This is Bavaria, Germany!
Table of contents:
Logwatch is a program which looks regularly for strange logentries in my logfiles. Unfortunately I have a lot of lines in my mails from mimedefang which look like that in the syslog:
**Unmatched Entries** g9EMHviZ019560: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de g9ENF5iZ019590: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de g9ENKRiZ019601: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de ...
That's because I changed MIMEDefang to put an extra header in my mails. This is how I managed it to filter these messages out of my daily watchlog-mails.
Create a file /etc/log.d/scripts/shared/removemimedefang (755, root.root):
#!/usr/bin/perl -w # Remove these lines in maillog: # g998UniZ025900: Milter add: header: X-Scanned-By: MIMEDefang 2.2 from lisa.d.franken.de while (defined($ThisLine =)) { next if $ThisLine =~ /Milter add: header: X-Scanned-By: MIMEDefang/; # everything else will get through # to test wether it works: print "$0 said:" . $Thisline print $ThisLine; }
This script filters out the lines and lets the rest go through.
Now I have to activate it in /etc/log.d/conf/services/sendmail.conf (in this directory are all the configs how logwatch shall work):
LogFile = maillog # Only give lines pertaining to the sendmail service... *OnlyService = sendmail *RemoveHeaders = # My new entry to filter my own mimedefang messages *removemimedefang =
After the equal sign there could be arguments passed to the script "removemimedefang"
Range "Yesterday" or so does not work yet, so let us watch ALL logfiles for testing:
/etc/log.d/scripts/logwatch.pl --service sendmail --range all
Wait for your mail.
I found an explanation how to do this in the file HOWTO-Make-Filter
Website of logwatch is http://www.logwatch.org
Some of my logfiles get archived for a longer period or get analyzed by perl-scripts. These logfiles get a daily logfilename and get archived in a "data-sink"-directory. Archiving is made by a program called "logrotate" in Linux. This program usually creates old file like log.1, log.2, log.3 and the real logfile wanders from log to 1->2->3 and after that it disappears in /dev/null.
My job was to let the logfiles live forever in a special logdirectory with special filesnames like log-yyyymmdd_hhmm.gz
# file /etc/logrotate.d/squid
/var/log/squid/access /var/log/squid/denied {
# This is called every night
# I care very much for these logfiles
# so they get archived in a logsink-directory
# most action is made in prerotate
#
# I compress on my own in prerotate
nocompress
# don't hold old versions, I do archiving by filename
# old files will get transfered to another place
# by cron/root
rotate 0
# copy the logfile to the new one and
# set the old one to 0 size:
copytruncate
# do postrotateaction only one time for all logfiles:
sharedscripts
# do this action daily|weekly
daily
prerotate
# the current filename (fqn = including directory)
# is in $1, there can be more than one filename
# before the { of this section!
from=$1
# there are spaces at the end of the argument $1
# delete them
from=`echo $from | sed 's/ +$//'`
dest=$from-`date '+%Y%m%d_%H%M'`
logsink_fqdn=/var/spool/logsink/
/bin/cp $from $dest
/usr/bin/gzip $dest
# move saved file to logsink if you like
/bin/mv ${dest}.gz $logsink_fqdn
# truncate current logfile
/bin/cp /dev/null $from
endscript
}
A usual logfile is not very interesting and shall dissapear like usual, x.log -> x.log.1 -> x.log.2 -> x.log.3 -> x.log.4 -> /dev/null
# file /etc/logrotate.d/samba
/var/log/samba/*.log {
# I don't care much for these...
# rotate log files weekly|daily
weekly
# Create 4 old logfile and put the oldest into nirvana
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
# compress
missingok
sharedscripts
copytruncate
postrotate
/bin/kill -HUP `cat /var/lock/samba/*.pid 2> /dev/null` 2> /dev/null || true
endscript
}
I wanted to find out in which rpm-packet in a directory a special file would be installed. I wrote a perlscript which writes me all files of all rpm-files into a logfile.
