How to configure system services

Quick and clean>>>>>>>>>

Configuration with:

- chkconfig on

management with:

- service start/stop/status/whatever

cheers

Stunnel with Linux

This command will create a TCP SSL Proxy from the port 25443 to 2080

stunnel -p /etc/stunnel/stunnel.pem -D 7 -o /var/log/stunnel4/stunnel.log -A /ca/cacert.pem -d 25443 -f -r 2080

To test the server we can issue the following command

openssl s_client -connect 192.168.56.126:25443

Cheerssss


Del.icio.us

Create a Loopback filesystem from a file. Linux

If you need to have a new filesystem to test some operations on the server or you want a more flexible way of performing snapshots other than volume management, you can use loopback filesystems.

First Step. Create the Loopback file

dd if=/dev/zero of=/apps/test/loop db=1024 count=30720

This will create a 30 Mb file.

Second Step. Create a Loopback device.

First of all we will type

losetup -a

to list the current used devices.

losetup /dev/loop0 /apps/test/loop

Third Step. Create and mount a device.

mkfs -t ext3 -m 1 -v /dev/loop0

mkdir /virt_drive

mount /dev/loop0 /virt_drive

Using NTP for time sync

What is NTP?

It's a time sync protocol that allows IT infrastructures to be one in time.

Why i need it?

When time sync it's a critical factor for the services to work. One clear example is Kerberos and Active Directory. SSO Web infrastructures like Oracle Access Manager require exact time sync in all components, all over the servers.

How does it work?

There are two actors in every ntp scenario:

- Client: is the final consumer of the service, which adecuates it's internal clock to the time set on the server

- Server: It's the reference for the time corrections and synchronization. But also it can act as a client for other servers which are authoritative sources for time sync, like NASA atomic time servers, etc

First of all: Let's configure it.

Configuration is quite simple:

- Server side:

+ Authoritative source: the server will be the main NTP server. No other servers will be requested for time sync.

+ Slave model : server will act as server for the client infrastructure, but also will contact

other time servers in order to have a more accurate referal.

Files for a basic configuration on a Linux NTP server:

+ ntp.conf:

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.
server 127.127.1.0
# local clock
#fudge
127.127.1.0 stratum 10

# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

After that we will start the daemon server.

On a Windows 2003 Server with AD acting as NTP server:

Please check the following registry key setting:

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/W32Time/

TimeProviders/NTPserver/Enabled=1

Next step with Linux

To test the service we will use
ntpdate -d 132.236.56.250

After that we will need to perform an initial sync , with the command:  

ntpdate 192.168.56.101

Once we have both machines synchronized we will start a new task on cron with the command

crontab -e

* * * * * /usr/sbin/ntpdate -s -b -p 8 -u 192.168.56.101

Next step with Windows

Please follow this procedure

Some final words.

This tip is an entry point for NTP configuration, if you need further info, please consider reading other

resources like the following ones:

- http://www.akadia.com/services/ntp_synchronize.html

- http://tldp.org/LDP/sag/html/index.html

- http://www.meinberg.de/english/sw/ntp.htm

A script for counting

This is very easy but, just in case:

for aa in `seq 1 10`; do echo $aa; done

Generic script for managing a Unix service

Create a file with the following contents:

#!/bin/bash
export user_name="root"

export srv_name="serv"
export exec_dir_stop="/home/$user_name/bin/stop_serv.sh"
export exec_dir_start="/home/$user_name/bin/start_serv.sh"

case "$1" in
start)
echo -n "Starting $srv_name Service Daemon"

/usr/bin/sudo -u $user_name $exec_dir_start
;;
stop)
echo -n "Shutting $srv_name Service Daemon"
/usr/bin/sudo -u $user_name $exec_dir_stop
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
;;
esac

Save it with a descriptive name on /etc/init.d (or /etc/rc.d) , for instance http_filter . Change the access rights to the user in charge of managing the service, and create a softlink on the run level you want the service to be started.

How to use ffmpeg to convert a video stream from avi to flv

This is not our usual kind of information but ... here comes an example for trancoding between avi and flv.

ffmpeg -i "e:\ejemplo_chulo.avi" -y -r 25 -b 650000 -f flv -vcodec flv -ab 128 -ar 44100 salidata.flv

For a complete list of video and audio qualities see this link

Curl https client certificate negotiation

Just in case we need to perform continous testing against a https resource that requires certificate authentication:
curl --cert buenokpl.pem --key buenokpr.pem --pass fulano123 -k -v https://www.google.es

Reading socket identifier from proc fs

cd /proc//fd
ls -ltr|grep -i socket
fetch the socket id on the rigth side and do a netstat -ae|grep -i

Getting server certificates with openssl

This recipe is very useful if you need to download the certificate from a server that uses ssl for connection encryption.

