i have a command that prints out some statistical information that looks like this:
Detailed Hardware Status Dump:
...
Summary:
Memory info: OK
HDD info: OK
...
I'd like to ./dump_hw_status | grep 'Summary:' so that grep start to output everything from the first line matching 'Summary:'
is there any simple way to do it?
ftp supports the put "|..." "remote-file.name" command to pipe data to an ftp connection. Is there something similar available for sftp?
In sftp i get the following error:
sftp 'jmw@backupsrv:/uploads'
sftp> put "| tar -cx /storage" "backup-2012-06-19--17-51.tgz"
stat | tar -cv /storage: No such file or directory
as above the sftp client doesn't obviously execute the command.
i want to use the pipe command to directly redirect the file stream to sftp. (because there is not enough space left to create a backup file on the same disk before uploading it to sftp server.)
i've setup a forwarding zone on a RHEL6 Bind server like this:
zone "office.local" IN {
type forward;
forward only;
forwarders { 192.168.0.2; 192.168.0.3; };
};
when i try to query using dig @127.0.0.1 monitorsms.office.local i see the following message in the syslog:
client 127.0.0.1#39376: query: monitorsms.office.local IN A + (127.0.0.1)
validating @0x7ff7640357d0: monitorsms.office.local A: bad cache hit (monitorsms.office.local/DS)
google tells me, that there is an issue with DNSSEC, but both servers do not have DNSSEC configured and thus do not send any DNSSEC records.
What's wrong with my configuration?
our office servers offer DNSSEC. I've tested this with dig.
how can i use DNSSEC with my RHEL6 workstation? (there is no bind on it...)
is it possible to add trusted keys to the workstation (i.e. in /etc/resolv.conf )?
Because I just use snmp v3 and want to disable version 1 and version 2c in snmpd.
How can I do this?
We're using mod_security and we have currently issues with some bots.
I would like to block IP Address that visited 404 pages more than 10 times in a minute.
How can this be done? How can I poll the 404 return codes?
How can I count the error 404 return codes in phase 3?
RESPONSE_STATUS may not work as expected in embedded mode, as Apache sometimes handles certain requests differently, and without invoking ModSecurity (all other modules).
How can I get the RESPONSE_STATUS every time for sure? phase 5?
we're using ldap with sssd for the usermanagement, so our users are not in the "/etc/passwd"
Unfortunately, ps just shows the UIDs:
[root@xyz ~]# id jmw
uid=1582(jmw) gid=1582(jmw) groups=1582(jmw), 1000(admins)
[root@xyz ~]# ps aux
[..cutting some output..]
1582 26794 25.0 0.4 190420 38508 ? S 12:15 0:00 /usr/bin/php-cgi -c php.ini
[..cutting some output..]
How can i poll the username, that belongs to a UID? ( a grep ':1582:' /etc/passwd doesn't work ;-) )
we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6:
my first idea was to give the following sudo permissions:
%JBossAdmins ALL=(root) /bin/vi /etc/httpd/*
%JBossAdmins ALL=(root) /bin/vi /etc/java/*
%JBossAdmins ALL=(root) /bin/vi /etc/jboss/*
Obviously, the users can now start the vi as root and then edit any file by executing f.e. :e /etc/passwd
So sudo is not a good idea.
Then it came into my mind to do a chgrp JBossAdmins -R path and then a chmod g+rw -R path.
But i'm not quite sure whether this is a good idea either.
So considering the security implications, what's the best practice allowing a group of users to edit some /etc file? Are there any better alternatives than sudo or chgrp/chmod?
I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config /etc/ssl/openssl.cnf
So far so good, finally let's take a look at the certificate with openssl x509 -noout -text -in myca.crt:
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=DE, ST=Berlin, L=Berlin, O=Org, OU=Unit, CN=My Root CA/[email protected]
Validity
Not Before: Jan 31 14:07:06 2012 GMT
Not After : Dec 18 07:38:50 1905 GMT
Why is the valid to date (not after date) wrong in the certificate? And what can be done to correct this?
Some testing showed, that the overflowing occurs somewhere in January 2038..
i have an lvm snapshot and i would like to see what files have been changed, added or deleted. (Just the file list is sufficient.)
Is there an easy way to get the list?
Thanks in advance for any reply.
Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not)
It must be some kind of packet loss, because from other clients there are no problems. It is just happening from one client to the remote server.
Usually, i messure packet loss with ping, but the remote server is blocking ICMP.
I made a binary TCPDUMP file. How can i see if there is packet loss?
capturing was done on the client. we do not have ssh access to the remote server.
i've used mysql before and i'm now switching to oracle.
I've already created a user in oracle. Now i want to give it "all privileges" for a schema.
In mysql i can give all privileges (DML/DDL) for a schema "mySchema" without grant (DCL) like this:
GRANT ALL PRIVILEGES ON mySchema.* TO 'user';
What's the oracle equivalent?
on my intranet dns server, want to override some addresses.
