Install & Configure OpenVZ (CentOS 6.2)

OpenVZ is a great tool which offers a great virtualization solution with near zero overhead, thus offering great performance.
In this short tutorial I will show how to install it on CentOS 6.2 machine, read on:


1) Get the OpenVZ repository and update "yum":

#wget -P /etc/yum.repos.d http://download.openvz.org/openvz.repo

#rpm --import http://download.openvz.org/RPM-GPG-Key-OpenVZ

#yum update

2) Install relevant packages

#yum install openvz-kernel-rhel6 vzctl vzquota bridge-utils -y

3) Modify relevant kernel (networking) settings to allow proper communication with the VPS'es:

#vi /etc/sysctl.conf

#add these lines for sysctl openvz configuration
net.ipv4.ip_forward=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.icmp_echo_ignore_broadcasts=1 

net.ipv4.conf.default.forwarding=1
net.ipv4.conf.default.proxy_arp = 0
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.eth0.proxy_arp=1

Update the new kernel settings:

#sysctl -p

4) Reboot the machine:

#shutdown -r now

A new Kernel should appear (2.6.32-042stab044.17 in my case) in the Grub menu.
Boot into the new Kernel.

5) Check that a new interface (venet0) exists:

# ifconfig venet0
venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet6 addr: fe80::1/128 Scope:Link
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:161 errors:0 dropped:0 overruns:0 frame:0
          TX packets:182 errors:0 dropped:12 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:19255 (18.8 KiB)  TX bytes:15822 (15.4 KiB)

Also, check the the "vz" service is running:

#/etc/init.d/vz status
OpenVZ is running...

6) So far, so good - It's time to get some OS template. Let's get an Ubuntu 11.10 64bit template:

#wget http://download.openvz.org/template/precreated/ubuntu-11.04-x86_64.tar.gz -P /vz/template/cache

All templates come as archives and reside inside /vz/template/cache directory.

As a best practice it's a good idea to keep /vz on a separate partition (or a LUN), the partition needs to be big enough to sustain all the VPS'es that are about to be created, so do the calculation according to your needs.

7) Basic installation is done. You should be able to use the vz* commands and administer your VM's via the CLI.

For example to create a new VM out of the downloaded template use:

#vzctl create 1 --ostemplate ubuntu-11.04-x86_64 --ipadd 10.0.0.12 --hostname vz03

When 1 is the uid of the VPS.

After the creation, initialize the created VPS via:

#vzctl start 1

You can now enter into the VPS by simply SSH'ing into it or via the following command:

#vzctl enter 1




A very cool (and free) web management which I highly recommend is called OpenVZ Web Panel, can be easily installed via this command:

#wget -O – http://ovz-web-panel.googlecode.com/svn/installer/ai.sh | sh

After the installation, check that the OpenVZ web panel is listening on port 3000:

#lsof -i :3000

An initialization script is provided as part of the installation and is located under: /etc/init.d/owp

Once installed the web panel can be accessed from your browser via: 
http://your-ip:3000

The interface is minimalistic but very convenient and user friendly:

Note: Be sure to modify firewall settings on the hosting machine accordingly to allow access to port 3000.

Happy VZ'ing!

How to Install & Configure Cfengine (v3) on CentOS 6

In this short tutorial I will demonstrate how to quickly install and configure Cfengine (version 3.x) on CentOS 6 x64 box and also show a basic example of this great automation tool, let's get started:

First, install the needed pre-requirements (EPEL/RPMforge provide these):

#yum install openssl openssl-devel db4 db4-devel flex pcre pcre-devel openldap gcc -y

Next, download the latest version source (3.2.3 at the moment of writing) and install it:

#wget http://cfengine.com/source-code/download?file=cfengine-3.2.3.tar.gz -O /root/cfengine-3.2.3.tar.gz

#tar xvzf cfengine-3.2.3.tar.gz; cd cfengine-3.2.3/

#./configure

#make

#make install

Now we will create the needed folders for CF under /var to work as should ,we will  also copy all relevant binaries and configuration files:

