Netkiller CentOS Linux 手札

Redhat, CentOS and Scientific Linux

Mr. Neo Chan, 陈景峰(BG7NYT)

中国广东省深圳市宝安区龙华镇溪山美地
518109
+86 13113668890
+86 755 29812080
<netkiller@msn.com>

$Id: book.xml 606 2013-05-29 09:52:58Z netkiller $

版权 © 2009, 2010, 2011, 2012, 2013, 2014 Neo Chan

版权声明

转载请与作者联系，转载时请务必标明文章原始出处和作者信息及本声明。

文档出处:

http://netkiller.github.io

http://netkiller.sourceforge.net

$Date: 2013-05-29 17:52:58 +0800 (Wed, 29 May 2013) $

我的系列文档

Netkiller Architect 手札 | Netkiller Developer 手札 | Netkiller PHP 手札 | Netkiller Python 手札 | Netkiller Testing 手札 | Netkiller Cryptography 手札
Netkiller Linux 手札 | Netkiller Debian 手札 | Netkiller CentOS 手札 | Netkiller FreeBSD 手札 | Netkiller Shell 手札 | Netkiller Security 手札
Netkiller Web 手札 | Netkiller Monitoring 手札 | Netkiller Storage 手札 | Netkiller Mail 手札 | Netkiller Docbook 手札 | Netkiller Version 手札
Netkiller Database 手札 | Netkiller PostgreSQL 手札 | Netkiller MySQL 手札 | Netkiller NoSQL 手札 | Netkiller LDAP 手札 | Netkiller Network 手札
Netkiller Cisco IOS 手札 | Netkiller H3C 手札 | Netkiller Multimedia 手札 | Netkiller Perl 手札 | Netkiller Amateur Radio 手札 |

您可以使用iBook阅读当前文档

QQ群：128659835 请注明“读者”

自述

目前技术书籍的价格一路飙升，动则80，100，少则50，60. 技术书籍有时效性，随着技术的革新或淘汰，大批书记成为废纸垃圾。并且这些书技术内容雷同，相互抄袭，质量越来越差，甚至里面给出的例子错误百出，只能购买影印版，或者翻译的版本。

在这种背景下我便萌生了自己写书的想法，资料主要来源是我的笔记与例子。我并不想出版，只为分享，所有我制作了基于CC License 发行的系列电子书。

本书注重例子，少理论，只要你对这例子一步一步操作，就会成功，会让你有成就感并能坚持学下去，因为很多人遇到障碍就会放弃，其实我就是这种人，只要让他看到希望，就能坚持下去。

为什么写这篇文章

有很多想法,工作中也用不到所以未能实现，所以想写出来,和大家分享.有一点写一点,写得也不好,只要能看懂就行,就当学习笔记了.

开始零零碎碎写过一些文档，也向维基百科供过稿，但维基经常被ZF封锁，后来发现sf.net可以提供主机存放文档，便做了迁移。并开始了我的写作生涯。

这篇文档是作者10年来对工作的总结,是作者一点一滴的积累起来的，有些笔记已经丢失，所以并不完整。

因为工作太忙整理比较缓慢。目前的工作涉及面比较窄所以新文档比较少。

我现在花在技术上的时间越来越少，兴趣转向摄影，无线电。也想写写摄影方面的心得体会。

写作动力:

曾经在网上看到外国开源界对中国的评价，中国人对开源索取无度，但贡献却微乎其微.这句话一直记在我心中，发誓要为中国开源事业做我仅有的一点微薄贡献

另外写文档也是知识积累，还可以增加在圈内的影响力.

人跟动物的不同,就是人类可以把自己学习的经验教给下一代人.下一代在上一代的基础上再创新,不断积累才有今天.

所以我把自己的经验写出来,可以让经验传承

没有内容的章节:

目前我自己一人维护所有文档，写作时间有限，当我发现一个好主题就会加入到文档中，待我有时间再完善章节，所以你会发现很多章节是空无内容的.

文档目前几乎是流水帐试的写作，维护量很大，先将就着看吧.

我想到哪写到哪,你会发现文章没一个中心,今天这里写点,明天跳过本章写其它的.

文中例子绝对多,对喜欢复制然后粘贴朋友很有用,不用动手写,也省时间.

理论的东西,网上大把,我这里就不写了,需要可以去网上查.

我爱写错别字,还有一些是打错的,如果发现请指正.

文中大部分试验是在Debian/Ubuntu/Redhat AS上完成.

系列文档

下面是我多年积累下来的经验总结，整理成文档供大家参考:

HTML 格式

http://netkiller.github.com/home/technology.html

http://netkiller.sourceforge.net/home/technology.html

CHM 格式电子文档下载

https://sourceforge.net/projects/netkiller/files/htmlhelp.chm/

PDF 格式

Download PDF Document 下载PDF文档1

Download PDF Document 下载PDF文档2

EPUB 格式

http://netkiller.sourceforge.net/technology.html

通过 GIT 镜像整个网站

https://github.com/netkiller/netkiller.github.com.git

$ git clone https://github.com/netkiller/netkiller.github.com.git

其他方式

获得光盘介质，RPM包，DEB包，如有特别需要，请联系我

YUM 在线安装电子书

http://netkiller.sourceforge.net/pub/repo/

# cat >> /etc/yum.repos.d/netkiller.repo <<EOF
[netkiller]
name=Netkiller Free Books
baseurl=http://netkiller.sourceforge.net/pub/repo/
enabled=1
gpgcheck=0
gpgkey=
EOF

查找包

# yum search netkiller

netkiller-centos.x86_64 : Netkiller centos Cookbook
netkiller-cryptography.x86_64 : Netkiller cryptography Cookbook
netkiller-docbook.x86_64 : Netkiller docbook Cookbook
netkiller-linux.x86_64 : Netkiller linux Cookbook
netkiller-mysql.x86_64 : Netkiller mysql Cookbook
netkiller-php.x86_64 : Netkiller php Cookbook
netkiller-postgresql.x86_64 : Netkiller postgresql Cookbook
netkiller-python.x86_64 : Netkiller python Cookbook
netkiller-version.x86_64 : Netkiller version Cookbook

安装包

yum install netkiller-docbook

作者简介

陈景峰 (ㄔㄣ ㄐ丨ㄥ ㄈㄥ)

Nickname：netkiller | English name: Neo chen | Nippon name: ちんけいほう (音訳) | Korean name: 천징봉 | Thailand name: ภูมิภาพภูเขา

Callsign: BG7NYT | QTH: ZONE CQ24 ITU44 ShenZhen, China

程序猿，攻城狮，挨踢民工, Full Stack Developer, UNIX like Evangelist, 业余无线电爱好者（呼号：BG7NYT）,户外运动，山地骑行以及摄影爱好者。

《Netkiller 系列 手札》的作者

成长阶段

1981年1月19日(庚申年腊月十四)出生于黑龙江省青冈县建设乡双富大队第一小队

1989年9岁随父母迁居至黑龙江省伊春市，悲剧的天朝教育，不知道那门子归定，转学必须降一级，我本应该上一年级，但体制让我上学前班，那年多都10岁了

1995年小学毕业，体制规定借读要交3000两银子(我曾想过不升初中)，亲戚单位分楼告别平房，楼里没有地方放东西，把2麻袋书送给我，无意中发现一本电脑书BASIC语言，我竟然看懂了，对于电脑知识追求一发而不可收，后面顶零花钱，压岁钱主要用来买电脑书《MSDOS 6.22》《新编Unix实用大全》《跟我学Foxbase》。。。。。。

1996年第一次接触UNIX操作系统，BSD UNIX, Microsoft Xinux(盖茨亲自写的微软Unix，知道的人不多)

1997年自学Turbo C语言，苦于没有电脑，后来学校建了微机室才第一次使用QBASIC(DOS 6.22 自带命令)，那个年代只能通过软盘拷贝转播，Trubo C编译器始终没有搞到，

1997年第一次上Internet网速只有9600Bps, 当时全国兴起各种信息港域名格式是www.xxxx.info.net, 访问的第一个网站是NASA下载了很多火星探路者拍回的照片，还有“淞沪”sohu的前身

1998~2000年在哈尔滨学习计算机，充足的上机时间，但老师让我们练打字（明伦五笔/WT）打字不超过80个/每分钟还要强化训练，不过这个给我的键盘功夫打了好底。

1999年学校的电脑终于安装了光驱，在一张工具盘上终于找到了Turbo C与Quick Basic编译器，当时对VGA图形编程非常感兴趣，通过INT33中断控制鼠标，使用绘图函数模仿windows界面。还有操作 UCDOS 中文字库，绘制矢量与点阵字体。

2000年沉迷于Windows NT与Back Office各种技术，神马主域控制器，DHCP，WINS，IIS，域名服务器，Exchange邮件服务器，MS Proxy, NetMeeting...以及ASP+MS SQL开发；用56K猫下载了一张LINUX。ISO镜像，安装后我兴奋的24小时没有睡觉。

职业生涯

2001年来深圳进城打工,成为一名外来务工者. 在一个4人公司做PHP开发，当时PHP的版本是2。0, 开始使用Linux Redhat 6.2.当时很多门户网站都是用FreeBSD,但很难搞到安装盘，在网易社区认识了一个网友,从广州给我寄了一张光盘，FreeBSD 3.2

2002年我发现不能埋头苦干,还要学会"做人".同住辗转广州工作了半年。

2003年这年最惨,公司拖欠工资16000元,打过两次官司2005才付清.

2004年开始加入分布式计算团队,目前成绩

2004-10月开始玩户外和摄影

2005-6月成为中国无线电运动协会会员,呼号BG7NYT,进了一部Yaesu FT-60R手台。

2006年单身生活了这么多年,终于找到归宿.

2007物价上涨,金融危机，休息了4个月（其实是找不到工作）,关外很难上439.460中继，搞了一台Yaesu FT-7800.

2008终于找到英文学习方法，， 《Netkiller Developer 手札》，《Netkiller Document 手札》

2008-8-8 08:08:08 结婚,后全家迁居湖南省常德市

2009《Netkiller Database 手札》,2009-6-13学车，年底拿到C1驾照

2010对电子打击乐产生兴趣，计划学习爵士鼓

2011 平凡的一年，户外运动停止，电台很少开，中继很少上，摄影主要是拍女儿与家人，年末买了一辆山地车

2012 对油笔画产生了兴趣，活动基本是骑行银湖山绿道，

2013开始学习民谣吉他，同时对电吉他也极有兴趣；最终都放弃了。这一年深圳开始推数字中继2013-7-6日入手Motorola MOTOTRBO XIR P8668，Netkiller 系列手札从Sourceforge向Github迁移；年底对MYSQL UDF，Engine与PHP扩展开发产生很浓的兴趣，拾起遗忘10+年的C，写了几个mysql扩展（图片处理，fifo管道与ZeroMQ）

2014职业生涯路上继续打怪升级

联系作者

http://netkiller.github.io/

http://netkiller.sourceforge.net/

Mobile: +86 13113668890

Tel: +86 755 2981-2080

Callsign: BG7NYT QTH: Shenzhen, China

注：请不要问我安装问题！

Email: netkiller@msn.com

MSN: netkiller@msn.com

ICQ: 101888222

QQ: 13721218

Yahoo/AIM/GTalk: bg7nyt

IRC: irc://irc.freenode.net /nickname netkiller or neo

CQ CQ CQ DE BG7NYT

写给火腿:

欢迎无线电爱好者和我QSO,我的QTH在深圳宝安区龙华镇溪山美地12B7CD,设备YAESU FT-50R,FT-60R,FT-7800 144-430双段机, ,拉杆天线/GP天线 Nagoya MAG-79EL-3W/Yagi

如果这篇文章对你有所帮助,请寄给我一张QSL卡片,qrz.cn or qrz.com or hamcall.net

Personal Amateur Radiostations of P.R.China

ZONE CQ24 ITU44 ShenZhen, China

Best Regards, VY 73! OP. BG7NYT

Blogger

Twitter: http://twitter.com/bg7nyt

Digg: http://www.digg.com/netkiller

Facebook: https://www.facebook.com/bg7nyt

LinkedIn: http://cn.linkedin.com/in/netkiller

Flickr: http://www.flickr.com/photos/bg7nyt/

Disqus: http://disqus.com/netkiller/

solidot: http://solidot.org/~netkiller/

ITEYE: http://netkiller-github-com.iteye.com

OSChina: http://my.oschina.net/neochen/

51CTO: http://bg7nyt.blog.51cto.com/|http://g.51cto.com/netkiller

pengyou: http://www.pengyou.com/netkiller

weibo: http://weibo.com/bg7nyt

163 Blog: http://t.163.com/netkiller

Mailing List

http://groups.google.com/group/netkiller

Send email to this group: netkiller@googlegroups.com

RSS http://groups.google.com/group/netkiller/feed/rss_v2_0_topics.xml?num=50

写给读者

写给读者

欢迎提出宝贵的建议,如有问题请到邮件列表讨论

至读者：

我不知道什么时候，我不再更新文档或者退出IT行业去从事其他工作，我必须给这些文档找一个归宿，让他能持续更新下去。

我想捐赠给某些基金会继续运转，或者建立一个团队维护它。

我用了10年时间坚持不停地写作，持续更新，才有今天你看到的《Netkiller 手扎》系列文档，在中国能坚持10年，同时没有任何收益的技术类文档，是非常不容易的。

有很多时候想放弃，看到外国读者的支持与国内社区的影响，我坚持了下来。

中国开源事业需要各位参与，不要成为局外人，不要让外国人说：中国对开源索取无度，贡献却微乎其微。

我们参与内核的开发还比较遥远，但是进个人能力，写一些文档还是可能的。

部分 I. System

第 1 章 Getting Started Guides

HDD Partition

partition

表 1.1. Linux server partition

volume | size
/boot | 300M
/ | 30G
/var | 50G
/opt | remainder
swap | memory * 2

表 1.2. Linux desktop partition

volume | size
/boot | 300M
/ | 30G
/var | 50G
/home | remainder
swap | memory * 2

Scientific Linux

Redhat Linux

CentOS Linux

5.x 减肥

卸载无用的包

yum remove NetworkManager
yum remove avahi
yum remove cups
yum remove bluez-gnome bluez-utils bluez-libs
yum remove isdn4k-utils

6.x Mini 安装后需要做的一些事

禁用防火墙与SELinux

lokkit --disabled --selinux=disabled

yum remove dhclient -y

yum update -y
yum install -y telnet wget rsync
yum install -y openssh-clients
yum install -y system-config-network-tui
yum install -y bind-utils
yum install -y vim-enhanced

第 2 章 System Utilities 配置工具

timeconfig

system-config-cluster

system-config-httpd

system-config-nfs

system-config-samba

setup

setup

system-config-date

   ┌────────┤ Timezone Selection ├────────┐
   │                                      │
   │ Select the timezone for the system.  │
   │                                      │
   │  Asia/Bahrain                    ↑   │
   │  Asia/Baku                       ▒   │
   │  Asia/Bangkok                    ▒   │
   │  Asia/Beirut                     ▮   │
   │  Asia/Bishkek                    ▒   │
   │  Asia/Brunei                     ▒   │
   │  Asia/Choibalsan                 ▒   │
   │  Asia/Chongqing                  ↓   │
   │                                      │
   │      [*] System clock uses UTC       │
   │                                      │
   │     ┌────┐          ┌────────┐       │
   │     │ OK │          │ Cancel │       │
   │     └────┘          └────────┘       │
   │                                      │
   │                                      │
   └──────────────────────────────────────┘

system-config-firewall

        ┌───────────┤ Firewall Configuration ├───────────┐
        │                                                │
        │ A firewall protects against unauthorized       │
        │ network intrusions. Enabling a firewall blocks │
        │ all incoming connections. Disabling a firewall │
        │ allows all connections and is not recommended. │
        │                                                │
        │             Firewall: [*] Enabled              │
        │                                                │
        │   ┌────┐      ┌───────────┐      ┌────────┐    │
        │   │ OK │      │ Customize │      │ Cancel │    │
        │   └────┘      └───────────┘      └────────┘    │
        │                                                │
        │                                                │
        └────────────────────────────────────────────────┘

system-config-securitylevel

     ┌────────────┤ Firewall Configuration ├────────────┐
     │                                                  │
     │ A firewall protects against unauthorized         │
     │ network intrusions. Enabling a firewall blocks   │
     │ all incoming connections. Disabling a firewall   │
     │ allows all connections and is not recommended.   │
     │                                                  │
     │    Security Level: ( ) Enabled (*) Disabled      │
     │                                                  │
     │               SELinux: Enforcing                 │
     │                        Permissive                │
     │                        Disabled                  │
     │                                                  │
     │    ┌────┐       ┌───────────┐      ┌────────┐    │
     │    │ OK │       │ Customize │      │ Cancel │    │
     │    └────┘       └───────────┘      └────────┘    │
     │                                                  │
     │                                                  │
     └──────────────────────────────────────────────────┘

system-config-language

 ┌──────────┤ Language Selection ├──────────┐
 │                                          │
 │   Select the language for the system.    │
 │                                          │
 │  English (Hong Kong)                   ↑ │
 │  English (India)                       ▒ │
 │  English (Ireland)                     ▮ │
 │  English (New Zealand)                 ▒ │
 │  English (Philippines)                 ▒ │
 │  English (Singapore)                   ▒ │
 │  English (South Africa)                ▒ │
 │  English (USA)                         ↓ │
 │                                          │
 │      ┌────┐            ┌────────┐        │
 │      │ OK │            │ Cancel │        │
 │      └────┘            └────────┘        │
 │                                          │
 │                                          │
 └──────────────────────────────────────────┘

system-config-keyboard

       ┌─────────────┤ Keyboard Selection ├──────────────┐
       │                                                 │
       │ Select the appropriate keyboard for the system. │
       │                                                 │
       │        Slovenian                       ↑        │
       │        Serbian                         ▒        │
       │        Serbian (latin)                 ▒        │
       │        Swedish                         ▒        │
       │        Turkish                         ▒        │
       │        Ukrainian                       ▮        │
       │        United Kingdom                  ▒        │
       │        U.S. English                    ↓        │
       │                                                 │
       │        ┌────┐                ┌────────┐         │
       │        │ OK │                │ Cancel │         │
       │        └────┘                └────────┘         │
       │                                                 │
       │                                                 │
       └─────────────────────────────────────────────────┘

system-config-network

system-config-network

          ┌──────┤ Select Action ├──────┐
          │                             │
          │    Device configuration     │
          │    DNS configuration        │
          │                             │
          │                             │
          │                             │
          │  ┌───────────┐   ┌──────┐   │
          │  │ Save&Quit │   │ Quit │   │
          │  └───────────┘   └──────┘   │
          │                             │
          │                             │
          └─────────────────────────────┘

system-config-network-cmd

[root@r910 ~]# system-config-network-cmd
DeviceList.Ethernet.eth0.AllowUser=False
DeviceList.Ethernet.eth0.BootProto=dhcp
DeviceList.Ethernet.eth0.Device=eth0
DeviceList.Ethernet.eth0.DeviceId=eth0
DeviceList.Ethernet.eth0.HardwareAddress=78:2B:CB:3B:4B:74
DeviceList.Ethernet.eth0.IPv6Init=False
DeviceList.Ethernet.eth0.NMControlled=True
DeviceList.Ethernet.eth0.OnBoot=False
DeviceList.Ethernet.eth0.Type=Ethernet
DeviceList.Ethernet.eth1.AllowUser=False
DeviceList.Ethernet.eth1.BootProto=dhcp
DeviceList.Ethernet.eth1.Device=eth1
DeviceList.Ethernet.eth1.DeviceId=eth1
DeviceList.Ethernet.eth1.HardwareAddress=78:2B:CB:3B:4B:76
DeviceList.Ethernet.eth1.IPv6Init=False
DeviceList.Ethernet.eth1.NMControlled=True
DeviceList.Ethernet.eth1.OnBoot=False
DeviceList.Ethernet.eth1.Type=Ethernet
DeviceList.Ethernet.eth2.AllowUser=False
DeviceList.Ethernet.eth2.BootProto=dhcp
DeviceList.Ethernet.eth2.Device=eth2
DeviceList.Ethernet.eth2.DeviceId=eth2
DeviceList.Ethernet.eth2.HardwareAddress=78:2B:CB:3B:4B:78
DeviceList.Ethernet.eth2.IPv6Init=False
DeviceList.Ethernet.eth2.NMControlled=True
DeviceList.Ethernet.eth2.OnBoot=False
DeviceList.Ethernet.eth2.Type=Ethernet
DeviceList.Ethernet.eth3.AllowUser=False
DeviceList.Ethernet.eth3.BootProto=dhcp
DeviceList.Ethernet.eth3.Device=eth3
DeviceList.Ethernet.eth3.DeviceId=eth3
DeviceList.Ethernet.eth3.HardwareAddress=78:2B:CB:3B:4B:7A
DeviceList.Ethernet.eth3.IPv6Init=False
DeviceList.Ethernet.eth3.NMControlled=True
DeviceList.Ethernet.eth3.OnBoot=False
DeviceList.Ethernet.eth3.Type=Ethernet
HardwareList.Ethernet.eth3.Card.ModuleName=bnx2
HardwareList.Ethernet.eth3.Description=Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet
HardwareList.Ethernet.eth3.Name=eth3
HardwareList.Ethernet.eth3.Status=system
HardwareList.Ethernet.eth3.Type=Ethernet
HardwareList.Ethernet.eth2.Card.ModuleName=bnx2
HardwareList.Ethernet.eth2.Description=Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet
HardwareList.Ethernet.eth2.Name=eth2
HardwareList.Ethernet.eth2.Status=system
HardwareList.Ethernet.eth2.Type=Ethernet
HardwareList.Ethernet.eth1.Card.ModuleName=bnx2
HardwareList.Ethernet.eth1.Description=Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet
HardwareList.Ethernet.eth1.Name=eth1
HardwareList.Ethernet.eth1.Status=system
HardwareList.Ethernet.eth1.Type=Ethernet
HardwareList.Ethernet.eth0.Card.ModuleName=bnx2
HardwareList.Ethernet.eth0.Description=Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet
HardwareList.Ethernet.eth0.Name=eth0
HardwareList.Ethernet.eth0.Status=system
HardwareList.Ethernet.eth0.Type=Ethernet
ProfileList.default.Active=True
ProfileList.default.ActiveDevices.1=eth0
ProfileList.default.ActiveDevices.2=eth1
ProfileList.default.ActiveDevices.3=eth2
ProfileList.default.ActiveDevices.4=eth3
ProfileList.default.DNS.Domainname=
ProfileList.default.DNS.Hostname=r910.example.com
ProfileList.default.DNS.PrimaryDNS=202.96.134.133
ProfileList.default.DNS.SearchList.1=example.com
ProfileList.default.DNS.SecondaryDNS=202.96.128.68
ProfileList.default.DNS.TertiaryDNS=
ProfileList.default.HostsList.1.AliasList.1=r910
ProfileList.default.HostsList.1.Hostname=r910.example.com
ProfileList.default.HostsList.1.IP=192.168.80.33
ProfileList.default.HostsList.2.AliasList.1=localhost
ProfileList.default.HostsList.2.Hostname=localhost.localdomain
ProfileList.default.HostsList.2.IP=127.0.0.1
ProfileList.default.HostsList.3.AliasList.1=r910
ProfileList.default.HostsList.3.AliasList.2=localhost6.localdomain6
ProfileList.default.HostsList.3.AliasList.3=localhost6
ProfileList.default.HostsList.3.Hostname=r910.example.com
ProfileList.default.HostsList.3.IP=::1
ProfileList.default.ProfileName=default

ntsysv

ntsysv

     ┌──────────────────┤ Services ├──────────────────┐
     │                                                │
     │ What services should be automatically started? │
     │                                                │
     │             [*] NetworkManager  ↑              │
     │             [*] acpid           ▮              │
     │             [*] atd             ▒              │
     │             [ ] auditd          ▒              │
     │             [*] autofs          ▒              │
     │             [*] avahi-daemon    ▒              │
     │             [*] bluetooth       ▒              │
     │             [ ] certmonger      ▒              │
     │             [ ] cgconfig        ▒              │
     │             [ ] cgred           ▒              │
     │             [*] cpuspeed        ▒              │
     │             [*] crond           ▒              │
     │             [*] cups            ▒              │
     │             [ ] dnsmasq         ▒              │
     │             [ ] firstboot       ▒              │
     │             [*] haldaemon       ↓              │
     │                                                │
     │        ┌────┐               ┌────────┐         │
     │        │ Ok │               │ Cancel │         │
     │        └────┘               └────────┘         │
     │                                                │
     │                                                │
     └────────────────────────────────────────────────┘

lokkit

lokkit

禁用Iptable与SELinux

lokkit --disabled --selinux=disabled

system-config-kdump

system-config-services

system-config-services

authconfig-tui

authconfig-tui

第 3 章 kickstart

摘要

Kickstart 无人值守安装

install kickstart

# yum search kickstart
Loaded plugins: refresh-packagekit
========================================================================== Matched: kickstart ==========================================================================
pykickstart.noarch : A python library for manipulating kickstart files
system-config-kickstart.noarch : A graphical interface for making kickstart files
sl-revisor-configs.noarch : Kickstart and config files for creating your own SL Spins

# yum install system-config-kickstart

ks.cfg

# cat ks.cfg
#platform=x86, AMD64, or Intel EM64T
#version=DEVEL
# Firewall configuration
firewall --disabled
# Install OS instead of upgrade
install
# Use CDROM installation media
cdrom
# Root password
rootpw --iscrypted $1$5T/3LoJq$0B3n9sC.NuuGslFqkWDSw/
# Network information
network  --bootproto=dhcp --device=eth0 --onboot=on
# System authorization information
auth  --useshadow  --passalgo=md5
# Use graphical install
graphical
firstboot --disable
# System keyboard
keyboard us
# System language
lang en_US
# SELinux configuration
selinux --disabled
# Installation logging level
logging --level=info

# System timezone
timezone  Asia/Harbin
# System bootloader configuration
bootloader --location=mbr
# Clear the Master Boot Record
zerombr
# Partition clearing information
clearpart --all --initlabel
# Disk partitioning information
part /boot --fstype="ext4" --size=500
part swap --fstype="swap" --size=32000
part / --fstype="ext4" --size=50000
part /opt --fstype="ext4" --grow --size=1

boot 参数

boot:

linux ks=floppy
linux ks=floppy:/<path>
linux ks=hd:fd0:/ks.cfg

linux ks=hd:<device>:/<file>
linux ks=hd:sda3:/ks.cfg

linux ks=nfs:<server:>/<path> ksdevice=eth1
linux ks=nfs:<server>:/<path>

linux ks=http://<server>/<path>

linux ks=file:/<file>
linux ks=cdrom:/<path>
linux ks=cdrom:/ks.cfg

USB:

linux install ks=hd:sda:/anaconda-ks.cfg
or
linux install ks=hd:sda1:/anaconda-ks.cfg

第 4 章 Package Manager

Yum Resource & Yum Mirror

yum install yum-fastestmirror -y

Fedora resource

http://fedoraproject.org/wiki/EPEL

Fedora 5.4

5.4

rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

Fedora 6.x

6.x

rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/i386/epel-release-6-5.noarch.rpm
rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm

上面的地址已经停用，新地址在：http://mirrors.fedoraproject.org/publiclist

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm

epel-release-6-7.noarch.rpm 升级为 epel-release-6-8.noarch.rpm

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

rpmforge-release

http://wiki.centos.org/AdditionalResources/Repositories/RPMForge

CentOS 5.x

http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm
http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm

# wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm
# rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt
# rpm -K rpmforge-release-0.5.2-2.el5.rf.*.rpm
# rpm -i rpmforge-release-0.5.2-2.el5.rf.*.rpm

CentOS 6.x

i686 http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.i686.rpm
x86_64 http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt
rpm -K http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
rpm -i http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

CentOS 6.5

http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.i686.rpm
http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm

CentALT

http://centos.alt.ru

http://centos.alt.ru/repository/centos/5/i386/centalt-release-5-3.noarch.rpm
http://centos.alt.ru/repository/centos/5/x86_64/centalt-release-5-3.noarch.rpm

http://centos.alt.ru/repository/centos/6/i386/centalt-release-6-1.noarch.rpm
http://centos.alt.ru/repository/centos/6/x86_64/centalt-release-6-1.noarch.rpm

含 php-fpm 等包

rpm -Uvh http://centos.alt.ru/repository/centos/6/x86_64/centalt-release-6-1.noarch.rpm

atomic

http://www6.atomicorp.com/channels/atomic/centos/5/x86_64/RPMS/atomic-release-1.0-14.el5.art.noarch.rpm

famillecollet

rpm --import http://rpms.famillecollet.com/RPM-GPG-KEY-remi
rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm

rpmfind.net

http://rpmfind.net

pkgs.org

http://pkgs.org/

China Resource

http://mirrors.163.com/ http://mirrors.sohu.com/

制作本地共享源

我使用Ubuntu + vsftpd为 Redhat 提供源

将光盘Mount到/mnt，或使用iso文件Mount 到 /mnt

sudo mount /dev/cdrom /mnt/
or
sudo mount -o loop rhel-server-5.6-i386-dvd.iso /mnt

将整个光盘复制到ftp的anonymous目录或者http目录

sudo rsync -auvP /mnt/* /srv/ftp/

一般完整DVD光盘复制，不需要做此步骤。如果你的RPM看来自非官方，需要运行createrepo

cd /srv/ftp/
sudo apt-get install createrepo
sudo createrepo -g repodata/comps-rhel5-server-core.xml Server

FTP方式

cat > /etc/yum.repos.d/rhel-source-dvd.repo <<EOF
[rhel-source-dvd]
name=Red Hat Enterprise Linux $releasever - Source
baseurl=ftp://172.16.1.2/Server
enabled=1
gpgcheck=1
gpgkey=ftp://172.16.1.2/RPM-GPG-KEY-redhat-release
EOF

HTTP方式

cat > /etc/yum.repos.d/rhel-source-dvd.repo <<EOF
[rhel-source-dvd]
name=Red Hat Enterprise Linux $releasever - Source
baseurl=http://172.16.1.2/Server
enabled=1
gpgcheck=1
gpgkey=http://172.16.1.2/RPM-GPG-KEY-redhat-release
EOF

