Red Hat commands and tips (Part2) - RPM and YUM

Red Hat commands and tips (Part2) - RPM and YUM

RPM stands for "Red Hat Package Management" and it is used to manage the install, removal and updae of packages on most Red Hat based systems.

I am going to show you some rpm commands which I use frequently and I think those are the ones you will need the most.

How to display all packages installed
[root@centos63 log]# rpm -qa
Note: This will display all packages installed, depending on your system, the list could contain thousands of packages or just few hundred. The list will be long.

How to find if specific package is installed
[root@centos63 log]# rpm -qa | grep openssh-server
openssh-server-5.3p1-81.el6.x86_64
Note: If no result gets displayed, that could mean a)you got the package name wrongly b) package is not installed

How to dump the list of packages installed to a file
[root@centos63 log]# rpm -qa > /tmp/all_packages

How to install a RPM package
[root@centos63 ~]# rpm -i samba4-4.0.0-55.el6.rc4.x86_64.rpm

How to install/update an RPM package
[root@centos63 ~]# rpm -Uvh samba4-4.0.0-55.el6.rc4.x86_64.rpm

How to find which package a file belongs to
[root@centos63 ~]# rpm -qf /etc/inittab
initscripts-9.03.31-2.el6.centos.1.x86_64

How to test an RPM package without installing it
[root@centos63 ~]# rpm -i --test samba4-4.0.0-55.el6.rc4.x86_64.rpm

How to debug and estract INFO from an RPM package
[root@centos63 ~]# rpm -ivv samba4-4.0.0-55.el6.rc4.x86_64.rpm

How to install a package if it is already installed
[root@centos63 ~]# rpm -iv --replacepkgs samba4-4.0.0-55.el6.rc4.x86_64.rpm

YUM stands for "Yellowdog Updater Modified" and it is an interactive, rpm based, package manager. It can automatically perform system updates, including dependency analysis and obsolete processing based on "repository" metadata.
I'll show you how to manage your server with the yum command and keep it up-to-date and easily search and install packages.

How to search for a package
[root@centos63 ~]# yum search samba4
==================================================================== N/S Matched: samba4 ====================================================================
samba4.x86_64 : The Samba4 CIFS and AD client and server suite
samba4-client.x86_64 : Samba client programs
samba4-common.x86_64 : Files used by both Samba servers and clients
How to install a package
[root@centos63 ~]# yum install samba4.x86_64
Note: the good thing about yum is it will try abd work out the dependencies for you.

How to update the system
[root@centos63 ~]# yum update

Note: if you get an error message similar to the one below:
Error: samba4 conflicts with samba
Error: samba4-common conflicts with samba-common

Run the command below:
[root@centos63 ~]# yum update --skip-broken
Install       8 Package(s)
Upgrade     126 Package(s)
Total download size: 155 M
Is this ok [y/N]:
Note: This should take care of most problems and and broken past installations.


How to download an RPM package with yum.
First you will need to download a program called "yumdownloader" part of a package called "yum-utils.noarch"

1. Search for the package
[root@centos63 ~]#yum search yumdownloader
yum-utils.noarch : Utilities based around the yum package manager

2. Installing the package "yum-utils.noarch"
[root@centos63 ~]# yum install yum-utils.noarch
 
3. How to download packages with yumdoanloder
[root@centos63 ~]# yumdownloader samba

I hoipe this will be useful to you and help you in learning or manage your Srvers well.

Many thanks

by Renato de Oliveira

Exchange 2010 Problem Exporting Mailbox

Recently I had a problem with our Exchange 2010 server. I need to export our mailboxes to PST files.
Whenever I ran the cmd command "New-MailboxExportRequest" it thrown an error message:

"There are no available servers running the Microsoft Exchange Mailbox Replication service"

There are many posts talking about similar error, some indicate the service "Microsoft Exchange Mailbox Replication" service isn't running. That was not my case!

