Backing up data is always a good idea, especially if it is something you will want later.
If it is a personal file Google Drive, Drop Box and One Box are all great resources that give you between 5 and 30 gig of space for free.
There are various methods of backing up data. If you are just backing up files the above will do. If you want more advanced options or more space you can always set up an sftp server and rsync your files. Whatever it is you are backing up make sure you back it up properly.
One thing I do want to mention is backup rotation. There are various methods of backing up data and one is simply to overwrite the old backup with a new one. This is nice if you loose a file but what if you over wrote changes that you wanted to keep?
If you are constantly adding data to a server or constantly changing a file or configuration it is best to back up using dates. One example of this is every time I make a change to a Cisco firewall I backup the change with the name of the machine and the current date.
For things that get changed more often and have large amounts of data sometimes its necessary to make a rotation cycle. For example:
Everyday for 1 week (7 backups)
Every week for 1 month (3 additional backups)
Every month for 1 year (11 additional backups)
and for tax purposes every year for 7 years I think (an additional 6 after that)
This leads to a total of 27 backups. While this method doesn't back up EVERY single change it goes with the assumption that you have a week to find a problem before it starts deleting data. The benefit to this is that it takes less space. If you are unconcerned about space then by all means backup and keep every backup.
For Databases:
MySQL backups can be done with a mysql dump. This "dumps" an entire database or databases into a file. You can also do individual tables. An LDAP database is similar in that you dump the database using slapcat (or some other commands).
Once I had to do a different dc for an ldap backup and it caused so differences.
Here are the commands I ran:
sudo slapcat -b dc=special,dc=com > ldapdumpspecial.raw
slapadd -l /home/mwaldorf/ldapdumpspecial -b dc=special,dc=com
I will include further instructions on specifics in different posts but I wanted to have this saved somewhere. I do believe before the restore we run:
egrep -v ‘^entryCSN:’ < /root/ldapdump.raw > /root/ldapdump on the
Always remember to restore permissions and SeLinux context. If you do not do this it will not work properly a lot of the time. For windows users backing up a file system can be different. There are various options for backup and recovery.
Thursday, November 12, 2015
Monday, September 14, 2015
ASA 5506
The new ASA frustrated me for quite a while. First I couldn't get the ASDM to run. Turns out it needs Java 7. I use Java 6 for Cisco CCP (a software predating the ASDM). So after playing with my network I got it to work in a Linux virtual machine (I like to do all of my Cisco networking changes in one environment). Turns out that sometimes on that linux bot the ASDM just stops loading until you restart the software. Well beggars can't be choosers I guess (another reason why the CLI is better... that worked instantly no problems at all). I did find the initial set up of the router a bit more friendly. DHCP is already enabled. ASDM is already enabled, and the wizard in the ASDM is a bit more friendly.
I have 6 of these to configure. Three sites each with a failover unit. One of them is supposed to have wifi. I spent a good amount of time trying to login the the wifi part of the unit. I had to dig around for a while before I found the command "hw-module module wlan recover configuration" after running that I was able to finally get in. I will mention I did use the wrong IP at first the default IP is http://192.168.10.2 while I was using http://192.168.10.1 an simple quick read error. I got the 5GHz up but not the 2.4, still not sure why its not up.
This is mostly a bit of ranting to remind me of two things 1) the correct IP for the wife and 2) the fact that ASDM has to be on Java 7 on in a Linux box. As an aside I also was unable to use Chrome and had to use Firefox to get it to work right.
As an update to this post the 5506 will not run properly in the newest Java either. Java 8 update 51 is the closest I can find to allowing everything to run correctly. On a separate machine I had to revert back to Java 8 update 11. I haven't tested everything with both of them and in part it is because we tunnel into machines that we get some problems. I also found that my Linux vm won't do for configuring everything on these machines as it doesn't show the entire spectrum of options. I am not sure why but this means that I will have to continue to have a windows box (or two depending on what we do with our old router I need Java 6 on).
I have 6 of these to configure. Three sites each with a failover unit. One of them is supposed to have wifi. I spent a good amount of time trying to login the the wifi part of the unit. I had to dig around for a while before I found the command "hw-module module wlan recover configuration" after running that I was able to finally get in. I will mention I did use the wrong IP at first the default IP is http://192.168.10.2 while I was using http://192.168.10.1 an simple quick read error. I got the 5GHz up but not the 2.4, still not sure why its not up.
This is mostly a bit of ranting to remind me of two things 1) the correct IP for the wife and 2) the fact that ASDM has to be on Java 7 on in a Linux box. As an aside I also was unable to use Chrome and had to use Firefox to get it to work right.
As an update to this post the 5506 will not run properly in the newest Java either. Java 8 update 51 is the closest I can find to allowing everything to run correctly. On a separate machine I had to revert back to Java 8 update 11. I haven't tested everything with both of them and in part it is because we tunnel into machines that we get some problems. I also found that my Linux vm won't do for configuring everything on these machines as it doesn't show the entire spectrum of options. I am not sure why but this means that I will have to continue to have a windows box (or two depending on what we do with our old router I need Java 6 on).
Wednesday, May 27, 2015
SELinux
So I have commented on SELinux before and to be honest it frustrates me very badly, but it also makes a system much more secure. I have heard taht A lot of people just turn SELinux off. Working with Health Care info that is not an option.
I have found that most of the time you can either fix it simply by going through the logs and a quick google search or if you know the context is supposed to be like another files by copying it (for example I ran into an error when a file did not have permissions due to recently being ssh'd over so a service would not start). I have found 2 commands to be extremely helpful.
This one copies the security permissions of one file to the new one
chcon --reference=/path/to/existingfile /path/to/newfile
The other one is restorecon -R /path/to/file(s) which I had to do when I deleted the entire folder in /etc/folder that was being used instead of just the contents of the folder.
All in all I have to say PLEASE don't just disable SELinux. You'll find the answer somewhere that's what the internet is for.
I have found that most of the time you can either fix it simply by going through the logs and a quick google search or if you know the context is supposed to be like another files by copying it (for example I ran into an error when a file did not have permissions due to recently being ssh'd over so a service would not start). I have found 2 commands to be extremely helpful.
This one copies the security permissions of one file to the new one
chcon --reference=/path/to/existingfile /path/to/newfile
The other one is restorecon -R /path/to/file(s) which I had to do when I deleted the entire folder in /etc/folder that was being used instead of just the contents of the folder.
All in all I have to say PLEASE don't just disable SELinux. You'll find the answer somewhere that's what the internet is for.
Monday, May 25, 2015
.eml file? and other IE uses
So I haven't done much ever with outlook and I have only dinked around with Thunderbird. These applications just are just too much from what I want in email. I do know however that many people use them in a professional environment. Normally this has no problem in sending emails back and forth but I got an attachment as a .eml file. I needed the file because it had how to set up specific VPN. Turns out this is a file type that Outlook and Thunderbird use (and quite possibly other systems from what I can gather)!
There are a few solutions to viewing it, changing the extension to be html and any browser will work but as it turns out the only one that will simply load it (and format it perfectly) was Internet Explorer.
Now I dislike IE as much as the next guy (well any one under the age of 60 to be fair), but as it turns out I have found 2 uses for it now. One being this .eml file viewer and the other being that you can disable the certificate check. Normally I would say NEVER DO THIS and if you are using IE make sure it is enabled but in my case it was necessary as the certificate was never properly installed on a server (which is now in the process of being fixed so we can all go back to using Chrome and Fire Fox).
