Mallow's questions

Question

When changing network configurations remotely, is there a way for the networking to attempt to use a different configuration file in the case of a failure?

Background - tldr;

I've been searching around but I'm not really seeing any references to doing something like passing a file to ifup, although saying that gave me an idea to check the man page for ifup, but irregardless. I can't test it right now.

Our server has been moved to the datacenter, while I am here working in a different city. Networking is not my strong suit, and after installing I wanted to bond the two nics together to improve throughput. But in doing so I lost connectivity as the networking interface failed initialization.

I had attempted in setting up the bond to have in /etc/sysconfig/network-scripts

bond0 : Taking eth0 and eth1 eth0 : Set up to bond eth1 : Set up to bond and then eth1:1 thinking I can bind an ip to that just in case i do get blocked out again...

Unfortunately this didn't work, and the only person qualified enough to go to the datacenter to do the support is my boss. Not a good situation. (And I had tested it twice on a virtual server just to make sure I wouldn't lost connectivity)

Now, we have it bonded but there is no way to do a "just in case" configuration so far as I can tell...

I thus today needed to bridge the connection for the vm inside the server.... Low and behold, I lost connectivity again and it's the second trip my boss will make this month to the datacenter. :facepalm:

There's gotta be a way, where if the interface isn't detected as up that the networking will use a completely different set of config files, a failsafe, if you will, so that after the failed networking attempt, a cron job running every five minutes would reestablish the network connection to the failsafe if the network is down.

I wish I had access to a linux box right now, but I usually check the network by doing a service network restart command. Is there a way to give it a failsafe command that if the network is not detected, that it will in turn, try a different failsafe configuration, until it is up.

Is there a standard as to how one sets up networking on a Server Host that will have virtual servers within?

In the past I've used virtualmin and set up the nic to have multiple alias such as eth0:1 eth0:2 and linked whatever ip to each of those alias, but in general we routed all our websites through a single IP.

Now we are switching over to a KVM set up where the host virtualizes the physical hardware on each sub server rather than virtualizing a whole new machine/server. While each sub server has a virtualmin installation within. I'm not as familiar with this type of layering and I'm wondering what the best practice for networking are.

I was thinking alone these three lines but would like recommendations of what is a "de-facto" standard on how these are generally set up.

The first method I thought about was where each virtualized server would simply request for their respective IP to the colocation's router. Something like:

I think the pros would be that each server has their own IP and so long as it is tracked, no issues will occur. (We will manage these servers from top to bottom, they are all for our use so I'm not worried as there is no third party that can go change the networking.)

The con is that I have a potential of 4 or more firewall/servers to maintain, but that's part of normal operations anyways and there's no escape from that, period.

My second thought would be to have a set-up similar to what I have here on my Laptop where I virtualize a router (PFSense) and all the virtual computers in the laptop, including the laptop itself, are connected to the router.

The pros I see here is a centralized firewall

The cons I see here is firewall settings are easy to mess up. The virtual servers already have csf+lsd+iptables If the Physical host doesn't have a backup network to connect to the nic and for some reason the PFSense doesn't start up, well the box looses connectivity and therefore the server is down and requires a physical trip to the server farm where it's co-located.

Lastly, although I'm not quite sure how to do this at the moment, but I guess it's similar to giving eth0:1 and eth0:2, I could have the host take all the ips available from the Co-location and then have the host machine allocate each server it's own line connected to it's respective IP.

This is what comes up to my mind but I'm a little too inexperienced/lacking confidence in myself to simply go with these plans without having feedback from people who actually have done this before.

I have a problem

It's been a while since I ran Tripwire. (One Year)

I'm able to make a report. (Takes about 1h30)

But when I run the command to accept the file, it just runs and runs and runs, never asks me for the local passphrase. (It ran for three days now)

 sudo /usr/local/sbin/tripwire --update --accept-all --twrfile /usr/local/lib/tripwire/report/Filenameremoved-20140811-164856.twr 

I had to cancel it because it took our site online.

How can I find out why it's doing this, and how to fix it?

Update

I found the --verbose tag so now I can see it's output

It doesn't seem to be doing nothing now. Lets wait and see if it hangs.

Update #2

24Hrs later. Now that I have the verbose I can see what's going on. It's stopped outputting information. The last entries only say

 Database update: Removing record xyz

The CPU allocated to it is 2.7% instead of 90%. It doesn't visually seem to be doing anything. :(

Update #3

It's still running... One week later... X_x

I've been attempting this for two weeks and I've accessed countless number of sites on this issue and it seems there is something I'm not getting here and I'm at a lost. I manged to figure out how to merge logs from two servers together. (Taking care to only merge the matching domains together)

The logs from the first server span from 15 Dec 2012 to 8 April 2014

The logs from the second server span from 2 Mar 2014 to 9 April 2014

I was able to successfully merge them using the logresolvemerge.pl script simply enermerating each log and > out_putting_it_to_file

Looking at the two logs from each server the format seems exactly the same.

