Infoaddict Just another site for Infoaddict's

19Feb/120

Oracle Database 10g R2(10.2.0.1) on RHEL5

Posted by Infoaddict

I'll describe the installation of Oracle Database 10g Release 2 (10.2.0.1) on Red Hat Enterprise Linux 5 (RHEL5). The article is based on a server installation similar to this, with a minimum of 2G swap, secure Linux disabled and the following package groups installed.

GNOME Desktop Environment
Editors
Graphical Internet
Text-based Internet
Development Libraries
Development Tools
Legacy Software Development
Server Configuration Tools
Administration Tools
Base
Legacy Software Support
System Tools
X Window System

Alternative installations may require more packages to be loaded, in addition to the ones listed below.

Download Software
Unpack Files
Hosts File
Set Kernel Parameters
Setup
Installation
Post Installation

Download Software

Download the following software.

Oracle Database 10g Release 2 (10.2.0.1) Software

Unpack Files

Unzip the files.

unzip 10201_database_linux32.zip

You should now have a single directory containing installation files. Depending on the age of the download this may either be named "db/Disk1" or "database".
Hosts File

The "/etc/hosts" file must contain a fully qualified name for the server.

<IP-address>  <fully-qualified-machine-name>  <machine-name>

Set Kernel Parameters

Add the following lines to the "/etc/sysctl.conf" file.

#kernel.shmall = 2097152
#kernel.shmmax = 2147483648
kernel.shmmni = 4096
# semaphores: semmsl, semmns, semopm, semmni
kernel.sem = 250 32000 100 128
#fs.file-max = 65536
net.ipv4.ip_local_port_range = 1024 65000
net.core.rmem_default=262144
net.core.rmem_max=262144
net.core.wmem_default=262144
net.core.wmem_max=262144

Run the following command to change the current kernel parameters.

/sbin/sysctl -p

Add the following lines to the "/etc/security/limits.conf" file.

*               soft    nproc   2047
*               hard    nproc   16384
*               soft    nofile  1024
*               hard    nofile  65536

Add the following line to the "/etc/pam.d/login" file, if it does not already exist.

session    required     pam_limits.so

Disable secure linux by editing the "/etc/selinux/config" file, making sure the SELINUX flag is set as follows.

SELINUX=disabled

Alternatively, this alteration can be done using the GUI tool (System > Administration > Security Level and Firewall). Click on the SELinux tab and disable the feature.
Setup

Install the following packages.

# From RedHat AS5 Disk 1
cd /media/cdrom/Server
rpm -Uvh setarch-2*
rpm -Uvh make-3*
rpm -Uvh glibc-2*
rpm -Uvh libaio-0*
cd /
eject

# From RedHat AS5 Disk 2
cd /media/cdrom/Server
rpm -Uvh compat-libstdc++-33-3*
rpm -Uvh compat-gcc-34-3*
rpm -Uvh compat-gcc-34-c++-3*
rpm -Uvh gcc-4*
rpm -Uvh libXp-1*
cd /
eject

# From RedHat AS5 Disk 3
cd /media/cdrom/Server
rpm -Uvh openmotif-2*
rpm -Uvh compat-db-4*
cd /
eject

Create the new groups and users.

groupadd oinstall
groupadd dba
groupadd oper

useradd -g oinstall -G dba oracle
passwd oracle

Create the directories in which the Oracle software will be installed.

mkdir -p /u01/app/oracle/product/10.2.0/db_1
chown -R oracle.oinstall /u01

Login as root and issue the following command.

xhost +<machine-name>

Edit the "/etc/redhat-release" file replacing the current release information (Red Hat Enterprise Linux Server release 5 (Tikanga)) with the following:

redhat-4

Login as the oracle user and add the following lines at the end of the ".bash_profile" file.

# Oracle Settings
TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR

ORACLE_BASE=/u01/app/oracle; export ORACLE_BASE
ORACLE_HOME=$ORACLE_BASE/product/10.2.0/db_1; export ORACLE_HOME
ORACLE_SID=TSH1; export ORACLE_SID
ORACLE_TERM=xterm; export ORACLE_TERM
PATH=/usr/sbin:$PATH; export PATH
PATH=$ORACLE_HOME/bin:$PATH; export PATH

LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib; export LD_LIBRARY_PATH
CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib; export CLASSPATH

if [ $USER = "oracle" ]; then
if [ $SHELL = "/bin/ksh" ]; then
ulimit -p 16384
ulimit -n 65536
else
ulimit -u 16384 -n 65536
fi
fi

Installation

Log into the oracle user. If you are using X emulation then set the DISPLAY environmental variable.

DISPLAY=<machine-name>:0.0; export DISPLAY

Start the Oracle Universal Installer (OUI) by issuing the following command in the database directory.

./runInstaller

During the installation enter the appropriate ORACLE_HOME and name then continue installation. For a more detailed look at the installation process, click on the links below to see screen shots of each stage.

Select Installation Method
Specify Inventory Directory and Credentials
Select Installation Type
Specify Home Details
Product-Specific Prerequisite Checks
Select Configuration Option
Select Database Configuration
Specify Database Configuration Options
Select Database Management Option
Specify Database Storage Option
Specify Backup and Recovery Options
Specify Database Schema Passwords
Summary
Install
Configuration Assistants
Database Configuration Assistant
Database Configuration Assistant Password Management
Execute Configuration Scripts
End Of Installation

Post Installation

Edit the "/etc/redhat-release" file restoring the original release information.

Red Hat Enterprise Linux Server release 5 (Tikanga)

Edit the "/etc/oratab" file setting the restart flag for each instance to 'Y'.

TSH1:/u01/app/oracle/product/10.2.0/db_1:Y

Print Friendly
Tagged as: , No Comments
19Feb/120

Oracle Database 11g R2(11.2)(64-bit) on Oracle Linux 5 (64-bit)

Posted by Infoaddict

The installation of Oracle Database 11g Release 2 (11.2) (64-bit) on Oracle Linux 5 (64-bit). The article is based on a server installation with a minimum of 2G swap, secure Linux disabled. Oracle recommend a default server installation, but for these installations the following package groups installed:

GNOME Desktop Environment
Editors
Graphical Internet
Text-based Internet
Development Libraries
Development Tools
Server Configuration Tools
Administration Tools
Base
System Tools
X Window System

An example of this type of Linux installations can be seen here. Alternative installations may require more packages to be loaded, in addition to the ones listed below.

Download Software
Unpack Files
Hosts File
Set Kernel Parameters
Setup
Installation
Post Installation

Download Software
Download the following software.

Oracle Database 11g Release 2 (11.2) Software (64-bit)

Unpack Files
Unzip the files.

unzip linux.x64_11gR2_database_1of2.zip
unzip linux.x64_11gR2_database_2of2.zip

You should now have a single directory called "database" containing installation files.
Hosts File
The "/etc/hosts" file must contain a fully qualified name for the server.

<IP-address>  <fully-qualified-machine-name>  <machine-name>

For example.

127.0.0.1       localhost.localdomain  localhost
192.168.2.181   ol5-11gr2.localdomain  ol5-11gr2

Set Kernel Parameters
Oracle recommend the following minimum parameter settings.

fs.suid_dumpable = 1
fs.aio-max-nr = 1048576
fs.file-max = 6815744
kernel.shmall = 2097152
kernel.shmmax = 536870912
kernel.shmmni = 4096
kernel.sem = 250 32000 100 128
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default = 262144
net.core.rmem_max = 4194304
net.core.wmem_default = 262144
net.core.wmem_max = 1048586

The current values can be tested using the following command.

/sbin/sysctl -a | grep <param-name>

Add or amend the following lines in the "/etc/sysctl.conf" file.

fs.suid_dumpable = 1
fs.aio-max-nr = 1048576
fs.file-max = 6815744
kernel.shmall = 2097152
kernel.shmmax = 536870912
kernel.shmmni = 4096
# semaphores: semmsl, semmns, semopm, semmni
kernel.sem = 250 32000 100 128
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default=4194304
net.core.rmem_max=4194304
net.core.wmem_default=262144
net.core.wmem_max=1048586

Run the following command to change the current kernel parameters.

/sbin/sysctl -p

Add the following lines to the "/etc/security/limits.conf" file.

oracle              soft    nproc   2047
oracle              hard    nproc   16384
oracle              soft    nofile  1024
oracle              hard    nofile  65536
oracle              soft    stack   10240

Disable secure linux by editing the "/etc/selinux/config" file, making sure the SELINUX flag is set as follows.

SELINUX=disabled

Alternatively, this alteration can be done using the GUI tool (Applications > System Settings > Security Level). Click on the SELinux tab and disable the feature. If SELinux is disabled after installation, the server will need a reboot for the change to take effect.
Setup
Install the following packages if they are not already present.

# From Oracle Linux 5 DVD
cd /media/cdrom/Server
rpm -Uvh binutils-2.*
rpm -Uvh compat-libstdc++-33*
rpm -Uvh compat-libstdc++-33*.i386.rpm
rpm -Uvh elfutils-libelf*
rpm -Uvh gcc-4.*
rpm -Uvh gcc-c++-4.*
rpm -Uvh glibc-2.*
rpm -Uvh glibc-common-2.*
rpm -Uvh glibc-devel-2.*
rpm -Uvh glibc-headers-2.*
rpm -Uvh ksh*
rpm -Uvh libaio-0.*
rpm -Uvh libaio-devel-0.*
rpm -Uvh libgomp-4.*
rpm -Uvh libgcc-4.*
rpm -Uvh libstdc++-4.*
rpm -Uvh libstdc++-devel-4.*
rpm -Uvh make-3.*
rpm -Uvh sysstat-7.*
rpm -Uvh unixODBC-2.*
rpm -Uvh unixODBC-devel-2.*
rpm -Uvh numactl-devel-2*
cd /
eject

Create the new groups and users.

groupadd oinstall
groupadd dba
groupadd oper
groupadd asmadmin

useradd -g oinstall -G dba,oper,asmadmin oracle
passwd oracle

Note. We are not going to use the "asmadmin" group, since this installation will not use ASM.

Create the directories in which the Oracle software will be installed.

mkdir -p /u01/app/oracle/product/11.2.0/db_1
chown -R oracle:oinstall /u01
chmod -R 775 /u01

Login as root and issue the following command.

xhost +<machine-name>

Login as the oracle user and add the following lines at the end of the ".bash_profile" file.

