Site moved!

Site has been moved over to tucuche-consulting.com.
Content is still free, but you may contact me for consulting services.

Mac Terminal timeout with SSH - Solved!

If you're like me and have a bajillion things open on your machine, it's a real PITA to have a SSH session timing out after a couple minutes of inactivity. Maybe in certain scenarios this is beneficial, but when I'm on my personal laptop at home, it's not a security risk.

At any rate, it's a really simple fix and it requires the creation/editing of a local user ssh config file.

vi~/.ssh/config

Add lines:

Host *  ServerAliveInterval 60

Save and Exit.

Just tweak some permissions and you'll be good to go.

chmod 600 ~/.ssh/config

That's pretty much it.

Details: http://www.kehlet.cx/articles/129.html

Troubleshooting Cron (Cron not working)

I had a very curious case on a developmental server where after a couple weeks, I realized the cronjobs were not running. The crontab was fine, the scripts and permissions were fine and could be manually executed. Seems like the issue was cron itself.

It took a bit of digging, and there was this obscure line highlighted in the man page. Much thanks to here for pointing me in the right direction.
https://askubuntu.com/questions/23009/why-crontab-scripts-are-not-working

Two things were wrong here.

1. The crond was stalled. Quietly. Check this first and start it if it's stopped. Even if it's running, consider restarting the service.

service crond status
service crond restart

2. Crontab needs an empty/newline at the end of the file in order to load.
My version of crontab does not match the one in the article (I'm on CentOS 6); but the newline was missing at the end. Oddly enough all the other servers that were fine had this blank/newline. Guess it's pretty important, if not documented/deprecated.

At any rate, cron performs important user functions, so consider checking it from time to time.

--EOF

Reset/Update NTP Server

There was an older machine on the network, with an outdated local NTP configuration, and the time was off by a couple minutes. This post shows how to perform a quick update and force sync. Use at your own risk for time sensitive applications.


1. Update the NTP client configuration.

service ntpd stop
vi /etc/ntp.conf

 Find Line
server 192.168.x.x
Change to new server
Save and quit.

 service ntpd start

2.  Force synchronization

 date ; service ntpd stop ; ntpdate 192.168.1.1 ; service ntpd start ; date

In one fell swoop it will give you the current time, stop the service, force an update, start the service and give you the updated time.

Tue Feb 21 11:40:44 AST 2017
Shutting down ntpd:                   [  OK  ]
21 Feb 11:44:28 ntpdate[10457]: step time server 192.168.x.x offset 223.794778 sec
Starting ntpd:                        [  OK  ]
Tue Feb 21 11:44:28 AST 2017

That's it. All updated.

Installing Docker on CentOS 7 (behind corporate proxy)

As part of my research into Percona's new Open Source offering, their Percona Monitoring and Management platform, I realized that a core component is provided via a Docker container. Now I've previously played around with docker on a small scale, but this needed to be done on an actual server environment on the corporate network. There was one little item that caused a brief moment of grief with the proxy, but I eventually sorted it out.

Docker Engine installation on CentOS7

0. Login as root
1. Update machine

yum update

2. Add the Docker yum repo

tee /etc/yum.repos.d/docker.repo <<-'EOF'[dockerrepo]name=Docker Repositorybaseurl=https://yum.dockerproject.org/repo/main/centos/7/enabled=1gpgcheck=1gpgkey=https://yum.dockerproject.org/gpgEOF

3. Install the Docker Engine Package

yum install docker-engine

4. Start the Daemon

systemctl start docker

5. Set to run at boot

systemctl enable docker

6. Verify Operation with simple test

docker run hello-world

**Note: if you're behind a proxy, you may notice an error 
... dial tcp xx.xx.xx.xx:53: getsockopt: connection refused

You may need to do the following

a. create a systemd drop-in directory for the docker service

mkdir /etc/systemd/system/docker.service.d

b. create a proxy configuration file
...in the directory just created, in my case I needed both an HTTP and an HTTPS proxy to get it to work

vi /etc/systemd/system/docker.service.d/http-proxy.conf

Add the following (one line)
[Service]
Environment="HTTP_PROXY=http://your.proxy.ip.addr:port/" "HTTPS_PROXY=http://your.proxy.ip.addr:port/"

