Oracle Database 10g R2(10.2.0.1) on RHEL5
I'll describe the installation of Oracle Database 10g Release 2 (10.2.0.1) on Red Hat Enterprise Linux 5 (RHEL5). The article is based on a server installation similar to this, with a minimum of 2G swap, secure Linux disabled and the following package groups installed.
GNOME Desktop Environment
Editors
Graphical Internet
Text-based Internet
Development Libraries
Development Tools
Legacy Software Development
Server Configuration Tools
Administration Tools
Base
Legacy Software Support
System Tools
X Window System
Alternative installations may require more packages to be loaded, in addition to the ones listed below.
Download Software
Unpack Files
Hosts File
Set Kernel Parameters
Setup
Installation
Post Installation
Download Software
Download the following software.
Oracle Database 10g Release 2 (10.2.0.1) Software
Unpack Files
Unzip the files.
unzip 10201_database_linux32.zip
You should now have a single directory containing installation files. Depending on the age of the download this may either be named "db/Disk1" or "database".
Hosts File
The "/etc/hosts" file must contain a fully qualified name for the server.
<IP-address> <fully-qualified-machine-name> <machine-name>
Set Kernel Parameters
Add the following lines to the "/etc/sysctl.conf" file.
#kernel.shmall = 2097152
#kernel.shmmax = 2147483648
kernel.shmmni = 4096
# semaphores: semmsl, semmns, semopm, semmni
kernel.sem = 250 32000 100 128
#fs.file-max = 65536
net.ipv4.ip_local_port_range = 1024 65000
net.core.rmem_default=262144
net.core.rmem_max=262144
net.core.wmem_default=262144
net.core.wmem_max=262144
Run the following command to change the current kernel parameters.
/sbin/sysctl -p
Add the following lines to the "/etc/security/limits.conf" file.
* soft nproc 2047
* hard nproc 16384
* soft nofile 1024
* hard nofile 65536
Add the following line to the "/etc/pam.d/login" file, if it does not already exist.
session required pam_limits.so
Disable secure linux by editing the "/etc/selinux/config" file, making sure the SELINUX flag is set as follows.
SELINUX=disabled
Alternatively, this alteration can be done using the GUI tool (System > Administration > Security Level and Firewall). Click on the SELinux tab and disable the feature.
Setup
Install the following packages.
# From RedHat AS5 Disk 1
cd /media/cdrom/Server
rpm -Uvh setarch-2*
rpm -Uvh make-3*
rpm -Uvh glibc-2*
rpm -Uvh libaio-0*
cd /
eject
# From RedHat AS5 Disk 2
cd /media/cdrom/Server
rpm -Uvh compat-libstdc++-33-3*
rpm -Uvh compat-gcc-34-3*
rpm -Uvh compat-gcc-34-c++-3*
rpm -Uvh gcc-4*
rpm -Uvh libXp-1*
cd /
eject
# From RedHat AS5 Disk 3
cd /media/cdrom/Server
rpm -Uvh openmotif-2*
rpm -Uvh compat-db-4*
cd /
eject
Create the new groups and users.
groupadd oinstall
groupadd dba
groupadd oper
useradd -g oinstall -G dba oracle
passwd oracle
Create the directories in which the Oracle software will be installed.
mkdir -p /u01/app/oracle/product/10.2.0/db_1
chown -R oracle.oinstall /u01
Login as root and issue the following command.
xhost +<machine-name>
Edit the "/etc/redhat-release" file replacing the current release information (Red Hat Enterprise Linux Server release 5 (Tikanga)) with the following:
redhat-4
Login as the oracle user and add the following lines at the end of the ".bash_profile" file.
# Oracle Settings
TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR
ORACLE_BASE=/u01/app/oracle; export ORACLE_BASE
ORACLE_HOME=$ORACLE_BASE/product/10.2.0/db_1; export ORACLE_HOME
ORACLE_SID=TSH1; export ORACLE_SID
ORACLE_TERM=xterm; export ORACLE_TERM
PATH=/usr/sbin:$PATH; export PATH
PATH=$ORACLE_HOME/bin:$PATH; export PATH
LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib; export LD_LIBRARY_PATH
CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib; export CLASSPATH
if [ $USER = "oracle" ]; then
if [ $SHELL = "/bin/ksh" ]; then
ulimit -p 16384
ulimit -n 65536
else
ulimit -u 16384 -n 65536
fi
fi
Installation
Log into the oracle user. If you are using X emulation then set the DISPLAY environmental variable.
DISPLAY=<machine-name>:0.0; export DISPLAY
Start the Oracle Universal Installer (OUI) by issuing the following command in the database directory.
./runInstaller
During the installation enter the appropriate ORACLE_HOME and name then continue installation. For a more detailed look at the installation process, click on the links below to see screen shots of each stage.
Select Installation Method
Specify Inventory Directory and Credentials
Select Installation Type
Specify Home Details
Product-Specific Prerequisite Checks
Select Configuration Option
Select Database Configuration
Specify Database Configuration Options
Select Database Management Option
Specify Database Storage Option
Specify Backup and Recovery Options
Specify Database Schema Passwords
Summary
Install
Configuration Assistants
Database Configuration Assistant
Database Configuration Assistant Password Management
Execute Configuration Scripts
End Of Installation
Post Installation
Edit the "/etc/redhat-release" file restoring the original release information.
Red Hat Enterprise Linux Server release 5 (Tikanga)
Edit the "/etc/oratab" file setting the restart flag for each instance to 'Y'.
TSH1:/u01/app/oracle/product/10.2.0/db_1:Y
Oracle Database 11g R2(11.2)(64-bit) on Oracle Linux 5 (64-bit)
The installation of Oracle Database 11g Release 2 (11.2) (64-bit) on Oracle Linux 5 (64-bit). The article is based on a server installation with a minimum of 2G swap, secure Linux disabled. Oracle recommend a default server installation, but for these installations the following package groups installed:
GNOME Desktop Environment
Editors
Graphical Internet
Text-based Internet
Development Libraries
Development Tools
Server Configuration Tools
Administration Tools
Base
System Tools
X Window System
An example of this type of Linux installations can be seen here. Alternative installations may require more packages to be loaded, in addition to the ones listed below.
Download Software
Unpack Files
Hosts File
Set Kernel Parameters
Setup
Installation
Post Installation
Download Software
Download the following software.
Oracle Database 11g Release 2 (11.2) Software (64-bit)
Unpack Files
Unzip the files.
unzip linux.x64_11gR2_database_1of2.zip
unzip linux.x64_11gR2_database_2of2.zip
You should now have a single directory called "database" containing installation files.
Hosts File
The "/etc/hosts" file must contain a fully qualified name for the server.
<IP-address> <fully-qualified-machine-name> <machine-name>
For example.
127.0.0.1 localhost.localdomain localhost
192.168.2.181 ol5-11gr2.localdomain ol5-11gr2
Set Kernel Parameters
Oracle recommend the following minimum parameter settings.
fs.suid_dumpable = 1
fs.aio-max-nr = 1048576
fs.file-max = 6815744
kernel.shmall = 2097152
kernel.shmmax = 536870912
kernel.shmmni = 4096
kernel.sem = 250 32000 100 128
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default = 262144
net.core.rmem_max = 4194304
net.core.wmem_default = 262144
net.core.wmem_max = 1048586
The current values can be tested using the following command.
/sbin/sysctl -a | grep <param-name>
Add or amend the following lines in the "/etc/sysctl.conf" file.
fs.suid_dumpable = 1
fs.aio-max-nr = 1048576
fs.file-max = 6815744
kernel.shmall = 2097152
kernel.shmmax = 536870912
kernel.shmmni = 4096
# semaphores: semmsl, semmns, semopm, semmni
kernel.sem = 250 32000 100 128
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default=4194304
net.core.rmem_max=4194304
net.core.wmem_default=262144
net.core.wmem_max=1048586
Run the following command to change the current kernel parameters.
/sbin/sysctl -p
Add the following lines to the "/etc/security/limits.conf" file.
oracle soft nproc 2047
oracle hard nproc 16384
oracle soft nofile 1024
oracle hard nofile 65536
oracle soft stack 10240
Disable secure linux by editing the "/etc/selinux/config" file, making sure the SELINUX flag is set as follows.
SELINUX=disabled
Alternatively, this alteration can be done using the GUI tool (Applications > System Settings > Security Level). Click on the SELinux tab and disable the feature. If SELinux is disabled after installation, the server will need a reboot for the change to take effect.
Setup
Install the following packages if they are not already present.
