Public Key Problem with Linux Server

A need comes up to set up password authentication between my notebook and Linux server. I have to use puttygen to generate public/private key on my notebook because it is running Windows 7. Then I uploaded public key(example.pub) to Linux server and run the the following command to add it into ssh's authorized_keys file.

#cat example.pub >> ~/.ssh/authorized_keys

But passwordless authentication with putty failed with message saying "Server Refused Our Key". Then I googled the error and found below link.
http://www.walkernews.net/2009/03/22/how-to-fix-server-refused-our-key-error-that-caused-by-putty-generated-rsa-public-key/

To make long story short, you have to modify the public key so that it will work on Linux server. Below are the steps extracted from above link. Pardon me for being lazy..

Hope it useful for somebody.

GFS2 & CLVM

GFS needs to go together with CLVM according to the following Red Hat KB. Otherwise Red Hat won't support any problem for GFS.

https://access.redhat.com/site/solutions/46637

Rocks Cluster Installation Problems

Yes, I am damn stupid enough to screw up Rocks Cluster Installation that is as easy as ABC. Here is culprits giving me headache for 2 days -

1. Never ever try LVM during installation. Or your installation will fail with some python error. But you can use LVM on other harddisks after installation. 
2. Don't use ".local" as domain suffix for frontend node. I used "headnode.local" for my frontend hostname. Installation went through well without complaining anything. However, server came up without public network/interface after installation finished. I had been barking the wrong tree for 1 and half day checking switch, using lower version of Rocks and using different IP schema. Finally, I used other FQDN like ".netlynker.net" and it solved the issue.

Really hope this post helpful for somebody out there. :D

Experience With Oracle Virtualization

Here is some of my experience with OVM (Up to Version 3.1.1)

1) Docs says that 3 x mode are supported for NIC bonding.
- Active/Backup
- Adaptive Load Balancing
- Dynamic Link Aggregation (LACP)
But only A/B and Link Aggregation can be used for VM network. If you hook VM to ALB-bonded interface, VM will get extremely unstable connection.
Like you guess, we have to approach our network guys to configure LACP on their switches to get Redundancy+Performance.

2) Max. 2 x physical NIC ports per each bonded interface. You want more? Upgrade to 3.2.1 and you will get 4 ports at Max. for each bond. That sucks. Doesn't it? Especially for VMware guys...

3) It supports Live-Migration!!! Hold on a sec! You can live-migrate only one VM at a time. Sorry pals, you get a long way to go if you have many VMs to migrate live.

4) NO SNAPSHOT! Don't waste time finding how to take snapshot of VMs in OVM. Oracle gives you a work-around method close enough to taking snapshot:"Thin Cloning".
Yes. Thin Cloning is a neat thing that makes use of OCFS2's Reflinking feature. You can do "Thin Cloning" live. You can read more about Reflinking here.

To be continued.....

Let's Guess Which RHEL Version Will Boot From This Installation DVD

Mount RHEL DVD on any machine. And check a hidden file named ".discinfo" in it.  You can find OS version (including minor version) and architecture there.

Hope useful for someone like me who never carry CD marker around. ;)

Do We Really Need To Turn Off NetworkManager?

As a Linux user, I bet most of us had suffered from NetworkManager at least once in a lifetime. As legend goes, we disabled NetworkManager to solve the problem. We never thought, "That very NetworkManager will be useful for us one day".

Now we are using various kind of devices for network communication. Wifi adapters, 3G/4G modem adapters. Configuring your Linux box to get connected without NetworkManager become a daunting task. Have you tried using 3G modem on your Linux box? It is almost impossible to set it up without NetworkManager.

Well. We have to run NetworkManager now for those special purposes but we still want to keep some devices not to be managed by it. How??

For RHEL/CentOS, add a parameter in desired network config file.(e.g /etc/sysconfig/network-scripts/ifcfg-eth0) -

NM_CONTROLLED=no

service network restart

For Ubuntu, add a section in network manager config file.(i.e  /etc/NetworkManager/NetworkManager.conf)

[keyfile]
unmanaged-devices=mac:<MAC address>, mac:<MAC address>

/etc/init.d/network-manager restart

Now NetworkManager won't manage those devices anymore.

