Friday, July 19, 2013

Install SNMP on Centos/RHEL


The following steps will install snmp daemon on your CentOS/RHEL server :

yum install net-snmp net-snmp-utils

Edit snmpd simple configuration ( change SECRET_NAME to a complex string ) :

echo rocommunity SECRET_NAME > /etc/snmp/snmpd.conf

Start snmpd :
service snmpd restart

Also make sure it starts on boot :
chkconfig snmpd on

To check snmpd is working ( change SECRET_NAME to the string you have chose before ) :

snmpwalk -v 1 -c SECRET_NAME -O e 127.0.0.1

you should get an output like below :

SNMPv2-MIB::sysDescr.0 = STRING: Linux 2.6.18-194.11.4.el5xen #1 SMP Tue Sep 21 05:40:24 EDT 2010 x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (242211) 0:40:22.11
SNMPv2-MIB::sysContact.0 = STRING: root@localhost
SNMPv2-MIB::sysName.0 = STRING: 
SNMPv2-MIB::sysLocation.0 = STRING: Unknown
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORID.1 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.2 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.3 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.4 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.5 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID.6 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID.7 = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID.8 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance

Saturday, July 30, 2011

Reset Cisco Switch and Router Password

How to Reset Cisco Switch Password
1. Unplug/Plug
2. Hold "Mode" button (15 secs)
> ROM (Switch)
3. flash_init
4. load_helper
4. dir flash:
> view config.text
5. rename flash:config.text flash:any_name
> bypass config.text
6. dir flash:
7. boot
8. a) #rename flash:any_name flash:config.text
        #copy flash:config.text running-config
or
     b) #copy flash:any_name running-config
9. Change password, write mem


How to Reset Cisco Router Password
1. Switch off/on
2. Ctrl-break
> ROM (rommon>)
3. confreg 0x2142
> bypass NVRAM
4. Reset
5. copy startup-config running-config
6. Change Password, then write
7. No Shutdown (Interfaces)
8. (Config)# config-register 0x2102
9. Reload


Copy IOS from COnsole after #erase flash:

Note: Use TerraTerm with Vista/Windows 7

Router
A. Connect to console
B. rommon 1> xmodem -c IOS.bin

Switch
A. Connect to Console
B. :Copy xmodem: IOS.bin flash: IOS.bin

Sunday, June 26, 2011

How To Install Gitolite

Gitolite is a tool to easily manage repositories in git with just a user account on a server. It provides access to several developers, without providing real access to a shell. It uses the ssh key. It is written by Sitaram Chamarty in the Perl language, and inspired gitosis. Gitolite can assign specific rights to a user, such as reading, (So the clone and fetch) write (push) for a repo. It is also possible to assign rights to branches or tags, practiced in a corporate environment or in the management of certain projects, for example. Gitolite can be installed without root privileges, and without additional software, only Git and Perl.

For installation, there are several ways to proceed. For users of Debian, Ubuntu, Fedora, and certainly others, it is possible to use the package system of distribution. It is also possible to start the installation with a script provided by the project. It is the solution that I use so it's the one I'll present. As I said above, Gitolite can be installed without using root privileges. So I prefer to create an individual user to manage the installation, it is also the user who will manage Git repositories. Not using the root account you can be sure access to the configuration of Git repositories has no root rights. We can then add user's public keys in / home / git / .ssh / authorized_keys.

adduser gitadmin
adduser git

Then we will take the identity of the newly created user gitadmin, and we will generate a key pair, which will add to the list of keys authorized git.

sudo su gitadmin
ssh-keygen -t dsa -b 1024
ssh-copy-id -i ~/.ssh/id_dsa.pub git@localhost

It is now possible to proceed to the installation. From the home folder of gitadmin - we start by recovering the sources of project, by cloning the project. We move into the project and we start the installation script. Note: we need to have at least Git 1.6.2 version or higher for Gitolite to work.

git clone http://github.com/sitaramc/gitolite.git
gitolite cd / src
. /gl-easy-install git localhost gitadmin

