LIVE FEED :: 11111110.00000000.00000000.00000001

Tugriceri Web Notes

Operational telemetry, Linux internals, forensic carving, and infrastructure automation war stories. by Emre Tugriceri.

88 Field Runbooks 30 System Taxonomies Archive: 2013 – 2026 SYS_HEALTH: OPTIMAL
Emre Tugriceri • • 1 min read
Linux Security StrongSwan

StrongSwan and Android configs

root@six #cat ipsec.conf conn tugriceri.com leftsubnet=0.0.0.0/0 left=209.208.63.204 leftcert=/cert/strongswan.pem leftauth=pubkey leftsendcert=yes leftid=six.tugriceri.com right=%any rightid=%any rightsourceip=10.0.5.0/24 rightauth=eap-mschapv2 rightsendcert=never eap_identity=%any auto=add root@six #cat ipsec.secrets # strongSwan IPsec secrets file : RSA /cert/strongswan.key six.tugriceri.com : RSA /cert/strongswan.key testuser : EAP "secretpass" root@six #cat openssl-req.cfg [req] req_extensions = v3_req distinguished_name = req_distinguished_name prompt = no

[ v3_req ]

Extensions to add to a certificate request

#keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = “DNS:six.tugriceri.com,DNS:www.tugriceri.com,IP:209.208.63.204,DNS:tugriceri.com” #subjectAltName = @alt_names

Comments (0) Read Playbook →
Emre Tugriceri • • 1 min read
HTTP

libgcc_s.so.1 must be installed for pthread_cancel to work

If you are trying to use the chroot feature with a multithreaded Apache installation you may get the folllowing message "libgcc_s.so.1 must be installed for pthread_cancel to
work". Add LoadFile /lib/libgcc_s.so.1 to your Apache configuration to fix this problem.



Comments (0) Read Playbook →
Emre Tugriceri • • 1 min read
DRBD

DRBD configuration with loop file

dd if=/dev/zero of=disk1.raw bs=1073741824 count=20
1009 losetup -f disk1.raw
1010 losetup -a
1012 stat /dev/loop0
fdisk /dev/loop0
# rpm -Uvh http://elrepo.org/elrepo-release-6-4.el6.elrepo.noarch.rpm

# vi /etc/yum.repos.d/elrepo.repo

enabled=0

# yum --enablerepo=elrepo install drbd83-utils kmod-drbd83

SRV1# cat /etc/drbd.conf
#
# please have a a look at the example configuration file in
# /usr/share/doc/drbd83/drbd.conf
#
global {
minor-count 1;
usage-count no; # Participate in DRBD's online usage counter at http://usage.drbd.org
}

resource zenoss {
protocol C;
startup {
wfc-timeout 30;
degr-wfc-timeout 60;
}
disk {
on-io-error detach;
fencing resource-only;
}
handlers {
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt -f"; # reboot the system after a connection fail
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt -f";
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater";
}
net {
after-sb-0pri discard-least-changes; # Self healing if split brean
after-sb-1pri call-pri-lost-after-sb;
max-buffers 2048; # datablock buffers used before writing to disk.
ko-count 4; # Peer is dead if this count is exceeded.
}
syncer {
rate 12M;
al-extents 257;
}
on SRV1 {
device /dev/drbd0;
disk /dev/loop0;
address 192.168.1.1:7789;
meta-disk internal;
}
on SRV2 {
device /dev/drbd0;
disk /dev/loop0;
address 192.168.1.2:7789;
meta-disk internal;
}
}


SRV1# cat /proc/drbd
SRV1# drbdsetup /dev/drbd0 primary -o
SRV1# cat /proc/drbd
SRV1# mkfs -t ext3 /dev/drbd0
SRV1# mkdir /mnt/drbd
SRV1# mount /dev/drbd0 /mnt/drbd
SRV1# cp /var/log/maillog /mnt/drbd
SRV1# ls /mnt/drbd

SRV1# umount /mnt/drbd
SRV1# drbdadm secondary zenoss


SRV2# drbdadm primary zenoss
SRV2# mkdir /mnt/drbd
SRV2# mount /dev/drbd0 /mnt/drbd
SRV2# ls /mnt/drbd

Comments (0) Read Playbook →
Emre Tugriceri • • 1 min read
PHP

PHP 5.4 memcache

In file included from /usr/local/memcache-3.0.6/memcache.c:30:
/usr/local/memcache-3.0.6/php_memcache.h:75:1: warning: "IS_CALLABLE" redefined
In file included from /usr/local/php/include/php/main/php.h:34,
from /usr/local/memcache-3.0.6/memcache.c:26:
/usr/local/php/include/php/Zend/zend.h:576:1: warning: this is the location of the previous definition
/usr/local/memcache-3.0.6/memcache.c: In function ‘mmc_find_persistent’:
/usr/local/memcache-3.0.6/memcache.c:721: error: too few arguments to function ‘zend_list_insert’
/usr/local/memcache-3.0.6/memcache.c:738: error: too few arguments to function ‘zend_list_insert’
/usr/local/memcache-3.0.6/memcache.c: In function ‘php_mmc_pool_addserver’:
/usr/local/memcache-3.0.6/memcache.c:778: error: too few arguments to function ‘zend_list_insert’
/usr/local/memcache-3.0.6/memcache.c: In function ‘php_mmc_connect’:
/usr/local/memcache-3.0.6/memcache.c:839: error: too few arguments to function ‘zend_list_insert’
make: *** [memcache.lo] Error 1


https://407441.bugs.gentoo.org/attachment.cgi?id=304865


Comments (0) Read Playbook →
Emre Tugriceri • • 1 min read
LVM

Resize LV 2

e2fsck -f /dev/mapper/VGeva-datavol0
fdisk /dev/mpath4 #Delete partition and then add again
pvresize /dev/mapper/mpath4p1
lvextend -r -L749.9G /dev/mapper/VGeva-datavol0

Comments (0) Read Playbook →
Emre Tugriceri • • 2 min read
SELinux

NFSEN SELinux Permission

Summary:

SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files
/var/local/nfsen/var/run/nfsen.comm.

