Amazon AWS resize the Volume for a Linux instance

Follow these steps:Stop the instance

• Make a snapshot (MySnap) from volume.
• Create new volume with new size from your snapshot (MySnap).
• Detach the old volume
• Attach the new volume as /dev/sda1
• Start the instance
• in terminal resize the partition:

resize2fs -p /dev/xvda1 (see fdisk -l for your partition name)

VPN Server on Debian

Install the pptp server package:

sudo apt-get install pptpd

Edit the “/etc/pptpd.conf” configuration file:

sudo vim /etc/pptpd.conf

Add to it:

localip 10.55.55.1

remoteip 10.55.55.100-200


that means Clients will get the IPs from 100 to 200.

Edit the “/etc/ppp/pptpd-options” configuration file:

sudo vim /etc/ppp/pptpd-options

Append to the end of the file, the following directives:

ms-dns xxx.xxx.xxx.xxx

nobsdcomp

noipx

mtu 1490

mru 1490

Where the IP used for the ms-dns directive is the DNS server for the local network your client will be connecting to and, again, it is your responsibility to adjust this to your network’s configuration.

Edit the chap secrets file:

sudo vim /etc/ppp/chap-secrets

Add to it the authentication credentials for a user’s connection, in the following syntax:

username * users-password *

Restart the connection’s daemon for the settings to take affect:

sudo /etc/init.d/pptpd restart

If you don’t want to grant yourself access to anything beyond the server, then you’re done on the server side.

Enable Forwarding (optional)

While this step is optional and could be viewed as a security risk for the extremely paranoid, it is my opinion that not doing it defeats the purpose of even having a VPN connection into your network.

By enabling forwarding we make the entire network available to us when we connect and not just the VPN server itself. Doing so allows the connecting client to “jump” through the VPN server, to all other devices on the network.

To achieve this we will be flipping the switch on the “forwarding” parameter of the system.

Edit the “sysctl” file:

sudo vim /etc/sysctl.conf

Find the “net.ipv4.ip_forward” line and change the parameter from 0 (disabled) to 1 (enabled):

net.ipv4.ip_forward=1

You can either restart the system or issue this command for the setting to take affect:

sudo sysctl -p

Add these rules to Firewall (IPTABLES):

iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P OUTPUT ACCEPT

now all the server side settings are prepared.

Reference: http://www.howtogeek.com/51237/setting-up-a-vpn-pptp-server-on-debian/

Sendmail gethostbyaddr Problem

The problem is that sendmail tries to resolve the ip of
every interface  your have. 

Change this line in sendmail.cf:

#O DontProbeInterfaces=False

to

O DontProbeInterfaces=True

and restert the sendmail.

Amzon EC2 - Changing Scale

This script disables the Auto Scaling, because min-size and max-size are zero.

ZONE="us-east-1d"
LC_NAME="myscaling-lc"
SG_NAME="dmcleaner-sg"

as-update-auto-scaling-group $SG_NAME --availability-zones $ZONE --launch-configuration $LC_NAME --min-size 0 --max-size 0

Amazon Auto Scaling

This script is enough for me :)


ZONE="us-east-1d" <=== Availability Zone
SECURITY_GROUP="default"
REGION="us-east-1"
INSTANCE_SIZE="t1.micro" <=== Instance Type (micro, small, Large, ...)
LB_NAME="myscaling-lb"
LC_NAME="myscaling-lc"
LC_IMAGE_ID="ami-xxxxxxxx" <=== Enter your AMI ID here
SG_NAME="dmcleaner-sg"

# Set up load balancer
elb-create-lb $LB_NAME --headers --listener "lb-port=80,instance-port=80,protocol=http" --availability-zones $ZONE --region $REGION

#Setup Load Balancer Health Check
elb-configure-healthcheck $LB_NAME --headers --target "HTTP:80/index.php" --interval 5 --timeout 2 --unhealthy-threshold 2 --healthy-threshold 2 --region $REGION


# Setup Auto Scaling
as-create-launch-config $LC_NAME --image-id $LC_IMAGE_ID --instance-type $INSTANCE_SIZE --group $SECURITY_GROUP --region $REGION

