Linuxtechi

How to Install GitLab on Debian 10 (Buster)

Mon, 18 Jan 2021 02:45:47 GMT

GitLab is a free and opensource front-end Git repository that features a Wiki and an issue tracking feature. It allows you to host Git repositories on your own server and setup DevOps platform. In this guide, we are going to install GitLab CE (Community Edition) on Debian 10 (Buster) system.

Prerequisites

Before getting started, ensure that you have the following in place:

An instance of Debian 10 server with SSH access.
Minimum of 8 GB RAM
20GB of hard disk space
A valid domain name pointed to the IP address of the server.
User with sudo rights

Let’s get started with installing GitLab on Debian 10 (Buster).

Step 1) Update the System

To get started, access your Debian server using SSH as a sudo user and invoke the following command to update the package lists on your system.

$ sudo apt update

Step 2) Install GitLab dependencies

Once the update is done, install the prerequisites required as shown below.

$ sudo apt install ca-certificates curl openssh-server postfix

For the Postfix mail server, ensure that you select ‘Internet Site’ as the option for mail configuration.

Next, provide the system mail name as shown and hit ENTER on the keyboard.

Thereafter, the system will automatically complete installing all the packages and their dependencies.

Step 3) Install Gitlab CE

Up until this point, we are done with installing all the prerequisites needed to install GitLab. In this step we will proceed to install GitLab CE.

To, achieve this, first download the repository script from GitLab to the /tmp directory as shown.

$ cd /tmp
$ wget https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh

Once the script is downloaded, you need to execute it as shown.

$ sudo bash script.deb.sh

This will setup the GitLab repository ready for the installation of GitLab.

Once you are done setting up the repository, install GitLab CE as shown.

$ sudo apt install gitlab-ce

When prompted, press ‘Y’ and press ENTER on the keyboard to continue with the installation.

During the installation, you will get a notification that GitLab has not yet been configured. Additionally, the output will notify you that you have not yet configured a valid hostname for your instance.

We will go a step further and make the necessary configurations.

Step 4) Configure Gitlab

To tune our GitLab installation, you need to edit the github.rb file. Here we will use the vim editor to open the file.

$ sudo vim /etc/gitlab/gitlab.rb

Search and locate the external_url parameter. Update the field to correspond to your domain as follows:

external_url ‘http://domain.com’

Using our test domain, this will be:

external_url 'http://crazytechgeek.info'

Next, locate the letsencrypt[‘contact_emails’] field and update it to include an email address that will be used to alert the user when Let’s Encrypt SSL certificate near its expiration date.

letsencrypt['contact_emails'] = ['admin@linuxtechi.com']

Finally, save the file and reconfigure GitLab installation as shown.

$ sudo gitlab-ctl reconfigure

The reconfiguration takes about 5 minutes to complete. Once done, you should get the notification ‘GitLab Reconfigured!’

Step 5) Access Gitlab

All the configurations are now done. The only thing remaining is to access GitLab on the front-end. To achieve this, browse your domain from a web browser as shown.

http://domain.com

On your first attempt, you will be presented with the login page below. Log in using the username root and your password.

You will then be required to change your password.

Once done, click on ‘change your password’ option and hit ENTER. This ushers you to the GitLab dashboard as shown.

Step 6) Secure Gitlab using Let’s Encrypt SSL Certificate

Let’s Encrypt SSL is a free security certificate by Lets Encrypt authority that allows you to secure your website. GitLab configuration supports Lets Encrypt and, in this step, we will configure our Gitlab instance to use Let’s Encrypt SSL for secure connections.

Head back to the gitlab.rb file

 $ sudo vim /etc/gitlab/gitlab.rb

Edit the following parameters as shown.

letsencrypt['enable'] = true
letsencrypt['auto_renew'] = true

The first line allows Let’s Encrypt to be configured and the second line sets the renewal of the certificate to be automatic.

Along with that, you can define the auto renewal hour and day of the month as follows:

letsencrypt['auto_renew_hour'] = 5
letsencrypt['auto_renew_day_of_month'] = "*/6"

Also, set the URL to use HTTPS protocol instead of HTTP.

external_url 'https://crazytechgeek.info'

Save the changes and exit the config file. To make above changes into the effect, once again run the below command .

$ sudo gitlab-ctl reconfigure

To verify that everything went according to plan, invoke the command:

$ sudo gitlab-rake gitlab:check

Reload the browser and notice that the URL to your server’s instance is now secured using Let’s Encrypt SSL certificates.

This wraps up our guide for today. In this guide, we showed you how to install and configure GitLab on Debian 10.

The post How to Install GitLab on Debian 10 (Buster) first appeared on LinuxTechi.

How to Launch AWS EC2 Instance Using Terraform

Wed, 13 Jan 2021 04:31:13 GMT

Terraform is an open source ‘infrastructure as code’ command line tool used to manage infrastructure in the cloud. With terraform you define declarative configuration file called HashiCorp Configuration Language (HCL) and provision your infrastructure. For instance, you need a Virtual machine, you just define resources like memory, storage, computing in the form of code and push in cloud. You will get the virtual machine or virtual instanace.Terraform is supported in all major cloud provider like Amazon cloud, Google cloud, Alibaba cloud and Microsoft Azure cloud.

This article will cover installation Terraform on Ubuntu 20.04 LTS system and launching AWS EC2 instance (Centos 8 stream) using terraform.

Installation of Terraform on Ubuntu 20.04 LTS

Download the latest version of Terraform from URL https://www.terraform.io/downloads.html . At the time of writing article, the latest version is 0.14.3.

To Download terraform from command, run following wget command

$ wget https://releases.hashicorp.com/terraform/0.14.3/terraform_0.14.3_linux_amd64.zip

Now, unzip the downloaded file.

$ sudo apt install zip -y
$ sudo unzip  terraform_0.14.3_linux_amd64.zip

This will output you a terraform file just move it to /usr/local/bin/ to execute the command.

$ sudo mv terraform /usr/local/bin/

Check the version

$ terraform version

This should provide you output similar to below

ubuntu@linuxtechi:~$ terraform version
Terraform v0.14.3
ubuntu@linuxtechi:~$

Prefect, above output confirm that Terraform has been installed.

Launching AWS EC2 Instance Using Terraform

Let’s make a directory and configure Terraform inside it. Run following commands

$ mkdir terraform
$ cd terraform

Now, make a configuration file. I am giving here the name as config.tf . You can give name as per your choice but remember the extension must be ‘tf’.

$ vi config.tf

Add the following terms provider AWS, your access key, secret key and region where you are going to launch ec2 instance. Here, I am going to use my favorite Singapore region.

On the second block of the code define resource as ‘aws_instance’, ami (I have picked ami from Centos AMI <https://wiki.centos.org/Cloud/AWS>). Give a instance type and also a tag of your choice.

provider "aws" {
access_key = "YOUR-ACCESS-kEY"
secret_key = "YOUR-SECRET-KEY"
region = "ap-southeast-1"
}

resource "aws_instance" "instance1" {
ami = "ami-05930ce55ebfd2930"
instance_type = "t2.micro"
tags = {
Name = "Centos-8-Stream"
}
}

Save & close the file.

Now, initialize your configuration by executing beneath terraform command

$ terraform init

Once Terraform has initialized, see what is going to happen by executing command,

$ terraform plan

If everything goes fine, then you should see following output.

Now, execute your terraform code,

$ terraform apply

Type ‘yes’ and press enter for the confirmation.

On the success of the executing you should be able to see output as below:

Log-in to your AWS account and go to ec2 service you should find a ec2 instance with the tag you defined above.

It’s simple and easy to provision infrastructure in cloud using the terraform. Hope you like the article. If you found any difficulty, please do comment us.

The post How to Launch AWS EC2 Instance Using Terraform first appeared on LinuxTechi.

How to Install and Use Helm in Kubernetes

Mon, 11 Jan 2021 04:26:14 GMT

Deploying applications on a Kubernetes cluster can be a complex affair. It often requires users to create various YAML manifest files to create pods, service and replicasets. Helm is an opensource package manager for Kubernetes that allows developers to seamlessly automate the process of deploying and configuring applications in a Kubernetes Cluster. If you are new to Kubernetes, you might want to first familiarize yourself with basic Kubernetes concepts.

In this guide, we will give you an overview to Helm and how it comes in handy in managing applications and packages in Kubernetes cluster. At the time of writing this guide, the latest release is Helm v3.

Basic Helm Terminologies & Concepts

As with any technology, it’s good to look at a few terminologies to get a better understanding of how it works. But basically, Helm comprises two elements: Helm which is a client and Tiller, which is a server. The tiller runs inside the Kubernetes Cluster. Let’s now have a peek at the definitions:

Helm: This is a command-line interface that enables you to define, deploy, & upgrade Kubernetes applications using charts.
Tiller: This is a server component that runs in a Kubernetes cluster and accepts commands from helm. It handles the deployment and configuration of software applications on the cluster.
Chart: This is a collection of helm packages that comprise YAML configuration files and templates which are rendered in Kubernetes manifest files. A single chart can deploy a simple application such as a memcached pod or a full web application with a database etc. Charts are quite easy to create, publish and share.
Chart repository: This is a location or database where charts can be collected and shared.
Release: It is a chart instance running inside a Kubernetes cluster. It can be installed as many times as possible as per the wish of a user and each time that happens, a new release is created.

Helm makes deployments easier and processes standardized and reusable. This makes it a cool way of managing a Kubernetes cluster. Helms charts are particularly helpful in that they help you get started without starting from scratch.

How to Install Helm on Kubernetes Cluster

Since Helm works in a Kubernetes Cluster, ensure that you first set up a Kubernetes Cluster. Also ensure that all the nodes are ready. You can achieve this by running the command from control plane:

$ kubectl get nodes

There are a couple of ways of installing helm, but the simplest of all is using an automated script.So, go ahead and download the automated script using curl command as shown:

$ curl -fsSL -o get_helm.sh \
https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3

Grant execute permissions asn execute the script as follows.

$ chmod 700 get_helm.sh
$ ./get_helm.sh

Helm will be installed in to the /usr/local/bin directory.

To check the version of helm, run:

$ helm version

Using Helm in Kubernetes Cluster

The first step in using helm is installing charts on your local system. The Artifacts hub contains hundreds of public chart repositories that you can install locally on your system. Artifacts Hub is an opensource project that that contains thousands of Kubernetes packages.

To install a chart from Artifacts hub, search for the chart name in the text field provided. In this example, we are searching for MariaDB chart.

When you hit ENTER, you will be provided with a list of charts to choose from.

Select your preferred chart and a list of instructions on how to install it will be provided

Adding a chart repository

Before installing a chart, you first need to add a chart repository. To achieve this, use the syntax:

$ helm repo add [chart_repo] [chart URL]

For example, to install the MariaDB chart, execute:

$ helm repo add bitnami https://charts.bitnami.com/bitnami

The output will confirm that the chart repository has been successfully added to your system.

