林加菲的窩

2019年9月24日星期二

Setting up rsync daemon and rsync data not-over ssh on CentOS 6.8

### Reference

link-1 link-2 link-3

### Version Information

All Servers OS : CentOS 6.8
rsync : 1.26

### Network Infrastructure

Rsyncd Server (rsync_Server) : 192.168.10.100
Backup Client (rsync_Client) : 192.168.20.100

### Config

## Execute following commands on rsync_Server

# set iptables
sudo /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 873 -j ACCEPT

sudo /sbin/service iptables save
sudo /sbin/service iptables restart

# daemonized rsync service and assign config file
sudo /bin/mkdir -p /etc/rsyncd

cd /etc/xinetd.d
sudo /bin/sed -i 's/disable = yes/disable = no/' rsync
sudo /bin/sed -i '/server_args.*/d' rsync
sudo /bin/sed -i '/\{/i\ server_args = --daemon --config=\/etc\/rsyncd\/rsyncd.conf' rsync

cd /etc/rsyncd
sudo /bin/cat << EOF > rsyncd.conf

### GLOBAL OPTIONS ###

#motd file = /etc/rsyncd/rsyncd.motd
pid file = /var/run/rsync.pid

### GLOBAL OPTIONS ###

### Modules ###

[DATA_BACKUP]
path = /data/bak/rsync_backup_data
uid = root
gid = root
read only = no
use chroot = yes

# limit access
auth users = rsync_user
secrets file = /etc/rsyncd/rsyncd.passwd
hosts allow = 192.168.20.100
hosts deny = *
max connections = 5

# log
transfer logging = yes
log file = /var/log/rsync.log
log format = %t %a %m %f %b

#syslog facility = local3
#lock file = /var/run/rsync.lock

timeout = 300

### Modules ###

EOF

# setup rsync password file
sudo /bin/cat << EOF > /etc/rsyncd/rsyncd.passwd
rsync_user:rsync_pass
EOF

sudo chown root:root /etc/rsyncd/rsyncd.passwd
sudo chmod 600 /etc/rsyncd/rsyncd.passwd

## Execute following commands on rsync_Client# setup rsync password file

sudo /bin/cat << EOF > /etc/rsyncd/login.passwd
rsync_pass
EOF

sudo chown root:root /etc/rsyncd/login.passwd
sudo chmod 600 /etc/rsyncd/login.passwd

### Execute rsync to backup files

## Execute following commands on rsync_Client
# rsync from <src_backup_dir> to dst_dir(module:<DATA_BACKUP>)
sudo /usr/bin/rsync -av --delete --password-file=/etc/rsyncd/login.passwd <src_backup_dir>/ rsync_user@192.168.10.100::DATA_BACKUP

2016年7月6日星期三

Using LVS (Linux Virtual Server) + keepalived (Direct Route mode) for Server Load Balancing on MariaDB Galera Cluster

參考 Reference
http://blog.xuite.net/misgarlic/weblogic/249523049-Using+keepalived+to+simulate+SLB+DSR
http://www.keepalived.org/pdf/sery-lvs-cluster.pdf

### Version Information
All Servers OS : CentOS 6.7
ipvsadm : 1.26
keepalived : 1.2.13
MariaDB : 5.10
MariaDB Galera Cluster : 25.3.9

### Network Infrastructure
Load Balance Server (SLB_1) : 192.168.1.10 [priority 50, active]
Load Balance Server (SLB_2) : 192.168.1.20 [priority 100, standby]

MariaDB Galera Cluster Server (DB_1) : 192.168.1.201:3306
MariaDB Galera Cluster Server (DB_2) : 192.168.1.202:3306
MariaDB Galera Cluster Server (DB_3) : 192.168.1.203:3306

Load Balance VIP (VIP_1) : 192.168.1.110:3306 (for read, mapping to DB_1[weight 4] & DB_2[weight 4] & DB_3[weight 1])
Load Balance VIP (VIP_2) : 192.168.1.111:3306 (for write, mapping to DB_3)

