CentOS-6.0 is now released { http://t.co/zAlkelc }; Enjoy!

July 10, 2011 1:58 pm via webReplyRetweetFavorite

@CentOS

Karanbir Singh

The first step is to create the directory structure for the repository.  You’ll need about 30GB of free space in the filesystem you use.  Let’s assume we have a mountpoint /repo that we want to use:

mkdir -p /repo/CentOS/6/addons/i386 /repo/CentOS/6/extras/i386 /repo/CentOS/6/isos/i386 \
        /repo/CentOS/6/os/i386 /repo/CentOS/6/updates/i386  \
        /repo/CentOS/6/addons/x86_64 /repo/CentOS/6/extras/x86_64 \
        /repo/CentOS/6/isos/x86_64 /repo/CentOS/6/os/x86_64 \
        /repo/CentOS/6/updates/x86_64

If you’d like to mirror other releases (such as CentOS 5), you’ll also need to create the directory structure for those as well.

Once the directory structure is in place, we can use rsync to pull down what we don’t have.  I’ve written a simple script to do this.  Since this is a new repository, the first run will pull down everything, so it might be best run overnight.  Also, note that I am mirroring both CentOS 5 and CentOS 6 in this script.  Simply remove 5 from the verlist if you only want to mirror CentOS 6.  The same applies for i386 in the archlist.

#!/bin/sh

rsync="/usr/bin/rsync -aqHz --delete"
mirror=us-msync.centos.org::CentOS

verlist="5 6"
archlist="i386 x86_64"
baselist="os updates addons extras isos"
local=/repo/CentOS

for ver in $verlist
do
  for arch in $archlist
  do
    for base in $baselist
    do
        remote=$mirror/$ver/$base/$arch/
        $rsync $remote $local/$ver/$base/$arch/
    done
  done
done

Since your yum clients will be accessing the repository via HTTP, you’ll need to setup a webserver.  Here, I’m using the standard Apache httpd that comes with CentOS.  Simply modify the following lines in /etc/httpd/conf/httpd.conf:

#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
DocumentRoot "/repo"
.

.

.

#
# This should be changed to whatever you set DocumentRoot to.
#
<Directory "/repo">

After reconfiguring Apache, start it up.  If everything works correctly, ensure that it will start at boot with chkconfig.

[dood@mirror ~]$ sudo /sbin/service httpd start
[dood@mirror ~]$ sudo /sbin/chkconfig httpd on

The last step is configuring your clients.  This can be done either through editing /etc/yum.conf, or adding to /etc/yum.repos.d:

[base]
name=CentOS-$releasever - Base
baseurl=http://mirror.lanigera.com/CentOS/$releasever/os/$basearch/
gpgcheck=1
gpgkey=http://mirror.lanigera.com/CentOS/RPM-GPG-KEY-CentOS-6
enabled=1

#released updates
[updates]
name=CentOS-$releasever - Updates
baseurl=http://mirror.lanigera.com/CentOS/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=http://mirror.lanigera.com/CentOS/RPM-GPG-KEY-CentOS-6
enabled=1

#packages used/produced in the build but not released
[addons]
name=CentOS-$releasever - Addons
baseurl=http://mirror.lanigera.com/CentOS/$releasever/addons/$basearch/
gpgcheck=1
gpgkey=http://mirror.lanigera.com/CentOS/RPM-GPG-KEY-CentOS-6
enabled=1

#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
baseurl=http://mirror.lanigera.com/CentOS/$releasever/extras/$basearch/
gpgcheck=1
gpgkey=http://mirror.lanigera.com/CentOS/RPM-GPG-KEY-CentOS-6
enabled=1

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$releasever - Plus
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus
baseurl=http://mirror.lanigera.com/CentOS/$releasever/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirror.lanigera.com/CentOS/RPM-GPG-KEY-CentOS-6

There you go.  Cron the repo script to run daily, and you should be good.

With dmidecode, I can get this information with a simple, one-line command:

# /usr/sbin/dmidecode|grep 'Serial Number'|head -1

                Serial Number: ABC1234

You can also page through the output to get the model number of the system.  I showed this to our DBA yesterday, so that he could know which systems a client had upgraded to.  As you can see, this system is a PowerEdge 6850:

# /usr/sbin/dmidecode |more

[blah blah blah]

Handle 0x0100

        DMI type 1, 25 bytes.