# Oracle Settings
TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR

ORACLE_HOSTNAME=ol5-11gr2.localdomain; export ORACLE_HOSTNAME
ORACLE_UNQNAME=DB11G; export ORACLE_UNQNAME
ORACLE_BASE=/u01/app/oracle; export ORACLE_BASE
ORACLE_HOME=$ORACLE_BASE/product/11.2.0/db_1; export ORACLE_HOME
ORACLE_SID=DB11G; export ORACLE_SID
PATH=/usr/sbin:$PATH; export PATH
PATH=$ORACLE_HOME/bin:$PATH; export PATH

LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib; export LD_LIBRARY_PATH
CLASSPATH=$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib; export CLASSPATH

Installation
Log into the oracle user. If you are using X emulation then set the DISPLAY environmental variable:

DISPLAY=<machine-name>:0.0; export DISPLAY

Start the Oracle Universal Installer (OUI) by issuing the following command in the database directory:

./runInstaller

Proceed with the installation of your choice. You can see the type of installation I performed by clicking on the links below to see screen shots of each stage.

Configure Security Updates
Select Install Option
System Class
Node Selection
Select Install Type
Typical Install Configuration
Create Inventory
Perform Prerequisite Checks
Summary
Install Product
Database Configuration Assistant
Database Configuration Assistant 2
Execute Configuration Scripts
Finish

Post Installation

Edit the "/etc/oratab" file setting the restart flag for each instance to 'Y'.

DB11G:/u01/app/oracle/product/11.2.0/db_1:Y

Print Friendly
Tagged as: , No Comments
18Feb/120

LAMP INSTALLATION WITH CONFIGURATION ON CENTOSE 5.3

Posted by Infoaddict

[root@fedorasmpp ~]#vi /etc/sysconfig/network-scripts/ifcfg-eth0

192.168.1.200

255.255.255.0

192.168.1.1

[root@fedorasmpp ~]#vi /etc/hosts

192.168.1.200 fedorasmpp.xxx.com fedorasmpp

:wq!

mysqladmin -h fedorasmpp.dataslices.com -u root password

[root@fedorasmpp ~]# yum install mysql mysql-server

[root@fedorasmpp ~]# chkconfig --levels 235 mysqld on

[root@fedorasmpp ~]# /etc/init.d/mysqld start

Starting mysqld:                                            [  OK  ]

[root@fedorasmpp ~]# mysqladmin -u root password redhat

[root@fedorasmpp ~]# mysqladmin -h fedorasmpp.dataslices.com -u root password redhat

[root@fedorasmpp ~]# yum install httpd

[root@fedorasmpp ~]# chkconfig --levels 235 httpd on

[root@fedorasmpp ~]# /etc/init.d/httpd start

Starting httpd:                                             [  OK  ]

[root@fedorasmpp ~]# yum install php

[root@fedorasmpp ~]#/etc/inid.d/httpd restart

open Browser mention in url

http://192.168.1.9/info.php

[root@fedorasmpp ~]# yum install php-mysql php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc

Loaded plugins: fastestmirror

Loading mirror speeds from cached hostfile

 * addons: mirror.eshk.hk

 * base: mirror.eshk.hk

 * extras: mirrors.digipower.vn

 * updates: mirrors.digipower.vn

Setting up Install Process

Package php-mysql-5.1.6-27.el5_5.3.i386 already installed and latest version

Package php-ldap-5.1.6-27.el5_5.3.i386 already installed and latest version

Package php-odbc-5.1.6-27.el5_5.3.i386 already installed and latest version

Package 1:php-pear-1.4.9-6.el5.noarch already installed and latest version

Resolving Dependencies

--> Running transaction check

---> Package php-gd.i386 0:5.1.6-27.el5_5.3 set to be updated

---> Package php-imap.i386 0:5.1.6-27.el5_5.3 set to be updated

--> Processing Dependency: libc-client.so.1 for package: php-imap

---> Package php-xml.i386 0:5.1.6-27.el5_5.3 set to be updated

---> Package php-xmlrpc.i386 0:5.1.6-27.el5_5.3 set to be updated

--> Running transaction check

---> Package libc-client.i386 0:2004g-2.2.1 set to be updated

--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================

 Package                        Arch                    Version                             Repository                  Size

=============================================================================================================================

Installing:

 php-gd                         i386                    5.1.6-27.el5_5.3                    updates                    117 k

 php-imap                       i386                    5.1.6-27.el5_5.3                    updates                     54 k

 php-xml                        i386                    5.1.6-27.el5_5.3                    updates                     97 k

 php-xmlrpc                     i386                    5.1.6-27.el5_5.3                    updates                     58 k

Installing for dependencies:

 libc-client                    i386                    2004g-2.2.1                         base                       516 k

Transaction Summary

=============================================================================================================================

Install       5 Package(s)

Upgrade       0 Package(s)

Total download size: 842 k

Is this ok [y/N]: y

Downloading Packages:

(1/5): php-imap-5.1.6-27.el5_5.3.i386.rpm                                                             |  54 kB     00:00

(2/5): php-xmlrpc-5.1.6-27.el5_5.3.i386.rpm                                                           |  58 kB     00:00

(3/5): php-xml-5.1.6-27.el5_5.3.i386.rpm                                                              |  97 kB     00:00

(4/5): php-gd-5.1.6-27.el5_5.3.i386.rpm                                                               | 117 kB     00:00

(5/5): libc-client-2004g-2.2.1.i386.rpm                                                               | 516 kB     00:01

-----------------------------------------------------------------------------------------------------------------------------

Total                                                                                        103 kB/s | 842 kB     00:08

Running rpm_check_debug

Running Transaction Test

Finished Transaction Test

Transaction Test Succeeded

Running Transaction

  Installing     : libc-client                                                                                           1/5

  Installing     : php-xmlrpc                                                                                            2/5

  Installing     : php-imap                                                                                              3/5

  Installing     : php-xml                                                                                               4/5

  Installing     : php-gd                                                                                                5/5

Installed:

  php-gd.i386 0:5.1.6-27.el5_5.3             php-imap.i386 0:5.1.6-27.el5_5.3         php-xml.i386 0:5.1.6-27.el5_5.3

  php-xmlrpc.i386 0:5.1.6-27.el5_5.3

Dependency Installed:

  libc-client.i386 0:2004g-2.2.1

Complete!

[root@fedorasmpp ~]# /etc/init.d/httpd restart

Stopping httpd:                                            [  OK  ]

Starting httpd:                                            [  OK  ]

[root@fedorasmpp ~]# wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

--2011-01-16 14:07:03--  http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

Resolving packages.sw.be... 85.13.226.40

Connecting to packages.sw.be|85.13.226.40|:80... connected.

HTTP request sent, awaiting response... 302 Found

Location: http://rpmforge.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm [following]

--2011-01-16 14:07:03--  http://rpmforge.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

Resolving rpmforge.sw.be... 85.13.226.40

Reusing existing connection to packages.sw.be:80.

HTTP request sent, awaiting response... 200 OK

Length: 16698 (16K) [application/x-rpm]

Saving to: `rpmforge-release-0.3.6-1.el5.rf.i386.rpm'

100%[===================================================================================>] 16,698      --.-K/s   in 0.1s

2011-01-16 14:07:04 (111 KB/s) - `rpmforge-release-0.3.6-1.el5.rf.i386.rpm' saved [16698/16698]

[root@fedorasmpp ~]# rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.i386.rpm

warning: rpmforge-release-0.3.6-1.el5.rf.i386.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6

Preparing...                ########################################### [100%]

   1:rpmforge-release       ########################################### [100%]

[root@fedorasmpp ~]# yum install phpmyadmin

Loaded plugins: fastestmirror

Loading mirror speeds from cached hostfile

 * addons: mirror.eshk.hk

 * base: mirror.eshk.hk

 * extras: mirrors.digipower.vn

 * rpmforge: fr2.rpmfind.net

 * updates: mirrors.digipower.vn

rpmforge                                                                                              | 1.1 kB     00:00

rpmforge/primary                                                                                      | 2.2 MB     00:22

rpmforge                                                                                                         10369/10369

Setting up Install Process

Resolving Dependencies

--> Running transaction check

---> Package phpmyadmin.noarch 0:2.11.11.1-1.el5.rf set to be updated

--> Processing Dependency: php-mbstring >= 4.1.0 for package: phpmyadmin

--> Processing Dependency: php-mcrypt for package: phpmyadmin

--> Running transaction check

---> Package php-mbstring.i386 0:5.1.6-27.el5_5.3 set to be updated

---> Package php-mcrypt.i386 0:5.1.6-15.el5.centos.1 set to be updated

--> Processing Dependency: libmcrypt.so.4 for package: php-mcrypt

--> Running transaction check

---> Package libmcrypt.i386 0:2.5.8-4.el5.centos set to be updated

--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================

 Package                      Arch                   Version                                  Repository                Size

=============================================================================================================================

Installing:

 phpmyadmin                   noarch                 2.11.11.1-1.el5.rf                       rpmforge                 4.2 M

Installing for dependencies:

 libmcrypt                    i386                   2.5.8-4.el5.centos                       extras                   116 k

 php-mbstring                 i386                   5.1.6-27.el5_5.3                         updates                  995 k

 php-mcrypt                   i386                   5.1.6-15.el5.centos.1                    extras                    16 k

Transaction Summary

=============================================================================================================================

Install       4 Package(s)

Upgrade       0 Package(s)

Total download size: 5.3 M

Is this ok [y/N]: y

Is this ok [y/N]: y

Downloading Packages:

(1/4): php-mcrypt-5.1.6-15.el5.centos.1.i386.rpm                                                      |  16 kB     00:00

(2/4): libmcrypt-2.5.8-4.el5.centos.i386.rpm                                                          | 116 kB     00:00

(3/4): php-mbstring-5.1.6-27.el5_5.3.i386.rpm                                                         | 995 kB     00:02

(4/4): phpmyadmin-2.11.11.1-1.el5.rf.noarch.rpm                                                       | 4.2 MB     00:09

-----------------------------------------------------------------------------------------------------------------------------

Total                                                                                        365 kB/s | 5.3 MB     00:14

Running rpm_check_debug

Running Transaction Test

Finished Transaction Test

Transaction Test Succeeded

Running Transaction

  Installing     : libmcrypt                                                                                             1/4

  Installing     : php-mcrypt                                                                                            2/4

  Installing     : php-mbstring                                                                                          3/4

  Installing     : phpmyadmin                                                                                            4/4

Installed:

  phpmyadmin.noarch 0:2.11.11.1-1.el5.rf

Dependency Installed:

  libmcrypt.i386 0:2.5.8-4.el5.centos    php-mbstring.i386 0:5.1.6-27.el5_5.3    php-mcrypt.i386 0:5.1.6-15.el5.centos.1

Complete!

