Moshe Shlomovitz - IT Professional

יום רביעי, 26 בפברואר 2014

Setup NFS Server On CentOS 6.X

NFS, Network File System, is a server-client protocol used for sharing files between linux/unix to unix/linux systems. NFS enables you to mount a remote share locally. You can then directly access any of the files on that remote share.

Scenario

In this how-to I use two systems running with CentOS 6.5, but it will work on all CentOS / RHEL / Scientific Linux 6.x distros.


NFS Server IP Address: 192.168.1.250/24

NFS Client IP Address: 192.168.1.251/24

1. Install NFS in Server system

# yum install nfs* -y

2. Start NFS service


# service rpcbind start

# chkconfig rpcbind on

hkconfig nfs on

# service nfs start

# 

c

3. Install NFS in Client System

# yum install nfs* -y

4. Start NFS service


# service rpcbind start

# chkconfig rpcbind on

hkconfig nfs on

# service nfs start

# 

c

5. Create shared directories in server

Create a shared directory named ‘/var/unixmen_share’ in server and let the client users to read and write files in that directory.


# mkdir /var/unixmen_share 

# chmod 755 /var/unixmen_share/

6. Export shared directory on NFS Server

Edit file /etc/exports,

# vi /etc/exports

Add the entry as shown below.

/var/unixmen_share/     192.168.1.0/24(rw,sync,no_root_squash,no_all_squash)

where,

/var/unixmen_share – shared directory

192.168.1.0/24 – IP address range of clients

rw – Writable permission to shared folder

sync – Synchronize shared directory

no_root_squash – Enable root privilege

no_all_squash – Enable user’s authority

7. Restart the NFS service.

# service nfs restart

8. Mount the share directory in client

Create a mount point to mount the share directory ‘var/unixmen_local’ which we created in the earlier step 5.

# mkdir /var/nfs_share

Mount the share from server to client as shown below


# mount -t nfs 192.168.1.250:/var/unixmen_share/ /var/nfs_share/ 

mount.nfs: Connection timed out

Probably it will show a connection timed out error which means that the firewall is blocking NFS server. To allow NFS server to access from outbound, goto NFS server system and add the as shown below in the ‘etc/sysconfig/iptables’ file.

# vi /etc/sysconfig/iptables

Append the following lines shown in red colour.


# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.



*filter

 -A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT  

-A INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT 

 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 892 -j ACCEPT 

-A INPUT -m state --state NEW -m tcp -p tcp --dport 32803 -j ACCEP

T 

-A INPUT -m state --state NEW -m tcp -p tcp --dport 875 -j ACCEPT 

 

-A INPUT -m state --state NEW -m tcp -p tcp --dport 662 -j ACCEP

T

INPUT ACCEPT [0:0]





::FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

tate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j 

-A INPUT -m state --

sACCEPT

-A INPUT -i lo -j ACCEPT

tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with

-A INPUT -m state --state NEW -m

  icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited



COMMIT

Now restart the iptables service.

# service iptables restart

Again mount the share in client system with command:

# mount -t nfs 192.168.1.250:/var/unixmen_share/ /var/nfs_share/

Now the NFS share will mount without any connection timed out error.

9. Verify NFS

Verify the share from the server is mounted or not using ‘mount’ command.

# mount

Sample output:


/dev/mapper/vg_client-lv_root on / type ext4 (rw)




proc on /proc type proc (rw)


devpts on /dev/pts type devpt
sysfs on /sys type sysfs (rw)

s (rw,gid=5,mode=620)


:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

none on /proc/sys
tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_
u/fs/binfmt_misc type binfmt_misc (rw)

rpc_pipefs (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type
 





nfsd on /proc/fs/nfsd type nfsd (rw)


192.168.1.250:/var/unixmen_share/ on /var/nfs_share type nfs (rw,vers=4,addr=192.168.1.250,clientaddr=192.168.1.251)

10. Automount the Shares

To mount the shares automatically instead of mounting them manually at every reboot, add the following lines shown in red colour in the ‘/etc/fstab’ file of your client system.