With your favorite openssl distribution just type:

openssl s_client -connect 172.16.1.42:22

CONNECTED(00000003)

depth=0 /C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

verify error:num=18:self signed certificate

verify return:1

depth=0 /C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

verify return:1

---

Certificate chain

0 s:/C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

i:/C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIC/DCCAroCBEuLj7EwCwYHKoZIzjgEAwUAMGQxCzAJBgNVBAYTAkVTMQ4wDAYD

VQQIEwVTcGFpbjEPMA0GA1UEBxMGbWFkcmlkMQwwCgYDVQQKEwNzaWExEjAQBgNV

BAsTCXNlZ3VyaWRhZDESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTEwMDMwMTA5NTgw

OVoXDTEwMDUzMDA5NTgwOVowZDELMAkGA1UEBhMCRVMxDjAMBgNVBAgTBVNwYWlu

MQ8wDQYDVQQHEwZtYWRyaWQxDDAKBgNVBAoTA3NpYTESMBAGA1UECxMJc2VndXJp

ZGFkMRIwEAYDVQQDEwlsb2NhbGhvc3QwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEA

/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow

9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7

g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi

64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSvu/o66oL5V0wLPQeCZ1FZV466

1FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64eK7OmdZFuo38L

+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhAAC

gYB6L1euyIcyqIcnDqjNoVxTIbq+hXPGuV7E27j6PkXQdhboJJPvOrBnS7GbCMtP

65IbedsJm+raK5rfCzkUXvrg6/LNM9zs6BNBZBVLiyh2o2ueecGc6hBCUA2WMbGc

6QB3oBIfxAv++//1+knIL1+A26jrBU58AfnNpDK43T1coTALBgcqhkjOOAQDBQAD

LwAwLAIURZdToJ9MjzXze0oCgS280KwsunICFC1Crf4hj1kP7OdZhVXvlP4gCQi1

-----END CERTIFICATE-----

subject=/C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

issuer=/C=ES/ST=Spain/L=madrid/O=xxx/OU=seguridad/CN=localhost

---

Acceptable client certificate CA names

/C=ES/O=Recipes/CN=ca

---

SSL handshake has read 1315 bytes and written 288 bytes

---

New, TLSv1/SSLv3, Cipher is EDH-DSS-DES-CBC3-SHA

Server public key is 1024 bit

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol : TLSv1

Cipher : EDH-DSS-DES-CBC3-SHA

Session-ID: 4B976688585F4BDA3C35765B4F2C6119F90064A77BFCC73D4C2E26A283864204

Session-ID-ctx:

Master-Key: D0D069F3AC2059DA628F55A2847A7EA9744AADBB62FA379D1D480832FB36330A560D93872F75CA340C999733EB0E2F45

Key-Arg : None

Start Time: 1268213384

Timeout : 300 (sec)

Verify return code: 18 (self signed certificate)

---

closed

Mounting an iso file.

No more words needed...
mount -o loop -t iso9660 /var/spool/isoFile.iso /mnt/cdrom

Copy MBR from one disk to another

This command will do the trick:
dd if=/dev/sda of=/dev/sdb bs=512 count=1

Getting Virtualized!!!

I had been looking for a process where you could take an existing physical machine, and convert it into a new virtual one.
There are a few steeps that are needed in order to achive this goal:
- Define a virtualized hardware: CPU, Memory, IO, Networking.
- Export the data: this is the most critical process.
In order to get an vmkd file or vdi of an existing physical instalation consists in a few steps that i will explain here:
- First, boot the operating system with a live linux cd.
- Second, identify the partition or partitions involved in the recovery. For instance hd3
- Third, make a good use of dd like this one:
dd if=/dev/hdc of=/mnt/USB/diskImage/win2k3.img bs=1024
the partition will be dumped into a file.
- Fourth: qemu-img convert -f raw /mnt/USB/diskImage/w2k3.img -O vmdk /mnt/external/diskImage/w2k3.vmdk