The options we pass a parameter to the install script, meaning the user will host git repositories, the server you are connected over here then localhost and the user gitadmin for the administration of repos. A series of questions will be asked, you can leave the default options. It will also be asked for a passphrase that can be left empty. Once installation is complete, we can begin to see how the configuration. It moves in the directory gitolite-admin, always with the user gitadmin of course. (User who manages the configuration) To add a user, add the public key in the folder Keydir, commit and do not forget to push as it is when the hooks that the configuration takes effect.

cp /home/lexter/id_dsa.pub Keydir/lexter.pub
git add Keydir/lexter.pub
git commit -a -m "Added user Lexter."
git push

If like me, there are more keys for the same user, there is a special syntax to use. lexter@lexter.pub lexter@work.pub - the name after the at sign may be what you want.
To delete a user, delete their key:

git rm Keydir/usersample.pub
git commit -a -m "Deleted usersample."
git push

Now to the management of repositories. Currently, two existing repo. There are of course the gitolite-admin repository and a repository-admin called testing. We note that the syntax and fairly clear and easy to understand. If we add the name of a repo that does not exist, it will be created automatically and placed in the directory / home / git / repository.

repo lexterproj
RW+ = lexter

It has such a repo, with the user who has rights lexter read, write, rewind permissions, in other words the ability to delete milestones. R: Right read only, RW: Right reading and writing, RW+: right reading, writing and rewind permission. It is also possible to manage groups. There is already a group that is @ all , it is used for testing the repo, this corresponds to all users.

@New_group = User1 user2 user3

It is now possible to use @ New_group. It is also possible to add only those rights on a branch of a repo. If you need more information about this you can see a sample configuration https://github.com/sitaramc/gitolite/blob/master/conf/example.conf. To get the project that uses git.

git clone git@host.com: lexterproj.git

One simple way to add/move a pre-existing repo to gitolite is to let gitolite create it as a brand new repo, then do the following:

cd [copy-of-your-repo]
# make sure all the branches are correct and no extra stuff, "temp"
# branches, etc., are present
git push --all git@server:reponame.git
git push --tags git@server:reponame.git

Please do a git ls-remote git@server:repo to make sure all the stuff you want went through, and is named correctly.

In conclusion, I find it really a handy tool, nice and powerful. It is very easy to configure and maintain.

Wednesday, December 29, 2010

IPTables Tutorial From Linux Journal

Here is a Three Part Tutorial Video of IPTables from Linux Journal.

Mastering IPTables Part 1



Firewall Script Part 1

### Start Of Script ###

#!/bin/sh

IPT=/sbin/iptables

$IPT -F

#policies

$IPT -P OUTPUT ACCEPT
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

#allowed inputs

$IPT -A INPUT --in-interface lo -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT

#allow responses

$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### End Of Script ###


Mastering IPTables Part 2



Firewall Script Part 2

### Start Of Script ###

#!/bin/sh

IPT=/sbin/iptables

$IPT -F

#policies

$IPT -P OUTPUT ACCEPT
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT

$IPT -N SERVICES

#allowed inputs

$IPT -A INPUT --in-interface lo -j ACCEPT
$IPT -A INPUT -j SERVICES

#allow responses

$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow services

$IPT -A SERVICES -p tcp --dport 22 -j ACCEPT
$IPT -A SERVICES -p tcp --dport 8080 -j ACCEPT

$IPT -A SERVICES -m iprange --src-range 192.168.1.1-192.168.1.254 -p tcp --dport 631 -j ACCEPT

$IPT -A SERVICES -m iprange --src-range 192.168.1.1-192.168.1.254 -p udp --dport 631 -j ACCEPT

$IPT -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080

$IPT -A FORWARD -p tcp --dport 8080 -j ACCEPT


### End Of Script ###


Mastering IPTables Part 3



Firewall Script Part 3

### Start Of Script ###

#!/bin/sh

IPT=/sbin/iptables

$IPT -F

#policies

$IPT -P OUTPUT ACCEPT
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT

$IPT -N SERVICES

#drop spoofed packets

$IPT -A INPUT --in-interface ! lo --source 127.0.0.0/8 -j DROP

#limit ping requests

$IPT -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

#drop bogus packets

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
$IPT -t filter -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP

#allowed inputs

$IPT -A INPUT --in-interface lo -j ACCEPT
$IPT -A INPUT -j SERVICES

#allow responses

$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow services

$IPT -A SERVICES -p tcp --dport 22 -j ACCEPT
$IPT -A SERVICES -p tcp --dport 8080 -j ACCEPT

