Soviero's questions

We have a cron script meant to run Salt in our environment along with several other steps, but for some reason it isn't executing it at all.

root@salt:~# cat /etc/cron.hourly/salt-apply.sh 
#!/bin/bash

/bin/cat << EOF | /bin/bash 2>&1 > /var/log/salt-apply.log
    /bin/date
    cd /srv/salt
    /usr/bin/git pull
    /usr/bin/salt '*' saltutil.sync_all
    /usr/bin/salt '*' state.apply
    /bin/date
EOF

root@salt:~# ls -l /etc/cron.hourly/salt-apply.sh 
-rwxr-xr-x 1 root root 199 Feb  7 22:47 /etc/cron.hourly/salt-apply.sh

It doesn't run, no errors are present in /var/log/salt-apply.log, and cron does appear to be running the hourly run-parts:

root@salt:~# grep -i cron.hourly /var/log/syslog | tail -n 5
Feb  7 22:17:01 salt CRON[6941]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Feb  7 23:17:01 salt CRON[8817]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Feb  8 00:17:01 salt CRON[10450]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Feb  8 01:17:01 salt CRON[12104]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Feb  8 02:17:01 salt CRON[13761]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)

And yes, the script runs fine if you just execute it at a shell prompt.

Any help would the greatly appreciated. Thanks!

I am passing the following simple shell script to bash on an LXC container:

apt-get update
apt-get install postgresql -y

sudo -u postgres psql -c 'create database dvdrental;'

The actual command I'm using to run it is:

cat sample.sh | lxc-attach -n test-container -- /bin/bash

The reason I'm doing it this way instead of uploading the script into the container and executing that way is that this is just the proof of concept for a much more complex application we're building that has to take commands over stdin and run them in the container.

It seems to work great, except for one thing. It moves onto the psql command while postgresql is still installing, i.e.,

[...]
Get:21 http://archive.ubuntu.com/ubuntu/ trusty/main ssl-cert all 1.0.33 [16.6 kB]
Get:22 http://archive.ubuntu.com/ubuntu/ trusty-updates/main postgresql-common all 154ubuntu1 [103 kB]
Get:23 http://archive.ubuntu.com/ubuntu/ trusty-updates/main postgresql-9.3 amd64 9.3.10-0ubuntu0.14.04 [2,669 kB]
Get:24 http://archive.ubuntu.com/ubuntu/ trusty-updates/main postgresql all 9.3+154ubuntu1 [5,038 B]
Fetched 5,834 kB in 28s (207 kB/s)                                             
Preconfiguring packages ...

    sudo -u postgres psql -c 'create database dvdrental;'
Selecting previously unselected package libroken18-heimdal:amd64.
(Reading database ... 14599 files and directories currently installed.)
Preparing to unpack .../libroken18-heimdal_1.6~git20131207+dfsg-1ubuntu1.1_amd64.deb ...
Unpacking libroken18-heimdal:amd64 (1.6~git20131207+dfsg-1ubuntu1.1) ...
Selecting previously unselected package libasn1-8-heimdal:amd64.
[...]

Note the existence of the sudo -u postgres psql -c 'create database dvdrental;' line in the middle of the output. Interestingly it always shows up right after the downloading portion of the apt-get command is completed...

Anyone know what could be causing this?

logrotate is unable to rotate a log file for our application on CentOS 7. This appears to be because of this AVC error:

type=AVC msg=audit(1441112694.305:19502): avc:  denied  { write } for  pid=9146 comm="logrotate" name="autuitive.log" dev="xvda1" ino=26262388 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file

I passed the error to the audit2allow utility to create a rule to allow it, but when I try to enable the rule, I get the following error:

[root@app1 ~]# semodule -i logrotate.pp
libsepol.print_missing_requirements: logrotate's global requirements were not met: type/attribute logrotate_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

Here is the rule itself that was generated:

[root@app1 ~]# cat logrotate.te 

module logrotate 1.0;

require {
    type logrotate_t;
    type usr_t;
    class file write;
}

#============= logrotate_t ==============
allow logrotate_t usr_t:file write;

Is there a tool in Linux that will take a path such as /var/log/httpd/error_log, and print the permission for each branch of the path, i.e.:

/var:                     root:root,         0755
/var/log:                 root:root,         0755
/var/log/httpd:           www-data:root,     0700
/var/log/httpd/error_log: www-data:www-data, 0644

Such a tool would make permission troubleshooting much easier, especially with exceptionally long paths like on file servers and such.

I would like to add the following lines to all /etc/sudoers files across my environment:

# Administrators LDAP Group
%Administrators   ALL=(ALL)       ALL

However, each server has a different /etc/sudoers file, and sourcing them all from one location would be impractical.

Is there a way in Salt to ensure a single line (or group of lines) exists in a file, rather than managing that whole file?

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file.

