Walker News » Search Results » 3-minutes

How To Install NRPE On RedHat Linux?

Walker — Sun, 20 Mar 2011 16:19:58 +0000

Nagios, an open source computer/network monitoring system, can monitor remote servers actively or passively. For active mode check, one can use check_by_ssh to execute Nagios plugin on remote hosts, check_snmp via SNMP protocol, NRPE addon (Nagios Remote Plugin Executor), etc.

The focus of this subject is active mode status checking using NRPE solution that supports SSL encryption and smaller communication overhead (as compare to SSH solution), better security control, etc.

A brief intro of how NRPE works with Nagios Core

Nagios Core process on server executes check_nrpe plugin to connect NRPE listener (daemon) on remote host that in turn executes Nagios plugin to check system/service status.

Therefore, you need to compile NRPE on Nagios server (for check_nrpe binary) and remote server (for NRPE listener binary).

How to compile and install NRPE on RHEL 5.2

NOTE:

Though this reference is based on RHEL 5.2, it should be applicable to Fedora and CentOS.
Prior to compile NRPE source files, uses rpm command to confirm the system has installed openssl, libssl, gcc, etc.
In additional, compile and install Nagios Plugins (refer to steps for “Nagios Plugins” and “create user account for running nagios” ONLY, if this standard plugins package is not already installed).
To play safe, compile NRPE source files on each Linux servers that require NRPE binaries.
On Nagios server, stop after executing “make install-plugin” command (see below).

Firstly, login as root and download NRPE to local disk. If the Linux machine has direct access to Internet, just run this wget to download NRPE v2.12 (latest version at this time of writing):

wget http://prdownloads.sourceforge.net/sourceforge/nagios/nrpe-2.12.tar.gz

Extract NRPE source files from the compressed tarball:

tar -zxvf nrpe-2.12.tgz
cd nrpe-2.12

Run configure file. The use of “with-nrpe_port” is optional, which is only applicable for those who want to change NRPE default listening port from 5666 to other port number (e.g. 63636):

./configure --with-nrpe_port=63636

Compile NRPE source files (pipe output to tee command is optionally, but duplicate output to file could be useful for tracing errors that happen during compilation):

make all | tee nrpe.make.all.log

Install NRPE plugin (will automatically copy src/check_nrpe to /usr/local/nagios/libexec directory):

make install-plugin

Stop here if this procedure is applied on Nagios server (as mentioned above). Continue next step if this procedure is done on remote server (to be monitored by Nagios server).

Install the daemon (NRPE listener) and sample of NRPE config file:

make install-daemon
make install-daemon-config

Append the entry of NRPE listener and port number to /etc/services file, e.g.:

nrpe      63636/tcp      # NRPE Listener

Edit /usr/local/nagios/etc/nrpe.cfg to change “allowed_hosts” from “127.0.0.1″ to the Nagios server IP address where check_nrpe plugin is running.

In my test, the “CHECK_NRPE: Error – Could not complete SSL handshake.” rejection is caused by “allowed_hosts” setting in nrpe.cfg file :(

Add this entry to /etc/rc.local file for Linux to run NRPE listener automatically after boot-up (for some reasons I couldn’t get NRPE daemon up via xinetd service):

/usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

To run NRPE daemon (listener) immediately, just manually execute that line in /etc/rc.local file. To terminate NRPE listener, execute ps command to find out the PID of NRPE:

ps -elf | grep nrpe | grep -v grep

Then run kill -9 to stop it.

Now, let’s check NRPE installation to confirm it works. So, make sure the NRPE daemon is running on remote server (login as root):

netstat -tulpan | grep nrpe

Confirm the RedHat Firewall is not running (for simplicity) or ensure it allows Nagios server connects to NRPE listening port number. In my test, the “Connection refused or timed out” is caused by RedHat Firewall.

Login to Nagios server as root or nagios user and run check_nrpe to confirm it can communicate with NRPE daemon on remote host (that listening to TCP port number 63636, in this example):

cd /usr/local/nagios/libexec
./check_nrpe -H  63636

If it displays “NRPE v2.12″ (the version used in this guide), it means everything OK and set to configure Nagios Core (e.g. /usr/local/nagios/etc/objects/linux.cfg, etc.) for monitoring that particular remote host using NRPE addon solution.

How To Restart VNC Server After VNC Service Hangs or Stops Unexpectedly?

Walker — Fri, 03 Apr 2009 10:32:55 +0000

How difficult is to restart the VNC server or service? Well, there is certainly no difficulty at all, if you’re in front of the server.

Now, imagine that server is at few hundred miles away and nobody is there to restart that bloody machine.

Worst still, simply reboot the machine might not able restart the VNC server.

So, what could you do in order to get the VNC server back to work? Precisely, if you can’t VNC to the remote server, how could you attempt to restart the VNC service?