还可以使用本地文件或者光盘Mount目录

cat > /etc/yum.repos.d/rhel-source-dvd.repo <<EOF
[rhel-source-dvd]
name=Red Hat Enterprise Linux $releasever - Source
baseurl=file:///mnt/Server
enabled=1
gpgcheck=1
gpgkey=file:///mnt/RPM-GPG-KEY-redhat-release
EOF

yum clean all
yum list updates

yum - Yellowdog Updater Modified

install

yum -y install package

reinstall

yum -y reinstall package

localinstall

yum localinstall 可以代替 rpm -ivh 并且会自己安装依赖包

# yum localinstall asymptote-2.08-1.fc12.i686.rpm

list

yum list

列出已经安装的包

yum list installed

yum list installed | wc -l

yum list installed ntp

yum list installed mysql\*

yum list updates
yum list extras

search

yum search mysql

update / upgrade

check update

[root@development ~]# yum check-update
[root@development ~]# yum -y update

upgrade

# yum upgrade

remove

#yum remove httpd

group

grouplist

[root@localhost ~]#  yum grouplist
Loaded plugins: fastestmirror
Setting up Group Process
Loading mirror speeds from cached hostfile
 * addons: mirrors.163.com
 * base: mirrors.163.com
 * extras: mirrors.163.com
 * updates: mirrors.163.com
Installed Groups:
   Administration Tools
   Development Libraries
   Dialup Networking Support
   Editors
   Mail Server
   Network Servers
   Office/Productivity
   Server Configuration Tools
   System Tools
   Text-based Internet
   Web Server
   Yum Utilities
Available Groups:
   Authoring and Publishing
   Base
   Beagle
   Cluster Storage
   Clustering
   DNS Name Server
   Development Tools
   Emacs
   Engineering and Scientific
   FTP Server
   FreeNX and NX
   GNOME Desktop Environment
   GNOME Software Development
   Games and Entertainment
   Graphical Internet
   Graphics
   Horde
   Java
   Java Development
   KDE (K Desktop Environment)
   KDE Software Development
   KVM
   Legacy Network Server
   Legacy Software Development
   Legacy Software Support
   Mono
   MySQL Database
   News Server
   OpenFabrics Enterprise Distribution
   PostgreSQL Database
   Printing Support
   Ruby
   Sound and Video
   Tomboy
   Virtualization
   Windows File Server
   X Software Development
   X Window System
   XFCE-4.4
Done

groupinfo

# yum groupinfo "Server Configuration Tools"
Loaded plugins: fastestmirror
Setting up Group Process
Loading mirror speeds from cached hostfile
 * addons: centos.ustc.edu.cn
 * base: centos.ustc.edu.cn
 * extras: centos.ustc.edu.cn
 * updates: centos.ustc.edu.cn

Group: Server Configuration Tools
 Description: This group contains all of CentOS's custom server configuration tools.
 Default Packages:
   system-config-httpd
   system-config-nfs
   system-config-printer-gui
   system-config-samba
   system-config-securitylevel
   system-config-services
 Optional Packages:
   system-config-bind
   system-config-boot
   system-switch-mail-gnome

groupinstall

#yum groupinstall 'X Window System'  -y

安装GNOME桌面环境
#yum groupinstall  'GNOME Desktop Environment' -y

安装KDE桌面环境
#yum groupinstall 'KDE (K Desktop Environment)' -y

groupremove

卸载GNOME桌面环境
#yum groupremove "GNOME Desktop Environment"

卸载KDE桌面环境
#yum groupremove "KDE (K Desktop Environment)"

yum groupremove "GNOME Desktop Environment" "Games and Entertainment" "Graphical Internet" "Graphics" "Office/Productivity" "Printing Support" "Sound and Video" "Web Server" "X Window System"

查看包的依赖关系

# yum deplist libcurl

provides

查询pg_config命令在那一个包中

# yum provides "*/pg_config"

# yum provides "*/libpq-fe.h"

YUM 源管理

列出所有yum源

# yum repolist all

查看启用YUM源

# yum repolist enabled

查看禁用YUM源

# yum repolist disabled

禁用YUM源

# yum-config-manager --disable mysql-connectors-community

启用YUM源

sudo yum-config-manager --enable mysql57-community-dmr

或者修改/etc/yum.repos.d/文件也能实现相同的作用 enabled=0 为禁用 enabled=1启用

rpm - RPM Package Manager

install/upgrade/remove

1.安装一个包
# rpm -ivh

2.升级一个包
# rpm -Uvh

3.删除一个包
# rpm -e

不检查依赖性关系

rpm -ivh --nodeps

强制安装

rpm -ivh --force --nodeps

--prefix

安装到指定目录

rpm -ivh --prefix=/opt/usr your.rpm

同时修改多个路径：

rpm xxx.rpm --relocate=/usr=/opt/usr --relocate=/etc=/usr/etc

query

查询一个包是否被安装

[root@database ~]# rpm -q mysql
mysql-5.0.77-3.el5
mysql-5.0.77-3.el5

安装的包的信息

[root@database ~]# rpm -qi nginx
Name        : nginx                        Relocations: (not relocatable)
Version     : 0.6.39                            Vendor: Fedora Project
Release     : 2.el5                         Build Date: Sat 05 Dec 2009 05:31:02 AM HKT
Install Date: Mon 28 Dec 2009 02:36:36 PM HKT      Build Host: x86-6.fedora.phx.redhat.com
Group       : System Environment/Daemons    Source RPM: nginx-0.6.39-2.el5.src.rpm
Size        : 772477                           License: BSD
Signature   : DSA/SHA1, Mon 07 Dec 2009 07:06:40 AM HKT, Key ID 119cc036217521f6
Packager    : Fedora Project
URL         : http://nginx.net/
Summary     : Robust, small and high performance http and reverse proxy server
Description :
Nginx [engine x] is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3
proxy server written by Igor Sysoev.

One third party module, nginx-upstream-fair, has been added.

列出该包中有哪些文件

[root@database ~]# rpm -ql cacti.noarch |more
/etc/cacti
/etc/cacti/db.php
/etc/cron.d/cacti
/etc/httpd/conf.d/cacti.conf
/etc/logrotate.d/cacti
/usr/share/cacti
/usr/share/cacti/about.php
/usr/share/cacti/auth_changepassword.php
/usr/share/cacti/auth_login.php
/usr/share/cacti/cdef.php
/usr/share/cacti/cmd.php
/usr/share/cacti/color.php
/usr/share/cacti/data_input.php
/usr/share/cacti/data_queries.php
/usr/share/cacti/data_sources.php
/usr/share/cacti/data_templates.php
/usr/share/cacti/gprint_presets.php
/usr/share/cacti/graph.php
/usr/share/cacti/graph_image.php
/usr/share/cacti/graph_settings.php
/usr/share/cacti/graph_templates.php
/usr/share/cacti/graph_templates_inputs.php
/usr/share/cacti/graph_templates_items.php

列出一个文件属于哪一个RPM包

[root@database ~]# rpm -qf /usr/bin/svn
subversion-1.4.2-4.el5_3.1

rpm -q --qf '%{NAME}-%{VERSION}-%{RELEASE} (%{ARCH})\n' \
gcc
gcc-c++

rpm -qa --qf '%{NAME} %{VENDOR}\n'

列出所有被安装的RPM包

[root@database ~]# rpm -qa |more
pciutils-devel-2.2.3-7.el5
rmt-0.4b41-4.el5
bsh-manual-1.3.0-9jpp.1
libgcc-4.1.2-46.el5
libICE-1.0.1-2.1
popt-1.10.2.3-18.el5
libXau-1.0.1-3.1
nspr-4.7.4-1.el5_3.1
libjpeg-6b-37
libogg-1.1.3-3.el5
libXdmcp-1.0.1-2.1
iproute-2.6.18-10.el5
libraw1394-1.3.0-1.el5
libbonobo-2.16.0-1.fc6
libavc1394-0.5.3-1.fc6
ttmkfdir-3.0.9-23.el5
cdrecord-2.01-10.7.el5
grep-2.5.1-55.el5
dmidecode-2.9-1.el5
nspr-4.7.4-1.el5_3.1
ncurses-5.5-24.20060715
libgcrypt-1.4.4-5.el5
keyutils-libs-1.2-1.el5

rpmbuild - Build RPM Package(s)

安装rpmbuild,我们将使用它来制作rpm包

yum search rpm-build
yum install -y rpm-build

Debian: sudo apt-get install rpm

rpm 工作空间，默认是/usr/src/redhat/

mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}

echo "%_topdir /home/neo/rpmbuild" >> ~/.rpmmacros
echo "%packager Test User <test@example.com>" >> ~/.rpmmacros
cat ~/.rpmmacros

touch ~/rpmbuild/SPECS/package-1.0.spec

准备好你的文件包

tar zcvf %{name}-%{version}.tar.gz your_dir

编辑spec文件

vim ~/rpmbuild/SPECS/package-1.0.spec

Summary: My Test Package
Name: test
Version: 1.0
Release: 1.0
License: BSD
# group you want your package in, mostly for GUI package browsers
# some example groups used by vendors:
# http://www.rpmfind.net/linux/RPM/Groups.html
Group: Networking/Daemons
# your name for example
Packager: Neo Chen <openunix@163.com>
#
#Source: http://full.url.to.the/package/%{name}-%{version}.tar.gz
Source: %{name}-%{version}.tar.gz
# list all your patches here:
#Patch:
# list all packages required to build this package
#BuildRequires:
#Provides:
# list all packages that conflict with this one:
#BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRoot: %{_tmppath}/%{name}-%{version}

####
# full length description
%description

description

#####
# this prepares a fresh build directory in ~/build/BUILD, useful macros here
# are:
# %setup - cleans any previous builds and untargzips the source
# %patch - applies patches
# any other commands here are executed as standard sh commands
%prep

%setup
#%patch

#####
# this tells rpmbuild how to build your package, rpmbuild runs it as a sh
# script
%build
#make

#####
# all the steps necessary to install your package into $RPM_BUILD_ROOT
# first step is to clear $RPM_BUILD_ROOT
%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
cp -r ../* %{_tmppath}
#install all files under RPM_BUILD_ROOT
#make install DESTDIR=$RPM_BUILD_ROOT
# now you can remove uneeded stuff
#rm -f $RPM_BUILD_ROOT{_prefix}

#####
# NOTE: this section is optional
# commands run just before the package is installed
%pre
#/usr/sbin/useradd -c "test user" -r -s /bin/false -u 666 -d / neo 2> /dev/null

#####
# NOTE: this section is optional
# commands run before uninstalling the software
%preun
#/sbin/service test stop > /dev/null 2>&1
#/sbin/chkconfig --del test

#####
# NOTE: this section is optional
# commands run after installing the package
%post
#/sbin/chkconfig -add test
#touch /var/log/test

#####
# NOTE: this section is optional
# commands run after unistalling the package
%postun
#/sbin/service test stop
#/usr/sbin/userdel test

#####
# list all the files that are part of the package. If a file is not in the
# list rpmbuild won't put it in the package
# see below on how to automate the process of creating this list.
# some useful macros here:
# %doc /path/to/filename - installs filename into /path/to/filename and marks
# it as being documentation
# %config /etc/config_file - similar for configuration files
# %attr(mode, user, group) file - lets you specify file attributes applied
# during installation, use - if you want to use defaults
%files
#/usr/bin/test
#/usr/sbin/test
# this will package the dir and all directories inside it
#/example/of/a/dir
/srv/neo
# this will package only the 'dir' directory
#%dir /example/of/a/dir

#####
# document changes between package releases
%changelog

开始制作rpm文件

rpmbuild -ba ~/rpmbuild/SPECS/package-1.0.spec

查看你的rpm文件包含文件列表

rpm -qpl /usr/src/redhat/RPMS/x86_64/test-1.0-1.0.x86_64.rpm
/srv
/srv/bin
/srv/bin/console
/srv/bin/nodekeeper
/srv/etc
/srv/etc/commands.cfg
/srv/etc/nodekeeper.cfg
/srv/etc/protocol.cfg
/srv/logs
/srv/logs/nodekeeper.log
/srv/run
/srv/run/nodekeeper.pid

安装RPM

# rpm -Uvh --nodeps /tmp/test-1.0-1.0.x86_64.rpm
Preparing...                ########################################### [100%]
   1:test                   ########################################### [100%]

也可以使用 yum 安装

yum localinstall /tmp/test-1.0-1.0.x86_64.rpm

查看安装信息

# rpm -qi test
Name        : test                         Relocations: (not relocatable)
Version     : 1.0                               Vendor: (none)
Release     : 1.0                           Build Date: Wed 21 Sep 2011 05:50:54 PM CST
Install Date: Wed 21 Sep 2011 05:46:50 PM CST      Build Host: dev3.example.com
Group       : Networking/Daemons            Source RPM: test-1.0-1.0.src.rpm
Size        : 20373                            License: BSD
Signature   : (none)
Packager    : Neo Chen <openunix@163.com>
Summary     : My Test Package
Description :

description

是使用yum info 查看信息

# yum info test
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.163.com
 * extras: mirrors.163.com
 * updates: mirrors.163.com
Installed Packages
Name       : test
Arch       : x86_64
Version    : 1.0
Release    : 1.0
Size       : 20 k
Repo       : installed
Summary    : My Test Package
License    : BSD
Description:
           : description

RPM_directory_macros

http://fedoraproject.org/wiki/Packaging/RPMMacros#RPM_directory_macros

%{_sysconfdir}        /etc

%{_prefix}            /usr

%{_exec_prefix}       %{_prefix}

%{_bindir}            %{_exec_prefix}/bin

%{_lib}               lib (lib64 on 64bit systems)

%{_libdir}            %{_exec_prefix}/%{_lib}

%{_libexecdir}        %{_exec_prefix}/libexec

%{_sbindir}           %{_exec_prefix}/sbin

%{_sharedstatedir}    /var/lib

%{_datadir}           %{_prefix}/share

%{_includedir}        %{_prefix}/include

%{_oldincludedir}     /usr/include

%{_infodir}           /usr/share/info

%{_mandir}            /usr/share/man

%{_localstatedir}     /var

%{_initddir}          %{_sysconfdir}/rc.d/init.d

Note: On releases older than Fedora 10 (and EPEL), %{_initddir} does not exist. Instead, you should use the deprecated%{_initrddir} macro.
RPM directory macros
%{_topdir}            %{getenv:HOME}/rpmbuild

%{_builddir}          %{_topdir}/BUILD

%{_rpmdir}            %{_topdir}/RPMS

%{_sourcedir}         %{_topdir}/SOURCES

%{_specdir}           %{_topdir}/SPECS

%{_srcrpmdir}         %{_topdir}/SRPMS

%{_buildrootdir}      %{_topdir}/BUILDROOT

Note: On releases older than Fedora 10 (and EPEL), %{_buildrootdir} does not exist.
Build flags macros
%{_global_cflags}     -O2 -g -pipe

%{_optflags}          %{__global_cflags} -m32 -march=i386 -mtune=pentium4 # if redhat-rpm-config is installed

Other macros
%{_var}               /var

%{_tmppath}           %{_var}/tmp

%{_usr}               /usr

%{_usrsrc}            %{_usr}/src

%{_docdir}            %{_datadir}/doc

--define 专递模板变量

spec 文件中定义宏默认值

%define <variable> <value>

另一种是在外部传递变量值

rpmbuild -ba SPECS/bacula.spec --define "build_su110 1" --define "build_mysql4 1"

注意：当两种同时使用时，外部--define无法替代%define 的定义。

查看GPG证书

$ gpg --list-keys
/home/neo/.gnupg/pubring.gpg
----------------------------
pub   1024R/63268A35 2013-09-11
uid                  Neo Chen (netkiller) <netkiller@msn.com>
sub   1024R/F4F946F9 2013-09-11

设置 _gpg_name 宏，与上面查看结果需一致

cat << EOF >> ~/.rpmmacros
%_signature gpg
%_gpg_name Neo Chen (netkiller) <netkiller@msn.com>
%_gpgpath ~/.gnupg
%_gpgbin /usr/bin/gpg
EOF

建立RPM

rpmbuild --define "_topdir /path/to/macrodir" -bb --sign spec

如果你的证书有Passphrase，会提示你输入了密码。

Enter pass phrase:
Pass phrase is good.

FAQ

error: File /home/neo/rpmbuild/SOURCES/netkiller-docbook-1.0.1.tar.gz: No such file or directory

Source 定义的文件不存在，如果你需要忽略Source可以使用 %setup -T

第 5 章 区域设置

Time Zone

timeconfig

system-config-date

/etc/sysconfig/clock

[root@ntp ~]# cat /etc/sysconfig/clock
ZONE="Asia/Harbin"
UTC=true
ARC=false

/usr/share/zoneinfo

[root@ntp ~]# ls /usr/share/zoneinfo
Africa      Asia       Canada   Cuba   EST      Factory  GMT0       Hongkong  Iran         Japan      Mexico   Navajo   Poland      PRC      ROK        Universal  W-SU
America     Atlantic   CET      EET    EST5EDT  GB       GMT-0      HST       iso3166.tab  Kwajalein  Mideast  NZ       Portugal    PST8PDT  Singapore  US         zone.tab
Antarctica  Australia  Chile    Egypt  Etc      GB-Eire  GMT+0      Iceland   Israel       Libya      MST      NZ-CHAT  posix       right    Turkey     UTC        Zulu
Arctic      Brazil     CST6CDT  Eire   Europe   GMT      Greenwich  Indian    Jamaica      MET        MST7MDT  Pacific  posixrules  ROC      UCT        WET

cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

日期、时间

# date -s "2008-7-19"
# date -s 18:10

rdate - get the time via the network

# rdate time-a.nist.gov 查看
# rdate -s time-a.nist.gov 设置

语言

system-config-language

vim /etc/sysconfig/i18n
LANG="en_US.UTF-8"

查看语言

locale -a

第 6 章 sudo, sudoedit - execute a command as another user

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
neo     ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL

第 7 章 Logging

第 8 章 crontab

# yum install crontabs

第 9 章 Services

[ ] NetworkManager   自动在多种网络连接中进行转换，如果你的电脑有Wireless WiFi 和 Ethernet多种网络连接类型的话，可以选择开启。
[ ] acpid            （Advanced Configuration and Power Interface）是为替代传统的APM电源管理标准而推出的新型电源管理标准。通常笔记本电脑需要启动电源进行管理。
[*] anacron          自动化运行任务守护进程
[*] atd              自动化运行任务守护进程
[ ] auditd           审核信息，将消息写入控制台以及 audit_warn 电子邮件别名。用于存放内核生成的系统审查记录，这些记录会被一些程序使用。特别是对于SELinux用户来说。
[ ] autofs           自动挂载/卸载文件系统服务，可以自动挂载想访问但还未挂载的文件系统,自动卸载长期不访问的文件系统,自动安装管理进程automount，与NFS 相关，依赖于NIS
[ ] avahi-daemon     Zeroconf service discovery守护进程，Avahi是zeroconf协议的实现。它可以在没有DNS服务的局域网里发现基于zeroconf协议的设备和服务。它跟mDNS一样。除非你有兼容的设备或使用 zeroconf 协议的服务，否则就可以关闭。
[ ] avahi-dnsconfd   /etc/avahi/dnsconf.action脚本守护进程
[ ] bluetooth        蓝牙
[ ] conman           控制台管理
[ ] cpuspeed         监测系统空闲百分比，降低或加快CPU时钟速度和电压
[*] crond            一个传统的UNIX程序crontab，可以周期地运行用户调度的任务。
[ ] cups             通用UNIX打印守护进程，（Common UNIX Printing System）公共UNIX打印支持，为Linux提供打印功能。 安装打印机时需要的服务。
[ ] dnsmasq          Dns cache server守护进程
[ ] dund             蓝牙拨号网络
[ ] firstboot        安装完之后的用户配置向导，用于第一次设置系统
[ ] gpm              为文本模式下的Linux程序提供鼠标支持、拷贝、粘贴操作、弹出式菜单
[ ] haldaemon        硬件监控系统
[ ] hidd             蓝牙H.I.D.服务器
[ ] httpd            Apache服务器
[ ] ip6tables        防火墙守护进程
[*] iptables         防火墙守护进程
[ ] irda             红外端口守护进程
[*] irqbalance       多系统处理器环境下的系统中断请求进行负载平衡，单CPU无用
[ ] kudzu            硬件自动检测程序，如不增加新硬件，可以关闭
[ ] lvm2-monitor     LVM2 mirror devices守护进程
[ ] mcstrans         SELinux Context Translation System Daemon
[ ] mdmonitor        RAID相关设备的守护程序
[ ] mdmpd            RAID相关设备的守护程序
[*] messagebus       事件监控服务，在必要时向所有用户发送广播信息
[ ] microcode_ctl    可编码以及发送新微代码到内核以更新Intel IA32系列处理器守护进程
[ ] multipathd       Manage device-mapper multipath devices
[ ] netconsole       Initializes network console logging
[ ] netfs            安装和卸载NFS、SAMBA和NCP网络文件系统
[ ] netplugd         服务监控网络界面,根据信号关闭或启动它,用于手提电脑
[*] network          激活已配置网络接口的脚本程序
[ ] nfs              网络文件系统守护进程
[ ] nfslock          NFS文件锁定功能
[ ] nscd             密码与群查找服务
[ ] ntpd             网络时间同步
[ ] oddjobd
[ ] pand             蓝牙个人区域网络
[ ] pcscd            智能卡支持
[ ] portmap          用来支持RPC连接，RPC被用于NFS以及NIS 等服务
[ ] psacct           进程审计守护进程
[ ] rawdevices		 rawdevices	to block devices。Oracle数据库使用
[ ] rdisc            discovers routers守护进程
[ ] readahead_early  开机内存载入优化
[ ] readahead_later  开机内存载入优化
[ ] restorecond      SELinux相关联
[ ] rpcgssd          manages RPCSEC GSS contexts for the NFSv4 server
[ ] rpcidmapd        rpcidmapd for NFSv4 that maps user names to UID and GID nu
[ ] rpcsvcgssd       rpcsvcgssd manages RPCSEC GSS contexts for the NFSv4 server
[ ] saslauthd        使用SASL的认证守护进程
[*] sendmail         邮件服务器sendmail守护进程
[*] smartd           监控硬盘故障
[*] sshd             OpenSSH服务器守护进程
[*] syslog           系统日志
[ ] winbind          用于Samba服务器
[ ] wpa_supplicant   无线设备支持
[ ] xfs              X Window字型服务器守护进程，为本地和远程X服务器提供字型集
[ ] ypbind           为NIS客户机激活ypbind服务进程
[ ] yum-updatesd	 RPM操作系统自动升级和软件包管理守护进程

chkconfig

chkconfig acpid off

[root@development ~]# chkconfig --add mysqld 		[在服务清单中添加mysql服务]
[root@development ~]# chkconfig mysqld on			[设置mysql服务开机启动]
[root@development ~]# chkconfig --list mysqld		[设置mysql启动级别]
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off

chkconfig --level 3 mysqld on
chkconfig --level 3 mysqld off

xinetd.d

# yum -y install xinetd

tftpd

# yum install -y tftp-server tftp

/etc/xinetd.d/tftp

# vim /etc/xinetd.d/tftp
# default: off
# description: The tftp server serves files using the trivial file transfer \
#       protocol.  The tftp protocol is often used to boot diskless \
#       workstations, download configuration files to network-aware printers, \
#       and to start the installation process for some operating systems.
service tftp
{
        socket_type             = dgram
        protocol                = udp
        wait                    = yes
        user                    = root
        server                  = /usr/sbin/in.tftpd
        server_args             = -s /tftpboot
        disable                 = yes
        per_source              = 11
        cps                     = 100 2
        flags                   = IPv4
}

disable = yes 改为 disable = no

mkdir /tftpboot
/etc/init.d/xinetd restart

atftp-server

# yum install -y atftp-server atftp

/etc/xinetd.d/tftp

# cat /etc/xinetd.d/tftp
# default: off
# description: The tftp server serves files using the trivial file transfer protocol. The tftp protocol is often used to boot diskless workstations, download configuration files to network-aware printers, and to start the installation process for some operating systems.
service tftp
{
    disable         = no
    socket_type     = dgram
    protocol        = udp
    wait            = yes
    user            = root
    server          = /usr/sbin/in.tftpd
    server_args     = /tftpboot
    per_source      = 11
    cps             = 100 2
    flags           = IPv4
}

atftp-server 是一个可以不依赖xinetd的tftp服务器

rsync

# vim /etc/xinetd.d/rsync
# default: off
# description: The rsync server is a good addition to an ftp server, as it \
#       allows crc checksumming etc.
service rsync
{
        disable = no
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/bin/rsync
        server_args     = --daemon
        log_on_failure  += USERID
}

rshd

/etc/xinetd.d/rsh

# cat  /etc/xinetd.d/rsh
# default: on
# description: The rshd server is the server for the rcmd(3) routine and, \
#	consequently, for the rsh(1) program.  The server provides \
#	remote execution facilities with authentication based on \
#	privileged port numbers from trusted hosts.
service shell
{
	socket_type		= stream
	wait			= no
	user			= root
	log_on_success		+= USERID
	log_on_failure 		+= USERID
	server			= /usr/sbin/in.rshd
	disable			= no
}

访问权限配置

# cat /etc/hosts.allow
#
# hosts.allow	This file describes the names of the hosts which are
#		allowed to use the local INET services, as decided
#		by the '/usr/sbin/tcpd' server.
#
in.rshd : your.example.com 192.168.0.1

# cat /etc/hosts.deny
#
# hosts.deny	This file describes the names of the hosts which are
#		*not* allowed to use the local INET services, as decided
#		by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
all : all

访问主机设置

# cat ~/.rhosts
your.example.com user
192.168.0.1	user

rpcinfo

# rpcinfo -p 192.168.187.75
   program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp    697  status
    100024    1   tcp    700  status
    100011    1   udp    864  rquotad
    100011    2   udp    864  rquotad
    100011    1   tcp    867  rquotad
    100011    2   tcp    867  rquotad
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100003    4   udp   2049  nfs
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
    100003    4   tcp   2049  nfs
    100021    1   udp  32778  nlockmgr
    100021    3   udp  32778  nlockmgr
    100021    4   udp  32778  nlockmgr
    100021    1   tcp  35837  nlockmgr
    100021    3   tcp  35837  nlockmgr
    100021    4   tcp  35837  nlockmgr
    100005    1   udp    880  mountd
    100005    1   tcp    883  mountd
    100005    2   udp    880  mountd
    100005    2   tcp    883  mountd
    100005    3   udp    880  mountd
    100005    3   tcp    883  mountd

SELINUX

禁用SElinux编辑/etc/selinux/config，修改如下内容：

SELINUX=disabled

使用命令

getenforce
setenforce 0

lokkit --selinux=disabled

第 10 章 File System

EXT4

install

# yum install e4fsprogs

format

# mkfs.ext4 /dev/sda2

label

# e4label /dev/sda2 /www

# mkdir /www

# cat /etc/fstab |grep ext4
LABEL=/www              /www                    ext4    defaults        1 2

mount/umount

# mount /www
# umount /www

LVM 卷

# mkfs.ext4 /dev/VolGroup00/LogVol02

[root@images ~]# cat /etc/fstab
/dev/VolGroup00/LogVol00 /                       ext3    defaults        1 1
/dev/VolGroup00/LogVol02 /images                 ext4    defaults        1 2
LABEL=/boot             /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0
/dev/VolGroup00/LogVol01 swap                    swap    defaults        0 0

# mount -a

LVM

zfs

# yum info zfs-fuse

Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * addons: mirrors.163.com
 * base: mirrors.163.com
 * epel: mirror01.idc.hinet.net
 * extras: mirrors.163.com
 * updates: mirrors.163.com
Available Packages
Name       : zfs-fuse
Arch       : x86_64
Version    : 0.6.9_beta3
Release    : 0.el5
Size       : 1.5 M
Repo       : epel
Summary    : ZFS ported to Linux FUSE
URL        : http://zfs-fuse.net/
License    : CDDL
Description: ZFS is an advanced modern general-purpose filesystem from Sun
           : Microsystems, originally designed for Solaris/OpenSolaris.
           :
           : This project is a port of ZFS to the FUSE framework for the Linux
           : operating system.
           :
           : Project home page is at http://zfs-fuse.net/

btrfs

yum install btrfs-progs

# mkfs.btrfs /dev/sdb1

指定卷标

# mkfs.btrfs /dev/sdb2 -L /backup

Mount Btrfs

# mkdir /mnt/btrfs
# mount /dev/sdb1 /mnt/btrfs

查看挂载是否成功

# df -Th
Filesystem    Type    Size  Used Avail Use% Mounted on
/dev/sda1     ext4     49G   15G   32G  32% /
tmpfs        tmpfs     32G  264K   32G   1% /dev/shm
/dev/sda3     ext4     52G  1.3G   48G   3% /var
/dev/sdb1    btrfs    2.0T   14G  2.0T   1% /mnt/btrfs

 针对 SSD 的优化:
# mount –t btrfs –o SSD /dev/sda5 /btrfsdisk

打开压缩功能：
# mount –t btrfs –o compress /dev/sda5 /btrfsdisk

Mount Snap

mount -t btrfs -o subvol=your_snapshot /dev/sdb2 /mnt/snap

mount -t btrfs -o subvol=aaa /dev/md127p5 /mnt/snap

fstab

btrfs-show

[root@r610 ~]# btrfs-show
Label: none  uuid: 0b097eeb-1f0b-476a-955b-52122ef42bfc
        Total devices 1 FS bytes used 13.03GB
        devid    1 size 2.00TB used 24.04GB path /dev/sdb1

Btrfs Btrfs v0.19

/etc/fstab

UUID=0b097eeb-1f0b-476a-955b-52122ef42bfc /opt    btrfs   defaults 1 2

Snapshots and subvolumes (快照与子卷管理)

subvolumes

# df -T
Filesystem     Type  1K-blocks      Used Available Use% Mounted on
/dev/md126p2   ext4   50395844  19952780  27883064  42% /
tmpfs          tmpfs   4024944       800   4024144   1% /dev/shm
/dev/md126p1   ext4     495844    172140    298104  37% /boot
/dev/md126p6   btrfs 500084736 360835636 119893924  76% /opt
/dev/md126p5   btrfs 409600000  24927332 368284612   7% /www

# btrfs subvolume create /www/git
Create subvolume '/www/git'

# btrfs subvolume list /www
ID 641 gen 21351 top level 5 path git

fstab 挂在子卷

$ cat /etc/fstab

#
# /etc/fstab
# Created by anaconda on Thu Oct 18 13:53:45 2012
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=88ec1ccf-7d8d-4107-a143-1ed0ec64a572 /                       ext4    defaults        1 1
UUID=c0786771-1c85-45be-a9ab-ef3ee16fccb4 /boot                   ext4    defaults        1 2
UUID=e1b89740-21f0-4507-97e9-a658cd7d3716 /opt                    btrfs   defaults        1 2
UUID=76e46795-ebaf-4d2d-8996-1e15979bf3c8 /www                    btrfs   defaults        1 2
UUID=76e46795-ebaf-4d2d-8996-1e15979bf3c8 /home/git               btrfs   defaults,subvol=git        1 2
UUID=c578f1b3-4bbe-4f48-b3d3-3929c65cb99c swap                    swap    defaults        0 0
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0

创建快照
# btrfs subvolume snapshot /www /www/backup_2012
查看快照
# btrfs subvolume list -a /www
挂在快照
# mount -t btrfs -o subvol=backup_2012 /dev/md127p5 /mnt/snap
删除快照
# btrfs subvolume delete /www/backup_2012
Delete subvolume '/www/backup_2012'

btrfsctl

Resizes the filesystem

Snapshot

Btrfs v0.19

# touch /mnt/btrfs/test1
# touch /mnt/btrfs/test2
# ls /mnt/btrfs/test?
/mnt/btrfs/test1  /mnt/btrfs/test2

# echo 'This is a test' > /mnt/btrfs/test1
# btrfsctl –s snap1 /mnt/btrfs
#vi test1
 Test1 is modified
#cd /mnt/btrfs/snap1
#cat test1
 This is a test

btrfs-vol

# btrfs-vol –a /dev/sdc1 /mnt/btrfs

btrfs-convert

btrfs-convert /dev/sdb1

btrfsck

# btrfsck /dev/sdb1
found 13994164224 bytes used err is 0
total csum bytes: 13588316
total tree bytes: 79728640
total fs tree bytes: 28860416
btree space waste bytes: 10282024
file data blocks allocated: 13931024384
 referenced 13906980864
Btrfs Btrfs v0.19

btrfs-debug-tree

[root@r610 ~]# btrfs-debug-tree /dev/sdb1 |head
root tree
leaf 49463296 items 9 free space 2349 generation 298 owner 1
fs uuid 0b097eeb-1f0b-476a-955b-52122ef42bfc
chunk uuid 2826f868-c775-4835-8690-1020a2a9fbf5
        item 0 key (EXTENT_TREE ROOT_ITEM 0) itemoff 3756 itemsize 239
                root data bytenr 49446912 level 2 dirid 0 refs 1
        item 1 key (DEV_TREE ROOT_ITEM 0) itemoff 3517 itemsize 239
                root data bytenr 36139008 level 0 dirid 0 refs 1
        item 2 key (FS_TREE INODE_REF 6) itemoff 3500 itemsize 17
                inode ref index 0 namelen 7 name: default

iSCSI

iSCSI 需要与GFS配合使用，其他文件系统不能实现数据同步。

过程 10.1. iSCSI Example

install.

