Sunday, November 9, 2014

How to apply static route in subinterface as redundant link.

How to apply static route in subinterface, use as a redundant link.

Add caption

 

 

 

 

 

 

 

 

 

 

 R4

interface FastEthernet1/1
 ip address 192.168.3.1 255.255.255.0
 no sh

interface FastEthernet1/0
 no sh
interface FastEthernet1/0.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.252

interface FastEthernet1/0.20
 encapsulation dot1Q 20
 ip address 20.20.20.1 255.255.255.252

 ip route 30.30.30.0 255.255.255.252 20.20.20.2

ip sla monitor 1
 type echo protocol ipIcmpEcho 10.10.10.2 source-interface FastEthernet1/0.10
 threshold 500
 frequency 5
ip sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
ip route 192.168.50.0 255.255.255.0 10.10.10.2 track 1

ip sla monitor 2
 type echo protocol ipIcmpEcho 30.30.30.1 source-interface FastEthernet1/0.20
 threshold 500
 frequency 5
ip sla monitor schedule 2 life forever start-time now
track 2 rtr 2 reachability
ip route 192.168.50.0 255.255.255.0 20.20.20.2 2 track 2

                  R6

 interface FastEthernet1/0
 no sh
!
interface FastEthernet1/0.20
 encapsulation dot1Q 20
 ip address 20.20.20.2 255.255.255.252

interface FastEthernet1/1
 no sh

interface FastEthernet1/1.30
 encapsulation dot1Q 30
 ip address 30.30.30.2 255.255.255.252

ip route 192.168.3.0 255.255.255.0 20.20.20.1
ip route 192.168.50.0  255.255.255.0 30.30.30.1

        R5

interface FastEthernet1/1
 ip address 192.168.50.1 255.255.255.0
     no sh
interface FastEthernet1/0
     no sh
interface FastEthernet1/0.10
     encapsulation dot1Q 10
ip address 10.10.10.2 255.255.255.252
interface FastEthernet1/0.30
   encapsulation dot1Q 30
ip address 30.30.30.1 255.255.255.252
ip route 20.20.20.0 255.255.255.252 30.30.30.2
ip sla monitor 1
   type echo protocol ipIcmpEcho 10.10.10.1 source-interface FastEthernet1/0.10
   threshold 500
   frequency 5
ip sla monitor schedule 1 life forever start-time now
   track 1 rtr 1 reachability
ip route 192.168.3.0 255.255.255.0 10.10.10.1 track 1

ip sla monitor 2
    type echo protocol ipIcmpEcho 20.20.20.1 source-interface FastEthernet1/0.30
    threshold 500
    frequency 5
ip sla monitor schedule 2 life forever start-time now
    track 2 rtr 2 reachability
ip route 192.168.3.0 255.255.255.0 30.30.30.2 2 track 2



IF any link is DOWN and UP,  result is below.




Sunday, November 2, 2014

POP3-SSL auth with stunnel in Qmail, OS- centOS

So lets get started shall we? :)  :
yum install stunnel

mkdir -p /var/qmail/supervise/qmail-pop3s/log
vim /var/qmail/supervise/qmail-pop3s/run
 #!/bin/sh
exec /usr/local/bin/softlimit -m 40000000 \
/usr/local/bin/tcpserver -H -R -v -l 0 -c100 0 995 \
/usr/bin/stunnel /etc/stunnel/pop3s.conf \
-l /var/qmail/bin/qmail-popup -- qmail-popup mail.ribtechbd.com \
/home/vpopmail/bin/vchkpw \
/var/qmail/bin/qmail-pop3d Maildir 2>&1

Note: Stunnel directory dependents*: /usr/bin/stunnel 

vi /var/qmail/supervise/qmail-pop3s/log/run
#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t n1000 s2000000 /var/log/qmail/qmail-pop3s 2>&1

 

Note: Stunnel directory dependents*: /usr/bin/stunnel
vim /etc/stunnel/pop3s.conf
cert = /var/qmail/control/servercert.pem


# Those to are only necessary for file logging, default is stdout

debug = 7

output = /etc/stunnel/stunnel.log


#####

client = no

foreground = yes

exec = /var/qmail/bin/qmail-popup
execargs = /var/qmail/bin/qmail-popup mail.ribtechbd.com /home/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir

chmod +x /etc/stunnel/pop3s.conf
chmod +x /var/qmail/supervise/qmail-pop3s/run
chmod +x /var/qmail/supervise/qmail-pop3s/log/run
cp -rfp /var/log/qmail/qmail-pop3d /var/log/qmail/qmail-pop3s
touch /etc/stunnel/stunnel.log
chmod 777 /etc/stunnel/stunnel.log
 ln -s /var/qmail/supervise/qmail-pop3s /service/
 **********************************************************************************


IT working fine. 
(rajib)

Saturday, October 11, 2014

SAMBA FILE SERVER AND WINDOWS ACTIVE DIRECTORY

SAMBA FILE SERVER AND WINDOWS ACTIVE DIRECTORY

ADS and DNS server IP : 192.168.3.14

Samba server IP: 192.168.3.13
yum install samba-*
yum install krb5-*
*************************************************
# /etc/resolv.conf
    search aiamibd.com
    nameserver 192.168.3.14


*************************************************

# /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = AIAMIBD.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]

 AIAMIBD.COM = {
  kdc = aia.aiamibd.com
 }

[domain_realm]
 .aiamibd.com = AIAMIBD.COM
 aiamibd.com = AIAMIBD.COM

************************************************

# /etc/nsswitch.conf
#
passwd:     files winbind compat
shadow:     files winbind compat
group:      files winbind compat

#hosts:     db files nisplus nis dns
hosts:      files dns winbind

*************************************************

# Add samba server to domain user

net ads join -U administrator


/etc/init.d/winbind restart
/etc/init.d/smb restart
/etc/init.d/nmb restart

# check it
kinit administrator
klist
wbinfo -u
wbinfo -g




*************************************************

 Global Settings
   
[global]

   workgroup = AIAMIBD
   password server = aia.aiamibd.com
   realm = AIAMIBD.COM
   security = ads
   idmap config * : range = 16777216-33554431
   template shell = /bin/bash
   winbind use default domain = yes
   winbind offline logon = true
   
# ----------------------- Network Related Options -------------------------
    server string = Samba Server Version %v
    hosts allow = 127. 192.168.
   