OK, here are the tips and tricks for VNC server running in Windows or Linux machine.

To apply this method, however, there must be network connection between you and the remote server.

Restart VNC service of a remote computer running Windows 2000 or above

You must do the following steps on a computer running Windows 2000 or above as well. Let say this is a Windows Vista Ultimate machine.

1) Click the Vista Orb (Start button), right-click on Computer and select Manage option from the pop-up menu. This will open Computer Management window.

2) Right-click the Computer Management (Local), the top node on left pane, and select Connect to another computer….

Alternatively, click the Action menu to find the same option.

3) In the Select Computer dialog box, opt for Another Computer and type the computer name in the text box.

If you can’t remember the computer name, click Browse button follow by Advanced button and click Find Now to list all computers detected.

Now, hopefully this step will be succeed. Otherwise, it ends here :-(

Once you’ve connected the remote computer, click Services and applications node on the left pane of Computer Management window. From there, locate the VNC service on the right pane and restart it.

Restart VNC service of a remote computer running Red Hat Enterprise Linux

With Linux, this job is easier :-)

Other than network connection, you must able to remotely login the Linux server, be it the vulnerable telnet or secure SSH protocol.

After login to Linux command prompt (via telnet or SSH), just execute service vncserver restart, if the VNC server is configured to auto-start when Linux boots up / reboot.

If there is no auto-start setup, then do the manual ways as you’ve done:

1) If the VNC server process stills exists, and it was started with DISPLAY:1, then kill it will command vncserver -kill :1

2) Start it again by executing vncserver :1

Now, you can confirm the VNC server is up again by executing netstat command:

netstat -tulpan | grep vnc

If the VNC server is started for DISPLAY:1, the netstat result should shows Xvnc listening to three different ports: 5801, 5901, and 6001.

How To Quit From Telnet Login Prompt Immediately?

Walker — Thu, 19 Mar 2009 14:48:22 +0000

To many of you, this is not an interested post. However, it will not cost much for recording it here as a reference.

Question: You’re accessing Linux command prompt in front of server console or via remote access client (be it a insecure telnet or encrypted SSH connection).

Then, from that Linux command prompt, you make a telnet connection to other telnet server (be it a Unix/Linux-based or the Windows Telnet server).

While at telnet login prompt, you find out that is not the right telnet server to access and want to quit immediately.

So, how could you exit from the telnet login prompt immediately, without waiting for it to time out or forcibly terminate the telnet client process?

Answer: I find out that the telnet client of either Windows Vista Ultimate or Red Hat Enterprise Linux 4 supports the same “escape” key.

This special key, better known as “escape character” brings up the telnet > command prompt instantly when it’s pressed.

As seen in this following screenshot, the “escape character” is ^]. That’s to say, press CTRL and ] together for the telnet > command prompt and just enter quit command to end the telnet client process properly:

With this “proper” way, there is no need to wait for time out, simply close Putty window, or execute kill -9 command from another session.

How To Create Volume Group And File System With LVM2 In Linux?

Walker — Sat, 07 Mar 2009 09:43:32 +0000

LVM, shorts for Logical Volume Management, is available in most modern Linux distributions. If I recall correctly, the disk layout for file systems of Red Hat Enterprise Linux 4 default installation is based on Logical Volume Management.

As the name implies, LVM is a software technique to consolidate a group multiple block devices (hard disk or disk partition) and present them to OS as a single disk volume. In other words, system administrator can build or create a 500GB file system with 2 units of 250GB hard disk.

Another advantage of using LVM implementation is flexibility to perform on-the-fly resize for the file system that built on this virtual disk partition, by adding in more physical hard disks and disk partitions.

^{A visualized concept diagram of the Linux Logical Volume Manager or LVM}

How to create a new volume group (VG) and file system on Logical Volume (LV)?

Base on RHEL4 and LVM2 as the platform, here is the summary of steps to build a new volume group (VG), create a Logical Volume (LV), followed by making new file system on it.

As with most Linux commands, the LVM and file system related commands come with number of option switches to extend or overwrite the command default behaviour.

Obviously, this general guide doesn’t cover detail of all option switches. For your own good sake, just vet through the command manual page to see if any of those option switches applicable to your environment.

1) Use lvmdiskscan to find out how many block devices (hard disks or disk partitions) seen by OS are currently used for LVM:

2) With reference to lvmdiskscan output, the /dev/sda2 disk partition is not currently used for LVM. However, it might be used by Red Hat.

So, you’ve to verify or confirm which of the non-LVM block devices are not currently used by Red Hat with the df command. For example, this following df -h output clearly indicates that /dev/sda2 and /dev/sda3 are actually mounted as root and boot file system respectively:

3) Now, let say I decides to create the new Volume Group (VG) with two unused SCSI hard disks, /dev/sdh and /dev/sdi. So, let’s use the pvcreate command to initialize these two SCSI hard disks for use by LVM:

pvcreate /dev/sdh /dev/sdi

The pvcreate command creates the VGDA, shorts of Volume Group Descriptor Area, for LVM to keep track Physical Extent (PE) allocation history, among other things. The initialized hard disk is known as Physical Volume (PV).

