Fedora and linux in general...

RHEL 6.x and Bind/RNDC changes

2011-12-19T11:49:00.002-05:00

I guess I'm a little late to the party, but I just installed RHEL 6.2 and started playing with it. One of the first things I decided to play with was the new version of Bind 9.7.3 and immediately ran into an issue. I hope this will help others should you have the same issue or not read the appropriate documentation ;)

After installing the bind packages and starting up the default configuration I noticed none of the rndc commands worked. It returned an error about no rndc.key / rndc.conf file. Since I've been on RHEL 5.x for so long I was stumped as to why no rndc.key got created after installing bind. After chatting with the folks in the RHEL irc channel they kindly pointed me to an updated bind errata notice on the Red Hat network, which stated they following...

* previously, the bind package generated the /etc/rndc.key file. However,
generating this file used entropy from /dev/random. Consequently, installation
of the bind package might have hung. The rndc.key is used by rndc utility for
advanced administration commands and is no longer automatically generated during
installation of the bind package. Users requiring the rndc utility should
generate key themselves, via the "rndc-confgen -a" command. (BZ#677381)

So on that advice, I ran the rndc-confgen -a command and generated my key. After that, I set the permissions to root.named rw- r-- --- on the rndc.key file and restarted bind. Guess what, it works now ;)

True?

2011-11-18T21:03:00.002-05:00

Almost that time of year...

2011-11-14T13:25:00.001-05:00

I know it's a bit early for holiday cheer, but I just love this app and look forward to running it every year... such old school classic!

Can someone explain this to me? - PART 2

2010-02-04T20:54:00.003-05:00

As a follow up to my earlier post, Red Hat believes in the freedom of choice last I heard. So if I choose to buy an open source virtualization product from a pure open source company then why I am being forced to use a proprietary operating system to control it?

Where is the freedom of choice in that?

Can someone explain this to me?

2010-02-04T20:31:00.002-05:00

How does a pure open source company like Red Hat do something like this? Buy our virtualization products to reduce costs and by the way you'll need a Windows server if you want management capabilities to control everything. Am I not reading this right? The source for this information is the overall datasheet file found here... http://www.redhat.com/f/pdf/rhev/RHEV_Servers_Datasheet.pdf

System Requirements

Management server:

x86 server running US English language version of Windows Server 2003 R2 with SP2, .Net 3.5 or later, Application Server role installed Windows Server 2008 not supported

Management console:
x86 desktop or server running Windows XP SP2 or later, Windows Vista, Windows 7, Windows Server 2003 or later, and Internet Explorer 6-8

The new version of RHN?

2010-01-21T20:08:00.003-05:00

Logged into the Red Hat network tonight and saw this... is this the new improved version?

Dear lazyweb and SELinux gurus...

2010-01-07T16:00:00.005-05:00

UPDATE: The below errors started yesterday after I installed updated packages for selinux-policy and selinux-policy-targeted on RHEL 5.4. I'm pretty confident these updates broke something with Postfix. Anyone else running RHEL see this?

If anyone has ever seen this postfix error before, I could use some help on fixing it:

One of my mailservers running postfix has suddenly stopped sending mail and has been generating the following errors:

Jan 7 12:03:08 postfix/sendmail[3560]: warning: premature end-of-input on /usr/sbin/postdrop -r while reading input attribute name
Jan 7 12:03:08 postfix/sendmail[3560]: fatal: root(0): unable to execute /usr/sbin/postdrop -r: Success
Jan 7 12:10:19 postfix/sendmail[3640]: warning: premature end-of-input on /usr/sbin/postdrop -r while reading input attribute name
Jan 7 12:10:19 postfix/sendmail[3640]: fatal: root(0): unable to execute /usr/sbin/postdrop -r: Success
Jan 7 12:20:04 postfix/sendmail[3675]: warning: premature end-of-input on /usr/sbin/postdrop -r while reading input attribute name
Jan 7 12:20:04 postfix/sendmail[3675]: fatal: root(0): unable to execute /usr/sbin/postdrop -r: Success
Jan 7 13:32:11 postfix/sendmail[3919]: warning: premature end-of-input on /usr/sbin/postdrop -r while reading input attribute name
Jan 7 13:32:11 postfix/sendmail[3919]: fatal: moonpup(500): unable to execute /usr/sbin/postdrop -r: Success

I believe it is an issue between postfix and selinux and think selinux somehow got corrupted. If I put selinux in permissive mode with a setenforce 0 I can send mail with no problem. As soon as I put selinux back into enforcing mode, I can no longer send mail and get the above errors. As an fyi, I installed sendmail and did a quick system-switch-mail to use it and sendmail works fine. I switch back to postfix and it still fails.

Things I have tried to fix this problem, but didn't work.

1) Stopped postfix, uninstalled and reinstalled.

2) Did a complete filesystem relabel with a touch /.autorelabel and reboot.

3) Did a restorecon -F -R on /etc/postfix, /var/spool/postfix and /usr/sbin/post*

Nothing above has worked and have no idea why with selinux disabled postfix works and with it on it fails.

Thanks for any ideas!

