Sunday 29 January 2017

INTRODUCTION TO SYSTEMD

Systemd is a system and service manager for Linux operating systems. It is designed to be backwards compatible with SysV init scripts, and provides a number of features such as parallel startup of system services at boot time, on-demand activation of daemons, support for system state snapshots, or dependency-based service control logic. In Red Hat Enterprise Linux 7, systemd replaces Upstart as the default init system.

 Systemd Unit Locations

Directory                                             Description
/usr/lib/systemd/system/            Systemd units distributed with installed RPM packages.
/run/systemd/system/                  Systemd units created at run time. This directory takes precedence over the directory with installed service units.
/etc/systemd/system/                   Systemd units created and managed by the system administrator. This directory takes precedence over the directory with runtime units.

MANAGING SYSTEM SERVICES

Previous versions of Red Hat Enterprise Linux, which were distributed with SysV init or Upstart, used init scripts located in the /etc/rc.d/init.d/ directory. These init scripts were typically written in Bash, and allowed the system administrator to control the state of services and daemons in their system. In Red Hat Enterprise Linux 7, these init scripts have been replaced with service units.
Service units end with the .service file extension and serve a similar purpose as init scripts. To view, start, stop, restart, enable, or disable system services, use the systemctl command as described in Table 21.2.1 “Comparison of the service Utility with systemctl ”, Table 21.2.2 “Comparison of the chkconfig Utility with systemctl”, and in the section below. The service and chkconfig commands are still available in the system and work as expected, but are only included for compatibility reasons and should be avoided.

Comparison of the service Utility with systemctl

service
systemctl
Description
service name start
systemctl start name.service
Starts a service.
service name stop
systemctl stop name.service
Stops a service.
service name restart
systemctl restart name.service
Restarts a service.
service name condrestart
systemctl try-restart name.service
Restarts a service only if it is running.
service name reload
systemctl reload name.service
Reloads configuration.
service name status
systemctl status name.service
systemctl is-active name.service
Checks if a service is running.
service --status-all
systemctl list-units --type service --all
Displays the status of all services.

Comparison of the chkconfig Utility with systemctl

chkconfig
systemctl
Description
chkconfig name on
systemctl enable name.service
Enables a service.
chkconfig name off
systemctl disable name.service
Disables a service.
chkconfig --list name
systemctl status name.service
systemctl is-enabled name.service
Checks if a service is enabled.
chkconfig --list
systemctl list-unit-files --type service
Lists all services and checks if they are enabled.
chkconfig --list
systemctl list-dependencies --after
Lists services that are ordered to start before the specified unit.
chkconfig --list
systemctl list-dependencies --before
Lists services that are ordered to start after the specified unit.

Starting a Service


To start a service unit that corresponds to a system service, type the following at a shell prompt as root:
systemctl start name.service
Replace name with the name of the service unit you want to start (for example, gdm). This command starts the selected service unit in the current session.
Example Starting a Service
The service unit for the Apache HTTP Server is named httpd.service. To activate this service unit and start the httpd daemon in the current session, run the following command as root:
~]# systemctl start httpd.service

Stopping a Service

To stop a service unit that corresponds to a system service, type the following at a shell prompt as root:
systemctl stop name.service
Replace name with the name of the service unit you want to stop (for example, bluetooth). This command stops the selected service unit in the current session.
Example Stopping a Service
The service unit for the bluetoothd daemon is named bluetooth.service. To deactivate this service unit and stop the bluetoothd daemon in the current session, run the following command as root:
~]# systemctl stop bluetooth.service

 Restarting a Service

To restart a service unit that corresponds to a system service, type the following at a shell prompt as root:
systemctl restart name.service
Replace name with the name of the service unit you want to restart (for example, httpd). This command stops the selected service unit in the current session and immediately starts it again. Importantly, if the selected service unit is not running, this command starts it too. To tell systemd to restart a service unit only if the corresponding service is already running, run the following command as root:
systemctl try-restart name.service
Certain system services also allow you to reload their configuration without interrupting their execution. To do so, type as root:
systemctl reload name.service
Note that system services that do not support this feature ignore this command altogether. For convenience, the systemctl command also supports the reload-or-restart and reload-or-try-restart commands that restart such services instead.
Example Restarting a Service
In order to prevent users from encountering unnecessary error messages or partially rendered web pages, the Apache HTTP Server allows you to edit and reload its configuration without the need to restart it and interrupt actively processed requests. To do so, type the following at a shell prompt as root:
~]# systemctl reload httpd.service

