Monitoring application with a simple bash under linux

 Edit a cron file

 vi /etc/cron.hourly/monitorhttpd.sh


#!/bin/bash
ps -ef |grep `cat /var/run/httpd/httpd.pid`|grep httpd>/tmp/httpjenkinscount
NBPCS=`wc -l
if [ "$NBPCS" -eq "0" ]; then
    service httpd start
fi



#!/bin/bash
ps -ef |grep `cat /var/run/tomcat-jenkins/tomcat.pid`|grep java>/tmp/tomcatjenkinscount
NBPCS=`wc -l
if [ "$NBPCS" -eq "0" ]; then
    sudo -ujenkins -- "/local/home/jenkins/tomcat-7/bin/shutdown.sh"
    sleep 30
    rm -f /var/run/tomcat-jenkins/tomcat.pid
    sudo -ujenkins -- "/local/home/jenkins/tomcat-7/bin/startup.sh"
fi 


But you can also perform some more complex monitoring by testing call to url (end to end test)
vi ./autorestartscript.sh

#!/bin/sh
rm -f /tmp/status
wget https://myserver/myapp/status --no-check-certificate -O /tmp/status
RETOUR=$?
KOCOUNT=`cat /tmp/status|grep KO|wc -w`
if [ $KOCOUNT -ge 1 ] || [ $RETOUR -ge 1 ];
then
service tomcat6_myapp stop;
sleep 30
service tomcat6_myapp start;
service httpd_myapp restart;
fi

How to redirect to different AJP connector based on server name only (same context path)

When you have two domains pointing to the same IP address, how to server different page only based on the URL.

-  Setup 2 tomcat listening on AJP port 8019 and 8009

- declare two domains on you DNS page

Then modify the apache configuration as follow.



NameVirtualHost *:80
ProxyPreserveHost On

ProxyPass  /  ajp://localhost:8009/
ProxyPassReverse /  ajp://localhost:8009/
ServerName virtualserver1.mydomain.com


ServerName virtualserver2.mydomain.com
ProxyPass / ajp://localhost:8019/
ProxyPassReverse /  ajp://localhost:8019/

Automatical periodic backup with simple bash script

Here is a very basic way to create a periodic backup of some of your folder in a LINUX environment

Create an cron file /etc/cron.montlhy/backup-tomcat

#!/bin/sh
SCOPE=monthly
tar -cvzf /mnt/nas/backup-tomcat/tomcat-`date +%Y%m%d`-$SCOPE.tgz -C/home/clement tomcat-8
find /mnt/nas/backup-tomcat/ -name \*$SCOPE\* -mtime +365 -exec rm -f {} \;

Simplify RDP

Having longer session on windows Server 2008

SSH with RSA keys without password

First generate a public key with the command:
ssh-keygen

then there are two files:

.ssh/id_rsa (your private key)
.ssh/id_rsa.pub (your public key)

Do a:
From your home directory:

chmod og-r -R .ssh

Check the rights of the folder .ssh
it should be xrw------

On the target server

create a folder .ssh
create a file named authorized_keys

In that file paste the content of the file id_rsa.pub

chmod og-r -R .ssh 
 On most of the configuration this will be enougth, but sometimes you could hae some limitation in the file

vi /etc/security/access.conf

You can allow a specific user to access your server by anabling

+ : youruser ALL


Also you must check that there is no restrictions linked to the domain. 

vi /etc/hosts.allow

You should check that there is no restriction on the 
sshd: domain

 

Connecting a postfix to a corporate outlook server

You may wish to test the sending of a mail in an unauthenticated way, but if you are in company working with outlook having some strong security constraints, the relay of unauthenticated mail will be forbidden. Here is a way to transform a postfix server into an unauthencated mail relay. 

You should modify the file /etc/postfix/main.cf and add the following line. 

# This line means mail directed to someone@mydomainname wont be relayed on the other server. 

relay_domains = mydomainname
# 
sender_canonical_classes = envelope_sender, header_sender
# This rewrite rules will make the mail seems like issued by you (always). 
sender_canonical_maps =  regexp:/etc/postfix/sender_canonical_maps

# this Enable postfix to use smtp relay with authentication. 
smtp_sasl_auth_enable = yes
# This is the firsl ine used to initiate the dialog. 

smtp_sasl_mechanism_filter = login ntlm
smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
# Set your password here 
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

#It is preferable to refrain to your network

smtpd_recipient_restrictions =    permit_mynetworks   reject_unauth_destination   permit

myhostname = toulouse.infosys.com
mydomain = toulouse.infosys.com
relayhost = [my.outlook.corporateserver.com]:587
myorigin = $myhostname

# mydestination = $myhostname, localhost.$mydomain, localhost
# To enable all the interfaces

inet_interfaces = all
mydestination =
mynetworks = 10.161.86.0/24 127.0.0.0/8

The file /etc/postfix/sender_canonical_maps
Contains and rewrite all header so that all mails appear to be issued by my.email@mycompany.com

/.+/    my.email@mycompany.com

File /etc/postfix/sasl_passwd contains 
[my.outlook.corporateserver.com]:587    my.email:My-P4ssw0rD

You should then hash this file
postmap /etc/postfix/sasl_passwd

Restart postfix 


service postfix restart

Dont forget to open firewall on port 25. All the mail you will send to thepostfix server will be relyed to the corporate server with your name.


 

Desactivate Selinux on centos

You could have a lot of mean issue with the security component selinux. In my experience, you want to run something in behind your apache2 httpd server, it is best to put selinux in permissive mode. Typically, Selinux can
- prevent a tomcat AJP connector to run on a port like 8019, supporting only the default port  8009
- prevent to access some files in that are not under /var/www for svn DAV module
-Prevent samba file sharing to see files in a directory (But the directory itself can be seen


All of these effect are very weird when you first see it, that is why, I recommend to desactivate selinux when you set up a new server. If your server will go on internet, you may harden your server afterwards by activating selinux.

The principle behind  Selinux is to perform a check that one process should go throught a set of rule before accessing a resource. The resource can be
- Socket
- Processes
- Files

For instance, it could put some rules so that httpd cannot not access to any resource on computer and this goes on top of the OS security rules.

The big issue with selinux is that nothing goes into the classical error logs. It is q very dry denial. So if you face an issue that you dont understand on httpd server, it is good to try to desactivate selinux and see what happens.

You can switch the system into permissive mode with the following command:

  setenforce 0 
To check what mode the system is in,

cat /selinux/enforce

The above will switch off enforcement temporarily - until you reboot the system. If you want the system to always start in permissive mode, then here is how you do it. In Fedora Core and RedHat Enterprise, edit /etc/selinux/config and you will see some lines like this:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

To get you current status you could type

sestatus