Kura-Kura Gurun

Install Android SDK on Linux

2012-01-16T23:55:00.000-08:00

Download Android SDK for linux at http://developer.android.com/sdk/index.html

Extract the package


[fazries@A1008 ~]$ tar -xf android-sdk_r16-linux.tgz
[fazries@A1008 ~]$ cd android-sdk-linux/
[fazries@A1008 android-sdk-linux]$ ls
add-ons  platforms  platform-tools  SDK Readme.txt  temp  tools

run the SDK


[fazries@A1008 android-sdk-linux]$ cd tools/
[fazries@A1008 tools]$ ./android

We need adb shell, because I want my galaxy mini set the application to SD card
after installation finish, you can find adb script at,platform-tools folder


[fazries@A1008 android-sdk-linux]$ cd platform-tools/
[fazries@A1008 platform-tools]$ ls
aapt  adb  aidl  dexdump  dx  fastboot  lib  llvm-rs-cc  NOTICE.txt  renderscript  source.properties

Ok, this is the fun part, Linux cannot read My devices, after read some reference at this page
http://forum.xda-developers.com/showthread.php?t=640158
and
http://yanzicjustnubie.wordpress.com/2011/04/22/cara-menjadikan-galaxy-mini-sebagai-modem-pada-ubuntu/

I cannot connecting My Device to my Linux box
you need generate udev files, and need root privilege for that


[root@A1008 ~]# touch /etc/udev/rules.d/51-android.rules
[root@A1008 ~]# vi /etc/udev/rules.d/51-android.rules
#fill with this
SUBSYSTEMS=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct} =="689e", MODE="0666"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct} =="685e", MODE="0666"

[root@A1008 ~]# cat /etc/udev/rules.d/51-android.rules 
SUBSYSTEMS=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct} =="689e", MODE="0666"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct} =="685e", MODE="0666"

ATTRS{idVendor}=="04e8" are Id Vendor for Samsung
ATTRS{idProduct} =="689e" are Id Product for Galaxy MiniATTRS{idProduct} =="689e" are Id Product for Galaxy Young

change files permission for 51-android.rules


[root@A1008 ~]# chmod 644 51-android.rules

restart udev services, Im using Fedora 16.


[root@A1008 ~]# service udev restart
Redirecting to /bin/systemctl  restart udev.service

Back to android-sdk-linux folder,


[fazries@A1008 ~]# cd ~/android-sdk/android-sdk-linux/platform-tools

Start adb script, on yor devices dont forget to set Allow Mock Location, and USB Debugging


[fazries@A1008 platform-tools]$ ./adb kill-server
[fazries@A1008 platform-tools]$ ./adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 

[fazries@A1008 platform-tools]$ ./adb devices
List of devices attached 
S5570412ac34e device

adb devices need times for detecting My Devices, just repeat the commands several times.
Run the command to move Default Installation to SD Card."adb shell pm setInstallLocation 2"


[fazries@A1008 platform-tools]$ ./adb shell pm setInstallLocation 2

Finish, Now My Galaxy Mini can move apps to SD :-), Horrey...

Rabbitvcs on Centos6.2

2012-01-16T03:29:00.000-08:00

Assalamualaykum,
Hai I'm back again,rabbitcvs is a great tools for svn frontend but its hard to install and find the rpm package for CentOs 6.2, here I success install rabbitvcs using fedora14 source package.
you need epel repo for this


rpm -ivh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm

do a repo list in yum


[root@A1006 ~]# yum repolist

Install the package, for rebuild rabbitvcs, the package are:
rpm-build pygtk2 subversion subversion-devel gcc gcc-c++ neon-devel python-devel pygtk2-devel python-configobj nautilus-devel meld libX11-devel pygobject2 pysvn python-dulwich gnome-vfs2-devel gnome-python2-devel make python-simplejson


[root@A1006 ~]# yum install rpm-build pygtk2 subversion subversion-devel gcc gcc-c++ neon-devel python-devel pygtk2-devel python-configobj nautilus-devel meld libX11-devel pygobject2 pysvn python-dulwich  --nogpgcheck


[root@A1006 ~]# yum install gnome-vfs2-devel gnome-python2-devel


[root@A1006 ~]# yum install python-simplejson


[root@A1006 ~]# yum install make

Download the rpm source for rabbitvcs


[root@A1006 ~]# wget -c http://download.fedora.redhat.com/pub/fedora/linux/updates/14/SRPMS/rabbitvcs-0.14.2.1-3.fc14.src.rpm
[root@A1006 ~]# wget -c http://download.fedora.redhat.com/pub/fedora/linux/releases/14/Everything/source/SRPMS/nautilus-python-0.7.0-2.fc14.src.rpm

Rebuild the package


[root@A1006 ~]# rpmbuild --rebuild rabbitvcs-0.14.2.1-3.fc14.src.rpm
Wrote: /root/rpmbuild/RPMS/noarch/rabbitvcs-core-0.14.2.1-3.el6.noarch.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/rabbitvcs-nautilus-0.14.2.1-3.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/rabbitvcs-thunar-0.14.2.1-3.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/rabbitvcs-gedit-0.14.2.1-3.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/noarch/rabbitvcs-cli-0.14.2.1-3.el6.noarch.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.1Y4O4p
+ umask 022
+ cd /root/rpmbuild/BUILD
+ cd rabbitvcs-0.14.2.1
+ rm -rf /root/rpmbuild/BUILDROOT/rabbitvcs-0.14.2.1-3.fc14.x86_64
+ exit 0
Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.WKTO2p
+ umask 022
+ cd /root/rpmbuild/BUILD
+ rm -rf rabbitvcs-0.14.2.1
+ exit 0

Rebuild package nautilus-python


[root@A1006 ~]# rpmbuild --rebuild nautilus-python-0.7.0-2.fc14.src.rpm --nosignature
Wrote: /root/rpmbuild/RPMS/x86_64/nautilus-python-0.7.0-2.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/nautilus-python-devel-0.7.0-2.el6.x86_64.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.6hyEjj
+ umask 022
+ cd /root/rpmbuild/BUILD
+ cd nautilus-python-0.7.0
+ rm -rf /root/rpmbuild/BUILDROOT/nautilus-python-0.7.0-2.fc14.x86_64
+ exit 0
Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.rgSbin
+ umask 022
+ cd /root/rpmbuild/BUILD
+ rm -rf nautilus-python-0.7.0
+ exit 0

Install nautilus-python


[root@A1006 ~]# yum localinstall rpmbuild/RPMS/x86_64/nautilus-python-0.7.0-2.el6.x86_64.rpm

Install rabbitvcs core and cli


[root@A1006 ~]# yum localinstall rpmbuild/RPMS/noarch/rabbitvcs-cli-0.14.2.1-3.el6.noarch.rpm rpmbuild/RPMS/noarch/rabbitvcs-core-0.14.2.1-3.el6.noarch.rpm

[root@A1006 ~]# yum localinstall rpmbuild/RPMS/x86_64/rabbitvcs-nautilus-0.14.2.1-3.el6.x86_64.rpm rpmbuild/RPMS/x86_64/rabbitvcs-gedit-0.14.2.1-3.el6.x86_64.rpm

We need to modify setting.py there is a bug, we cannot run rabbitvcs settings, you can refer to this page
http://code.google.com/p/rabbitvcs/issues/detail?id=591#c0
replace this line
self.get_widget("pages").get_nth_page(5).set_visible(show_git)


[root@A1006 ~]# vi /usr/lib/python2.6/site-packages/rabbitvcs/ui/settings.py
#self.get_widget("pages").get_nth_page(5).set_visible(show_git)

 if show_git:
                self.get_widget("pages").get_nth_page(5).show()
        else:
                self.get_widget("pages").get_nth_page(5).hide()

make a symbolic link from /usr/lib/ to /usr/lib64 for rabbitvcs package


ln -s /usr/lib/python2.6/site-packages/rabbitvcs /usr/lib64/python2.6/site-packages/rabbitvcs
ln -s /usr/lib/python2.6/site-packages/rabbitvcs-0.14.2.1-py2.6.egg-info /usr/lib64/python2.6/site-packages/rabbitvcs-0.14.2.1-py2.6.egg-info

Next reboot your GDM, and setup your gedit to activate rabbitvcs plugins

check the rabbitvcs plugins

rabbitvcs on my nautilus

Part II - LDAP Client using nss_pam_ldap

2012-01-05T19:52:00.000-08:00

Hello good morning, here in indonesia still morning, I write this article at 9 am, but never mind, lets continue my next article. at this part I will make a LDAP Client still using Centos 6.2, continuing my last article about Directory Server Part I. I'm using nss_pam_ldap for it, you can read the manual here.
http://arthurdejong.org/nss-pam-ldapd/setup
Ok, first we need install the package (-_-! of course).


[root@localhost ~]# yum install nss-pam-ldapd

We need configure some files:
nss-pam-ldap:
/etc/nslcd.conf
authentication:
/etc/sysconfig/authconfig
nss:
/etc/nsswitch.conf
services:
/etc/init.d/nslcd
Minimum configuration for nslcd.conf


uid nslcd
gid ldap
base dc=sidoel,dc=com
uri ldap://192.168.1.200/

configure /etc/sysconfig/authconfig for enabling USELDAPAUTH


USELDAPAUTH=yes
USELDAP=yes

configuring /etc/nsswitch.conf


passwd:     files ldap
shadow:     files ldap
group:      files ldap

hosts:      files dns

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   files ldap

publickey:  nisplus

automount:  files ldap
aliases:    files nisplus

check all auth configuration


[root@localhost ~]# authconfig --updateall
Starting nslcd:                                            [  OK  ]

restart the nslcd services


[root@localhost ~]# /etc/init.d/nslcd restart
Stopping nslcd:                                            [  OK  ]
Starting nslcd:                                            [  OK  ]

cek our ldap account and group


[root@localhost ~]# getent passwd | grep fazrie
fazrie:*:1001:1001:Fazrie:/home/fazrie:/bin/bash
[root@localhost ~]# getent group | grep Linux
Linux Users:*:1001:

you can read this as a reference
http://www.yolinux.com/TUTORIALS/LDAP_Authentication.html
http://arthurdejong.org/nss-pam-ldapd/setup

Part I - 389 Directory Server on Centos 6.2

2012-01-04T19:29:00.000-08:00

Configure the host name


[root@ketoprak ~]#vi /etc/hosts
192.168.1.200 ketoprak.sidoel.com ketoprak

Install Centos Directory Server


[root@localhost ~]# yum install nss-pam-ldapd nscd pam-ldap
[root@localhost ~]# yum install 389-ds-base*
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: centos.biz.net.id
 * rpmforge: ftp-stud.fht-esslingen.de
Setting up Install Process
Resolving Dependencies

Dependencies Resolved

===========================================================================================================================================
 Package                                    Arch                     Version                               Repository                 Size
===========================================================================================================================================
Installing:
 389-ds-base                                x86_64                   1.2.9.14-1.el6                        base                      1.4 M
 389-ds-base-devel                        x86_64                   1.2.9.14-1.el6                        base                       92 k
 389-ds-base-libs                           x86_64                   1.2.9.14-1.el6                        base                      362 k
Installing for dependencies:
 audit-libs-python                          x86_64                   2.1.3-3.el6                           base                       58 k
 cyrus-sasl-gssapi                          x86_64                   2.1.23-13.el6                         base                       33 k
 libcgroup                                     x86_64                   0.37-3.el6                            base                      104 k
 libicu                                           x86_64                   4.2.1-9.1.el6_2                       updates                   4.9 M
 libsemanage-python                     x86_64                   2.0.43-4.1.el6                        base                       81 k
 lm_sensors-libs                            x86_64                   3.1.1-10.el6                          base                       37 k
 net-snmp-libs                               x86_64                   1:5.5-37.el6_2.1                      updates                   1.5 M
 nspr-devel                                    x86_64                   4.8.8-3.el6                           base                      109 k
 nss-devel                                     x86_64                   3.12.10-17.el6_2                      updates                   168 k
 nss-softokn-devel                         x86_64                   3.12.9-11.el6                         base                       16 k
 nss-softokn-freebl-devel                x86_64                   3.12.9-11.el6                         base                       25 k
 nss-tools                                      x86_64                   3.12.10-17.el6_2                      updates                   749 k
 nss-util-devel                                x86_64                   3.12.10-2.el6                         base                       59 k
 openldap-clients                           x86_64                   2.4.23-20.el6                         base                      161 k
 perl-Mozilla-LDAP                          x86_64                   1.5.3-4.el6                           base                      160 k
 policycoreutils-python                   x86_64                   2.0.83-19.18.el6                      base                      337 k
 setools-libs                                  x86_64                   3.3.7-4.el6                           base                      400 k
 setools-libs-python                       x86_64                   3.3.7-4.el6                           base                      222 k
 svrcore                                       x86_64                   4.0.4-5.1.el6                         base                       15 k
 svrcore-devel                              x86_64                   4.0.4-5.1.el6                         base                      9.7 k
Updating for dependencies:
 nss                                            x86_64                   3.12.10-17.el6_2                      updates                   776 k
 nss-sysinit                                  x86_64                   3.12.10-17.el6_2                      updates                    30 k

Transaction Summary
===========================================================================================================================================
Install      23 Package(s)
Upgrade       2 Package(s)

Total download size: 12 M
Is this ok [y/N]: y

Centos repos didn't provide 389-ds package only 389-ds-base. so here I cannot run setup-ds-admin.pl it will provide admin account, I will fix it later for now I will use Directory Manager as an example to accessing the Database.
Run and configure the Default Directory Server Instance and Administration Server.


[root@localhost ~]# setup-ds.pl

==============================================================================
This program will set up the 389 Directory Server.

It is recommended that you have "root" privilege to set up the software.
Tips for using this  program:
  - Press "Enter" to choose the default and go to the next screen
  - Type "Control-B" or the word "back" then "Enter" to go back to the previous screen
  - Type "Control-C" to cancel the setup program

Would you like to continue with set up? [yes]: yes

==============================================================================
Your system has been scanned for potential problems, missing patches,
etc.  The following output is a report of the items found that need to
be addressed before running this software in a production
environment.

389 Directory Server system tuning analysis version 10-AUGUST-2007.

NOTICE : System is x86_64-unknown-linux2.6.32-220.el6.x86_64 (1 processor).

ERROR  : Only 238MB of physical memory is available on the system. 256MB is the
recommended minimum. 1024MB is recommended for best performance on large production system.

NOTICE : The net.ipv4.tcp_keepalive_time is set to 7200000 milliseconds
(120 minutes).  This may cause temporary server congestion from lost
client connections.

WARNING: There are only 1024 file descriptors (hard limit) available, which
limit the number of simultaneous connections.  

WARNING: There are only 1024 file descriptors (soft limit) available, which
limit the number of simultaneous connections.  

ERROR  : The above errors MUST be corrected before proceeding.

Would you like to continue? [no]: yes

==============================================================================
Choose a setup type:

   1. Express
       Allows you to quickly set up the servers using the most
       common options and pre-defined defaults. Useful for quick
       evaluation of the products.

   2. Typical
       Allows you to specify common defaults and options.

   3. Custom
       Allows you to specify more advanced options. This is 
       recommended for experienced server administrators only.

To accept the default shown in brackets, press the Enter key.

Choose a setup type [2]: 2

==============================================================================
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
.
Example: eros.example.com.

To accept the default shown in brackets, press the Enter key.

Warning: This step may take a few minutes if your DNS servers
can not be reached or if DNS is not configured correctly.  If
you would rather not wait, hit Ctrl-C and run this program again
with the following command line option to specify the hostname:

    General.FullMachineName=your.hostname.domain.name

Computer name [ketoprak.sidoel.com.sidoel.com]: ketoprak.sidoel.com

==============================================================================
The server must run as a specific user in a specific group.
It is strongly recommended that this user should have no privileges
on the computer (i.e. a non-root user).  The setup procedure
will give this user/group some permissions in specific paths/files
to perform server-specific operations.

If you have not yet created a user and group for the server,
create this user and group using your native operating
system utilities.

System User [nobody]: 
System Group [nobody]: 

==============================================================================
The standard directory server network port number is 389.  However, if
you are not logged as the superuser, or port 389 is in use, the
default value will be a random unused port number greater than 1024.
If you want to use port 389, make sure that you are logged in as the
superuser, that port 389 is not in use.

Directory server network port [389]: 

==============================================================================
Each instance of a directory server requires a unique identifier.
This identifier is used to name the various
instance specific files and directories in the file system,
as well as for other uses as a server instance identifier.

Directory server identifier [ketoprak]: 

==============================================================================
The suffix is the root of your directory tree.  The suffix must be a valid DN.
It is recommended that you use the dc=domaincomponent suffix convention.
For example, if your domain is example.com,
you should use dc=example,dc=com for your suffix.
Setup will create this initial suffix for you,
but you may have more than one suffix.
Use the directory server utilities to create additional suffixes.

Suffix [dc=sidoel, dc=com]: 

==============================================================================
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and typically has a
bind Distinguished Name (DN) of cn=Directory Manager.
You will also be prompted for the password for this user.  The password must
be at least 8 characters long, and contain no spaces.
Press Control-B or type the word "back", then Enter to back up and start over.

