Archive | Uncategorized

Plesk – Howto Clear Hung Database Copy

By leerb on June 16, 2012 in Uncategorized

Recent versions of Plesk include a “Make a Copy” feature for databases. Unfortunately, on occasion the copy will fail but the copy task will not be removed. Then you’ll see a message like this every time you go to the affected database in Plesk.

You can view a list of the current tasks with the following command from a root ssh login:

echo "select * from longtasks" | \
mysql --password=`cat /etc/psa/.psa.shadow` -u admin psa

1 2	echo "select * from longtasks" \| \ mysql --password=`cat /etc/psa/.psa.shadow` -u admin psa

You can clear the task by running the following command:

echo "delete from longtasks" | \
mysql --password=`cat /etc/psa/.psa.shadow` -u admin psa

1 2	echo "delete from longtasks" \| \ mysql --password=`cat /etc/psa/.psa.shadow` -u admin psa

Passive Mode FTP with iptables

By leerb on March 8, 2012 in Uncategorized

There’s lots of advice on the net about how to setup a server with iptables to allow passive mode FTP. Below is the approach that we’ve found to be most effective.

Start by configuring your FTP daemon to use a fixed range of ports. We use 41361 to 65534 which is the IANA registered ephemeral port range. The exact config depends on what FTP software you’re using:

vsftpd

Edit /etc/vsftpd/vsftpd.conf and add the following lines:

pasv_min_port=49152 
pasv_max_port=65534

1 2	pasv_min_port=49152 pasv_max_port=65534

proftpd

Edit /etc/proftpd.conf and add to the Global section:

......
PassivePorts 49152 65534

1 2	...... PassivePorts 49152 65534

Now restart your FTP service so the changes take effect.

Next you’ll need to configure the ip_conntrack_ftp iptables module to load. On Redhat/CentOS just edit /etc/sysconfig/iptables-config and add “ip_conntrack_ftp” to the IPTABLES_MODULES like this:

IPTABLES_MODULES="ip_conntrack_ftp"

1	IPTABLES_MODULES="ip_conntrack_ftp"

Next edit /etc/sysconfig/iptables and add a rule to allow TCP port 21. The new line is marked in red:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

Now restart the iptables service:

/sbin/service iptables restart

1	/sbin/service iptables restart

You can verify that the correct port range has been registered with lsmod like this:

lsmod | grep conntrack_ftp

1	lsmod \| grep conntrack_ftp

and you’ll get something like this:

ip_conntrack_ftp       <strong>41361</strong>  0
ip_conntrack           91621  2 ip_conntrack_ftp,xt_state

1 2	ip_conntrack_ftp <strong>41361</strong> 0 ip_conntrack 91621 2 ip_conntrack_ftp,xt_state

And that’s all it takes to get passive mode ftp working behind iptables.

One extra note: If your server is NATed behind a physical firewall then you’ll probable need to load the “ip_nat_ftp” iptables module.

On a AWS EC2 server with vsftpd I had to add “pasv_address=x.x.x.x” to the /etc/vsftpd/vsftpd.conf file where x.x.x.x was the public (elastic) address of the server. On an AWS EC2 server with Plesk and proftpd I had to add “MasqueradeAddress x.x.x.x” to a new file at /etc/proftpd.d/1-pasv_addr.conf.

NFS Server On RackSpace Cloud

By leerb on March 3, 2012 in Uncategorized

Today we’re going to setup an NFS server and client on a pair of RackSpace Cloud Servers.

To get started create two cloud servers – one will be the NFS server and the other will be the NFS client. We’ll be using CentOS (RHEL) for our project but you can use the distribution of your choice.

We’re going to do the NFS share over the Private Net interface which is a 10.x.x.x unroutable network. This way NFS is not exposed to the public network and the security issues are simplified.

Our server will be named “file01” and our client will be “client01”. We will share the /data directory tree on the server and mount it to /data on the client.