### Config

## Execute following commands on DB_1, DB_2, DB_3, SLB_1 and SLB_2
# set iptables
sudo /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT

sudo /sbin/service iptables save
sudo /sbin/service iptables restart

## Execute following commands on DB_1, DB_2 and DB_3
# set sysctl parameters
sudo /bin/cat << EOF >> /etc/sysctl.conf

# Prevent ARP action on lo interface for keepalived Direct-Route mode
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
EOF

sudo /sbin/sysctl -p
# bind VIPs on lo interface
sudo /bin/cat << EOF > /etc/sysconfig/network-scripts/ifcfg-lo:vip110
DEVICE=lo:vip110
IPADDR=192.168.1.110
NETMASK=255.255.255.255
ONPARENT=yes
BOOTPROTO=none
TYPE=Ethernet
EOF

sudo /bin/cat << EOF > /etc/sysconfig/network-scripts/ifcfg-lo:vip111
DEVICE=lo:vip111
IPADDR=192.168.1.111
NETMASK=255.255.255.255
ONPARENT=yes
BOOTPROTO=none
TYPE=Ethernet
EOF

sudo /sbin/ifup lo:vip110
sudo /sbin/ifup lo:vip111

sudo /bin/ls -la /etc/sysconfig/network-scripts/ifcfg-lo*
sudo /sbin/ip addr show lo

## Execute following commands on SLB_1 and SLB_2
# set iptables
sudo /sbin/iptables -I INPUT -p vrrp -m comment --comment "VRRP - keepalived HA detecting" -j ACCEPT

sudo /sbin/service iptables save
sudo /sbin/service iptables restart

# install ipvsadm
sudo /usr/bin/yum -y install ipvsadm
sudo /sbin/chkconfig ipvsadm on

sudo /sbin/ipvsadm
# install and config keepalived
sudo /usr/bin/yum -y install keepalived
sudo /sbin/chkconfig keepalived on

sudo /bin/mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.`/bin/date +%y%m%d`
sudo /bin/cat << EOF > /etc/keepalived/keepalived.conf
global_defs {
notification_email {
user1@xxx.com
user2@xxx.com
}
notification_email_from user3@xxx.com
smtp_server xxx.xxx.xxx.xxx
smtp_connect_timeout 30
router_id MYRTID
}

vrrp_sync_group G1 {
group {
VI_1
}
}

vrrp_instance VI_1 {
state BACKUP
interface eth0
lvs_sync_daemon_interface eth0
smtp_alert
## set virtual_router_id between 1 to 255
virtual_router_id MYVRTID
priority MYPRIORITY
advert_int 1
authentication {
auth_type PASS
auth_pass 11223344
}
virtual_ipaddress {
192.168.1.110
192.168.1.111
}
}

virtual_server 192.168.1.110 3306 {
delay_loop 5 # health check interval
lb_algo wrr # weighted round robin
lb_kind DR # direct route mode
protocol TCP

real_server 192.168.1.201 3306 {
weight 4
inhibit_on_failure
TCP_CHECK {
connect_port 3306
connect_timeout 3
}
}

real_server 192.168.1.202 3306 {
weight 4
inhibit_on_failure
TCP_CHECK {
connect_port 3306
connect_timeout 3
}
}

real_server 192.168.1.203 3306 {
weight 1
inhibit_on_failure
TCP_CHECK {
connect_port 3306
connect_timeout 3
}
}

}

virtual_server 192.168.1.111 3306 {
delay_loop 5 # health check interval
lb_algo wrr # weighted round robin
lb_kind DR # direct route mode
protocol TCP

real_server 192.168.1.203 3306 {
weight 4
## inhibit_on_failure
TCP_CHECK {
connect_port 3306
connect_timeout 3
}
}
}
EOF