$IPT -A SERVICES -m iprange --src-range 192.168.1.1-192.168.1.254 -p tcp --dport 631 -j ACCEPT

$IPT -A SERVICES -m iprange --src-range 192.168.1.1-192.168.1.254 -p udp --dport 631 -j ACCEPT

$IPT -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080

$IPT -A FORWARD -p tcp --dport 8080 -j ACCEPT

### End Of Script ###

Wednesday, December 15, 2010

OpenKM 5.0 on Ubuntu 10.04

OpenKM is a Knowledge Management System used in document management.

Required is the install of Sun Java JDK 1.6 on Ubuntu 10.04.

We are going to be installing Java with the help of apt-get so, as you can guess, we will be doing this from the command line. So fire up your favorite terminal window and get ready to work.

The first step is to add the necessary repositories to the /etc/apt/sources.list file. So open that file up with your favorite text editor and add the following line to the bottom of that file:

deb http://archive.canonical.com/ lucid partner

Now to update apt, issue the command:

$ sudo apt-get update

Once apt has completed its update, you are ready to install. The actual installation command is:

$ sudo aptitude install sun-java6-jdk

Next is we need to get the install files of OpenKM, download the the zip file OpenKM-5.0_JBoss-4.2.3.GA.zip from http://www.openkm.com/Download.html

Unzip the file and using winscp (http://winscp.net/eng/download.php)
- copy the jboss-4.2.3.GA folder to the Ubuntu /opt directory.

To manually run OpenKM, first go to /opt/jboss-4.2.3.GA/bin directory and run chmod +x *.sh
Then type ./run.sh -b 0.0.0.0 and enter.

Point your favorite browser to http://:8080/OpenKM/
Autenticate to OpenKM using user "okmAdmin" with password "admin"

To Run OpenKM as a Service so that OpenKM will run after a reboot, go to the console of ubuntu
Run $ vi /etc/init.d/jboss

Insert the following lines to the vi editor:
#! /bin/sh
# /etc/init.d/jboss: Start and stop JBoss AS
ECHO=/bin/echo
TEST=/usr/bin/test
JBOSS_START_SCRIPT=/opt/jboss-4.2.3.GA/bin/run.sh
JBOSS_STOP_SCRIPT=/opt/jboss-4.2.3.GA/bin/shutdown.sh

$TEST -x $JBOSS_START_SCRIPT || exit 0
$TEST -x $JBOSS_STOP_SCRIPT || exit 0

start() {
$ECHO -n "Starting JBoss"
sudo $JBOSS_START_SCRIPT -b 0.0.0.0 > /dev/null 2> /dev/null &
$ECHO "."
}

stop() {
$ECHO -n "Stopping JBoss"
sudo $JBOSS_STOP_SCRIPT -S > /dev/null &
$ECHO "."
}

case "$1" in
start)
start
;;
stop)
stop
;;
restart)
stop
sleep 30
start
;;
*)
$ECHO "Usage: jboss {start|stop|restart}"
exit 1
esac

exit 0

#end of script

Make the file executable with
$ sudo chmod 755 /etc/init.d/jboss

Update the run levels with
$ sudo update-rc.d jboss defaults

Done. The OpenKM now runs as a service. You can start OpenKM with
$ sudo ./etc/init.d/jboss start

Last step is to update the database config file to prevent the repositories from being deleted.
$ vi /opt/jboss-4.2.3.GA/OpenKM.cfg

Change the line hibernate.hbm2ddl=create to hibernate.hbm2ddl=none

Note:
From OpenKM 5.x there's a property definition in OpenKM.cfg to create automatically database. Once the tables are created, change the hibernate.hbm2ddl property from create to none. Do it after first time running, in other case all repository it'll be deleted and created in next OpenKM starting