Enabling a Service

To configure a service unit that corresponds to a system service to be automatically started at boot time, type the following at a shell prompt as root:
systemctl enable name.service
Replace name with the name of the service unit you want to enable (for example, httpd). This command reads the [Install] section of the selected service unit and creates appropriate symbolic links to the /usr/lib/systemd/system/name.service file in the /etc/systemd/system/ directory and its subdirectories. This command does not, however, rewrite links that already exist. If you want to ensure that the symbolic links are re-created, use the following command as root:
systemctl reenable name.service
This command disables the selected service unit and immediately enables it again.

Example Enabling a Service
To configure the Apache HTTP Server to start automatically at boot time, run the following command as root:
~]# systemctl enable httpd.service
ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service'

Disabling a Service

To prevent a service unit that corresponds to a system service from being automatically started at boot time, type the following at a shell prompt as root:
systemctl disable name.service
Replace name with the name of the service unit you want to disable (for example, bluetooth). This command reads the [Install] section of the selected service unit and removes appropriate symbolic links to the /usr/lib/systemd/system/name.service file from the /etc/systemd/system/ directory and its subdirectories. In addition, you can mask any service unit to prevent it from being started manually or by another service. To do so, run the following command as root:
systemctl mask name.service
This command replaces the /etc/systemd/system/name.service file with a symbolic link to /dev/null, rendering the actual unit file inaccessible to systemd. To revert this action and unmask a service unit, type as root:
systemctl unmask name.service
Example Disabling a Service
To prevent this service unit from starting at boot time, type the following at a shell prompt as root:
~]# systemctl disable bluetooth.service
rm '/etc/systemd/system/dbus-org.bluez.service'

rm '/etc/systemd/system/bluetooth.target.wants/bluetooth.service'

Changing the Time Zone in RHEL 7

To list all available time zones, type the following at a shell prompt:
~]# timedatectl list-timezones
To change the currently used time zone, type as root:
~]# timedatectl set-timezone time_zone
Replace time_zone with any of the values listed by the timedatectl list-timezones command.
Example Changing the Time Zone
To identify which time zone is closest to your present location, use the timedatectl command with the list-timezones command line option. For example, to list all available time zones in Europe, type:
~]# timedatectl list-timezones | grep Europe
Europe/Amsterdam
Europe/Andorra
Europe/Athens
Europe/Belgrade
Europe/Berlin
Europe/Bratislava
To change the time zone to Europe/Prague, type as root:

~]# timedatectl set-timezone Europe/Prague

NTP configuration in RHEL 7

The Network Time Protocol (NTP) enables the accurate dissemination of time and date information in order to keep the time clocks on networked computer systems synchronized to a common reference over the network or the Internet. Many standards bodies around the world have atomic clocks which may be made available as a reference. The satellites that make up the Global Position System contain more than one atomic clock, making their time signals potentially very accurate. Their signals can be deliberately degraded for military reasons. An ideal situation would be where each site has a server, with its own reference clock attached, to act as a site-wide time server. Many devices which obtain the time and date via low frequency radio transmissions or the Global Position System (GPS) exist. However for most situations, a range of publicly accessible time servers connected to the Internet at geographically dispersed locations can be used. These NTP servers provide “Coordinated Universal Time” (UTC). Information about these time servers can found at www.pool.ntp.org.
Accurate time keeping is important for a number of reasons in IT. In networking for example, accurate time stamps in packets and logs are required. Logs are used to investigate service and security issues and so time stamps made on different systems must be made by synchronized clocks to be of real value. As systems and networks become increasingly faster, there is a corresponding need for clocks with greater accuracy and resolution. In some countries there are legal obligations to keep accurately synchronized clocks. Please see www.ntp.org for more information. In Linux systems, NTP is implemented by a daemon running in user space. The default NTP user space daemon in Red Hat Enterprise Linux 7 is chronyd. It must be disabled if you want to use the ntpd daemon.

