Installing with yum from a text file.

To install a list of specific  packages that are installed on one server to another server .

rpm -qa > installed.txt

will create a text file with a list of all installed packages

copy installed.txt from server1 using rsync to server2, like this:

rsync installed.txt  server2:

then on server2  type

 yum -y install $(cat installed.txt)

This will now install all the packages listed in installed.txt on server2.

Disallowing programs through Sudo

You want to grant user cgerada root privelages to all programs except one, lets use tcpdump in this example.
ie we want to prevent cgerada from running  tcpdump,  but he must still be able to run all other commands as root using sudo. Further ,you do not want cgerada to have the ability to sudo -i
which effectively changes cgerada to the root user.

Normally with sudo you list the programs that the user is allowed to run with root privelages.
in this example you want to list and implement a program that is not allowed..

To edit the sudoers config file
type visudo  [enter]
which will bring up the sudoers file in vi ready to edit..

add the following line

under the section were the Cmnd_Alias is commented out
add the following alias

Cmnd_Alias DISALLOWED = /user/tcpdump, /bin/bash

You can separate with commas all the commands that you want to disallow.

Im also disallowing /bin/bash simply because when a user types sudo -i a new bash session is started as root. by disallowing this my user will not be able to sudo -i.

Further down in the sudoers file were you see
root   ALL=(ALL)    ALL

add the following underneath

cgerada ALL=ALL, !DISALLOWED

The !(Bang) means the opposite  ie without the !(bang) the user will have access to those programs.
by putting in a !(bang) in front the opposite is true.

save the file and exit by typing :x [enter]

Now look what happens if the user cgerada tries to run tcpdump


sudo tcpdump -n port 25
[sudo] password for cgerada: 
Sorry, user cgerada is not allowed to execute '/usr/sbin/tcpdump -n port 25' as root on server.

now look what happens if the user tries to sudo -i

sudo -i
[sudo] password for cgerada: 
Sorry, user cgerada is not allowed to execute '/bin/bash' as root on server

Continuously keep trying a connection

To send continuous packets to a port on a server
useful for when your are tracing packets to troubleshoot a VPN or connection problem.

The following will keep retrying

 while true; do nc <ip address of server> <port>;done 

eg

 while true; do nc 192.168.0.1 8080;done 
or if you prefer telnet over netcat

while true; do telnet 192.168.0.1 8080;done 

can also be used to keep retrying your ssh connection until it connects.
eg
while true; do ssh user@192.168.0.1 ;done 

rdesktop tips

When connecting to Windows servers using Linux rdesktop
use the following command to connect to the windows server
rdesktop

eg rdesktop 192.168.2.100

This will open up a remote desktop session to the server

rdesktop -r disk:name=path  

eg rdesktop -r disk:home=/home/cgerada 192.168.2.100
will make your local path available under "my computer" so that you can copy files from client to server

rdesktop -g 1024x768

eg rdesktop -g 1024x768 192.168.2.100
will set your screen resolution to 1024x768

more examples


rdesktop -d domainname -u cgerada -p passw0rd  -k en-gb -a 16 -g 1024x768 -r disk:home=/home/cgerada 192.168.2.100

-d = domain name
-u = username
-p = password
-k = keyboard layout eg en-us for a us keyboard layout or en-gb for a british one
-a = amount of colours in the pallet

Make Ubuntu boot into run Level 3

Edit /etc/default/grub with your favorite editor,

sudo vim  /etc/default/grub
Find this line:

GRUB_CMDLINE_LINUX_DEFAULT=”quiet splash”
Change it to:

GRUB_CMDLINE_LINUX_DEFAULT=”text”

Update Grub:
sudo update-grub

Done, Next time you boot it will be into run level 3

Show how old your Linux installation is.

