RAID LEVEL SUMMARY

Level Techniques Description Min. Drives Failure Conditions Pros/Cons Uses


RAID O Disk striping (no fault tolerance) Data is broken into stripes which 2 When one drive fails, the entire array is compromised. Offers Best performance Video editing and production

are sent to each disk in the array.

No fault tolerance.

RAID 1 Disk mirroring Data on one drive is mirrored on another. 2 If one drive fails, data is not lost. If both drives fail, the data is lost. 100% redundancy of data/Slower performance and 50% loss of storage space. Accounting, payroll, financial

RAID 2 Byte level striping with Hamming code ECC Data is split at the bit level over a number of data and ECC disks. Up to 14+ Only one drive may fail and still be recoverable "on the fly". On the fly data error correction/Extremely high cost. No commercial uses

RAID 3 Byte level striping with dedicated parity Data is striped at the byte-level, across multiple disks. 3 When more then one drive fails, the array is compromised. High read/write data transfer rates/Complex controller design Image and video editing

RAID 4 Block level striping with dedicated parity Data is striped in blocks across data disk, with parity store on a separate disk. 3 When more then one drive fails, the array is compromised. High Read/Low Write data transaction rates. General purpose

RAID 5 Block level striping with distributed parity Data and parity are striped in blocks across all disks. 3 When more then one drive fails, the array is compromised. High Read data transaction rates/ Complex controller design Web, database or file servers

http://www.raidrecoveryguide.com/levels2.html
 

The 5 Qualities of Remarkable Bosses

Remarkable bosses aren’t great on paper. Great bosses are remarkable based on their actions.

Results are everything—but not the results you might think.

Consistently do these five things and everything else follows. You and your business benefit greatly.

More importantly, so do your employees.

1. Develop every employee. Sure, you can put your primary focus on reaching targets, achieving results, and accomplishing concrete goals—but do that and you put your leadership cart before your achievement horse.

Without great employees, no amount of focus on goals and targets will ever pay off. Employees can only achieve what they are capable of achieving, so it’s your job to help all your employees be more capable so they—and your business—can achieve more.

It's your job to provide the training, mentoring, and opportunities your employees need and deserve. When you do, you transform the relatively boring process of reviewing results and tracking performance into something a lot more meaningful for your employees: Progress, improvement, and personal achievement.

So don’t worry about reaching performance goals. Spend the bulk of your time developing the skills of your employees and achieving goals will be a natural outcome.

Plus it’s a lot more fun.

2. Deal with problems immediately. Nothing kills team morale more quickly than problems that don't get addressed. Interpersonal squabbles, performance issues, feuds between departments... all negatively impact employee motivation and enthusiasm.

And they're distracting, because small problems never go away. Small problems always fester and grow into bigger problems. Plus, when you ignore a problem your employees immediately lose respect for you, and without respect, you can't lead.

Never hope a problem will magically go away, or that someone else will deal with it. Deal with every issue head-on, no matter how small.

3. Rescue your worst employee. Almost every business has at least one employee who has fallen out of grace: Publicly failed to complete a task, lost his cool in a meeting, or just can’t seem to keep up. Over time that employee comes to be seen by his peers—and by you—as a weak link.

While that employee may desperately want to “rehabilitate” himself, it's almost impossible. The weight of team disapproval is too heavy for one person to move.

But it’s not too heavy for you.

Before you remove your weak link from the chain, put your full effort into trying to rescue that person instead. Say, "John, I know you've been struggling but I also know you're trying. Let's find ways together that can get you where you need to be." Express confidence. Be reassuring. Most of all, tell him you'll be there every step of the way.

Don't relax your standards. Just step up the mentoring and coaching you provide.

If that seems like too much work for too little potential outcome, think of it this way. Your remarkable employees don’t need a lot of your time; they’re remarkable because they already have these qualities. If you’re lucky, you can get a few percentage points of extra performance from them. But a struggling employee has tons of upside; rescue him and you make a tremendous difference.

Granted, sometimes it won't work out. When it doesn't, don't worry about it.  The effort is its own reward.

And occasionally an employee will succeed—and you will have made a tremendous difference in a person's professional and personal life.

Can’t beat that.