Save and exit

c. flush changes

systemctl daemon-reload

d. Verify that the configuration has been loaded:
systemctl show --property=Environment docker

e. Restart Docker:

systemctl restart docker

Verify Operation with simple test (works, yay!)
docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
c04b14da8d14: Pull complete
Digest: sha256:0256e8a36e2070f7bf2d0b0763dbabdd67798512411de4cdcf9431a1feb60fd9
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker Hub account:
 https://hub.docker.com

For more examples and ideas, visit:
 https://docs.docker.com/engine/userguide/

BootCamp: OSX (El Capitan) and Windows 10

The only reason I'm posting this is because I was stuck for a few hours and the internet had tons of conflicting fixes for this that led me nowhere. Still stuck with GPT errors and a whole lot of general bollocks. For some reason this refused to work on the USB port on the left of my macbook and for reasons known only to Job's & Gates' lovechild,  worked on the one located on the right. Sorcery.

This is what worked for me, I can't guarantee that it will work for you and I'm by no means a Mac expert - so use at your own risk. Caveat emptor. No screenshots because of reasons.

What you need:

1. MacBook or other Mac Computer that is listed here: https://support.apple.com/en-us/HT204990
2. Windows 10 64-bit ISO.
3. A fresh USB stick, 8G or more would be fine.
4. At least 100GB free on your Mac for a 64GB Windows install.


What's next?
0. Update your mac if needed.
1. Run bootcamp and select the two options

- Create a Windows 7 or later setup disk

 - Download the latest windows support software from Apple

1.1. Click Continue, grab a beer. or three. This takes a while.

2. Exit bootcamp. Because of reasons.

3. Fire up bootcamp and this time select the option to install (only).

4. Drag a partition size that suits you, I went with 64GB - then click Continue

5. Magic happens then the computer would probably reboot right into OSX. Manually reboot and this time hit the Option Key, Feel free to bang away at it. (Disclaimer: Do not bang away at it.)

6. When presented with boot options, please ignore the Windows option. Select UEFI boot.

7. Oh looky, run through the windows install until you get to the Disk screen. At this point choose your desired windows partition created in step 4 and then click format. The next button magically appears and you should now be able to proceed with installation.

8. Magic happens again, then a couple reboots later and Win 10 is done. Grab another beer. or three.

9. The next time you bring up the dual boot screen, Only OSX and Windows would be presented and the UEFI option is gone.

10. Happy dualbooting. Hell you'd be happy too after six beers.

 

Using Grep to search for a string inside a file

Simple story here really.

I had a borked config somewhere inside my /etc/ folder that was throwing some application errors. It's a development machine with poor documentation so I had to try to figure out where the typo happened.

Grep is a simple, but incredibly powerful command that took care of this quite easily. The flags I used  provided the filenames that contain the matching string as well as the line number where the string is matched. Helpful for fixing or tweaking some borked config or code.

Usage is quite simple:


grep -inr "badconfigurationstring" /searchdirectory

the flags are as follows;
-i = ignore case sensitivity
-n = print line number of matching string
-r = recursively read all files under search directory

more info at the grep man page: http://linux.die.net/man/1/grep

--end.

TurnitinTwo Issues with Moodle 3 on CentOS 6

I recently stumbled upon a Turnitin bug on my Moodle 3 environment where it was simply failing to connect with Turnitin through the configuration interface.


The message was fairly cryptic and the logs even more so.

The error message was simply: "Could not connect to Turnitin, Double check your API URL setting". This was fine, so I looked at the API log, which indicated a "Curl error: Proxy CONNECT aborted", alongside an error 502.