Installing a chart

Once the chart repository has been added, you can install the chart using the syntax:

$ helm install [release-name] [chart_repo]/[chart-name]

For example, to install the MariaDB chart with a name my-release run:

$ helm install my-release bitnami/mariadb

The helm client prints a list of the resources created and additional configuration steps that you can take.

Once done, you can list the chart installed using the command:

$ helm ls

To re-read the configuration information, execute:

$ helm status release-name

In this case:

$ helm status my-release

Creating your own chart

You can also create your own chart using the command:

$ helm create chart-name

For example, to create a chart called my-chart execute:

$ helm create my-chart

You can check the directory structure of the chart using the tree command shown:

$ tree my-chart/

Removing a chart

To uninstall a chart, use the syntax

$ helm delete release-name

For example, to delete the currently installed chart, the command will be:

$ helm delete my-release

Getting help

To get more options on using helm CLI, run the command below

$ helm get -h

Conclusion:

For more information about helm and its commands, please check out the helm documentation

Also Read: How to Setup NGINX Ingress Controller in Kubernetes

The post How to Install and Use Helm in Kubernetes first appeared on LinuxTechi.

How to Create and Configure Sudo User on Arch Linux

Wed, 06 Jan 2021 06:35:46 GMT

It’s always advised against running administrative-level commands as the root user. In fact, as a rule of thumb, it’s recommended to configure or create a sudo user on any Linux server that you intend to manage. Executing commands as the root user is risky and can cause detrimental damage to your system. All it takes is a single command to accidentally crash your system. To avoid that, running elevated operations as the sudo user comes highly recommended.

A sudo user (short for super user do) is a regular user that has been granted root or elevated privileges and hence can perform elevated tasks similar to those which are a reserve for the root user. These include editing configuration files, installing and removing software packages, starting and stopping services, and so much more.

In this guide, we focus on how you can create and configure sudo user on Arch Linux.

Step 1) Install sudo package

Right off the bat, we need to install the sudo utility. Unlike other Linux distributions, this is not included by default in the base install. To install this, execute the following command as root:

# pacman -S sudo

Step 2) Create a regular user

Next, we need to create a regular user. We will later add this user to the sudoers group to enable them to carry out administrative tasks.

To create a sudo user, use the useradd command as shown:

# useradd -m -G wheel -s /bin/bash username

Let’s break down the command:

The -m option creates a home directory for the user /home/user.

The -G option adds the user to an additional group. In this case, the user is being added to the wheel group.

The -s option specifies the default login shell. In this case, we are assigning bash shell denoted by /bin/bash.

So, let’s assume you want to add a regular user called techuser. To accomplish this, run the command as follows:

# useradd -m -G wheel -s /bin/bash techuser

Step 3) Configure the regular user as sudo user

What we have so far done is to create a regular login user. The user does not yet have the capability of running elevated commands. We need to edit the sudoers file located at /etc/sudoers

The wheel group is a special type of group in Linux systems that controls who has access to sudo commands.

To confirm that the wheel group is enabled, execute the command:

# visudo
Or
# vi /etc/ sudoers

This ushers you to the sudoers file which is rendered on a vim editor. The sudoers file defines access rights and can be edited to grant or deny certain privileges to regular users.

Once you have opened the sudoers file, scroll and locate the following entry. In the basic arch linux installation it would be commented. Uncomment it and save the file to enable the wheel group.

 %wheel   ALL=(ALL)   ALL

As we have already a regular user, let’s assign password as shown using the passwd command.

# passwd techuser

When prompted, provide the new user’s password and confirm it.

Alternate way to configure regular user as sudo user, add following user’s entry in the sudoers file as shown below,

# vim /etc/sudoers

Under the User privilege specification section, add the following line.

techuser ALL=(ALL)  ALL

Save and exit the sudoers file

Step 3) Testing the sudo user

Lastly, we are going to confirm if the user can perform root tasks. First, switch over to the new user.

$ su - techuser

Provide the user’s password and hit ENTER.

Now try invoking sudo along with a command that is usually reserved for the root user. In the example below, we are updating Arch Linux.

$ sudo  pacman -Syu

You will be provided with a disclaimer informing you of the salient things to keep in mind when invoking sudo and later, you will be prompted for the password.

That’s conclude the article, we hope that this guide has provided enough insights in the creation of a sudo user in Arch Linux. Please do share your feedback and comments in below comments section.

The post How to Create and Configure Sudo User on Arch Linux first appeared on LinuxTechi.

Monitor API Call and User Activity in AWS Using CloudTrail

Mon, 04 Jan 2021 05:38:55 GMT

CloudTrail is a service that is used to track user activity and API usage in AWS cloud. It enables auditing and governance of the AWS account. With it, you can monitor what is happening in your AWS account and continuously monitor them. It provides event history which tracks resource changes. You can also enable logging of all the event in S3 and analyze which another service like Athena or Cloudwatch.

In this tutorial, we are going to see the event history of your AWS account. Also, we are going to create a ‘trail’ and store the event in S3 and analyze them using Cloudwatch.

Event history

All read/write management events are logged by event history. It lets you view, filter, and download your recent AWS account activity over the past 90 days. You don’t need to set anything for it.

Using AWS console

Go to the service ‘CloudTrail’ and click on the dashboard. You can see the event name, time, and source. You can click on ‘View full Event history’ to get all the events.

On the detail page of Event history, you can apply a filter as your choice. To see all the events use Read-only and false as above.

Using AWS CLI

You can also use AWS CLI to look at the events. The following command shows the Terminated instance of your account.

# aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=TerminateInstances

Trails

Now, let’s create a trail that will log all the events of your account and store them in an S3 bucket.

On the left side, select Trails and click on ‘Create trail’

On the next page, give a trail name, choose to create a new S3 bucket, and give a bucket name. (If you have already a bucket, you can choose the existing s3 bucket also)

Scroll down the page and enable CloudWatch Logs. Create a log group and give a name. Also, Assign IAM role and give a name. Then, Click on next.

If you want to log all types of events, then click select options under the Events type section. We are just going with Management events. So, click on next.

Now, review your configuration and click on ‘Create Trail’.

You can also see the list of created trails with the help of following AWS command.

# aws cloudtrail list-trails

Use the following command to see all the events of the trail we created above.

# aws cloudtrail describe-trails --trail-name-list management-events

Analyze log in Cloudwatch

During creating CloudTrail we have defined to send the log to Cloudwatch. So, go to Cloudwatch service and click on ‘log group’.

By default, logs are kept indefinitely and never expire. Here, you can also apply the filter to get the desired output. For example, we are going to see all the running instances in the AWS account. To do this, use the filter ‘RunInstances’ as shown below. The output is shown in JSON format.

You can also use CLI to get all the log events. Run the following command to get all the events of the log group you defined above.

# aws logs filter-log-events --log-group-name aws-cloudtrail-logs-20201229

In this article, we see how to audit and find the activities in AWS account using CloudTrail. Thank you for reading.

Also Read: How to Extend EBS Boot Disk of EC2 Instance without Reboot

The post Monitor API Call and User Activity in AWS Using CloudTrail first appeared on LinuxTechi.

Deepin 20.1 Installation Steps with Screenshots

Fri, 01 Jan 2021 16:54:34 GMT

Deepin is a user-friendly Debian based Linux distribution. It is a free and open source operating system mostly used at desktop level. Recently stable version of Deepin 20.1 has been released. Deepin 20.1 comes with stable kernel version 5.4 and Debian 10.6 package repositories.

In this article, we will cover Deepin 20.1 OS Installations steps with screenshots. Following are the minimum system requirements for Deepin 20.1

More than 2 GB of RAM (4GB is recommended)
Intel Pentium IV 2GHz (or higher)
25 GB free disk space ( or Higher)
Bootable USB Drive
Stable Internet Connection

Let’s jump into the Installation steps

Step 1) Download Deepin 20.1 ISO file

Download Deepin 20.1 ISO file on your system from their official web site, use the following URL:

Download Deepin 20.1

Step 2) Create Bootable USB Drive for Deepin 20.1

Once ISO file is downloaded on your system then burn it into a USB drive and make it bootable. On windows system use ‘Rufus’ tool to create a bootable usb drive and on Linux systems use ‘UNetbootin’ tool or dd command.

Reboot the system on which you want to install Deepin 20.1 and go to the bios settings and change the boot medium from Hard disk to USB drive.

Step 3) Deepin 20.1 Installation Menu

Once the system boots up using the bootable USB drive then you will get the following screen, choose “Install Deepin 20.1 with kernel 5.4 desktop” and hit enter

Step 4) Choose your preferred language for installation

Select the language that suits to your installation and Accept Program License & End User License Agreement.

Click on ‘Next’

Step 5) Create Partitions for Deepin 20.1

In the next window , following screen will be presented. Here we have two options either installer to create required partitions automatically on disk or create partition manually.

As we can see I have 64 GB disk space and when I choose ‘Full Disk’ option and then click on Disk Icon then it will create partitions automatically and will show the partitions. If you wish to encrypt the disk as well then Click on ’Encrypt This Disk’ option.

If you are planning to create own partitions scheme, then choose ‘Advanced’ option and select the disk and then click on ‘+’ sign to start creating partitions

Once you are done with partitions then Click on ‘Next’ to proceed further.

Note : In this guide, we are using automatic partition scheme created by installer.

Click on ‘Continue’ to create and format partitions as ext4 file system.

Step 6) Deepin 20.1 Installation Progress

Below Screen confirms that installation of Deepin 20.1 has been started and is in progress.

Once the Installation is completed, installer will prompt to reboot the system.

Click on ‘Reboot Now’

Step 7) Login Screen and Deepin Desktop after installation

After the reboot, following grub boot loader screen will be presented, choose the first option ‘Deepin 20.1 GNU/Linux’ and hit enter.

In the next window, choose the language for Deepin system and accept the license agreement.

Click on Next and Choose the preferred keyboard layout in the following window,

Click on Next and Choose the Timezone for that suits to your system.

Click on Next

Specify the local username, its password and system’s hostname and then click on Next to proceed further.

In the following window, above changes will be applied,

Now, finally we will get following login screen, use the same username and its credentials that was created above.

After entering the credentials, hit enter and will following desktop screen.

Above desktop screen confirms that Deepin 20.1 OS has been installed successfully. Now explore this exciting Linux distribution and have fun .

Please don’t hesitate to share your feedback and suggestion on Deepin 20.1 OS installation steps.

The post Deepin 20.1 Installation Steps with Screenshots first appeared on LinuxTechi.

How to Boot Arch Linux in Single User Mode / Rescue Mode

Mon, 28 Dec 2020 04:14:30 GMT

Booting any Linux distribution into single user mode (or rescue mode) is one of the important troubleshooting methods that every Linux geek should know. In this guide we will demonstrate how to boot Arch Linux into a single user mode or rescue mode. There can be different scenarios where we need to boot arch linux into single user mode, some of these scenarios are listed below:

Reset Forgotten user’s password including root
Update /etc/fstab file
Repair corrupted file system
Release space from the file system which is 100 % utilized.
Start & stop any application service at boot time

Let’s dive into the single user mode booting steps.