Let me give you an idea of the system:

• Windows 2008
• Exchange 2010
• SP1
• Microsoft Exchange Mailbox Replication running and started

So the problem was somethingelse. I started looking at updates and rollups and I came across one post which indicate that one of the pre-sp2 roll ups was causing the problem.

I applied Exchange SP2 and I managed to solve the problem, but Exchange SP2 can also cause you some headaches.

Before you apply Exchange SP2, do your home work and check the potential problems, check also the requirements.

I started with the requirements:

• Exchange 2010 SP2 makes updates to the Active Directory schema
• Windows 2008 must be on SP2
• IIS requires the following modules:
• IIS 6 WMI Compatibility
• ASP.NET 
• ISAPI Filters 
• Client Certificate Mapping Authentication 
• Directory Browsing 
• HTTP Errors 
• HTTP Logging 
• HTTP Redirection 
• Tracing 
• Request Monitor 
• Static Content
• If you use HTTP redirect, it will fail. Be aware, you will need to edit web.config
• If you have customised OWA web access theme, have a backup ready.

Take a look at the Links below:
http://technet.microsoft.com/en-us/library/hh529924(v=exchg.141).aspx
http://technet.microsoft.com/en-us/library/hh529928(v=exchg.141).aspx
http://technet.microsoft.com/en-us/library/hh672189(v=exchg.141).aspx

I hope this will help you; if you have come across this problem, solve it. If you are planning in applying Exchange SP 2, just do some research and be aware of some of pitfalls.

Hope you enjoy it.

by Renato de Oliveira

Being a good Linux systems administrator

Being a good Linux systems administrator

 

Throughout out my journey as a Linux Systems administrator, I have met many interesting sysadmins. I believe after 13 years working as a Sysadmin and another 7 as IT in general, I know what ‘being a good sysadmin’ means and entails.

 

There are few words that come to mind.

·         Responsibility

·         Safety

·         Backup

·         Security

·         Hard working

·         Diligent

·         Self-motivated

 

A good sysadmin takes the system as its own responsibility and takes care of it as if it was their own.

When making a change, always think about the consequences or negative impact a simple change might cause.

Whenever modifying configuration files; always make a back copy before making changes.

Backs up the system and keep a fresh backup up their sleeves.

Always take security seriously and investigates logs, keep the system up-to-date with patches. There is no half-job, does not make their lives easier, the system integrity comes first.

Work, research, investigate, re-visit solutions, double check consultant work. Create procedures, planning is vital. Having a roll back procedure is crucial.

Never consider a job done; there are always things which can be improved.

A good sysadmin needs to spot things before hand, need to be watching and think ahead.

 

With so many requirements, a good sys admin must be self-motivated, to keep fresh, learning new technologies, turning things around quickly and provide good result.

 

I have met many sysadmins, very intelligent in certain areas, but lacking on enthusiasm or just lazy. Some don’t think about the consequences and just run commands without thinking twice.

 

I think it is also important to have creativity to solve problems, keep an attention to the detail, and have focus on the task.

 

I know experience comes with some mistakes, but a good sysadmin needs to be able to see when to avoid mistakes. There are mistakes and mistakes.

 

I think if you hit <ENTER> without double checking the command line and testing the result you are up for trouble.

 

I think a good rule is; test it before you do it on live.

Things are much easier now a day, we have more resources available for testing, and we don’t necessary need to invest loads of money to create a test environment.

With Virtualbox, ESXi and many more, we can easily and quickly test any OS, and create a small network.

There are many simulators out there for almost anything.

Take for instance Cisco one can use www.gns3.net and have loads of virtual cisco kit. There is almost a virtual appliance for any major player on the market. Netapp provides a virtual appliance for its Filer. So their homework is part of the job.

 

There are many different ways of doing the same thing, with that in mind I think it is hard to judge which one is right and which one is wrong.