# From Oracle Linux 5 DVD
cd /media/cdrom/Server
rpm -Uvh binutils-2.*
rpm -Uvh compat-libstdc++-33*
rpm -Uvh compat-libstdc++-33*.i386.rpm
rpm -Uvh elfutils-libelf*
rpm -Uvh gcc-4.*
rpm -Uvh gcc-c++-4.*
rpm -Uvh glibc-2.*
rpm -Uvh glibc-common-2.*
rpm -Uvh glibc-devel-2.*
rpm -Uvh glibc-headers-2.*
rpm -Uvh ksh*
rpm -Uvh libaio-0.*
rpm -Uvh libaio-devel-0.*
rpm -Uvh libgomp-4.*
rpm -Uvh libgcc-4.*
rpm -Uvh libstdc++-4.*
rpm -Uvh libstdc++-devel-4.*
rpm -Uvh make-3.*
rpm -Uvh sysstat-7.*
rpm -Uvh unixODBC-2.*
rpm -Uvh unixODBC-devel-2.*
rpm -Uvh numactl-devel-2*
cd /
eject
Create the new groups and users.
groupadd oinstall
groupadd dba
groupadd oper
groupadd asmadmin
useradd -g oinstall -G dba,oper,asmadmin oracle
passwd oracle
Note. We are not going to use the "asmadmin" group, since this installation will not use ASM.
Create the directories in which the Oracle software will be installed.
mkdir -p /u01/app/oracle/product/11.2.0/db_1
chown -R oracle:oinstall /u01
chmod -R 775 /u01
Login as root and issue the following command.
xhost +<machine-name>
Login as the oracle user and add the following lines at the end of the ".bash_profile" file.
# Oracle Settings
TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR
ORACLE_HOSTNAME=ol5-11gr2.localdomain; export ORACLE_HOSTNAME
ORACLE_UNQNAME=DB11G; export ORACLE_UNQNAME
ORACLE_BASE=/u01/app/oracle; export ORACLE_BASE
ORACLE_HOME=$ORACLE_BASE/product/11.2.0/db_1; export ORACLE_HOME
ORACLE_SID=DB11G; export ORACLE_SID
PATH=/usr/sbin:$PATH; export PATH
PATH=$ORACLE_HOME/bin:$PATH; export PATH
LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib; export LD_LIBRARY_PATH
CLASSPATH=$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib; export CLASSPATH
Installation
Log into the oracle user. If you are using X emulation then set the DISPLAY environmental variable:
DISPLAY=<machine-name>:0.0; export DISPLAY
Start the Oracle Universal Installer (OUI) by issuing the following command in the database directory:
./runInstaller
Proceed with the installation of your choice. You can see the type of installation I performed by clicking on the links below to see screen shots of each stage.
Configure Security Updates
Select Install Option
System Class
Node Selection
Select Install Type
Typical Install Configuration
Create Inventory
Perform Prerequisite Checks
Summary
Install Product
Database Configuration Assistant
Database Configuration Assistant 2
Execute Configuration Scripts
Finish
Post Installation
Edit the "/etc/oratab" file setting the restart flag for each instance to 'Y'.
DB11G:/u01/app/oracle/product/11.2.0/db_1:Y
LAMP INSTALLATION WITH CONFIGURATION ON CENTOSE 5.3
[root@fedorasmpp ~]#vi /etc/sysconfig/network-scripts/ifcfg-eth0
192.168.1.200
255.255.255.0
192.168.1.1
[root@fedorasmpp ~]#vi /etc/hosts
192.168.1.200 fedorasmpp.xxx.com fedorasmpp
:wq!
mysqladmin -h fedorasmpp.dataslices.com -u root password
[root@fedorasmpp ~]# yum install mysql mysql-server
[root@fedorasmpp ~]# chkconfig --levels 235 mysqld on
[root@fedorasmpp ~]# /etc/init.d/mysqld start
Starting mysqld: [ OK ]
[root@fedorasmpp ~]# mysqladmin -u root password redhat
[root@fedorasmpp ~]# mysqladmin -h fedorasmpp.dataslices.com -u root password redhat
[root@fedorasmpp ~]# yum install httpd
[root@fedorasmpp ~]# chkconfig --levels 235 httpd on
[root@fedorasmpp ~]# /etc/init.d/httpd start
Starting httpd: [ OK ]
[root@fedorasmpp ~]# yum install php
[root@fedorasmpp ~]#/etc/inid.d/httpd restart
open Browser mention in url
[root@fedorasmpp ~]# yum install php-mysql php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: mirror.eshk.hk
* base: mirror.eshk.hk
* extras: mirrors.digipower.vn
* updates: mirrors.digipower.vn
Setting up Install Process
Package php-mysql-5.1.6-27.el5_5.3.i386 already installed and latest version
Package php-ldap-5.1.6-27.el5_5.3.i386 already installed and latest version
Package php-odbc-5.1.6-27.el5_5.3.i386 already installed and latest version
Package 1:php-pear-1.4.9-6.el5.noarch already installed and latest version
Resolving Dependencies
--> Running transaction check
---> Package php-gd.i386 0:5.1.6-27.el5_5.3 set to be updated
---> Package php-imap.i386 0:5.1.6-27.el5_5.3 set to be updated
--> Processing Dependency: libc-client.so.1 for package: php-imap
---> Package php-xml.i386 0:5.1.6-27.el5_5.3 set to be updated
---> Package php-xmlrpc.i386 0:5.1.6-27.el5_5.3 set to be updated
--> Running transaction check
---> Package libc-client.i386 0:2004g-2.2.1 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================================================================
Package Arch Version Repository Size
=============================================================================================================================
Installing:
php-gd i386 5.1.6-27.el5_5.3 updates 117 k
php-imap i386 5.1.6-27.el5_5.3 updates 54 k
php-xml i386 5.1.6-27.el5_5.3 updates 97 k
php-xmlrpc i386 5.1.6-27.el5_5.3 updates 58 k
Installing for dependencies:
libc-client i386 2004g-2.2.1 base 516 k
Transaction Summary
=============================================================================================================================
Install 5 Package(s)
Upgrade 0 Package(s)
Total download size: 842 k
Is this ok [y/N]: y
Downloading Packages:
(1/5): php-imap-5.1.6-27.el5_5.3.i386.rpm | 54 kB 00:00
(2/5): php-xmlrpc-5.1.6-27.el5_5.3.i386.rpm | 58 kB 00:00
(3/5): php-xml-5.1.6-27.el5_5.3.i386.rpm | 97 kB 00:00
(4/5): php-gd-5.1.6-27.el5_5.3.i386.rpm | 117 kB 00:00
(5/5): libc-client-2004g-2.2.1.i386.rpm | 516 kB 00:01
-----------------------------------------------------------------------------------------------------------------------------
Total 103 kB/s | 842 kB 00:08
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : libc-client 1/5
Installing : php-xmlrpc 2/5
Installing : php-imap 3/5
Installing : php-xml 4/5
Installing : php-gd 5/5
Installed:
php-gd.i386 0:5.1.6-27.el5_5.3 php-imap.i386 0:5.1.6-27.el5_5.3 php-xml.i386 0:5.1.6-27.el5_5.3
php-xmlrpc.i386 0:5.1.6-27.el5_5.3
Dependency Installed:
libc-client.i386 0:2004g-2.2.1
Complete!
[root@fedorasmpp ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@fedorasmpp ~]# wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
--2011-01-16 14:07:03-- http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
Resolving packages.sw.be... 85.13.226.40
Connecting to packages.sw.be|85.13.226.40|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://rpmforge.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm [following]
--2011-01-16 14:07:03-- http://rpmforge.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
Resolving rpmforge.sw.be... 85.13.226.40
Reusing existing connection to packages.sw.be:80.