I mentioned installing certificates for websites in this post but I probably will not write on that if I don't do it for a personal site. It is a fairly straight forward process that involves creating a .csr and .key files and uploading/emailing them and then downloading the .crt file and it will depend on who you get your domain from etc. Most sites will have specific instructions on how to make them.
Here is the one from GoDaddy. It also has ones for generating a CSR etc.
There are a few solutions to viewing it, changing the extension to be html and any browser will work but as it turns out the only one that will simply load it (and format it perfectly) was Internet Explorer.
Now I dislike IE as much as the next guy (well any one under the age of 60 to be fair), but as it turns out I have found 2 uses for it now. One being this .eml file viewer and the other being that you can disable the certificate check. Normally I would say NEVER DO THIS and if you are using IE make sure it is enabled but in my case it was necessary as the certificate was never properly installed on a server (which is now in the process of being fixed so we can all go back to using Chrome and Fire Fox).
I mentioned installing certificates for websites in this post but I probably will not write on that if I don't do it for a personal site. It is a fairly straight forward process that involves creating a .csr and .key files and uploading/emailing them and then downloading the .crt file and it will depend on who you get your domain from etc. Most sites will have specific instructions on how to make them.
Here is the one from GoDaddy. It also has ones for generating a CSR etc.
Thursday, May 21, 2015
Learning Python
So I am learning the python coding language (definatly not my favorite) but it can be a powerful tool (just like any language). There are lots of tools for free (don't go and spend money on learning a language unless you have to for a class).
There is a book for about $25 - $30 called Learn Python the Hard Way. Well the guy (Zed Shaw) decided to also publish everything online free (with option to pay for support and videos etc).
http://learnpythonthehardway.org/
I have found it useful but at the same time I am not using it enough for it to be amazing, although it has helped me understand some of the back end things that go on with our system.
I am currently on lesson 24 of 50. I have to say this is a good site to use to teach the basics for anyone who wants to learn a language. I will most likely post when I finish. The real learning comes with doing the additional work though, not just creating the mimic files he makes.
Most of what I have done has been in the Cisco field, as such I was able to take a few basics and use them to rewrite the Cisco config quickly so I can use the same basic schema with a few differences.
There is a book for about $25 - $30 called Learn Python the Hard Way. Well the guy (Zed Shaw) decided to also publish everything online free (with option to pay for support and videos etc).
http://learnpythonthehardway.org/
I have found it useful but at the same time I am not using it enough for it to be amazing, although it has helped me understand some of the back end things that go on with our system.
I am currently on lesson 24 of 50. I have to say this is a good site to use to teach the basics for anyone who wants to learn a language. I will most likely post when I finish. The real learning comes with doing the additional work though, not just creating the mimic files he makes.
Most of what I have done has been in the Cisco field, as such I was able to take a few basics and use them to rewrite the Cisco config quickly so I can use the same basic schema with a few differences.
Monday, May 18, 2015
Lots of New Stuff
So I went to Open West there was a lot of cool things. I tried to get Fedora 21 up and running but turned out I had a server disk and I am not too good with out a GUI so I ended up not able to create my VPN yet. Fedora 22 is coming out (it comes out the 26th of this month).
In the mean time a quick update about things I think are interesting. So I have been in both a PCI and HIPPA environment now, and as such I have dealt with different security things. Hopefully I can find some things to show.
In the mean time a quick note about Wifi security I learned at Open West: Wifi security is crap. You can do a lot of things to be more secure, but all and all if someone wants to get you they can.
Here are the things you can do to make you more secure than your neighbor though, which means they get hacked and not you!
-Once you have every device you want connected turn off your SSID broadcasting.
-Don't have a password under 10 characters (the guy giving the seminar said his is over 50, but he was a little extreme, Mine is about 15) and make it alpha numeric, the more random the better.
-Use WPA2 encrytion, for now that is the most secure.
-Pay attention to what Wifi you are connecting too. There are devices that can essentially broadcast and connect your computer to any network.
That is it for this update. I will be dedicating some time to blogging this week so we should see regular updates again for a while at least.
In the mean time a quick update about things I think are interesting. So I have been in both a PCI and HIPPA environment now, and as such I have dealt with different security things. Hopefully I can find some things to show.
In the mean time a quick note about Wifi security I learned at Open West: Wifi security is crap. You can do a lot of things to be more secure, but all and all if someone wants to get you they can.
Here are the things you can do to make you more secure than your neighbor though, which means they get hacked and not you!
-Once you have every device you want connected turn off your SSID broadcasting.
-Don't have a password under 10 characters (the guy giving the seminar said his is over 50, but he was a little extreme, Mine is about 15) and make it alpha numeric, the more random the better.
-Use WPA2 encrytion, for now that is the most secure.
-Pay attention to what Wifi you are connecting too. There are devices that can essentially broadcast and connect your computer to any network.
That is it for this update. I will be dedicating some time to blogging this week so we should see regular updates again for a while at least.
Wednesday, March 25, 2015
Cisco Site to Site VPN
So the reason I have not posted is because I have been working on setting up a site to site VPN using Cisco. I had gone through the configs a few times and couldn't figure out what I was doing wrong. After a week we got Cisco support involved, but it took a week to get the support.
All in all I found out a few things in the process. The most important thing I found out was that make sure you send the correct data to the other end. I had put in an incorrect IP in the form I sent them which made my end correct according to what they sent me and their end incorrect.
I'll post some of the other things I learned along the way in another post (for example the troubleshooting that I did).
I am also planning on putting up a VPN at home this week so I will let you know how it goes!
All in all I found out a few things in the process. The most important thing I found out was that make sure you send the correct data to the other end. I had put in an incorrect IP in the form I sent them which made my end correct according to what they sent me and their end incorrect.
I'll post some of the other things I learned along the way in another post (for example the troubleshooting that I did).
I am also planning on putting up a VPN at home this week so I will let you know how it goes!
Wednesday, March 18, 2015
Tunneling
So sometimes it is necessary to tunnel to get access to a router (which is a way more secure way to get to that router).
Windows:
Windows doesn't have a native terminal. I use PuTTY (tty - teletypewriter new fun fact)
UPDATE: Windows 10 does have a Linux terminal now (its basically an Ubuntu shell if I remember correctly). I will add a post on how to enable it but honestly I have found I prefer KiTTY.
In the settings under Connections>SSH>Tunnels you can add a tunnel. Source port is the port you want to connect through and then the ip of the gateway and port. Click add and it adds it to the list above.
Then go to 127.0.0.1:8080
For those seeking an alternative to PuTTY I found KiTTY it is similar but gives the end user a few more options, as well as allows for saving sessions to a directory or registry. I am pretty sure it was built with the PuTTY backbone though.
Windows:
Windows doesn't have a native terminal. I use PuTTY (tty - teletypewriter new fun fact)
UPDATE: Windows 10 does have a Linux terminal now (its basically an Ubuntu shell if I remember correctly). I will add a post on how to enable it but honestly I have found I prefer KiTTY.
In the settings under Connections>SSH>Tunnels you can add a tunnel. Source port is the port you want to connect through and then the ip of the gateway and port. Click add and it adds it to the list above.
Then go to 127.0.0.1:8080
For those seeking an alternative to PuTTY I found KiTTY it is similar but gives the end user a few more options, as well as allows for saving sessions to a directory or registry. I am pretty sure it was built with the PuTTY backbone though.
Linux:
ssh -f user@ip.of.lan.machine -L 8080:ip.of.default.gateway:443 -N
-L is for local-port:hostname:remote-port format
-N is to not execute a command on the remote system.
Then go to 127.0.0.1:8080 -note if it is https you may have to put in https:// before the 127
A Ctrl + c should end the tunnel.
ssh -f user@ip.of.lan.machine -L 8080:ip.of.default.gateway:443 -N
-L is for local-port:hostname:remote-port format
-N is to not execute a command on the remote system.
