ntpd not booting up on systemd

If ntpd is not booting up after reboot, then disable chronyd.

# systemctl disable chronyd

Then reboot your machine to verify

Hang when mounting nfs share

You have already configured the share in NFS server but when you mount it on the nfs client, the command just hang. To resolve use -o nolock

# mount -t nfs -o nolock 192.168.1.1:/home /home

Install asterisk on CentOS 6

How to install asterisk on CentOS 6. In this tutorial, the version of CentOS 6 is

# cat /etc/redhat-release 
CentOS release 6.4 (Final)

1. Update the environment

# yum install -y epel-release dmidecode gcc-c++ ncurses-devel libxml2-devel make wget openssl-devel newt-devel kernel-devel sqlite-devel libuuid-devel gtk2-devel jansson-devel binutils-devel

2. Install pjproject

# cd /tmp
# wget http://www.pjsip.org/release/2.5.5/pjproject-2.5.5.tar.bz2
# tar -jxvf pjproject-2.5.5.tar.bz2

2.1 Compile pjproject

# cd pjproject-2.5.5
# ./configure CFLAGS="-DNDEBUG -DPJ_HAS_IPV6=1" --prefix=/usr --enable-shared --disable-video --disable-sound --disable-opencore-amr

NOTE: I am installing in an 32bit machine. If you are using 64bit machine, add --libdir=/usr/lib64

# make dep
# make 
# make install
# ldconfig

Verify the pjsip libraries have been dynamically linked

# ldconfig -p | grep pj

3. Install asterisk

# cd /tmp
#  wget http://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-13.8-current.tar.gz
# tar -zxvf asterisk-certified-13.8-current.tar.gz 
# cd asterisk-certified-13.8-cert2
# ./configure

NOTE: If you are using 64bit machine, add --libdir=/usr/lib64 Error encountered

checking for json_dumps in -ljansson... no
configure: error: *** JSON support not found (this typically means the libjansson development package is missing)
#

To resolve, install jansson

# wget http://www.digip.org/jansson/releases/jansson-2.9.tar.gz
# tar -zxvf  jansson-2.9.tar.gz
# cd jansson-2.9
# ./configure
# make
# make install

Go back to asterisk-certified-13.8-cert2 and run ./configure Verify if the pjsip channel driver dependencies have been successfully installed.

# make menuselect

If all res_pjsip has (*) then you are good. Proceed with the installation.

# make 
# make install

You should see the following

 +---- Asterisk Installation Complete -------+
 +                                           +
 +    YOU MUST READ THE SECURITY DOCUMENT    +
 +                                           +
 + Asterisk has successfully been installed. +
 + If you would like to install the sample   +
 + configuration files (overwriting any      +
 + existing config files), run:              +
 +                                           +
 + For generic reference documentation:      +
 +    make samples                           +
 +                                           +
 + For a sample basic PBX:                   +
 +    make basic-pbx                         +
 +                                           +
 +                                           +
 +-----------------  or ---------------------+
 +                                           +
 + You can go ahead and install the asterisk +
 + program documentation now or later run:   +
 +                                           +
 +               make progdocs               +
 +                                           +
 + **Note** This requires that you have      +
 + doxygen installed on your local system    +
 +-------------------------------------------+
#

If you want Asterisk to start at boot time use the following command to setup the Asterisk service. You should have asterisk in /etc/init.d

# make config
# chkconfig --list | grep asterisk
asterisk        0:off   1:off   2:on    3:on    4:on    5:on    6:off

Error Encountered

# asterisk /usr/sbin/asterisk -C /etc/asterisk/asterisk.conf
asterisk: error while loading shared libraries: libjansson.so.4: cannot open shared object file: No such file or directory

Solution

# ln -s /usr/local/lib/libjansson.so.4 /usr/lib/libjansson.so.4
# echo /usr/local/lib > /etc/ld.so.conf.d/asterisk.conf
# ldconfig

Verify if you can locate libjansson.so.4

# updatedb
# locate libjansson.so.4

You should be able to list /usr/lib/libjansson.so.4

Change or Remove Passphrase Key in ssh Private Key

Change or Remove Passphrase Key in ssh Private Keys

# ssh-keygen -p -f private_key
Enter old passphrase:
Key has comment 'private_key'
Enter new passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved with the new passphrase.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

I have an error after I do fdisk on my new disk.

[root@local ~]$

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)

Command (m for help): p

Disk /dev/sdb: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1      243201  1953512001   8e  Linux LVM

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table.
The new table will be used at the next reboot.
Syncing disks.
[root@local ~]$

Solution:

hdparm -z /dev/sdb

How to change crontab editor

How to change the default crontab editor

export VISUAL='vim'

How to identify if your bash shell is vulnerable to Bash Code Injection Vulnerability (CVE-2014-6271) , CVE-2014-7169

This new vulnerable in bash is spreading quickly over the Internet just like the heartbleed. How to know if your bash version is vulnerable?
For Linux

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

For Solaris 10

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

For Solaris 11

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Solution is of course to patch or update to the latest version of bash. Go check out your OS for any updates now.