4. Serve others, not yourself. You can get away with being selfish or self-serving once or twice... but that's it.

Never say or do anything that in any way puts you in the spotlight, however briefly. Never congratulate employees and digress for a few moments to discuss what you did.

If it should go without saying, don't say it. Your glory should always be reflected, never direct.

When employees excel, you and your business excel. When your team succeeds, you and your business succeed. When you rescue a struggling employee and they become remarkable, remember they should be congratulated, not you.

You were just doing your job the way a remarkable boss should.

When you consistently act as if you are less important than your employees—and when you never ask employees to do something you don’t do—everyone knows how important you really are.

5. Always remember where you came from. See an autograph seeker blown off by a famous athlete and you might think, “If I was in a similar position I would never do that.”

Oops. Actually, you do. To some of your employees, especially new employees, you are at least slightly famous. You’re in charge. You’re the boss.

That's why an employee who wants to talk about something that seems inconsequential may just want to spend a few moments with you.

When that happens, you have a choice. You can blow the employee off... or you cansee the moment for its true importance: A chance to inspire, reassure, motivate, and even give someone hope for greater things in their life. The higher you rise the greater the impact you can make—and the greater your responsibility to make that impact.

In the eyes of his or her employees, a remarkable boss is a star.

Remember where you came from, and be gracious with your stardom.

Search for File containing specific text.

Something
Search for a string called redeem reward in all text files located in /home/tom/*.txt directory, use

$ grep "redeem reward" /home/tom/*.txt

Task: Search all subdirectories recursively

You can search for a text string all files under each directory, recursively with -roption:

$ grep -r "redeem reward" /home/tom

Task: Only print filenames

By default, grep command prints the matching lines You can pass -H option to print the filename for each match.

$ grep -H -r “redeem reward” /home/tom

Output:

filename.txt: redeem reward

...To just print the filename use cut command as follows:

$ grep -H vivek /etc/* -R
cut -d: -f1

Output:
filename.txt

System Administrator - while joining new project. Taking hand over of Servers.

Get access credentials.

Figure out current owners of servers. Your scope in handling those servers.

Details of service running on each physical server. ( check by ps -eaf command). Get details of service running. There configuration files. Purpose.

architecture of application if running on multiple servers. Where is Database. Middle ware, Where is application running, Storage for that application.

Details of configuration files in use.

Network configuration ( IP address - iptables if running), check routes. Check all interface connected. VLAN information.

Details of backup. How they are being taken, Backup Schedule. Backup tool in use.

VERY IMPORTANT -- Try to deploy application or tool with same configuration on test environment to get total control, else iyou will always be lost.

Give other users right on directory. Files created by root are editable by group users.

Link

http://www.udel.edu/topics/os/unix/general/groupsharing.html




Now this directory is correct for group sharing, but new files will not be correct. New files will be owned but the group of the shell and will not have the correct permissions. If you start the shell in the correct group and set the umask command you can make new files automatically owned and permitted properly. However if your group members put file here with ftp or scp, these shell commands will not help.
Instead we will use two commands to solve this problem. The command:

chmod g+s groupshare

will set the "set groupid" bit for the groupshare directory. This means all new files will be owned by the group of the parent directory instead of the current shell. In this case, group which is 0217 will be assigned to all new files or directories. Also this "set groupid" bit will be set on all new directories, so the group will be properly set for all files in the hierarchy.
The command

setfacl -m d:u::rwx,d:g::rwx,d:m:rwx,d:o:r-x groupshare

will set the default:user, default:group, default:mask and default:other. These defaults will be used to set the permission modes for any new file. You must set all these defaults, so this means you have a long command. That is why we used the abbreviations d:u,d:g, d:m and d:o.

Migration Centos 4.4 to 5

Link 

http://wiki.centos.org/HowTos/MigrationGuide/ServerCD_4.4_to_5

• HowTos
• MigrationGuide
• ServerCD 4.4 to 5

This is not a supported upgrade path !

The Server CD series mentioned here does not exist in all CentOS releases, nor in each point level respin. The CentOS team strives to permit minimal installs with just CD 1 of a given series, but this is not always possible. Please check the Release Notes for a given Major and Point release for further details.