Then go to 127.0.0.1:8080 -note if it is https you may have to put in https:// before the 127
A Ctrl + c should end the tunnel.
Monday, March 16, 2015
Google Voice getting phone calls.... And other settings!
I love Google Voice. I am a huge fan of texting it gets things done its quick. Mostly I grew up in the era of IM's so it is something I used to spend many sleepless nights doing. Google voice just makes sense for this. I used it for a bit but didn't really need it. Now I rely heavily on it as I do not have a phone outside of emergencies and an old iPhone with no service.
So it took me a while to figure out why my Google voice was not accepting calls correctly to my iPhone, I didn't have the time until recently to dig into it, a few quick searches and I found it. In saying that I want to point out that searching for the correct key words really helps.
Basically what I use for all calls is my Google voice and it was great for outgoing calls and text, but I couldn't receive calls. Well I found the answer! There is setting that it seems is only turned off initially with iPhones, thank you Google...
To send pictures using your Google Voice number from a computer go to the bottom.
Below is how to fix it.
What I found was
1) You have to use the "Hangouts" app (the Google voice app makes it go through your phone)
2) You have to change a single setting called incoming calls or something of that sort which is under another setting called phone number.
I pasted the instructions from
https://support.google.com/voice/answer/3438876?hl=en
Get an incoming call
To receive incoming calls through Hangouts, you must have a Google Voice account. Incoming calls will appear as notifications instead of ringing directly on your cell phone. You can answer the call by touching the notification or swiping it on the lock screen. But remember, if your screen is passcode-protected, you’ll have to unlock it first.
If you have Google Voice set to forward calls to your cell phone, you’ll receive the call directly to your phone instead of through the Hangouts app.
Set the Hangouts app as the default for incoming Google Voice calls
You can only set the Hangouts app as the default for incoming Google Voice calls if you are a U.S. Google Voice customer.
Open the iOS Hangouts app.
Touch your profile photo at the top of the screen.
Choose the settings icon
Touch Phone number.
Touch Incoming phone calls to on make Hangouts the preferred destination for all calls made to your Google Voice number.
Hangouts will be the automatic setting for calls to the Hangout app on iPads and iPod Touches, but not iPhones.
This setting is only for each device you have, not each account. So if you more than one device you'll need to change the setting on each device.
Sending Pictures from Google Voice number
First off you have to be using the new hangouts chat in G-mail. Once there search for the person or number you want to send to. With this just start typing in the contact name and then click on the sms link for the desired phone number.
From the iPhone app you just click the paperclip button...
Wednesday, March 11, 2015
Random Tips
These are just things I don't really have a place for but I don't want to forget either.
Disable enable Task Manager and Windows Lock Work Station
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
32 bit REG_DWORD
Hit your Window keys really fast and make sure it pops up quickly. It is most likely jammed (I couldn't figure out why windows media player kept popping up). Other possible culprits are Ctrl and Alt keys but I have seen Windows key most.
Chrome extensions:
Adblock and Adblock plus if you do not have these install them.
I decided to include a story about why these are great tools I support. So I had them installed and then my sister asked for a program like dia where you could make a map of things etc. I decided to try dia out and thought it was nice and intuitive. I sent her a link to one of the download pages and it was filled with ads (which I did not know as I had adblock on) and she clicked an incorrect download link and got some nice adware. A simple system restore fixed her problem but at the same time I realized that everyone needs this and from now on when sharing downloads to family I will just have to do it through Drop Box.
Notepad++
Add "," comma to end of lines in Notepad++
Notepad made life is easier for user to add comma at the end of the each row.
1) Keep the cursor at the end of the column
2) Press SHIFT + ALT + DOWN ARROW KEY till you reach last row or drag till the rows you wish to add comma
3) Press "," comma and you see comma is added to end of all rows,
- You can also use this feature for indenting as well. In the above example, you just have to use SPACE or TAB instead of COMMA.
Compare 2 files?
WinMerge is a good tool Linux has a native file comparison (comm) need to find out more about it
diff can also be used in Linux but that just shows the differences comm compares.
Super large file?
Vim is for Linux and Windows. It is the only thing I have found that allowed me to navigate a sql database file that was massive (a couple of gig).
Windows keys that come with computers can only be used on that mother board (there are ways around this although the legality I have heard is questionable).
Disable enable Task Manager and Windows Lock Work Station
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
32 bit REG_DWORD
- DisableTaskMgr 1 is disable and 0 is enable.
- DisableLockWorkstation 1 is disable and 0 is enable
Hit your Window keys really fast and make sure it pops up quickly. It is most likely jammed (I couldn't figure out why windows media player kept popping up). Other possible culprits are Ctrl and Alt keys but I have seen Windows key most.
Chrome extensions:
Adblock and Adblock plus if you do not have these install them.
I decided to include a story about why these are great tools I support. So I had them installed and then my sister asked for a program like dia where you could make a map of things etc. I decided to try dia out and thought it was nice and intuitive. I sent her a link to one of the download pages and it was filled with ads (which I did not know as I had adblock on) and she clicked an incorrect download link and got some nice adware. A simple system restore fixed her problem but at the same time I realized that everyone needs this and from now on when sharing downloads to family I will just have to do it through Drop Box.
Monday, March 9, 2015
Syslog Server for localhost and Cisco.
A bit ago I posted about Linux audit logs. This is kind of a follow up to that. It is a much nicer way to view and search them.
So I set up a syslog server, but I decided to make it much nicer to myself and add a program called loganalyzer to it (it uses apache and php to view the logs and makes it look so much nicer).
I was going to put this in a CentOS box I had installed but I forgot the password, so I was going to fresh install everything anyway but the most recent Virtual Box update broke PXE booting.. So I installed everything on my Fedora 20 test box.
I followed the basic instructions (with a few modifications) from
http://tecadmin.net/setup-rsyslog-with-mysql-and-loganalyzer/
and
http://tecadmin.net/setup-loganalyzer-with-rsyslog-and-mysql/ but I will post them as well as I had trouble with step 3.6 to 3.7 so I started over from step 3.1 and got it to work. Basically it kept looping me weird.back to step 6.
The basics are:
Install the packages:
# yum install php php-mysql mysql-server httpd
Start the services:
# service httpd start
# service mysqld start
Make sure they are on at startup:
# chkconfig httpd on
# chkconfig mysqld on <-wouldn't run for me
# mysqladmin -u root password 'itsasecret'
Install more packages:
# yum install rsyslog rsyslog-mysql
Turn off syslog:
# service syslog stop
# chkconfig syslog off
Turn on rsyslog:
# service rsyslog start
# chkconfig rsyslog on
Create rsyslog Database:
# mysql -u root -p < /usr/share/doc/rsyslog-mysql-4.8.10/createDB.sql
Create MySQL user and grant privileges
# mysql -u root -p
mysql> GRANT ALL ON Syslog.* TO 'user'@'localhost' IDENTIFIED BY 'itsadifferentsecret';
mysql> FLUSH PRIVILEGES;
mysql> exit
# vi /etc/rsyslog.conf <-note you can use whatever editor you want here.
In the Modules section of the file (this is near the begining) add:
$ModLoad ommysql
*.* :ommysql:127.0.0.1,Syslog,user,itsadifferentsecret
Restart the service
# service rsyslog restart
Then install loganaylzer:
# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
# tar xzf loganalyzer-3.6.5.tar.gz
Move it to where httpd can get to:
# mv loganalyzer-3.6.5/src /var/www/html/loganalyzer
Create a blank config file and give apache the rights to it:
# cd /var/www/html/loganalyzer
# touch config.php
# chown apache:apache config.php
# chmod 777 config.php
I went through quite a few sites and most all have the same content so you can google rsyslog and loganalyzer and they find one. I liked his because it had pictures as well as the commands written out.
