Home

Search this site:
 

Horshack’s
very
own site

 

This is Bavaria, Germany!
You will find links to Perl,
bootdisks for system administration,
a lot of Linux,
Windows administration
and some personal belongings.
Linux: system administration

Linux: system administration

Table of contents:


Logwatch, how to filter lines which I don't care about

Problem

Logwatch is a program which looks regularly for strange logentries in my logfiles. Unfortunately I have a lot of lines in my mails from mimedefang which look like that in the syslog:

**Unmatched Entries**
g9EMHviZ019560: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de
g9ENF5iZ019590: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de
g9ENKRiZ019601: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de
...

That's because I changed MIMEDefang to put an extra header in my mails. This is how I managed it to filter these messages out of my daily watchlog-mails.

Create filter script

Create a file /etc/log.d/scripts/shared/removemimedefang (755, root.root):

#!/usr/bin/perl -w
# Remove these lines in maillog:
# g998UniZ025900: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de
while (defined($ThisLine = )) {
    next if $ThisLine =~ /Milter add: header: X-Scanned-By: MIMEDefang/;
    # everything else will get through
    # to test wether it works: print "$0 said:" . $Thisline
    print $ThisLine;
}

This script filters out the lines and lets the rest go through.

Activate filter script

Now I have to activate it in /etc/log.d/conf/services/sendmail.conf (in this directory are all the configs how logwatch shall work):

LogFile = maillog
# Only give lines pertaining to the sendmail service...
*OnlyService = sendmail
*RemoveHeaders =
# My new entry to filter my own mimedefang messages
*removemimedefang =

After the equal sign there could be arguments passed to the script "removemimedefang"

Test it

Range "Yesterday" or so does not work yet, so let us watch ALL logfiles for testing:

/etc/log.d/scripts/logwatch.pl --service sendmail --range all

Wait for your mail.

More information

I found an explanation how to do this in the file HOWTO-Make-Filter
Website of logwatch is http://www.logwatch.org

 

Logrotate

Some of my logfiles get archived for a longer period or get analyzed by perl-scripts. These logfiles get a daily logfilename and get archived in a "data-sink"-directory. Archiving is made by a program called "logrotate" in Linux. This program usually creates old file like log.1, log.2, log.3 and the real logfile wanders from log to 1->2->3 and after that it disappears in /dev/null.

My job was to let the logfiles live forever in a special logdirectory with special filesnames like log-yyyymmdd_hhmm.gz

# file /etc/logrotate.d/squid
/var/log/squid/access /var/log/squid/denied {
    # This is called every night
    # I care very much for these logfiles
    # so they get archived in a logsink-directory
    # most action is made in prerotate
    #
    # I compress on my own in prerotate
    nocompress
    # don't hold old versions, I do archiving by filename
    # old files will get transfered to another place
    # by cron/root
    rotate 0
    # copy the logfile to the new one and
    # set the old one to 0 size:
    copytruncate
    # do postrotateaction only one time for all logfiles:
    sharedscripts
    # do this action daily|weekly
    daily
    prerotate
        # the current filename (fqn = including directory)
        # is in $1, there can be more than one filename
        # before the { of this section!
        from=$1
        # there are spaces at the end of the argument $1
        # delete them
        from=`echo $from | sed 's/ +$//'`
        dest=$from-`date '+%Y%m%d_%H%M'`
        logsink_fqdn=/var/spool/logsink/
        /bin/cp $from $dest
        /usr/bin/gzip $dest
        # move saved file to logsink if you like
        /bin/mv ${dest}.gz $logsink_fqdn
        # truncate current logfile
        /bin/cp /dev/null $from
    endscript
}

A usual logfile is not very interesting and shall dissapear like usual, x.log -> x.log.1 -> x.log.2 -> x.log.3 -> x.log.4 -> /dev/null

# file /etc/logrotate.d/samba

/var/log/samba/*.log {
    # I don't care much for these...
    # rotate log files weekly|daily
    weekly
    # Create 4 old logfile and put the oldest into nirvana
    rotate 4
    # create new (empty) log files after rotating old ones
    create
    # uncomment this if you want your log files compressed
    # compress
    missingok
    sharedscripts
    copytruncate
    postrotate
        /bin/kill -HUP `cat /var/lock/samba/*.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Dealing with RPM

In which rpm is a special file?

