Showing posts with label linux. Show all posts
Showing posts with label linux. Show all posts

Saturday, 2 April 2022

awk commands

The awk action is inside braces {}

ps | awk '{print $1}''


Default separator is spaces

Change it to , for csv

awk -F ","


Change to : for passwd file

awk -F ":"


awk -F ":" '{print $1}' /etc/passwd


Print out multiple columns

awk -F ":" '{print $1 $6 $7}' /etc/passwd


Add some tabs between outputs to make it more readable

awk -F ":" '{print $1"\t"$6"\t"$7}' /etc/passwd


Change the field separator

Work on data that has : as field separator

But output the data with - as the field separator 

awk 'BEGIN{FS=":" OFS="-"} {print $1,$6,$7}' /etc/password


Print the last column

awk -F "/" '/^\//' {print $NF} /etc/shells | uniq | sort


the /'s need to be escaped \/dev

df | awk '/\/dev\/loop/' {print $1"\t"$2}


Find all the /bin/fish running

ps -ef | awk '{if ($NF == "/bin/fish") print $0}'


For loop

awk 'BEGIN {for 1=1; i<=10; i++) print "The square root of", i, "is", i*i';}'


Matching a pattern

awk '$1 ~ /^[b,c]/ {print $0}' .bashrc


awk 'match ($0, /mystring/' {print $0}'' numbered.txt


Print a section (NR number of records, line numbers)

between lines 7 and 11

df | awk 'NR==7, NR==11 {print NR, $0}'


Getting a line count

awk 'END {print NR}' /etc/shells


Friday, 13 July 2018

install cisco anyconnect client on linux mint

visit the IP of a server where its setup
login
you should get prompted to do manual install
download vpnsetup.sh
make it executable (chmod +x)
sudo ./vpnsetup.sh

use asdm on linux mint


Here is what I do.  Install java web start (aka icedtea).
sudo apt-get install icedtea-plugin
Then I have a single line script, which I call asdm.
javaws https://$1/admin/public/asdm.jnlp
Make it executable:
chmod +x asdm
Then to run ASDM on say, 1.2.3.4:
./asdm 1.2.3.4
This doesn't require any web browser, or web browser support.  It just uses the native installed java directly.

Taken from
https://supportforums.cisco.com/t5/firewalling/asdm-on-ubuntu/td-p/3067651

Monday, 10 July 2017

read csr information in linux

Extract information from the CSR

$ openssl req -in shellhacks.com.csr -text -noout

Verify the signature

$ openssl req -in shellhacks.com.csr -noout -verify

Whom the certificate will be issued to?

$ openssl req -in shellhacks.com.csr -noout -subject

Show the public key

$ openssl req -in shellhacks.com.csr -noout -pubkey

Tuesday, 30 May 2017

Tuesday, 8 September 2015

nmap

nmap -sP 192.168.1.0 /24 (icmp ping the network see if anyone responds)

nmap -sP -PT80 192.168.1.0 /24 (see if port 80 responds)

nmap -P0 --top-ports 192.168.1.127-254 > file (scan a range top 10 ports only output to file)

nmap -sS 192.168.1.254

-sS (SYN scan)
-sT (TCP connect)
-sU (UDP port scans)

-O (detect OS)
-sV (service version, which version of sendmail is running on port 25)

-P0 (don't ping just scan)

-T (pre set timing options used to avoid IDS/IPS)

-p (choose ports)

-F (fast scan)
-n (dont do revers DNS lookup)

Monday, 24 August 2015

slowness on login to linux server

Had a server which was taking 10 seconds to login after moving it from a hub to a VLAN on a switch. Sub interfaces were also created on the ASA.

Checked all the speed and duplex on the switch ports and server all looked good.
Linux command for checking network card info
sudo ethtool eth0

Sent some large ping packets back and forth was fine.

Found the issue was /etc/resolv.conf
The server couldn't reach the DNS servers configured in there

We changed the DNS servers to reachable ones and the issue was resolved.

The server must have been trying to resolve our IP address during login.