When Turnitin was contacted, they gave this response, which did not work.

If you encounter connectivity issues while using the Turnitin Moodle Direct V2 integration (error: Turnitin API Base URL incorrect or unavailable, or error: Double check your API URL setting) this could be related to a CA certificate being unavailable to cURL. Viewing the Turnitin Apilog files will identify if this is the case.

The Moodle Direct plugin uses the server operating system's implementation of cURL. If cURL has an out of date (or no) CA certificates, the interaction with Turnitin will fail due to cURL performing peer SSL certificate verification and not being able to verify the Turnitin SSL certificate. Until cURL 7.18.0 some CA certificates were provided, but after 7.18.0 no CA certificates have been provided at all. Because of this, the Moodle server administrator would need to ensure that an up to date CA certificate bundle is used.

For Debian and RedHat based distributions:
CA certificates are distributed in the ca-certificates package. Gentoo servers provide them via the app-misc/ca-certificates ebuild. It's also a good idea to make sure that the OpenSSL libraries (libssl) and cURL libraries (libcurl) are up to date on your server.

You will also need to place a file with the Bundle of CA Root Certificates (downloadable from http://curl.haxx.se/ca/cacert.pem) on your webserver and make a curl.cainfo reference to this file in your php.ini.

For Windows based servers:

1. You need to be running PHP 5.3.7 or later.
2. Download https://raw.github.com/bagder/curl/master/lib/mk-ca-bundle.vbs from the Curl repository on GitHub.
3. Open a Command Prompt as Administrator and go to the directory in which you downloaded mk-ca-bundle.vbs .
4. Run mk-ca-bundle.vbs . Accept the default file name and do not include the text information for each certificate.
5. After running this you will end up with a file ca-bundle.crt.
6. Copy that to a known location, e.g. {path}/ca-bundle.crt.
7. Add curl.cainfo={path}/ca-bundle.crt to php.ini. See PHP Runtime Configuration for more details
[PHP]
;;;;;;;;;;;;;;;;;;;
; CURL Settings ;
;;;;;;;;;;;;;;;;;;;
curl.cainfo={path}/ca-bundle.crt
8. Restart the IIS web site

We were eventually able to resolve the issue by a combination of factors:

1. In addition to having an http_proxy environment variable in the operating system, I also needed to explicitly set an https_proxy. This is dependent on if your server currently uses an http_proxy environment variable. Do not make any changes if your server can access the web directly.

vi /etc/bashrc
add linesexport http_proxy=’http://yourproxyip:port/’ export https_proxy=’http://yourproxyip:port/’ save and exit shell

2. The CA-Certificates bundle from curl.hexx.se did not work and resulted in a bunch of errors related to the SSL CA Cert (Message: Problem with the SSL CA cert (path? access rights?)) , so I re-installed the ca-certificates bundle from CentOS repositories.

yum reinstall ca-certificates openssl

3. I then used the “update-ca-trust” package to update the certificate store.

update-ca-trust

4. I removed the Moodle Proxy configuration from the Moodle application interface.

    Dashboard / ► Site administration / ► Server / ► HTTP (Server Proxy section)

Please note that these steps fixed the issue with my particular environment, if you are faced with similar issues I'd suggest starting with steps 2 and 3. If you are having proxy connect issues beforehand, you may try step 1 first.

Good luck and happy moodling!

-Noveck

Merging multiple files using the cat command

Nothing major today, this is a straightforward case that I was surprised would work with the Linux cat command.

I had a folder with several mp3's that were part of one long mixtape but were split into dozens of files, when they should have really been one big file.

I could have used a tool to fix this, but it can be accomplished natively using a Linux or Mac terminal.

First navigate to the folder where the files are located. If they are in numerical order, that's short and easy.

 cat *.mp3 > ../mylongsong.mp3

This combines all the files into one and dumps in one directory above to avoid an endless loop, depending on the shell you're using.