HTTP request sent, awaiting response... 200 OK
Length: 16698 (16K) [application/x-rpm]
Saving to: `rpmforge-release-0.3.6-1.el5.rf.i386.rpm'
100%[===================================================================================>] 16,698 --.-K/s in 0.1s
2011-01-16 14:07:04 (111 KB/s) - `rpmforge-release-0.3.6-1.el5.rf.i386.rpm' saved [16698/16698]
[root@fedorasmpp ~]# rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.i386.rpm
warning: rpmforge-release-0.3.6-1.el5.rf.i386.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
Preparing... ########################################### [100%]
1:rpmforge-release ########################################### [100%]
[root@fedorasmpp ~]# yum install phpmyadmin
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: mirror.eshk.hk
* base: mirror.eshk.hk
* extras: mirrors.digipower.vn
* rpmforge: fr2.rpmfind.net
* updates: mirrors.digipower.vn
rpmforge | 1.1 kB 00:00
rpmforge/primary | 2.2 MB 00:22
rpmforge 10369/10369
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package phpmyadmin.noarch 0:2.11.11.1-1.el5.rf set to be updated
--> Processing Dependency: php-mbstring >= 4.1.0 for package: phpmyadmin
--> Processing Dependency: php-mcrypt for package: phpmyadmin
--> Running transaction check
---> Package php-mbstring.i386 0:5.1.6-27.el5_5.3 set to be updated
---> Package php-mcrypt.i386 0:5.1.6-15.el5.centos.1 set to be updated
--> Processing Dependency: libmcrypt.so.4 for package: php-mcrypt
--> Running transaction check
---> Package libmcrypt.i386 0:2.5.8-4.el5.centos set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================================================================
Package Arch Version Repository Size
=============================================================================================================================
Installing:
phpmyadmin noarch 2.11.11.1-1.el5.rf rpmforge 4.2 M
Installing for dependencies:
libmcrypt i386 2.5.8-4.el5.centos extras 116 k
php-mbstring i386 5.1.6-27.el5_5.3 updates 995 k
php-mcrypt i386 5.1.6-15.el5.centos.1 extras 16 k
Transaction Summary
=============================================================================================================================
Install 4 Package(s)
Upgrade 0 Package(s)
Total download size: 5.3 M
Is this ok [y/N]: y
Is this ok [y/N]: y
Downloading Packages:
(1/4): php-mcrypt-5.1.6-15.el5.centos.1.i386.rpm | 16 kB 00:00
(2/4): libmcrypt-2.5.8-4.el5.centos.i386.rpm | 116 kB 00:00
(3/4): php-mbstring-5.1.6-27.el5_5.3.i386.rpm | 995 kB 00:02
(4/4): phpmyadmin-2.11.11.1-1.el5.rf.noarch.rpm | 4.2 MB 00:09
-----------------------------------------------------------------------------------------------------------------------------
Total 365 kB/s | 5.3 MB 00:14
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : libmcrypt 1/4
Installing : php-mcrypt 2/4
Installing : php-mbstring 3/4
Installing : phpmyadmin 4/4
Installed:
phpmyadmin.noarch 0:2.11.11.1-1.el5.rf
Dependency Installed:
libmcrypt.i386 0:2.5.8-4.el5.centos php-mbstring.i386 0:5.1.6-27.el5_5.3 php-mcrypt.i386 0:5.1.6-15.el5.centos.1
Complete!
[root@fedorasmpp ~]# vi /etc/httpd/conf.d/phpmyadmin.conf
# Web application to manage MySQL
#
<Directory "/usr/share/phpmyadmin">
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Directory>
Alias /phpmyadmin /usr/share/phpmyadmin
Alias /phpMyAdmin /usr/share/phpmyadmin
Alias /mysqladmin /usr/share/phpmyadmin
:wq!
Next Configuration Step we change the authentication in phpMyAdmin for cookie by http:
========================
BY DEFAULT CONFIGURATION
========================
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'cookie';
s
==========================
AFTER CHANGE CONFIGURATION
==========================
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[root@fedorasmpp ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
you can access phpMyAdmin under http://192.168.1.9/phpmyadmin/:
How to Install and Configure SARG
SARG (Squid Analysis Report Generator) is a tool that allow you to view "where" your users are going to on the Internet.
Sarg it self, provide to end user a generic interface to create reports based on squid access log (begin of log to current date).
sarg-reports (this script) is useful because it allow you to easily create and manage Daily, Weekly and Monthly reports.
Using sarg-reports is very easy, read the following steps to know how to installing and configuring this tools:
Requirements
a) An unix system with bash shell (like GNU/Linux, FreeBSD, etc...)
b) Squid - http://www.squid-cache.org
c) Sarg - http://sarg.sourceforge.net/
d) Apche web server - http://www.apache.org/
1. Download the package from here.
2. Unzip the package by following command.
#unzip sarg-2.2.5-1.el5.rf.i386.zip
3. This is the RPM package, so I can install the package easily, I use the following command.
# rpm -ivh sarg-2.2.5-1.el5.rfi386.rpm
4. Edit configuration file as shown bellow
# vim /etc/sarg/sarg.conf
This is my configuration file, of course you can change it like you want
access_log /var/log/squid/access.log graphs yes graph_days_bytes_bar_color orange title "Squid User Access Reports" output_dir /var/www/htdocs/sarg resolve_ip no topuser_sort_field BYTES reverse user_sort_field BYTES reverse lastlog 3 remove_temp_files yes index yes overwrite_report yes topsites_num 100 topsites_sort_order CONNECT D index_sort_order D max_elapsed 28800000 report_type topsites sites_users users_sites date_time denied auth_failures site_user_time_date show_successful_message yes show_read_statistics yes topuser_fields NUM DATE_TIME USERID CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE user_report_fields CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE topuser_num 0 show_sarg_logo yes
6. To Generate the log report, simply run the command
#sarg - l /var/log/squid/access.log
The reports will be saved in /var/www/sarg/ONE-SHOT directory
To generate the log report by the cron job you can make entry in "/etc/crontab" file
00 23 * * * root /usr/bin/sarg
It will generate the log report every day at 11.00 P.M
You can also see all command line switches by following command
#sarg -h
7. Example To generate report by manually :
#sarg -l /var/log/squid/access.log -o /var/www/sarg/daily -z -d 21/06/2009
It will generate the log report date 21/6/2009 into /var/www/sarg/daily directory
If you want log report from 21/06/2009 to 28/06/2009 then run this command
#sarg -l /var/log/squid/access.log -o /var/www/sarg/ONE-SHOT -z -d 21/06/2009-28/06/2009
8. To view the log report generated by sarg start httpd service
/etc/init.d/httpd start
And browes url "http://ip_of_linux box/sarg" eg.
http://10.0.0.1/sarg
make sure that apache is working and publish squidlogs..
If you want apache ask password to allow sarg report you can configure .htaccess file and .htpassword.
Source: http://sarg.sourceforge.net/
Linux Load Balancer of Webserver
6 Nodes Load Balancer
Two nodes for LVS (Piranha Pulse nannay Ipvsadm) as Load balancer
Two nodes for Web servers can be multiple upto your requirement.
Two nodes for mysql database server using Drbd & heartbeat for highly avaliable mysql database.
3 types of LoadBalancers
1. Nating
2. Direct Routing
3. Tunneling
CentOS 5.3 is used as Operating System.
In this setup we are using LVS(Linux virtual server) using Direct Routing Method these packages are available on Redhat5.x/CentOs5.x.
We will cover these in few steps.
1 . we will setup basic setup for whole 6 nodes
> Host file configuration (In real network use DNS or both.)
> Ssh key generation (For authentication betwen all 6 nodes)
> NTP Configuration (For time syncronization if possible use dedicated NTP server otherwise 1 node can be used)
2 . We need to configure LVS setup for the two highly available Load balancers. (If one down other will do the same function)
3 . We need to configure web servers for the Load balancing the web service. (Both will have apache php php-mysql php-gd service installaed We also install joomla on both server to check our web and Mysql service working.)
4 . We need to configure Drbd & heartbeat service on two db servers.(Db1 and Db2 will be active passive mode to give highly availabe mysql database service and it's data/databses).
5 . We need to configure joomla on both web server's and make thier connection with mysql databses servers.
1. Basic configurations of all 6 nodes.
On all Nodes. Please copy this file on all servers/nodes
[root@lb1 /]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
##### IP's of Load Balancers #####
10.0.0.1 lb1.infoaddict.org lb1
10.0.0.2 lb2.infoaddict.org lb2
##### IP's of Web Servers #####
10.0.0.30 www1.infoaddict.org www1
10.0.0.40 www2.infoaddict.org www2
##### IP's of MySQL DB servers #####
10.0.0.50 db1.infoaddict.org db1
10.0.0.51 db2.infoaddict.org db2
########## Here is Virtual IP/Service IP of Webserver and MySQL DB ##########
10.0.0.3 www.infoaddict.org www
10.0.0.190 db.infoaddict.org db
Copy this /etc/hosts file to all the servers
[root@lb1 /]#
Now generate ssh keys
[root@lb1 ~]# ssh-keygen -t rsa
[root@lb1 ~]# ssh-keygen -t dsa
[root@lb1 ~]# cd /root/.ssh/
[root@lb1 ~]# cat *.pub > authorized_keys
[root@lb1 ~]#scp -r /root/.ssh/ lb2:/root/
[root@lb1 ~]#scp -r /root/.ssh/ www1:/root/
[root@lb1 ~]#scp -r /root/.ssh/ www2:/root/
[root@lb1 ~]#scp -r /root/.ssh/ db1:/root/
[root@lb1 ~]#scp -r /root/.ssh/ db2:/root/
[root@lb1 ~]#ssh-keyscan -t dsa lb1 lb2 db1 db2 www1 www2
[root@lb1 ~]#ssh-keyscan -t rsa lb1 lb2 db1 db2 www1 www2
Stop Unwanted services on all nodes.
