spiralbound.net

Debugging UDP Connections

Cliff — Wed, 19 Dec 2012 22:09:31 +0000

The most basic network troubleshooting trick in the book is a simple test to make sure that a daemon is listening on its respective port. This is easy with TCP connections because you can simply setup the daemon on the destination and telnet to the port. It’s harder for UDP connections because there is no ACK.

For Solaris, or even better yet illumos:

snoop -d ce0 'host server.example.com and udp and port 137'

ping -U -p 137 server.example.com

If you have linux it’s:

tcpdump -i en1 'host server.example.com and udp and port 137'

People who looked at this item also looked at…

Mounting ISO Images on Illumos

Cliff — Mon, 23 Jul 2012 17:10:09 +0000

I always have to look this up, so I’m wiring it down. To mount an ISO image on Solaris derived systems, do the following:

lofiadm -a /path/to/image.iso /dev/lofi/1
mount -F hsfs -o ro /dev/lofi/1 /path/to/mountpoint

People who looked at this item also looked at…

Illumos ZFS Storage Appliance

Cliff — Wed, 04 Jul 2012 05:38:04 +0000

A while back Casey started complaining that his Drobo storage robot was no longer being awesome. This got me thinking about how easy it would be to build a nice ZFS storage appliance that provide massive storage, constant data protection and self-healing against bit rot. I have wanted to build something like this for some time, but just never had the storage needs at home to justify it. Well, data needs grow and my discussion with Casey while stumbling around Fry’s was all it took to get me moving.

What is ZFS? Well, put simply, ZFS is Jeff Bonwick and The Bonwick Youth’s answer to every filesystem annoyance the world has ever known. It is the pinnacle of human achievement in filesystem development, and quite honestly, the only commonly available storage option that will truly protect your data. Now, before you start leaving angry comments explaining how [insert RAID solution here] does a perfectly good job of protecting data, I’m not talking about RAID. I’m talking about leveraging copy on write transactions and checksums at the block level to ensure data integrity, and an implemented strategy for self-healing against bit rot, current spikes, bugs in disk firmware, ghost writes, etc. I’m also talking about a dead simple and logical volume management layer and wealth of features too numerous to list here.

Anyhow, I cobbled together the items listed below, installed Openindiana Illumos on it and configured Netatalk. It works wonderfully, and I can’t say enough about how pleased I am with Illumos, and how happy I am to have an industrial strength, feature-rich UNIX in the open source community.

The links below will take you to listings for the components I used:
Motherboard
Memory X2
Case
PSU
Drives X5

Price: $807.92
Usable Storage: 7.6TB (raidz)

People who looked at this item also looked at…

Using MacPorts Subversion With BBEdit

Cliff — Thu, 15 Mar 2012 16:12:31 +0000

PROTIP: If you want to use the Subversion features in BBedit, and you also like using v1.7+ of svn, you have to change the default location. Obviously this assumes that you have MacPorts installed and have used it to build and install the Subversion port.

PLAIN TEXT

CODE:

defaults write com.barebones.bbedit Subversion:SubversionToolPathOverride /opt/local/bin/svn

People who looked at this item also looked at...

How to Replace a Failed Drive in a ZFS Pool

Cliff — Mon, 09 Jan 2012 18:49:42 +0000

So you have a failed disk in a ZFS pool and you want to fix it? Routine disk failures are really a non-event with ZFS because the volume management makes replacing them so dang easy. In many cases, unlike hardware RAID or older volume management solutions, the replacement disk doesn't even need to be exactly the same as the original. So let's get started replacing our failed disk. These instructions will be for a Solaris 10 system, so a few of the particulars related to unconfiguring the disk and device paths will vary with different flavors of UNIX.

First, take a look at the zpools to see if there are any errors. The -x flag will only display status for pools that are exhibiting errors or are otherwise unavailable.
Note: If the disk is actively failing (a process that sometimes takes a while as the OS offlines it), any commands that use storage related system calls will hang and take a long time to return. These include "zpool" and "format", so just be patient; they will eventually return.

