Archy's Blog

If for some reason your ds.keytab has been corrupted, for example through time drift in the hardware clocks of your multi-master infrastructure, you'll find yourself with a non-working or very slow krb5kdc. However, this can be fixed fairly fast but you'll have to check your replicas for errors and maybe even replicate the whole infrastructure from a known good replica. Let's get to fixing the corrupted ds.keytab first. All these steps will be done with your authentication services offline, so it's probably the safest to do all of the steps as root. Start by stopping the ipa services on the host: [archy@ipa02 ~]$ sudo su - [root@ipa02 ~]# ipactl stop Next up move the not-working keytab: [root@ipa02 ~]# mv /etc/dirsrv/ds.keytab /etc/dirsrv/ds.keytab-$(date +%Y-%m-%d) In order to fix the keytab, a few services are required to run: [root@ipa02 ~]# start-dirsrv [root@ipa02 ~]# systemctl start krb5kdc.service Next login to the krb5kdc and export...

This is only about the setup of different logging, one being done with Filebeat and the other being done with sending logging to a dedicated port opened in Logstash using the TCP / UDP Inputs. Prerequesites: You'll need a working Elasticsearch Cluster with Logstash and Kibana. Start by getting the Log Data you want to structure parsed correctly. Mikrotik Logs are a bit difficult since they show you Data in the interface which is already enriched with Time / Date. That means a message that the remote logging will send to Logstash will look like this: firewall,info forward: in:lan out:wan, src-mac aa:bb:cc:dd:ee:ff, proto UDP, 172.31.100.154:57061->109.164.113.231:443, len 76 You can check them in the grok debugger and create your own filters and mapping. The following is my example which might not fit your needs. Here are some custom patterns I wrote for my pattern matching: MIKROTIK_DATE \b(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?...

This is only about the setup of different logging, one being done with Filebeat and the other being done with sending logging to a dedicated port opened in Logstash using the TCP / UDP Inputs. Prerequesites: You'll need a working Elasticsearch Cluster with Logstash and Kibana and an installation of Filebeat on the Host(s) where you get your nginx logs from. Start by getting the Log Data you want to structure parsed correctly. The nginx logs are pretty straight forward, so after checking them out in the grok debugger, I'll have the following structure mapped: %{IP:ClientIP} - %{DATA:username} \[%{NGINXTIMESTAMP:timestamp}%{GREEDYDATA}\] \"%{WORD:method} %{DATA:request_uri} %{DATA:http-version}\" %{RETURNCODE:http_return_code} %{GREEDYDATA} \"%{DATA:server_name}\" \"%{GREEDYDATA}\" Also, I've written some custom patterns: NGINXTIMESTAMP (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])\/\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|rua...

While I'm currently not a huge fan of Chrome OS or Chromebooks in general since they are rather limited in their functionality, I still wanted to give it a try. Maybe it proves me wrong and became very good? So here's a short guide on how I built a bootable Chromium OS USB-Stick. A lot of this is mentioned on the official chromium os page. I'm using an ubuntu 16.04 to build it which is also the recommended version from the chromium project. Note that I installed this machine just for this purpose. First, you'll need to install some basic stuff: [archy@buildbot ~]$ sudo apt-get -y install git-core gitk git-gui subversion curl lvm2 thin-provisioning-tools python-pkg-resources python-virtualenv python-oauth2client vim Next up, Google has written some wrappers for git which, they say, is required to build it. So you'll need to git clone them locally and set the path variable to include them. [archy@buildbot ~]$ git clone https://chromium.googlesource.com...

Since I started this blog I've mostly been covering the server-side of Linux, not so much the desktop side. My recent switch from Ubuntu(LTS) to Fedora as my main Distro on the Desktop(s) gave me the idea to write about that. Now, I know that this kind of comparison has been done probably a thousand times but I thought I write about my experiences with these 2 great distros. First of all, why Fedora? Well, by now I know the Red Hat Ecosystem fairly good and Fedora is pretty stable while maintaining very recent versions of almost any software that I deal with. While Canonical delivers a new version of its OS every 6 months, same as Red Hat with Fedora, I found it to be not as stable and reliable as Fedora. What are the differences between Fedora and Ubuntu? From a visual point of view, it's probably the Desktop Appearance. Since I'm using GNOME as my desktop, I'm only able to compare it within these 2 distros. Fedora ships a more basic and default setup...

So, I've recently completed the RHCSA and RHCE exams successfully and I wanted to share my experience with it. Here are a few of my thoughts about both exams. Time: There's plenty of it on RHCSA but not so much on RHCE. If you know what you are doing on the topics, you'll be done in under 1 hour (in case of the RHCSA) assuming you are decently fast in typing. However, that's not the case with RHCE. For passing RHCE, you'll need to have good time management and eventually skip tasks that you get stuck on since you might not be completing the rest of the tasks. Tasks: Take a minute and read through all the tasks first. Map your own 'Big Picture' on how the system has to look like in the end. This includes the configuration of SELinux, Firewalld and systemctl. Note that your changes and configurations have to be persistent between reboots. If you can do the labs without too much of a hassle, you should be good to go. What you want to avoid however is ...