[root@RHEL7 ~]# systemctl stop chronyd
[root@RHEL7 ~]# systemctl disable chronyd
[root@RHEL7 ~]# yum install ntp
Configure ntp.conf file like shown below
[root@RHEL7 ~]# cat /etc/ntp.conf
tinker panic 0
driftfile /var/lib/ntp/drift
restrict default nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict ::1
server 10.18.17.32 iburst
server 10.18.17.33 iburst
server 10.18.11.30 iburst
server 10.18.11.31 iburst
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
disable monitor
[root@RHEL7 ~]# systemctl restart ntpd
[root@RHEL7 ~]# systemctl status ntpd
[root@RHEL7 ~]# systemctl enable ntpd
[root@RHEL7 ~]# ntpq -np
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 10.18.17.32    .INIT.          16 u    - 1024    0    0.000    0.000   0.000
 10.18.17.33    .INIT.          16 u    - 1024    0    0.000    0.000   0.000
*10.18.11.30    10.18.11.30     5 u  261  512  377    0.827   -8.280  10.270
+10.18.11.31    10.18.11.30     5 u  497  512  377    0.720  -23.474  11.101

[root@RHEL7 ~]# ntpstat
synchronised to NTP server (10.18.11.30) at stratum 6
   time correct to within 388 ms
   polling server every 512 s
[root@RHEL7 ~]#

timedatectl command gives a detailed info about system time and date

[root@RHEL7 ~]# timedatectl
      Local time: Thu 2015-12-31 00:27:00 CST
  Universal time: Thu 2015-12-31 06:27:00 UTC
        RTC time: Thu 2015-12-31 06:27:00
       Time zone: America/Chicago (CST, -0600)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: no
 Last DST change: DST ended at
                  Sun 2015-11-01 01:59:59 CDT
                  Sun 2015-11-01 01:00:00 CST
 Next DST change: DST begins (the clock jumps one hour forward) at
                  Sun 2016-03-13 01:59:59 CST
                  Sun 2016-03-13 03:00:00 CDT

VMware tools in RHEL 7

The open-vm-tools package is a suite of open source virtualization utilities and drivers which improve performance and user experience when running Red Hat Enterprise Linux 7 as a guest on a VMware vSphere ESX(i) hypervisor. The open-vm-tools package provides a secure and authenticated mechanism for performing various operations on the guest operating system from the hypervisor.

Red Hat Enterprise Linux 7 includes the latest stable release of open-vm-tools. Updates to the open-vm-tools package are provided with the operating system maintenance updates and patches.

[root@RHEL7 ~]# rpm -qa |grep open-vm
open-vm-tools-9.10.2-4.el7.x86_64
open-vm-tools-desktop-9.10.2-4.el7.x86_64
[root@RHEL7 ~]#

To interact with open-vm-tools , issue commands to the vmtoolsd service from a guest with the systemctl command, for example:

To query whether open-vm-tools is running:

# systemctl status vmtoolsd.service

To start open-vm-tools:

# systemctl start vmtoolsd.service

To start open-vm-tools on boot, enable the vmtoolsd service:

# systemctl enable vmtoolsd.service

To restart open-vm-tools:

# systemctl restart vmtoolsd.service

To stop open-vm-tools:

# systemctl stop vmtoolsd.service

To disable the vmtoolsd service from running at boot:

# systemctl disable vmtoolsd.service

For additional help with the vmtoolsd and other commands, run:


# systemctl help vmtoolsd

CONFIGURE NIC (NETWORK INTERFACE CARD) BONDING in RHEL 7

NIC (Network Interface Card) bonding is also known as Network bonding. It can be defined as the aggregation or combination of multiple NIC into a single bond interface. Its main purpose is to provide high availability and redundancy.