[root@lb1 ~]# /etc/init/sendmail stop
[root@lb1 ~]# chkconfig --level 235 sendmail off
3. NTP configuration.
Run this command on all nodes & Make sure the ntp is installed on all nodes.
[root@lb1 ~]# rpm -qa | grep ntp
ntp-4.2.2p1-9.el5.centos
chkfontpath-1.10.1-1.1
[root@lb1 ~]#
[root@lb1 ~]# vim /etc/ntp.conf ###Configuration for NTP server###
restrict 127.0.0.1
server 127.127.1.0 # local clock
save & quit
[root@lb1 ~]#
[root@lb1 ~]# /etc/init.d/ntpd restart
Shutting down ntpd: [ OK ]
Starting ntpd: [ OK ]
[root@lb1 ~]#
Clinet side configuration
[root@db2 /]# vim /etc/ntp.conf
#restrict 127.0.0.1
#restrict -6 ::1
server 10.0.0.1 ##Put Server IP here##
#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org
#server 127.127.1.0 # local clock
#fudge 127.127.1.0 stratum 10
save & quit
[root@db2 /]# /etc/init.d/ntpd restart
Shutting down ntpd: [ OK ]
Starting ntpd: [ OK ]
[root@db2 /]#
[root@db2 /]#
[root@db2 /]# ntpdate -u 10.0.0.1
16 Jul 11:55:34 ntpdate[12101]: step time server 10.0.0.1 offset -3.069414 sec
[root@db2 /]#
Copy this file /etc/ntp.conf on all 4 nodes .i.e www1 www2 db1 db2 and restart the ntp service on those nodes.
Run this command on all nodes.
[root@db2 /]# ntpdate -u 10.0.0.1
LVS Setup configuration on LB1 and LB2
We need to install Piranha package it will automaticaly instll pulse,ipvsadm,nanny
install piranha on both nodes
[root@lb1 ~]# yum install piranha -y
[root@lb2 ~]# yum install piranha -y
[root@lb1 ~]# vim /etc/sysconfig/ha/lvs.cf
serial_no = 14
primary = 10.0.0.1
service = lvs
rsh_command = ssh
backup_active = 1
backup = 10.0.0.2
heartbeat = 1
heartbeat_port = 1050
keepalive = 2
deadtime = 10
network = direct ### use nat if nating method is used ###
debug_level = NONE
monitor_links = 1
virtual server1 {
active = 1
address = 10.0.0.3 eth0:1
port = 80
send = "GET / HTTP/1.1\r\n\r\n"
expect = "HTTP"
load_monitor = uptime
scheduler = rr
protocol = tcp
timeout = 10
reentry = 180
quiesce_server = 0
server www1 {
address = 10.0.0.30
active = 1
weight = 1
}
server www2 {
address = 10.0.0.40
active = 1
weight = 1
}
}
save & exit
[root@lb1 ~]# scp /etc/sysconfig/ha/lvs.cf lb2:/etc/sysconfig/ha/
[root@lb1 ~]# cat /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
save & exit
[root@lb1 ~]# scp /etc/sysctl.conf lb2:/etc/
Run this command on both nodes
[root@lb1 ~]# [root@lb1 ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@lb1 ~]#
Before starting service pulse start httpd on both web servers.
[root@www1 ~]#/etc/init.d/httpd start
[root@www1 ~]#/etc/init.d/httpd start
Start pulse service on both lvs/LoadBalancer servers
[root@lb1 ~]# /etc/init.d/pulse start
Starting pulse:
[root@lb1 ~]#
[root@lb1 ~]# /etc/init.d/pulse restart
Shutting down pulse: [ OK ]
Starting pulse: [ OK ]
[root@lb1 ~]# tail -f /var/log/messages
Jul 16 12:24:18 lb1 pulse[6363]: STARTING PULSE AS MASTER
Jul 16 12:24:28 lb1 pulse[6363]: partner dead: activating lvs
Jul 16 12:24:28 lb1 avahi-daemon[2940]: Registering new address record for 10.0.0.3 on eth0.
Jul 16 12:24:28 lb1 lvs[6367]: starting virtual service server1 active: 80
Jul 16 12:24:28 lb1 nanny[6376]: starting LVS client monitor for 10.0.0.3:80
Jul 16 12:24:28 lb1 lvs[6367]: create_monitor for server1/www1 running as pid 6376
Jul 16 12:24:28 lb1 nanny[6377]: starting LVS client monitor for 10.0.0.3:80
Jul 16 12:24:28 lb1 lvs[6367]: create_monitor for server1/www2 running as pid 6377
Jul 16 12:24:28 lb1 nanny[6376]: [ active ] making 10.0.0.30:80 available
Jul 16 12:24:28 lb1 nanny[6377]: [ active ] making 10.0.0.40:80 available
Jul 16 12:24:33 lb1 pulse[6369]: gratuitous lvs arps finished
it seems good now our pulse is working fine.
3. Web servers configuration On both servers.
[root@www1 ~]# yum install httpd php php-mysql php-gd
[root@www1 ~]# yum install arptables_jf
[root@www1 ~]#echo "Load Balancing" > /var/www/html/test.html
[root@www2 ~]#echo "Load Balancing1" > /var/www/html/test.html
For both server we need to configure the Loopback interface
[root@www1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-lo:0
DEVICE=lo:0
IPADDR=10.0.0.3
NETMASK=255.255.255.255
NETWORK=10.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=10.255.255.255
ONBOOT=yes
NAME=loopback
[root@www1 ~]#
[root@www1 ~]#ifup lo:0
[root@www2 ~]# vim /etc/sysconfig/network-scripts/ifcfg-lo:0
DEVICE=lo:0
IPADDR=10.0.0.3
NETMASK=255.255.255.255
NETWORK=10.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=10.255.255.255
ONBOOT=yes
NAME=loopback
[root@www2 ~]#
[root@www2 ~]# ifup lo:0
on both real servers
[root@www1 ~]#arptables -A IN -d 10.0.0.3 -j DROP
[root@www1 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.1
[root@www1 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.2
[root@www1 ~]#
[root@www1 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables: [ OK ]
[root@www1 ~]#
[root@www2 ~]#arptables -A IN -d 10.0.0.3 -j DROP
[root@www2 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.1
[root@www2 ~]#arptables -A OUT -d 10.0.0.3 -j mangle --mangle-ip-s 10.0.0.2
[root@www2 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables: [ OK ]
[root@www2 ~]#
We need to tell system to up lo:0 every time at boot.
[root@www1 ~]# echo "ifup lo:0" > /etc/rc.local
[root@www2 ~]# echo "ifup lo:0" > /etc/rc.local
Here we need to test the setup is working fine here we have two lvs and webservers
this command will show about the connections.
[root@lb1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP www.infoaddict.org:ht rr
-> www2.infoaddict.org:h Route 1 0 0
-> www1.infoaddict.org:h Route 1 0 0
[root@lb1 ~]#
[root@lb1 ~]# watch ipvsadm -Lcn
Configuration of Drbd & Heartbeat on Both database servers
Here we need to configure partitions on both servers
PARTITION SETUP On Both Servers.
Partion setup on both server identical same with fdisk
We have 4GB disks on both servers.
Partition Setup for Cluster Servers
We need to create LVM partition
[root@db1 ~]# fdisk -l
[root@db1 ~]# fdisk /dev/sdb
[root@db1 ~]# fdisk /dev/sd
sda sda1 sda2 sdb sdb1
[root@db2 ~]# fdisk /dev/sdb
Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 522 4192933+ 8e Linux LVM
Command (m for help): d
Selected partition 1
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-522, default 522): +4000M
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 83 Linux
Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 8e Linux LVM
Command (m for help):
Command (m for help): w
[root@db1 ~]# partprobe
Create Physical Volume for LVM this is second step for LVM partition.
[root@db1 ~]# pvcreat /dev/sdb1 /dev/sdb2
Create Volume Group with this command
[root@db1 ~]# vgcreate vgdb /dev/sdb1
Create Logical volume partition
[root@db1 ~]# lvcreate -L +1000M -n /dev/mapper/vgdb/lvdb
[root@db1 ~]# lvcreate -L +256M -n /dev/mapper/vgdb/lvmeta
Note: Create LVM on Both servers identical same ...................
install drbd and configure it.
