Pages

Friday, July 10, 2015

Routing multiple network interfaces inside a Xen PV CentOS VPS

1) Comment the "GATEWAY=" line in the /etc/sysconfig/network file.

Let us first set some symbolical names. Let $IF1 be the name of the first interface and $IF2 the name of the second interface. Then let $IP1 be the IP address associated with $IF1 and $IP2 the IP address associated with $IF2. Next, let $P1 be the IP address of the gateway at Provider 1, and $P2 the IP address of the gateway at provider 2. Finally, let $P1_NET be the IP network $P1 is in, and $P2_NET the IP network $P2 is in.

2) Creates two additional routing tables, say T1 and T2. These are added in /etc/iproute2/rt_tables. 

echo 1 T1 >> /etc/iproute2/rt_tables
echo 2 T2 >> /etc/iproute2/rt_tables

Eg:

================================
[root@test ~]# cat /etc/iproute2/rt_tables
#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
1 T1
2 T2
================================

3) Then you set up routing in these tables as follows:

       ip route add $P1_NET dev $IF1 src $IP1 table T1
       ip route add default via $P1 table T1
       ip route add $P2_NET dev $IF2 src $IP2 table T2
       ip route add default via $P2 table T2

4) Next you set up the main routing table. Note the `src' arguments, they make sure the right outgoing IP address is chosen.

         ip route add $P1_NET dev $IF1 src $IP1
         ip route add $P2_NET dev $IF2 src $IP2

5) Then, your preference for default route:

         ip route add default via $P1

6) Next, you set up the routing rules. These actually choose what routing table to route with. You want to make sure that you route out a given interface if you already have the corresponding source address:

         ip rule add from $IP1 table T1
         ip rule add from $IP2 table T2

7) Put the above commands in the /etc/rc.local file.

Example:
########################
ip route add 210.61.156.0/24 dev eth0 src 210.61.156.253 table T1
ip route add default via 210.61.156.254 table T1
ip route add 59.125.26.0/24 dev eth1 src 59.125.26.34 table T2
ip route add default via 59.125.26.254 table T2

ip route add 210.61.156.0/24 dev eth0 src 210.61.156.253
ip route add 59.125.26.0/24 dev eth1 src 59.125.26.34

ip route add default via 210.61.156.254

ip rule add from 210.61.156.253 table T1
ip rule add from 59.125.26.34 table T2
#########################

8) Reboot the VM and check if eth0 and eth1 are responding to ping requests.

Reference:

Friday, November 14, 2014

HP Smart Array RAID status on CentOS

(1) You can download the rpm from here:

 wget ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p1257348637/v71527/hpacucli-9.10-22.0.x86_64.rpm

Check the controller status
-----------------------------
#hpacucli controller all show status

Check the logical drive
------------------------
#hpacucli controller slot=0 logicaldrive all show status

Check the physical drives
--------------------------
hpacucli controller slot=0 physicaldrive all show status


Adaptec Raid Monitoring


You can download the source from here

http://download.adaptec.com/raid/storage_manager/asm_linux_x64_v7_31_18856.tgz

/usr/StorMan/arcconf getconfig 1


/opt/adaptec-monitor.pl
===================
#!/usr/bin/perl -w
# adaptec-monitor.sh - Monitors Adaptec Hardware RAID

use strict;
open(my $arcout, "/usr/StorMan/arcconf getconfig 1|") or die $!;
my @arcout;
while(<$arcout>) {
chomp;
push(@arcout,$_);

}
close($arcout);

my $cont_trouble;
my %disk_trouble;
my $disk_number;

for(@arcout) {
if(/Status of logical device\s+:\s+(Degraded|Missing|SMART-ERROR|Offline|Warning|Critical|Bad|Unknown|Device-Error)/) {
$cont_trouble = $1;
}
if(/Device #(\d+)/) {
$disk_number = $1;
}
if (/State\s+:\s+(Degraded|Missing|SMART-ERROR|Offline|Warning|Critical|Bad|Unknown|Device-Error)/) {
$disk_trouble{ $disk_number } = $1;
}
}

if($cont_trouble) {
&mailit($cont_trouble);
}

while ( my ($key, $value) = each(%disk_trouble) ) {
&mailit($key,$value);
}

sub mailit {

my $title='RAID Issue!';
my $to='<email_id>';
my $from= 'root@server';
my $subject='RAID issue detected on hostname';

open(MAIL, "|/usr/sbin/sendmail -t");

