Formating and mouting a disk

Formating and mouting a new disk in Linux system.

In cPanel server we can take backups in /backup folder. For this we can purchase a new disk and formate and mount to your existing system. So the backup space will be added in the new disk.


Step 1: We need to find out the new disk attached to our system.

# fdisk -l

Disk /dev/sda: 1999.9 GB, 1999978364928 bytes
255 heads, 63 sectors/track, 243150 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1          13      104391   83  Linux
/dev/sda2              14        6387    51199155   83  Linux
/dev/sda3            6388        6897     4096575   83  Linux
/dev/sda4            6898      243150  1897702222+   5  Extended
/dev/sda5            6898       10084    25599546   83  Linux
/dev/sda6           10085       10594     4096543+  82  Linux swap / Solaris
/dev/sda7           10595       10849     2048256   83  Linux
/dev/sda8           10850      243150  1865957751   83  Linux

 Disk /dev/sdb: 500 GB, 16139354112 bytes

/dev/sdb new partition will not have a partition. 

Step 2:

Check new disk is already mounted

# df

If the new device is mounted you can unmounted this
# umount /dev/sdb

Step 3:

Create a new partition in" /dev/sdb"

A) # fdisk /dev/sdb

A console will be prompted and

Press "n"  make new partition
Press Enter Button
Preess P button to create a new partition(primary)
Press 1
Press Enter Button
Press Enter Button for First and last cylinder. This will make the entire disk as a single partition.
Press t button   To change the file system typr
Press  Enter Button
Press L  button to see all list
type 83 for Linux
Press Enter Button
press w  Button
Press  Enter Button

This will create a new partition on your /dev/sdb disk.

Step 4:
Formate the new partition
# mkfs.ext4 /dev/sdb1

Step 5:
Mount the partition.

# mkdir /backup
# mount /dev/sdb1 /backup

# vi /etc/fstab

/dev/sdb1 /backup ext4 defaults 1 2

Another Issue.
My test server which is created in VMWare EXSI server. After upgrading the disk space we need to mount the extra hard disk space on it.


root@puppetmaster:/# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       6.8G  6.0G  501M  93% /
none            4.0K     0  4.0K   0% /sys/fs/cgroup
udev            1.1G  4.0K  1.1G   1% /dev
tmpfs           208M  512K  207M   1% /run
none            5.0M     0  5.0M   0% /run/lock
none            1.1G  208K  1.1G   1% /run/shm
none            100M     0  100M   0% /run/user
overflow        100M     0  100M   0% /tmp
overflow        100M     0  100M   0% /tmp
root@puppetmaster:/# mkfs.ext3 /dev/sda2



root@puppetmaster:/# fdisk -l

Disk /dev/sda: 19.3 GB, 19327352832 bytes
255 heads, 63 sectors/track, 2349 cylinders, total 37748736 sectors

So I have created a new partition /dev/sda2
root@puppetmaster:/# fdisk /dev/sda

Command (m for help): n
Partition type:
   p   primary (1 primary, 0 extended, 3 free)
   e   extended
Select (default p):
Using default response p
Partition number (1-4, default 2):
Using default value 2
First sector (14680064-37748735, default 14680064):
Using default value 14680064
Last sector, +sectors or +size{K,M,G} (14680064-37748735, default 37748735):
Using default value 37748735

Command (m for help): p

I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00047f2a

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048    14680063     7339008   83  Linux
/dev/sda2        14680064    37748735    11534336   83  Linux


Command (m for help): t
Partition number (1-4): 2
Hex code (type L to list codes): 83

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table. The new table will be used at
the next reboot or after you run partprobe(8) or kpartx(8)
Syncing disks.
root@puppetmaster:/#

while formating the new partition,

root@puppetmaster:/# mkfs.ext3 /dev/sda2
mke2fs 1.42.9 (4-Feb-2014)
mkfs.ext3: inode_size (128) * inodes_count (0) too big for a
    filesystem with 0 blocks, specify higher inode_ratio (-i)
    or lower inode count (-N).
So I have rebooted the server and executed the command.