Starting spamd: child process [22173] exited or timed out without signaling production of a PID file

I upgraded spamassassin and encountered an error when trying to start it.

[root@nelsoncli Mail-SpamAssassin-3.4.0]# /etc/init.d/spamassassin start
Starting spamd: child process [22173] exited or timed out without signaling production of a PID file: exit 255 at /usr/bin/spamd line 2960.
                                                           [FAILED]

Solution: Run sa-update.

httpd: apr_sockaddr_info_get() failed for

Error:

[root@kraken htdocs]# /usr/local/apache2/bin/apachectl start
httpd: apr_sockaddr_info_get() failed for kraken
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[root@kraken htdocs]#

Solution:

Edit your httpd.conf and check the line

ServerName

You may put ServerName <hostname> or Server localhost

gvfs Permission denied

I'm trying to delete a certain file using inum because I could not delete it using the filename. To my surprise, I could not delete it either. The file I'm trying to delete is:

 -rw-r--r-- 1 root root 0 Aug 6 2012 ./?}>L1]?b1?}9?R?#?M???M@ 

 It has an inum of 3932293 so I execute find . -inum 3932293 -exec ls -l {} \; but still could not delete either.

[root@nelsoncli admin]# find . -inum 3932293 -exec ls -l {} \;          
-rw-r--r-- 1 root root 0 Aug  6  2012 ./?}>L1]?b1?}9?R?#?M???M@
find: `./.gvfs': Permission denied

So what the heck is gvfs. I have no time to do a research just that my goal is to delete this file. So I search the web and the solution was to unmount it.

root@nelsoncli admin]# umount /home/admin/.gvfs

After that, I was able now to delete the file.

passwd permission denied even for root on solaris

I tried to reset the password of the local account but encountered an error.

root@foo # passwd 
New Password: 
Re-enter new Password: Permission denied 

I'm a bit confused because I was login as root. I checked /etc/nsswitch.conf and passwd was configured on ldap.

passwd: compat
passwd_compat: ldap

I found out I need to use -r to point passwd to files instead of ldap. So basically, my problem resolved by using passwd -r. If you are wandering what is -r, visit man passwd :-) 

How to manually rotate pacct

If your file /var/adm/pacct is growing rapidly and you want to rotate it manually, you may use either of the below.

1. Use the command /usr/lib/acct/ckpacct. After you execute it, a file pacct1 will be created and an empty pacct.

2. If you have logadm command, you may just execute logadm -p now /var/adm/pacct

Changing permission of /dev/ttyS0 permanently

I've been setting up the Serial Connection of my server to be used for Virtualization. It seems that my Serial Port is not detected on my guest vms. One thing I notice is that /dev/ttyS0 has a permission of

crw-rw---- 1 root dialout 4, 64 Jan 6 2013 /dev/ttyS0 

I added the user on the dialout group and since I'm using CentOS 6, I need to modify files in udev which is /etc/udev/rules.d/40-permissions.rules. and put the content below

KERNEL=="ttyS[0-9]", GROUP="dialout", MODE="0770" 

In case it doesn't exists, you need to create one. Once done, restart udev.

[root@nelsoncli rules.d]# /etc/init.d/udev-post stop 
[root@nelsoncli rules.d]# /etc/init.d/udev-post start Retrigger failed udev events [ OK ] 

Reboot your server to confirm if everything went ok.

_default_ virtualhost overlap on port 443

I'll be setting up a web server where there pages includes authentication. We don't want to use http in logging in some sort of authentication, right? So I enabled virtual hosting on apache on port 80 and 443. However, I'm getting a warning whenever I'm starting apache.

 [warn] _default_ virtualhost overlap on port 443, the first has precedence 

To fix the issue, edit httpd-ssl and put the line below:

NameVirtualHost *:443 

You need to restart or reload apache to take effect the new settings.

I'm setting up stunnel and will be enabling x-forwarded-for patch for it to partner with haproxy. However, I'm having an issue in starting up haproxy.

[root@ZAPATUS stunnel]# /etc/init.d/stunnel start
Starting universal SSL tunnel: stunnelClients allowed=500
stunnel 4.53 on i686-pc-linux-gnu platform
Compiled/running with OpenSSL 1.0.1c 10 May 2012
Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:LIBWRAP Sockets:POLL+IPv6
Reading configuration from file /usr/local/etc/stunnel/stunnel.conf
FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported
str_stats: 5 block(s), 93 data byte(s), 210 control byte(s)
 failed.