Remarks: I experience some bugs from RHEL/Fedora - Even though you add "NM_CONTROLLED=no", NetworkManager is still messing up with interfaces. Put in "service NetworkManager stop" in your troubleshooting checklist. :)

Happy Linuxing!

Using Serial-To-USB adapter on Linux

As and when, I need to manage some network devices(Switch, router, firewall and etc...) with serial console. I bought serial-to-usb adapter since my notebook doesn't come with serial port.


I am using Linux as on my notebook. I use "screen" utility to connect serial device.

sudo screen /dev/ttyUSB0

After I finish my job, I will kill screen session.

Ctrl+a+k

Press "k" to kill the session

Hope someone find it useful.

Using CentOS6 Installation DVD as YUM Repository

The following link is how to use CentOS5 Installation DVD as YUM Repository to install packages locally.

http://netlynker.blogspot.sg/2012/01/centos5-installing-softwares-from.html

For CentOS version 6, you can follow above link except that you have to use "c6-media" instead of "c5-media" as below -

yum --disablerepo=\* --enablerepo=c6-media update
yum --disablerepo=\* --enablerepo=c6-media search <package name>
yum --disablerepo=\* --enablerepo=c6-media install <package name>

:D

Office 2007(Word/Powerpoint/Excel/Visio) On Ubuntu 12.04 with PlayOnLinux

Finally, I can use Visio on my notebook that is running Ubuntu 12.04. I use a wine wrapper called PlayOnLinux to install Office 2007 and Visio. You can download PlayOnLinux from http://www.playonlinux.com/en/download.html
Here are some screenshots for your appetite -

May the source be with you!!!

RHCE!

Finally I am Red Hat Certified Engineer........ :D

ClusterSSH : Working With Multiple SSH Sessions Concurrently.

Requirement -

1. General Purpose Linux OS (Mine is Fedora 16)
2. Internet Connection
3. Brain

Lately when I am doing testing with multiple Linux Servers, I need to ssh into a few servers and manage them simultaneously. And I get tired of typing same commands on the servers one after another. For example, If I want to change gateway on  all servers. I have to ssh to server , edit the config and restart network service on all servers.

I use a program called "ClusterSSH" to do that. It let you manage multiple servers via SSH concurrently.

Install ClusterSSH

sudo yum install clusterssh

Now ClusterSSH is ready on your system. Connect to multiple systems.

cssh server1 server2

Congrat! Now you can be lazy like me too. :P. I attached the screenshot to poke your interest.

CentOS5 - Installing Softwares From Installation Media

Requirement :

1. Installation Media (DVD or ISO)
2. Brain

Mounting Media DVD or ISO

Create the directory to mount.

mkdir -p /media/CentOS

Mount DVD to created directory, if you are using DVD.

mount -t auto /dev/cdrom /media/CentOS

Mount ISO to created directory, if you are using ISO.(assuming ISO file is in /root/ directory)

mount -t iso9660 -o loop  /root/CentOS-5.7-i386-bin-DVD-1of2.iso /media/CentOS

Installing softwares from mounted DVD or ISO 
Update YUM database

yum --disablerepo=\* --enablerepo=c5-media update

Search and Install Software

yum --disablerepo=\* --enablerepo=c5-media search nmap

yum --disablerepo=\* --enablerepo=c5-media install nmap -y

CONGRATULATION! 


Oops! I almost forget. Here is how to unmount the media

umount /media/CentOS

 

 

 

Rsync on different port rather than 22

One day, I need to rsync between two Linux servers. And i have to know that only port 80 is opened between those. So use the following command so that rsync can use port 80 rather than 22.
#rsync -e "ssh -p 80" -avp /tmp root@remotehost:/tmp
Hope that somebody find this post useful.

Published with Blogger-droid v1.7.2

Sysloging To Remote Log Server on RHEL/CentOS

Purpose - Logging to remote log server instead of keeping log on locally for security reason.
In our case, we will send logs messages to a server with IP Address ( 192.168.1.2 )
How To
#vi /etc/syslog.conf
find the following line
*.info;mail.none;authpriv.none;cron.none                           /var/log/messages

change it to
*.info;mail.none;authpriv.none;cron.none                           @192.168.1.2

and restart the syslog server
#service syslog restart

May your logs be safe in peace! :D