Serveurs Software

tcprules

26.06.2008 0

Comme je n’arrive jamais à retenir cette ligne pourtant fort simple, hop hop je la note dans un coin de mon blog, ca peut toujours (me) servir. Ceux qui en ont besoin sauront à quoi ca sert :)
tcprules tcp.qmail-smtp.cdb tcp.qmail-smtp.tmp < tcp.qmail-smtp

Optimiser un serveur MySQL

25.06.2008 0

Voici quelques informations et scripts bien utiles pour optimiser un serveur MySQL:

- http://rackerhacker.com/mysqltuner/

Ce script produit des recommandations après avoir analysé la configuration du serveur


ovh ~ # ./mysqltuner.pl

>> MySQLTuner 0.9.1 - Major Hayden
>> Bug reports, feature requests, and downloads at http://mysqltuner.com/
>> Run with '--help' for additional options and output filtering
Please enter your MySQL administrative login: root
Please enter your MySQL administrative password:

-------- General Statistics --------------------------------------------------
[OK] You have the latest version of MySQLTuner
[OK] Currently running supported MySQL version 5.0.44-log
[OK] Operating on 32-bit architecture with less than 2GB RAM

-------- Storage Engine Statistics -------------------------------------------
[--] Status: -Archive +BDB -Federated +InnoDB -ISAM -NDBCluster
[--] Data in MyISAM tables: 428K (Tables: 79)
[!!] InnoDB is enabled but isn't being used
[!!] BDB is enabled but isn't being used
[!!] Total fragmented tables: 9

-------- Performance Metrics -------------------------------------------------
[--] Up for: 5d 20h 44m 17s (282K q [0.557 qps], 67K conn, TX: 102M, RX: 38M)
[--] Reads / Writes: 66% / 34%
[--] Total buffers: 1.6M per thread and 58.0M global
[OK] Maximum possible memory usage: 213.5M (21% of installed RAM)
[OK] Slow queries: 0% (0/282K)
[OK] Highest usage of available connections: 10% (10/100)
[OK] Key buffer size / total MyISAM indexes: 16.0M/315.0K
[OK] Key buffer hit rate: 99.9%
[!!] Query cache is disabled
[OK] Sorts requiring temporary tables: 0%
[OK] Temporary tables created on disk: 4%
[!!] Thread cache is disabled
[!!] Table cache hit rate: 12%
[OK] Open file limit used: 12%
[OK] Table locks acquired immediately: 99%

-------- Recommendations -----------------------------------------------------
General recommendations:
Add skip-innodb to MySQL configuration to disable InnoDB
Add skip-bdb to MySQL configuration to disable BDB
Run OPTIMIZE TABLE to defragment tables for better performance
Enable the slow query log to troubleshoot bad queries
Set thread_cache_size to 4 as a starting value
Increase table_cache gradually to avoid file descriptor limits
Variables to adjust:
query_cache_size (>= 8M)
thread_cache_size (start at 4)
table_cache (> 64)

- http://www.day32.com/MySQL/

Cette page regroupe plusieurs scripts dont certains surveillent une réplication MySQL. Voici un exemple de résultat sur le même serveur que précédemment


-- MYSQL PERFORMANCE TUNING PRIMER --
- By: Matthew Montgomery -

MySQL Version 5.0.44-log i686

Uptime = 5 days 20 hrs 49 min 18 sec
Avg. qps = 0
Total Questions = 282259
Threads Connected = 6

Server has been running for over 48hrs.
It should be safe to follow these recommendations

To find out more information on how each of these
runtime variables effects performance visit:

http://dev.mysql.com/doc/refman/5.0/en/server-system-variables.html

Visit http://www.mysql.com/products/enterprise/advisors.html
for info about MySQL's Enterprise Monitoring and Advisory Service

SLOW QUERIES
The slow query log is NOT enabled.
Current long_query_time = 10 sec.
You have 0 out of 282280 that take longer than 10 sec. to complete
Your long_query_time may be too high, I typically set this under 5 sec.

