Centos 6 patching bind for bind bug CVE-2015-5477

In order to patch centos 6 for bind bug CVE-2015-5477 it is necessary to use the CR (continuous release) repository as it is not available for 6.6 and will be released in 6.7 and thus must be installed as a hot fix.

To do this simple enable the CR repository

# yum install centos-release-cr

Then update bind

# yum update bind

For good measure restart bind

# service named restart

And then I suggest you remvoe the CR repository

# yum erase centos-release-cr

You can check which repositories are in use

# yum repolist

 

redirecting tcp traffic

Sometimes I see a transit issue on the internet which I can't fix as I don't have a contract with the particular company in question. Whilst I am waiting for it to be resolved I sometimes route traffic round the issue by bouncing it off another server in another part of the world.

So for instance if I wanted to send tcp traffic to a particular port from a server in say the UK to a server in Singapore when there is a traffic issue between them then I could bounce the traffic off a server I have in Japan using iptables.

SERVERIP="x.x.x.x"
DESTIP="y.y.y.y"
ORIGIP="z.z.z.z"
PORT="nnn"

iptables -F -t nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -s $ORIGIP -d $SERVERIP --dport $PORT -j DNAT --to-destination $DESTIP
iptables -A POSTROUTING -t nat -o eth0 -s $ORIGIP -d $DESTIP -j MASQUERADE
iptables -A POSTROUTING -t nat -o eth0 -s $DESTIP -d $ORIGIP -j MASQUERADE

Simply run the commands above on the server in Japan setting SERVERIP to the address of the server in Japan, DESTIP to the address of the server in Singapore and ORIGIP to the address of the server in the UK.

Once that's done send the traffic to SERVIP rather than DESTIP and it will be redirsted to DESTIP and appear to be from ORIGIP.

Bear in mind you won't be able to send traffic to SERVERIP on the port specified so it's probably not a good idea to redirect port 22!

resize an lvm partition on a vm guest

So you've order an upgrade to your virtual disk from your cloud provider and the virtual disk has been extended but df show it is still the same size.

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_test-lv_root
                       28G  1.4G   26G   6% /
tmpfs                 504M     0  504M   0% /dev/shm
/dev/sda1             477M   48M  404M  11% /boot

e2fsck won't work because it's mounted.

# e2fsck -f /dev/mapper/vg_test-lv_root
e2fsck 1.41.12 (17-May-2010)
/dev/mapper/vg_test-lv_root is mounted.
e2fsck: Cannot continue, aborting.

resize2fs says there is nothing to do!

# resize2fs /dev/mapper/vg_test-lv_root
resize2fs 1.41.12 (17-May-2010)
The filesystem is already 7473152 blocks long.  Nothing to do!

You need to extend the partition with lvextend....

# lvextend -l +100%FREE /dev/mapper/vg_test-lv_root
  Size of logical volume vg_test/lv_root changed from 28.51 GiB (7298 extents) to 78.51 GiB (20098 extents).
  Logical volume lv_root successfully resized

and then resize the file system....

# resize2fs -p /dev/mapper/vg_test-lv_root
resize2fs 1.41.12 (17-May-2010)
Filesystem at /dev/mapper/vg_test-lv_root is mounted on /; on-line resizing required
old desc_blocks = 2, new_desc_blocks = 5
Performing an on-line resize of /dev/mapper/vg_test-lv_root to 20580352 (4k) blocks.
The filesystem on /dev/mapper/vg_test-lv_root is now 20580352 blocks long.

now you can see the space you have ordered!

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_test-lv_root
                       78G  1.4G   72G   2% /
tmpfs                 504M     0  504M   0% /dev/shm
/dev/sda1             477M   48M  404M  11% /boot

As always such operations carry a risk so take a backup or better still a snapshot and carry out at your own risk.

centos resolv.conf keeps getting overwritten

So if ever resolv.conf keeps getting overwritten when you boot linux you can tear your hair out trying to
work out why various web sites will tell you its NetworkManager (as does the file) or dhcpd or netctl.

Having ruled out all those, checked all sorts of boot scripts and even tried to use audit to find out what is changing the file check for /etc/resolv.conf.save. If it exists it will get copied to /etc/resolv.conf when the server boots.

remove /etc/resolv.conf.save and all should be well.

Using fail2ban with dated log files

I recently set up a new web server and took advantage of apache's ability to log directly to date stamped log files. This means there is no need to restart apache each day or rotate the logs.

Unfortunately I could not find a way to get fail2ban to recognise the new log file names for example error_20140603.log rather than error.log Even when I managed to add and remove log files using fail2ban-client I found issues as sendmail-whois-lines still searched the original files rather than the latest.

My final solution was to simply write a script to start fail2ban when the server is booted which also runs each day at midnight and takes account of the dated log files.

One problem I faced is fail2ban won't start if it can't find the log file so you have to ensure it exists.