The system is going down for reboot NOW!
root@puppetmaster:/#

ubuntu@puppetmaster:~$ sudo mkfs.ext3 /dev/sda2
mke2fs 1.42.9 (4-Feb-2014)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
655360 inodes, 2621440 blocks
131072 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=2684354560
80 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
    32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done                           
Writing inode tables: done                           
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

ubuntu@puppetmaster:~$
ubuntu@puppetmaster:~$ sudo mount /dev/sda2 /backup
ubuntu@puppetmaster:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       6.8G  6.0G  506M  93% /
none            4.0K     0  4.0K   0% /sys/fs/cgroup
udev            1.1G   12K  1.1G   1% /dev
tmpfs           208M  500K  207M   1% /run
none            5.0M     0  5.0M   0% /run/lock
none            1.1G  208K  1.1G   1% /run/shm
none            100M     0  100M   0% /run/user
/dev/sda2       9.8G   23M  9.2G   1% /backup

Make atractive color for your Linux shell prompt.

You can make actractive colors for your linux servers shell prompt.

Add the following lines to your home directories .bashrc file.

export PS1='\[\033[01;31m\]\u\[\033[01;33m\]@\[\033[01;36m\]\h \[\033[01;33m\]\w \[\033[01;35m\]\$ \[\033[00m\]'

Here you can see  color codes used for user , @, hostname , w, etc in the above scripts. By changing the values you can use your own colors.

 ajeesh@tech3:~$ export PS1='\[\033[01;31m\]\u\[\033[01;33m\]@\[\033[01;36m\]\h \[\033[01;33m\]\w \[\033[01;35m\]\$ \[\033[00m\]'

ajeesh@tech3 ~ $

Monitoring Mysql in cPanel server.

You can easily monitor mysql process on your cPanel servers.

Steps:
1. cd /home
2. remove file named latest-watchmysql , if any
3. wget http://www.ndchost.com/cpanel-whm/plugins/watchmysql/download.php
4. sh latest-watchmysql

Login to WHM > Plugins > Watch MySQL

After enabling the watchmysql daemon you can monitor your mysql process on your server.

hot link protection

We can enable hot link protection using out .htaccess.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|jpeg|bmp|zip|rar|mp3|flv|swf|xml|php|png|css|pdf|html)$ - [F]

view external: query (cache) message for non existing domains

Mar  1 02:13:48 server named[51666]: client IP_address#4938: view external: query (cache) 'domain.com/A/IN' denied


This is seems to be a dns attack in your server and lots of messages are getting in /var/log/messages.

I have fixed this issue by adding ,

additional-from-cache no;

+++++++++++++++++

recursion no;

additional-from-cache no;

minimal-responses yes;

};

+++++++++++++++++

Here BIND server consider it as " additional-from-auth yes " and Cache disabled. BIND will follow out-of-zone records but since this requires the cache.BIND will return REFUSED for the out-of-zone record. In the case you have to set recursion no

Installing Nagios and monitoring remote machines:

Installing Repo:

[root@server /]# wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
--2013-02-21 10:24:21-- http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt

2013-02-21 10:24:25 (78.8 KB/s) - `RPM-GPG-KEY.dag.txt' saved [1672/1672]

[root@server /]# rpm --import RPM-GPG-KEY.dag.txt
[root@server /]# rm -f RPM-GPG-KEY.dag.txt
[root@server /]# vi /etc/yum.repos.d/dag.repo

The contents should be :
[dag]
name=Dag RPM Repository for Red Hat Enterprise Linux
baseurl=http://apt.sw.be/redhat/el5/en/$basearch/dag/
gpgcheck=1
enabled=0