# --------------------------- Logging Options -----------------------------
# Max Log Size let you specify the max size log files should reach
   
    # logs split per machine
    log file = /var/log/samba/log.%m
    # max 50KB per log file, then rotate
    max log size = 50
   
# ----------------------- Standalone Server Options ------------------------
    passdb backend = tdbsam

#============================ Share Definitions ==============================
   
[homes]
    comment = Home Directories
    browseable = yes
    writable = yes
    valid users = %S
    valid users = AIAMIBD\%S

[omes]
        comment = omes Directories
              path  = /omes
        browseable  = yes
        writable    = yes
        valid users = @"AIAMIBD\Domain Users"
       
        (Note: Permission to access omes folder for All Domain users)

[INFRA]
        comment     = Use for all domain Users
        path        = /IT
        browseable  = yes
        writable    = yes
        valid users = @"AIAMIBD\samba-infra"
       
        (Note: Permission to access INFRA folder for samba-infra group users of AD)


[Spacial]
        comment     = Use for all domain Users
        path        = /software
        browseable  = yes
        writable    = yes
        valid users = AIAMIBD\tumi ami test1

        (Note: Permission to access Spacial folder for some domain users of AD)

Wednesday, October 8, 2014

How to check if your Linux server is under DDOS Attack?

How to check if your Linux server is under DDOS Attack?


Login to your server as root and fire the following command, using  which you can check if your server is under DDOS attack or not:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort –n

This command will show you the list of IP’s which have logged in is maximum number of connections to your server.

ddos becomes more complex as attackers  use fewer connections with more number of attacking IP’s.In such cases, you should get less number of connections even when your server is under ddos.One important thing that you should check is the number of active connections that your server currently has.For that execute the following command:
netstat -n | grep :80 |wc –l

The above command will show the active connections that are open to your server.
You can also fire the following command :
netstat -n | grep :80 | grep SYN |wc –l

Result of active connections from the first command will vary but if it shows connections more than 500, then you will be definitely having problems. If the result after you fire second command is 100 or above then you are having problems with sync attack.
Once you get an idea of the ip attacking your server, you can easily block it.
Fire the following command to block that ip or any other specific ip:
route add ipaddress reject

Once you block a paricular IP on the server, you can even crosscheck if the IP is blocked or not
by using the following command:
route -n |grep IPaddress

You can also block a IP with iptables on the server by using the following command.
iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT
service iptables restart
service iptables save

After firing the above command, KILL all httpd connection and than restart httpd service by
using following command:
killall -KILL httpd
service httpd start




 https://kb.hivelocity.net/how-to-check-if-your-linux-server-is-under-ddos-attack/

Sunday, September 28, 2014

MikroTik router to CISCO ASA 8.0.2 Firewall IPSEC

MikroTik  to CISCO ASA Firewall IPSEC

IMAGE step by step

Step 1







 

ASA firewall configuration

 

interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 192.168.5.121 255.255.255.0

interface Ethernet0/2
 nameif dmz
 security-level 50
 ip address 192.168.6.1 255.255.255.0
!
access-list nonata2m extended permit ip host 192.168.6.2 host 192.168.3.254
access-list a2m extended permit ip host 192.168.6.2 host 192.168.3.254
nat (dmz) 0 access-list nonata2m

crypto ipsec transform-set asamik esp-3des esp-md5-hmac
crypto map asavpn 10 match address a2m
crypto map asavpn 10 set peer 192.168.5.1
crypto map asavpn 10 set transform-set asamik
crypto map asavpn 10 set security-association lifetime seconds 86400
crypto map asavpn interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

tunnel-group 192.168.5.1 type ipsec-l2l
tunnel-group 192.168.5.1 ipsec-attributes
 pre-shared-key *

 

Friday, September 26, 2014

Very Simple Network Diagram with Cisco ASA 5520


 Apply IP Address to Interface

 interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 192.168.5.121 255.255.255.0
 no sh
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.4.1 255.255.255.0
 no sh

 !
interface Ethernet0/2
 nameif dmz
 security-level 50
 ip address 192.168.6.1 255.255.255.0
 no sh
!

NAT 0 for Without address translate inside to dmz
access-list no-nat extended permit ip 192.168.4.0 255.255.255.0 192.168.6.0 255.255.255.0
nat (inside) 0 access-list no-nat
******************************************************
Allow web side from DMA to Inside host, and Outside

access-list dmz-in extended permit tcp host 192.168.6.2 any eq www
access-list dmz-in extended permit udp host 192.168.6.2 any eq domain
access-list dmz-in extended permit tcp host 192.168.6.2 any eq domain
access-list dmz-in extended permit tcp host 192.168.6.2 any eq https

Allow Ping from DMA
access-list dmz-in extended permit icmp 192.168.6.0 255.255.255.0 any
access-list dmz-in extended deny tcp any any log
access-group dmz-in in interface dmz
*******************************************************
Allow All from inside
access-list inside-in extended permit ip any any log
access-group inside-in in interface inside