#mkdir -p  /var/cfengine/{masterfiles,bin,inputs}
#cp -rp /usr/local/share/cfengine/masterfiles/*.cf /var/cfengine/masterfiles/
#cp -rp /usr/local/share/cfengine/masterfiles/*.cf /var/cfengine/inputs/
#cp -rp /usr/local/sbin/cf-* /var/cfengine/bin/

Test the installation with:

#cf-promises -v

On the last line output you should get:
cf3>  -> Inputs are valid

Now, in order to demonstrate Cfengine abilities we will create a new file under /tmp called "cftest" with premissions of 744 and owner root.

In order to do that we will create a special configuration input file under:
/var/cfengine/inputs, called cftest.cf

So, let's see what we got inside of the configuration file:

#cat /var/cfengine/inputs/cftest.cf

body common control
{
# Define a bundle sequence
bundlesequence => { "checkperms" };
# Include cfengine_stdlib.cf
inputs => { "cfengine_stdlib.cf" };
version => "1.0.0";
 }
bundle agent checkperms        
{
files:                   
"/tmp/cftest"
create => "true",                             
perms => m("744");
}

Let's verify it's syntax with cf-promise:
#cf-promise -f /var/cfengine/inputs/cftest.cf

We will see that there is no file called cftest under /tmp ,prior running cf-agent.

# ls -l /tmp/cftest
ls: cannot access /tmp/cftest: No such file or directory

Now for the run:

#cf-agent -f /var/cfengine/inputs/cftest.cf

Lets check what's under /tmp:
# ls -l /tmp/cftest
-rwxr--r-- 1 root root 0 Jan 14 01:14 /tmp/cftest

Great, the file was created with the right permissions, just as we wanted. 
This is just the most basic example, via Cfengine you can do much much more, more practical examples to come so stay tuned!

XenServer - Cannot Shut VM

Have you ever experienced  a situation where you could not shut one of your running XenServer running VM's?   In this brief article I'll present a workaround for this common problem...  From my personal experiences this problem is often caused when the domain of the specific VM is still active (this often happens as a result of inproper shutdown and/or storage cutoffs) - in such case the domain needs to be destroyed manually.  OK, so here's the problem - from the XenServer (v 5.6 SP1) dom0 CLI I'm trying to shut a VM (using the force option): #xe vm-reset-powerstate vm=xxxxxxx force=true
 However the output I get is:  The operation could not be performed because a domain still exists for the specified VM.
vm: f087dxxxxx (xxxxxx)
domid: 5  From the output we will need  two parameters :the domain id (5 in our case) and the UUID of the problematic VM , so write them down somewhere. Now we need to destroy the currently active domain, XenServer includes couple of good tools under /opt/xensource, the command that is relevant is:   #/opt/xensource/debug/destroy_domain -domid 5  Now, finally, we will be able shut the VM with:  #xe vm-reboot uuid=XXXX --force  And we're done.  Hope that helped some one out there. Cheers!

Perl SSH Log-in

Hi Folks, 

In the following post I will demonstrate a password-less login into Cisco appliance via the SSH protocol using a Perl script.

When combined with cron, it can be a great solution for saving your appliance configuration (show run) or checking status without the need to log-in into the appliance each time.

Pre requirements:

• Perl
• SSH client (duh!)
• Net-SSH-Perl module

On Red-Hat (and friends) the module can be obtained via:

#yum install perl-Net-SSH-Perl -y 

Be sure to have a proper repository installed such as rpmforge 

 

Our simple script connects to the Cisco appliance via SSH and runs "show run" command (this account has enabled privilege).
The script itself should look like this:

#!/usr/bin/perl -w
use strict;
use warnings;
use Net::SSH::Perl;
my $ssh = Net::SSH::Perl->new('hostname');
$ssh->login('username', 'password');
my($out) = $ssh->cmd("show run");
print $out;

Since the script contains your appliance username & password don't forget to remove permissions for others:

#chmod o-rwx script.pl

Now, let's run the script:

#./script.pl

Output:

Building configuration...