# yum install iscsi-initiator-utils -y
# rpm -ql iscsi-initiator-utils
# rpm -q --scripts iscsi-initiator-utils
postinstall scriptlet (using /bin/sh):
/sbin/ldconfig

if [ ! -f /etc/iscsi/initiatorname.iscsi ]; then
        echo "InitiatorName=`/sbin/iscsi-iname`" > /etc/iscsi/initiatorname.iscsi
fi
/sbin/chkconfig --add iscsid
/sbin/chkconfig --add iscsi
preuninstall scriptlet (using /bin/sh):
if [ "$1" = "0" ]; then
    /sbin/chkconfig --del iscsi
    /sbin/chkconfig --del iscsid
fi
postuninstall scriptlet (using /bin/sh):
/sbin/ldconfig

config

# cat /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.1994-05.com.redhat:9b2024102698

starting service.

# chkconfig iscsi on
# chkconfig iscsid on

# service iscsi start
iscsid is stopped
Starting iSCSI daemon:                                     [  OK  ]
                                                           [  OK  ]
Setting up iSCSI targets: iscsiadm: No records found!
                                                           [  OK  ]
# service iscsi status
iscsid (pid  17501) is running...
# service iscsid status
iscsid (pid  17501) is running...

discovery targets.

# iscsiadm -m discovery -t sendtargets -p 172.16.0.30:3260
172.16.0.30:3260,1 iqn.2010-09.com.openfiler:tsn.c7a241688f35

or

iscsiadm --mode discovery --type sendtargets --portal 172.16.0.30:3260

iscsiadm -m discovery -t st -p 172.16.0.30:3260

login / logout

# iscsiadm -m node --loginall=all
Logging in to [iface: default, target: iqn.2010-09.com.openfiler:tsn.c7a241688f35, portal: 172.16.0.30,3260]
Login to [iface: default, target: iqn.2010-09.com.openfiler:tsn.c7a241688f35, portal: 172.16.0.30,3260]: successful

or

iscsiadm --mode node --targetname iqn.2010-09.com.openfiler:tsn.c7a241688f35 --portal 192.168.0.10:3260 --login

logout

# iscsiadm -m node --logoutall=all

分区设置

fdisk -l
fdisk /dev/sdb #依次选p n 1 w
mkfs.ext4 /dev/sdb1

挂载
mkdir /iscsi
mount /dev/sdb1 /iscsi

设自动挂载
vi /etc/fstab
/dev/sdb1 /iscsi ext3 _netdev 0 0

auth

# cp /etc/iscsi/iscsid.conf /etc/iscsi/iscsid.conf.old
# vim /etc/iscsi/iscsid.conf

show node

]# iscsiadm -m node
172.16.0.30:3260,1 iqn.2006-01.com.openfiler:tsn.0b232d1cc3ee
172.16.0.30:3260,1 iqn.2010-09.com.openfiler:tsn.c7a241688f35

delete node

iscsiadm -m node -o delete -T iqn.2006-01.com.openfiler:tsn.0b232d1cc3ee

GFS

[root@dev2 ~]# /etc/init.d/iscsi start
iscsid is stopped
Starting iSCSI daemon:                                     [  OK  ]
                                                           [  OK  ]
Setting up iSCSI targets: iscsiadm: No records found!
                                                           [  OK  ]
[root@dev2 ~]# iscsiadm -m discovery -t st -p 192.168.3.194
192.168.3.194:3260,1 iqn.2007-09.jp.ne.peach.istgt:disk0
[root@dev2 ~]# iscsiadm -m node -l
Logging in to [iface: default, target: iqn.2007-09.jp.ne.peach.istgt:disk0, portal: 192.168.3.194,3260]
Login to [iface: default, target: iqn.2007-09.jp.ne.peach.istgt:disk0, portal: 192.168.3.194,3260]: successful

# fdisk -l

Disk /dev/sda: 250.0 GB, 250000000000 bytes
255 heads, 63 sectors/track, 30394 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1          13      104391   83  Linux
/dev/sda2              14       30394   244035382+  8e  Linux LVM

Disk /dev/sdb: 499.5 GB, 499558383616 bytes
255 heads, 63 sectors/track, 60734 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdb doesn't contain a valid partition table

fdisk /dev/sdb

# fdisk -l /dev/sdb

Disk /dev/sdb: 499.5 GB, 499558383616 bytes
255 heads, 63 sectors/track, 60734 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1       60734   487845823+   5  Extended
/dev/sdb5               1       60734   487845792   83  Linux

# mkfs.gfs2 -p lock_dlm -t edb_ha:gfs1 -j 3 /dev/sdb5
This will destroy any data on /dev/sdb5.

Are you sure you want to proceed? [y/n] y

Device:                    /dev/sdb5
Blocksize:                 4096
Device Size                465.25 GB (121961448 blocks)
Filesystem Size:           465.25 GB (121961446 blocks)
Journals:                  3
Resource Groups:           1861
Locking Protocol:          "lock_dlm"
Lock Table:                "edb_ha:gfs1"
UUID:                      A75C4963-85A2-A28B-4099-07FD7E3379D6

GFS - Cluster Storage

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Global_File_System_2/index.html

yum groupinstall "Cluster Storage"
# egrep 'GFS2|DLM' /boot/config-2.6.32-*
/boot/config-2.6.32-131.2.1.el6.x86_64:CONFIG_GFS2_FS=m
/boot/config-2.6.32-131.2.1.el6.x86_64:CONFIG_GFS2_FS_LOCKING_DLM=y
/boot/config-2.6.32-131.2.1.el6.x86_64:CONFIG_DLM=m
/boot/config-2.6.32-131.2.1.el6.x86_64:CONFIG_DLM_DEBUG=y
/boot/config-2.6.32-71.el6.x86_64:CONFIG_GFS2_FS=m
/boot/config-2.6.32-71.el6.x86_64:CONFIG_GFS2_FS_LOCKING_DLM=y
/boot/config-2.6.32-71.el6.x86_64:CONFIG_DLM=m
/boot/config-2.6.32-71.el6.x86_64:CONFIG_DLM_DEBUG=y

pvcreate /dev/sdb3
vgcreate vg01 /dev/sdb3
lvcreate -L 500G -n lvol0 vg01
mkfs.gfs2 -p lock_dlm -t alpha:mydata1 -j 8 /dev/vg01/lvol0

# pvcreate /dev/sdb3
  Physical volume "/dev/sdb3" successfully created
# vgcreate vg01 /dev/sdb3
  Volume group "vg01" successfully created
# lvcreate -L 500G -n lvol0 vg01
  Logical volume "lvol0" created

# mkfs.gfs2 -p lock_dlm -t alpha:mydata1 -j 8 /dev/vg01/lvol0
This will destroy any data on /dev/vg01/lvol0.
It appears to contain: symbolic link to `../dm-6'

Are you sure you want to proceed? [y/n] y

Device:                    /dev/vg01/lvol0
Blocksize:                 4096
Device Size                500.00 GB (131072000 blocks)
Filesystem Size:           500.00 GB (131071998 blocks)
Journals:                  8
Resource Groups:           2000
Locking Protocol:          "lock_dlm"
Lock Table:                "alpha:mydata1"
UUID:                      4FC256A0-00BD-2087-15DF-8EA4366481AA

# mkdir /mnt/gfs2
# mount -t gfs2 -o noatime /dev/mapper/vg01-lvol0 /mnt/gfs2
gfs_controld join connect error: Connection refused
error mounting lockproto lock_dlm

glusterfs

# rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
# yum install glusterfs glusterfs-fuse glusterfs-rdma glusterfs-server glusterfs-vim

# gzip /etc/glusterfs/*

# chkconfig glusterd off
# chkconfig glusterfsd on

# service glusterd stop
# service glusterfsd start

or

/etc/init.d/glusterd start
/etc/init.d/glusterfsd start

mkdir -p /home/export

cat >> /etc/hosts <<EOF
192.168.80.107  gluster1
192.168.80.33   gluster2
192.168.80.1    gluster3
EOF

# glusterfs-volgen --name store1 --raid 1 gluster1:/home/export gluster2:/home/export
Generating server volfiles.. for server gluster2 as '/root/gluster2-store1-export.vol'
Generating server volfiles.. for server gluster1 as '/root/gluster1-store1-export.vol'
Generating client volfiles.. '/root/store1-tcp.vol'

cp ./store1-tcp.vol /etc/glusterfs/glusterfs.vol
scp gluster1-store1-export.vol root@gluster1:/etc/glusterfs/glusterfsd.vol
scp gluster2-store1-export.vol root@gluster2:/etc/glusterfs/glusterfsd.vol

ssh root@gluster1 service glusterfsd restart
ssh root@gluster2 service glusterfsd restart

# mkdir -p /mnt/glusterfs
# glusterfs /mnt/glusterfs/
or
# glusterfs -l /tmp/glusterfs.log -f /etc/glusterfs/glusterfs.vol /mnt/glusterfs/

Umount

umount /mnt/glusterfs

注意：请使用umount 卸载，不要kill glusterfs进程

部分 II. Network

第 11 章 IP Address

system-config-network

ifconfig eth0 192.168.0.10 netmask 255.255.255.0
or
ip addr add 192.168.0.10 dev eth0

ifcfg-eth0,ifcfg-eth1,ifcfg-eth2 ... ifcfg-eth(n)

[root@development httpd]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Broadcom Corporation NetLink BCM5784M Gigabit Ethernet PCIe
DEVICE=eth0
BOOTPROTO=static
BROADCAST=192.168.3.255
HWADDR=00:25:64:A3:59:BF
IPADDR=192.168.3.40
IPV6INIT=yes
IPV6_AUTOCONF=yes
NETMASK=255.255.255.0
NETWORK=192.168.3.0
ONBOOT=yes

eth0:1

[root@development httpd]# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0:1
[root@development httpd]# vi /etc/sysconfig/network-scripts/ifcfg-eth0:1
# Broadcom Corporation NetLink BCM5784M Gigabit Ethernet PCIe
DEVICE=eth0:1
BOOTPROTO=static
BROADCAST=192.168.3.255
HWADDR=00:25:64:A3:59:BF
IPADDR=192.168.3.41
IPV6INIT=yes
IPV6_AUTOCONF=yes
NETMASK=255.255.255.0
NETWORK=192.168.3.0
ONBOOT=yes

reload network

[root@development ~]# /etc/init.d/network reload
Shutting down interface eth0:                              [  OK  ]
Shutting down loopback interface:                          [  OK  ]
Bringing up loopback interface:                            [  OK  ]
Bringing up interface eth0:

Gateway

[root@development ~]# cat /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=yes
HOSTNAME=development.domain.org
GATEWAY=192.168.3.1

hosts

# cat -n /etc/hosts
     1  # Do not remove the following line, or various programs
     2  # that require network functionality will fail.
     3  127.0.0.1               development.domain.org development localhost.localdomain localhost
     4  ::1             localhost6.localdomain6 localhost6

bonding

cat >> /etc/modprobe.d/bonding.conf <<EOF
alias bond0 bonding
options bond0 mode=balance-alb miimon=1000
EOF

cat > /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
DEVICE="eth0"
ONBOOT="yes"
BOOTPROTO="none"
USERCTL="no"
NM_CONTROLLED="no"
EOF

cat > /etc/sysconfig/network-scripts/ifcfg-eth1 <<EOF
DEVICE="eth1"
ONBOOT="yes"
BOOTPROTO="none"
USERCTL="no"
NM_CONTROLLED="no"
EOF

cat > /etc/sysconfig/network-scripts/ifcfg-bond0 <<EOF
DEVICE="bond0"
ONBOOT="yes"
BOOTPROTO="none"
TYPE="Ethernet"
IPADDR=172.16.0.5
NETMASK=255.255.255.0
NETWORK=172.16.0.0
USERCTL="no"
NM_CONTROLLED="no"
EOF

modprobe bonding mode=balance-alb miimon=1000
ifconfig bond0 up
ifconfig bond0 172.16.0.5 netmask 255.255.255.0 up
ip route add default via 172.16.0.254 dev bond0
ifenslave bond0 eth0
ifenslave bond0 eth1

cat >> /etc/rc.local <<EOF
#-------------------------
ifenslave bond0 eth0
ifenslave bond0 eth1
ip route add default via 172.16.0.254 dev bond0
#-------------------------
EOF

more /proc/net/bonding/bond0

brctl

Linux 系统4个物理网卡的名称则分别为eth0，eth1，eth2，eth3。我们将四个网口桥接到br0端口。

你可以这样理解 vlan 2, vlan ip 192.168.0.1，然后将4个接口划分到vlan2, 这时这4个接口可以通过vlan 2访问其他用户。我只是做了一个比喻，让你能够理解。

# brctl addbr br0

# brctl addif br0 eth0
# brctl addif br0 eth1
# brctl addif br0 eth2
# brctl addif br0 eth3

# ifconfig eth0 0.0.0.0
# ifconfig eth1 0.0.0.0
# ifconfig eth2 0.0.0.0
# ifconfig eth3 0.0.0.0

# ifconfig br0 192.168.0.1

第 12 章 Iptables

Activating the IPTables Service

# chkconfig --level 345 iptables on
# service iptables start

Saving and Restoring IPTables Rules

# service iptables save

Firewall Policies

第 13 章 INND

# yum -y install inn

readers.conf

# vim /etc/news/readers.conf
auth "localhost" {
    hosts: "*"
    default: "*"
}

access "localhost" {
    users: "*"
    newsgroups: "*,!junk,!control,!control.*"
    access: RPA
}

create a group

# /usr/lib/news/bin/ctlinnd newgroup test

第 14 章 Piranha - Cluster administation tools

摘要

Piranha 安装与配置

install

Install piranha and ipvsadm packages on the LVS Routers

yum -y install ipvsadm piranha

Turning on Packet Forwarding on the LVS Routers

vi /etc/sysctl.conf

net.ipv4.ip_forward = 1 把原来的0改成1
使刚才的修改生效
sysctl -p

临时生效
echo "1" >/proc/sys/net/ipv4/ip_forward

Configuring Services on the LVS Routers

chkconfig pulse on
chkconfig ipvsadm on
chkconfig piranha-gui on

Setting a Password for the Piranha Configuration Tool

# piranha-passwd

Starting the Piranha Configuration Tool Service

# setenforce 0
setenforce: SELinux is disabled
# service ipvsadm start
# service piranha-gui start

configure

http://your.domain.com:3636/

user: piranha

passwd: your piranha

/etc/sysconfig/ha/lvs.cf

real server

DR连接方式

VIP=192.168.3.212
ifconfig lo:0 $VIP netmask 255.255.255.255 broadcast $VIP
/sbin/route add -host $VIP dev lo:0
echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce
echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce
sysctl -p >/dev/null 2>&1

Tunnel模式

ifconfig tunl0 $VIP netmask 255.255.255.255 broadcast $VIP
/sbin/route add -host $VIP dev tunl0
echo "1" >/proc/sys/net/ipv4/conf/tunl0/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/tunl0/arp_announce
echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce
sysctl -p >/dev/null 2>&1

Example

Master

例 14.1. piranha master

[root@lvs1 ~]# cat /etc/sysconfig/ha/lvs.cf
serial_no = 31
primary = 172.16.0.2
primary_private = 172.16.2.2
service = lvs
backup_active = 1
backup = 172.16.0.3
backup_private = 172.16.2.3
heartbeat = 1
heartbeat_port = 539
keepalive = 2
deadtime = 6
network = direct
debug_level = NONE
monitor_links = 0
syncdaemon = 0
virtual LVS-HTTP {
     active = 1
     address = 172.16.0.1 eth0:1
     vip_nmask = 255.255.255.255
     port = 80
     send = "GET / HTTP/1.0\r\n\r\n"
     expect = "HTTP"
     use_regex = 0
     load_monitor = none
     scheduler = wlc
     protocol = tcp
     timeout = 6
     reentry = 15
     quiesce_server = 0
     server Web1 {
         address = 172.16.0.5
         active = 1
         port = 80
         weight = 2
     }
     server Web2 {
         address = 172.16.0.6
         active = 1
         port = 80
         weight = 2
     }
     server Web3 {
         address = 172.16.0.7
         active = 1
         port = 80
         weight = 2
     }
     server Web4 {
         address = 172.16.0.8
         active = 0
         port = 80
         weight = 0
     }
}

Slave

例 14.2. piranha slave

serial_no = 30
primary = 172.16.0.2
primary_private = 172.16.2.2
service = lvs
backup_active = 1
backup = 172.16.0.3
backup_private = 172.16.2.3
heartbeat = 1
heartbeat_port = 539
keepalive = 2
deadtime = 6
network = direct
debug_level = NONE
monitor_links = 0
syncdaemon = 0
virtual LVS-HTTP {
     active = 1
     address = 172.16.0.1 eth0:1
     vip_nmask = 255.255.255.255
     port = 80
     send = "GET / HTTP/1.0\r\n\r\n"
     expect = "HTTP"
     use_regex = 0
     load_monitor = none
     scheduler = wlc
     protocol = tcp
     timeout = 6
     reentry = 15
     quiesce_server = 0
     server Web1 {
         address = 172.16.0.5
         active = 1
         port = 80
         weight = 2
     }
     server Web2 {
         address = 172.16.0.6
         active = 1
         port = 80
         weight = 2
     }
     server Web3 {
         address = 172.16.0.7
         active = 1
         port = 80
         weight = 2
     }
     server Web4 {
         address = 172.16.0.8
         active = 0
         port = 80
         weight = 3
     }
}

MySQL

virtual SLB-MySQL {
     active = 1
     address = 172.16.1.50 eth0:2
     vip_nmask = 255.255.255.255
     port = 3306
     persistent = 30
     send = ""
     expect = ""
     use_regex = 0
     load_monitor = none
     scheduler = wlc
     protocol = tcp
     timeout = 5
     reentry = 15
     quiesce_server = 0
     server MySQL1 {
         address = 172.16.1.46
         active = 1
         port = 3306
         weight = 1
     }
     server MySQL2 {
         address = 172.16.1.47
         active = 1
         port = 3306
         weight = 1
     }
     server MySQL3 {
         address = 172.16.1.48
         active = 1
         port = 3306
         weight = 1
     }

}

# cat /srv/script/lvs-client-start

#!/bin/bash
### Disable IP_Forward in Linux Kernel ###
echo 0 > /proc/sys/net/ipv4/ip_forward

### Disable ARP Reponse on This RealServer ###
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce

### Add VIP Address and Route ###
VIP=172.16.1.50

/sbin/ifconfig lo:0 $VIP broadcast $VIP netmask 255.255.255.255 up
/sbin/route add -host $VIP1 dev lo:0

我比较喜欢使用ip命令代替route命令

ip route add $VIP dev lo:0 src $VIP

第 15 章 NFS

yum install -y nfs-utils

NFS Server Configuration

过程 15.1. On the *SERVER* side

stop & disable services

service nfs stop
service nfslock stop
service rpcbind stop
service rpcidmapd stop

/etc/fstab

as root edit /etc/fstab and add nfs4 exports

/www  /exports    none    bind    0 0

as root edit /etc/exports

NFSv3

/exports 		172.16.1.0/24 (rw,sync)

NFSv4

/exports 		172.16.1.0/24(rw,sync,fsid=0,anonuid=99,anongid=99)
/exports/neo	*(rs,sync)

reload exported filesystems

# exportfs -rv

start required services

chkconfig rpcbind on
chkconfig nfs on
chkconfig nfslock on
chkconfig rpcidmapd on

service rpcbind start
service rpcidmapd start
service nfs start
service nfslock start

nfs status

#  nfsstat
Server rpc stats:
calls      badcalls   badauth    badclnt    xdrcall
171        0          0          0          0

Server nfs v3:
null         getattr      setattr      lookup       access       readlink
3         1% 150      88% 0         0% 3         1% 2         1% 0         0%
read         write        create       mkdir        symlink      mknod
0         0% 0         0% 0         0% 0         0% 0         0% 0         0%
remove       rmdir        rename       link         readdir      readdirplus
0         0% 0         0% 0         0% 0         0% 0         0% 9         5%
fsstat       fsinfo       pathconf     commit
0         0% 3         1% 0         0% 0         0%

# watch nfsstat -c

Every 2.0s: nfsstat -c                                                                                                                          Mon Sep 20 16:53:55 2010

Client rpc stats:
calls      retrans    authrefrsh
286818929   1160       0

Client nfs v4:
null         read         write        commit       open         open_conf
0         0% 37286763 13% 6         0% 1         0% 38990106 13% 17986485  6%
open_noat    open_dgrd    close        setattr      fsinfo       renew
6         0% 0         0% 38774539 13% 2172019   0% 16        0% 147       0%
setclntid    confirm      lock         lockt        locku        access
321       0% 321       0% 0         0% 0         0% 0         0% 62157123 21%
getattr      lookup       lookup_root  remove       rename       link
80553542 28% 8828991   3% 8         0% 5         0% 5         0% 0         0%
symlink      create       pathconf     statfs       readlink     readdir
0         0% 1         0% 0         0% 5         0% 0         0% 13933     0%
server_caps  delegreturn
24        0% 54556     0%

security

# vi /etc/hosts.deny
rpcbind:ALL

# vi /etc/hosts.allow
rpcbind:172.16.1.0/255.255.254.0

NFS的队列大小下面将设置为较合理的值256K

# echo 262144 > /proc/sys/net/core/rmem_default
# echo 262144 > /proc/sys/net/core/rmem_max
# echo 262144 > /proc/sys/net/core/wmmen_default
# echo 262144 > /proc/sys/net/core/wmmen_max

过程 15.2. NFSv4

/etc/exports

# cat /etc/exports
/www		172.16.1.2/32(ro,sync,fsid=0,anonuid=99,anongid=99)
/www/logs	*(rw,sync)

注意，要通过NFS4共享一个目录,必须使用 fsid=0 的参数,使用fsid=0选项的时候只能共享一个目录，这个目录将成为NFS服务器的根目录。

启动NFS,v4 不需要rpcbind

service rpcbind stop
service rpcidmapd stop
service nfs restart
service nfslock stop

查看 export 设置

# exportfs
/www          	172.16.1.2/32
/www/logs     	172.16.1.0/24

mount NFSv4

mount -t nfs4 172.16.1.15:/logs /mnt

NFS 防火墙配置

查看NFS正在使用的端口

rpcinfo -p localhost

vi /etc/sysconfig/nfs

LOCKD_TCPPORT=32803
LOCKD_UDPPORT=32769
MOUNTD_PORT=892
RQUOTAD_PORT=875
STATD_PORT=662
STATD_OUTGOING_PORT=2020

service nfs restart

iptables -I INPUT -m state --state NEW -p tcp \
    -m multiport --dport 111,892,2049,32803 -s 192.168.0.0/24 -j ACCEPT

iptables -I INPUT -m state --state NEW -p udp \
    -m multiport --dport 111,892,2049,32769 -s 192.168.0.0/24 -j ACCEPT

NFS Client Configuration

CentOS 6 NFSv3 portmap 已经不存,已经被rpcbind替代

chkconfig rpcbind on
service rpcbind start

test nfs

mount 172.16.1.10:/exports /mnt

NFSv4

mount -t nfs4 -o ro,intr 172.16.1.10:/ /mnt

umount /mnt

过程 15.3. On the *CLIENT* side

Mounting NFS File Systems using /etc/fstab

The general syntax for the line in /etc/fstab is as follows:

server:/usr/local/pub    /pub   nfs    rsize=8192,wsize=8192,timeo=14,intr

NFSv4

server:/ /mount/point nfs4 rw,hard,intr,proto=tcp,port=2049,auto 0 0

mount all stuff from /etc/fstab

# mount -a

rpcinfo

rpcinfo -p
   program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp    707  status
    100024    1   tcp    710  status
    100021    1   udp  48233  nlockmgr
    100021    3   udp  48233  nlockmgr
    100021    4   udp  48233  nlockmgr
    100021    1   tcp  58065  nlockmgr
    100021    3   tcp  58065  nlockmgr
    100021    4   tcp  58065  nlockmgr

start required services

centos 5.x

chkconfig portmap on
service portmap start

centos 6

chkconfig rpcbind on
service rpcbind start

Using NFS over UDP

For example, on demand via the command line (client side):

mount -o udp shadowman.example.com:/misc/export /misc/local

When the NFS mount is specified in /etc/fstab (client side):

server:/usr/local/pub    /pub   nfs    rsize=8192,wsize=8192,timeo=14,intr,udp

NFS For Windows

安装NFS服务，进入“控制面板”，点击“打开或关闭Windows功能”，再勾选“NFS 服务”，最后确定

启动NFS服务，控制面板\管理工具\Network File System 服务(NFS)

或者通过命令启动NFS服务

nfsadmin client [ComputerName] start

指定挂在用户ID，开始“运行”输入“regedit”回车，然后找到 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default，右键“新建”选择“DWORD(32为)值” 添加 AnonymousUid，AnonymousGid，然后双击 AnonymousUid，AnonymousGid编辑，选择十进制并输入用户ID。

重新启动NFS 服务，不需要重新启动计算机。

挂载文件系统

C:\Users\neo>mount \\192.168.2.15\www x:\

卸载文件系统

C:\Users\neo>umount x:

正在断开                x:      \\192.168.2.15\www
连接上存在打开的文件和/或未完成的目录搜索。

要继续此操作吗? (Y/N) [N]:Y

命令已成功完成。

提示

很不幸Microsoft Windows 目前尚不支持UTF-8字符集。

exportfs - maintain table of exported NFS file systems

# exportfs -o rw,all_squash,sync,anonuid=500,anongid=500 172.16.0.0/24:/www
# exportfs
/www          	172.16.0.0/24

# cat /var/lib/nfs/etab
/www	172.16.0.0/24(rw,sync,wdelay,hide,nocrossmnt,secure,root_squash,all_squash,no_subtree_check,secure_locks,acl,anonuid=500,anongid=500)

reload /etc/exports

/usr/sbin/exportfs -r

To unexport the /usr/tmp directory:

# exportfs -u netkiller.github.com:/usr/tmp

To unexport all exports listed in /etc/exports:

# exportfs -au

#!/bin/bash
RETVAL=0

start()
{
	/usr/sbin/exportfs -o rw,all_squash,sync,anonuid=500,anongid=500 172.16.0.0/24:/backup
	mount /dev/sdb1 /backup
	RETVAL=$?
	echo
}

stop()
{
	exportfs -u 172.16.0.0/24:/backup
	umount /backup
	RETVAL=$?
}

第 16 章 Synchronizes system time using the Network Time Protocol (NTP)

http://www.ntp.org

ntpd - Network Time Protocol (NTP) daemon

过程 16.1. ntp server

# yum install ntp

port

[root@ntp ~]# netstat -unlnp |grep 123
udp        0      0 192.168.5.5:123             0.0.0.0:*                               10810/ntpd
udp        0      0 172.16.0.5:123              0.0.0.0:*                               10810/ntpd
udp        0      0 192.168.3.5:123             0.0.0.0:*                               10810/ntpd
udp        0      0 127.0.0.1:123               0.0.0.0:*                               10810/ntpd
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               10810/ntpd
udp        0      0 ::1:123                     :::*                                    10810/ntpd
udp        0      0 fe80::225:64ff:fe9a:123     :::*                                    10810/ntpd
udp        0      0 :::123                      :::*                                    10810/ntpd

[root@ntp ~]# lsof -i :123
COMMAND   PID USER   FD   TYPE DEVICE SIZE NODE NAME
ntpd    10810  ntp   16u  IPv4  35921       UDP *:ntp
ntpd    10810  ntp   17u  IPv6  35922       UDP *:ntp
ntpd    10810  ntp   18u  IPv6  35923       UDP [fe80::225:64ff:fe9a:d7e0]:ntp
ntpd    10810  ntp   19u  IPv6  35924       UDP localhost6.localdomain6:ntp
ntpd    10810  ntp   20u  IPv4  35925       UDP localhost.localdomain:ntp
ntpd    10810  ntp   21u  IPv4  35926       UDP nis.example.com:ntp
ntpd    10810  ntp   22u  IPv4  35927       UDP 172.16.0.5:ntp
ntpd    10810  ntp   23u  IPv4  35928       UDP 192.168.5.5:ntp

status

ntpstat

[root@subversion ~]# ntpstat
synchronised to local net at stratum 11
   time correct to within 11 ms
   polling server every 1024 s

[root@subversion ~]# ntptrace -n 127.0.0.1
127.0.0.1: stratum 11, offset 0.000000, synch distance 0.010984

[root@subversion ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 122.226.192.4   .INIT.          16 u    - 1024    0    0.000    0.000   0.000
 218.75.4.130    .INIT.          16 u    - 1024    0    0.000    0.000   0.000
 www.chinaepg.ne .INIT.          16 u    - 1024    0    0.000    0.000   0.000
*LOCAL(0)        .LOCL.          10 l   60   64  377    0.000    0.000   0.001

http://www.pool.ntp.org/

vim /etc/ntp.conf
server 2.cn.pool.ntp.org
server 3.asia.pool.ntp.org
server 2.asia.pool.ntp.org

# chkconfig ntpd on
# service ntpd start/stop/restart

ntp client

使用 ntpdate 临时更新时间

[root@dev1 ~]# ntpdate 192.168.3.5 && hwclock -w
 9 Aug 12:38:22 ntpdate[2538]: step time server 192.168.3.5 offset 3543.674078 sec

另外一个命令rdate同样可以达到ntpdate目的，rdate是系统默认安装。

过程 16.2. ntp client

# yum install ntp

# chkconfig ntpd on
# service ntpd start

vim /etc/ntp.conf
#server 0.centos.pool.ntp.org
#server 1.centos.pool.ntp.org
#server 2.centos.pool.ntp.org
server 192.168.3.5

ntpd 启动后，不能再使用ntpdate

第 17 章 openvpn - secure IP tunnel daemon.