Directory Manager DN [cn=Directory Manager]: 
Password: manager^123
Password (confirm): manager^123
Your new DS instance 'ketoprak' was successfully created.
Exiting . . .
Log file is '/tmp/setupzE1qqa.log'

It will generate instance database named slapd-ketoprak
the configuration you can find it at /etc/dirsrv/slapd-ketoprak


[root@ketoprak slapd-ketoprak]# cd /etc/dirsrv/slapd-ketoprak/
[root@ketoprak slapd-ketoprak]# ls
cert8.db  certmap.conf  dse.ldif  dse.ldif.bak  dse.ldif.startOK  dse_original.ldif  key3.db  schema  secmod.db  slapd-collations.conf

See entire Database, using ldap search


[root@ketoprak ~]# ldapsearch -x -b "dc=sidoel,dc=com"
# extended LDIF
#
# LDAPv3
# base  with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# sidoel.com
dn: dc=sidoel,dc=com
objectClass: top
objectClass: domain
dc: sidoel

# Directory Administrators, sidoel.com
dn: cn=Directory Administrators,dc=sidoel,dc=com
objectClass: top
objectClass: groupofuniquenames
cn: Directory Administrators
uniqueMember: cn=Directory Manager

# Groups, sidoel.com
dn: ou=Groups,dc=sidoel,dc=com
objectClass: top
objectClass: organizationalunit
ou: Groups

# People, sidoel.com
dn: ou=People,dc=sidoel,dc=com
objectClass: top
objectClass: organizationalunit
ou: People

# Special Users, sidoel.com
dn: ou=Special Users,dc=sidoel,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Special Users
description: Special Administrative Accounts

# Accounting Managers, Groups, sidoel.com
dn: cn=Accounting Managers,ou=Groups,dc=sidoel,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: Accounting Managers
ou: groups
description: People who can manage accounting entries
uniqueMember: cn=Directory Manager

# HR Managers, Groups, sidoel.com
dn: cn=HR Managers,ou=Groups,dc=sidoel,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: HR Managers
ou: groups
description: People who can manage HR entries
uniqueMember: cn=Directory Manager

# QA Managers, Groups, sidoel.com
dn: cn=QA Managers,ou=Groups,dc=sidoel,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: QA Managers
ou: groups
description: People who can manage QA entries
uniqueMember: cn=Directory Manager

# PD Managers, Groups, sidoel.com
dn: cn=PD Managers,ou=Groups,dc=sidoel,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: PD Managers
ou: groups
description: People who can manage engineer entries
uniqueMember: cn=Directory Manager

# search result
search: 2
result: 0 Success

# numResponses: 10
# numEntries: 9

Now I will add some account and group to the Database. Using ldif file.
add entries for user fazrie and Linux Group


[root@ketoprak ~]# vi account.ldif
dn: cn=Linux Users,ou=Groups,dc=sidoel,dc=com
objectClass: posixGroup
objectClass: top
cn: Linux Users
userPassword: {crypt}x
gidNumber: 1001

dn: uid=fazrie,ou=People,dc=sidoel,dc=com
objectClass: top
objectClass: posixaccount
cn: Fazrie
gidNumber: 1001
homeDirectory: /home/fazrie
uid: fazrie
uidNumber: 1001
loginShell: /bin/bash
userPassword: {crypt}x

Insert the ldif file to Database usign ldapmodify commands


[root@ketoprak ~]# ldapmodify -x -a -p 389 -h localhost -D "cn=Directory Manager" -w manager^123 -f account.ldif 
adding new entry "cn=Linux Users,ou=Groups,dc=sidoel,dc=com"

adding new entry "uid=fazrie,ou=People,dc=sidoel,dc=com"

Check the account we have been insert.


[root@ketoprak ~]# ldapsearch -x -b "dc=sidoel,dc=com" | grep fazrie
# fazrie, People, sidoel.com
dn: uid=fazrie,ou=People,dc=sidoel,dc=com
homeDirectory: /home/fazrie
uid: fazrie
[root@ketoprak ~]# ldapsearch -x -b "dc=sidoel,dc=com" | grep Linux
# Linux Users, Groups, sidoel.com
dn: cn=Linux Users,ou=Groups,dc=sidoel,dc=com
cn: Linux Users

modify password ldap account


[root@ketoprak ~]# ldappasswd -xv -D "cn=Directory Manager" -w manager^123 -S "uid=fazrie,ou=People,dc=sidoel,dc=com"
New password: fazrie
Re-enter new password: fazrie 
ldap_initialize(  )
Result: Confidentiality required (13)
Additional info: Operation requires a secure connection.

You can combine it with samba as pdc follow this linkhttp://kura2gurun.blogspot.com/2011/06/samba-pdc-with-centos-directory-server.html

tips and trick part 7

2011-12-20T20:10:00.000-08:00

I found some interesting commands at the internet,

1. Google query for finding ebook or files directly


-inurl:htm -inurl:html intitle:"index of" +("/ebooks"|"/book") +(chm|pdf|zip) +"Solaris 10"

2. How to kill a session in linux


kill -9 `ps -u herwidodok | grep -v PID | awk '{ printf ("%s ", $1); }'`

3. How to create an iso file


mkisofs -JR -joliet-long -V my_label -o my_iso_file.iso /path/the/folder/you/want/to/create/an/iso

OpenVPN modules for SELinux

2011-12-20T19:59:00.000-08:00

Each time I setup a new keys for my client, the selinux always preventing the connection so the vpn wont work.this is the syntax for enable openvpn selinux.


module openvpn 1.0;

require {
        type openvpn_t;
        type user_home_t;
        class file { read open };
}

#============= openvpn_t ==============
allow openvpn_t user_home_t:file open;
#!!!! This avc is allowed in the current policy

allow openvpn_t user_home_t:file read;

And how to generate a module from *.te file? please read my previous article
http://kura2gurun.blogspot.com/2011/09/tips-and-trick-part-3.html

Bye :-)

mounting udf file system

2011-12-01T02:37:00.001-08:00


[root@A1009 x86(32 bit)]# mount -o loop -t udf en_windows_7_ultimate_x86_dvd_x15-65921.iso /media/iso/
mount: unknown filesystem type 'udf'


[root@A1009 x86(32 bit)]# cat /proc/filesystems 
nodev sysfs
nodev rootfs
nodev bdev
nodev proc
nodev cgroup
nodev cpuset
nodev tmpfs
nodev devtmpfs
nodev binfmt_misc
nodev debugfs
nodev securityfs
nodev sockfs
nodev usbfs
nodev pipefs
nodev anon_inodefs
nodev devpts
 ext3
 ext4
nodev ramfs
nodev hugetlbfs
 iso9660
nodev autofs
nodev mqueue
nodev selinuxfs
nodev fuse
 fuseblk
nodev fusectl


[root@A1009 x64(64 bit)]# modprobe -l | grep udf
kernel/fs/udf/udf.ko
[root@A1009 x86(32 bit)]# locate udf.ko
/lib/modules/2.6.35.14-103.fc14.x86_64/kernel/fs/udf/udf.ko
/lib/modules/2.6.35.14-95.fc14.x86_64/kernel/fs/udf/udf.ko
/lib/modules/2.6.35.14-96.fc14.x86_64/kernel/fs/udf/udf.ko


[root@A1009 x86(32 bit)]# uname -a
Linux A1009.asyx.com 2.6.35.14-103.fc14.x86_64 #1 SMP Thu Oct 27 15:41:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
[root@A1009 x86(32 bit)]# cd /lib/modules/2.6.35.14-103.fc14.x86_64/kernel/fs/udf/
[root@A1009 x86(32 bit)]# insmod udf.ko


[root@A1009 x86(32 bit)]# cat /proc/filesystems 
nodev sysfs
nodev rootfs
nodev bdev
nodev proc
nodev cgroup
nodev cpuset
nodev tmpfs
nodev devtmpfs
nodev binfmt_misc
nodev debugfs
nodev securityfs
nodev sockfs
nodev usbfs
nodev pipefs
nodev anon_inodefs
nodev devpts
 ext3
 ext4
nodev ramfs
nodev hugetlbfs
 iso9660
nodev autofs
nodev mqueue
nodev selinuxfs
nodev fuse
 fuseblk
nodev fusectl
        udf


[root@A1009 x64(64 bit)]# mount -o loop -t udf en_windows_7_ultimate_x64_dvd_x15-65922.iso /media/iso/
loop: can't delete device /dev/loop2: Device or resource busy
mount: wrong fs type, bad option, bad superblock on /dev/loop2,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so


[root@A1009 x86(32 bit)]# lsof | grep loop
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/heriyanto/.gvfs
      Output information may be incomplete.
abrtd     2805      root  mem       REG              253,2      24088    1186347 /usr/lib64/abrt/libKerneloopsScanner.so
abrtd     2805      root  mem       REG              253,2      15664    1186346 /usr/lib64/abrt/libKerneloopsReporter.so
abrtd     2805      root  mem       REG              253,2      11400    1186345 /usr/lib64/abrt/libKerneloops.so
gnome-set 3581 heriyanto  mem       REG              253,2      18744    1185847 /usr/lib64/libpulse-mainloop-glib.so.0.0.4
gnome-vol 3657 heriyanto  mem       REG              253,2      18744    1185847 /usr/lib64/libpulse-mainloop-glib.so.0.0.4
loop0     4942      root  cwd       DIR              253,2       4096          2 /
loop0     4942      root  rtd       DIR              253,2       4096          2 /
loop0     4942      root  txt   unknown                                          /proc/4942/exe
loop1     6744      root  cwd       DIR              253,2       4096          2 /
loop1     6744      root  rtd       DIR              253,2       4096          2 /
loop1     6744      root  txt   unknown                                          /proc/6744/exe
loop2     6838      root  cwd       DIR              253,2       4096          2 /
loop2     6838      root  rtd       DIR              253,2       4096          2 /
loop2     6838      root  txt   unknown                                          /proc/6838/exe


[root@A1009 x86(32 bit)]# ps axf | grep loop
 4942 ?        S<     0:00  \_ [loop0]
 6744 ?        S<     0:00  \_ [loop1]
 6838 ?        S<     0:00  \_ [loop2]
 6915 pts/0    S+     0:00                      \_ grep --color=auto loop

[root@A1009 x86(32 bit)]# kill -9 6744
[root@A1009 x86(32 bit)]# kill -9 6838


[root@A1009 x86(32 bit)]# mount -o loop -t udf en_windows_7_ultimate_x86_dvd_x15-65921.iso /media/iso/
mount: warning: /media/iso/ seems to be mounted read-only.
[root@A1009 x86(32 bit)]# ls /media/iso/
autorun.inf  boot  bootmgr  efi  setup.exe  sources  support  upgrade

tips and trick part 6

2011-11-17T19:26:00.001-08:00

1.) How to extract RPM packages
use rpm2cpio "package-name" | cpio -idv


[fazries@A1008]# rpm2cpio flash-plugin-11.0.1.152-release.x86_64.rpm |cpio -idv
./usr/lib64/flash-plugin
./usr/lib64/flash-plugin/LICENSE
./usr/lib64/flash-plugin/README
./usr/lib64/flash-plugin/homecleanup
./usr/lib64/flash-plugin/libflashplayer.so
./usr/lib64/flash-plugin/setup
./usr/share/doc/flash-plugin-11.0.1.152
./usr/share/doc/flash-plugin-11.0.1.152/readme.txt
36761 blocks

Mod Security2 Apps for Splunk

2011-11-17T02:05:00.001-08:00

Hai, I'm back.
today I will explain how to make an applications for Splunk, as an example I will used mod security2 ( because I cannot find apps for this -_-! so lets make it by your self ).
this is the example after I build my own apps for mod security2.

Next, First step. 1) We will make apps template provide by Splunk
Login to Splunk and go to

Manager-Apps-create apps
look like the image below

Fill the empty field like the image above, or you can put everything you want

2) After the template has been created, you should preparing the tools
go to /opt/splunk/etc/apps

[root@localhost ~]# cd /opt/splunk/etc/apps
[root@localhost apps]# cd mod_security2/default
[root@localhost default]#  touch {indexes.conf,inputs.conf,props.conf,savedsearches.conf,transforms.conf}

here we have 5 files, for configuration, you can find the explanation for each files at
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Whatsinthismanual
and type on the"search" :-)
indexes.conf

# Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved.  Version 4.2.4
# Creates a sample index for sample data.

[modsec]
homePath   = $SPLUNK_DB/modsec/db
coldPath   = $SPLUNK_DB/modsec/colddb
thawedPath = $SPLUNK_DB/modsec/thaweddb

inputs.conf

# Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved.  Version 4.2.4
# Creates an input for sample data.

[monitor:///var/log/httpd/modsec_audit.log]
index=modsec
source=mod_security
sourcetype=modsec

props.conf

[modsec]
TRUNCATE = 0 
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = (--[a-z0-9]+-A--)
REPORT-get = get
REPORT-post = post
REPORT-severity = severity
REPORT-msg = msg
REPORT-error = error
REPORT-ipsrc = ipsrc
REPORT-tagid = tagid

savedsearches.conf

[default]
disabled = 0

[All Status]
enableSched = 0
search = index=modsec sourcetype="modsec" sev_stat="*" tagid_stat="*" ipsrc_stat="*" msg_stat="*"
dispatch.earliest_time = -4d
vsid = *:guuvw49b

[Severity Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  sev_stat limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[HTTP/GET Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  ms_get limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[HTTP/POST Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  ms_post limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[HTTP Error Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  error_stat limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[Vulnerability Message]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  msg_stat limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[IP Source Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  ipsrc_stat limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[Vulnerability Status]
enableSched = 0
search =  index=modsec sourcetype="modsec" | top  tagid_stat limit=1000
dispatch.earliest_time = -7d@d
vsid = *:guuvw49b

[HTTP Error Message]
action.email.reportServerEnabled = 0
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -7d@d
dispatch.latest_time = now
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index=modsec sourcetype="modsec" | top error_stat limit="100"
vsid = *:gv3j8amu

transforms.conf

[get]
REGEX = (GET.+?)$
FORMAT = ms_get::$1

[post]
REGEX = (POST.+?)$
FORMAT = ms_post::$1

[severity]
REGEX = (severity)."(.+?)"\]
FORMAT = sev_stat::$2

[msg]
REGEX = \[(msg)."(.+?)"\]
FORMAT = msg_stat::$2

[error]
REGEX = (HTTP/....[45]0[0-5]\s\w{1,}.*)
FORMAT = error_stat::$1

[ipsrc]
REGEX = 0\]\s{1}\w{1,}\s{1}(\d+\.\d+\.\d+\.\d+)?
FORMAT = ipsrc_stat::$1

[tagid]
REGEX = tag\s"(\w{1,}.+?)"\]
FORMAT = tagid_stat::$1

3) Modify the navigation menus

[root@localhost default]# vim ../local/data/ui/nav/default.xml

modify this

became this

4) touch /opt/splunk/etc/apps/mod_security2/local/viewstates.conf if that file not there.
fill with this

[*:guuvw49b]
AxisScaleFormatter_0_9_0.default = ""
ChartTypeFormatter_0_4_0.default = bar
Count_0_3_0.default = 10
DataOverlay_0_5_0.dataOverlayMode = none
DataOverlay_0_5_0.default = none
FlashChart_0_4_1.height = 300px
LegendFormatter_0_10_0.default = top
LineMarkerFormatter_0_7_0.default = false
NullValueFormatter_0_9_0.default = gaps
SplitModeFormatter_0_8_0.default = false
StackModeFormatter_0_7_0.default = default
XAxisTitleFormatter_0_6_1.default = tagid_stat
YAxisRangeMaximumFormatter_0_8_0.default = ""
YAxisRangeMinimumFormatter_0_7_0.default = ""
YAxisTitleFormatter_0_6_2.default = Frequency

[*:gv3fqc6l]
AxisScaleFormatter_0_9_0.default = ""
ChartTypeFormatter_0_4_0.default = area
Count_0_3_0.default = 10
DataOverlay_0_5_0.dataOverlayMode = none
DataOverlay_0_5_0.default = none
FlashChart_0_4_1.height = 300px
LegendFormatter_0_10_0.default = top
LineMarkerFormatter_0_7_0.default = false
NullValueFormatter_0_9_0.default = gaps
SplitModeFormatter_0_8_0.default = false
StackModeFormatter_0_7_0.default = default
XAxisTitleFormatter_0_6_1.default = time
YAxisRangeMaximumFormatter_0_8_0.default = ""
YAxisRangeMinimumFormatter_0_7_0.default = ""
YAxisTitleFormatter_0_6_2.default = count of events

[*:gv3j8amu]
AxisScaleFormatter_0_9_0.default = ""
ChartTitleFormatter_0_6_0.default = HTTP Error Message
ChartTypeFormatter_0_4_0.default = pie
Count_0_3_0.default = 10
DataOverlay_0_5_0.dataOverlayMode = none
DataOverlay_0_5_0.default = none
FlashChart_0_4_1.height = 300px
LegendFormatter_0_10_0.default = right
LineMarkerFormatter_0_7_0.default = false
NullValueFormatter_0_9_0.default = gaps
SplitModeFormatter_0_8_0.default = false
StackModeFormatter_0_7_0.default = default
XAxisTitleFormatter_0_6_1.default = error_stat
YAxisRangeMaximumFormatter_0_8_0.default = ""
YAxisRangeMinimumFormatter_0_7_0.default = ""
YAxisTitleFormatter_0_6_2.default = Frequency

5) Restart Splunk services

[root@localhost ~]# /opt/splunk/bin/splunk restart

6) Login to Splunk again, and try to accessing your mod security apss.

authentication failure using SSH pam_unix(sshd:auth): authentication failure;

2011-10-27T19:50:00.000-07:00


2011-10-24T11:22:22.125623+07:00 ID41-ND016 sshd[8909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=sshK ruser= rhost=10.62.41.115  user=fazries
2011-10-24T11:22:22.151540+07:00 ID41-ND016 sshd[8909]: Accepted password for fazries from 10.62.41.115 port 49633 ssh2
2011-10-24T11:22:22.263304+07:00 ID41-ND016 sshd[8909]: pam_unix(sshd:session): session opened for user fazries by (uid=0)

when I try connect to another server using ssh, I found an error on /var/log/secure "pam_unix(sshd:auth): authentication failure; "
okay, we know the problem is on the pam module, so we should look at sshd module on pam directory at /etc/pam.d/

at /etc/pam.d/sshd


auth       include      system-auth

account    required     pam_nologin.so
account    include      system-auth

password   include     system-auth

session    required     pam_selinux.so close
session    include      system-auth
session    required     pam_loginuid.so require_auditd

here we can see the authentication included system-auth"auth include system-auth". okay next we should take a look on /etc/pam.d/system-authon pam system-auth look at auth section, at my system-auth module, the system will check local system (pam_unix) at the first timethen check the ldap database (pam_ldap).