# zpool status -x

 pool: data
 state: DEGRADED
status: One or more devices are faulted in response to persistent errors.
        Sufficient replicas exist for the pool to continue functioning in a
        degraded state.
action: Replace the faulted device, or use 'zpool clear' to mark the device
        repaired.
 scrub: none requested
config:

        NAME        STATE     READ WRITE CKSUM
        data        DEGRADED     0     0     0
          mirror-0  DEGRADED     0     0     0
            c1t4d0  ONLINE       0     0     0
            c1t5d0  FAULTED      1    81     0  too many errors
          mirror-1  ONLINE       0     0     0
            c1t2d0  ONLINE       0     0     0
            c1t3d0  ONLINE       0     0     0

errors: No known data errors

So we can easily see that c1t5d0 has failed. Take a look at the "format" output do get the particulars about the disk:
# format

Searching for disks...done


AVAILABLE DISK SELECTIONS:
       0. c1t0d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@0,0
       1. c1t1d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@1,0
       2. c1t2d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@2,0
       3. c1t3d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@3,0
       4. c1t4d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@4,0
       5. c1t5d0 
          /pci@0/pci@0/pci@2/scsi@0/sd@5,0
Specify disk (enter its number):

Get your hands on a replacement disk that is as similar as possible to a SEAGATE-ST914602SSUN146G-0603-136.73GB. I was only able to dig up a HITACHI-H103014SCSUN146G-A2A8-136.73GB, so I'll be using that instead of a direct replacement.

Next, use "cfgadm" to look at the disks you have and their configuration status:

# cfgadm -al

Ap_Id                          Type         Receptacle   Occupant     Condition
c1                             scsi-sata    connected    configured   unknown
c1::dsk/c1t0d0                 disk         connected    configured   unknown
c1::dsk/c1t1d0                 disk         connected    configured   unknown
c1::dsk/c1t2d0                 disk         connected    configured   unknown
c1::dsk/c1t3d0                 disk         connected    configured   unknown
c1::dsk/c1t4d0                 disk         connected    configured   unknown
c1::dsk/c1t5d0                 disk         connected    configured   unknown

We want to replace t5, so we prepare it for removal by unconfiguring it:

# cfgadm -c unconfigure c1::dsk/c1t5d0

The "safe to remove" led should turn on and you can pull the disk, remembering to allow it several seconds to spin down. Replace it with the new disk and take a look at "cfgadm -al" output again to ensure that it has been automatically configured. If it has not, you can manually configure it like below:

# cfgadm -c configure c1::dsk/c1t5d0

Now, it's a simple matter of a quick "zpool replace" to get things rebuilding:

# zpool replace data c1t5d0

You can use the output of zpool status to watch the resilver process...

People who looked at this item also looked at...

How to Enable SSL for CSWapache2

Cliff — Fri, 20 Aug 2010 17:56:43 +0000

If you've spent any time at all around Solaris 10, you know that Sun has invested a fair amount of effort developing a pretty snazzy Service Management Facility (SMF). It is extremely flexible and feature rich, but it's not quite as strait forward as the old legacy /etc/init.d scripts. If you're running the OpenCSW Apache package, it installs a Service Manifest into the SMF, so you'll have to edit this to run Apache SSL... Here's how:


# svccfg

svc:> select cswapache2
svc:/network/http:cswapache2> listprop httpd/ssl

httpd/ssl  boolean  false

svc:/network/http:cswapache2> setprop httpd/ssl=true
svc:/network/http:cswapache2> exit

Now, make the changes active:


# svcadm disable cswapache2
# svcadm enable cswapache2
# svcprop -p httpd/ssl svc:/network/http:cswapache2

false

# svcadm refresh cswapache2
# svcprop -p httpd/ssl svc:/network/http:cswapache2

true

People who looked at this item also looked at...

Wes Anderson Parodies

Cliff — Thu, 05 Aug 2010 21:24:27 +0000

Courtney points out that urlesque has a post entitled "7 Great Wes Anderson Parodies". I found Wes' work through Rushmore and he immediately became my favorite film director of all time! Having joined the creative ranks of Alfred Hitchcock, Orson Welles and Mike Nichols, imagining what movies like Spiderman or The Lord of the Rings may have been like under his unique style of direction is really quite fun!

Anyhow, visit the Urlesque post for a complete list... My favorite is the Spiderman parody.

People who looked at this item also looked at...

ZoneType.sh Version 2.0

Cliff — Tue, 26 Jan 2010 17:29:29 +0000

We just started supporting Solaris 10 in our VMware cluster so I had to update my zone type script to detect if the OS is running there. I'm not sure how I feel about depending on the output of ptrdiag since the interface is labeled "unstable", but it works for now, and I really don't see Sun changing the first line of output where the system configuration is listed. Anyhow, when issued with the -v or --vmware flag, the script returns 0 if it's running on the cluster and 1 if it is not.

