iSCSI/NFS on LVM on RAID5 (Software RAID) howto guide, CentOS 5.3

This is just a quid blog to show howto, cos I found there are not much on-line tutorial cover this in a easy way.

And of course, as I keep it simple, it only cover basic stuffs. Please feel free to comment and add on better approach.

## RAID ##
===============================
Links:
 http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch26_:_Linux_Software_RAID

= Create Partition with 'fdisk'
to create partition (with 'n')
modify the partition's label to RAID (with 't', and code is fd)
then 'w' to write the partition
repeat until the disks is done
do a 'partprobe' to make sure it's written and take effect
do 'fdisk -l' to make sure the partition tables is correct

= Assign disk to raid
mdadm -C -v /dev/md0 -l5 -n3 /dev/hdb1 /dev/hdc1 /dev/hdd1
    # l5 => RAID 5, n3 => a RAID set of 3 disks
cat /proc/mdstat  # make sure RAID is created. it will also show if it's sync-ing or recoverying
mdadm -D -s -v   # Double check. or 'mdadm -D -s -V /dev/md0 


## LVM ##
===============================
Links: 
 http://www.howtoforge.com/linux_lvm_p3

= Create Physical Volume(PV), Volume Group(VG) and Logical Volume(LV)
pvcreate /dev/md0   # assign "/dev/md0" as an PV
pvdisplay    # make sure they're all set
vgcreate vg-raid /dev/md0  # create VG group "lvm-raid" 
vgdisplay    # Show the Volume Group status
lvcreate -n xStorage -L 40G vg-raid # Create a LV as xStorage, 40G from vg-raid
lvdisplay    # Show Logical Volume status
ls /dev/vg-raid/xStorage  # The created LV should be here.. 
mkfs.ext3 /dev/vg-raid/xStorage # format the LV to be used
mount /dev/vg-raid/xStorage /mnt # lets test if we could mount it. :-) 
df -h    # You should see it in your mounted list

## iSCSI ##
===============================
Links: 
 http://www.cyberciti.biz/tips/howto-setup-linux-iscsi-target-sanwith-tgt.html

= Installation
yum -y install scsi-target-utils iscsi-initiator-utils
chkconfig iscsid on
chkconfig iscsi on
chkconfig tgtd on
chkconfig --list | grep iscsi
chkconfig --list | grep tdtd
/etc/init.d/iscsi restart
/etc/init.d/tgtd restart
/etc/init.d/iscsid restart

= Configuring iSCSI Target (iSCSI Server)
tgt-setup-lun  -d /dev/vg-raid/xStorage  -n xStore 192.168.1.4 # create lun only accept client with IP 192.168.1.4
   #*** NOTE: You can only setup lun with a device, not partition!! ***#
tgtadm --lld iscsi --op show --mode target    # Show alll luns
iscsiadm --mode discovery --type sendtargets --portal 192.168.1.4 # List lun from the server
Change iptables:
 iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 3260 -j ACCEPT # Open the port to all NIC
 iptables-save > /etc/sysconfig/iptables     # Save the updated rules to iptables configuration file
 
= Configuring iSCSI Initiator (iSCSI Client)
iscsiadm -m discovery --type sendtargets --portal 192.168.1.4 # Check if the iSCSI Target is accessable 
iscsiadm -m node -T iqn.2001-04.com.NesSAN-xStore -l   # -l to login to target, -u to logout
          # add '--portal 192.168.1.4:3260' for specifid server 
ll /dev/sd*        # The new disk should be now there.
mount /dev/sdc /mnt       # Lets mount it..
df -h
touch `hostname`-`date +%Y%m%d-%H%M%S`    # Test if it's writable and if it's sync over the network


