Gnome 3 Super key focus

Running Windows guest in a VirtualBox session can be complicated when the host is Gnome 3.

The "windows / superkey" keyboard shortcut is mapped strictly to the host, so the guest never catches it.  How do you then use the "windows" key in a Windows guest?

There are two very simple options:

1) If your keyboard has two "Windows" key, then the one on the right is not mapped to the Gnome 3 host by default.  It will be passed to the windows guest.

2) If you don't have two "Windows" keys, then you can use the windows key combination: Left Ctrl+Esc

The windows guest will interpret it as the "Windows" key.

Resolve IPs from list of domains

A command to resolve IPs from a list of domains, without impacting a DNS server too much.

I needed to resolve the IPs for a list of 900+ domains and didn't want to impact our DNS servers too much, so I improved on commands and suggestions that I found online; in particular a command from user alanwilliamson on http://www.commandlinefu.com/commands/view/3066/resolve-a-list-of-domain-names-to-ip-addresses

list2.txt is a simple text file with a domain per line.

$ awk < list2.txt '{ while( ("resolveip -s " $1 " 2>/dev/null; sleep 1;" | getline tmp ) > 0){ print $1 "," tmp} }'

For a given list of:

domain1.com
domain2.com
www.domain3.com
The output would look like: 

domain1.com,xxx.xxx.xxx.xxx
domain2.com,xxx.xxx.xxx.xx2
www.domain3.com,xxx.xxx.xxx.xx3

A slightly improved version which times the command, outputs to a file and flushes the buffer immediately so that the following "tail" command will be in real-time. 

$ time awk < list.txt '{ while( ("resolveip -s " $1 " 2>/dev/null; sleep 1;" | getline tmp ) > 0){ print $1 "," tmp; fflush(stdout) } }' > report.txt

You can then watch the growth of report.txt or set a tail -f on it to watch the progress:

$ tail -f ./report.txt 

Format XML with Gedit and xmllint

A very simple technique to format (beautify) xml using xmllint and gedit.

Gedit allows you to create plugins (external tools) which can act upon the current document.

Make sure xmllint is installed on your system.

1) Open gedit

2) Edit->Preferences->Plugins:  Check the "External Tools" box and close.

3) Tools->Manage External Tools

4) Click on the "new" button which looks like a plus in the bottom left corner of the window.

5) Insert a name for this plugin, "FormatXML" for example, then press enter.

6) Insert the following code in the "edit" portion of the screen:

#!/bin/sh
xmllint --format /dev/stdin

7) Set the "Input" menu to "Current document" and "Output" menu to "Replace current document".  Close the "manage external tools" window.

Now, you can paste or type unformatted XML.

And simply click on Tools->External Tools->FormatXML to format it properly.

Apache control on RedHat 7

As RedHat 7 is rolled out, the standard method to control Apache has been changed:  It seems RedHat is now favouring the original apachectl command; and this is probably a good thing as it lines up well with other distributions.

See the RHEL 7 docs: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Web_Servers.html

Systemctl is still used to start, stop, enable and disable the service (and more), however configuration testing, graceful restarts, have all been restituted to apachectl.  NOTE: apachectl was always available under RedHat, since it is part of the Apache package, but it was not the RHEL recommended way to control it.

For example:

# service httpd graceful

is replaced by:

# apachectl graceful

Or,

# service httpd configtest

is replaced by

# apachectl configtest

Mapping a VMWARE SCSI device to its Linux OS device

In VMWARE, you can see your SCSI channel and ID number in the Virtual Machine's Properties window under "Hardware": 



Once you have this information, you can then start determining where it is being used by your system either as /dev/ or an LVM physical volume.

Check the attached SCSI devices on linux:

[root@<server> ~]# cat /proc/scsi/scsi
Attached devices:
Host: scsi1 Channel: 00 Id: 00 Lun: 00
  Vendor: NECVMWar Model: VMware IDE CDR10 Rev: 1.00
  Type:   CD-ROM                           ANSI  SCSI revision: 05
Host: scsi2 Channel: 00 Id: 00 Lun: 00
  Vendor: VMware   Model: Virtual disk     Rev: 1.0
  Type:   Direct-Access                    ANSI  SCSI revision: 02
Host: scsi2 Channel: 00 Id: 01 Lun: 00
  Vendor: VMware   Model: Virtual disk     Rev: 1.0
  Type:   Direct-Access                    ANSI  SCSI revision: 02
Host: scsi2 Channel: 00 Id: 02 Lun: 00
  Vendor: VMware   Model: Virtual disk     Rev: 1.0
  Type:   Direct-Access                    ANSI  SCSI revision: 02
Host: scsi2 Channel: 00 Id: 03 Lun: 00
  Vendor: VMware   Model: Virtual disk     Rev: 1.0
  Type:   Direct-Access                    ANSI  SCSI revision: 02