## Execute following commands on SLB_2
# config and run keepalived
sudo /bin/sed -i s/MYRTID/rt`/bin/uname -n`/ /etc/keepalived/keepalived.conf
sudo /bin/sed -i s/MYVRTID/110/ /etc/keepalived/keepalived.conf

sudo /bin/sed -i s/MYPRIORITY/100/ /etc/keepalived/keepalived.conf

sudo /sbin/service keepalived start

## Execute following commands on SLB_1
# config and run keepalived
sudo /bin/sed -i s/MYRTID/rt`/bin/uname -n`/ /etc/keepalived/keepalived.conf
sudo /bin/sed -i s/MYVRTID/110/ /etc/keepalived/keepalived.conf

sudo /bin/sed -i s/MYPRIORITY/50/ /etc/keepalived/keepalived.conf

sudo /sbin/service keepalived start

2013年9月19日星期四

DS VPS - Ubuntu 12.10 x86 - transmission-daemon 安裝

參考
http://thkaw.pixnet.net/blog/post/91980843-linux%E9%98%B2%E5%81%A5%E5%BF%98%E6%97%A5%E8%AA%8Cno.69-ubuntu-12.04-%E5%AE%89%E8%A3%9D%E5%8F%8A%E8%A8%AD%E5%AE%9Atransm
https://trac.transmissionbt.com/wiki/ConfigurationParameters

注意！不用的時候要關閉service，不然放著會吃掉DS VPS的每月可用頻寬

# login as user account

1. 安裝

sudo apt-get install transmission-daemon

2. 設定

vi /etc/transmission-daemon/settings.json

# "peer-port": #Port1#, (另外訂一個非 default 的 port，降低被攻擊的機會)

# "rpc-password": "xxxx", (web登入密碼，可以先輸入明碼密碼，transmission啟動時會自動加密後儲存)

# "rpc-port": #Port2#, (另外訂一個非 default 的 port，降低被攻擊的機會)

# "rpc-username": "xxxx", (web登入帳號)

# "rpc-whitelist": "127.0.0.1", (有特定的連線來源IP時，可以改這邊)

# "rpc-whitelist-enabled": true, (限定特定來源IP功能是否要啟動)

# "speed-limit-down": 100, (下載限速多少)

# "speed-limit-down-enabled": false, (啟用下載限速)

# "speed-limit-up": 100, (上載限速多少)

# "speed-limit-up-enabled": false, (啟用上載限速)

3. 重新啟動服務

# 不可直接 service transmission-daemon restart

# transmission-daemon 會在 stop service 時把 config 寫入 settings.jason

# 所以要先將更改過的config重新載入後再重新啟動服務

sudo invoke-rc.d transmission-daemon reload

sudo service transmission-daemon restart

4. 連線測試

http://server-ip:#Port2#/

DS VPS - Ubuntu 12.10 x86 - amule-daemon 安裝

參考
http://alohalpho.blogspot.tw/2012/06/amule-in-ubuntu-server.html
http://wiki.ubuntu.org.cn/index.php?title=AMule&variant=zh-hant#.E7.A7.BB.E6.A4.8DeMule.E7.9A.84.E9.85.8D.E7.BD.AE

注意！不用的時候要關閉service，不然放著會吃掉DS VPS的每月可用頻寬

# login as user account
1. 安裝
# login as user account
sudo apt-get install amule
sudo apt-get install amule-daemon

2. 設定
2.1 設定default user
sudo vi /etc/default/amule-daemon
# AMULED_USER = "dsvps" (用哪個使用者啟動，必填)
# AMULED_HOME = "" (預設程式config檔放在哪個$AMULD_USER的[.aMule]內)

2.2 產生MD5編碼後之密碼
echo -n <yourpassword> | md5sum | cut -d ' ' -f 1

2.3 設定遠端管控
cd /home/dsvps/.aMule
amuleweb -w
vi remote.conf
# [EC]
# Port=#Port1# (另外訂一個非 default 4712 的 port，降低被攻擊的機會)
# Password=<md5sum hash過的password>
# [Webserver]
# Port=#Port2# (另外訂一個非 default 4711 的 port，降低被攻擊的機會)
# AdminPassword=<md5sum hash過的password>
# GuestPassword=<md5sum hash過的password>