## NFS ##
===============================
Links: 
 http://www.cyberciti.biz/tips/howto-setup-linux-iscsi-target-sanwith-tgt.html


echo '
# Local Mount Name  # Client Access List
/mnt           192.168.1.0/24(rw,no_root_squash,sync)
' >> /etc/exports

exportfs -a
/etc/init.d/nfs restart  # Restart nfs mount

BASH: Using untyped variable to get unlimited parameter

I have been working a backup script at work that support MySQL, PostgreSQL and file using mysql_dump, pg_dump and duplicity commands. Since the script will be running parallel, the script will be calling up itself a lot, I need a better parameter parsing. And I absolutely do not want to use 100 lines of code to do such simple task. It will be so hard to maintain. And when I was trying to improve my parameter parsing, I found something called "untyped variable". I am not sure if it's a proper name.

Anyway, the whole point of doing this is: you do not have to use a lot of if conditions or case to sort variable one by one. You can just put the variable name in a loop, and it will parse out all recognized variable names.

I am using 'eval' to assign the values into variables. I was originally using 'export'. And I know there is actually some other way to do some, something like $($OPT)=$FIELDS, but somehow it didn't work for me. :-(


Using 'eval' to assign.

eval $OPT=$FIELDS

Parsing all variables and values

# Define all acceptable variable names here
ALL_OPT=(Type Host Pass User DB Table MaxTry BackupDir Src Dst Port sshUser Period dbExtra) 

for WORD in $@ ; do # $WORD is the name of variable, 
  for OPT in ${ALL_OPT[*]} ; do  # Check if I have the option in the list
  FIELDS=""
  case $WORD in
    $OPT=?*)  # To make sure it has '=' and at least one character after '='
      FIELDS=${WORD:`echo ${#OPT}+1 |bc`} # grap the value
      eval $OPT=$FIELDS    # Assign the variable to 
      echo "   export $OPT $FIELDS" 
      ;;
    Report)
      echo "calling up Report"
      bkReport
      break
      ;;
  esac
  [ "$FIELDS" == "" ] || break  # no value at all
  done
done 

Display all variable names and value

for OPT in ${ALL_OPT[*]} ; do
    eval aaa=\$$OPT
    echo $OPT = $aaa
done

Calling up the function

# Define all function names, which is the accepted variables value in first variable in ALL_OPT
ALL_TYPE=(Mysql File MySql Redmine)
[ $Type == "NULL" ] || for TypeCHK in ${ALL_TYPE[*]} ; do
  if [ $Type == $TypeCHK ] ; then 
    ChkPeriod $Period
    [ $? == 0 ] && bk$Type # Of course, you have to have the function, e.g: 'bkFile'.
  fi 
done

All codes

The Smallst Linux.. what can it do??

It's such an interesting product. I found it when I was thinking to build my own digital frame. This little guy runs uClinux, build-in web and telnet service. I wonder what else can it do... any one??

The Smallest Linux in the World

Chris Tyler ROCKZZZZ!!!

Is that a Ronald USB midi guitar?? Hopefully it's Linux based LOL

This is a top secret photo. I think Chris sneaked out when he was supposed to go No Frills to buy milk for next week.. sh... don't tell Diana.. LOL

Chris and other Seneca teachers whom should not be named of...

Just a joke.. Chris.. hope you don't mind... LOL

The easiest way to setup the most unsecure sendmail service in linux

Yes, the easiest way, and yes, the most unsecure, i mean it.

I hope this blog will help you. This is what I've found after 2 days of reading and frustration of trying to set up sendmail server/client for whole day.

And trust me, never setup sendmail on Friday... @@



--- Setup Sendmail ---

-- Server --
#vi /etc/mail/sendmail.mc
= Replace 192.168.168.1 with your mail server's IP.

DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=192.168.168.1, Name=MTA')dnl

## and...
= find "relay_based_on_MX" and comment or replace it with "loose_relay_check"

dnl #FEATURE(`relay_based_on_MX')dnl
FEATURE('loose_relay_check')dnl

# then..
echo "Connect:192.168.2 RELAY" >> /etc/mail/access

-- Client --
# find following line in sendmail.mc and change it.
[root@bb ~]# grep mail000 /etc/mail/sendmail.mc
define(`SMART_HOST', `mail0001.test')dnl


-- MAKE SURE --

= check if sendmail is listening to port 25
netstat -ant | grep LISTEN | grep 25

= check local or the service connect by telneting the port
telnet mail0001 25

= check sendmail status
service sendmail status


--- Links ---
-- Howto --
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch21_:_Configuring_Linux_Mail_Servers

-- Masquerading --
http://www.brandonhutchinson.com/Sendmail_masquerading.html

-- Mail Relay --
http://www.sendmail.org/m4/anti_spam.html

PS:
Here is the story be hide this post. Has any one found that the documentation of sendmail is a mess?? I always found it overwhelm, all the tutorial gives you some options that you may not even understand. That's why, I think it's good to setup the most basic one and then build stuffs on top of it. Making a service work is more important than any thing after all. Well... the worst thing about the way I setup is someone may use you mail server to send spam.... well... u lose some resources cos people may use it to send spam but, you can setup other options once you make sure every thing is working.

20090723
When I read this page again, I found that the reason why I could send it, it`s because I have already accept all my internal network. After doing more configuring with sendmail, I realize it wasn`t a fully open relay. I now have SSL configured with sendmail and dovecot. I may post the tutorial later, once I`m sure that`s really working and it`s the simplest way to do.

Laziest way to set SSH without password

I've been crazily busy lately, finally got a chance to check our fabulous CDOT planet again. Saw a few nice posts from LUX classmates. As the king of blog in LUX class, of course I have to post something, I'm gonna beat Kezong!! hehe... (see below for Kezhong's blog)

Yesterday I just did public key authentication too. You can actually do the following to minimize all the work. All you have to do is copy and paste following and type your password twice. :-)

===== Commands =====
##### Step: 1 #####
ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa
Key=`cat ~/.ssh/id_rsa.pub `
ssh -f -q nestor@bossanesta.ath.cx "echo $Key >> .ssh/authorized_keys"

##### Step: 2 #####
ssh -f -q nestor@bossanesta.ath.cx chmod 600 .ssh/authorized_keys



===== Verify =====
# if dosen't work, you can always use verbose/debug mode to see the ssh process..

ssh -vv bossanesta.ath.cx

# if still dosen't work and you're sure your file and permission is right, you may want to check the server sshd config file and make sure Public Key authentication is enabled. It's enabled by default anyway. Also you may need to create and change the ~/.ssh folder permission by yourself, if you have never ssh "from" the server/target.

##### IF SOMETHING GOES WRONG #####
Just follow the official guide step by step.. :-)


=== LINK ===
OpenSSH Public Key Authentication

A professional article about Public Key Authentication from very profession LUX student

Weekend; Toronto Island; Unplug day..

I've been quite busy for work and things that I want to learn in this field. Last week was very busy. So, last weekend, I decided not to do any thing about computer.. well.. i did tried. I went to Toronto Island for photography. I found that's the best way to be away of computer and get some real fresh away. :-)

I did about 300, 400 photos in there, went there around 5pm and start shooting once I was on a boat. I was surprised that view was so good from Toronto Island. Too bad there were a bit of fogs. I should go there one more time when humility was low. Any way, hope you enjoy the photos. Save them as your wallpaper if you want. :-)

hackers; spider; IDS; spam

In last few days, I've been getting a lot of possible attack warning from my IDS. Before, i always get some local port scan, brut force attack. Yesterday, I found one form Hong Kong.. i was like.. how could that be?

Then, I found the reason. 1,2 days ago.. I login to a photography site and post some of my photos, and I updated my profile and put my domain name on it. That site is from HK.. so.. I guess that explain why I got more attacker from HK.