        System Information

                Manufacturer: Dell Computer Corporation

                Product Name: PowerEdge 6850

                Version: Not Specified

                Serial Number: ABC1234

                UUID: 11122222-3333-4444-5555-666666777777

                Wake-up Type: Power Switch

There’s a lot more information returned by dmidecode than I’ve covered here.  Also, the version included in RHEL 4 does not seem to take any arguments, nor does it have a manpage.  Peeking at CentOS 5, it does accept several arguments (and there’s actually a manpage, hooray!).  YMMV.

Active Directory Configuration

Create an account in Active Directory to be used for enumerating users and groups.  Active Directory does not allow anonymous binds.

Tomcat Configuration

These instructions assume that you are modifying a clean install of Tomcat 6.0.

First, the JNDI Realm must be configured in the main Tomcat configuration file ($CATALINA_HOME/conf/server.xml).  This defines the LDAP connection to Active Directory.  Next, access controls are configured within the context, or application, configuration file ($WEB_APP/WEB-INF/web.xml).

Define Realm in $CATALINA_HOME/conf/server.xml

Comment out the UserDatabase Realm:

<!--
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>
-->

Add a Realm definition for the LDAP connection:

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
       connectionURL="ldap://companydc1:389"
       alternateURL="ldap://companydc2:389"
       connectionName="BIND_USER@company.com"
       connectionPassword="BIND_PASSWD"
       referrals="follow"
       userBase="dc=company,dc=com"
       userSearch="(sAMAccountName={0})"
       userSubtree="true" roleBase="dc=company,dc=com"
       roleName="cn"
       roleSearch="(member={0})"
       roleSubtree="true"
/>

Define Context Security Settings in web.xml

Edit the web.xml configuration file of the context (application) you want to secure, modifying the url-pattern, http-method, auth-method, and role-name tags as needed:

<security-constraint>
  <display-name>Example Security Constraint</display-name>
  <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <!-- Define the context-relative URL(s) to be protected -->
    <url-pattern>/PATH_TO_WEBAPP/*</url-pattern>
    <!-- If you list http methods, only those methods are protected -->
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>PUT</http-method>
  </web-resource-collection>
  <auth-constraint>
    <!-- Anyone with one of the listed roles may access this area -->
    <role-name>ACTIVE_DIRECTORY_GROUP</role-name>
  </auth-constraint>
</security-constraint>

<!-- Default login configuration uses form-based authentication -->
<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>Example Form-Based Authentication Area</realm-name>
  <form-login-config>
    <form-login-page>/jsp/security/protected/login.jsp</form-login-page>
    <form-error-page>/jsp/security/protected/error.jsp</form-error-page>
  </form-login-config>
</login-config>

<!-- Security roles referenced by this web application -->
<security-role>
  <role-name>ACTIVE_DIRECTORY_GROUP</role-name>
</security-role>

Note that multiple roles can be specified, and that roles are equivalent to groups in Active Directory.

Applying

Restart Tomcat for your changes to take effect.

# bin/shutdown.sh
Using CATALINA_BASE:   /usr/local/apache-tomcat-6.0.14
Using CATALINA_HOME:   /usr/local/apache-tomcat-6.0.14
Using CATALINA_TMPDIR: /usr/local/apache-tomcat-6.0.14/temp
Using JRE_HOME:       /usr/java/jdk1.5.0_13

Wait for the java process to exit – this can take 10 to 15 seconds:

# ps -ef|grep java
root     26858     1 47 10:00 pts/2    00:00:15 /usr/java/jdk1.5.0_13/bin/java
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.
logging.config.file=/usr/local/apache-tomcat-6.0.14/conf/logging.properties -D
java.endorsed.dirs=/usr/local/apache-tomcat-6.0.14/endorsed -classpath :/usr/l
ocal/apache-tomcat-6.0.14/bin/bootstrap.jar:/usr/local/apache-tomcat-6.0.14/bi
n/commons-logging-api.jar -Dcatalina.base=/usr/local/apache-tomcat-6.0.14 -Dca
talina.home=/usr/local/apache-tomcat-6.0.14 -Djava.io.tmpdir=/usr/local/apache
-tomcat-6.0.14/temp org.apache.catalina.startup.Bootstrap start
# ps -ef|grep java
root     26951 19329  0 10:01 pts/2    00:00:00 grep java

After the process has ended, start Tomcat again:

# bin/startup.sh
Using CATALINA_BASE:   /usr/local/apache-tomcat-6.0.14
Using CATALINA_HOME:   /usr/local/apache-tomcat-6.0.14
Using CATALINA_TMPDIR: /usr/local/apache-tomcat-6.0.14/temp
Using JRE_HOME:       /usr/java/jdk1.5.0_13

If you received errors on startup, shutdown Tomcat again, and double-check your changes.