Alhamdulillah that issue because sshd:auth want to connect to remote server and cannot find the user at local system (pam_unix), that's why appears message authentication failure,

because my user at ldap database after cannot find the user on local system then sshd:auth try to find it at ldap database (pam_ldap), and found it.

"Accepted password for fazries from 10.62.41.115 port 49633 ssh2"

at /etc/pam.d/system-auth


auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

this is the way out.... :-)

replace try_first_pass to pam.ldap.so and use_first_pass to pam_unix.so that will make ssh search user from ldap database first,if not found then ssh will search at local system.


auth        required      pam_env.so
auth        sufficient    pam_ldap.so try_first_pass
auth        sufficient    pam_unix.so nullok use_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

that will make the error message "sshd[8909]: pam_unix(sshd:auth): authentication failure;" gone.


2011-10-27T13:33:16.738779+07:00 ID41-ND016 sshd[16689]: Accepted password for fazries from 10.62.41.115 port 41924 ssh2
2011-10-27T13:33:16.895793+07:00 ID41-ND016 sshd[16689]: pam_unix(sshd:session): session opened for user fazries by (uid=0)

Jual Madu Hutan Riau "Pak Arif"

2011-10-26T01:34:00.001-07:00

Jual Madu Hutan Riau asli.

spesifikasi:

- Asli (InsyaAlloh) dari Hutan(Sialang) Riau

- Berat 1000gr/ 1kg

- Ada tanggal kadularsa nya (InsyaAlloh Aman) dan terjaga

- Rasa telah teruji

Bila berminat silahkan hubungi YM (private message) yang tertera atau kirimkan email ke aji2782@gmail.com

check files inside a folder,nagios

2011-10-18T20:38:00.000-07:00

Bagaimana mengecek jumlah file yang ada dalam sebuah folder?, bila file yang terdapat dalam sebuah folder melebihi batas maksimum/kosong yang telah kita tentukan, maka nagios mengirimkan pesan.


#!/bin/bash
# Standard Nagios return codes
#OK       = 0
#WARNING  = 1
#CRITICAL = 2
#UNKNOWN  = 3

#SUPGEN.csv.base

usage()
{
        echo "usage: check_file [-c critical_value] [-d directory_path]"
        echo
        echo "check_file -c 0 -d /path/to/file/location"
        exit 3
}


while getopts c:d: OPTNAME; do
        case "$OPTNAME" in
        c)
                CRITVAL="$OPTARG"
                ;;
        d)
                DIRPATH="$OPTARG"
                ;;
        *)
                usage
                ;;
        esac
done

#check value
if [ "$CRITVAL" = "" ]; then
                echo "Error: critical_value must not empty"
                usage
                exit 3
fi
#check dir
if [ "$DIRPATH" = "" ]; then
                echo "Error: directory must exist do not empty"
                usage
                exit 3
fi

# get file status
NUMFILE=$(($(ls -la $DIRPATH | grep -v '^d'| wc -l)-1))
if [ $NUMFILE -gt $CRITVAL ] ; then

                echo "*** CRITICAL ***"
                echo "there is $NUMFILE files at $DIRPATH on `hostname`"
                exit 2

                else
                echo "** OK ** $NUMFILE file at $DIRPATH on `hostname`"
                exit 0
fi

check file time stamp inside a folder, nagios

2011-10-18T02:19:00.000-07:00

Bagaimana bila kita ingin memeriksa seluruh file dalam sebuah folder, lalu bila kita menemukan file yang time stamp nya lebih dari 30 menit/ dari waktu yang kita tentukan, nagios mengirimkan peringatan.


#!/bin/bash
# Standard Nagios return codes
#OK       = 0
#WARNING  = 1
#CRITICAL = 2
#UNKNOWN  = 3

usage()
{
        echo "usage: check_amq [-c critical_value (in minutes)] [-d amq_path]"
        echo
        echo "check_amq -c 30 -d /path/to/amq_journal"
        exit 3
}

while getopts c:d: OPTNAME; do
        case "$OPTNAME" in
        c)
                CRITVAL="$OPTARG"
                ;;
        d)
                DIRPATH="$OPTARG"
                ;;
        *)
                usage
                ;;
        esac
done


#check value
if [ "$CRITVAL" = "" ]; then
        echo "Error: critical_value must not empty"
        usage
        exit 3
fi

#check directory path
if [ "$DIRPATH" = "" ]; then
        echo "Error: directory path must not empty"
        usage
        exit 3
fi

#set status number to 0
stat=0

# check if file are exist on that directory
CHECKFILE=$(($(ls -la $DIRPATH | grep -v '^d'| wc -l)-1))


if [ $CHECKFILE -gt 0 ]; then

        for file in $(find $DIRPATH -type f -print)
        do
                CHECK=`stat -c %y $file | cut -f1 -d '.'`
                MINUTES_SINCE=$(((`date +%s` - `date -d "$CHECK" +%s`)/60))

                if [ $MINUTES_SINCE -gt $CRITVAL ] ; then
                        echo "$file are $MINUTES_SINCE minutes"
                        let stat+=1
                fi
        done

        if [ $stat -gt 0  ]; then
                echo "*** CRITICAL ***"
                echo "$stat files older than $CRITVAL minutes"
                exit 2;
        else
                echo "OK - all file age lower than $CRITVAL minutes"
                exit 0;
        fi
fi
echo "No file at $DIRPATH"

hasil nya:


[fazries@A1008 ~]$ ./check_amq.sh -c 100 -d /home/fazries/123
/home/fazries/123/1.txt are 103 minutes
*** CRITICAL ***
1 files older than 100 minutes
[fazries@A1008 ~]$ ./check_amq.sh -c 150 -d /home/fazries/123
OK - all file age lower than 150 minutes

check crond nagios plugin II

2011-10-18T02:13:00.000-07:00

Metode kedua dengan cara membaca status dari cron log, dengan cara ini lebih sederhana. kita dapat melihat service status dari log cron.lalu waktu dari log service tersebut di parsing menjadi detik dan dikurangi dengan waktu sekarang.


#!/bin/bash
# Standard Nagios return codes
#OK       = 0
#WARNING  = 1
#CRITICAL = 2
#UNKNOWN  = 3

LOG=/var/log/cron

usage()
{
        echo "usage: check_crond [-w warning_value (in minutes)] [-c critical_value (in minutes)] -s services"
        echo
        echo "check_crond -w 0 -c 5 -s /usr/bin/yum"
        echo "critical_value must be greater than warning_value"
        exit 3
}


while getopts w:c:s: OPTNAME; do
        case "$OPTNAME" in
        w)
                WARNVAL="$OPTARG"
                ;;
        c)
                CRITVAL="$OPTARG"
                ;;
        s)
                SERVICES="$OPTARG"
                ;;
        *)
                usage
                ;;
        esac
done


#check value
if [ "$WARNVAL" != "" -a "$CRITVAL" != "" ]; then
        if [ $CRITVAL -le $WARNVAL ] ; then
                echo "Error: critical_value must be greater than warning_value"
                echo        
                usage
                exit 3
        fi
fi

#check dir
if [ "$SERVICES" = "" ]; then
                echo "Error: services must exist do not empty"
                echo
                usage
                exit 3
fi

# Compare
LASTRUN=$(grep $SERVICES $LOG  | tail -n 1 | cut -f1 -d  '.' | sed -e 's/T/ /')
CHECK=$(((`date +%s` - `date -d "$LASTRUN" +%s`)/60))
HOURS=$(((`date +%s` - `date -d "$LASTRUN" +%s`)/3600))


if [ $CHECK != "" ] ; then

        if [ $WARNVAL -ge $CHECK ] ; then
                echo "** WARNING **"
                echo "last error at $CHECK minutes ago"
                exit 1;
        fi

        if [ $CHECK -gt $CRITVAL ] ; then
                echo "** CRITICAL **"
                echo "last error at $CHECK minutes ago,$HOURS hours"
                exit 2;
        fi
        else
                echo "** OK **";
                echo "crond run at $LASTRUN at `hostname`"
fi
exit 0

check crond nagios plugin

2011-10-12T21:12:00.000-07:00

kasus:
Dalam server produksi menjalankan service secara otomatis menggunakan crond, masalah muncul bila crond mati atau gagal menjalan kan service.
maka saya buat plugins untuk check crond service berdasarkan log file, mengikuti referensi
http://rubypond.com/blog/bash-script-to-check-timestamp-on-logfile
saya rubah sesuai kebutuhan.
di dalam crond file, buat agar service menghasilkan dua file, log file dan error log file

/path/to/myscript > /var/log/myscript 2>&1; echo $? > /var/log/myscript-error-code

#!/bin/bash
# Standard Nagios return codes
#OK       = 0
#WARNING  = 1
#CRITICAL = 2
#UNKNOWN  = 3

usage()
{
        echo "usage: check_crond [-w warning_value (in minutes)] [-c critical_value (in minutes)] [-d log_path] [ -l log_file] [-e error_log_file]"
        echo
        echo "check_crond -w 0 -c 5 -d /var/log -l my_log_file -e my_error_log_file"
        echo
        echo "warning value must less than critical value"
        exit 3
}

while getopts w:c:d:l:e: OPTNAME; do
        case "$OPTNAME" in
        w)
                WARNVAL="$OPTARG"
                ;;
        c)
                CRITVAL="$OPTARG"
                ;;
        d)
                LOGDIR="$OPTARG"
                ;;
        l)
                LOGFILE="$OPTARG"
                ;;
        e)
                LOGERROR="$OPTARG"
                ;;
        *)
                usage
                ;;
        esac
done

#check value
if [ "$WARNVAL" != "" -a "$CRITVAL" != "" ]; then
        if [ $CRITVAL -le $WARNVAL ] ; then
                echo "Error: critical_value must be greater than warning_value"
                exit 3
        fi
fi

# Compare
if [[ $(find $LOGDIR -name $LOGERROR) ]] ; then

        # Get last change time stamp from log and error file
        RUN=`stat -c %y $LOGDIR/$LOGFILE | cut -f1 -d '.'`
        ERROR=`stat -c %y $LOGDIR/$LOGERROR | cut -f1 -d '.'`

        # Convert date into second 
        MIN_RUN=`date -d "$RUN" +%s`
        MIN_ERROR=`date -d "$ERROR" +%s`

        if [ $MIN_ERROR -gt $MIN_RUN ] ; then
                MINUTES_SINCE=$(((`date +%s` - `date -d "$ERROR" +%s`)/60))

                if [ $MINUTES_SINCE -ge $WARNVAL ] ; then
                        echo "** WARNING **"
                        echo "last error at $MINUTES_SINCE minutes ago"
                        exit 1;
                fi

                if [ $MINUTES_SINCE -gt $CRITVAL ] ; then
                        echo "** CRITICAL **"
                        echo "last error at $MINUTES_SINCE minutes ago"
                        exit 2;
                fi
                else
                        echo "** OK **";
                        echo "crond run at $RUN at `hostname`"
        fi

        else
                echo "Error: file not found, please put the right path file"
                exit 3
fi
exit 0

Password Policy pada Redhat Directory Server

2011-09-22T20:42:00.000-07:00

Redhat Directory Server support password policy, pada kesempatan ini saya akan jelaskan bagaimana membuat password policy pada level subtree/ lokal.

Untuk subtree (contoh, ou=Accounts,dc=kuragurun,dc=com), masukan beberapa entri berikut:

Aktif kan nssldap-pwpolicy-local = on, agar server dapat mengenali password policy pada subtree / bukan password policy global.

dn: cn=config
changetype: modify
replace: nsslapd-pwpolicy-local: on
nsslapd-pwpolicy-local: off

Entri Container (nsPwPolicyContainer) pada level subtree untuk menyimpan macam-macam entri password-policy untuk subtree dan directory di bawah nya:

#nsPwPolicyContainer
dn: cn=nsPwPolicyContainer,ou=Accounts,dc=kuragurun,dc=com
objectClass: nsContainer
objectClass: top
cn: nsPwPolicyContainer

Password policy entri, fungsi entri ini untuk menyimpan berbagai attribute password policy yang akan digunakan oleh subtree dan directory di bawah nya,

berikut ini adalah contoh policy yang saya implementasikan di server kantor, anda bisa merujuk ke dokumentasi redhat untuk menambah policy dengan menggunakan attribut yang lain sesuai kebutuhan dan policy yang akan anda buat.

#nsPwPolicyEntry
dn:      cn="cn=nsPwPolicyEntry,ou=Accounts,dc=kuragurun,dc=com",cn=nsPwPolicyContainer,ou=Accounts,dc=kuragurun,dc=com
objectClass: extensibleObject
objectClass: ldapsubentry
objectClass: passwordpolicy
objectClass: top
cn: "cn=nsPwPolicyEntry,ou=Accounts,dc=kuragurun,dc=com"
passwordChange: on
passwordCheckSyntax: on
passwordExp: on
passwordGraceLimit: 0
passwordInHistory: 5
passwordLockout: on
passwordLockoutDuration: 1800
passwordMaxAge: 10368000
passwordMaxFailure: 3
passwordMinAge: 0
passwordMinDigits: 1
passwordMinLength: 8
passwordMinUppers: 1
passwordMinSpecials: 1
passwordMustChange: on
passwordResetFailureCount: 900
passwordStorageScheme: ssha
passwordUnlock: on
passwordWarning: 604800
passwordHistory:: b24=

Attribute	Keterangan
passwordChange	bila on;User di izinkan untuk bisa mengganti password nya
passwordCheckSyntax	bila on;Server DS akan men cek password syantax sebelum di simpan kedalam database
passwordExp	bila on;User password akan kadaluarsa setelah diberikan interval waktu oleh attribute passwordMaxAge
passwordGraceLimit	0 (int); User tidak di izin kan login ketika password nya telah kadaluarsa
passwordInHistory	5 (int); Server akan menyimpan password di dalam history sebanyak 5 kali, untuk mencegah user menggunakan password yang telah dipakai sebelum nya,lihat passwordMaxAge
passwordLockout	bila on; Bila user salah memasukkan password,Server dapat mengunci password/account, lihat passwordMaxFailure,passwordLockoutDuration
passwordLockoutDuration	1800 (dtk); Bila user gagal/salah memasukkan password makan account nya akan terkunci selama 30 menit berhubungan dengan passwordMaxFailure,passwordMaxFailure
passwordMaxAge	10368000 (dtk); Usia password aktif hingga 120 hari (3 Bulan), setelah 3 bulan password akan kadaluarsa
passwordMaxFailure	3 (int); Maksimal kesalahan yang di izinkan oleh Server, sebanyak 3 kali setelah itu user akan terkunci lihat passwordLockoutDuration.
passwordMinAge	0 (dtk); User bisa langsung mengganti password nya tanpa harus menunggu waktu yang telah ditentukan
passwordMinDigits	1 (int); Password syntax harus memiliki 1 angka (12345...dst )
passwordMinLength	8 (int); Minimal panjang password 8 karakter
passwordMinUppers	1 (int); Password syntax harus memiliki 1 huruf besar (ABCD... dst)
passwordMinSpecials	1 (int); Password syntax harus memiliki 1 spesial karakter (!@#$%^&*()
passwordMustChange	bila on; User harus mengganti password nya saat pertama kali login
passwordResetFailureCount	900 (dtk); Bila user salah meng entri password account nya akan terkunci selama 30 menit, lihat passwordMaxFailure,passwordLockout
passwordStorageScheme	ssha; Password menggunakan enkripsi ssha
passwordUnlock	bila on; Password user dapat di unlock bila user telah melanggar policy
passwordWarning	604800 (dtk); Server mengirimkan pemberitahuan kepada user apa bila password user akan kadaluarsa, 7 hari sebelum kadaluarsa
passwordHistory	:: b24=; binary (ok) untuk mengaktifkan password history,lihat passwordInHistory

Entri template CoS class of service (nsPwTemplateEntry) harus memiliki value pwdpolicysubentry yang diarahkan ke entri (nsPwPolicyEntry).


# nsPwTemplateEntry
     dn: cn="cn=nsPwTemplateEntry,ou=Accounts,dc=kuragurun,dc=com",cn=nsPwPolicyContainer,ou=Accounts,dc=kuragurun,dc=com
     objectClass: extensibleObject
     objectClass: costemplate
     objectClass: ldapsubentry
     objectClass: top
     cn: "cn=nsPwTemplateEntry,ou=Accounts,dc=kuragurun,dc=com"
     cosPriority: 1
     pwdpolicysubentry:      cn="cn=nsPwPolicyEntry,ou=Accounts,dc=kuragurun,dc=com",cn=nsPwPolicyContainer,ou=Accounts,dc=kuragurun,dc=com

Entri spesifikasi CoS (nsPwPolicy_CoS) pada level subentry.