Step 1) Reboot Arch Linux & Interrupt booting

Reboot the Arch Linux and go the the grub boot loader screen, choose the first option ‘Arch Linux’ as shown below:

Step 2) Append an argument ‘init=/bin/bash’ to boot in single user mode

Press ‘e’ to enter in the edit mode and add ‘init=/bin/bash’ at the end of the line which starts with ‘linux’ word. Example is shown below

Now press ‘Ctrl-x‘ or F10 to boot Arch Linux in single user mode. Below window confirms that we have entered in single user mode or rescue mode.

Step 3) Mount root file system & perform troubleshooting

To run commands and perform troubleshooting steps, we have to first mount root file system (/) in read write mode.

Run following command to mount / file system in read write mode.

# mount -n -o remount,rw /

Now perform troubleshooting steps like resetting the forgotten root password and edit /etc/fstab file.

Once you are done with all the troubleshooting steps then execute the command ‘exec /sbin/init’ to save changes & start Arch Linux.

That’s all from this guide. I hope, now you have better understanding on how to boot arch linux in single user mode or rescue mode. Please don’t hesitate to share your feedback and comments in comments section below.

Also Read : How to Install LEMP Stack on Arch Linux

The post How to Boot Arch Linux in Single User Mode / Rescue Mode first appeared on LinuxTechi.

Top 14 SS Command Examples to Monitor Socket Connections

Mon, 21 Dec 2020 05:35:17 GMT

SS is a command line tool is a tool that displays socket statistics and monitor network connections of a Linux system. It has replaced the netstat command which has now been deprecated. The ss command is much faster and prints more detailed network statistics than the netstat command. In this guide, we focus on the how to use ss command to monitor socket connections on a Linux system.

1) View all socket connections (ss)

In its basic form, without any arguments, the ss command displays all the socket or network connections (TCP/UDP/UNIX) as shown:

$ ss

To make it easier to view the output, you can pipe the output to less as shown.

$ ss | less

2) View TCP / UDP socket connections

The ss command comes with a myriad of options that you can pass to view different statistics. For example, to view TCP scoket connections only, pass the -t option only as shown.

$ ss -t

To filter out UDP connections, pass the -ua option as shown.

$ ss -ua

3) View all listening sockets (ss -l)

To get a glimpse of all the listening sockets, – which are usually omitted by default, use the -l option.

$ ss -l

4) View all listening TCP socket connections (ss -lt)

To narrow down the search results and list only the TCP listening connections, use the -lt option.

$ ss -lt

5) View all listening UDP socket connections (ss -lu)

For UDP listening connections, pass the -lu option as shown. In most cases, the listening UDP connections will be fewer than TCP connections

$ ss -lu

6) View all the listening and non-listening sockets (ss -a)

The -a option will print out all the connected and non-listening sockets on your Linux system as shown.

$ ss -a

7) List IPv4 and Ipv6 socket connections

To have a peek at the current IPv4 socket connections use the -4 option.

$ ss -4

For IPv6, pass the -6 argument.

pkumar@linuxtechi:~$ ss -6
Netid        State         Recv-Q         Send-Q             Local Address:Port                      Peer Address:Port
icmp6        UNCONN        0              0                   *:ipv6-icmp                            *:*
pkumar@linuxtechi:~$

8) List Summary of all socket connections (ss -s)

If you want to just view the overall statistics of the socket connections including the number of TCP & UDP, IPv4 and IPv6 connections simply pass -s option as shown. This prints out the results in a tabular format.

$ ss -s

9) Filter connections by port number

You can also decide to filter connections by the port number. For instance, in the example below, we have filtered connections lined to SSH port 22

$ ss -at '( dport = :22 or sport = :22 )'

10) List socket connections without resolving hostname (ss -nt)

By default, ss command tries to resolve ip address into the hostname. In case you want ss command to prevent ip address to hostname resolution then use ‘-n’ option, example is shown below:

pkumar@linuxtechi:~$ ss -nt
State           Recv-Q        Send-Q        Local Address:Port         Peer Address:Port
ESTAB           0             0             192.168.1.80:22            192.168.1.3:53155
ESTAB           0             36            192.168.1.80:22            192.168.1.3:53152
pkumar@linuxtechi:~$

11) List process name and pid for socket connections (ss -p)

Use ‘-p’ option in ss command to list the process name and pid associated to the network connections. Example is shown below,

$ ss -p | more

12) Extended output of socket connections (ss -e)

Use ‘-e’ option in ss command to display the extended output of socket connections. Extended output will display the uid of the socket, socket’s inode number and uuid of the socket.

Run below command to list the extended tcp listening sockets.

$ ss -elt

For UDP extended socket connection details, run

$ ss -elu

13) View memory usage of socket connections (ss -m)

Use -m option in ss command to view how much memory is consumed by a socket connection.

Socket memory format would look like below:

Below command will display the memory usage of tcp connections.

$ ss -mt

14) Kill IPv4 / IPv6 Socket Connection (ss -k)

ss command can terminate or kill ipv4 & ipv6 socket connection forcefully using -k option. Let’s suppose we want to kill ipv4 ssh socket connection.

pkumar@linuxtechi:~$ ss -4
Netid         State         Recv-Q         Send-Q        Local Address:Port                 Peer Address:Port
tcp           ESTAB         0              0             192.168.1.80:ssh                   192.168.1.3:53155
tcp           ESTAB         0              36            192.168.1.80:ssh                   192.168.1.3:53152

pkumar@linuxtechi:~$

To terminate the 2nd ssh session, use below ss command,

pkumar@linuxtechi:~$ sudo ss -K dst 192.168.1.3 dport = 53152

For more options on the ss command usage, visit the man pages as shown.

$ man ss

This wraps up our guide today. Hopefully, you can now use the ss command confidently to view your socket connections. Thanks for taking your time, and as always, we appreciate your feedback

Also Read : 8 Stat Command Examples in Linux

The post Top 14 SS Command Examples to Monitor Socket Connections first appeared on LinuxTechi.

How to Install PHP 8 on Debian 10

Sun, 13 Dec 2020 14:54:25 GMT

Recently stable version of PHP 8 has been released. This version comes with lot of advance features and improvements. In this guide, we will demonstrate on how to install PHP 8 on a Debian 10 system step by step.

Minimum requirements for PHP 8:

Debian 10 Installed system
Local user with sudo rights
Internet connection

Let’s jump into PHP 8 installation steps on Debian 10 system,

Step 1) Install updates with apt command

Note: In case you don’t want to install updates then you skip this step and then move to step 2

sysadmin@debian-10:~$ sudo apt update
sysadmin@debian-10:~$ sudo apt upgrade -y

Once all the updates are installed successfully and then reboot your system using below reboot command,

sysadmin@debian-10:~$ sudo reboot

Step 2) Enable PHP 8 Repository (SURY PPA)

PHP 8 packages are not available in the default Debian 10 package repositories. So, to install php 8 first we have to enable SURY PPA,

Run the Following commands one after the another

sysadmin@debian-10:~$ sudo apt install -y lsb-release apt-transport-https ca-certificates wget
sysadmin@debian-10:~$ sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
sysadmin@debian-10:~$ echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list

Run below ‘apt update’ command after enabling SURY PPA repository to update package index.

sysadmin@debian-10:~$ sudo apt update

Above output confirms that we are ready to install php 8 on Debian 10 system,

Step 3) Install PHP 8 using apt command

To install php 8 for apache web server and other web applications, run the following command

sysadmin@debian-10:~$ sudo apt install php8.0 -y

To Install PHP 8 FPM for NGINX Web server, run the following command

sysadmin@debian-10:~$ sudo apt install php8.0-fpm -y

To install PHP extensions, run the following

$ sudo apt install php8.0-{extensions-name}

Let’s assume we want to install php extensions like mysql, cli, common, snmp, ldap, curl, mbstring and zip

sysadmin@debian-10:~$ sudo apt install -y php8.0-{mysql,cli,common,snmp,ldap,curl,mbstring,zip} -y

To Verify the PHP version, execute below php command,

sysadmin@debian-10:~$ php -v
PHP 8.0.0 (cli) (built: Dec  6 2020 06:56:45) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.0.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.0, Copyright (c), by Zend Technologies
sysadmin@debian-10:~$

To list all the loaded PHP modules, run beneath php command,

sysadmin@debian-10:~$ php -m

Step 4) Configure PHP 8 for Web Applications

To configure PHP 8 for the web applications like apache web server, edit its configuration file ‘/etc/php/8.0/apache2/php.ini’, add or change the below parameters that suits to your application

sysadmin@debian-10:~$ sudo vi /etc/php/8.0/apache2/php.ini
--------
upload_max_filesize = 16M
post_max_size = 30M
memory_limit = 128M
max_execution_time = 500
max_input_vars = 2000
max_input_time = 1000
--------

Save & close the file. To make the above changes into the effect restart the Apache service

sysadmin@debian-10:~$ sudo systemctl restart apache2

To configure php 8 fpm for NGINX web server, edit its configuration file ‘/etc/php/8.0/fpm/pool.d/www.conf‘ and set the parameters that suits to your nginx server setup. After making the changes to file, don’t forget to restart php 8 fpm service

sysadmin@debian-10:~$ sudo systemctl restart php8.0-fpm

Step 5) Test PHP 8 via Web Browser

Let’s create info.php file under apache web server document root,

sysadmin@debian-10:~$ sudo vi /var/www/html/info.php
<?php
phpinfo();
?>

Save & exit the file and restart apache service using the following systemctl command

sysadmin@debian-10:~$ sudo systemctl restart apache2

Now open the Web browser and type the following URL:

http://<Your-Server-IPAddress>/info.php

Perfect, above screen confirms that PHP 8 has been installed successfully on Debian 10 system. That’s all from this guide, please don’t hesitate to share your feedback and comments in the comments section below.

The post How to Install PHP 8 on Debian 10 first appeared on LinuxTechi.

How to Install PHP 8 on CentOS 8 / RHEL 8

Fri, 11 Dec 2020 03:11:12 GMT

Hello Geeks, recently PHP 8 has been released officially. It is a new major version and comes with lot of new improvements and features. In this article, we will demonstrate on how to install latest version of PHP 8 on CentOS 8 and RHEL 8 system.

Prerequisites for PHP 8

Minimal CentOS 8 / RHEL 8
User with sudo rights
Internet Connection

Let’s deep dive into the php 8 installation steps,

Note – These steps are also applicable for CentOS 8 stream operating system.

Step 1) Apply Updates

$ sudo dnf update
$ sudo dnf upgrade

Once all the updates are applied successfully then take a reboot of your system once.