[root@fedorasmpp ~]# vi /etc/httpd/conf.d/phpmyadmin.conf

#  Web application to manage MySQL

#

<Directory "/usr/share/phpmyadmin">

  Order Deny,Allow

  Deny from all

  Allow from 127.0.0.1

</Directory>

Alias /phpmyadmin /usr/share/phpmyadmin

Alias /phpMyAdmin /usr/share/phpmyadmin

Alias /mysqladmin /usr/share/phpmyadmin

:wq!

Next Configuration Step we change the authentication in phpMyAdmin for cookie by http:

========================

BY DEFAULT CONFIGURATION

========================

/* Authentication type */

$cfg['Servers'][$i]['auth_type'] = 'cookie';

s

==========================

AFTER CHANGE CONFIGURATION

==========================

/* Authentication type */

$cfg['Servers'][$i]['auth_type'] = 'http';

[root@fedorasmpp ~]# /etc/init.d/httpd restart

Stopping httpd:                                            [  OK  ]

Starting httpd:                                            [  OK  ]

you can access phpMyAdmin under http://192.168.1.9/phpmyadmin/:

Print Friendly
Tagged as: No Comments
18Feb/120

How to Install and Configure SARG

Posted by Infoaddict

SARG (Squid Analysis Report Generator) is a tool that allow you to view "where" your users are going to on the Internet.
Sarg it self, provide to end user a generic interface to create reports based on squid access log (begin of log to current date).
sarg-reports (this script) is useful because it allow you to easily create and manage Daily, Weekly and Monthly reports.
Using sarg-reports is very easy, read the following steps to know how to installing and configuring this tools:

Requirements
a) An unix system with bash shell (like GNU/Linux, FreeBSD, etc...)
b) Squid - http://www.squid-cache.org
c) Sarg - http://sarg.sourceforge.net/
d) Apche web server - http://www.apache.org/

1. Download the package from here.

2. Unzip the package by following command.

#unzip sarg-2.2.5-1.el5.rf.i386.zip

3. This is the RPM package, so I can install the package easily, I use the following command.

# rpm -ivh sarg-2.2.5-1.el5.rfi386.rpm

4. Edit configuration file as shown bellow

# vim /etc/sarg/sarg.conf

This is my configuration file, of course you can change it like you want

access_log /var/log/squid/access.log
graphs yes
graph_days_bytes_bar_color orange
title "Squid User Access Reports"
output_dir /var/www/htdocs/sarg
resolve_ip no
topuser_sort_field BYTES reverse
user_sort_field BYTES reverse
lastlog 3
remove_temp_files yes
index yes
overwrite_report yes
topsites_num 100
topsites_sort_order CONNECT D
index_sort_order D
max_elapsed 28800000
report_type topsites sites_users users_sites date_time denied auth_failures site_user_time_date
show_successful_message yes
show_read_statistics yes
topuser_fields NUM DATE_TIME USERID CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE
user_report_fields CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE
topuser_num 0
show_sarg_logo yes

6. To Generate the log report, simply run the command

#sarg - l /var/log/squid/access.log

The reports will be saved in /var/www/sarg/ONE-SHOT directory

To generate the log report by the cron job you can make entry in "/etc/crontab" file

00 23 * * * root /usr/bin/sarg

It will generate the log report every day at 11.00 P.M

You can also see all command line switches by following command

#sarg -h

7. Example To generate report by manually :

#sarg -l /var/log/squid/access.log -o /var/www/sarg/daily -z -d 21/06/2009

It will generate the log report date 21/6/2009 into /var/www/sarg/daily directory

If you want log report from 21/06/2009 to 28/06/2009 then run this command

#sarg -l /var/log/squid/access.log -o /var/www/sarg/ONE-SHOT -z -d 21/06/2009-28/06/2009

8. To view the log report generated by sarg start httpd service

/etc/init.d/httpd start

And browes url "http://ip_of_linux box/sarg" eg.

http://10.0.0.1/sarg

make sure that apache is working and publish squidlogs..

If you want apache ask password to allow sarg report you can configure .htaccess file and .htpassword.

Source: http://sarg.sourceforge.net/

Print Friendly
18Feb/120

Linux Load Balancer of Webserver

Posted by Infoaddict

6 Nodes Load Balancer

Two nodes for LVS (Piranha Pulse nannay Ipvsadm) as Load balancer
Two nodes for Web servers can be multiple upto your requirement.
Two nodes for mysql database server using Drbd & heartbeat for highly avaliable mysql database.

3 types of LoadBalancers
1. Nating
2. Direct Routing
3. Tunneling

CentOS 5.3 is used as Operating System.

In this setup we are using LVS(Linux virtual server) using Direct Routing Method these packages are available on Redhat5.x/CentOs5.x.

We will cover these in few steps.

1 . we will setup basic setup for whole 6 nodes

> Host file configuration (In real network use DNS or both.)
> Ssh key generation (For authentication betwen all 6 nodes)
> NTP Configuration (For time syncronization if possible use dedicated NTP server otherwise 1 node can be used)

2 . We need to configure LVS setup for the two highly available Load balancers. (If one down other will do the same function)

3 . We need to configure web servers for the Load balancing the web service. (Both will have apache php php-mysql php-gd service installaed We also install joomla on both server to check our web and Mysql service working.)

4 . We need to configure Drbd & heartbeat service on two db servers.(Db1 and Db2 will be active passive mode to give highly availabe mysql database service and it's data/databses).

5 . We need to configure joomla on both web server's and make thier connection with mysql databses servers.

1. Basic configurations of all 6 nodes.

On all Nodes. Please copy this file on all servers/nodes

[root@lb1 /]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6

##### IP's of Load Balancers #####
10.0.0.1 lb1.infoaddict.org lb1
10.0.0.2 lb2.infoaddict.org lb2

##### IP's of Web Servers #####
10.0.0.30 www1.infoaddict.org www1
10.0.0.40 www2.infoaddict.org www2

##### IP's of MySQL DB servers #####
10.0.0.50 db1.infoaddict.org db1
10.0.0.51 db2.infoaddict.org db2

########## Here is Virtual IP/Service IP of Webserver and MySQL DB ##########

10.0.0.3 www.infoaddict.org www
10.0.0.190 db.infoaddict.org db

Copy this /etc/hosts file to all the servers

[root@lb1 /]#

Now generate ssh keys

[root@lb1 ~]# ssh-keygen -t rsa

[root@lb1 ~]# ssh-keygen -t dsa

[root@lb1 ~]# cd /root/.ssh/

[root@lb1 ~]# cat *.pub > authorized_keys

[root@lb1 ~]#scp -r /root/.ssh/ lb2:/root/

[root@lb1 ~]#scp -r /root/.ssh/ www1:/root/

[root@lb1 ~]#scp -r /root/.ssh/ www2:/root/

[root@lb1 ~]#scp -r /root/.ssh/ db1:/root/

[root@lb1 ~]#scp -r /root/.ssh/ db2:/root/

[root@lb1 ~]#ssh-keyscan -t dsa lb1 lb2 db1 db2 www1 www2

[root@lb1 ~]#ssh-keyscan -t rsa lb1 lb2 db1 db2 www1 www2

Stop Unwanted services on all nodes.

[root@lb1 ~]# /etc/init/sendmail stop

[root@lb1 ~]# chkconfig --level 235 sendmail off

3. NTP configuration.

Run this command on all nodes & Make sure the ntp is installed on all nodes.

[root@lb1 ~]# rpm -qa | grep ntp
ntp-4.2.2p1-9.el5.centos
chkfontpath-1.10.1-1.1
[root@lb1 ~]#
[root@lb1 ~]# vim /etc/ntp.conf ###Configuration for NTP server###
restrict 127.0.0.1

server 127.127.1.0 # local clock

save & quit
[root@lb1 ~]#
[root@lb1 ~]# /etc/init.d/ntpd restart
Shutting down ntpd: [ OK ]
Starting ntpd: [ OK ]
[root@lb1 ~]#

Clinet side configuration

[root@db2 /]# vim /etc/ntp.conf

#restrict 127.0.0.1
#restrict -6 ::1

server 10.0.0.1 ##Put Server IP here##

#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org

#server 127.127.1.0 # local clock
#fudge 127.127.1.0 stratum 10

save & quit

[root@db2 /]# /etc/init.d/ntpd restart
Shutting down ntpd: [ OK ]
Starting ntpd: [ OK ]
[root@db2 /]#

[root@db2 /]#
[root@db2 /]# ntpdate -u 10.0.0.1
16 Jul 11:55:34 ntpdate[12101]: step time server 10.0.0.1 offset -3.069414 sec
[root@db2 /]#

Copy this file /etc/ntp.conf on all 4 nodes .i.e www1 www2 db1 db2 and restart the ntp service on those nodes.

Run this command on all nodes.

[root@db2 /]# ntpdate -u 10.0.0.1

LVS Setup configuration on LB1 and LB2

We need to install Piranha package it will automaticaly instll pulse,ipvsadm,nanny

install piranha on both nodes

[root@lb1 ~]# yum install piranha -y

[root@lb2 ~]# yum install piranha -y

[root@lb1 ~]# vim /etc/sysconfig/ha/lvs.cf

serial_no = 14
primary = 10.0.0.1
service = lvs
rsh_command = ssh
backup_active = 1
backup = 10.0.0.2
heartbeat = 1
heartbeat_port = 1050
keepalive = 2
deadtime = 10
network = direct ### use nat if nating method is used ###
debug_level = NONE
monitor_links = 1
virtual server1 {
active = 1
address = 10.0.0.3 eth0:1
port = 80
send = "GET / HTTP/1.1\r\n\r\n"
expect = "HTTP"
load_monitor = uptime
scheduler = rr
protocol = tcp
timeout = 10
reentry = 180
quiesce_server = 0
server www1 {
address = 10.0.0.30
active = 1
weight = 1
}
server www2 {
address = 10.0.0.40
active = 1
weight = 1
}
}

save & exit

[root@lb1 ~]# scp /etc/sysconfig/ha/lvs.cf lb2:/etc/sysconfig/ha/

[root@lb1 ~]# cat /etc/sysctl.conf

net.ipv4.ip_forward = 1

net.ipv4.conf.eth0.arp_ignore = 1

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.eth0.arp_announce = 2

save & exit

[root@lb1 ~]# scp /etc/sysctl.conf lb2:/etc/

Run this command on both nodes

[root@lb1 ~]# [root@lb1 ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@lb1 ~]#

Before starting service pulse start httpd on both web servers.