[root@db1 ~]# yum install drbd82 kmod-drbd82 -y
[root@db2 ~]# yum install drbd82 kmod-drbd82 -y
[root@db1 ~]modprobe drbd
[root@db2 ~]modprobe drbd
[root@db1 ~]echo "modprobe drbd" > /etc/rc.local
[root@db2 ~]echo "modprobe drbd" > /etc/rc.local
[root@db1 ~]#vim /etc/drbd.conf
global {
usage-count yes;
}
common {
syncer { rate 10M; }
}
resource r0 {
protocol C;
handlers {
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt -f";
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt -f";
local-io-error "echo o > /proc/sysrq-trigger ; halt -f";
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";
}
startup {
}
disk {
on-io-error detach;
}
net {
after-sb-0pri disconnect;
after-sb-1pri disconnect;
after-sb-2pri disconnect;
rr-conflict disconnect;
}
syncer {
rate 10M;
al-extents 257;
}
on db1.infoaddict.org {
device /dev/drbd0;
disk /dev/vgdb/lvdb;
address 10.0.0.50:7788;
meta-disk /dev/vgdb/lvmeta[1];
}
on db2.infoaddict.org {
device /dev/drbd0;
disk /dev/vgdb/lvdb;
address 10.0.0.51:7788;
meta-disk /dev/vgdb/lvmeta[1];
}
}
save & exit
[root@db1 ~]#scp /etc/drbd.conf lb2:/etc/
[root@db1 ~]#vi /etc/sysctl.conf
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
save & quit
[root@db1 ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@db1 ~]#
save it........
[root@db1 ~]#
[root@db1 ~]# scp /etc/drbd.conf db2:/etc/drbd.conf
We need to run module on both servers to run drbd
Load DRBD module both nodes:
[root@db1 ~]# modprobe drbd
[root@db1 ~]# echo "modprobe drbd" >> /etc/rc.local
[root@db2 ~]# modprobe drbd
[root@db2 ~]# echo "modprobe drbd" >> /etc/rc.local
##### run this on both servers ######
[root@db1 ~]#drbdadm create-md r0
[root@db2 ~]#drbdadm create-md r0
[root@db1 ~]#drbdadm attach r0
[root@db2 ~]#drbdadm attach r0
[root@db1 ~]#drbdadm syncer r0
[root@db2 ~]#drbdadm syncer r0
[root@db1 ~]#drbdadm connect r0
[root@db2 ~]#drbdadm connect r0
On Primary Node only
[root@db1 ~]#drbdadm -- --overwrite-data-of-peer primary r0
On both Nodes:
[root@db1 ~]#drbdadm up all
[root@db2 ~]#drbdadm up all
On Primary Node only
[root@db1 ~]#drbdadm -- primary all #### ON Node one Only ####
[root@db1 ~]#watch cat /proc/drbd
only on db1 ########## Primary Node ########
[root@db1 ~]#mkfs.ext3 /dev/drbd0
[root@db1 ~]#mkdir /data/
[root@db1 ~]#mount /dev/drbd0 /data/
[root@db1 ~]#
[root@db1 ~]# df -hk
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
5967432 2625468 3033948 47% /
/dev/sda1 101086 12074 83793 13% /boot
tmpfs 257720 0 257720 0% /dev/shm
/dev/drbd0 4031516 107600 3719128 3% /data
[root@db1 ~]#
[root@db1 ~]# umount /dev/drbd0 /data
Note: HeartBeat will automatically handle this.
On db2 ####### Secondry Node #######
[root@db2 ~]#mkdir /data
Heartbeat Setup:
================
Install heartbeat package using yum
Note: Internet connection is required or configure yum repository on your local machine with extras.
[root@db1 ~]#yum install -y heartbeat heartbeat-pils heartbeat-stonith heartbeat-devel
[root@db1 ~]#vim /etc/ha.d/ha.cf ## Create this file and copy this text ##
logfacility local0
keepalive 2
#deadtime 30 # USE THIS!!!
deadtime 10
# we use two heartbeat links, eth2 and serial 0
bcast eth0
#serial /dev/ttyS0
baud 19200
auto_failback off
node db1.infoaddict.org
node db2.infoaddict.org
save & quit.
Server db1
[root@db1 ~]#vi /etc/ha.d/haresources
db1 IPaddr::10.0.0.190/8/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 mysql
Server db2:
[root@db2 ~]#vi /etc/ha.d/haresources
db2 IPaddr::10.0.0.190/8/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 mysql
On Both Servers:
[root@db1 ~]#vi /etc/ha.d/authkeys
auth 3
3 md5 redhat ######### Use Long name as password #########
both NODE:
[root@db1 ~]#chmod 600 /etc/ha.d/authkeys
[root@db1 ~]#scp /etc/ha.d/authkeys db2:/etc/ha.d/authkeys
[root@db1 ~]#chkconfig --level 235 heartbeat on
Note: if you have problem mounting /dev/drbd0 on /data then run these commands to check the status if you found the drbddisk stopped then start it.
Mysql Configuration.
cp /etc/my.cnf /etc/my.cnf.orig
vi /etc/my.cnf
[mysqld]
# datadir=/var/lib/mysql
datadir=/data/mysql
#socket=/var/lib/mysql/mysql.sock
socket=/data/mysql/mysql.sock
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1
[mysql.server]
user=mysql
#basedir=/var/lib
basedir=/data
[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid
[mysql]
socket=/data/mysql/mysql.sock
Now it is time to add users/hosts to mysql server:
mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'10.0.0.30' IDENTIFIED BY 'redhat'
mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'10.0.0.40' IDENTIFIED BY 'redhat'
mysql> FLUSH PRIVILEGES;
mysql>quit
Now we need to install joomla on both web servers
On Webserver 1
[root@www1 /]# yum install php php-mysql php-gd -y
[root@www1 ~]# ls
anaconda-ks.cfg Desktop install.log install.log.syslog Joomla_1.5.13-Stable-Full_Package
[root@www1 ~]# cd Joomla_1.5.13-Stable-Full_Package/
[root@www1 Joomla_1.5.13-Stable-Full_Package]# ls
[root@www1 Joomla_1.5.13-Stable-Full_Package]# cp -avr * /var/www/html/
[root@www1 Joomla_1.5.13-Stable-Full_Package]# cd /var/www/html/
[root@www1 html]# ls
[root@www1 html]# cd ..
[root@www1 www]# ls
cgi-bin error html icons
[root@www1 www]# chown apache:apache html/ -R
[root@www1 www]#
[root@www1 www]# ls
cgi-bin error html icons
[root@www1 www]# cd html/
[root@www1 html]# ll
[root@www1 html]#
Now open internet explorer then open
http://10.0.0.30
Install Joomla follow the steps and give required information.
In Database section give
Host 10.0.0.190 IP use MySQL as database.
user root
passwdor redhat
database joomla
Must check install sample data.
Copy all the joomla code on www2
[root@www1 html]# scp -r * www2:/var/www/html/
We need to open this file and edit it on line 391 add index.php
[root@www1 html]#vim /etc/httpd/conf/httpd.conf
DirectoryIndex index.html index.html.var index.php
save & quit
[root@www1 /]#
[root@www1 ~]# scp /etc/httpd/conf/httpd.conf www2:/etc/httpd/conf/
httpd.conf 100% 33KB 32.9KB/s 00:00
[root@www1 ~]#
[root@www1 ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@www1 ~]#
On Web Server 2
[root@www2 html]# chown apache:apache * -R
[root@www2 html]# ll
[root@www2 /]# yum install php php-mysql php-gd -y
[root@www2 ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@www2 ~]#
Remeber that each machine(LVS+Real) must have default gw the ip of router connected to these servers
[root@www1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 10.0.0.20 0.0.0.0 UG 0 0 0 eth0
[root@www1 ~]#
Now you can test all the network by accessing web on http://10.0.0.3 or http://www.infoaddict.org/
[root@lb1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP www.infoaddict.org:ht rr
-> www2.infoaddict.org:h Route 1 0 0
-> www1.infoaddict.org:h Route 1 0 0
[root@lb1 ~]#
[root@lb1 ~]# watch ipvsadm -Lcn
Configuration of DNS (Bind) server in chroot environment
KVM in the CentOS 5.4 – How to fixing bridge Problem
When we use KVM in CentOS 5.4 we will notice that there is no bridge setup to allow your virtual guests to directly connect to the local network.
We need to do so simple steps to fix it.