And finally you can co-relate that with the OS's own mapping:

[root@<server> ~]# ll /sys/bus/scsi/drivers/sd/2\:0\:3\:0/block/
total 0
drwxr-xr-x. 8 root root 0 Nov 19 15:10 sdd

This means that the SCSI device on Channel 00 ID 03 maps to /dev/sdd

Zabbix agent and Selinux

UPDATED (Aug 1, 2017 - yes very late): RedHat released an errata in October 2014 which resolves this problem: https://access.redhat.com/errata/RHBA-2014:1568

-- Original Post --

Recently, certain versions of SeLinux and the Zabbix Agent are having a  hard time working together.  Some of the Zabbix discovery processes are failing as they are being blocked by SeLinux.

More details are available at RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=1032691

Since I use both systems quite a bit, I needed to find a simple solution rather quickly.  (I probably wouldn't recommend this solution for extremely high security systems.  On the other hand, it does allow me to monitor systems which need to be continously available.)  I added the Zabbix process type to the SeLinux permissive list.  This can be done very easily by issuing the following commands:

First, you will need to be certain you know which process type zabbix-agent is running as on your system:

$ sudo ps -eZ | grep zabbix
...
unconfined_u:system_r:zabbix_agent_t:s0 7848 ? 00:00:00 zabbix_agentd
...

Next, we will add this type to the permissive list:

$ sudo semanage permissive -a zabbix_agent_t

Finally, we can check that we did this correctly:

$ sudo semanage permissive -l
...
Customized Permissive Types

zabbix_agent_t

You will have seen a list of all the permissive types go by and finally the customized premissive types - with yours in it.

Once Zabbix or RedHat issues a fix, you can remove the permissive type by running the same command with the -d option instead of -a.

$ sudo semanage permissive -d zabbix_agent_t

Hopefully a proper solution will be available soon.  Interestingly, just after posting this, I found that another blogger had a published almost exactly the same article:
http://inboundtraffic.net/selinux-permissive-domain/

Oh well - two similar articles can't hurt.

Enabling the talk daemon on Fedora 20

well, it's been a few years and as technology changes, so does the methods used to configure a system.

I still use the talk program on a regular basis.  Here are the instructions for enabling it:

# yum install xinetd talk-server talk

# systemctl enable xinetd.service
# systemctl enable ntalk.service

At this poing, simply starting the xinetd and ntalk services does not seem to allow the talk program to function.  At the moment, the only solution I had was to reboot the system.  If someone has a better way, I would very much like to know.

# reboot

Talk should now work.  However, there is a chance that SELinux will deny it.  Check your logs:

# grep -i denied /var/log/audit/audit.log

If you do get a denial you will need to build a new policy.  Make sure you have the following utility installed: checkpolicy

# yum install checkpolicy

# grep in.ntalkd /var/log/audit/audit.log | audit2allow -M mypol

# semodule -i mypol.pp

That's it.

Block access to files by IP using X-Forwarded-For

What is the purpose of blocking by X-Forwarded-For IP, instead of the REMOTE_ADDR?

Sometimes a site may be behind a reverse proxy and it may not be possible to add a rule to block a file by IP at the reverse proxy level.  If the reverse proxy is passing the remote client IP in a header like X-Forwarded-For, you can still block by client IP.

Match the header to an IP address and assign it to an environment variable in Apache.  Here is an example of a complete configuration to block remote access to a wordpress login page, except for a certain range of IPs:

<files wp-login.php>
order deny,allow
deny from all
SetEnvIf X-Forwarded-For "192\.168\..*" LocalAccess
SetEnvIf X-Forwarded-For "10\..*" LocalAccess
Allow from env=LocalAccess
</files>

If the IP contained in the X-Forwarded-For header matches one of the regular expressions, it will populate the "LocalAccess" environment variable.