Bind – Disabling Caching

To disable caching on a name server, use the recursion options statement:

root# cat /etc/named.comf
--cut
options {
directory "/var/named";
recursion no;
};
--cut
root#

Disabling recursion is one of the most effective ways to limit the amount of memory a name server uses.
Processing a recursive query often requires a name server to query another name server, and the name server then caches the response.
It’s caching that causes a name server’s memory usage to increase over time.
Unfortunately, you can’t disable recursion on just any old name server.
Many name servers serve one or more authorized resolvers, and those resolvers need their recursive queries answered, well, recursively.
Name servers used as forwarders must process recursive queries, too.

Postfix relay certain domain internal and external.

root# cat /etc/postfix/main.cf
--cut
relay_domains = $mydestination, hash:/etc/postfix/relaydomains
--cut
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_client_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/acc
ess, reject
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination
--cut

root# cat /etc/postfix/relaydomains
domain.com OK
domain1.com OK

root# cat /etc/postfix/access
172.16.12.99 OK

root# cat /etc/postfix/mynetworks
172.16.12.100/32
172.16.12.101/32

Remember to run: postmap /etc/postfix/relaydomains and postmap /etc/postfix/access
172.16.12.99 is allowed to send e-mails just to domain.com and domain1.com via the relay server.
172.16.12.100 and 172.16.12.101 are allowed to send e-mails to everywhere via the relay server.

cat /proc/meminfo

cat /proc/meminfo
MemTotal: 34953160 kB
MemFree: 980328 kB
Buffers: 203072 kB
Cached: 29832444 kB
SwapCached: 1688 kB
Active: 24206252 kB
Inactive: 8308536 kB
Active(anon): 20258736 kB
Inactive(anon): 4469052 kB
Active(file): 3947516 kB
Inactive(file): 3839484 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 18866168 kB
SwapFree: 18634044 kB
Dirty: 152 kB
Writeback: 0 kB
AnonPages: 2477584 kB
Mapped: 9469408 kB
Shmem: 22248516 kB
Slab: 351700 kB
SReclaimable: 228540 kB
SUnreclaim: 123160 kB
KernelStack: 5456 kB
PageTables: 670360 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 36342748 kB
Committed_AS: 31083012 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 255616 kB
VmallocChunk: 34359480108 kB
HardwareCorrupted: 0 kB
AnonHugePages: 190464 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
DirectMap4k: 49152 kB
DirectMap2M: 35602432 kB

And an explanation from https://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-proc-meminfo.html

Much of the information here is used by the free, top, and ps commands. In fact, the output of the free command is similar in appearance to the contents and structure of /proc/meminfo. But by looking directly at /proc/meminfo, more details are revealed:

MemTotal — Total amount of physical RAM, in kilobytes.
MemFree — The amount of physical RAM, in kilobytes, left unused by the system.
Buffers — The amount of physical RAM, in kilobytes, used for file buffers.
Cached — The amount of physical RAM, in kilobytes, used as cache memory.
SwapCached — The amount of swap, in kilobytes, used as cache memory.
Active — The total amount of buffer or page cache memory, in kilobytes, that is in active use. This is memory that has been recently used and is usually not reclaimed for other purposes.
Inactive — The total amount of buffer or page cache memory, in kilobytes, that are free and available. This is memory that has not been recently used and can be reclaimed for other purposes.
HighTotal and HighFree — The total and free amount of memory, in kilobytes, that is not directly mapped into kernel space. The HighTotal value can vary based on the type of kernel used.
LowTotal and LowFree — The total and free amount of memory, in kilobytes, that is directly mapped into kernel space. The LowTotal value can vary based on the type of kernel used.
SwapTotal — The total amount of swap available, in kilobytes.
SwapFree — The total amount of swap free, in kilobytes.
Dirty — The total amount of memory, in kilobytes, waiting to be written back to the disk.
Writeback — The total amount of memory, in kilobytes, actively being written back to the disk.
Mapped — The total amount of memory, in kilobytes, which have been used to map devices, files, or libraries using the mmap command.
Slab — The total amount of memory, in kilobytes, used by the kernel to cache data structures for its own use.
Committed_AS — The total amount of memory, in kilobytes, estimated to complete the workload. This value represents the worst case scenario value, and also includes swap memory.
PageTables — The total amount of memory, in kilobytes, dedicated to the lowest page table level.
VMallocTotal — The total amount of memory, in kilobytes, of total allocated virtual address space.
VMallocUsed — The total amount of memory, in kilobytes, of used virtual address space.
VMallocChunk — The largest contiguous block of memory, in kilobytes, of available virtual address space.
HugePages_Total — The total number of hugepages for the system. The number is derived by dividing Hugepagesize by the megabytes set aside for hugepages specified in /proc/sys/vm/hugetlb_pool. This statistic only appears on the x86, Itanium, and AMD64 architectures.
HugePages_Free — The total number of hugepages available for the system. This statistic only appears on the x86, Itanium, and AMD64 architectures.
Hugepagesize — The size for each hugepages unit in kilobytes. By default, the value is 4096 KB on uniprocessor kernels for 32 bit architectures. For SMP, hugemem kernels, and AMD64, the default is 2048 KB. For Itanium architectures, the default is 262144 KB. This statistic only appears on the x86, Itanium, and AMD64 architectures.