If the files have arbitrary names, but you can figure out the order, you can use a slightly longer command:

cat 1.mp3 2.mp3 a.mp3 myfav.mp3 wow.mp3 > ../mylongsong2.mp3

The caveat is that all the files need to be encoded the same way and be of the same filetype. It will not merge mp3 with wma, it will not merge a 320kbps mp3 with a 128kbps version.

Installing MySQL 5.6 on CentOS 6

MySQL on CentOS6 is currently limited to version 5.1, which sucks. A lot of modern web applications can benefit of running the most recent version of MySQL (up to 5.6 at the writing of this post), and as a result we will be installing MySQL 5.6 on CentOS 6.x, patched to the latest sub-version.

There are several ways of accomplishing this, but I think it's a good idea to take the software directly from the source.

It's also a pretty good idea to have a backup mechanism, and sadly the free version does not play well with hot backups, which are performed while the database is running in full read/write made.

Percona has a wonderful set of tools, and offer a free hot backup solution for MySQL that works awesomely. I'll provide the instructions to install the tool, you can feel free to peruse their docs to implement your own backup strategy :)

More on Percona Xtrabackup here: http://www.percona.com/doc/percona-xtrabackup/2.2/
More on MySQL Community Server here: http://dev.mysql.com/downloads/mysql/


0. Got root/sudo

1. Get and Install the RPM from MySQL/Oracle

cd /tmp
wget  http://dev.mysql.com/get/mysql-community-release-el6-5.noarch.rpm
rpm -Uvh mysql-community-release-el6-5.noarch.rpm

2. Install MySQL and start / enable service

yum install mysql-community-server 
service mysqld start && chkconfig mysqld on

3. Secure MySQL server

./usr/bin/mysql_secure_installation

4.  Install Percona with repos

rpm -Uvh http://www.percona.com/downloads/XtraBackup/XtraBackup-2.2.9/binary/redhat/6/x86_64/percona-xtrabackup-2.2.9-5067.el6.x86_64.rpm

 Verify successful install and check version

xtrabackup --version

--EOF

Pluggable Authentication Modules (PAM) - some basic tricks on CentOS 6

I've been playing around with PAM on a couple distros recently, and I thought I'd share some quick tips and tricks in setting up a secure CentOS 6 Linux multi-user environment. Whilst these are not bulletproof password policies, they are a step beyond the default distribution configuration and are not too complex that the users would be bugging you, the friendly neighbourhood sysadmin.

As usual, any feedback is appreciated, so drop me a line: noveck@woblag.com. Once it gets past the spam filters, I'll try my best to respond asap.

1. Use PAM to disable the use of null passwords in user Accounts.

vi /etc/pam.d/system-auth

Find line 

password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

Remove/delete nullok option, so the line now reads:
password sufficient pam_unix.so md5 shadow try_first_pass use_authtok

save and close file

2. Use PAM to prevent re-using/recycling passwords .

This example prevents the use of the last 3 passwords.

vi /etc/pam.d/system-auth
find line
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

Add to end of line
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=3

save and close file

3. Set password minimum length

This example sets the minimum password length to 8 characters.

vi /etc/pam.d/system-auth

find line
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

Add new line BEFORE
passwd password requisite pam_cracklib.so minlen=8
save and close file

4. Configure server to deny access with multiple incorrect login attempts

This example temporarily denies access after 5 attempts. The temporary lockout time can also be configured for a certain time, which will be set to 1 hour (3600 seconds) in this example.

vi /etc/pam.d/system-auth

Add the following line to end of file
auth required pam_tally.so onerr=fail deny=5 unlock_time=3600

save and close file

--END

Fedora 20 as a (viable!) Windows Desktop Replacement

So I've been bound to windows desktops for so long, that it's been my second nature for workstations. My de facto preference for most server environments are Linux, so I've been between both worlds for quite some time.