# nsPwPolicy_CoS
     dn: cn=nsPwPolicy_CoS,ou=Accounts,dc=kuragurun,dc=com
     objectClass: ldapsubentry
     objectClass: cosSuperDefinition
     objectClass: cosPointerDefinition
     objectClass: top
     cosAttribute: pwdpolicysubentry default operational-default
     cn: nsPwPolicy_CoS
     costemplatedn:      cn="cn=nsPwTemplateEntry,ou=Accounts,dc=kuragurun,dc=com",cn=nsPwPolicyContainer,ou=Accounts,dc=kuragurun,dc=com

tips and trick part 5 (error after update chrome fedora)

2011-09-20T03:42:00.000-07:00

error after install update google chrome at fedora 14

/opt/google/chrome/chrome: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied

fix with :

[roots@A1012 fazries]# sudo chcon -t usr_t chrome-sandbox

or make selinux modules:first make .te file

[root@A1012 fazries]# vi chrome.te
#type this:
module chrome 1.0;

require {
        type user_t;
        type execmem_exec_t;
        type setroubleshootd_t;
        class file { read execmod };
}

#============= chrome_sandbox_t ==============
allow user_t execmem_exec_t:file execmod;

#============= setroubleshootd_t ==============
allow setroubleshootd_t execmem_exec_t:file read;

generate module .mod from .te file

[root@A1012 fazries]# checkmodule -M -m -o chrome.mod chrome.te 
checkmodule:  loading policy configuration from chrome.te
checkmodule:  policy configuration loaded
checkmodule:  writing binary representation (version 10) to chrome.mod

Create binary file .pp from module file

[root@A1012 fazries]# semodule_package -o chrome.pp -m chrome.mod

Install the binary using semodule

[root@A1012 fazries]# semodule -i chrome.pp

referece : http://code.google.com/p/chromium/issues/detail?id=87704

System Networking + System Administrator = System Engineer

2011-09-14T02:54:00.000-07:00

Instalation network cable via eternit

Nagios Escalations Notification

2011-09-13T21:12:00.000-07:00

analogi:

Suatu ketika ada sebuah Rumah Sakit dan memiliki 3 ( Hilal, Dzaki dan Gally) orang Dokter (IT Staff) dan 1 orang Kepala RS (si Bos),

Lalu di suatu malam yang indah dan bertaburan bintang salah satu pasien (service) tiba-tiba kejang-kejang (akibat sakit menahun), dan si perawat (nagios) yang selalu setia menmantau pasiennya akan mengirimkan sebuah pesan pemberitahuan klo ada pasien (service) yang kejang-kejang.

Karena tidak ada tingkatan / jenjang kepada siapa pemberitahuan tersebut dikirim pertama kali, maka semua orang yang bertanggung jawab akan dikirimi semua yaitu 3 orang dokter (IT Staff) dan ke Kepala RS,

Si Bos yang sedang tidur nyenyak sangat terganggu dengan kiriman pemberitahuan yang bertubi-tubi itu. Akhir nya untuk mengatasi masalah tersebut maka si Bos akan mengirim kan perintah kepada si perawat, bila nanti ada yang kejang-kejang lagi yang pertama harus dikirim pemberitahuan adalah Dokter Hilal, bila masih kejang-kejang juga kirim pemberitahuan ke Dokter Dzaki, klo ternyata masih juga kejang-kejang kirim pemberitahuan ke Dokter Gally, begitu seterus nya sampai si pasien berhenti kejang-kejang..

okeh lalu bagaimana cara membuat escalation notification di nagios?

1.) define contact group

definisikan semua kontak yang akan dikirimi pemberitahuan (ketiga Dokter itu)

/etc/nagios/objects/contacts.cfg

define contact {

contact_name Hilal

use generic-contact

alias dr.Hilal

email hilal@rs-sehat-selalu.com

}

define contact {

contact_name Dzaki

use generic-contact

alias dr.Dzaki

email dazki@rs-sehat-selalu.com

}

define contact {

contact_name Gally

use generic-contact

alias dr.Gally

email gally@rs-sehat-selalu.com

}

2.) define service

define service {

use hardware-service

host_name pasien_raid

service_description md-raid_status

check_command check_nrpe!check_mdraid

check_interval 15

max_check_attempts 4

notification_interval 30

notification_period 24x7

}

3.) define serviceescalation berdasarkan service yang ingin kita monitor

# Escalation 1

define serviceescalation

{

host_name pasien_raid

service_description md-raid_status

first_notification 4

last_notification 8

contacts Hilal

notification_interval 15

}

# Escalation 2

define serviceescalation

{

host_name pasien_raid

service_description md-raid_status

first_notification 8

last_notification 0

contacts Dzaki

notification_interval 120

}

# Escalation 3

define serviceescalation

{

...... untuk latihan ......rubah last_notification pada eskalasi 2, agar hasil nya bisa berjenjang... :)

}

Keterangan

contacts : daftar semua kontak yang terkait dengan pemberitahuan ini eskalasi

first_notification : nomor pemberitahuan yang menyebabkan eskalasi aktif

last_notification : nomor pemberitahuan yang menyebabkan eskalasi mati; men set ke 0 akan menyebabkan pemberitahuan secara terus-menerus

Eskalasi 1 akan aktif setelah di picu oleh pemberitahuan ke empat yang dikirim oleh nagios, dan akan berhenti mengirimkan pesan pemberitahuan setelah pesan ke delapan yang dikirim kan oleh nagios, interval dari pemberitahuan ini adalah 15 menit.

Eskalasi 2 akan aktif setelah dipicu oleh pemberitahuan ke delapan yang dikirim kan oleh nagios, dan tidak akan berhenti sampai service bisa teratasi karena last_notification di set ke 0. interval dari pemberitahuan ini adalah 2 jam.

sumber: Wojciech Kocjan (Learning Nagios 3.0)

Reseting pam_tally2 login failure

2011-08-23T21:36:00.000-07:00


[root@kurakura ~]# pam_tally2 -u fazries
Login           Failures Latest failure     From
fazries             8    08/24/11 11:32:40  /dev/pts/1
[root@kurakura ~]# pam_tally2 -u fazries -r
Login           Failures Latest failure     From
fazries             8    08/24/11 11:32:40  /dev/pts/1
[root@kurakura ~]# pam_tally2 -u fazries
Login           Failures Latest failure     From
fazries             0

Automake home dir for ldap user

2011-08-22T23:10:00.000-07:00

Automake home dir for ldap user, when first time login, add the bold line below at "/etc/pam.d/system-auth" :


#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

#Add this line
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0077
#

session     optional      pam_ldap.so

example:


[root@ketoprak ~]# ssh kura@localhost
kura@localhost's password: 
Creating directory '/home/kura'.
Creating directory '/home/kura/.mozilla'.
Creating directory '/home/kura/.mozilla/extensions'.
Creating directory '/home/kura/.mozilla/plugins'.
Last login: Mon Aug 22 10:23:56 2011 from ketoprak.asik.com

openvpn howto make OCSP server using OpenSSL [Part2]

2011-08-08T19:10:00.000-07:00

# At Server 192.168.5.1

create OCSP server using openssl ocsp at vpnserver


# cd /etc/openvpn/my_keys
# openssl ocsp -index keys/index.txt -port 4444 -CA keys/ca.crt -rsigner keys/ca.crt -rkey keys/ca.key -resp_text

download ocsp script at http://svn.openvpn.net/projects/openvpn/contrib/dazo/contrib/OCSP_check/OCSP_check.sh
save as /etc/openvpn/my_keys/ocsp.sh,
this script will be use by openvpn server for check sertificate validation.

edit the script


# vim ocsp.sh
ocsp_url="http://192.168.5.1:4444"
issuer="/etc/openvpn/my_keys/ca.crt"
verify="/etc/eopnvpn/my_keys/ca.crt"

at the end of the script add this echo command below "# check that it's good"
so become like this.


# check that it's good
  echo "OCSP status: $status"

make sure the scipt executable


# chmod 755 ocsp.sh

enable tls option,unmark ; at server.conf


script-security 2
tls-verify /etc/openvpn/my_keys/ocsp.sh
tls-auth   /etc/openvpn/my_keys/ta.key 0


# openvpn --config server.conf

<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

At Client 192.168.5.5

Server


# scp /etc/openvpn/my_keys/ta.key root@192.168.5.5:/etc/openvpn/my_keys/

Back to client

enable tls option, unmark ; at client.conf


ns-cert-type server
tls-auth /etc/openvpn/my_keys/ta.key 1


# openvpn --config client.conf

openpvn howto make CA,server,client sertificate on openvpn [Part1]

2011-08-07T23:32:00.000-07:00

On SERVER ip 192.168.5.1


# cd /etc/openvpn/
# mkdir my_keys/
# cd my_keys/

copied entire easy-rsa to my_keys


# cp /usr/share/openvpn/easy-rsa/2.0/* .

edit vars


# vim vars


	 export EASY_RSA="/etc/openvpn/my_keys"
	 export	OPENSSL="openssl"
	 export PKCS11TOOL="pkcs11-tool"
	 export GREP="grep"


	 export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
	 export KEY_DIR="$EASY_RSA/keys"
	 echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR


	 export PKCS11_MODULE_PATH="dummy"
	 export PKCS11_PIN="dummy"


	 export KEY_SIZE=2048
	 export CA_EXPIRE=3650
	 export KEY_EXPIRE=1000


	 export KEY_COUNTRY="ID"
	 export KEY_PROVINCE="BANTEN"
	 export KEY_CITY="TANGERANG"
	 export KEY_ORG="Fort-Funston"
	 export KEY_EMAIL="me@myhost.mydomain"

update vars


# . ./vars
# ./clean-all

build dh


# ./build-dh

build ca


# ./build-ca

build server sertificate


# ./build-key-server openvpnserver

build client sertificate


# ./build-key openvpnclient1

generate tls key


# openvpn --genkey --secret ta.key

copied ca.crt,dh2048.pem,server.crt,server.key


# cp keys/ca.crt /etc/openvpn/my_keys/ca.crt
# cp keys/dh2048.pem /etc/openvpn/my_keys/dh2048.pem
# cp keys/openvpnserver.crt /etc/openvpn/my_keys/server.crt
# cp keys/openvpnserver.key /etc/openvpn/my_keys/server.key

make server config file


# cp /usr/share/doc/openvpn-2.1.1/sample-config-files/server.conf /etc/openvpn/
# cd /etc/openvpn/
# vim /etc/openvpn/server.conf


	port 1194
	proto udp
	dev tun
	ca   my_keys/ca.crt
	cert my_keys/server.crt
	key  my_keys/server.key  
	dh   my_keys/dh2048.pem
	server 10.8.0.0 255.255.255.0
	ifconfig-pool-persist ipp.txt
	keepalive 10 120
	comp-lzo
	persist-key
	persist-tun
	;script-security 2
        ;tls-verify /etc/openvpn/my_keys/ocsp.sh
	;tls-auth   /etc/openvpn/my_keys/ta.key 0
	status openvpn-status.log
	verb 3

running openvpn


# openvpn --config server.conf
# ifconfig -a

<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
On Client ip 192.168.5.5


# cd /etc/openvpn
# mkdir /etc/openvpn/my_keys

on server copied openvpnclient1.crt,openvpnclient1.key and rename into client.crt,client.key
client certificate


# scp /etc/openvpn/my_keys/keys/openvpnclient1.crt  root@192.168.5.5:/etc/openvpn/my_keys/client.crt

client certificate key


# scp /etc/openvpn/my_keys/keys/openvpnclient1.key  root@192.168.5.5:/etc/openvpn/my_keys/client.key

ta key


# scp /etc/openvpn/my_keys/ta.key  root@192.168.5.5:/etc/openvpn/my_keys/ta.key

back to client, make client config file


# cp /usr/share/doc/openvpn-2.1.1/sample-config-files/client.conf /etc/openvpn/
# cd /etc/openvpn/
# vim client.conf

	client
	dev tun
	proto udp
	remote 192.168.5.1 1194
	resolv-retry infinite
	nobind
	persist-key
	persist-tun
	ca    /etc/openvpn/my_keys/ca.crt
	cert  /etc/openvpn/my_keys/client.crt
	key   /etc/openvpn/my_keys/client.key
	;ns-cert-type server
	;tls-auth /etc/openvpn/my_keys/ta.key 1	
	comp-lzo
	verb 3

running openvpn client


# openvpn --config client.conf
# ifconfig -a

tip n trik linux part 4

2011-07-19T02:49:00.000-07:00

Biar enggak lupa, :-)

menghapus chace memory pada linux

# sync; echo 3 > /proc/sys/vm/drop_caches

mengganti vbox hd-uuid

# VBoxManage internalcommands sethduuid hardisk.vdi

Set bash time out

# vim /etc/profile.d/tmout.sh
TMOUT=900 
readonly TMOUT
export TMOUT

extract zip file

$ unzip file.zip

dump partition tables

# sfdisk -d /dev/sda > sda_dump.out

import partition tables ke disk lain

# sfdisk /dev/sda < sda_dump.out

membuat module SELinux

# audit2allow -M namamodule < /var/log/audit/audit.log

atau

 
# less /var/log/audit/audit.log | grep nagios > audit2allow -M namamodule

Replace 2nd bay hard drive on DLINK 323 NAS

2011-07-10T21:33:00.000-07:00

Two days ago my boss send me an email he ask me to repair office NAS because one of the hard drive fail.My office have 2x2 TB Hard drive on DLINK-323 in the office, He just give me the ip address and admin password for nas storage.
Then I decide access it via ssh first, although the DNS-323 have web interfaces.
next check raid status.

root@xxxx:~# cat /proc/mdstat

Personalities : [linear] [multipath] [raid0] [raid1]
md0 : active raid1 sda1[0] sdb1[2](F)
      24418688 blocks [2/1] [U_]

then I see [U_] that mean I have degraded RAID1 Array.
next I'm using dmesg.

root@xxxx:~# dmesg
#######################################
#              HD1 awake now ! #
#######################################

SCSI error : <1 0 0 0> return code = 0x8000002
sdb: Current: sense key=0x3
    ASC=0x0 ASCQ=0x0
Info fld=0xa707ec94
end_request: I/O error, dev sdb, sector 2802314386
raid1: Disk failure on sdb2, disabling device.
    Operation continuing on 1 devices
raid1: sdb2: rescheduling sector 2800225936
RAID1 conf printout:
--- wd:1 rd:2
disk 0, wo:0, o:1, dev:sda2
disk 1, wo:1, o:0, dev:sdb2
RAID1 conf printout:
--- wd:1 rd:2
disk 0, wo:0, o:1, dev:sda2
raid1: sda2: redirecting sector 2800225936 to another mirror

Broken Hard drive on /dev/sdb,
okay after knowing the problem, then second step is read the manual, how to add/ replace hard drive on DNS-323.
you can read the manual from here
http://wiki.dns323.info/information:known_issues
after read carefully still in the same page i found this link on the section "Adding an extra disc can wipe data on existing drive!!"
http://forum.dsmg600.info/t885-OMFG,-Lost-data!-D-link-terrible!.html.
and
http://forum.dsmg600.info/t3113-Arghhh.-Drive-wiped.html.

Hmm.. I found DNS-323 web gui have a bug from that forum, web gui has wrong define hard drive between right bay (hd00) and left bay(hd01). I don't wanna take a risk using web gui. anyways my boss still in vacation in Holland. After lot of searching on google,
Alhamdulillah then I found this manual http://www.howtoforge.com/replacing_hard_disks_in_a_raid1_array.
using sfdisk commands http://linux.die.net/man/8/sfdisk.
but I cannot find sfdisk command on DNS-323. yup another problem has been found :-).

Hey I can put broken hard drive on a pc then read the partition tables using sfdisk,
then I follow the manual from "how to forge" link above, next I put broken disk on pc. dump the partition:
sfdisk -d /dev/sdb > sdb_partition_tables.out

# cat sdb_partition_tables.out
# partition table of /dev/sdb
unit: sectors

/dev/sdb1 : start= 63, size= 1060227, Id=82
/dev/sdb2 : start= 2088450, size=3902815035, Id=83
/dev/sdb3 : start= 0, size= 0, Id= 0
/dev/sdb4 : start= 1060290, size= 1028160, Id=83

then put new hard drive and import it:
sfdisk /dev/sdb < sdb_partition_tables.out

replace new hard drive, access it via ssh,check again using mdstat.

root@xxxx:~# cat /proc/mdstat
Personalities : [linear] [raid0] [raid1]
md0 : active raid1 sdb2[2](F) sda2[0]
1951407424 blocks [2/1] [U_]
[==========================================>] recovery =210.0% (4098891072/1951407424) finish=28.0min speed=1261990K/sec
unused devices: <none>

it will start recovery now.just wait....

dog tag (Error code: sec_error_reused_issuer_and_serial)

2011-07-10T21:24:00.000-07:00

After I remove dogtag instance and rebuild again, suddenly I cannot access web gui dog tag, in firefox it say the certificate number is same but cannot verify this certificate please ask new certivicate.

find certificate db at firefox


[root@ketoprak ~]# locate cert8.db
/etc/dirsrv/admin-serv/cert8.db
/etc/dirsrv/slapd-ketoprak/cert8.db
/etc/httpd/alias/cert8.db
/etc/pki/nssdb/cert8.db
/root/.dogtag-idm-console/cert8.db
/root/.mozilla/firefox/lirlvw2m.default/cert8.db
/var/lib/pki-ca/alias/cert8.db
/var/lib/pki-kra/alias/cert8.db
/var/lib/pki-ra/alias/cert8.db
/var/lib/pki-tps/alias/cert8.db

delete the certificate

[root@ketoprak ~]# rm -rf /root/.mozilla/firefox/lirlvw2m.default/cert8.db

restart firefox, and try to access dogtag web gui again.

reference:
http://saltwetbytes.wordpress.com/2009/09/14/firefox-issues-error-sec_error_reused_issuer_and_serial/

Put FireWall on dom0 XEN

2011-06-27T01:27:00.000-07:00

topology:

+------------------------+
.              | physical machine, dom0 |
.              |   +---------------+    |
-- Internet -------+ Firewall domU +--------- Intranet
.              |   +------+--------+    |
.              |          |             |
.              |          |   DMZ       |
.              |    +-----+-+-------+   |
.              |    |       |       |   |
.              | +--+--+ +--+--+ +--+--+|
.              | |domU1| |domU2| |domU3||
.              | +-----+ +-----+ +-----+|
.              +------------------------+

gateway     192.168.1.1

dom0 eth0   192.168.1.199

dom0 virbr0 192.168.122.1

on dom0 firewall.

REJECT all access to dom0, but accept only from local network.