Changes: I couldn't set the mysqld to run at start up but the mariadb would so I did that (not sure if this is working yet).
Also note there is a newer version of loganalyzer than he is using.
I will be adding other servers to the logging once I get that figured out.
I had some trouble setting up the Cisco configuration on the server but all in all I got it working. This is what I ended up doing:
In the rsyslog.conf file:
Uncomment out $ModLoad imudp and $UPDServerRun 514 lines
At the bottom add the following two lines to the bottom of the file:
# # Logging for Cisco router 192.168.1.1 # local7.* /var/log/cisco
$AllowedSender UDP, 127.0.0.1, ip.of.cisco.router
Then add the file:
touch /var/log/cisco
restart the rsyslog service:
rsyslog service restart
In order to get it to show up in loganalyzer:
chmod 755 cisco (I don't remember why i did those permissions but they worked)
Make sure firewall rules allow for connections on ports 514 and 80
#not necessary
In the admin console (after the permissions are changed) add a source that looks like the following:
I also ended up opening port the default port 514 on udp for the server as I couldn't figure out why the settings were not working. I basically changed things a number of times so I am not sure when it started working but this is the ending configuration of everything.
Lastly you have to set up the Cisco part. That was pretty intuitive basically I just put the logging level I wanted as well as the IP address I was sending the logs to. Once that was done I made sure it was turned on. I was using Cisco Configuration Professional but ASDM is pretty similar in its config.
The end results!! BEHOLD!
When I rebooted I noticed my firewall was not working correctly. I opened ports 514 for TCP and UDP and everything worked again. I did this through the GUI in Fedora 20.
So I set up a syslog server, but I decided to make it much nicer to myself and add a program called loganalyzer to it (it uses apache and php to view the logs and makes it look so much nicer).
I was going to put this in a CentOS box I had installed but I forgot the password, so I was going to fresh install everything anyway but the most recent Virtual Box update broke PXE booting.. So I installed everything on my Fedora 20 test box.
I followed the basic instructions (with a few modifications) from
http://tecadmin.net/setup-rsyslog-with-mysql-and-loganalyzer/
and
http://tecadmin.net/setup-loganalyzer-with-rsyslog-and-mysql/ but I will post them as well as I had trouble with step 3.6 to 3.7 so I started over from step 3.1 and got it to work. Basically it kept looping me weird.back to step 6.
The basics are:
Install the packages:
# yum install php php-mysql mysql-server httpd
Start the services:
# service httpd start
# service mysqld start
Make sure they are on at startup:
# chkconfig httpd on
# chkconfig mysqld on <-wouldn't run for me
# mysqladmin -u root password 'itsasecret'
Install more packages:
# yum install rsyslog rsyslog-mysql
Turn off syslog:
# service syslog stop
# chkconfig syslog off
Turn on rsyslog:
# service rsyslog start
# chkconfig rsyslog on
Create rsyslog Database:
# mysql -u root -p < /usr/share/doc/rsyslog-mysql-4.8.10/createDB.sql
Create MySQL user and grant privileges
# mysql -u root -p
mysql> GRANT ALL ON Syslog.* TO 'user'@'localhost' IDENTIFIED BY 'itsadifferentsecret';
mysql> FLUSH PRIVILEGES;
mysql> exit
# vi /etc/rsyslog.conf <-note you can use whatever editor you want here.
In the Modules section of the file (this is near the begining) add:
$ModLoad ommysql
*.* :ommysql:127.0.0.1,Syslog,user,itsadifferentsecret
Restart the service
# service rsyslog restart
Then install loganaylzer:
# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
# tar xzf loganalyzer-3.6.5.tar.gz
Move it to where httpd can get to:
# mv loganalyzer-3.6.5/src /var/www/html/loganalyzer
Create a blank config file and give apache the rights to it:
# cd /var/www/html/loganalyzer
# touch config.php
# chown apache:apache config.php
# chmod 777 config.php
Here I had some selinux issues. I ran: "setenforce 0" and was able to find out the problem.
Run: setsebool -P http_read_user_content 1
If you changed setenforce change it back to 1
In a web browser go to:
http:ip.of.log.server/loganalyzer/install.php
(I did this on the local machine)
Here is where I recommend using the other guys pictures as I didn't take any... Sorry. It is pretty intuitive to set up from here as well.
Changes: I couldn't set the mysqld to run at start up but the mariadb would so I did that (not sure if this is working yet).
Also note there is a newer version of loganalyzer than he is using.
I will be adding other servers to the logging once I get that figured out.
I had some trouble setting up the Cisco configuration on the server but all in all I got it working. This is what I ended up doing:
In the rsyslog.conf file:
Uncomment out $ModLoad imudp and $UPDServerRun 514 lines
At the bottom add the following two lines to the bottom of the file:
# # Logging for Cisco router 192.168.1.1 # local7.* /var/log/cisco
$AllowedSender UDP, 127.0.0.1, ip.of.cisco.router
Then add the file:
touch /var/log/cisco
restart the rsyslog service:
rsyslog service restart
In order to get it to show up in loganalyzer:
chmod 755 cisco (I don't remember why i did those permissions but they worked)
Make sure firewall rules allow for connections on ports 514 and 80
#not necessary
In the admin console (after the permissions are changed) add a source that looks like the following:
I also ended up opening port the default port 514 on udp for the server as I couldn't figure out why the settings were not working. I basically changed things a number of times so I am not sure when it started working but this is the ending configuration of everything.
Lastly you have to set up the Cisco part. That was pretty intuitive basically I just put the logging level I wanted as well as the IP address I was sending the logs to. Once that was done I made sure it was turned on. I was using Cisco Configuration Professional but ASDM is pretty similar in its config.
The end results!! BEHOLD!
When I rebooted I noticed my firewall was not working correctly. I opened ports 514 for TCP and UDP and everything worked again. I did this through the GUI in Fedora 20.
Wednesday, March 4, 2015
Password Rants and Raves...
Sometimes it is necessary to update a password or sometimes you can't use the default one you use for everything. For things you use regularly I recommend at minimum changing your password every three months, especially for anything that has sensitive information. Not that passwords are all guessable, I love my base one, but I did see 2014 top dumb passwords list and was surprised at how easy some are, including numbers 1 and 2 respectively 123456 and password (http://www.cnet.com/news/worst-passwords-of-2014-are-just-as-awful-as-you-can-imagine/).
If you don't want the hassle of changing all of your passwords, most online services have two factor (basically a number that changes every 30 seconds). So long as you have an accurate time it works nicely. I have seen private ones get blocked by firewalls because the ntp service could not reach the server.
So here are a couple of suggestions for varying strength in passwords.
Simple:
Go to a dictionary (physical book or online) and find a random word (thumb the page for a few seconds and stop after about 3-7 then find a word on the page or choose a random word from your favorite dictionary site). Convert that word into leet (1337) there are various methods of doing this, including online converters that you choose the conversion. Generally I only use a few @ for a $ for s and 3 for e to keep it simple.
Find a poem you like and choose the first letters of each word, or line.
Write a poem and do the same.
Add a ... or ,,, or ??? etc at the end of your current password - (this actually increases it's complexity significantly)
http://creativitygames.net/random-word-generator is a site that I often use as it lets you pick a number of random words.
http://watchout4snakes.com/ is another good one that gives you options to make a phrase etc.