*******************************************************
Allow web server from internet with port forward of DMZ WEB Server 192.168.6.2
access-list OUTSIDE_IN extended permit tcp any host 192.168.5.120 eq www
static (dmz,outside) tcp 192.168.5.120 8080 192.168.6.2 www netmask 255.255.255.255
access-group OUTSIDE_IN in interface outside

Allow NAT with inside and DMZ
global (outside) 1 interface
nat (inside) 1 192.168.4.0 255.255.255.0
nat (dmz) 1 192.168.6.0 255.255.255.0


Default Route
route outside 0.0.0.0 0.0.0.0 192.168.5.1 1

Monday, September 1, 2014

Rsync (Remote Sync): 10 Practical Examples of Rsync Command in Linux

Some advantages and features of Rsync command
  1. It efficiently copies and sync files to or from a remote system.
  2. Supports copying links, devices, owners, groups and permissions.
  3. It’s faster than scp (Secure Copy) because rsync uses remote-update protocol which allows to transfer just the differences between two sets of files. First time, it copies the whole content of a file or a directory from source to destination but from next time, it copies only the changed blocks and bytes to the destination.
  4. Rsync consumes less bandwidth as it uses compression and decompression method while sending and receiving data both ends.
Basic syntax of rsync command
# rsync options source destination
Some common options used with rsync commands
  1. -v : verbose
  2. -r : copies data recursively (but don’t preserve timestamps and permission while transferring data
  3. -a : archive mode, archive mode allows copying files recursively and it also preserves symbolic links, file permissions, user & group ownerships and timestamps
  4. -z : compress file data
  5. -h : human-readable, output numbers in a human-readable format
Install rsync in your Linux machine
We can install rsync package with the help of following command.
# yum install rsync (On Red Hat based systems)
# apt-get install rsync (On Debian based systems)

1. Copy/Sync Files and Directory Locally

Copy/Sync a File on a Local Computer
This following command will sync a single file on a local machine from one location to another location. Here in this example, a file name backup.tar needs to be copied or synced to /tmp/backups/ folder.
[root@tecmint]# rsync -zvh backup.tar /tmp/backups/

created directory /tmp/backups

backup.tar

sent 14.71M bytes  received 31 bytes  3.27M bytes/sec

total size is 16.18M  speedup is 1.10
In above example, you can see that if the destination is not already exists rsync will create a directory automatically for destination.
Copy/Sync a Directory on Local Computer
The following command will transfer or sync all the files of from one directory to a different directory in the same machine. Here in this example, /root/rpmpkgs contains some rpm package files and you want that directory to be copied inside /tmp/backups/ folder.
[root@tecmint]# rsync -avzh /root/rpmpkgs /tmp/backups/

sending incremental file list

rpmpkgs/

rpmpkgs/httpd-2.2.3-82.el5.centos.i386.rpm

rpmpkgs/mod_ssl-2.2.3-82.el5.centos.i386.rpm

rpmpkgs/nagios-3.5.0.tar.gz

rpmpkgs/nagios-plugins-1.4.16.tar.gz

sent 4.99M bytes  received 92 bytes  3.33M bytes/sec

total size is 4.99M  speedup is 1.00

2. Copy/Sync Files and Directory to or From a Server

Copy a Directory from Local Server to a Remote Server
This command will sync a directory from a local machine to a remote machine. For example: There is a folder in your local computer “rpmpkgs” which contains some RPM packages and you want that local directory’s content send to a remote server, you can use following command.
[root@tecmint]$ rsync -avz rpmpkgs/ root@192.168.0.101:/home/

root@192.168.0.101's password:

sending incremental file list

./

httpd-2.2.3-82.el5.centos.i386.rpm

mod_ssl-2.2.3-82.el5.centos.i386.rpm

nagios-3.5.0.tar.gz

nagios-plugins-1.4.16.tar.gz

sent 4993369 bytes  received 91 bytes  399476.80 bytes/sec

total size is 4991313  speedup is 1.00
Copy/Sync a Remote Directory to a Local Machine
This command will help you sync a remote directory to a local directory. Here in this example, a directory /home/tarunika/rpmpkgs which is on a remote server is being copied in your local computer in /tmp/myrpms.
[root@tecmint]# rsync -avzh root@192.168.0.100:/home/tarunika/rpmpkgs /tmp/myrpms

root@192.168.0.100's password:

receiving incremental file list

created directory /tmp/myrpms

rpmpkgs/

rpmpkgs/httpd-2.2.3-82.el5.centos.i386.rpm

rpmpkgs/mod_ssl-2.2.3-82.el5.centos.i386.rpm

rpmpkgs/nagios-3.5.0.tar.gz

rpmpkgs/nagios-plugins-1.4.16.tar.gz

sent 91 bytes  received 4.99M bytes  322.16K bytes/sec

total size is 4.99M  speedup is 1.00

3. Rsync Over SSH

With rsync, we can use SSH (Secure Shell) for data transfer, using SSH protocol while transferring our data you can be ensured that your data is being transferred in a secured connection with encryption so that nobody can read your data while it is being transferred over the wire on the internet.
Also when we use rsync we need to provide the user/root password to accomplish that particular task, so using SSH option will send your logins in an encrypted manner so that your password will be safe.
Copy a File from a Remote Server to a Local Server with SSH
To specify a protocol with rsync you need to give “-e” option with protocol name you want to use. Here in this example, We will be using “ssh” with “-e” option and perform data transfer.
[root@tecmint]# rsync -avzhe ssh root@192.168.0.100:/root/install.log /tmp/

root@192.168.0.100's password:

receiving incremental file list

install.log

sent 30 bytes  received 8.12K bytes  1.48K bytes/sec

total size is 30.74K  speedup is 3.77
Copy a File from a Local Server to a Remote Server with SSH
[root@tecmint]# rsync -avzhe ssh backup.tar root@192.168.0.100:/backups/