# iptables -P INPUT ACCEPT
# iptables -P FORWARD ACCEPT
# iptables -P OUTOUT DROP
# iptables -A INPUT  -i eth0 -j ACCEPT    //accept all access from local network
# iptables -A INPUT -j REJECT               //reject all access where not come from local network

next SNAT package for domU subnet, snat tcp,udp protocol from domU subnet where destination not to domU subnet to eth0 192.168.1.199


# iptables -A POSTROUTING -p tcp -s 192.168.122.0/24 -d ! 192.168.122.0/24 -j SNAT --to 192.168.1.199 
# iptables -A POSTROUTING -p udp -s 192.168.122.0/24 -d ! 192.168.122.0/24 -j SNAT --to 192.168.1.199 
# iptables -A POSTROUTING -s 192.168.122.0/24 -d ! 192.168.122.0/24 -j SNAT --to 192.168.1.199

Howto Install OSSEC HIDS

2011-06-13T23:04:00.000-07:00

1 Prepare RPMs required by ossec:
2 Install the main ossec RPMs:
- 2.1 On the ossec server:
- 2.2 On the ossec agent:
3 Make symbolic link on ossec server and agent:
4 Edit ossec.conf, make sure fill this property base on your environment:
- 4.1 On the server:
- 4.2 On the agent:
5 Generate key for new agent:
- 5.1 Add agent on the ossec server
- 5.2 Extract key for an agent
- 5.3 On the ossec agent

Tribute to Heriyanto, for making this manual and ask me to put in my blog

Prepare RPMs required by ossec:

libprelude-0.9.24-3.el5.x86_64.rpm [1]
ossec-hids-2.5.1-2.x86_64.rpm
ossec-hids-server-2.5.1-2.x86_64.rpm
ossec-hids-client-2.5.1-2.x86_64.rpm

Install the main ossec RPMs:

On the ossec server:

yum localinstall libprelude-0.9.24-3.el5.x86_64.rpm hids-2.5.1-2.x86_64.rpm ossec-hids-server-2.5.1-2.x86_64.rpm

On the ossec agent:

yum localinstall libprelude-0.9.24-3.el5.x86_64.rpm hids-2.5.1-2.x86_64.rpm ssec-hids-client-2.5.1-2.x86_64.rpm

Make symbolic link on ossec server and agent:

ln -s /etc/init.d/ossec-hids /usr/bin/

Edit ossec.conf, make sure fill this property base on your environment:

On the server:

[root@ossec ~]#vi /var/ossec/etc/ossec.conf
 <global>
   <email_notification>yes</email_notification>
   <email_to>root@localhost</email_to>
   <smtp_server>127.0.0.1</smtp_server>
   <email_from>ossec@asoy.com</email_from>
 </global>

On the agent:

[root@client ~]#vi /var/ossec/etc/ossec.conf
<client>
   <server-ip>192.168.0.2</server-ip>  # make sure this your ossec server IP.
</client>

Generate key for new agent:

Add agent on the ossec server

The server-agent traffic is encrypted and validated using pre-shared keys. These keys must be generated on the server and then imported on the agent side. Create a key for each agent by adding the agent using the manage_agents utility. Run the utility and then choose Add an agent by entering A.

[root@ossec ~]# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.5.1 Agent manager.     *
* The following options are available: *
****************************************
  (A)dd an agent (A).
  (E)xtract key for an agent (E).
  (L)ist already added agents (L).
  (R)emove an agent (R).
  (Q)uit.
Choose your action: A,E,L,R or Q: A
- Adding a new agent (use '\q' to return to the main menu).
 Please provide the following:
  * A name for the new agent: client.ossec.net    
  * The IP Address of the new agent: 192.168.1.3 
  * An ID for the new agent[001]: 001
Agent information:
  ID:001
  Name:client.ossec.net
  IP Address:192.168.1.3
Confirm adding it?(y/n): y
Agent added.

Extract key for an agent

From the manage agents menu, enter E to extract a key. You are provided with a list of already configured agents. Choose your agent by entering the correct ID. The key is displayed so you can copy it to your clipboard.

[root@ossec ~]# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.5.1 Agent manager.     *
* The following options are available: *
****************************************
  (A)dd an agent (A).
  (E)xtract key for an agent (E).
  (L)ist already added agents (L).
  (R)emove an agent (R).
  (Q)uit.
Choose your action: A,E,L,R or Q: E
Available agents: 
  ID: 001, Name: client.ossec.net, IP: 192.168.1.3
Provide the ID of the agent to extract the key (or '\q' to quit): 001
Agent key information for '001' is: MDAxIGNsaWVudC5vc3NlYy5uZXQgMTkyLjE2OC4xLjMgZTIxN2E0MzU1Nzg2OWNmNTdhNTAxYzNlOGFjZTQ4ZTViMTU2MjhkY2ZjMjViYmYwYWMyMDI4OGViMGFhMDg3Nw==
** Press ENTER to return to the main menu.

press q button for quit from ossec Agent manager

On the ossec agent

To import the key, run the manage_agents utility on the agent host. The menu for agents is much simpler, because importing keys is the only option. Enter I to import and then paste the key value previously saved to your clipboard.

[root@client ~]# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.5.1 Agent manager.     *
* The following options are available: *
****************************************
  (I)mport key from the server (I).
  (Q)uit.
Choose your action: I or Q: I
* Provide the Key generated by the server.
* The best approach is to cut and paste it.
*** OBS: Do not include spaces or new lines.
Paste it here (or '\q' to quit):  MDAxIGNsaWVudC5vc3NlYy5uZXQgMTkyLjE2OC4xLjMgZTIxN2E0MzU1Nzg2OWNmNTdhNTAxYzNlOGFjZTQ4ZTViMTU2MjhkY2ZjMjViYmYwYWMyMDI4OGViMGFhMDg3Nw==
Agent information:
  ID:001
  Name:client.ossec.net
  IP Address:192.168.1.3
Confirm adding it?(y/n): y
Added.
** Press ENTER to return to the main menu.

press q button for quit from ossec Agent manager

note: Libprelude is the Prelude library. Prelude is a Universal "Security Information Management" (SIM) system. Prelude collects, normalizes, sorts, aggregates, correlates and reports all security-related events independently of the product brand or license giving rise to such events; Prelude is "agentless".

Howto setup Bacula

2011-06-13T22:58:00.000-07:00

1 Installation
- 1.1 Bacula
  - 1.1.1 Package
  - 1.1.2 Configuration
    - 1.1.2.1 Server
      - 1.1.2.1.1 bacula-dir
      - 1.1.2.1.2 bacula-sd
      - 1.1.2.1.3 bacula-fd
      - 1.1.2.1.4 bconsole.conf
      - 1.1.2.1.5 read-client.conf
    - 1.1.2.2 Client
      - 1.1.2.2.1 bacula-fd.conf
  - 1.1.3 Test Run
- 1.2 Webacula
2 Firewall

Installation

Bacula

Package

Download bacula package


bacula-bat-5.0.3-2.x86_64.rpm
bacula-client-5.0.3-1.x86_64.rpm
bacula-docs-5.0.3-1.noarch.rpm
bacula-libs-5.0.3-1.x86_64.rpm
bacula-mtx-5.0.3-1.x86_64.rpm
bacula-mysql-5.0.3-1.x86_64.rpm
bacula-updatedb-5.0.3-1.x86_64.rpm

Install all package using yum


yum localinstall --nogpgcheck bacula-*.rpm

Configuration

You should config Bacula at Server and Client

Server

At server side, we need configure several files, include one file we need to create,

bacula-dir

In bacula-dir we should define Director, Jobs, File Sets need to backup, client, storage and console.

Director


Director {                     # define myself
 Name = bacula.server-dir      # will be read at bconsole.conf ( Director ),bacula-fd.conf (Director) and bacula-sd.conf (Director)
 DIRport = 9101                # where we listen for UA connections
 QueryFile = "/usr/lib64/bacula/query.sql"
 WorkingDirectory = "/var/lib/bacula"
 PidDirectory = "/var/run"
 Maximum Concurrent Jobs = 1
 Password = "director-pass"    # bconsole.conf will using this password
 Messages = Daemon
}

Jobs Definition and Job


JobDefs {
 Name = "DefaultJob"
 Type = Backup
 Level = Incremental
 Client = package.asik.com-fd
 FileSet = "Full Set"
 Schedule = "WeeklyCycle"
 Storage = package-storage
 Messages = Standard
 Pool = Default
 Priority = 10
}
#
# Define the main nightly save backup job
#   By default, this job will back up to disk in /tmp
Job {
 Name = "BackupClient1"
 JobDefs = "DefaultJob"
 Write Bootstrap = "/var/lib/bacula/Client1.bsr"
}

Another Job Backup example


# Backup the catalog database (after the nightly save)
Job {
 Name = "BackupCatalog"
 JobDefs = "DefaultJob"
 Level = Full
 FileSet="Catalog"
 Schedule = "WeeklyCycleAfterBackup"
 # This creates an ASCII copy of the catalog
 # WARNING!!! Passing the password via the command line is insecure.
 # see comments in make_catalog_backup for details.
 # Arguments to make_catalog_backup are:
 #  make_catalog_backup <database-name> <user-name> <password> <host>
 RunBeforeJob = "/usr/lib64/bacula/make_catalog_backup bacula bacula"
 # This deletes the copy of the catalog
 RunAfterJob  = "/usr/lib64/bacula/delete_catalog_backup"
 Write Bootstrap = "/var/lib/bacula/BackupCatalog.bsr"
 Priority = 11                   # run after main backup
}
#
# Standard Restore template, to be changed by Console program
#  Only one such job is needed for all Jobs/Clients/Storage ...
#
Job {
 Name = "RestoreFiles"
 Type = Restore
 Client=package.asik.com-fd
 FileSet="Full Set"
 Storage = package-storage
 Pool = Default
 Messages = Standard
 Where = /tmp/bacula-restores
}

File Set, you can define which file need to be backup


# List of files to be backed up
FileSet {
 Name = "Full Set"
 Include {
   Options {
     signature = MD5
   }
#    
#  Put your list of files here, preceded by 'File =', one per line
#    or include an external list with:
#
#    File = <file-name
#
#  Note: / backs up everything on the root partition.
#    if you have other partitions such as /usr or /home
#    you will probably want to add them too.
#
#  By default this is defined to point to the Bacula binary
#    directory to give a reasonable FileSet to backup to
#    disk storage during initial testing.
#
   File = /usr/sbin
 }
#
# If you backup the root directory, the following two excluded
#   files can be useful
#
 Exclude {
   File = /var/lib/bacula
   File = /tmp
   File = /proc
   File = /tmp
   File = /.journal
   File = /.fsck
 }
}

Client


# Client (File Services) to backup
Client {
 Name = package.asik.com-fd
 Address = localhost
 FDPort = 9102
 Catalog = MyCatalog
 Password = "package-pass"           # password for FileDaemon
 File Retention = 30 days            # 30 days
 Job Retention = 6 months            # six months
 AutoPrune = yes                     # Prune expired Jobs/Files
}

Storage


# Definition of file storage device
Storage {
 Name = package-storage
# Do not use "localhost" here    
 Address = localhost                 # N.B. Use a fully qualified name here
 SDPort = 9103
 Password = "storage-pass" # Will be used at bacula-sd.conf as (Director) password
 Device = FileStorage                #will be read at bacula-sd.conf
 Media Type = File                   #will be read at bacula-sd.conf
}

Catalog


# Generic catalog service
Catalog {
 Name = MyCatalog
# Uncomment the following line if you want the dbi driver
# dbdriver = "dbi:mysql"; dbaddress = 127.0.0.1; dbport =  
 dbname = "bacula"; dbuser = "bacula"; dbpassword = "baculapass"
}

Message


# Reasonable message delivery -- send most everything to email address
#  and to the console
Messages {
 Name = Standard
#
# NOTE! If you send to two email or more email addresses, you will need
#  to replace the %r in the from field (-f part) with a single valid
#  email address in both the mailcommand and the operatorcommand.
#  What this does is, it sets the email address that emails would display
#  in the FROM field, which is by default the same email as they're being
#  sent to.  However, if you send email to more than one address, then
#  you'll have to set the FROM address manually, to a single address. 
#  for example, a 'no-reply@mydomain.com', is better since that tends to
#  tell (most) people that its coming from an automated source.
#
 mailcommand = "/usr/sbin/bsmtp -h localhost -f \"\(Bacula\) \<%r\>\" -s \"Bacula: %t %e of %c %l\" %r"
 operatorcommand = "/usr/sbin/bsmtp -h localhost -f \"\(Bacula\) \<%r\>\" -s \"Bacula: Intervention needed for %j\" %r"
 mail = root@localhost = all, !skipped
 operator = root@localhost = mount
 console = all, !skipped, !saved
#
# WARNING! the following will create a file that you must cycle from
#          time to time as it will grow indefinitely. However, it will
#          also keep all your messages if they scroll off the console.
#
 append = "/var/lib/bacula/log" = all, !skipped
 catalog = all , !skipped, !saved
}
# Message delivery for daemon messages (no job).
Messages {
 Name = Daemon
 mailcommand = "/usr/sbin/bsmtp -h localhost -f \"\(Bacula\) \<%r\>\" -s \"Bacula daemon message\" %r"
 mail = root@localhost = all, !skipped
 console = all, !skipped, !saved
 append = "/var/lib/bacula/log" = all, !skipped
}

Pool


# Default pool definition
Pool {
 Name = Default
 Pool Type = Backup
 Recycle = yes                       # Bacula can automatically recycle Volumes
 AutoPrune = yes                     # Prune expired volumes
 Volume Retention = 365 days         # one year
}
# Scratch pool definition
Pool {
 Name = Scratch
 Pool Type = Backup
}

Console, bacula can access via bconsole


#
# Restricted console used by tray-monitor to get the status of the director
#
Console {
 Name = package.asik.com-mon
 Password = "fazrie"
 CommandACL = status, .status
}

Add this line at the end of config file, this command will tell bacula server to read all client config at file read-client.conf

@/etc/bacula/read-client.conf

bacula-sd

Define the storage

Storage {                             # definition of myself
 Name = package.asik.com-sd
 SDPort = 9103                        # Director's port      
 WorkingDirectory = "/var/lib/bacula"
 Pid Directory = "/var/run"
 Maximum Concurrent Jobs = 20
}

Define the director to be used based on Director at bacula-dir.conf


#
# List Directors who are permitted to contact Storage daemon
#
Director {
 Name = bacula.server-dir
 Password = "storage-pass"
}


#
# Restricted Director, used by tray-monitor to get the
#   status of the storage daemon
#
Director {
 Name = package.asik.com-mon
 Password = "director-pass"
 Monitor = yes
}


Define Device should be used, based on Device config at bacula-dir.conf
#
# Devices supported by this Storage daemon
# To connect, the Director's bacula-dir.conf must have the
#  same Name and MediaType. 
#
Device {
 Name = FileStorage    # read from bacula-dir.conf at Storage section  
 Media Type = File     # read from bacula-dir.conf at Storage section
 Archive Device = /home/bacula
 LabelMedia = yes;                   # lets Bacula label unlabeled media
 Random Access = Yes;
 AutomaticMount = yes;               # when device opened, read it
 RemovableMedia = no;
 AlwaysOpen = no;
}

Message


Messages {
 Name = Standard
 director = package.asik.com-dir = all
}

bacula-fd


#
# List Directors who are permitted to contact this File daemon
#
Director {
 Name = bacula.server-dir
 Password = "package-pass"
}
#
# Restricted Director, used by tray-monitor to get the
#   status of the file daemon
#
Director {
 Name = package.asik.com-mon
 Password = "fazrie"
 Monitor = yes
}
#
# "Global" File daemon configuration specifications
#
FileDaemon {                          # this is me
 Name = package.asik.com-fd
 FDport = 9102                  # where we listen for the director
 WorkingDirectory = /var/lib/bacula
 Pid Directory = /var/run
 Maximum Concurrent Jobs = 20
}
# Send all messages except skipped files back to Director
Messages {
 Name = Standard
 director = package.asik.com-dir = all, !skipped, !restored
}

bconsole.conf


#
# Bacula User Agent (or Console) Configuration File
#
Director {
 Name = bacula.server-dir   # director name at bacula-dir.conf
 DIRport = 9101             # director port
 address = localhost        # director address
 Password = "director-pass" # director password
}

read-client.conf

Make a Client Directory at /etc/bacula/, we will put all client configuration at that directory, so the read-client.conf will read all config file.


mkdir -p /etc/bacula/client


#
# Include subfiles associated with configuration of clients.
# They define the bulk of the Clients, Jobs, and FileSets.
# Remember to "reload" the Director after adding a client file.
#
@|"sh -c 'for f in /etc/bacula/client/*.conf ; do echo @${f} ; done'"

Client

Edit bacula config file at /etc/bacula/bacula-fd.conf

bacula-fd.conf

Password should be macth with the server


Director {
       Name            = bacula.server-dir
       Password        = Agw6a4ckidwQ493JwAVl9oTPu3R8PaJGtv3PptWb9Yh2HyryaO1kOm9KiCVLOmaB51FIk8ReEapvrg9reON7k7nDutbadcj4wA5L5ajyuyusVSwovt5Gy4EBZMFd9BxPDYm3W23LK6mtiaJiCZUufiwEq8C9lDDmE4wt3w66tP8EK7ACaFmiMsv9aOjTeSETep7NeaOrPQqhfeR8TDkqO4eBADWYTPjwE1QugpHgWNsta3i91UvVkAOJjztzBKSn
}
FileDaemon {
       Name    = messaging
       FDport  = 9102
       WorkingDirectory = /var/bacula
       Pid Directory    = /var/run
       Maximum Concurrent Jobs = 20
}
Messages {
       Name = Standard
       director = bacula.server-dir = all, !skipped, !restored
}

At the server make a client config file at /etc/bacula/client/me_the_client.conf and put this line