Testing

After restarting Tomcat, open a web browser, and go to a protected URL that you just configured.  You should be prompted to enter a username and password.  Login with an account that has a role that you specified in the web.xml file, and you should be able to access the context.

References

http://tomcat/docs/realm-howto.html or http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html

http://cymulacrum.net/writings/adv_tomcat/c487.html

http://www.cafesoft.com/products/cams/tomcat-security.html

http://wiki.apache.org/tomcat/JNDI_HowTo

This is something that I have seen cause confusion in the past. A DBA, developer, or consultant is trying to figure out why a particular application or program is running poorly (it’s never, ever their Java or SQL code), runs top or free, sees very little free memory, and jumps to the conclusion that the system is out of memory.  And the buck is inevitably passed.  To you.

So, how the heck do you find out how much memory is *really* being used?  One way is to view /proc/meminfo:

MemTotal:     32904572 kB
MemFree:         92028 kB
Buffers:        196172 kB
Cached:       24069564 kB
SwapCached:        336 kB
Active:       20241392 kB
Inactive:      9761156 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:     32904572 kB
LowFree:         92028 kB
SwapTotal:    22020088 kB
SwapFree:     21883304 kB
Dirty:             392 kB
Writeback:           0 kB
Mapped:        9632036 kB
Slab:           569292 kB
CommitLimit:  38472372 kB
Committed_AS: 14082748 kB
PageTables:    2170840 kB
VmallocTotal: 536870911 kB
VmallocUsed:    276288 kB
VmallocChunk: 536594487 kB
HugePages_Total:     0
HugePages_Free:      0
Hugepagesize:     2048 kB

As we can see, the system has 32 GB of memory, but less than 90MB of “free” memory.  Oh noes!  But as with most things Unix, if you understand what’s going on, this all makes quite a bit more sense.  Let’s zero in on a few, key numbers here:

MemTotal:     32904572 kB

This is the total amount of memory in the system.  Pretty straightforward.

Active:       20241392 kB

This is the amount of memory actively being used by the system, in this case just less than 20 GB.  Notice that subtracting this number from the total does not equal the following:

MemFree:         92028 kB

So if memory’s not actively being used, and it’s not free, then what the heck is going on?  Part of it is that the Linux kernel is being smart and keeping things in memory that it was using, but isn’t now.  That way, in case you need the data again, it is sitting there in nice, fast memory instead of on slow disk.

Inactive:      9761156 kB

“Inactive” memory is memory that hasn’t been recently used and is eligible for cleaning.  But for now, it’s being used as a cache and also to confuse your dev team.

Dirty:             392 kB

“Dirty” memory is memory that doesn’t match what’s on disk and probably needs to be flushed.

For further reading, see Red Hat Magazine, “Understanding Virtual Memory.”  It’s for RHEL 3, but probably still fairly accurate.

Overalls?  Check

Huge beard?  Check

Plus sized? Check

“Big Iron” enthusiast?  Check

Yeah, I think there’s a good chance this guy is a fellow Unix admin.  Good to know we have career options!

]]> http://www.lanigera.com/wordpress/2011/02/career-options/feed/ 0 http://www.lanigera.com/wordpress/2009/11/linux-kiosk-for-oracle-msca/ http://www.lanigera.com/wordpress/2009/11/linux-kiosk-for-oracle-msca/#comments Thu, 19 Nov 2009 16:46:38 +0000 tkyle http://www.lanigera.com/wordpress/?p=57 Recently, I was asked to explore building a kiosk image for use in our manufacturing facilities. All the system would need to do would be to allow the user to telnet into an Oracle MSCA/MWA service. I thought going in that this would be a straightforward task, but it turned out to be more complicated than I realized.

There were two problems that I was experiencing. The first was that F1-F4 were mapped differently, for what appears to be historical reasons (VT100 terminals did not have these keys). The other was that the telnet client needed to be in character mode, instead of line mode, and there was no easy way to do this in the Linux telnet client except through the user manually changing the mode.

So I used Expect to translate the F1-F4 keys to what the remote MSCA telnet server wanted, and then used C-Kermit as my telnet client. The scripts I wrote to perform these two steps are as follows:

[shell]
#!/usr/local/bin/kermit

set telnet newline-mode nvt raw
set telnet echo remote

telnet /nowait host.company.com 12345

quit
[/shell]

and

[shell]
#!/usr/bin/expect

eval spawn -noecho "/usr/local/bin/ktelnet.sh"

interact {
"\033[[A" { send "\033[P" }
"\033[[B" { send "\033[Q" }
"\033[[C" { send "\033[R" }
"\033[[D" { send "\033[S" }
}
[/shell]