centos – The Blog of Nitin J Mutkawoa, AKA @TheTunnelix

Tag: centos

Deploy AWS EC2 instances using Ansible

10/18/2019 Nitin J Mutkawoa Add Comment

We have seen in the past how to use Terraform to deploy AWS EC2 instance. But, this is also possible using Ansible. In this blog post, we will focus on the deployment of AWS EC2 instance using Ansible. I assume that you have already been to the basics installation of Ansible and basic playbook creation. Here are some links on tunnelix.com on Ansible. Please consider visiting them if you have any doubt. I assume that you have already install Ansible on your machine and know the basics of Ansible Playbook creation.

Setup the AWS IAM Account

1. Start by creating an AWS user account through the AWS IAM. Go to IAM, then click on USER, then click on ADD USER:

2. Once you have click on the ADD USER, Enter a name and tick on PROGRAMMATIC ACCESS, click on NEXT: PERMISSIONS

3. On the following page, Create a group, I have created one called ‘Ansible’ then attached the user to the group. After that click on ATTACH EXISTING POLICIES DIRECTLY’, then search for AMAZONEC2FULLACCESS and tick it and click on NEXT: TAGS.

4. Click on Next, add the tags and click on ‘CREATE USER’.

5. Consider downloading the credential.csv file by clicking on Download .csv

6. Consider also creating a key pair

Some installations and configurations on the Ansible controller

7. Now, on your Linux controller, we will need some Python modules to interact with AWS. Assuming you have already installed Ansible, consider installing python-pip:

yum install python-pip

8. Let’s now install the AWS CLI

yum install awscli

9. Sync the clock of the VM to prevent any error

hwclock -s

10. Configure your AWS CLI

aws configure

It will prompt you to enter the AWS Access Key ID, secret key, etc. Just enter the information. Example:

[[email protected] ~]# aws configure

AWS Access Key ID [****************GYGY]: AKIA5xxxxxxxxxx
AWS Secret Access Key [****************458q]: EvEd55xxxxxxxxxx
Default region name [us-east-1]:
Default output format [json]:

11. Create the following file: /home/.boto

[Credentials]
aws_access_key_id = AKIAxxxxxxxxxxxxx
aws_secret_access_key = xc3xxxxxxxxxxx

12. The following command should test your AWS credentials

aws get sts-caller-identity

13. Install the boto Python module. The boto python module will talk with the AWS CLI to authenticate on aws.

pip install boto

Creating the Playbook and Deploying the AWS EC2 Instance

14. Now, let’s create a playbook as follows in /home/AWSTask.yml

- name: EC2 Instance creation
  hosts: localhost
  connection: local
  tasks:
  - name: Launching the EC2 instance
    ec2: 
      instance_type: t2.nano
      key_name: ansible
      image: ami-0b69ea66ff7391e80
      region: us-east-1
      group: default
      count: 1
      vpc_subnet_id: subnet-ef9179a4
      wait: yes
      assign_public_ip: yes

You can also access it on my Ansible Github repository.

15. Simply launch the Playbook

ansible-playbook AWSTask.yml

16. As you can see below, the EC2 instance has been created.

Linux Application, Scripts and codes Ansible, AWS, centos, DevOps, linux

Diving into the basics of IPv6

04/21/2019 Nitin J Mutkawoa 2 Comments

The Internet is growing. In case you are not on IPv6, for sure one day, you might need to migrate from IPv4 to IPv6. Now what kind of methodology you would apply whether a dual stack or a direct changeover depends upon a rigid observation and analysis of the network infrastructure. But, it should no more be taken as a complexity. Since a few years, many companies, government bodies, ISPs, and others are moving towards IPv6. Some are adopting dual stack. IPv6 can be said to be version 2 of the Internet. In this blog post, I will make my best to shed some basics and simple way to understand the features and benefits when using IPv6. I will also contrast it with IPv4. For research purpose, I have perused several books and blogs over the Internet and, same are referenced below. One of the challenges in Africa is to enable the smooth transition to IPv6. Whilst others are doing dual stack, others have successfully migrated the whole network infrastructure to IPv6. IPv4 has been created in the early ’80s. The Internet growth which is so huge and it will definitely need to move ahead with modern technology IPv6 running at its core. I had always admired one of the modern futurist physicist, Dr. Michio Kaku who said that “In the future, the Internet might become a brain“.