[root@www1 ~]#/etc/init.d/httpd start
[root@www1 ~]#/etc/init.d/httpd start

Start pulse service on both lvs/LoadBalancer servers

[root@lb1 ~]# /etc/init.d/pulse start
Starting pulse:
[root@lb1 ~]#

[root@lb1 ~]# /etc/init.d/pulse restart
Shutting down pulse: [ OK ]
Starting pulse: [ OK ]
[root@lb1 ~]# tail -f /var/log/messages
Jul 16 12:24:18 lb1 pulse[6363]: STARTING PULSE AS MASTER
Jul 16 12:24:28 lb1 pulse[6363]: partner dead: activating lvs
Jul 16 12:24:28 lb1 avahi-daemon[2940]: Registering new address record for 10.0.0.3 on eth0.
Jul 16 12:24:28 lb1 lvs[6367]: starting virtual service server1 active: 80
Jul 16 12:24:28 lb1 nanny[6376]: starting LVS client monitor for 10.0.0.3:80
Jul 16 12:24:28 lb1 lvs[6367]: create_monitor for server1/www1 running as pid 6376
Jul 16 12:24:28 lb1 nanny[6377]: starting LVS client monitor for 10.0.0.3:80
Jul 16 12:24:28 lb1 lvs[6367]: create_monitor for server1/www2 running as pid 6377
Jul 16 12:24:28 lb1 nanny[6376]: [ active ] making 10.0.0.30:80 available
Jul 16 12:24:28 lb1 nanny[6377]: [ active ] making 10.0.0.40:80 available
Jul 16 12:24:33 lb1 pulse[6369]: gratuitous lvs arps finished

it seems good now our pulse is working fine.

3. Web servers configuration On both servers.

[root@www1 ~]# yum install httpd php php-mysql php-gd

[root@www1 ~]# yum install arptables_jf

[root@www1 ~]#echo "Load Balancing" > /var/www/html/test.html

[root@www2 ~]#echo "Load Balancing1" > /var/www/html/test.html

For both server we need to configure the Loopback interface

[root@www1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-lo:0
DEVICE=lo:0
IPADDR=10.0.0.3
NETMASK=255.255.255.255
NETWORK=10.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=10.255.255.255
ONBOOT=yes
NAME=loopback
[root@www1 ~]#
[root@www1 ~]#ifup lo:0

[root@www2 ~]# vim /etc/sysconfig/network-scripts/ifcfg-lo:0
DEVICE=lo:0
IPADDR=10.0.0.3
NETMASK=255.255.255.255
NETWORK=10.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=10.255.255.255
ONBOOT=yes
NAME=loopback
[root@www2 ~]#
[root@www2 ~]# ifup lo:0

on both real servers

[root@www1 ~]#arptables -A IN -d 10.0.0.3 -j DROP
[root@www1 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.1
[root@www1 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.2
[root@www1 ~]#
[root@www1 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables: [ OK ]
[root@www1 ~]#

[root@www2 ~]#arptables -A IN -d 10.0.0.3 -j DROP
[root@www2 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.1
[root@www2 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.2
[root@www2 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables: [ OK ]
[root@www2 ~]#

We need to tell system to up lo:0 every time at boot.

[root@www1 ~]# echo "ifup lo:0" > /etc/rc.local
[root@www2 ~]# echo "ifup lo:0" > /etc/rc.local

Here we need to test the setup is working fine here we have two lvs and webservers

this command will show about the connections.

[root@lb1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP www.infoaddict.org:ht rr
-> www2.infoaddict.org:h Route 1 0 0
-> www1.infoaddict.org:h Route 1 0 0
[root@lb1 ~]#

[root@lb1 ~]# watch ipvsadm -Lcn

Configuration of Drbd & Heartbeat on Both database servers

Here we need to configure partitions on both servers

PARTITION SETUP On Both Servers.

Partion setup on both server identical same with fdisk

We have 4GB disks on both servers.

Partition Setup for Cluster Servers

We need to create LVM partition

[root@db1 ~]# fdisk -l

[root@db1 ~]# fdisk /dev/sdb

[root@db1 ~]# fdisk /dev/sd
sda sda1 sda2 sdb sdb1
[root@db2 ~]# fdisk /dev/sdb

Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 522 4192933+ 8e Linux LVM

Command (m for help): d
Selected partition 1

Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-522, default 522): +4000M

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 83 Linux

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 8e Linux LVM

Command (m for help):

Command (m for help): w

[root@db1 ~]# partprobe

Create Physical Volume for LVM this is second step for LVM partition.

[root@db1 ~]# pvcreat /dev/sdb1 /dev/sdb2

Create Volume Group with this command

[root@db1 ~]# vgcreate vgdb /dev/sdb1

Create Logical volume partition

[root@db1 ~]# lvcreate -L +1000M -n /dev/mapper/vgdb/lvdb
[root@db1 ~]# lvcreate -L +256M -n /dev/mapper/vgdb/lvmeta

Note: Create LVM on Both servers identical same ...................

install drbd and configure it.

[root@db1 ~]# yum install drbd82 kmod-drbd82 -y

[root@db2 ~]# yum install drbd82 kmod-drbd82 -y

[root@db1 ~]modprobe drbd

[root@db2 ~]modprobe drbd

[root@db1 ~]echo "modprobe drbd" > /etc/rc.local

[root@db2 ~]echo "modprobe drbd" > /etc/rc.local

[root@db1 ~]#vim /etc/drbd.conf

global {
usage-count yes;
}

common {
syncer { rate 10M; }
}

resource r0 {
protocol C;
handlers {
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt -f";
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt -f";
local-io-error "echo o > /proc/sysrq-trigger ; halt -f";
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";
}

startup {
}

disk {
on-io-error detach;
}

net {
after-sb-0pri disconnect;
after-sb-1pri disconnect;
after-sb-2pri disconnect;
rr-conflict disconnect;
}

syncer {
rate 10M;
al-extents 257;
}

on db1.infoaddict.org {
device /dev/drbd0;
disk /dev/vgdb/lvdb;
address 10.0.0.50:7788;
meta-disk /dev/vgdb/lvmeta[1];
}

on db2.infoaddict.org {
device /dev/drbd0;
disk /dev/vgdb/lvdb;
address 10.0.0.51:7788;
meta-disk /dev/vgdb/lvmeta[1];
}

}

save & exit

[root@db1 ~]#scp /etc/drbd.conf lb2:/etc/
[root@db1 ~]#vi /etc/sysctl.conf

net.ipv4.conf.eth0.arp_ignore = 1

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.eth0.arp_announce = 2

save & quit

[root@db1 ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@db1 ~]#

save it........

[root@db1 ~]#
[root@db1 ~]# scp /etc/drbd.conf db2:/etc/drbd.conf

We need to run module on both servers to run drbd

Load DRBD module both nodes:

[root@db1 ~]# modprobe drbd

[root@db1 ~]# echo "modprobe drbd" >> /etc/rc.local

[root@db2 ~]# modprobe drbd

[root@db2 ~]# echo "modprobe drbd"  >> /etc/rc.local

##### run this on both servers ######

[root@db1 ~]#drbdadm create-md r0

[root@db2 ~]#drbdadm create-md r0

[root@db1 ~]#drbdadm attach r0

[root@db2 ~]#drbdadm attach r0

[root@db1 ~]#drbdadm syncer r0

[root@db2 ~]#drbdadm syncer r0

[root@db1 ~]#drbdadm connect r0

[root@db2 ~]#drbdadm connect r0

On Primary Node only

[root@db1 ~]#drbdadm -- --overwrite-data-of-peer primary r0

On both Nodes:

[root@db1 ~]#drbdadm up all

[root@db2 ~]#drbdadm up all

On Primary Node only

[root@db1 ~]#drbdadm -- primary all #### ON Node one Only ####

[root@db1 ~]#watch cat /proc/drbd

only on db1 ########## Primary Node ########

[root@db1 ~]#mkfs.ext3 /dev/drbd0

[root@db1 ~]#mkdir /data/

[root@db1 ~]#mount /dev/drbd0 /data/

[root@db1 ~]#
[root@db1 ~]# df -hk
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
5967432 2625468 3033948 47% /
/dev/sda1 101086 12074 83793 13% /boot
tmpfs 257720 0 257720 0% /dev/shm
/dev/drbd0 4031516 107600 3719128 3% /data
[root@db1 ~]#
[root@db1 ~]# umount /dev/drbd0 /data

Note: HeartBeat will automatically handle this.

On db2 ####### Secondry Node #######

[root@db2 ~]#mkdir /data

Heartbeat Setup:
================

Install heartbeat package using yum

Note: Internet connection is required or configure yum repository on your local machine with extras.

[root@db1 ~]#yum install -y heartbeat heartbeat-pils heartbeat-stonith heartbeat-devel

[root@db1 ~]#vim /etc/ha.d/ha.cf ## Create this file and copy this text ##

logfacility local0
keepalive 2
#deadtime 30 # USE THIS!!!
deadtime 10
# we use two heartbeat links, eth2 and serial 0
bcast eth0
#serial /dev/ttyS0
baud 19200
auto_failback off
node db1.infoaddict.org
node db2.infoaddict.org

save & quit.

Server db1

[root@db1 ~]#vi /etc/ha.d/haresources

db1 IPaddr::10.0.0.190/8/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 mysql

Server db2:

[root@db2 ~]#vi /etc/ha.d/haresources

db2 IPaddr::10.0.0.190/8/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3  mysql

On Both Servers:

[root@db1 ~]#vi /etc/ha.d/authkeys

auth 3
3 md5 redhat ######### Use Long name as password #########

both NODE:

[root@db1 ~]#chmod 600 /etc/ha.d/authkeys

[root@db1 ~]#scp /etc/ha.d/authkeys db2:/etc/ha.d/authkeys

[root@db1 ~]#chkconfig --level 235 heartbeat on

Note: if you have problem mounting /dev/drbd0 on /data then run these commands to check the status if you found the drbddisk stopped then start it.

