address 10.8.8.57
netmask 255.255.255.0
gateway 10.8.8.8
#dns-search firma.ad
dns-nameservers 8.8.8.8
uname -r
sudo apt-get remove --purge $(dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d')
sudo apt-get purge pulseaudio
| Cytuj: |
| arecord -l |
| Cytuj: |
| arecord plik |
| Cytuj: |
| aplay plik |
- sudo apt-get update
- sudo apt-get install iptables-persistent
- sudo nano /etc/iptables/rules.v4
*filter
# Allow all outgoing, but drop incoming and forwarding packets by default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Custom per-protocol chains
:UDP - [0:0]
:TCP - [0:0]
:ICMP - [0:0]
# Acceptable UDP traffic
# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT
# Acceptable ICMP traffic
# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
# Pass traffic to protocol-specific chains
## Only allow new connections (established and related should already be handled)
## For TCP, additionally only allow new SYN packets since that is the only valid
## method for establishing a new TCP connection
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP
# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
# Commit the changes
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
Test your rules file for syntax errors:
- sudo iptables-restore -t < /etc/iptables/rules.v4
ADD rulessudo iptables-restore < /etc/iptables/rules.v4If no syntax errors are displayed, reload the firewall to implement the new rule set:
- sudo service iptables-persistent reload
Mikrotik/ ip firewall filter add chain=input connection-state=established comment="Accept established connections" add chain=input connection-state=related comment="Accept related connections" add chain=input connection-state=invalid action=drop comment="Drop invalid connections" add chain=input protocol=udp action=accept comment="UDP" disabled=no add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings" add chain=input protocol=icmp action=drop comment="Drop excess pings" add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell" add chain=input protocol=tcp dst-port=8291 comment="winbox" # Edit these rules to reflect your actual IP addresses! # add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network" add chain=input src-address=10.0.0.0/8 comment="From our private LAN" # End of Edit # add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else" add chain=input action=drop comment="Drop everything else"
S-1-5-21-3656904587-1668747452-4095529-500du -m /home | sort -rn
Przykładowe użycie: iostat -x 1avg–cpu: %user %nice %system %iowait %steal %idleDevice rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq–sz avgqu–sz await svctm util
0,46 0,00 0,08 0,02 0,00 99,44
sda 0,09 0,77 0,07 0,23 2,69 7,87 35,74 0,00 4,49 0,84 0,02


apt-get install iotop
TOP
TOP VIRT - to co mysli ze mam, RES -> tyle ile faktycznie ma,
s-STAN np. z - zombie, przy CPU id-ile proces byl nieuzywany,
wa - io/wait po tym mozna sprawdzic czy nie potrzebujemy szybszego dysku,
hi -> przerwania < > - sortowanie albo po lewej albo po prawej kolumnie, R -> od najwiekszych do najmniejszych 1 -> pokazuje ilosc procesorow NI - nice, priorytet. Dziala tak ze jak ktos ma wiekszy NICE to ma mniej procesora.
Zeby przyspieszyc np tylko jeden proces nalezy dac komus NIC ujemny. r - zmieniamy NICE. Minusowe wartosci da sie robic tylko z konta roota. k - killuje load avarage -> jak obciazany jest system,
ilosc procesow ktore stoja w jakiejs kolejce do egzekucji.
Kazdy system moze inaczej, powyzej 1-ego juz wiadomo ze jest troche obciazony.