So basicially, it should forward all resolving requests for the zone mydomain.tld, that are not in the "/etc/named/mydoamin.tld" file to the real DNS servers...
zone "mydomain.tld" IN {
type master;
file "/etc/named/mydomain.tld";
forwarders { 1.1.1.1; 2.2.2.2; 3.3.3.3; };
forward only;
};
how can this be done?
Clarification:
In the file "/etc/named/mydomain.tld" there are - for example - a cupple of records:
abc.mydomain.tld. IN A 192.168.1.2
def.mydomain.tld. IN A 192.168.1.3
ghi.mydomain.tld. IN A 192.168.1.4
jkl.mydomain.tld. IN A 192.168.1.5
and - for example - this records are (not in the file "/etc/named/mydomain.tld" but) in the offical nameservers:
abc.mydomain.tld. IN A 123.123.123.123
www.mydomain.tld. IN A 123.123.123.123
mail.mydomain.tld. IN A 123.123.123.123
so when a client in the intranet asks the intranet nameserver, the namesever should first look at his definitions and then in the case the entry is NOT sepcified, he should ask the official nameservers.
if the client asks for abc.mydomain.tld. the intranet nameserver should return 192.168.1.2...
and if the client asks for www.mydomain.tld. the intranet nameserver should return 123.123.123.123...
I would like to give an ip access to tcp port 3306 for an hour. After that, all connections must be closed.
How can i add a timeout to the following expression?
iptables -A INPUT -m state --state NEW -m tcp -p tcp --source 1.2.3.4 --dport 3306 -j ACCEPT
I'm about to implement my own Certification Authority (CA) for interal use only.
Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted.
What else could be done to enhance the security of the private key?
my wildcard certificate doesn't get accepted with ldap 2.4.23. when i try to connect i get the following error:
TLS certificate verification: subject:
OID.2.5.29.17=DNS:*.domain.com,CN=*.domain.com,OU=LALALA,O=LALALA S.A.,L=LALALA,ST=LALALA,C=XX,
issuer: [email protected],CN=LALALA Root C.A.,O=LALALA,L=LALALA,ST=LALALA,C=XX,
cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256,
cache hits: 0, cache misses: 0, cache not reusable: 0
TLS: hostname (openldap1.domain.com) does not match common name in certificate (*.domain.com).
my certificate is: CN=*.domain.com AND subjectAltName=DNS:*.domain.com
How can I make it so that my certificate is accepted in LDAP?
i've just migrated some xen vms to kvm. so far everything is working fine.
except for one little thing: when i start virtual-manager and looking at the vm's display, there is no login: prompt.
i see, the boot output and everything starts up fine...
i think init, might be pointing to a wrong display.
thanks a lot for any reply...
BTW: i did the migration of the ubuntu hardy vms by hand (followed this tutorial that google returned me). worked like a charm, except for the login prompt on the host's screen.
i would like to limit the number of concurrent open TCP streams from the the same IP to the server's (local) port. Let's say 4 concurrent connections.
How can this be done with ip tables?
the closest thing, that i've found was: In Apache, is there a way to limit the number of new connections per second/hour/day?
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 86400 --hitcount 100 -j REJECT
But this limitation just measures the number of new connections over the time. This might be good for controlling HTTP traffic. But this is not a good solution for me, since my TCP streams usually have a lifetime between 5 minutes and 2 hours.
thanks a lot in advance for any reply :)
i'm using ubuntu 10.10
i've a local backup user called "backup". :)
i would like to give this user just a bandwidth of 1Mbit. No matter which software wants to connect to the network.
this solution limits:
iptables -t mangle -A OUTPUT -p tcp -m owner --uid-owner 1001 -j MARK --set-mark 12
iptables -t mangle -A POSTROUTING -p tcp -m owner --uid-owner 1001 -j MARK --set-mark 12
tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 2 htb default 1
tc filter add dev eth0 parent 2: protocol ip pref 2 handle 12 fw classid 2:6
tc class add dev eth0 parent 2: classid 2:6 htb rate 10Kbit ceil 1Mbit
tc qdisc show dev eth0
tc class show dev eth0
tc filter show dev eth0
the mysql database has arround 2TB of data.
i have a master-slave-slave replication running. the application that uses the database does read (SELECT) queries just on one of the 2 slaves and write (DELETE/INSERT/UPDATE) queries on the master. the application does way more reads, than writes.
if we have a problem with the read (SELECT) queries, we can just add another slave database and tell the application, that there is another salve. so it scales well...
Currently, the master is running arround 40% disk io due to the writes.
So i'm thinking about how to scale the the database in the future. Because one day the master will be overloaded.
What could be a solution there?
maybe mysql cluster? if so, are there any pitfalls or limitations in switching the database to ndb?
thanks a lot in advance... :)