You have to force an install of python-sqlite from the CentOS 5 repositories after the upgrade, as the version number of python-sqlite didn't change between 4 and 5.

rpm -Uvh --replacepkgs python-sqlite-1.1.7-1.2.1.i386.rpm

Otherwhise you'll get the error

Could not find any working storages

or

There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:

   No module named sqlite

Please install a package which provides this module, or
verify that the module is installed correctly.

It's possible that the above module doesn't match the
current version of Python, which is:
2.4.3 (#1, Mar  5 2011, 21:25:56)                    
[GCC 4.1.2 20080704 (Red Hat 4.1.2-50)]              

If you cannot solve this problem yourself, please go to
the yum faq at:
  http://wiki.linux.duke.edu/YumFaq                     

Always have a current backup of you data !

This is a "general" guideline for a CentOS 4.4 Server CD install upgrade via yum.

YMMV with additionally installed RPMS and RPMS from third party Repositories.

I did a fresh install of the x86_64 Server 4.4 CD (everything) for this migration test.

Now that I have a CentOS 4.4 install, I will begin the migration to CentOS 5 via yum.

Start the upgrade process

mkdir /tmp/Upgrades
cd /tmp

Check for centos-yumconf

rpm -qi centos-yumconf

* If centos-yumconf exist, remove it.

* NOTE this seems to be only installed if you installed from the x86_64 version of the ServerCD 4.4 ISO.

rpm -e centos-yumconf

Installing needed RPMS manually

I used wget to acquire the RPMS.

Install centos-release-5-0.0.el5.centos.2.x86_64.rpm centos-release-notes-5.0.0-2.x86_64.rpm

rpm -Uvh centos-release-5-0.0.el5.centos.2.x86_64.rpm centos-release-notes-5.0.0-2.x86_64.rpm

# Make sure you disable all other repos and only have CentOS Base and Updates repositories enabled.

Install the CentOS 5 GPG Key

# Get the GPG key from a mirror or CentOS 5 media.

rpm --import http://mirrors.kernel.org/centos/RPM-GPG-KEY-CentOS-5

cd /tmp/Upgrades

Download the following RPMS

# This gets the new yum/rpm working.

• rpm-libs-4.4.2-37.el5.x86_64.rpm
• rpm-4.4.2-37.el5.x86_64.rpm
• yum-3.0.5-1.el5.centos.2.noarch.rpm
• rpm-python-4.4.2-37.el5.x86_64.rpm
• popt-1.10.2-37.el5.x86_64.rpm
• glibc-2.5-12.x86_64.rpm
• glibc-common-2.5-12.x86_64.rpm
• beecrypt-4.1.2-10.1.1.x86_64.rpm
• glibc-headers-2.5-12.x86_64.rpm
• glibc-devel-2.5-12.x86_64.rpm
• binutils-2.17.50.0.6-2.el5.x86_64.rpm
• elfutils-libelf-0.125-3.el5.x86_64.rpm
• elfutils-0.125-3.el5.x86_64.rpm
• elfutils-libs-0.125-3.el5.x86_64.rpm
• beecrypt-python-4.1.2-10.1.1.x86_64.rpm
• python-2.4.3-19.el5.x86_64.rpm
• python-devel-2.4.3-19.el5.x86_64.rpm
• python-elementtree-1.2.6-5.x86_64.rpm
• python-sqlite-1.1.7-1.2.1.x86_64.rpm
• python-urlgrabber-3.1.0-2.noarch.rpm
• neon-0.25.5-5.1.x86_64.rpm
• libxml2-2.6.26-2.1.2.x86_64.rpm
• libxml2-python-2.6.26-2.1.2.x86_64.rpm
• db4-4.3.29-9.fc6.x86_64.rpm
• libselinux-1.33.4-2.el5.x86_64.rpm
• libsepol-1.15.2-1.el5.x86_64.rpm
• mcstrans-0.1.10-1.el5.x86_64.rpm
• m2crypto-0.16-6.el5.1.x86_64.rpm
• krb5-libs-1.5-17.x86_64.rpm
• openssl-0.9.8b-8.3.el5.x86_64.rpm
• readline-5.1-1.1.x86_64.rpm

# Install above RPMS

rpm -Uvh *.rpm --nodeps

# Clean and rebuild rpmdb for CentoS 5

rm -f /var/lib/rpm/__*
rpm --rebuilddb

# Clean yum files

yum clean all

# Remove deps/outdated packages

Note: You can run yum upgrade to help find deps that you need to remove.