As we are using libvirt,
We need to follwo steps below to fix it.
Step 1: Create the bridge script at /etc/sysconfig/network-scripts/ifcfg-br0
[root@babar /root]# vi /etc/sysconfig/network-scripts/ifcfg-br0
DEVICE=br0
BOOTPROTO=static
TYPE=Bridge
IPADDR=192.168.0.100
NETMASK=255.255.255.0
ONBOOT=yes
NM_CONTROLLED=no
Save & exit
As you can see, I use static IP config.
Step 2: hook up eth0 to the bridge and remove it’s IP config in /etc/sysconfig/network-scripts/ifcfg-eth0
[root@babar /root]# vi /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes
BRIDGE=br0
NM_CONTROLLED=no
TYPE=Ethernet
Please restart the network service or your system and you will done. Now create a new virtual machine with virt-manager,we can select to have it directly hooked up to the physical network.
[root@babar ~]# ifconfig
br0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::215:17ff:febd:c94d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:168 errors:0 dropped:0 overruns:0 frame:0
TX packets:33 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:11475 (11.2 KiB) TX bytes:9580 (9.3 KiB)
eth0 Link encap:Ethernet HWaddr 00:xx:xx:xx:xx:xx
inet addr:192.168.1.253 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::215:17ff:febd:c94c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3240 errors:0 dropped:0 overruns:0 frame:0
TX packets:5286 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:417544 (407.7 KiB) TX bytes:5574477 (5.3 MiB)
Memory:b1a20000-b1a40000
eth1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet6 addr: fe80::215:17ff:febd:c94d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9113 errors:0 dropped:0 overruns:0 frame:0
TX packets:122 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:755212 (737.5 KiB) TX bytes:27911 (27.2 KiB)
Memory:b1a00000-b1a20000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:969 errors:0 dropped:0 overruns:0 frame:0
TX packets:969 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2744681 (2.6 MiB) TX bytes:2744681 (2.6 MiB)
virbr0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
inet6 addr: fe80::200:ff:fe00:0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:9535 (9.3 KiB)
vnet0 Link encap:Ethernet HWaddr A2:F7:06:6D:C1:2F
inet6 addr: fe80::a0f7:6ff:fe6d:c12f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:57 errors:0 dropped:0 overruns:0 frame:0
TX packets:1035 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:9782 (9.5 KiB) TX bytes:208709 (203.8 KiB)
Now it is working fine.
How to Install BANDWIDTHD…
NTRODUCTION:
It is important to know traffic usage of your client if you're a Linux network administrator. You can monitor your client in text mode, graphic mode or html exported like mrtg, cacti or bandwidthd and one of my favorite bandwidth monitor is bandwidthd.
BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.
Download Bandwidthd form http://sourceforge.net/projects/bandwidthd/files/
[root@arslan]# tar xvfz bandwidthd-2.0.1.tgz
[root@arslan]# cd bandwidthd
Configure and install the Bandwidthd source:
[root@arslan]# ./configure && make install
Please make sure you have:
libpcap from http://www.tcpdump.org/
libpng from http://www.libpng.org/
libgd from http://www.boutell.com/gd/
Now Edit /usr/local/bandwidthd/etc/bandwidthd.conf
to suit your network environment.
My Example is :
subnet 192.168.0.0/24
subnet 192.168.1.0/24
# Device to listen on
# Bandwidthd listens on the first device it detects
# by default. Run "bandwidthd -l" for a list of
# devices.
dev "eth0"
#dev "eth1"
Now Start Bandwidthd
/usr/local/bandwidthd/bandwidthd
You can't see your graphic report until you set /usr/local/bandwidthd/htdocs/ folder to set as apache virtual directory. Add below line to your apache config file.
Alias /bandwidthd "/usr/local/bandwidthd/htdocs"
<Directory "/usr/local/bandwidthd/htdocs">
Order Allow,Deny
Allow from All
</Directory>
now go to browser and write http://your-server-ip/bandwidthd
Transparent squid on High Availability Cluster
OS CentOS 5.3 on both machines.
We will setup for Transparent squid on High Availability Cluster.
Packages are available on CentOS extras repository.
Our Scenario
We have two servers
fahad 192.168.1.50 Primary server
rony 192.168.1.60 Secondry server
Setup for ip to name resolve ## we don't have DNS we need this step ##
Basic Setup Configuration.
[root@fahad ~]# vim /etc/hosts
192.168.1.50 fahad
192.168.1.60 rony
save & exit
[root@fahad ~]# ping fahad
PING fahad (192.168.1.50) 56(84) bytes of data.
64 bytes from fahad (192.168.1.50): icmp_seq=1 ttl=64 time=4.15 ms
64 bytes from fahad (192.168.1.50): icmp_seq=2 ttl=64 time=0.126 ms
64 bytes from fahad (192.168.1.50): icmp_seq=3 ttl=64 time=1.88 ms
[1]+ Stopped ping fahad
[root@fahad ~]# ping rony
PING rony (192.168.1.60) 56(84) bytes of data.
64 bytes from rony (192.168.1.60): icmp_seq=1 ttl=64 time=1.32 ms
64 bytes from rony (192.168.1.60): icmp_seq=2 ttl=64 time=0.523 ms
64 bytes from rony (192.168.1.60): icmp_seq=3 ttl=64 time=1.79 ms
[2]+ Stopped ping rony
[root@fahad ~]#
[root@fahad ~]# scp /etc/hosts 192.168.1.60:/etc/hosts
On Node1 servers:
stop unwanted services on both servers
[root@fahad ~]# /etc/init/sendmail stop
[root@fahad ~]# chkconfig --level 235 sendmail off
[root@fahad ~]# iptables -F
[root@fahad ~]#service iptables save
[root@rony ~]# /etc/init/sendmail stop
[root@rony ~]# chkconfig --level 235 sendmail off
[root@rony ~]# iptables -F
[root@rony ~]#service iptables save
[root@fahad ~]# rpm -qa | grep ntp
ntp-4.2.2p1-9.el5.centos.1
[root@fahad ~]#
Then we need to open ntp server configuration file.
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org
#broadcast 192.168.1.255 key 42 # broadcast server
#broadcastclient # broadcast client
#broadcast 224.0.1.1 key 42 # multicast server
#multicastclient 224.0.1.1 # multicast client
#manycastserver 239.255.254.254 # manycast server
#manycastclient 239.255.254.254 key 42 # manycast client
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.
########## for server use this and on clients comment this and use server serverIP ##################
server 127.127.1.0 # local clock
#fudge 127.127.1.0 stratum 10
# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
# driftfile /var/lib/ntp/drift
# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
# Specify the key identifiers which are trusted.
# trustedkey 4 8 42
# Specify the key identifier to use with the ntpdc utility.
# requestkey 8
# Specify the key identifier to use with the ntpq utility.
#controlkey 8
keys /etc/ntp/keys
save quit.
[root@fahad ~]#
[root@fahad ~]# /etc/init.d/ntpd start
[root@fahad ~]# chkconfig --level 235 ntpd on
[root@rony ~]# vim ntp.conf
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
#restrict 127.0.0.1
#estrict -6 ::1
# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 192.168.1.50 ### add this line on second server ###
#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org
#broadcast 192.168.1.255 key 42 # broadcast server
#broadcastclient # broadcast client
#broadcast 224.0.1.1 key 42 # multicast server
#multicastclient 224.0.1.1 # multicast client
#manycastserver 239.255.254.254 # manycast server
#manycastclient 239.255.254.254 key 42 # manycast client
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.
#server 127.127.1.0 # local clock ##### #####
#fudge 127.127.1.0 stratum 10
# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift
# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys
# Specify the key identifiers which are trusted.
#trustedkey 4 8 42
# Specify the key identifier to use with the ntpdc utility.
#requestkey 8
# Specify the key identifier to use with the ntpq utility.
#controlkey 8
save & exit
[root@rony ~]# /etc/init.d/ntpd start
[root@rony ~]# chkconfig --level 235 ntpd on
[root@rony ~]# ntpdate -u 192.168.1.50
[root@rony ~]# watch ntpq -p -n
[root@fahad ~]# watch ntpq -p -n
PARTITION SETUP On Both Servers.
Partion setup on both server identical same with fdisk
We have 3GB disks on both servers.