Usage:

# zonetype.sh -g or --global
Return 0: The machine is a global zone with 1 or more local zones
Return 1: The machine is not a global zone

# zonetype.sh -l or --local
Return 0: The machine is a local zone
Return 1: The machine is not a not a local zone

# zonetype.sh -v or --vmware
Return 0: The machine is running on a VMware hypervisor
Return 1: The machine is not running in VMware

#! /bin/bash
#
# When issued with the -g or --global flag, this script will return:
# 0 if the machine is a global zone and has one or more local zones. 
# Otherwise, it will return 1
#
# When issued with the -l or --local flag, this script will return:
# 0 if if is a local zone and 1 if it is not
#
# When issued with the -v or --vmware flag, this script will return:
# 0 if it is a vmware host and 1 if not.
#

list=( `/usr/sbin/zoneadm list -civ | awk '{ print $1 }'`)

  case "$1" in
    -g|--global)
        # If the third element in our array is null, set it to 0
        if [ "${list[2]}" == ""  ]; then
        list[2]=0
        fi
        # This is a global zone only if it has one or more local zones.
        if [ ${list[1]} -eq 0 ] && [ ${list[2]} -ge 1 ]; then
        # 1 is returned if we have a global and local zone, 
        # otherwise, we return 0
                exit 0
            else
                exit 1
        fi
              ;;
    -l|--local)
        # If the second element in our array is = or > 1, it is a local zone.
        if [ ${list[1]} -ge 1 ]; then
        # Return 1 if this is a local zone, otherwise return 0.
                exit 0
            else
                exit 1
        fi

              ;;
   -v|--vmware)
        # Don't run our check on local zones... Prtdiag can't run there
        if [ ${list[1]} != 0 ]; then
                exit 1
           else 
                vmhost=( `/usr/sbin/prtdiag | grep System | awk '{ print $5 }'`)
                if [ $vmhost == VMware ]; then
                        #If the host is running on the vmware cluster return 0, 
                        # otherwise, return 1
                        exit 0
                else
                        exit 1
                fi
        fi
              ;;
        *)
        echo "Usage: /local/adm/zonetype.sh {-l | --local | -g | --global | -v | --vmware}"
        exit 1
  esac

People who looked at this item also looked at...

WP Error: The data could not be converted to UTF-8

Cliff — Wed, 23 Dec 2009 01:27:23 +0000

If you've just upgraded to WordPress 2.9 and you are now getting UTF 8 conversion errors on your dashboard, you'll need to take a look at WordPress Trac Ticket #11219.
RSS Error: The data could not be converted to UTF-8
The bottom line is that you'll need to enable either iconv or mbstring in your PHP configuration. I'm using CoolStack on Solaris 10, so it was a simple matter of uncommenting the following lines from /opt/coolstack/php5/lib/php.ini and restarting apache. While you're at it, may as well uncomment ctype as well since the new image uploader needs it.

Uncommnet the following lines in /opt/coolstack/php5/lib/php.ini.
extension=iconv.so extension=mbstring.so extension=ctype.so

Finally, restart apache:
svcadm restart apache22-csk

People who looked at this item also looked at...

UNIX – Find Files that Changed Within Time Window

Cliff — Mon, 02 Nov 2009 18:57:56 +0000

Every so often us lowly UNIX admins find ourselves needing to search a file system for files that have been created or changed within a certain time window. In other words, those files that are newer than time "X", but not newer than time "Y". There are a number of ways to accomplish this, but my preferred method is to create two reference files to indicate the beginning and end of my window and use the "-newer" and "! -newer" flags to search for files that changed within that window.
# touch -amt 200910260000 /tmp/starttime # touch -amt 200910262359 /tmp/endtime # find / -type f -newer /tmp/starttime -a ! -newer /tmp/endtime
The guys at virtuelvis.com point out that it is more elegant to accomplish this without creating two files, but their solution does not work with operating systems that use strict POSIX compliant "find" implementations, making it of little use in some cases. For the curious, here is their example:
# find . -type f -newermt 2009-10-26 ! -newermt 2009-10-27

People who looked at this item also looked at...

Arduino Resources for the n00b

Cliff — Wed, 14 Oct 2009 21:08:16 +0000

Lately I've been entertaining myself by building a rebreather loop controller using the Arduino micro controller. This little open source board is really nice to work with for a number of reasons. Unlike many of the alternatives which employ proprietary programming languages, the Arduino simply uses "C". It also has an IDE that runs the my Mac, and it enjoys an enormous development community.