To find out when your Root partition was created.

type

sudo tune2fs -l $(df -h / |(read; awk '{print $1; exit}')) | grep -i created 

Convert MP4 to MKV

My Blue Ray Player does not play .mp4 files (x264)

To convert .mp4 files  to .mkv using ffmpeg
sudo yum install ffmpeg    (To install ffmpeg)

Then use the following command

ffmpeg -i filename.mp4 -vcodec ffv1 -acodec pcm_s16le filename.mkv

Upgrading Java

When ever you upgrade Java, the old version is always left on the server and is still in use. You will have to do the following to activate and use the new version.
in this example I am upgrading from Java 1.4 to 1.6
if java is available in your repository type 
yum update java or if you have the rpm
type rpm -Uvh java-version_of_yourJava.i386.rpm 
Although upgrade option is used in both instances, java is not actually upgraded. Just the new version is  installed alongside your current version.

You need to use the alternatives system to use the new version. here's how. type alternatives --config java 
The alternatives system maintains symbolic links determining default commands. Our new version of java is installed under
 /usr/java/jdk1.6.0_26 (so the path of java binary is /usr/java/jdk1.6.0_26/bin/java. I’ll add this as the default for Java:

type 

alternatives --config java 
You should receive output similar to the following:


There is 1 program which provide 'java'.

  Selection    Command
-----------------------------------------------
*  1           /usr/lib/jvm/jre-1.4.2-gcj/bin/java

Enter to keep the current selection[+], or type selection number: 


As you can see the new version of Java is not only not being used, but there is no mention of it in the alternatives system.
So we need to add it to the alternatives system to be able to use it. heres how. type 
alternatives --install /usr/bin/java java /usr/java/jdk1.6.0_43/bin/java 1 

The syntax of alternatives is as following 
-- install /path_to_symlink program_name /path_to_program priority

Once done if you type
alternatives --config java 
You should now get the following 


There are 2 programs which provide 'java'.

  Selection    Command
-----------------------------------------------
*  1           /usr/lib/jvm/jre-1.4.2-gcj/bin/java
 + 2           /usr/java/jdk1.6.0_43/bin/java

Enter to keep the current selection[+], or type selection number: 

Simply select the version that you want to use as the default version.
Select 2 to use the new 1.6 version.
You can switch between versions this way and change back to the old version if you need to.

2 Way Synchronization with Unison

2 Way directory Synchronization

I found unison is a better option than rsync if the files in both locations frequently change, or if you want to synchronise between more than 2 locations. and you need to keep all locations synchronised.

yum install unison 
on all machines that you want to synchronise between.

for password-less sync make sure you setup ssh private/public key
as described in this previous post ssh public/private key

create a file sync.sh

vim sync.sh

copy and paste the following into your file


#!/bin/bash
# set paths / dirs
_paths="/home/cgerada/directory_to_sync"

# binary file name
_unison=/usr/bin/unison

# server names 
# sync local +server1 with server2 and server3
_rserver="server1.clive.com server2.clive.com server3.clive.com"

# sync it
for r in ${_rserver}
do
        for p in ${_paths}
        do
                ${_unison} -batch -force newer -times "${p}"  "ssh://${r}/${p}"
        done
done

save the file and give it execute rights

chmod + x sync.sh

to run the script on a cronjob every half an hour and output details into a log file

crontab -e

and add the following

*/30 * * * * /path/to/sync.sh &>/var/log/sync.sh.log

save and you are done.

~                                                                          
~                                                  

Chrooted SFTP

This will chroot (restrict)
all sftp users to their home directory

on your SFTP server type

group add sftpusers

vim /etc/ssh/sshd-config

comment out

#Subsystem       sftp    /usr/libexec/openssh/sftp-server

add

Subsystem       sftp    internal-sftp

You want to put only certain users (i.e users who belongs to sftpusers group) in the chroot jail environment. Add the following lines at the end of /etc/ssh/sshd_config

Match Group sftpusers

        ChrootDirectory %h

        ForceCommand internal-sftp

Match Group sftpusers – This indicates that the following lines will be matched only for users who belong to group sftpusers

ChrootDirectory /sftp/%h – This is the path that will be used for chroot after the user is authenticated. %h indicates the users home directory. So, for john, this will be /home/john.

