Many times you will end up tailing multiple files simultaneously. There is a sweet linux utility called multitail that will let you tail multiple files at the same time within the same shell.

And not only will you be able to tail multiple files! You will also be able to run multiple commands and tail their outputs!

Read the rest of this entry »

Ever had your linux box getting Out of Memory (OOM)? Cleaning up after the OOM killer kicked in to find out that even though OOM killer did a decent job at trying to kill the bad processes, your system ends up in an unknown state and you might be better of rebooting the host to make sure it comes back up in a state that you know is safe.

Read the rest of this entry »

Let’s continue the network monitoring serie with yet another use case…. the “What program is using my bandwidth?” problem while not imposible to solve, still remains a pain. What if there were some kind of top for network?

NetHogs is a nifty tool that will do that for you and will help you finding what is hogging your connection.

Read the rest of this entry »

There is many tools out there that help in monitoring network usage, collect statistics and generate graphs so we can view what happened at a given date/time. Anyhow, finding the bandwidth usage over an hour/day/week/month can be really tricky.

vnstat is a suite of daemon and client programs that monitor network bandwidth usage.

Read the rest of this entry »

Last time we saw how bash can help us in handling default values out of the box using parameter expansion. This time we will see how basic string operations (nonetheless common and useful) can also be achieved using bash.

There is many ways to do string manipulation with bash, like finding a filename extension using expr, separating the directory part from a filename using dirname and basename…. or even more sophisticated ones based on regex, sed….

Why using a sledgehammer to crack a nut when you could use bash builtin functionalities!

Read the rest of this entry »

Bash is a sh-compatible command language interpreter that executes commands read from the standard input or from a file.
There is much more to bash than running a sequence of commands, one of the features bundled with bash is parameter expansion.

Any shell user has most likely used shell variables, be it $1 or $myvar, to save values… but there is more to it. This tutorial will cover a subset of shell parameter expansion that can become really handy and save you a lot of time.

Read the rest of this entry »

top is most likely one of the most known Linux command and also one of the most used one, however most people do not take full advantage of its capabilities.

In this tutorial, we will see a few usages of top that will make allow you to get more out of it.

Read the rest of this entry »

Client configuration

To get the client configuration set, you will need to provide the following file:

• ta.key
• ca.crt

# mkdir clientconfig
# cp /etc/openvpn/easy-rsa/2.0/keys/{ca.crt,ta.key} clientconfig/

And finally create the config file clientconfig/client.ovpn

client
dev tun
proto udp
# change to your vpn server
remote 172.16.132.5 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
ns-cert-type server
tls-auth ta.key 1
# in UDP mode, explicitely notify
# the server that we exit
# send up to 3 attempts
explicit-exit-notify 3
comp-lzo
verb 3
auth-user-pass

Finally, provide the clientconfig folder and its content to a client.

I would recommend using network-manager-openvpn package on Debian/Ubuntu. It is a easy as importing the configuration through network-manager wizard.

Another way to connect to your newly intalled openvpn server is to run the following command:

chantra@fb-ubu1210-64:~/clientconfig$ sudo openvpn ovpn.ovpn
Tue Jan 15 20:22:14 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct  8 2012
Enter Auth Username:chantra
Enter Auth Password:
Tue Jan 15 20:22:22 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jan 15 20:22:22 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Jan 15 20:22:22 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 15 20:22:22 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 15 20:22:22 2013 LZO compression initialized
Tue Jan 15 20:22:22 2013 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jan 15 20:22:22 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Jan 15 20:22:22 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jan 15 20:22:22 2013 Local Options hash (VER=V4): '504e774e'
Tue Jan 15 20:22:22 2013 Expected Remote Options hash (VER=V4): '14168603'
Tue Jan 15 20:22:22 2013 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue Jan 15 20:22:22 2013 UDPv4 link local: [undef]
Tue Jan 15 20:22:22 2013 UDPv4 link remote: [AF_INET]172.16.132.5:1194
Tue Jan 15 20:22:22 2013 TLS: Initial packet from [AF_INET]172.16.132.5:1194, sid=8c1e69ca 24d3f240
Tue Jan 15 20:22:22 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 15 20:22:22 2013 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston CA/emailAddress=me@myhost.mydomain
Tue Jan 15 20:22:22 2013 VERIFY OK: nsCertType=SERVER
Tue Jan 15 20:22:22 2013 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston CA/emailAddress=me@myhost.mydomain
Tue Jan 15 20:22:22 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 15 20:22:22 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 15 20:22:22 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 15 20:22:22 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 15 20:22:22 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jan 15 20:22:22 2013 [frd1h01] Peer Connection Initiated with [AF_INET]172.16.132.5:1194
Tue Jan 15 20:22:24 2013 SENT CONTROL [frd1h01]: 'PUSH_REQUEST' (status=1)
Tue Jan 15 20:22:24 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Tue Jan 15 20:22:24 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jan 15 20:22:24 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jan 15 20:22:24 2013 OPTIONS IMPORT: route options modified
Tue Jan 15 20:22:24 2013 OPTIONS IMPORT: route-related options modified
Tue Jan 15 20:22:24 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jan 15 20:22:24 2013 ROUTE default_gateway=172.16.132.2
Tue Jan 15 20:22:24 2013 TUN/TAP device tun0 opened
Tue Jan 15 20:22:24 2013 TUN/TAP TX queue length set to 100
Tue Jan 15 20:22:24 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jan 15 20:22:24 2013 /sbin/ifconfig tun0 10.8.0.2 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
Tue Jan 15 20:22:24 2013 /sbin/route add -net 172.16.132.5 netmask 255.255.255.255 gw 172.16.132.2
Tue Jan 15 20:22:24 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Tue Jan 15 20:22:24 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Tue Jan 15 20:22:24 2013 GID set to nogroup
Tue Jan 15 20:22:24 2013 UID set to nobody
Tue Jan 15 20:22:24 2013 Initialization Sequence Completed

That’s it, you should now be able to connect to your OpenVPN server and encrypt all the traffic between your workstation and your server!

Munin 2.0 has been released and a .deb package has even been backported to Debian Squeeze!.

Version 2.0 comes with a bunch of new features and scalability improvements. This how-to will explain how to install and configure Munin 2.0 using Apache and mod-fcgid on Debian Squeeze.

The feature that I was really looking forward in Munin 2 was graph zooming which makes it really easy and convenient to visualize what happened at a given moment in time.

Most of the install process is actually detailed in http://munin-monitoring.org/wiki/CgiHowto2 but there were some missing bits to get it properly working on my set up (Debian Squueze + Apache2), hence while this how-to will look pretty similar to that wiki page, it should hopefully fill the gaps.

I will not cover the munin-node part as there should not be anything different since 1.4 and this old tutorial should still be accurate: How-To: Monitoring A Server With Munin.

Installing Munin

Debian backport is providing a .deb for Debian Squeeze, so once you have added debian backports repository, installing Munin is nearly an apt-get away.

Adding Debian Backport Repository

Create and edit /etc/apt/sources.list.d/backports.list and add:

deb http://backports.debian.org/debian-backports squeeze-backports main

Update your repositories:

# apt-get update

and finally, install Munin from the squeeze-backports:

# apt-get install munin -t squeeze-backports

The default /etc/munin/munin.conf is enough to monitor localhost. Within the next 5 minutes, a cron job will be ran and will start collecting metrics.

Now, we need to configure Apache to serve munin pages.