So why do we really need IPv6?

Besides, from the growth of the Internet and the scarcity of IPv4 addresses, we all knew that in IPv4, the network has been divided into two parts which are the Private IPs and the Public IPs allocation. And, those two segments which are Interconnected required NAT configuration. This breaks the contiguous of the Internet. Another reason is that there is no security in IPv4 at its core. Of course, there are other strategies to secure an IPv4 network. When it comes to data prioritization, it cannot be done at the core of IPv4 which means that there is not much of Quality of Service (QoS). In IPv4, we can configure or assigned an IP to a device or simply use an address configuration mechanism such as DHCP. But, the moment DHCP is down, we land into a problem. Here is the catch, this means that there is no way to make a device to be assigned a globally unique address. So, that’s why we need IPv6. Well, wait… What happened to IPv5 ? and what about IPv1, IPv2, and IPv3?

What happened to IPv1, IPv2, IPv3, and IPv5?

Have a look at the diagram below which makes it pretty easy to understand:

So, IPv0, IPv1, IPv2, and IPv3 were used in the development testing phase. Ipv5 was used while doing the Stream experimentation of the Internet.

Features of IPv6

There is no backward compatibility when using IPv6, but, the basic functions remain the same, and the features have been changed completely. Since IPv4 is a 32-bit address and IPv6 is a 128-bit address, just imagine how much bigger it is. When compared to an IPv4 address bit, IPv6 has four times more bits. We can say that there are more than 1500 IP addresses per square meter on earth.

Another feature of the IPv6 is about the header which is twice the size of IPv4.

In IPv6, there is also end-to-end connectivity which means that NAT is not required for the continuity of the Internet. Every host can reach another host over the Internet.

Other features are “auto-configuration” which can be either stateful or stateless. Stateless is a mechanism that does not require any intermediate support in the form of DHCP for IP assignment whereas Stateful serves IP addresses from a pool. Also to take into consideration is “faster routing”. In IPv6, the routing information is stored in the first part of the header which makes routing decisions faster by the router. Another feature is IPSec (IP Security). It creates an end-to-end tunnel between the source and the target though it is optional. “No Broadcast” is another feature within IPv6. Using an IPv4 network, you will notice during the IP Address configuration, the clients need to broadcast to the DHCP. In IPv6, the client doesn’t need to broadcast and instead will multicast to communicate with machines over the network. It is important to understand the difference between ‘broadcast’ (one-to-all) and ‘multicast'(one-to-many). In broadcast, clients will send messages to all hosts on the network, whereas in multicast, messages are sent to a group of stations. This allows the building of distribution networks where group management is required. IPv6 does not limits itself to multicast but also bring the ‘unicast’ (one-to-one) feature. This is used especially between routers which need to communicate to a specific router. However, if you have several routers nearby and you can choose any routers for communication, let’s say for a CDN purpose, we can use the anycast method to process efficiency packet routing.

Photo Credits: techiemaster.wordpress.com

Reading IPv6 addressing

Now, that you have grasped the basic concepts of IPv6 and why we need it, let’s see how to read IPv6. An IPv6 address is made up of 128-bits divided into 16-bits blocks. Each block is then converted into 4-digits hexadecimal numbers separated by colon symbol. For example, this is an IPv6 address in binary:

0010011000000110 0100011100000000 0000000000110000 0000000000000000 0000000000000000 0000000000000000 0110100000010010 0010100001100000

Since we have three series of zeros, it can be escaped between the two colons symbols. Leading zeros in the third block will result in 30. In case, you had one block of zeros, use one zero in the hexadecimal IP address. When converted to hexadecimal it is:

2606:4700:30::6812:2860

Let’s get into more details. There are two rules when reading an IPv6 address.