#/etc/bacula/cilentdef/<hostname>.conf
Client {
       Name            = messaging # client name
       Address         = messaging.asik.com # fqdn address
       FDPort          = 9102
       Catalog         = MyCatalog #DefaultCatalog <= ASYX server using this
       Password        = Agw6a4ckidwQ493JwAVl9oTPu3R8PaJGtv3PptWb9Yh2HyryaO1kOm9KiCVLOmaB51FIk8ReEapvrg9reON7k7nDutbadcj4wA5L5ajyuyusVSwovt5Gy4EBZMFd9BxPDYm3W23LK6mtiaJiCZUufiwEq8C9lDDmE4wt3w66tP8EK7ACaFmiMsv9aOjTeSETep7NeaOrPQqhfeR8TDkqO4eBADWYTPjwE1QugpHgWNsta3i91UvVkAOJjztzBKSn # director password
       File Retention  = 30 days
       Job Retention   = 6 months
       AutoPrune       = yes
}

Test Run

Start the bacula server daemon


# service bacula-dir start
# service bacula-sd start

open bacula manager using bconsole,just type bconsole on the terminal


# bconsole

Webacula

To use Webcaula we need the latest PHP , ZendFramework and MySQL, download this packages


webacula-5.0.3-1.el5.noarch.rpm


json-c-0.9-1.el5.x86_64.rpm
libedit-20090923-3.0_1.el5.rf.x86_64.rpm
php-5.3.5-1.el5.remi.1.x86_64.rpm
php-cli-5.3.5-1.el5.remi.1.x86_64.rpm
php-common-5.3.5-1.el5.remi.1.x86_64.rpm
php-devel-5.3.5-1.el5.remi.1.x86_64.rpm
php-gd-5.3.5-1.el5.remi.1.x86_64.rpm
php-pdo-5.3.5-1.el5.remi.1.x86_64.rpm
php-pear-1.9.1-6.el5.remi.noarch.rpm
php-process-5.3.5-1.el5.remi.x86_64.rpm
php-xml-5.3.5-1.el5.remi.1.x86_64.rpm
php-ZendFramework-1.11.0-1.el5.remi.noarch.rpm
t1lib-5.1.2-1.el5.rf.x86_64.rpm
ZendFramework-1.11.3-minimal.tar.gz

Install all using yum


yum localinstall --nogpgcheck *.rpm

Firewall

Bacula need several port to be open


daemon       |    port
bacula-dir        9101
bacula-fd         9102
bacula-sd         9103

in iptables

# iptables -I INPUT -p tcp -m multiport --dport 9101,9102,9103 -j ACCEPT

Configuring SNORT in SPLUNK

2011-06-13T22:48:00.000-07:00

1. Download snort plugins for splunk, choose manager, the data inputs

2. Make new data files, ponting data path to your barnyard2/alert file.

3. edit the host field value based on your snort host name and source type value into snor_alert_full

4. view the result

Howto Install SNORT IDS

2011-06-13T22:15:00.001-07:00

Spec files

I rebuild my snort package, you can search or downloaded the snort rpm package snort-2.9.0.5.src.rpm.

i make little bit changes in my spec file,

extract src.rpm package using rpm2cpio snort-2.9.0.5.src.rpm | cpio -idv

edit the spec.file and change this line into

SNORT_BASE_CONFIG="--prefix=%{_prefix} \

--bindir=%{_sbindir} \

--sysconfdir=%{_sysconfdir}/snort \

--with-libpcap-includes=%{_includedir} \

--enable-decoder-preprocessor-rules --enable-targetbased \

--enable-dynamicplugin --enable-zlib --enable-ipv6 --enable-normalizer

and start to rebuild the package. read my manual how to build a package from source

http://kura2gurun.blogspot.com/2011/01/make-rpm-packages-from-source.html

Installation

yum localinstall libdnet-1.12-7.x86_64.rpm libdnet-progs-1.12-7.x86_64.rpm libdnet-devel-1.12-7.x86_64.rpm

yum localinstall libpcap1-devel-1.1.1-9.x86_64.rpm libpcap1-1.1.1-9.x86_64.rpm

yum localinstall daq-0.5-1.x86_64.rpm

yum localinstall snort-2.9.0.5-1.x86_64.rpm

yum localinstall barnyard2-1.9-1.x86_64.rpm

Download snort rules from official website snortrules-snapshot-2904.tar.gz

you can also install snort and barnyard using source package and configure the snort installation with

--enable-dynamicplugin --enable-zlib --enable-ipv6 --enable-normalizer

And follow this configurations

Configuration

snort

make snort log file directory

mkdir /var/log/snort/
chown snort:snort /var/log/snort/

edit snort config file at /etc/snort/snort.conf

change ipvar into var

set HOME_NET to your ip subnet

var HOME_NET 192.168.1.0/24

setup path to your rule path

var RULE_PATH rules
var SO_RULE_PATH so_rules
var PREPROC_RULE_PATH preproc_rules

remark dynamic rules and preprocessors because we dont need it

# path to dynamic rules libraries
### dynamicdetection directory /usr/local/lib/snort_dynamicrules

# Inline packet normalization. For more information, see README.normalize
# Does nothing in IDS mode
### preprocessor normalize_ip4
### preprocessor normalize_tcp: ips ecn stream
### preprocessor normalize_icmp4
### preprocessor normalize_ip6
### preprocessor normalize_icmp6

set the output to

output unified2: filename snort.log, limit 128

extract snortrules-snapshot-2904.tar.gz and put these folder into /etc/snort

rules
so_rules
preproc_rules

barnyard2

make directory for barnyard2 log

mkdir -p /var/log/barnyard2/

make waldo file for barnyard2

touch /var/log/snort/barnyard2.waldo

edit baryard2 config at /etc/snort/barnyard2.conf

setup path for barnyard2 where the snort config files use

# set the appropriate paths to the file(s) your Snort process is using.
#
config reference_file:      /etc/snort/reference.config
config classification_file: /etc/snort/classification.config
config gen_file:            /etc/snort/gen-msg.map
config sid_file:            /etc/snort/sid-msg.map

# set the directory for any output logging
#
config logdir: /var/log/barnyard2

# set the hostname and interface
config hostname:        ketoprak.humor.com
config interface:       eth0

# enable the year being shown in timestamps
#
config show_year

# define the full waldo filepath.
#
config waldo_file: /var/log/snort/barnyard2.waldo

# Step 2: setup the input plugins
#
# this is not hard, only unified2 is supported ;)
input unified2

# set output alert mode
output alert_full

oinkmaster

Download oink master from here

http://pkgs.org/download/centos-5-rhel-5/atomic-i386/oinkmaster-2.0-0.el5.art.noarch.rpm.html

Install the package

[root@ketoprak tmp]# yum localinstall oinkmaster-2.0-0.el5.art.noarch.rpm -y --nogpgcheck

locate the file to make sure the files was install correctly, and oinkmaster.pl has been send to /usr/bin/

[root@ketoprak tmp]# locate oink
/etc/oinkmaster.conf
/usr/bin/oinkmaster.pl
/usr/share/doc/oinkmaster-2.0
/usr/share/doc/oinkmaster-2.0/ChangeLog
/usr/share/doc/oinkmaster-2.0/LICENSE
/usr/share/doc/oinkmaster-2.0/README
/usr/share/doc/oinkmaster-2.0/README.gui
/usr/share/doc/oinkmaster-2.0/README.templates
/usr/share/doc/oinkmaster-2.0/README.win32
/usr/share/doc/oinkmaster-2.0/UPGRADING
/usr/share/doc/oinkmaster-2.0/template-examples.conf
/usr/share/man/man1/oinkmaster.1.gz

Check the snort version using

snort -v

and the result is

[root@ketoprak ~]# snort -v
Running in packet dump mode
       --== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth1".
Decoding Ethernet
       --== Initialization Complete ==--

,,_     -*> Snort! <*-
 o"  )~   Version 2.9.0.5 (Build 135) 
  '    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
          Copyright (C) 1998-2011 Sourcefire, Inc., et al.
          Using libpcap version 1.1.1
          Using PCRE version: 6.6 06-Feb-2006
          Using ZLIB version: 1.2.3

Edit the oinkmaster.conf locate at /etc/oinkmaster.conf

url = http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode here>/<filename> 
edit like this
url = http://www.snort.org/pub-bin/oinkmaster.cgi/ee4075a398290459/snortrules-snapshot-2861.tar.gz

note:

you will get the oinkcode from snort official website after you register,

Run Snort and Barnyard and Oinkmaster

First run snort service

snort -c /etc/snort/snort.conf -i eth0

then run the Barnyard2

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log

then run the Oinkmaster

oinkmaster.pl -o <snort rules located>
oinkmaster.pl -o /etc/snort/rules

make the crontab schedule

# crontab -e 
 0 3 * * * /usr/local/bin/oinkmaster.pl -C /etc/oinkmaster.conf -o /etc/snort/rules 2>&1

Howto Copy Log Files using rsync

2011-06-13T22:12:00.000-07:00

Configure rsync daemon( at rsyslog server )

rsyncd.conf

create file rsyncd.conf at /etc/ with this content

max connections = 2
log file = /var/log/rsync.log
timeout = 300

[rsyslog]
comment = Copy rsyslog Log file for splunk
path = /var/log/rsyslog
read only = yes
list = yes
uid = nobody
gid = nobody
# auth users = root
# secrets file = /etc/rsyncd.secrets
# host allow = 192.168.0.200

rsyncd.secret (optional)

just unmark the # at rsyncd.conf to activate the secret file

root:PLa1nr0otP4s$wOrd

run the rsync daemon

#rsync --daemon --config=/etc/rsyncd.conf

rsync client ( at splunk server )

run this command for copy the log file

#rsync -avuzP rsync://192.168.0.3/rsyslog /var/log/rsyslog

create schedules to run rsync using cron

PATH=/sbin:/bin:/usr/sbin:/usr/bin
5 * * * * /usr/bin/rsync -avuzP rsync://192.168.0.3/rsyslog /var/log/rsyslog

Firewall Issue

Daemon need to open port 873:

#iptables -I INPUT -p tcp --dport 873 -j ACCEPT

Samba PDC with Centos Directory Server backend

2011-06-01T03:06:00.000-07:00

hostname = ketoprak
domain = sidoel.com
ipaddres = 192.168.1.100

edit hosts
# vim /etc/hosts/

192.168.1.100 ketoprak.sidoel.com ketoprak

install directory server

# setup-ds-admin.pl

setup nss
edit ldap.conf

# vim /etc/ldap.conf

host 127.0.0.1

base dc=sidoel,dc=com
binddn uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot
bindpw admin
timelimit 120
bind_timelimit 120
idle_timelimit 3600
pam_lookup_policy yes
nss_base_passwd         ou=People,dc=sidoel,dc=com?one
nss_base_passwd         ou=Machines,dc=sidoel,dc=com?one
nss_base_group          ou=Groups,dc=sidoel,dc=com?one
nss_initgroups_ignoreusers  root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm

# vim /etc/nsswitch.conf

passwd:     files ldap
shadow:     files ldap
group:      files ldap

hosts:      files dns

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   files ldap

publickey:  nisplus

automount:  files ldap
aliases:    files nisplus

install samba

# yum install samba3x samba3x-client

libtalloc-2.0.1-11.el5.x86_64.rpm
libtdb-1.2.1-5.el5.x86_64.rpm
samba3x-winbind-3.5.4-0.70.el5_6.1.x86_64.rpm
samba3x-3.5.4-0.70.el5_6.1.x86_64.rpm
samba3x-common-3.5.4-0.70.el5_6.1.x86_64.rpm
samba3x-client

make directory server samba schema by converting samba schema

# cd /usr/share/doc/samba3x-3.5.4/LDAP/
# perl ol-schema-migrate.pl -b samba.schema > ~/61samba.ldif

copied to your slap-instance
# cp ~/61samba.ldif /etc/dirsrv/slapd-ketoprak/schema/

restart the service (your-instance)
# service dirsrv restart ketoprak

First get the Samba SID for your PDC : remember this SID

# net getlocalsid
SID for domain KETOPRAK is: S-1-5-21-3965608580-1676198639-4080886704

Edit samba configuration

# cp /etc/samba/smb.conf /etc/samba/smb.conf.orig
# echo "" > /etc/samba/smb.conf
# vi /etc/samba/smb.conf


[global]
workgroup = SIDOEL
netbios name = KETOPRAK 

log file = /var/log/samba/log.%m
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 

security = user
passdb backend = ldapsam:ldap://127.0.0.1
#ldap admin dn = cn=Directory Manager
ldap admin dn = uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot
ldap suffix = dc=sidoel,dc=com
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
#ldap ssl = start tls
ldap ssl = off 

domain master = yes
domain logons = yes
logon path = \\%L\profiles\%u
logon home = \\%L\%u\profiles
logon drive = H: 

local master = yes
os level = 65 
preferred master = yes 

wins support = yes 

template shell = /bin/false
winbind use default domain = no 

load printers = yes
printcap name = cups
printing = cups 

[homes]
comment = Home Directories
browseable = no
writable = yes
valid users = %S
create mask = 0775
directory mask = 0775 

[printers]
comment = All Printers
path = /var/spool/samba
browseable = yes
guest ok = no
writable = yes
printable = yes
create mask = 0700
public = yes
available = yes
print command = /usr/bin/lpr -P %p -r %s 

[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
guest ok = no
writable = no
share modes = no
browseable = no
admin users = Administrator
valid users = %U 

[profiles]
comment = Users profiles
path = /var/lib/samba/profiles
browseable = yes
guest ok = no
read only = no
create mask = 0700
directory mask = 0700
valid users = %U 

[public]
comment = Public Stuff
path = /home/samba
public = yes
writable = yes
printable = no
valid users = %U

make netlogon and profile directory

# mkdir -p /var/lib/samba
# mkdir /var/lib/samba/{netlogon,profiles}
# chown root:root -R /var/lib/samba
# chmod 0755 /var/lib/samba/netlogon
# chmod 1755 /var/lib/samba/profiles

Setup samba ldap administrator

# smbpasswd -w (ldap-admin-password)
Setting stored password for "uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" in secrets.tdb

Importing samba domain name and net group

make sambaDomain entries and save as sambaDomainName.ldif file.

dn: sambaDomainName=SIDOEL,dc=sidoel,dc=com
objectclass: sambaDomain
objectclass: sambaUnixIdPool
objectclass: top
sambaDomainName: SIDOEL
sambaSID: S-1-5-21-3965608580-1676198639-4080886704
uidNumber: 550
gidNumber: 550

import to database

# /usr/lib64/dirsrv/slapd-ketoprak/ldif2ldap "uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" admin sambaDomainName.ldif

Create Samba Domain Groups entries and save as sambaGroups.ldif file.

dn: cn=Domain Admins,ou=Groups,dc=sidoel,dc=com
objectClass: posixGroup
objectClass: top
cn: Domain Admins
userPassword: {crypt}x
gidNumber: 512

dn: cn=Domain Users,ou=Groups,dc=sidoel,dc=com
objectClass: posixGroup
objectClass: top
cn: Domain Users
userPassword: {crypt}x
gidNumber: 513

dn: cn=Domain Guests,ou=Groups,dc=sidoel,dc=com
objectClass: posixGroup
objectClass: top
cn: Domain Guests
userPassword: {crypt}x
gidNumber: 514

dn: cn=Domain Computers,ou=Groups,dc=sidoel,dc=com
objectClass: posixGroup
objectClass: top
cn: Domain Computers
userPassword: {crypt}x
gidNumber: 515

import to database

# /usr/lib64/dirsrv/slapd-ketoprak/ldif2ldap "uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" admin sambaGroups.ldif

Map samba groups to linux groups

# net groupmap add rid=512 ntgroup='Domain Admins'  unixgroup='Domain Admins'
# net groupmap add rid=513 ntgroup='Domain Users' unixgroup='Domain Users'
# net groupmap add rid=514 ntgroup='Domain Guests' unixgroup='Domain Guests'
# net groupmap add rid=515 ntgroup='Domain Computers' unixgroup='Domain Computers'

# net groupmap list
Domain Admins (S-1-5-21-3965608580-1676198639-4080886704-512) -> Domain Admins
Domain Users (S-1-5-21-3965608580-1676198639-4080886704-513) -> Domain Users
Domain Guests (S-1-5-21-3965608580-1676198639-4080886704-514) -> Domain Guests
Domain Computers (S-1-5-21-3965608580-1676198639-4080886704-515) -> Domain Computers

make ldap admin for samba and save as sambaAdmin.ldif file

dn: uid=Administrator,ou=People,dc=sidoel,dc=com
objectClass: top
objectClass: posixaccount
cn: Samba Admin
gidNumber: 0
homeDirectory: /root
uid: Administrator
uidNumber: 0
gecos: Samba Admin
loginShell: /bin/bash
userPassword: {crypt}x

import to ldap database

# /usr/lib64/dirsrv/slapd-ketoprak/ldif2ldap "uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" admin sambaAdmin.ldif

Create a Samba Administrator account, we already register samba admin to ldap, then setup the password, here my samba Administrator password similar like my ldap admin (uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot)the password is = admin

# smbpasswd -a Administrator
New SMB password: admin
Retype new SMB password: admin
Added user Administrator.

Show the Database Samba users

# pdbedit -L 
Administrator:0:Samba Admin

modify the account to use the correct Samba SID :
pdbedit -U your_machines_sid-500 -u Administrator

# pdbedit -U S-1-5-21-3965608580-1676198639-4080886704-500 -u Administrator

Start samba and testing samba

#/etc/init.d/smb start
#/etc/init.d/nmb start

you can use debug mode for nmbd
#/usr/sbin/nmbd -d 3 -i 

# smbclient -L localhost -U%
Domain=[SIDOEL] OS=[Unix] Server=[Samba 3.5.4-0.70.el5_6.1]

Sharename       Type      Comment
---------       ----      -------
profiles        Disk      Users profiles
public          Disk      Public Stuff
IPC$            IPC       IPC Service (Samba 3.5.4-0.70.el5_6.1)
Domain=[SIDOEL] OS=[Unix] Server=[Samba 3.5.4-0.70.el5_6.1]

Server               Comment
---------            -------
KETOPRAK             Samba 3.5.4-0.70.el5_6.1

Workgroup            Master
---------            -------
SIDOEL               KETOPRAK

see if your nss work, this should show the group list and user list based on ldap database

# getent passwd
# getent group

Join Domain with WinXP
1. Control Panel -> Network and Internet Connection -> Network Connection -> (right click) properties -> Internet protocol /TCP IP
setup to enable netbios over tcp ip,
2. fill the wins server to your samba/ldap ip 192.168.1.100 ,
3. change computer name with machine name then restart after that change domain name to your samba domain name

for win 7 you need to change registry setting,

Windows Registry Editor Version 5.00

; Win7_Samba3DomainMember
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters]
"DNSNameResolutionRequired"=dword:00000000
"DomainCompatibilityMode"=dword:00000001

; Speedup settings
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"SlowLinkDetectEnabled"=dword:00000000
"DeleteRoamingCache"=dword:00000001
"WaitForNetwork"=dword:00000000
"CompatibleRUPSecurity"=dword:00000001

; Can drive you nuts
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=dword:00000000

or you can download it at
https://bugzilla.samba.org/attachment.cgi?id=4988&action=view
http://wiki.samba.org/index.php/Windows7

continue with same step like windows XP

refrence:

http://directory.fedoraproject.org/wiki/Howto:Samba

Alhamdulillah....

tip n trik part 3 (Increase bash history storage)

2011-05-31T00:52:00.000-07:00

edit your home .bashrc,and add this line

export HISTSIZE=100000
 export HISTFILE=~/.bash_history

becoming like this


 # .bashrc
 # User specific aliases and functions
 
 alias rm='rm -i'
 alias cp='cp -i'
 alias mv='mv -i'

 export HISTSIZE=100000
 export HISTFILE=~/.bash_history

 # Source global definitions
 if [ -f /etc/bashrc ]; then
        . /etc/bashrc
 fi

reload the configuration

source ~/.bashrc

and your bash hisrtory will increasing,it can save 100000 command.you also can change the HISTFILE target.