#Setup Auto Scaling Group
as-create-auto-scaling-group $SG_NAME --availability-zones $ZONE --launch-configuration $LC_NAME --min-size 1 --max-size 6 --load-balancers $LB_NAME --health-check-type ELB --grace-period 60 --region $REGION

# Setup Scaling Policies (to add instance)
SCALE_UP_POLICY=`as-put-scaling-policy MyScaleUpPolicy1 --auto-scaling-group $SG_NAME --adjustment=1 --type ChangeInCapacity --cooldown 300 --region $REGION`

#Setup Alarm (Add instance when CPU Load is more then 70%)
mon-put-metric-alarm MyHighCPUAlarm1 --region $REGION --comparison-operator GreaterThanThreshold --evaluation-periods 1 --metric-name CPUUtilization --namespace "AWS/EC2" --period 60 --statistic Average --threshold 70 --alarm-actions $SCALE_UP_POLICY --dimensions "AutoScalingGroupName=$SG_NAME"

# Setup Scaling Policies (to reduce instance)
SCALE_DOWN_POLICY=`as-put-scaling-policy MyScaleDownPolicy1 --auto-scaling-group $SG_NAME --adjustment=-1 --type ChangeInCapacity --cooldown 300 --region $REGION`

#Setup Alarm (Reduce instance when CPU Load is less then 30%)
mon-put-metric-alarm MyLowCPUAlarm1 --region $REGION --comparison-operator LessThanThreshold --evaluation-periods 1 --metric-name CPUUtilization --namespace "AWS/EC2" --period 60 --statistic Average --threshold 30 --alarm-actions $SCALE_DOWN_POLICY --dimensions "AutoScalingGroupName=$SG_NAME"

How can I log the client IP address on the backend in Varnish?

All I see is the IP address of the varnish server. How can I log the client IP address?

We will need to add the IP address to a header used for the backend request, and configure the backend to log the content of this header instead of the address of the connecting client (which is the varnish server).

Varnish configuration:

sub vcl_recv {
    # Add a unique header containing the client address remove
    req.http.X-Forwarded-For;
    set    req.http.X-Forwarded-For = client.ip;
    # [...] }

For the apache configuration, we copy the “combined” log format to a new one we call “varnishcombined”, for instance, and change the client IP field to use the content of the variable we set in the varnish configuration:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" varnishcombined

And so, in our virtualhost, you need to specify this format instead of “combined” (or “common”, or whatever else you use):

 ServerName www.example.com 
# [...] 

 CustomLog /var/log/apache2/www.example.com/access.log varnishcombined

 # [...] 


Reference: Varnish Website

Installing Varnish on Debian

Varnish is the key software that speeds up your web site. It is Open Source, built on industry standards and requires very few resources.

Install on Debian:

curl http://repo.varnish-cache.org/debian/GPG-key.txt | apt-key add -
echo "deb http://repo.varnish-cache.org/debian/ $(lsb_release -s -c) varnish-2.1" >> /etc/apt/sources.list
apt-get update
apt-get install varnish


Change the Apache's port in /etc/apache2/ports.conf

NameVirtualHost *:8000

Listen 8000

The configuration daemon for Varnish is located in /etc/default/varnish. Here you can pass the startup options:

DAEMON_OPTS=
           "-a :80 \            
            -T localhost:6082 \
            -f /etc/varnish/default.vcl \
            -S /etc/varnish/secret \
            -s malloc,256M \    
            -u www-data \
            -g www-data"

Now let's get to the configuration file (/etc/varnish/default.vcl). This is a very simple use of Varnish
which strips the cookies of some static files, like jpg and png, allowing them to be cached. In my case
this works best, and it also gives me a header information of what was cached and what not
(if you check the headers with something like FireBug). Of course you can find even better configurations available.
Having a specific configuration for your platform.

backend apache { 
     .host = "127.0.0.1";
     .port = "8000"; }

acl purge {
      "localhost";
      "127.0.0.1"; }

sub vcl_recv {
   // Strip cookies for static files:
   if (req.url ~ "\.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html|htm)$") {
      unset req.http.Cookie;
      return(lookup); }

   // Remove has_js and Google Analytics __* cookies.
   set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js)=[^;]*", "");

   // Remove a ";" prefix, if present. 
   set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

