Table of Contents

Linux Admin

linux_system_administration.pdf
red_hat_linux_administration_-_a_beginner_s_guide_2003.pdf

Fix Old CentOS Repos

Maintainece update not supported from 2020/11/30 ⇒ you must config repos to new mirror for Fixing yum error: 

yum list
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror
Determining fastest mirrors
YumRepo Error: All mirror URLs are not using ftp, http[s] or file.
 Eg. Invalid release/repo/arch combination/
removing mirrorlist with no valid mirrors: /var/cache/yum/x86_64/6/base/mirrorlist.txt

Steps:

  1. Step1: Update /etc/yum.repos.d/CentOS-Base.repo
[base]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/6.10/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
#released updates
[updates]
name=CentOS-$releasever - Updates
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra
baseurl=http://vault.centos.org/6.10/updates/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras&infra=$infra
baseurl=http://vault.centos.org/6.10/extras/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$releasever - Plus
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus&infra=$infra
baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
#contrib - packages by Centos Users
[contrib]
name=CentOS-$releasever - Contrib
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib&infra=$infra
baseurl=http://vault.centos.org/6.10/contrib/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
  1. Step2:
    yum clean all

Install software

Install rpm package

mount /dev/cdrom /mnt/cdrom/
cd /mnt/cdrom/CentOS
rpm -i mc-4.6.1a-35.el5.i386.rpm

Manage packages with yum - Yellowdog Updater Modified

It can automatically perform system updates, including dependancy analysis and obsolete processing based on “repository” metadata. It can also perform installation of new packages, removal of old packages and perform queries on the installed and/or available packages among many other commands/services (see below). yum is similar to other high level package managers like apt-get and smart.

Manage Packages with Apt

apt-cache - performs a variety of operations on APT's package cache. apt-cache does not manipulate the state of the system but does provide operations to search and generate interesting output from the package metadata.

dpkg - package manager for Debian

upgrades all installed packages 

apt-get upgrade

Search Packages:

Admin User and Group

Admin user

Admin group

Modify Group of user

Chown

Passwd file

refer: http://www.yolinux.com/TUTORIALS/LinuxTutorialManagingGroups.html 

cat /etc/passwd | grep ftp

output: 

ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
(username:ftp
userid:14
group:50 => ftp
Real name: FTP User
home directory: /var/ftp
Shell: /sbin/nologin
)

Information of user profile

cat ~/.bash_profile
cat ~/.bashrc => login profile for user
cat ~/.bash_history => history commands of user

sudo config

umask

umask(The user file-creation mode mask) is use to determine the file permission for newly created files

System startup and shutdown

System startup config

OS startup config files

+ /etc/inittab
id:3:initdefault:
=> id:runlevels:action:command
+ /etc/rc.local
=> startup script when linux start

Understand run-level scripts in config files

Understanding run-level scripts:A software package that has a service to start at boot time (or when the system changes run levels)

Managing xinetd services

There are a bunch of services, particularly Internet services, that are not handled by separate run-level scripts. Instead, a single run-level script called xinetd 1) is run to handle incoming requests for these services ⇒ xinetd is sometimes referred to as the super-server.Below is script start,stop: 

/etc/inid.d/xinetd

Manage services in linux

Host and network config

Change hostname

Edit login banner

telnet session

/etc/issue.net /etc/issue

ssh session

/etc/ssh/sshd_config

Network config

Check network card

/sbin/ifconfig -a
/sbin/arp -a

Check hardware network

sudo /usr/sbin/dmidecode -t
sudo /usr/sbin/dmidecode -t baseboard

output: 

Handle 0x002B, DMI type 10, 6 bytes
On Board Device Information
        Type: Ethernet
        Status: Enabled
        Description: Onboard Ethernet
Handle 0x006A, DMI type 41, 11 bytes
Onboard Device
        Reference Designation:  Onboard LAN
        Type: Ethernet
        Status: Enabled
        Type Instance: 1
        Bus Address: 0000:00:19.0

Config Route

Static route

Dynamic route

DNS

[/etc/resolv.conf] 

nameserver 202.96.209.5

DHCP server

Security

Iptables

start,stop iptables

service iptables start
service iptables stop
service iptables restart
service iptables status
chkconfig --level 345 iptables on
chkconfig --list iptables

Iptable config

log system: messages,secure,cron

http://linuxhelp.blogspot.com/2005/01/system-logging.html

syslogd, klogd

These daemons provide centralized logging in linux.