While I was practicing for RHCSA, I noticed, that for me, the automount part is the most difficult. For making this thing more memorable, I decided to write a short guide to what I did to get this working and share my knowledge. Maybe this will actually help someone understanding it :) I'll work with two nodes, nfssrv.archyslife.lan and nfsclnt.archyslife.lan. The names are kind of obvious what the servers will do. First, let's set up the server which will share it's files: [root@nfssrv ~]# yum -y install nfs-utils [root@nfssrv ~]# vim /etc/exports /storage 172.31.100.0/24 (rw,secure,sync,no_subtree_check) [root@nfssrv ~]# mkdir /storage [root@nfssrv ~]# systemctl enable nfs.service [root@nfssrv ~]# systemctl start nfs.service This set of commands will install the nfs-server software, configure your /storage directory to be shared using nfs to the network 172.31.100.0/24 and start the nfs-service on boot. Now the client-side: ...

Elasticsearch along with Logstash and Kibana is a great combination for aggregating and enriching log files, splitting them into different fields and visualizing them. For this setup, I will set up a 3 Node Cluster with every node operating every role. The recommended Setup would be separating master-eligible nodes and data nodes, as well as ingest nodes (depending on your workload).  Quick Note on the software components: Elasticsearch: Elasticsearch is a distributed search backend using the lucene engine for searching its shards and saved data. The Data indexed into this will be in the json-format. Logstash: Logstash takes your data, passes it through the grok filters you wrote, enriches them if you've configured to do so and indexes them into elasticsearch. Kibana: With Kibana you can control and manage your cluster as well as configure pipelines. Kibana will also give you a fancy frontend to search your data and build graphs. Since I'm only going to go...

There's a newer version covering EL8 I'll be using a plain CentOS 7 minimal install with the latest updates for this installation. First up, let's install the packages we need to make the Host a hypervisor: [archy@hyv01 ~]$ sudo yum install qemu-kvm libvirt libvirt-python libguestfs-tools virt-install tuned [archy@hyv01 ~]$ sudo systemctl enable libvirtd.service [archy@hyv01 ~]$ sudo systemctl start libvirtd.service [archy@hyv01 ~]$ sudo tuned-adm profile virtual-host NOTE: Tuned is optional but might squeeze out a little bit more performance and optimize the host for virtualization workloads. More info can be found by using 'man tuned-profiles'. Next, the network Configuratin. I'll use 4 Interfaces for the bond itself which will then again be a slave interface to the bridge which the VMs on this host will connect to. The Network Interfaces for the Bond will be: - ens2f0 - ens2f1 - ens2f2 - ens2f3 [archy@hyv01 ~]$ sudo nmcli connecti...

I recently went over my network configuration and noticed that the dhcp-leases were not pushed into the IPA-DNS yet. So I thought, why not do it now. The setup is very similar to setting it up on a single bind instance not managed by IPA (I've already written a guide about this here ). My setup is done with the following hosts: ipa01.archyslife.lan - 172.31.0.1 inf01.archyslife.lan - 172.31.0.5 First of all, create a rndc-key: [archy@ipa01 ~]$ sudo rndc-confgen -a -b 512 This will create the following file '/etc/rndc-key' [archy@ipa01 ~]$ sudo cat /etc/rndc.key key "rndc-key" { algorithm hmac-md5; secret "secret_key_here=="; }; We also need to make named aware of the rndc-key and allow our remote dhcp server to write dns entries: [archy@ipa01 ~]$ sudo vim /etc/named.conf ... include "/etc/rndc-key"; controls { inet 172.31.0.1 port 953 allow { 172.31.0.5; } keys ...

There are various ways to back up files in linux and most of them are possible through already onboard applications like rsync and tar. I will demonstrate how to backup files using both, tar and rsync with remote and local destination. I will also show how to restore files in case you need it. So let's begin with tar. Options and their meanings will be shown below. Create the archive using tar to a local directory: [archy@host ~]$ tar -cvpzf backup-homedir.tar.gz --exclude=backup-homedir.tar.gz ./* options: c - create a new archive v - verbose output p - preserve permissions z - compression with gzip f - the filename for the new archive Extracting the archive using tar from a local directory: [archy@host ~]$ tar -xvpzf backup-homedir.tar.gz -C /path/to/destination options: x - create new archive v - verbose output p - preserve permissions z - uncompress with gzip f - the filename of the archive If you just need to keep directories in sync. For archiving...

NGINX is a lightweight webserver with much more features than just being a webserver, but I'm just going to dig a bit deeper into the webserver functionality for now. As the title says, this is about redirecting traffic from http to https using nginx. I'll be hosting the site on the nginx directly. This is how a simple config for serving static html might look like: [archy@websrv ~]$ sudo cat /etc/nginx/sites-available/http_example.com.conf server { listen 80; server_name www.example.com; root /var/www/html; index index.html index.htm index.nginx-debian.html; location / { try_files $uri $uri/ = 404; } } If you want to redirect traffic from http to https, you'll have to do just minor changes to the config: [archy@websrv ~]$ sudo cat /etc/nginx/sites-available/http_example.com.conf server { listen 80; server_name ...