Showing posts with label Apps. Show all posts
Showing posts with label Apps. Show all posts

Sunday, May 22, 2011

Subversion Quickstart

This short tutorial is intended for new users to grasp subversion quickly.
Subversion is a open source version control system based on Copy-Modify-Merge  model rather than lock-Modify-Unlock model.
It is primarily used for software development, which allows developers to modify files and directories concurrently (no locking) and switch between versions easily.  In system administration world, it could be used to track system changes and roll back changes.
Fundamental Concepts(don't skip):
 - The Repository
Repository is a central store for all versions of data, subversion server configuration files are also located in the repository.
Once repository is created, you are NOT supposed to visit the repository directory other than changing subversion server configuration
You should modify versions of data in a “working copy” of the repository data.
The repository can be accessed in a number ways:
file:/// Direct repository access (on local disk)
http:// Access via WebDAV protocol to Subversion-aware Apache server
https:// Same as http://, but with SSL encryption.
svn:// Access via custom protocol to an svnserve server
svn+ssh:// Same as svn://, but through an SSH tunnel
To setup svnserv server to offer svn:// access over network, you need to enable authentication and authorization  by modifying  repository-path/conf/{svnserve.conf,passwd,authz} then start “svnserve -d -r repository-path”
- The Working copy directory
A working copy is a subset of repository data. To creating a working copy, use “svn checkout” to checkout the root or sub directory of repository.
You modify data in  “working copy” NOT  in repository directory
Install subversion 
Most Linux distros include subversion by default. to Install in Centos:
$yum install subversion
$rpm -qa | grep subv
subversion-1.6.11-7.el5_6.3
Create  a subversion repository
#It is where all data are saved, you should have enough space
$svnadmin create /var/svn
#svnadmin populated the directory with following structure
#conf is the location of server configuration files
#db is the location of your versions of data
$ls /var/svn
conf  db  format  hooks  locks  README.txt
#It is ideal to create individual directory for different project.
#-m is to give a description of this operation, later, it can be view with “svn log”
#This transaction is recorded as revision 1
#the command is svn not svnadmin
#svnadmin and svnlook are server side commands, They always action on a PATH  NOT a URL like file:///”
$svn mkdir file:///var/svn/proj_1 -m "test mkdir"
Committed revision 1.
#Verify the sub dir is created
$svn list -v  file:///var/svn
3 root                  May 22 11:33 ./
3 root                  May 22 11:33 proj_1/
Import data  into the repository
#let's import /etc/sysconfig  into the repository
#import is used to to populate repository for the first time
#adding new files later need “svn add” command in a “working copy”
$ svn import /etc/sysconfig/  file:///var/svn/proj_1 -m "test import"
Adding         /etc/sysconfig/irda
Adding         /etc/sysconfig/kernel
Adding         /etc/sysconfig/syslog
..
Adding         /etc/sysconfig/snmpd.options
Committed revision 2.
#let's view the imported files in repository
#something wrong? Where are those files? even dir “proj_1” doesn't exist
#let me repeat, you are supposed to modify data in repository directly,  Do this in a “working copy”
$ls  /var/svn
conf  db  format  hooks  locks  README.txt
# if you are curious about where the data is stored, all data are “packed” in a binary file
$ strings /var/svn/db/revs/0/2 | grep $(hostname)
HOSTNAME=filer.example.com
# or view “svn ls”  and “svn cat”
svn cat file:///var/svn/proj_1/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=filer.example.com
Create a working copy
#create a working copy by checkout proj_1,  The target dir proj_1 will be automatically created, of course, you can name it differently 
$cd /root/svn
$svn checkout file:///var/svn/proj_1 proj_1
A    proj_1/irda
A    proj_1/kernel
A    proj_1/syslog
#I want to add /etc/hosts to repository
#any operations in “working copy” should use subversion-aware commands e.g “svn mkdir, svn add, svn mv, svn cp”
$ cd  /root/svn/proj_1
$svn mkdir  ./etc
$ cp /etc/hosts ./etc
$ svn add ./etc/hosts
A         etc/hosts
#commit the changes to repository
$svn commit -m "added hosts file"
Adding         etc
Adding         etc/hosts
Transmitting file data .
Committed revision 3.
#svnlook shows the latest version is 3
$svnlook  youngest  /var/svn
3
$svn log /root/svn/proj_1/
------------------------------------------------------------------------
r3 | root | 2011-05-22 11:33:03 +1000 (Sun, 22 May 2011) | 1 line
added hosts file
------------------------------------------------------------------------
r2 | root | 2011-05-22 11:29:17 +1000 (Sun, 22 May 2011) | 1 line
test import
------------------------------------------------------------------------
r1 | root | 2011-05-22 11:29:05 +1000 (Sun, 22 May 2011) | 1 line
test mkdir
------------------------------------------------------------------------
$svn diff -r 2:3  /root/svn/proj_1/
Index: /root/svn/proj_1/etc/hosts
===================================================================
--- /root/svn/proj_1/etc/hosts  (revision 0)
+++ /root/svn/proj_1/etc/hosts  (revision 3)
@@ -0,0 +1,8 @@
Rollback to previous versions
That is where subversion shines, no matter how many changes you have made, one simple command can switch versions
$ svn update -r 2 /root/svn/proj_1/
D    /root/svn/proj_1/etc
Updated to revision 2.
$ ls ./etc
ls: ./etc: No such file or directory
$svn update -r 3 /root/svn/proj_1/
A    /root/svn/proj_1/etc
A    /root/svn/proj_1/etc/hosts
Updated to revision 3.
$ ls ./etc
hosts

Friday, March 20, 2009

Integrating Nagios plugin with OpenNMS


OpenNMS is highly scalable enterprise level management system. I like its features of versatile built-in monitors, auto-discovery and graphing ability. It can also work with ngaios plugin to use any customized monitor.

