Birbirine Internet üzerinden erişebilen iki Linux cihaz düşünelim. (IP adresleri yine de Internet üzerinde kullanılmayan bloktan verilmiştir)

IP TANIMLARI

node1 (eth0 internet, eth1 iç ağa bakan kısım olsun)
eth0 : 192.168.200.150/24
eth1:  10.1.1.1/24
tunel arayuzu (tonode2): 172.16.151.1/30

node2 (eth0 internet, eth1 iç ağa bakan kısım olsun)
eth0:  10.10.10.150/24
eth1:  10.2.1.1/24
tunnel arayuzu (tonode1): 172.16.151.2/30

node1 ve node2 cihazlarının birbirlerine eth0 arayüzleri üzerinde Interneti kullanarak erişebildiğini düşünelim. Sırasıyla cihazları yapılandıralım.

TUNEL YAPILANDIRMASI

node1)

#modprobe ip_gre
#ip tunnel add tonode2 mode gre remote 10.10.10.150 local 192.168.200.150
#ip link set tonode2 up
#ip addr add 172.16.151.1/30 dev tonode2

node2)

#modprobe ip_gre
#ip tunnel add tonode1 mode gre remote 192.168.200.150 local 10.10.10.150
#ip link set tonode1 up
#ip addr add 172.16.151.1/30 dev tonode1

node1 üzerinde yaptıklarımızı anlatırsak:

• ip_gre modülünü yükledik
• tonode2 adında bir tünel arayüzü yaratıp uç noktaları (yerel ve uzaktaki adresler) belirledik
• Tünel arayüzü ayağa kaldırdık
• Tünelimize bir IP addresi verdik.

Fakat henüz iç ağımıza giden trafiği tünele yönlendirmedik. Bunun için :

node1)

#ip route add 10.2.1.0/24 dev tonode2

Bu komutla 10.2.1.0/24 ağını tünelin diğer tarafına yönlendirmiş oluyoruz.

node2)

#ip route add 10.1.1.0/24 dev tonode1

Şimdi node2 üzerinden 10.1.1.1 adresine ping attığınızda cevap almanız gerekiyor. Alamıyorsanız bir yerde bir hata yapmış olmalı yada aradaki bağlantılarda bir sorun olması gerek.

The exact description of what this does is

Our test user is : mert

1) Adjust /etc/sysconfig/vncservers config file as below:

2) Login to mert account and set vncpassword

3) Start vnc service and add it into the startup.

However if you connect via VNC client now, you won’t see default GNOME but twm instead.

Open the file /home/mert/.vnc/xstartup and uncomment the following lines (remove the hash in front)

Restart VNC server to have the new changes affected.

4) Below is a step by step login into VNC server from my windows OS

a) connection screen

b) Password screen

c) GNOME screen

It is very useful to use the option “-t” in screen as it allows you to mark your instances. If you run a new screen sheel with the command;

Then when you run Ctrl-a “ to list the windows, you will recognize your tailing window with the title “/var/log/local6″

This is a very short article about screen. I hope on the way I use this tool, I may improve this it.

Slave Interfaces : eth1 and eth2
Bonding interface: bond0

1) First add the followings into /etc/modprobe.conf file to provide module paramaters:

With this configuration, we use active backup mode. By that, if the primary interface goes down for some reason, bonding system will fail over into the other interface. If you want to use round robin load balancing which will enable to use both interfaces actively use “balanced_rr” instead of “active-backup”

2) Configure slave and bonding interfaces.

/etc/sysconfig/network-scripts/ifcfg-bond0

3) Now bring up the bonding interface and look at “ip addr” output

#ifup bond0

You might have noticed that both eth1 and eth2 use the same MAC address which actually what we expect and how it works.

In order to see the bonding status and current active slave interface, issue the following;

Here you can see the real mac addresseses of the interfaces.

4) Fail over test

You can actually test how fail over works. In my vmware test system, I have disconnected eth1 and active slave (eth1)  failed over into eth2 at around 3 secs. (I was pinging at the same time) It switches over quite fast but what I have realized is, system keeps the previous mac address even though the interface having that MAC failed. For example in my setup (according to the previous bond0 output), eth1 is failed and eth2 is active slave however other nodes in the network know my 10.0.0.230 IP of having 00:0c:29:47:49:8d MAC. It is quite reasonable indeed. We don’t have to change mac and send unnecessary gratitous arp requests. Once one of your interfaces goes down in your bonding you will see a similar output in your dmesg.

That is all for this article, please drop your comments if you have anything to add or questions.

You can find quite a lot of information about bonding at the following address. I recommend you to read it

http://www.linuxfoundation.org/collaborate/workgroups/networking/bonding

For example if you want to set ethernet options into your ifcfg-eth0 file below is the quote from this file;

I hope that you have taken the backup of partition table previously with the command;

Or if you also want to backup the whole MBR to a file do this;

From now on, I assume that you have booted the system in rescue mode with networking support.

1) The first thing is to paste this partition table back into its original space. Presumably, you have copied the partition table from network and put it under /tmp/sda_partition_table.out

This will fix your partition table. Now time to fix MBR

2) As the MBR has gone, we have to write MBR again. Do the followings;

The root (hd0,0) command assumes that your boot partition is in /dev/sda1

After these commands, you should be able to boot your system as before.

In my rescue environment when I issue “lvm vgdisplay” , I was able to display the configuration but there was no device files under /dev. To overcome this problem do the followings:

The first command “vgscan” scans all disks for volume groups and the second one “vgchange” makes the logical volumes known to the kernel. To deactivate you should but “n” instead of “y” on the command line.

Now you can access logical volumes.

1) seinfo: This is the selinux query tool to see statistics about your policy.

2) sesearch: This is a very handy tool. When I started using SELinux, I was thinking that processes with a specific type are only allowed to make operations of the same type:) how stupid I am. Then I have seen by experience that policy can defines it and to see what a source can do, we can use sesearch. For example to search for httpd_t type source in order to see in which types it is associated with issue the following;

3) Restorecon

This is a very useful utility that allows you to restore types configured statically in the system. The only thing you should do is

However if your type is in /etc/selinux/targeted/contexts/customizable_types file then you have to add “-F” flag into the command, if you don’t nothing happens:)  As I have quoted text from Dan Walsh’s blog (RH engineer) , restorecon ignores these types and -F must be added.

• customizable_types
  • These are a list of file types that restorecon will ignore.  So if you want to relabel your entire system using restorecon, and a file is labeled with a context in this file, the context will not be changed.  This can be overridden with the -F flag.  This allows you to specify special directories on your system as being readable by apache.  So if you chcon -R -t httpd_sys_content_t  /var/myhtml, a relabel will not change this directory tree back to var_t.

Selinux User Guide: http://docs.fedoraproject.org/selinux-user-guide/f12/en-US/index.html