Thursday, October 28, 2010

MRTG On Ubuntu Server

This article will describe how to install and configure Tobi Oetiker’s MRTG (Multi Router Traffic Grapher) on your Ubuntu server. Once configured, you’ll be able to use it to monitor the traffic in and out of your network using the SNMP capability in your network’s gateway/router. MRTG generates static HTML pages containing PNG images which provide a visual representation of this traffic. MRTG typically produces daily, weekly, monthly, and yearly graphs. MRTG is written in perl and works on Unix/Linux as well as Windows. MRTG is free software licensed under the GNU GPL.
So, let’s get started.
Download and Install
First, download and install MRTG using apt-get:
sudo apt-get install mrtg
If this is the first time installing MRTG on your server you’ll likely be presented with the following message. Answering “Yes” means that the default configuration file will be installed with permissions set at 640. Answering “No” means that the permissions are set at 644. In this example we’re going to accept the default Yes. No worries though, if you select No the steps in this tutorial will still work.



MRTG installs a sample configuration file, mrtg.cfg, in /etc. This is the file that will eventually hold the information obtained from your gateway\router. MRTG also creates a directory for the html pages it will serve up at /var/www/mrtg. For a full listing of what MRTG installs and where, run the locate command:
sudo updatedb && locate mrtg
Technically speaking, mrtg.cfg could remain in /etc, but just to keep things tidy, and to help facilitate the startup script that will be created later, let’s create a directory for it and move it into that directory:
sudo mkdir /etc/mrtg && sudo mv /etc/mrtg.cfg /etc/mrtg
That’s it for installing MRTG. Now let’s move on and configure it.
Configure
MRTG includes a script called cfgmaker that will help us populate mrtg.cfg with the information obtained from your gateway/router. But before you run cfgmaker, you should set up the snmp community. This usually involves logging into your gateway/router and enabling SNMP. The default community will typically be “public.” If you change the default community to another name though, make note of it. Now, run the following command, substituting the SNMP community name, if you’ve changed it, and adding the IP address of your gateway/router:
sudo cfgmaker --output /etc/mrtg/mrtg.cfg public@your-router's-IP-address
Next, open mrtg.cfg in a text editor and make sure under Global Configiration Options that “WorkDir: /var/www/mrtg” (under Debian) is uncommented, and under Global Defaults, make sure that “Options[_]: growright, bits” is uncommented. Finally, add the following lines under the Global Defaults section:
RunAsDaemon: Yes
Interval: 5
Logdir: /var/log/
EnableIPv6: no
What does all this do? RunAsDaemon will enable MRTG to run as a daemon. This is beneficial because MRTG is launched only once, thus the parsing of mrtg.cfg file is done only once, not repeatedly as would be the case if one were to run MRTG as a cron task – another acceptable method for running MRTG. Also, when running as a daemon, MRTG itself is responsible for timing the measurement intervals; therefore, we need to add the Interval option and assign it a value – in this case 5 (minutes). This means that every five minutes MRTG will update its graphs.
Speaking of graphs, by default MRTG graphs grow to the left, so by adding the option “growright” the direction of the traffic visible in MRTG’s graphs flips causing the current time to be at the right edge of the graph and the history values to the left of it. We’ve also chosen the “bits” option, which means that the monitored traffic values obtained from your gateway/router are multiplied by 8 and displayed bits per second instead of bytes per second. Finally, we’ve given MRTG a directory to put its log file, and because many routers do not currently support SNMP over IPv6, we’ve shut that off.
Okay, now it’s time to create the web pages which display the MRTG graphs. Run the following command:
sudo mkdir /var/www/mrtg
sudo indexmaker --output=/var/www/mrtg/index.html /etc/mrtg/mrtg.cfg
MRTG has been configured. Let’s start it up and see what it displays
Start
There’s something important to keep in mind when starting MRTG, and that is that MRTG requires the environmental variable “LANG” to be C in order to run properly. Since most Linux systems these days, including Ubuntu server, use UTF-8 (run echo $LANG to see what your system uses), let’s change LANG to C and start MRTG using the following command:
sudo env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
When you run MRTG for the first time you may see a lot of complaints about missing log files. No worries, this is normal for the first 2-3 times you start MRTG this way. If, however, it continues to complain you may want to look into the source of the problem.
Well, that’s it. Now point your browser to http://your-server-address/mrtg and you should see a page that resembles the following. You may have more or less graphs depending on the number interfaces reported by your gateway/router.



