Friday, December 6, 2019

linux - ssh public key authentication

I have tried to configure ssh to use public key authentication




The link



/etc/ssh/sshd_config has got this parameters.



RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

PasswordAuthentication yes



But I'm still being prompted for password. If I use



PasswordAuthentication no


I can't login



Any suggestion?







It works but only for root user.



My problem was, I had this parameter



PermitRootLogin no.



I can login with keys with root user if I use




PermitRootLogin yes.



In the system there is only a /root/.ssh directory an authorized_keys file in this directory



How can I add this to other users, if there isn't, in this system, a home/$USER/.ssh directory and authorized_keys file for each user?



Is there a way to configure for each user?
I will need diferent authorized_keys files for each user.




Is possible to configure for a different hosts, domains or ips? similar to httpd.conf

Thursday, December 5, 2019

monitoring - calculating days until disk is full

We use graphite to track history of disk utilisation over time. Our alerting system looks at the data from graphite to alert us when the free space falls below a certain number of blocks.



I'd like to get smarter alerts - what I really care about is "how long do I have before I have to do something about the free space?", e.g. if the trend shows that in 7 days I'll run out of disk space then raise a Warning, if it's less than 2 days then raise an Error.



Graphite's standard dashboard interface can be pretty smart with derivatives and Holt Winters Confidence bands but so far I haven't found a way to convert this to actionable metrics. I'm also fine with crunching the numbers in other ways (just extract the raw numbers from graphite and run a script to do that).



One complication is that the graph is not smooth - files get added and removed but the general trend over time is for disk space usage to increase, so perhaps there is a need to look at local minimum's (if looking at the "disk free" metric) and draw a trend between the troughs.



Has anyone done this?

Wednesday, December 4, 2019

storage - How to remember RAID levels?





How do you remember(if you really do :-)) all the different levels and what each level does? Can anyone suggest an easy way to remember?


Answer



0 - S (stripe)



1 - M (mirror)




5 - P (parity)



10 - MS (mirror + stripe)



Smart Men Pay MicroSoft



or



Silly Men Pay MicroSoft



Tuesday, December 3, 2019

windows server 2008 - Secondary Domain Controller no longer part of the domain

[before anyone corrects me I've used the terms secondary and primary colloquially and I understand the terminology]



I have a problem with my secondary DC, but not on any other server in the domain. Everything is Windows Server 2008. Virtualized using VMWARE. It appears to not be part of the domain anymore. Accounts appear "locked out" on DC2 but are not locked out on DC1. Active directory won't pull up on DC2 and I can't edit accounts to unlock DC2 locally.




Any network pings are "General Failure", including 127.0.0.1 any other server by IP or DNS name. Ping TO the DC2 fail conclusively as well. Everything is fine in the adapter settings and it even shows "connected" to the correct domain, but it can't reach anything else. Services are fine. There are NO enabled firewalls or issues that would arise from connection problems.



I believe it may be a trust issue? I'm not entirely sure

domain name system - DNS/Web Hosting to a private network setup



I've tried to find a lot of answers to my question, but I am quite a bit confused to some of it and now I am here to seek further advice.




The setup:



We have a hosting and our domain will be something like this www.example.biz.



In our infra, we have the following traditional servers which will be put behind firewall and private network




  1. Web Server

  2. Database Server




Now the domain will be given to us and we would like to point it to our web server to host the web pages.



This was the solution I've come up,



Configure the hosting's domain to point the record to our Public IP which will be forwarded by the firewall through port forwarding to our web server and accept traffic to be able to serve this web pages.



My question would be, was my solution enough for this setup? or should I configure a public authoritative dns server and add it to the domain hosting's nameserver which i would still use my firewall to point it to my private network's web server.




I would really appreciate for any advice there is, I am still new and I've found this site very helpful.



Thank you and Regards,
Ian


Answer



You don't need to run your own DNS server. DNS is a basic service, you can rely on your provider or a third party like CloudFlare / AWS Route 53 for that.



Other than the DNS part of your question your solution is standard and should work.



A note: firewalls don't exactly "forward" traffic, I would say they intercept or pass through traffic but that's mostly a semantic difference. A reverse proxy server like Nginx would forward traffic.