root@192.168.0.100's password:

sending incremental file list

backup.tar

sent 14.71M bytes  received 31 bytes  1.28M bytes/sec

total size is 16.18M  speedup is 1.10

4. Show Progress While Transferring Data with rsync

To show the progress while transferring the data from one machine to a different machine, we can use ‘–progress’ option for it. It displays the files and the time remaining to complete the transfer.
[root@tecmint]# rsync -avzhe ssh --progress /home/rpmpkgs root@192.168.0.100:/root/rpmpkgs

root@192.168.0.100's password:

sending incremental file list

created directory /root/rpmpkgs

rpmpkgs/

rpmpkgs/httpd-2.2.3-82.el5.centos.i386.rpm

           1.02M 100%        2.72MB/s        0:00:00 (xfer#1, to-check=3/5)

rpmpkgs/mod_ssl-2.2.3-82.el5.centos.i386.rpm

          99.04K 100%  241.19kB/s        0:00:00 (xfer#2, to-check=2/5)

rpmpkgs/nagios-3.5.0.tar.gz

           1.79M 100%        1.56MB/s        0:00:01 (xfer#3, to-check=1/5)

rpmpkgs/nagios-plugins-1.4.16.tar.gz

           2.09M 100%        1.47MB/s        0:00:01 (xfer#4, to-check=0/5)

sent 4.99M bytes  received 92 bytes  475.56K bytes/sec

total size is 4.99M  speedup is 1.00

5. Use of –include and –exclude Options

These two options allows us to include and exclude files by specifying parameters with these option helps us to specify those files or directories which you want to include in your sync and exclude files and folders with you don’t want to be transferred.
Here in this example, rsync command will include those files and directory only which starts with ‘R’ and exclude all other files and directory.
[root@tecmint]# rsync -avze ssh --include 'R*' --exclude '*' root@192.168.0.101:/var/lib/rpm/ /root/rpm

root@192.168.0.101's password:

receiving incremental file list

created directory /root/rpm

./

Requirename

Requireversion

sent 67 bytes  received 167289 bytes  7438.04 bytes/sec

total size is 434176  speedup is 2.59

6. Use of –delete Option

If a file or directory not exist at the source, but already exists at the destination, you might want to delete that existing file/directory at the target while syncing .
We can use ‘–delete‘ option to delete files that are not there in source directory.
Source and target are in sync. Now creating new file test.txt at the target.
[root@tecmint]# touch test.txt
[root@tecmint]# rsync -avz --delete root@192.168.0.100:/var/lib/rpm/ .
Password:
receiving file list ... done
deleting test.txt
./
sent 26 bytes  received 390 bytes  48.94 bytes/sec
total size is 45305958  speedup is 108908.55
Target has the new file called test.txt, when synchronize with the source with ‘–delete‘ option, it removed the file test.txt.

7. Set the Max Size of Files to be Transferred

You can specify the Max file size to be transferred or sync. You can do it with “–max-size” option. Here in this example, Max file size is 200k, so this command will transfer only those files which are equal or smaller than 200k.
[root@tecmint]# rsync -avzhe ssh --max-size='200k' /var/lib/rpm/ root@192.168.0.100:/root/tmprpm

root@192.168.0.100's password:

sending incremental file list

created directory /root/tmprpm

./

Conflictname

Group

Installtid

Name

Provideversion

Pubkeys

Requireversion

Sha1header

Sigmd5

Triggername

__db.001

sent 189.79K bytes  received 224 bytes  13.10K bytes/sec

total size is 38.08M  speedup is 200.43

8. Automatically Delete source Files after successful Transfer

Now, suppose you have a main web server and a data backup server, you created a daily backup and synced it with your backup server, now you don’t want to keep that local copy of backup in your web server.
So, will you wait for transfer to complete and then delete those local backup file manually? Of Course NO. This automatic deletion can be done using ‘–remove-source-files‘ option.
[root@tecmint]# rsync --remove-source-files -zvh backup.tar /tmp/backups/

backup.tar

sent 14.71M bytes  received 31 bytes  4.20M bytes/sec

total size is 16.18M  speedup is 1.10

[root@tecmint]# ll backup.tar

ls: backup.tar: No such file or directory

9. Do a Dry Run with rsync

If you are a newbie and using rsync and don’t know what exactly your command going do. Rsync could really mess up the things in your destination folder and then doing an undo can be a tedious job.
Use of this option will not make any changes only do a dry run of the command and shows the output of the command, if the output shows exactly same you want to do then you can remove ‘–dry-run‘ option from your command and run on the terminal.
root@tecmint]# rsync --dry-run --remove-source-files -zvh backup.tar /tmp/backups/

backup.tar

sent 35 bytes  received 15 bytes  100.00 bytes/sec

total size is 16.18M  speedup is 323584.00 (DRY RUN)

10. Set Bandwidth Limit and Transfer File

You can set the bandwidth limit while transferring data from one machine to another machine with the the help of ‘–bwlimit‘ option. This options helps us to limit I/O bandwidth.
[root@tecmint]# rsync --bwlimit=100 -avzhe ssh  /var/lib/rpm/  root@192.168.0.100:/root/tmprpm/
root@192.168.0.100's password:
sending incremental file list
sent 324 bytes  received 12 bytes  61.09 bytes/sec
total size is 38.08M  speedup is 113347.05
Also, by default rsync syncs changed blocks and bytes only, if you want explicitly want to sync whole file then you use ‘-W‘ option with it.
[root@tecmint]# rsync -zvhW backup.tar /tmp/backups/backup.tar
backup.tar
sent 14.71M bytes  received 31 bytes  3.27M bytes/sec
total size is 16.18M  speedup is 1.10
That’s all with rsync now, you can see man pages for more options. Stay connected with Tecmint for more exciting and interesting tutorials in future. Do leave your comments and suggestions.

