VSFTP Configuration - vsftpd 安裝設定

1. 安裝:
RPM Requierment: vsftpd-2.0.5-16.el5

]#yum install vsftpd

2 設定:

2.1 設定vsftpd.conf:
]# vi /etc/vsftpd/vsftpd.conf

###begin of file###

##使用stand alone 方式啟動vsftpd daemon
listen=YES

#不允許 anonymous login
anonymous_enable=NO

#允許local端使用者登入
local_enable=YES

#允許檔案修改寫入
write_enable=YES

#設定新增檔案權限umask (目錄755檔案644)
local_umask=022

#允許顯示操作目錄訊息
dirmessage_enable=YES

#確認使用20 port 傳輸資料
connect_from_port_20=YES

##log 相關設定
#允許同時使用 vsftpd log及 xferlog
dual_log_enable=YES
#log timestamp 使用系統時間
use_localtime=YES
#xferlog log設定, 僅記錄檔案傳輸訊息.
xferlog_std_format=YES
xferlog_enable=YES
xferlog_file=/var/log/xferlog
#記錄所有vsftp user動作log
log_ftp_protocol=YES
#log路徑
vsftpd_log_file=/var/log/vsftpd.log

##使用change root 將使用者鎖在家目錄中
chroot_local_user=YES

##啟動禁止login的帳戶清單
#法一
userlist_enable=YES
#啟動清單中名單禁止
userlist_deny=YES
userlist_file=/etc/vsftpd/user_list
#法二
#使用系統pam認證, 設定禁止名單
pam_service_name=vsftpd

##啟動chroot功能
chroot_list_enable=YES
#若chroot enable, 此為允許列出上層目錄名單
#若chroot disable, 此為不允許列出上層目錄名單
chroot_list_file=/etc/vsftpd/chroot_list
####其選項, # mask 起來即可.

###end of file ####

2.2 設定pam的vsftpd檔:

]# vi /etc/pam.d/vsftpd

###begin of file##
#%PAM-1.0
session optional pam_keyinit.so force revoke
auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth required pam_shells.so
auth include system-auth
account include system-auth
session include system-auth
session required pam_loginuid.so
###end of file###

3 啟動測試:

3.1 啟動vsftpd:

]# /etc/init.d/vsftpd start

確認是否有錯誤訊息.

3.2 建立帳號:

]# useradd username
建立使用者username, 預設家目錄為/home/username.
]# passwd username
設定username密碼.

3.3 登入測試:

]# ftp 127.0.0.1
Connected to 127.0.0.1.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (127.0.0.1:root): username
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

ok!

3.4 檢查vsftp log:

]# tail -f /var/log/vsftpd.log
Fri Oct 16 14:35:17 2009 [pid 1461] FTP response: Client "127.0.0.1", "530 Please login with USER and PASS."
Fri Oct 16 14:35:23 2009 [pid 1461] FTP command: Client "127.0.0.1", "USER username"
Fri Oct 16 14:35:23 2009 [pid 1461] [username] FTP response: Client "127.0.0.1", "331 Please specify the password."
Fri Oct 16 14:35:25 2009 [pid 1461] [username] FTP command: Client "127.0.0.1", "PASS "
Fri Oct 16 14:35:25 2009 [pid 1460] [username] OK LOGIN: Client "127.0.0.1"
Fri Oct 16 14:35:25 2009 [pid 1462] [username] FTP response: Client "127.0.0.1", "230 Login successful."

ok!

mysql replication setup

實作版本
OS: CentOS 5.3
mysql : 5.1.37

實作目標:

Slave server 資料與 Master server 同步.

設定步驟:

1. 修改 Master Server my.cnf 檔:
#vi /etc/my.cnf
(預設路徑)

[mysqld]
.
.
server-id = 1 #設定id(與slave server區別)

log-slave-updates #啟動覆寫機制

log-bin=dba-master-bin #設定repilation binlog 檔名

存檔跳出後 restart mysql


2. 設定mysql replication 的帳號權限:
#mysql -uroot -p
(登入mysql console)
mysql> grant replication slave on *.* to userrepl@'172.16.%'identified by 'password';
( 帳號 userrepl 密碼 password, 允許172.16.0.0/16的區段連線 )
mysql> flush privileges;
(使帳號權限生效)

3. Master Server 的 lock DB 與dump DB:

3.1 lock DB:
#mysql -uroot -p
( 登入mysql console)
mysql> flush tables with read lock;
(lock db 確保來源檔案在dump的過程中不會再異動)

3.2 查看master log position資訊:

mysql> show master status\G;
*************************** 1. row ***************************
File: dba-master-bin.000005
Position: 845
Binlog_Do_DB:
Binlog_Ignore_DB:
1 row in set (0.00 sec)
ERROR:No query specified

(上面資訊把binlog的檔名:dba-master-bin.000005及位置:845記下來)

3.3 dump DB:
( system console)
#mysqldump -uroot -p --all-database --master-data > ALL_DB.sql
( 將lock中的DB全部dump到ALL_DB.sql)
再把ALL_DB.sql 傳送到slave server上

4. 修改 Slave Server my.cnf 檔:

#vi /etc/my.cnf
(預設路徑)

[mysqld]
.
.
server-id = 2 #設定id(與master server區別)


存檔跳出後 restart mysql

5. Store DB file:

#mysql -uroot -p < ALL_DB.sql ( 將master 的sql檔 store進slave server)


6. Slave mysql setting:

#mysql -uroot -p ( 登入slave mysql console)
mysql> CHANGE MASTER TO
MASTER_HOST='172.16.1.2', ( 示範的master server IP 位置)
MASTER_USER='userrepl',
MASTER_PASSWORD='password',
MASTER_LOG_FILE='dba-master-bin.000005',
MASTER_LOG_POS=845;

mysql> slave start;

( 啟動replication )

7. unlock master db:

回到master server 的mysql console

mysql>unlock tables;
(讓db可以正常寫入)


8. 檢查replication是否正常:

到slave server的mysql console

mysql>show slave status\G;

*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event .
.
.
Last_Errno: 0
Last_Error: ( 沒有錯誤訊息, 正常運作中 )
.
.