Server

Install necessary packages. You’ll need nfs-utils and portmap. Additional dependent packages will be installed automatcially:

yum install nfs-utils portmap

1

yum install nfs-utils portmap

Note: On RHEL6, “portmap” is now “rpcbind”.
Setup /etc/hosts. On the server, I like to add host entries to /etc/hosts for each client so that it’s easy to reference them in the configuration files. So we’ll add this line to /etc/hosts:

10.10.232.1 client01-private

1

10.10.232.1 client01-private

Remember to use the private address of the client. We want the NFS traffic to use the non-public network for improved security.
Setup /etc/exports. This text file defines what paths will be shared and to whom. Here is a simple case sharing /data to a single client:

/data client01-private(rw,no_root_squash)

1

/data client01-private(rw,no_root_squash)

There are a number of different configuration options available for the /etc/exports file. See the man page for full details.
Setup /etc/hosts.allow. This text file defines access controls for the NFS related services. Here’s an example configuration:

portmap: client01-private lockd: client01-private rquotad: client01-private mountd: client01-private statd: client01-private

1
2
3
4
5

portmap: client01-private
lockd: client01-private
rquotad: client01-private
mountd: client01-private
statd: client01-private
Setup iptables. Edit the /etc/sysconfig/iptables file and add the following line to the RH-Firewall-1-INPUT table right before the final COMMIT:

-A RH-Firewall-1-INPUT -s 10.176.97.227 -j ACCEPT

1

-A RH-Firewall-1-INPUT -s 10.176.97.227 -j ACCEPT

Notice that the IP address is the private interface on the client. You’ll need to add additional lines if you have more then one client. This is a very simple rule that allows all traffic from the client to the server. Now restart iptables:

/sbin/service iptables restart

1

/sbin/service iptables restart
Configure startup. Use the following commands to configure the nfs and portmap services to start on boot.

/sbin/chkconfig --level 345 portmap on /sbin/chkconfig --level 345 nfs on

1
2

/sbin/chkconfig --level 345 portmap on
/sbin/chkconfig --level 345 nfs on
Start services. Start or restart the portmap and nfs services. You’ll need to do this anytime that you change the NFS configuration.

/sbin/service portmap restart /sbin/service nfs restart

1
2

/sbin/service portmap restart
/sbin/service nfs restart

Client

Install necessary packages. You’ll need nfs-utils and portmap. Additional dependent packages will be installed automatcially:

yum install nfs-utils portmap

1

yum install nfs-utils portmap
Setup /etc/hosts. On the server, I like to add host entries to /etc/hosts for the server so that it’s easy to reference them in the configuration files. So we’ll add this line to /etc/hosts:

10.10.232.2 file01-private

1

10.10.232.2 file01-private

Remember to use the private address of the client. We want the NFS traffic to use the non-public network for improved security.
Configure startup. Use the following commands to configure the portmap service to start on boot.

/sbin/chkconfig --level 345 portmap on

1

/sbin/chkconfig --level 345 portmap on
Start portmap service. Start or restart the portmap.

/sbin/service portmap restart

1

/sbin/service portmap restart
Setup /etc/fstab. The /etc/fstab text file contains a list of filesystems that should be mounted on the client server. We need to add new line at the bottom of the file for our NFS server. Here’s an example:

file01-private:/data /data nfs rw,hard,intr 0 0

1

file01-private:/data /data nfs rw,hard,intr 0 0

Notice that we’ve stated that the /data share on file01-private should be mounted to /data on the client server.
Create the mount point. The mount point is just an empty directory to which the remote filesystem will be connected.

mkdir /data

1

mkdir /data
Mount the share. Next step is to mount the share with this command:

mount /data

1

mount /data

And now you should have a working NFS mount of file01:/data to client01:/data.

If it’s not working, here’s a good page of advice on how to troubleshoot:

http://tldp.org/HOWTO/NFS-HOWTO/troubleshooting.html

Syncing Content Between RackSpace Cloud Servers With Unison

By admin on June 2, 2011 in Misc, Uncategorized

We have two RackSpace Cloud Server running CentOS that need to have the web content kept in sync. Changes on either server need to be replicated to the other server. Easy way to get this accomplished is with the Unison File Syncronizer (http://www.cis.upenn.edu/~bcpierce/unison/). Here are the steps:

1. Install SSH keys for root on each server so SSH can run without passwords between the servers.

2. Add /etc/hosts file entries to map the private addresses of the servers to names.

192.168.10.1 web1-priv
192.168.10.2 web2-priv

1 2	192.168.10.1 web1-priv 192.168.10.2 web2-priv

3. Install Unison on each server:

yum install unison227

1	yum install unison227

4. Create a profile on each server at /root/.unison/sync_web.prf containing:

# Reasonable defaults
auto=true
confirmbigdeletes=true
contactquietly=true
group=true
maxthreads=20
numericids=true
owner=true
times=true

# Skip confirmation
batch=true

# Log all sync operations
log=true
logfile=/var/log/unison.log

# Backup deleted files
backup=Name *
backuplocation=central
backupdir=/var/www/vhosts/mydomain.com/backup/
maxbackups=5

# Local root
root=/var/www/vhosts/mydomain.com/httpdocs/

# Remote root (the double forward-slash between IP and remote path is correct)
root=ssh://<font style="color:red">web2-priv</font>///var/www/vhosts/mydomain.com/httpdocs/