安装环境CentOS 6.x

过程 17.1. OpenVPN Server

# yum install openvpn easy-rsa

察看openvpn包中的文件

# rpm -ql openvpn
/etc/openvpn
/etc/rc.d/init.d/openvpn
/usr/lib64/openvpn
/usr/lib64/openvpn/plugin
/usr/lib64/openvpn/plugin/lib
/usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so
/usr/lib64/openvpn/plugin/lib/openvpn-down-root.so
/usr/lib64/openvpn/plugins
/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
/usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so
/usr/sbin/openvpn
/usr/share/doc/openvpn-2.3.2
/usr/share/doc/openvpn-2.3.2/AUTHORS
/usr/share/doc/openvpn-2.3.2/COPYING
/usr/share/doc/openvpn-2.3.2/COPYRIGHT.GPL
/usr/share/doc/openvpn-2.3.2/INSTALL
/usr/share/doc/openvpn-2.3.2/PORTS
/usr/share/doc/openvpn-2.3.2/README
/usr/share/doc/openvpn-2.3.2/README.auth-pam
/usr/share/doc/openvpn-2.3.2/README.down-root
/usr/share/doc/openvpn-2.3.2/contrib
/usr/share/doc/openvpn-2.3.2/contrib/OCSP_check
/usr/share/doc/openvpn-2.3.2/contrib/OCSP_check/OCSP_check.sh
/usr/share/doc/openvpn-2.3.2/contrib/README
/usr/share/doc/openvpn-2.3.2/contrib/multilevel-init.patch
/usr/share/doc/openvpn-2.3.2/contrib/openvpn-fwmarkroute-1.00
/usr/share/doc/openvpn-2.3.2/contrib/openvpn-fwmarkroute-1.00/README
/usr/share/doc/openvpn-2.3.2/contrib/openvpn-fwmarkroute-1.00/fwmarkroute.down
/usr/share/doc/openvpn-2.3.2/contrib/openvpn-fwmarkroute-1.00/fwmarkroute.up
/usr/share/doc/openvpn-2.3.2/contrib/pull-resolv-conf
/usr/share/doc/openvpn-2.3.2/contrib/pull-resolv-conf/client.down
/usr/share/doc/openvpn-2.3.2/contrib/pull-resolv-conf/client.up
/usr/share/doc/openvpn-2.3.2/sample
/usr/share/doc/openvpn-2.3.2/sample/Makefile
/usr/share/doc/openvpn-2.3.2/sample/Makefile.am
/usr/share/doc/openvpn-2.3.2/sample/Makefile.in
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/README
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/client.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/firewall.sh
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/home.up
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/loopback-client
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/loopback-server
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/office.up
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/openvpn-shutdown.sh
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/openvpn-startup.sh
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/roadwarrior-client.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/roadwarrior-server.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/server.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/static-home.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/static-office.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/tls-home.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/tls-office.conf
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/xinetd-client-config
/usr/share/doc/openvpn-2.3.2/sample/sample-config-files/xinetd-server-config
/usr/share/doc/openvpn-2.3.2/sample/sample-keys
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/README
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/ca.crt
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/ca.key
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/client.crt
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/client.key
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/dh1024.pem
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/pass.crt
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/pass.key
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/pkcs12.p12
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/server.crt
/usr/share/doc/openvpn-2.3.2/sample/sample-keys/server.key
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer/README
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer/build
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer/simple.c
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer/simple.def
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/defer/winbuild
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/log
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/log/build
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/log/log.c
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/log/log_v3.c
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/log/winbuild
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple/README
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple/build
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple/simple.c
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple/simple.def
/usr/share/doc/openvpn-2.3.2/sample/sample-plugins/simple/winbuild
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts/auth-pam.pl
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts/bridge-start
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts/bridge-stop
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts/ucn.pl
/usr/share/doc/openvpn-2.3.2/sample/sample-scripts/verify-cn
/usr/share/doc/openvpn-2.3.2/sample/sample-windows
/usr/share/doc/openvpn-2.3.2/sample/sample-windows/sample.ovpn
/usr/share/man/man8/openvpn.8.gz
/usr/share/openvpn
/var/run/openvpn

# rpm -ql easy-rsa
/usr/share/doc/easy-rsa-2.2.0
/usr/share/doc/easy-rsa-2.2.0/COPYING
/usr/share/doc/easy-rsa-2.2.0/COPYRIGHT.GPL
/usr/share/doc/easy-rsa-2.2.0/doc
/usr/share/doc/easy-rsa-2.2.0/doc/Makefile.am
/usr/share/doc/easy-rsa-2.2.0/doc/README-1.0
/usr/share/doc/easy-rsa-2.2.0/doc/README-2.0
/usr/share/easy-rsa
/usr/share/easy-rsa/2.0
/usr/share/easy-rsa/2.0/build-ca
/usr/share/easy-rsa/2.0/build-dh
/usr/share/easy-rsa/2.0/build-inter
/usr/share/easy-rsa/2.0/build-key
/usr/share/easy-rsa/2.0/build-key-pass
/usr/share/easy-rsa/2.0/build-key-pkcs12
/usr/share/easy-rsa/2.0/build-key-server
/usr/share/easy-rsa/2.0/build-req
/usr/share/easy-rsa/2.0/build-req-pass
/usr/share/easy-rsa/2.0/clean-all
/usr/share/easy-rsa/2.0/inherit-inter
/usr/share/easy-rsa/2.0/list-crl
/usr/share/easy-rsa/2.0/openssl-0.9.6.cnf
/usr/share/easy-rsa/2.0/openssl-0.9.8.cnf
/usr/share/easy-rsa/2.0/openssl-1.0.0.cnf
/usr/share/easy-rsa/2.0/pkitool
/usr/share/easy-rsa/2.0/revoke-full
/usr/share/easy-rsa/2.0/sign-req
/usr/share/easy-rsa/2.0/vars
/usr/share/easy-rsa/2.0/whichopensslcnf

key

# cd /usr/share/openvpn/easy-rsa/2.0/

vim vars
export KEY_COUNTRY="CN"
export KEY_PROVINCE="GD"
export KEY_CITY="Shenzhen"
export KEY_ORG="http://www.example.com"
export KEY_EMAIL="neo.chen@example.com"

# chmod +x *
# cp openssl-1.0.0.cnf openssl.cnf

# source ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
./build-key neo

# cp keys/ca.key keys/ca.crt keys/dh1024.pem keys/server.key keys/server.crt /etc/openvpn/

server.conf

cp keys/ca.key keys/ca.crt keys/dh1024.pem keys/server.key keys/server.crt /etc/openvpn/
vim /etc/openvpn/server.conf

启用IP转发

# vim /etc/sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1

net.ipv4.ip_forward = 1 使IP转发生效

sysctl -w net.ipv4.ip_forward=1

# /etc/init.d/openvpn start
Starting openvpn:                                          [  OK  ]

第 18 章 vsftpd - Very Secure FTP Daemon

# yum install vsftpd

chroot

chroot_local_user=YES

第 19 章 Samba

[root@development ~]# yum -y install samba

smbpasswd

[root@development ~]# sudo smbpasswd -L -a neo

smb.conf

#============================ Share Definitions ==============================

[homes]
        comment = Home Directories
        browseable = no
        writable = yes
        valid users = %S

[developer]
        comment = Developer Stuff
        path = /var/www/html
        public = yes
        writable = yes
        printable = no
        write list = +apache

第 20 章 Memcache

source code

libevent

# yum install libevent libevent-devel -y

memcache

# wget http://memcached.googlecode.com/files/memcached-1.4.5.tar.gz
# tar zxf memcached-1.4.5.tar.gz
# cd memcached-1.4.5
# ./configure --prefix=/usr/local/memcached-1.4.5
# make && make install

start

# ln -s /usr/local/memcached-1.4.5 /usr/local/memcached
# /usr/local/memcached/bin/memcached -d -m 128 -p 11211 -u nobody -l 172.16.0.1

yum install

# yum install memcached
# chkconfig memcached on
# chkconfig --list memcached

# cat /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS=""

# /etc/init.d/memcached start
Starting memcached:                                        [  OK  ]

第 21 章 radiusd - Authentication, Authorization and Accounting server

http://freeradius.org/

安装 radiusd

过程 21.1. 安装步骤

yum 安装

yum install -y freeradius

设置启动文件

chkconfig radiusd on
service radiusd start

配置 radiusd

cp /etc/raddb/clients.conf{,.original}
cp /etc/raddb/users{,.original}
cp /etc/raddb/sites-enabled/default{,.original}

cat >> /etc/raddb/clients.conf <<EOF

client 192.168.0.0/16 {
       secret          = testing123
       shortname       = freeradius.example.com
}
EOF

/etc/raddb/users

guest Cleartext-Password := "test"

/etc/raddb/sites-enabled/default

测试 radiusd

$ radtest guest test 192.168.2.1 1812 testing123
Sending Access-Request of id 223 to 192.168.2.1 port 1812
	User-Name = "guest"
	User-Password = "test"
	NAS-IP-Address = 127.0.1.1
	NAS-Port = 1812
	Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 192.168.2.1 port 1812, id=223, length=20

802.1

过程 21.2. 

第 22 章 Services

[ ] NetworkManager   自动在多种网络连接中进行转换，如果你的电脑有Wireless WiFi 和 Ethernet多种网络连接类型的话，可以选择开启。
[ ] acpid            （Advanced Configuration and Power Interface）是为替代传统的APM电源管理标准而推出的新型电源管理标准。通常笔记本电脑需要启动电源进行管理。
[*] anacron          自动化运行任务守护进程
[*] atd              自动化运行任务守护进程
[ ] auditd           审核信息，将消息写入控制台以及 audit_warn 电子邮件别名。用于存放内核生成的系统审查记录，这些记录会被一些程序使用。特别是对于SELinux用户来说。
[ ] autofs           自动挂载/卸载文件系统服务，可以自动挂载想访问但还未挂载的文件系统,自动卸载长期不访问的文件系统,自动安装管理进程automount，与NFS 相关，依赖于NIS
[ ] avahi-daemon     Zeroconf service discovery守护进程，Avahi是zeroconf协议的实现。它可以在没有DNS服务的局域网里发现基于zeroconf协议的设备和服务。它跟mDNS一样。除非你有兼容的设备或使用 zeroconf 协议的服务，否则就可以关闭。
[ ] avahi-dnsconfd   /etc/avahi/dnsconf.action脚本守护进程
[ ] bluetooth        蓝牙
[ ] conman           控制台管理
[ ] cpuspeed         监测系统空闲百分比，降低或加快CPU时钟速度和电压
[*] crond            一个传统的UNIX程序crontab，可以周期地运行用户调度的任务。
[ ] cups             通用UNIX打印守护进程，（Common UNIX Printing System）公共UNIX打印支持，为Linux提供打印功能。 安装打印机时需要的服务。
[ ] dnsmasq          Dns cache server守护进程
[ ] dund             蓝牙拨号网络
[ ] firstboot        安装完之后的用户配置向导，用于第一次设置系统
[ ] gpm              为文本模式下的Linux程序提供鼠标支持、拷贝、粘贴操作、弹出式菜单
[ ] haldaemon        硬件监控系统
[ ] hidd             蓝牙H.I.D.服务器
[ ] httpd            Apache服务器
[ ] ip6tables        防火墙守护进程
[*] iptables         防火墙守护进程
[ ] irda             红外端口守护进程
[*] irqbalance       多系统处理器环境下的系统中断请求进行负载平衡，单CPU无用
[ ] kudzu            硬件自动检测程序，如不增加新硬件，可以关闭
[ ] lvm2-monitor     LVM2 mirror devices守护进程
[ ] mcstrans         SELinux Context Translation System Daemon
[ ] mdmonitor        RAID相关设备的守护程序
[ ] mdmpd            RAID相关设备的守护程序
[*] messagebus       事件监控服务，在必要时向所有用户发送广播信息
[ ] microcode_ctl    可编码以及发送新微代码到内核以更新Intel IA32系列处理器守护进程
[ ] multipathd       Manage device-mapper multipath devices
[ ] netconsole       Initializes network console logging
[ ] netfs            安装和卸载NFS、SAMBA和NCP网络文件系统
[ ] netplugd         服务监控网络界面,根据信号关闭或启动它,用于手提电脑
[*] network          激活已配置网络接口的脚本程序
[ ] nfs              网络文件系统守护进程
[ ] nfslock          NFS文件锁定功能
[ ] nscd             密码与群查找服务
[ ] ntpd             网络时间同步
[ ] oddjobd
[ ] pand             蓝牙个人区域网络
[ ] pcscd            智能卡支持
[ ] portmap          用来支持RPC连接，RPC被用于NFS以及NIS 等服务
[ ] psacct           进程审计守护进程
[ ] rawdevices		 rawdevices	to block devices。Oracle数据库使用
[ ] rdisc            discovers routers守护进程
[ ] readahead_early  开机内存载入优化
[ ] readahead_later  开机内存载入优化
[ ] restorecond      SELinux相关联
[ ] rpcgssd          manages RPCSEC GSS contexts for the NFSv4 server
[ ] rpcidmapd        rpcidmapd for NFSv4 that maps user names to UID and GID nu
[ ] rpcsvcgssd       rpcsvcgssd manages RPCSEC GSS contexts for the NFSv4 server
[ ] saslauthd        使用SASL的认证守护进程
[*] sendmail         邮件服务器sendmail守护进程
[*] smartd           监控硬盘故障
[*] sshd             OpenSSH服务器守护进程
[*] syslog           系统日志
[ ] winbind          用于Samba服务器
[ ] wpa_supplicant   无线设备支持
[ ] xfs              X Window字型服务器守护进程，为本地和远程X服务器提供字型集
[ ] ypbind           为NIS客户机激活ypbind服务进程
[ ] yum-updatesd	 RPM操作系统自动升级和软件包管理守护进程

chkconfig

chkconfig acpid off

[root@development ~]# chkconfig --add mysqld 		[在服务清单中添加mysql服务]
[root@development ~]# chkconfig mysqld on			[设置mysql服务开机启动]
[root@development ~]# chkconfig --list mysqld		[设置mysql启动级别]
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off

chkconfig --level 3 mysqld on
chkconfig --level 3 mysqld off

xinetd.d

# yum -y install xinetd

tftpd

# yum install -y tftp-server tftp

/etc/xinetd.d/tftp

# vim /etc/xinetd.d/tftp
# default: off
# description: The tftp server serves files using the trivial file transfer \
#       protocol.  The tftp protocol is often used to boot diskless \
#       workstations, download configuration files to network-aware printers, \
#       and to start the installation process for some operating systems.
service tftp
{
        socket_type             = dgram
        protocol                = udp
        wait                    = yes
        user                    = root
        server                  = /usr/sbin/in.tftpd
        server_args             = -s /tftpboot
        disable                 = yes
        per_source              = 11
        cps                     = 100 2
        flags                   = IPv4
}

disable = yes 改为 disable = no

mkdir /tftpboot
/etc/init.d/xinetd restart

atftp-server

# yum install -y atftp-server atftp

/etc/xinetd.d/tftp

# cat /etc/xinetd.d/tftp
# default: off
# description: The tftp server serves files using the trivial file transfer protocol. The tftp protocol is often used to boot diskless workstations, download configuration files to network-aware printers, and to start the installation process for some operating systems.
service tftp
{
    disable         = no
    socket_type     = dgram
    protocol        = udp
    wait            = yes
    user            = root
    server          = /usr/sbin/in.tftpd
    server_args     = /tftpboot
    per_source      = 11
    cps             = 100 2
    flags           = IPv4
}

atftp-server 是一个可以不依赖xinetd的tftp服务器

rsync

# vim /etc/xinetd.d/rsync
# default: off
# description: The rsync server is a good addition to an ftp server, as it \
#       allows crc checksumming etc.
service rsync
{
        disable = no
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/bin/rsync
        server_args     = --daemon
        log_on_failure  += USERID
}

rshd

/etc/xinetd.d/rsh

# cat  /etc/xinetd.d/rsh
# default: on
# description: The rshd server is the server for the rcmd(3) routine and, \
#	consequently, for the rsh(1) program.  The server provides \
#	remote execution facilities with authentication based on \
#	privileged port numbers from trusted hosts.
service shell
{
	socket_type		= stream
	wait			= no
	user			= root
	log_on_success		+= USERID
	log_on_failure 		+= USERID
	server			= /usr/sbin/in.rshd
	disable			= no
}

访问权限配置

# cat /etc/hosts.allow
#
# hosts.allow	This file describes the names of the hosts which are
#		allowed to use the local INET services, as decided
#		by the '/usr/sbin/tcpd' server.
#
in.rshd : your.example.com 192.168.0.1

# cat /etc/hosts.deny
#
# hosts.deny	This file describes the names of the hosts which are
#		*not* allowed to use the local INET services, as decided
#		by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
all : all

访问主机设置

# cat ~/.rhosts
your.example.com user
192.168.0.1	user

rpcinfo

# rpcinfo -p 192.168.187.75
   program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp    697  status
    100024    1   tcp    700  status
    100011    1   udp    864  rquotad
    100011    2   udp    864  rquotad
    100011    1   tcp    867  rquotad
    100011    2   tcp    867  rquotad
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100003    4   udp   2049  nfs
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
    100003    4   tcp   2049  nfs
    100021    1   udp  32778  nlockmgr
    100021    3   udp  32778  nlockmgr
    100021    4   udp  32778  nlockmgr
    100021    1   tcp  35837  nlockmgr
    100021    3   tcp  35837  nlockmgr
    100021    4   tcp  35837  nlockmgr
    100005    1   udp    880  mountd
    100005    1   tcp    883  mountd
    100005    2   udp    880  mountd
    100005    2   tcp    883  mountd
    100005    3   udp    880  mountd
    100005    3   tcp    883  mountd

SELINUX

禁用SElinux编辑/etc/selinux/config，修改如下内容：

SELINUX=disabled

使用命令

getenforce
setenforce 0

lokkit --selinux=disabled

第 23 章 设备管理

CPU 资源管理

lscpu - display information about the CPU architecture

查看CPU信息

# lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                1
On-line CPU(s) list:   0
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             1
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 13
Stepping:              3
CPU MHz:               2400.084
BogoMIPS:              4800.16
Hypervisor vendor:     KVM
Virtualization type:   full
L1d cache:             32K
L1i cache:             32K
L2 cache:              4096K
NUMA node0 CPU(s):     0

chcpu - configure CPUs

禁用谋个CPU(含超线程)

# chcpu -d 3
CPU 3 disabled

# lscpu -c --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
3   -    -      -    :::           no

# lscpu -b --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   0    0      1    1:1:1:0       yes
2   0    0      2    2:2:2:0       yes
4   0    1      3    3:3:3:1       yes
5   0    1      4    4:4:4:1       yes
6   0    1      5    5:5:5:1       yes
7   0    1      6    6:6:6:1       yes

# lscpu --all --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   0    0      1    1:1:1:0       yes
2   0    0      2    2:2:2:0       yes
3   -    -      -    :::           no
4   0    1      3    3:3:3:1       yes
5   0    1      4    4:4:4:1       yes
6   0    1      5    5:5:5:1       yes
7   0    1      6    6:6:6:1       yes

# chcpu -d 3
CPU 3 is already disabled

# chcpu -d 1
CPU 1 disabled

# chcpu -d 3
CPU 3 disabled

# chcpu -d 5
CPU 5 disabled

# chcpu -d 7
CPU 7 disabled

# lscpu --all --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   -    -      -    :::           no
2   0    0      1    1:1:1:0       yes
3   -    -      -    :::           no
4   0    1      2    2:2:2:1       yes
5   -    -      -    :::           no
6   0    1      3    3:3:3:1       yes
7   -    -      -    :::           no

启用谋个CPU

# chcpu -e 3
CPU 3 enabled

# lscpu --all --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   0    0      1    1:1:1:0       yes
2   0    0      2    2:2:2:0       yes
3   0    0      3    3:3:3:0       yes
4   0    1      4    4:4:4:1       yes
5   0    1      5    5:5:5:1       yes
6   0    1      6    6:6:6:1       yes
7   0    1      7    7:7:7:1       yes

0 号 CPU不允许禁用

# lscpu --all --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   -    -      -    :::           no
2   -    -      -    :::           no
3   -    -      -    :::           no
4   -    -      -    :::           no
5   -    -      -    :::           no
6   -    -      -    :::           no
7   -    -      -    :::           no

# chcpu -d 0
CPU 0 is not hot pluggable

1号处于启用状态，0号仍然不能禁用

# lscpu --all --extended
CPU NODE SOCKET CORE L1d:L1i:L2:L3 ONLINE
0   0    0      0    0:0:0:0       yes
1   0    0      1    1:1:1:0       yes
2   -    -      -    :::           no
3   -    -      -    :::           no
4   -    -      -    :::           no
5   -    -      -    :::           no
6   -    -      -    :::           no
7   -    -      -    :::           no

# chcpu -d 0
CPU 0 is not hot pluggable

第 24 章 Web Server

Apache httpd

[root@development httpd-2.2.14]# yum install zlib-devel.x86_64

./configure --prefix=/usr/local/httpd-2.2.14 \
--with-mpm=worker \
--enable-so \
--enable-mods-shared=all \
--enable-static-support \
--enable-static-htpasswd \
--enable-static-htdigest \
--enable-static-ab \
--disable-include \
--disable-actions \
--disable-alias \
--disable-asis \
--disable-autoindex \
--disable-auth_basic \
--disable-authn_file \
--disable-authn_default \
--disable-authz_groupfile \
--disable-authz_user \
--disable-authz_default \
--disable-cgi \
--disable-cgid \
--disable-env \
--disable-negotiation \
--disable-status \
--disable-userdir

Install

Apache

[root@development ~]# yum -y install httpd

PHP

[root@development ~]# yum -y install php
[root@development ~]# yum -y install php-mysql php-gd php-mbstring php-bcmath
[neo@development ~]$ sudo yum -y install php-pecl-memcache

mysql

[root@development ~]# yum -y install mysql-server

Uninstall

# yum remove httpd

Configure

Apache

VirtualHost

[root@development ~]# vim /etc/httpd/conf.d/vhost.conf
#
# Use name-based virtual hosting.
#
NameVirtualHost *:80
#
# NOTE: NameVirtualHost cannot be used without a port specifier
# (e.g. :80) if mod_ssl is being used, due to the nature of the
# SSL protocol.
#

#
# VirtualHost example:
# Almost any Apache directive may go into a VirtualHost container.
# The first VirtualHost section is used for requests without a known
# server name.
#
<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /www/docs/dummy-host.example.com
    ServerName dummy-host.example.com
    ErrorLog logs/dummy-host.example.com-error_log
    CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>

MySQL

reset mysql's password

[root@development ~]# /usr/bin/mysqladmin -u root password 'new-password'
[root@development ~]# /usr/bin/mysqladmin -u root -h development.domain.org password 'new-password'

Alternatively you can run:

[root@development ~]# /usr/bin/mysql_secure_installation

Starting

levels

[root@development ~]# chkconfig --list mysqld
mysqld          0:off   1:off   2:off   3:off   4:off   5:off   6:off

[root@development ~]# chkconfig --list httpd
httpd           0:off   1:off   2:off   3:off   4:off   5:off   6:off

[root@development ~]# chkconfig httpd on
[root@development ~]# chkconfig --list httpd
httpd           0:off   1:off   2:on    3:on    4:on    5:on    6:off

[root@development ~]# chkconfig mysqld on
[root@development ~]# chkconfig --list mysqld
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off

Apache

[root@development ~]# service httpd start

MySQL

[root@development ~]# service mysqld start

[root@development ~]# netstat -nat | grep 80
tcp        0      0 :::80                       :::*                        LISTEN

[root@development ~]# netstat -nat | grep 3306
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN

FAQ

compile php

[root@development php-5.3.0]# yum install libxml2-devel
[root@development php-5.3.0]# yum install curl-devel
[root@development php-5.3.0]# yum install gd-devel
[root@development php-5.3.0]# yum install libjpeg-devel
[root@development php-5.3.0]# yum install libpng-devel
[root@development php-5.3.0]# yum install openldap-devel
[root@development php-5.3.0]# yum install mysql-devel
[root@development php-5.3.0]# yum install net-snmp-devel

Nginx

yum install nginx
yum -y install mysql mysql-server
yum -y install php php-cgi php-mysql php-mbstring php-gd php-fastcgi
yum -y install perl-DBI perl-DBD-MySQL

install nginx

spawn-fcgi script

yum -y install spawn-fcgi

/etc/sysconfig/spawn-fcgi

移除SOCKET与OPTIONS注释, apache改为nginx

# cat /etc/sysconfig/spawn-fcgi
# You must set some working options before the "spawn-fcgi" service will work.
# If SOCKET points to a file, then this file is cleaned up by the init script.
#
# See spawn-fcgi(1) for all possible options.
#
# Example :
SOCKET=/var/run/php-fcgi.sock
OPTIONS="-u apache -g apache -s $SOCKET -S -M 0600 -C 32 -F 1 -P /var/run/spawn-fcgi.pid -- /usr/bin/php-cgi"

chkconfig spawn-fcgi on

starting spawn-fcgi

/etc/init.d/spawn-fcgi start

check port

# netstat -nl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN
tcp        0      0 :::22                       :::*                        LISTEN
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING     25282  /var/run/php-fcgi.sock
unix  2      [ ACC ]     STREAM     LISTENING     8227   @/com/ubuntu/upstart

Unix domain socket

        location ~ \.php$ {
            fastcgi_pass   unix:/var/run/php-fcgi.sock;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  /var/www/nginx-default$fastcgi_script_name;
            include        fastcgi_params;
        }

TCP/IP

/usr/bin/spawn-fcgi -a 127.0.0.1 -p 9000 -u nginx -g nginx -d /www -C 32 -F 1 -P /var/run/spawn-fcgi.pid -f /usr/bin/php-cgi

        location ~ \.php$ {
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  /var/www/nginx-default$fastcgi_script_name;
            include        fastcgi_params;
        }

# netstat -tulpn | grep :9000
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      26877/php-cgi

chkconfig nginx on

check config

nginx -t

php-fpm

rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
yum install nginx -y

chkconfig nginx on

check config

nginx -t

其他 php-fpm YUM源

rpm --import http://rpms.famillecollet.com/RPM-GPG-KEY-remi
rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm

# rpm -Uvh http://centos.alt.ru/repository/centos/6/i386/centalt-release-6-1.noarch.rpm
# yum update

fastcgi backend

upstream backend  {
  server   localhost:1234;
}

fastcgi_pass   backend;

第 25 章 IBM WebSphere

WebSphere Commerce Engerprise 7.0

设置语言

# locale
LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=

我使用英文UTF-8,如需更改使用下面命令

LANG=xx_XX
export LANG

LC_ALL=xx_XX
export LC_ALL

echo $LANG

/etc/profile

export TMP=/tmp
export TMPDIR=/tmp
export ORACLE_BASE=/opt/oracle
export ORACLE_HOME=$ORACLE_BASE/product/11.2.0.1/client
export PATH=$ORACLE_HOME/bin:$PATH

export JAVA_HOME=/opt/IBM/WebSphere/AppServer/java
export CLASSPATH=$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$CLASSPATH
export PATH=$PATH:$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$HOMR/bin

/etc/hosts

echo "127.0.0.1    wcs.example.com" >> /etc/hosts

hostname wcs.example.com

# grep HOSTNAME  /etc/sysconfig/network
HOSTNAME=wcs.example.com

创建一个非root用户

adduser wcuser
echo "wcuser:passw0rd" | chpasswd

yum install -y compat-db libXp rpm-build elfutils elfutils-libs
./setup.sh

安装依赖软件，后Back在Next一次

rpm -ivh libXp-1.0.0-8.1.el5.i386.rpm libXp-1.0.0-8.1.el5.x86_64.rpm
# rpm -ivh compat-db*
Preparing...                ########################################### [100%]
   1:compat-db              ########################################### [ 50%]
   2:compat-db              ########################################### [100%]

忽略提示下一步

UpdateInstaller (AppServer, Plugins, IBMIHS)

# tar zxvf 7.0.0.11-ws-updi-linuxamd64.tar.gz
# UpdateInstaller/install

# cp *.pak /opt/IBM/WebSphere/UpdateInstaller/maintenance/

WAS

/opt/IBM/WebSphere/UpdateInstaller/update.sh

# grep Finish /opt/IBM/WebSphere/AppServer/logs/update/install/updatelog.txt
# /opt/IBM/WebSphere/AppServer/java/bin/java -version
java version "1.6.0"
Java(TM) SE Runtime Environment (build pxa6460sr7ifix-20100629_01(SR7+IZ69890+IZ70326+IZ68882))
IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 Linux amd64-64 jvmxa6460sr7-20100219_54097 (JIT enabled, AOT enabled)
J9VM - 20100219_054097
JIT  - r9_20091123_13891
GC   - 20100216_AA)
JCL  - 20091202_01

Plugins

/opt/IBM/WebSphere/UpdateInstaller/update.sh

IHS

/opt/IBM/WebSphere/UpdateInstaller/update.sh

backup

su - root
cp -i -r IBM IBM.pack
cp -i -r IBMIHS IBMIHS.pack

UpdateInstaller (CommerceServer70)

