Showing posts with label ServerAdministration. Show all posts
Showing posts with label ServerAdministration. Show all posts

Friday, August 23, 2013

Linux server partitioning with mdadm software RAID and LVM2

Over the years, I've really come to appreciate what judicious use of LVM (or LVM2) brings to the table when administering servers. If you rely on it heavily and leverage it properly, you can do things like:
  • Snapshot any file system (other then /boot) for backups, or to make images, or to test something out.
  • Migrate a logical volume (LV) from one physical volume (PV) to another, without having to take the file system offline or deal with downtime.
  • Resize file systems that are too large or too small, with minimal downtime (if the file system supports it).
Basically, other then /boot, if you're thinking of creating a separate partition or Software RAID device the you should be using LVM instead of physical partitions or RAID devices. You gain a lot of flexibility in the long-run and setting up LVM on top of hardware or software RAID or plain old disks is no longer that difficult.

These days, when I setup disk partitions to hold a server's boot-up files, I only create (2) partitions on the drive. One for the Software RAID-1 mirror set to hold /boot (usually 256-1024MB) and the rest of the drive is a second RAID-1 mirror set that is turned into a LVM physical volume (PV) and assigned to a volume group. I will usually only partition out to about 99% of the drive size if I'm doing Software RAID, because that makes it easier later to put in a different model disk of the same capacity and still have things work. Drives from different manufacturers have slightly different capacities, so you can run into trouble down the road when you go to replace a failed drive if you assumed all drives were exactly the size as your original drives.

Inside that LVM volume group (VG), I create all of my other partitions. These days, that means:
  • / - the "root" partition, usually 16-32GB for CentOS 6
  • /home - Usually starts at 4GB for a server where people won't be logging in much.
  • /opt - 4-24GB
  • /srv - 1-4GB (sub-directories get their own LV later)
  • /tmp - 4-24GB
  • /usr/local - 8-24GB
  • /var - 4-24GB
  • /var/log - 4-24GB
  • /var/spool - 2-4GB to start
  • /var/tmp - 2-8GB to start
And that's just the basic operating system file systems. For things like squid, e-mail, web servers, samba shares, etc., each of those will get its own LV, allocated from the server-wide volume group.

Follow ups:
  • GRUB2 understands mdadm (software RAID) and LVM. So we will eventually be able to put /boot in an LVM volume. But the GRUB that ships with RHEL6 and CentOS6 is still GRUB 0.97.

Monday, August 12, 2013

Auto-mounted external USB drives with Linux autofs daemon

This explains how to use 'autofs' to automatically mount external USB hard drives at a predictable path under CentOS 6 (but probably also works for CentOS 5, RHEL 5, RHEL 6, etc.). On one of my Ubuntu desktops; file systems on USB drives get automatically mounted, but that requires a GUI environment to be installed. On our servers at work, we generally do not install a GUI environment. We also had some special requirements in order to use the USB drives as backup targets:
  • The USB drive needs to mount at a standard location. Such as /mnt/offsite/LABEL or something. This way the backup scripts are not overly complex.
  • Mounting needs to be automatic, without any user intervention.
  • Ideally, the file system should be dismounted when not in use. That way the user who swaps out the backup drives only needs to check the drive activity light before knowing that it is safe to swap out the drive.

So the standard Ubuntu method of doing things via Gnome comes close, but I explored other options as well. The one I settled on is called 'autofs'. It is a script/daemon that is found in the standard CentOS 6 repositories, so you just need to run "yum install autofs".

Configuration of the autofs daemon consists of two parts:

A. You need to find and edit the master configuration file for autofs, also called the 'master map file'. Under CentOS 6, this is located at /etc/auto.master, or you can look at '/etc/sysconfig/autofs ' to find out the configuration file location.

If you want to mount your USB backup drives at /mnt/offsite/XYZ, then your auto.master file only needs to contain the following:

# USB backup drives
/mnt/offsite            /etc/auto.offsite       --timeout=1800

As you can see, you tell autofs the location, what configuration file to look at for devices that need to be mounted, and optional arguments such as custom timeout settings. Note that you need to create the location directory by hand (e.g. "# mkdir /mnt/offsite") before starting autofs.

B. The second part of configuration is telling autofs which devices should be automatically mounted. It is best if you use either the UUID of the partition (/dev/disk/by-uuid/XYZ) or the device ID (/dev/disk/by-id/XYZ-part0).

OFFSITE1 -fstype=ext4,rw,noatime,data=journal,commit=1 
    :/dev/disk/by-uuid/b5c1db0d-776f-499b-b4f2-ac53ec3bf0ef

Please note that the above should be all on line line, I have broken it up for clarity.