More Complex:
Convert a phrase to leet from your favorite quotes, books, etc.
Grab multiple words in the dictionary (3 to 4 is generally a good amount of security) and throw in random numbers and symbols.
http://www.robertecker.com/hp/research/leet-converter.php
This is my favorite leet converting site. Mostly because it lets you pick a few things thus making it more random or pre-generated if you are lazy ^.^
Most complex:
Use a random alpha numeric and symbol generator (the utility here is from a personal developer I know http://www.maxoutput.com/)
It is actually a networking utility (I use that aspect of it the most) but the fact that it creates random passwords has been a bonus. It even does more than one at once.
From my experience I believe generally 10 to 12 characters minimum is sufficient, but beefier the better.
If you are anything like me you have many variations on your password and cannot always keep straight which one is which. Well I have 3 solutions:
Classic little black book - no one looks for these any more, you can get one for about a dollar at the store for notes and such and just choose a page for passwords.
KeePass - If you don't like carrying notebooks around but always have a flash drive you can use Key Pass. the nice thing about it is it lets you organize everything as well. It does however take a password to open so in reality you only need to remember 1 password so you can access everything else. You can also make notes about each item. It includes a random password creator which is (I think) intended for use as you are making accounts.
Passpack - So I recently started using this because of work. It is nice in that you can share your password with people if you want as well as has 2 layers of passwords before you get to actually see the passwords. The other nice thing is it is online. A simple account is free to use with limited sharing etc but I found I didn't need more than that. You create an account, Then you create what they call a packing key (they recommend using a sentence). Then you can view things, search the database they have and even "hide" things from people peeking over your shoulder. They even include a generator as well I found out the other day.
https://www.passpack.com/online/
I mostly use KeePass as I have used that one the longest and am most comfortable with it.
This one was a bit long but hopefully people will be encouraged to beef up their security a bit.
If you don't want the hassle of changing all of your passwords, most online services have two factor (basically a number that changes every 30 seconds). So long as you have an accurate time it works nicely. I have seen private ones get blocked by firewalls because the ntp service could not reach the server.
So here are a couple of suggestions for varying strength in passwords.
Simple:
Go to a dictionary (physical book or online) and find a random word (thumb the page for a few seconds and stop after about 3-7 then find a word on the page or choose a random word from your favorite dictionary site). Convert that word into leet (1337) there are various methods of doing this, including online converters that you choose the conversion. Generally I only use a few @ for a $ for s and 3 for e to keep it simple.
Find a poem you like and choose the first letters of each word, or line.
Write a poem and do the same.
Add a ... or ,,, or ??? etc at the end of your current password - (this actually increases it's complexity significantly)
http://creativitygames.net/random-word-generator is a site that I often use as it lets you pick a number of random words.
http://watchout4snakes.com/ is another good one that gives you options to make a phrase etc.
More Complex:
Convert a phrase to leet from your favorite quotes, books, etc.
Grab multiple words in the dictionary (3 to 4 is generally a good amount of security) and throw in random numbers and symbols.
This is my favorite leet converting site. Mostly because it lets you pick a few things thus making it more random or pre-generated if you are lazy ^.^
Most complex:
Use a random alpha numeric and symbol generator (the utility here is from a personal developer I know http://www.maxoutput.com/)
It is actually a networking utility (I use that aspect of it the most) but the fact that it creates random passwords has been a bonus. It even does more than one at once.
From my experience I believe generally 10 to 12 characters minimum is sufficient, but beefier the better.
If you are anything like me you have many variations on your password and cannot always keep straight which one is which. Well I have 3 solutions:
Classic little black book - no one looks for these any more, you can get one for about a dollar at the store for notes and such and just choose a page for passwords.
KeePass - If you don't like carrying notebooks around but always have a flash drive you can use Key Pass. the nice thing about it is it lets you organize everything as well. It does however take a password to open so in reality you only need to remember 1 password so you can access everything else. You can also make notes about each item. It includes a random password creator which is (I think) intended for use as you are making accounts.
Passpack - So I recently started using this because of work. It is nice in that you can share your password with people if you want as well as has 2 layers of passwords before you get to actually see the passwords. The other nice thing is it is online. A simple account is free to use with limited sharing etc but I found I didn't need more than that. You create an account, Then you create what they call a packing key (they recommend using a sentence). Then you can view things, search the database they have and even "hide" things from people peeking over your shoulder. They even include a generator as well I found out the other day.
https://www.passpack.com/online/
I mostly use KeePass as I have used that one the longest and am most comfortable with it.
This one was a bit long but hopefully people will be encouraged to beef up their security a bit.
Monday, March 2, 2015
Wireshark and tcpdump
First off let me say I started using Wireshark having NO IDEA what the crap was going on other than I see things on the network. This made it a very non useful tool to me. I could find out things I wanted to know without so much jumble in the middle other ways. That said I never had to look at packets as I was generally trying to figure out other things.
Now I have taken the time to look at a few things with it, as I needed a way to capture the packets so the development department at work could figure out if we were truncating responses in our software or if a client was.
Some things to note:
1) Working with Wireshark is much easier once you understand it a bit. It is not something I think someone should just jump into as it gets frustrating.
2) Know what you want to do before you go to Wireshark. In this example I am looking for requests and responses to one other machine.
3) Understand filtering of what you want to do.
So I want to filter two machines (hopefully based on IP) and I want to follow their tracing.
Now I can only capture based on what is sent to one computer so I would need Wireshark on both computers (this being said I only have access to one so I was only responsible for getting results to one).
So objective: Compare two packets and see if loss occurs.
tcpdump is another tool that lets us do basically the same thing but command line only. Write it to a file and then import it to another machine and load it in Wireshark if you prefer the gui.
tcpdump -w <filename>.pcap -i eth0
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
(I forgot my username at first, then I forgot to do it with sudo ^.^ sorry but at least it has the commands in there)
Ctrl+c to stop the dump. I believe you can also run it as a daemon but I don't remember.
Results:
Effectively what I ended up doing was using just what I said using tcpdump and inporting it to Wireshark. I dumped everything as I didn't have my notes with but but luckily Wireshark lets you filter very nicely which made it easy. The hard part is I don't have the .pcap file from the other people to compare with they only sent over the csv of ALL the communication between the two computers but none of the packets, which I want to compare.
I merged the two files together so it would be easier to try and use native Wireshark tools to try and analyze it. Here is what I used to filter out the two. The times are different on our end and theirs which made it hard to search through and note I am only looking for https requests hence port 443 being looked at only.
(ip.src == internal.ip.addr.server && ip.addr == external.ip.addr.client) || (ip.src == external.ip.addr.server && ip.addr == internal.ip.addr.client) && tcp.port == 443
I don't have a server and client scan that I can use (the one I was using has sensitive data on it so I don't want to take a chance).
Here is a smaller filter of a packet capture I did that uses part of this larger filter:
The || is or so if you have both files combined it works nicely. There are lots of tips for filtering Wireshark. Just give Google a go.
Wiresharks native compare tool almost lined the times up exactly from what I could tell which made it much easier to tell where the packet loss happened as well as the fact they issued a connection reset. All in all it was most useful yet we didn't find what was causing the "bug" in our (or their) software, but now I know a lot more about packets and networking.
The compare tool told me basically the time difference and I was able to find it on both sides using that but also because I was at the location on one side and at the beginning of the trace on the other and it just happened to be at the beginning of the other trace. We calculated the difference by hand (basically found some packets that matched and subtracted the time difference) and the compare tool was right on. If you are using two different traces, you have to combine them together first then compare, otherwise it won't tell you much.