Mysql Configuration.

cp /etc/my.cnf /etc/my.cnf.orig

vi /etc/my.cnf

[mysqld]
# datadir=/var/lib/mysql
datadir=/data/mysql
#socket=/var/lib/mysql/mysql.sock
socket=/data/mysql/mysql.sock
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1

[mysql.server]
user=mysql
#basedir=/var/lib
basedir=/data

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

[mysql]
socket=/data/mysql/mysql.sock

Now it is time to add users/hosts to mysql server:

mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'10.0.0.30' IDENTIFIED BY 'redhat'
mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'10.0.0.40' IDENTIFIED BY 'redhat'
mysql> FLUSH PRIVILEGES;

mysql>quit

Now we need to install joomla on both web servers

On Webserver 1

[root@www1 /]# yum install php php-mysql php-gd -y

[root@www1 ~]# ls
anaconda-ks.cfg Desktop install.log install.log.syslog Joomla_1.5.13-Stable-Full_Package
[root@www1 ~]# cd Joomla_1.5.13-Stable-Full_Package/
[root@www1 Joomla_1.5.13-Stable-Full_Package]# ls
[root@www1 Joomla_1.5.13-Stable-Full_Package]# cp -avr * /var/www/html/

[root@www1 Joomla_1.5.13-Stable-Full_Package]# cd /var/www/html/
[root@www1 html]# ls
[root@www1 html]# cd ..
[root@www1 www]# ls
cgi-bin error html icons
[root@www1 www]# chown apache:apache html/ -R
[root@www1 www]#
[root@www1 www]# ls
cgi-bin error html icons
[root@www1 www]# cd html/
[root@www1 html]# ll
[root@www1 html]#

Now open internet explorer then open

http://10.0.0.30

Install Joomla follow the steps and give required information.

In Database section give

Host 10.0.0.190 IP use MySQL as database.
user root
passwdor redhat
database joomla

Must check install sample data.

Copy all the joomla code on www2

[root@www1 html]# scp -r * www2:/var/www/html/

We need to open this file and edit it on line 391 add index.php

[root@www1 html]#vim /etc/httpd/conf/httpd.conf

DirectoryIndex index.html index.html.var index.php

save & quit

[root@www1 /]#
[root@www1 ~]# scp /etc/httpd/conf/httpd.conf www2:/etc/httpd/conf/
httpd.conf 100% 33KB 32.9KB/s 00:00
[root@www1 ~]#
[root@www1 ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@www1 ~]#

On Web Server 2
[root@www2 html]# chown apache:apache * -R
[root@www2 html]# ll
[root@www2 /]# yum install php php-mysql php-gd -y

[root@www2 ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@www2 ~]#

Remeber that each machine(LVS+Real) must have default gw the ip of router connected to these servers

[root@www1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 10.0.0.20 0.0.0.0 UG 0 0 0 eth0
[root@www1 ~]#

Now you can test all the network by accessing web on http://10.0.0.3 or http://www.infoaddict.org/

[root@lb1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP www.infoaddict.org:ht rr
-> www2.infoaddict.org:h Route 1 0 0
-> www1.infoaddict.org:h Route 1 0 0
[root@lb1 ~]#

[root@lb1 ~]# watch ipvsadm -Lcn

Print Friendly
Tagged as: , , No Comments
18Feb/120

Configuration of DNS (Bind) server in chroot environment

Posted by Infoaddict

OS CentOS 5.4 X86_64
-------------------------------------
Please Install the bind packages
-------------------------------------
[root@ns1 ~]# yum install bind bind-utils bind-*
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * addons: virror.hanoilug.org
 * extras: ftp.hostrino.com
 * updates: ftp.hostrino.com
addons                                                                                                                                                     |  951 B     00:00
extras                                                                                                                                                     | 1.1 kB     00:00
ftp                                                                                                                                                        | 2.1 kB     00:00
updates                                                                                                                                                    | 1.9 kB     00:00
updates/primary_db                                                                                                                                         | 444 kB     00:00
Setting up Install Process
Package 30:bind-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-utils-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-sdb-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-chroot-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-devel-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-devel-9.3.6-4.P1.el5_4.1.i386 already installed and latest version
Package 30:bind-libs-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-libs-9.3.6-4.P1.el5_4.1.i386 already installed and latest version
Package 30:bind-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-utils-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-libbind-devel-9.3.6-4.P1.el5_4.1.x86_64 already installed and latest version
Package 30:bind-libbind-devel-9.3.6-4.P1.el5_4.1.i386 already installed and latest version
Nothing to do
----------------------------------------------
Please Configure Static IP and Default Gateway
----------------------------------------------
[root@ns1 ~]#  vi /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.150.100
NETMASK=255.255.255.0
ONBOOT=yes
HWADDR=00:16:36:73:7e:4f
wq!
[root@ns1 ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:16:36:73:7E:4F
          inet addr:192.168.150.100  Bcast:192.168.150.255  Mask:255.255.255.0
          inet6 addr: fe80::216:36ff:fe73:7e4f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1641 errors:0 dropped:0 overruns:0 frame:0
          TX packets:950 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:192907 (188.3 KiB)  TX bytes:117111 (114.3 KiB)
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:105 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:10213 (9.9 KiB)  TX bytes:10213 (9.9 KiB)
[root@ns1 ~]#
[root@ns1 ~]# vi /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=dns.company.xy
GATEWAY=192.168.150.1
wq!
--------------------------------------------------------------------------------------------------------------------
Now we are going to configure the Bind service  please copy the files content and modify with your network settings
--------------------------------------------------------------------------------------------------------------------
[root@ns1 ~]#
[root@ns1 ~]# cd /var/named/chroot/
[root@ns1 chroot]# ll
total 24
drwxr-x---  2 root named 4096 Dec  1 00:00 dev
drwxr-x---  2 root named 4096 Jan  4 04:42 etc
dr-xr-xr-x 85 root root     0 Jan 11 22:41 proc
drwxr-x---  6 root named 4096 Dec  1 00:00 var
[root@ns1 chroot]#
-------------------------------
Now create zone file named.conf
-------------------------------
[root@ns1 chroot]#  vi etc/named.conf
options
{
        directory "/var/named"; // the default
        dump-file               "data/cache_dump.db";
        statistics-file         "data/named_stats.txt";
        memstatistics-file      "data/named_mem_stats.txt";
};
zone "." IN {
        type hint;
        file "named.root";
};
zone "localhost" IN {
        type master;
        file "localhost.fwd";
        allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "localhost.rev";
        allow-update { none; };
};
zone "company.xy" IN {
        type master;
        file "company.xy.fwd";
        allow-update { none; };
};
zone "1.168.192.in-addr.arpa" IN {
        type master;
        file "company.xy.rev";
        allow-update { none; };
};
 wq!
[root@ns1 chroot]# cd var/named
[root@ns1 named]#
--------------------------
Now create named.root file
--------------------------
[root@ns1 named]#
First We confiure named.root file for root dns
[root@ns1 named]# vi named.root
.                       6D  IN      NS      A.ROOT-SERVERS.NET.
.                       6D  IN      NS      B.ROOT-SERVERS.NET.
.                       6D  IN      NS      C.ROOT-SERVERS.NET.
.                       6D  IN      NS      D.ROOT-SERVERS.NET.
.                       6D  IN      NS      E.ROOT-SERVERS.NET.
.                       6D  IN      NS      F.ROOT-SERVERS.NET.
.                       6D  IN      NS      G.ROOT-SERVERS.NET.
.                       6D  IN      NS      H.ROOT-SERVERS.NET.
.                       6D  IN      NS      I.ROOT-SERVERS.NET.
.                       6D  IN      NS      J.ROOT-SERVERS.NET.
.                       6D  IN      NS      K.ROOT-SERVERS.NET.
.                       6D  IN      NS      L.ROOT-SERVERS.NET.
.                       6D  IN      NS      M.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET.     6D  IN      A       198.41.0.4
B.ROOT-SERVERS.NET.     6D  IN      A       192.228.79.201
C.ROOT-SERVERS.NET.     6D  IN      A       192.33.4.12
D.ROOT-SERVERS.NET.     6D  IN      A       128.8.10.90
E.ROOT-SERVERS.NET.     6D  IN      A       192.203.230.10
F.ROOT-SERVERS.NET.     6D  IN      A       192.5.5.241
G.ROOT-SERVERS.NET.     6D  IN      A       192.112.36.4
H.ROOT-SERVERS.NET.     6D  IN      A       128.63.2.53
I.ROOT-SERVERS.NET.     6D  IN      A       192.36.148.17
J.ROOT-SERVERS.NET.     6D  IN      A       192.58.128.30
K.ROOT-SERVERS.NET.     6D  IN      A       193.0.14.129
L.ROOT-SERVERS.NET.     6D  IN      A       199.7.83.42
M.ROOT-SERVERS.NET.     6D  IN      A       202.12.27.33
wq!
----------------------------------------------------------------------------------------------------------------------------------
Now create zone db files one by one  localhost.fwd and the localhost.rev are must then your network zone files forward and reverse
----------------------------------------------------------------------------------------------------------------------------------
[root@ns1 named]# vi localhost.fwd
$ORIGIN localhost.
$TTL    86400
@        IN     SOA     ns1.company.xy.  ns1.company.xy. (
                                20100104      ; Serial number
                                3H            ; Refresh     1 day
                                15M           ; Retry       2 hours
                                1W            ; Expire      41.67 days
                                1D  )         ; Minimum TTL 2 days
@       IN      NS      dns.company.xy.
localhost.              IN      A       127.0.0.1
wq!     ##### Save the file after copying the content from here. #####
[root@ns1 named]# vi localhost.rev
$ORIGIN 0.0.127.in-addr.arpa.
$TTL    86400
@        IN     SOA     ns1.company.xy.  ns1.company.xy. (
                                20100104      ; Serial number
                                3H            ; Refresh     1 day
                                15M           ; Retry       2 hours
                                1W            ; Expire      41.67 days
                                1D  )         ; Minimum TTL 2 days
@       IN      NS      ns1.company.xy.
1.0.0.127.in-addr.arpa. IN      PTR     localhost.
wq!
[root@ns1 named]# vi company.xy.fwd
$ORIGIN company.xy.
$TTL    86400
@        IN     SOA     ns1.company.xy.  ns1.company.xy. (
                                20100104      ; Serial number
                                3H            ; Refresh     1 day
                                15M           ; Retry       2 hours
                                1W            ; Expire      41.67 days
                                1D  )         ; Minimum TTL 2 days
@       IN      NS      ns1.company.xy.
ns1.company.xy.         IN      A       192.168.150.254
ftp.company.xy.         IN      A       192.168.150.101
www.company.xy.         IN      A       192.168.150.102
client3.company.xy.         IN      A       192.168.150.103
client4.company.xy.         IN      A       192.168.150.104
wq!
[root@ns1 named]# vi company.xy.rev
$ORIGIN 1.168.192.in-addr.arpa.
$TTL    86400
@        IN     SOA     ns1.company.xy.  root.company.xy. (
                                20100104      ; Serial number
                                3H            ; Refresh     1 day
                                15M           ; Retry       2 hours
                                1W            ; Expire      41.67 days
                                1D  )         ; Minimum TTL 2 days
@       IN      NS      ns1.company.xy.
254.150.168.192.in-addr.arpa.     IN      PTR     ns1.company.xy.
101.150.168.192.in-addr.arpa.     IN      PTR     ftp.company.xy.
102.150.168.192.in-addr.arpa.     IN      PTR     www.company.xy.
103.150.168.192.in-addr.arpa.     IN      PTR     client1.company.xy.
104.150.168.192.in-addr.arpa.     IN      PTR     clinet2.company.xy.
wq!
[root@ns1 ~]# vi /etc/resolv.conf
search company.xy
nameserver 192.168.150.254
wq!
-----------------------------------------------------------------
Configuration has been done now start "/etc/init.d/named" service
-----------------------------------------------------------------
[root@ns1 ~]# /etc/init.d/named start
Starting named:                                            [  OK  ]
[root@ns1 ~]# dig yahoo.com
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.1 <<>> yahoo.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46559
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 7, ADDITIONAL: 2
;; QUESTION SECTION:
;yahoo.com.                     IN      A
;; ANSWER SECTION:
yahoo.com.              21600   IN      A       209.191.93.53
yahoo.com.              21600   IN      A       69.147.114.224
yahoo.com.              21600   IN      A       209.131.36.159
;; AUTHORITY SECTION:
yahoo.com.              172800  IN      NS      ns1.yahoo.com.
yahoo.com.              172800  IN      NS      ns2.yahoo.com.
yahoo.com.              172800  IN      NS      ns3.yahoo.com.
yahoo.com.              172800  IN      NS      ns4.yahoo.com.
yahoo.com.              172800  IN      NS      ns5.yahoo.com.
yahoo.com.              172800  IN      NS      ns6.yahoo.com.
yahoo.com.              172800  IN      NS      ns8.yahoo.com.
;; ADDITIONAL SECTION:
ns6.yahoo.com.          172800  IN      A       202.43.223.170
ns8.yahoo.com.          172800  IN      A       202.165.104.22
;; Query time: 643 msec
;; SERVER: 192.168.150.100#53(192.168.150.100)
;; WHEN: Tue Jan 12 03:01:01 2010
;; MSG SIZE  rcvd: 233
[root@ns1 ~]#
--------------------------------------------------
Now please open ports for named server for network
--------------------------------------------------
[root@ns1 ~]# iptables -A INPUT -p tcp -m multiport --dport 53,953 -j ACCEPT
[root@ns1 ~]# iptables -A INPUT -p udp -m multiport --dport 53,953 -j ACCEPT
[root@ns1 ~]#
[root@ns1 ~]# /etc/init.d/iptables save
Saving firewall rules to /etc/sysconfig/iptables:          [  OK  ]
[root@ns1 ~]#
[root@ns1 ~]# dig ns1.company.xy
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.1 <<>> ns1.company.xy
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29732
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;ns1.company.xy.            IN      A
;; ANSWER SECTION:
ns1.company.xy.     86400   IN      A       192.168.150.100
;; AUTHORITY SECTION:
company.xy.         86400   IN      NS      ns1.company.xy.
;; Query time: 1 msec
;; SERVER: 192.168.150.100#53(192.168.150.100)
;; WHEN: Tue Jan 12 03:13:33 2010
;; MSG SIZE  rcvd: 66
[root@ns1 ~]#
[root@ns1 ~]# dig www.company.xy
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.1 <<>> www.company.xy
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10800
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;www.company.xy.            IN      A
;; ANSWER SECTION:
www.company.xy.     86400   IN      A       192.168.150.102
;; AUTHORITY SECTION:
company.xy.         86400   IN      NS      ns1.company.xy.
;; ADDITIONAL SECTION:
ns1.company.xy.     86400   IN      A       192.168.150.100
;; Query time: 1 msec
;; SERVER: 192.168.150.100#53(192.168.150.100)
;; WHEN: Tue Jan 12 03:14:09 2010
;; MSG SIZE  rcvd: 86
[root@ns1 ~]#
We have configured proper bind server on  CentOs 5.4
Note:Please install bind packages and then  copy the files text from this configuration  and paste to your server.
Also modify the settings as per your network machine names and their IP's.
Print Friendly
Tagged as: No Comments
18Feb/120