   // Remove empty cookies. 
   if (req.http.Cookie ~ "^\s*$") {
         unset req.http.Cookie;  }   
   if (req.request == "PURGE") {
       if (!client.ip ~ purge) {
              error 405 "Not allowed.";}
       purge("req.url ~ " req.url " && req.http.host == " req.http.host);
       error 200 "Purged.";  }
}

sub vcl_hash {
    if (req.http.Cookie) {
         set req.hash += req.http.Cookie;   }
}

sub vcl_fetch {
   // Strip cookies for static files: 
   if (req.url ~ "\.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html|htm)$") {
        unset beresp.http.set-cookie;  }

   // Varnish determined the object was not cacheable 
   if (!beresp.cacheable) {
       set beresp.http.X-Cacheable = "NO:Not Cacheable";  }
   // You don't wish to cache content for logged in users
   elsif(req.http.Cookie ~"(UserID|_session)") {
        set beresp.http.X-Cacheable = "NO:Got Session";  
        return(pass);  }
   // You are respecting the Cache-Control=private header from the backend
   elsif ( beresp.http.Cache-Control ~ "private") {
         set beresp.http.X-Cacheable = "NO:Cache-Control=private";
         return(pass);  } 
   // You are extending the lifetime of the object artificially
   elsif ( beresp.ttl < 1s ) {
       set beresp.ttl   = 300s;
       set beresp.grace = 300s;  
       set beresp.http.X-Cacheable = "YES:Forced";  }
  // Varnish determined the object was cacheable
  else {  
      set beresp.http.X-Cacheable = "YES";  }
return(deliver);
}


then Restart Apache2 and Varnish processes:

/etc/init.d/apache2 restart
/etc/init.d/varnish restart

Add new rule to SpamAssassin

Add this lines to /etc/mail/spamassassin/local.cf:

body LOCAL_DEMONSTRATION_RULE   /test/
score LOCAL_DEMONSTRATION_RULE 0.1
describe LOCAL_DEMONSTRATION_RULE       This is a simple test rule

then you must restart the SpamAssassin Process:

/etc/init.d/psa-spamassassin restart

You can also add rule to each user in ~/.spamassassin/user_prefs

but remember that by default allow_user_rules is 0, and you must change
that to 1. Add this line to:

/etc/mail/spamassassin/local.cf


allow_user_rules 1

Don't forget to restart the SpamAssassin.

Migrate MySQL to Oracle

http://www.oracle.com/technetwork/database/migration/mysqllauncher-086083.html

Likewise-Open: Authenticate a Linux machine to an Active Directory domain

To install the likewise-open package in Ubuntu, open a terminal prompt and enter:

sudo apt-get install likewise-open

Or you could download appropriate Script from here.

The main executable file of the likewise-open package is /usr/bin/domainjoin-cli, which is used to join your computer to the domain. Before you join a domain you will need to make sure you have:

• Access to an Active Directory user with appropriate rights to join the domain.

• The Fully Qualified Domain Name (FQDN) of the domain you want to join. If your AD domain does not match a valid domain such as example.com, it is likely that it has the form of domainname.local.

• DNS for the domain setup properly. In a production AD environment this should be the case. Proper Microsoft DNS is needed so that client workstations can determine the Active Directory domain is available.

  
  

To join a domain, from a terminal prompt enter:

sudo domainjoin-cli join example.com Administrator

See here for more details.

Qmail & SpamAssassin - Change Default Rules Score

Under this directory:

/var/qmail/mailnames/DOMAIN-NAME/USERNAME/.spamassassin

edit user_prefs and add the new Score for desire rule:

Example:

score RDNS_NONE 5.0

that overrides the defualt score.

You can find all rules here:

http://wiki.apache.org/spamassassin/Rules/

Ubuntu - Convert jpg files to gif animator

Run this command:

convert -delay 10 -loop 0 *.jpg animation.gif

Chrooted SSH/SFTP

with these settings, works for me in Debian Lenny:

Be sure that this line in /etc/ssh/sshd_config exists:

Subsystem sftp internal-sftp

Chroot the user to his home:

ChrootDirectory %h

The owner of home must be root (mod 755).

These lines are important, otherwise the root user could not login into system:

Match User root
ChrootDirectory /

Restart the ssh process:

/etc/init.d/ssh restart