Detailed Description:

SELinux has denied the httpd access to potentially mislabeled files
/var/local/nfsen/var/run/nfsen.comm. This means that SELinux will not allow
httpd to use these files. If httpd should be allowed this access to these files
you should change the file context to one of the following types,
lsassd_var_socket_t, abrt_var_run_t, httpd_tmpfs_t, setrans_var_run_t,
avahi_var_run_t, mysqld_var_run_t, httpd_var_run_t, nscd_var_run_t,
nslcd_var_run_t, slapd_var_run_t, sssd_var_lib_t, mysqld_db_t,
system_dbusd_var_run_t, postgresql_var_run_t, winbind_var_run_t,
postgresql_tmp_t, devlog_t, httpd_cobbler_rw_content_t,
httpd_munin_rw_content_t, httpd_bugzilla_rw_content_t, httpd_cvs_rw_content_t,
httpd_git_rw_content_t, httpd_sys_rw_content_t, httpd_nagios_rw_content_t,
httpd_nutups_cgi_rw_content_t, httpd_squid_rw_content_t, nscd_var_run_t,
pcscd_var_run_t, httpd_smokeping_cgi_rw_content_t,
httpd_apcupsd_cgi_rw_content_t, httpd_prewikka_rw_content_t,
httpd_awstats_rw_content_t, httpd_w3c_validator_rw_content_t,
httpd_user_rw_content_t. Many third party apps install html files in directories
that SELinux policy cannot predict. These directories have to be labeled with a
file context which httpd can access.

Allowing Access:

If you want to change the file context of /var/local/nfsen/var/run/nfsen.comm so
that the httpd daemon can access it, you need to execute it using semanage
fcontext -a -t FILE_TYPE '/var/local/nfsen/var/run/nfsen.comm'.
where FILE_TYPE is one of the following: lsassd_var_socket_t, abrt_var_run_t,
httpd_tmpfs_t, setrans_var_run_t, avahi_var_run_t, mysqld_var_run_t,
httpd_var_run_t, nscd_var_run_t, nslcd_var_run_t, slapd_var_run_t,
sssd_var_lib_t, mysqld_db_t, system_dbusd_var_run_t, postgresql_var_run_t,
winbind_var_run_t, postgresql_tmp_t, devlog_t, httpd_cobbler_rw_content_t,
httpd_munin_rw_content_t, httpd_bugzilla_rw_content_t, httpd_cvs_rw_content_t,
httpd_git_rw_content_t, httpd_sys_rw_content_t, httpd_nagios_rw_content_t,
httpd_nutups_cgi_rw_content_t, httpd_squid_rw_content_t, nscd_var_run_t,
pcscd_var_run_t, httpd_smokeping_cgi_rw_content_t,
httpd_apcupsd_cgi_rw_content_t, httpd_prewikka_rw_content_t,
httpd_awstats_rw_content_t, httpd_w3c_validator_rw_content_t,
httpd_user_rw_content_t. You can look at the httpd_selinux man page for
additional information.

Additional Information:

Source Context unconfined_u:system_r:httpd_t:s0
Target Context system_u:object_r:var_t:s0
Target Objects /var/local/nfsen/var/run/nfsen.comm [ sock_file ]
Source httpd
Source Path /usr/sbin/httpd
Port
Host
Source RPM Packages httpd-2.2.15-5.el6.centos
Target RPM Packages
Policy RPM selinux-policy-3.7.19-54.el6_0.5
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name httpd_bad_labels
Host Name csn.tugriceri.com
Platform Linux csn.tugriceri.com
2.6.32-71.29.1.el6.x86_64 #1 SMP Mon Jun 27
19:49:27 BST 2011 x86_64 x86_64
Alert Count 8
First Seen Tue Mar 6 14:02:04 2012
Last Seen Tue Mar 6 14:38:35 2012
Local ID 8433f07d-91df-46a0-ba75-5228a1a1180a
Line Numbers 7, 8, 43, 44, 75, 76, 87, 88, 119, 120, 155, 156,
251, 252, 257, 258

Raw Audit Messages

type=AVC msg=audit(1331037515.880:4652026): avc: denied { write } for pid=4402 comm="httpd" name="nfsen.comm" dev=dm-2 ino=23992283 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=sock_file

type=SYSCALL msg=audit(1331037515.880:4652026): arch=c000003e syscall=42 success=no exit=-13 a0=1a a1=7fffd0623350 a2=25 a3=632e6e6573666e2f items=0 ppid=4398 pid=4402 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=236800 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)





[root@legion ~]# grep httpd /var/log/audit/audit.log | audit2allow -M tugriceri_http
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i tugriceri_http.pp


Comments (0) Read Playbook →
Emre Tugriceri • • 1 min read
Uncategorized

Failed to open "/var/lib/dbus/machine-id"

process 16780: D-Bus library appears to be incorrectly set up; failed to read machine uuid: Failed to open "/var/lib/dbus/machine-id": No such file or directory
See the manual page for dbus-uuidgen to correct this issue.
D-Bus not built with -rdynamic so unable to print a backtrace
Aborted


dbus-uuidgen > /var/lib/dbus/machine-id



Comments (0) Read Playbook →
HOST: DETECTING...
© 2026 Tugriceri Web Notes Emre Tugriceri