ForceCommand internal-sftp – This forces the execution of the internal-sftp and ignores any command that are mentioned in the ~/.ssh/rc file.

next either add new users to your system or you can add existing users to the system

user add john mary clive

Add all sftp users to the sftp group by editing your 

/etc/group file  

sftpusers:x:501:john,mary,clive

Make sure users cannot login using ssh, do this by editing /etc/passwd

vim /etc/passwd

and changing /bin/bash to /bin/nologin of each SFTP user

From

john:x:500:500::/home/john:/bin/bash

To

john:x:500:500::/home/john:/bin/nologin

next 

chmod -R 755 /home/john

then you must set the following ownership to the users home directory

chown -R root:sftpusers /home/john

restart sshd

/etc/init.d/sshd restart

you can now sftp into your server and the sftp users will be restricted to their /home folder only.

                   

                                                                                                                                                

~                                                                                                                                                                 

Encrypting existin Swap Redhat / CentOS

yum install cryptsetup

Switch off swap

swapon -a

comment out existing swap partition is /etc/fstab

#/dev/mapper/VolGroup00-swap swap  

Wipe swap partition

dd if=/dev/zero of=/dev/mapper/VolGroup00-swap

add the swap partition to /etc/crypttab

If it is not already created, create the /etc/crypttab file. Add an entry to /etc/crypttab file. .


swap /dev/mapper/VolGroup00-swap /dev/urandom swap



Add the following entry to  /etc/fstab file.


/dev/mapper/swap none swap defaults 0 0


The next time you boot the system and the /etc/rs.sysinit script executes, it creates a raw dm-crypt device with a random key and formats it as a swap device. During /etc/fstab processing, the swap device is activated.
Reboot the system.
Verify that the swap space is encrypted.
swapon -s
You should see a new entry for the added swap file system. You can see it listed below in the second entry, in our example.
swapon -s


Filename Type Size Used Priority
/dev/dm-2                               partition 2064376 580 -1


Voila. your swap partition has been encrypted

mount remote directories over SSH using SSHFS

When you need to mount a remote directory securely
use SSHFS which is a much easier quicker option than trying to tunnel NFS over an ssh tunnel.

SSHS is quick , easy and secure.

yum install fuse-sshfs

If not done already you will wan't to create your private and public encryption keys and put your public key on the server who's directory you want to mount, so that you will have a password less connection
ssh-keygen to create the keys

leave passphrase blank

then to copy your public key to the server type
ssh-copy-id -i .ssh/id_rsa.pub user@remoteserver

Now, lets say there is some directory /mnt/dir/ on the remote system user@remoteserver and we want to mount it on our /localfolder directory. This is how we do it using sshfs.

type
sudo sshfs user@remoteserver:/mnt/dir /localfolder

Thats it. done.

and to unmount type

fusermount -u /localfolder/

If you want the directory to be available after a reboot

You could just put sudo sshfs user@remote:/mnt/dir /localfolder
in to your /etc/rc.local file

or if you prefer to use /etc/fstab then add the following line to your /etc/fstab file

sshfs#user@remoteserver:/mnt/dir /localfolder fuse    comment=sshfs,noauto,users,exec,uid=1000,gid=1000,allow_other,reconnect,transform_symlinks,BatchMode=yes

Dealing with Vcard meeting requests in Mutt

Receiving Vcard Meeting requests that have been generated in Microsoft exchange or MS outlook
arrives in to your Mutt inbox, as an illegible mess of text that is difficult to make heads or tails out of

To configure your mutt to play nicely with Vcard meeting requests do the following.
.
First install the following (If they are not already installed)

yum install perl
yum install perl-devel
yum install perl-Data-ICal
yum install perl-Text-Autoformat

or use apt-get install if your distribution is Debian based

Then edit your .muttrc and add in the following lines

alternative_order text/calendar
This tells Mutt to display the text/calendar part in preference to the text/plain part.

color index black yellow "~b text/calendar"
this shows all meeting requests as black on yellow
change the colours to which ever you would prefer

The final step is to decode the vCalendar text into something that’s a bit more readable.