/var/log

Scheduling System Tasks

Check log all crontabs on linux system: 

cat /var/log/cron

Scheduling System Tasks with at

/etc/at.deny
echo "/sbin/init 0" | at now +1 minutes

atq
job 12 at 2009-08-17 20:06

Scheduling System Tasks with crond(crontab)

to sheduleing with crond, the crond was configured auto-restart when linux start: 

chkconfig crond on

Availabe System Crontabs

All available crontabs: 

crontab
cron.deny
cron.hourly
cron.daily
cron.weekly
cron.monthly
cron.d

basic contab commands

crontab configuration file base on linux user

Create 1 simple crontab

create crontab for user anhvc to backup file /home/anhvc/data.txt at 21h45 every day

Create contab to update date/time of system

  1. Step1: Install ntpdate
    yum install ntpdate
  2. Step2: Create contab content:
    */30 * * * * /usr/sbin/ntpdate  pool.ntp.org

logrotate

Config run logrotate everydays in crond

logrotate was run everydays with crond default config /etc/cron.daily/logrotate below: 

#!/bin/sh
 
/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

Config logrotate for apache logs

in /etc/logrotate.d/httpd 

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

⇒ we can chage the directory which contain log files /var/log/httpd/*log

Config logrotate for nginx logs

refer: http://article.gmane.org/gmane.comp.web.nginx.english/586

  1. Step1: Config ngix create pid file in conf/nginx.conf:
    worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pid        /var/run/nginx.pid;
  2. Step2: Restart nginx and check content of /var/log/nginx.pid. If OK, go to next step
  3. Step3: create logrotate config for nginx /etc/logrotate.d/nginx with content below:
    /usr/local/nginx/logs/*log {
    #rotate the logfile(s) daily
    daily
    # adds extension like YYYYMMDD instead of simply adding a number
    dateext
    # If log file is missing, go on to next one without issuing an error msg
    missingok
    # Save logfiles for the last 52 days
    rotate 52
    # Old versions of log files are compressed with gzip
    compress
    # Postpone compression of the previous log file to the next rotation cycle
    delaycompress
    # Do not rotate the log if it is empty
    notifempty
    # create mode owner group
    create 640 root nobody
    sharedscripts
    #after logfile is rotated and nginx.pid exists, send the USR1 signal
    postrotate
        [ ! -f /var/run/nginx.pid ] || kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

    ⇒ root:nobody(user: root, group: nobody) permissions might need further revision in your own system, as well as the logs and pid file location

  4. Step4: run to check nginx logrotate config 
    logrotate --force /etc/logrotate.d/nginx

Optimize OS parameters(sysctl)

refer: http://ithubinfo.blogspot.com/2013/07/how-to-increase-ulimit-open-file-and.html

dynamic config(will restore when OS restart)

Increase number open files /etc/sysctl.conf

Check number open files

Steps to config max number open files:

  1. Step1: Edit config in /etc/sysctl.conf to increase max number of ulimit open file in Linux
    fs.file-max = 65536
  2. Step2: add config into /etc/security/limits.conf
    *          soft     nproc          65535
*          hard     nproc          65535
*          soft     nofile         65535
*          hard     nofile         65535
  3. Step3: reboot
  4. Step4: recheck after config:
    ulimit -n

    output: 

    65535

Check config

ulimit -a
sysctl -a => Display all values currently available.
sysctl kernel => for kernel
sysctl fs => for file system
sysctl net => for net system
1)
formerly inetd