 

 

By Renato Oliveira

 

 

 

 

 

 

 

 

 

 

 

How to secure your Linux server (part 1)

How to secure a Linux Server (Part 1)

 

There are many people and companies which don’t believe in security. I wish 'security' was just a myth, but I am afraid there are many people out there with the intent of cause disruption and take advantage of it. I heard and read many times on the news, stories about data being stollen, compromised servers being used to attack other systems, back dorrs, trojans, keyloggers, crackers, hackers, bored teenagers, industrial espionage, even country sabotage.

There are many unscrupulous people in the world, and with the easiness of the Internet, anyone from anywhere can easily connect to any system around the globe and just cause havoc.

I wish I could spend my time just improving the system and making it more reliable, user friendly, more robust but we have to keep an eye on the bad guys.

At least if you can’t stop them, make it harder, so they have to spend more time trying to get into your system.

I am going to show you few things I do, to harden you Linux servers and give you some space for breathing.

Tips

1.    Only install the software you need onto your Linux server

2.    Disable unnecessary processes and services

3.    Change SSH default port from 22 to something like 2297

4.    Configure iptables and only allow IN the services you MUST

a.    If you only need Apache, just allow in port 80

5.    Make use of TCPwrapers

                a.  /etc/hosts.allow

                b.  /etc/hosts.deny

6.    Disable Apache signature

7.    Do not allow root login via SSH

8.    Create an user with an unusual name to be your admin

9.    Create a list of allowed users and set it on /etc/ssh/sshd_config

10.  Setup sudo and always use it

11.  Don’t log in directly as root to manage the server

12.  Create a banner /etc/issue

                a.    Add a security disclaimer

                b.    Make sure you specify that the server is not public

13.  Install and configure tripwire – IDS (Intrusion Detection System)

14.  Configure /tmp as a loopback mounted file

15.  Mount /tmp with the following options on /etc/fstab

                a. tmpdir /tmp ext4 loop,noexec,nosuid,rw 0 0

16.  Send logs to a remote syslog server

17.  Keep your Linux server patched and up-to-date

18.  Use different passwords for root and for your admin user

19.  Use different passwords for different servers and services

20.  Change your Password regularly (every 3 months)

21.  Set ssh login attempts to:

             a. MaxAuthTries 5

22.  Install and configure Fail2Ban to automatically block too many password failures

23.  Set grub boot password

Note: Be careful if you reboot your Server remotely

24.  Always create separate file systems or partitions

25.  Mount your application file system as follows on /etc/fstab

      a.  nosuid,nodev,noexec 1 2

26.  Disable SUID and SGID for binaries

27.  Install a log analyser

 

If you follow these tips, your server will become much harder to crack.

There are many more things you can do, to improve your security, keep your eyes open and be alert, always check your logs. Make sure you rotate your logs and save them to a remote location.
 
I will in the next post show you how to set these things up and which files you need to modify.
 
I hope this will be useful to you.

 

By Renato de Oliveira

 

 

 

 

Red Hat commands and tips (Part1)

Red Hat commands and tips (Part1)

There are many commands on Linux and many different ways of doing things.
There are some commands which are important to know and ways of piping them to give you a best result.

I am going to cover some commands which I find interesting and how to best use them.

I would like to point out that some of these commands you will be able to use in any distro, but some are Red Hat/Centos/Fedore specific.

Check which services are enables on runlevel 3
[root@centos63 ~]# chkconfig --list | grep 3:on
auditd          0:off   1:off   2:on    3:on    4:on    5:on    6:off
crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
ip6tables       0:off   1:off   2:on    3:on    4:on    5:on    6:off
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
Check services on runlevel 3, output process name and runlevel 3
[root@centos63 ~]# chkconfig --list | grep 3:on | awk '{print $1,$5}'
auditd 3:on
crond 3:on
ip6tables 3:on
iptables 3:on
lvm2-monitor 3:on
Disable service (smb - samba) from runlevel 3
[root@centos63 ~]# chkconfig --level 3 smb off