The manual page suggests setting a DOS disk partition to Linux LVM partition type (0x8e) prior to execute pvcreate command. But, why not to keep a standard by explicitly creating or changing non-LVM partition to LVM partition type?

1) To change existing, non-LVM disk partition to LVM partition type (0x8e) by using fdisk command:

2) To use the entire hard disk for LVM, simply proceed with fdisk to create one primary partition to take up whole hard disk space and then set the partition type to 0x8e.

The pvcreate manual page, however, suggest a faster approach by destroying the existing partition table, with this dd command:
dd if=/dev/zero of=/dev/sdi bs=512 count=1

4) Now, use vgcreate command to create a new Volume Group called vg7, using the block devices (/dev/sdh and /dev/sdi) initialized by pvcreate command in previous step (you may run pvdisplay to see difference of before and after executing vgcreate command):

vgcreate -s 16M vg7 /dev/sdh /dev/sdi

A Volume Group can be thought of a container that house all the PV specified by vgcreate or vgextend command. Conceptually, you should regard Volume Group as a virtual hard disk, as you can see later that it’s possible to “partition” the Volume Group into Logical Volume (LV).

The -s option switches specify the physical extent size (PE size) of the volume group. If this is not specifying, the default PE size is 4MB, which is best for most applications.

The maximum number of PE per Logical Volume (LV) is not applicable in LVM2. However, high number of PE could affect LVM tool performance.

As such, set a bigger PE size could effectively reducing number of PE per VG and LV (if the VG is big enough).

Take note that the name of VG must not conflict with existing VG. To list existing VG in system, execute vgscan

5) Next, we proceed to partition Volume Group into Logical Volume. A file system can only be built on Logical Volume (LV) but not Volume Group (VG). Therefore, at least one LV must be created per VG. For example, this lvcreate command create a 400MB Logical Volume (virtual disk partition) called lvol3 in the Volume Group called vg7:

lvcreate -L 400M -n lvol3 vg7

Similar to VG, the name of LV must not crash with the existing LV in the same VG. Again, this can be verified by executing lvscan

To use all free Physical Extent in Volume Group for Logical Volume, you can use -l option switch to specify the number of PE to create the LV. The number of free PE in Volume Group vg7 can be checked by executing vgdisplay vg7

6) Now, with the new Logical Volume (lvol3), we can create file system on this virtual disk partition. For example, this mkfs command create the Linux EXT3 file system on Logical Volume /dev/vg7/lvol3, with -m 2 option switch to specify 2% of the file system blocks reserved for super-user.:

mkfs -t ext3 -m 2 -v /dev/vg7/lvol3

The full path of logical volume can be checked by executing lvscan command.

7) Once the mkfs successfully creates EXT3 file system, it’s ready to mount the new file system. First, create a directory as mount point, let say this:

mkdir /NewVGMnt

8) Then execute the mount command to mount the new file system to /NewVGMnt:

mount -t ext3 /dev/vg7/lvol3 /mnt/NewVGMnt

To verify the mount point, just type df -h command to confirm it’s done successfully. To enable Linux automatically mount the new file system during boot-up, include this new file system to /etc/fstab system file.

How To Install And Start Telnet Server In Red Hat Linux?

Walker — Tue, 18 Nov 2008 17:26:48 +0000

Every server administrators should and must know that telnet protocol is not secure, because data packets transfer between telnet server and client not encrypted.

That’s to say, anyone who use sniffer to capture network packets can read the plain text transfer over the network. If the packets captured contain login credentials, the server access and security control will be compromised.

Thus, by default, most Linux distributions install SSH server and not telnet. Red Hat Linux even explicitly categorize telnet server as one of the “legacy network servers”.

However, what if you really want the Linux machine running such insecure protocol?

How to install and start the insecure telnet server (in Red Hat Linux Enterprise 4)?

Look for the telnet-server RPM file in the installation CD/DVD and install it from command line, e.g. rpm -Uvh telnet-server-0.17-31.EL4.3.
Alternatively, login to GNOME Desktop, go to Application menu, System Settings, and click Add/Remove Applications to bring up Package Management window:

^{How to install and start telnet server in Red Hat Linux?}

Select Legacy Network Server (tick the check box), click Details link to bring up Legacy Network Server Package Details window, and select Telnet-Server to proceed with the installation.
At Linux command prompt, execute chkconfig telnet on to allow the xinetd spawns telnet-server processes upon client requests.
Alternatively, edit the telnet configuration file (/etc/xinetd.d/telnet) and change disable = yes to disable = no.
Make sure the xinetd is running on your Linux default runlevel. To be sure, configure xinetd to start at runlevel 3, 4, and 5:
```
chkconfig --level 345 xinetd on
```
If xinetd is not currently running (run ps -elf | grep xinetd), execute service xinetd start or service xinetd restart to start/restart it.