Proxies for the Iranian protestors

2009-06-18T19:20:00.003-04:00

I noticed over on planet.ubuntu.com that one user is calling for volunteers to setup anonymous squid proxies to allow the protestors uncensored access to the net. He has nice How-To setup including ACL lists to block access to Iranian government agencies and how to communicate information regarding your proxy. If you have a virtualization setup, this would most likely be an easy and secure way to create the proxy and then take it down later.

If anyone is interested you can find more info on his blog post here...

http://ubuntu-tutorials.com/2009/06/18/create-anonymous-squid-proxy-for-iranian-election-protestors/

Geocaching

2009-06-17T13:38:00.003-04:00

From reading other posts here, I know there are geocachers lurking around. I'm not sure how many of you are familiar with the geomatejr, but this is one slick device. It's geocaching right out the box, and for $69.95 you can't go wrong. I picked one up yesterday and immediately tried it out and it worked awesome, leading me directly to the closet geocache.

It's going to be getting an update kit which will be available soon (July) that will let you update the database and allow software updates. If you're into spontaneous geocaching, just pull this out and fire it up.

Read more about it here... http://www.geomatejr.com

How's your ISP stack up?

2009-06-10T10:22:00.002-04:00

gotta love the .edu pipes!

Say it ain't so...

2009-03-24T08:39:00.002-04:00

I hope this is just bad speculation on the part of investors, but I hope Red Hat does not sell out to Oracle. If there is one company I despise as much as Microsoft, it's Oracle. Please... just say no to an acquisition!!

http://www.reuters.com/article/innovationNews/idUSTRE52M6P020090323

cp -a command bug or selinux bug??

2009-02-18T10:57:00.005-05:00

I'm buidling an NFS installation server and could not get the files from the mounted iso image to copy into the /install directory I created until I spoke to the fine folks in the #rhel channel on freenode. The conclusion was a bug from 2 or 3 years ago that was fixed in Fedora but not RHEL. Why is something so basic and necessary still broken on RHEL? Is it possible this is not a bug and just an outdated man page or incorrect documentation from Redhat?

Let me tell you exactly what I did to cause this problem to happen.

1) [root@habanero /]# mkdir /install
drwxr-xr-x 2 root root 4096 Feb 18 11:06 install

2) mount -ro loop /home/xxxx/isos/rhel-server-5.3-i386-dvd.iso /mnt

3) cp -ar /mnt/. /install
UPDATE: cp -a /mnt/. /install (same errors as below)

4) weeeee, look at the errors - truncated of course :)
cp: cannot create regular file `/install/./EULA': Permission denied
cp: cannot create regular file `/install/./GPL': Permission denied
cp: cannot create regular file `/install/./README-as.html': Permission denied
cp: cannot create regular file `/install/./README-bn.html': Permission denied
cp: cannot create regular file `/install/./README-de.html': Permission denied
cp: cannot create regular file `/install/./README-en': Permission denied
cp: cannot create regular file `/install/./README-en.html': Permission denied
cp: cannot create regular file `/install/./README-es.html': Permission denied

5) now look at the permissions on my /install directory
dr-xr-xr-x 2 root root 4096 Jan 6 17:39 install

6) Now here's the kicker... if I do any of the following, the files copy into the /install directory without issue.

cp -r /mnt/. /install
cp -dpR /mnt/. /install (equivalent of -a)
cp -ar /mnt/. /install (with selinux set to permissive with setenforce 0)
cp -a /mnt/. /install (with selinux set to permissive with setenforce 0)

So I ask you... is this an selinux bug or cp command bug?? Comments more than welcome!

BTW - Redhat documentation states using the command cp -a (just for the record)

Hacker claiming private exploit against kernels > 2.6.24

2008-09-19T13:29:00.002-04:00

Here's a link to a thread I have been following over on the Ubuntu security forums. I'm not sure what the whole story is and how true it is, but is interesting none the less. Hacker claiming he can get root on a server through a private exploit on the kernels > 2.6.24. Give it a read and see what you think.

http://ubuntuforums.org/showthread.php?t=921618

Virtualbox 2.0 hits the scene!

2008-09-05T16:32:00.002-04:00

Talk about a surprise, I recently mentioned that version 1.6.6 just came out and here a couple days after it's release comes 2.0! I wasn't expecting to see version 2.0 for some time, but it's here now so get it while it's hot!

www.virtualbox.org

Amazon to sell OLPC laptops!

2008-09-05T10:20:00.005-04:00

Photo taken from boston.com

This is great news, as I remember the first round of laptop sales were plagued by delivery and fulfillment problems. It appears as though they will have this in place before the holiday season, so hopefully this will increase sales and visibility. Maybe I should I buy one for my daughter and that way I can retire the dying laptop she is using that runs Ubuntu :)

More info here... http://www.boston.com/business/technology/articles/2008/09/05/amazon_to_sell_laptops_from_foundation/

Updated to fix above link :)

The free media program flood gates have opened!