# find out contents of all rpm-files
# in a directory and write it to a logfile
use strict;
my $rpmdir = ".";
my $logfile = "/tmp/rpmcontents.log";
my ( $file, $line, $cmd );
print "List contents of all rpm-files\n";
print "in directory $rpmdir\n";
print "with logfile in $logfile\n\n";
print "<PRESS RETURN>\n";
my $keypress = <STDIN>
opendir( RPM, $rpmdir );
while ( defined ($file = readdir(RPM)) ) {
# don't care about . and ..
next if ( $file =~ /^\./ );
# open LOG new for each rpm
open( LOG, ">> /tmp/log" );
&say("***** content of rpm $file\n\n");
$cmd = "rpm -qlp $file \|";
open( CMD, $cmd );
while () {
$line = $_;
&say(" $line");
}
close CMD;
say("end of content of rpm $file\n\n");
close LOG;
}
closedir RPM;
exit;
sub say {
my ($line) = @_;
print LOG $line;
print $line;
}
Use a simple netdate with several hosts:
# file: /usr/local/bin/timesync # echo "Syncronizing time with NTP-hosts" # -l: max sync time is 180 sec # -v: show groups logger "Syncronizing time with $0" netdate -l 180 \\
ntps1-2.uni-erlangen.de \\
ntps1-0.cs.tu-berlin.de \\
ntpa2.kph.uni-mainz.de \\
ntps1-1.rz.uni-osnabrueck.de
hwclock -w
An iso-file is a raw-file which can be written by a cd-burner to a new cd. It contains the whole CD block by block. You can mount that with this command:
# mount -t iso9660 -o loop /home/cds/enigma-i386-disc1.iso /mnt/cds/rh72/disk1 # mount ... /home/cds/enigma-i386-disc1.iso on /mnt/cds/rh72/disk1 type iso9660 (rw,loop=/dev/loop0)
If you have a special line in /etc/fstab:
/home/cds/enigma-i386-disc1.iso /mnt/cds/rh72/disk1 iso9660 loop,ro 0 3
the devices gets mounted automatically with starting Linux or you can mount as easy like this:
[root@gatekeeper /etc]# mount /mnt/cds/rh72/disk1 [root@gatekeeper /etc]# mount ... /home/cds/enigma-i386-disc1.iso on /mnt/cds/rh72/disk1 type iso9660 (rw,loop=/dev/loop0)
... which allows normal users to act like root. Sudo is a programm which can execute a programm as root even if you are a normal user.
horshack$ sudo -u uucp /usr/sbin/uucico -S odnExample for acting as root:
horshack$ sudo /sbin/reboot
Although user horshack is not allowed to do that he is now able to. All this is configured in /etc/sudoers. You are only allowed to edit this file with the command visudo.
root# visudo
Here is a little example of /etc/sudoers to cheat from:
# File: /etc/sudoers # This file MUST be edited with the 'visudo' command as root. # Prepare that su does only work from this local # Computera (127.0.0.1 seems not to work) Host_Alias LOKAL=10.1.1.1 # collect several users to a group User_Alias SYSADMINS = horshack,hirn User_Alias WEBSERVER = wwwrun # Cmnd alias specification Cmnd_Alias GOLDCOMMANDS = /bin/bash,/bin/cat Cmnd_Alias UUCPCOMMANDS = /usr/sbin/uucico -S odn Cmnd_Alias SHUTDOWNCOMMANDS = /sbin/reboot # A tunnel with portfording, this is called from a shell script # by the user Cmnd_Alias TUNNEL_FROM_OUTSIDE = /usr/bin/ssh -p 22 -L 25\:smtp.local\:25 -L 143\:imap.local\:143 -L 515\:laserjet.local\:515 -L 3128\:proxy.local\:3128 -L 5000\:mypc-rdp.local\:3389 myuser@somegateway.local # User privilege specification root ALL=(ALL) ALL # SYSADMINS ALL=(ALL) NOPASSWD:GOLDCOMMANDS # All the people which belong to the group SYSADMINS # are allowed to do "something" as root. They don't # have to submit a password for that. # "Something" means the commands defined above. SYSADMINS LOKAL=NOPASSWD:\ GOLDCOMMANDS, UUCPCOMMANDS, SHUTDOWNCOMMANDS, TUNNEL_FROM_OUTSIDE # The user which runs the webserver is allowed to # execute certain uucp-commands. So it's possible to # start mailtransfer from a webpage. WEBSERVER LOKAL=NOPASSWD:\ UUCPCOMMANDS
These are links for creating a linux-router with a single disk:
Linux is the everlasting system in the background of all my computers surrounding me. Here I can find the newest kernel for Linux in http://www.kernel.org