Enable service to start on runlevel 3
[root@centos63 ~]# chkconfig --level 3 smb on

Start, Stop and re-start services
[Start]
[root@centos63 ~]# service smb start
Starting SMB services:                                     [  OK  ]
[Stop]
[root@centos63 ~]# service smb stop
Shutting down SMB services:                                [  OK  ]
[Re-start]
[root@centos63 ~]# service smb restart
Shutting down SMB services:                                [  OK  ]
Starting SMB services:                                     [  OK  ]
Find the IP addresses of your Linux server (only IPs)
[root@centos63 ~]#ifconfig | grep "inet addr" | awk '{print $2}' | cut -d : -f 2
192.168.1.34
127.0.0.1
How to bring eth0 interface down
[root@centos63 ~]# ifdown eth0
Note: Be careful if you are logged via SSH, it will drop the connection.

How to bring eth0 interface up
[root@centos63 ~]# ifup eth0

How to set a default Gateway
[root@centos63 ~]# route add default gw 192.168.1.1

How to delete a default gateway
[root@centos63 ~]# route del default gw 192.168.1.1
How to add a static route to netwotk 192.168.3.0/24
[root@centos63~]# route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.1.1

Check File System usage (human readable)
[root@centos63 ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
                       47G  1.1G   44G   3% /
tmpfs                 499M     0  499M   0% /dev/shm
/dev/sda1             485M   52M  408M  12% /boot

Check free memory
[root@centos63 ~]# free -m
             total       used       free     shared    buffers     cached
Mem:           996        121        875          0          7         44
-/+ buffers/cache:         69        927
Swap:         2015          0       2015
Check all running processes
[root@centos63 ~]# ps -eaf
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 20:40 ?        00:00:01 /sbin/init
root         2     0  0 20:40 ?        00:00:00 [kthreadd]
root         3     2  0 20:40 ?        00:00:00 [migration/0]
root         4     2  0 20:40 ?        00:00:00 [ksoftirqd/0]
root      1207  1054  0 21:53 ?        00:00:00 sshd: root@pts/0
root      1209  1207  0 21:54 pts/0    00:00:00 -bash
root      1288     1  0 22:09 ?        00:00:00 smbd -D
root      1290  1288  0 22:10 ?        00:00:00 smbd -D
root      1373  1163  0 22:20 tty1     00:00:00 -bash
postfix   1447  1131  0 22:20 ?        00:00:00 pickup -l -t fifo -u
Check if specific process is running
[root@centos63 ~]# ps -eaf | grep smb
root      1288     1  0 22:09 ?        00:00:00 smbd -D
root      1290  1288  0 22:10 ?        00:00:00 smbd -D
root      1461  1209  0 22:31 pts/0    00:00:00 grep smb
Check all open TCP ports on your Server
[root@centos63 ~]# netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN
tcp        0     52 192.168.1.34:22             192.168.1.33:55348          ESTABLISHED
tcp        0      0 :::139                      :::*                        LISTEN
tcp        0      0 :::22                       :::*                        LISTEN
tcp        0      0 :::445                      :::*                        LISTEN
There are many very useful commands, these a just some of the commands and combinations I use.
If you found this useful, let me know and I will write some more useful commands to share with you.

Hope you have enjoyed.

by Renato de Oliveira

My CV

My CV

PROFILE

 

·       An IT career professional who constantly refreshes his technical knowledge base with the ability to learn and deploy new technologies quickly and to very high standards.

·       An expert systems and network administrator with excellent practical skills in setting up and administrating NT/200x/XP, Linux and Solaris networks.

·       Extensive experience in both peer-to-peer and client-server network architectures, as well as LANs and WANs.

·       Works equally well on own initiative and as part of a team with a methodical approach to problem solving.

·       Responsive and sensitive to user difficulties and enquiries.