Rule1: Leading zeros should be discarded. As we can see in the 3rd block of the IPv6 address above i.e; 0000000000110000 when converted it is written as 30, because it can be read as 110000. Here is a video on how to convert Binary to Hexadecimal.

[yotuwp type=”videos” id=”tSLKOKGQq0Y” ]

Rule2: If two or more blocks contain consecutive zeros, omit them all and replace by double colons signs. Example the three blocks of zeros in purple above have been replaced as “::“, However, if there is a single block of zero, use 0 in the IPv6 address.

Assignment of IPv6 address

Similar to IPv4, we need to understand how to identify the number of networks and hosts in IPv6. Let’s take an example from a generic unicast address which uses 64-bits as network ID and 64-bits as hosts ID. Please note from the picture below the 64-bits in the network has been shared in three distinctive fields in the IPv6 packet structure.

At this stage, it should be clear how a generic unicast address has been designed. Now, another important point is the IPv6 address scope. A scope is a region where an IPv6 address can be defined as a unique identifier of a network interface. As we can see below, there are three scopes, Global Unicast Address, Unique Local, and Link Local.

Photo Credits: steves-internet-guide.com

The Global Unicast Address is routed and is reachable across the Internet. Also. the prefix for global routing prefix in IPv6 has been assigned by the Internet Assigned Number Authority – IANA, so that by only looking at the prefix of an IPv6 address, you can determine if its global or not. In the picture below, you can see the first 3 bits within the global prefix. Remember, that this is unique globally.

Then, comes the Site level aggregator – SLA which is the subnet ID assigned to the customer by the service provider. This follows by the LAN id that is used by the customer and is free to manipulate. This address is globally unique.

Let’s take a look at a Unique Local Unicast Address. It looks like private IP addresses and is used for local communication intersite usually in a LAN and for VPN purpose. It is not routable on the Internet.

The last one is the link local unicast address. This is used for communication between two IPv6 devices on the same link. By default, it is automatically assigned by the device as soon as IPv6 is enabled, and it is not routable. These types of IP addresses are identified by the first 10-bits of the address, i.e; FE80.

In this blog post, I took an example from only Unicast addresses. Remember, there are also Multicast and Anycast address ranges. Let’s now create some servers and perform some IPv6 configurations.

Goodbye IPv4 and, say Hello to IPv6

I created a CentOS7 machine on my VirtualBox. As you can see, the interface card enp0s8 have the IP Address 192.168.100.9 as well as fe80::9ef3:b9d3:8b87:4940. Remember, the fe80 is the Link Local Address.

You can also see the connection using the following command:

To create a connection using nmcli use the following command and check back the connection. You will notice that the connection has been created without any device attached to it.

I am now modifying ipv6-tunnelix and attached it to enp0s9. I will also assign it to an IPv6 address. (For learning and testing purpose, this IPv6 address has not been assigned to me, it’s that of Facebook’s public IPv6)

As you can see, the address has been assigned. But remember, same as you can assign a public IPv4 address on a virtual machine, you will need to route it for connectivity. In this example, I took an example of Facebook public IP Address.

Are your blog’s IPv6 ready?

In 2016, during migration on Cloudflare, tunnelix.com became dual stack i.e; both compatible for IPv4 and IPv6. You can test any website for IPv6 support at this link.

https://ipv6-test.com

Certifications

Getting certified on IPv6 is really interesting as it can demonstrate comprehensibility. You can participate in free IPv6 training and get certified from Hurricane Electric. It is important to read the IPv6 primer.

There is also a service from Hurricane Electric, called Tunnel Broker which can facilitate you for creating a tunnel from your IPv4 static IP address to free IPv6 tunnels. In future blog posts on IPv6, I will get into more details about it. If you like the article, please comment, and share.