$ sudo reboot

Step 2) Enable EPEL & Remi Repository

PHP 8 is not available in the default CentOS 8 and RHEL 8 package repositories. So, we have to enable EPEL and remi repositories. Run following commands to enable them,

$ sudo dnf install -y epel-release
$ sudo dnf install -y  http://rpms.remirepo.net/enterprise/remi-release-8.rpm
$ sudo dnf install -y dnf-utils

Run below command to list the available versions of PHP,

$ sudo dnf module list php

Output of above command would be:

Step 4) Install PHP 8 using Remi Module

Run the following commands to reset PHP module and install PHP 8 from remi-8.0 module.

$ sudo dnf module reset php
$ sudo dnf module install -y php:remi-8.0

Once the PHP packages are installed successfully then execute below command to verify PHP version,

[linuxtechi@centos-8 ~]$ php -v
PHP 8.0.0 (cli) (built: Nov 24 2020 17:04:03) (NTS gcc x86_64 )
Copyright (c) The PHP Group
Zend Engine v4.0.0-dev, Copyright (c) Zend Technologies
[linuxtechi@centos-8 ~]$

Great, above output confirms that PHP 8 has been installed. This PHP is for HTTPD web server.

To Install PHP 8 for NGINX web server, we have to install php 8 fpm package.

$ sudo dnf install -y php-fpm

Once php-fpm package is installed then start and enable its services by executing following command,

$ sudo systemctl enable php-fpm --now

To verify the status of php-fpm service, run

$ systemctl status php-fpm

PHP 8 extensions can also be installed via dnf command, some of the php 8 extensions installation example is listed below:

$ sudo dnf install -y php-{mysqlnd,xml,xmlrpc,curl,gd,imagick,mbstring,opcache,soap,zip}

Step 5) Configure PHP 8 for HTTPD & NGINX

To configure the PHP 8 for web servers, edit its configuration file and tweak the parameters that suits to your setup.

$ sudo vi /etc/php.ini
………
upload_max_filesize = 32M 
post_max_size = 48M 
memory_limit = 256M 
max_execution_time = 600 
max_input_vars = 3000 
max_input_time = 1000
………

Save & close the file and then restart web server’s service to make above changes into the effect.

For NGINX Web server, php-fpm is configured via its configuration file ‘/etc/php-fpm.d/www.conf’. you can tweak user and group information that suits to your setup. After making the changes, restart the php-fpm service.

That’s all from this article. I hope these helps you to install latest version of PHP 8 on your CentOS 8 / RHEL 8 system.

Also Read : 8 Stat Command Examples in Linux

The post How to Install PHP 8 on CentOS 8 / RHEL 8 first appeared on LinuxTechi.

How to Install Minikube on Debian 10 (Buster)

Mon, 07 Dec 2020 03:06:38 GMT

If you are looking for an easy and cost-effective way of getting started with Kubernetes, then Minikube is your go to resource. So what is Minikube? Minikube is a free and opensource Kubernetes implementation that allows you to create a virtual machine locally on your PC and deploy a simple one-cluster node. Minikube provides a command-line interface that enables you to manage cluster operations such as starting, stopping and deleting nodes from the cluster. In this tutorial, you will learn how to install Minikube on Debian 10 (Buster).

Prerequisites for Minikube

A newly installed instance of Debian 10 Buster
A regular user with sudo
A stable internet connection

Let’s now roll our sleeves and get into installing Minikube on Debian 10.

Step 1) Apply updates & install minikube dependencies

First and foremost, we need to update the system packages on our instance. To achieve this, execute the commands:

$ sudo apt update -y
$ sudo apt upgrade -y

Additionally, ensure that you have installed the necessary packages to enable you execute subsequent commands later on in this guide.

$ sudo apt install curl wget apt-transport-https -y

Step 2) Install KVM hypervisor

To create virtual machines, we will need to have a hypervisor installed. In this guide, we are using KVM hypervisor. Check out this guide for more on how to install KVM hypervisor in Debian 10

Step 3) Install Minikube

Once you have the KVM hypervisor is in place, then use the wget command to download the latest Minikube library as shown.

$ wget https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64

Next, copy the binary file to the /usr/local/bin path as shown

$ sudo cp minikube-linux-amd64 /usr/local/bin/minikube

Be sure to assign execute permissions to the file.

$ sudo chmod +x /usr/local/bin/minikube

At this point, you can check the version of Minikube installed by running the command below. At the time of writing this guide. The latest version of Minikube is Minikube v1.15.1

$ minikube version

output of above command would be:

linuxtechi@debian-10:~$ minikube version
minikube version: v1.15.1
commit: 23f40a012abb52eff365ff99a709501a61ac5876
linuxtechi@debian-10:~$

Step 4) Install kubectl tool

Kubectl is Kubernetes command-line tool that enables you to execute commands against a Kubernetes cluster. With kubectl, you can deploy applications, manage and inspect cluster resources including having a peek at the log files.

To install kubectl , you first need to download the binary file using the curl command as shown:

$ curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl

Make the binary file executable.

$ chmod +x ./kubectl

Next, move the binary file to your path as shown.

$ sudo mv ./kubectl /usr/local/bin

You can now verify the installation by running the command:

$ kubectl version -o yaml

Step 4) Starting Minikube

To start Minikube run the command:

$ minikube start

The command automatically select the KVM driver, downloads the virtual machine boot image and creates a Kubernetes cluster with a single node.

You can access Minikube on the command-line by running the command

$ minikube ssh

To exit from the shell, simply run:

$ exit

To stop a Kubernetes cluster run :

$ sudo minikube stop

To view the status of Minikube, run following minikube command:

linuxtechi@debian-10:~$ minikube status
minikube
type: Control Plane
host: Running
kubelet: Running
apiserver: Running
kubeconfig: Configured
linuxtechi@debian-10:~$

Run below command to verify status of node

linuxtechi@debian-10:~$ kubectl get nodes
NAME       STATUS   ROLES    AGE     VERSION
minikube   Ready    master   3h54m   v1.19.4
linuxtechi@debian-10:~$

To verify the status of the cluster, invoke the command:

$ kubectl cluster-info

Some output similar to what we have will be displayed on the terminal.

Additionally, to get a glance at kubectl’s default configuration, run the command:

$ kubectl config view

Step 6) Accessing Kubernetes dashboard

Kubernetes comes with built-in dashboard that allows you to manage your cluster. To view all the addons that come with minikube run:

$ minikube addons list

To activate the Kubernetes dashboard, execute:

$ minikube dashboard

This will trigger your default web browser to pop open the Kubernetes dashboard as shown below:

Perfect! We have successfully installed Minikube on Debian 10 and automatically created a single-node Kubernetes cluster.

Also Read : How to Setup Highly Available Kubernetes Cluster with Kubeadm

The post How to Install Minikube on Debian 10 (Buster) first appeared on LinuxTechi.

8 Stat Command Examples in Linux

Mon, 30 Nov 2020 16:19:10 GMT

In Linux, there always seems to be an ingenious way of getting things done. For any task, there’s always more than one command-line utility to execute it in a better way. The Linux stat command is a command-line tool used to display detailed information about a file. In this guide, we highlight 8 stat command usages in Linux. This works across all Linux distributions.

Linux stat command

Think of stat command as a better version of the ls -l command. While the -l flag provides more details about files such as file ownership and permissions, The stat command goes deeper under the hood and provides a wealth of information about a file.

The syntax for Linux stat command is as shown:

$ stat [OPTION] filename

1) Stat command with no arguments

In its simplest form – without any parameters – the stat command displays the default output. This includes file size and type, device type, inode number, UID, GID, number of links and access/modification dates of the file.

For example, to view the file details of a file residing in the current home directory, execute:

$ stat file1.txt

Let’s flesh out the output:

File : This shows the name of the file.
Size : Size of the file in bytes.
Block : Number of blocks allocated to the file.
IO Block : This is the byte size of every block.
Device : The device number in hexadecimal or decimal format.
Inode : This is the inode number of the file.
Links : Number of hard links associated with the file.
Access : File permissions either in symbolic or numeric format.
Uid : User ID & name of the owner.
Gid : Group ID & name of the owner.
Context : SeLinux security context
File type : Shows what type the file is (Whether a regular file, symbolic link etc).
Access : Shows the last time the file was accessed.
Modify : Shows the last time the contents of the file were changed.
Change : Shows the last time a file’s metadata e.g permissions & ownership was changed.

2) View information about multiple files

You can view a detailed report on multiple files by specifying the files on the command line one after the other as shown.

$ stat file1.txt file2.pdf

3) Display file system status

You can check the filesystem status where the file is sitting on by using the -f option as shown. This gives you the block size, total & available memory to mention just a few attributes.

$ stat -f /home

4) Display information in terse form

The -t option is used to display information in a terse format as shown:

$ stat -t file1.txt

5) Enable following of symbolic links

Usually, if you run the stat command on a symbolic link, it will only give you information about the link, and not the file that the link points to. Take for example the /usr/share/zoneinfo/America/Cayman symbolic link.

$ stat /usr/share/zoneinfo/America/Cayman

In the example above, the symbolic link /usr/share/zoneinfo/America/Cayman points to ( ->) Panama. The symbolic link is only 6 bytes.

To get information on the file that the links points to, use the -L option also known as the dereference option.

$ stat -L /usr/share/zoneinfo/America/Cayman

This now displays information about the file and not the link, even though the output suggests it’s the link. This is because we passed it as an argument with the stat command.

6) Format sequencing

From previous examples, we have seen that stat command prints out a barrage of information on the terminal. If you want specific information, you can custom the output using a format sequence to provide exactly what you need and leave other details.

Popular expressions used to custom the output include –printf or –format option

For example, to display inode of a file only, use the %i format sequence as shown. The \n operand print a new line.

$ stat --printf='%i\n' file1.txt

To display access rights and uid (User ID) use the %a and %u format sequences.

$ stat --printf='%a:%u\n' file1.txt

The –format option prints out a new line without requiring an additional operand.

$ stat --format='%a:%F' file1.txt

Here’s a complete list of the format sequences that you can use:

%a Displays the access rights in octal format.
%A Displays the access rights in a human readable format.
%b This is the number of blocks allocated (see %B).
%B the size in bytes of each block reported by %b.
%C Shows the SELinux security context string.
%d Displays the device number in a decimal format.
%D The device number in hexadecimal format.
%f Displays the raw mode in hexadecimal.
%F Displays the file type.
%g Prints the group ID of owner.
%G Prints the group name of owner.
%h Displays the number of hard links.
%i Prints out the inode number.
%m Prints the mount point.
%n Displays the file name of the file
%N Shows quoted file name with dereference if symbolic link
%o Prints the optimal I/O transfer size hint.
%s total size, in bytes.
%t major device type in hex, for character/block device special files
%T minor device type in hex, for character/block device special files
%u Shows the user ID of owner.
%U Prints the username of owner.
%w Reveals the time of file birth, human-readable; – if unknown.
%W Prints the time of file birth, seconds since Epoch; 0 if unknown.
%x The time of last access, human-readable.
%X The time of last access, seconds since Epoch.
%y Displays the last time of last modification, human-readable.
%Y Prints the time of last modification, seconds since Epoch.
%z This is the time of last change, human-readable.
%Z The time of last change, seconds since Epoch.