To fix, include fips=no on stunnel.conf. Here is the global portion of my stunnel.conf

sslVersion = all
setuid = stunnel 
setgid = stunnel
pid = /tmp/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
fips=no 

Error compiling mod_security

Oh men! Compiling mod_security is hell! I've been trying to compile it for several days now. I successfully compile mod_evasive with a slight issue. Here is my error in mod_security

[root@ip-10-162-54-86 modsecurity-apache_2.6.7]# /usr/local/apache2/bin/apxs -cia apache2/modsecurity.c                        
/usr/local/apache/build/libtool --silent --mode=compile gcc -prefer-pic   -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -g -O2 -pthread -I/usr/local/apache2/include  -I/usr/local/apache/include   -I/usr/local/apache/include   -c -o apache2/modsecurity.lo apache2/modsecurity.c && touch apache2/modsecurity.slo
In file included from apache2/modsecurity.h:38,
                 from apache2/modsecurity.c:19:
apache2/msc_xml.h:21:31: error: libxml/xmlschemas.h: No such file or directory
apache2/msc_xml.h:22:26: error: libxml/xpath.h: No such file or directory
In file included from apache2/modsecurity.h:38,
                 from apache2/modsecurity.c:19:
apache2/msc_xml.h:27: error: expected specifier-qualifier-list before 'xmlSAXHandler'

There has been an issue with apxs. Upon searching in Google, solution was compile it this way

/usr/local/apache2/bin/apxs -cia -n modsecurity -I /usr/include/libxml2 apache2/modsecurity.c 

Viola! modsecurity module was successfully compiled.

semanage command not found

I need to run semanage in one of my Linux box to check the settings of selinux to users. But it seems semanage was not installed

[root@centosprod1 sysconfig]# semanage login -l
-bash: semanage: command not found

I don't have any idea what package to install. libsemanage was installed already. Thank you to yum. Use provides option to yum to find the package for semanage.

[root@centosprod1 sysconfig]# yum provides */semanage
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
libsemanage-devel-2.0.43-4.1.el6.x86_64 : Header files and libraries used to build policy manipulation tools
Repo        : cdrom
Matched from:
Filename    : /usr/include/semanage



policycoreutils-python-2.0.83-19.18.el6.x86_64 : SELinux policy core python utilities
Repo        : cdrom
Matched from:
Filename    : /usr/sbin/semanage



libsemanage-devel-2.0.43-4.1.el6.i686 : Header files and libraries used to build policy manipulation tools
Repo        : cdrom
Matched from:
Filename    : /usr/include/semanage

Based on the output of yum, you need to install policycoreutils-python.

Disabling virbr0

I notice there is virbr0 interface on my CentOS Machine. There is no kvm running on this machine so I guess there is no need for this interface.

virbr0    Link encap:Ethernet  HWaddr 52:54:00:56:BD:B2
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:9410 (9.1 KiB)

To disable, just do the following:

[root@centosprod1 iptables-1.4.7]# virsh net-list
Name                 State      Autostart
-----------------------------------------
default              active     yes

[root@centosprod1 iptables-1.4.7]# virsh net-destroy default
Network default destroyed

[root@centosprod1 iptables-1.4.7]# virsh net-undefine default
Network default has been undefined

[root@centosprod1 iptables-1.4.7]# service libvirtd restart
Stopping libvirtd daemon:                                  [  OK  ]
Starting libvirtd daemon: 16:46:33.012: 2051: info : libvirt version: 0.9.4, package: 23.el6 (CentOS BuildSystem , 2011-12-08-01:26:50, c6b18n3.bsys.dev.centos.org)
16:46:33.012: 2051: warning : virGetHostname:1884 : getaddrinfo failed for 'centosprod1': Name or service not known
                                                           [  OK  ]

virbr0 is now gone. Verify it by running ifconfig -a

[root@centosprod1 iptables-1.4.7]# ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:80:8D:19
          inet addr:10.0.1.101  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe80:8d19/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:743 errors:0 dropped:0 overruns:0 frame:0
          TX packets:708 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:71738 (70.0 KiB)  TX bytes:111377 (108.7 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:78 errors:0 dropped:0 overruns:0 frame:0
          TX packets:78 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6054 (5.9 KiB)  TX bytes:6054 (5.9 KiB)

[root@centosprod1 iptables-1.4.7]# virsh net-list
Name                 State      Autostart
-----------------------------------------

apu library not found

I'm compiling mod_security to patch with apache. However, I encountered the following when patching mod_security with the command apxs on the apache.

checking for libapu config script... no
configure: *** apu library not found.
configure: error: apu library is required

Solution:
Install apr-util-devel. I install it via yum and this resolves the error.

yum -y install apr-util-devel

bind mysql port to an ip address

I've been setting up servers for so many times and it was been my habit that all my applications/services should be listening on one of server's ip address. I just installed MySQL and by default, it listen to 0.0.0.0. Server's ip address is 10.0.1.101 and I would like to listen it to that ip address instead of 0.0.0.0. To change this, you should have an entry bind-address on your /etc/my.cnf.

bind-address=10.0.1.101

You should restart mysqld. Reloading mysqld would not work. I tried it but it didn't work I guess I need to stop also all applications writing to the database.

[root@centosprod1 ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 10.0.1.101:22               0.0.0.0:*                   LISTEN      21154/sshd
tcp        0      0 127.0.0.1:32000             0.0.0.0:*                   LISTEN      18834/veaintf
tcp        0      0 0.0.0.0:5634                0.0.0.0:*                   LISTEN      17820/xprtld
tcp        0      0 10.0.1.101:3306             0.0.0.0:*                   LISTEN      21376/mysqld
tcp        0      0 :::5634                     :::*                        LISTEN      17820/xprtld
udp        0      0 0.0.0.0:68                  0.0.0.0:*                               1092/dhclient