Partition Setup for Cluster Servers
We need to create LVM partition
[root@fahad ~]# fdisk -l
[root@fahad ~]# fdisk /dev/sdb
[root@fahad ~]# fdisk /dev/sd
sda sda1 sda2 sdb sdb1
[root@rony ~]# fdisk /dev/sdb
Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 522 4192933+ 8e Linux LVM
Command (m for help): d
Selected partition 1
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-522, default 522): +4000M
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 83 Linux
Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)
Command (m for help): p
Disk /dev/sdb: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 487 3911796 8e Linux LVM
Command (m for help):
Command (m for help): w
[root@fahad ~]# partprobe
Create Physical Volume for LVM this is second step for LVM partition.
[root@fahad ~]# pvcreat /dev/sdb1
Create Volume Group with this command
[root@fahad ~]# vgcreate vgdrbd /dev/sdb1
Create Logical volume partition
[root@fahad ~]# lvcreate -n lvdrbd /dev/mapper/vgdrbd -L +4000M
Note: Create LVM on Both servers identical same ...................
add these three values in sysctl.conf
[root@fahad ~]#vi /etc/sysctl.conf
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
save & quit
[root@fahad ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
[root@fahad ~]#
DRBD Setup
==========
Install drbd82 & kmod-drbd82 rpms using yum command.
[root@fahad ~]#yum install -y drbd82 kmod-drbd82
open /etc/drbd.conf
[root@fahad ~]#vim /etc/drbd.conf
global {
usage-count yes;
}
common {
syncer { rate 10M; }
}
resource r0 {
protocol C;
handlers {
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt -f";
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt -f";
local-io-error "echo o > /proc/sysrq-trigger ; halt -f";
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";
}
startup {
}
disk {
on-io-error detach;
}
net {
after-sb-0pri disconnect;
after-sb-1pri disconnect;
after-sb-2pri disconnect;
rr-conflict disconnect;
}
syncer {
rate 10M;
al-extents 257;
}
on fahad {
device /dev/drbd0;
disk /dev/VGdrbd/lvdrbd;
address 192.168.1.50:7788;
meta-disk internal;
}
on node2 {
device /dev/drbd0;
disk /dev/VGdrbd/lvdrbd;
address 192.168.1.60:7788;
meta-disk internal;
}
}
save it........
[root@fahad ~]#
[root@fahad ~]# scp /etc/drbd.conf rony:/etc/drbd.conf
We need to run module on both servers to run drbd
Load DRBD module both nodes:
[root@fahad ~]# modprobe drbd
[root@fahad ~]# echo "modprobe drbd" >> /etc/rc.local
[root@rony ~]# modprobe drbd
[root@rony ~]# echo "modprobe drbd" >> /etc/rc.local
##### run this on both servers ######
[root@fahad ~]#drbdadm create-md r0
[root@rony ~]#drbdadm create-md r0
[root@fahad ~]#drbdadm attach r0
[root@rony ~]#drbdadm attach r0
[root@fahad ~]#drbdadm syncer r0
[root@rony ~]#drbdadm syncer r0
[root@fahad ~]#drbdadm connect r0
[root@rony ~]#drbdadm connect r0
On Primary Node only
[root@fahad ~]#drbdadm -- --overwrite-data-of-peer primary r0
On both Nodes:
[root@fahad ~]#drbdadm up all
[root@rony ~]#drbdadm up all
On Primary Node only
[root@fahad ~]#drbdadm -- primary all #### ON Node one Only ####
[root@fahad ~]#watch cat /proc/drbd
only on fahad ########## Primary Node ########
[root@fahad ~]#mkfs.ext3 /dev/drbd0
[root@fahad ~]#mkdir /data/
[root@fahad ~]#mount /dev/drbd0 /data/
[root@fahad ~]#
[root@fahad ~]# df -hk
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
5967432 2625468 3033948 47% /
/dev/sda1 101086 12074 83793 13% /boot
tmpfs 257720 0 257720 0% /dev/shm
/dev/drbd0 4031516 107600 3719128 3% /data
[root@fahad ~]#
On rony ####### Secondry Node #######
[root@rony ~]#mkdir /data
Heartbeat Setup:
================
Install heartbeat package using yum
Note: Internet connection is required or configure yum repository on your local machine with extras.
[root@fahad ~]#yum install -y heartbeat heartbeat-pils heartbeat-stonith heartbeat-devel
[root@fahad ~]#vim /etc/ha.d/ha.cf ## Create this file and copy this text ##
logfacility local0
keepalive 2
#deadtime 30 # USE THIS!!!
deadtime 10
# we use two heartbeat links, eth2 and serial 0
bcast eth0 ####### We can use eth1 instead of eth0 it's better option ########
#serial /dev/ttyS0
baud 19200
auto_failback on ################## Active Active state #################
node fahad
node rony
save & quit.
Server Fahad
[root@fahad ~]#vi /etc/ha.d/haresources
fahad IPaddr::192.168.1.190/24/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 squid
Server rony:
[root@rony ~]#vi /etc/ha.d/haresources
rony IPaddr::192.168.1.190/24/eth0 drbddisk::r0 Filesystem::/dev/drbd0::/data::ext3 squid
On Both Servers:
[root@fahad ~]#vi /etc/ha.d/authkeys
auth 3
3 md5 redhat ######### Use Long name as password #########
both NODE:
[root@fahad ~]#chmod 600 /etc/ha.d/authkeys
[root@fahad ~]#scp /etc/ha.d/authkeys rony:/etc/ha.d/authkeys
[root@fahad ~]#chkconfig --level 235 heartbeat on
Note: if you have problem mounting /dev/drbd0 on /data then run these commands to check the status if you found the drbddisk stopped then start it.
[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 status
[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 start
[root@fahad ~]#/etc/ha.d/resource.d/drbddisk r0 restart
[root@fahad data]# service drbd status
drbd driver loaded OK; device status:
version: 8.0.13 (api:86/proto:86)
GIT-hash: ee3ad77563d2e87171a3da17cc002ddfd1677dbe build by buildsvn@c5-i386-build, 2008-10-02 13:31:44
m:res cs st ds p mounted fstype
0:r0 Connected Primary/Secondary UpToDate/UpToDate C /data ext3
we can see that servers are in Primary/Secondary state and working well with /data directory mounted.
To takeover the machine fahad to node2 forcefully.
[root@fahad ~]#/usr/lib/heartbeat/hb_takeover
Transparent Squid Configuration on both servers.
[root@fahad ~]#vim /etc/sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1 #### If it is 0 make it 1 for packet forwarding ####
save it
then
[root@fahad ~]#scp /etc/sysctl.conf rony:/etc/sysctl.conf
[root@fahad ~]#sysctl -p
[root@rony ~]# sysctl -p
[root@fahad ~]#yum install -y squid
[root@fahad ~]#vim /etc/squid/squid.conf
search these options using / and edit as required
http_port 3128 transparent
acl our_networks src 192.168.1.0/24 192.168.2.0/24
http_access allow our_networks
cache_dir ufs /data/squid 1000 32 256 ##### cache directories must be at /data/squid #####
visible_hostname squid.ha-cluster.com
save & exit
[root@fahad ~]# cd /data
[root@fahad ~]# mkdir squid
[root@fahad ~]# chown squid:squid squid
Note: This is required on only primary server i.e fahad
[root@fahad ~]#scp /etc/squid/squid.conf rony:/etc/squid/squid.conf
[root@fahad ~]#iptables -F
[root@fahad ~]#iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j REDIRECT --to-port 3128
[root@fahad ~]#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
[root@fahad ~]#service iptables save
[root@rony ~]#iptables -F
[root@rony ~]#iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j REDIRECT --to-port 3128
[root@rony ~]#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
[root@rony ~]#service iptables save
On both servers
[root@fahad ~]#/etc/init/heartbeat start
[root@fahad ~]#ifconfig
[root@fahad ~]#tail -f /var/log/squid/access.log
[root@rony ~]#/etc/init/heartbeat start
[root@rony ~]#ifconfig
Note: We must use VIP/Service IP which we define in heartbeat i.e. 192.168.1.190 as default gateway IP for accessing the internet transparently.
Snort is an open source Network Intrusion Detection System
Snort can also act as Sniffer and Logger
In this section we will discuss the more beneficial part of Snort that is Intrusion Detection System (IDS)
Snort can also be installed on Windows Platform which will be covered later.