Nes: 20090603:2030
I totally forgot to mention about "spider". I believe after posting that photo site (dcfever.com) I got attack from HK. I believe somehow some hacker use spider program to search every one's profile and see if there is a site. I believe that's how they got my site. I'm putting myself in a hacker's situation, I would do this. Why waste the time to surf every one's profile and see if there is any possible site to attack?:-)

I've been thinking to do something interesting to my possible attacker. I was thinking to hack them back.. but. hehe... i'm not a good hacker and i dun wanna get in big trouble. So, I've been thinking to telnet their mail port (25) and use snmp protocol to send them an email and tell them that there is 'someone' trying to hack other people's network. (hey, if someone trying to login my ssh with root or ssh more than 5 and it's not me, i'm sure that's not accident!!) That would be fun.. but I think i'll have to mangle my IP too. Just send that mail command, i wouldn't care if i got receive back.

Unfortunately, my Rogers broadband block port 25.. sigh.. I've been thinking to switch an other ISP.. found one for $45 with a static IP and all port open!! That seems to be a good choice tho.

My IDS has some Interesting reports.. got attacks from a security blog server

In the LUC course, we wrote an IDS program in perl. After setting up my own server, I put my IDS there and add on some simple features. When ever there is an possible attack, no matter if it's brute force, port scan, I will block the source IP and also port scan back with "nmap -A -PN", then output the result in my apache directory. It's been running for a while. And my IDs has collected quite a lot of interesting reports.

As far as I know, the source IP can be a hacked machine or from a network. Althought I may not able to track down the attacker, but I would like to see where it's from. One of the source has an entry mentioned about an site called "http://echelon.pl/", it blog talk about IT security or.. IPSec... I'm thinking how could it end up attacking my server? haha...

Tne entry:

106/tcp open pop3pw Poppassd 1.8.5 (http://echelon.pl/pubs/poppassd.html)

Anywya, if you're interested, you can see all the nmap result here.. And have some mercy.. don't hack my server.. ;-)

http://bossanesta.ath.cx/NesIds/nmap/

FREE Photogrphier for Open Source and Seneca!!

Dessert Flower, love the contrast

Just bought a new lens, Nikkor 50mm F1.4. It's super amazing!!! It's not expensive tho, I bought a used one for $320, a new one is around $350. It's actually a mid-priced lens. cos the top one should be 50mm F1.2 or 80mm F1.4. But.. u know what? this is amazing!! When I first saw the photos, i was like.. OMG.. are those really my photos? hahaha..

I would love to dedicate my hobby to all every one involved in open source and Seneca. Let me know if I could help you. And I'll try my best!

PS: look at my tittle, geez.. i should be in media instead of computing. Maybe I've read too much gossip magazine, hahaha..

SHOW TIME!! Great deep of view from my Nikkor 50mm F1.4

Zen, love the colour match and the peaceful sweet scene

CDOT Student Presentation 200904 in Flickr

Finally, I've uploaded it, hehe.. If you want the original, please let me know.



CDOT Student Presentation 200904 in Flickr
(Full Screen, flash required)

CDOT Student Presentation 200904 in Flickr

Another Andrio Phone, Samsung i7500

Cool.. finally, another Android!! Really looking forward to see the real thing. I actually have been using my iPhone at home when I have problem with my network. It's just so cool and convenience. When every I need to test WLAN or LAN, I would use it.I can run ping, nmap, sniffer, tcpdump, ifconfig, etc networking tool on my phone. And in last few days, on my brother's request, I setup tittering for his brand new Asus 1000HE, so he can connect the internet any where with his 3G network. And he loves it!!

And it should be practical at work also. You know, in some critical production site or some data center, it's quite hard to get internet connection. Using your phone, which allow you connect to the internet without affect the production site network, this is amazing.

When there is a new iPhone coming up(next year?), i may get a new phone, it should be either the new iPhone or an Android. Frankly, mostly i'll get the new iPhone. But if I do use it to type command.. well.. an Linux based smarphone with slide keyboard should be a better choice tho. Although I do love the touch screen on iPhone.. but for typing? A physical keyboard is much more better tho.