BINARY UPDATE LOG
The binary update log is enabled
The expire_logs_days is not set.
The mysqld will retain the entire binary log until RESET MASTER or PURGE MASTER LOGS commands are run manually
Setting expire_logs_days will allow you to remove old binary logs automatically
See http://dev.mysql.com/doc/refman/5.0/en/purge-master-logs.html

WORKER THREADS
Current thread_cache_size = 0
Current threads_cached = 0
Current threads_per_sec = 1
Historic threads_per_sec = 0
Your thread_cache_size is fine

MAX CONNECTIONS
Current max_connections = 100
Current threads_connected = 6
Historic max_used_connections = 10
The number of used connections is 10% of the configured maximum.
You are using less than 10% of your configured max_connections.
Lowering max_connections could help to avoid an over-allocation of memory
See "MEMORY USAGE" section to make sure you are not over-allocating

MEMORY USAGE
Max Memory Ever Allocated : 57 M
Configured Max Per-thread Buffers : 158 M
Configured Max Global Buffers : 42 M
Configured Max Memory Limit : 200 M
Physical Memory : 997.33 M
Max memory limit seem to be within acceptable norms

KEY BUFFER
Current MyISAM index space = 448 K
Current key_buffer_size = 16 M
Key cache miss rate is 1 : 712
Key buffer fill ratio = 1.00 %
Your key_buffer_size seems to be too high.
Perhaps you can use these resources elsewhere

QUERY CACHE
Query cache is supported but not enabled
Perhaps you should set the query_cache_size

SORT OPERATIONS
Current sort_buffer_size = 512 K
Current read_rnd_buffer_size = 508 K
Sort buffer seems to be fine

JOINS
Current join_buffer_size = 132.00 K
You have had 0 queries where a join could not use an index properly
Your joins seem to be using indexes properly

OPEN FILES LIMIT
Current open_files_limit = 1024 files
The open_files_limit should typically be set to at least 2x-3x
that of table_cache if you have heavy MyISAM usage.
Your open_files_limit value seems to be fine

TABLE CACHE
Current table_cache value = 64 tables
You have a total of 96 tables
You have 64 open tables.
Current table_cache hit rate is 8%, while 100% of your table cache is in use
You should probably increase your table_cache

TEMP TABLES
Current max_heap_table_size = 16 M
Current tmp_table_size = 32 M
Of 2541 temp tables, 4% were created on disk
Effective in-memory tmp_table_size is limited to max_heap_table_size.
Created disk tmp tables ratio seems fine

TABLE SCANS
Current read_buffer_size = 252 K
Current table scan ratio = 1 : 1
read_buffer_size seems to be fine

TABLE LOCKING
Current Lock Wait ratio = 1 : 5629
Your table locking seems to be fine

- http://hackmysql.com/mysqlreport

Ce script dispose d’un guide comple disponible ici http://hackmysql.com/mysqlreportguide qui permet d’approfondir les résultats obtenus.


MySQL 5.0.44-log uptime 5 20:52:50 Wed Jun 25 14:51:12 2008

__ Key _________________________________________________________________
Buffer used 150.00k of 16.00M %Used: 0.92
Current 1.87M %Usage: 11.67
Write hit 24.14%
Read hit 99.85%

__ Questions ___________________________________________________________
Total 282.76k 0.6/s
Com_ 184.34k 0.4/s %Total: 65.19
DMS 144.44k 0.3/s 51.08
-Unknown 113.28k 0.2/s 40.06
COM_QUIT 67.25k 0.1/s 23.79
Slow 10 s 0 0/s 0.00 %DMS: 0.00 Log: OFF
DMS 144.44k 0.3/s 51.08
SELECT 96.55k 0.2/s 34.14 66.84
REPLACE 40.42k 0.1/s 14.30 27.98
INSERT 6.53k 0.0/s 2.31 4.52
UPDATE 681 0.0/s 0.24 0.47
DELETE 267 0.0/s 0.09 0.18
Com_ 184.34k 0.4/s 65.19
admin_comma 113.73k 0.2/s 40.22
change_db 67.88k 0.1/s 24.00
show_variab 760 0.0/s 0.27