Other things to note the sending side will always have more than the receiving as parts are getting stripped in the routing.
Now I have taken the time to look at a few things with it, as I needed a way to capture the packets so the development department at work could figure out if we were truncating responses in our software or if a client was.
Some things to note:
1) Working with Wireshark is much easier once you understand it a bit. It is not something I think someone should just jump into as it gets frustrating.
2) Know what you want to do before you go to Wireshark. In this example I am looking for requests and responses to one other machine.
3) Understand filtering of what you want to do.
So I want to filter two machines (hopefully based on IP) and I want to follow their tracing.
Now I can only capture based on what is sent to one computer so I would need Wireshark on both computers (this being said I only have access to one so I was only responsible for getting results to one).
So objective: Compare two packets and see if loss occurs.
tcpdump is another tool that lets us do basically the same thing but command line only. Write it to a file and then import it to another machine and load it in Wireshark if you prefer the gui.
tcpdump -w <filename>.pcap -i eth0
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
Ctrl+c to stop the dump. I believe you can also run it as a daemon but I don't remember.
Results:
Effectively what I ended up doing was using just what I said using tcpdump and inporting it to Wireshark. I dumped everything as I didn't have my notes with but but luckily Wireshark lets you filter very nicely which made it easy. The hard part is I don't have the .pcap file from the other people to compare with they only sent over the csv of ALL the communication between the two computers but none of the packets, which I want to compare.
I merged the two files together so it would be easier to try and use native Wireshark tools to try and analyze it. Here is what I used to filter out the two. The times are different on our end and theirs which made it hard to search through and note I am only looking for https requests hence port 443 being looked at only.
(ip.src == internal.ip.addr.server && ip.addr == external.ip.addr.client) || (ip.src == external.ip.addr.server && ip.addr == internal.ip.addr.client) && tcp.port == 443
I don't have a server and client scan that I can use (the one I was using has sensitive data on it so I don't want to take a chance).
Here is a smaller filter of a packet capture I did that uses part of this larger filter:
The || is or so if you have both files combined it works nicely. There are lots of tips for filtering Wireshark. Just give Google a go.
Wiresharks native compare tool almost lined the times up exactly from what I could tell which made it much easier to tell where the packet loss happened as well as the fact they issued a connection reset. All in all it was most useful yet we didn't find what was causing the "bug" in our (or their) software, but now I know a lot more about packets and networking.
The compare tool told me basically the time difference and I was able to find it on both sides using that but also because I was at the location on one side and at the beginning of the trace on the other and it just happened to be at the beginning of the other trace. We calculated the difference by hand (basically found some packets that matched and subtracted the time difference) and the compare tool was right on. If you are using two different traces, you have to combine them together first then compare, otherwise it won't tell you much.
Other things to note the sending side will always have more than the receiving as parts are getting stripped in the routing.
Wednesday, February 25, 2015
Linux Audit Logs
So I had to dig through the Linux audit logs the other day and it was a bit painful to look at.
sealrert - this lets you read alerts that are in your audit log file.
I think you have to install it with yum install setroubleshoot-server
It isn't the best but it if you want the basics
yum install setroubleshoot-server
After the install is completed, you can then analyze the audit log by issuing the following command:
sealert -a /var/log/audit/audit.log > /var/log/audit/audit_human_readable.log
rcauditd is an audit service that makes it much easier to understand things.
I found the summary to be quite useful as it is literally a quick view of everything.
aureport --summary
This let me see basically everything I wanted to and specify time frame as well as other useful things like who logged in etc.
A good link is:
https://www.suse.com/documentation/sles11/singlehtml/audit_quickstart/audit_quickstart.html
sealrert - this lets you read alerts that are in your audit log file.
I think you have to install it with yum install setroubleshoot-server
It isn't the best but it if you want the basics
yum install setroubleshoot-server
After the install is completed, you can then analyze the audit log by issuing the following command:
sealert -a /var/log/audit/audit.log > /var/log/audit/audit_human_readable.log
rcauditd is an audit service that makes it much easier to understand things.
I found the summary to be quite useful as it is literally a quick view of everything.
aureport --summary
This let me see basically everything I wanted to and specify time frame as well as other useful things like who logged in etc.
A good link is:
https://www.suse.com/documentation/sles11/singlehtml/audit_quickstart/audit_quickstart.html
Monday, February 23, 2015
Linux/Windows/Mac and Opinion
I will try to not be exclusive in the future with the how to's etc. If someone really needs me to convert something I have written to a different OS ask. I have comments open for a reason and will do my best, or feel free to email me. The rest of this post is kinda rant like so feel free to skip it.
So I am a windows user and have been for an extremely long time, but mostly by culture not by choice. Essentially Windows was chosen for me many times and I've just gone with it. I have looked at Apple and played with it a bit but in all honesty I am starting to fall in love with Linux distros.
1) They are FREE 99
2) They come with the things you need when working as an admin.
3) Updates are much easier to handle and control I feel.
Reasons why I will ALWAYS own a windows machine (or VM):
1) Gaming - people don't develop games as much for linux
2) Excel - It is the most robust tool for any financial things and although I am not an expert with it (nor an accountant) I get files that are in Excel format and can't always change/convert.
So From what I have found it comes down to why are you using the machine. I have something like 5 or 6 (or maybe closer to 10) computers in my house and I use each for different reasons. In working as an Administrator I have found you pretty much have to use Linux at some point and so I am learning what I can replace on Windows with Linux alternatives and for somethings it is just easier for me to do in Windows because I have done it that way for so long.
So I guess I am going to re-install some of my computers with Linux.
I decided to comment on Mac as well. I own a really really old (over 10 years) MacBook but I'm a poor guy so I am not able to speculate on Mac. Nor will I include any mac stuff in my how to's as I can't test it.
So I am a windows user and have been for an extremely long time, but mostly by culture not by choice. Essentially Windows was chosen for me many times and I've just gone with it. I have looked at Apple and played with it a bit but in all honesty I am starting to fall in love with Linux distros.
1) They are FREE 99
2) They come with the things you need when working as an admin.
3) Updates are much easier to handle and control I feel.
Reasons why I will ALWAYS own a windows machine (or VM):
1) Gaming - people don't develop games as much for linux
2) Excel - It is the most robust tool for any financial things and although I am not an expert with it (nor an accountant) I get files that are in Excel format and can't always change/convert.
So From what I have found it comes down to why are you using the machine. I have something like 5 or 6 (or maybe closer to 10) computers in my house and I use each for different reasons. In working as an Administrator I have found you pretty much have to use Linux at some point and so I am learning what I can replace on Windows with Linux alternatives and for somethings it is just easier for me to do in Windows because I have done it that way for so long.
So I guess I am going to re-install some of my computers with Linux.
I decided to comment on Mac as well. I own a really really old (over 10 years) MacBook but I'm a poor guy so I am not able to speculate on Mac. Nor will I include any mac stuff in my how to's as I can't test it.
Thursday, February 19, 2015
Task oriented
I am a very task oriented person.
Pen and paper works best for me. something about hand writing it helps me.
other options:
Evernote:
I was not a big fan of, mostly because writing it down kept me more focused. It does allow you to do many more things though so if you are a good note taker and have lots of notes this is a nice application.
I stole the image from Google (I think it actually came from the evernote blog).
Google tasks:
https://mail.google.com/tasks/canvas
Lets you have multiple lists. I use this one for goals for myself rather than actual tasks.
Your phone task list - I never got this one down but for some people it is a quick task list they need.
Another one that I have used is Asana.
