RHEL 7 + selinux + sendmail greylisting

If you have combination RHEL 7 + selinux + sendmail greylisting (smf-grey), maybe this will help you resolve problems.

First identify from /var/log/audit/audit.log lines, which are related to your case, for example:

type=AVC msg=audit(1415573843.208:2609): avc:  denied  { getattr } for  pid=12969 comm="sendmail" path="/run/smfs/smf-grey.sock" dev="tmpfs" ino=65392 scontext=system_u:system_r:sendmail_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1415575051.524:3068): avc:  denied  { write } for  pid=13609 comm="sendmail" name="smf-grey.sock" dev="tmpfs" ino=65392 scontext=system_u:system_r:sendmail_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1415575527.915:3082): avc:  denied  { connectto } for  pid=13759 comm="sendmail" path="/run/smfs/smf-grey.sock" scontext=system_u:system_r:sendmail_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket

Install packages policycoreutils, policycoreutils-python, checkpolicy and setroubleshoot. Now execute:

cat file_with_needed_audit_lines |audit2allow -m greylist > greylist.te
checkmodule -M -m -o greylist.mod greylist.te
semodule_package -m greylist.mod -o greylist.pp
semodule -i greylist.pp

Oh, and if you need to enable other ports to some services, use semanage, example:

semanage port -l | grep smtp
semanage port -a -t smtp_port_t -p tcp 2525

Identify WWN of FC card interface in RHEL6

If you have many FC cards in your server like in this example, how to identify what are WWNs of dual FC interface in first ISP2532 card on bus?

# lspci |grep Fibre
05:00.0 Fibre Channel: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA (rev 02)
05:00.1 Fibre Channel: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA (rev 02)
08:00.0 Fibre Channel: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA (rev 02)
08:00.1 Fibre Channel: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA (rev 02)
0b:00.6 Fibre Channel: QLogic Corp. 8200 Series 10GbE Converged Network Adapter (FCoE) (rev 54)
0b:00.7 Fibre Channel: QLogic Corp. 8200 Series 10GbE Converged Network Adapter (FCoE) (rev 54)
11:00.6 Fibre Channel: QLogic Corp. 8200 Series 10GbE Converged Network Adapter (FCoE) (rev 54)
11:00.7 Fibre Channel: QLogic Corp. 8200 Series 10GbE Converged Network Adapter (FCoE) (rev 54)

You can run something like this:

# for i in /sys/class/fc_host/host*; do (cd $i; pwd -P; cat port_name) ; done
/sys/devices/pci0000:00/0000:00:05.0/0000:11:00.6/host2/fc_host/host2
0x21002c27d754443b
/sys/devices/pci0000:00/0000:00:05.0/0000:11:00.7/host3/fc_host/host3
0x21002c27d754443f
/sys/devices/pci0000:00/0000:00:07.0/0000:0b:00.6/host4/fc_host/host4
0x21002c27d7544493
/sys/devices/pci0000:00/0000:00:07.0/0000:0b:00.7/host5/fc_host/host5
0x21002c27d7544497
/sys/devices/pci0000:00/0000:00:09.0/0000:08:00.0/host6/fc_host/host6
0x5001438021e03ecc
/sys/devices/pci0000:00/0000:00:09.0/0000:08:00.1/host7/fc_host/host7
0x5001438021e03ece
/sys/devices/pci0000:00/0000:00:0a.0/0000:05:00.0/host8/fc_host/host8
0x5001438021e04024
/sys/devices/pci0000:00/0000:00:0a.0/0000:05:00.1/host9/fc_host/host9
0x5001438021e04026

Now you see pairs of WWN and location on bus.

Online resize of multipath device in RHEL 6

Task: On RHEL 6 64-bit, perform online resize of filesystem /journal from 50GB to 100GB. That filesystem is part of multipath device brc001_journal_pv.

Serial console in RHEL 6

There are changes between RHEL5 and RHEL6 about how to setup serial console. In RHEL 6 you no longer specify it in /etc/inittab, but leave it on upstart daemon work.

1. If you DONT WANT to have serial console as your default console:

# cat /boot/grub/menu.lst
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
serial --unit=0 --speed=9600 --word=8 --parity=no --stop=1
terminal --timeout=10 serial console
hiddenmenu
title Red Hat Enterprise Linux (2.6.32-131.0.15.el6.x86_64)
 root (hd0,0)
 kernel /vmlinuz-2.6.32-131.0.15.el6.x86_64 ro root=/dev/mapper/rootvg-rootvol rd_LVM_LV=rootvg/rootvol rd_LVM_LV=rootvg/swapvol rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto quiet console=ttyS0,9600n8 console=tty0
 initrd /initramfs-2.6.32-131.0.15.el6.x86_64.img

# grep ttyS0 /etc/securetty 
ttyS0

# cat /etc/init/ttyS0.conf
start on runlevel [345]
stop on runlevel [S016]

respawn
instance /dev/ttyS0
exec /sbin/agetty ttyS0 9600 vt100-nav

And initialize console with:

# initctl start ttyS0

2. If you DO WANT to have serial console as default console:

Add serial and terminal lines to menu.lst as above plus append "console=tty0 console=ttyS0,9600" to kernel line in /boot/grub/menu.lst

Thats all, as upstart will automatically start serial login process on last specified console parameter extracted from kernel line (in this case ttyS0).

How to create ultra small Linux machine on Amazon EC2

If you are using amazon aws services, you know that by default Amazon will let you use virtual machine with 8GB root filesystem. But sometimes you are using under 2GB of actual space, so why not to shrink this machine and pay only for 2GB instead of 8GB? This mini-tutorial is for that.