To do this we use the following perl script
http://notes.asd.me.uk/wp-content/uploads/2012/08/vcal2text.txt

click on the link then

you can copy and paste the text into your own local file

name the file vcal2text

and save it in /usr/local/bin

Give the script execute permissions

chmod +x /usr/local/bin/vcal2text

Start up Mutt and all Vcard meeting requests will be Legible

Printing with Mutt

By default, when you press the p key to print a message in mutt, you will not be prompted to choose a printer. Mutt will just print to the printer defined in your PRINTER environment variable.

To change the printer mutt uses , from within mutt, type in the following:

:set print_command="/usr/bin/lp.cups"
Make sure you type in the colon first. If you do not type in the colon first, the rest of what you type will be interpreted by mutt as  commands (for example, the 's' from the word 'set' will try to save the message).

To see what your current printer command is, type in:

:set print_command
If you are using Gnome 3 and you would like to use your Default cups printer from within mutt, you can set your printer command as follows:

:set print_command="/usr/bin/lp.cups"
To make this setting permanent

edit your .muttrc file and put

set print_command="/usr/bin/lp.cups"

at the end of the file  like so

vim .muttrc
and this time without the :

set print_command="/usr/bin/lp.cups"

Install Gnome 3.4 weather extention on Fedora 17

su - yum install gnome-common gtk3-devel glib2-devel intltool automake autoconf vala wget gnome-tweak-tool


wget https://github.com/simon04/gnome-shell-extension-weather/zipball/gnome3.4
unzip gnome3.4
mv simon04-gnome-shell-extension-weather-* weather
cd weather
./autogen.sh --prefix=/usr
make 
make install
Restart Gnome [Alt] + [F2] r
Click on top right hand corner of desktop, Then click on advanced settings (gnome-tweak-tool)
Click on
Shell Extensions and turn on the weather indicator extension.
Next you need to set your area, open up your web browser and goto this site http://edg3.co.uk/
Enter your closest City to get your woeid eg my city is Valletta and the code is mtxx0001
In a non root terminal type the following to set your city
gsettings set org.gnome.shell.extensions.weather woeid mtxx0001
Substituting mtxx0001 for your own cities woeid.
You can also change the name of your City by typing the following would change the city name to "Mosta" which is my actual village gsettings set org.gnome.shell.extensions.weather city Mosta
To set the units to Fahrenheit or celcius, type one of the following.
gsettings set org.gnome.shell.extensions.weather unit celsius
gsettings set org.gnome.shell.extensions.weather unit fahrenheit
The position of the GNOME Shell extension in the panel can be configured to either 'left', 'center' or 'right' (requires restart of GNOME Shell). type one of the following
gsettings set org.gnome.shell.extensions.weather position-in-panel center
gsettings set org.gnome.shell.extensions.weather position-in-panel left
gsettings set org.gnome.shell.extensions.weather position-in-panel right

rc.local on suse

Suse does not have rc.local enabled by default.

which means it is difficult to have a program automatically start up, after your system has been booted.

Suse does have a file called /etc/init.d/boot.local.

However it is not the same as rc.local
Inputting paths to files to run in the boot.local file
executes them before going to the first run level.
Which is a problem if you need your application to run after the system has completely booted.

rc.local to the rescue.

simply create your own rclocal file like so.
I use vim but you can use any file editor program like nano or gedit
vim /etc/rc.d/rclocal

then inside the file type the following (between the -----)
--------------------------------------------------------------------------
#! /bin/sh
## This script simulates redhat's rc.local (Add commands at the end)
### BEGIN INIT INFO
# Provides: rclocal
# Required-Start: $local_fs $remote_fs $network
# X-UnitedLinux-Should-Start: $ALL
# Required-Stop:
# X-UnitedLinux-Should-Stop:
# Default-Start: 3 5
# Default-Stop: 0 1 2 6
# Short-Description: Simulates rc.local
# Description: Simulates redhat's rc.local: contains
# commands to execute after system has booted (all services are already
# available)
### END INIT INFO
## Execute ony when service is started
case "$1" in
start)
## commands will be executed
;;
*)
exit 0
;;
esac


