OpenVZ - Reverse path filtering (rp_filter ) - sysctl.conf

If you come across packet loss problem with the OpenVZ VMs, change rp_filter (Reverse path filtering ) to loose mode (rp_filter = 2) on the hardware node to fix the intermittent network connection loss in the VM's. 

####sysctl.conf variables###
net.netfilter.nf_conntrack_max = 196608
net.nf_conntrack_max = 196608
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2

########################

Dell PERC H200 RAID card (sas2ircu)

Setup CL/i monitoring tool for Dell PERC H200 RAID card (sas2ircu)
=======================================================

Check the status using /usr/sbin/sas2ircu-status

setup script to monitor RAID status
===================================

Bash script to send emails in case of any status change in RAID array.

************************************
#!/bin/bash
EMAIL="test1@dmain.com"
EMAIL1="test2@domain.com"
EMAIL2="test3@domain.com"
rm -f /tmp/alert
/usr/sbin/sas2ircu 0 STATUS > /tmp/alert
diff /etc/orig /tmp/alert
if [ $? -ne 0 ]; then

#Send alert email
/bin/mail -s "RAID status changed on `hostname` -- ( <IP_Address> )" ${EMAIL} ${EMAIL1} ${EMAIL2} < /tmp/alert
fi
************************************

Note: Run the below command and create the file

/usr/sbin/sas2ircu 0 STATUS > /etc/orig

Check HDD health with hardware RAID: MegaCli

(1) Find out the device ID's using MegaCli too

Megacli64 -PDlist -a0|grep Device.Id

Device Id: 7
Device Id: 6
Device Id: 5
Device Id: 4

(2) Check the HDD health on each device using smartctl

smartctl -a -d sat+megaraid,7 /dev/sda|grep 'PASSED\|Reallocated_Sector_Ct\|Temperature_Celsius'
smartctl -a -d sat+megaraid,6 /dev/sda|grep 'PASSED\|Reallocated_Sector_Ct\|Temperature_Celsius'
smartctl -a -d sat+megaraid,5 /dev/sda|grep 'PASSED\|Reallocated_Sector_Ct\|Temperature_Celsius'
smartctl -a -d sat+megaraid,4 /dev/sda|grep 'PASSED\|Reallocated_Sector_Ct\|Temperature_Celsius'

Vi Vs Vim

Entering And Leaving VI   File Manipulation
-----------------------   -----------------
%vi name edit name at top :w     write back changes
%vi +n name ... at line n  :wq    write and quit
%vi + name ... at end  :q    quit
%vi -r  list saved files :q!    quit, discard changes
%vi -r name recover file name :e name    edit file name
%vi name ... edit first;rest via :n :e!    reedit discard changes
%vi -t tag start at tag  :e + name  edit starting at end
%vi +/pat name search for pat  :e +n name edit starting at line n
% view name read only mode  :e #    edit alternate file
ZZ  save and exit from vi CTRl-^    synonym for :e #
CTRL-Z  stop vi, don't exit :r(name)   paste file name starting at
         current position.
     :w(name)   write file name
The Display    :w! name   overwrite file name
-----------    :sh    run shell, then return
     :!cmd    run cmd, then return
Last line   Error mesg, echoing input :n    edit next file in arglist 
     to :/? and !, feedback :n args    specify new arglist
     about i/o and large changes :f    show current file and line
@ lines     On screen only, not in file CTRL-G    synonym for :f
~lines      Lines past end of file :ta tag    to tag file entry tag
CTRL-x      Control characters, DEL is CTRL-]    :ta, following word tag
     delete.
tabs     Expand to spaces, cursor
     at last.