I've already tried creating a basic log scrape. E.g.:

log[/var/log/audit/audit.log,type=AVC,"UTF-8",100]

However, it does not work. I believe this is due to the /var/log/audit/audit.log and it's parent folder using the following permissions:

drwxr-x---.  2 root root    4096 Apr 20 04:29 .
drwxr-xr-x. 13 root root    4096 Apr 14 12:07 ..
-rw-------.  1 root root 5948185 Apr 20 15:27 audit.log
-r--------.  1 root root 6291566 Apr 20 04:29 audit.log.1
-r--------.  1 root root 6291704 Apr 19 16:56 audit.log.2
-r--------.  1 root root 6291499 Apr 19 05:22 audit.log.3
-r--------.  1 root root 6291552 Apr 18 17:48 audit.log.4

I would prefer not to change the permissions for security reasons.

Has anyone done log monitoring of /var/log/audit/audit.log using Zabbix? And if so, how?

This question is related to my previous question: Log all commands run by admins on production servers

It is company policy for admins to login to the servers via a personal username, and then run sudo -i to become root. Upon running sudo -i, sudo will create an environmental variable called SUDO_USER, which contains the original user's username.

Is it possible to have auditd include this variable in it's logs for each command? Or a functional equivalent.

This is the current rule set for auditd:

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Log any command run on this system
#-a exit,always -F arch=b64 -S execve
-a exit,always -F arch=b32 -S execve

It is company policy for admins to login to the servers via a personal username, and then run sudo -i to become root. Upon running sudo -i, sudo will create an environmental variable called SUDO_USER, which contains the original user's username.

Is there a way to log ALL commands within syslog with something akin to the following syntax:

${TIME/DATE STAMP}: [${REAL_USER}|${SUDO_USER}]: ${CMD}

An example entry would be:

Sat Jan 19 22:28:46 CST 2013: [root|ksoviero]: yum install random-pkg

Obviously it doesn't have to be exactly the above syntax, it just has to include a minimum of the real user (eg. root), the sudo user (eg. ksoviero), and the full command that was run (eg. yum install random-pkg).

I've already tried snoopy, but it did not include the SUDO_USER variable.

Imagine the following scenario:

    Primary Switch
          |
    (VLAN 3 Port)
          |
   Unmanaged Switch
  (Dedicated to IPMI
      Interfaces)
          |
         / \
        /   \
Server 1    Server 2
 (IPMI)      (iDRAC)

Would the clients on the unmanaged switch automatically become part of VLAN 3 when trying to communicate the the rest of the network?

I just rebooted my monitoring server for the first time in a while, and the following starting filling the screen:

Jul 11 23:52:30 monit kernel: [   25.255908] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
Jul 11 23:52:30 monit kernel: [   25.256170] ata1.00: BMDMA stat 0x24
Jul 11 23:52:30 monit kernel: [   25.256278] ata1.00: failed command: READ DMA
Jul 11 23:52:30 monit kernel: [   25.256410] ata1.00: cmd c8/00:c0:20:68:35/00:00:00:00:00/e0 tag 0 dma 98304 in
Jul 11 23:52:30 monit kernel: [   25.256416]          res 51/40:9f:41:68:35/00:00:00:00:00/e0 Emask 0x9 (media error)
Jul 11 23:52:30 monit kernel: [   25.256809] ata1.00: status: { DRDY ERR }
Jul 11 23:52:30 monit kernel: [   25.256933] ata1.00: error: { UNC }
Jul 11 23:52:30 monit kernel: [   25.304388] ata1.00: configured for UDMA/66
Jul 11 23:52:30 monit kernel: [   25.304430] ata1: EH complete

. . . 

Jul 11 23:52:30 monit kernel: [   25.552451] sd 0:0:0:0: [sda] Unhandled sense code
Jul 11 23:52:30 monit kernel: [   25.552462] sd 0:0:0:0: [sda]  Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
Jul 11 23:52:30 monit kernel: [   25.552475] sd 0:0:0:0: [sda]  Sense Key : Medium Error [current] [descriptor]
Jul 11 23:52:30 monit kernel: [   25.552490] Descriptor sense data with sense descriptors (in hex):
Jul 11 23:52:30 monit kernel: [   25.552498]         72 03 11 04 00 00 00 0c 00 0a 80 00 00 00 00 00 
Jul 11 23:52:30 monit kernel: [   25.552529]         00 35 68 41 
Jul 11 23:52:30 monit kernel: [   25.552543] sd 0:0:0:0: [sda]  Add. Sense: Unrecovered read error - auto reallocate failed
Jul 11 23:52:30 monit kernel: [   25.552559] sd 0:0:0:0: [sda] CDB: Read(10): 28 00 00 35 68 20 00 00 c0 00
Jul 11 23:52:30 monit kernel: [   25.552587] end_request: I/O error, dev sda, sector 3500097
Jul 11 23:52:30 monit kernel: [   25.556607] ata1: EH complete

I already know I need to replace the HDD (Cost of Data > Cost of HDD), but I want to know for my own knowledge what's actually wrong with it.