#  Add your commands bellow this line

--------------------------------------------------------------------
Save the file.
Make the file executable by typing the following: chmod +x rclocal
Create symlink to make it easy to find:  ln -s rclocal rc.local
Next, you need to enable the rc.local simulation in yast.
Type
yast2
then scroll to
System > system services (Run Level)
then scroll down to
> rclocal   simulates rc.local
and enable it
 > Enable

Save your settings, and you are done.
you now have a rc.local that behaves exactly like the redhat/fedora  rc.local
You can add/remove commands to /etc/rc.d/rc.local anytime
by simply editing the rclocal file and adding your commands you wish to execute at the bottom of the file.

How to Upgrade from Fedora 16 to Fedora 17 (Beefy Miracle)

Insure that your system has more than 600MB of RAM, The upgrade requires this.(1GB or more is recommended)

First change to root user

su -

Upgrading To Fedora 17 (Desktop)
First upgrade your rpm package:

yum update rpm

Install the latest updates:

yum -y update

Clean the yum cache:

yum clean all

If a new kernel got installed during yum -y update, you should reboot the system

reboot

After the reboot, su back to root

su -


Install preupgrade...  (preupgrade will also take care of your RPMFusion packages)

yum install preupgrade

run preupgrade

preupgrade

The preupgrade wizard will then start on your desktop. Select Fedora 17 (Beefy Miracle). Your system will then prepare for the upgrade.

At the end, of the prepartion click on the Reboot Now button.
During the next boot make sure to catch the boot loader and select
Upgrade to Fedora 17 (Beefy Miracle).

During the reboot, your system will upgrade. This can take a  very long time, so please be patient.

(My system took about 4 hours)

That's it, Once Complete you can log into your new Fedora 17 (Beefy Miracle). system

To do the same on a Server that does not have X server (GUI) installed

Follow the same steps as above but run preupgrade with the following option

preupgrade-cli

preupgrade will show you a list of releases that you can upgrade to. included in that list will be

Fedora 17 (Beefy Miracle) 

[root@server1 ~]# preupgrade-cli

Loaded plugins: blacklist, langpacks, whiteout

No plugin match for: rpm-warm-cache

No plugin match for: remove-with-leaves

No plugin match for: auto-update-debuginfo

Loaded plugins: langpacks, presto, refresh-packagekit

please give a release to try to pre-upgrade to

valid entries include:

   "Fedora 17 (Beefy Miracle)"

[root@server1 ~]#

To upgrade, append the release string to the preupgrade-cli command:

preupgrade-cli "Fedora 17 (Beefy Miracle)"

Preupgrade will also take care of your RPMFusion packages, so all you have to do after preupgrade has finished is to reboot:

reboot

catch the boot loader and select Upgrade to Fedora 17 (Beefy Miracle).

that's it, your Done.

Power off machine after process is complete

This will check your machine for a specified process.

As soon as that process stops running , your machine will power off.

This is useful for example if you are using wget to download a large website.

you can then tell your machine to power off as soon as the website is finished being downloaded ie when wget is finished.

 while pgrep wget || sudo shutdown -P now; do sleep 1m; done

substitute wget for the process that you want to monitor.

Joining Linux server/workstation to Windows Active Directory

This  joins your Linux machine to a Windows Active Directory domain
and allows you to share your samba shares to users of the Active Directory domain without further authentication.