My Windows7 machine suffered an OS failure a couple months ago, after almost 4 years of constant everyday use. I installed Windows 8 and was relatively happy with it until it just decided to screw over my WIFI. Nobody messes with my WIFI.

I finally decided to chuck the 15 year Redmond tether and go for broke. I'm gonna run Fedora 20 as a desktop environment, and I'm never looking back. Or so I hope.

Anyhow, FC20 is nice, but to make the environment a bit more aesthetic and a bit more intuitive for use by longtime Windows users I've compiled a "Sanity list". These make everyday use a bit less complicated and quite easy to forget that you're running Linux, traditionally seen as a big, bad, complex beast.

I'll explain why in line, followed by the instructions to accomplish on Fedora 20. This assumes a base Fedora 20 installation has been completed, with a default Gnome desktop.

If you ever decide to take the plunge, this can probably help you break the windows habit ;)

Why Fedora?

Tweak List as of 06-OCTOBER-2014

- install cinnamon, a pretty good looking desktop environment.
This can be selected from the settings icon on the default login screen and it will be the future default afterwards.

sudo yum groupinstall cinnamon

- install infinality, some font eyecandy.
There are a number of styles, I prefer the OSX style on my 4 year old Dell Latitude display

sudo rpm -Uvh http://www.infinality.net/fedora/linux/infinality-repo-1.0-1.noarch.rpm
sudo yum -y install freetype-infinality fontconfig-infinality
cd /etc/fonts/infinality/
./infctl.sh setstyle osx 

(personal pref - more options are in README documentation)

- install MSTTCoreFonts
You have to admit that MS ships with some solid fonts. If you want to avoid formatting issues with opening MS Office docs with LibreOffice, this is a pretty good idea.

sudo yum install cabextract
sudo yum install http://sourceforge.net/projects/mscorefonts2/files/rpms/msttcore-fonts-installer-2.6-1.noarch.rpm

- install vlc
This is another personal preference; VLC is a solid media player and works great on Windows as well as Linux

su -c 'yum localinstall --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm'
sudo yum install vlc

- install flash player
As much as I didn't want to, there are still several sites that I use that are flash based. A necessary evil.

rpm -ivh http://linuxdownload.adobe.com/adobe-release/adobe-release-i386-1.0-1.noarch.rpmrpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-adobe-linuxyum check-updateyum install flash-plugin nspluginwrapper alsa-plugins-pulseaudio libcurl

- install google chrome
Chrome is a great addition to Fedora, compliments the use of Firefox, which I personally find to be a bit bloated now.

cat << EOF > /etc/yum.repos.d/google-chrome.repo
[google-chrome]
name=google-chrome - \$basearch
baseurl=http://dl.google.com/linux/chrome/rpm/stable/\$basearch
enabled=1
gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub
EOF
yum install google-chrome-stable

- install skype
Skype, almost a universal tool for free webcalling. I installed it because I use it a lot for international calling to the US for free.

wget http://download.skype.com/linux/skype-4.2.0.11-fedora.i586.rpmsudo yum install skype-4.2.0.11-fedora.i586.rpm

- install dropbox
I've been using dropbox on all my boxes, it's a great way to keep some personal docs on the cloud and have multiple versions for backup.

cat << EOF > /etc/yum.repos.d/dropbox.repo
[Dropbox]
name=Dropbox Respository
baseurl=http://linux.dropbox.com/fedora/19/
gpgkey=http://linux.dropbox.com/fedora/rpm-public-key.asc
EOF
sudo yum install nautilus-dropbox

- install google talk
I consider this an optional item. You may or may not actually need this.

wget http://dl.google.com/linux/direct/google-talkplugin_current_i386.rpm
yum install google-talkplugin_current_i386.rpm --nogpgcheck

- install teamviewer
TeamViewer is an excellent desktop sharing/control tool that comes in handy to access my laptop remotely if needed.