I'm pretty new to this kind of thing, so I've been using web tutorials to work my way up from the most basic blinking LED to something that actually monitors oxygen sensors and populates an LCD with information. Some of the more valuable resources I have used are as follows:

People who looked at this item also looked at...

The Banana Slug is not a Mythical Creature

Cliff — Fri, 01 May 2009 06:27:55 +0000

OK, so I never actually believed that they were a mythical creature, but it took me so long to actually find one after moving to Santa Cruz that I had great fun telling those who didn't know better that they were figment of the collective local imagination. Courtney, who had seen them before, always sighed, rolled her eyes, and reassured whatever unwitting soul I happened to be talking with at the moment that they did exist, and that I should absolutely not be taken seriously. On this point, I cannot disagree with her, but I must have been somewhat convincing because her mom actually sounded surprised when a friend finally pointed one out to me and I managed to snap a picture of it. She actually made me send her the picture because she didn't believe me.

A few banana slug facts:

They are native to the Northwest
The are HUGE! Some have reached 10 inches in length, and weights of a quarter of a pound.
They were almost the official mollusk of California. Yes, the legislature actually voted in the noble slug, but the Governor vetoed it.
They are the official mascot of UC Santa Cruz.

Banana Slug

People who looked at this item also looked at...

Useful MySQL Commands

Cliff — Fri, 01 May 2009 02:45:21 +0000

There are a lot of usefully MySQL commands that I either don't run enough to remember or just end up using some GUI to accomplish. Nothing against Navicat, but what kind of sysadmin would I be if I couldn't do it at the command line as well. Anyhow, I had to do a bunch of this kind of work lately, so I thought I would write the more common commands down here so I would have them to reference.

It is generally a good idea to firewall off your MySQL port (3306) unless you are on a secure network. The downside to this is that it prevents you from using GUI tools like Navicat to connect to your database server. No problem, just use this command to SSH tunnel a connection. After doing this, you can connect to your database on localhost port 8888:
ssh -fNg -L 8888:127.0.0.1:3306 login@mysql-server

Once you have installed a new instance of MySQL, you have to change the root password:
# mysql -u root mysql> SET PASSWORD FOR 'root'@'localhost' = PASSWORD('newpwd'); mysql> SET PASSWORD FOR 'root'@'yourhostname' = PASSWORD('newpwd'); mysql> exit

Depending on the way you handle your MySQL installation, you will most likely have to run the mysql_upgrade script after upgrades to use all the new features:
mysql_upgrade -u root â€“password=yourpassword

Do a thorough check to see if your tables are corrupted:
mysqlcheck -u root -p --check --extended --all-databases

Repair any corruption if it exists:
mysqlcheck -u root -p --repair --all-databases

Look at all your tables and optomize them if necessary:
mysqlcheck -u root -p --optimize --all-databases

People who looked at this item also looked at...

Best of the Santa Cruz City Council

Cliff — Wed, 04 Mar 2009 15:00:39 +0000

She may not the the world's angriest woman, but the lady in this video may very well be the biggest airhead! The rest of the characters in the last one are pretty good too. It turns out that you don't have to live in Santa Cruz very long before you start running into these folks. What can I say... It's a crazy place.

Santa Cruz lady at city council meeting:

Santa Cruz Lady Vs. Sarah Palin:

The whole Santa Cruz City Council Mashup:

People who looked at this item also looked at...

Script to Determine Solaris 10 Zone Type

Cliff — Tue, 03 Mar 2009 22:46:27 +0000

We use a lot of local zones in our Solaris 10 environment. We also use cfengine pretty heavily and there are some instances when we need to include or exclude certain automated tasks based on what type of zone we are working with. I wrote this little script that checks to see what type of zone we are dealing with. Based on the return value, I can set a cfengine class and control what gets run and where.