KVM in the CentOS 5.4 – How to fixing bridge Problem

Posted by Infoaddict

When we use KVM in CentOS 5.4 we will notice that there is no bridge setup to allow your virtual guests to directly connect to the local network.
We need to do so simple steps to fix it.

As we are using libvirt,
We need to follwo steps below to fix it.

Step 1: Create the bridge script at /etc/sysconfig/network-scripts/ifcfg-br0

[root@babar /root]# vi /etc/sysconfig/network-scripts/ifcfg-br0

DEVICE=br0
BOOTPROTO=static
TYPE=Bridge
IPADDR=192.168.0.100
NETMASK=255.255.255.0
ONBOOT=yes
NM_CONTROLLED=no

Save & exit

As you can see, I use static IP config.

Step 2: hook up eth0 to the bridge and remove it’s IP config in /etc/sysconfig/network-scripts/ifcfg-eth0

[root@babar /root]# vi /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes
BRIDGE=br0
NM_CONTROLLED=no
TYPE=Ethernet

Please restart the network service or your system and you will done. Now create a new virtual machine with virt-manager,we can select to have it directly hooked up to the physical network.

[root@babar ~]# ifconfig
br0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::215:17ff:febd:c94d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:168 errors:0 dropped:0 overruns:0 frame:0
TX packets:33 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:11475 (11.2 KiB) TX bytes:9580 (9.3 KiB)

eth0 Link encap:Ethernet HWaddr 00:xx:xx:xx:xx:xx
inet addr:192.168.1.253 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::215:17ff:febd:c94c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3240 errors:0 dropped:0 overruns:0 frame:0
TX packets:5286 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:417544 (407.7 KiB) TX bytes:5574477 (5.3 MiB)
Memory:b1a20000-b1a40000

eth1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet6 addr: fe80::215:17ff:febd:c94d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9113 errors:0 dropped:0 overruns:0 frame:0
TX packets:122 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:755212 (737.5 KiB) TX bytes:27911 (27.2 KiB)
Memory:b1a00000-b1a20000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:969 errors:0 dropped:0 overruns:0 frame:0
TX packets:969 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2744681 (2.6 MiB) TX bytes:2744681 (2.6 MiB)

virbr0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
inet6 addr: fe80::200:ff:fe00:0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:9535 (9.3 KiB)

vnet0 Link encap:Ethernet HWaddr A2:F7:06:6D:C1:2F
inet6 addr: fe80::a0f7:6ff:fe6d:c12f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:57 errors:0 dropped:0 overruns:0 frame:0
TX packets:1035 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:9782 (9.5 KiB) TX bytes:208709 (203.8 KiB)

Now it is working fine.

Print Friendly
Tagged as: No Comments
18Feb/120

How to Install BANDWIDTHD…

Posted by Infoaddict

NTRODUCTION:
It is important to know traffic usage of your client if you're a Linux network administrator. You can monitor your client in text mode, graphic mode or html exported like mrtg, cacti or bandwidthd and one of my favorite bandwidth monitor is bandwidthd.
BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.

Below are the setups to configure Bandwidthd..

Download Bandwidthd form http://sourceforge.net/projects/bandwidthd/files/

[root@arslan]# tar xvfz bandwidthd-2.0.1.tgz
[root@arslan]# cd bandwidthd
Configure and install the Bandwidthd source:
[root@arslan]# ./configure && make install

Please make sure you have:
libpcap from http://www.tcpdump.org/
libpng from http://www.libpng.org/
libgd from http://www.boutell.com/gd/

Now Edit /usr/local/bandwidthd/etc/bandwidthd.conf
to suit your network environment.

My Example is :

subnet 192.168.0.0/24
subnet 192.168.1.0/24
# Device to listen on
# Bandwidthd listens on the first device it detects
# by default.  Run "bandwidthd -l" for a list of
# devices.
dev "eth0"
#dev "eth1"

Now Start Bandwidthd
/usr/local/bandwidthd/bandwidthd

You  can't see your graphic report until you set /usr/local/bandwidthd/htdocs/ folder to set as apache virtual directory. Add below line to your apache config file.

Alias /bandwidthd "/usr/local/bandwidthd/htdocs"
<Directory "/usr/local/bandwidthd/htdocs">
Order Allow,Deny
Allow from All
</Directory>

now go to browser and write http://your-server-ip/bandwidthd

Print Friendly
18Feb/120

Transparent squid on High Availability Cluster

Posted by Infoaddict

OS CentOS 5.3 on both machines.

We will setup for Transparent squid on High Availability Cluster.

Packages are available on CentOS extras repository.

Our Scenario

We have two servers

fahad 192.168.1.50 Primary server

rony 192.168.1.60 Secondry server

Setup for ip to name resolve ## we don't have DNS we need this step ##

Basic Setup Configuration.