wget http://download.teamviewer.com/download/teamviewer_linux.rpm

Additional tweaks:

- tweak boot timeout behaviour
Shorten the time to countdown the OS selection

vi /etc/default/grub
GRUB_TIMEOUT=0
GRUB_HIDDEN_TIMEOUT_QUIET=true
grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg

- logind tweaks
These control some suspend/hibernate options when the lid is closed. You can decide if you need these.

vi /etc/systemd/logind.conf
HandleSuspendKey=ignore
HandleHibernateKey=ignore
HandleLidSwitch=ignore
HandlePowerKey=poweroff

- eyecandy that can be installed through the extensions menu
(Settings -> Extensions)
Opacify


That's it for now. I'll add to this post and drop a datestamp with any new additions!

Image courtesy http://www.fedoraproject.org

Fedora 20 - Missing WIFI driver/support on clean install

I've started a little experiment on porting a crashed windows 7 Laptop (Dell Inspiron 1525) over to Linux. Why Linux at this point? The crash was largely due to the infamous Windows Update Issue. For me that was the straw that broke the camel's back.

The experiment part of this update comes from the fact that the user has never really used Linux before, so this is really a true test of the user-friendliness of the OS, once initially set up. My weapon of choice was Fedora 20, largely because I'm entrenched in the RHEL distribution tree for almost everything that I do, so it's naturally easier for me to troubleshoot quickly.

The installation and initial configuration went pretty smoothly, except for the fact that out of the box, WIFI appeared nonexistent. This was not a big problem, as it worked on a Kali Linux Live USB, so I knew that the hardware was fine. From the old install I knew that the device was Broadcom based, so I had a launch point.

Credit to http://wireless.kernel.org/en/users/Drivers/b43 for thoroughly documenting the resolution of this issue.

First check the device for support:
0. As root:
lspci -vnn -d 14e4:

It spat out some device information, including the model, in my case the Broadcom Corporation BCM4312, which was supported by the b43 driver. I compared the output to the corresponding CHIP ID segment on the table
Taken from: http://wireless.kernel.org/en/users/Drivers/b43

PCI-ID	Supported?	Chip ID	Modes	PHY version	Alternative
14e4:4315	yes	BCM4312	b/g	LP (r1)	wl

The Fedora specific instructions are as follows:
1. Install the firmware extractor tool

su -

yum install b43-fwcutter wget

2. Install the driver

Define the Firmware path (Fedora specific)

export FIRMWARE_INSTALL_DIR="/lib/firmware"
Download and extract the Broadcom driver

wget http://mirror2.openwrt.org/sources/broadcom-wl-5.10.56.27.3_mipsel.tar.bz2

tar xjf broadcom-wl-5.10.56.27.3_mipsel.tar.bz2

Install the driver

sudo b43-fwcutter -w "$FIRMWARE_INSTALL_DIR" broadcom-wl-5.10.56.27.3/driver/wl_apsta/wl_prebuilt.o

3. Reboot

These steps were sufficient for me, as soon as I rebooted the WIFI was available to connect. If these steps do not solve your issue, you may need to blacklist older drivers. Take a read here: http://wireless.kernel.org/en/users/Drivers/b43

Maybe I'll break the chains of Microsoft bondage on my own laptop - which oddly enough, works swimmingly on a fresh Windows 8.1 installation. We'll see.

-noveck

Introduction to Linux Systems Administration (a Workshop)

I recently delivered a free 5 (half) day workshop on an Introduction to Linux Systems Administration. The information was culled from a range of web sources, classes and personal notes, so all credit to the respective sources. All practicals were tested on a vanilla CentOS 6.5 Virtual Machine on VMWare Player, which is free for personal use.

At the end of the workshop, I asked the participants to describe what they thought of Linux using one or two words, and this was the result:

I'd like to share the PDF version of the presentation and if you have any feedback, drop me a line. It's very much a work in progress and I welcome your contributions!