Because of the aforementioned options added to mrtg.cfg, you’ll see the graph starting “grow” to the right as the traffic is monitored over time, and the Y axis displayed as bits per second. If you click on any one of these graphs you’ll be taken to another page showing individual graphs for daily, weekly, monthly, and yearly traffic averages, along with the maximum, average, and current bit rate in and out of that particular interface. Only interested in displaying one particular interface? Don’t like the look of the page? No worries, just edit mrtg.cfg and/or /var/www/mrtg until you get it looking the way you want.
Okay, so now that we have MRTG installed, configured and running let’s move on and discuss how to keep it running.
Operate
Starting MRTG by hand is not ideal in the long run. So perhaps after you’ve done some tweaking on MRTG and are satisfied with your results, you can automate the process of running MRTG by creating a startup script in your system startup sequence. Here’s the script that I use:
##### START OF SCRIPT #####
#!/bin/bash

### START OF SCRIPT
MRTG="/usr/bin/mrtg"
CONFIG="/etc/mrtg/mrtg.cfg"
PIDFILE="/etc/mrtg/mrtg.pid"
LOCKFILE="/etc/mrtg/mrtg"
OPTIONS="--daemon"

RETVAL=0

start() {
 echo -n $"Enabling MRTG: "
 rm -f ${LOCKFILE} 2> /dev/null
 env LANG=C ${MRTG} --pid-file=${PIDFILE} --lock-file=${LOCKFILE} ${OPTIONS} ${CONFIG}
 RETVAL=$?
 echo
}

stop() {
 echo -n $"Disabling MRTG: "
 kill `cat ${PIDFILE}` && rm -f ${LOCKFILE}
 RETVAL=$?
 echo
}

restart() {
 stop
 start
}

case "$1" in
 start)
 start
 ;;
 stop)
 stop
 ;;
 restart|force-reload)
 restart
 ;;
 status)
 if [ -f $LOCKFILE ]; then
  echo $"MRTG is enabled."
  RETVAL=0
 else
  echo $"MRTG is disabled."
  RETVAL=3
 fi
 ;;
 *)
 echo $"Usage: $0 {start|stop|status|restart|force-reload}"
 exit 1
esac

exit $RETVAL

###### END OF SCRIPT #####

To use this script simply save it as “mrtg” to your home directory. Now make the file executable and move it to /etc/init.d by running the following command:
chmod +x mrtg && sudo mv mrtg /etc/init.d/
Finally, link the script to the appropriate system run-level. For Debian or Ubuntu this should be 2. In most other Linux distributions, it will typically be 4 or 5.
sudo ln -s /etc/init.d/mrtg /etc/rc2.d/S99mrtg
sudo ln -s /etc/init.d/mrtg /etc/rc2.d/K99mrtg
Now, let’s start MRTG using our script. If it’s currently running then substitute restart for start in the following command:
sudo /etc/init.d/mrtg start
That’s it. Now if for some reason your server is rebooted, MRTG should fire up automatically.
Conclusion
This concludes the article on how to install and configure MRTG on Ubuntu server. As you can see, MRTG isn’t terribly complicated and proves to be a really nice open source package for monitoring and displaying traffic in and out your network from virtually anywhere you have a web browser. For a full list of all the configuration options and other information I encourage you to visit the MRTG web site.
References
http://oss.oetiker.ch/mrtg/doc/index.en.html

Wednesday, July 21, 2010

Install OTRS 2.4 on Ubuntu 10.04 LTS Server

First you need to install LAMP on Ubuntu.

There are only two steps to install OTRS.

Step 1: From the console as root, run:
root@srv1:~# apt-get install libapache2-mod-perl2-dev

Step 2: root@srv1:~# apt-get install otrs2

If you forget to do Step 1, you will encounter an error ...

"dpkg: error processing otrs2 (--configure):
subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
otrs2
E: Sub-process /usr/bin/dpkg returned an error code (1)"

Run the following to fix the error:
root@srv1:~# apt-get install libapache2-mod-perl2-dev

Then purge the otrs install:
root@srv1:~# apt-get purge otrs2

And finally install again otrs
root@srv1:~# apt-get install otrs2

Once the installation is completed, Login to the website of OTRS:
http://[ip address of OTRS Server]/otrs

Username: root@localhost
Password: root