rpm -e VFlib2 caching-nameserver autofs kudzu pcmcia-cs xorg-x11 newt-perl hal crypto-utils --nodeps

Install new CentOS 5 kernel

# If you are getting the new kernel via wget you need to do the following first.

yum upgrade wget

rpm -ivh kernel-2.6.18-8.el5.x86_64.rpm --nodeps

Remove old CentOS 4 kernel(s)

rpm -qa | grep kernel

remove 2.6.9 bits

rpm -e kernel-2.6.9-42.EL kernel-devel-2.6.9-42.EL kernel-doc-2.6.9-42.EL

Upgrade the system to CentOS 5

yum upgrade

# Install removed packages that were not reinstalled

yum install caching-nameserver autofs

• cd /tmp

# Generate list of RPMS on the system after upgrade to see what old RPMS are left

rpm -qa >Upgrade_RPM_List

# Reboot system

reboot

# Login and you should be on CentOS 5

uname -a

• Linux localhost.localdomain 2.6.18-8.1.1.el5 #1 SMP Mon Apr 9 09:43:24 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux

At this point you will need to start upgrading any extra/third party RPMS. 

IP Masquerading using iptables

http://billauer.co.il/ipmasq-html.html

1 Talk’s outline

• iptables versus ipchains
• The goal (or: my goal)
• The packet’s way through iptables
• “Classic” masquerading (SNAT)
• DNS faking (with DNAT)
• Other things
• Firewalling with iptables (If we have time)
• Questions I’ll hopefully answer

Not covered: packet mangling (change TOS, TTL and flags)

2 Differences between iptables and ipchains

• Same author (Rusty Russell), and basically smells the same
• Most important: FORWARD taken apart from INPUT and OUTPUT
• Changes in syntax
• Masqurading is handled “separately”

3 ipchains and iptables don’t live together

• If the ipchains module is resident in the kernel, iptables won’t insmod
• And vice versa
• Typical error message is misleading: “No kernel support”
• Red Hat 7.3 boots up with ipchains as default

4 What I wanted in the first place

5 Requirements

• Windows computer should have a gateway
• DNS issue solved elegantly
• Both computers have access to network at the same time
• Network between computers is trustful
• Proper firewalling
• ADSL modem is considered hostile

6 iptables: The IP packet’s flow

7 iptables: How to swallow this

• Packet filtering (firewalls) and manipulation (masquerading) are neighbours
• Therefore, the same tools are used
• Think routing tables
• Chains: Think subroutines
• Each chain is terminated with a target, or next line taken
• Subchains work exactly like subroutines
• Tables: Group of chains: filter and nat
• Each chain has a policy - the default target

8 What is Masquerading?

• All computers appear to have the same IP
• This is done with Network Adress Translation
• It’s easy to fake the “outgoing packet”
• “Incoming packets” must be translated too
• Port translation - a must

9 iptables: The IP packet’s flow

10 Source Network Address Translation (SNAT)

• On ADSL: catch packets going out on ppp0
• The source IP is changed
• Source port numbers may be changed
• Easiest rule: Do SNAT on all packets going out on ppp0
• Will include OUTPUT packets by accident, but who cares?
• Remember: Every SNAT produces an implicit DNAT
• And vice versa

11 “Incoming” packets

• The problem: Where should the packet go?
• Simple TCP connection: iptables remembers the port numbers
• UDP: Tricky
• DNS: Return the answer to whoever asked
• ICMP: Ping answers go the right way (!)
• FTP, ICQ and friends: Requires special treatment (they work for me as a basic client)
• When the other side opens a connection, that has to be treated specially
• iptables has application-based modules

12 Defining SNAT iptables commands

The strict way:

iptables -t nat -A POSTROUTING -o ppp0 -j SNAT \                                --to $PPPIP

The liberal way:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

• The “liberal” form is better for temporary connections:
• MASQUERADE automatically chooses address
• MASQUERADE forgets old connections when interface goes down
• For dial-up, cable modems and ADSL: MASQUERADE wins

13 POSTROUTE is just another chain

• Selective rules can be used
• Different manipulations are possible
• Use -j ACCEPT to let the packet through untouched