Wednesday, 23 October 2013

some useful redhat commands

Check Main IP and aliases

watch /sbin/ifconfig

Check Physical/Virtual/Manufacturer/Serial

/usr/sbin/dmidecode | less

Check scheduled tasks

crontab -l

Check RedHat Version

cat /etc/redhat-release


How to check esx version
vmware -v
vimsh -n -e 'hostsvc/hostsummary' | grep fullName
cat /proc/vmware/version


Check Apache version
/usr/sbin/httpd -v


Detect Jboss version
ls -l /usr/jboss
ls /usr/ | grep jboss

Detect java version
java -version

Detect mysql version
mysql -V
"mysql  Ver 14.12 Distrib 5.0.45, for redhat-linux-gnu (i686) using readline 5.0"

Detect oracle
. oraenv
bct1
sqlplus "/ as sysdba"
select * from v$version where banner like 'Oracle%';

Detect f-prot version
/usr/local/f-prot/fpscan --versio

Wednesday, 16 October 2013

tailing the squid logs for hosts with the most sessions

tail -5000 /var/log/squid/access.log | grep 'website.name' | awk -F " " '{print $3}' | sort -nr | uniq -c | more

Wednesday, 18 September 2013

find unauthorized SUID and SGID system executables

The administrator should take care to ensure that no rogue set-UID programs have been introduced into the system. In addition, if possible, the administrator should attempt a Set-UID audit and reduction. To check for these run the following script:
#!/bin/bash
for part in `awk '($3 == "ext2" || $3 == "ext3") { print $2 }' /etc/fstab`
do
 find $part -xdev \( -perm -04000 -o -perm -02000 \) -type f -print
done

find unauthorized world writable files in linux

World writeable files can be modified by any user on the system. Generally 
removing write access for the "other" category (chmod o-w ) is advisable, but 
always consult the relevant documentation in order to avoid breaking any 
application dependencies on a particular file. Run the following script to print 
a list of world writeable files to screen. These files should then be reviewed 
and if possible the world writeable permissions removed. 

#!/bin/bash
for part in `awk '($3 == "ext2" || $3 == "ext3") { print $2 }' /etc/fstab`
do
 find $part -xdev -perm -0002 -type f -print | less
done

SELinux TFTP policy

If you have SELINUX running SELINUX won't allow you to PUT or upload files to your TFTP server. You can use "audit2allow" to allow you to create custom SELINUX policies
To use this you need to examine your servers audit logs. /var/log/audit/audit.log. This is where selinux logs errors. If you are receiving permission denied errors when uploading or puttiing files due to SELINUX have a check of this log. If SELINUX is causing the problem you will see an error log entry that looks like this:

type=AVC msg=audit(1245199930.280:31): avc: denied { write } for pid=2584 comm="in.tftpd" name="tftpboot" dev=dm-0 ino=1747009 scontext=system_u:system_r:tftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tftpdir_t:s0 tclass=dir
type=SYSCALL msg=audit(1245199930.280:31): arch=40000003 syscall=5 success=no exit=-13 a0=805e7a2 a1=8041 a2=1b6 a3=8041 items=0 ppid=2565 pid=2584 auid=4294967295 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=4294967295 comm="in.tftpd" exe="/usr/sbin/in.tftpd" subj=system_u:system_r:tftpd_t:s0-s0:c0.c1023 key=(null)
Using this error and the audit2allow tool we can create a policy that allows TFTP writes.

Step 1

Create some policy rules to load into SELINUX. Using the grep command input log entries which match our error from the audit file to the audit2allow tool. $ grep tftpd_t /var/log/audit/audit.log | audit2allow -M tftplocal

NOTE!

The audit2allow tool isn't infallible and sometimes you might want to check the rules that are contained in the output module the above command has created aren't too relaxed. These rules are kept in a file called tftplocal.te that gets created as a result of the above command. It should look something like this:
module tftplocal 1.0;

require {
        type tftpd_t;
        type tftpdir_t;
        class dir { write };
        class file { write };
}

#============= tftpd_t ==============
allow tftpd_t tftpdir_t:dir { write add_name };
allow tftpd_t tftpdir_t:file { write create };

Step 2

Import the selinux policy module created in step 1 $ semodule -i tftplocal.pp

checking the status of a service in linux

In this example I want to see if SMB is running

Check the status:
/etc/init.d/smb status

I can restart a service with
/etc/init.d/smb stop
/etc/init.d/smb start

or simply
/etc/init.d/smb restart

Check if the service is set to start on boot up
chkconfig --list | grep smb

SELinux

SElinux can stop samba (and other things) from working. You can turn it off by running the following command as root
"setenforce 0"
This is not recommended as it disables other security features but no one seems to know how to create exceptions for SElinux. SElinux will start again after a reboot. To stop it starting on reboot
sudo vi /etc/selinux/config
change the line SELINUX=enforcing to SELINUX=permissive
Save your changes and that should be it.