Sources:

Networking, Security centos, CloudComputing, IPv6, linux, VirtualBox

Recover logical volumes data from deleted LVM partition

04/18/2019 Nitin J Mutkawoa Add Comment

Have you ever deleted a logical volume by accident? Can you recover it looking into the backups? Well, the answer is YES. For those who are not familiar with Logical Volume Management (LVM) is a device mapper target that provides logical volume management for the Linux kernel.- Wikipedia. It is an abstraction layer or software that has been placed on top of your hard drive for flexible manipulation of the disk space. Some of the articles published in the past on LVM are:

All test carried out on this blog post have been tested on a CentOS machine. Please don’t make a live test on a production server.

1. So, as you can see below I have an lv called lvopt which is from a vg called centos.

2. Same is mounted on the /opt

3. There are some data in that partition as well:

4. I created a directory inside the /opt directory

5. Now, let’s pretend to remove the lvm lvopt. Or say, someone did it by accident because it was unmounted. The command lvremove will be used here to remove the lv. Note: that the lv need to be unmounted.

6. If you make an lvs, lvdisplay or vgs or even mount again the partition, you cannot do it. The data is lost. But you can still recover it. This is because the lvm contains the archive of your lv inside the folder /etc/lvm/archive. But, you cannot read the files directly.

7. But you can still, interpret part of the files. Since we deleted the volume group called “centos”, we knew that it is referenced in the file centos_… The question that arises here is which file is relevant for you. Right? So to understand which archive you want to restore, you need to use the command vgcfgrestore –list <name of volume group>. Here is an example:

8. If you observe carefully, each archive has been backup at a certain time. In my case, I deleted the LV on 18-Apr-2019 at 11:17:17 2019:

9. So, I want to restore from that last archive. You will need to copy the full patch of the vg file. In my case it is /etc/lvm/archive/centos_00004-1870674349.vg. The goal here is to restore the lv before this specific time, or simply restore back the lv before the command lvremove was fired. Here is the command:

10. If you launch the command lvs, you will notice the presence of the lv.

11. But, mounting back the lv won’t result in anything. This is because the lv is inactive. You can see it with the command lvscan. Please take note below that the lvopt is inactive.

12. To activate it you simply need to use the command lvchange.

13. Mount it back and you are done.

I believe this can be very useful especially when you have encountered a situation where someone deleted an lv. I hope you enjoy this blog post. Please share and comment below if you like it.

Linux Application, Linux System centos, linux, lvm

Installing the Networker Management Console (NMC) on CentOS 7

01/31/2019 Nitin J Mutkawoa Add Comment

In the last article, we have seen how to install Dell EMC Networker on CentOS7. There have been some issues with dependencies. In this article, I will install the Networker Management Console on the same server. Prior before installing, we will see the services running when the networker services have been started. Then, I will compare if after installation of the NMC.

Before proceeding to installation, the packages that I will install is :

lgtonmc (Networker Management Console) – Gives you the ability to access the Management Interface or Management console to manage backups.

1. The services running before the installation is as indicated in the screenshot below:

2. In the previous article, I downloaded all the packages. From the directory, I have installed the NMC using the RPM command followed with the execution of the script /opt/lgtonmc/bin/nmc_config. You will be prompted to answer a few questions for the installation. I selected the default answer except to the creation of user for the PostgreSQL database.

3. Now, we can see a bunch of new services is running such as more Java processes and PostgreSQL.

4. Since we installed the NMC on the VM, we should be able to access the console on the same network on the port 9000. My VM is actually configured with the IPAddress 192.168.100.19 and by accessing it on port 9000 will now show me the console.

5. As you can notice on the screenshot above I don’t have Java Runtime enabled on the Mac. So I had to install and enable it. Follow the instructions for the installation by clicking on “Browser, OS, & JRE Requirements”.

6. Once installed and activated, you should be able to access the console by clicking on “Click here to start Management Console”. The prompt to enter username/password should then appear.

The default username is Administrator and password is the one you have set when installing Networker.

7. Follow the instructions to set up the database backup server, authentication server etc.. and at the end, you should be able to reach the console.

Linux Application, Linux System centos, DELL EMC Networker

Installing EMC Dell Networker 9 on CentOS 7

01/30/2019 Nitin J Mutkawoa Add Comment

Its been since some days, I attended a training on EMC Dell Networker 9 in Mauritius itself. Though not everything can be covered in the training such as the installation of the networker on Linux machines, I decided to install it myself on my lab.