# Resolve conflicts in favor of local root
prefer=newer

# Don't sync (can specify multiple ignore lines)
#ignore=Path */var/cache

# Reasonable defaults

auto=true

confirmbigdeletes=true

contactquietly=true

group=true

maxthreads=20

numericids=true

owner=true

times=true

# Skip confirmation

batch=true

# Log all sync operations

log=true

logfile=/var/log/unison.log

# Backup deleted files

backup=Name *

backuplocation=central

backupdir=/var/www/vhosts/mydomain.com/backup/

maxbackups=5

# Local root

root=/var/www/vhosts/mydomain.com/httpdocs/

# Remote root (the double forward-slash between IP and remote path is correct)

root=ssh://<font style="color:red">web2-priv</font>///var/www/vhosts/mydomain.com/httpdocs/

# Resolve conflicts in favor of local root

prefer=newer

# Don't sync (can specify multiple ignore lines)

#ignore=Path */var/cache

Notice the hostname “web2-priv” in red above. The file on web1 should reference web2-priv. The file on web2 should reference web1-priv.

You’ll need to adjust the path listed in the file to match your environment.

5. Next create a script to run Unison with the profile created in the previous step. Name the script /root/sync_web.sh and make it executable.

#!/bin/bash

export HOME=/root
unison sync_web

#!/bin/bash

export HOME=/root

unison sync_web

6. Add an entry to /etc/cronjob to run Unison once per minute:

*/1 * * * * root /root/sync_web.sh > /tmp/sync.log 2>&1

1	/1 * * * root /root/sync_web.sh > /tmp/sync.log 2>&1

Everything should now be ready to go. You can test by running the sync_web.sh script manually on each server. If there are no errors then try adding, changing and removing files on both servers and verify that the changes are synced within one minute.

MySQL Load Balancing With HAProxy

By admin on March 31, 2011 in Uncategorized

The goal of this series of articles has been to construct a high availability and load balanced MySQL cluster with CentOS on the RackSpace Cloud.

You should begin with this article to setup the HA Linux cluster:

HA Linux Cluster On RackSpace Cloud Servers

Then follow this article to add the multi-master MySQL replication:

MySQL Multi Master HA Cluster

The last part of the process is to add load balancing.

1. Start by installing HAProxy on both servers:

yum install haproxy

1	yum install haproxy

Unfortunately yum will provide an outdated version so we need to upgrade from source as follows:

cd /root/archive/
wget http://haproxy.1wt.eu/download/1.4/src/haproxy-1.4.14.tar.gz
tar -xvzf haproxy-1.4.14.tar.gz
cd haproxy-1.4.14
make TARGET=linux26
make install

cd /root/archive/

wget http://haproxy.1wt.eu/download/1.4/src/haproxy-1.4.14.tar.gz

tar -xvzf haproxy-1.4.14.tar.gz

cd haproxy-1.4.14

make TARGET=linux26

make install

Now edit /etc/init.d/haproxy and change this line:

exec="/usr/sbin/haproxy"

1	exec="/usr/sbin/haproxy"

to:

exec="/usr/local/sbin/haproxy"

1	exec="/usr/local/sbin/haproxy"

2. Now edit /etc/haproxy/haproxy.cfg

a. Remove all existing “listen”, “frontend” and “backend” sections.

b. Find this line if it exists:

option      httplog

1	option httplog

and change it to:

option      tcplog

1	option tcplog

c. Add this listen section:

listen mysql-cluster 0.0.0.0:3307
    mode tcp
    balance roundrobin
    option mysql-check user root

    server db01 [HOST1_IP]:3306 check
    server db02 [HOST2_IP]:3306 check

listen mysql-cluster 0.0.0.0:3307

mode tcp

balance roundrobin

option mysql-check user root

server db01 [HOST1_IP]:3306 check

server db02 [HOST2_IP]:3306 check

The [PASSWORD] controls access to the HAProxy web interface. And [HOST1_IP] and [HOST2_IP] are the private addresses of the servers.

d. Repeat on the other server.

3. Set haproxy service to start on boot:

/sbin/chkconfig --level 345 haproxy on

1	/sbin/chkconfig --level 345 haproxy on

4. Finally start the haproxy service.

/sbin/service haproxy restart

← Previous 1 … 3 4 5 … 7 Next →

Need help immediately?

$100/hour
Satisfaction Guaranteed

Top Nav

Navigation