# vi /etc/fstab


#

# /etc/fstab

# Created by anaconda on Sun Mar 3 22[root@client unixmen]:10:15 2013

#

Accessible filesystems, by reference, are maintained under '/dev/disk'
#

#

  See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

#

dev/mapper/vg_client-lv_root / ext4 defaults 1 1

/
defaults 1 2
/dev/mapper/vg_client-lv_swap swap swap defaults 0 0

UUID=1aa7d041-056b-48f4-a773-f713759e981f /boot ext4

 

tmpfs /dev/shm tmpfs defaults 0 0

devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0


proc /proc proc defaults 0 0

192.168.1.250:/var/unixmen_share/ /var/nfs_share/ nfs rw,sync,hard,intr 0 0

Reboot the client system and check the share whether it is automatically mounted or not.

# mount

Sample output:


/dev/mapper/vg_client-lv_root on / type ext4 (rw)




proc on /proc type proc (rw)


devpts on /dev/pts type devpt
sysfs on /sys type sysfs (rw)

s (rw,gid=5,mode=620)


:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

none on /proc/sys
tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_
u/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)



nfsd on /proc/fs/nfsd type nfsd (rw)


192.168.1.250:/var/unixmen_share/ on /var/nfs_share type nfs (rw,vers=4,addr=192.168.1.250,clientaddr=192.168.1.251)

Thanks to: sk from unixmen

http://www.unixmen.com/nfs-server-installation-and-configuration-in-centos-6-3-rhel-6-3-and-scientific-linux-6-3/

יום שלישי, 4 בפברואר 2014

Power on / off / suspend a virtual machine on an ESXi host from CLI

Get a list of all registered virtual machines, identified by their VMID, Display Name, and path to the .vmx configuration file, using this command:

vim-cmd vmsvc/getallvms
To get the current state of a virtual machine:

vim-cmd vmsvc/power.getstate VMID
Shutdown the virtual machine using the VMID found in Step 2 and run:

vim-cmd vmsvc/power.shutdown VMID

Note: If the virtual machine fails to shut down, use this command:

vim-cmd vmsvc/power.off VMID

4. Suspend the virtual machine:

vim-cmd vmsvc/power.suspend VMID

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1014165

יום ראשון, 2 בפברואר 2014

Change Timezone in CentOS

First, make a backup of the existing localtime file. It’s always good practice to make backups of original config files.

# mv /etc/localtime /etc/localtime.bak

Next, create the link:

# ln -s /usr/share/zoneinfo/Asia/Jerusalem /etc/localtime

Now you just need to test your change. Run “date” from the command line, and ensure that the appropriate time, date, and timezone are reported.

יום חמישי, 23 בינואר 2014

Reset vCenter Appliance root password

To reset the root user password in the vCenter Boot the virtual appliance and navigate to the console for the virtual machine in the vSphere Client. Click in the console and press any key to display the GRUB menu.

Note: The GRUB prompt remains on screen for few seconds before it starts the boot sequence.

On the GRUB menu, select SUSE Linux Enterprise Server for VMware.

Type e to edit the line. A list of items in the GRUB configuration file appears.

Select the line that starts with kernel and type e to edit the line.

At the end of the line, press the spacebar and type init=/bin/sh.

Press Enter to exit edit mode.

On the GRUB screen, type b to boot into single-user mode.

The virtual appliance boots in single-user mode.

To change the root user password, type passwd root and follow the on-screen prompts.

To restart the virtual appliance, type reboot and press Enter.

When the virtual appliance restarts, you can log in using the new password.

יום רביעי, 22 בינואר 2014

Installing & Configuring OpenLDAP Server CentOS 6.5

== Installation ==

yum install openldap-servers openldap-clients

== Configuration ==

Edit your ldap.conf file and enter the IP address or domain name of your server:

vi /etc/openldap/ldap.conf

URI ldap://88.88.88.75

BASE dc=my-domain,dc=com

Copy the sample files from /usr/share/openldap to /etc/openldap and var/lib/ldap

cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

Setup a new LDAP Admin password:

slappasswd

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Copy the encrypted password from STDOUT as it will need to be put in to configuration.