Return 0 if the machine is a global zone with 1 or more local zones
Return 1 if the machine is either a local zone or a global zone with 0 local zones

#! /bin/bash
#
# When issued with the -g or --global flag, this script will return:
# 0 if the machine is a global zone and has one or more local zones.
# Otherwise, it will return 1
#
# Wen issued with the -l or --local flag, this script will return:
# 0 if if is a local zone and 1 if it is not
#

list=( `/usr/sbin/zoneadm list -civ | awk '{ print $1 }'`)
  case "$1" in
    -g|--global)
        # If the third element in our array is null, set it to 0
        if [ "${list[2]}" == ""  ]; then
        list[2]=0
        fi
        # This is a global zone only if it has one or more local zones.
        if [ ${list[1]} -eq 0 ] && [ ${list[2]} -ge 1 ]; then
        # 1 is returned if we have a global and local zone, otherwise, we return 0
                exit 0
            else
                exit 1
        fi
              ;;
    -l|--local)
        # If the second element in our array is = or > 1, it is a local zone.
        if [ ${list[1]} -ge 1 ]; then
        # Return 1 if this is a local zone, otherwise return 0.
                exit 0
            else
                exit 1
        fi
              ;;
        *)
        echo "Usage: /local/adm/zonetype.sh {-l | --local | -g | --global}"
        exit 1
  esac

People who looked at this item also looked at...

Check Speed / Duplex on Solaris 10

Cliff — Mon, 02 Mar 2009 23:52:54 +0000

In the past, I always had to use the ndd - get command to figure out what my link speed and duplex settings were. In Solaris 10, Sun now gives us the handy dladm command, which makes it a whole lot easier.

# dladm show-dev e1000g2 link: up speed: 1000 Mbps duplex: full e1000g3 link: up speed: 1000 Mbps duplex: full e1000g0 link: up speed: 1000 Mbps duplex: full e1000g1 link: up speed: 1000 Mbps duplex: full

People who looked at this item also looked at...

Replace Failed SVM Mirror Drive

Cliff — Mon, 16 Feb 2009 05:45:42 +0000

So you have used SVM to mirror your disk, and one of the two drives fails. Aren't you glad you mirrored them! You don't have to do a restore from tape, but you are going have to replace the failed drive.

Many modern RAID arrays just require you to take out the bad drive and plug in the new one, while everything else is taken care of automatically. It's not quite that easy on a Sun server, but it's really just a few simple steps. I just had to do this, so I thought I would write down the procedure here.

Basically, the process boils down to the following steps:

Detach the failed meta devices from the failed drive
Delete the meta devices from the failed drive
Delete the meta databases from the failed drive
Unconfigure the failed drive
Remove and replace the failed drive
Configure the new drive
Copy the remaining drive's partition table to the new drive
Re-create the meta databases on the new drive
Install the bootblocks on the new drive
Recreate the meta devices
Attach the meta devices

Let's look at each step individually. In my case, c0t1d0 has failed, so, I detach all meta devices on that disk and then delete them:

# metadetach -f d0 d2 # metadetach -f d10 d12 # metadetach -f d40 d42 # metaclear d2 # metaclear d12 # metaclear d42

Next I take a look at the status of my meta databases. Below we can see the the replicas on that disk have write errors:

# metadb -i
        flags           first blk       block count
     a m  p  luo        16               8192            /dev/dsk/c0t0d0s3
     a    p  luo        8208             8192            /dev/dsk/c0t0d0s3
     W    p  luo        16                8192            /dev/dsk/c0t1d0s3
     W    p  luo        8208            8192            /dev/dsk/c0t1d0s3
 r - replica does not have device relocation information
 o - replica active prior to last mddb configuration change
 u - replica is up to date
 l - locator for this replica was read successfully
 c - replica's location was in /etc/lvm/mddb.cf
 p - replica's location was patched in kernel
 m - replica is master, this is replica selected as input
 W - replica has device write errors
 a - replica is active, commits are occurring to this replica
 M - replica had problem with master blocks
 D - replica had problem with data blocks
 F - replica had format problems
 S - replica is too small to hold current data base
 R - replica had device read errors

The replicas on c0t1d0s3 are dead to us, so let's wipe them out!

# metadb -d c0t1d0s3 # metadb -i

        flags           first blk       block count
     a m  p  luo        16               8192            /dev/dsk/c0t0d0s3
     a    p  luo        8208             8192            /dev/dsk/c0t0d0s3

The only replicas we have left are on c0t0d0s3, so I'm all clear to unconfigure the device. I run cfgadm to get the c0 path:

# cfgadm -al

Ap_Id                          Type         Receptacle   Occupant     Condition
c0                             scsi-bus     connected    configured   unknown
c0::dsk/c0t0d0                 disk         connected    configured   unknown
c0::dsk/c0t1d0                 disk         connected    configured   unknown
c0::dsk/c0t2d0                 disk         connected    configured   unknown
c0::dsk/c0t3d0                 disk         connected    configured   unknown
c1                             scsi-bus     connected    configured   unknown
c1::dsk/c1t0d0                 CD-ROM       connected    configured   unknown
usb0/1                         unknown      empty        unconfigured ok
usb0/2                         unknown      empty        unconfigured ok
usb1/1.1                       unknown      empty        unconfigured ok
usb1/1.2                       unknown      empty        unconfigured ok
usb1/1.3                       unknown      empty        unconfigured ok
usb1/1.4                       unknown      empty        unconfigured ok
usb1/2                         unknown      empty        unconfigured ok

I run the following command to unconfigure the failed drive:

# cfgadm -c unconfigure c0::dsk/c0t1d0

The drive light turns blue
Pull the failed drive out
Insert the new drive

Configure the new drive:

# cfgadm -c configure c0::dsk/c0t1d0

Now that the drive is configured and visible from within the format command, we can copy the partition table from the remaining mirror member:

# prtvtoc /dev/rdsk/c0t0d0s2 | fmthard -s - /dev/rdsk/c0t1d0s2

Next, I install the bootblocks onto the new drive:

# installboot /usr/platform/`uname -i`/lib/fs/ufs/bootblk /dev/rdsk/c0t1d0s2

Create the state replicas:

metadb -a -c 2 c0t1d0s3

Recreate the meta devices:
metainit -f d2 1 1 c0t1d0s0 metainit -f d12 1 1 c0t1d0s1 metainit -f d42 1 1 c0t1d0s4

And finally, reattach the metadevices which will sync them up with the mirror.

metattach d0 d2 metattach d10 d12 metattach d40 d42

People who looked at this item also looked at...

Happy 1234567890′th Second UNIX!

Cliff — Tue, 27 Jan 2009 19:31:24 +0000

Today, Friday February 13, at 3:31 PM (PST), the UNIX time will read exactly 1234567890. So exacly what is all this excitement about UNIX being able to count to 10? Surely, the operating system that is slowly but steadily putting Microsoft out of business must be able to do that. Well, it's actually the UNIX time stamp, and what has all of us nerds talking is really just the fact that the numbers have never lined up in sequence like this before.

So what the heck is this UNIX time anyhow? Well, simply put, it's actually the exact number of seconds since the the Unix epoch. This was 00:00:00 UTC on January 1, 1970.

From Wikipedia:

It is not a linear representation of time nor a true representation of UTC (though it is frequently mistaken for both) as the times it represents are UTC but it has no way of representing UTC leap seconds (e.g. 1998-12-31 23:59:60).

People who looked at this item also looked at...

Basic iptables Configuration

Cliff — Thu, 01 Jan 2009 00:05:54 +0000

It's always a good idea to setup a local firewall on hosts that are on unprotected networks. The internet "winds" blow harder and harder each day, and it's only a matter of time before some daemon has an exploit that gets taken advantage of. I use CentOS 5 for all my web servers, and here is an example of the script I use to create a DEFAULT TO DENY set of firewall rules. This script generates a file called iptables in /etc/sysconfig.

I used to create a special rule for MySQL that only allowed connections from my own network, but lately I have been omitting this rule and tunneling the connection through ssh instead. That is why it is commented out in the script below.

### SCRIPT ### #!/bin/sh # Drop all incoming traffic /sbin/iptables -P INPUT DROP # Drop all forwarded traffic /sbin/iptables -P FORWARD DROP # Allow all outgoing traffic /sbin/iptables -P OUTPUT ACCEPT # Allow returning packets /sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # Allow incoming traffic on port 80 for web server /sbin/iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT # Allow MySQL only from a certain network /sbin/iptables -A INPUT -p tcp -m tcp -s XXX.XXX.XXX.0/24 --dport 3306 -j ACCEPT # Allow local traffic /sbin/iptables -A INPUT -i lo -j ACCEPT # Allow incoming SSH on port 22 #/sbin/iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # Allow ping /sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT /sbin/iptables-save > /etc/sysconfig/iptables chmod go-r /etc/sysconfig/iptables /sbin/sudo service iptables restart ### /SCRIPT ###

Here is what /etc/sysconfig/iptables looks like after running this script:

# Generated by iptables-save v1.3.5 on Wed Dec 31 13:47:40 2008 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [12:8972] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT COMMIT # Completed on Wed Dec 31 13:47:40 2008

After you are done, make sure you have iptables setup to start when the system boots.