How many CPU sockets does my server have?

$ egrep "processor|physical id|core id" /proc/cpuinfo
processor   : 0
physical id  : 0
core id        : 0
processor   : 1
physical id  : 0
core id        : 0


The output show is for a single socket dual core machine.  Each core has a different processor ID, but the same physical ID (The physical ID indicating they are in fact on the same socket.  A virtual machine will usually only show the processor line and not the physical or core id's.

Thursday, 8 August 2013

tracking what servers are using port 25 with linux CLI tools

There was an issue with an unknown server sending out emails and getting the public IPs blacklisted, one of my colleagues came up with this line to find what that server was by searching the syslog.

grep 'Built outbound TCP connection' my-asa-log.log | grep '/25' | grep -v 'INSIDE:192.160.10.50' | awk -F " " '{print $15}' | awk -F "/" '{print $1} | sort | uniq -c


grep 'Built outbound TCP connection' my-asa-log.log
search for outbound connections in the ASA syslog file

grep '/25'
Search for connections to port 25

grep -v 'INSIDE:192.160.10.50'
Remove entires for 192.160.10.50 (the real email server)

awk -F " " '{print $15}'
Print column 15 which was

awk -F "/" '{print $1}'
I think this was the date

sort
sorts the data alpha numeric

uniq -c
Only shows one instance of an IP address and shows the count of how many times it appeared


Thursday, 25 July 2013

configuring an IP on centos / redhat

I was used to using ubuntu so this was a bit different

sudo vi /etc/sysconfig/network
set hostname and default gateway

sudo vi /etc/sysconfig/network-scripts/ifcfg-eth0
set up and IP on the interface

service network restart


Wednesday, 3 July 2013

servers time going out of sync

I had an issue where a monitoring slave went out of sync with the master.

Quick fix - set the date/time manually
date MMddhhmmyyyy” so 17:32 13/12/2012 would be “date 121317322012”. You need to be root to run this command so “sudo su” or “sudo bash” first.
Or restart ntpd

You should have an NTP server configured in your network. FYI you can configure a Cisco ASA to provide NTP. The NTP server should be syncing off a local ntp server see http://www.pool.ntp.org/en/.

Some troubleshooting / information gathering steps below:

Step 1 - log on to both servers (the out of sync and the in sync)
Run "watch -n 1 date" this should highlight the difference in time

Step 2 - is the server VM or physical
sudo /usr/sbin/dmidecode | grep "Manufacturer: \|Product Name: "
If its a VM check for the vmware or hyper-v tools check time sync settings there
Check time sync settings on the VM host
If physical check ntp settings

Step 3 - check ntp config
vi /etc/ntp.conf 

Step 4 - check scheduled tasks, is ntpdate or ntpd running
sudo bash
crontab -l
*/1 * * * * /usr/bin/ntpd -q ?
This runs ntpd with –q which quits after it has set the time the “ > /dev/null” just redirects any output to trash because we don’t want to see the output. The 2>&1 is used to redirect stderr to stdout.  /dev/null 2>&1
ntpdate and ntpd are different and you shouldn't have both running at the same time

Step 5 - check service startup settings
/sbin/chkconfig –list

Step 6 - check ntpd service status
/etc/init.d/ntpd status


Tuesday, 5 March 2013

investigating RAM, CPU or disk space alerts on linux servers

First establish what is alerting, RAM CPU or disk usage and connect to the server.


If the alert is for RAM usage
Connect to the server and run the "top" command (type "top" and press enter)
Top is similar to taskmgr on windows.

Press Shift and M to sort the processes by highest mem usage

The command "free -m" can also be useful for seeing how much memory is used/free.

You can see which process is using up all the memory. What user is running the process. You may need to contact the customer, application or DB team to find out if this is expected and what the next step should be.