The problem I'm having is producing the stats page for the logs. The command I've boiled it down to is

/usr/share/awstats/tools/awstats_buildstaticpages.pl -configdir=/home/User/Documents/conf/ -config=example.com awstatsprog=/usr/share/awstats/wwwroot/cgi-bin/awstats.pl dir=/home/User/Documents/parced -month=all -year=all -update -buildpdf

In the conf directory I have a filed called: awstats.example.com.conf

 # Name of the logfile
 LogFile=/home/User/Documents/MergedStats/merged_example.com_access_log
 LogType=W
 LogFormat=1
 SiteDomain="example.com"
 HostAliases="REGEX[example\.com$] "
 etc...

Everything Seems in order but the generated stats only show stats from 2 Mar 2014 to 9 April 2014 (The second server's data) I'm not getting the three years data's worth of the first server. At first I thought Awstats was only generating the first month of stats, but the date range is limited to the second server's stats. Even though the merge file contains all of it.

What did I miss?

Update

alxgomz response showed me that the files I wanted were in the dirdata directory I had made. It seems that if you do awstats on a non server it still wants to be served up so I imported those dirdata files to the server however I missing the month of January from the stats. It generated all the way back from 2012 but can't find those records... Could the server maybe not have moved the access logs yet??

Meaning does the main server access_log get parced and spread out to each sub domain by a command or does it Cpanel make all the logs at the same time?

I keep running into this issue when I need to temporarily end a Zope server in order to do something. If I run the script

./bin/zopectrl fg or ./bin/isntance fg

It launches zope's server gets the ports it needs and starts serving. The only way I found to end this command is to do ctrl-z and then disown %1 however once I start it up, the resources it took the first time are blocked from being used again. THe only way I know to fix this is to restart the whole server which is not efficient.

How to I stop the script properly so I can start it up again?

I have a distributed MsAccess front-end database which uses a mysql backend.

It uses the Windows System DSN ODBC connections to connect to the server. All my Linked tables refer to that ODBC connection. The thing is though, they all use the same username and password which is hard-coded into each computer.

What would be a better way to implement it so that each user gets it's login.

Since each DSN Connection is "hard-wired" I don't think that rewriting the registry every time the application starts is a secure way since the moment the app crashes the DSN settings will remain.

I am unaware if I can leave the System DSN without a username and password for a prompt, however we connect to four different databases so I wouldn't want the user to enter their info four times as that would just frustrate the user.

I was thinking maybe I could use the System DSN user as a read only to a user table, or maybe preferably a procedure that would validate the user, except once validated I am unsure how I would subsequently connect every table. Can I store a global variable in the ODBC connection string?

What is a better way to make MsAccess more User Aware?

(I looked into the MSACCESS Security settings however it seems that Microsoft is weening off of that and my attempt to establish it locks me out completely and doesn't present any form of login validation. I guess it just uses the widows login as security but that's not a real solution) And there is a disclaimer here:

Introduction to Access 2010 security (office.microsoft.com)

Access and user-level security

Access does not support user-level security for databases that are created in the new file format (.accdb and .accde files). However, if you open a database from an earlier version of Access in Access 2010 and that database has user-level security applied, those settings will still function.

IMPORTANT Permissions created by using the user-level security feature do not protect your database from users who have malicious intent, and are not intended as a security barrier. It is appropriate to use this feature to improve the usability of a database for trusted users. To help keep your data secure, allow only trusted users to access your database file or associated user-level security files by using Windows file system permissions.

If you convert a database from an earlier version of Access with user-level security to the new file format, Access strips out all security settings automatically, and the rules for securing an .accdb or .accde file apply.

Finally, remember that all users can see all database objects at all times when you open databases that have the new file format.

I am not too familiar with this level of management on a nix server however I am unable to get either the bashrc or bash_profile to source at login.

Details about the server:

• Centos 6.0 - Basic GUI installation
• Virtualmin Server Manager

I am logging in as a user I created in the Virtualmin module through ssh and putty from my windows pc. The .bash_profile has the following in it:

 PATH=$PATH:$HOME/bin
 export PATH

I've created a bin directory in that user's home and placed my application inside however upon log out and log in there is no change. I've tried adding the same two lines in the bashrc file as well when I saw that it wasn't working in the bash profile.

So far I can remedy the situation by typing source .bash_profile but that is tedious. I thought I could save some time by making a bash shell script but alas i cannot simply type in ./script.sh I must type source ~/script.sh in order for it to be effective under the current shell.

How do I get these scripts to load? Is it that virtualmin disables the user profiles? Is logging in via ssh preventing them from loading? Is it that installing Centos 6 with a gui disables profiles loading in terminals regardless of them being tunneled through ssh?

Thank you for the help.

Full contents of Bash Profile:

 # .bash_profile

 # Get the aliases and functions
 if [ -f ~/.bashrc ]; then
         . ~/.bashrc
 fi

 # User specific environment and startup programs


 PATH=$PATH:$HOME/bin
 export PATH