# unzip download.updii.7002.linux.amd64.zip
# UpdateInstaller/install
# cp 7.0.0-WS-WCServer-FP002.pak /opt/IBM/WebSphere/UpdateInstaller1/maintenance/

# /opt/IBM/WebSphere/CommerceServer70/bin/versionInfo.sh

WebSphere Commerce Engerprise 7.0 Feature Pack 2.iso

# unzip download.updii.7002.linux.amd64.zip
# UpdateInstaller/install
# cp 7.0.0-WS-WCServer-FP002.pak /opt/IBM/WebSphere/UpdateInstaller1/maintenance/

# /opt/IBM/WebSphere/CommerceServer70/bin/versionInfo.sh

creating a WebSphere Commerce instance

su - wcuser
./config_server.sh
./config_client.sh -protocol SSL&

备份操作

su - root
cp -i -r IBM IBM.instance
cp -i -r IBMIHS IBMIHS.instance

ls /opt/IBM/WebSphere/AppServer/profiles/demo/installedApps/WC_demo_cell/WC_demo.ear/xml/config/wc-server.xml

# ls /opt/IBM/WebSphere/CommerceServer70/instances/demo/httplogs/ | wc -l
0
# cat /opt/IBM/WebSphere/CommerceServer70/instances/demo/logs/createInstanceANT.err.log |wc -c
0
# grep error /opt/IBM/WebSphere/CommerceServer70/instances/demo/logs/trace.txt
# grep error /opt/IBM/WebSphere/CommerceServer70/instances/demo/logs/messages.txt
# cat /opt/IBM/WebSphere/CommerceServer70/logs/WCSconfig.log |wc -l

# su - oracle
exp wcuser/passw0rd@wcsdb file=/home/oracle/wcuser.dmp

Oracle 部分

create tablespace tablespaceName datafile 'dataFilePath'
   size 100M reuse autoextend on next 2M maxsize unlimited;
create user oracleUser identified by oraclePassword default tablespace tablespaceName;
grant create procedure, create session, create synonym, create table, create
   trigger, create view, create materialized view to oracleUser;
ALTER USER oracleUser QUOTA UNLIMITED ON tablespaceName;

cat >> /opt/oracle/product/11.2.0.1/client/network/admin/tnsnames.ora <<EOF
WCSDB =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.3.50)(PORT = 1521))
    )
    (CONNECT_DATA =
      (SERVICE_NAME = wcsdb)
    )
  )
EOF

测试tnsnames.ora

# sqlplus /nolog
SQL> conn wcuser/password@wcsdb
SQL> select * from site;

enableFeature

[root@wcs ~]# /opt/IBMIHS/bin/apachectl -k start -f /opt/IBM/WebSphere/CommerceServer70/instances/demo/httpconf/httpd.conf
[root@wcs ~]# su - wcuser
[wcuser@wcs bin]$ pwd
/opt/IBM/WebSphere/AppServer/profiles/demo/bin

[wcuser@wcs bin]$ ./startServer.sh server1
$ grep error /opt/IBM/WebSphere/AppServer/profiles/demo/logs/server1/startServer.log | wc -l
0

确认端口都工作正常

# netstat -nlp | grep "0 0.0.0.0:"
# netstat -nlp | egrep "httpd|java"
[root@wcs ~]# netstat -nlp | egrep "httpd|java" | egrep "0 192.168.3.198:|0 0.0.0.0:"

https://wcs.example.com:8002/adminconsole

https://wcs.example.com:8004/orgadminconsole

IBM Bug Oracle默认端口是50000，更改oralce端口密码1521

# vim /opt/IBM/WebSphere/CommerceServer70/instances/demo/xml/demo.xml
# vim /opt/IBM/WebSphere/CommerceServer70/instances/demo/xml/demo.xml.bak

foundation

[root@wcs ~]# su - wcuser
[wcuser@wcs ~]$ cd /opt/IBM/WebSphere/CommerceServer70/bin/
[wcuser@wcs bin]$ ./config_ant.sh -buildfile /opt/IBM/WebSphere/CommerceServer70/components/common/xml/enableFeature.xml -DinstanceName=demo -DfeatureName=foundation -DdbUserPassword=passw0rd

[wcuser@wcs bin]$ egrep "error|Error|exception|Exception" ../instances/demo/logs/enablefoundation_2011.05.31_15.05.32.871.log

management-center

./config_ant.sh -buildfile /opt/IBM/WebSphere/CommerceServer70/components/common/xml/enableFeature.xml -DinstanceName=demo -DfeatureName=management-center -DdbUserPassword=passw0rd

egrep "error|Error|exception|Exception" ../instances/demo/logs/enablemanagement-center_2011.05.31_15.49.35.040.log
https://wcs.example.com:8000/lobtools

store-enhancements

./config_ant.sh -buildfile /opt/IBM/WebSphere/CommerceServer70/components/common/xml/enableFeature.xml -DinstanceName=demo -DfeatureName=store-enhancements -DdbUserPassword=passw0rd
[wcuser@wcs bin]$ egrep "error|Error|exception|Exception" ../instances/demo/logs/enablestore-enhancements_2011.05.31_16.28.23.659.log

checkEnablementStatus

[wcuser@wcs bin]$ ./checkEnablementStatus.sh -DinstanceName=demo -DdbUserPassword=passw0rd

check version

所有版本都应该是 7.0.0.11

/opt/IBM/WebSphere/AppServer/bin/versionInfo.sh
/opt/IBM/WebSphere/Plugins/bin/versionInfo.sh
/opt/IBMIHS/bin/versionInfo.sh

Start IBMIHS and AppServer

IBMIHS

Start IBMIHS

[root@wcs bin]$ /opt/IBMIHS/bin/apachectl -k start -f /opt/IBM/WebSphere/CommerceServer70/instances/demo/httpconf/httpd.conf

IHS管理控制台

[root@wcs bin]$ /opt/IBMIHS/bin/adminctl start / stop

AppServer

Start AppServer

[wcuser@wcs bin]$ ./startServer.sh server1
ADMU0116I: Tool information is being logged in file
           /opt/IBM/WebSphere/AppServer/profiles/demo/logs/server1/startServer.log
ADMU0128I: Starting tool with the demo profile
ADMU3100I: Reading configuration for server: server1
ADMU3200I: Server launched. Waiting for initialization status.
ADMU3000I: Server server1 open for e-business; process id is 7869

[wcuser@wcs bin]$ ./stopServer.sh server1
ADMU0116I: Tool information is being logged in file
           /opt/IBM/WebSphere/AppServer/profiles/demo/logs/server1/stopServer.log
ADMU0128I: Starting tool with the demo profile
ADMU3100I: Reading configuration for server: server1
Realm/Cell Name: <default>
Username: configadmin
Password:
ADMU3201I: Server stop request issued. Waiting for stop status.
ADMU4000I: Server server1 stop completed.

Starting and stopping the WebSphere Commerce Information Center

To start the WebSphere Commerce Information Center, issue one of the following commands:

/opt/IBM/WebSphere/CommerceServer70/bin/startHelp.sh

[root@wcs ~]# su - wasadmin
[wasadmin@wcs ~]$ cd /opt/IBM/WebSphere/CommerceServer70/bin/
[wasadmin@wcs bin]$ ./startHelp.sh

To stop the WebSphere Commerce Information Center, issue one of the following commands:

[wasadmin@wcs bin]$ ./stopHelp.sh

http://wcs.example.com:8001/help/index.jsp

管理入口

https://wcs.example.com:8000/lobtools
https://wcs.example.com:8000/accelerator
https://wcs.example.com:8002/adminconsole
https://wcs.example.com:8004/orgadminconsole
https://wcs.example.com:9063/ibm/console/logon.jsp (configadmin)

Initialization store

ExtendedSites-FEP.sar

MadisonsEnhancements.sar

第 26 章 MySQL

Installation

# yum install mysql-server
# /etc/init.d/mysqld start

设置数据库root密码

/usr/bin/mysqladmin -u root password 'new-password'
/usr/bin/mysqladmin -u root -h your.domain password 'new-password'

or

# /usr/bin/mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.

Set root password? [Y/n]
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n]
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n]
 ... Success!

By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n]
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n]
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.

Thanks for using MySQL!

create database and user

# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>
CREATE DATABASE dbname DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;

GRANT ALL PRIVILEGES ON dbname.* TO 'dbuser'@'localhost' IDENTIFIED BY 'your_password' WITH GRANT OPTION;

FLUSH PRIVILEGES;

test login

# mysql -u dbuser -p dbname
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 11
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

第 27 章 Teamwork

Subversion

[root@development ~]# yum -y install subversion

classic Unix-like xinetd daemon

[root@development ~]# vim /etc/xinetd.d/subversion
service subversion
{
    disable = no
    port = 3690
    socket_type = stream
    protocol = tcp
    wait = no
    user = svnroot
    server = /usr/bin/svnserve
    server_args = -i -r /home/svnroot
}

firewall

iptables -A INPUT -p tcp -m tcp --sport 3690 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 3690 -j ACCEPT

WebDav

install webdav module

[root@development ~]# yum install mod_dav_svn

create directory

mkdir /var/www/repository
svnadmin create /var/www/repository

subversion.conf

[root@development ~]# vim /etc/httpd/conf.d/subversion.conf
LoadModule dav_module modules/mod_dav.so
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so

vhost.conf

<Location />
DAV svn
SVNPath /var/www/repository
AuthType Basic
AuthName "Subversion Repository"
AuthUserFile /etc/subversion/svn-auth-file
Require valid-user
</Location>

auth file

[root@development ~]# htpasswd -c /etc/subversion/svn-auth-file my_user_name

项目目录结构

–trunk #存放主线

–branches #存放分支，可修改

–tags #存放标记，不可修改

Trac

http://trac.edgewall.org/

[root@development ~]# yum install python-setuptools
[root@development ~]# easy_install Trac

[root@development ~]# trac-admin /var/www/myproject initenv

trac.ini

subversion 仓库配置

vim /srv/example/conf/trac.ini

repository_dir = /svnroot/example.com

standalone

tracd -s --port 8000 /var/www/myproject

multiple projects

tracd --port 8000 /var/www/trac/project1/ /var/www/trac/project2 ...
or
tracd --port 8000 -e /var/www/trac/

Using Authentication

Using Authentication

To create a .passwd file using htdigest:

htdigest -c /var/www/trac/.passwd localhost neo

then for additional users:

htdigest /var/www/trac/.passwd localhost netkiller

bind ip

tracd -d --host 192.168.3.9 --port 8000 --auth=*,/srv/trac/.passwd,localhost -e /srv/trac

$ tracd -p 8080 \
   --auth=project1,/path/to/users.htdigest,mycompany.com \
   --auth=project2,/path/to/users.htdigest,mycompany.com \
   /path/to/project1 /path/to/project2

tracd -p 8000 \
   --auth=*,/var/www/trac/.passwd,localhost \
   -e /var/www/trac/

trac-admin

# trac-admin /srv/example help
trac-admin - The Trac Administration Console 0.12.3

Usage: trac-admin </path/to/projenv> [command [subcommand] [option ...]]

Invoking trac-admin without command starts interactive mode.

help                 Show documentation
initenv              Create and initialize a new environment
attachment add       Attach a file to a resource
attachment export    Export an attachment from a resource to a file or stdout
attachment list      List attachments of a resource
attachment remove    Remove an attachment from a resource
changeset added      Notify trac about changesets added to a repository
changeset modified   Notify trac about changesets modified in a repository
component add        Add a new component
component chown      Change component ownership
component list       Show available components
component remove     Remove/uninstall a component
component rename     Rename a component
config get           Get the value of the given option in "trac.ini"
config remove        Remove the specified option from "trac.ini"
config set           Set the value for the given option in "trac.ini"
deploy               Extract static resources from Trac and all plugins
hotcopy              Make a hot backup copy of an environment
milestone add        Add milestone
milestone completed  Set milestone complete date
milestone due        Set milestone due date
milestone list       Show milestones
milestone remove     Remove milestone
milestone rename     Rename milestone
permission add       Add a new permission rule
permission list      List permission rules
permission remove    Remove a permission rule
priority add         Add a priority value option
priority change      Change a priority value
priority list        Show possible ticket priorities
priority order       Move a priority value up or down in the list
priority remove      Remove a priority value
repository add       Add a source repository
repository alias     Create an alias for a repository
repository list      List source repositories
repository remove    Remove a source repository
repository resync    Re-synchronize trac with repositories
repository set       Set an attribute of a repository
repository sync      Resume synchronization of repositories
resolution add       Add a resolution value option
resolution change    Change a resolution value
resolution list      Show possible ticket resolutions
resolution order     Move a resolution value up or down in the list
resolution remove    Remove a resolution value
session add          Create a session for the given sid
session delete       Delete the session of the specified sid
session list         List the name and email for the given sids
session purge        Purge all anonymous sessions older than the given age
session set          Set the name or email attribute of the given sid
severity add         Add a severity value option
severity change      Change a severity value
severity list        Show possible ticket severities
severity order       Move a severity value up or down in the list
severity remove      Remove a severity value
ticket remove        Remove ticket
ticket_type add      Add a ticket type
ticket_type change   Change a ticket type
ticket_type list     Show possible ticket types
ticket_type order    Move a ticket type up or down in the list
ticket_type remove   Remove a ticket type
upgrade              Upgrade database to current version
version add          Add version
version list         Show versions
version remove       Remove version
version rename       Rename version
version time         Set version date
wiki dump            Export wiki pages to files named by title
wiki export          Export wiki page to file or stdout
wiki import          Import wiki page from file or stdin
wiki list            List wiki pages
wiki load            Import wiki pages from files
wiki remove          Remove wiki page
wiki rename          Rename wiki page
wiki replace         Replace the content of wiki pages from files (DANGEROUS!)
wiki upgrade         Upgrade default wiki pages to current version

Permissions

BROWSER_VIEW

CHANGESET_VIEW

CONFIG_VIEW

EMAIL_VIEW

FILE_VIEW

LOG_VIEW

MILESTONE_ADMIN

MILESTONE_CREATE

MILESTONE_DELETE

MILESTONE_MODIFY

MILESTONE_VIEW

PERMISSION_ADMIN

PERMISSION_GRANT

PERMISSION_REVOKE

REPORT_ADMIN

REPORT_CREATE

REPORT_DELETE

REPORT_MODIFY

REPORT_SQL_VIEW

REPORT_VIEW

ROADMAP_ADMIN

ROADMAP_VIEW

SEARCH_VIEW

TICKET_ADMIN

TICKET_APPEND

TICKET_CHGPROP

TICKET_CREATE

TICKET_EDIT_CC

TICKET_EDIT_COMMENT

TICKET_EDIT_DESCRIPTION

TICKET_MODIFY

TICKET_VIEW

TIMELINE_VIEW

TRAC_ADMIN

VERSIONCONTROL_ADMIN

WIKI_ADMIN

WIKI_CREATE

WIKI_DELETE

WIKI_MODIFY

WIKI_RENAME

WIKI_VIEW

admin

$ trac-admin /path/to/projenv permission add neo TICKET_ADMIN  TRAC_ADMIN  WIKI_ADMIN

group

$ trac-admin /path/to/projenv permission add admin MILESTONE_ADMIN PERMISSION_ADMIN REPORT_ADMIN ROADMAP_ADMIN TICKET_ADMIN TRAC_ADMIN VERSIONCONTROL_ADMIN WIKI_ADMIN

$ trac-admin /path/to/projenv permission add developer WIKI_ADMIN
$ trac-admin /path/to/projenv permission add developer REPORT_ADMIN
$ trac-admin /path/to/projenv permission add developer TICKET_ADMIN

user

$ trac-admin /path/to/projenv permission add bob developer
$ trac-admin /path/to/projenv permission add john developer

Resync

# trac-admin /srv/example repository resync '(default)'

旧版本trac: trac-admin /srv/trac/neo resync

Browser interface for CVS and SVN version control repositories

# yum install viewvc

CGI 方式安装

# vim /etc/httpd/conf/httpd.conf
ScriptAlias /viewvc /usr/lib/python2.4/site-packages/viewvc/bin/cgi/viewvc.cgi
Alias /viewvc-static/ "/usr/share/viewvc/templates/docroot/"

部分 III. Virtualization

第 28 章 Xen

install

[root@development ~]# xm list
Name                                      ID Mem(MiB) VCPUs State   Time(s)
Domain-0                                   0     1735     2 r-----   1194.1

create a virtual harddisk

[root@development ~]# mkdir /srv/vm/
[root@development ~]# dd if=/dev/zero of=/srv/vm/centos.img bs=1M count=4096
4096+0 records in
4096+0 records out
4294967296 bytes (4.3 GB) copied, 49.2547 seconds, 87.2 MB/s

ubuntu

[root@development ~]# virt-install -n centos -r 256 -f /srv/vm/centos.img --nographics -l ftp://192.168.3.9/pub/

Manager

list

[root@development ~]# xm list
Name                                      ID Mem(MiB) VCPUs State   Time(s)
Domain-0                                   0     1726     2 r-----   5686.6
centos                                     6      127     1 -b----     74.3

start

[root@development ~]# virsh  start centos
Domain centos started

reboot

[root@development ~]# xm reboot centos

shutdown

[root@development ~]# xm shutdown centos

console

[root@development ~]# xm console centos

config

[root@development ~]# cat /etc/xen/centos
name = "centos"
uuid = "a6a3f200-bcbb-cdbd-c06e-9e71f739310f"
maxmem = 128
memory = 128
vcpus = 1
bootloader = "/usr/bin/pygrub"
on_poweroff = "destroy"
on_reboot = "restart"
on_crash = "restart"
disk = [ "tap:aio:/srv/vm/centos.img,xvda,w" ]
vif = [ "mac=00:16:36:5d:41:d0,bridge=xenbr0,script=vif-bridge" ]

Automatically starting domains

[root@development ~]# mv /etc/xen/centos /etc/xen/auto

第 29 章 KVM

http://wiki.centos.org/HowTos/KVM

kvm install usage yum

确认处理器是否支持KVM

egrep 'vmx|svm' /proc/cpuinfo

对当前系统做一个全面升级

sudo yum update
sudo yum upgrade

Installing

如果你不想安装Virtualization组，想单独安装需要的软件，可是使用下面命令

# yum install kvm kmod-kvm qemu
# yum install bridge-utils

确认kvm已经安装

lsmod | grep kvm

[root@scientific ~]# lsmod|grep kvm
kvm_intel              45674  0
kvm                   291811  1 kvm_intel

Create the disk image

qemu-img create -f qcow2 disk.img 5G

or

dd if=/dev/zero of=disk.img bs=1G count=5

# qemu-img create -f qcow2 disk.img 5G
Formatting 'disk.img', fmt=qcow2, size=5242880 kB

# dd if=/dev/zero of=disk.img bs=1G count=5
5+0 records in
5+0 records out
5368709120 bytes (5.4 GB) copied, 61.0353 seconds, 88.0 MB/s

Creating a virtual machine

/usr/libexec/qemu-kvm -hda disk.img -cdrom archlinux-2009.08-core-x86_64.iso -m 512 -boot d

如果你不在localhost上安装OS,你需要指定vnc,这样你可以远程连接到kvm

[root@scientific ~]# /usr/libexec/qemu-kvm disk.img -cdrom rhel-server-5.6-x86_64-dvd.iso -m 8000 -boot d -vnc :1

[root@scientific ~]# yum install -y virt-manager virt-top virt-v2v virt-viewer
or
[root@scientific ~]# yum groupinstall 'Virtualization'

brctl / tunctl

[root@scientific ~]# yum install -y tunctl

DHCP

brctl addbr br0
ifconfig eth0 0.0.0.0
brctl addif br0 eth0
dhclient br0
tunctl -b -u root
ifconfig tap0 up
brctl addif br0 tap0

STATIC IP Address

brctl addbr br0
ifconfig eth0 0.0.0.0
brctl addif br0 eth0
ifconfig br0 up
tunctl -b -u root
ifconfig tap0 up
brctl addif br0 tap0

ifconfig br0 192.168.1.120 netmask 255.255.255.0 up
ip route add default via 192.168.3.1 dev br0

[root@scientific ~]# ip route
192.168.3.0/24 dev br0  proto kernel  scope link  src 192.168.3.43
192.168.3.0/24 dev tap0  proto kernel  scope link  src 192.168.3.21

default via 192.168.3.1 dev br0
[root@scientific ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.4ea7e4cf4633       no              eth0
                                                        tap0
br06499         8000.000000000000       no

启动KVM

指定网络参数 -net nic -net tap,ifname=tap0,script=no

/usr/libexec/qemu-kvm -hda disk.img -m 8000 -net nic -net tap,ifname=tap0,script=no -vnc :1

/usr/libexec/qemu-kvm -hda disk.img -m 8000 -net nic -net tap,ifname=tap0,script=no -nographic -daemonize

virt-install

yum install -y libvirt python-virtinst virt-manager

命令行安装

sudo virt-install --connect qemu:///system -n Ubuntu32 -r 512 --vcpus=1 -f /dev/sda3 -s 9 -c Desktop/ubuntu-10.10-desktop-i386.iso --vnc --noautoconsole --os-type linux --os-variant generic26 --accelerate --network=bridge:virbr0 --hvm
sudo virt-install --connect qemu:///system -n Ubuntu32 -r 512 --vcpus=1 -f ~/ubuntu32.qcow2 -s 12 -c esktop/ubuntu-10.10-desktop-i386.iso --vnc --noautoconsole --os-type linux --os-variant generic26 --accelerate --network=bridge:br0 --hvm

进入GUI工具

sudo virt-manager

Ubuntu

确认你的CPU是否支持KVM

egrep '(vmx|svm)' –color=always /proc/cpuinfo

sudo apt-get install kvm libvirt-bin ubuntu-vm-builder  bridge-utils kvm-pxe uml-utilities

kvm gui

sudo apt-get install ubuntu-virt-server ubuntu-virt-mgmt ubuntu-vm-builder python-vm-builder kvm-pxe

CentOS 6.2

# yum groupinstall Virtualization
# yum groupinstall "Virtualization Client"
# yum groupinstall "Virtualization Platform"

# /etc/init.d/libvirtd start
Starting libvirtd daemon:                                  [  OK  ]

Scientific Linux Virtualization

[root@scientific ~]# yum groupinstall 'Virtualization' 'Virtualization Client' 'Virtualization Platform' 'Virtualization Tools'

FAQ

Error: No hypervisor options were found for this connection

[root@r910 etc]# grep kvm /var/log/messages
Jun 21 15:28:05 r910 udevd[803]: specified group 'kvm' unknown
Jun 21 15:28:05 r910 udevd[803]: specified group 'kvm' unknown
Jun 21 15:28:07 r910 kernel: kvm: disabled by bios
Jun 21 15:28:07 r910 yum: Installed: 2:qemu-kvm-0.12.1.2-2.1 13.el6_0.8.x86_64
Jun 21 15:58:27 r910 kernel: kvm: disabled by bios
Jun 21 16:48:08 r910 kernel: kvm: disabled by bios
Jun 21 17:15:42 r910 yum: Erased: qemu-kvm
Jun 21 17:20:00 r910 kernel: kvm: disabled by bios
Jun 21 17:20:00 r910 yum: Installed: 2:qemu-kvm-0.12.1.2-2.1 13.el6_0.8.x86_64

第 30 章 OpenVZ

安装OpenVZ

过程 30.1. OpenVZ 安装步骤

获得OpenVZ yum安装源

# cd /etc/yum.repos.d
# wget http://download.openvz.org/openvz.repo
# rpm --import  http://download.openvz.org/RPM-GPG-Key-OpenVZ

安装OpenVZ核心以及头文件

# yum install ovzkernel[-flavor]

修改启动所使用的内核为OpenVZ内核，使OpenVZ内核为默认启动内核

# vim /etc/grub.conf

将类似下面的内容

title Fedora Core (2.6.8-022stab029.1)
       root (hd0,0)
       kernel /vmlinuz-2.6.8-022stab029.1 ro root=/dev/sda5 quiet rhgb vga=0x31B
       initrd /initrd-2.6.8-022stab029.1.img

修改为类似这样

title OpenVZ (2.6.8-022stab029.1)
        root (hd0,0)
        kernel /vmlinuz-2.6.8-022stab029.1 ro root=/dev/sda5
        initrd /initrd-2.6.8-022stab029.1.img

或直接在里面寻找类似开头为

title CentOS (2.6.18-194.3.1.el5.028stab069.6)

的项目，并且把default改为他的下标，下标从0开始

修改LINUX网络配置文件

/etc/sysctl.conf
# On Hardware Node we generally need
# packet forwarding enabled and proxy arp disabled
net.ipv4.ip_forward = 1 #修改

net.ipv6.conf.default.forwarding = 1 #添加
net.ipv6.conf.all.forwarding = 1 #添加
net.ipv4.conf.default.proxy_arp = 0 #添加

# Enables source route verification
net.ipv4.conf.all.rp_filter = 1 #修改

# Enables the magic-sysrq key
kernel.sysrq = 1 #修改

# We do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1 #添加
net.ipv4.conf.all.send_redirects = 0 #添加

关闭SELinux

# lokkit --selinux=disabled

SELINUX=disabled

重启LINUX

# reboot

安装OpenVZ管理工具

# yum install vzctl
# yum install vzquota
# yum install vzyum

用到什么工具就安装什么工具，具体可以使用# yum search vz*搜索一下

启动OpenVZ服务

# /sbin/service vz start

使用OpenVZ & 建立VPS

由于VZ是半虚拟化的，所以VZ和VM不同的是VZ需要系统模板，而不是VM那样只需要一个ISO文件就可以安装

安装操作系统模板

搜索系统模板

# yum search vztmpl

在搜索出来的结果中选用你想安装的操作系统

# yum install vztmpl-centos-4 -y

为操作系统模板建立缓存

在我装的最小化CENTOS中，此步要下载很多包，需要很长时间完成

# vzpkgcache

该命令将建立centos-4-i386-minimal.tar.gz和centos-4-i386-default.tar.gz文件 或

# vzpkgcache centos-4-i386-minimal

建立 centos-4-i386-minimal.tar.gz

# vzpkgcache centos-4-i386-default

建立 centos-4-i386-default.tar.gz

出现Cache file centos-4-i386-default.tar.gz [120M] created.表示创建成功

注意：本次步骤可能会出现如下错误

cp: cannot stat `/etc/sysconfig/vz-scripts//ve-vps.basic.conf-sample': No such file or directory
ERROR: Can't copy VPS config

解决方法：进入/etc/sysconfig/vz-scripts/目录，将ve.basic.conf-sample 拷贝一份重命名为ve-vps.basic.conf-sample

查看系统中已经存在的操作系统缓存

# vzpkgls

创建OpenVZ操作系统节点（VPS）

准备配置文件

平分主机系统资源（当然，如果你对配置文件的修改很熟悉也可以自己定制）

cd /etc/sysconfig/vz-scripts/
vzsplit -n 3 -f vps.zenw.org

这样，系统资源就被平均分成了3分，并且产生了一个配置文件示例

验证配置文件有效性

vzcfgvalidate ve-vps.zenw.org.conf-sample

创建VPS节点

vzctl create 100 --ostemplate centos-4-i386-minimal --config vps.zenw.org

其中100是该节点的编号，可以自己定义

配置该VPS

设置VPS的hostname
vzctl set 100 --hostname zenw.org --save
设置VPS的ip
vzctl set 100 --ipadd 192.168.xxx.xxx --save
设置VPS的管理员帐号和密码
vzctl set 100 --userpasswd root:xxxxxxxxx
设置VPS的DNS服务器
vzctl set 100 --nameserver 8.8.8.8 --save
设置VPS自启动
vzctl set 100 --onboot yes --save
启动VPS节点
vzctl start 100
执行VPS内部的命令（这里是开启VPS的ssh服务）
vzctl exec 100 service sshd start
加入VPS节点
vzctl enter 100
停止VPS节点
vzctl stop 100

设置VPS参数

修改VPS节点的配置文件

vim /etc/sysconfig/vz-scripts/100.conf
在文件中添加或修改 DISK_QUOTA=no

重启VPS节点
vzctl restart 100
查看当前磁盘大小
vzctl exec 100 df
设置磁盘大小
vzctl set 100 --diskinodes 75000000:79000000 --save
vzctl set 100 --quotatime 600 --save
查看修改后的磁盘大小
vzctl exec 100 df
vzctl exec 100 stat -f /

vzctl set 100 --quotaugidlimit 100 --save
vzctl restart 100

vzctl exec 100 rpm -q quota

vzyum 100 install quota

vzquota stat 100 -t

为VPS节点安装yum工具或其他工具

vzyum 100 install <软件名称>
vzyum 100 install yum

另外,如果vzctl enter进入节点时出现错误，或无法ssh节点，需要运行以下命令： vzctl exec 112 "cd /dev; /sbin/MAKEDEV pty; /sbin/MAKEDEV tty; /sbin/MAKEDEV generic"

第 31 章 虚拟机界面

libvirt

virsh

$ sudo virsh -c qemu:///system list
 Id Name                 State
----------------------------------
  1 Ubuntu               running
  2 Ubuntu-Server        running

# virsh list
 Id    Name                           State
----------------------------------------------------
 1     Ubuntu                         running
 2     CentOS6.4                      running

# virsh

显示虚拟机列表：
virsh # list --all

启动虚拟机：
virsh # start [name]

关闭虚拟机：
virsh # shutdown [name]

重启虚拟机：
virsh # reboot [name]

指定虚拟机开机自动启动：
virsh # autostart [name]

例 31.1. virsh

virsh # list --all
 Id    Name                           State
----------------------------------------------------
 -     CentOS6.4                      shut off
 -     FreeBSD                        shut off
 -     Test                           shut off
 -     Ubuntu                         shut off
 -     www                            shut off

virsh # start Ubuntu
Domain Ubuntu started

virsh # list --all
 Id    Name                           State
----------------------------------------------------
 1     Ubuntu                         running
 -     CentOS6.4                      shut off
 -     FreeBSD                        shut off
 -     Test                           shut off
 -     www                            shut off

virsh # quit

console

console Test

dumpxml

dump 虚拟机配置文件

virsh dumpxml Test

Virtual Machine Manager

OpenStack

CloudStack

OpenNode

OpenNEbula

部分 IV. Monitor

第 32 章 Munin

http://munin-monitoring.org/

# rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
# yum install munin -y
# yum install munin-node -y
# yum install munin-java-plugins -y
# yum install unbound-munin -y
# service munin-node start
# chkconfig munin-node on

test

# telnet localhost 4949
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
# munin node at datacenter.example.com
list
cpu df df_inode entropy forks fw_packets http_loadtime if_err_eth0 if_eth0 interrupts iostat iostat_ios irqstats load memory munin_stats netstat open_files open_inodes proc_pri processes sendmail_mailqueue sendmail_mailstats sendmail_mailtraffic swap threads uptime users vmstat yum

http://localhost/munin/

用户认证

$ sudo vim /etc/apache2/conf.d/munin.conf

        AuthUserFile /etc/munin/munin-htpasswd
        AuthName "Munin"
        AuthType Basic
        require valid-user

munin-node and plugins

config: /etc/munin/munin-node.conf

plugins: /usr/share/munin/plugins/

munin-node.conf

allow ^127\.0\.0\.1$
allow ^192\.168\.3\.5$

mysql plugin

mysql

# ln -s /usr/share/munin/plugins/mysql_* /etc/munin/plugins

# vim /etc/munin/plugin-conf.d/munin-node
env.mysqlopts -uneo -pchen

# or

env.mysqlopts -h 172.16.1.17 -u monitor -ppassword

# service munin-node start

验证安装，telnet localhost 4949 之后，执行 fetch mysql_queries

apache plugin

apache

# ln -s /usr/share/munin/plugins/apache_* /etc/munin/plugins

# vim /etc/httpd/conf/httpd.conf
ExtendedStatus On
<Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from .example.com
	Allow from localhost
</Location>