14 The wrong way to masquerade

iptables -t nat -A POSTROUTING -j MASQUERADE

• This makes masquerading the default policy for any outgoing packet
• ... including any forwarded packet.
• All forwarded packets will appear to come from the masquerading host.
• May confuse firewalls
• Even worse, may confuse service applications to compromise security

15 Masquerading and firewalling

• The internal computers are implicitly firewalled
• The main computer gets all the unrelated packets
• Main computer must be protected
• Main computer protected with INPUT and OUTPUT chains
• Other computers protected with FORWARD chains
• Note that FORWARD chains also apply to the intranet connection

16 DNS faking with DNAT

• The other computers have constant DNS addresses
• The address is translated with DNAT

iptables -t nat -A PREROUTING -d 10.2.0.1 \      -j DNAT --to-destination 192.115.106.31 iptables -t nat -A PREROUTING -d 10.2.0.2 \      -j DNAT --to-destination 192.115.106.35

17 Automatic DNS DNAT setup

• In an ADSL connection, the DNS addresses are given on connection
• An ip-up.local script writes these addresses in the resolv.conf file

DNScount=1 for nameserver in \  `perl -nle "/nameserver\D*(\d*\.\d*\.\d*\.\d*)/i && \      (\\$1=~/^127/ || print \\$1)" /etc/resolv.conf`; do iptables -t nat -A PREROUTING -d 10.2.0.$DNScount \             -j DNAT --to-destination $nameserver   let DNScount=DNScount+1; done;

• The perl statement above extracts the two addresses

18 The MTU on the Windows computer

• ADSL ppp connection has MTU of 1452
• Normal Ethernet has MTU 1500
• Windows computer doesn’t know it goes through ADSL
• Fragmentation
• Fixed by adding an entry in Window’s registry

19 Other tricks

• Server on masqueraded host (DNAT)
• Port remapping (redirection)
• Load balancing (One-to-many forward DNAT)
• Packet mangling

20 The filter chains

• INPUT, OUTPUT and FORWARD
• Targets with ACCEPT, DROP, REJECT or QUEUE
• A set of selective rules makes a firewall

21 Example: A firewall

Close everything and flush chains

iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -F -t nat iptables -F -t filter iptables -X

22 Example: A firewall (cont.)

Allow everything on loopback interface

iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT

23 Example: A firewall (cont.)

Keep ADSL modem short

iptables -A INPUT -i eth1 -s 10.0.0.138/32 \           -d 10.0.0.0/8 -p tcp \           --sport 1723 -m state \           --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -s 10.0.0.138/32 \            -d 10.0.0.0/8 -p gre -j ACCEPT iptables -A INPUT -i eth1 -j DROP iptables -A OUTPUT -o eth1 -s 10.0.0.0/8 \           -d 10.0.0.138/32 -p tcp --dport 1723 \           -j ACCEPT iptables -A OUTPUT -o eth1 -s 10.0.0.0/8 \           -d 10.0.0.138/32 -p gre -j ACCEPT iptables -A OUTPUT -o eth1 -j DROP

24 Example: A firewall (cont.)

Linux computer with network rules:

iptables -A OUTPUT -o ppp0 -s $PPPIP -j ACCEPT iptables -A INPUT -s ! 10.128.0.0/16 -p tcp \           --dport 0:1023 -j DROP iptables -A INPUT -i ppp0 -d $PPPIP -m state \           --state ESTABLISHED,RELATED -j ACCEPT

25 Example: A firewall (cont.)

Everything is allowed on internal network

iptables -A INPUT -s 10.128.0.0/16 \           -d 10.128.0.0/16 -j ACCEPT iptables -A OUTPUT -s 10.128.0.0/16 \           -d 10.128.0.0/16 -j ACCEPT

26 Example: A firewall (cont.)

Forwarding....

iptables -A FORWARD -i ppp0 -o eth0 -m state \           --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT iptables -A FORWARD -j DROP

Note that there is no forwarding in internal network

27 iptables script finale

• Make sure that the main chains end with DROP
• Zero counters

iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP iptables -A FORWARD -j DROP iptables -Z

28 Summary

• It works really well
• It’s not difficult to set up if you know what you’re doing

29 References

• Linux IP Masquerade HOWTO (a version written in Jan 2003 is available)
• man iptables