I wanted to find out in which rpm-packet in a directory a special file would be installed. I wrote a perlscript which writes me all files of all rpm-files into a logfile.

# find out contents of all rpm-files
# in a directory and write it to a logfile
use strict;

my $rpmdir  = ".";
my $logfile = "/tmp/rpmcontents.log";
my ( $file, $line, $cmd );

print "List contents of all rpm-files\n";
print "in directory $rpmdir\n";
print "with logfile in $logfile\n\n";
print "<PRESS RETURN>\n";
my $keypress = <STDIN>

opendir( RPM, $rpmdir );
while ( defined ($file = readdir(RPM)) ) {

    # don't care about . and ..
    next if ( $file =~ /^\./ );

    # open LOG new for each rpm
    open( LOG, ">> /tmp/log" );
    &say("***** content of rpm $file\n\n");
    $cmd = "rpm -qlp $file \|";
    open( CMD, $cmd );
    while () {
        $line = $_;
        &say("  $line");
    }
    close CMD;
    say("end of content of rpm $file\n\n");
    close LOG;
}
closedir RPM;
exit;

sub say {
    my ($line) = @_;
    print LOG $line;
    print $line;
}

Syncing time of local machine with timeservers from the internet

Use a simple netdate with several hosts:

# file: /usr/local/bin/timesync
#
echo "Syncronizing time with NTP-hosts"
# -l: max sync time is 180 sec
# -v: show groups
logger "Syncronizing time with $0"
netdate -l 180 \\
ntps1-2.uni-erlangen.de \\
ntps1-0.cs.tu-berlin.de \\
ntpa2.kph.uni-mainz.de \\
ntps1-1.rz.uni-osnabrueck.de
hwclock -w

Prepare a new disk for your Linux system

  1. Put the disk into your system
  2. Get root
  3. Find out which devicenumber your disk has
    IDE#1, disk 1 = /dev/hda
    IDE#1, disk 2 = /dev/hdb
    IDE#2, disk 3 = /dev/hdc and so on
  4. Take care not to overwrite a current disk in use, so do a mount
    [root]# mount
    /dev/sda1 on / type ext3 (rw)
    none on /proc type proc (rw)
    none on /dev/pts type devpts (rw,gid=5,mode=620)
    none on /dev/shm type tmpfs (rw)
    /dev/hda1 on /var type ext3 (rw)
    /dev/hdb1 on /mnt/hdb type ext3 (rw)
  5. My new disk is /dev/hdc
  6. fdisk /dev/hdc -> n = new partition, p = primary partion, decide how large the partition will be
    t = write a "magic byte" into the beginning of the disk so that the OS has a hint what's on it
    In the end: w = write it
  7. Create a ext2-filesystem on the disk:
    [root]# mke2fs dev/hdc
  8. Create the journalfile to make it a ext3-fs
     [root]# tune2fs -j /dev/hdc
  9. Create a mountpoint in your filesystem
    [root]# mkdir /mnt/hdc
  10. Mount it by hand and check it:
    [root]# mount -t ext3 /dev/hdc /mnt/hdc
    [root]# mount
    /dev/hdc should be in one line:
    [root@gatekeeper mnt]# mount
    /dev/sda1 on / type ext3 (rw)
    none on /proc type proc (rw)
    none on /dev/pts type devpts (rw,gid=5,mode=620)
    none on /dev/shm type tmpfs (rw)
    /dev/hda1 on /var type ext3 (rw)
    /dev/hdb1 on /mnt/hdb type ext3 (rw)
    /dev/hdc on /mnt/hdc type ext3 (rw)
  11. Create line for the new disk in /etc/fstab so the new disk gets mounted when the system restarts
    /dev/sda1               /                       ext3    defaults        1 1
    ...
    /dev/hdc                /mnt/hdc                ext3    defaults        1 2
  12.  That's it.