You need to install the latest version of Samba which is currently version 3
also  install samba-common, samba-client  and samba-winbind

yum install samba samba-client samba-common samba-winbind

if not already installed you also need to have
ntpd, and kerebos installed

yum install ntpd  kerberos

it is imperative that your linux machines clock is in sync with the active directory domain controller

ntpdate -u  [ip of your ADserver]

eg
ntpdate -u 192.168.1.10

next make sure that ntpd winbind and samba all start on boot up and are all running

chkconfig ntpd on
chkconfig winbind on
chkconfig smb on
/etc/init.d/ntpd start
/etc/init.d/smb start
/etc/init.d/winbind start

next edit your samba config file

vim /etc/samba/smb.conf

and change the following settings so that they are as they appear here.
Substitute CLIVE.COM with your Active directory domain name.
Also insure that you do not have a netbios entry.
If you have a line in your samba config file that says
netbios name = somename

delete the above line (if it exists)

the netbios entry will be added automatically by the system when you join the domain later.

your smb.conf should look something like this

 workgroup = CLIVE
        realm = CLIVE.COM
        preferred master = no
        server string = Samba File Server

 security = ADS
        encrypt passwords = yes
        log level = 3
        log file = /var/log/samba/%m
        max log size = 50
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind nested groups = Yes
        winbind separator = +
        idmap uid = 600-20000
        idmap gid = 600-20000
        hosts allow = 192.168.1.0/24 (put the ip of your network here)
        hosts deny = 0.0.0.0/0

Restart samba to load in the new config.

/etc/init.d/smb restart 

next you need to edit your kerberos config file

vim /etc/krb5.conf
and make the following additions
change CLIVE.COM for your AD domain name
and change servername to your active Directory domain controllers machine name.

case sensitivity is of extreme importance here.
[realms]
 CLIVE.COM = {
  kdc = servername.clive.com:88
  admin_server = servername.clive.com:749
  default_domain = clive.com
 }

 [domain_realm]
 .kerberos.server = CLIVE.COM
 .clive.com = CLIVE.COM
 clive.com = CLIVE.COM

save the file

and then run the following file to make sure everything is working as it should.

 /usr/kerberos/bin/kinit administrator@CLIVE.COM

You should be asked for the domain administrators password, once put in correctly you will return to a command prompt.

(Please note if you get an error here it is more than likely because your clock on your linux machine is not synced to your active directory domain controller)  check your clock and use ntpd to sync it properly.

next edit your nsswitch.conf file and change it so that it looks like this

vim /etc/nsswitch.conf

passwd:     compat winbind

shadow:     compat

group:      compat winbind

save the file and restart winbind

/etc/init.d/winbind restart

Edit your /etc/hosts file

vim /etc/hosts 

and insure you have the following line
127.0.0.1   hostname.clive.com hostname

remove localhost localdomain from the 127.0.0.1 entry

save /etc/hosts

 And now lets join your machine to the domain.

type

net ads join -U Administrator@CLIVE.COM

put in the administrators password and if all goes well your machine will be added to the domain

next type

wbinfo -u

to show a list of all the users of the Active directory domain.

in Samba to give access to an active directory user to your samba share,

edit the valid users line in your smb.conf file and add your active directory users like so,

substitute CLIVE for your domain name

[share]

        comment = share

        path = "/home/samba/shares/share/"

        browseable = yes

        writable = yes

        read only = no

        create mode = 0777

        directory mode = 2777

        valid users = CLIVE+administrator CLIVE+cliveg CLIVE+user2

to add an entire group ie Domain Users use the @

eg

valid users = "@CLIVE+Domain_users" 

don't forget to restart Samba every time you make changes to smb.conf.

Find 20 Largest Files on your system

Running out of Disk Space ?
want to see which files are the largest files on your system and are contributing to filling up your hard disk.
Copy and paste the following command into your terminal. and run it in your root directory.


find . -type f -print0 | xargs -0 du -h | sort -hr | head -20


This will  list the 20 Largest files on your System, and report their size in human readable format.

better still, copy and paste the line into a file,
name the file bigfiles
save the file in /usr/local/bin
chmod +x /usr/local/bin/bigfiles
then from anywhere on your system simply type 
bigfiles