Mark C Allen - Linux Articles

Fixing SELinux Content in a HTML directory

mallen — Sat, 13 Sep 2008 13:51:10 -0700

Problem

Getting a 403 forbidden error message when accessing a new file or directory in /var/www/html.

Check /var/log/messages to see if there are any:

Sep 13 13:11:28 fserver02 kernel: audit(1221336688.892:14): avc: denied { getattr } for pid=25036 comm="httpd" name="phpldapadmin" dev=dm-0 ino=2441537 scontext=root:system_r:httpd_t tcontext=root:object_r:user_home_t tclass=dir

Solution

First check the context on the root directory.

cd /var/www/html
ls -Z index.html
-rw-r--r-- root     root     root:object_r:httpd_sys_content_t index.html

Look at the context of the new directory or file

ls -Z index.php
-rw-r--r-- root     root     root:object_r:user_home_t index.php

Now change the file or directory to the correct context

chcon root:object_r:httpd_sys_content_t . -Rc

Check the context of the file:

ls -Z index.php
-rw-r--r-- root     root     root:object_r:httpd_sys_content_t index.php

Setting up VNCServer

mallen — Sun, 25 May 2008 11:13:21 -0700

Initialize

Startup vncserver for the first time on port 5910 (:10) and set the password.

[root@localhost ~]# vncserver :10

You will require a password to access your desktops.

Password:
Verify:
xauth:  creating new authority file /root/.Xauthority

New 'localhost.localdomain:10 (root)' desktop is localhost.localdomain:10

Creating default startup script /root/.vnc/xstartup
Starting applications specified in /root/.vnc/xstartup
Log file is /root/.vnc/localhost.localdomain:10.log

[root@localhost ~]#

Configure

Edit ~/.vnc/xstartup and change the session manager to

gnome-session - for Gnome
startkde - for KDE

#!/bin/sh

# Uncomment the following two lines for normal desktop:
# unset SESSION_MANAGER
# exec /etc/X11/xinit/xinitrc

[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
gnome-session &

Restart vncserver

[root@localhost .vnc]# vncserver -kill :10
Killing Xvnc process ID 2844
[root@localhost .vnc]# vncserver :10

New 'localhost.localdomain:10 (root)' desktop is localhost.localdomain:10

Starting applications specified in /root/.vnc/xstartup
Log file is /root/.vnc/localhost.localdomain:10.log

[root@localhost .vnc]#

Configure IPTables

Edit /etc/sysconfig/iptables and add

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5910 -j ACCEPT

Restart iptables

[root@localhost ~]# /etc/init.d/iptables restart
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]
[root@localhost ~]#

Accessing

Open a VNC client and go to :10

Enter the password.

Copying directories between file systems

mallen — Sat, 16 Feb 2008 20:55:12 -0800

cd /old_file_system/

find . -print -depth | cpio -pamVd /new_file_system/

Link down on RedHat Linux 3

mallen — Sat, 16 Feb 2008 20:55:38 -0800

On RedHat Enterprise 3 Linux on VMWare each interface link is always down.

The following needs to be added to all the ifcfg-eth in /etc/sysconfig/networking-scripts/

check_link_down() {
return 1;
}

See http://www.vmware.com/support/guestnotes/doc/guestos_redhat90.html for more information.

Getting https pages with Perl

mallen — Sat, 16 Feb 2008 20:55:24 -0800

Configure CPAN

The first thing to do is to setup perl to manage modules using CPAN. As root run:

perl -MCPAN -e shell \;

run through the configuration if you haven't done so.

Install LWP

Inside the CPAN shell run:

install LWP

This will install all then necessary modules for accessing websites. Make sure you select y for GET, POST and HEAD, these are great scripts for getting at web page information from the command line.

Install OpenSSL

If you don't have openssl-devel installed on your system you will need to install it. Check using:

rpm -q openssl-devel

Install openssl-devel with up2date:

up2date openssl-devel

Install Crypt-SSL

Install Crypt-SSL with perl:

perl -MCPAN -e shell \;

inside the shell run:

install Crypt::SSLeay

Test

GET https://www.markcallen.com

Setting up VMware Server on Linux

mallen — Fri, 18 May 2007 11:45:45 -0700

Pre-Setup

Download VMware server rpm for Linux from http://www.vmware.com and register for a free serial number. The current version is 1.0.3.

Setup access to the server. See Installing Cygwin for Windows XP for instructions on how to setup access to the linux server.

Installation

Log into the linux server

ssh linux01
cd /media/usbdisk/source/vmware/server/linux/1.0.3
su

Install the RPM

rpm -ivh VMware-server-1.0.3-44356.i386.rpm

Configure VMware

As root run:

/usr/bin/vmware-config.pl

Accept the End User License.
Accept the default directory for mime type icon.
Accept the default desktop menu entry files
Accept the default for application's icons
Networking for Virtual Machines: yes
Ethernet network: eth0
NAT networking: yes
Probe for private subnet: yes
Host-only network: yes
Probe for private subnet: yes
Accept default for remote console connections
Accept default direction for virtual machine files
Enter the VMware serial number you received when you downloaded vmware server.