# /sbin/chkconfig --list | grep iptables


iptables       	0:off	1:off	2:on	3:on	4:on	5:on	6:off

If it's not on, just run:
/sbin/chkconfig iptables on

People who looked at this item also looked at...

Install Solaris Package in Alternate Base Directory

Cliff — Sun, 28 Dec 2008 23:25:59 +0000

Unless you specify a different administrative file, the pkgadd command reads "/var/sadm/install/admin/default", which specifies the base directory as "/opt". Do not change the settings in this file, but rather create a custom admin file and enter an alternate "basedir" directive if you want to install your package into a different directory. We are going to install our package into "/var/applications", and call our custom admin file "custom".

First, create and edit "/var/sadm/install/admin/custom", adding a line similar to this:
basedir=/var/applications/$PKGINST

Next, issue the pkgadd command with the "-a" flag to call you alternative admin file:

pkgadd -d device -a custom PackageName

This really comes in handy when your customers want to retain control over their packages, but you don't want to give them access to write packages into the system area. More detailed instructions can be found here.

People who looked at this item also looked at...

World’s Coolest Datacenter

Cliff — Sun, 07 Dec 2008 23:10:11 +0000

Ever since coming to work at UC Santa Cruz, I have been feeling pretty lucky to work in a well engineered and managed datacenter. So lucky, in fact, that I've been cultivating hatred towards me in my former coworkers by regaling them with stories about how wonderfully designed everything is here. The problem with thinking you have it made though, is that someone will always point out some greener grass in another field.

This is exactly what happened when I saw this article about the Pionen datacenter, owned by Bahnhof in Sweden. Located nearly 100 feet beneath the city of Stockholm, this epic datacenter has been compared (fairly I might add) to the secret layer of a James Bond villian. It's got backup power provided by twin submarine engines, triple-redundant internet backbone connections, and can reportedly stand up to a Hydrogen bomb. We spend so much time and effort trying to make our servers comfortable when designing datacenters, we often forget about the Human element. Even though these guys are literally working in a cave, it's nice to see that Bahnhof is trying to make its people comfortable as well.

People who looked at this item also looked at...

Move to Santa Cruz

Cliff — Sat, 23 Aug 2008 20:14:54 +0000

Well, after five years living in Vermont, and something like thirteen years living in New England, Courtney and I have gone and moved to Santa Cruz, CA. There are a lot of reasons for this; the very hard winters and extremely rainy summers in Vermont were starting to wear on us, but mostly we just wanted to live in a young and vital place that has a larger population. Courtney had some experience with the area during her brief stint working at Land of Medicine Buddha, and I had always enjoyed The Monterey Bay area when my family and I would camp here as a kid, so Santa Cruz seemed the perfect place for us.

I applied for a UNIX Systems Engineer position at the University of California Santa Cruz, and was offered the job back in July. After some serious soul searching, I decided to accept, and we started the process of relocating a full 3,000 miles from home, which I can assure you is no simple task! I've been here just under two weeks, but Courtney is still tidying up our affairs in Vermont before she starts the long journey out here in our car. Yep... That's car, not cars. The public transportation system is so good out here that we can finally be a single car family. For my part, I've managed to move clear across this country twice and not driven it a single time. This is fine with me, however, since I have very little interest in seeing middle America.

Casey and I managed to find Paula's Breakfast Shack while he was out for WordCamp 08. Home of the $1.99 Basic Breakfast, this place is so good, that I simply can't imagine going anywhere else for eggs and home fries! I've tried a number of taquerias, but the jury is still out on which one is best. Once I find it I'll have to freeze some tacos and burritos and send them out to Matt, who has strongly indicated that he hates me for having such easy access to good Mexican Food.

People who looked at this item also looked at...

Bare Metal Linux Restore

Cliff — Tue, 05 Aug 2008 16:14:34 +0000

Several weeks ago we started seeing some pretty scary errors showing up on the main system disk for our Blackboard server. We had an extra server hanging around, so we decided to move all the data off the failing disk and onto our spare server. The only question was how to make the new server as close to a perfect copy of the old one as possible. Simply restoring all the filesystems failed for a variety of reasons, mostly related to GRUB and the kernel, so I had to find a way of excluding only the files and directories that were tied to the specific model of server.

To do this, I started by installing a minimal copy of RHEL 4, making sure to lay the filesystems out in exactly the same way as they were on the old server. I then went through several experiments, leaving just the bare minimum files and directories required for the hardware and booting, but formatting all other filesystems and restoring the data from our old server. In the end, the below process resulted in system that worked perfectly, and very closely mirrored the original server.