Consider Linux SmartPhone is going to be the future, should every Sys admin get a smart phone?


Samsung i7500 in cent

Hands on preview in a Russian site

mNm Release 0.9

mNm Release 0.9

= integrated multi-language support
= progress bar & message
= Existing Code migrate with Fedora First Boot, as a plug-in in 'Create User' Module
= Improved Auto Mount (instead of un-mount every thing, it only mount non-existing one)

OH.. My gosh... i almost delete all my post in blogger..

I was managing my label/tag of my post to prepare my project presentation.. i click on the 'delete' below 'apply label', it thought it's delete the label. But no!! it deleted my blog. I actually doubt about it already, but as labeling a blog has an undo function, i thought delete a blog should have an undo, right?



NO!!! IT DOSE NOT!!


Lucky that I was playing blogger because my FreeBSD assignment needs to import post from blogger to wordpress. And I did have a backup... that I didn't even remember. Thanks god.. every thing is here.. :-) I still wanna show my blog to my grand children... LOL

Migrate aNd Manager Release 0.8 Progress Update

mNm running as an Firstboot module


So... I've been trying to put mNm to merge with firstboot. Althought I should contact firstboot owner soon.. but I still want to make sure my program will not have big problem when integrate to firstboot. I've been playing around the modules. After 2 days of testing, I finally figure out a way for it.

Instead of using it as a module in Firstboot, mNm should be used as a plug-in (Please correct me if this is not the proper way to call it.). So.. in "Create User" module, user can also choose a 'Network Login' thing.. (honestly, i dun really know what it really dose tho). It calls up '/usr/bin/authconfig-gtk --firstboot' as a process. So... that where mNm should be!!

Let me also talk why it should be a plug-in. I was thinking if mNm should be replacing 'create user' module or should be an alternative module. But the logic is kinda wired. and firstboot dose not run like that. Firstboot will call up modules one by one in sequence. As mNm will do automount, it's kinda silly to mount every thing even mNm will not even being used. I believe running mNm as the Create User plugin is the best way to do. And also.. it seems that calling up mNm as a module in firstboot is not possible. As you can see in the capture that I run mNm as a module and the item list is blank. Maybe there will be some way to do.. but if the plug idea is working.. why bother? :-)

But I will still confirm with my super duper professor Chris Tyler first. Then... multi-language!!


Here is some improvements I've also done in last two days..
1. disable umount when calling up 'AutoMount'.
2. It has a bug that, if the user folder contain file, mNm will crash. This issue has been fixed.

PS:
Finally, I fixed the problem in the tree list when mNm running as a module in firstboot. I've also uploaded the capture as the first image. (Nestor, 200904071200)

mNm running as an plug-in inside Firstboot module 'Create User'

Migrate aNd Manager Release 0.8

This version of mNm has a functional GUI that will provide all functions that need to be done for firstboot. Although there are some small improvements need to be made but Since it matches all milestone that I planed before except Multi-Language font part, therefore, I'm posting it here.

Hopefully, I'll have a newer version of 0.8, which would be called 0.8.1 coming this weekend that will have scroll bar and it will a better version of 0.8. The next release 0.9 should be a fully working version. And I'm targeting to do bug fixing and improvement after release 0.9.

Here is a list of things that I've added in this 0.8 release...
* check boxes
* auto mount (add on auto mount to mount all supported types)
* auto search (including OS type and users, default OS User home only)
-- get supported OS type from database
-- put list of supported OS object(classes) in a list
-- find out if the mounted drives (just in all drives except default live CD user) has any user

mNm Program/Source

mNm Main Page in FedoraHosted

Migrate aNd Manager Release 0.71

Welcome to the team
First welcome Kezong Liang, Stephen joing me on this project. Stephen will be concentrating on multi-language support of the program.