Apache settings

This new version of Munin now defaults to using CGI to generate HTML and GRAPH, so if you don’t have any CGI module installed yet, get it rolling and install one and enable it:

# apt-get install libapache2-mod-fcgid
# a2enmod fcgid

Then, we will create a new virtual host that will serve Munin graphs. So, let’s create /etc/apache2/sites-available/munin and edit it with:

<VirtualHost *:80>
        DocumentRoot /var/cache/munin/www
        ServerName munin.example.com
        Alias /static /etc/munin/static
        # Rewrites
        RewriteEngine On
        # HTML
        RewriteCond %{REQUEST_URI} !^/static
        RewriteCond %{REQUEST_URI} .html$ [or]
        RewriteCond %{REQUEST_URI} =/
        RewriteRule ^/(.*)           /usr/lib/munin/cgi/munin-cgi-html/$1 [L]
        # Images
        # - remove path to munin-cgi-graph, if present
        RewriteRule ^/munin-cgi/munin-cgi-graph/(.*) /$1
        RewriteCond %{REQUEST_URI}                 !^/static
        RewriteCond %{REQUEST_URI}                 .png$
        RewriteRule ^/(.*)  /usr/lib/munin/cgi/munin-cgi-graph/$1 [L]
        # Ensure we can run (fast)cgi scripts
        ScriptAlias /munin-cgi/munin-cgi-graph /usr/lib/munin/cgi/munin-cgi-graph
        <Location /munin-cgi/munin-cgi-graph>
                Options +ExecCGI
                <IfModule mod_fcgid.c>
                        SetHandler fcgid-script
                </IfModule>
                <IfModule !mod_fcgid.c>
                        SetHandler cgi-script
                </IfModule>
                Allow from all
        </Location>
        ScriptAlias /munin-cgi/munin-cgi-html /usr/lib/munin/cgi/munin-cgi-html
        <Location /munin-cgi/munin-cgi-html>
                Options +ExecCGI
                <IfModule mod_fcgid.c>
                        SetHandler fcgid-script
                </IfModule>
                <IfModule !mod_fcgid.c>
                        SetHandler cgi-script
                </IfModule>
                Allow from all
        </Location>
        <Location />
                Options +ExecCGI
                <IfModule mod_fcgid.c>
                        SetHandler fcgid-script
                </IfModule>
                <IfModule !mod_fcgid.c>
                        SetHandler cgi-script
                </IfModule>
                Allow from all
        </Location>
        <Location /static/>
                SetHandler None
                Allow from all
        </Location>
        <Directory /var/cache/munin/www>
                Order allow,deny
                #Allow from localhost 127.0.0.0/8 ::1
                Allow from all
                Options None
                # Set the default expiration time for files to 5 minutes 10 seconds from
                # their creation (modification) time.  There are probably new files by
                # that time.
                #
            <IfModule mod_expires.c>
                ExpiresActive On
                ExpiresDefault M310
            </IfModule>
        </Directory>
</VirtualHost>

Finally, enable this new site:

# a2ensite munin

That’s it, we now need to reload apache:

# /etc/init.d/apache2 reload

Now, you should be able to access munin at http://munin.example.com and zoom on graph!

Linux start up behaviour is driven by the so-called runlevels. It will use the default value provided in /etc/inittab for some systems (Debian…), or /etc/init/rc-sysinit.conf or some others (Ubuntu…).

This tutorial will show how to change the runlevel used during boot by modifying Grub2 start up prompt.

One of the common use case to change runlevel during boot is when you lost the root password and need to change it. In that case, you will want to boot linux in runlevel 1, this runlevel is a single user mode and makes you land on a system directly with a root prompt \o/.
This is also called in many distribution as the Recovery mode or Rescue mode.

Accessing Grub Screen

In order to be able to modify the runlevel used at boot, you will first need to access Grub 2 boot start up screen. Most distro will stay on that screen for about 10 seconds and will boot a default kernel in case you did not touch any keys, on some others, this screen is getting more and more hidden and in that case, you will need to try out a combinaison of either Esc or Shift keys until you get Grub2 startup screen.

Editing boot parameters

Once there, you need to enter

e

On the Grub entry you would like to boot.

This will get you to the boot parameter edition screen.
You now need to go to the end of the linux line and add a 1.

Booting it

Finally, hit F10 or Ctrl-x to boot linux with this new parameter.

You should now have a root prompt!