Verify that vmware will startup when the server reboots. As root run:

/sbin/chkconfig --list vmware
vmware          0:off   1:off   2:on    3:on    4:off   5:on    6:off

Install VMware Console on Windows

Download VMware console for windows from http://www.vmware.com

On the windows workstation install the server:

Double click on VMware-console-1.0.3-44356.exe
Accept the End User Agreement.
Accept the default installation location.

Configure the Console

Double click on the VMware Server Console icon on the windows desktop.

In the Connect to Host dialog box enter the hostname, username and password.

Creating a new linux file system

mallen — Sat, 16 Feb 2008 20:54:55 -0800

Partition Table

# /sbin/fdisk /dev/sdc

The number of cylinders for this disk is set to 60801.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): d
Selected partition 1

Command (m for help): p

Disk /dev/sdc: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id System

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-60801, default 1): 1
Last cylinder or +size or +sizeM or +sizeK (1-60801, default 60801):
Using default value 60801

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table.
The new table will be used at the next reboot.
Syncing disks.
#

Format the new Partition

Formatted as ext3

# /sbin/mkfs -t ext3 -j /dev/sdc1
mke2fs 1.35 (28-Feb-2004)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
61063168 inodes, 122096000 blocks
6104800 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=125829120
3727 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
        102400000

Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 36 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
#

Setting up PXE

mallen — Sat, 16 Feb 2008 20:54:02 -0800

The following is a good starting point:

http://www.redhat.com/docs/manuals/enterprise/RHEL-3-Manual/sysadmin-guide/ch-pxe.html

Disk Performance

mallen — Sat, 16 Feb 2008 20:54:16 -0800

To measure the current performance of your disk run:

hdparm -tT /dev/sda

You will get something like:

/dev/sda:
Timing cached reads: 896 MB in 2.01 seconds = 446.06 MB/sec
Timing buffered disk reads: 168 MB in 3.01 seconds = 55.77 MB/sec

Updating VMware Server Serial Number

mallen — Sat, 16 Feb 2008 20:54:31 -0800

Get the serial number from http://www.vmware.com

Open up the VMware Server Console on the windows machine and login to the linux server as root.

Click on Help -> Enter Serial Number

Enter all the information required.

No output from the Console when connecting to a Server running on Linux

mallen — Sat, 16 Feb 2008 20:53:20 -0800

The problem is that the vmx file is not executable. Go to the VM directory and run:

chmod 755 *.vmx

Then restart the vmware server, output will then be displayed on the console.

Syslogd Stops working after installing VMWare Server

mallen — Sat, 16 Feb 2008 20:53:12 -0800

Seems that VMWare server adds a new service to the /etc/service file. If you have SELinux running the file's security context changes.

To fix run:

/sbin/restorecon /etc/services

For more information see
http://www.vmware.com/community/thread.jspa?messageID=435464

Mounting ISO in Linux

mallen — Sat, 16 Feb 2008 20:53:03 -0800

To mount an ISO file in linux so it turns up as a directory structure do the following:

mount -o loop -t iso9660 filename.iso /mnt/iso

Simple as that.

Unable to use Mac OS X FTP

mallen — Sat, 16 Feb 2008 20:53:41 -0800

Problem

When trying to use the Mac OS X ftp client the following error occues when trying to list the files on the ftp server.

ftp> ls
229 Entering Extended Passive Mode (|||37628|)
502 Illegal EPRT Command
200 PORT command successful.

421 Service not available, remote server timed out. Connection closed
ftp>

Solution

Issue a epsv4 command to turn EXPV/EPRT on IPv4 off.

ftp> epsv4
EPSV/EPRT on IPv4 off.
ftp> ls
227 Entering Passive Mode (64,40,110,153,254,46)
150 Opening ASCII mode data connection for /bin/ls.
total 64
srwxrwxrwx   1 mysql    other          0 Jun 23 12:27 mysql.sock
-rw-rw----   1 mysql    other        849 Jun 23 12:27 sh2600
-rw-r--r--   1 root     other         10 Jul 14 11:29 time
drwxrwxr-x   2 root     root         176 Jun 23 12:27 .X11-pipe
drwxrwxr-x   2 root     root         176 Jun 23 12:27 .X11-unix
226 Transfer complete.
ftp>

Setting up ntpd

mallen — Sat, 16 Feb 2008 20:53:31 -0800

On a Redhat system (Redhat, CentOS, Fedora or Oracle Linux) edit the /etc/sysconfig/ntpd file:

Change:

SYNC_HWCLOCK=no

SYNC_HWCLOCK=yes

Add:

-x to OPTIONS so that the clock will be set every time ntpd is started

OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid -x"

Now make sure that ntpd is running

/sbin/chkconfig --level 2345 ntpd on

/sbin/service ntpd start