Installing Rsnapshot Backup in Linux

Step 1: Installing Rsnapshot Backup in Linux

Installation of rsnapshot using Yum and APT may differs slightly, if you’re using Red Hat and Debian based distributions.
On RHEL/CentOS
First you will have to install and enable third-party repository called EPEL. Please follow below link to install and enable under your RHEL/CentOS systems. Fedora users don’t require any special repository configurations.
  1. Install and Enable EPEL Repository in RHEL/CentOS 6/5/4
Once you get things setup, install rsnapshot from the command line as shown.
# yum install rsnapshot
On Debian/Ubuntu/Linux Mint
By default, rsnapshot included in Ubuntu’s repositories, so you can install it using apt-get command as shown.
# apt-get install rsnapshot

Step 2: Setting up SSH Password-less Login

To backup remote Linux servers, your rsnapshot backup server will be able to connect through SSH without a password. To accomplish this, you will need to create an SSH public and private keys to authenticate on the rsnapshot server. Please follow below link to generate a public and private keys on your rsnapshot backup server.
  1. http://nilgodhuli.blogspot.com/2014/09/ssh-passwordless-login-using-ssh-keygen.html

Step 3: Configuring Rsnapshot

Now you will need to edit and add some parameters to rsnapshot configuration file. Open rsnapshot.conf file with vi or nano editor.
# vi /etc/rsnapshot.conf
Next create a backup directory, where you want to store all your backups. In my case my backup directory location is “/data/backup/”. Search for and edit the following parameter to set the backup location.
snapshot_root    /data/backup/
Also uncomment the “cmd_ssh” line to allow to take remote backups over SSH. To uncomment the line remove the “#” in-front of the following line so that rsnapshot can securely transfer your data to a backup server.
cmd_ssh   /usr/bin/ssh
Next, you need to decide how many old backups you would like to keep, because rsnapshot had no idea how often you want to take snapshots. You need to specify how much data to save, add intervals to keep, and how many of each.
Well, the default settings are good enough, but still I would like you to enable “monthly” interval so that you could also have longer term backups in place. Please edit this section to look similar to below settings.
#########################################
#           BACKUP INTERVALS            #
# Must be unique and in ascending order #
# i.e. hourly, daily, weekly, etc.      #
#########################################

interval        hourly  6
interval        daily   7
interval        weekly  4
interval        monthly 3
One more thing you need to edit is “ssh_args” variable. If you have changed the default SSH Port (22) to something else, you need to specify that port number of your remote backing up server.
ssh_args  -p 7851
Finally, add your local and remote backup directories that you want to backup.
Backup Local Directories
If you’ve decided to backup your directories locally to the same machine, the backup entry would look like this. For example, I am taking backup of my /tecmint and /etc directories.
backup  /tecmint/  localhost/
backup  /etc/   localhost/
Backup Remote Directories
If you would like to backup up a remote server directories, then you need to tell the rsnapshot where the server is and which directories you want to backup. Here I am taking a backup of my remote server “/home” directory under “/data/backup” directory on rsnapshot server.
backup   root@example.com:/home/   /data/backup/
Read Also:
  1. How to Backup/Sync Directories Using Rsync (Remote Sync) Tool
  2. How to Transfer Files/Folders Using SCP Command
Exclude Files and Directories
Here, I’m going to exclude everything, and then only specifically define what I want to backed up. To do this, you need to create a exclude file.
# vi /data/backup/tecmint.exclude
First get the list of directories that you want to backed up and add ( - * ) to exclude everything else. This will only backup what you listed in the file. My exclude file looks like similar to below.
+ /boot
+ /data
+ /tecmint
+ /etc
+ /home
+ /opt
+ /root
+ /usr
- /usr/*
- /var/cache
+ /var
- /*
Using exclude file option can be very tricky due to use of rsync recursion. So, my above example may not be what you are looking. Next add the exclude file to rsnapshot.conf file.
exclude_file    /data/backup/tecmint.exclude
Finally, you are almost finished with the initial configuration. Save the “/etc/rsnapshot.conf” configuration file before moving further. There are many options to explain, but here is my sample configuration file.
config_version  1.2
snapshot_root   /data/backup/
cmd_cp  /bin/cp
cmd_rm  /bin/rm
cmd_rsync       /usr/bin/rsync
cmd_ssh /usr/bin/ssh
cmd_logger      /usr/bin/logger
cmd_du  /usr/bin/du
interval        hourly  6
interval        daily   7
interval        weekly  4
interval        monthly 3
ssh_args -p 25000
verbose  2
loglevel        4
logfile /var/log/rsnapshot/
exclude_file    /data/backup/tecmint.exclude
rsync_long_args --delete        --numeric-ids   --delete-excluded
lockfile        /var/run/rsnapshot.pid
backup  /tecmint/  localhost/
backup  /etc/   localhost/
backup  root@example.com:/home/   /data/backup/
All the above options and argument explanations are as follows:
  1. config_version 1.2 = Configuration file version
  2. snapshot_root = Backup Destination to store snapshots
  3. cmd_cp = Path to copy command
  4. cmd_rm = Path to remove command
  5. cmd_rsync = Path to rsync
  6. cmd_ssh = Path to SSH
  7. cmd_logger = Path to shell command interface to syslog
  8. cmd_du = Path to disk usage command
  9. interval hourly = How many hourly backups to keep.
  10. interval daily = How many daily backups to keep.
  11. interval weekly = How many weekly backups to keep.
  12. interval monthly = How many monthly backups to keep.
  13. ssh_args = Optional SSH arguments, such as a different port (-p )
  14. verbose = Self-explanatory
  15. loglevel = Self-explanatory
  16. logfile = Path to logfile
  17. exclude_file = Path to the exclude file (will be explained in more detail)
  18. rsync_long_args = Long arguments to pass to rsync
  19. lockfile = Self-explanatory
  20. backup = Full path to what to be backed up followed by relative path of placement.