 

Mounting iso9660-files in the filesystem as loop-devices

Mounting by hand

An iso-file is a raw-file which can be written by a cd-burner to a new cd. It contains the whole CD block by block. You can mount that with this command:

# mount -t iso9660 -o loop /home/cds/enigma-i386-disc1.iso /mnt/cds/rh72/disk1
# mount
...
/home/cds/enigma-i386-disc1.iso on /mnt/cds/rh72/disk1 type iso9660 (rw,loop=/dev/loop0)

Mounting automatically

If you have a special line in /etc/fstab:

/home/cds/enigma-i386-disc1.iso /mnt/cds/rh72/disk1 iso9660 loop,ro 0 3

the devices gets mounted automatically with starting Linux or you can mount as easy like this:

[root@gatekeeper /etc]# mount /mnt/cds/rh72/disk1
[root@gatekeeper /etc]# mount
...
/home/cds/enigma-i386-disc1.iso on /mnt/cds/rh72/disk1 type iso9660 (rw,loop=/dev/loop0)

How to configure sudo...

... which allows normal users to act like root. Sudo is a programm which can execute a programm as root even if you are a normal user.

horshack$ sudo -u uucp /usr/sbin/uucico -S odn
Example for acting as root:
horshack$ sudo /sbin/reboot

Although user horshack is not allowed to do that he is now able to. All this is configured in /etc/sudoers. You are only allowed to edit this file with the command visudo.

root# visudo

Here is a little example of /etc/sudoers to cheat from:

# File: /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# Prepare that su does only work from this local
# Computera (127.0.0.1 seems not to work)
Host_Alias	LOKAL=10.1.1.1
# collect several users to a group
User_Alias SYSADMINS = horshack,hirn
User_Alias WEBSERVER = wwwrun
# Cmnd alias specification
Cmnd_Alias GOLDCOMMANDS = /bin/bash,/bin/cat
Cmnd_Alias UUCPCOMMANDS = /usr/sbin/uucico -S odn
Cmnd_Alias SHUTDOWNCOMMANDS = /sbin/reboot
# A tunnel with portfording, this is called from a shell script
# by the user
Cmnd_Alias TUNNEL_FROM_OUTSIDE = /usr/bin/ssh -p 22 -L 25\:smtp.local\:25 -L 143\:imap.local\:143  -L 515\:laserjet.local\:515 -L 3128\:proxy.local\:3128  -L 5000\:mypc-rdp.local\:3389 myuser@somegateway.local
# User privilege specification
root	ALL=(ALL) ALL
# SYSADMINS	ALL=(ALL)	NOPASSWD:GOLDCOMMANDS
# All the people which belong to the group SYSADMINS
# are allowed to do "something" as root. They don't 
# have to submit a password for that.
# "Something" means the commands defined above.
SYSADMINS	LOKAL=NOPASSWD:\
   GOLDCOMMANDS, UUCPCOMMANDS, SHUTDOWNCOMMANDS,  TUNNEL_FROM_OUTSIDE
# The user which runs the webserver is allowed to 
# execute certain uucp-commands. So it's possible to 
# start mailtransfer from a webpage.
WEBSERVER	LOKAL=NOPASSWD:\
	UUCPCOMMANDS

 

One-disk Linux

These are links for creating a linux-router with a single disk:

Kernel, how to get and compile

Linux is the everlasting system in the background of all my computers surrounding me. Here I can find the newest kernel for Linux in http://www.kernel.org

Linux-Firewall

Impressum