## Mail Header
print MAIL "To: $to\n";
print MAIL "From: $from\n";
print MAIL "Subject: $subject\n\n";
## Mail Body
if ($_[1]) {
print MAIL "Disk Status: #$_[0]: $_[1]\n";
}
else { print MAIL "Controller Status: $_[0]\n" }
close(MAIL);

}


[root@op1 backup]# crontab -l
* */1 * * * /usr/bin/perl /opt/adaptec-monitor.pl

ARP

Current arp cache
==============
root@server [~]# arp -n
Address      HWtype  HWaddress           Flags Mask  Iface
70.167.140.1 ether   00:00:0C:9F:F0:04   C           eth0

Clearing arp cache with verbose
======================
root@server [~]# ip -s -s neigh flush all
70.167.140.1 dev eth0 lladdr 00:00:0c:9f:f0:04 ref 42 used 17/0/65 REACHABLE
*** Round 1, deleting 1 entries ***
70.167.140.1 dev eth0  ref 42 used 0/0/0 INCOMPLETE
*** Round 2, deleting 1 entries ***
*** Flush is complete after 2 rounds ***

Current entries
============
root@server [~]# arp -n
Address      HWtype  HWaddress           Flags Mask  Iface
69.167.140.1 ether   00:00:0C:9F:F0:04   C           eth0

Delete specific arp entries
==================
root@server [~]# arp -d 192.168.1.1
root@server [~]# arp -d 192.168.1.2

Add a static arp entry
===================
root@server [~]# arp -s 192.168.1.10 00:00:93:12:04:57

Saturday, July 12, 2014

WP-Login Mod security Rule


(1)Compile apache to enable mod_security

(2)Make sure SecDataDir is present.

(3)If you do not have a SecDataDir anywhere then add it and also create the directory, for example:

mkdir /usr/local/apache/logs/modsec
chown root:nobody /usr/local/apache/logs/modsec
----------------------------------------------------------------------
root@server [/usr/local/apache/conf]# cat /usr/local/apache/conf/modsec2.conf | grep SecDataDir
SecDataDir /usr/local/apache/logs/modsec 
root@server [/usr/local/apache/conf]# 
-------------------------------------------------------------------

(4)Add the rule in a seperate file as follows.
-------------------------------------------------------------------

root@server [/usr/local/apache/conf]# cat modsec2.wplogin.conf
<LocationMatch "/wp-login.php">
SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog,id:313371
SecAction "phase:5,deprecatevar:ip.counter=3/30,pass,nolog,id:313372"
SecRule IP:COUNTER "@gt 1" "phase:2,pause:3000,deny,status:406,setenv:RATELIMITED,skip:1,log,id:313373"
SecAction "phase:2,pass,setvar:ip.counter=+1,nolog,id:313374"
</LocationMatch> 
root@server [/usr/local/apache/conf]# 
-------------------------------------------------------------------
(5) Add the Include file accordingly as follows.
----------------------------------------------------------------
[root@server/usr/local/apache/conf]# cat modsec2.conf | grep Include
Include "/usr/local/apache/conf/modsec2.user.conf"
Include "/usr/local/apache/conf/modsec2.wplogin.conf"
[root@server/usr/local/apache/conf]#
---------------------------------------------------------------
(6)Make sure that following ErrorDocument is existing
[root@mserver]# cat /usr/local/apache/conf/includes/errordocument.conf | grep 406
# 406 - Not Acceptable
ErrorDocument 406 /406.shtml
[root@server/usr/local/apache/conf]# 
--------------------------------------------------------------


exclude few IPs from the rule
---------------------------------
root@server [/usr/local/apache/conf]# cat modsec2.wplogin.conf
<LocationMatch "/wp-login.php">
SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog,id:313371
SecRule  REMOTE_ADDR  "@pmFromFile /usr/local/apache/conf/whitlist.txt"  "nolog,allow,id:313372"
SecAction "phase:5,deprecatevar:ip.counter=3/30,pass,nolog,id:313372"
SecRule IP:COUNTER "@gt 1" "phase:2,pause:3000,deny,status:406,setenv:RATELIMITED,skip:1,log,id:313373"
SecAction "phase:2,pass,setvar:ip.counter=+1,nolog,id:313374"
</LocationMatch> 
root@server [/usr/local/apache/conf]# 
-----------------------------------