Current configuration : 8011 bytes
...more output ommited...

Works like charm!

Now, the only thing is left is to synchronize it with cron :)

Enjoy.

Howto configure LDAP with TLS

Configuring LDAP over TLS is a crucial step in order to achieve a secure directory based authentication.

In the following tutorial I'll demonstrate how to configure OpenLDAP with TLS.

For the demonstration both server & client I've used are CentOS 5.5 x86_64

My LDAP server is OpenLDAP v2.3.43

Let's get started.

Step1 - Generating and Signing Certificates:

First of all we need to generate and sign the OpenLDAP server certificates.

In this scenario we will both generate and sign our certificate (self signed), this solution is good for internal and usually small environments.
If you ever plan to use this in a big enterprise production environment you will need a proper CA, like Verisign or Terrena to sign the certificates.

Before continuing please make sure the open SSL package is installed.

Generate your private key and a certificate request form:

#cd /etc/openldap/cacerts

#openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr  Sign the certificate with:
#openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
 

Now you got both private and public keys.

After the certificates have been generated, assign the correct permissions and ownerships:

#chown ldap server.*

#chmod 0400 server.key

#chmod 0644 server.crt

Step2 - Server Side:

The following two lines need to be added in your server configuration file
(/etc/openldap/slapd.conf):

TLSCertificateFile      /etc/openldap/cacerts/server.crt
TLSCertificateKeyFile   /etc/openldap/cacerts/server.key

Restart the LDAP server:

#/etc/init.d/ldap restart 

Step3 - Client Side:

Make sure the ssl parameter in your LDAP client configuration file (/etc/ldap.conf) looks like this:

ssl start_tls

Also, make sure /etc/openldap/ldap.conf includes the following parameters:

TLS_CACERTDIR /etc/openldap/cacerts

TLS_REQCERT allow

That's it, from this point your OpenLDAP is ready to be used over TLS.
Stay secure ;)

XenServer Backup Script

This handy bash script I wrote, enables Xen Server Administrators to create On-Line backups (Importing the VM into.xva file) while the backed up virtual machine is up and running.

I found this extremely useful for big production environments - where lots of VM's require an appropriate & efficient back-up solution and downtime is not an option.

The script is very simple and user friendly, it's executed as root from the dom0 machine and used as follows:

In order to list all the available VM's on the system:

#./xen_onlinebackup.sh -l

In order to back up a VM:

#./xen_onlinebackup.sh -p /path/to/backupdir -s vm-name

The script supports both interactive and unattended mode (-u flag), the later designed to be built into scripts as an automation solution for large production environments.

For any help/usage, just run:

#./xen_onlinebackup.sh -h

Tested succesefully on XenServer 5.6 FP1 & XenServer 5.6 SP2.

Any comments, feed-backs or suggestions for improvements are very welcomed.

 #!/bin/bash

#

#This script used to create XenServer VM's online backup #Importing the VM into .xva file #Written by Paul Podolny - July 2011

#Variables

COUNT=0

AUTO=0 #Used for unattended mode

VMLIST=`xe vm-list is-control-domain=false |grep -i name-label|awk -F": " '{print $2}'`

#Functions

list() {

echo "====================================="

echo "Listing available VM's on $HOSTNAME..."

echo "====================================="

for i in $VMLIST;do

      echo $i;let COUNT+=1

done

echo "================================="

echo "Total $COUNT Virtual Machines"

echo "================================="

exit 0

}

usage() {

cat << EOF

This script will backup your Xen VMs on-line:

------

Usage:

------

-h Help/Usage.

-l List VM's.

-u Run in unattended mode (No questions asked).

-s Server Name (Backed Up VM).

-p Path to backup.

