Category: Reliable Penguin

Find group writable home directories

March 22, 2009

With procmail, vacation and forward files do not work if the user’s home directory is group writable. Here’s a script that will locate all group writable home directories:

#!/usr/bin/perl

my %users;
open(P,"/etc/passwd");
while(<p>) {
        chomp();
        my ($uname,$pass,$uid,$gid,$gecos,$home,$shell) = split(/\:/,$_);
        $users{$uname} = $home;
};
close P;

LINE: foreach $user (sort keys %users) {
        $home = $users{$user};
        next LINE if ($user eq "dbus");
        next LINE if ($user eq "distcache");
        next LINE if ($user eq "haldaemon");
        next LINE if ($user eq "nobody");
        next LINE if ($user eq "rpc");
        $test = `find $home -maxdepth 0 -perm -g=w -type d 2>&1`;
        chomp($test);
        if ($test ne "") {
                if ($test =~ /No such file or directory/) {
                        $msg = "NOT FOUND";
                } else {
                        print $user . " : " . $home . "\n";
                };
        };
};
</p>

#!/usr/bin/perl

my %users;

open(P,"/etc/passwd");

while(<p>) {

chomp();

my ($uname,$pass,$uid,$gid,$gecos,$home,$shell) = split(/\:/,$_);

$users{$uname} = $home;

};

close P;

LINE: foreach $user (sort keys %users) {

$home = $users{$user};

next LINE if ($user eq "dbus");

next LINE if ($user eq "distcache");

next LINE if ($user eq "haldaemon");

next LINE if ($user eq "nobody");

next LINE if ($user eq "rpc");

$test = `find $home -maxdepth 0 -perm -g=w -type d 2>&1`;

chomp($test);

if ($test ne "") {

if ($test =~ /No such file or directory/) {

$msg = "NOT FOUND";

} else {

print $user . " : " . $home . "\n";

};

</p>

Content Sync For Load Balancer With Unison

March 10, 2009

This Unison program is great. It neatly handles syncing between two servers where changes are occurring on both sides. On one client site it takes about 30 seconds to compare/sync a 23GB /var/www/html/ structure with about 100 sites. 1) Install unison (http://www.cis.upenn.edu/~bcpierce/unison/). Requires “ocaml” compiler (http://caml.inria.fr/), and needs the “etags” command from emacs (so “yum install emacs”, whatever) 2) Set up a “/root/.unison/profile-name.prf” file. See example pasted below. Comment out “batch=true” and “silent=true” for initial test runs. Uncomment them for running from a cron job. 3) Run manually to test: unison profile-name 4) If you leave the logging turned on, make an /etc/logrotate.d/unison file, something like this:


/var/log/unison.log {
       notifempty
       daily
       rotate 7
       missingok
       compress
}

/var/log/unison.log {

notifempty

daily

rotate 7

missingok

compress

}

5) Set up cron job(s). Create multiple profiles if specific paths need more frequent syncing. With silent=true, the jobs should produce no output (silent=true automatically sets batch=true). Sample profile (/root/.unison/profile-name.prf)

# Reasonable defaults
auto=true
confirmbigdeletes=true
contactquietly=true
fastcheck=true
group=true
maxthreads=20
numericids=true
owner=true
times=true

# Dump an archive listing to ~/unison.dump
#dumparchives=true

# Skip confirmation
batch=true

# Suppress output (sets batch=true)
silent=true

# Run in a loop, repeating every X seconds (sort of daemon mode)
#repeat=60

# Log all sync operations
log=true
logfile=/var/log/unison.log

# Backup deleted files
backup=Name *
backuplocation=central
backupdir=/var/www/unison-backups


# Local root
root=/var/www/html/

# Remote root (the double forward-slash between IP and remote path is correct)
root=ssh://1.2.3.4//var/www/html/

# Resolve conflicts in favor of local root
prefer=/var/www/html/


# Limit to specific relative path (can specify multiple path= params)
#path=somepath/

# Don't sync (can specify multiple ignore lines)
ignore=Path */var/cache

# Reasonable defaults

auto=true

confirmbigdeletes=true

contactquietly=true

fastcheck=true

group=true

maxthreads=20

numericids=true

owner=true

times=true

# Dump an archive listing to ~/unison.dump

#dumparchives=true

# Skip confirmation

batch=true

# Suppress output (sets batch=true)

silent=true

# Run in a loop, repeating every X seconds (sort of daemon mode)

#repeat=60

# Log all sync operations

log=true

logfile=/var/log/unison.log

# Backup deleted files

backup=Name *

backuplocation=central

backupdir=/var/www/unison-backups

# Local root

root=/var/www/html/

# Remote root (the double forward-slash between IP and remote path is correct)

root=ssh://1.2.3.4//var/www/html/

# Resolve conflicts in favor of local root

prefer=/var/www/html/

# Limit to specific relative path (can specify multiple path= params)

#path=somepath/

# Don't sync (can specify multiple ignore lines)

ignore=Path */var/cache

SED Search / Replace Multiple Files

March 5, 2009

I’m a big fan of the “replace” utility included in the mysql client package. With this utility you can search/replace a string of text across multiple files like this:

replace 'from-string' 'to-string' -- start-folder/*.pl

1	replace 'from-string' 'to-string' -- start-folder/*.pl

Quick and easy! But on occasion I’m on a system that doesn’t have the mysql client package so here’s a similar function using find and sed:

find start-folder/ -name '*.pl' -exec sed -iorig 's/from-string/to-string/' {} \;

1	find start-folder/ -name '*.pl' -exec sed -iorig 's/from-string/to-string/' {} \;

Forcing ARP table flush

January 26, 2009

I just ran across this method for remotely forcing a gateway to flush an arp entry when you move IP addresses around. 1) Download/install “arping” from the following URL. System will need libnet-devel and libpcap: http://www.habets.pp.se/synscan/programs.php?prog=arping 2) Run this command: arping -c 1 -S a.a.a.a b.b.b.b Where “a.a.a.a” is the IP you’ve moved, and “b.b.b.b” is the gateway IP. Run this from the server to which you moved the IP. This should force the gateway to flush its arp entry for that source IP.

Plesk Horde Vulnerablity Fix

January 26, 2009

Below is the quick fix for the Plesk-Horde vulnerability. Manually apply a patch to the Horde Permission’s User Interface code to “remove” the “All Authenticated Users” option from the HTML form: A quick fix to hide this setting in the UI code is to add HTML comments (“<! –” … “–>”) around the “All Authenticated Users” options in the HTML form. Basically, it is to add “<! –” at line 63 and “–>” at (original) line 81 in /usr/share/psa-horde/templates/shares/edit.inc