__ SELECT and Sort _____________________________________________________
Scan 6.44k 0.0/s %SELECT: 6.67
Range 0 0/s 0.00
Full join 0 0/s 0.00
Range check 0 0/s 0.00
Full rng join 0 0/s 0.00
Sort scan 1.51k 0.0/s
Sort range 993 0.0/s
Sort mrg pass 0 0/s

__ Table Locks _________________________________________________________
Waited 26 0.0/s %Total: 0.02
Immediate 146.48k 0.3/s

__ Tables ______________________________________________________________
Open 64 of 64 %Cache: 100.00
Opened 860 0.0/s

__ Connections _________________________________________________________
Max used 10 of 100 %Max: 10.00
Total 67.27k 0.1/s

__ Created Temp ________________________________________________________
Disk table 112 0.0/s
Table 2.55k 0.0/s Size: 32.0M
File 5 0.0/s

__ Threads _____________________________________________________________
Running 1 of 6
Cached 0 of 0 %Hit: 0
Created 67.27k 0.1/s
Slow 0 0/s

__ Aborted _____________________________________________________________
Clients 34 0.0/s
Connects 11 0.0/s

__ Bytes _______________________________________________________________
Sent 103.02M 203.1/s
Received 38.68M 76.3/s

__ InnoDB Buffer Pool __________________________________________________
Usage 2.80M of 16.00M %Used: 17.48
Read hit 100.00%
Pages
Free 845 %Total: 82.52
Data 178 17.38 %Drty: 0.00
Misc 1 0.10
Latched 0 0.00
Reads 1.40k 0.0/s
From file 0 0/s 0.00
Ahead Rnd 0 0/s
Ahead Sql 0 0/s
Writes 1.17k 0.0/s
Flushes 189 0.0/s
Wait Free 0 0/s

__ InnoDB Lock _________________________________________________________
Waits 0 0/s
Current 0
Time acquiring
Total 0 ms
Average 0 ms
Max 0 ms

__ InnoDB Data, Pages, Rows ____________________________________________
Data
Reads 0 0/s
Writes 38 0.0/s
fsync 16 0.0/s
Pending
Reads 0
Writes 0
fsync 0

Pages
Created 178 0.0/s
Read 0 0/s
Written 189 0.0/s

Rows
Deleted 0 0/s
Inserted 0 0/s
Read 0 0/s
Updated 0 0/s

(EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of « xxx »

27.05.2008 1

Gentoo c’est bien, mais à chaque nouvelle release d’un package apache, php ou mysql, ils font des choses bizarres et plus rien ne marche. Le dernier en date que je n’avais pas encore eu, lors de l’install d’apache-2.2.8, le serveur refuse de démarrer (Error: [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of « xxx ») car je n’ai pas mis l’ip dans le fichier /etc/hosts. Du coup, il faut commenter la ligne LoadModule unique_id_module modules/mod_unique_id.so dans /etc/apache2/httpd.conf et tout rentre dans l’ordre.

Shorewall 3.4.6 et multi ISP

24.02.2008 0

Depuis plusieurs jours, je me cassais la tête sur la configuration de shorewall qui refusait de respecter mes règles de routing pour le traffic sortant de mon installation. Je dispose d’une configuration à deux lignes DSL (une Free et une Wanadoo), l’une de ces lignes est utilisée par la DMZ, l’autre par le bureau.

J’ai découvert aujourd’hui la présence de deux patchs qui m’ont permis de résoudre mon problème sans rien modifier à ma configuration actuelle, vous les trouverez ici : http://www.shorewall.net/shorewall_index.htm#Notice

A la base, j’avais trouvé ce post sur une mailing list qui correspondait exactement à mon problème.