--------

Example:

--------

$0 -s server01 -p /nfs/backupdir/ -u

EOF

exit 0

}

check_dir() {

echo "=============================================================="

echo "XenServer Online Backup"

echo "=============================================================="

if  [ -e ${BACKUPPATH}/${VMNAME} ];then

        echo "Directory ${VMNAME} on path ${BACKUPPATH} seem to exist, will use it."

else

      echo "Creating dir. ${VMNAME} on backup path: ${BACKUPPATH}"

      mkdir ${BACKUPPATH}/${VMNAME}

fi

echo "`date +%H:%M` Backing Up ${VMNAME}, please hold on...Do NOT interrupt with CTRL+C !!!"

echo "================================================="

}

################################

#MAIN Prog

################################

while getopts "s:p:lhu" flag ; do

        case $flag in

                l ) list;;

                s ) VMNAME=$OPTARG;;

                p)  BACKUPPATH=$OPTARG;;

                h ) usage;;

                u)  AUTO=1;;

                *)  usage;;

        esac

done

#Sanity check  - Make sure backup path + VM name specificed if [ -z ${VMNAME} ] || [ -z ${BACKUPPATH} ];then echo  "Error:Both backup path AND VM name must be specified, exiting..."

echo  "Use $0 -h  for help"

exit 1

fi

#If running in interactive mode

if [ ${AUTO} != "1" ];then

      echo "Going to back-up ${VMNAME} to ${BACKUPPATH} ,is this OK? [y/n]"

      read ANSWER

      if [ ${ANSWER} != "y" ] && [ ${ANSWER} != "Y" ];then

            echo "Exiting by users request..."

            exit 1
      fi
fi

      #else proceed with main program...

      else

            check_dir

            TEMPUUID=$(xe vm-snapshot vm=$VMNAME new-name-label=snap_tmp_`date +%F`)

            xe template-param-set is-a-template=false ha-always-run=false uuid=$TEMPUUID

            xe vm-export vm=${TEMPUUID} filename=${BACKUPPATH}/${VMNAME}/${VMNAME}_backup_`date +%F`.xva

            echo "Removing Temporary Snapshot....(DO NOT PANIC!)"

            xe vm-uninstall uuid=${TEMPUUID} force=true

            echo "==============================================================="

            echo "### Back Up of ${VMNAME} Completed!###"

            echo  "`date +%H:%M`"

#END OF SCRIPT

Howto:Reduce LVM Root Partition

In this short tutorial I'll demonstrate how to reduce the size of LVM (/dev/VolGroup00/LogVol00) mounted on "/" (aka root partition).

Since the procedure cannot be done on the run (you will need to unmount the root partition...) , you will have to boot your machine either with some sort of Linux LiveCD or either with the original CentOS DVD/ISO which offers special rescue mode.

I didn't have a LiveCD so I used the original CentOS DVD for this task.

Boot the machine with a CentOS DVD/ISO (v 5.5 in my case) and enter the rescue mode by typing:

#linux rescue

CentOS will boot in rescue mode when a menu pops up and asks you if you want to mount your old partitions, chose "SKIP" (otherwise your original disk partitions will be mounted under /mnt/sysimage - in that case umount it before proceeding).

After you made sure your original disk partitions are not mounted you will have to activate the LVM in Rescue Mode:
# lvm vgchange -a y

Check the LVM for any filesystem errors, this is crucial for next step:
# e2fsck -f /dev/VolGroup00/LogVol00

It's time to resize the filesystem to a new size ,note that you should leave enough space for current data on the root partition or you will suffer a data loss.
In our case we are reducing the partition to a new size of 20GB.
Note that the procedure may take some time (depending on your root partition size, so do not panic!):
# resize2fs -f /dev/VolGroup00/LogVol00 20G

Finally, resize the LVM to the new size (20 GB):
#lvm lvreduce -L20G /dev/VolGroup00/LogVol00

You should boot your OS into regular mode and cross your fingers ...

Disclaimer: Do at your own risk, I'm not responsible for any data loss which may be caused to your system.