7) Getting help with stat command

For more command options , use the –help option with stat command as shown.

$ stat --help

You can also visit the man pages of stat command, run

$ man stat

8) Checking the version of stat

Finally to check the version of stat command, run the command:

$ stat --version

That’s what we had in store for you in this guide. As you can see, the stat command goes over and above what the ls command gives you and is ideal in gathering detailed information about a file or file system.

Also Read : 14 Useful ‘ls’ Command Examples in Linux

The post 8 Stat Command Examples in Linux first appeared on https://www.linuxtechi.com.

How to Fix ‘Repository does not have a release file’ Error in Ubuntu

Thu, 26 Nov 2020 05:49:08 GMT

When installing software on Ubuntu, sometimes you may be required to add third-party PPAs. Adding PPAs enables you to access software packages that have not been included in official Ubuntu repositories. Sometimes, when updating your system or installing software packages, you may run into an error indicating that the added PPA does not have a release file.

This error is quite frustrating as it limits your ability to manage software packages in an efficient manner. In this guide, we will guide you on how you can resolve this issue and go back to using your system without an issue.

So, let’s first understand, what is the meaning of error ‘Repository does not have a release file’ ?

Before we address this issue, it’s prudent that we first understand what this error means. The ‘Repository does not have a release file’ error essentially tells you that the repository that you have just added is not available for your Ubuntu version.

For example, I tried to install Deepin desktop environment on Ubuntu 18.04 using the PPA below which should be used on Ubuntu 20.04 also known as Focal Fossa.

$ sudo add-apt-repository ppa:ubuntudde-dev/stable

This yielded the error shown in the snippet below.

This error prevents you from updating, upgrading and even installing software packages.

How to Fix ‘Repository does not have a release file’ error

Having known what causes the error, let’s now see how you can fix your system. To clear the error, you need to remove the troublesome repository. You can achieve this graphically the ‘Software & Updates’ tool or running commands on the terminal.

To remove the repository graphically, launch the ‘Software & Updates‘ tool as shown.

Click on the ‘Other Software’ tab and then select the PPA to be removed. Finally, click on the ‘Remove’ button at the bottom of the window.

An authentication window will pop up prompting you for your password. Type in your user’s password and press ENTER.

On the command line, you can remove the repository using the syntax shown:

$ sudo add-apt-repository --remove ppa:name/here

In our case, our command will be:

$ sudo add-apt-repository --remove ppa:ubuntudde-dev/stable

Then hit ENTER to remove the repository.

And that’s how you resolve the “Repository does not have a release file” error on Ubuntu.

The post How to Fix 'Repository does not have a release file' Error in Ubuntu first appeared on Linuxtechi.

How to Install Cockpit Web Console on Debian 10

Mon, 23 Nov 2020 02:02:06 GMT

Cockpit is free and open-source remote server management web console. Using cockpit web console one can do almost all day to day administrative tasks without login in server’s cli. Apart from administrative tasks, Cockpit provides real time RAM, CPU and DISK utilization report of your system. One of the major advantages of using cockpit tool is that it will not consume much resources from your system. In this article, we will demonstrate how to install and use cockpit web console on Debian 10 (Buster).

Prerequisites for Cockpit:

Freshly Installed Debian 10
Local user with sudo rights
Stable internet connection

Let’s dive into the Cockpit installation steps on Debian 10,

Step 1) Update apt package index

linuxtechi@debian-10:~$ sudo apt update

Step 2) Install Cockpit with apt command

Cockpit package and its modules are available in the default Debian 10 repository, so its installation is quite straight forward, just run the following command,

linuxtechi@debian-10:~$ sudo apt -y install cockpit

Create following directory to suppress warning message displayed in cockpit web console.

linuxtechi@debian-10:~$ sudo mkdir -p /usr/lib/x86_64-linux-gnu/udisks2/modules

To install additional cockpit modules like docker, then run

linuxtechi@debian-10:~$ sudo apt -y install cockpit-docker

Once cockpit and its dependencies are installed then start its service using beneath systemctl command,

linuxtechi@debian-10:~$ sudo systemctl start cockpit

Verify the cockpit service status by running following command

linuxtechi@debian-10:~$ sudo systemctl status cockpit

Step 3) Allow Cockpit port in OS firewall

In case OS firewall is running on your Debian 10 system then allow 80 & 9090 tcp ports in the firewall by running beneath commands,

linuxtechi@debian-10:~$ sudo ufw allow 9090
linuxtechi@debian-10:~$ sudo ufw allow 80

Step 4) Access Cockpit Web Console

To access cockpit web console, type the following URL on your web browser,

https://<Your-Server-IP>:9090

Use root user credentials or local user credentials to login.

Great, above dashboard confirms that cockpit has been installed successfully on your Debian 10 system. Let’s look at some of the administrative tasks that can be accomplished via cockpit.

Software Updates

From the cockpit dashboard, we can view the available software updates for the system. Click on ‘Software Updates’ Tab

If you wish to install only security related updates, then choose ‘Install Security Updates’ option and if you wish to install all updates then choose second option.

We also have the facility to install application and their update from the ‘Applications’ tab

Manage User Accounts

From the cockpit dashboard, we can manage local users. Choose ‘Accounts’ tab

Manage Containers

From the ‘Containers’ tab, we can manage containers, here manage containers means start, stop and provision new containers using docker image.

Manage Networking

From ‘Networking’ tab, we can manage networking of our Debian 10 server

Similarly using other tabs like ‘Storage‘ and ‘Logs‘ we can manage storage and logs of your Debian 10 system.

That’s all from this guide. I hope these steps help you to give technical insight on how to install and use Cockpit on Debian 10.

Also Read : Top 8 Things to do after Installing Debian 10 (Buster)

The post How to Install Cockpit Web Console on Debian 10 first appeared on Linuxtechi.

How to Replace Strings and Lines with Ansible

Mon, 16 Nov 2020 06:52:11 GMT

Ansible provide multiple ways that you can use to replace a string, an entire line or words that match a certain pattern. There are two modules that you can use to achieve this: the replace module and the inline module. We are going to dive deep and take a look at some examples of how these modules can be used in a playbook to replace strings and lines.

Replacing a string from a file with Ansible

The replace module replaces all instances of a defined string within a file.

If the string does not exist, then nothing will be done and no error will be displayed. Ansible simply returns that nothing has been changed. To successfully replace strings in a file, three parameters are required:

The location of the file denoted by the ‘path‘ directive.
The ‘regexp‘ directive – The string to be replaced or changed. Additionally, you can pass any regular Python expression.
The ‘replace‘ directive – This is the replacement word or string.

This is how the syntax looks like with the replace module:

- replace:
    path: /path/to/file
    regexp: 'string or regular expression for search'
    replace: 'word to replace the search string'
    backup: yes

I have a sample text file called sample.txt which has the content below.

Unix is a free and opensource system used by developers, and desktop lovers. Thanks to Linux Torvalds’ efforts, Unix grew to become the most popular opensource system.

The goal is to replace the string ‘Unix’ with ‘Linux’. To achieve that, we are going to create a playbook file as shown.

- hosts: 127.0.0.1
  tasks:
  - name: Ansible replace string example
    replace:
      path: /etc/ansible/sample.txt
      regexp: 'Unix'
      replace: "Linux"

We are then going to run the playbook.

# ansible-playbook sample.txt

From the output, you can clearly see that the string ‘Unix’ has been replaced by ‘Linux’

Let’s take another example.

Our second objective is to change a hostname entry in my /etc/hosts file from server.myubuntu.com to server.linuxtechi.info

We will create a playbook file change_hostname.yml which will look as follows:

- hosts: 127.0.0.1
  tasks:
  - name: Ansible replace string example
    replace:
      path: /etc/hosts
      regexp:  '(\s+)server\.myubuntu\.com(\s+.*)?$'
      replace: '\1server.linuxtechi.info\2'

Upon running the playbook, the name of the domain name changes accordingly as shown:

# ansible-playbook change_hostname.yml

Ansible lineinfile module

The Ansible inline module can be used in a variety of ways. It can be used for inserting a new line, removing or modifying an existing line from the file. We are going to take a closer look at each of these.

Inserting a line at the end of the file (EOF)

To start off, we will begin by learning how to create a line if it is not present in a file. Begin by specifying the path of the file where you are going to add the line using the path attribute. This has replaced the dest option which was used in Ansible 2.3 and earlier versions.

Then specify the line to be added at EOF. In this case, we’re adding a new entry to the /etc/hosts file. If the line already exists, then Ansible will skip adding it and no changes will be made.

The state parameter instructs Ansible to write the line in the file and the create parameter tells Ansible to create the file if it’s not already there. This is the update_ip.yml playbook file.

- hosts: 127.0.0.1
  tasks:
    - name: Ansible update IP address
      lineinfile:
        path: /etc/hosts
        line: '173.82.56.150 wwww.linuxtechi.io'
        state: present
        create: yes

When the playbook file is run, notice that the new entry or line has been added.

# ansible-playbook update_ip.yml

Inserting a line before or after

Sometimes, you may want to insert a new line just before or after a section of a file and not always at the end of the line. For this, you need to use the insertafter and insertbefore directives.

In the playbook below, we are adding a line to specify our preferred inventory file just after the [defaults] section in the ansible.cfg file. We have escaped the [] since they are regex characters.

- hosts: 127.0.0.1
  tasks:
    - name: Ansible update IP address
      lineinfile:
        path: /etc/ansible/ansible.cfg
        line: 'inventory  = /home/linuxtechi/hosts'
        insertafter: '\[defaults\]'

To add a line just before a parameter, use the ‘insertbefore‘ parameter. In the example below, we are adding the same line just before the #library pattern in the Ansible config file.

- hosts: 127.0.0.1
  tasks:
    - name: Ansible update IP address
      lineinfile:
        path: /etc/ansible/ansible.cfg
        line: 'inventory  = /home/linuxtechi/hosts'
        insertbefore: ‘#library’

Remove a line using lineinfile module

This is the exact opposite of adding a line. A simple way of achieving this is to set the state parameter to absent . For example, to remove the entry in the file, ensure that the state parameter has the absent value

- hosts: 127.0.0.1
  tasks:
    - name: Ansible update IP address
      lineinfile:
        path: /etc/hosts
        line: ‘173.82.56.150 wwwwlinuxtechi.io’
        state: absent

Another way of removing a line is by using the regexp parameter. For example, the playbook below deletes all lines in a file beginning with the Unix word.