 

 

CAREER HISTORY

 

 

CANTAB CAPITAL PARTNERS

 

Date                             September 2011 to current date

Position                       IT Manager/Systems Administrator

Nature of Business       Hedge Fund

 

Responsibilities and Achievements

 

·         Working alone, I had full responsibility for the design and project management of the move from a single office environment to two offices and two Data Centres (Primary and Backup), providing full business continuity across the organisation.

·         Designed and built both data centres.

·         Designed a resilient and robust network solution, based on Citrix for secure remote access.

·         Designed a resilient and robust Firewall architecture around the Juniper SRX technology, using a HA pair in a cluster).

·         Designed the network infrastructure around the Cisco 3750 switch models, separated by VLANs to accommodate STORAGE, DMZ, LAN and Management networks.

·         Oversaw the Citrix implementation

·         Manage Exchange 2010

·         Implemented a  UPS system to keep 20+NetApp high processing servers high availability

·         Responsible for the phone system and redesigned it to accommodate VoIP

·         Act as Security Officer for the Company

·         Automated the process to install Linux servers and integrated Linux to Active Directory for unified logon

·         Implemented VM backups using Veeam 6.0

·         Implemented NetApp Synchronisation using Snapmirror across Live and DR DC

·         Designed a Radianz infrastructure to accommodate communication to various banks and financial institutions and implement ipSec VPNs to brokers

·         Recruitment and management of two additional System Administrators to manage the new architecture. This role includes training and the creation and implementation of procedures and standards for best practice.

 

 

VELOCIX LTD

 

Date                             September 2010 to September 2011

Position                       Systems Administrator

Nature of Business       CDN Provider

 

Responsibilities and Achievements

 

Responsible for Supporting a Linux CDN infrastructure across multiple sites around the world.

 

 

GRANT INSTRUMENTS

 

Date                             November 2009 to September 2010

Position                       Systems Administrator

Nature of Business       Manufacture and Design of Scientific Equipment and Data Analysis

 

Responsibilities and Achievements

                                   

·         Responsible for the design and implementation of a 24x7 monitoring and alerting system across a distributed (UK and US) server estate.

·         Implemented security policies and firewall rules to make the system secure

·         Documented the whole system, including creation of systems administration procedures for shut down and restore of servers, application of patches and kernels changes.

·         Designed and implemented a robust backup for the Postgres database system making use of quick recovery and warm standby technologies using PITR.

·         Implemented a new test environment, replicating the live production system, to enable the development team to test their code safely.

·         Implemented VMware across the server estate, using VMware backup to allow VMs be restored and backed up on the fly.

·         Implemented a process to install and clone servers using Kickstart technology and dd over ssh.

·         Responsible for selection and purchase of IT equipment related to the projects in which I was involved.

 

 

MAILTRACK LIMITED/DIGITAL MARKETING SERVICES

 

Date                             December 2008 to November 2009

Position                       Systems Administrator

Nature of Business       Mail marketing industry

 

Responsibilities and Achievements     

 

·         Responsible for 3 data centres, including purchase and management of all necessary equipment for a successful operation.

·         Management of 50 Linux servers (BSD, Debian, Suse), Windows XP/Vista PCs and MAC X clients.

·         Organise the office infrastructure to a very reliable, efficient and  manageable state by simplifying it, documenting it fully and redesigning it from scratch.

·         Setup backup strategy and redundancy implementation.

 

 

 

LIMEHOUSE SOFTWARE LIMITED

 

Date                             December 2006 to December 2008

Position                       Systems Administrator

Nature of Business       Software House

 

Responsibilities and Achievements     

 

·         Manage and support a mixed platform environment including SageCRM, Mitel 3300, Exchange 2003, Windows 2000, and Windows 2003 server, Microsoft SQL 2000 and 2005, Netscreen Firewall f25, Solaris 10, Linux Gentoo, Linux Redhat Enterprise 4, Tomcat, Apache and Resin.