I conducted a minimal OS install on the new server, replicating the filesystem layout on the old server.
I booted the new server from DVD in rescue mode, allowing it to mount the filesystems in /mnt/sysimage
I removed EVERYTHING in every filesystem and directory EXCEPT the following:

Everything in /sys
Everything in /dev
Everything in /proc
Everything in /boot
/lib/modules
/etc/grub.conf
/etc/sysconficg/grub
/etc/modules.conf
/etc/fstab

Next, I went to my backups and restored the entire system to /mnt/sysimage, making sure not to overwrite existing files. We use NetBackup, which defaults to not overwrite, but other systems are not so careful. If you accidentally overwrite the files we excluded from deletion above, your restored system will not boot.

Once the restore was complete, I rebooted the system and it came up pretty much as a carbon copy of the old server. Once it was up and on the network, I ran "up2date -uf" to install the latest version of the kernel and I was done.

People who looked at this item also looked at...

Installing APC on CentOS

Cliff — Mon, 14 Jul 2008 19:06:12 +0000

Casey needed me to install APC cache for the Scriblio project. It's a PECL module, and pecl install apc gives an error. Here are some great instructions for getting it all to work.

UPDATE: Casey actually has some instructions that provide a more elegant method of installing APC on CentOS or RHEL. Both methods will work, but Casey's instructions will get you around the package management problems.

People who looked at this item also looked at...

RMAN 10G NFS Mount Options

Cliff — Wed, 11 Jun 2008 15:51:18 +0000

We backup our Oracle databases using RMAN and then write the backup pieces out to an NFS share. This has always worked well, but RMAN started complaining that the NFS share was not mounted with the correct options when we upgraded to Oracle 10G. After some poking around in the docs I finally came up with a set of mount options that work.

Vfstab entry on a Solaria 8 box:
nfsserver.domain.com:/path/to/remote/mountpoint /local-mountpoint nfs 0 yes rw,bg,intr,hard,timeo=600,wsize=32768,rsize=32768
Manual mount on a Solaris 8 box:
mount -o rw,bg,intr,hard,timeo=600,wsize=32768,rsize=32768 nfsserver.domain.com:/path/to/remote/mountpoint /local-mountpoint

According to the docs, the options on a Linux box are pretty much the same, except you would add the following:
nfsver=3,tcp

spiralbound.net

Debugging UDP Connections

People who looked at this item also looked at…

Related items

Mounting ISO Images on Illumos

People who looked at this item also looked at…

Related items

Illumos ZFS Storage Appliance

People who looked at this item also looked at…

Related items

Using MacPorts Subversion With BBEdit

People who looked at this item also looked at...

Related items

How to Replace a Failed Drive in a ZFS Pool

People who looked at this item also looked at...

Related items

How to Enable SSL for CSWapache2

People who looked at this item also looked at...

Related items

Wes Anderson Parodies

People who looked at this item also looked at...

Related items

ZoneType.sh Version 2.0

People who looked at this item also looked at...

Related items

WP Error: The data could not be converted to UTF-8

People who looked at this item also looked at...

Related items

UNIX – Find Files that Changed Within Time Window

People who looked at this item also looked at...

Related items

Arduino Resources for the n00b

People who looked at this item also looked at...

Related items

The Banana Slug is not a Mythical Creature

People who looked at this item also looked at...

Related items

Useful MySQL Commands

People who looked at this item also looked at...

Related items

Best of the Santa Cruz City Council

People who looked at this item also looked at...

Related items

Script to Determine Solaris 10 Zone Type

People who looked at this item also looked at...

Related items

Check Speed / Duplex on Solaris 10

People who looked at this item also looked at...

Related items

Replace Failed SVM Mirror Drive

People who looked at this item also looked at...

Related items

Happy 1234567890′th Second UNIX!

People who looked at this item also looked at...

Related items

Basic iptables Configuration

People who looked at this item also looked at...

Related items

Install Solaris Package in Alternate Base Directory

People who looked at this item also looked at...

Related items

World’s Coolest Datacenter

People who looked at this item also looked at...

Related items

Move to Santa Cruz

People who looked at this item also looked at...

Related items

Bare Metal Linux Restore

People who looked at this item also looked at...

Related items

Installing APC on CentOS

People who looked at this item also looked at...

Related items

RMAN 10G NFS Mount Options

People who looked at this item also looked at...

Related items