# partx -l /dev/sdb # partx -v -a /dev/sdb /dev/mapper# vgscan --mknodes """W jednej lini
ls /sys/class/scsi_host/ | while read host ;
do echo "- - -" > /sys/class/scsi_host/$host/scan ; done
"""
fdisk -l
tail -f /var/log/message=====================================================
# echo 1 > /sys/block/devName/device/delete
# echo 1 > /sys/block/sdc/device/delete# echo "scsi add-single-deviceWhere," > /proc/scsi/scsi
# echo "scsi add-single-device 0 0 2 0">/proc/scsi/scsi
# fdisk -l
# cat /proc/scsi/scsi========================================================= # fdisk /dev/sdc
# mkfs.ext3 /dev/sdc3# mkdir /disk3# vi /etc/fstab/dev/sdc3 /disk3 ext3 defaults 1 2
yum update
Tworzenie skryptów autostart
Create the file (touch>chmod>edit seems recommended, I don't known why):
touch /etc/systemd/system/activefolder.service chmod 664 /etc/systemd/system/activefolder.service vim /etc/systemd/system/activefolder.service
/etc/systemd/system/activefolder.service example: [Unit]
Description=activefolder After=network.target
[Service] WorkingDirectory=/var/www/activefolder/current ExecStart=/var/www/activefolder/current/script/delayed_job start Type=forking
PIDFile=/run/activefolder.pid Environment="RAILS_ENV=production" #User=httpd #Group=httpd [Install]
WantedBy=default.target
systemctl daemon-reload systemctl start name.service LUB $ crontab -e
Run a script called /home/vivek/bin/installnetkit.sh
@reboot /home/vivek/bin/installnetkit.sh # chkconfig crond on
## Commands to start/stop/restart crond ###
# service crond restart
# service crond start
# service crond stopRejestracja i subskrypcjasubscription-manager register --username admin-example --password secret --auto-attach
Network
nmcli con mod net-eth0 connection.autoconnect yes
1
2
|
apt-get install haproxy
apt-get install keepalived
|
1
|
net.ipv4.ip_nonlocal_bind=1
|
1
|
vim /etc/sysctl.conf
|
1
|
net.ipv4.ip_nonlocal_bind=1
|
root@S-09:~# sysctl -p
net.ipv4.ip_nonlocal_bind = 1
vi /etc/defaults/haproxy CONFIG="/etc/haproxy/haproxy.cfg" ENABLED=1 |
1
|
vim /etc/keepalived/keepalived.conf
|
global_defs {
# Keepalived process identifier
lvs_id haproxy_DH
}
# Script used to check if HAProxy is running
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}
# Virtual interface
# The priority specifies the order in which the assigned interface to take over in a failover
vrrp_instance VI_01 {
state MASTER
interface eth0
virtual_router_id 51
priority 101
# The virtual ip address shared between the two loadbalancers
virtual_ipaddress {
192.168.6.164
}
track_script {
check_haproxy
}
}
|
global_defs {
# Keepalived process identifier
lvs_id haproxy_DH_passive
}
# Script used to check if HAProxy is running
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}
# Virtual interface
# The priority specifies the order in which the assigned interface to take over in a failover
vrrp_instance VI_01 {
state SLAVE
interface eth0
virtual_router_id 51
priority 100
# The virtual ip address shared between the two loadbalancers
virtual_ipaddress {
192.168.6.164
}
track_script {
check_haproxy
}
}
|
1
|
service keepalived start
|
1
|
vim /etc/default/haproxy
|
1
|
vim /etc/haproxy/haproxy.cfg
|
|
1
2
3
4
5
6
7
8
9
10
11
12
|
root@S-08:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0
inet 192.168.6.164/32 scope global eth0
inet6 fe80::250:56ff:febb:506/64 scope link
valid_lft forever preferred_lft forever
|
1
2
3
4
5
6
7
8
9
10
11
|
root@S-09:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0
inet6 fe80::250:56ff:febb:508/64 scope link
valid_lft forever preferred_lft forever
|
1
2
3
4
5
6
7
8
9
10
11
|
root@S-08:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0
inet6 fe80::250:56ff:febb:506/64 scope link
valid_lft forever preferred_lft forever
|
1
2
3
4
5
6
7
8
9
10
11
12
|
root@S-09:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0
inet 192.168.6.164/32 scope global eth0
inet6 fe80::250:56ff:febb:508/64 scope link
valid_lft forever preferred_lft forever
|