Wednesday, January 15, 2014

ngrep & tcpdump

ngrep -q -d eth0 -W byline host my domain.com and port 80

tcpdump -s 1111  port 80 -w capture_file

tcpdump -nnvvS and src 10.5.2.3 and dst port 3389


# Traffic originating from Mars or Pluto that isn't to the SSH port

tcpdump -vv src mars and not dst port 22


Monitor network traffic / Find the rouge IP address  machine

tcpdump -l -n arp | egrep 'arp who-has' | head -100 | awk '{ print $NF }' |sort | uniq -c | sort -n

Friday, January 10, 2014

Vagrant + Puppet + RVM + serverspec

http://serverspec.org/
http://rvm.io/
http://docs.puppetlabs.com/learning/
http://mouapp.com/



What we want to achieve:
Install hypervisor for ubuntu-12.04

Install vagrant
Install virtual box
Create a directory on the system for this project, say KVM
mkdir kvm

Create a Gemfile
vim Gemfile
source 'https://rubygems.org'

gem 'colorize'
gem 'facter', "1.6.5"
gem 'puppet', "2.7.20"
gem 'serverspec'
gem 'puppet-lint'
gem 'fpm'

Create a Rakefile
 vim Rakefile

require 'rake'
require 'rspec/core/rake_task'

RSpec::Core::RakeTask.new(:spec) do |t|
  t.pattern = 'spec/*/*_spec.rb'
end

Create/initialize a vagrant file : vagrant init
 config.vm.box = "precise64"
config.vm.box_url = "http://files.vagrantup.com/precise64.box"
config.vm.network :private_network, ip: "192.168.33.10"
config.vm.provision :shell, inline: "apt-get update -y"

   config.vm.provision :puppet do |puppet|
     puppet.module_path = "modules"
     puppet.manifests_path = "manifests"
     puppet.manifest_file  = "site.pp"
   end


Make two directories as
manifests/site.pp
modules/kvm/manifests/init.pp

Mainfests is plays the role of "what to be done" and Modules plays the role of "how to be done"


Vim init.pp
class l3-kvm {

  package {
     "kvm-ipxe":
         ensure => present;
     "python-vm-builder":
        ensure => present;
      "ubuntu-virt-server":
         ensure => present;
  }

}


====
vim site.pp

### Global variables ###

#backup settings
File { backup => local }
# Default path
Exec { path => [ "/usr/local/sbin/", "/bin/", "/sbin/" , "/usr/bin/", "/usr/sbin/" ] }

# Centralized backup filebucket
filebucket { local: path => "/var/lib/puppet/clientbucket" }

node /precise64/ {
  include kvm
}


 rake -T
(in /Users/n/work/techops/kvm)
rake spec  # Run RSpec code examples


==

-->
user [kvm] $ ls -la
total 80
drwxr-xr-x  18 user  staff   612 Jan 10 21:10 .
drwxr-xr-x  55 user  staff  1870 Jan 10 15:47 ..
drwxr-xr-x   3 user  staff   102 Jan 10 16:10 .bundle
-rw-r--r--   1 user  staff   151 Jan 10 15:59 .gemrc
drwxr-xr-x  13 user  staff   442 Jan 10 17:15 .git
-rw-r--r--   1 user  staff    59 Jan 10 16:00 .gitignore
-rw-r--r--   1 user  staff    30 Jan 10 16:00 .rspec
-rw-r--r--   1 user  staff     7 Jan 10 16:00 .ruby-gemset
-rw-r--r--   1 user  staff    16 Jan 10 16:00 .ruby-version
drwxr-xr-x   3 user  staff   102 Jan 10 15:40 .vagrant
-rw-r--r--   1 user  staff   136 Jan 10 15:49 Gemfile
-rw-r--r--   1 user  staff  1213 Jan 10 16:10 Gemfile.lock
-rw-r--r--@  1 user  staff   353 Jan 10 17:12 README.md
-rw-r--r--   1 user  staff   124 Jan 10 16:17 Rakefile
-rw-r--r--   1 user  staff  3413 Jan 10 17:06 Vagrantfile
drwxr-xr-x   3 user  staff   102 Jan 10 16:58 manifests
drwxr-xr-x   3 user  staff   102 Jan 10 16:57 modules
drwxr-xr-x   4 user  staff   136 Jan 10 16:17 spec


====

more .gemrc
:backtrace: false
:benchmark: false
:bulk_threshold: 1000
:sources:
- http://rubygems.org/
:update_sources: true
:verbose: true
gem: --no-ri --no-rdoc
==
more .gitignore
.vagrant
.DS_Store
scripts/build
*.box
.bundle
*.swp
*.swo

====
 more .rspec
--colour
-f
progress
-f
doc
==
more .ruby-gemset
puppet
==

more .ruby-version
ruby-1.9.2-p290


==

vim kvm/spec/default

require 'spec_helper'

describe package('ubuntu-virt-server') do
  it { should be_installed }
end

describe package('python-vm-builder') do
  it { should be_installed   }
end

describe package('kvm-ipxe') do
  it { should be_installed }
end

#describe file('/etc/httpd/conf/httpd.conf') do
 # it { should be_file }
#  it { should contain "ServerName default" }
#end

==
puppet apply --verbose --debug --modulepath modules manifests/site.pp

Friday, January 3, 2014

Empty /tmp directory in linux

11 10 * * * /usr/bin/find /tmp/ -maxdepth 2 -name "*" -not -name tmp -exec rm -rf {} \; > /dev/null 2>&1