coanor's questions

I'm using a CentOS(CentOS release 6.4 (Final)) to upload data to cluster, the bandwidth reached to about 100MByte/s (and the net usage is full). Also, a redis(v=3.2.1) server (0.0.0.0:6379) running to maintain the uploading state. I run the redis-server at backend(not quit after SSH exited):

$ (redis-server redis.conf &)

By login the CentOS from another Linux (name jump-server), sometimes(not always happen, but often), the CentOS will close the SSH client:

Connection to <CentOS-ip> closed by remote host.

with -vvv option added for ssh -vvv root@centos-ip, I get more message when the connection closed by the server:

$ debug3: Wrote 64 bytes for a total of 11549
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
#0 client-session (t4 r0 i0/0 o0/0 fd 4/5 cc -1)

debug3: channel 0: close_fds r 4 w 5 e 6
Connection to <CentOS-ip> closed by remote host.
Connection to <CentOS-ip> closed.
Transferred: sent 8520, received 82248 bytes, in 474.0 seconds
Bytes per second: sent 18.0, received 173.5
debug1: Exit status -1

and the redis-server also gone! I greped the redis.log (DBEUG level), there is no error or crash hint. And I started a sleepy process on the server:

# sleep.py
import time
while 1:
    time.sleep(1)

# run as (python sleep.py &)

after SSH closed, the process gone too!

Why this happen? The messy truth is, all the process I started gone! why?

There may be a lot of reason lead this issue, please give me some hints, and I can supply other info to debug the issue if required. Thanks a lot.

I'm trying to get the disk serial number of disks attached to the Centos server. When there was no raid0 (under LSI), I can get the serial number and model of /dev/sdb by:

smartctl -i /dev/sdb

and the output is:

smartctl 5.43 2012-06-30 r3573 [x86_64-linux-2.6.32-431.el6.x86_64] (local build)
Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
disk Model:       WDC WD4000FYYZ-01UL1B2
Serial Number:    WD-WMC130D3PEZ4
LU WWN disk Id:   5 0014ee 0ae93b565
Firmware Version: 01.01K03
User Capacity:    4,000,787,030,016 bytes [4.00 TB]
Sector Size:      512 bytes logical/physical
disk is:          Not in smartctl database [for details use: -P showall]
ATA Version is:   8
ATA Standard is:  Exact ATA specification draft version not indicated
Local Time is:    Mon Apr 13 15:09:29 2015 CST
SMART support is: Available - disk has SMART capability.
SMART support is: Enabled

But when /dev/sdb behind raid0, the output changed to:

# smartctl -i /dev/sdb
smartctl 5.43 2012-06-30 r3573 [x86_64-linux-2.6.32-431.el6.x86_64] (local build)
Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

Vendor:               LSI
Product:              LSI
Revision:             3.19
User Capacity:        2,999,999,004,672 bytes [2.99 TB]
Logical block size:   512 bytes
Logical Unit id:      0x6234567890abcde01b73bdde67c081d1
Serial number:        00d181c067debd731be0cdab90785634
Device type:          disk
Local Time is:        Fri Apr 17 17:05:47 2015 CST
Device does not support SMART

And the Serial number is no the real serial number labeled on the disk specification, so we can't using it. And I added some parameters of smartctl:

smartctl -i -d sat+megaraid,N /dev/sdb

Here the non-negative integer N (in the range of 0 to 127 inclusive) denotes which disk on the controller is monitored, and I can get the real serial number (another disk, not the one metioned before):

# smartctl -i -d sat+megaraid,0 /dev/sda
smartctl 5.43 2012-06-30 r3573 [x86_64-linux-2.6.32-431.el6.x86_64] (local build)
Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Device Model:     ST3000NM0033-9ZM178
Serial Number:    Z1Z40MVG
LU WWN Device Id: 5 000c50 066d78a8b
Firmware Version: SN02
User Capacity:    3,000,592,982,016 bytes [3.00 TB]
Sector Size:      512 bytes logical/physical
Device is:        Not in smartctl database [for details use: -P showall]
ATA Version is:   8
ATA Standard is:  ACS-2 (revision not indicated)
Local Time is:    Fri Apr 17 17:12:57 2015 CST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Question 1

But when I (only) changed the /dev/sda to /dev/sdb or any other device existed, the output is the same, Is it a bug?

Question 2

The capacity of /dev/sda is only 278.5G:

# lsblk /dev/sda -io name,size -d
NAME   SIZE
sda  278.5G

But when I run smartctl -i -d sat+megaraid,0 /dev/sda, the output of User Capacity is 3TB, NOT the real disk's capacity, and there was no strict map between slot label to N (at least now) but if /dev/sd* not exist, smartctl will fail:

Smartctl open device: /dev/sdx [megaraid_disk_12] [SAT] failed: No such device

It seems like the smartctl only check the disk's existence.

I have 13 disk (include the system disk) attached, how do I get the strict map relation between N and /dev/sd*?

Question 3

I want to get the last serial number and I run smartctl -i -d sat+megaraid,12 /dev/sda, but the output is:

smartctl 5.43 2012-06-30 r3573 [x86_64-linux-2.6.32-431.el6.x86_64] (local build)
Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

Smartctl: Device Read Identity Failed: megasas_cmd result: 0.12 = 0/45

A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.

What 0.12 = 0/45 means here?

My tool working among 100 disks, some of them may attach or detach from the server during the tool running. I want to use disk's UUID as disk's id, and I got the question: If some disk disk_1 got a UUID, say 32c8da8b-e6d5-9a85-5cfc-1a8b59535263. When it's space full, I detached the disk and formatted it (mkfs.ext3), then re-attach to machine, will it's UUID change?

I have created a web service running on protected server(Centos, 123.123.123.123:8192), we can only login to the web server via SSH from a jump server (say 111.111.111.111). I can login the web server via SSH (first login to jump server, then dump to web server). Now I want to make a HTTP request to web server, How do setup the SSH tunnel to make it worker? Or if current limitation impossible, what is most secure way to open a door to make it possible?

Other limitations:

• the web server can only access to database, other out data are disabled (no yum, no ping, e.t.,)
• the jump server's SSH server listen on redefined port, say 32220.
• the user name of web server (ws) and jump server (js) are different.

I have set the following rules in iptables:

sudo iptables -I INPUT -i eth0 -p tcp -s 192.168.37.184 -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE

What I want to do is forward all Mysql traffic data to NFQ, and I wish to detect these data in Suricata, but these iptable rules not working as expected, only part of the data in NFQ goes into Suricata(or only part of data goes into NFQ). but when I set the following iptables:

sudo iptables -I INPUT -j NFQUEUE
sudo iptables -I OUTPUT -j NFQUEUE

This works well, all the packages go into NFQ and all detected by Suricata, but this iptable rule forward all the traffic onto NFQ, and this is not I want.

My question is how to set specific iptables rules only apply to Mysql protocol?