如果發生幾個不重要的query錯誤造成停止,
可使用下面命令跳過該query, 繼續運作replication.

mysql>slave stop; (先停止replication)
mysql>SET GLOBAL SQL_SLAVE_SKIP_COUNTER = 1; (跳過的query數)
mysql>slave start; (重啟replication)

新增 swap - CentOS, Fedora, RHEL

1. 新增swap檔案, 例1024Mb的swap空間:

#dd if=/dev/zero of=/swapfile bs=1024 count=1048576

新增 / 下面 swapfile 檔 count= bs * 1024

2. format swap 檔案:

#mkswap /swapfile

3. 啟動與停止 swap:

啟動
#swapon
停止
#swapoff

4. 設定/etc/fstab, 開機時自動mount swap 區塊
#vi /etc/fstab
設定一:
/dev/sda1 swap swap defaults 0 0
/swapfile swap swap defaults 0 0
設定二:
/swapfie swap swap noatime 0 0

5.確認swap是否有啟動

1.#top
2.#free
3.#cat /proc/swap

CentOS, Fedora snmp 設定

1. 使用rpm安裝.

1.1. yum 指令:
#yum install net-snmp

1.2. 設定snmpd.conf

#vi /etc/snmp/snmpd.conf ( 預設路徑 )
寫入
rocommunity public
即可:wq存檔離開,
(此法如果防火牆未開, 任何主機皆可查詢的到你)

CentOS VNC

1.start kdm
#/etc/init.d/xfs start ( important !!!)

1.1kdm
edit option in file /etc/X11/xdm/kdmrc
[Xdmcp]Enable=1
#netstat -tunlp (check listen port shows following)
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
5920/Xtcp 0 0 :::6000 :::* LISTEN
5920/Xudp 0 0 :::177 :::*

2.vnc setting

#su "username"#vncpasswd (setting a password for vnc)
clean all words in file/home/"username"/.vnc/xstartup
#exit ( return to root )
#vi /etc/sysconfig/vncservers ( change configure for vnc login user )VNCSERVERS="2:"username""
VNCSERVERARGS[2]="-geometry 800x600 -query localhost"
(2 = port )
#/etc/init.d/vncserver start (start vnc )
ok!

3.vnc start command
#vncserver :3 (start,3 = port )
#vncserver -kill :3(stop)

modify /root/.vnc/xstartup
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid greyvncconfig -iconic &xterm -geometry 80x24+10+10 -ls -title $VNCDESKTOP Desktop" &
#gnome desktopgnome-session &

Apache page authorization - htpaccess

1.configure the config file httpd.conf or apache.conf
#vi /etc/httpd/conf/httpd.conf

2.edit description as below
AccessFileName .htaccess

<file>

Order allow,deny
Deny from all
</files>

<directory>

AllowOverride
AuthConfig
Order allow,deny
Allow from all
</directory>

3.create authorization file(authorize path)
# vi .htaccess
content as :
AuthName "(text name)"
Authtype Basic
AuthUserFile (authorization file path)
require user (username)

4.Create user and password
#htpasswd -c (authorization file path) (username)
it can enter several user and password.

Drop duplicate mail - Postfix

Postfix mail server praised by all technician.
but it has a small problem of using "aliases" to define email group.
For example, when someone sends mail to "jameschen" who in the group "all",
"jameschen" will receive two the same mail form the server.
because the group title "all" is "jameschan"'s alias and "jameschan" is in group "all",
So that, Posrfix thinks that is two different username and will not drop the same mail,
Even the mail which sent to "all" will translate to "jameschan".
To solve this problem, we can use "procmail" to filter duplicate mail,
Touch a execute file name ".procmailrc" content as following:

:0 Whc: msgid.lock
formail -D 8192 msgid.cache
:0 a:
/dev/null

the confiig file of Postfix "main.cf" should be write a command line

"mailbox_command = /usr/bin/procmail"

Then copy to each user home directory,
The some mail will be drop.

CentOS 下把系統時區改為CST與系統對時

1. 複製台北時區設定檔為系統時間
# cp /usr/share/zoneinfo/Asia/Taipei /etc/localtime

2. 與 rdate server對時
# rdate -s time.bora.net
( time.bora.net 為少數rdate server之一)

3. 設定 cron job對時

3.1. 叫出cron job 編輯畫面
# crontab -e
3.2. 寫入設定每小時對時一次
0 * * * * rdate -s time.bora.net
3.3. 儲存跳出
:wq
(crontab: installing new crontab)

如此一來就可確保系統時間的正確性了.

One Way Trusted SSH Authorized Key

1. make public key:/.ssh]#ssh-keygen -d
2. Enter file in which to save the key (/root/.ssh/id_dsa): (just enter)
3. Enter passphrase (empty for no passphrase): (just enter)
4. Enter same passphrase again: (just enter)
5. Your identification has been saved in /root/.ssh/id_dsa.
6. Your public key has been saved in /root/.ssh/id_dsa.pub.
7. Use Scp id_dsa.pub to target remote host /.ssh/authorized_keys2

ok!