=== /etc/openldap/slapd.conf ===

Search and replace the “dc=my-domain” with “dc=my-domain”
replace the rootpw password with above encrypted password so it looks like

rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Here is the config file in use

#

# See slapd.conf(5) for details on configuration options.

# This file should NOT be world readable.

#

include     /etc/openldap/schema/corba.schema

include     /etc/openldap/schema/core.schema

include     /etc/openldap/schema/cosine.schema

include     /etc/openldap/schema/duaconf.schema

include     /etc/openldap/schema/dyngroup.schema

include     /etc/openldap/schema/inetorgperson.schema

include     /etc/openldap/schema/java.schema

include     /etc/openldap/schema/misc.schema

include     /etc/openldap/schema/nis.schema

include     /etc/openldap/schema/openldap.schema

include     /etc/openldap/schema/ppolicy.schema

include     /etc/openldap/schema/collective.schema

# Allow LDAPv2 client connections.  This is NOT the default.

allow bind_v2

# Do not enable referrals until AFTER you have a working directory

# service AND an understanding of referrals.

#referral   ldap://root.openldap.org

pidfile     /var/run/openldap/slapd.pid

argsfile    /var/run/openldap/slapd.args

loglevel    -1

# Load dynamic backend modules

# - modulepath is architecture dependent value (32/64-bit system)

# - back_sql.la overlay requires openldap-server-sql package

# - dyngroup.la and dynlist.la cannot be used at the same time

# modulepath /usr/lib/openldap

modulepath /usr/lib64/openldap

# moduleload accesslog.la

# moduleload auditlog.la

# moduleload back_sql.la

# moduleload chain.la

# moduleload collect.la

# moduleload constraint.la

# moduleload dds.la

# moduleload deref.la

# moduleload dyngroup.la

# moduleload dynlist.la

moduleload memberof.la

# moduleload pbind.la

# moduleload pcache.la

# moduleload ppolicy.la

# moduleload refint.la

# moduleload retcode.la

# moduleload rwm.la

# moduleload seqmod.la

# moduleload smbk5pwd.la

# moduleload sssvlv.la

# moduleload syncprov.la

# moduleload translucent.la

# moduleload unique.la

# moduleload valsort.la

# The next three lines allow use of TLS for encrypting connections using a

# dummy test certificate which you can generate by running

# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk

# at self-signed certificates, however.

TLSCACertificatePath /etc/openldap/certs

#TLSCertificateFile "\"OpenLDAP Server\""

#TLSCertificateKeyFile /etc/openldap/certs/password

TLSCertificateFile /etc/pki/tls/certs/slapd.pem

TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem

# Sample security restrictions

#   Require integrity protection (prevent hijacking)

#   Require 112-bit (3DES or better) encryption for updates

#   Require 63-bit encryption for simple bind

# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:

#   Root DSE: allow anyone to read it

#   Subschema (sub)entry DSE: allow anyone to read it

#   Other DSEs:

#       Allow self write access

#       Allow authenticated users read access

#       Allow anonymous users to authenticate

#   Directives needed to implement policy:

# access to dn.base="" by * read

# access to dn.base="cn=Subschema" by * read

# access to *

#   by self write

#   by users read

#   by anonymous auth

#

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn.  (e.g., "access to * by * read")

#

# rootdn can always read and write EVERYTHING!

# enable on-the-fly configuration (cn=config)

database config

rootdn      "cn=admin,cn=config"

rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

access to *

    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage

    by * none

# enable server status monitoring (cn=monitor)

database monitor

access to *

    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read

        by dn.exact="cn=Manager,dc=my-domain,dc=com" read

        by * none

#######################################################################

# database definitions

#######################################################################

database    bdb

suffix      "dc=my-domain,dc=com"

rootdn      "cn=Manager,dc=my-domain,dc=com"