[root@fahad ~]# vim /etc/hosts

192.168.1.50 fahad
192.168.1.60 rony

save & exit

[root@fahad ~]# ping fahad
PING fahad (192.168.1.50) 56(84) bytes of data.
64 bytes from fahad (192.168.1.50): icmp_seq=1 ttl=64 time=4.15 ms
64 bytes from fahad (192.168.1.50): icmp_seq=2 ttl=64 time=0.126 ms
64 bytes from fahad (192.168.1.50): icmp_seq=3 ttl=64 time=1.88 ms

[1]+ Stopped ping fahad
[root@fahad ~]# ping rony
PING rony (192.168.1.60) 56(84) bytes of data.
64 bytes from rony (192.168.1.60): icmp_seq=1 ttl=64 time=1.32 ms
64 bytes from rony (192.168.1.60): icmp_seq=2 ttl=64 time=0.523 ms
64 bytes from rony (192.168.1.60): icmp_seq=3 ttl=64 time=1.79 ms

[2]+ Stopped ping rony
[root@fahad ~]#

[root@fahad ~]# scp /etc/hosts 192.168.1.60:/etc/hosts

On Node1 servers:

stop unwanted services on both servers

[root@fahad ~]# /etc/init/sendmail stop

[root@fahad ~]# chkconfig --level 235 sendmail off

[root@fahad ~]# iptables -F

[root@fahad ~]#service iptables save

[root@rony ~]# /etc/init/sendmail stop

[root@rony ~]# chkconfig --level 235 sendmail off

[root@rony ~]# iptables -F

[root@rony ~]#service iptables save

[root@fahad ~]# rpm -qa | grep ntp
ntp-4.2.2p1-9.el5.centos.1

[root@fahad ~]#

Then we need to open ntp server configuration file.

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org

#broadcast 192.168.1.255 key 42 # broadcast server
#broadcastclient # broadcast client
#broadcast 224.0.1.1 key 42 # multicast server
#multicastclient 224.0.1.1 # multicast client
#manycastserver 239.255.254.254 # manycast server
#manycastclient 239.255.254.254 key 42 # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.

########## for server use this and on clients comment this and use server serverIP ##################

server 127.127.1.0 # local clock

#fudge 127.127.1.0 stratum 10

# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
# driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
# Specify the key identifiers which are trusted.
# trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
# requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8
keys /etc/ntp/keys

save quit.

[root@fahad ~]#
[root@fahad ~]# /etc/init.d/ntpd start
[root@fahad ~]# chkconfig --level 235 ntpd on

[root@rony ~]# vim ntp.conf
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
#restrict 127.0.0.1
#estrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

server 192.168.1.50 ### add this line on second server ###

#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org

#broadcast 192.168.1.255 key 42 # broadcast server
#broadcastclient # broadcast client
#broadcast 224.0.1.1 key 42 # multicast server
#multicastclient 224.0.1.1 # multicast client
#manycastserver 239.255.254.254 # manycast server
#manycastclient 239.255.254.254 key 42 # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.

#server 127.127.1.0 # local clock ##### #####
#fudge 127.127.1.0 stratum 10

# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

save & exit

[root@rony ~]# /etc/init.d/ntpd start
[root@rony ~]# chkconfig --level 235 ntpd on

[root@rony ~]# ntpdate -u 192.168.1.50

[root@rony ~]# watch ntpq -p -n

[root@fahad ~]# watch ntpq -p -n

PARTITION SETUP On Both Servers.

Partion setup on both server identical same with fdisk

We have 3GB disks on both servers.

Partition Setup for Cluster Servers

We need to create LVM partition

[root@fahad ~]# fdisk -l

[root@fahad ~]# fdisk /dev/sdb

[root@fahad ~]# fdisk /dev/sd
sda sda1 sda2 sdb sdb1
[root@rony ~]# fdisk /dev/sdb

Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 522 4192933+ 8e Linux LVM

Command (m for help): d
Selected partition 1

Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-522, default 522): +4000M

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 83 Linux

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)

Command (m for help): p

Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 8e Linux LVM

Command (m for help):

Command (m for help): w

[root@fahad ~]# partprobe

Create Physical Volume for LVM this is second step for LVM partition.

[root@fahad ~]# pvcreat /dev/sdb1

Create Volume Group with this command

[root@fahad ~]# vgcreate vgdrbd /dev/sdb1

Create Logical volume partition

[root@fahad ~]# lvcreate -n lvdrbd /dev/mapper/vgdrbd -L +4000M

Note: Create LVM on Both servers identical same ...................

add these three values in sysctl.conf

[root@fahad ~]#vi /etc/sysctl.conf

net.ipv4.conf.eth0.arp_ignore = 1

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.eth0.arp_announce = 2

save & quit

[root@fahad ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@fahad ~]#

DRBD Setup
==========

Install drbd82 & kmod-drbd82 rpms using yum command.

[root@fahad ~]#yum install -y drbd82 kmod-drbd82

open /etc/drbd.conf

[root@fahad ~]#vim /etc/drbd.conf

global {
usage-count yes;
}

common {
syncer { rate 10M; }
}

resource r0 {
protocol C;
handlers {
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt -f";
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt -f";
local-io-error "echo o > /proc/sysrq-trigger ; halt -f";
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";
}

startup {
}

disk {
on-io-error detach;
}

net {
after-sb-0pri disconnect;
after-sb-1pri disconnect;
after-sb-2pri disconnect;
rr-conflict disconnect;
}

syncer {
rate 10M;
al-extents 257;
}

on fahad {
device /dev/drbd0;
disk /dev/VGdrbd/lvdrbd;
address 192.168.1.50:7788;
meta-disk internal;
}

on node2 {
device /dev/drbd0;
disk /dev/VGdrbd/lvdrbd;
address 192.168.1.60:7788;
meta-disk internal;
}

}

save it........

[root@fahad ~]#
[root@fahad ~]# scp /etc/drbd.conf rony:/etc/drbd.conf

We need to run module on both servers to run drbd

Load DRBD module both nodes:

[root@fahad ~]# modprobe drbd

[root@fahad ~]# echo "modprobe drbd" >> /etc/rc.local

[root@rony ~]# modprobe drbd

[root@rony ~]# echo "modprobe drbd" >> /etc/rc.local

##### run this on both servers ######

[root@fahad ~]#drbdadm create-md r0

[root@rony ~]#drbdadm create-md r0

[root@fahad ~]#drbdadm attach r0

[root@rony ~]#drbdadm attach r0

[root@fahad ~]#drbdadm syncer r0

[root@rony ~]#drbdadm syncer r0

[root@fahad ~]#drbdadm connect r0

[root@rony ~]#drbdadm connect r0

On Primary Node only

[root@fahad ~]#drbdadm -- --overwrite-data-of-peer primary r0

On both Nodes:

[root@fahad ~]#drbdadm up all

[root@rony ~]#drbdadm up all

On Primary Node only

[root@fahad ~]#drbdadm -- primary all #### ON Node one Only ####

[root@fahad ~]#watch cat /proc/drbd

only on fahad ########## Primary Node ########

[root@fahad ~]#mkfs.ext3 /dev/drbd0

[root@fahad ~]#mkdir /data/

[root@fahad ~]#mount /dev/drbd0 /data/

[root@fahad ~]#
[root@fahad ~]# df -hk
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
5967432 2625468 3033948 47% /
/dev/sda1 101086 12074 83793 13% /boot
tmpfs 257720 0 257720 0% /dev/shm
/dev/drbd0 4031516 107600 3719128 3% /data
[root@fahad ~]#

On rony ####### Secondry Node #######

[root@rony ~]#mkdir /data

Heartbeat Setup:
================

Install heartbeat package using yum

Note: Internet connection is required or configure yum repository on your local machine with extras.

[root@fahad ~]#yum install -y heartbeat heartbeat-pils heartbeat-stonith heartbeat-devel

[root@fahad ~]#vim /etc/ha.d/ha.cf ## Create this file and copy this text ##

logfacility local0
keepalive 2
#deadtime 30 # USE THIS!!!
deadtime 10
# we use two heartbeat links, eth2 and serial 0
bcast eth0 ####### We can use eth1 instead of eth0 it's better option ########
#serial /dev/ttyS0
baud 19200
auto_failback on ################## Active Active state #################
node fahad
node rony

save & quit.

Server Fahad

[root@fahad ~]#vi /etc/ha.d/haresources

fahad IPaddr::192.168.1.190/24/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 squid

Server rony:

[root@rony ~]#vi /etc/ha.d/haresources

rony IPaddr::192.168.1.190/24/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 squid

On Both Servers:

[root@fahad ~]#vi /etc/ha.d/authkeys

auth 3
3 md5 redhat ######### Use Long name as password #########

both NODE:

[root@fahad ~]#chmod 600 /etc/ha.d/authkeys

[root@fahad ~]#scp /etc/ha.d/authkeys rony:/etc/ha.d/authkeys

[root@fahad ~]#chkconfig --level 235 heartbeat on

Note: if you have problem mounting /dev/drbd0 on /data then run these commands to check the status if you found the drbddisk stopped then start it.

[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 status
[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 start
[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 restart

[root@fahad data]# service drbd status
drbd driver loaded OK; device status:
version: 8.0.13 (api:86/proto:86)
GIT-hash: ee3ad77563d2e87171a3da17cc002ddfd1677dbe build by buildsvn@c5-i386-build, 2008-10-02 13:31:44
m:res cs st ds p mounted fstype
0:r0 Connected Primary/Secondary UpToDate/UpToDate C /data ext3

we can see that servers are in Primary/Secondary state and working well with /data directory mounted.

To takeover the machine fahad to node2 forcefully.

[root@fahad ~]#/usr/lib/heartbeat/hb_takeover

Transparent Squid Configuration on both servers.