Set outgoing IP address in Solaris 10

root@sol3 # route get default
   route to: default
destination: default
       mask: default
    gateway: 192.168.168.2
  interface: e1000g0:1
      flags:
 recvpipe  sendpipe  ssthresh    rtt,ms rttvar,ms  hopcount      mtu     expire
       0         0         0         0         0         0      1500         0



root@sol3 # ifconfig -a
lo0: flags=2001000849 mtu 8232 index 1
        inet 127.0.0.1 netmask ff000000
e1000g0: flags=9040843 mtu 1500 index 2
        inet 192.168.168.31 netmask ffffff00 broadcast 192.168.168.255
        groupname prodgr
        ether 0:c:29:20:e6:9
e1000g0:1: flags=1000843 mtu 1500 index 2
        inet 192.168.168.41 netmask ffffff00 broadcast 192.168.168.255
e1000g0:2: flags=1000843 mtu 1500 index 2
        inet 192.168.168.51 netmask ffffff00 broadcast 192.168.168.255
e1000g1: flags=69040843 mtu 1500 index 3
        inet 192.168.168.32 netmask ffffff00 broadcast 192.168.168.255
        groupname prodgr
        ether 0:c:29:20:e6:13



root@sol3 # route delete default 192.168.168.2
delete net default: gateway 192.168.168.2
root@sol3 #
root@sol3 # route add default 192.168.168.2 -setsrc 192.168.168.51
add net default: gateway 192.168.168.2


root@sol3 # route get default
   route to: default
destination: default
       mask: default
    gateway: 192.168.168.2
     setsrc: 192.168.168.51
  interface: e1000g0:1
      flags:
 recvpipe  sendpipe  ssthresh    rtt,ms rttvar,ms  hopcount      mtu     expire
       0         0         0         0         0         0      1500         0

rTorrent patch - almost linear downloading

Are you rTorrent user? Want to play .avi files as soon as possible, while downloading? Then maybe this patch will you find handy. Info: tested on rtorrent/libtorrent 0.8.5/0.12.5  All changes are affecting only one file: libtorrent-0.12.5/src/download/chunk_selector.cc

Update, May 2010: Patch applicable to rtorrent 0.8.6/0.12.6

IP multipathing with RHEL 5

In this page you can find sample working configs, which do following:

- setup two bond interfaces (bond0, bond1) with 802.3ad support
- setup two aliases for bond0
- setup two VLANs on bond1
- setup custom routes for these VLANs
- setup default gw trought bond0

All this we make on RedHat Linux 5.4, server is SunFire x4150 with 4x onboard ethernet devices.

IO multipathing with RHEL 5

In this post, we describe working IO multipathing configuration. Used technologies: RedHat Linux 5.4 64bit, 2x SunFire x4150, Sun StorageTek 2540, 2x Qlogic FC HBA.

Turn on word wrapping in "pre" tag

On Blogger, you need to edit template to turn on wrapping of tag "pre", otherwise long lines are not showing correctly. So paste this to your template:

pre {
white-space: -moz-pre-wrap; /* Mozilla, supported since 1999 */
white-space: -pre-wrap; /* Opera 4 - 6 */
white-space: -o-pre-wrap; /* Opera 7 */
white-space: pre-wrap; /* CSS3 */
word-wrap: break-word; /* IE 5.5+ */
 background: #dddddd;
 display: block;
 padding: 0.5em 1em;
 border: 1px solid #bebab0;
}

Redhat 5 + serial console setup

Here is quick setup of serial console for RedHat 5. It works for other linux distros too.

# grep agetty /etc/inittab
S0:12345:respawn:/sbin/agetty ttyS0 9600 vt100-nav

# grep SAFE /etc/sysconfig/kudzu
SAFE=yes

# grep ttyS0 /etc/securetty
ttyS0

# cat /boot/grub/menu.lst
default=0
timeout=5
hiddenmenu
serial --unit=0 --speed=9600 --word=8 --parity=no --stop=1
terminal --timeout=10 serial console
title Red Hat Enterprise Linux Server (2.6.18-164.2.1.el5)
 root (hd0,0)
 kernel /vmlinuz-2.6.18-164.2.1.el5 ro root=/dev/VolGroup00/rootvol console=tty0 console=ttyS0,9600n8 quiet
 initrd /initrd-2.6.18-164.2.1.el5.img

Installing geoip netfilter module under fedora 9

Just few tips, after you have patched current kernel sources and iptables, you want now compile geoip module (not whole kernel).

So in kernel sources dir, where is also Makefile, execute this commands:

make modules_prepare
make -C $(pwd) M=net/netfilter/ modules
cp net/netfilter/xt_geoip.ko /lib/modules/`uname -r`/extra/
depmod -a
modprobe xt_geoip

Using .htaccess files easy way

If you have configured .htaccess file in your public_html like this...

cat ~/public_html/private/.htaccess
AuthType Basic
AuthUserFile /path/to/homedir/public_html/private/.htpasswd
AuthGroupFile /dev/null
AuthName AnyNameYouLike
require valid-user

... you will have problem to allow guest to read subdir without entering password. Thats why this .htaccess file will help you:

cat ~/public_html/private/guestok/.htaccess
AuthName AnyNameYouLike
Allow from all
Satisfy any

Setup Debian Etch on NSLU2 for torrent downloading

Hi, if you don't already have cheap, small, power efficient and silent file server at home, meet NSLU2. This is way of setting up Debian after its installing for more or less torrent downloading.

Shape application easy way

Want to limit bandwidth for some specific program in userspace? Use trickle!

Example for shaping scp download to 100KB/s:

trickle -d 100 scp remote.host.ip:big_file.iso .