The running xinetd (extend Internet service daemon) listens to telnet client request on port 23 and spawn the telnet-server (/usr/sbin/in.telnetd) upon request, shut it down when telnet client drop the connection.

To confirm xinetd is listening to port 23, execute the netstat utility:

netstat -tulpan | grep 23

Linux: How To Backup And Restore Directory With Tar Over SSH Connection?

Walker — Wed, 05 Nov 2008 17:53:44 +0000

As per internal disaster recovery code, we have to redo DR server setup exercise every year, as to get sysadmins familiar with processes that are not frequently done and take chance to confirm latest updates deployed to live server are also working well in DR server.

So, it’s unavoidable to backup some directories on live machine and restore them to DR box. Problem is that the live system has insufficient free disk space to create tarball (tar archive or .tar file), as some of the directories are bulky.
In this situation, flexibility of Linux system comes into picture. Instead of creating the tarball at live system, we opt to backup and restore over network!

In brief, it’s a method called tar over SSH, where we are going to create tarball of directories on live server, pipe it over SSH connection (secure shell connection), and untar the tarball on remote DR server at one go (i.e. enter a series of Linux commands on one line and press ENTER key to execute them).

How to backup and restore Linux file system with Tar command over SSH connection?

This is the commands template:

tar -zcvpf - dir1 dir2 | ssh root@walkernews.net "cd /usr/local/share/lib; tar -zxvpf -"

where

tar option switch
- -z and -c meant to create (-c) a compressed tarball using gzip (-z)
- -v meant to verbosely list files processed
- -p meant to preserve file permission information
- -f meant the tarball output location. In this example, the tarball is created to – (i.e. stdin or standard input).
dir1 and dir2 are the target directories to be backup
| is the pipeline, meant the Linux inter-process communication (IPC).
the SSH remote shell command execution group the series of commands in double-quotation mark, in which it login to remote DR server (e.g. walkernews.net) using root user account, changes working directory to /usr/local/share/lib follow by untar the tarball data stream from stdin input of first tar command (the tarball creation that initiated on live server).

Now, what about if you want to tar backup directories of local system onto remote DR server? I.e. to create tarball of local directories onto remote server over SSH connection (use either one of these two commands; where backup.tgz is a gzip-compressed tarball file name):

tar -zcvpf - dir1 dir2 | ssh root@walkernews.net "cd /backupdir; cat > backup.tgz"

tar -zcvpf - dir1 dir2 | ssh root@walkernews.net "cd /backupdir; dd of=backup.tgz"

How To Crack Targus DEFCON CL Laptop Lock BY CHANCE In 3 Seconds?

Walker — Sun, 20 Jul 2008 05:41:45 +0000

Believe me, it’s not a 3-seconds or 3-minutes job to unlock, to break or to crack a laptop cable lock, especially the Targus DEFCON lock that built with cut-resistant, vinyl-coated, galvanized steel cable and a user-settable combination lock with up to 10,000 possible settings!

But, you’ll know how could someone “crack” your laptop lock “by chance” in just three seconds…

Question 1: Where do you normally use the laptop computer cable lock? Most likely the answer is in the office.

Question 2: How many people used to scramble or reset the security code after unlocking the laptop for a meeting at next door?

Well, I’m afraid that not many users remember to reset the security code, i.e. leave the cable lock in unlock state.

^{How to crack a highly secured Targus DEFCON CL laptop lock in just 3 seconds?}

So, it happened last week in my office. A 3rd-party office cleaner, who came for cleaning works during lunch hour, stole a premium Dell XPS M1330 that was secured with a Targus DEFCON CL lock (the branded cable lock bundled with most Dell laptop package).

The CCTV footage shows that the guy unlocked the “super secured” cable lock as if he knows the security code.

Is there a master unlock code of this 30 over bucks cable lock, that allowed him to crack it so easily?

(We highly believe that) the answer is the careless of owner. The manager recalled that he used to leave the cable lock in unlock state whenever he took the laptop away his office, especially when rushed for a meeting.

So happen that he used to back his cubic after lunch in case the meeting was in morning session, and the cleaner is so smart to remember his security code of the cable lock that was left in unlock status.

That’s how the cleaner crack the Targus DEFCON CL Laptop lock BY CHANCE in 3 seconds on the next day lunch hour, when the manager left for lunch with his Dell laptop “locked” in office.

This careless could lead someone to break just any cable locks, not limited to the tough Targus DEFCON CL lock!

Verdict: Remember to scramble / reset the security code after unlock the laptop!