This is a nice way for a manager to assign tasks as well as it makes it easy to break things down to different levels and make projects. This was very nice for me when my tasks changed daily on what I needed to work on as my manager could see what I was doing and assign things different priorities. The best part about it is the hidden unicorn feature.
Same thing for this image as the Evernote one.
Pen and paper works best for me. something about hand writing it helps me.
other options:
Evernote:
I was not a big fan of, mostly because writing it down kept me more focused. It does allow you to do many more things though so if you are a good note taker and have lots of notes this is a nice application.
Google tasks:
https://mail.google.com/tasks/canvas
Lets you have multiple lists. I use this one for goals for myself rather than actual tasks.
Your phone task list - I never got this one down but for some people it is a quick task list they need.
Another one that I have used is Asana.
This is a nice way for a manager to assign tasks as well as it makes it easy to break things down to different levels and make projects. This was very nice for me when my tasks changed daily on what I needed to work on as my manager could see what I was doing and assign things different priorities. The best part about it is the hidden unicorn feature.
Same thing for this image as the Evernote one.
Wednesday, February 18, 2015
Microsoft Security Essentials Logs
So there may come a time when you need to know what has happened with your virus scans for reporting or anything really (for me it was reporting). Well when that happens here is how you can find your logs in Microsoft Security Essentials.
Microsoft Security Essentials (MSE) actually logs all of its scans and findings, although you can't find them in the program itself. It logs them to the event viewer.
Microsoft Security Essentials (MSE) actually logs all of its scans and findings, although you can't find them in the program itself. It logs them to the event viewer.
There are a couple of options:
1) Find and create a filter for the specific logging you want.
2) There is a built in dump of all of the logs to one file called MpCmdRun
To run the built in option simply open an administrator command prompt and go to the directory where it is located.
cd %programfiles%\Microsoft Security Essential
[add pic]
Then run "MpCmdRun.exe -getfiles"
It takes a bit to run sometimes depending on how often and how many logs there are.
It makes a file called MPSupportFiles.cab which will be saved automatically to "%ProgramData%\Microsoft\Microsoft Antimalware\Support\" folder
[add pic]
The other option lets you export an XML so you can then import that into MySQL or anything really. I will get a query once I test it out again.
You can also use the Event Viewer (Start > Run > eventvwr.msc) under [System] right click View > filter (by Event Source: Microsoft Antimalware)
I usually make the filter for a week so I don't get too much data.
I filter out the update events but other than that here is the xml:
<ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>System</Channel><Source>Microsoft Antimalware</Source><RelativeTimeInfo>4</RelativeTimeInfo><EventId>-2000</EventId></Simple></QueryParams><QueryNode><Name>MSE Events</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft Antimalware'] and TimeCreated[timediff(@SystemTime) <= 604800000]]]</Select><Suppress Path="System">*[System[(EventID=2000)]]</Suppress></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>
It is all in one line. To export it to a database it is easier to use powershell but that was a project in and of itself so I am not going to go over that in this post.
Monday, February 9, 2015
How to reduce the root partition in LVM
So at work I ended up being told two different things. First I was told use all of the disk space so that we can get an LVM with as much size on it as possible. Then I was told oh we need 20 percent or so so that we can use it for backing up. With that I set out on a mission to find out how to resize LVM space. We come to find out we put the root partition in the LVM. This means we have a few more steps to do.
A few sites mention how to do this but I found one step by step guide with pictures the rest were not as informative as this site and we were using the same distro so I chose to use this for my base documentation. Other changes include a few grammer tweaks.
Best practice would be to make sure you don't have to shrink your LVM as it can become corrupt, and it is much easier to enlarge it.
Modified from:
https://rbgeek.wordpress.com/2013/02/11/how-to-reduce-the-root-partition-in-lvm/
My additions are in blue comments and have brackets
In this tutorial, I am using the CentOS 6 (I believe that its also applicable on other Linux distro but haven't tried yet) that has ext4 partition lv_root mounted as / and lv_swap as swap from the volume group vg_centos6 (which is default), that has two hard drives (66GB & 25GB). Due to some reasons, I want to remove the 25GB hard drive from my computer and want to add new 50 GB hard drive. Before, removing the hard drive from the computer, we need to resize the lv_root, then remove it from volume group and at the end from the physical volume.
WARNING: It’s really dangerous, so backup your data before attempting this. Please don’t blame me, if you destroy your system. You are responsible for your own actions!
Check the size of lv_root before starting this process:
df -h
Boot from CentOS 6 DVD (or any other Linux distro that you are using) and select “rescue” option:
[The next thing I chose to do was I selected to enable the em0 (the ethernet device adapter) incase I needed it for any reason. This was not a step mentioned in the tutorial I took this from.]
Select the Skip, so that it will not mount the filesystem:
Run these commands:
pvscan
vgscan
vgchange -a y
lvscan
Display the lv_root:
lvdisplay /dev/vg_centos6/lv_root
[This section would not run] fsck on the large root filesystem (lv_root):
fsck.ext4 /dev/vg_centos6/lv_root
]
Run e2fsck with -f (force) option:
e2fsck -f /dev/vg_centos6/lv_root
Issue the resize2fs command to reduce the filesystem (Important: The size here is the actual/total size of thelv_root after reduce, not the size that we want to decrease):
resize2fs -p /dev/vg_centos6/lv_root 65G [I chose to use 2750G as we have 4 terabytes and that is what I calculated to be 20 % ish]
Now, issue the lvreduce command to reduce the logical volume size:
lvreduce -L 65G /dev/vg_centos6/lv_root [Once again I chose to use 2750G]
Run lvdisplay command to confirm the change:
lvdisplay /dev/vg_centos6/lv_root
Reboot the system and login. Remove the disk (in my case it is, /dev/sdb1) from volume group and then from physical volume:
[These next two commands would also not run]
sudo vgreduce vg_centos6 /dev/sdb1
sudo pvremove /dev/sdb1
]
Check the size of lv_root after all these changes:
df -h
Success!
Boot from CentOS 6 DVD (or any other Linux distro that you are using) and select “rescue” option:
[The next thing I chose to do was I selected to enable the em0 (the ethernet device adapter) incase I needed it for any reason. This was not a step mentioned in the tutorial I took this from.]
Select the Skip, so that it will not mount the filesystem:
Run these commands:
pvscan
vgscan
vgchange -a y
lvscan
Display the lv_root:
lvdisplay /dev/vg_centos6/lv_root
[This section would not run] fsck on the large root filesystem (lv_root):
fsck.ext4 /dev/vg_centos6/lv_root
]Run e2fsck with -f (force) option:
e2fsck -f /dev/vg_centos6/lv_root
Issue the resize2fs command to reduce the filesystem (Important: The size here is the actual/total size of thelv_root after reduce, not the size that we want to decrease):
resize2fs -p /dev/vg_centos6/lv_root 65G [I chose to use 2750G as we have 4 terabytes and that is what I calculated to be 20 % ish]
Now, issue the lvreduce command to reduce the logical volume size:
lvreduce -L 65G /dev/vg_centos6/lv_root [Once again I chose to use 2750G]
Run lvdisplay command to confirm the change:
lvdisplay /dev/vg_centos6/lv_root
Reboot the system and login. Remove the disk (in my case it is, /dev/sdb1) from volume group and then from physical volume:
[These next two commands would also not run]
sudo vgreduce vg_centos6 /dev/sdb1
sudo pvremove /dev/sdb1
]Check the size of lv_root after all these changes:
df -h
Success!
Monday, January 26, 2015
Netstat, ports and taskkill
The netstat command in windows I found very useful for identifying problems with Apache not running. Most of the time I found the actual problem was that something else had already bonded on port 80.