The only real mount options that you need is "fstype=auto,rw,noatime". I have added "data=journal,commit=1" to make the ext4 file system on the drive a bit more resilient.

One limitation of autofs is that if you have multiple USB drives to be mounted, each one needs its own unique mount point (/mnt/offsite/OFFSITE1, /mnt/offsite/OFFSITE2, etc.). However, you could decide to mount all of the drives at the same location if you give them all the same UUID. But I'm not sure how well autofs would deal with two drives, having the same UUID, being hooked up to the server at the same time.



After editing your mapping file, you (probably) need to restart autofs. Assuming that you have done everything correctly, attempting to list the contents 'ls -l /mnt/offsite/OFFSITE1' will cause the drive to be automatically mounted. After the timeout period expires, the drive will automatically dismount.

Updates (2015):

I have started to document this process in my "sync2usb" project over on GitHub.  Including using LUKS encryption to protect the contents of the USB drive against disclosure after loss/theft.

https://github.com/tgharold/sync2usb/blob/master/AUTOFS.md
https://github.com/tgharold/sync2usb/blob/master/LUKS.md

Sunday, July 01, 2007

CentOS5: Moving /var/log to a separate volume

One thing I like to do is put /var/log on its own volume. That keeps the root volume from overflowing and also gets the log files out of the way. However, in CentOS5 (and probably RHEL5), SELinux is probably going to complain unless we tell it to "fixup" the new filesystem.

  1. Create the filesystem (I use ext3, so # /sbin/mke2fs -j /dev/mdX)
  2. Mount it at a temporary location: # mkdir /mnt/log ; mount /dev/mdX /mnt/log
  3. Copy the contents: # cp -a /var/log/* /mnt/log/
  4. It may be necessary to "fixup" the new volume: # cd /mnt/log ; /sbin/restorecon -R *
  5. Edit the /etc/fstab file to mount the new volume at /var/log
  6. Reboot

AFAIK, that's the extent of what's needed. Looking at the directory listings using "ls -lZ" seems to show the correct SELinux flags on the files between the two different directories.

Wednesday, June 20, 2007

UltraVNC (Server) Install on Windows XP

Installing UltraVNC (see also "UltraVNC Installation")

  1. Download UltraVNC for MS Windows
  2. Run the setup program (currently this is: UltraVNC-100-RC203-Setup.exe)
  3. Accept the license agreement and read the Information screen
  4. Use the default install destination location
  5. Choose "Complete Install"
  6. Use the default Start Menu Folder
  7. Turn ON "Register Ultr@VNC Server as system service"
  8. Turn ON "Start or restart Ultr@VNC service"
  9. Turn OFF the (3) options that create desktop icons
  10. Turn ON "Associated .vnc files with Ultr@VNC Viewer"
  11. Click "Install" to start the installation.

WinVNC: Default Local System Properties (see "configuration for details)

  1. Turn OFF "Enable JavaViewer"
  2. Turn ON "Display Query Window", Set the timeout to 60 seconds, with "Accept" as the default action.
  3. Under "Multi viewer connections", CHANGE to "Keep existing connections"
  4. Under "Authentication", set a secure default password
  5. Under "Authentication", turn ON "Require MS Logon", turn ON "New MS Logon"
  6. Click on "Configure MS Logon Groups", Add, enter "Administrators" (note the plural) and click "OK". Grant that group full control and click "OK" to close the UltraVNC Security Editor window.
  7. Most other options can be left "as is"

AES Encryption plugin (a.k.a. DSM)

  1. Download the AESV2 Plugin (currently: AESV2Plugin100.zip)
  2. Extract the .DSM file to the program folder where you installed UltraVNC (usually: C:\Program Files\UltraVNC), see "DSM quick start" for more information.
  3. Re-open the "Default Local System Properties" window for the UltraVNC server (Start -> UltraVNC -> UltraVNC Server -> Show Default Settings). Alternately, start up the service helper systray app (Run Service Helper) and go to "Admin Properties")
  4. Under "DSM Plugin", turn ON the "Use:" checkbox and select "AESV2Plugin.dsm" from the list.
  5. Click "OK"

VNC Resource Links

Various links about VNC

Virtual Network Computing (VNC) - Wikipedia entry about VNC.

Taking your desktop virtual with VNC by Tim Waugh

VNC FAQ-o-Matic

Making VNC more secure using SSH

Free and Easy Remote Access with VNC Reverse Connections

Geek to Live: Secure VNC with Hamachi

Secure VNC with two-factor authentication