For those who are not familiar with Networker 9 formerly called Legato NetWorker is an “enterprise-level data protection software product that unifies and automates backup to tape, disk-based, and flash-based storage media across physical and virtual environments for granular and disaster recovery.”. To install it, I created a Centos 7 minimal installation lab on virtual box, made an update and install some few packages such as vim, tcpdump, net-tools, traceroute, epel-repo, locate, atop, htop and wget. These are basic packages for my own use on the VM. It has nothing to do with the Networker installation.

To be able to download the necessary packages, it’s a prerequisite to register on the EMC Dell website first. Once authenticated, you can move on to the download section of the packages. Dell will provide you in a tar.gz all packages for Debian and RHEL as well. Even Avamar packages will be found there. So, you will need to install only the necessary packages. Follow the instructions below after registration on the Dell website and download of the packages and the links highlighted. Once the file has been downloaded and decompressed, you will notice several RPMs and DEBs inside. The one which will be needed for the networker installation are as follows:

lgtoclnt (Networker client) – Provides you the ability to perform file system backup and recovery options.

lgtoxtdclnt (Networker Extended client) – Provides additional feature support for NetWorker clients, such as snapshot backup support, command line utility support including server reporting and administration, cloning and staging support, and so on.

lgtonode (Networker Storage Node) – Provides features for the storage node which will control storage devices such as tape drives, disk devices, autochangers, and silos.

lgtoserv (Networker Server) – Provides you the web server of the Networker portal.

lgtoauthc (Networker Authentication Service) – Authentication layer used for the backup purpose.

lgtoman (Networker Manual) – Its important for the manual. However, it’s not a prerequisite.

Whilst installing these packages, you will notice dependencies problems. See the “Tips” section below for more information. I had to install the Glibc 32-bit package as some of the networker packages might depend on them.

Here is an idea what error message { libc.so.6 is needed by lgtoclnt-9.1.1.7-1.x86_64 } you may have while performing the installation.

This can be confirmed by a yum whatprovides libc.so.6 which is found inside glibc.i686 package

1. At this point, to continue on with the installation I made the following steps:

yum install glibc-2.17-260.el7.i686

rpm -ivh lgtoclnt*.rpm lgtoxtdclnt*.rpm lgtonode*.rpm lgtoserv*.rpm lgtoauth*.rpm lgtoman*.rpm

2. If you are installing the package one by one, you will need to install lgtoauth first before installing lgtoserv. After installation of lgtoauth, it will prompt you to launch the following script:

/opt/nsr/authc-server/scripts/authc_configure.sh

3. It will prompt you where to specify where you have installed the Java Runtime. At the time, I’m writing this article, I’m using Java Runtime 8 from the oracle.com website. Use the following syntax to download it from wget.

wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "https://download.oracle.com/otn-pub/java/jdk/8u202-b08/1961070e4c9b4e26a04e7f5a083f551e/jre-8u202-linux-x64.rpm"

4. Once, downloaded and installed, java -version should provide you the runtime environment.

5. Now, you can launch the script /opt/nsr/authc-server/scripts/authc_configure.sh anew and it will prompt you to enter the key store and administrator passwords.

6. Once the installation is complete, you can now run the /etc/init.d/networker daemon and check the process running.

Tips:

The problem is that the GLIBC2.0 symbol is not provided by the x86-64 Libc on CentOS, but it is provided by the 32-bit i686 package. There is no real dependency of the EMC NetWorker 9.1 package on the 32-bit library, but this is probably a false dependency RPM problem. So it is necessary to download the following 32-bit packages from the CentOS website and install them.

If you have installed the JAVA elsewhere, you will need to specify the path launch executing the script /opt/nsr/authc-server/scripts/authc_configure.sh

The installation logs are found at /opt/nsr/authc-server/logs/install.log.

For testing purpose, I deactivated firewalld and disable SELinux.

Linux Application, Linux System centos, DELL EMC Networker