Alhamdulillah.

The A Team

2011-05-25T20:38:00.000-07:00

ASYX Indonesia team while gathering on friday Mei 2011

Error Centos-Directory Server wont running

2011-05-10T20:46:00.000-07:00

Today i have a plan to resolve my sssd project, then this morning when i start my virtual machine for run centos-ds then i found an error like this,


[root@ketoprak dirsrv]# service dirsrv start
Starting dirsrv: 
ketoprak...Warning: Incorrect PIN may result in disabling the token
Enter PIN for Internal (Software) Token: 
[FAILED]
*** Warning: 1 instance(s) failed to start

woaa, yesterday my machine look fine?? then start googling to find an answer, i found this link
http://www.mail-archive.com/fedora-directory-users@redhat.com/msg09219.html
from this link i find how to run dirsrv-instance in debug mode,


/usr/lib64/dirsrv/slapd-myinstance/start-slapd -d 1

then i find another problem


[11/May/2011:10:28:10 +0700]Error - Problem accessing the lockfile /var/lock/dirsrv/slapd-myinstance/lock
[11/May/2011:10:28:10 +0700] - Shutting down due to possible conflicts with other slapd processes

getting deeper into rabbit hole,

ls /var/lock/dirsrv/

then i cannot find my instance folder for keep the lock files, then use the slackware way, if you dont have it then build it :)


# mkdir /var/lock/dirsrv/slapd-myinstance

try to run again, trial and error

# /usr/lib64/dirsrv/slapd-myinstance/start-slapd -d 1



now the error message has change.




[11/May/2011:10:31:19 +0700] - Warning - couldn't set the ownership for /var/lock/dirsrv/slapd-ketoprak
[11/May/2011:10:31:19 +0700] - Shutting down due to possible conflicts with other slapd processes


Ohh, the permission, then i try to run setup-ds.pl, at the middle of reinstallation the script ask for user and group with nobody as a default name, then i canceled the installation, and try to changes the ownership to nobody without reinstall.


chown nobody:nobody -vR /var/lock/dirsrv/slapd-myinstance


okay,then try again, trial and error


[root@ketoprak dirsrv]# service dirsrv start ketoprak
Starting dirsrv: 
ketoprak...Warning: Incorrect PIN may result in disabling the token
Enter PIN for Internal (Software) Token: 
[  OK  ]

Woalaa, then the problem solve.. thanks to Alloh Subhanahu wa ta'ala.

tip n trik part 2 (multiple grep)

2011-04-18T19:46:00.000-07:00

using grep to catch multiple string

example :

find more than one package list


rpm -qa | grep -i -e "ruby" -e "python"

or
find more than one string at file


egrep -i "str1|str2" /your/file

reference

Generate RedHat Directory Server SSL

2011-04-12T00:11:00.000-07:00

1. install the packages Centos-ds

2. run setup-ds-admin.pl
fill all the step, you can search on google...
bla bla bla, insert this, answer yes, bla bla..

3. create SSL certificate


# cd /etc/dirsrv/slapd-instance
# tar -cf * ~/db_backup.tar
# touch /tmp/pwdfile; echo "p4ssw0rd" > /tmp/pwdfile
# certutil -N -d . -f /tmp/pwdfile
# certutil -S -n "CA certificate" -s "cn=My Org CA cert,dc=combro,dc=com" -2 -x -t "CT,," -m 1000 -v 120 -d . -k rsa -f /tmp/pwdfile         
# certutil -S -n "Server-Cert" -s "cn=hostname.combro.com" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -k rsa -f /tmp/pwdfile
# certutil -d . -L -n "CA certificate" -a > cacert.asc
# pk12util -d . -o ldap1.p12 -n Server-Cert -w /tmp/pwdfile -k /tmp/pwdfile
# touch pin.txt; echo "Internal (Software) Token: p4ssw0rd" > pin.txt
# chmod 0400 pin.txt
# vim dse.ldif

edit cn=config


dn: cn=config
nsslapd-security: on
nsslapd-ssl-check-hostname: off

edit cn=encryption,cn=config


dn: cn=encryption,cn=config
nsSSL3: on
nsSSLClientAuth: allowed
nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
244  +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,
245  +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,
246  +tls_rsa_export1024_with_des_cbc_sha

add cn=RSA,cn=ecryption,cn=config:


dn: cn=RSA,cn=encryption,cn=config
objectClass: nsEncryptionModule
objectClass: top
nsSSLActivation: on
nsSSLToken: internal (software)
nsSSLPersonalitySSL: Server-Cert
cn: RSA

note: you can modify dse.ldif easier using ApacheDirectoryStudio
1. at Root DSE -> right click (go to DN..)
2. type cn=config
3. make new entry for cn=RSA,cn=encryption,cn=config
then put the attribute like above
4. then modify the cn=config and cn=encryption

# service dirsrv start
Starting dirsrv:
package...Warning: Incorrect PIN may result in disabling the token
Enter PIN for Internal (Software) Token: p4ssw0rd
[ OK ]

Usaha Gila Part 1 "JAMBAN PORTABLE"

2011-03-29T21:46:00.000-07:00

Berawal dari pembicaraan dengan heri mengenai usaha tiba-tiba terlintas dalam benak saya,
bila kita berpergian jauh terkadang kita sulit menemukan toilet, apa lagi kalau perjalanan nya menembus hutan atau melewati lautan bahkan untuk berhenti sebentar saja susah, kalau pun kendaraan bisa berhenti kita tetap saja sulit untuk buang air. entah karena tempat nya seram, atau posisi nya gak enak misal, banyak pohonan atau semak-semak. kan gak lucu kalau lagi pipis tiba-tiba di gigit ular?.

oleh karena persoalan diatas, saya memiliki ide original untuk membuat sebuah alat yang berfungsi sebagai toilet, dan saya menyebut nya sebagai "Jamban Portabel ver.1" (ini original made in indonesia makannya nama nya jamban).

baiklah akan saya lanjut kan, mengenai cetak biru produk ini.
jamban portable di buat seminimal mungkin sehingga bisa disimpan di mana pun, di dalam tas, di bagasi mobil, bahkan nanti sampai bisa di kantongin. bahkan produk ini bisa di buat sendiri (sekalian anda prakarya) dan alat-alat nya sangat mudah di temukan di sekitar kita :)
nah dengan baik hati saya akan terang kan bagaimana cara membuat nya, (sebelum saya produksi masal).

Alat-alat :
1. Cutter / pisau
2. Selotip
3. tali
4. Masker
5. Pengharum ruangan

Bahan :

1. Kardus yang tidak tepakai, di saran kan kardus bekas tv atau bekas kulkas lebih baik
2. Kangtong Plastik hitam ukuran sedang kalau tidak ada bisa menggunakan kantong kresek yang biasa di pakai ibu-ibu berbelanja.

Cara membuat nya:
1. Potong kardus secara vertikal dengan menggunakan cutter atau pisau pada bagian samping, ingat potong hanya bagian sisi saja seperti terlihat pada gambar:

2. Lubangi sisi kardus tadi seukuran dengan tali, lubangi pada dua sisi saja, seperti terlihat pada gambar:

3. Gunakan selotip untuk menahan tali agar sisi kardus tidak terbuka, seperti terlihat pada gambar:

4. Selalu siap kan kantong plastik ukuran sedang setiap kali ingin menggunakan jamban portable ini, dan letakkan tepat di tengah-tengah kardus. seperti terlihat pada gambar:

sampai disini jamban portable sudah dapat digunakan, selanjut nya adalah cara penggunaan nya yang benar,

5. Selalu gunakan masker sebelum masuk kedalam jamban portable,(ini bagian penting jangan sampai anda lupa)

6. Jongkok lah sesuai posisi plastik berada, dan anda bisa merubah posisi plastik sesuai keinginan anda.

7. Gunakan pengharum ruangan setelah anda selesai menuntaskan hajat anda,
8. Buang plastik hitam ketempat sampah yang telah disediakan.

Kelak saya akan memproduksi produk ini secara masal, anda bisa membeli nya atau membuat sendiri? semua kembali kepada anda?

Jamban Portable ini sangat berguna bila anda seorang traveller, atau seorang pebisnis yang terus mobile. bisa digunakan dimana saja, dan kapan saja.

JAMBAN PORTABLE, any where, any time, build, use, and go ....

tip n trik part 1 (Copy file with yes option)

2011-03-22T04:25:00.000-07:00

yes n | cp -R -h -i /dirone/* /dirtwo

reference :

New Island, New Adventure

2011-03-17T02:44:00.000-07:00

Genap empat bulan sudah mendarat disini setelah perjalan panjang dan melelahkan dari pulau sebelum nya akhir nya saya memutus kan untuk memulai perjalan kembali untuk berlayar, banyak ketemu hal-hal baru yang belum pernah dilihat bahkan dicoba di pulau ini, penduduk sedikit banget sampe bisa di hitung jari, hehehe....
Alhamdulillah saya di berikan banyak waktu untuk melakukan riset dan belajar hampir 8 jam penuh untuk riset sebuah pekerjaan,:P weks, puass banget deh..

dan kebebasan untuk beribadah yang paling penting, karena pulau ini deket dengan masjid jadi bisa tiap waktu sholat pergi kemasjid, tinggal naik sampan sebentar nyampe..

kepala suku di pulau ini baik, dan juga jago. banyak hal-hal kecil yang bisa dipelajari dari dia. seperti memperkuat keamanan kapal Linux saya. jadi lebih aware lagi deh masalah security Linux.

Semoga bisa bertahan lama di pulau ini.. atau saya akan berlayar lagi?hmmm.. banyak belahan lautan yang belum terjamah di luar sana, semoga bisa sampai menyebrang benua. doakan saja (amin).

Anyer Februari 2011

2011-03-16T20:16:00.000-07:00

Akhir Februari lalu diberikan kesempatan oleh alloh subhanawata'ala untuk berwisata ke Anyer, dalam rangka mengisi liburan Sinar Mulia Foto Copy ( punya bang ikrom ), sekalian ajah ikut. karena awal tahun baru kemarin tidak bisa ikut.

pemandangan sore hari di anyer

Sinar Mulia Foto Copy

bersama keluarga

detik-detik keberangkatan bermain banana "boat"

di kapal feri

semoga diberikan kesempatan lagi oleh alloh, untuk jalan-jalan lagi ketempat yang lebih jauh misal nya lombok atau pulau komodo <= huhu..hu...hu.. (obsesi terpendam) :)

Howto Copy Log Files using rsync

2011-03-16T03:29:00.000-07:00

1 Configure rsync daemon( at rsyslog server )
- 1.1 rsyncd.conf
- 1.2 rsyncd.secret (optional)
- 1.3 run the rsync daemon
2 rsync client ( at splunk server )
3 create schedules to run rsync using cron

Configure rsync daemon( at rsyslog server )

rsyncd.conf

create file rsyncd.conf at /etc/ with this content

max connections = 2
log file = /var/log/rsync.log
timeout = 300

[rsyslog]
comment = Copy rsyslog Log file for splunk
path = /var/log/rsyslog
read only = yes
list = yes
uid = nobody
gid = nobody
# auth users = root
# secrets file = /etc/rsyncd.secrets
# host allow = 192.168.0.200

rsyncd.secret (optional)

just unmark the # at rsyncd.conf to activate the secret file

root:PLa1nr0otP4s$wOrd

run the rsync daemon

#rsync --daemon --config=/etc/rsyncd.conf

rsync client ( at splunk server )

run this command for copy the log file

#rsync -avuzP rsync://192.168.0.3/rsyslog /var/log/rsyslog

create schedules to run rsync using cron

PATH=/sbin:/bin:/usr/sbin:/usr/bin
5 * * * * /usr/bin/rsync -avuzP rsync://192.168.0.3/rsyslog /var/log/rsyslog

Howto setup Centralize logs using rsyslog

2011-03-16T03:27:00.000-07:00

Hasil ngporek dikantor sama bung Heri ( new partner )....

[hide]

Install rsyslog

Download and install rsyslog package from

http://www.rsyslog.com

both for server and client

Enable rsyslog

By default most of Linux Distribution use syslog as their log maintenance, but we will replace the syslog and using rsyslog turn off syslog run level

chkconfig syslog off

shutting down syslog

service syslog stop

set run level for rsyslog

chkconfig --level 234 rsyslog on

check and see run level for rsyslog

chkconfig --list | grep rsyslog

Do this both at server and client or each time you install rsyslog. rsyslog will takeover syslog.

Configuration

Rsyslog Server

At server,

Make mkdir for rsyslog log file

#mkdir /var/log/rsyslog

edit rsyslog config file at

/etc/rsyslog.conf

add some modules and make a template for client log files

$template DailyPerHostLogs,"/var/log/rsyslog/%HOSTNAME%/%HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log"
$ModLoad imtcp
$InputTCPServerRun 514

run template

*.* -?DailyPerHostLogs;

so the configuration files will like this

Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template DailyPerHostLogs,"/var/log/rsyslog/%HOSTNAME%/%HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log"
$ModLoad imtcp
$InputTCPServerRun 514
# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                      /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none     /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                   /var/log/secure
# Log all the mail messages in one place.
mail.*                                      -/var/log/maillog
# Log cron stuff
cron.*                                       /var/log/cron
# Everybody gets emergency messages
*.emerg                                      *
# Save news errors of level crit and higher in a special file.
uucp,news.crit                              /var/log/spooler
# Save boot messages also to boot.log
local7.*                                    /var/log/boot.log
*.* -?DailyPerHostLogs;

Edit another rsyslog file at

/etc/sysconfig/rsyslog.conf

Replace

replace "-m 0" with "-c3"

Rsyslog Client

At client, edit rsyslog config file at

/etc/rsyslog.conf

add tcp module

$ModLoad imtcp

add log server ip and port,

*.* @@192.168.1.200:514

we can define the port,not only using 514, the @@ mark it means the rsyslog will using TCP connection.

so the configuration files will like this

# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock
$ModLoad imtcp
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                  /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.*                               /var/log/secure
# Log all the mail messages in one place.
mail.*                                  -/var/log/maillog
# Log cron stuff
cron.*                                   /var/log/cron
# Everybody gets emergency messages
*.emerg                                  *
# Save news errors of level crit and higher in a special file.
uucp,news.crit                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                /var/log/boot.log
#Add this line,for send log file to rsyslog server
 *.* @@192.168.1.200:514

Edit another rsyslog file at

/etc/sysconfig/rsyslog.conf

Replace

replace "-m 0" with "-c3"

Then restart rsyslog service

service rsyslog restart

Mod cluster on JBoss AS 5.x

2011-03-02T23:13:00.000-08:00

Download Files

Download all files, to build mod_cluster and mod_proxy_ajp

1.Download packages for Mod_cluster module version 1.1.1 :
  http://downloads.jboss.org/mod_cluster//1.1.1.Final/mod_cluster-1.1.1.Final-bin.tar.gz
2.Download library for Mod_cluster :
  http://downloads.jboss.org/mod_cluster//1.1.1.Final/mod_cluster-1.1.1.Final-linux2-x64-so.tar.gz
3.Reference Documentation for mod_cluster and how it works
  wget -c http://www.jugs.ch/html/events/slides/090313_BrianStansberry_mod-cluster-jug.pdf

http://community.jboss.org/thread/162859

Install

Install mod_cluster

extract file mod_cluster-1.1.1.Final-bin.tar.gz
copy folder mod_cluster.sar to JBoss AS/server/node01/deploy or where the server node stored

configure file mod_cluster-jboss-beans.xml at mod_cluster.sar/META-INF add this following lines :

<bean name="HAModClusterConfig" class="org.jboss.modcluster.config.ha.HAModClusterConfig" mode="On Demand">
<property name="proxyList">${jboss.modcluster.proxyList:localhost:80}</property>
<property name="domain">${jboss.Domain:DefaultDomain}</property>
<property name="stickySession">true</property>
       <property name="stickySessionForce">true</property>
           <property name="stickySessionRemove">false</property>
               <property name="maxAttempts">1</property>
                   <property name="workerTimeout">-1</property>
                       <property name="balancer">${jboss.modcluster.balancer}</property>
 </bean>