Step 4: Verify Rsnapshot Configuration

Once you’ve done with your all configuration, its time to verify that everything works as expected. Run the following command to verify that your configuration has the correct syntax.
# rsnapshot configtest

Syntax OK
If everything configured correctly, you will receive a “Syntax OK” message. If you get any error messages, that means you need to correct those errors before running rsnapshot.
Next, do a test run on one of the snapshot to make sure that we are generating correct results. We take the “hourly” parameter to do a test run using -t (test) argument. This below command will display a verbose list of the things it will do, without actually doing them.
# rsnapshot -t hourly
Sample Output
echo 2028 > /var/run/rsnapshot.pid 
mkdir -m 0700 -p /data/backup/ 
mkdir -m 0755 -p /data/backup/hourly.0/ 
/usr/bin/rsync -a --delete --numeric-ids --relative --delete-excluded /home \
    /backup/hourly.0/localhost/ 
mkdir -m 0755 -p /backup/hourly.0/ 
/usr/bin/rsync -a --delete --numeric-ids --relative --delete-excluded /etc \
    /backup/hourly.0/localhost/ 
mkdir -m 0755 -p /data/backup/hourly.0/ 
/usr/bin/rsync -a --delete --numeric-ids --relative --delete-excluded \
    /usr/local /data/backup/hourly.0/localhost/ 
touch /data/backup/hourly.0/
Note: The above command tells rsnapshot to create an “hourly” backup. It actually prints out the commands that it will perform when we execute it really.

Step 5: Running Rsnapshot Manually

After verifying your results, you can remove the “-t” option to run the command really.
# rsnapshot hourly
The above command will run the backup script with all the configuration that we added in the rsnapshot.conf file and creates a “backup” directory and then creates the directory structure under it that organizes our files. After running above command, you can verify the results by going to the backup directory and list the directory structure using ls -l command as shown.
# cd /data/backup
# ls -l

total 4
drwxr-xr-x 3 root root 4096 Oct 28 09:11 hourly.0

Step 6: Automating the Process

To automate the process, you need to schedule rsnapshot to be run at certain intervals from Cron. By default, rsnapshot comes with cron file under “/etc/cron.d/rsnapshot“, if it’s doesn’t exists create one and add the following lines to it.
By default rules are commented, so you need to remove the “#” from in front of the scheduling section to enable these values.
# This is a sample cron file for rsnapshot.
# The values used correspond to the examples in /etc/rsnapshot.conf.
# There you can also set the backup points and many other things.
#
# To activate this cron file you have to uncomment the lines below.
# Feel free to adapt it to your needs.

0     */4    * * *    root    /usr/bin/rsnapshot hourly
30     3     * * *    root    /usr/bin/rsnapshot daily
0      3     * * 1    root    /usr/bin/rsnapshot weekly
30     2     1 * *    root    /usr/bin/rsnapshot monthly
Let me explain exactly, what above cron rules does:
  1. Runs every 4 hours and creates an hourly directory under /backup directory.
  2. Runs daily at 3:30am and create a daily directory under /backup directory.
  3. Runs weekly on every Monday at 3:00am and create a weekly directory under /backup directory.
  4. Runs every monthly at 2:30am and create a monthly directory under /backup directory.
To better understand on how cron rules works, I suggest you read our article that describes.
  1. 11 Cron Scheduling Examples

Step 7: Rsnapshot Reports

The rsnapshot provides a nifty small reporting Perl script that sends you an email alert with all the details as to what occurred during your data backup. To setup this script, you need to copy the script somewhere under “/usr/local/bin” and make it executable.
# cp /usr/share/doc/rsnapshot-1.3.1/utils/rsnapreport.pl /usr/local/bin
# chmod +x /usr/local/bin/rsnapreport.pl
Next, add “–stats” parameter in your “rsnapshot.conf” file to the rsync’s long arguments section.
vi /etc/rsnapshot.conf
rsync_long_args --stats --delete        --numeric-ids   --delete-excluded
Now edit the crontab rules that were added earlier and call the rsnapreport.pl script to pass the reports to specified email address.
# This is a sample cron file for rsnapshot.
# The values used correspond to the examples in /etc/rsnapshot.conf.
# There you can also set the backup points and many other things.
#
# To activate this cron file you have to uncomment the lines below.
# Feel free to adapt it to your needs.

0     */4    * * *    root    /usr/bin/rsnapshot hourly 2>&1  | \/usr/local/bin/rsnapreport.pl | mail -s "Hourly Backup" yourname@email.com
30     3     * * *    root    /usr/bin/rsnapshot daily 2>&1  | \/usr/local/bin/rsnapreport.pl | mail -s "Daily Backup" yourname@email.com
0      3     * * 1    root    /usr/bin/rsnapshot weekly 2>&1  | \/usr/local/bin/rsnapreport.pl | mail -s "Weekly Backup" yourname@email.com
30     2     1 * *    root    /usr/bin/rsnapshot monthly 2>&1  | \/usr/local/bin/rsnapreport.pl | mail -s "Montly Backup" yourname@email.com
Once you’ve added above entries correctly, you will get a report to your e-mail address similar to below.
SOURCE           TOTAL FILES FILES TRANS TOTAL MB    MB TRANS   LIST GEN TIME  FILE XFER TIME
--------------------------------------------------------------------------------------------------------
localhost/          185734    11853     2889.45    6179.18    40.661 second   0.000 seconds

Reference Links

  1. rsnapshot homepage

SSH Passwordless Login Using SSH Keygen in 5 Easy Steps

First login into server 192.168.1.1 with user rajib and generate a pair of 
public keys using following command. 