# Cleartext passwords, especially for the rootdn, should

# be avoided.  See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

#       secret

#       {crypt}ijFYNcSNctBYg

rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

access to dn.subtree="dc=my-domain,dc=com"

    by self write

    by set="[cn=Administrators,ou=groups,dc=my-domain,dc=com]/member* & user" write

    by set="[cn=Operators,ou=groups,dc=my-domain,dc=com]/member* & user" read

    by * break

access to attrs=userPassword

  by anonymous auth

  by self =rwdx

  by set="user & [cn=Administrators,ou=groups,dc=my-domain,dc=com]/member*" manage

  by dn.children="ou=Special Accounts,dc=my-domain,dc=com" auth

#access to attrs=uid,userPassword,mail

#    by self write

#    by set="[cn=Administrators,ou=group,dc=my-domain,dc=com]/member* & user" manage

#    by set="[cn=Operators,ou=group,dc=my-domain,dc=com]/member* & user" read

#    by * none

#access to *

#  by set="user & [cn=Administrators,ou=groups,dc=my-domain,dc=com]/member*" manage

#  by * break

#access to dn.children="ou=people,dc=my-domain,dc=com"

#  attrs=givenName,sn,displayName,cn,telephoneNumber,fax,postalAddress,homePhone,homePostalAddress,mobile,pager,postalCode,postOfficeBox,preferredLanguage,streetAddress,l,st

#  by self write

#  by * break

#access to dn.children="ou=people,dc=my-domain,dc=com"

#  attrs=uid,uidNumber,gidNumber,mail,telephoneNumber,mobile,departmentNumber,manager,title,initials,givenName,sn,displayName,cn,fax,organizationName,organizationalUnitName,pager,postalAddress,l,st,c

#  by * read

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory   /var/lib/ldap

# Indices to maintain for this database

index objectClass                       eq,pres

index ou,cn,mail,surname,givenname      eq,pres,sub

index uidNumber,gidNumber,loginShell    eq,pres

index uid,memberUid                     eq,pres,sub

index nisMapName,nisMapEntry            eq,pres,sub

overlay memberof

cachesize 10000

checkpoint  1024 15

# Replicas of this database

#replogfile /var/lib/ldap/openldap-master-replog

#replica host=ldap-1.example.com:389 starttls=critical

#     bindmethod=sasl saslmech=GSSAPI

#     authcId=host/ldap-master.example.com@EXAMPLE.COM

create a new file root.ldif with following content

dn: dc=my-domain,dc=com

objectClass: dcObject

objectClass: organization

dc: my-domain

o: my-domain

dn: ou=groups,dc=my-domain,dc=com

ou: groups

objectClass: organizationalUnit

dn: ou=people,dc=my-domain,dc=com

ou: people

objectClass: organizationalUnit

Remove everything in slapd.d dir and tell the slapd for root.ldif file

rm -rf /etc/openldap/slapd.d/*

slapadd -n 2 -l /root/root.ldif

slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d

Set the appropriate permissions:

chown -R ldap:ldap /var/lib/ldap

chown -R ldap:ldap /etc/openldap/slapd.d

Make sure the service is active on the runlevel 3:

chkconfig --level 235 slapd on

service slapd start

== LDAPS ==

cd /etc/pki/tls/certs

rm slapd.pem

make slapd.pem

chmod 640 slapd.pem

chown :ldap slapd.pem

ln -s /etc/pki/tls/certs/slapd.pem /etc/openldap/cacerts/slapd.pem

vi /etc/sysconfig/ldap

SLAPD_LDAPS=yes

vi /etc/openldap/slapd.conf

TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

TLSCertificateFile /etc/pki/tls/certs/slapd.pem

TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem

vi /etc/openldap/ldap.conf

TLS_CACERTDIR /etc/openldap/cacerts

TLS_REQCERT never

== Test ==

Test if everything is up and working fine:

rm -rf /etc/openldap/slapd.d/*

slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d

chown -R ldap:ldap /etc/openldap/slapd.d

service slapd restart

ldapsearch -x -ZZ -h localhost #(TLS)

ldapsearch -x -H ldaps://localhost #(SSL)

Thanks to:

http://rojanu.wordpress.com/2013/07/08/installing-openldap-server/
http://easylinuxtutorials.blogspot.co.il/2013/11/installing-configuring-openldap-server.html