Vi Modes    Positioning within File
--------    -----------------------
Command     Normal and initial state CTRL-F     forward screenfull
     Others return here. Esc CTRL-B     backward screenfull
     (escape) cancels partial CTRL-D     scroll down half screen
     command.   CTRL-U     scroll up half screen
Insert     Entered by a i A I O G    goto line (end default)
     o c C s S R. Arbitrary /pattern   next line matching pattern
     test then terminates ?pattern   prev line matching pattern
     with ESC character, or n    repeat last / or ?
     abnormally with interrupt N    reverse last / or ?
Last line   Reading input for :/? or !; /pat/+n    n'th line after pat
     terminate with ESC or CR ?pat?-n    n'th line befor pat
     to execute. interrupt to ]]    next section/function
m           cancel.   [[    previous section/function
     %    find matching () { or }

Counts Before Vi Commands  Adjusting the Screen
-------------------------  --------------------
line/column number  z G | CTRL-L    clear and redraw
scroLl half-page CTRL-D CTRL-U CTRL-R    retype, eliminate @ lines
replicate insert a i A I  z<CR>   redraw, at window top
repeat effect  most rest z-    ... at bottom
     z.    ... at center
Simple Commands    /pat/z-    pat line at bottom
---------------    zn.    use 
     CTRL-E    scroll window down 1 line
dw     delete word   CTRL-Y    scroll window up 1 line
de     ... leave punct
dd     delete a line  Corrections during Insert Mode
3dd     ... 3 lines   ------------------------------
i(text) ESC insert text (return 
     to cmd mode)
cw(new) ESC  change word to new  CTRL-H    erase last character
      (return to cmd mode)
easESC     pluralize word  CTRL-W    erases last word
xp     transpose characters  erase    your erase, same as CTRL-H
     (switch current char  Kill erase input this line 
      w/ next)
Interrupting, Cancelling  \    escapes CTRL-H, erase, kill
------------------------  ESC    end insert, command mode
     CTRL-C    interrupt, terminate insert
ESC     end insert or command CTRL-D    backtab over autoindent
CTRL-C     interrupt (or DEL)  CTRL-^D    kill auto, save for next
CTRL-L     refresh screen  0CTRL-D    ... but at margin next also
     CTRL-V    quote non-printing character

Marking and Returning   Insert and Replace
---------------------   ------------------
``     previous context  a    append after cursor
''     ... at first non-white i    insert before
     in line   A    append at end of line
mx     mark position with   I    insert before first non-white
`x     to mark x   o    open line below
'x     ... at first non-white O    open above
     in line   rx    replace single char with x
     R    replace characters

Line Positioning   Operators (double to effect line)
----------------   ---------------------------------

H     top window line  dd    delete line
L     last window line  cc    cut line to paste with p.
M     middle window line  <    left shift
+     next line at first  >    right shift
     non-white   !    filter through command
-     previous line, at first =    indent for LISP
CR     return, same as +  yy    yank lines to buffer
down arrow    
or j     next line, same column Miscellaneous Operations
up arrow    ------------------------
or k     prev line, same column
     C    change rest of line
Character Positioning   D    delete rest of line
---------------------   s    substitute chars
     S    substitute lines
^     beginning of Line.  J    join lines
$     end of line   X    ... before cursor
right arrow    Y    yank lines
or l     forward   x    delete characters
left arrow    Yank and Put
or h     backwards   ------------
CTRL-H     same as left arrow
space     same as right arrow  p    put back lines
     (num)yy    yank num lines 
     Undo,Redo,Retrieve
|     to specified column  ------------------
%     find matching () or {}
     u    undo last change
Words, Sentences, Paragraphs  U    restore current line
----------------------------  .    repeat last change
     (num)yy    yank num lines 
w     word forward
b     back word (to first char)  Commands for LISP
e     to last character of W -----------------
)     to next sentence
}     to next paragraph  )    Forward s-expression
(     back sentence  }    ... but don't stop at atoms
{     back paragraph  (    back s-expression
W     word forward  {    ... but don't stop at
B     back W (to first char)
E     to last character of W 

Linux kernel rp_filter settings

The main functionality of a router is to route packets from one place to another. Linux machine can be used as router on your network that will route substantial amount of traffic without any issues, if configured correctly.