-Noveck

Migrating a Virtual Machine from VMWare Player to ESXi

This post covers the migration of a virtual machine from a VMWare Player environment, which is located on my workstation (Windows 7 64-bit), to a VMWare ESXi server in my datacenter.

Both are the free versions, so they don't have all the fancy bells and whistles as the awesome licensed versions.

It took a bit of doing, but it's relatively straightforward.


1. Upgrade VMWare player (if necessary)
I realized that I was using version 3.0, and was a 'few' versions behind. Newer versions contain the OVFTool, which we will use to create the ESXi ready OVF.
Visit here: http://www.vmware.com/products/player


2. Upgrade and Reboot your pitiful workstation.

3. Read the VMWare OVFTool guide. Or not.

4. Login to the Virtual Machine in VMWare Player and uninstall the VMWare Tools. Reboot VM.

5. When VM boots, ignore any driver errors. Do a clean shutdown.

6. Export the OVF from the VM
Open Command Prompt as Administrator
cd C:\Program Files\VMWare\VMWare OVF Tool

Make sure the tool works, run the help
ovftool -h

You should be presented with a range of flag options.

Export the OVF
ovftool "C:\Path to VMname.vmx" "C:\Path to place OVF"
If the output does not look like this, it might be a good idea to check the documentation.

7. Import the OVF Into VMWare ESXi
Login to your ESXi Host
Click File -> Deploy OVF Template
Browse to "C:\Path to place OVF" as specified in step 6.
Use defaults, or configure accordingly.
When completed boot VM in ESXi, enable the network adapter and update the IP/Hostname or any other relevant configuration.

That's it!

Issues with Percona Xtrabackup on CentOS 5/MySQL 5.0

I've got a couple servers that really can't move from CentOS5 / MySQL 5.0 just yet, and while attempting to restore a MySQL InnoDB database backup using percona's innobackupex/xtrabackup, I got the following error (hashtags added, 'cause I can't remember the exact preamble.):


Can't exec "xtrabackup_51": No such file or directory at /usr/local/bin/innobackupex-############

#### fatal error: no 'mysqld' group in MySQL options
 
Absolutely freaking beautiful.

 Turns out that it's caused due to the automatic yum update to  version 2.1.x of the xtrabackup application, which uses the MySQL 5.1+ plugins and fortunately, it's a very quick fix, even though I nearly pulled out what little hair I have to figure it out. Thankfully percona includes the last version with their repo, so it's just to specify the version and it's gonna work again.


0. Got root/sudo

1. Remove existing xtrabackup package.  
yum remove xtrabackup

2. Check that the older version of the package is available from the repo 
yum list | grep percona


3. Specify/Install version 2.0 explicitly (choose based on your OS version!)
yum install percona-xtrabackup-20.x86_64


It's as simple as that! No need to pull out your hair just yet or try to build from source, which is it's own piece of work thanks to cryptic documentation.

To avoid this from happening again, I'd suggest disabling the percona repo when doing a yum update for the entire server, or manually patching the version by calling yum update percona-xtrabackup-20.

Cheerio
-noveck

SSL Secured Apache Webserver

Here's a quick way to run an SSL Secured Webserver. Ideally, a trusted Certificate Authority should be used, but as a proof of concept, we'll be generating our own self-signed certificate.

This assumes a fully functional Apache Webserver running on CentOS Linux.