Install OpenNMS

http://www.opennms.org/documentation/InstallStable.html

Setup NRPE on client

yum install nrpe nagios-plugins-nrpe nagios-plugins

#==create a test script
$vi /usr/lib/nagios/plugins/check_test.sh

#!/bin/sh
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
echo "check test"
exit $STATE_OK


$ make sure nagios user has rx permission for the script.
chmod +rx check_test.sh


#vi /etc/nagios/nrpe.cfg
allowed_hosts=127.0.0.1,IP of OpenNMS
command[check_test]=/usr/lib/nagios/plugins/check_test.sh

#==start nrpe
service nrpe start

#==Now test it mannually, It is important to run the check as user nagios not root

sudo -u nagios /usr/lib/nagios/plugins/check_nrpe -n -H localhost -c check_test
sudo -u nagios /usr/lib/nagios/plugins/check_nrpe -H localhost -c check_test

-n = Do no use SSL,if nrpe doesn't support both mode, it is important to set usessl value in opennms config file.

Setup NRPE on OpenNMS system:

yum install nagios-plugins-nrpe nagios-plugins
#==no configuration needed here, first run a mannual test
sudo -u nagios /usr/lib/nagios/plugins/check_nrpe -n -H remote-host -c check_test
sudo -u nagios /usr/lib/nagios/plugins/check_nrpe -H remote-host -c check_test
-n = Do no use SSL. if nrpe doesn't support both mode, it is important to set usessl value in opennms config file.


OpenNMS configuration

Two configuartion files need to be modified for new added service.
/opt/opennms/etc/capsd-configuration.xml /* service definition for initial scan */
/opt/opennms/etc/ poller-configuration.xml /* service definition for constant polling */


/opt/opennms/etc/capsd-configuration.xml
protocol-plugin
protocol-plugin protocol="NRPE-test" class-name="org.opennms.netmgt.capsd.plugins.NrpePlugin" scan="on"
property key="banner" value="*"
property key="port" value="5666"
property key="timeout" value="3000"
property key="retry" value="2"
property key="usessl" value="true"
property key="command" value="check_test"
protocol-plugin


- Important Notes:
Set usessl value depending on your nrpe ssl supporting ability
command used for polling, it better to be set to your customized script(or system built-in cmd: _NRPE_CHECK)

/opt/opennms/etc/ poller-configuration.xml

service name="NRPE-test" interval="300000" user-defined="true" status="on"
parameter key="retry" value="3"
parameter key="timeout" value="3000"
parameter key="port" value="5666"
parameter key="command" value="check_test"
parameter key="usessl" value="true"
parameter key="padding" value="2"
parameter key="rrd-repository" value="/opt/opennms/share/rrd/response"
parameter key="ds-name" value="nrpe-test"
service

- Important Notes:

The name attribute of the service in poller-configuration.xml needs to match the protocol attribute of the protocol-plugin in capsd-configuration.xml.
The ds-name attribute also needs to be unique for each service, or you'll find response time from one service overwriting response time from another.
You'll also need a line to map the new service to a monitor class (see at the end of the file)

monitor service="NRPE-test" class-name="org.opennms.netmgt.poller.monitors.NrpeMonitor"
Restart OpenNMS for the changes to take effect
The new service should be discovered by re-scan.

Troubleshooting
if the new added service can't be discovered, turn on debug on for discovery process capsd

/opt/opennms/etc/log4j.properties

# Capsd
log4j.category.OpenNMS.Capsd=DEBUG, CAPSD
log4j.appender.CAPSD.File=/opt/opennms/logs/daemon/capsd.log


if the new added service can be discovered, but having issue with polling,turn on debug on for polling process poller
/opt/opennms/etc/log4j.properties

# Pollers
log4j.category.OpenNMS.Poller=DEBUG, POLLERS

Wednesday, March 18, 2009

Authenticate Linux Clients with Active Directory

Great ariticle exlplaining Authenticate Linux Clients with Active Directory using three Authentication Strategies

Using LDAP Authentication
Using LDAP and Kerberos
Using Winbind

http://technet.microsoft.com/en-us/magazine/2008.12.linux.aspx

Tuesday, March 17, 2009

Learned one critical rule of Openldap's slapd.conf format

One critical rule of Openldap's slapd.conf format : no leading space.

Openldap is easy to config, you just need to customize three params suffix,rootdn and rootpw
# /etc/openldap/slapd.conf

database bdb
suffix "dc=example,dc=com"
rootdn "cn=root,dc=example,dc=com"
rootpw {SSHA}Ok/uoTJYELAj346giEh2mdvmiE5etgcg
The above is my initial config, the rootpw is generated by slappasswd

# slappasswd  -s pass123
{SSHA}sKFAA5OKE6oi+XCXQAJDj/69+g/K9irH


I started ldap service, it was fine,But when i do do ldapsearch it get "ldap_bind: Invalid credentials (49)" error

# ldapsearch -x -h 127.0.0.1 -D "cn=root,dc=example,dc=com" -w pass123
ldap_bind: Invalid credentials (49)


The rootdn and rootpw are definately correct, but why? Did you notice the space before rootpw? it is the culprit. The same search returned ok after deleted the leading space.

Another common error "ldap_sasl_interactive_bind_s: No such attribute (16)" will appear if you omit -x :simple authentication

# ldapsearch   -h 127.0.0.1 -D "cn=root,dc=example,dc=com" -w pass123
ldap_sasl_interactive_bind_s: No such attribute (16)


Openldap tested is slapd 2.3.27