[rajib@frombackup.com ~]$ ssh-keygen -t rsa

Generating public/private rsa key pair.
Enter file in which to save the key (/home/rajib/.ssh/id_rsa): [Press enter key]
Created directory '/home/rajib/.ssh'.
Enter passphrase (empty for no passphrase): [Press enter key]
Enter same passphrase again: [Press enter key]
Your identification has been saved in /home/rajib/.ssh/id_rsa.
Your public key has been saved in /home/rajib/.ssh/id_rsa.pub.
The key fingerprint is:
af:bc:25:72:d4:04:65:d9:5d:11:f0:eb:1d:89:50:4c rajib@frombackup.com
The key's randomart image is:
+--[ RSA 2048]----+
|        ..oooE.++|
|         o. o.o  |
|          ..   . |
|         o  . . o|
|        S .  . + |
|       . .    . o|
|      . o o    ..|
|       + +       |
|        +.       |
+-----------------+
 
 
Use SSH from server 192.168.1.1 to connect server 192.168.1.2 using sheena as user 
and create .ssh directory under it, using following command. 
 
[rajib@frombackup.com]$ ssh sheena@192.168.1.2 mkdir -p .ssh

The authenticity of host '192.168.1.2 (192.168.1.2)' can't be established.
RSA key fingerprint is d6:53:94:43:b3:cf:d7:e2:b0:0d:50:7b:17:32:29:2a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.2' (RSA) to the list of known hosts.
sheena@192.168.1.2's password: [Enter Your Password Here]






Use SSH from server 192.168.1.1 and upload new generated public key (id_rsa.pub) on server 192.168.1.2 under sheena‘s .ssh directory as a file name authorized_keys.

[rajib@frombackup.com]$ cat .ssh/id_rsa.pub | ssh sheena@192.168.1.2 'cat >> .ssh/authorized_keys'
sheena@192.168.1.2's password: [Enter Your Password Here]
 
 
 
 
 
Due to different SSH versions on servers, we need to set permissions on .ssh directory and authorized_keys file.

[rajib@frombackup.com]$ ssh sheena@192.168.1.2 "chmod 700 .ssh; chmod 640 .ssh/authorized_keys" sheena@192.168.1.2's password: [Enter Your Password Here]



[rajib@frombackup.com]$ ssh sheena@192.168.1.2







for more : http://www.tecmint.com/ssh-passwordless-login-using-ssh-keygen-in-5-easy-steps/
 



Thursday, March 13, 2014

Make ssl certificale for mikrotik

HTTPS connection enabling

Creating certificate
Trusted SSL Certificate can be bought from trusted authorities, for example, VeriSign. An unsigned certificate can be generated by hand, using OpenSSL on a Linux box. To do it issue following commands in the shell:
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Two important things:
  1. Enter the same pass phrase always when asked for "Enter pass phrase for server.key" (Should be 4 times);
  2. Enter your server's domain name, when asked for "Common Name (eg, YOUR name) []". This is important, because otherwise some browsers may refuse your certificate. For example, if the User Manager server's address is http://userman.mt.lv/userman, then "userman.mt.lv" must be specified as Common Name for the certificate.
After doing this three files will be created:
  1. server.crt - Certificate, must be uploaded to router;
  2. server.key - Private key, must be uploaded to router;
  3. server.csr - Signature request, can/should be deleted;
Upload server.crt and server.key to the router and import them, using the same pass phrase again when asked. server.crt must be imported before server.key.
Importing certificate
Certificate file can be then uploaded to the router and imported with command
/certificate import file-name=...
The command should return
    certificates-imported: 1
    private-keys-imported: 1
           files-imported: 1
      decryption-failures: 0
 keys-with-no-certificate: 0
If it doesn't, could happen that the file contains private key and certificate sections in incorrect order. In this situation the output should be
    certificates-imported: 1
    private-keys-imported: 0
           files-imported: 1
      decryption-failures: 0
 keys-with-no-certificate: 1
Just repeat the same command
/certificate import file-name=...
once again and the output should be this time
    certificates-imported: 0
    private-keys-imported: 1
           files-imported: 1
      decryption-failures: 0
 keys-with-no-certificate: 0
Now certificate is imported correctly and ready for use;
Enabling WWW SSL
SSL connections for WWW server can be enabled with command
/ip service set www-ssl disabled=no certificate=cert1
where cert1 must be replaced by a correct certificate name (from /certificate section)


Troubleshooting
1. Authorize.net requires that time time on the server be within 15 minutes of UTC or you will get a failed transaction, use NTP client.
2. Your user manager must be accessible from the internet on port 443, make sure you have DNS setup properly or use the IP address for all of your references. Don't forget to open your firewall for port 443 and use NAT to get to your user manager if behind a firewall.
3. You must put the URL of your UserManager instance in your Authorize.net control panel. For example: Response Reason Code: 14
Response Reason Text: The Referrer or Relay Response URL is invalid.
Notes: Applicable only to SIM and WebLink APIs. The Relay Response or Referrer URL does not match the merchant?s configured value(s) or is absent.
To add a valid Response/Receipt URL, please follow these steps:
1: Login to your Merchant Interface at https://account.authorize.net. 
2: Click Settings in the main left side menu. 
3: Click Response/Receipt URLs. 
4: Click Add URL. 
5: Enter your Response URL. 
6: Click Submit.
4. When inputting the above URL, use only the base URL, not /userman or it won't work.

Saturday, March 8, 2014

Error building eapol_test

Error building eapol_test

Thank you, it works perfectly now!