Enable SNMP on Cisco Devices (part 1)

In this short tutorial I'll demonstrate how to quickly configure SNMP on your Cisco appliance and test it's working.


There will be another tutorial dealing with how to configure the SNMP manager side.


1) Let's start by logging in to your Cisco appliance (In my case I used 851 series Cisco router with IOS version 12.3).

2) Enter configuration mode:

cisco851#configure terminal

3) Set your community string and the mode (read only, read write):

cisco851(config)#snmp-server community myComunity1 RW

4) Point the appliance to the SNMP manager (in our case 192.168.2.4) , with the same community string you've set before: 

 cisco851(config)#snmp-server host 192.168.2.4 version 2c myComunity1


5) Enable the trap types you wish to monitor, for example:

cisco851(config)#snmp-server enable traps snmp linkdown linkup coldstart warmstart

6) Save the configuration:

cisco851(config)#do wr

At this point the basic configuration on the Cisco appliance is done, let's see if we able to querry the appliance from our server.

I have used Ubuntu 11.04 x64 box with "snmp" package installed.

Check it's indeed installed with:

root@ubuntu:~#dpkg --list |grep snmp

If not get it with:

root@ubuntu:~#apt-get install snmp

After snmp package has been succefully installed it's time test the configuration.

Issue the following command and see if you're able to retrieve the SNMPv1 agent  or our Cisco appliance (192.168.2.1) MIB tree list :

root@ubuntu:~#snmpwalk -v 1 -c myComunity1 192.168.2.1

At this point you should be able to list the entire tree (output was ommited), means Cisco side is configured successfully.

You can now get the desired info for monitoring purposes, like the system uptime:

root@ubuntu:~#snmpget -v 1 -c myComunity1 192.168.2.1 iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0


DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (490514418) 56 days, 18:32:24.18
 
Or our appiance hostname:

root@ubuntu:~#snmpget -v 1 -c myComunity1 192.168.2.1 iso.org.dod.internet.mgmt.mib-2.system.sysName.0


SNMPv2-MIB::sysName.0 = STRING: gw1.slsphr.net.il
 
Mission accomplished.
 
In the next SNMP article I will touch the server side configuration.
 
Cheers.

Howto remove old NAT configuration from Cisco router

Recently I came upon a situation where my ISP has assigned me a static IP - instead of L2TP dialer (Virtual PPP Interface in Cisco) I was using before ...
Anyway, I started to remove old and irrelevant NAT settings that were associated with my old dialer ,but when I've tried to configure the new NAT settings I got an error:
%Dynamic mapping in use, cannot change

After scratching my head for awhile I found the solution.

To remove old NAT settings on Cisco router you need to 

1)Clear all old NAT translations
router#clear ip nat translatiom *

2)Disable old NAT pool settings

router(config)#no ip nat pool public_access 200.100.10.33 netmask 255.255.255.252

3)And finally, disable the translation:

router(config)#no ip nat inside source list 1 pool public_access overload

From this point you can safely configure the new NAT settings.

Cheers.

Howto Connect NetApp iSCSI to XenServer 5.6 FP1

Since iSCSI is a great choice as a SR for your XenServer, in terms of performance and scalability, I've decided to created a straight forward and easy to understand guide of how to connect NetApp iSCSI based storage to XenServer, read on...

On the NetApp side:

1) Enable iSCSI service on the filer:

2) Create the desired LUN:

·        

3) Dedicate a separate NIC for iSCSI traffic, be sure the filer iSCSI dedicated NIC is assigned with a proper IP address:

·        

4)From the XenServer copy it's iscsi FQN:

5)Add the new initiator:

6)Map the new LUN to the new initiator:

On the XenServer side:

1)      Be sure you have a NIC assigned to iSCSI traffic.

2)      Right click on the XenServer -> New storage-> Software iSCSI

Click on Discover IQNs, it should find the NetApp IQN.

Next, click on Discover LUN's, it should find the available LUN's.

Click "Finish" to attach the SR.

Your newly created LUN should be successfully attached to XenServer at this point.