2008-09-04T08:56:00.002-04:00

Holy smokes, I didn't realize that they opened the media program yesterday and this morning I found 479 new messages from the free media email list. It's nice to see such a demand for a great operating system. After checking the media page, it looks like we will accept the first 100 orders or more if we feel ambitious and generous :)

Since I'm new to this group, this was a bit of a shock to see such a volume of requests and I can only imagine what will happen when Fedora 10 hits general release. Anyway, it's all good but I hope the contributors burners do not go up in flames!

Virtualbox 1.6.6 released!

2008-09-03T21:12:00.009-04:00

My favorite virtualization software has been updated once again. It's nice to see that Sun has not bought Virtualbox to just let it sit around and stagnate. I'm so happy that it's being actively developed on, with bug fixes and improvements being made on a regular basis. Personally I think it's a great piece of software and I hope it continues to be successful. If you have not tried it yet, you should!

I've joined the Fedora Free-Media Group!

2008-08-22T10:58:00.002-04:00

Hi eveyone,

I've recently decided to get my feet wet and joined the fedora free-media group. Not much to do right now with the media program currently closed, but I'm sure we'll be busy once Fedora 10 hits the mirrors. Anyway, just wanted to say hello and see if I got this feed thing working correctly :)

Great beginner website for new linux admins

2008-01-07T12:19:00.000-05:00

If you're a new linux admin or just need a quick tutorial, take a look at the below website. I think you will find it quite useful.

http://www.linuxhomenetworking.com/

When YUM goes bad...

2007-11-25T13:40:00.000-05:00

Ever do a 'yum update' from the command line, then after downloading the packages and starting the update it begins to throw errors at you? I have found that this usually means there is something wrong with the cache or the rpm database. The way I have learned to fix this error is simple, just remove the cache and then rebuild the rpm database as root, like this...

rm -rf /var/cache/yum

rpm --rebuilddb

Once those two commands finish, simply run 'yum update' again and things should be working normally.Good luck!

Restoring a frozen ssh session

2007-11-16T12:56:00.000-05:00

If you have ever been logged into an ssh session and had your connection burp and freeze your ssh session, here's a way to get it back without closing the session and opening a new one. Try the following key combination to bring back your locked up ssh session...

ENTER ~ .

(enter key,then shift ~, then period)

This should bring back your ssh session if connectivity comes back. Also, if you were using 'screen' during your ssh session, it would be like you never left and you would be exactly where you were before it locked up :)

Which network interface is which?

2007-11-14T14:45:00.000-05:00

Servers typically have more than one network interface card. In fact, at my company most linux servers have 5 cards. Just the other day we had to troubleshoot network connectivity with a box that we could not get back up on the network. To make matters worse, we had no idea which physical interface was which. This is where 'ethtool' is your best friend. All we did was run the command below and we could see which physical card was giving us the problem.

ethtool -p eth2 5

The result of this command will blink the light on the network card eth2 for 5 seconds. Of course you can set whatever number of seconds you like. Next time you're not sure which card is which, fire up good 'ol ethtool.

Keeping separate history files for users who su to root

2007-11-13T11:39:00.000-05:00

THIS IS NOT INTENDED TO BE USED AS A SECURITY SOLUTION.
If you're like me and work for a company who has many linux admins all logging into servers and then su'ing to root, you may find this tip beneficial. It is simply 3 lines that you add to root's .bash_profile which will keep separate history files for each admin that su's to root and the commands they ran. It will allow you to go back and see what the user did as root. Granted the user could delete the history file, but we are only interested in keeping separate history files and going back to review if necessary. You may need to implement a policy or have an agreement with the admins which states no one will delete the history files.

So if you're ready to try this out, fire up vi and add the below lines to root's .bash_profile

export HISTSIZE=3000
export HISTFILESIZE=5000
export HISTFILE=/root/.bash_hist-$(who am i | awk '{print $1}';exit)

Save the file and you're good to go. Now when an admin logs in, su's to root and logs out; a hidden file will be created in the root directory called .bash_hist-userid

Here's an example:

If user jsmith logged in and then su'd to root, you would see a file called .bash_hist-jsmith in the root home directory after the user logs out. Hope this helps :)

This tip is courtesy of my senior admin Steve V.

Have fun!

How to 'grep' in color

2007-11-13T08:27:00.000-05:00

Have you ever had to grep for words in a log file or document and wish they jumped out at you? Well here's a real easy way to accomplish this by using alias.

Modify the .bashrc file in your home directory by adding the following line:

alias grep='grep --color=auto'

Save the file and log out and back in again. If you don't want to logout just type the above on the command line and hit enter. Now grep a log file for a keyword and see what comes back! Here's what I get when I grep on .i386 in the /var/log/messages file

[root@testbox ~]# cat /var/log/messages|grep i386

Nov 13 07:07:54 testbox yum: Updated: gnome-python2-extras - 2.19.1-10.fc8.i386
Nov 13 07:08:01 testbox yum: Updated: elfutils-libelf - 0.131-1.fc8.i386
Nov 13 07:08:03 testbox yum: Updated: link-grammar - 4.2.5-1.fc8.i386
Nov 13 07:08:27 testbox yum: Updated: tomboy - 0.8.1-3.fc8.i386
Nov 13 07:08:28 testbox yum: Updated: gnome-python2-libegg - 2.19.1-10.fc8.i386