Policy Details
Ploicy Name
Code
Description
balance-rr
0
Round-Robin policy for fault tolerance
active-backup
1
Active-Backup policy for fault tolerance
balance-xor
2
Exclusive-OR policy for fault tolerance
broadcast
3
All transmissions are sent on all slave interfaces.
802.3ad
4
Dynamic link aggregation policy
balance-tlb
5
Transmit Load Balancing policy for fault tolerance
balance-alb
6
Active Load Balancing policy for fault tolerance

Prerequisite:

If bonding module is not loaded on your linux box then use the below command to load.

# modprobe bonding

To list the bonding module info, use following command.

# modinfo bonding
[root@localhost ~]# modinfo bonding
filename:       /lib/modules/3.10.0-229.el7.x86_64/kernel/drivers/net/bonding/bonding.ko
alias:          rtnl-link-bond
author:         Thomas Davis, tadavis@lbl.gov and many others
description:    Ethernet Channel Bonding Driver, v3.7.1
version:        3.7.1
license:        GPL
rhelversion:    7.1

create a file bonding.conf in /etc/modprobe.d/

[root@localhost ~]# vi /etc/modprobe.d/bonding.conf
alias bond0 bonding
[root@localhost ~]#

Create a bond interface file. In my case its bond0

[root@localhost ~]# cd /etc/sysconfig/network-scripts/
[root@localhost network-scripts]# vi ifcfg-bond0
DEVICE=bond0
TYPE=Bond
NAME=bond0
BONDING_MASTER=yes
BOOTPROTO=none
ONBOOT=yes
IPADDR=x.x.x.x
NETMASK=x.x.x.x
GATEWAY=x.x.x.x
DNS1=x.x.x.x
BONDING_OPTS="mode=1 miimon=100"
[root@localhost network-scripts]#

Choose desired bond policy and make changes in BONDING_OPTS field. In my case I have chosen mode 1 which is active backup.

Configure the existing interfaces as slave to bond0

[root@localhost network-scripts]# cat ifcfg-eth0
TYPE=Ethernet
BOOTPROTO=none
DEVICE=eth0
ONBOOT=yes
HWADDR="00:50:56:96:64:9d"
MASTER=bond0
SLAVE=yes
[root@localhost network-scripts]# cat ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=none
DEVICE=eth1
ONBOOT=yes
HWADDR="00:50:56:96:18:a6"
MASTER=bond0
SLAVE=yes
[root@localhost network-scripts]# systemctl restart network
[root@localhost network-scripts]# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: fault-tolerance (active-backup)
Primary Slave: None
Currently Active Slave: eth0
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: eth0
MII Status: up
Speed: 10000 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: 00:50:56:96:64:9d
Slave queue ID: 0

Slave Interface: eth1
MII Status: up
Speed: 10000 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: 00:50:56:96:18:a6
Slave queue ID: 0
[root@localhost ~]#


We have successfully configured nic bonding with Bonding Mode: fault-tolerance (active-backup)

HOW TO DISABLE CTRL-ALT-DEL IN RHEL7

Disable the ctrl + Alt + delete key combination, one need to mask a service. This is like disabling a service,
Run the following command:
[root@RHEL7 ~]# ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
Or
[root@RHEL7 ~]# systemctl mask ctrl-alt-del.target
Created symlink from /etc/systemd/system/ctrl-alt-del.target to /dev/null.
NOTE: systemd will recognize units symlinked to /dev/null and show them as masked. If one try to send key combination, this will fail with following similar error.
However above steps will not disable ctrl + Alt + delete key combination, in GUI mode. To disable it in GUI change keyboard settings.
Navigate to  Applications -> System Tools -> Settings -> Keyboard  -> Shortcuts -> System

Set value of `Logout` as Disabled

Deny user direct login via ssh but allow login in between servers using match method

To Deny user direct login via ssh but allow login in between servers we can user below “Match” method, This will Allow Ranjith_P04 user to login only from 10.18.43.69/10.18.43.70/10.18.43.71 servers and the same user is denied to login from entire network 10.18.*.*
This needs to be added in last line of /etc/ssh/sshd_config file with same order in all 3 servers and restart sshd service
 Also need to remove “DenyUsers Ranjith_P04” line from /etc/ssh/sshd_config in order allow the user to login via ssh in between the given servers.