# /etc/init.d/httpd restart
# service munin-node restart

验证安装,telnet localhost 4949 之后，执行 fetch apache_processes

memcached plugin

memcached plugin要求符号链接名字的格式是: memcached_connections_[IP Address]_[Port], IP与Port是在符号链接名字中配置的

ln -s /usr/share/munin/plugins/memcached_bytes_ /etc/munin/plugins/memcached_bytes_127_0_0_1_11211
ln -s /usr/share/munin/plugins/memcached_connections_ /etc/munin/plugins/memcached_connections_127_0_0_1_11211
ln -s /usr/share/munin/plugins/memcached_hits_ /etc/munin/plugins/memcached_hits_127_0_0_1_11211
ln -s /usr/share/munin/plugins/memcached_items_ /etc/munin/plugins/memcached_items_127_0_0_1_11211
ln -s /usr/share/munin/plugins/memcached_requests_ /etc/munin/plugins/memcached_requests_127_0_0_1_11211
ln -s /usr/share/munin/plugins/memcached_traffic_ /etc/munin/plugins/memcached_traffic_127_0_0_1_11211

验证安装，telnet localhost 4949 之后，执行 fetch memcached_requests_127_0_0_1_11211

munin.conf

# vim /etc/munin/munin.conf
# a simple host tree
[localhost]
    address 127.0.0.1
    use_node_name yes
[database]
    address 192.168.3.40
    use_node_name yes

munin-node

# yum install munin-node -y
# chkconfig munin-node on
# service munin-node start

munin-node.conf

vim /etc/munin/munin-node.conf allow ^127\.16\.1\.2$

第 33 章 MRTG

# yum install mrtg

start

# env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg

/etc/mrtg/mrtg.cfg

HtmlDir: /var/www/mrtg
ImageDir: /var/www/mrtg
LogDir: /var/lib/mrtg
ThreshDir: /var/lib/mrtg
#Target[r1]: 2:public@myrouter.somplace.edu
#MaxBytes[r1]: 1250000
#Title[r1]: Traffic Analysis
#PageTop[r1]: <H1>Stats for our Ethernet</H1>

Target[dell_3548_switch]: ifInOctets.1&ifOutOctets.1:public@172.16.0.252
MaxBytes[dell_3548_switch]: 1250000
Title[dell_3548_switch]: Traffic Analysis
PageTop[dell_3548_switch]: <H1>Stats for our Ethernet</H1>

create mrtg.cfg

cp /etc/mrtg/mrtg.cfg /etc/mrtg/mrtg.cfg.old

cfgmaker --global "HtmlDir: /var/www/mrtg" \
--global "ImageDir: /var/www/mrtg" \
--global "LogDir: /var/lib/mrtg" \
--global "ThreshDir: /var/lib/mrtg" \
--global "Options[_]: growright,bits"  \
--ifref=name --ifdesc=descr  --show-op-down \
public@172.16.0.252 > /etc/mrtg/mrtg.cfg

index.html

# indexmaker --output=/var/www/mrtg/index.html /etc/mrtg/mrtg.cfg

监控多个设备

cfgmaker --global "HtmlDir: /var/www/mrtg" \
--global "ImageDir: /var/www/mrtg" \
--global "LogDir: /var/lib/mrtg" \
--global "ThreshDir: /var/lib/mrtg" \
--global "Options[_]: growright,bits"  \
--ifref=name --ifdesc=descr \
--subdirs=Dell6224 \
public@172.16.0.251 \
--ifref=name --ifdesc=descr \
--subdirs=Dell3548 \
public@172.16.0.252 \
--ifref=name --ifdesc=descr \
--subdirs=H3CS3600 \
public@172.16.0.253 > /etc/mrtg/mrtg.cfg

indexmaker --output=/var/www/mrtg/index.html /etc/mrtg/mrtg.cfg

批量生成监控配置文件

for host in 253 252 251 250 249
do

cfgmaker --global "HtmlDir: /var/www/mrtg" \
--global "ImageDir: /var/www/mrtg" \
--global "LogDir: /var/lib/mrtg" \
--global "ThreshDir: /var/lib/mrtg" \
--global "Options[_]: growright,bits"  \
\
--ifref=name --ifdesc=descr \
--subdirs=Cisco-Switch-2960G-$host \
public@172.16.0.$host \
\
> /etc/mrtg/switch-2960-$host.cfg

indexmaker --output=/var/www/mrtg/switch-2960-$host.html /etc/mrtg/switch-2960-$host.cfg

done

图片尺寸

Xsize / Ysize

cfgmaker --global "HtmlDir: /var/www/mrtg" \
--global "ImageDir: /var/www/mrtg" \
--global "LogDir: /var/lib/mrtg" \
--global "ThreshDir: /var/lib/mrtg" \
--global "Options[_]: growright,bits"  \
--global "Xsize[_]: 600" \
--global "Ysize[_]: 200" \
\
--ifref=name --ifdesc=descr \
--subdirs=Juniper-Firewall \
public@172.16.0.1 \
> /etc/mrtg/firewall.cfg

第 34 章 smartd - SMART Disk Monitoring Daemon

配置表示smartd以静默状态工作，当SMART中报告PASSED的时候不理睬一旦出现Failure，立刻用邮件通知用户指定的邮箱

vi /etc/smartd.conf
/dev/sdb -H -m neo@domain.com

修改配置后重启服务：

/etc/init.d/smartd start

第 35 章 snmpd - daemon to respond to SNMP request packets.

# yum -y install net-snmp net-snmp-utils

net-snmp-config --create-snmpv3-user -a PASSWORD MYUSERNAME
snmpwalk -v 3 -a md5 -A PASSWORD -x des -X PASSWORD -u MYUSERNAME IP.ADD.RE.SS
snmpwalk -v 3 -a md5 -A PASSWORD -l authNoPriv -u MYUSERNAME IP.ADD.RE.SS

第 36 章 cacti

yum install cacti

database

mysqladmin -uroot -p create cacti
echo "GRANT ALL ON cacti.* TO cacti@localhost IDENTIFIED BY '1ba0128c';" | mysql -uroot -p
echo "flush privileges;" | mysql -uroot -p
mysql -uroot -p cacti < /usr/share/doc/cacti-0.8.7e/cacti.sql

enable crontab

# cat /etc/cron.d/cacti
*/5 * * * *     cacti   /usr/bin/php /usr/share/cacti/poller.php > /dev/null 2>&1

install cacti

http://localhost/cacti/install/

第 37 章 Nagios

nagios

Install Nagios & Plugins

[root@database ~]# yum -y install nagios nagios-plugins-all nagios-plugins-nrpe

Create the default Nagios web access user & set a password

# htpasswd -c /etc/nagios/passwd nagiosadmin

Verify default config files

nagios -v /etc/nagios/nagios.cfg

Start Nagios

Start Nagios

Configure it to start on boot

chkconfig --levels 345 nagios on

http://localhost/nagios/

plugins

nrpe plugins

neo@monitor:/etc/nagios3/hosts$ sudo cat www.example.com.cfg

define host{
        use             generic-host            ; Inherit default values from a template
        host_name       www.example.com             ; The name we're giving to this host
        alias           Some Remote Host        ; A longer name associated with the host
        address         172.16.1.10              ; IP address of the host
        hostgroups      http-servers                    ; Host groups this host is associated with
        }

# NRPE disk check.
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-disk
        check_command                   check_nrpe_1arg!check_all_disks!172.16.1.10
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-users
        check_command                   check_nrpe_1arg!check_users!172.16.1.10
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-swap
        check_command                   check_nrpe_1arg!check_swap!172.16.1.10
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-procs
        check_command                   check_nrpe_1arg!check_total_procs!172.16.1.10
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-load
        check_command                   check_nrpe_1arg!check_load!172.16.1.10
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-zombie_procs
        check_command                   check_nrpe_1arg!check_zombie_procs!172.16.1.10
}

nrpe node

# yum install nrpe nagios-plugins-all

allowed_hosts=172.16.1.2

command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10
command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
command[check_hda1]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -p /dev/hda1
command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z
command[check_total_procs]=/usr/lib64/nagios/plugins/check_procs -w 150 -c 200
command[check_http]=/usr/lib64/nagios/plugins/check_http -I 127.0.0.1 -p 80 -u http://www.example.com/index.html
command[check_swap]=/usr/lib64/nagios/plugins/check_swap -w 20% -c 10%
command[check_all_disks]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -e

# chkconfig nrpe on
# service nrpe start

其实没有必要安装所有的监控插件

yum install nrpe -y
yum install nagios-plugins-disk  nagios-plugins-load nagios-plugins-ping nagios-plugins-procs nagios-plugins-swap nagios-plugins-users -y

部分 V. X Windows

第 38 章 Fonts 字体

# yum install fonts-chinese.noarch

第 39 章 VNC

yum -y install tigervnc-server

设置vnc登录密码

vncpasswd

启动vnc服务

vncserver :1

启动vnc服务同时指定分辨率

vncserver :1 -geometry 800x600 -depth 24

停止vnc服务

vncserver -kill :1

第 40 章 gparted

yum install gparted

部分 VI. IDC快速装机

在工作中，需要经常为新系统安装软件，重复而简单，但又不得不作，我将过去几年中工作中临时写的脚本这里了一下，能够实现半自动化安装标本，只需要Ctrl+C, Ctrl+V 快速粘贴复制，即可快速完成安装

环境 CentOS 6.3 64bit Minior 安装

第 41 章 OS 安装与初始化

快速初始化Linux服务器

服务器快速安装与部署

Kickstart

使用 Kickstart 实现无人值守安装，制作一个Linux 安装光盘或ISO文件将ks文件放置到根目录。这样光盘放入光驱后无需人为干预，实现自动安装。

另外还可以采用无盘启动网络安装

anaconda-ks.cfg

# Kickstart file automatically generated by anaconda.

#version=RHEL6
install
cdrom
lang en_US.UTF-8
keyboard us
network --device eth0 --bootproto static --ip 172.16.3.81 --netmask 255.255.255.0 --gateway 172.16.3.254 --nameserver 8.8.8.8 --hostname www.example.com
rootpw  --iscrypted $6$Ze/iw9HmY5LVYHhN$Hil8L/e8r2EwzmpacjW7VnZu1Jx6V9ZE55oAAWNr52qnh82ZL9m9J340mSRQXB5fYI2/ahL09xSlZ2WbdeTe3.
firewall --service=ssh
authconfig --enableshadow --passalgo=sha512 --enablefingerprint
selinux --enforcing
timezone --utc Asia/Harbin
bootloader --location=mbr --driveorder=sda,sdb --append="crashkernel=auto rhgb quiet"
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
#clearpart --none --drives=sda

#part / --fstype=ext4 --grow --size=200
#part swap --size=64000

#part /www --fstype=ext4 --grow --size=200

repo --name="CentOS"  --baseurl=file:///mnt/source --cost=100

%packages
@core
@server-policy
%end

快速初始化

后面章节中提供很多脚本，直接复制下面命令，右键粘贴到终端中运用即可。

例如每个服务器都需要安装ntp,您只需要服务下面代码，粘贴到终端即可，它能实现自动安装，修改配置文件与启动服务等等

yum install ntp -y
vim /etc/ntp.conf <<VIM > /dev/null 2>&1
:17,17s/^/server 172.16.1.10\r/
:wq
VIM
service ntpd start
chkconfig ntpd on

你也可以吧这些脚本组合，制作一个你自己的脚本，然后批量执行。例如：

$ cat install.sh
#!/bin/bash

if [ ! -f /usr/bin/vim ] ; then
        alias vim='vi'
fi

if [ -z "$( egrep "CentOS|Redhat" /etc/issue)" ]; then
        echo 'Only for Redhat or CentOS'
        exit
fi

echo -ne "
search example.com
nameserver 172.16.3.51
nameserver 172.16.3.52
nameserver 208.67.222.222
nameserver 202.67.220.220
nameserver 8.8.8.8
nameserver 4.4.4.4
" > /etc/resolv.conf

echo -ne "

* soft nofile 65536
* hard nofile 65536
" >>/etc/security/limits.conf

cat >> /etc/sysctl.conf <<EOF

net.ipv4.ip_local_port_range = 1024 65500
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 60
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 4096
EOF

yum update -y
rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt
rpm -K http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
rpm -i http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

# redhat 5.6 cp /etc/ntp.conf.original /etc/ntp.conf
yum install ntp -y
vi /etc/ntp.conf <<VIM > /dev/null 2>&1
:22,24s/^/#/
:25,25s/^/\rserver 172.16.3.51\rserver 172.16.3.52\r/
:wq
VIM
service ntpd start
chkconfig ntpd on

yum install net-snmp -y
vi /etc/snmp/snmpd.conf <<VIM > /dev/null 2>&1
:62,62s/systemview/all/
:85,85s/^#//
:wq
VIM
service snmpd start
chkconfig snmpd on

yum install -y nrpe nagios-plugins
vi /etc/nagios/nrpe.cfg <<VIM > /dev/null 2>&1
:%s/allowed_hosts=127.0.0.1/allowed_hosts=172.16.1.2/
:wq
VIM

cat >> /etc/nagios/nrpe.cfg <<EOF

#command[check_http]=/usr/lib64/nagios/plugins/check_http -I 127.0.0.1 -p 80 -u http://www.example.com/index.html
command[check_swap]=/usr/lib64/nagios/plugins/check_swap -w 20% -c 10%
command[check_all_disks]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -e
EOF

chkconfig nrpe on
service nrpe start

cat >> /etc/bashrc <<EOF

export HISTTIMEFORMAT="%Y-%m-%d-%H:%M:%S "
EOF

将上面脚本放到web server 上，然后使用rsh循环批量执行的

curl -s http://172.16.0.20/shell/install.sh | bash

JDK and Tomcat

#!/bin/bash
rsync -auzv root@172.16.3.23:/srv/* /srv/
ln -s /srv/java /usr/local/java
ln -s /srv/apache-tomcat /usr/local/
mkdir -p /www/logs/tomcat
echo -ne '
export JAVA_HOME=/srv/java
export CATALINA_HOME=/srv/apache-tomcat
export CLASSPATH=$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$CATALINA_HOME/lib
export PATH=$PATH:$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$CATALINA_HOME/bin:
export JAVA_OPTS="-server -Xms512m -Xmx8192m  -XX:PermSize=64M -XX:MaxPermSize=512m"
' >> /etc/profile

批量安装

检查日期

for ip in {23..32} {49,50} {81..92}; do ssh root@172.16.0.$ip date; done

时间更新

for ip in {23..32} {49,50} {81..92}; do ssh root@172.16.0.$ip ntpdate 172.16.0.1; done

安装NFS Server

for ip in {21..32} {41,50} {81..92}; do rsh root@172.16.0.$ip "yum install -y nfs-utils"; done

for host in {21..32} {41,50} {81..92}; do echo 172.16.0.$host && rsh root@172.16.0.$host "exportfs"; done

for ip in {21..32} {41,50} {81..92}; do rsync -auz ~/config/nfs/exports root@172.16.0.$ip:/etc/; rsh root@172.16.0.$ip "service nfs reload"; done

IP / Mac Address

IP Address

nmap -sP 172.16.1.0/24

Mac Address

nmap -sP -PI -PT -oN ipandmaclist.txt 172.16.1.0/24

NIC

DEVICE=eth0
BOOTPROTO=static
HWADDR=00:15:17:3E:90:90
ONBOOT=yes
NETMASK=255.255.255.0
IPADDR=172.16.1.26
GATEWAY=172.16.1.1
TYPE=Ethernet
USERCTL=no
IPV6INIT=no
PEERDNS=yes

DNS

echo -ne "
search example.com
nameserver 208.67.222.222
nameserver 202.67.220.220
nameserver 8.8.8.8
nameserver 4.4.4.4
" > /etc/resolv.conf

bonding

http://www.kernel.org/pub/linux/kernel/people/marcelo/linux-2.4/Documentation/networking/bonding.txt

http://www.linuxfoundation.org/collaborate/workgroups/networking/bonding

http://blog.webdir.bg/ubuntu-linux-and-cisco-switch-link-aggregation-load-balancing-bonding/

cat >> /etc/modprobe.d/bonding.conf <<EOF
alias bond0 bonding
options bond0 miimon=100 mode=1  primary=eth0
alias bond1 bonding
options bond1 miimon=100 mode=1  primary=eth2
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
DEVICE=eth0
ONBOOT=yes
MASTER=bond0
SLAVE=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth1 <<EOF
DEVICE=eth1
ONBOOT=yes
MASTER=bond0
SLAVE=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth2 <<EOF
DEVICE=eth2
ONBOOT=yes
MASTER=bond1
SLAVE=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth3 <<EOF
DEVICE=eth3
ONBOOT=yes
MASTER=bond1
SLAVE=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-bond0 <<EOF
DEVICE=bond0
ONBOOT=yes
IPADDR=192.168.80.1
NETMASK=255.255.255.0
NETWORK=192.168.80.0
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-bond1 <<EOF
DEVICE=bond1
ONBOOT=yes
IPADDR=192.168.80.2
NETMASK=255.255.255.0
NETWORK=192.168.80.0
BOOTPROTO=none
USERCTL=no
EOF

cp /etc/sysconfig/network-scripts/ifcfg-eth0{,.original}

cat >> /etc/modprobe.d/bonding.conf <<EOF
alias bond0 bonding
options bond0 mode=balance-alb miimon=1000
EOF

cat > /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=none
USERCTL=no
EOF

cat > /etc/sysconfig/network-scripts/ifcfg-eth1 <<EOF
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth2 <<EOF
DEVICE=eth2
ONBOOT=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-eth3 <<EOF
DEVICE=eth3
ONBOOT=yes
BOOTPROTO=none
USERCTL=no
EOF

cat >> /etc/sysconfig/network-scripts/ifcfg-bond0 <<EOF
DEVICE=bond0
ONBOOT=yes
BOOTPROTO=none
TYPE=Ethernet
IPADDR=192.168.80.65
NETMASK=255.255.255.0
NETWORK=192.168.80.0
USERCTL=no
EOF

modprobe bonding mode=balance-alb miimon=1000
ifconfig bond0 up
ifconfig bond0 192.168.80.1 netmask 255.255.255.0 up
ifenslave bond0 eth0
ifenslave bond0 eth1

echo 1000 > /sys/class/net/bond0/bonding/miimon
echo 6 > /sys/class/net/bond0/bonding/mode
echo balance-alb > /sys/class/net/bond0/bonding/mode

BONDING_OPTS="mode=1 miimon=100"

echo balance-rr >/sys/class/net/bond0/bonding/mode
modprobe bonding mode=balance-tlb miimon=1000

ifenslave -d bond0 eth0 eth1
ifenslave bond1 eth2 eth3

# ethtool eth0
Settings for eth0:
	Supported ports: [ TP ]
	Supported link modes:   10baseT/Half 10baseT/Full
	                        100baseT/Half 100baseT/Full
	                        1000baseT/Full
	Supports auto-negotiation: Yes
	Advertised link modes:  10baseT/Half 10baseT/Full
	                        100baseT/Half 100baseT/Full
	                        1000baseT/Full
	Advertised pause frame use: No
	Advertised auto-negotiation: Yes
	Speed: 100Mb/s
	Duplex: Full
	Port: Twisted Pair
	PHYAD: 1
	Transceiver: internal
	Auto-negotiation: on
	MDI-X: Unknown
	Supports Wake-on: g
	Wake-on: d
	Link detected: yes

# more /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.5.0 (November 4, 2008)

Bonding Mode: adaptive load balancing
Primary Slave: None
Currently Active Slave: None
MII Status: down
MII Polling Interval (ms): 1000
Up Delay (ms): 0
Down Delay (ms): 0

[root@r610 ~]# ifconfig bond0 up
[root@r610 ~]# ifenslave bond0 eth0 eth2

# more /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.5.0 (November 4, 2008)

Bonding Mode: adaptive load balancing
Primary Slave: None
Currently Active Slave: eth0
MII Status: up
MII Polling Interval (ms): 1000
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr: 14:fe:b5:dc:30:ee

Slave Interface: eth1
MII Status: up
Link Failure Count: 0
Permanent HW addr: 14:fe:b5:dc:30:f0

[root@r610 network-scripts]# cat /sys/class/net/bond0/bonding/miimon
1000
[root@r610 network-scripts]# cat /sys/class/net/bonding_masters
bond0
[root@r610 network-scripts]# cat /sys/class/net/bond0/bonding/mode
balance-alb 6

limits.conf

临时设置

ulimit -HSn 65536
ulimit -HSm 65536

echo "ulimit -SHn 65530" >> /root/.bash_profile
echo "ulimit -SHm 16000000" >> /root/.bash_profile
echo "ulimit -HSn 65536" >>/root/.bash_profile

使用“*”作用于所有用户，但见这样设置，最好的方式是针对需要的用户个别设置

echo -ne "
* soft nofile 65536
* hard nofile 65536
" >>/etc/security/limits.conf > /dev/null 2>&1

/etc/security/limits.d

cat >> /etc/security/limits.conf <<EOF
root 	soft nofile 10240
root 	hard nofile 65536
nobody 	soft nofile 10240
nobody 	hard nofile 65536
EOF

cat >> /etc/security/limits.conf <<EOF
www 	soft nofile 65536
www 	hard nofile 65536
EOF

cat >> /etc/security/limits.conf <<EOF
apache 	soft nofile 65536
apache 	hard nofile 65536
EOF

cat >> /etc/security/limits.conf <<EOF
nginx 	soft nofile 65536
nginx 	hard nofile 65536
EOF

cat >> /etc/security/limits.conf <<EOF
mysql 	soft nofile 65536
mysql 	hard nofile 65536
EOF

sysctl

cat >> /etc/sysctl.conf <<EOF
net.ipv4.ip_local_port_range = 1024 65500
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 60
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 4096
EOF
/sbin/sysctl -p

profile

echo -ne '
export JAVA_HOME=/usr/local/java
export RESIN_HOME=/usr/local/resin
export CLASSPATH=$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$CLASSPATH
export PATH=$PATH:$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$HOMR/bin:
export PATH=$PATH:/usr/local/httpd:/usr/local/php:/usr/local/mysql:/usr/local/resin
export JAVA_OPTS="-server -Xms512m -Xmx4096m  -XX:PermSize=64M -XX:MaxPermSize=512m"
' >> /etc/profile

Crontab

crontab 中输出信息很保存到 /var/spool/clientmqueue 需要定时清除

# du -sh /var/* | sort -rn|head -n 10
# cd /var/spool/clientmqueue
# ls | xargs rm -f

避免上述情况可以在crontab 中加入 >/dev/null 2>&1

# crontab -l
* */2 * * * /usr/local/apache/bin/apachectl restart >/dev/null 2>&1

crontab 日志

$ crontab -l
# m h  dom mon dow   command
0 1 * * * /home/mgmt/backup && echo `date` >> /home/mgmt/backup.log

NFS

Images

/images            172.16.1.0/24(rw,sync,fsid=0,anonuid=99,anongid=99)
/images/2008     *(rw,sync)
/images/2009     *(rw,nohide,sync)
/images/2010	 *(rw,nohide,sync)

chkconfig portmap on
chkconfig nfs on
chkconfig nfslock on
chkconfig rpcidmapd on

service portmap start
service rpcidmapd start
service nfs start
service nfslock start

释放内存

sync
echo 3 > /proc/sys/vm/drop_caches

名称 : sync
使用权限 : 系统管理者
使用方式 : sync
说明 : Linux 系统中欲写入硬盘的资料有的时候会了效率起见，会写到 filesystem buffer 中，这个 buffer 是一块记忆体空间，如果欲写入硬盘的资料存于此 buffer 中，而系统又突然断电的话，那么资料就会流失了，sync 指令会将存于 buffer 中的资料强制写入硬盘中。

To free pagecache: echo 1 > /proc/sys/vm/drop_caches
To free dentries and inodes: echo 2 > /proc/sys/vm/drop_caches
To free pagecache, dentries and inodes: echo 3 > /proc/sys/vm/drop_caches

TCP/IP

TCP 状态

netstat -n | awk '/^tcp/ {++state[$NF]} END {for(key in state) print key,"\t",state[key]}'

状态：			描述
CLOSED：			无连接是活动的或正在进行
LISTEN：			服务器在等待进入呼叫
SYN_RECV：		一个连接请求已经到达，等待确认
SYN_SENT：		应用已经开始，打开一个连接
ESTABLISHED：	正常数据传输状态
FIN_WAIT1：		应用说它已经完成
FIN_WAIT2：		另一边已同意释放
ITMED_WAIT：		等待所有分组死掉
CLOSING：		两边同时尝试关闭
TIME_WAIT：		另一边已初始化一个释放
LAST_ACK：		等待所有分组死掉

减少TIME_WAIT状态

net.ipv4.tcp_syncookies = 1 	表示开启SYN Cookies。当出现SYN等待队列溢出时，启用cookies来处理，可防范少量SYN攻击，默认为0，表示关闭；
net.ipv4.tcp_tw_reuse = 1 		表示开启重用。允许将TIME-WAIT sockets重新用于新的TCP连接，默认为0，表示关闭；
net.ipv4.tcp_tw_recycle = 1 	表示开启TCP连接中TIME-WAIT sockets的快速回收，默认为0，表示关闭。
net.ipv4.tcp_fin_timeout = 30	修改系統默认的 TIMEOUT 时间

vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30

TIME_WAIT

# netstat -tna | cut -b 49- |grep TIME_WAIT | sort

SYN_RECV / SYN_SENT

# netstat -an | grep SYN | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -nr | more

Linux 日常管理

日常管理的几个要点

服务器负载 load average

网络负载

磁盘容量

登录用户

日志分析

第 42 章 RPM包

lokkit --disabled --selinux=disabled

yum remove dhclient -y

yum update -y
yum install -y telnet wget rsync
yum install -y system-config-network-tui
yum install -y bind-utils
yum install -y vim-enhanced

yum install -y openssh-clients

yum源

yum update -y
rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt
rpm -K http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
rpm -i http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