·         Design and implement more robust solutions for the future.  Particular areas of concern are backup, security and disaster recovery as a consequence of Limehouse's central London location.

·         Manage remote data centre infrastructure in the UK and US and redesign solution to incorporate a new UK data centre location outside of London.

·         Manage corporate VPN and provide support to remote workers both in the UK and US.

 

 

PLASTIC LOGIC LIMITED

 

Date                             April 2003 to December 2006

Position                       Systems Administrator

Nature of Business       Leader in Plastic Electronics

 

Responsibilities and Achievements     

 

·         Responsible for the planning, development and management of IT throughout the whole Company with project management of internal IT projects.

·         Planned and implemented a corporate IT strategy including backup, disaster recovery and IT network security.

·         Improved Internet stability and security through migration to an alternative provider and the implementation of a double layer firewall (external Cisco PIX, internal running Linux).

·         Management of the IT support team providing 24/7 in-house and remote support to 60 users, Clean Room Network, LAB networks and Test environment.

·         Installed, configured and maintains SurfControl email and web filter.

·         Designed, implemented and managed Exchange 2003 Front-end/Back-end topology.

·         Designed and implemented Windows 2003 Active Directory Network.

·         Installed and configured Cadence Software running on Linux.

·         Managed a network comprising 11 Servers (7 Windows 2003, 3 Linux and 1 Solaris 10).

·         Set-up, configured and managed DNS servers on Linux and Windows 2003.

 

 

COMPUTACENTER (UK) LTD

 

Date                             October 2002 to April 2003

Position                       Network Services Analyst

Nature of Business       Computer systems distributor

 

Responsibilities and Achievements     

 

·         Provided remote monitoring and management services to clients of Comutacenter.

·         Installed, configured and managed BMC Patrol as a tool to monitor customer networks.

·         Administered and managed Netbackup and ARCServeIt backup servers.

·         Used Compaq Insight Manager to monitor Compaq Servers.

·         Managed Citrix Servers and Terminal Services.

·         Administered Windows 2000 Active Directory for several different customers.

·         Monitored, analysed and problem-solved client networks.

·         Monitored and managed ORACLE database, Veritas Cluster Servers, E10 and E15K Sun Machines and Sun Solaris 9.0 servers.

 

 

IMERGE LTD

 

Date                             March 2000 to October 2002

Position                       Systems Network Administrator

Nature of Business       Development and provision of media appliance technology

 

Responsibilities and Achievements     

 

·         Planned and set-up the whole heterogeneous network architecture including remote access WAN between offices using Cisco routers, ISDN lines, PABX, Switches, ATM and Frame Relay.  

·         Set up and implemented a corporate backup strategy using Veritas Backup Exec.

·         Set up DNS, SSH, SFTP, NFS and NIS servers on Linux and Solaris.

·         Set up a VPN server using Windows NT 4.0 PPTP, and Linux IPSec to enable remote access to company network.

·         Managed and maintained MS Exchange Server 5.5/2000, SQL servers and NetApp file server.

·         Provided PC, Linux, Windows 98/ME/NT4.0/2000/XP, networking support to 70 users across 3 offices.

·         Set up and maintained Intranet using Linux RedHat 6.2 and Apache.

 

 

CONSULTORIA E SISTEMAS LTDA, RECIFE, BRAZIL

 

Date                             March 1999 to December 1999

Position                       Linux Consultant

Nature of Business       Linux consultancy provider, partner of Conectiva Linux, the official Linux distributor in Brazil

 

 

BRITANIC INTERNATIONAL HOUSE, RECIFE, BRAZIL

 

Date                             July 1997 to March 1999

Position                       IT Manager

Nature of Business       UK-affiliated language school

 

 

TRE (REGIONAL ELECTIONS COUNCIL), RECIFE, BRAZIL

Date                             June 1996 July 1997

Position                       IT Support Officer

Nature of Business       Local Government