- hosts: 127.0.0.1
  tasks:
    - name: Ansible lineinfile regexp example
      lineinfile:
        dest: /etc.ansible/sample.txt
        regexp: '^Unix'
        state: absent

That’s all from this article, I hope it helps to understand how to replace a string and lines with Ansible.

Also Read: 9 tee Command Examples in Linux

The post How to Replace Strings and Lines with Ansible first appeared on Linuxtechi.

How to Setup Highly Available NGINX with KeepAlived in Linux

Thu, 12 Nov 2020 05:24:26 GMT

As we know NGINX is a highly rated web server which can also be used as reverse proxy, load balancer and HTTP cache. In this article, we will demonstrate how to setup highly available (HA) NGINX web server with keepalived in Linux. Keepalived works on VRRP (Virtual Router Redundancy Protocol) which allows one static IP to be fail-over between two Linux systems.

Following are my lab details for NGINX HA:

Node 1 – 192.168.1.130 – nginx1.example.com – minimal CentOS 8 / RHEL 8
Node 2 – 192.168.1.140 – nginx2.example.com – minimal CentOS 8 / RHEL 8
Virtual IP (VIP) – 192.168.1.150
sudo user pkumar
Firewalld enbled
SELinux Running

Let’s jump into the Installation and configuration steps,

Step 1) Install NGINX Web Server from command line

NGINX package is available in the default CentOS 8 / RHEL 8 repositories, so run below dnf command on both the nodes to install nginx web sever

$ sudo dnf install -y nginx

For CentOS 7 / RHEL 7

NGINX package is not available in default CentOS 7 / RHEL 7 repositories, so to install it first we have to enable epel repository. Run the following command on both the nodes

$ sudo yum install epel-release -y
$ sudo yum install -y nginx

For Ubuntu / Debian

For Debian based Linux distributions, nginx web server package is available in default package repositories, so to install nginx, run

$ sudo apt update
$ sudo apt install -y nginx

Step 2) Configure Custom index.html file for both nodes

Let’s create custom index.html file for both the nodes so that we can easily identify which server is serving the web site while accessing via virtual ip.

For node 1, run following echo command,

[pkumar@nginx1 ~]$ echo "<h1>This is NGINX Web Server from Node 1</h1>" | sudo tee /usr/share/nginx/html/index.html

For node 2, run

[pkumar@nginx2 ~]$ echo "<h1>This is NGINX Web Server from Node 2</h1>" | sudo tee /usr/share/nginx/html/index.html

Step 3) Allow NGINX port in firewall and start its service

In case firewall is enabled and running on both the nodes then allow port 80 by executing following commands,

For CentOS / RHEL System

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd –reload

For Ubuntu / Debian System

$ sudo ufw allow 'Nginx HTTP'

Start and enable nginx service by running beneath command commands on both the nodes,

$ sudo systemctl start nginx
$ sudo systemctl enable nginx

Test NGINX Web server of both the nodes by running following curl command from outside,

$ curl http://192.168.1.130
<h1>This is NGINX Web Server from Node 1</h1>
$ curl http://192.168.1.140
<h1>This is NGINX Web Server from Node 2</h1>

Perfect, above command’s output confirm that nginx is running and accessible from outside with system’s ip address.

Step 4) Install and Configure Keepalived

For CentOS / RHEL systems, keepalived package and its dependencies are available in the default package repositories, so its installation is straight forward, just run below command on both the nodes.

$ sudo dnf install -y keepalived       // CentOS 8/ RHEL 8
$ sudo yum install -y keepalived      // CentOS 7 / RHEL 7

For Ubuntu / Debian System,

$ apt install -y keepalived

Once the keepalived is installed then configure it by editing its configuration file ‘/etc/keepalived/keepalived.conf’. We will keep node 1 as master node and node 2 as backup node.

Take backup of configuration file,

[pkumar@nginx1 ~]$ sudo cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf-org

Replace the content of keepalived.conf with below:

[pkumar@nginx1 ~]$ echo -n | sudo tee /etc/keepalived/keepalived.conf
[pkumar@nginx1 ~]$ sudo vi /etc/keepalived/keepalived.conf

Paste the following contents

global_defs {
  # Keepalived process identifier
  router_id nginx
}

# Script to check whether Nginx is running or not
vrrp_script check_nginx {
  script "/bin/check_nginx.sh"
  interval 2
  weight 50
}

# Virtual interface - The priority specifies the order in which the assigned interface to take over in a failover
vrrp_instance VI_01 {
  state MASTER
  interface enp0s3
  virtual_router_id 151
  priority 110

  # The virtual ip address shared between the two NGINX Web Server which will float
  virtual_ipaddress {
    192.168.1.150/24
  }
  track_script {
    check_nginx
  }
  authentication {
    auth_type AH
    auth_pass secret
  }
}

Now create a script with the following contents which will check whether nginx service is running or not. Keepalived will always check the output of check_nginx.sh script, if it finds that nginx service is stopped or not responding then it will move virtual ip address on backup node.

[pkumar@nginx1 ~]$ sudo vi /bin/check_nginx.sh
#!/bin/sh
if [ -z "`pidof nginx`" ]; then
  exit 1
fi

save & close the file and set the required permission with chmod command,

[pkumar@nginx1 ~]$ sudo chmod 755 /bin/check_nginx.sh

Now copy the keepalived.conf and check_nginx.sh files from node 1 to node 2 using following scp command.

[pkumar@nginx1 ~]$ scp /etc/keepalived/keepalived.conf root@192.168.1.140:/etc/keepalived/
[pkumar@nginx1 ~]$ scp /bin/check_nginx.sh root@192.168.1.140:/bin/

Once files are copied then login to Node 2 and make couple of changes in keepalived.conf file. Change State from MASTER to BACKUP and lower the priority by setting it as 100. After making the changes, keepalived.conf on Node 2 would look like below,

In Case OS firewall is running then allow VRRP by the running following commands,

Note – Execute these commands on both the nodes

For CentOS / RHEL Systems

$ sudo firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
$ sudo firewall-cmd --reload

For Ubuntu / Debian Systems

Allow VRRP by executing followings, from the master node (Node 1), run

$ sudo ufw allow to 224.0.0.18 comment 'VRRP Broadcast'
$ sudo ufw allow from 192.168.1.140 comment 'VRRP Router'

From the Backup / Slave Node (Node 2)

$ sudo ufw allow to 224.0.0.18 comment 'VRRP Broadcast'
$ sudo ufw allow from 192.168.1.130 comment 'VRRP Router'

Now finally start keepalived service by running beneath systemctl commands from both the nodes,

$ sudo systemctl start keepalived
$ sudo systemctl enable keepalived

Verify the keepalived service by running below:

$ sudo systemctl status keepalived

Perfect, now verify VIP (virtual ip address) status on master node, in our case VIP is 192.168.1.130

$ ip add show

Above output confirms VIP is configure on master node on its enp0s3 interface. So, lets do keepalived and nginx testing in the next step.

Step 5) Keepalived and NGINX Testing

To perform the testing, try access nginx web server with virtual IP (192.168.1.150), currently it should show us node 1 nginx page.

Open the wen browser and type ‘http://192.168.1.150’ and hit enter,

Now try to stop the NGINX service on node 1 and see whether virtual IP is switched from Node 1 to Node 2 and then try to access nginx web page with VIP (192.168.1.150) and this time it should show us nginx page from node 2.

[pkumar@nginx1 ~]$ sudo systemctl stop nginx
[pkumar@nginx1 ~]$ ip add show

[pkumar@nginx2 ~]$ ip add show

Now, let’s try to access web page using virtual ip,

Great, above confirms that we have successfully setup highly available NGINX Web server with keepalived. That’s all from this article, please do share your feedback, comments and suggestions.

The post How to Setup Highly Available NGINX with KeepAlived in Linux first appeared on Linuxtechi.

How to Solve ‘E: Could not get lock /var/lib/dpkg/lock’ Error in Ubuntu

Mon, 09 Nov 2020 07:14:37 GMT

Recently, I bumped into the error ‘Could not get lock /var/lib/dpkg/lock’. As a result, I could neither install any packages nor update the system. This error is also closely related to the ‘Could not get lock /var/lib/apt/lists/lock’ error. Here’s some sample output on Ubuntu 20.04.

Reading package lists... Done
E: Could not get lock /var/lib/apt/lists/lock. It is held by process 3620 (apt)
N: Be aware that removing the lock file is not a solution and may break your system.
E: Unable to lock directory /var/lib/apt/lists/

This can be quite frustrating and often leaves you stranded, unable to update, upgrade or install any packages.

So, what causes this error?

As the error suggests, this error usually happens when another process is currently using the /var/lib/dpkg/lock or /var/lib/dpkg/lock file. Such happens when you have 2 or more terminals running a system update or upgrade. It can also occur when you prematurely cancel an update/upgrade that is in progress, accidentally or otherwise. A second attempt to use apt or apt-get command will yield the error.

There’s absolutely no need to panic in case you run into this error. A couple of options are available to fix this issue. Let’s explore some of the solutions.

Solution 1) Killing all processes which are using the APT manager

The first step in diagnosing this problem is listing the processes that are using the apt package manager. To do so, use the ps command as shown:

$ ps aux | grep - i apt

Here’s the output I got.

To clear the error, you need to kill the processes that are associated with the apt command. You can do so by sending a SIGKILL command to shut down the process immediately. Execute the kill -9 command followed by the process ID as follows.

$ sudo kill -9 3619
$ sudo kill -9 3620

Once done, verify again if the processes have ended using the ps command. If they have all cleared, you can proceed to update the system without a problem.

Solution 2)

In some situations, the root cause could be the lock file. The lock file blocks two or multiple processes from accessing the same data. When you run any apt or apt-get command, a lock file is usually created. However, if the latest apt command was not successfully executed (i.e terminated abruptly), the lock file persists and blocks any subsequent apt or apt-get instances.

The solution to this problem is to get rid of the apt lock file(s). And it’s quite easy. Simply run the command below:

$ sudo rm /var/lib/apt/lists/lock

If the error you are getting is the ‘Could not get lock /var/lib/dpkg/lock.’ error, delete the lock file as shown:

$ sudo rm /var/lib/dpkg/lock

Other times, you might get a /var/lib/dpkg/lock-frontend error. The lock-frontend error implies that a graphical application that used apt / dpkg is currently running. This could either be Gdebi or synaptic package manager or any other application.

The immediate remedy is to exit or close the application and give it another try. If nothing gives, simply remove the /var/lib/dpkg/lock-frontend file as shown.

$ sudo rm /var/lib/dpkg/lock-frontend

Removing the lock-frontend file might again lead to the ‘Could not get lock /var/lib/dpkg/lock’ error, so once again, you will have to remove the lock file.

$ sudo rm /var/lib/dpkg/lock

If you happen to get an error about the apt-cache lock such as /var/cache/apt/archives/lock, proceed and remove the lock file as shown.