Devenir root sur un serveur en exploitant une failler du kernel

10.02.2008 0

Si vous vous rendez ici, vous pourrez trouver un bout de code qui vous permet de devenir root très simplement:

bash-3.00$ whoami
olivier
bash-3.00$ ./exploit
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7f63000 .. 0xb7f95000
[+] root
bash-3.00# whoami
root
bash-3.00#

La faille impacte tous les noyaux du 2.6.17 au 2.6.24. Le 2.6.24.1 est corrigé pour la faille sauf si vous l’avez patché avec vserver.Si vous utilisez grsec avec PaX la faille ne passe pas. Debian fournit un patch.

Migrer des comptes qmail/vpopmail d’un serveur à un autre

07.02.2008 0

J’ai dû déplacer pour un client ses comptes mails géré par vpopmail d’un serveur à un autre. Après avoir installé qmail/vpopmail sur le nouveau serveur, j’ai déplacé le contenu de son répertoire vpopmail/domains, remis les droits corrects, copié le contenu des fichiers /var/qmail/control/rcpthosts /var/qmail/control/morercpthosts /var/qmail/control/virtualdomains et /var/qmail/users/assign (en changeant la valeur des uid:gid dans ce dernier fichier) Rien à faire, vpopmail refuse de voir les domaines ajoutés de cette façon. Je n’ai trouvé nulle part sur l’ancien serveur de database locale contenant éventuellement d’autres informations.J’ai donc utilisé un script trouvé ici qui permet de sauvegarder les mailbox vpopmail de l’ancien serveur et crée un script sh de recréation de compte sur le nouveau serveur. Pratique, mais il faut se taper tous les domaines à la main.

Installer l’extension ssh2 dans PHP Gentoo

29.01.2008 0

Pour installer l’extension Pecl ssh2 sous Gentoo, commencez par télécharger l’archive ssh2-0.10.tgz puis une fois décompressée:

phpize &amp;&amp; configure --with-ssh2

Modifiez alors le fichier config.h et ajoutez en haut du fichier:

#define LIBSSH2_APINO 200412301450

puis

make et make install

Plus qu’à ajouter l’extension dans /etc/php/cli-php4/php.ini et /etc/php/apache2-php4/php.ini

extension=ssh2.so 

et

/etc/init.d/apache2 restart
ssh2-0.10 # php --info | grep ssh2
Registered PHP Streams =&gt; php, http, ftp, https, ftps, compress.bzip2, compress.zlib, ssh2.shell, ssh2.exec, ssh2.tunnel, ssh2.scp, ssh2.sftp
ssh2
libssh2 version =&gt; 0.18
banner =&gt; SSH-2.0-libssh2_0.18
PWD =&gt; /usr/local/src/ssh2-0.10
_SERVER["PWD"] =&gt; /usr/local/src/ssh2-0.10
_ENV["PWD"] =&gt; /usr/local/src/ssh2-0.10 

mindi-busybox-1.2.2 error: asm/page.h: No such file or directory

19.12.2007 0

Sur un serveur Gentoo avec kernel 2.6.16-hardened-r10, mindi-busybox-1.2.2 refuse de compiler et j’obtiens:

/var/tmp/portage/sys-apps/mindi-busybox-1.2.2/work/mindi-busybox-1.2.2/ util-linux/mkswap.c:44:59: error: asm/page.h: No such file or directory make: *** /var/tmp/portage/sys-apps/mindi-busybox-1.2.2/work/mindi-busybox-1.2.2/ util-linux/mkswap.o Error 1

Il suffit de modifier l’ebuild de cette façon:

# Copyright 1999-2006 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$

inherit eutils flag-o-matic

DESCRIPTION="The rescue part of a program that creates emergency boot disks/CDs using your kernel, tools and modules."
HOMEPAGE="http://www.mondorescue.org"
SRC_URI="ftp://ftp.mondorescue.org/src/${P}.tar.gz"
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="~x86 ia64 -*"
DEPEND="virtual/libc"
RDEPEND="&gt;=app-arch/bzip2-0.9
sys-devel/binutils"

src_unpack() {
unpack ${A} || die "Failed to unpack ${A}"
cd ${P}
#    create a link to page.h in kernel dir
mkdir include/asm
mkdir include/asm-generic
mkdir include/linux

ln -s /usr/src/linux/include/asm/page.h include/asm/page.h
ln -s /usr/src/linux/include/asm-generic/page.h include/asm-generic/page.h
ln -s /usr/src/linux/include/linux/const.h include/linux/const.h
make oldconfig
}

src_compile() {
# work around broken ass powerpc compilers
emake EXTRA_CFLAGS="${CFLAGS}" busybox || die "build failed"
}

src_install() {
# bundle up the symlink files for use later
emake PREFIX="${D}/usr/lib/mindi/rootfs" install || die
}

puis

aloyse mindi-busybox # ebuild mindi-busybox-1.2.2.ebuild digest
<div>&gt;&gt;&gt; Creating Manifest for /usr/local/portage/sys-apps/mindi-busybox

et enfin:

emerge =mindi-busybox-1.2.2

et vous pouvez continuer avec l’installation de mindi puis mondoarchive.

PAM unable to dlopen(/lib/security/pam_unix.so)

09.12.2007 0

La version stable de pam sous Gento (sys-libs/pam-0.99) nécessite de recompiler certains outils qui ne sont pas identifiables avec revdep-rebuild (shadow, vixie-cron, openssh, courier-authlib, cyrus-sasl etc.). Ce genre de problème se manifeste dans vos logs systèmes par ce genre de message:

Dec  9 00:00:01 aloyse cron[8986]: PAM unable to dlopen(/lib/security/pam_unix.so) <div>Dec  9 00:00:01 aloyse cron[8986]: PAM [dlerror: /lib/security/pam_unix.so: symbol pam_modutil_getlogin, version LIBPAM_MODUTIL_1.0 not defined in file libpam.so.0 with link time reference]</div><div>Dec  9 00:00:01 aloyse cron[8986]: PAM adding faulty module: /lib/security/pam_unix.so</div><div>Dec  9 00:00:01 aloyse cron[8986]: PAM unable to dlopen(/lib/security/pam_limits.so)</div><div>Dec  9 00:00:01 aloyse cron[8986]: PAM [dlerror: /lib/security/pam_limits.so: symbol pam_syslog, version LIBPAM_EXTENSION_1.0 not defined in file libpam.so.0 with link time reference]</div><div>Dec  9 00:00:01 aloyse cron[8986]: PAM adding faulty module: /lib/security/pam_limits.so</div>Dec  9 00:00:01 aloyse cron[8986]: Module is unknown

Utilisez qdepends pour trouver les packages à ré-émerger :

aloyse ~ # qdepends -Q pam<div>app-misc/screen-4.0.3</div><div>sys-process/vixie-cron-4.1-r9</div><div>sys-apps/shadow-4.0.18.1-r1</div><div>net-misc/openssh-4.7_p1-r1</div><div>net-dialup/ppp-2.4.4-r13</div><div>
Note: qpedends se toruve dans le package portage-utils

Réinstaller Python sur un serveur Gentoo.

04.12.2007 0

Si par mégarde vous avez tapé la commande « emerge -C python », vous vous êtes rendu compte que emerge est écrit en python:

emerge -av python -/bin/bash: /usr/bin/emerge: /usr/bin/python: bad interpreter: No such file or directory

La solution, réinstaller Python à la main.

cd /root
wget http://distfiles.gentoo.org/distfiles/Python-2.5.1.tar.bz2
tar xjf Python-2.5.1.tar.bz2
cd Python-2.5.1
./configure --prefix=/usr --host=i686-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --with-fpectl --enable-shared --infodir=${prefix}/share/info --mandir=${prefix}/share/man --with-libc= --enable-unicode=ucs4 --with-threads --build=i686-pc-linux-gnu
make
make install

et voilà ! Merci à Human Bomb pour m’avoir donné l’opportunité de trouver cette solution ;)