>> 1- Copy defconfig to .config
>> 2- Uncomment CONFIG_EAPOL_TEST=y
>> 3- Enter: make eapol_test
>>
>> Then it starts building it and in the end this error message is shown:
>>
>> /usr/bin/ld: cannot find -lnl
>
> This is a library used by the nl80211 driver wrapper. You will either
> need to install libnl development package or disable that driver wrapper
> in the build (comment CONFIG_DRIVER_NL80211=y).
>

Friday, March 7, 2014

Authenticating WiFi users with Windows AD + RADIUS Server


 At fast Install:
 http://nilgodhuli.blogspot.com/2014/03/installing-active-directory-on-windows.html 
then:
http://nilgodhuli.blogspot.com/2014/03/how-to-install-enterprise-certificate.html
  1. Log into the Windows server using Domain Admin credentials.
  2. Open the Server Manager console.
 In the Server Manager console right-click Roles and select Add role.
  1. When the Add Roles Wizard opens click Next.
 
 On Select Server Roles, check the box Network Policy and Access Services and click Next.

 On the Select Role Services, check the box labeled Network Policy Server and click Next.

 Network Policy Server And   Health Registration Authority

Use the local CA to issue on this computer


On the "Confirm Installation Selections" dialog, click Install.
Wait for the Installation Progress to complete.

Configuring RADIUS service

Choose Start | Ad­min­is­tra­tive Tools | Net­work Pol­icy Server
Right click on NPS and then click on Reg­is­ter server in Ac­tive Di­rec­tory
 
Stay on NPS (local) and from the right win­dow choose |RA­DIUS server for 802.1x Wire­less or Wired Con­nec­tions |Click on Con­fig­ure 802.1x

Choose |Se­cure Wire­less Con­nec­tions | Choose Name |Next

Ra­dius clients |Add

Choose a name for client | Enter IP ad­dress (it has to be fixed) of client that we are reg­is­ter­ing | Shared se­cret – Man­ual |Enter pass­word for client iden­ti­fi­ca­tion |OK

Next

Choose | Mi­crosoft Pro­tected EAP (PEAP) |Click on Con­fig­ure

Cer­tifi­cate Prop­er­ties | Se­lect Se­cured pass­word | click on Edit

Edit num­ber of au­then­ti­ca­tion re­tries to de­sired value | OK |OK

Next

Choose groups that will be able to au­then­ti­cate with RA­DIUS |Next

Next

Fin­ish
After fin­ish­ing con­fig­u­ra­tion click on Start |Ad­min­is­tra­tive Tools | Ser­vices |find NPS ser­vice and restart it.
By click­ing on Ra­dius Clients and Servers | Ra­dius Clients I can see cre­ated client. I`m now able to au­then­ti­cate with RA­DIUS.
That is the basic setup for RA­DIUS server.
You can setup RA­DIUS more de­tailed under |NPS |Poli­cies |Con­nec­tion Re­quest Poli­cies or Net­work Poli­cies

I`m now di­rect­ing my at­ten­tion to Net­work Poli­cies
Net­work Poli­cies | Choose cre­ated WiFiAP and right click| Prop­er­ties

Tab Con­straints |I have cho­sen even less se­cure au­then­ti­ca­tion meth­ods for test­ing pur­poses. In pro­duc­tion en­vi­ron­ment you should choose only most se­cure pro­to­cols.

Tab Set­tings | En­cryp­tion. For test­ing pur­poses I left all op­tions ON, in pro­duc­tion en­vi­ron­ment you should choose strongest en­cryp­tion (MPPE 128bit)
You should go through all the set­tings and setup RA­DIUS to your pref­er­ences.

ACCESS POINT setup

I used Linksys WAP54G. Setup is more or less the same for all APs. Al­though I had some APs that just won`t work with Win­dows Server based RA­DIUS server, so be care­ful when you choose your equip­ment.

Ac­cess Point should have eth­er­net con­nec­tion to the net­work en­vi­ron­ment where RA­DIUS server is lo­cated.

Ac­cess Point should be setup as fol­lows:
Sta­tic IP, same sub­net as RA­DIUS server


Setup as Ac­cess Point


Basic Wire­less Set­tings |Setup SSID name


Wire­less Se­cu­rity |Choose WPA En­ter­prise ( My AP is older so It doesn`t have WPA2 ) |En­cryp­tion AES | RA­DIUS Server: IP ad­dress of RA­DIUS server | RA­DIUS Port: it`s usu­ally 1812 |Shared se­cret: you de­fined it while cre­at­ing new client in NPS, de­sir­able value for shared se­cret is for ex­am­ple: 984752G2N3
Key re­newal: leave as it is.

Ad­vanced Wire­less Set­tings | Leave de­fault set­tings.

With this step we con­fig­ured AP for com­mu­ni­ca­tion with RA­DIUS. Save your set­tings and re­boot Ac­cess Point.

Testing


I want to con­nect my iPhone (iOS5) to WiFI net­work Ra­diusTest and by that con­nec­tion test con­nec­tion be­tween client – AP and RA­DIUS server.

On my iPhone in WiFI net­works I can see cre­ated WiFi Ra­diusTest  – I`m tap­ing on it to con­nect.
I need to au­then­ti­cate. I en­tered my do­main user ac­count and pass­word in fol­low­ing form : Do­main\user + pass­word | Choose Join
After few sec­onds I`m of­fered the cer­tifi­cate that I cre­ated ear­lier on RA­DIUS server | Ac­cept
iPhone is suc­cess­fully con­nected and au­then­ti­cated on RA­DIUS server.
With this step in­stalling, con­fig­ur­ing and test­ing RA­DIUS server on Win­dows Server 2008 x64 is suc­cess­fully fin­ished.