Monday, December 2, 2019

cron - Python script succeeds manually but fails on crontab

So I'm currently trying to get a script working but it's behaving differently when I run it manually than when I run it from crontab. Basically, I have a reverse ssh tunnel set up from one server to another, and in order to verify that my tunnel is up I:





  • SSH from server A to server B

  • Wget a test url from on server A from server B

  • if Wget succeeds, I disconnect and do nothing

  • if Wget fails, I disconnect and restart the tunnel



I know there are more elegant ways to verify ssh tunnels (like autossh and ServerKeepAlive), but for both policy and redundancy issues, I have to do things this way. Anyways, here's the script:




from __future__ import print_function
from __future__ import absolute_import

import os, sys, subprocess, logging, pexpect

COMMAND_PROMPT = '[#$] '
TERMINAL_PROMPT = '(?1)terminal type\?'
TERMINAL_TYPE = 'vt100'
SSH_NEWKEY = '(?i)are you sure you want to continue connecting'
SERVERS = [{address':'192.168.100.10', 'connString':'ssh user@192.168.100.10', 'testGet':'wget http://192.168.100.11/test.html -t 1 -T 10', 'tunnel':'start_tunnel'}, {address':'192.168.100.12', 'connString':'ssh user@192.168.100.12', 'testGet':'wget http://192.168.100.13/test.html -t 1 -T 10', 'tunnel':'start_tunnel2'}]


def main():

global COMMAND_PROMPT, TERMINAL_PROMPT, TERMINAL_TYPE, SSH_NEWKEY, SERVERS

#set up logging
log = logging.getLogger(__name__)
log.setLevel(logging.DEBUG)
handler = logging.FileHandler('/home/user/tunnelTest.log')
formatter = logging.Formatter('%(asctime)s - %(module)s.%(funcName)s: %(message)s')

handler.setFormatter(formatter)
log.addHandler(handler)


for x in SERVERS:

#connect to server
child = pexpect.spawn(x['connString'])
i = child.expect([pexpect.TIMEOUT, SSH_NEWKEY, COMMAND_PROMPT, '(?i)password'])
if i == 0: #Timeout

log.debug('ERROR! Could not log in to ' + x['address'] + ' ...')
sys.exit(1)
if i = 1: #No key cached
child.sendline('yes')
child.expect(COMMAND_PROMPT)
log.debug('Connected to ' + x['address'] + '...')
if i = 2: #Good to go
log.debug('Connected to ' + x['address'] + '...')
pass


#Housecleaning
child.sendline('cd /tmp')
child.expect(COMMAND_LINE)
child.sendline('rm -r test.html')
child.expect(COMMAND_LINE)

log.debug('Testing service using ' + x['testGet'] + ' ...')
child.sendline(x['testGet'])
child.expect(COMMAND_PROMPT)
if 'saved' in child.before.lower():

log.debug('Tunnel working, nothing to do here!')
log.debug('Disconnecting from remote host ' + x['address'] + '...')
child.sendline('exit')
else:
log.error('Tunnel down!')
log.debug('Disconnecting from remote host ' + x['address'] + ' and restarting tunnel')
child.sendline('exit')
subprocess.call(['start',x['tunnel']])
log.debug('Autossh tunnel restarted')


if __name__ == "__main__":
main()


My crontab entry is as follows:



0,30 * * * * python /home/user/tunnelTest.py


So yeah -- this script runs fine when I do it manually (sudo python tunnelTest.py) and also runs fine on crontab unless a tunnel is down. When a tunnel is down, I get the "Tunnel down!" and "Disconnecting from remote host 192.168.100.10 and restarting tunnel" messages in my log, but the script seems to die there. The tunnel doesn't restart, and I get no messages in my log until the start of the next scheduled run.




The start_tunnel script is in /etc/init, the testTunnel.py script is in /home/user, the testTunnel.log file is in /home/user/logs, and I ran crontab -e as root.



Any insight into this matter would be greatly appreciated.



Thanks!

Sunday, December 1, 2019

monitoring - Nagios - NagWin - Send notification with gmail

I would like to send Nagios notifications using my gmail account.



I have already set up my hosts I want to monitor and services also.



What is the most simple way to accomplish this using NagWin on a Windows Server 2012 installation?




As far as I know I must change some of these configuration settings:



# 'notify-host-by-email' command definition
define command{
command_name notify-host-by-email
command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /bin/blat - -to $CONTACTEMAIL$ -f nagios@localhost -subject "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" -server ???
}

# 'notify-service-by-email' command definition

define command{
command_name notify-service-by-email
command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$\n" | /bin/blat - -to $CONTACTEMAIL$ -f nagios@localhost -subject "** $NOTIFICATIONTYPE$ Service Alert: $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" -server ???
}


What should I use for smtp server? Is it possible to directly send my notifications to the Gmail server?

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...