If the alert is for CPU usage

Connect to the server and run the "top" command (like taskmgr on windows)
Press Shift and P to sort the processes by highest CPU usage

You can see which process is using up all the CPU. What user is running the process. You may need to contact the customer, application or DB team to find out if this is expected and what the next step should be.



If the alert is for disk space usage
Connect to the server and run the "df -h" command.

This will show you the percent usage on each partition/mount
To get further infromation on reads/writes to that partition run
"vmstat -p /mount/point" for example "vmstat -p /dev/sda2"

If we run the "df -h" command and we discover that /home is at 95% usage. We can see what is using up all the space by using the du command. First "cd /home". You can use the following du command:
"du -sm * | sort -nr | head -10" this will give the results in MB, sort them with the largest at the top and only show the top 10 results.

You can contact the owners of large files and ask them if they are required. You may find that log files grow to a large size or backup files are building up. Best practice is to set up a script to remove old files.
Before assigning to N&S you should complete the steps above. With the information provided you should be able to resolve the tag. If not take screen shots of your output and attach them to the tag.

More on using the top command
press shift P - sorts processes by highest CPU usage
press shift M - sort processes by highest Mem usage
press u type a username and press enter - shows only processes for that username (press u and enter to bring them all back)
press r and enter the PID to re-nice a process - sets a process to a higher or lower priority (be careful)
press shift R - this will sort by PID (shift R again to change it back)
press c - shows full command that was used to launch the process
press k and enter the PID - will kill the selected process (be careful)
press q - will quit the top application


Script to list largest directory or files
Just copy the script below onto the server you want to check
It will give you the top 10 directories and then the top files in those directories
You may need to make it executable

#!/bin/bash
# This will give the user back a listing of the largest files/dirs on the system

# make some tempfiles
mktemp1="/tmp/mktemp1"

# get overall 10 largest dirs
du -sm /* |sort -nr |head > $mktemp1

echo "Directory size listings for " $(hostname -s)
echo "Run date: "$(date)
echo "All sizes on left are in MB"
echo " "
echo "/ dir size list"
cat $mktemp1
echo " "

# for the largest 5 of the above get the sizes in them
top5=$(head -5 $mktemp1 |awk -F " " '{print $2}')

for dir in $top5
do
        echo $dir dir size list
        du -sm $dir/* |sort -nr |head
        echo " "
done

rm $mktemp1
exit 0



Tuesday, 22 January 2013

Using Bash(shell) history effectively

Using Bash(shell) history effectively

The majority of these tricks utilize the ‘history’ command in some way, so let’s cover that one first. Just type:

history

To execute a specific command from your history, you can just type an exclamation point followed by the number of the command as listed by history. Here, I’ll re-execute command number 510.

!510
By the way, an exclamation point is referred to as a “bang.”

You can also refer to a command by how long ago it was run. Next, let’s execute whatever we typed three commands ago.

!-3

Quick Substitutions

Let’s say you want to rerun your previous command. Just type two exclamation points. This is perfect for when you run a command that needs super-user privileges and you forgot to do that. Just give it the old “sudo bang bang” treatment:

sudo !!

Let’s say you want to run a command with the last argument you used. Typing it out is too tedious. Just use a “bang dollar” to substitute your last argument automatically.

cd !$


What if you ran a command with two arguments and you want to run the first one? “Bang caret” This works well when you make a backup of a config file and then want to edit it.

nano !^


Next, let’s search for a specific command from your history. Ctrl+R will search backwards for whatever you type. It will autocomplete as you type, and you can scroll back up through the history if you hit Ctrl+R again to find the specific instance you’re looking for.



If you know the last command you ran with a specific keyword, you can skip the search process and pare down your key presses by at least one.

!keyword


Now, for the power substitution: you can substitute an argument for your last specific command using something similar to the previous method. Just add a colon and the number of the argument.

ls !ln:2

Here, I substituted the second argument from my last ‘ln’ command.



As you can see, I used a Ctrl+R lookup to help illustrate where that argument came from.

Once you’ve found the command you have several options:

  1. Run it verbatim – just press Enter
  2. Edit it before running – you can use arrow keys or different key bindings to navigate to the point you want to edit
  3. Cycle through other commands that match the letters you’ve typed – press Ctrl-R successively
  4. Quit the search and back to the command line empty-handed – press Ctrl-G