Yes, our monitoring server has no RAID, just one HDD... Don't look at me...

A standard xinit command looks like this:

xinit /usr/local/bin/app -- :1 vt2

However, I have a command that looks like this:

xinit /usr/bin/xfreerdp -a 16 -u '' -x m -z --disable-wallpaper --disable-full-window-drag --disable-menu-animations --disable-theming --plugin rdpsnd --plugin rdpdr --data disk:Devices:/media/root -- 10.0.0.197 -- :1 vt2

Notice how the command given to xinit uses "--" in-and-of-itself (before the IP)? Well, xinit complains about it:

Fatal server error:
Unrecognized option: 10.0.0.197

How do I get xinit to allow the use of a "--" within the command given to it?

Please note that I thought about moving the sub-command to it's own bash script, but this is for an LTSP server.

I already looked at this thread: Hyper-V and Hyper-threading: On or off?, but the only answer is Windows specific....

I am building a VM server (using Proxmox VE if that makes a difference) and was wondering about how hyper threading can affect virtual machines...

Specifically, if I max out the number of virtual machines, would hyper threading help, or hurt performance?

Also, the largest virtual machines will be a Terminal Server with ~30 clients (4 Cores/8 GB of RAM), and a file server if that helps.

Update: The server is a Dell R410 with a 1TB RAID 10, 32 GB of RAM and Dual Intel Xeon E5530 (I am not sure about the exact model, but it was an E55xx with 2+ Ghz)

Update: Most VMs will be on KVM.

Let's say I bought two Intel Xeon's and installed them into server class hardware... If one CPU failed would the other still function and pick up the slack, therefore providing fault tolerance?

This does not seem very likely, but I figured I would ask instead of making any assumptions.

The standard way to setup a central "/home" directory on a Linux workstation is using NFS. The problem is that I don't like the lack of real security in NFS. So instead I want to try to use SSHFS. SSHFS in-and-of itself works fine, the problem is with mounting it at boot. If I add a line to "/etc/fstab" for the SSHFS share, the workstation complains that it can't contact the SSH server. This is true because the "/etc/fstab" lines are executed before networking is actually up!

Right now I am using the following init script to mount "/home":

#!/bin/sh

# Mounts "/home"  over SSHFS at boot

start () {
    while true; do
        ping -c 1 "10.0.0.200" 1> /dev/null

        if [ "$?" = 0 ]; then
            break
        fi

        sleep 1
    done

    sshfs [email protected]:/home/ /home/ -o transform_symlinks,allow_other,nonempty,hard_remove
}

case "$1" in
    start)
        start
        ;;

    *)
        echo "Usage: $0 {start}"
        exit 1

esac

Basically it pings the SSH server once per second until it can connect, then it mounts the SSHFS share.

My question is: Is there a more direct and less "hack-ish" way to make "/etc/fstab" wait until there is an active network connection before attempting to mount "/home"?

An alternative idea I had, was adding the "sshfs [email protected]:/home/ /home/ -o transform_symlinks,allow_other,nonempty,hard_remove" line as an "post-up" script in "/etc/network/interfaces", but that still feels wrong.

Environment:

Server OS: Ubuntu Server Edition 10.04

Client OS: Ubuntu Desktop 10.04

I want to leave the root user enabled on my servers for convenience, and the only reason people are against the idea (that I know of) is brute-force attacks on SSH.

So, is there is a way in SSH to enable password access for all users except root, but allow ssh-key access for root?

OS: Ubuntu Server Edition 10.04 x86

SSH Version: OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009

Does anyone know where I can find the specs for what each wire inside CAT 6 does? Specifically, which are for sending, and which are for receiving?

Both 100mbit and 1Gbit specs would be useful, thank you in advance...

Lets say I have a forward facing switch, but all the server's NICs are rear facing. What is the proper way to get the CAT cables from the front to the rear of the rack in a way that doesn't open an air-flow hole(s)?

A patch panel seems like overkill to me, but let me know if I am wrong...

In Apache2 is it possible to set multiple ServerNames in one VHost?

I want to setup a "wiki" vhost for an internal wiki.

My network has a ".lan" suffix. How do I get Apache to answer both "wiki" and "wiki.lan" on the same vhost?

I can't afford a 4 post rack right now, but I can afford a 2 post one...

However, you can't mount a server in a 2 post rack because it will break the ears.

Will a 2 post rack support a server (even a really heavy one) if I mount it at the center instead of just the ears?

Aside from space, why use a rack mountable server over a tower server?

Or is space the only reason...

Tower servers are cheaper, more space for cooling, and more expandable... Why rack mount?