Match User Ranjith_P04 Address 10.18.43.69
PasswordAuthentication yes
Match User Ranjith_P04 Address 10.18.43.70
PasswordAuthentication yes
Match User Ranjith_P04 Address 10.18.43.71
PasswordAuthentication yes
Match User Ranjith_P04 Address 10.18.*.*
PasswordAuthentication no

Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory Unable to get Chassis Power Status

You might of faced below error while executing “ipmitool lan print” command to find ILO IP.

Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory Unable to get Chassis Power Status

To overcome this we need to load two modules.

#modprobe ipmi_si

#modprobe ipmi_devintf

Authentication failure (Clock skew too great)

I’ve faced a ACCESS DENIED issue when trying to login  after vmware tools update. While checking on /var/log/secure I found (Clock skew too great) error.

To overcome this I re-synchronized ntp and authentication worked successfully.

Jul 25 06:34:13 RHEL7 sshd[16099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=domain.platforms.com  user=Ranjith_P04
Jul 25 06:34:13 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)
Jul 25 06:34:13 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)
Jul 25 06:34:15 RHEL7 sshd[16099]: Failed password for Ranjith_P04 from 10.81.11.250 port 50457 ssh2
Jul 25 06:34:20 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)
Jul 25 06:34:20 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)

How to set grub password in rhel 7

 Set grub password in rhel 7

GRUB 2 supports both plain-text and encrypted passwords in the GRUB 2 template files. To enable the use of passwords, specify a superuser who can reach the protected entries. Other users can be specified to access these entries as well. Menu entries can be password-protected for booting by adding one or more users to the menu entry as described below
Use grub2-mkpasswd-pbkdf2 command as superuser and generate hash of your password

[root@RHEL7 ~]# grub2-mkpasswd-pbkdf2
Enter password:
Reenter password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.94B202970DD3C124AF25AC9F05B504C6CAFBDEB976821E5D8247A938D3DBC0D9678B62E9519EEBC8A01DA479666578DC87B8CD0A8AF45A2D27285E76A1810F27.C8C6F75E5B6F9063271FEBB8294CA1276F4E87848632D30A95E29471F9AD43D845903B98CFE547C08B272E37E441768786BDC9899239CAC6599A8522D845F3A6

When the users and passwords are set up, specify the menu entries that should be password-protected in the /etc/grub.d/40_custom file in a similar fashion to the following:

[root@RHEL7 ~]# cat /etc/grub.d/40_custom
#!/bin/sh
exec tail -n +3 $0
set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.94B202970DD3C124AF25AC9F05B504C6CAFBDEB976821E5D8247A938D3DBC0D9678B62E9519EEBC8A01DA479666578DC87B8CD0A8AF45A2D27285E76A1810F27.C8C6F75E5B6F9063271FEBB8294CA1276F4E87848632D30A95E29471F9AD43D845903B98CFE547C08B272E37E441768786BDC9899239CAC6599A8522D845F3A6
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

NOTE: the line below "set superusers" is a single line it should be password_pbkdf2 root followed by the encrypted password.

[root@RHEL7 ~]#

Run grub2-mkconfig -o /boot/grub2/grub.cfg to import the changes into the main configuration file.

[root@RHEL7 ~]# grub2-mkconfig -o /boot/grub2/grub.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-3.10.0-327.3.1.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-327.3.1.el7.x86_64.img
Found linux image: /boot/vmlinuz-3.10.0-229.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-229.el7.x86_64.img
Found linux image: /boot/vmlinuz-0-rescue-aed9495c9fa84bfbb71646105626f6c3
Found initrd image: /boot/initramfs-0-rescue-aed9495c9fa84bfbb71646105626f6c3.img
done