CentOS 5.7 精简 rpm

setup-2.8.14-13.el6.noarch
basesystem-10.0-4.el6.noarch
ncurses-base-5.7-3.20090208.el6.x86_64
glibc-common-2.12-1.47.el6_2.9.x86_64
glibc-2.12-1.47.el6_2.9.x86_64
bash-4.1.2-8.el6.centos.x86_64
libcap-2.16-5.5.el6.x86_64
info-4.13a-8.el6.x86_64
popt-1.13-7.el6.x86_64
libcom_err-1.41.12-11.el6.x86_64
libacl-2.2.49-6.el6.x86_64
bzip2-libs-1.0.5-7.el6_0.x86_64
libsepol-2.0.41-4.el6.x86_64
glib2-2.22.5-6.el6.x86_64
shadow-utils-4.1.4.2-13.el6.x86_64
readline-6.0-3.el6.x86_64
xz-libs-4.999.9-0.3.beta.20091007git.el6.x86_64
dbus-libs-1.2.24-5.el6_1.x86_64
pcre-7.8-3.1.el6.x86_64
lua-5.1.4-4.1.el6.x86_64
findutils-4.4.2-6.el6.x86_64
iptables-1.4.7-5.1.el6_2.x86_64
gawk-3.1.7-6.el6.x86_64
elfutils-libelf-0.152-1.el6.x86_64
psmisc-22.6-15.el6_0.1.x86_64
bzip2-1.0.5-7.el6_0.x86_64
which-2.19-6.el6.x86_64
tcp_wrappers-libs-7.6-57.el6.x86_64
expat-2.0.1-9.1.el6.x86_64
perl-Pod-Escapes-1.04-119.el6_1.1.x86_64
perl-version-0.77-119.el6_1.1.x86_64
perl-Pod-Simple-3.13-119.el6_1.1.x86_64
pth-2.0.7-9.3.el6.x86_64
libgcrypt-1.4.5-9.el6_2.2.x86_64
iptables-ipv6-1.4.7-5.1.el6_2.x86_64
gmp-4.3.1-7.el6_2.2.x86_64
libnih-1.0.1-7.el6.x86_64
xfsprogs-3.1.1-6.el6.x86_64
xz-4.999.9-0.3.beta.20091007git.el6.x86_64
libutempter-1.1.5-4.1.el6.x86_64
vim-minimal-7.2.411-1.6.el6.x86_64
net-tools-1.60-109.el6.x86_64
tar-1.23-3.el6.x86_64
e2fsprogs-libs-1.41.12-11.el6.x86_64
pinentry-0.7.6-6.el6.x86_64
binutils-2.20.51.0.2-5.28.el6.x86_64
attr-2.4.44-7.el6.x86_64
ncurses-5.7-3.20090208.el6.x86_64
less-436-10.el6.x86_64
gzip-1.3.12-18.el6.x86_64
cracklib-dicts-2.8.16-4.el6.x86_64
pam-1.1.1-10.el6_2.1.x86_64
redhat-logos-60.0.14-10.el6.centos.noarch
hwdata-0.233-7.6.el6.noarch
nss-3.13.1-7.el6_2.x86_64
openldap-2.4.23-20.el6.x86_64
libcap-ng-0.6.4-3.el6_0.1.x86_64
ethtool-2.6.33-0.3.el6.x86_64
gpm-libs-1.20.6-12.el6.x86_64
krb5-libs-1.9-22.el6_2.1.x86_64
libssh2-1.2.2-7.el6_2.3.x86_64
curl-7.19.7-26.el6_2.4.x86_64
rpm-4.8.0-19.el6_2.1.x86_64
gpgme-1.1.8-3.el6.x86_64
fipscheck-lib-1.2.0-7.el6.x86_64
ustr-1.0.4-9.1.el6.x86_64
libffi-3.0.5-3.2.el6.x86_64
python-2.6.6-29.el6.x86_64
python-iniparse-0.3.1-2.1.el6.noarch
rpm-python-4.8.0-19.el6_2.1.x86_64
python-urlgrabber-3.9.1-8.el6.noarch
yum-3.2.29-22.el6.centos.2.noarch
slang-2.2.1-1.el6.x86_64
newt-python-0.52.11-3.el6.x86_64
centos-release-6-2.el6.centos.7.x86_64
util-linux-ng-2.17.2-12.4.el6.x86_64
udev-147-2.40.el6.x86_64
kbd-1.15-11.el6.x86_64
plymouth-0.8.3-24.el6.centos.x86_64
dracut-kernel-004-256.el6_2.1.noarch
rsyslog-4.6.2-12.el6.x86_64
cyrus-sasl-2.1.23-13.el6.x86_64
crontabs-1.10-33.el6.noarch
cronie-1.4.4-7.el6.x86_64
dhclient-4.1.1-25.P1.el6_2.1.x86_64
ntp-4.2.4p8-2.el6.centos.x86_64
openssh-server-5.3p1-70.el6_2.2.x86_64
authconfig-6.1.12-5.el6.x86_64
system-config-firewall-base-1.2.27-5.el6.noarch
man-1.6f-29.el6.x86_64
efibootmgr-0.5.4-9.el6.x86_64
sudo-1.7.4p5-7.el6.x86_64
xfsdump-3.0.4-2.el6.x86_64
tmpwatch-2.9.16-4.el6.x86_64
rootfiles-8.1-6.1.el6.noarch
traceroute-2.0.14-2.el6.x86_64
libgcc-4.4.6-3.el6.x86_64
filesystem-2.4.30-3.el6.x86_64
ca-certificates-2010.63-3.el6_1.5.noarch
tzdata-2012b-3.el6.noarch
nss-softokn-freebl-3.12.9-11.el6.x86_64
ncurses-libs-5.7-3.20090208.el6.x86_64
libattr-2.4.44-7.el6.x86_64
zlib-1.2.3-27.el6.x86_64
audit-libs-2.1.3-3.el6.x86_64
chkconfig-1.3.49.3-1.el6_2.x86_64
db4-4.7.25-16.el6.x86_64
nspr-4.8.9-3.el6_2.x86_64
nss-util-3.13.1-3.el6_2.x86_64
libselinux-2.0.94-5.2.el6.x86_64
gamin-0.1.10-9.el6.x86_64
sed-4.2.1-7.el6.x86_64
libuuid-2.17.2-12.4.el6.x86_64
libblkid-2.17.2-12.4.el6.x86_64
libstdc++-4.4.6-3.el6.x86_64
grep-2.6.3-2.el6.x86_64
sqlite-3.6.20-1.el6.x86_64
cyrus-sasl-lib-2.1.23-13.el6.x86_64
libidn-1.18-2.el6.x86_64
file-libs-5.04-11.el6.x86_64
libgpg-error-1.7-4.el6.x86_64
libselinux-utils-2.0.94-5.2.el6.x86_64
cpio-2.10-9.el6.x86_64
libedit-2.11-4.20080712cvs.1.el6.x86_64
sysvinit-tools-2.87-4.dsf.el6.x86_64
gdbm-1.8.0-36.el6.x86_64
perl-libs-5.10.1-119.el6_1.1.x86_64
perl-Module-Pluggable-3.90-119.el6_1.1.x86_64
perl-5.10.1-119.el6_1.1.x86_64
dbus-glib-0.86-5.el6.x86_64
iproute-2.6.32-17.el6.x86_64
nss-softokn-3.12.9-11.el6.x86_64
libusb-0.1.12-23.el6.x86_64
upstart-0.6.5-10.el6.x86_64
grubby-7.0.15-2.el6.x86_64
xz-lzma-compat-4.999.9-0.3.beta.20091007git.el6.x86_64
MAKEDEV-3.24-6.el6.x86_64
procps-3.2.8-21.el6.x86_64
checkpolicy-2.0.22-1.el6.x86_64
db4-utils-4.7.25-16.el6.x86_64
libss-1.41.12-11.el6.x86_64
diffutils-2.8.1-28.el6.x86_64
libxml2-2.7.6-4.el6_2.4.x86_64
vim-common-7.2.411-1.6.el6.x86_64
groff-1.18.1.4-21.el6.x86_64
coreutils-libs-8.4-16.el6.x86_64
cracklib-2.8.16-4.el6.x86_64
coreutils-8.4-16.el6.x86_64
module-init-tools-3.9-19.el6_2.x86_64
plymouth-scripts-0.8.3-24.el6.centos.x86_64
logrotate-3.7.8-12.el6_0.1.x86_64
nss-sysinit-3.13.1-7.el6_2.x86_64
libuser-0.56.13-4.el6_0.1.x86_64
pciutils-libs-3.1.4-11.el6.x86_64
mingetty-1.08-5.el6.x86_64
keyutils-libs-1.4-3.el6.x86_64
libcurl-7.19.7-26.el6_2.4.x86_64
rpm-libs-4.8.0-19.el6_2.1.x86_64
gnupg2-2.0.14-4.el6.x86_64
mysql-libs-5.1.61-1.el6_2.1.x86_64
fipscheck-1.2.0-7.el6.x86_64
libsemanage-2.0.43-4.1.el6.x86_64
python-libs-2.6.6-29.el6.x86_64
yum-metadata-parser-1.1.2-16.el6.x86_64
pygpgme-0.1-18.20090824bzr68.el6.x86_64
python-pycurl-7.19.0-8.el6.x86_64
yum-plugin-fastestmirror-1.1.30-10.el6.noarch
dash-0.5.5.1-3.1.el6.x86_64
newt-0.52.11-3.el6.x86_64
plymouth-core-libs-0.8.3-24.el6.centos.x86_64
kbd-misc-1.15-11.el6.noarch
iputils-20071127-16.el6.x86_64
initscripts-9.03.27-1.el6.centos.1.x86_64
openssh-5.3p1-70.el6_2.2.x86_64
libdrm-2.4.25-2.el6.x86_64
dracut-004-256.el6_2.1.noarch
kernel-2.6.32-220.13.1.el6.x86_64
ntpdate-4.2.4p8-2.el6.centos.x86_64
postfix-2.6.6-2.2.el6_1.x86_64
cronie-anacron-1.4.4-7.el6.x86_64
dhcp-common-4.1.1-25.P1.el6_2.1.x86_64
sysstat-9.0.4-18.el6.x86_64
openssh-clients-5.3p1-70.el6_2.2.x86_64
policycoreutils-2.0.83-19.21.el6_2.x86_64
grub-0.97-75.el6.x86_64
vim-enhanced-7.2.411-1.6.el6.x86_64
wget-1.12-1.4.el6.x86_64
passwd-0.77-4.el6_2.2.x86_64
audit-2.1.3-3.el6.x86_64
e2fsprogs-1.41.12-11.el6.x86_64
acl-2.2.49-6.el6.x86_64
gpg-pubkey-c105b9de-4e0fd3a3
openssl-1.0.0-20.el6_2.4.x86_64

CentOS 6.2

setup-2.8.14-13.el6.noarch
basesystem-10.0-4.el6.noarch
ncurses-base-5.7-3.20090208.el6.x86_64
glibc-common-2.12-1.47.el6_2.9.x86_64
glibc-2.12-1.47.el6_2.9.x86_64
bash-4.1.2-8.el6.centos.x86_64
libcap-2.16-5.5.el6.x86_64
info-4.13a-8.el6.x86_64
popt-1.13-7.el6.x86_64
libcom_err-1.41.12-11.el6.x86_64
libacl-2.2.49-6.el6.x86_64
bzip2-libs-1.0.5-7.el6_0.x86_64
libsepol-2.0.41-4.el6.x86_64
glib2-2.22.5-6.el6.x86_64
shadow-utils-4.1.4.2-13.el6.x86_64
readline-6.0-3.el6.x86_64
xz-libs-4.999.9-0.3.beta.20091007git.el6.x86_64
dbus-libs-1.2.24-5.el6_1.x86_64
pcre-7.8-3.1.el6.x86_64
lua-5.1.4-4.1.el6.x86_64
findutils-4.4.2-6.el6.x86_64
iptables-1.4.7-5.1.el6_2.x86_64
gawk-3.1.7-6.el6.x86_64
elfutils-libelf-0.152-1.el6.x86_64
psmisc-22.6-15.el6_0.1.x86_64
bzip2-1.0.5-7.el6_0.x86_64
which-2.19-6.el6.x86_64
tcp_wrappers-libs-7.6-57.el6.x86_64
expat-2.0.1-9.1.el6.x86_64
perl-Pod-Escapes-1.04-119.el6_1.1.x86_64
perl-version-0.77-119.el6_1.1.x86_64
perl-Pod-Simple-3.13-119.el6_1.1.x86_64
pth-2.0.7-9.3.el6.x86_64
libgcrypt-1.4.5-9.el6_2.2.x86_64
iptables-ipv6-1.4.7-5.1.el6_2.x86_64
gmp-4.3.1-7.el6_2.2.x86_64
libnih-1.0.1-7.el6.x86_64
xfsprogs-3.1.1-6.el6.x86_64
xz-4.999.9-0.3.beta.20091007git.el6.x86_64
libutempter-1.1.5-4.1.el6.x86_64
vim-minimal-7.2.411-1.6.el6.x86_64
net-tools-1.60-109.el6.x86_64
tar-1.23-3.el6.x86_64
e2fsprogs-libs-1.41.12-11.el6.x86_64
pinentry-0.7.6-6.el6.x86_64
binutils-2.20.51.0.2-5.28.el6.x86_64
attr-2.4.44-7.el6.x86_64
ncurses-5.7-3.20090208.el6.x86_64
less-436-10.el6.x86_64
gzip-1.3.12-18.el6.x86_64
cracklib-dicts-2.8.16-4.el6.x86_64
pam-1.1.1-10.el6_2.1.x86_64
redhat-logos-60.0.14-10.el6.centos.noarch
hwdata-0.233-7.6.el6.noarch
nss-3.13.1-7.el6_2.x86_64
openldap-2.4.23-20.el6.x86_64
libcap-ng-0.6.4-3.el6_0.1.x86_64
ethtool-2.6.33-0.3.el6.x86_64
gpm-libs-1.20.6-12.el6.x86_64
krb5-libs-1.9-22.el6_2.1.x86_64
libssh2-1.2.2-7.el6_2.3.x86_64
curl-7.19.7-26.el6_2.4.x86_64
rpm-4.8.0-19.el6_2.1.x86_64
gpgme-1.1.8-3.el6.x86_64
fipscheck-lib-1.2.0-7.el6.x86_64
ustr-1.0.4-9.1.el6.x86_64
libffi-3.0.5-3.2.el6.x86_64
python-2.6.6-29.el6.x86_64
python-iniparse-0.3.1-2.1.el6.noarch
rpm-python-4.8.0-19.el6_2.1.x86_64
python-urlgrabber-3.9.1-8.el6.noarch
yum-3.2.29-22.el6.centos.2.noarch
slang-2.2.1-1.el6.x86_64
newt-python-0.52.11-3.el6.x86_64
centos-release-6-2.el6.centos.7.x86_64
util-linux-ng-2.17.2-12.4.el6.x86_64
udev-147-2.40.el6.x86_64
kbd-1.15-11.el6.x86_64
plymouth-0.8.3-24.el6.centos.x86_64
dracut-kernel-004-256.el6_2.1.noarch
rsyslog-4.6.2-12.el6.x86_64
cyrus-sasl-2.1.23-13.el6.x86_64
crontabs-1.10-33.el6.noarch
cronie-1.4.4-7.el6.x86_64
ntp-4.2.4p8-2.el6.centos.x86_64
openssh-server-5.3p1-70.el6_2.2.x86_64
authconfig-6.1.12-5.el6.x86_64
system-config-firewall-base-1.2.27-5.el6.noarch
man-1.6f-29.el6.x86_64
efibootmgr-0.5.4-9.el6.x86_64
sudo-1.7.4p5-7.el6.x86_64
xfsdump-3.0.4-2.el6.x86_64
tmpwatch-2.9.16-4.el6.x86_64
rootfiles-8.1-6.1.el6.noarch
traceroute-2.0.14-2.el6.x86_64
libgcc-4.4.6-3.el6.x86_64
filesystem-2.4.30-3.el6.x86_64
ca-certificates-2010.63-3.el6_1.5.noarch
tzdata-2012b-3.el6.noarch
nss-softokn-freebl-3.12.9-11.el6.x86_64
ncurses-libs-5.7-3.20090208.el6.x86_64
libattr-2.4.44-7.el6.x86_64
zlib-1.2.3-27.el6.x86_64
audit-libs-2.1.3-3.el6.x86_64
chkconfig-1.3.49.3-1.el6_2.x86_64
db4-4.7.25-16.el6.x86_64
nspr-4.8.9-3.el6_2.x86_64
nss-util-3.13.1-3.el6_2.x86_64
libselinux-2.0.94-5.2.el6.x86_64
gamin-0.1.10-9.el6.x86_64
sed-4.2.1-7.el6.x86_64
libuuid-2.17.2-12.4.el6.x86_64
libblkid-2.17.2-12.4.el6.x86_64
libstdc++-4.4.6-3.el6.x86_64
grep-2.6.3-2.el6.x86_64
sqlite-3.6.20-1.el6.x86_64
cyrus-sasl-lib-2.1.23-13.el6.x86_64
libidn-1.18-2.el6.x86_64
file-libs-5.04-11.el6.x86_64
libgpg-error-1.7-4.el6.x86_64
libselinux-utils-2.0.94-5.2.el6.x86_64
cpio-2.10-9.el6.x86_64
libedit-2.11-4.20080712cvs.1.el6.x86_64
sysvinit-tools-2.87-4.dsf.el6.x86_64
gdbm-1.8.0-36.el6.x86_64
perl-libs-5.10.1-119.el6_1.1.x86_64
perl-Module-Pluggable-3.90-119.el6_1.1.x86_64
perl-5.10.1-119.el6_1.1.x86_64
dbus-glib-0.86-5.el6.x86_64
iproute-2.6.32-17.el6.x86_64
nss-softokn-3.12.9-11.el6.x86_64
libusb-0.1.12-23.el6.x86_64
upstart-0.6.5-10.el6.x86_64
grubby-7.0.15-2.el6.x86_64
xz-lzma-compat-4.999.9-0.3.beta.20091007git.el6.x86_64
MAKEDEV-3.24-6.el6.x86_64
procps-3.2.8-21.el6.x86_64
checkpolicy-2.0.22-1.el6.x86_64
db4-utils-4.7.25-16.el6.x86_64
libss-1.41.12-11.el6.x86_64
diffutils-2.8.1-28.el6.x86_64
libxml2-2.7.6-4.el6_2.4.x86_64
vim-common-7.2.411-1.6.el6.x86_64
groff-1.18.1.4-21.el6.x86_64
coreutils-libs-8.4-16.el6.x86_64
cracklib-2.8.16-4.el6.x86_64
coreutils-8.4-16.el6.x86_64
module-init-tools-3.9-19.el6_2.x86_64
plymouth-scripts-0.8.3-24.el6.centos.x86_64
logrotate-3.7.8-12.el6_0.1.x86_64
nss-sysinit-3.13.1-7.el6_2.x86_64
libuser-0.56.13-4.el6_0.1.x86_64
pciutils-libs-3.1.4-11.el6.x86_64
mingetty-1.08-5.el6.x86_64
keyutils-libs-1.4-3.el6.x86_64
libcurl-7.19.7-26.el6_2.4.x86_64
rpm-libs-4.8.0-19.el6_2.1.x86_64
gnupg2-2.0.14-4.el6.x86_64
mysql-libs-5.1.61-1.el6_2.1.x86_64
fipscheck-1.2.0-7.el6.x86_64
libsemanage-2.0.43-4.1.el6.x86_64
python-libs-2.6.6-29.el6.x86_64
yum-metadata-parser-1.1.2-16.el6.x86_64
pygpgme-0.1-18.20090824bzr68.el6.x86_64
python-pycurl-7.19.0-8.el6.x86_64
yum-plugin-fastestmirror-1.1.30-10.el6.noarch
dash-0.5.5.1-3.1.el6.x86_64
newt-0.52.11-3.el6.x86_64
plymouth-core-libs-0.8.3-24.el6.centos.x86_64
kbd-misc-1.15-11.el6.noarch
iputils-20071127-16.el6.x86_64
initscripts-9.03.27-1.el6.centos.1.x86_64
openssh-5.3p1-70.el6_2.2.x86_64
libdrm-2.4.25-2.el6.x86_64
dracut-004-256.el6_2.1.noarch
kernel-2.6.32-220.13.1.el6.x86_64
ntpdate-4.2.4p8-2.el6.centos.x86_64
postfix-2.6.6-2.2.el6_1.x86_64
cronie-anacron-1.4.4-7.el6.x86_64
dhcp-common-4.1.1-25.P1.el6_2.1.x86_64
sysstat-9.0.4-18.el6.x86_64
openssh-clients-5.3p1-70.el6_2.2.x86_64
policycoreutils-2.0.83-19.21.el6_2.x86_64
grub-0.97-75.el6.x86_64
vim-enhanced-7.2.411-1.6.el6.x86_64
wget-1.12-1.4.el6.x86_64
passwd-0.77-4.el6_2.2.x86_64
audit-2.1.3-3.el6.x86_64
e2fsprogs-1.41.12-11.el6.x86_64
acl-2.2.49-6.el6.x86_64
gpg-pubkey-c105b9de-4e0fd3a3
openssl-1.0.0-20.el6_2.4.x86_64

第 43 章 常用网络服务

vsftpd

        yum install -y vsftpd
        adduser --home-dir /www/logs/ --shell /sbin/nologin logs
        echo logs >> /etc/vsftpd/chroot_list
        vim /etc/vsftpd/vsftpd.conf <<VIM > /dev/null 2>&1
:%s/#chroot_list_enable=YES/chroot_list_enable=YES/
:%s/#chroot_list_file/chroot_list_file/
VIM
        chkconfig vsftpd on
        service vsftpd start

adduser -o --home /www --shell /sbin/nologin --uid 99 --gid 99 --group nobody www
echo "www:chen" | chpasswd
echo www > /etc/vsftpd/chroot_list
ncftp ftp://www:chen@172.16.0.1

rsync

yum install xinetd rsync -y

vim /etc/xinetd.d/rsync <<VIM > /dev/null 2>&1
:%s/yes/no/
:wq
VIM

cat > /etc/rsyncd.conf <<EOD
uid = root
gid = root
use chroot = no
max connections = 8
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock
log file = /var/log/rsyncd.log

hosts deny=*
hosts allow=192.168.2.0/255.255.255.0

[www]
    uid = www
    gid = www
    path = /www/www.example.com
    ignore errors
    read only = no
    list = no
    auth users = neo
    secrets file = /etc/rsyncd.passwd
[images]
    uid = www
    gid = www
    path = /www/images.example.com
    ignore errors
    read only = no
    list = no
    auth users = neo
    secrets file = /etc/rsyncd.passwd

EOD

# chmod 600 /etc/rsyncd.*

# service xinetd restart
Stopping xinetd:                                           [  OK  ]
Starting xinetd:                                           [  OK  ]

例 43.1. /etc/rsyncd.conf

cat > /etc/rsyncd.conf <<EOD
uid = root
gid = root
use chroot = no
max connections = 8
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock
log file = /var/log/rsyncd.log

hosts deny=*
hosts allow=192.168.2.0/255.255.255.0

[www]
    uid = www
    gid = www
    path = /www
    ignore errors
    read only = no
    list = no
    auth users = www
    secrets file = /etc/rsyncd.passwd
EOD

cat > /etc/rsyncd.passwd <<EOD
www:eF9nJCcGKJPsiqZsfjGXxwfF41cLibTo
EOD

chmod 600 /etc/rsyncd.passwd

NTPD

yum install ntp -y
vim /etc/ntp.conf <<VIM > /dev/null 2>&1
:17,17s/^/server 172.16.1.10\r/
:wq
VIM
service ntpd start
chkconfig ntpd on

dnsmasq

yum install -y dnsmasq
chkconfig dnsmasq on
service dnsmasq start

snmp

yum install net-snmp -y
vim /etc/snmp/snmpd.conf <<VIM > /dev/null 2>&1
:62,62s/systemview/all/
:85,85s/^#//
:wq
VIM
service snmpd start
chkconfig snmpd on

nrpe

rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
yum install nrpe -y
yum install -y nagios-plugins-disk nagios-plugins-load nagios-plugins-ping nagios-plugins-procs nagios-plugins-swap nagios-plugins-users

chkconfig nrpe on

vim /etc/nagios/nrpe.cfg <<VIM > /dev/null 2>&1
:79,79s/allowed_hosts=127.0.0.1/allowed_hosts=172.16.1.2/
:wq
VIM

cat >> /etc/nagios/nrpe.cfg <<EOF

#command[check_http]=/usr/lib64/nagios/plugins/check_http -I 127.0.0.1 -p 80 -u http://www.example.com/index.html
command[check_swap]=/usr/lib64/nagios/plugins/check_swap -w 20% -c 10%
command[check_all_disks]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -e
EOF

service nrpe start

NAGIOS3 Template

define host{

        use             generic-host

        host_name       www.example.com

        alias           www.example.com

        address         172.16.1.5

        hostgroups      mysql-servers

        }
define service{

        use                     generic-service ; Inherit values from a template

        host_name               www.example.com ; The name of the host the service is associated with

        service_description     PING            ; The service description

        check_command           check_ping!200.0,20%!600.0,60%  ; The command used to monitor the service

        normal_check_interval   5       ; Check the service every 5 minutes under normal conditions

        retry_check_interval    1       ; Re-check the service every minute until its final/hard state is determined

        }

define service{

        use             generic-service

        host_name               www.example.com

        service_description     MySQL

        check_command   check_mysql_database!monitor!xmNhjDCjfYHjcSG!test

        }

# NRPE disk check.
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-disk
        check_command                   check_nrpe_1arg!check_all_disks
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-users
        check_command                   check_nrpe_1arg!check_users
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-swap
        check_command                   check_nrpe_1arg!check_swap
}
;define service {
;        use                             generic-service
;        host_name                       www.example.com
;        service_description             nrpe-procs
;        check_command                   check_nrpe_1arg!check_total_procs
;}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-load
        check_command                   check_nrpe_1arg!check_load
}
define service {
        use                             generic-service
        host_name                       www.example.com
        service_description             nrpe-zombie_procs
        check_command                   check_nrpe_1arg!check_zombie_procs
}

bandwidthd

rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm

rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm

yum search bandwidthd
yum install bandwidthd

vim /etc/bandwidthd.conf

subnet 0.0.0.0 0.0.0.0
or
subnet 0.0.0.0/0

/etc/init.d/bandwidthd start

samba

yum install samba -y

cp /etc/samba/smb.conf /etc/samba/smb.conf.original

cat >> /etc/samba/smb.conf <<EOF

##########################
[tmp]
   comment = tmp folder
   writable = yes
   locking = yes
   path = /tmp
   public = yes

[www]
   comment = www development
   writable = yes
   locking = yes
   path = /www
   public = yes

EOF

smbpasswd -a www

service smb start

OpenSSH

OpenSSH 安全配置

禁止 root 用户登录

禁止使用密码登录，使用证书登录

history 安装,避免其他用户从history获得不安全的信息

history 安全

ln -s /dev/null .bash_history
ln -s /dev/null .mysql_history

sshd_config

sshd_config 禁止root登陆

vim /etc/ssh/sshd_config <<end > /dev/null 2>&1
:%s/#PermitRootLogin yes/PermitRootLogin no/
:%s/#AuthorizedKeysFile/AuthorizedKeysFile/
:%s/#UseDNS yes/UseDNS no/
:wq
end

/etc/init.d/sshd reload

HISTTIMEFORMAT

echo 'export HISTTIMEFORMAT="%Y-%m-%d-%H:%M:%S "' >> /etc/bashrc

haproxy

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm

yum install haproxy -y

ZModem

yum install lrzsz -y

Puppet

Puppet Master

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm

yum install puppet-server
service puppetmaster start
chkconfig puppetmaster on

Puppet Nodes

yum install puppet -y
service puppet start
chkconfig puppet on

curl

wget http://curl.haxx.se/download/curl-7.28.1.tar.gz
tar zxvf curl-7.28.1.tar.gz
cd curl-7.28.1
./configure --prefix=/srv/curl-7.28.1/ --without-nss --with-ssl && make &&make install

第 44 章 安装 LAMP

groupadd -g 80 www
adduser -o --home /www --uid 80 --gid 80 -c "Web User" www

Apache

./configure --prefix=/usr/local/$HTTPD_DIR \
--with-mpm=worker \
--enable-so \
--enable-mods-shared=all \
--disable-authn_file \
--disable-authn_default \
--disable-authz_groupfile \
--disable-authz_user \
--disable-authz_default \
--disable-auth_basic \
--disable-include \
--disable-env \
--disable-autoindex \
--disable-asis \
--disable-cgi \
--disable-cgid \
--disable-negotiation \
--disable-actions \
--disable-userdir \
--disable-alias

./configure --prefix=/usr/local/httpd-2.2.16 \
--with-mpm=worker \
--enable-modules="dir mime rewrite deflate expires headers vhost_alias cache mem-cache" \
--enable-mods-shared="alias status info ssl usertrack file-cache disk-cache version " \
--disable-authn_file \
--disable-authn_default \
--disable-authz_groupfile \
--disable-authz_user \
--disable-authz_default \
--disable-auth_basic \
--disable-version \
--disable-env \
--disable-autoindex \
--disable-asis \
--disable-cgid \
--disable-cgi \
--disable-negotiation \
--disable-actions \
--disable-userdir \
--enable-so \
--enable-file-cache \
--enable-cache \
--enable-disk-cache \
--enable-mem-cache \
--enable-expires \
--enable-headers \
--enable-ssl \
--enable-info \
--enable-rewrite

make && make install

MySQL

./configure --prefix=/usr/local/mysql-5.1.45/ \
--enable-assembler \
--with-extra-charsets=complex \
--enable-thread-safe-client \
--with-big-tables \
--with-readline \
--with-ssl \
--with-embedded-server \
--enable-local-infile \
--with-plugins=innobase \
--with-mysqld-user=mysql \
--without-ndb-debug \
--without-debug \
--with-charset=utf8 \
--localstatedir=/data/mysql/data \
--with-collation=utf8_general_ci
make
make install

PHP

./configure --prefix=/usr/local/php-5.3.3 \
--with-config-file-path=/usr/local/php-5.3.3/etc \
--with-apxs2=/usr/local/httpd-2.2.16/bin/apxs \
--with-curl \
--with-gd \
--with-jpeg-dir=/usr/lib64 \
--with-iconv \
--with-zlib-dir \
--with-pear \
--with-xmlrpc \
--with-openssl \
--with-mysql \
--with-mysqli \
--with-pdo-mysql \
--enable-zip \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-magic-quotes \
--enable-inline-optimization \
--enable-xml \
--enable-ftp

export ORACLE_HOME=/usr/lib/oracle/10.2.0.3/client64
export LD_LIBRARY_PATH=/usr/lib/oracle/10.2.0.3/client64:$LD_LIBRARY_PATH
export NLS_LANG="AMERICAN_AMERICA.AL32UTF8"

./configure --prefix=/usr/local/php-5.2.14 \
--with-config-file-path=/usr/local/php-5.2.14/etc \
--with-apxs2=/usr/local/httpd-2.2.16/bin/apxs \
--with-curl \
--with-gd \
--with-jpeg-dir=/usr/lib64 \
--with-iconv \
--with-zlib-dir \
--with-pear \
--with-xmlrpc \
--with-openssl \
--with-mysql \
--with-mysqli \
--with-pdo-mysql \
--with-pdo-oci \
--enable-zip \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-magic-quotes \
--enable-inline-optimization \
--enable-xml \
--enable-ftp

make && make install

--with-oci8 \
--with-pdo-oci=instantclient,/usr,10.2.0.3

httpd

AllowOverride All

<IfModule dir_module>
    DirectoryIndex index.html index.php
</IfModule>

<IfModule mpm_worker_module>
        StartServers        //Apache启动立即产生n个子进程
        MaxClients          //允许最大的客户数
        ServerLimit         //最大允许n子进程数
        MinSpareThreads     //最少有n个空线程
        MaxSpareThreads     //最多有n个空线程
        ThreadLimit         //最多有n个线程
        ThreadsPerChild     //一个子进程有n个常驻线程
        MaxRequestsPerChild //当处理的线程数达到n销毁
</IfModule>

<IfModule mpm_worker_module>
    StartServers         16
    ServerLimit          64
    ThreadLimit         256
    MaxClients         4096
    MinSpareThreads     128
    MaxSpareThreads   	250
    ThreadsPerChild     256
    MaxRequestsPerChild   10000
</IfModule>

php

display_errors = Off
mysql.connect_timeout = 30

resin-pro

./configure \
--enable-64bit \
--enable-jni \
--enable-ssl \
--enable-debug

make && make install

httpd-2.2.21 + php-5.3.8 自动安装脚本

#!/bin/bash
#================================================================================
# LAMP Installing script by Neo <openunix@163.com>
# http://netkiller.sourceforge.net/
# $Id: chapter.lamp.xml 437 2012-07-16 10:21:18Z netkiller $
#================================================================================
SRC_DIR=$(pwd)
PREFIX_DIR=/srv
EMAIL=webmaster@example.com
#================================================================================
HTTPD_SRC='httpd-2.2.21.tar.gz'
PHP_SRC='php-5.3.8.tar.gz'
MYSQL_SRC='mysql-5.5.9.tar.gz'
MYSQL_LIBS_SRC='mysql-5.1.50.tar.gz'
MYSQL_BIN='mysql-5.1.50-linux-x86_64-glibc23.tar.gz'
JAVA_BIN='jdk-6u20-linux-x64.bin'
#================================================================================
HTTPD_DIR=${HTTPD_SRC%%.tar.gz}
PHP_DIR=${PHP_SRC%%.tar.*}
MYSQL_DIR=${MYSQL_SRC%%.tar.*}
MYSQL_LIBS_DIR=${MYSQL_LIBS_SRC%%.tar.*}
#================================================================================

if [ -z "$( egrep "CentOS|Redhat" /etc/issue)" ]; then
	echo 'Only for Redhat or CentOS'
	exit
fi

function clean(){
        rm -rf $HTTPD_DIR
        rm -rf $PHP_DIR
        rm -rf $MYSQL_DIR
        rm -rf $MYSQL_LIBS_DIR
}

function depend(){
        yum install gcc gcc-c++ make autoconf -y
        yum install curl-devel libmcrypt-devel gd-devel libjpeg-devel libpng-devel libXpm-devel libxml2-devel libxslt-devel mhash-devel openldap-devel -y
        yum install ncurses-devel -y
#        yum install mysql-devel -y
        yum install libevent-devel -y
	yum install e4fsprogs -y
	yum install net-snmp-devel -y
	yum install setuptool ntsysv system-config-network-tui -y
	#rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
}

function httpd(){
rm -rf $HTTPD_DIR
tar zxf $HTTPD_SRC
cd $HTTPD_DIR

RETVAL=$?
[[ $RETVAL != 0 ]] && echo "Static: "$RETVAL &&  exit $?

vim server/mpm/worker/worker.c <<end > /dev/null 2>&1
:%s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 256/
:%s/#define DEFAULT_THREAD_LIMIT 64/#define DEFAULT_THREAD_LIMIT 1024/
:wq
end
#define MAX_SERVER_LIMIT 20000
#define MAX_THREAD_LIMIT 20000

[[ $? -ne 0 ]] && echo "Step: server/mpm/worker/worker.c" &&  exit $?