[root@fahad ~]#vim /etc/sysctl.conf

# Controls IP packet forwarding

net.ipv4.ip_forward = 1 #### If it is 0 make it 1 for packet forwarding ####

save it

then

[root@fahad ~]#scp /etc/sysctl.conf rony:/etc/sysctl.conf

[root@fahad ~]#sysctl -p

[root@rony ~]# sysctl -p

[root@fahad ~]#yum install -y squid

[root@fahad ~]#vim /etc/squid/squid.conf

search these options using / and edit as required

http_port 3128 transparent

acl our_networks src 192.168.1.0/24 192.168.2.0/24

http_access allow our_networks

cache_dir ufs /data/squid 1000 32 256 ##### cache directories must be at /data/squid #####

visible_hostname squid.ha-cluster.com

save & exit

[root@fahad ~]# cd /data

[root@fahad ~]# mkdir squid

[root@fahad ~]# chown squid:squid squid

Note: This is required on only primary server i.e fahad

[root@fahad ~]#scp /etc/squid/squid.conf rony:/etc/squid/squid.conf

[root@fahad ~]#iptables -F

[root@fahad ~]#iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j REDIRECT --to-port 3128

[root@fahad ~]#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@fahad ~]#service iptables save

[root@rony ~]#iptables -F

[root@rony ~]#iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j REDIRECT --to-port 3128

[root@rony ~]#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@rony ~]#service iptables save

On both servers

[root@fahad ~]#/etc/init/heartbeat start

[root@fahad ~]#ifconfig

[root@fahad ~]#tail -f /var/log/squid/access.log

[root@rony ~]#/etc/init/heartbeat start

[root@rony ~]#ifconfig

Note: We must use VIP/Service IP which we define in heartbeat i.e. 192.168.1.190 as default gateway IP for accessing the internet transparently.

Print Friendly
Tagged as: No Comments
18Feb/120

Snort is an open source Network Intrusion Detection System

Posted by Infoaddict

Snort can also act as Sniffer and Logger
In this section we will discuss the more beneficial part of Snort that is Intrusion Detection System (IDS)

Snort can also be installed on Windows Platform which will be covered later.
Currently the Operating System is CentOS-5.3

Snort Installation and Configuration:
------------------------------------

First of all download and install the following required packages

# snort and snort-mysql rpm (download-able from http://www.snort.org/downloads)
# mysql and mysql-server-5.0 with all affected packages
# libpcap
# Apache
# php5
# php-cli
# php-common
# php-devel
# php-ldap
# Php5-mysql

You can check these rpms through rpm -qa command.
you can install missing packages either from source DVD or through yum command

After downloading snort rpms, just install them

[root@snortserver tmp]# rpm -ivh snort-2.8.5.3-1.RH5.i386.rpm

[root@snortserver tmp]# rpm -ivh snort-mysql-2.8.5.3-1.RH5.i386.rpm

now configure some basic settings for snort:

# vim /etc/snort/snort.conf

Change var HOME_NET any to var HOME_NET 192.168.2.0/24 # you can give a single ip address or range of IP addresses by syntax [192.168.2.1,192.168.2.10] and similarly different networks can also be defined as [192.168.1.0/24,192.168.2.0/24]

Change var EXTERNAL_NET any to var EXTERNAL_NET !$HOME_NET # (It states that everything except HOME_NET is external).

The rule path should be

var RULE_PATH /etc/snort/rules

save and exit

Now add rules to /etc/snort/rules directory

just download all the .rules file from the link http://cvs.snort.org/viewcvs.cgi/snort/rules/ one by one.

or just follow a simple way, i have created all the links for your convenience and time saving.

# cd /tmp

# mkdir rules

# cd rules

# vim download-rules.txt

http://cvs.snort.org/viewcvs.cgi/*check ... v=1.23.2.7
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.50
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.22.2.5
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.14.2.7
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.39
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.42
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.43
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.80
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.29
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.63
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.25
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... =1.13.2.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.31
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.59
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.54
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.16
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.12
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.20
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.14
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.26
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.12
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.24
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.19.2.6
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.48
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.19
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.32
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.40
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... =1.63.2.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.30
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.35
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.84
http://cvs.snort.org/viewcvs.cgi/*check ... 1.102.2.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.23
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.20

save and exit

# wget -i download-rules.txt

it will download all the rules at once saving a lot of time.

[you can start snort by simple creating blank .rules files but remember with blank rule files snort will not detect anything]

after downloading the rules in a directory. Copy the directory on another location. Rename each file to rule-name.rules and then paste the files in /etc/snort/rules directory

change the ownership of newly created rules files

# chown snort.root /etc/snort/rules/*

Keep the original rules directory and match weekly the revision version of each rule on the site to incorporate changes accordingly.

some rules can also be download and copied in rules directory from http://openmaniak.com/snort_bleeding.php
then append these lines in inlude section of /etc/snort/snort.conf file for each new rule

include $RULE_PATH/bleeding.rules
include $RULE_PATH/bleeding-attack_response.rules
include $RULE_PATH/bleeding-dos.rules
include $RULE_PATH/bleeding-drop.rules
include $RULE_PATH/bleeding-dshield.rules
include $RULE_PATH/bleeding-exploit.rules
include $RULE_PATH/bleeding-game.rules
include $RULE_PATH/bleeding-inappropriate.rules
include $RULE_PATH/bleeding-malware.rules
include $RULE_PATH/bleeding-p2p.rules
include $RULE_PATH/bleeding-scan.rules
include $RULE_PATH/bleeding-virus.rules
include $RULE_PATH/bleeding-web.rules

Now its time to start snort

Start snort

# /etc/init.d/snortd start

Remember syslogd daemon must be running in order to take logs

The log file named 'alert' will be generated in /var/log/snort directory

now do a port scan and check the alerts in /var/log/snort/alert file, if you have defined a complete subnet in HOME_NET variable then you can do a port scan of any host but that host must be reachable by snort server
If you have some network issues then try stopping iptables and SElinux for test purpose

if you have nmap installed then simple run the command to scan ports

# nmap localhost

you can see alerts in real time by command

# tailf /var/log/snort/alert

At this time snort is running fine and generating alerts
Now lets move to an interesting section

Creating your own Snort Rules:
----------------------------

you can also use Snort Rule Generator or some other utilities but its better to write a rule in a file. lets do it

We are going to create a rule for generating alerts whenever someone is trying to open youtube.com

# vim /etc/snort/rules/youtube.rules

alert tcp any any -> any any (content:"www.youtube.com"; msg:"someone is accessing youtube"; sid:1000003; rev:1;)

save and exit

now add the rule path in snort.conf

#vim /etc/snort/snort.conf

append the line in include section as

include $RULE_PATH/youtube.rules

save and exit

and restart snort daemon to take affect changes

# /etc/init.d/snortd restart

lets describe the rule:

alert tcp any any -> any any (content:"www.youtube.com"; msg:"someone is accessing youtube"; sid:1000003; rev:1;)

tcp = protocol
1st any = Source IP (your local IP in this case)
2nd any = Source Port
-> = request for
3rd any = Destination IP (youtube IP in this case)
4th any = Destination Port (that would be 80 in this case)
sid = snort unique id which snort uses to differentiate different alerts and their descriptions
rev = version number

Now after creating the rule and restarting the snort daemon, lets check our new rule working status

just type

# elinks www.youtube.com

wait for youtube to be loaded

or Open a browser and type www.youtube.com

then view the alerts

# cat /var/log/snort/alert

you will see some alerts like

[**] [1:100003:1] someone is accessing youtube.com [**] [Priority: 0] {TCP} 192.168.2.5:48401 -> 64.233.169.139:80
[**] [1:100003:1] someone is accessing youtube.com [**] [Priority: 0] {TCP} 192.168.2.5:38510 -> 110.93.194.23:80

SnortSnarf:
----------

In order to get better results we will have to manage alerts in a more descriptive form

So lets install and configure SnortSnarf an html generator for snort alerts

make sure that you have installed Apache and its running

[root@snortserver ~]# /etc/init.d/httpd status
httpd (pid 2992 2991 2990 2989 2988 2987 2986 2985 2983) is running...
[root@snortserver ~]#

otherwise just start it

# /etc/init.d/httpd start

make sure that you have installed perl5 packages because SnortSnarf depends on perl based Time modules

lets start

download snortsnarf from http://sourceforge.net/projects/snortsnarf/

# cd /etc

# wget http://downloads.sourceforge.net/projec ... rror=space

# tar -zxvf SnortSnarf-1.0.tar.gz

Now you have to download and install Time modules needed for snortsnarf from http://search.cpan.org/~muir/Time-modules-2006.0814/

# wget http://search.cpan.org/CPAN/authors/id/ ... 814.tar.gz

# tar -zxvf Time-modules-2006.0814.tar.gz

# cd Time-modules-2006.0814

install the modules by following commands:

# perl Makefile.pl

# make

# make test

# make install

After successfull installation of Time modules, create a destination directory where snortsnarf will generate html pages as an output

# mkdir /var/www/html/ids

Now run snortsnarf

# cd /etc/SnortSnarf-1.0

# ./snortsnarf.pl -d /var/www/html/ids/ /var/log/snort/alert

where -d defines output directory and /var/log/snort/alert is the source file to take input.

The above command shows a similar output on the console

[root@snortserver SnortSnarf-1.0]# ./snortsnarf.pl -d /var/www/html/ids/ /var/log/snort/alert
Using an array as a reference is deprecated at include/SnortSnarf/HTMLMemStorage.pm line 290.
Using an array as a reference is deprecated at include/SnortSnarf/HTMLAnomMemStorage.pm line 266.
SnortFileInput: input file /var/log/snort/alert exists but is length 0; skipping it
[root@snortserver SnortSnarf-1.0]#

if your /var/log/snort/alert file is not empty then you will not see the last output line

Cron Job for SnortSnarf:
-----------------------

Create a cron job to automatically run the snorsnarf script to append alerts in html pages

first of all make a simple script

# cd /etc

# touch snortsnarf

# vim snortsnarf

cd /etc/SnortSnarf-1.0
./snortsnarf.pl -d /var/www/html/ids /var/log/snort/alert

save and exit

make the script executable

# chmod +x snortsnarf

now define a new cron job to run snortsnarf after every 5 minutes

# crontab -e

*/5 * * * * /etc/snortsnarf

save and exit

*/5 means that snortsnarf will be run after every 5 minutes, you can adjust the time accordingly.

restart the cron and Apache daemons

# /etc/init.d/crond restart

# /etc/init.d/httpd restart

now create a simple port scan and generate alerts in /var/log/snort/alert file and then open your browser and type http://localhost/ids

You can see the alerts, further click the alerts and find some more information and go on.

Now snort IDS with SnortSnarf has been successfully configured, Alhamdullilah

In next session we will discuss some advanced functionality, how alerts can be stored in a database and managed by Basic Analysis and Security Engine which is an enhanced version of ACID with Graph facilities, and also how SnortSnarf and other web based utilities can be secured.

Print Friendly
Tagged as: , No Comments