Web Server

Install the Web Server for this you can use the native jboss web server you can download it at

http://downloads.jboss.org/mod_cluster//1.1.1.Final/mod_cluster-1.1.1.Final-linux2-x64-ssl.tar.gz

extract and put it at /opt

Configure Web server Edit the http.conf and add the Virtual hosts for JBoss AS node if you want use a web server from download.jboss.org:

edit the configuration at /opt/jboss/httpd/httpd/conf

Unmark this line

# Virtual hosts
Include conf/extra/httpd-vhosts.conf

then leave this native configuration we only need to remark the Advertise module, so we still can access the mod_cluster-manager from localhost

# MOD_CLUSTER_ADDS
# Adjust to you hostname and subnet.
<IfModule manager_module>
  Listen 127.0.0.1:6666
  ManagerBalancerName mycluster
   <VirtualHost 127.0.0.1:6666>
      <Location />
       Order deny,allow
       Deny from all
       Allow from 127.0.0
      </Location>

KeepAliveTimeout 300
  MaxKeepAliveRequests 0
  #ServerAdvertise on http://@IP@:6666
  #AdvertiseFrequency 5 ==> remark this line, so the Advertise modules will not conflict with the virtual host 
  #AdvertiseSecurityKey secret
  #AdvertiseGroup @ADVIP@:23364
 
      <Location /mcm>
        SetHandler mod_cluster-manager
        Order deny,allow
        #Deny from all
        Allow from 127.0.0
      </Location>
  </VirtualHost>
</IfModule>

In this configuration modules is already loaded, and the *.so files is already at modules directory. next we need to configure the VirtualHost at

/opt/jboss/httpd/httpd/conf/extra/httpd-vhost.conf

add this line:

<VirtualHost node01.asik.local:80> # change the node
 <Directory />
    Order deny,allow
    Allow from all
 </Directory>
 <Location /mcm>
     SetHandler mod_cluster-manager
     Order deny,allow
     Allow from all
     Allow from 192.168
 </Location>
 KeepAliveTimeout 60
 MaxKeepAliveRequests 0
 ManagerBalancerName testcluster
 AdvertiseFrequency 5
</VirtualHost>
<VirtualHost *:80>
 ServerAdmin admin@asik.local
 DocumentRoot /opt/jboss/httpd/htdocs/htdocs/node01.asik.local/data
 ServerName node01.asik.local:80                                        # change the node
 ErrorLog logs/node01.asik.local-error_log                              # change the node
 CustomLog logs/node01.asik.local-access_log combined                   # change the node
 LogLevel debug
 ProxyPass / balancer://cluster1/application1 stickysession=JSESSIONID|jsessionid nofailover=On
 ProxyPassReverse / balancer://cluster1/application1 #the application1 is a test aplication for cluster we will use it
</VirtualHost>

Restart Web Server

Run the web server

#/opt/jboss/httpd/sbin/httpd -k start

#/opt/jboss/httpd/sbin/apachectl start

Build application tester

download the file at

http://community.jboss.org/servlet/JiveServlet/download/588259-27006/clusterjsp.war

extract and repack again with different name

jar xvf clusterjsp.war
jar cvf application1.war *

Put the application1.war at JBoss AS/server/deploy/ Run the JBoss AS

./bin/run.sh -c node01 -g cluster1 -Djboss.messaging.ServerPeerID=1 -Djboss.service.binding.set=ports-default 
-Djboss.jvmRoute="node01" -Djboss.Domain=domain1 -Djboss.mod_cluster.proxyList="192.168.1.176:80" 
-Djboss.modcluster.balancer="cluster1"  -Djboss.bind.address="0.0.0.0"

Run application tester

open the mod_cluster-manager

< JBoss server fqdn / ip address >/mcm

open application tester

< JBoss server fqdn / ip address >/application1

Tak terasa Waktu berlalu

2011-01-26T21:52:00.000-08:00

1/4 Abad sudah waktu berlalu tepat pada hari ini, tak terasa memang. seperti baru kemarin menapaki bukit ternyata perjalanan sudah sampai se per-empat nya.
tidak banyak yang telah dilakukan bila menengok kebelakang, seakan diri ini kecil sekali dan bukan apa-apa...
banyak hati yang tersakiti dan bahkan terluka oleh diri ini selama menapaki bukit kehidupan, baik yang terasa atau tidak.
belum banyak diri ini bermanfaat bagi orang lain, bagi keluarga, istri , dan teman.
kadang ketika merenung dalam proses panjang ini, seakan hati ini bersedih dan selalu bertanya;
apa yang aku cari? apa yang aku kejar? untuk apa aku disini?
cukup kah kebahagiaan hanya dengan uang?tidak. ternyata bukan itu...
iya 1/4 Abad bukan waktu yang sebentar, cukup sudah bermain-main nya, cukup sudah waktu untuk menjelajah, cukup sudah hidup dalam semu keinginan. karena 1/4 Abad yang akan datang belum tentu aku bisa menulis ini lagi... atau tidak akan sampai puncak perjalanan dengan segala target yang belum tercapai?
Ya Alloh swt engkau lah pemilik jagat raya ini, yang didalam nya terdapat mahkluk-mahkluk mu yang kecil dan hina, dengan kesombongan mereka yang sudah merasa lebih dari apapun. jadi kan lah aku hambamu yang bertakwa lindungi lah aku dari sifat sombong, dengan 1/4 Abad ini semoga aku bisa lebih dekat kepada-Mu mengejar ketertinggalan ku di masa lalu.

air mata ku berlinang pada hari ini takkala mendengar istri ku mengucapkan sebuah kalimat yang membuat ku terharu di sela-sela rasa khawtir kami, ketika ku buka handphone dan membaca pesan dari adik ku, ketika kudengar keponakan ku berteriak untuk ku.terimakasih semoga kita selalu dalam rahmat Alloh sesungguh nya Dia lah yang menyayangi kita lebih dari siapapun di dunia yang semu ini....

Enable remote CUPS web interface

2011-01-12T19:46:00.000-08:00

I have a problem with cups, one of my employee in the office cannot access the printer. and don't wanna fix it form his machine, so i think i will remote the cups from my linux box :)

lets start, open and edit the cups config file at

/etc/cups/cupsd.conf

edit this line

# Only listen for connections from the local machine.
Listen localhost:631
Listen /var/run/cups/cups.sock

into

# Only listen for connections from the local machine.
Port 631
Listen /var/run/cups/cups.sock

add the bold line into config file

# Restrict access to the server...
<Location />
  Order allow,deny
  

Allow From 192.168.1.176 or Allow all
</Location>
# Restrict access to the admin pages...
<Location /admin>
  Order allow,deny
  Allow @LOCAL
  
Allow From 192.168.1.176 or Allow all
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow @LOCAL
  Allow From 192.168.1.176 or Allow all
</Location>

restart the services

/etc/init.d/cups restart

then access the cups web interface from your linux box

http://ip-cups-remote:631

Enable JMX on activeMQ

2011-01-10T23:52:00.000-08:00

Apache activeMQ provide some startup daemon, if you extract the package and go into bin/ folder you will see

bin/
activemq
activemq-admin
linux-x86-32
linux-x86-64
|
--activemq libwrapper.so wrapper wrapper.conf
macosx
run.jar
wrapper.jar

Configure config file

Edit activemq config files at

apache-activemq-5.4.2/conf/activemq.xml

change this following lines from false into true

<managementContext>
           <managementContext createConnector="false"/>
</managementContext>

into

<managementContext>
           <managementContext createConnector="true"/>
</managementContext>

if you wanna using wrapper, unmark the jmx option at

apache-activemq-5.4.2/bin/linux-x86-64/wrapper.conf

become

wrapper.java.additional.n=-Dcom.sun.management.jmxremote.authenticate=false
wrapper.java.additional.n=-Dcom.sun.management.jmxremote.ssl=false

Run ActiveMQ

start the activeMQ, we are using the 64bit architecture

cd apache-activemq-5.4.2/bin/linux-x86-64/
./activemq start

test the jmx connection using activemq query

./../activemq query

Test JMX

if success it will appears

INFO: Using default configuration
(you can configure options in one of these file: /etc/default/activemq /home/fazries/.activemqrc)
INFO: Invoke the following command to create a configuration file
./activemq setup [ /etc/default/activemq | /home/fazries/.activemqrc ]
INFO: Using java '/usr/java/latest//bin/java'
Java Runtime: Sun Microsystems Inc. 1.6.0_20 /usr/java/jdk1.6.0_20/jre
 Heap sizes: current=42496k  free=42042k  max=629888k
 JVM args: -Dactivemq.classpath=/home/fazries/activemq/conf; -Dactivemq.home=/home/fazries/activemq - Dactivemq.base=/home/fazries/activemq
ACTIVEMQ_HOME: /home/fazries/activemq
ACTIVEMQ_BASE: /home/fazries/activemq
Connecting to JMX URL: service:jmx:rmi:///jndi/rmi://localhost:1099/jmxrmi

TemporaryQueues = []
TemporaryTopics = []
DurableTopicSubscribers = []
QueueSubscribers = []
BrokerVersion = 5.4.2
TempLimit = 107374182400
Persistent = true
InactiveDurableTopicSubscribers = []
TempPercentUsage = 0
MemoryLimit = 67108864
SslURL = 
StorePercentUsage = 0
Type = Broker
TemporaryTopicSubscribers = []
BrokerId = ID:A1008.asyx.com-33582-1294640921569-0:1
TotalMessageCount = 0
TotalEnqueueCount = 3
StompSslURL = 
Queues = [org.apache.activemq:BrokerName=localhost,Type=Queue,Destination=example.A,   org.apache.activemq:BrokerName=localhost,Type=Queue,Destination=TEST.FOO,  org.apache.activemq:BrokerName=localhost,Type=Queue,Destination=example.B] 
Topics = [org.apache.activemq:BrokerName=localhost,Type=Topic,Destination=ActiveMQ.Advisory.Queue]
OpenWireURL = tcp://A1008.asyx.com:61616
DataDirectory = /home/fazries/activemq/data
StoreLimit = 107374182400
TopicSubscribers = []
BrokerName = localhost
TotalDequeueCount = 0
VMURL = vm://localhost
StompURL = 
TemporaryQueueSubscribers = []
StatisticsEnabled = true
MemoryPercentUsage = 0
TotalConsumerCount = 0
Slave = false

try using jconsole

jconsole service:jmx:rmi:///jndi/rmi://localhost:1099/jmxrmi

make RPM packages from source

2011-01-09T20:44:00.000-08:00

My boss give me a project with nagios and ActiveMQ and MySQL, the nagios should monitoring the message queue in ActiveMQ and for MysQL i should know the replication delay.
Okay then the adventure is begin.
After searching in google, i found very interesting plugins at exchange.nagios.org, the issue is those packages are build in source not in RPM packet. hmm then i should build it into a RPM.
the solution is rebuild the source into a rpm.
let's start.

I try this with Fedora 13 and Centos 5.5

ingredients
1. download and install.

rpm-build
redhat-rpm-config
gcc
make

note : you should use ordinary user account for build the package not using root.

you can use this package rpmdev-setup for auto configuration, so you no need to build the folder again

yum install rpmdev-setup

2. create folders for build the rpm package and create hidden files named rpmmacros at your home directory.
in centos

mkdir -p ~/rpm/{SOURCES,BUILD,SPEC,SRPMS,RPMS,tmp}

touch ~/.rpmmacros

%packager check_logfiles
%_topdir /home/fazries/rpm           
%_tmppath /home/fazries/rpm/tmp

if you using Fedora you don't need to create those directory, its automatic create when you install the depedency packet.

in fedora the directory structure will become like this:

rpmbuild/
BUILD/
BUILDROOT/
RPMS/
SOURCES/
SPEC/
SPECS/
SRPMS/
tmp/

3. for example i will rebuild the check_mysql_health (need to be complie) and check_jmx (binary already) plugins

download the source.

cd ~/rpm/SOURCES/

wget -c http://labs.consol.de/wp-content/uploads/2010/12/check_mysql_health-2.1.5.tar.gz

4. next create a spec file, inside this file is a configuration for making a RPM packet.

cd ~/rpm/SPEC/touch check_mysql_health.spec

copy and paste this config into check_mysql_health.spec:

Summary: Mysql check plugin for nagios
Name: check_mysql_health
Version: 2.1.5

Release: 1%{?dist}
License: GPL 
Group: Applications/System
URL: http://sourceforge.net/projects/check-logfiles
Packager: Dag Wieers 
Vendor: Dag Apt Repository, http://dag.wieers.com/apt/
Source: http://labs.consol.de/wp-content/uploads/2010/12/check_mysql_health-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root

%description
check_logfiles is a plugin for Nagios which searches for patterns in mysql It is capable of scanning multiple    logfiles and their rotated ancestors in a single run.

%prep

%setup -n %{name}-%{version}

%build

%configure  --libexecdir=%_libdir/nagios/plugins

%install
%{__rm} -rf %{buildroot}
%{__make} install DESTDIR="%{buildroot}"

%clean
%{__rm} -rf %{buildroot}

%files
%defattr(-, root, root, 0755)
%{_libdir}/nagios/plugins/check_mysql_health

%changelog
* Thu Sep 16 2010 Christoph Maser - 3.4.2-1 - 9115/yury- Update to version 3.4.2.
* Thu Jan 10 2008 Christoph Maser - 2.3.1.2-1- Initial package.

5. build the packet

rpmbuild -ba check_mysql_health.spec

6. the your rpm packet will create an stored at ~/rpm/RPMS/check_mysql_health-2.1.5-1.x86_64.rpm

and for the check_jmx you can download it at:
http://exchange.nagios.org/directory/Plugins/Java-Applications-and-Servers/check_jmx-II/details
put it into SOURCES folder
install the unzip , cause the source is compressed by zip

# yum install unzip

repeat,start from step 4. and create the .spec file for check_jmx

touch check_jmx.spec

copy and paste this config:

Version:2
Release:1%{?dist}
Summary:check_jmx

Name: check_jmx
Group:Application/System
License:APL 2.0
URL:http://exchange.nagios.org
BuildRoot:%{_builddir}/%{name}-root
BuildArch:noarch

%description
jmx plugins for nagios

%prep
rm -rf %{buildroot}
rm -rf $RPM_BUILD_ROOT/*

%build
pwd
cd %{_sourcedir}unzip -e check_jmxII.zip

%install
cd %{_sourcedir}
ls
cd jmxquery/nagios/plugin
mkdir -p $RPM_BUILD_ROOT/usr/lib64/nagios/plugin
scp * $RPM_BUILD_ROOT/usr/lib64/nagios/plugins

%clean
rm -rf $RPM_BUILD_ROOT

%files
%defattr(755,root,root)/usr/lib64/nagios/plugins
%changelog

* Tue Jan 15 2011 Vash27- recreated
* Tue Jan 10 2011 Vash27- Created initial spec file for check_jmx

great tutorial,you can download it at:
http://www.gurulabs.com/downloads/GURULABS-RPM-LAB/GURULABS-RPM-GUIDE-v1.0.PDF

next i will explain how to use those plugins with nagios

Kura-Kura Gurun

Install Android SDK on Linux

ATTRS{idVendor}=="04e8" are Id Vendor for Samsung ATTRS{idProduct} =="689e" are Id Product for Galaxy MiniATTRS{idProduct} =="689e" are Id Product for Galaxy Young

Rabbitvcs on Centos6.2

Part II - LDAP Client using nss_pam_ldap

Part I - 389 Directory Server on Centos 6.2

tips and trick part 7

OpenVPN modules for SELinux

mounting udf file system

tips and trick part 6

Mod Security2 Apps for Splunk

authentication failure using SSH pam_unix(sshd:auth): authentication failure;

Jual Madu Hutan Riau "Pak Arif"

check files inside a folder,nagios

check file time stamp inside a folder, nagios

check crond nagios plugin II

check crond nagios plugin

Password Policy pada Redhat Directory Server

tips and trick part 5 (error after update chrome fedora)

System Networking + System Administrator = System Engineer

Nagios Escalations Notification

Reseting pam_tally2 login failure

Automake home dir for ldap user

openvpn howto make OCSP server using OpenSSL [Part2]

openpvn howto make CA,server,client sertificate on openvpn [Part1]

tip n trik linux part 4

Replace 2nd bay hard drive on DLINK 323 NAS

dog tag (Error code: sec_error_reused_issuer_and_serial)

Put FireWall on dom0 XEN

Howto Install OSSEC HIDS

Contents

Tribute to Heriyanto, for making this manual and ask me to put in my blog

Prepare RPMs required by ossec:

Install the main ossec RPMs:

On the ossec server:

On the ossec agent:

Make symbolic link on ossec server and agent:

Edit ossec.conf, make sure fill this property base on your environment:

On the server:

On the agent:

Generate key for new agent:

Add agent on the ossec server

Extract key for an agent

On the ossec agent

Howto setup Bacula

Contents

Installation

Bacula

Package

Configuration

Server

bacula-dir

bacula-sd

bacula-fd

bconsole.conf

read-client.conf

Client

bacula-fd.conf

Test Run

Webacula

Firewall

Configuring SNORT in SPLUNK

Howto Install SNORT IDS

Spec files

Installation

Configuration

snort

barnyard2

oinkmaster

Run Snort and Barnyard and Oinkmaster

Howto Copy Log Files using rsync

Configure rsync daemon( at rsyslog server )

rsyncd.conf

rsyncd.secret (optional)

run the rsync daemon

rsync client ( at splunk server )

create schedules to run rsync using cron

Firewall Issue

Samba PDC with Centos Directory Server backend

tip n trik part 3 (Increase bash history storage)

ATTRS{idVendor}=="04e8" are Id Vendor for Samsung
ATTRS{idProduct} =="689e" are Id Product for Galaxy MiniATTRS{idProduct} =="689e" are Id Product for Galaxy Young