Below is the code which is called by /etc/rc.d/rc.local to ensure fail2ban is started when the server is booted and by cron at midnight.

# define variables
pidfile="/var/run/fail2ban/fail2ban.pid"
nlogfile="/var/log/apache2/error."
nlogfile+=`date +%Y.%m.%d`
nlogfile+=".log"
# check if fail2ban is running
dostart=1
if [ -f $pidfile ];
then
  pid=`cat $pidfile`
  if ps -p $pid > /dev/null
  then
    echo fail2ban is running
    dostart=0
  fi
fi
# create config file
cat < /etc/fail2ban/jail.local
[apache]
enabled  = true
filter   = apache
action   = iptables-multiport[name=APACHE, port="http,https"]
        sendmail-whois-lines[name=APACHE, dest=root, sender=fail2ban@mydomain.com, sendername="fail2ban", logpath=${nlogfile}]
logpath  = ${nlogfile}
maxretry = 0
bantime  = 86400
EOF
# ensure real log file is created
wget http://127.0.0.1/fail2ban.php
sleep 1
# reload/start as required
if [ $dostart == 1 ];
then
  fail2ban-client start
else
  fail2ban-client reload
fi

As you can hopefully see the code creates a new jail.local with the correct logfile name in it.

It also does a wget of a non existant file to cause an error to be logged by the web server. This ensures the dated log file is created by apache and has the correct permissions.

Just remember to ensure apache is started before fail2ban!

Symantec System Recovery Desktop Edition

So I have a failed PC and a spare PC, best way to move from one to another is Symantec System Recovery Desktop Edition as the hardware is different and simply moving the drive from one to the other won't work.

I buy Symantec System Recovery Desktop Edition 2013 from Symantec online but then have to wait 2-3 days before I get my licence key so can't do anything.

Finally the key arrives and I can get cracking.

Or perhaps not the 2013 version won't work on my system as I get the error message "Error 0x0000005D: Your PC needs to restart. Please hold down the power button" 

After chatting to support it appears my machine is not PAE capable so won't work with the 2013 edition as per tech note http://www.symantec.com/business/support/index?page=content&id=TECH203411

So I request and get a download of the 2011 edition which boots fine and I can now do a cold backup using the boot iso.

I then attempt to restore the backup on my spare pc which I know supports Windows 7 as it has run it in the past.

All goes well until it reboots and windows starts configuring itself when I get the following message.

"Windows could not parse or process the unattend answer file for pass [specialize]. The settings specified in the answer file can not be applied. The error was detected while processing settings for the component [Microsoft-Windows-Shell-Script]"

When I click OK the PC then reboots and when it restarts windows I get another message.

"The computer restarted unexpectedly or encountered a problem or an unexpected error. Windows installation cannot proceed. To install windows click "OK" to restart the computer and restart the installation".

 
There is a method to get round this message which I tried but I did not end up with a useable system afterwards. Even after much googling I ended up with a pc which appeared to work but had issues with DNS resolution, entries appeared in the dns cache correctly but for some reason the program requesting the lookup did not get the address meaning I could ping an ip address but not a name such as www.google.co.uk.

Next day after some sleep I decided to do a restore but to prevent Symantec System Recovery creating an answer file, this can be done as follows:-

During the restore wizard process, hold down the 'Ctrl' key when clicking the 'Use Rrestore Anywhere' option. Disable 'Run Windows Mini Setup' and put a check in 'Delete existing drivers'. 

The restore then worked without error and windows booted correctly except although windows correctly saw my network card I had no network access.

Having learnt from my earlier restore when I had the same issue I removed and reinstalled my firewall software (AVG it turns out but this will probably apply to most virus software) and hey presto my network appeared.

Symantec support were helpful but in the end I worked it out myself.

Hope this helps some other poor unfortunate sole if they have the same issue.

mysql commands out of sync after repair table

Recently I was trying to automate some table repairs when a server crash is detected. My code attempted to repair a number of tables but after repairing the first table subsequent repairs failed with "Commands out of sync; you can't run this command now".

On investigation I realised I actually needed to read the response from the database much as if I had queried a table.

It appears four columns are returned from the repair statement reflecting the status of the repair.

Example code:-

    sprintf(sql_statement,"repair table %s",tablename);
    reportlog(sql_statement);
    if (mysql_query (local, sql_statement) != 0) {
        sprintf(message,"mysql select failed:\nError %u %s\n",mysql_errno(local), mysql_error(local));
        reportlog(message);
    }

    res_set = mysql_store_result(local);
    if (res_set != NULL) {
        row = mysql_fetch_row (res_set);
        if (row != NULL) {
            sprintf(message,"%s %s %s %s",row[0],row[1],row[2],row[3]);
            reportlog(message);
        }
    }   
    mysql_free_result(res_set);

Running the code results in :-

database.tablename repair status OK