./configure --prefix=$PREFIX_DIR/$HTTPD_DIR \
--with-mpm=worker \
--enable-modules="so dir mime rewrite deflate vhost_alias include" \
--enable-mods-shared="alias filter expires headers  setenvif status info ssl usertrack cache mem-cache file-cache disk-cache version mod_unique_id " \
--disable-authn_file \
--disable-authn_default \
--disable-authz_groupfile \
--disable-authz_user \
--disable-authz_default \
--disable-auth_basic \
--disable-version \
--disable-env \
--disable-autoindex \
--disable-asis \
--disable-cgid \
--disable-cgi \
--disable-negotiation \
--disable-actions \
--disable-userdir \
--enable-so \
--enable-file-cache \
--enable-cache \
--enable-disk-cache \
--enable-mem-cache \
--enable-expires \
--enable-headers \
--enable-ssl \
--enable-info \
--enable-rewrite

#--with-mpm=worker \
#--enable-so \
#--enable-mods-shared=all \
#--disable-alias
#--disable-include \
#--disable-status \

[[ $? -ne 0 ]] && echo "Step: configure" &&  exit $?

make clean
make

[[ $? -ne 0 ]] && echo "Step: make" &&  exit $?

make install

[[ $? -ne 0 ]] && echo "Step: make install" &&  exit $?

cd ..
ln -s $PREFIX_DIR/$HTTPD_DIR $PREFIX_DIR/httpd
ln -s $PREFIX_DIR/httpd $PREFIX_DIR/apache

cp $PREFIX_DIR/httpd/conf/httpd.conf  $PREFIX_DIR/httpd/conf/httpd.conf.original
mkdir -p /www/logs/error

vim $PREFIX_DIR/httpd/conf/httpd.conf <<end > /dev/null 2>&1
:%s/User daemon/User nobody/
:%s/Group daemon/Group nobody/
:%s/ServerAdmin you@example.com/ServerAdmin $EMAIL/
:%s!#ServerName www.example.com:80!#ServerName www.example.com:80\rServerName 127.0.0.1!
:%s#$PREFIX_DIR/$HTTPD_DIR/htdocs#/www#g
:%s/#\n    AllowOverride None/#\r    AllowOverride All/
:%s#    DirectoryIndex index.html#    DirectoryIndex index.html index.php#
:%s=    #AddType text/html .shtml=    AddType text/html .shtml=
:%s=    #AddOutputFilter INCLUDES .shtml=    AddOutputFilter INCLUDES .shtml=
:%s=AddOutputFilter INCLUDES .shtml=AddOutputFilter INCLUDES .shtml\r\r    AddType application/x-httpd-php .php .phtml\r    AddType application/x-httpd-php-source .phps\r=
:%s#ErrorLog "logs/error_log"#ErrorLog "| $PREFIX_DIR/httpd/bin/rotatelogs /www/logs/error/error.%Y-%m-%d.log 86400 480"#
:%s=#Include conf/extra/httpd-info.conf=Include conf/extra/httpd-info.conf=
:%s=#Include conf/extra/httpd-mpm.conf=Include conf/extra/httpd-mpm.conf=
:%s=#Include conf/extra/httpd-languages.conf=Include conf/extra/httpd-languages.conf=
:%s=#Include conf/extra/httpd-vhosts.conf=Include conf/extra/httpd-vhosts.conf=
:%s=#Include conf/extra/httpd-default.conf=Include conf/extra/httpd-default.conf=
:wq
end
#:%s!Listen 80!Listen 0.0.0.0:80!
#:%s!#ServerName www.example.com:80!#ServerName www.example.com:80\rServerName *!

#vim $PREFIX_DIR/httpd/conf/extra/httpd-mpm.conf <<end > /dev/null 2>&1
#:%s/<IfModule mpm_worker_module>/<IfModule mpm_worker_module>\r    ServerLimit         16\r    ThreadLimit         128/
#:%s/StartServers          2/StartServers        8/
#:%s/MaxClients          150/MaxClients          2048/
#:%s/MinSpareThreads      25/MinSpareThreads     64/
#:%s/MaxSpareThreads      75/MaxSpareThreads     128/
#:%s/ThreadsPerChild      25/ThreadsPerChild     128/
#:%s/MaxRequestsPerChild   0/MaxRequestsPerChild 10000/
#:wq
#end

vim $PREFIX_DIR/httpd/conf/extra/httpd-mpm.conf <<end > /dev/null 2>&1
:%s/<IfModule mpm_worker_module>/<IfModule mpm_worker_module>\r    ServerLimit         16\r    ThreadLimit         256/
:%s/StartServers          2/StartServers        8/
:%s/MaxClients          150/MaxClients          4096/
:%s/MinSpareThreads      25/MinSpareThreads     64/
:%s/MaxSpareThreads      75/MaxSpareThreads     256/
:%s/ThreadsPerChild      25/ThreadsPerChild     256/
:%s/MaxRequestsPerChild   0/MaxRequestsPerChild 10000/
:wq
end

vim $PREFIX_DIR/httpd/conf/extra/httpd-languages.conf <<end > /dev/null 2>&1
:%s/LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv tr zh-CN zh-TW/#LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv tr zh-CN zh-TW/
:%s/ForceLanguagePriority Prefer Fallback/#ForceLanguagePriority Prefer Fallback/
:wq
end

echo -ne "
AddDefaultCharset UTF-8
" >> $PREFIX_DIR/httpd/conf/extra/httpd-languages.conf

vim $PREFIX_DIR/httpd/conf/extra/httpd-info.conf <<end > /dev/null 2>&1
:%s/Allow from .example.com/Allow from 127.0.0.1 172.16.1 113.106.63.1/g
:wq
end

vim $PREFIX_DIR/httpd/conf/extra/httpd-default.conf <<end > /dev/null 2>&1
:%s/ServerTokens Full/ServerTokens Prod/
:wq
end

echo -ne "
$PREFIX_DIR/httpd/bin/apachectl start
" >> /etc/rc.local

}
function php(){
#ln -s /usr/lib64/mysql/* /usr/lib64/
#ln -s /srv/mysql/bin/mysql_config /usr/local/bin/

rm -rf $PHP_DIR
tar zxf $PHP_SRC
cd $PHP_DIR

./configure --prefix=$PREFIX_DIR/$PHP_DIR \
--with-config-file-path=$PREFIX_DIR/$PHP_DIR/etc \
--with-config-file-scan-dir=$PREFIX_DIR/$PHP_DIR/etc/conf.d \
--with-apxs2=$PREFIX_DIR/$HTTPD_DIR/bin/apxs \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-xpm-dir \
--with-iconv \
--with-zlib-dir \
--with-xmlrpc \
--with-openssl \
--with-mcrypt \
--with-mhash=shared \
--with-mysql=/srv/mysql-5.1.50-linux-x86_64-glibc23 \
--with-pdo-mysql=/srv/mysql-5.1.50-linux-x86_64-glibc23 \
--with-sqlite=shared \
--with-pdo-sqlite=shared \
--with-ldap=shared \
--with-snmp=shared \
--with-xsl=shared \
--with-pear \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-magic-quotes \
--enable-inline-optimization \
--enable-gd-native-ttf \
--enable-zip \
--enable-xml \
--enable-ftp

#--with-mysqli=/srv/mysql-5.1.50-linux-x86_64-glibc23/bin/mysql_config \
#--enable-embedded-mysqli \

#--enable-fpm \
#--with-fpm-user=nobody \
#--with-fpm-group=nobody \
#--with-mysql=/srv/mysql-5.5.9-linux2.6-x86_64 \
#--with-pdo-mysql=/srv/mysql-5.5.9-linux2.6-x86_64 \

[[ $? -ne 0 ]] && echo "Step: configure" &&  exit $?

#make && make test && make install
#make &&  make install
make
[[ $? -ne 0 ]] && echo "Step: make" &&  exit $?

make install
[[ $? -ne 0 ]] && echo "Step: make install" &&  exit $?

mkdir -p $PREFIX_DIR/$PHP_DIR/etc/conf.d
cp $PREFIX_DIR/src/$PHP_DIR/php.ini-production $PREFIX_DIR/$PHP_DIR/etc/php.ini
ln -s $PREFIX_DIR/$PHP_DIR $PREFIX_DIR/php

cp $PREFIX_DIR/$PHP_DIR/etc/php.ini $PREFIX_DIR/$PHP_DIR/etc/php.ini.original

vim $PREFIX_DIR/php/etc/php.ini <<EOF > /dev/null 2>&1
:%s!;include_path = ".:/php/includes"!;include_path = ".:/php/includes"\rinclude_path = ".:$PREFIX_DIR/$PHP_DIR/lib/php"!
:%s:;extension_dir = "./":extension_dir = "$PREFIX_DIR/$PHP_DIR/lib/php/extensions":
:%s/memory_limit = 128M/memory_limit = 64M/
:%s/log_errors = Off/log_errors = On/
:%s#;error_log = php_errors.log#error_log = php_errors.log#
:%s#;open_basedir =#open_basedir = /www/:/tmp/#
:%s/upload_max_filesize = 2M/upload_max_filesize = 8M/
:wq
EOF

#:%s/mysql.allow_persistent = On/mysql.allow_persistent = Off/
#:%s/register_long_arrays = On/register_long_arrays = Off/
#:%s/display_errors = On/display_errors = Off/
#:%s/output_buffering = Off/output_buffering = On/
#:%s/allow_call_time_pass_reference = On/allow_call_time_pass_reference = Off/
#:%s#;error_log = php_errors.log#error_log = /www/logs/php_errors.log#

    read -p "php memcache module? [y/n]" -n 1 key
    echo
    if [ $key = 'y' ]; then
$PREFIX_DIR/php/bin/pecl install memcache
cp $PREFIX_DIR/$PHP_DIR/lib/php/extensions/no-debug-zts-*/memcache.so $PREFIX_DIR/$PHP_DIR/lib/php/extensions/
cat > $PREFIX_DIR/php/etc/conf.d/memcache.ini <<EOF
extension=memcache.so
EOF
#> /dev/null 2>&1
#memcache.default_timeout_ms=30
    fi

    read -p "php APC module? [y/n]" -n 1 key
    echo
    if [ $key = 'y' ]; then
$PREFIX_DIR/php/bin/pecl install apc
cp $PREFIX_DIR/$PHP_DIR/lib/php/extensions/no-debug-zts-*/apc.so $PREFIX_DIR/$PHP_DIR/lib/php/extensions/
cat > $PREFIX_DIR/php/etc/conf.d/apc.ini <<EOF
extension=apc.so
EOF
# > /dev/null 2>&1

    fi
}

function mysql(){
rm -rf $MYSQL_DIR
tar zxf $MYSQL_SRC
cd $MYSQL_DIR
./configure \
--prefix=$PREFIX_DIR/$MYSQL_DIR \
--with-mysqld-user=mysql \
--with-unix-socket-path=/tmp/mysql.sock \
--with-charset=utf8 \
--with-collation=utf8_general_ci
--with-extra-charsets=complex \
--with-big-tables \
--with-readline \
--with-ssl \
--with-embedded-server \
--with-plugins=innobase \
--with-mysqld-user=mysql \
--without-ndb-debug \
--without-debug \
--without-bench
--without-docs \
--localstatedir=/data/mysql/data \
--enable-assembler \
--enable-thread-safe-client \
--enable-local-infile \

make clean
make && make install
cd ..

ln -s $PREFIX_DIR/$MYSQL_DIR $PREFIX_DIR/mysql
$PREFIX_DIR/$MYSQL_DIR/bin/mysql_install_db --user=mysql
chown mysql.mysql -R $PREFIX_DIR/$MYSQL_DIR
cp $PREFIX_DIR/src/$MYSQL_DIR/support-files/mysql.server /etc/init.d/mysql
/etc/init.d/mysql start
$PREFIX_DIR/$MYSQL_DIR/bin/mysqladmin -u root password '9S5wxCVPMY'
}

function java(){
	JAVA_DIR=${JAVA_BIN%%.bin}
        #yum install java-1.6.0-openjdk -y
        chmod +x $JAVA_BIN
        ./$JAVA_BIN
        mv $JAVA_DIR ..
        ln -s $PREFIX_DIR/$JAVA_DIR $PREFIX_DIR/java
echo -ne '
export JAVA_HOME=$PREFIX_DIR/java
export CLASSPATH=$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$CLASSPATH
export PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$HOMR/bin:$PATH
export PATH=$PATH:$PREFIX_DIR/httpd/bin:$PREFIX_DIR/php/bin:$PREFIX_DIR/mysql/bin:$PREFIX_DIR/resin/bin:$PREFIX_DIR/python/bin
' >> /etc/profile

}
function resin(){
        tar zxf resin-4.0.6.tar.gz
        mv resin-4.0.6 $PREFIX_DIR/
	echo 'export RESIN_HOME=$PREFIX_DIR/resin' >> /etc/profile
}
function memcache(){
        MEMCACHED_PKG=memcached-1.4.5.tar.gz
        MEMCACHED_SRC=memcached-1.4.5
        rm -rf $MEMCACHED_SRC
        tar zxf $MEMCACHED_PKG
        cd $MEMCACHED_SRC
        ./configure --prefix=$PREFIX_DIR/memcached-1.4.5
        make && make install
}

function vsftpd(){
	yum install -y vsftpd
	adduser --home-dir /www/target/logs/ --shell /sbin/nologin --password logs.example.com logs
	echo logs >> /etc/vsftpd/chroot_list
	vim /etc/vsftpd/vsftpd.conf <<VIM > /dev/null 2>&1
:%s/#chroot_list_enable=YES/chroot_list_enable=YES/
:%s/#chroot_list_file/chroot_list_file/
VIM
	chkconfig vsftpd on
	service vsftpd start
}

# See how we were called.
case "$1" in
  clean)
        clean
        ;;
  httpd)
        httpd
        ;;
  php)
        php
        ;;
  mysql)
        if [ -f $0 ] ; then
                mysql
        fi
        ;;
  depend)
        depend
        ;;
  java)
        java
        ;;
  resin)
        resin
        ;;
  profile)
        profile
        ;;
  memcache)
        memcache
        ;;
  lamp)
        clean

        echo ##################################################
        echo # $MYSQL_DIR Installing...
        echo ##################################################
        mysql

        echo ##################################################
        echo # $HTTPD_DIR Installing...
        echo ##################################################
        httpd

        echo ##################################################
        echo # $PHP_DIR Installing...
        echo ##################################################
        php

        clean
        ;;
  vsftpd)
	vsftpd
	;;
  optimization)
	optimization
	;;
  *)
        echo $"Usage: $0 {depend|clean}"
        echo "		{httpd|php|mysql|vsftpd}"
        echo "		{java|resin}"
        echo "		{memcache}"
        echo "		{optimization}"
        echo "		{ntp|snmp|nagios|nrpe}"
        RETVAL=2
        ;;
esac

exit $RETVAL

第 45 章 Nginx

groupadd -g 80 www
adduser -o --home /www --uid 80 --gid 80 -c "Web Application" www

CentOS 5.x

cat > /etc/yum.repos.d/nginx.repo <<EOF
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/5/x86_64/
gpgcheck=0
enabled=1
EOF

yum search nginx

yum install -y nginx
chkconfig nginx on
service nginx start

CentOS 6.x

cat > /etc/yum.repos.d/nginx.repo <<EOF
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/6/x86_64/
gpgcheck=0
enabled=1
EOF

yum search nginx

yum install -y nginx
chkconfig nginx on
service nginx start

cp /etc/nginx/nginx.conf{,.original}

php-fpm status

    location ~ ^/(status|ping)$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_param  SCRIPT_FILENAME  $fastcgi_script_name;
        include        fastcgi_params;
    }

cat /etc/nginx/conf.d/www.conf

server {
    listen       80;
    server_name  www.test.com;

    #charset koi8-r;
    access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /www;
        index  index.html index.php;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    location ~ ^/(status|ping)$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_param  SCRIPT_FILENAME  $fastcgi_script_name;
        include        fastcgi_params;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        root           html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /www$fastcgi_script_name;
        include        fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
}

http://www.mydomain.com/status

pool:                 www
process manager:      dynamic
start time:           13/Aug/2012:17:07:54 +0800
start since:          8
accepted conn:        4
listen queue:         0
max listen queue:     0
listen queue len:     128
idle processes:       1
active processes:     1
total processes:      2
max active processes: 1
max children reached: 0

http://www.mydomain.com/ping

pong

第 46 章 FastCGI

安装编译器

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm

yum install gcc gcc-c++ make automake autoconf -y
yum install curl-devel libmcrypt-devel gd-devel libjpeg-devel libpng-devel libXpm-devel libxml2-devel libxslt-devel mhash-devel openssl-devel recode-devel -y
yum install openldap-devel net-snmp-devel -y

wget http://mirror.services.wisc.edu/mysql/Downloads/MySQL-5.5/MySQL-devel-5.5.25-1.el6.x86_64.rpm
wget http://mirror.services.wisc.edu/mysql/Downloads/MySQL-5.5/MySQL-shared-5.5.25-1.el6.x86_64.rpm
wget http://mirror.services.wisc.edu/mysql/Downloads/MySQL-5.5/MySQL-shared-compat-5.5.25-1.el6.x86_64.rpm

php-5.2.17

http://hk.php.net/releases/

wget http://php-fpm.org/downloads/php-5.2.17-fpm-0.5.14.diff.gz
wget http://museum.php.net/php5/php-5.2.17.tar.gz

tar zxvf php-5.2.17.tar.gz
gzip -cd php-5.2.17-fpm-0.5.14.diff.gz | patch -d php-5.2.17 -p1

cd php-5.2.17

./configure --prefix=/srv/php-5.2.17 \
--with-config-file-path=/srv/php-5.2.17/etc \
--with-config-file-scan-dir=/srv/php-5.2.17/etc/conf.d \
--with-libdir=lib64 \
--enable-fastcgi \
--enable-fpm \
--with-pear \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-zlib-dir \
--with-iconv \
--with-mcrypt \
--with-mysql \
--with-pdo-mysql \
--with-mysql-sock=/var/lib/mysql/mysql.sock \
--with-openssl=shared \
--with-mhash=shared \
--with-sqlite=shared \
--with-pdo-sqlite=shared \
--with-xsl=shared \
--with-pear \
--enable-pcntl \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-magic-quotes \
--enable-inline-optimization \
--enable-gd-native-ttf \
--enable-zip \
--enable-xml \
--enable-ftp \
--enable-bcmath \
--enable-calendar \
--enable-sqlite-utf8 \
--enable-shmop \
--enable-dba \
--enable-wddx \
--enable-sysvsem \
--enable-sysvshm \
--enable-sysvmsg \
--disable-debug

make && make install

mkdir -p /srv/php-5.2.17/etc/conf.d/
cp php.ini-recommended /srv/php-5.2.17/etc/php.ini
cp /srv/php-5.2.17/etc/php-fpm.conf /srv/php-5.2.17/etc/php-fpm.conf.original

php-5.3.13 + MySQL-devel-5.5.25

wget http://tw.php.net/distributions/php-5.3.13.tar.gz

mysql开发库

ls -1

MySQL-devel-5.5.25-1.el6.x86_64.rpm
MySQL-shared-5.5.25-1.el6.x86_64.rpm
MySQL-shared-compat-5.5.25-1.el6.x86_64.rpm

rpm -e --nodeps mysql-libs
yum localinstall MySQL-*

# php ./configure bug， mysql库的地址是/usr/lib/， 让Makefile 使用/usr/lib64中的mysql库

ln -s /usr/lib64/mysql/* /usr/lib64/
ln -s /usr/lib64/libmysql* /usr/lib/

还可以使用 --with-libdir=lib64 指定目录

tar zxvf php-5.3.13.tar.gz
cd php-5.3.13

./configure --prefix=/srv/php-5.3.13 \
--with-config-file-path=/srv/php-5.3.13/etc \
--with-config-file-scan-dir=/srv/php-5.3.13/etc/conf.d \
--with-libdir=lib64 \
--enable-fpm \
--with-fpm-user=www \
--with-fpm-group=www \
--with-pear \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-zlib-dir \
--with-iconv \
--with-mcrypt \
--with-mysql \
--with-pdo-mysql \
--with-mysql-sock=/var/lib/mysql/mysql.sock \
--with-xmlrpc=shared \
--with-openssl=shared \
--with-mhash=shared \
--with-sqlite=shared \
--with-pdo-sqlite=shared \
--with-xsl=shared \
--with-pear \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-magic-quotes \
--enable-inline-optimization \
--enable-gd-native-ttf \
--enable-zip \
--enable-xml \
--enable-ftp \
--enable-bcmath \
--enable-calendar \
--enable-sqlite-utf8 \
--enable-shmop \
--enable-dba \
--enable-wddx \
--enable-sysvsem \
--enable-sysvshm \
--enable-sysvmsg \
--disable-debug

make && make install

--with-snmp=shared \

ln -s /srv/php-5.3.13 /srv/php
cp sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
chmod 755 /etc/init.d/php-fpm
chkconfig --add php-fpm
chkconfig php-fpm on

cp /srv/php/etc/php-fpm.conf.default /srv/php/etc/php-fpm.conf
cp php.ini-production /srv/php/etc/php.ini

php-fpm.conf

# grep -v ';' /srv/php/etc/php-fpm.conf | grep -v "^$"
[global]
pid = run/php-fpm.pid
error_log = log/php-fpm.log
[www]
listen = 127.0.0.1:9000

user = www
group = www
pm = dynamic
pm.max_children = 2048
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35

pm.max_requests = 500

chkconfig --add php-fpm

php-5.4.8

mysql开发库

ls -1

MySQL-devel-5.5.25-1.el6.x86_64.rpm
MySQL-shared-5.5.25-1.el6.x86_64.rpm
MySQL-shared-compat-5.5.25-1.el6.x86_64.rpm

rpm -e --nodeps mysql-libs
yum localinstall MySQL-*

tar zxvf php-5.4.8.tar.gz
cd php-5.4.8

./configure --prefix=/srv/php-5.4.8 \
--with-config-file-path=/srv/php-5.4.8/etc \
--with-config-file-scan-dir=/srv/php-5.4.8/etc/conf.d \
--enable-fpm \
--with-fpm-user=www \
--with-fpm-group=www \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-zlib-dir \
--with-iconv \
--with-mcrypt \
--with-mysql \
--with-mysqli=/usr/bin/mysql_config \
--with-pdo-mysql \
--with-mysql-sock=/var/lib/mysql/mysql.sock \
--with-openssl=shared \
--with-mhash=shared \
--with-xsl=shared \
--with-recode=shared \
--with-pear \
--enable-sockets \
--enable-soap \
--enable-mbstring \
--enable-gd-native-ttf \
--enable-zip \
--enable-xml \
--enable-bcmath \
--enable-calendar \
--enable-shmop \
--enable-dba \
--enable-wddx \
--disable-debug

make && make install

mkdir -p /srv/php-5.4.8/etc/conf.d
cp php.ini-* /srv/php-5.4.8/etc/
cp /srv/php-5.4.8/etc/php.ini-development /srv/php-5.4.8/etc/php.ini
cp /srv/php-5.4.8/etc/php-fpm.conf.default /srv/php-5.4.8/etc/php-fpm.conf
cp /srv/php-5.4.8/etc/pear.conf{,.original}
cp ./sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
chmod +x /etc/init.d/php-fpm

ln -s /srv/php-5.4.8/ /srv/php

php-fpm.conf

php-fpm.conf

vim /srv/php-5.4.8/etc/php-fpm.conf <<end > /dev/null 2>&1
:25,25s/;//
:wq
end

# grep -v '^;' /srv/php-5.4.8/etc/php-fpm.conf | grep -v '^$'
[global]
pid = run/php-fpm.pid

rlimit_files = 4096

[www]
user = www
group = www
listen = 127.0.0.1:9000

pm = dynamic
pm.max_children = 512
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3

pm.status_path = /status

ping.path = /ping
ping.response = pong
access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"

slowlog = log/$pool.log.slow

php.ini-development

php.ini

vim /srv/php-5.4.8/etc/php.ini <<EOF > /dev/null 2>&1
:%s!;include_path = ".:/php/includes"!include_path = ".:/srv/php-5.4.8/lib/php:/srv/php-5.4.8/share"!
:%s:extension_dir = "./":extension_dir = "/srv/php-5.4.8/lib/php/extensions":
:%s/memory_limit = 128M/memory_limit = 16M/
:%s$;open_basedir = $open_basedir = /www/:/tmp/:/srv/php-5.4.8/lib/php/:/srv/php-5.4.8/bin/$
:%s/upload_max_filesize = 2M/upload_max_filesize = 8M/
:%s/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=1/
:%s$;date.timezone =$date.timezone = Asia/Hong_Kong$
:%s:;session.save_path = "/tmp":session.save_path = "/dev/shm":
:wq
EOF

Extension 扩展安装

APC

pecl install apc

cat > /srv/php-5.4.8/etc/conf.d/apc.ini <<EOF
extension=apc.so
EOF

Xdebug

pecl install xdebug

cat > /srv/php-5.4.8/etc/conf.d/xdebug.ini <<EOF
[Zend Modules]
zend_extension=/srv/php-5.4.8/lib/php/extensions/no-debug-non-zts-20100525/xdebug.so
[Xdebug]
xdebug.profiler_enable = on
xdebug.trace_output_dir = "/tmp/xdebug"
xdebug.profiler_output_dir = "/tmp/xdebug"
EOF

PATH

cat >> /etc/profile	<<EOF
export PATH=$PATH:/srv/php/bin
EOF

cat >> .bashrc	<<EOF
export PATH=$PATH:/srv/php/bin
EOF

Test

pdo_mysql

pdo_mysql测试代码

<?php
$dbms   ="mysql";
$db_host="192.168.2.10";
$db_name="example";
$db_user="www";
$db_pwd="www";
$dsn="$dbms:host=$db_host;dbname=$db_name";
try {
    $start   =   microtime();
    $dbh=new PDO($dsn,$db_user,$db_pwd);
#    $dbh->query("select * from files order by id desc limit 10″);

    foreach($dbh->query('SELECT id, username from members limit 10') as $row) {
        print_r($row);
    }
    $dbh = null;

    $end   =   microtime();
    $starttime   =   explode(" ",   $start);
    $endtime   =   explode(" ",   $end);
    $exectime=$endtime[0]+$endtime[1]-$starttime[0]-$starttime[1];
    echo   "执行时间为："   .   $exectime;
}
catch (PDOException $e) {
    print("Error:".$e->getMessage());
}
?>

第 47 章 Linux 数据备份

批量差异备份

/etc/cron.daily/backup

#!/bin/bash
for ip in {23..32} {49,50} {81..92}; do mkdir -p /opt/backup/$ip/srv/; rsync -auz --delete root@172.16.3.$ip:/srv/* /opt/backup/$ip/srv/; done &
for ip in {23..32} {49,50} {81..92}; do mkdir -p /opt/backup/$ip/www/; rsync -auz --delete root@172.16.3.$ip:/www/* /opt/backup/$ip/www/; done &

mysql备份

#!/bin/bash
###################################
# $Id: chapter.backup.xml 428 2012-06-16 11:12:06Z netkiller $
# Author: netkiller@msn.com
# Home:	http://netkiller.github.com
###################################
# SELECT `user`, `host`, `password` FROM `mysql`.`user`;
# CREATE USER 'backup'@'localhost' IDENTIFIED BY 'SaJePoM6BAPOmOFOd7Xo3e1A52vEPE';
# GRANT SELECT, LOCK TABLES  ON *.* TO 'backup'@'localhost';
# FLUSH PRIVILEGES;
# SHOW GRANTS FOR 'backup'@'localhost';
###################################
BACKUP_HOST="localhost"
BACKUP_USER="backup"
BACKUP_PASS="PA3nScWWdqC3Ww4KPu"
BACKUP_DIR=/opt/backup
BACKUP_DBNAME="dbname"
#Number of copies
COPIES=30
####################################
MYSQLDUMP="/usr/bin/mysqldump"
TIMEPOINT=$(date -u +%Y-%m-%d)
MYSQLDUMP_OPTS="-h $BACKUP_HOST -u$BACKUP_USER -p$BACKUP_PASS"
####################################
test ! -w $BACKUP_DIR && echo "Error: $BACKUP_DIR is un-writeable." && exit 0

umask 0077

for dbname in $BACKUP_DBNAME
do
	test ! -d "$BACKUP_DIR/$dbname" && mkdir -p "$BACKUP_DIR/$dbname"

	$MYSQLDUMP $MYSQLDUMP_OPTS $dbname | gzip > $BACKUP_DIR/$dbname/$dbname.$TIMEPOINT.sql.gz
done
find $BACKUP_DIR -type f -mtime +$COPIES -delete

第 48 章 MySQL

Installation

# yum install mysql-server
# /etc/init.d/mysqld start

设置数据库root密码

/usr/bin/mysqladmin -u root password 'new-password'
/usr/bin/mysqladmin -u root -h your.domain password 'new-password'

or

# /usr/bin/mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.

Set root password? [Y/n]
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n]
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n]
 ... Success!

By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n]
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n]
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.

Thanks for using MySQL!

create database and user

# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>
CREATE DATABASE dbname DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;

GRANT ALL PRIVILEGES ON dbname.* TO 'dbuser'@'localhost' IDENTIFIED BY 'your_password' WITH GRANT OPTION;

FLUSH PRIVILEGES;

test login

# mysql -u dbuser -p dbname
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 11
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

附录 A. 附录

Redhat Doc

http://docs.redhat.com/docs/zh-CN/index.html

System reduce

采用最小化安装后仍有很多不必要的软件

	[root@dev1 ~]# yum remove cups