What's in 0.71 release?
This release is a preview of 0.8. Several bugs have been fixed in GUI mode. And it could be download with yum from Mohak Dilipbhai Vyas.
The GUI function is only showing ideas of how the GUI may look like.

Instruction:
1. download this rpm package and put vyasrepo in your repo list
http://matrix.senecac.on.ca/~mdvyas/vyasrepo-10-1.fc10.noarch.rpm
2. type in this command..
yum install mnm

How to run...
the program will be saved in your /usr/sbin/. If you do not want to risk you documents, running in virtual machine is strongly recommanded.

Thanks
Thank you for Patty, Milton on helping me testing this program, and Mohak kindly packaged this program and put it in his repository. And of course all the hard work from Stephen Liang. :-)

How many VMs can my Asus EEE PC handle?? 2?? no.. 4?? em... hehe..

Intro:
I've been working on my NAD project with vbox's vms.. i'm really curous what this little single core cpu machine can do. Here is the config..

Asus EEE
- 2G Ram (MAX for eee)
- Fedora 10
- fresh boot
- laptop mode (as real ram as much as possible, instead of swap)
VMs
- 4 F10 with 256 ram, 4mb Video ram, text mode (init 3)
- 1 F10 with 512 ram, 12mb Video, X windows

Assumption:
- F10 host (Asus EEE) fresh boot with X running use about 500-700mb
- One F10 VM in text mode use around 250Mb
- idealy
- total 2gb ram means I can use at least 5 Vms.. (700+(250*5))
- when the VM in text mode and idle, it use 5-15% CPU
- start all VMs one by one to reduce run time and chance of crashes

Result:
- IT WORKS!!! 5VMs running smoothly!!
- impressive!!
- it use some swap but.. well.. cos the last one was 512mb F10..
- it may able to run 6 VMs smoothly if I have 2 more 256mb ram F10
- really impressive!!
- if it has service running (httpd, dns).. it may use a bit more memory... and a lot more CPU. using a 'find' command use 60% host CPU already!
- it may able to handle 6VMs or even 7VMs in text mode and still have an acceptable performance. even with some simple service on and those are not busy services..
- it's perfect for testing...
- it's absolutely impressive!!!! ;-p

Adding a bridge NIC(virbr, br, pan) in Fedora 10(F10), purely command lines..

I've been using Virtual Box for a while and love it. But the downside of vbox is you can not use your NIC's alias as the bridge or interface. So, I found out a way to add a bridge NIC in pure command mode. Since there is no such tutorial online, I would love to write this down and share with you. This is just a short tutorial that to show you create a virtual NIC in command lines only.


========================================================================

brctl addbr virbr2
ifconfig virbr2 up
ifconfig virbr2
# now, record the MAC address of your Virtual NIC

vi /etc/sysconfig/network-scripts/ifcfg-virbr2
# and type all following lines in there,
# but modify 'HWADDR' as the MAC address
# and change the IP as you want.

TYPE=Ethernet
DEVICE=virbr2
HWADDR=B6:9F:39:E6:DC:64
BOOTPROTO=none
ONBOOT=yes
USERCTL=no
PEERDNS=yes
IPV6INIT=no
NM_CONTROLLED=no
NETMASK=255.255.255.0
IPADDR=192.200.200.2

# now, check if it's really working
# if it's successfull, the ip you typed before should be assigned
service network restart
ifconfig virbr2

========================================================================
then, your virtual NIC should be up and running after restart.


PS: i put a long title on purpose, so other people can google it. :-)

mNm Update

I've been working on the GUI after 0.7 release. The next release will have a working GUI that automatic mount Fedora supported partitions, and detect all users from supported OS. It will also have a click box that allow user just migrate certain folder, mount or users. And of course, automatically create user if the user is not existing.

And finally, I got my tree working with check box. The next step will be integrating these check box with the migration process. Since I don't have good foundation on python GUI module, this may take me a while.

But i can't help myself to show off my work, hehe.. even there is a lot to work on..so.. here is the capture...