[root@server /]# yum --enablerepo=dag -y install nagios nagios-plugins


Dependency Installed:
fontconfig.x86_64 0:2.4.1-7.el5 fping.x86_64 0:3.4-1.el5.rf gd.x86_64 0:2.0.33-9.4.el5_4.2 libtool-ltdl.x86_64 0:1.5.22-7.el5_4 perl-Crypt-DES.x86_64 0:2.05-3.2.el5.rf
perl-Digest-HMAC.noarch 0:1.01-15 perl-Digest-SHA1.x86_64 0:2.11-1.2.1 perl-Net-SNMP.noarch 0:5.2.0-1.2.el5.rf perl-Socket6.x86_64 0:0.19-3.fc6

Complete!



Configuration:


[root@server /]# vi /etc/nagios/nagios.cfg

uncommend the below line:

cfg_dir=/etc/nagios/servers



[root@server /]# vi /etc/httpd/conf.d/nagios.conf

For Directory "/usr/lib64/nagios/cgi"
Order allow,deny
Allow from all

Or allow IP as per your requirements.

and for directory /nagios "/usr/share/nagios"
Allow from all


[root@server /]# mkdir /etc/nagios/servers
[root@server /]# chown nagios. /etc/nagios/servers


[root@server /]# vi /etc/nagios/objects/contacts.cfg

Update your notification email address:


email ajeesh@xyz.com


[root@server /]# htpasswd -c /etc/nagios/htpasswd.users nagiosadmin
New password:
Re-type new password:

root@server /]# /etc/rc.d/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@server /]#
[root@server /]# /etc/rc.d/init.d/nagios start
nagios is stopped
Starting nagios: [ OK ]


Now you will be able access your Nagios using http://172.16.9.155/nagios/ that is  ip/nagios

user name : nagiosadmin password : xyz


Next step is add a remote machine on your Nagios server.



vi /etc/nagios/servers/ldapserver.cfg

define host{
use linux-server
host_name ldap.ajeesh.com
alias lan
address 172.16.9.156
}
define service{
use generic-service
host_name ldap.ajeesh.com
service_description PING
check_command check_ping!100.0,20%!500.0,60%

}

sshd rootkit exploit reported

Recently sshd rootkit exploited in cPanel , CentOs, CloudLinux , DirectAdmin, Plesk etc.

Once this happened hackers can steal passwords, ssh keys ,  /etc/shadow and they will get the server access and do spamming in your server.

For 64 bit servers

 /lib64/libkeyutils.so.1.9

For 32 bit servers

 /lib/libkeyutils.so.1.9

For non effected server it should be

[~]# ls -la /lib64/libkeyutils*
-rwxr-xr-x 1 root root 9472 Jan  6  2007 /lib64/libkeyutils-1.2.so*
lrwxrwxrwx 1 root root   18 Aug 24 11:26 /lib64/libkeyutils.so.1 -> libkeyutils-1.2.so*

You can check your server is infected or not using the following command
# wget -qq -O - http://www.cloudlinux.com/sshd-hack/check.sh |/bin/bash

Ajeesh.server10.net #                                                                                                                                                    
Cannot find compromised library

If your server is infected please execute the following command:
# wget -qq -O - http://www.cloudlinux.com/sshd-hack/clean.sh |/bin/bash

Also you can check the integrity of this file using rpm commands , whether there is any patch over written with your existing libkey-utils package.

 root@server [/]# rpm -Vv keyutils-libs-1.2-1.el5
........    /lib/libkeyutils-1.2.so
........    /lib/libkeyutils.so.1
........    /usr/share/doc/keyutils-libs-1.2
........  d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL
........    /lib64/libkeyutils-1.2.so
........    /lib64/libkeyutils.so.1
........    /usr/share/doc/keyutils-libs-1.2
........  d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL

From the above output we can see that the package installed on our server is not modified with any patches.

If your output something like
S.5.....    /lib/libkeyutils.so.1

It is vulnerable and you need to update your server as fast as possible.