$ sudo rm /var/cache/apt/archives/lock
$ sudo rm /var/lib/dpkg/lock

And that’s how you resolve the ‘Could not get lock /var/lib/dpkg/lock‘ and could not get lock /var/lib/apt/lists/lock errors. I’m sure that if you have come this far, you should have resolved the error by now. Let us know how it went.

The post How to Solve ‘E: Could not get lock /var/lib/dpkg/lock’ Error in Ubuntu first appeared on Linuxtechi.

20 Awesome Nmap Command Examples in Linux

Mon, 02 Nov 2020 04:59:03 GMT

Nmap stands for Network Mapper, it is a free and open-source network discovery and reconnaissance tool used for host discovery and collecting detailed information about a host. Written in C, C++ and Python and Initially released in September 1997, nmap has become an integral tool for cybersecurity and digital forensic professionals who rely on it to reveal detailed information about target hosts and unearth potential vulnerabilities. Nmap reveals information such as Active hosts on a network, open ports, OS and service detection, and performing stealth scans to mention just a few.

In this guide, we highlight some of the handy Nmap commands that you can use to retrieve as much information as you can from host systems.

How to install nmap

Before we look at various ways in which the nmap command can be used, let’s check out how you can install this useful command-line tool. The universal and easiest way to install nmap is using snap packages. Snaps are prebuilt software packages that ship with libraries and dependencies. They are readily available in all major Linux distros. You can find tons of snaps in snapstore. However, before installing Nmap from snap packages, you need to first enable the snapd daemon. This will enable you to download and install snap packages.

To install Nmap using snaps, run the command below.

$ sudo snap install nmap

Alternatively, you can choose to go with installing Nmap using package managers unique to each family of Linux distribution.

For Ubuntu & Debian

For Ubuntu/Debian/Mint based distributions use the APT package manager as shown.

$ sudo apt -y install nmap

For CentOS 8 / RHEL 8 / Fedora 22 and later version

For CentOS 8 / RHEL 8 and Fedora 22 and later use the dnf package manager.

$ sudo dnf -y install nmap

For CentOS 7 & RHEL 7

For CentOS 7 / RHEL 7 and earlier versions use the yum package manager.

$ sudo yum -y install nmap

For Arch Linux / Manjaro

For Arch-based systems, use the pacman package manager as shown.

$ sudo pacman -S nmap

Having looked at the installation of nmap, let’s now proceed and see 20 awesome nmap command examples in Linux

1) Nmap command for scanning a single host

In its basic form, the nmap command can be used to scan a single host without passing any arguments. The syntax is as shown:

$ nmap target-ip

For example;

$ nmap 192.168.2.102

Alternatively, instead of specifying the IP address, you can specify the domain name as shown:

$ nmap scanme.nmap.org

2) Scan multiple hosts

Scanning multiple hosts at a go comes particularly in handy for extensive networks where you want to scan several hosts at once. It’s a convenient way of scanning hosts in a single command instead of scanning each host separately. For instance, you can scan 10 or more hosts or an entire subnet as you work on something else. There are different ways of going about this.

Firstly, you can specify multiple IP address or domains in a row separated by a space as shown;

$ nmap 192.168.2.1 192.168.2.103

Rather than typing the IP addresses in full, you can separate the endings with a comma as shown.

$ nmap 192.168.2.1,102,103

Also, you can specify a range of IP addresses using a hyphen. For example, the command below scans hosts from 192.168.2.1 to 192.168.2.100

$ nmap 192.168.2.1-100

3) Scan a subnet with nmap

Additionally, you can use a wildcard to scan an entire subnet as shown:

$ nmap 192.168.2.*
OR
$ nmap 192.168.2.0/24

To refine the scan and only discover live hosts in a subnet, use the -sP option as shown.

$ nmap -sP 192.168.2.*

4) Get more information with verbose option

To get more robust output during the nmap scan, use the -v option. This option prints out the details of the scan such as the nature of the scan and open ports that are discovered.

$ nmap -v 192.168.2.1

5) Exclude hosts from a Nmap scan

When scanning a range of hosts, you may decide to exclude a single host from the scan. To achieve this, use the –exclude option. In the example below, we have excluded the host 192.168.2.20 from being scanned.

$ nmap 192.168.2.0/24 --exclude 192.168.2.20

To exclude multiple hosts from the Nmap scan , specify the hosts to be excluded in a file and link the command to the file as shown:

$ nmap 192.168.2.* --excludefile exclude.txt

The above command excludes all the hosts contained in the exclude.txt file.

6) Perform a fast scan

As the name suggests, you can perform a much faster scan using nmap by passing the -F flag as shown:

$ nmap -F 173.82.202.201

A disclaimer though – This scan yields fewer ports than the ordinary scan.

7) Scan Active hosts in a network

This is more like a ping scan. It detects active hosts in a subnet. To scan for active hosts, pass the -sn option followed by the IP address and the subnet. For example:

$ nmap -sn 192.168.2.0/24

8) Scan hosts contained in a file

If you have a segmented network, especially one with VLANs, chances are that you have hosts in different subnets. An easy way of scanning them is by defining their IP addresses in a text file and passing the file as an argument using the -iL option.

$ nmap iL hosts.txt

Here’s a sample of the host file

$ cat hosts.txt
192.168.2.100
192.168.2.102
192.168.20.5-50

9) Perform a scan to detect Firewall

Firewall detection is especially useful when performing vulnerability tests or ethical hacking. It allows the sysadmin to know if the firewall of the target host is enabled or not. To know the status of a firewall, use the -sA flag as shown.

$ nmap -sA 192.168.2.1

This initiates an ACK scan which examines whether packets can pass through unfiltered. Use the -n flag to prevent reverse DNS resolution on the target host.

10) Perform OS detection with nmap

Nmap can also provide insights on the OS or operating system of the target system and also version detection. For OS detection pass the -O option as shown. We’re going to scan a cloud VPS hosted on a Linux system and see what nmap gives us.

NOTE: If you are a regular user, you need to invoke the sudo command as OS detection requires sudo privileges.

$ sudo nmap -O 173.82.202.201

Nmap does its very best to identify the OS and it’s version however, the results may not always represent an accurate result.

11) Perform port scanning

One of the essential tasks on the nmap tool is scanning ports on a host system. You can cut to the chase and specify a port to be scanned using the -p flag followed by the port number as shown:

$ nmap -p 80 173.82.202.201

Additionally, you can scan for multiple ports by separating them using a comma as shown:

$ nmap -p 80,443 192.168.2.1

You can also define a range of ports to be scanned by separating them with a hyphen.

$ nmap -p 80-443 192.168.2.1

12) Scan for TCP/UDP ports

You can narrow down to scanning ports which are either TCP or UDP. To scan TCP ports, use the -sT option as shown.

$ nmap -sT 173.82.202.201

For a particular TCP port, such as port 80,run:

$ nmap -p T:80 173.82.202.201

For UDP ports, use the -sU option.

$ nmap -sU 173.82.202.201

For a particular UDP port, such as port 69 execute:

$ nmap -p U:69 173.82.202.201

13) Discover service version

When scanning for possible vulnerabilities, detecting running services and their versions as well as the ports they are listening on is crucial. This allows you to know which services can be leveraged by an attacker to compromise your system. Knowledge about service & port versions enables you to make a decision on whether to update the services to their latest versions or uninstall them altogether.

To gather services and port information use the -sV flag.

$ nmap -sV 173.82.202.201

14) Perform a stealth scan

A nmap scan is usually ‘noisy’ and leave footprints which can be flagged by a robust IDS ( intrusion detection system ) and eventually be traced back to you. To stay anonymous , you can perform a stealth scan using the -sS option.

$ nmap -sS 173.82.202.201

15) Determine supported IP protocols

You can retrieve information about the protocols supported by a target system (ICMP,TCP, UDP etc) using the -sO flag.

$ sudo nmap -sO 173.82.202.201

16) Perform an aggressive scan

When the -A option is used, nmap gives very detailed scan results including open ports and versions of running services, OS detection and even performs a traceroute of the target host(s).

$ nmap -A 173.82.202.201

17) Save nmap output to a file

By default, nmap prints out scan results on the terminal. But if you need to save the results on a text file for more analysis at your convenience, you can use the redirection operator as shown.

$ nmap 173.82.202.201 > scanme.txt

To verify that the scan results have been saved, use the cat command as shown.

$ cat scanme.txt

Additionally, you can pass the -oN option followed by the output file and the host.

$ nmap -oN scanme.txt scanme.nmap.org

18) Print out the host interfaces and routes

Sometimes, you might find the need to find the host system’s interfaces and routes for debugging purposes. This can be easily achieved by passing the –iflist option.

$ nmap --iflist

19) Get help with nmap

To satiate your curiosity on additional nmap options, use the -h flag. This is synonymous with getting help with nmap commands.

$ nmap -h

20) Check nmap version

To check the version of nmap you are using run the command:

$ nmap -v

Those are just 20 of the basic Nmap commands that you can use to enumerate various host systems. There are still plenty of nmap options that you can use to get refined details about the target system, but the examples we have listed are a good place to start from. We hope that this guide has been helpful in acquainting you with the nmap tool and various command examples.

Also Read : 9 tee Command Examples in Linux

The post 20 Awesome Nmap Command Examples in Linux first appeared on Linuxtechi.

How to Configure NGINX as TCP/UDP Load Balancer in Linux

Mon, 26 Oct 2020 02:51:39 GMT

As we know NGINX is one of the highly rated open source web server but it can also be used as TCP and UDP load balancer. One of the main benefits of using nginx as load balancer over the HAProxy is that it can also load balance UDP based traffic. In this article we will demonstrate how NGINX can be configured as Load balancer for the applications deployed in Kubernetes cluster.

I am assuming Kubernetes cluster is already setup and it is up and running, we will create a VM based on CentOS / RHEL for NGINX.

Following are the lab setup details:

NGINX VM (Minimal CentOS / RHEL) – 192.168.1.50
Kube Master – 192.168.1.40
Kube Worker 1 – 192.168.1.41
Kube worker 2 – 192.168.1.42

Let’s jump into the installation and configuration of NGINX, in my case I am using minimal CentOS 8 for NGINX.

Step 1) Enable EPEL repository for nginx package

Login to your CentOS 8 system and enable epel repository because nginx package is not available in the default repositories of CentOS / RHEL.