0. Login as root/sudo into the terminal

1. Install prerequisites
yum install mod_ssl openssl

2. Generate Certificate / Private Key
(or use instructions from trusted CA with a purchased certificate) 
openssl genrsa -out ca.key 1024

3. Generate Certificate Signing Request (CSR)
openssl req -new -key ca.key -out ca.csr

4. Generate Self Signed Key
openssl -x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

5. Copy files to appropriate locations
cp ca.crt /etc/pki/tls/certs
cp ca.key /etc/pki/tls/private/ca.key
cp ca.csr /etc/pki/tls/private/ca.csr

6. For SELinux
restorecon -Rvf /etc/pki

7. Update the Apache SSL config file
vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf

Edit the two entries in the file

SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key

8. Restart Apache
service httpd restart


9. Configure the firewall to accept incoming SSL requests
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
service iptables save
iptables -L –v


10. Test
From a web browser hit https://servername.com and the page should be displayed.


Finito!
Now get some coffee.:)

-noveck

Troubleshooting VNC Connection error

So I'm back out to work after a nice vacation, so I should have seen this coming, right?

When attempting to connect to my VNC Server from my client, a nice error message popped up.
Unable to connect to server.
I managed to ssh into the server, but the VNC Server refused to restart:

[myuser@xxxxxx tmp]# service vncserver restart
Shutting down VNC server: 3:myuser                         [FAILED]
Starting VNC server: 3:myuser
Warning: xxx.xxx.xxx:3 is taken because of /tmp/.X3-lock
Remove this file if there is no X server xxx.xxx.xxx.xxx:3
A VNC server is already running as :3                         [FAILED]







Long story short, I had to delete the lockfile and socket in order to be able restart the VNC Server.

0. Login as root/sudo
1. Remove lock file and socket
rm -rf /tmp/.X3-lock
rm -rf /tmp/.X11-unix/X3

2. Restart vnc service
service vncserver restart

Standalone server reporting with Sar and KSar

Zabbix is a great tool for monitoring and reporting for multiple servers and that installation is covered here. In this instance, Sar and KSar will be used as a standalone data collection tool, as it falls outside the physical and networking reach of my Zabbix server.


Sar is a neat little tool that is part of the sysstat package, more information can be found on the author's website. In my case, we will be using to collect data on CPU, Memory, Swap, Network and all the other metrics that can make or break a Linux based service.

kSar is a separate java based tool that generates some lovely graphs using the collected sar data, because a picture paints a thousand words, or in this case, a graph summarizes a crapload of data.

This tutorial covers the installation of both, as well as a practical usage scenario.

0. Got root/ sudo?



1. Install the packagesyum install sysstat java



2. Set the sysstat cron to run
nano /etc/cron.d/sysstat
Ensure the following lines are active / not commented out. The first line specifies how often the tool should take a snapshot, the second is when the daily summary is processed.


*/10 * * * * root /usr/lib/sa/sa1 1 1
53 23 * * * root /usr/lib/sa/sa2 –A

3. Configure sar to keep a month's worth of data
By default, sar keeps 7 days worth of data. Since we need data monthly, the configuration needs updating.

nano /etc/sysconfig/sysstat

Update line, HISTORY = 7 to now read:
HISTORY = 31

4. Download kSar
Located at http://sourceforge.net/projects/ksar
Create a folder to store kSar and Monthly text files
mkdir /mon
Extract kSar into /mon
Change permissions to make kSar executable
chmod +x /mon/kSar


5. View Daily Server Data (default)
Prep report:
LC_ALL=C sar -A > /mon/sardata.txt

See the graphs
cd /mon/kSarx.x.x/
./run.sh

Click "Data" Menu option -> Load from text file
Select /mon/sardata.txt

6. View Monthly Server Data (see below for actual script)

Prep report:
cd /mon/
./sarprep_monthly.sh
(Ensure script is executable before running!)

See the graphs
cd /mon/kSarx.x.x/
./run.sh

Click "Data" Menu option -> Load from text file
Select /mon/sarmonthly_July.txt (use appropriate month name)

7. All done!

sarprep_monthly.sh
#cleanup old monthly file
rm -rf /mon/sarmonthly_$(date +"%B").txt
#loop through 31 possible days, merge all files into one
for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31; do
LC_ALL=C sar -A -f /var/log/sa/sa$i >> /mon/sarmonthly_$(date + "%B").txt
done


That's it! Til next time...
-noveck