Currently the Operating System is CentOS-5.3
Snort Installation and Configuration:
------------------------------------
First of all download and install the following required packages
# snort and snort-mysql rpm (download-able from http://www.snort.org/downloads)
# mysql and mysql-server-5.0 with all affected packages
# libpcap
# Apache
# php5
# php-cli
# php-common
# php-devel
# php-ldap
# Php5-mysql
You can check these rpms through rpm -qa command.
you can install missing packages either from source DVD or through yum command
After downloading snort rpms, just install them
[root@snortserver tmp]# rpm -ivh snort-2.8.5.3-1.RH5.i386.rpm
[root@snortserver tmp]# rpm -ivh snort-mysql-2.8.5.3-1.RH5.i386.rpm
now configure some basic settings for snort:
# vim /etc/snort/snort.conf
Change var HOME_NET any to var HOME_NET 192.168.2.0/24 # you can give a single ip address or range of IP addresses by syntax [192.168.2.1,192.168.2.10] and similarly different networks can also be defined as [192.168.1.0/24,192.168.2.0/24]
Change var EXTERNAL_NET any to var EXTERNAL_NET !$HOME_NET # (It states that everything except HOME_NET is external).
The rule path should be
var RULE_PATH /etc/snort/rules
save and exit
Now add rules to /etc/snort/rules directory
just download all the .rules file from the link http://cvs.snort.org/viewcvs.cgi/snort/rules/ one by one.
or just follow a simple way, i have created all the links for your convenience and time saving.
# cd /tmp
# mkdir rules
# cd rules
# vim download-rules.txt
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.23.2.7
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.50
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.22.2.5
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.14.2.7
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.39
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.42
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.43
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.80
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.29
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.63
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.25
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... =1.13.2.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.31
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.59
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.13
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.54
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.16
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.12
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.20
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.14
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.26
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.12
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.24
http://cvs.snort.org/viewcvs.cgi/*check ... v=1.19.2.6
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.48
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.19
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.32
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.40
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.21
http://cvs.snort.org/viewcvs.cgi/*check ... =1.63.2.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.27
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.30
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.35
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.84
http://cvs.snort.org/viewcvs.cgi/*check ... 1.102.2.15
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.23
http://cvs.snort.org/viewcvs.cgi/*check ... s?rev=1.20
save and exit
# wget -i download-rules.txt
it will download all the rules at once saving a lot of time.
[you can start snort by simple creating blank .rules files but remember with blank rule files snort will not detect anything]
after downloading the rules in a directory. Copy the directory on another location. Rename each file to rule-name.rules and then paste the files in /etc/snort/rules directory
change the ownership of newly created rules files
# chown snort.root /etc/snort/rules/*
Keep the original rules directory and match weekly the revision version of each rule on the site to incorporate changes accordingly.
some rules can also be download and copied in rules directory from http://openmaniak.com/snort_bleeding.php
then append these lines in inlude section of /etc/snort/snort.conf file for each new rule
include $RULE_PATH/bleeding.rules
include $RULE_PATH/bleeding-attack_response.rules
include $RULE_PATH/bleeding-dos.rules
include $RULE_PATH/bleeding-drop.rules
include $RULE_PATH/bleeding-dshield.rules
include $RULE_PATH/bleeding-exploit.rules
include $RULE_PATH/bleeding-game.rules
include $RULE_PATH/bleeding-inappropriate.rules
include $RULE_PATH/bleeding-malware.rules
include $RULE_PATH/bleeding-p2p.rules
include $RULE_PATH/bleeding-scan.rules
include $RULE_PATH/bleeding-virus.rules
include $RULE_PATH/bleeding-web.rules
Now its time to start snort
Start snort
# /etc/init.d/snortd start
Remember syslogd daemon must be running in order to take logs
The log file named 'alert' will be generated in /var/log/snort directory
now do a port scan and check the alerts in /var/log/snort/alert file, if you have defined a complete subnet in HOME_NET variable then you can do a port scan of any host but that host must be reachable by snort server
If you have some network issues then try stopping iptables and SElinux for test purpose
if you have nmap installed then simple run the command to scan ports
# nmap localhost
you can see alerts in real time by command
# tailf /var/log/snort/alert
At this time snort is running fine and generating alerts
Now lets move to an interesting section
Creating your own Snort Rules:
----------------------------
you can also use Snort Rule Generator or some other utilities but its better to write a rule in a file. lets do it
We are going to create a rule for generating alerts whenever someone is trying to open youtube.com
# vim /etc/snort/rules/youtube.rules
alert tcp any any -> any any (content:"www.youtube.com"; msg:"someone is accessing youtube"; sid:1000003; rev:1;)
save and exit
now add the rule path in snort.conf
#vim /etc/snort/snort.conf
append the line in include section as
include $RULE_PATH/youtube.rules
save and exit
and restart snort daemon to take affect changes
# /etc/init.d/snortd restart
lets describe the rule:
alert tcp any any -> any any (content:"www.youtube.com"; msg:"someone is accessing youtube"; sid:1000003; rev:1;)
tcp = protocol
1st any = Source IP (your local IP in this case)
2nd any = Source Port
-> = request for
3rd any = Destination IP (youtube IP in this case)
4th any = Destination Port (that would be 80 in this case)
sid = snort unique id which snort uses to differentiate different alerts and their descriptions
rev = version number
Now after creating the rule and restarting the snort daemon, lets check our new rule working status
just type
# elinks www.youtube.com
wait for youtube to be loaded
or Open a browser and type www.youtube.com
then view the alerts
# cat /var/log/snort/alert
you will see some alerts like
[**] [1:100003:1] someone is accessing youtube.com [**] [Priority: 0] {TCP} 192.168.2.5:48401 -> 64.233.169.139:80
[**] [1:100003:1] someone is accessing youtube.com [**] [Priority: 0] {TCP} 192.168.2.5:38510 -> 110.93.194.23:80
SnortSnarf:
----------
In order to get better results we will have to manage alerts in a more descriptive form
So lets install and configure SnortSnarf an html generator for snort alerts
make sure that you have installed Apache and its running
[root@snortserver ~]# /etc/init.d/httpd status
httpd (pid 2992 2991 2990 2989 2988 2987 2986 2985 2983) is running...
[root@snortserver ~]#
otherwise just start it
# /etc/init.d/httpd start
make sure that you have installed perl5 packages because SnortSnarf depends on perl based Time modules
lets start
download snortsnarf from http://sourceforge.net/projects/snortsnarf/
# cd /etc
# wget http://downloads.sourceforge.net/projec ... rror=space
# tar -zxvf SnortSnarf-1.0.tar.gz
Now you have to download and install Time modules needed for snortsnarf from http://search.cpan.org/~muir/Time-modules-2006.0814/
# wget http://search.cpan.org/CPAN/authors/id/ ... 814.tar.gz
# tar -zxvf Time-modules-2006.0814.tar.gz
# cd Time-modules-2006.0814
install the modules by following commands:
# perl Makefile.pl
# make
# make test
# make install
After successfull installation of Time modules, create a destination directory where snortsnarf will generate html pages as an output
# mkdir /var/www/html/ids
Now run snortsnarf
# cd /etc/SnortSnarf-1.0
# ./snortsnarf.pl -d /var/www/html/ids/ /var/log/snort/alert
where -d defines output directory and /var/log/snort/alert is the source file to take input.
The above command shows a similar output on the console
[root@snortserver SnortSnarf-1.0]# ./snortsnarf.pl -d /var/www/html/ids/ /var/log/snort/alert
Using an array as a reference is deprecated at include/SnortSnarf/HTMLMemStorage.pm line 290.
Using an array as a reference is deprecated at include/SnortSnarf/HTMLAnomMemStorage.pm line 266.
SnortFileInput: input file /var/log/snort/alert exists but is length 0; skipping it
[root@snortserver SnortSnarf-1.0]#
if your /var/log/snort/alert file is not empty then you will not see the last output line
Cron Job for SnortSnarf:
-----------------------
Create a cron job to automatically run the snorsnarf script to append alerts in html pages
first of all make a simple script
# cd /etc
# touch snortsnarf
# vim snortsnarf
cd /etc/SnortSnarf-1.0
./snortsnarf.pl -d /var/www/html/ids /var/log/snort/alert
save and exit
make the script executable
# chmod +x snortsnarf
now define a new cron job to run snortsnarf after every 5 minutes
# crontab -e
*/5 * * * * /etc/snortsnarf
save and exit
*/5 means that snortsnarf will be run after every 5 minutes, you can adjust the time accordingly.
restart the cron and Apache daemons
# /etc/init.d/crond restart
# /etc/init.d/httpd restart
now create a simple port scan and generate alerts in /var/log/snort/alert file and then open your browser and type http://localhost/ids
You can see the alerts, further click the alerts and find some more information and go on.
Now snort IDS with SnortSnarf has been successfully configured, Alhamdullilah
In next session we will discuss some advanced functionality, how alerts can be stored in a database and managed by Basic Analysis and Security Engine which is an enhanced version of ACID with Graph facilities, and also how SnortSnarf and other web based utilities can be secured.