[linuxtechi@nginxlb ~]$ sudo dnf install epel-release -y

Step 2) Install NGINX with dnf command

Run the following dnf command to install nginx,

[linuxtechi@nginxlb ~]$ sudo dnf install nginx -y

Verify NGINX details by running beneath rpm command,

# rpm -qi nginx

Allow NGINX ports in firewall by running beneath commands

[root@nginxlb ~]# firewall-cmd --permanent --add-service=http
[root@nginxlb ~]# firewall-cmd --permanent --add-service=https
[root@nginxlb ~]# firewall-cmd –reload

Set the SELinux in permissive mode using the following commands,

[root@nginxlb ~]# sed -i s/^SELINUX=.*$/SELINUX=permissive/ /etc/selinux/config
[root@nginxlb ~]# setenforce 0
[root@nginxlb ~]#

Step 3) Extract NodePort details for ingress controller from Kubernetes setup

In Kubernetes, nginx ingress controller is used to handle incoming traffic for the defined resources. When we deploy ingress controller then at that time a service is also created which maps the host node ports to port 80 and 443. These host node ports are opened from each worker node. To get this detail, login to kube master node or control plan and run,

$ kubectl get all -n ingress-nginx

As we can see the output above, NodePort 32760 of each worker nodes is mapped to port 80 and NodePort 32375 are mapped to 443 port. We will use these node ports in Nginx configuration file for load balancing tcp traffic.

Step 4) Configure NGINX to act as TCP load balancer

Edit the nginx configuration file and add the following contents to it,

[root@nginxlb ~]# vim /etc/nginx/nginx.conf

Comments out the Server sections lines (Starting from 38 to 57) and add following lines,

upstream backend {
   server 192.168.1.41:32760;
   server 192.168.1.42:32760;
}

server {
   listen 80;
   location / {
       proxy_read_timeout 1800;
       proxy_connect_timeout 1800;
       proxy_send_timeout 1800;
       send_timeout 1800;
       proxy_set_header        Accept-Encoding   "";
       proxy_set_header        X-Forwarded-By    $server_addr:$server_port;
       proxy_set_header        X-Forwarded-For   $remote_addr;
       proxy_set_header        X-Forwarded-Proto $scheme;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_pass http://backend;
   }

    location /nginx_status {
        stub_status;
    }
}

Save & exit the file.

As per the above changes, when any request comes on port 80 on nginx server IP then it will be routed to Kubernetes worker nodes IPs (192.168.1.41/42) on NodePort (32760).

Let’s start and enable NGINX service using following commands,

[root@nginxlb ~]# systemctl start nginx
[root@nginxlb ~]# systemctl enable nginx

Test NGINX for TCP Load balancer

To test whether nginx is working fine or not as TCP load balancer for Kubernetes, deploy nginx based deployment, expose the deployment via service and defined an ingress resource for nginx deployment. I have used following commands and yaml file to deploy these Kubernetes objects,

[kadmin@k8s-master ~]$ kubectl create deployment nginx-deployment --image=nginx
deployment.apps/nginx-deployment created
[kadmin@k8s-master ~]$ kubectl expose deployments nginx-deployment  --name=nginx-deployment --type=NodePort --port=80
service/nginx-deployment exposed
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ vi nginx-ingress.yaml

[kadmin@k8s-master ~]$ kubectl create -f nginx-ingress.yaml
ingress.networking.k8s.io/nginx-ingress-example created
[kadmin@k8s-master ~]$

Run following commands to get deployment, svc and ingress details:

Perfect, let update your system’s host file so that nginx-lb.example.com points to nginx server’s ip address (192.168.1.50)

192.168.1.50      nginx-lb.example.com

Let’s try to ping the url to confirm that it points to NGINX Server IP,

# ping nginx-lb.example.com
Pinging nginx-lb.example.com [192.168.1.50] with 32 bytes of data:
Reply from 192.168.1.50: bytes=32 time<1ms TTL=64
Reply from 192.168.1.50: bytes=32 time<1ms TTL=64

Now try to access the URL via web browser,

Great, above confirms that NGINX is working fine as TCP load balancer because it is load balancing tcp traffic coming on port 80 between K8s worker nodes.

Step 5) Configure NGINX to act as UDP Load Balancer

Let’s suppose we have an UDP based application running inside the Kubernetes, application is exposed with UDP port 31923 as NodePort type. We will configure NGINX to load balance the UDP traffic coming on port 1751 to NodePort of k8s worker nodes.

Let’s assume we have already running a pod named “linux-udp-port” in which nc command is available, expose it via service on UDP port 10001 as NodePort type.

[kadmin@k8s-master ~]$ kubectl expose pod linux-udp-pod --type=NodePort --port=10001 --protocol=UDP
service/linux-udp-pod exposed
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ kubectl get svc linux-udp-pod
NAME            TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S)           AGE
linux-udp-pod   NodePort   10.96.6.216   <none>        10001:31923/UDP   19m
[kadmin@k8s-master ~]$

To configure NGINX as UDP load balancer, edit its configuration file and add the following contents at end of file

[root@nginxlb ~]# vim /etc/nginx/nginx.conf
……
stream {
  upstream linux-udp {
    server 192.168.1.41:31923;
    server 192.168.1.42:31923;
  }
  server {
    listen 1751 udp;
    proxy_pass linux-udp;
    proxy_responses 1;
  }
 ……

Save and exit the file and restart nginx service using following command,

[root@nginxlb ~]# systemctl restart nginx

Allow UDP port 1751 in firewall by running following command

[root@nginxlb ~]# firewall-cmd --permanent --add-port=1751/udp
[root@nginxlb ~]# firewall-cmd --reload

Test UDP Load balancing with above configured NGINX

[kadmin@k8s-master ~]$ kubectl exec -it linux-udp-pod -- bash
root@linux-udp-pod:/# nc -l -u -p 10001

Leave this as it is, login to the machine from where you want to test UDP load balancing, make sure NGINX server is reachable from that machine, run the following command to connect to udp port (1751) on NGINX Server IP and then try to type the string

# nc -u 192.168.1.50 1751

[root@linux-client ~]# nc -u 192.168.1.50 1751
Hello, this UDP LB testing

Now go to POD’s ssh session, there we should see the same message,

root@linux-udp-pod:/# nc -l -u -p 10001
Hello, this UDP LB testing

Perfect above output confirms that, UDP load balancing is working fine with NGINX. That’s all from this article, I hope you find this informative and helps you to setup NGINX Load balancer. Please don’t hesitate to share your technical feedback in the comments section below.

The post How to Configure NGINX as TCP/UDP Load Balancer in Linux first appeared on Linuxtechi.

How to Install OpenLiteSpeed Web Server on CentOS 8/RHEL 8

Mon, 19 Oct 2020 02:35:20 GMT

When it comes to opensource web servers, Apache and Nginx usually take the lion’s share in the hosting space and will often get the most attention. But those aren’t the only opensource web servers in the market which offer great performance and impressive stability. OpenLiteSpeed is yet another powerful, lightweight and opensource HTTP web server that is developed by LightSpeed technologies under the GPLv3.0 license. Notable features include:

An intuitive web-based admin GUI that displays real-time statistics.
Event-drive architecture with low resource overheads (RAM & CPU).
Efficient page caching.
Remarkable scalability thanks to worker processes.
Ability to handle thousands of concurrent connections without yielding load spikes.
Support for third-party modules.

And so much more.

In this guide, we will walk you the installation of OpenLiteSpeed on CentOS 8 / RHEL 8 system.

Step 1) Configure OpenLiteSpeed Repository

Before anything else, the first step is to add the OpenLiteSpeed repository to your CentOS 8 or RHEL 8 instance. This will allow you to install the OpenLiteSpeed web server and associated packages and dependencies. Therefore, log into your server instance and invoke the command below.

$ sudo rpm -Uvh http://rpms.litespeedtech.com/centos/litespeed-repo-1.1-1.el8.noarch.rpm

Then update the package lists as shown:

$ sudo dnf update

Step 2) Install PHP from OpenLiteSpeed Repositories

In this step, we are going to install PHP 7.4 using OpenLiteSpeed repository colloquially referred to as LSPHP. But before that, ensure that you have added the EPEL repo using the command:

$ sudo dnf install -y epel-release

After installing the EPEL repo, install LSPHP as shown

$ sudo dnf install -y lsphp74 lsphp74-mysqlnd lsphp74-process lsphp74-mbstring lsphp74-mcrypt lsphp74-gd lsphp74-opcache lsphp74-bcmath lsphp74-pdo lsphp74-common lsphp74-xml

Once PHP packages have been installed successfully using above dnf command then let’s install MariaDB database server.

Step 3) Install & Secure MariaDB database server

To install MariaDB database server, run:

$ sudo dnf install -y mariadb mariadb-server

Once installed, start mariadb database server by running:

$ sudo systemctl start mariadb
$ sudo systemctl enable mariadb

Run following systemctl command to check status of mariadb service,

$ sudo systemctl status mariadb

By default, MariaDB is not secure and therefore, we need to take some extra steps to secure it and avoid breaches. To do so, run:

$ sudo mysql_secure_installation

Begin by setting the root password if none was assigned.

For the remainder of the prompts. Simply press ‘Y’ for Yes to enforce best practice settings.

Step 4) Install OpenLiteSpeed with dnf command

Now, you need to get OpenLiteSpeed installed on your CentOS 8 instance. To install the web server, simply invoke the following dnf command:

$ sudo dnf install -y openlitespeed

Once the installation is completed, you can check the status of the web server using the command:

$ sudo systemctl status lsws

If the web server is not active and running, you can start it by running the command:

$ sudo systemctl start lsws

The web server listens on two ports: 8088 and 7080. Port 8088 is for demo purposes while the port 7080 gives you access to the administrative UI.

You can confirm the ports that the web server is listening on using the netstat command as shown:

$ sudo netstat -pnltu

If the firewall is running on your system then you should consider opening these ports as shown.

$ sudo firewall-cmd --zone=public --permanent --add-port=8088/tcp
$ sudo firewall-cmd --zone=public --permanent --add-port=7080/tcp
$ sudo firewall-cmd --reload

Step 5) Change the default Administrator Password

By default, the Admin’s password is set to ‘123456’, and for obvious reasons, we need to change this password and set a very robust password. Even better, we will specify a different username from the default ‘admin’ username.

To achieve this run the script shown below

$ sudo /usr/local/lsws/admin/misc/admpass.sh

Specify a different username and password as demonstrated below.

Step 6) Accessing OpenLiteSpeed web server

To access the default page for OpeLiteSpeed web server, browser the server’s address as shown:

http://server-ip:8088

This takes you to the demo page as shown.

You can click the menu bar options so see what’s in store. For example, when you click on the ‘Demos’ option, you get some featured demos such as testing the output ‘Hello word’ from the CGI script and the PHP version.

To access the administrative section, browse the server’s IP with the port 7080 using the https protocol.

https://server-ip:7080

Provide the new username and password that you set in the previous step and click the ‘Login’ button.

This takes you to the OpenLiteSpeed dashboard as shown below.

From here, you can configure virtual hosts, change the default port from port 8088 to another port and so much more. And this brings down the curtain on our topic for today. Please don’t hesitate to share your feedback and comments in the comments section below.

Also Read: How to Harden and Secure NGINX Web Server in Linux

The post How to Install OpenLiteSpeed Web Server on CentOS 8/RHEL 8 first appeared on Linuxtechi.