Simply run netstat -ano in the command line (as an administrator of course) and end the process that is causing the hiccup. be warned sometimes this is a system process. You may want to find out more about the process first using the task manager and good old fashioned google searching.
For more info on how to do any of this visit:
http://security.fnal.gov/handouts/IdentifyingOpenPortsWinXP-2003.pdf
Taskkill
The taskkill command is nice if you have a task that just will not close or you opened up a billion of the same thing and you only have a remote connection you don't want to loose. There are other uses for it but I have mostly used it for those things.
If you know the PID (which you can get using the task manager or the aforementioned netstat) or the imagename (which you can use if it is multiple instances of the same)
taskkill /IM imagename /T /F
or
taskkill /PID processid /T /F
The /T kills and child processes which were started by it and the /F forcefully terminates it
Simply run netstat -ano in the command line (as an administrator of course) and end the process that is causing the hiccup. be warned sometimes this is a system process. You may want to find out more about the process first using the task manager and good old fashioned google searching.
For more info on how to do any of this visit:
http://security.fnal.gov/handouts/IdentifyingOpenPortsWinXP-2003.pdf
Taskkill
The taskkill command is nice if you have a task that just will not close or you opened up a billion of the same thing and you only have a remote connection you don't want to loose. There are other uses for it but I have mostly used it for those things.
If you know the PID (which you can get using the task manager or the aforementioned netstat) or the imagename (which you can use if it is multiple instances of the same)
taskkill /IM imagename /T /F
or
taskkill /PID processid /T /F
The /T kills and child processes which were started by it and the /F forcefully terminates it
Monday, January 12, 2015
PHP and SQL
So I used to use these daily (MySQL more than anything and PHP mostly I just looked at and told the dev team it looks like your bug is around here so reading more than writing) and there were a few things I had to look up every time because I'm forgetful. Before I start posting a bunch of other Random Tech Info I wanted a post for my original reason for making the blog! Unfortunately I have less use of it now but for anyone else who may need it here it is!
PHP
Time Zones I commonly needed:
America/Denver
America/Los_Angeles
America/New_York
Full list is available here:
http://php.net/manual/en/timezones.america.php
Error Reporting:
Nothing is more frustrating than bad code, except bad code that doesn't load because of a WAMP errorloging:
[add pic of file here]
Change E_ALL to E_ERROR in the php.ini file. In my opinion the only time a production server should report all errors is in testing or when troubleshooting. Otherwise you are using resources that can be used elsewhere in production.
Other types of "Bad code"
Bad code isn't just code with bugs in it. It is also code that is written that is hard to understand, or code that is written so complicated that it takes forever to run.
Sometimes though it is not as easy as simply "fixing" the code as it is changing the way things are done (for example calculating a number every time versus storing the number in the database once it is calculated and then checking to see if it needs recalculating because other numbers have changed or not because nothing has changed).
Long store short, Sometimes this is needed:
max_execution_time = 300
that is 5 minutes. I don't recommend going higher ever as (from what I have heard) other vulnerabilities may exist and that gives hackers a 5 minute window in that area.
MySQL
Max Allowed Packets-
Most commonly used when restoring large databases (I think the WAMP build was way outdated).
Packets larger than max_allowed_packet are not allowed.
The max_allowed_packet variable can be set globally by running a query.
However, if you do not change it in the my.ini file (as dragon112 suggested), the value will reset when the server restarts, even if you set it globally.
To change the setting for everyone until the server restarts:
SET GLOBAL max_allowed_packet=1073741824;
OR
Change in the my.ini file. Include the single line under [mysqld] in your file
max_allowed_packet=500M
now restart the MySQL service and you are done.
[add pic of file]
http://opensource-soa.blogspot.com/2008/08/change-mysql-maxallowedpacket-variable.html
Creating a TEMP table
CREATE TEMPORARY TABLE IF NOT EXISTS table2 AS (SELECT * FROM table1)
You can get much more in-depth with selecting different columns etc.
Creating table from scratch with unique id's in sequential order to insert data manually
I hated doing this as it involved a lot of hand work until I learned how to do it this way.
SELECT column1,
column2,
column3,
@curRow := @curRow + 1 AS row_number
FROM table
JOIN (SELECT @curRow := 0) r;
Intervals are very useful so you can find things that are most recent or in a certain date range:
SELECT * FROM table
WHERE datetime BETWEEN DATE_SUB(NOW(), INTERVAL 30 DAY) AND NOW();
For SQL Server Identity Insert:
SET IDENTITY_INSERT IdentityTable ON
INSERT IdentityTable(TheIdentity, TheValue) VALUES (3, 'First Row')
SET IDENTITY_INSERT IdentityTable OFF
Using Variables
I didn't have to do this a lot but I had to look it up every time. Essential I had to create a table using information from other tables (if you ever have to do this I am sorry, consult your programmer about just grabbing the information he needs from the places it actually exists... and don't let him BS you he can make it work). I had to make unique ID's for a table and this was the simplest way I could find. Let me know if someone has a better.
First declare your variable.
DECLARE @i AS int;
Then set it to a starting point:
SET @i= 0;
Then your select query:
SELECT @i+1, column1, column2 FROM table1 JOIN table2 on table1.columnA = table2.columnB WHERE columnC = (something);
that is 5 minutes. I don't recommend going higher ever as (from what I have heard) other vulnerabilities may exist and that gives hackers a 5 minute window in that area.
MySQL
Max Allowed Packets-
Most commonly used when restoring large databases (I think the WAMP build was way outdated).
Packets larger than max_allowed_packet are not allowed.
The max_allowed_packet variable can be set globally by running a query.
However, if you do not change it in the my.ini file (as dragon112 suggested), the value will reset when the server restarts, even if you set it globally.
To change the setting for everyone until the server restarts:
SET GLOBAL max_allowed_packet=1073741824;
OR
Change in the my.ini file. Include the single line under [mysqld] in your file
max_allowed_packet=500M
now restart the MySQL service and you are done.
[add pic of file]
http://opensource-soa.blogspot.com/2008/08/change-mysql-maxallowedpacket-variable.html
Creating a TEMP table
CREATE TEMPORARY TABLE IF NOT EXISTS table2 AS (SELECT * FROM table1)
You can get much more in-depth with selecting different columns etc.
Creating table from scratch with unique id's in sequential order to insert data manually
I hated doing this as it involved a lot of hand work until I learned how to do it this way.
SELECT column1,
column2,
column3,
@curRow := @curRow + 1 AS row_number
FROM table
JOIN (SELECT @curRow := 0) r;
Intervals are very useful so you can find things that are most recent or in a certain date range:
SELECT * FROM table
WHERE datetime BETWEEN DATE_SUB(NOW(), INTERVAL 30 DAY) AND NOW();
For SQL Server Identity Insert:
SET IDENTITY_INSERT IdentityTable ON
INSERT IdentityTable(TheIdentity, TheValue) VALUES (3, 'First Row')
SET IDENTITY_INSERT IdentityTable OFF
Using Variables
I didn't have to do this a lot but I had to look it up every time. Essential I had to create a table using information from other tables (if you ever have to do this I am sorry, consult your programmer about just grabbing the information he needs from the places it actually exists... and don't let him BS you he can make it work). I had to make unique ID's for a table and this was the simplest way I could find. Let me know if someone has a better.
First declare your variable.
DECLARE @i AS int;
Then set it to a starting point:
SET @i= 0;
Then your select query:
SELECT @i+1, column1, column2 FROM table1 JOIN table2 on table1.columnA = table2.columnB WHERE columnC = (something);
Subscribe to:
Posts (Atom)