Due to the increasing amount of malicious and attack traffic on the internet, it has become very much necessary to take some extra care while configuring routes on a Linux machine or physical router's.

One of the major problem that internet security people are dealing with today, is spoofing.





What is IP address spoofing?

IP spoofing is a method adopted by attacker's to send forged source address in their attack traffic.Which means they can send an IP packet with an IP address of their wish.

Most of the time's spoofing is used by an attacker mainly for the following reasons.

To conduct a DDOS attack ,and he does not want the response from the target machine to reach him
To compromise source based authentication
Spoofing can be controlled to a certain extent by using Reverse Path filtering(not fully although).



What is reverse path filtering?

Reverse path filtering is a mechanism adopted by the Linux kernel, as well as most of the networking devices out there to check whether a receiving packet source address is routable.

So in other words, when a machine with reverse path filtering enabled receives a packet, the machine will first check whether the source of the received packet is reachable through the interface it came in.

If it is routable through the interface which it came, then the machine will accept the packet
If it is not routable through the interface, which it came, then the machine will drop that packet.
Latest red hat machine's will give you one more option. This option is kind of liberal in terms of accepting traffic.

If the received packet's source address is routable through any of the interfaces on the machine, the machine will accept the packet.


Reverse Path Filter(rp_filter) settings in Red hat 5/Centos 5 machines



In Linux machine's Reverse Path filtering is handled by sysctl, like many other kernel settings.

The current value on your machine can be found from the following method.

[root@localhost ~]# cat /proc/sys/net/ipv4/conf/default/rp_filter
1
[root@localhost ~]#


Let's understand the boolean values for rp_filter first then go ahead with configuration.

1 indicates, that the kernel will do source validation by confirming reverse path.

0 indicates, no source validation.
The previously shown output of /proc/sys/net/ipv4/conf/default/rp_filter  indicates the default value of Reverse path filtering for any new interface.

You can also enable reverse path filtering only on your desired interface, because each interface has got different rp_filter files.

[root@localhost ~]# cd /proc/sys/net/ipv4/conf/
[root@localhost conf]# ll
total 0
dr-xr-xr-x 2 root root 0 Feb 28 05:12 all
dr-xr-xr-x 2 root root 0 Feb 28 05:12 default
dr-xr-xr-x 2 root root 0 Feb 28 05:12 eth0
dr-xr-xr-x 2 root root 0 Feb 28 05:12 lo


All the folder's in the above shown output has the file rp_filter. I will recommend enabling it by modifying the file /proc/sys/net/ipv4/conf/all/rp_filter file, if you Reverse filtering very strictly. This can be done by simply redirecting your desired boolean value(1 or 0) to the desired file.

[root@localhost conf]# echo 1 >  /proc/sys/net/ipv4/conf/all/rp_filter
[root@localhost conf]#
Now restart your network for the new configuration to take effect.



However editing file's inside /proc is not at all a good practice. So you can do this by editing sysctl.conf file

[root@localhost conf]#  sysctl -w "net.ipv4.conf.all.rp_filter=1"
net.ipv4.conf.all.rp_filter = 1
Replace "all" with default,eth0,<or any interface name of your wish>



Reverse Path Filter(rp_filter) settings in Red hat 6/Centos 6 mahcines



Like previously mentioned there is one more option which is to do a source validation of the packet's recieved through all the interfaces on the machine.

In other words if the source address is routable with any of the routes on any of the interface, then packet is accepted. And this is called as a loose mode reverse filtering.

The numeric value to enable this mode of rp_filter in redhat-linux 6 is 2 .

For example you can simply set the value of 2 as shown below to enable this mode.



[root@localhost conf]# echo 2 >  /proc/sys/net/ipv4/conf/all/rp_filter
[root@localhost conf]#
Rest of the setting's related to rp_filter in Red Hat enterprise Linux 6 is same as in Red Hat 5.