I was in the midst of my first ever PCI audit – the company I was doing work for wanted to start taking credit card orders over their website. I thought it would be easy – the website was a wrap-around of the credit card company’s authorization site, so no numbers ever touched the company-owned systems. Unfortunately the security firm required all external facing IP addresses to test. One of those IP addresses pointed to an Ubuntu 10.04.4LTS system that was running Owncloud software on apache (think DAV for multiple users via web interface).

So the PCI audit returns with a giant FAIL. Apache is out of date!

apache2 -v
2.2.14
This version came out in October of 2009.

So I edited the apt sources list to grab a newer file:
nano /etc/apt/sources.list
And added:

deb http://us.archive.ubuntu.com/ubuntu/ oneiric main
deb-src http://us.archive.ubuntu.com/ubuntu/ oneiric main

apt-get update
apt-get install apache2
apache2 -v
2.2.20
This version came out in August of 2010

Run the PCI compliance test again – FAIL. Apparently they require 2.2.21 or higher. The only issues I could find with 2.2.20 deal with mods being enabled that they don’t use, or .htaccess permissions that they also don’t use. OK, so let’s go up another version.

nano /etc/apt/sources.list
Add:

deb http://us.archive.ubuntu.com/ubuntu/ precise main
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main

apt-get update
apt-get install apache2
apache2 -v
2.2.22
This version came out in January of 2012

I verified the site was still working. Make sure you comment out the sources.list precise and oneiric otherwise you’ll have lots of update issues down the road.

Source generator:
http://repogen.simplylinux.ch/generate.php

I had just run some simple patching on a test webserver and had some issues with PHP. Ran a few more commands and the problem went away. Until I decided to patch a production server as well.

Basically the update included an apache update, which wrecked the php modules. How do I know this?

Running Ubuntu 10.04.03 LTS
apt-get update
apt-get dist-upgrade
Load website and it prompts to download/save the PHP file instead of displaying the PHP file. Great.

Check if the PHP5 module is activated:
a2enmod php5
apache2ctl restart

Only the restart yielded this:

apache2: Syntax error on line 204 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/php5.load: Cannot load /usr/lib/apache2/modules/libphp5.so into server: /usr/lib/apache2/modules/libphp5.so: cannot open shared object file: No such file or directory

So just install the module libraries for PHP5:
apt-get install libapache2-mod-php5

This should automatically restart apache, but just for good measure you can do it again to verify there are no more errors:
apache2ctl restart

Proxmox 1.9 – not fully updated (1.9 build 6542)
Had backups set to backup snapshots of machines every day starting at 2AM. They generally took about 3 hours and would finish by 5AM.

Little did I realize that I was no longer receiving the emails saying “backup successful”. Last one was 4 weeks ago. Whoops doesn’t even start to cover that.

Checking it out it looks like the backup stalled on one of the virtual machines.
ps auxww |grep vzdump
Then just kill any PID that looks like vzdump is running.

Re-run the command to backup either from the GUI or from the command line:
vzdump --quiet --snapshot --storage STORAGE --maxfiles 5 --mailto admin 101 102 103 etc

Ubuntu 10.04.3 LTS x32 fully patched.

I needed to install SNMP so my cacti installation could work with graphing. And I thought I had already installed SNMP on the server I was testing against.

Testing from cacti:
snmpwalk -v 1 -c public IPOFSERVER

Timeout: No Response from IPOFSERVER

OK, so let me see if the process is running:
ps aux | grep snmp

root 439193 0.0 0.0 3884 616 pts/0 S+ 09:59 0:00 grep snmp

Well, looks like I need to install it:
apt-get install snmpd

The installation auto-starts the snmpd service with the default configuration file. I verified it was working with ps aux again, and the snmpd service is running under the snmp user.
On the local machine I could now run snmpwalk:
snmpwalk -v 1 -c public localhost
Which retrieved the information I wanted. Unfortunately I still could not run snmpwalk from the cacti server. Doh!

Edit the snmpd.conf file if you want a different community or RO/RW rights:
nano /etc/snmp/snmpd.conf

Otherwise, just edit the default snmpd configuration:
nano /etc/default/snmpd
Change the following line:

SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1′

To:

SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid -c /etc/snmp/snmpd.conf’

Save and quit

Restart the snmpd service:
/etc/init.d/snmpd restart

Test again:
snmpwalk -v 1 -c public IPOFSERVER

Profit.

I needed to find an easy, and fairly secure, way to allow a user to login on a website and display their current user’s disk usage. Generally I just navigate to the user’s home directory and run
du -hc
But in this case I needed it to work from the web.

By default, Ubuntu runs apache as www-data. Enter sudoers. My editor’s file is nano.
visudo
Add the following to the bottom of the file:
www-data ALL=NOPASSWD: /usr/bin/du, /usr/bin/ls, other/command
Save and quit

Now your www-data user can run those commands by running sudo command. And it will not allow the user to sudo any other commands.

My PHP page is as follows:
echo exec("sudo du -hc /mnt/ | grep " . $_SESSION["valid_user"] . "| awk '{print $1}'") . " Disk Space Used
";
Obviously the SESSION variable comes from a login page, but it’s a pretty good start for me.

I know there is a GUI for RHEL, but I still prefer to do these things via a command line.

RHEL Setup NTPd

To simply set the time to the time server (correct time one-off), use the following command:
/usr/sbin/ntpdate IP_or_ADDR_of_NTP_Server

In my case it was this command and this result:

-bash-3.2# /usr/sbin/ntpdate 10.4.0.253
18 Jan 08:16:02 ntpdate[13347]: step time server 10.4.0.253 offset 756.199630 sec

As you can see, this server was off by over 12 minutes!

If you want to edit the NTP Servers List:
nano (or vi) /etc/ntpd.conf
Add the specific time server you require
/sbin/service ntpd restart

I recently installed FreeNAS 8.x release and wanted to setup a per user quota. There is no way to set this up using the GUI front end – you can only setup a mount point quota at this time.

To setup a per user quota using the CLI, just login as root using your admin password, then issue the following commands:

zfs set userquota@USERNAME=10g SHARENAME
So in my case I had a /mnt/files filesystem, so I used:
zfs set userquota@thelibrarie=10g files

You can list the user quota
zfs list -o userquota@USERNAME SHARENAME

You can remove the user quota
zfs set userquota@USERNAME=none SHARENAME

View the current Input/Output statistics
zpool iostatzpool upgrade -v

View the current compression for all pools
zfs list -o compression