2.4 設定amule config
vi /home/dsvps/.aMule/amule.conf
# [aMule]
# Nick=xxxx (可以改自己喜歡的nickname)
# Port=#Port3# (另外訂一個非 default 4662 的 port，降低被攻擊的機會)
# UDPPort=#Port4# (另外訂一個非 default 4672 的 port，降低被攻擊的機會)
# TempDir=/home/dsvps/.aMule/Temp (視需要改變)
# IncomingDir=/home/dsvps/.aMule/Incoming (視需要改變)
# [ExternalConnect]
# AcceptExternalConnections=1
# ECPort=#Port1#
# ECPassword=<md5sum hash過的password>
# [WebServer] (同remote.conf裡[Webserver]的設定值)
# Enabled=1
# Password=<md5sum hash過的password>
# Port=#Port2# (另外訂一個非 default 4711 的 port，降低被攻擊的機會)

2.5 防火牆policy異動
# DS VPS 預設沒有安裝 ufw，所以先不用設定

2.6 更新server.met
cp /home/dsvps/.aMule/server.met /home/dsvps/.aMule/server.met.orig
wget http://ed2k.im/server.met -O /home/dsvps/.aMule/server.met
http://ed2k.im/server.met

2.7 啟動服務
sudo service amule-daemon restart

2.8 連線測試
http://server-ip:#Port2#/

PS:
A. 要找比較新的 server.met，驢子的server list比較常有變動 (參見http://emulefans.com/tag/server-met/)
B. (待驗證)可以直接從eMule的config目錄複製過來的文件有：
addresses.dat、clients.met、cryptkey.dat、emfriends.met、key_index.dat、known.met、known2.met、preferences.dat、server.met

DS VPS - Ubuntu 12.10 x86 - 加強 OS 的安全性

1. 關閉目前先不會使用到的服務

# login as root

# list all services

netstat -an | more

service --status-all

# disable service

service apache2 stop

service sendmail stop

2. 帳號管理

# login as root

2.1 更改 root 密碼

# 同公司要求，12碼以上，含特殊符號、英文大小寫、數字

passwd root

2.2 建立個人帳號

# create user account "dsvps", set dsvps's passwd

useradd -g users -s /bin/bash -m -d /home/dsvps dsvps

passwd dsvps

2.3 關閉 root 遠端 ssh login

vi /etc/ssh/sshd_config

# 將 [PermitRootLogin yes] 改為 [PermitRootLogin no]

service ssh restart

2.4 允許帳號dsvps sudo

usermod -a -G sudo dsvps

2.5 測試

# remote root ssh login should fail

ssh root@user-vps-host

# remote dsvps ssh login should success

ssh dsvps@user-vps-host

# test sudo

sudo service ssh restart

3. 線上更新
# login as root
apt-get -y update
apt-get -y upgrade

DS VPS - 買虛擬主機 (DirectSpace VPS)

在朋友的介紹之下，跑去買了 DirectSpace 家的虛擬主機 http://directspace.net/

從這邊 http://directspace.net/webhosting/vps/inventory.php 選取了最便宜的方案
「DSVPS.1」 15鎂/年 (還滿搶手的，常常是售完狀態，用twitter去follow它，可以買的時候會通知)

還算便宜，資源雖然不是頂強，但是拿來當 Linux Server 玩玩順便當下載機應該也夠用了

然後第一次試用 google wallet 付款，等了好久才看到付款，還怕是我操作錯誤而沒買到

付款後要稍微等一陣子，會收到 email 通知一個管控台頁面 (https://vps.directspace.net/login.php) 的登入帳號與密碼。

登入這個管控台頁面後，可以看到自己 VPS 的狀態，也可以做其他管控如： Reboot/Shutdown/Boot/Reinstall/Serical Console/Log/Quick Backup

一開始我會選擇重新安裝 OS，先從 Ubuntu 12.10 x86 開始吧，選擇 Reinstall 以及 OS 後，稍等一下就會重灌好了，接下來就開始玩 OS 與 APP 囉～

訂閱：文章 (Atom)

2019年9月24日 星期二