Squid Proxy with basic username and password authentication.

The basic squid config /etc/squid3/squid.conf instead of the default config file.

auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid3/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_port 3128

Setting up a user:

sudo htpasswd -c /etc/squid3/passwords username

and then restart the squid3 by

/etc/init.d/squid3 or systemctl restart squid3.service

Rsyslogd the traditional File Format.

Add the following $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat to /etc/rsyslogd.conf to have a traditional file format like this:

Jan 12 15:51:07 sles29 dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.16.12.151, lip=172.16.60.15, session=
Jan 12 15:51:14 sles29 postfix/smtpd[9226]: connect from unknown[172.16.12.151]
Jan 12 15:51:14 sles29 postfix/smtpd[9226]: disconnect from unknown[172.16.12.151]
Jan 12 15:51:17 sles29 postfix/postfix-script[10446]: stopping the Postfix mail system
Jan 12 15:51:17 sles29 postfix/master[9120]: terminating on signal 15

instead of this:
2016-01-12T15:50:14.273797+00:00 sles29 postfix/smtpd[9226]: connect from unknown[172.16.12.151]
2016-01-12T15:50:14.274207+00:00 sles29 postfix/anvil[9231]: statistics: max connection rate 1/60s for (smtp:172.16.12.151) at Jan 12 15:40:14
2016-01-12T15:50:14.274534+00:00 sles29 postfix/anvil[9231]: statistics: max connection count 1 for (smtp:172.16.12.151) at Jan 12 15:40:14
2016-01-12T15:50:14.274781+00:00 sles29 postfix/anvil[9231]: statistics: max cache size 2 at Jan 12 15:41:53
2016-01-12T15:50:14.281123+00:00 sles29 postfix/smtpd[9226]: disconnect from unknown[172.16.12.151]

The rp_filter kernel setting.

The rp_filter – INTEGER

0 – No source validation.

1 – Strict mode as defined in RFC3704 Strict Reverse Path. Each incoming packet is tested against the FIB and if the interface is not the best reverse path the packet check will fail. By default failed packets are discarded.

2 – Loose mode as defined in RFC3704 Loose Reverse Path. Each incoming packet’s source address is also tested against the FIB and if the source address is not reachable via any interface the packet check will fail.

Current recommended practice in RFC3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or other complicated routing, then loose mode is recommended.

The max value from conf/{all,interface}/rp_filter is used when doing source validation on the {interface}. (Which means it can be set
on each individual interface, or globally. The global setting will override the individual interface settings).

Debian packages – list and install on another server.

To list all currently installed packages, type “dpkg –get-selections”. You can save this data to a file by running “dpkg --get-selections > ~/packages.txt“.
And then place this file on another system and install the listed packages by running “cat packages.txt > sudo dpkg --set-selections && sudo apt-get dselect-upgrade“.
Also, the list of packages can be loaded for installation by running “dpkg --clear-selections && sudo dpkg --set-selections < packages.txt".
This could be used also for recovery. This trick is helpful when a system must be reinstalled, then all of the same packages can be installed all at once.
Sometimes, the output of "dpkg --get-selections" may list packages marked to be uninstalled or some other status. If so happens, use the following "dpkg --get-selections | grep -w install$ > ~/packages.txt". I mean, "| grep -w install$"

The port forwarding from one ip to another ip in same network using iptables

Let’s say that we need to forward all connection to a port 143 IMAP to localhost to another server to a port 143 IMAP:

iptables -t nat -I PREROUTING -p tcp -d localhost --dport 143 -j DNAT --to-destination anotherserver:143
iptables -t nat -A POSTROUTING -p tcp --dport 143 -d anotherserver -j SNAT --to localhost

172.16.60.5 – localhost
172.16.10.77 – another server

# Forward port 143 IMAP to 172.16.10.77
iptables -t nat -I PREROUTING -p tcp -d 172.16.60.5 --dport 143 -j DNAT --to-destination 172.16.10.77:143
iptables -t nat -A POSTROUTING -p tcp --dport 143 -d 172.16.10.77 -j SNAT --to 172.16.60.5

# Log connection to port 143 to /var/log/firewall
iptables -t nat -I PREROUTING -p tcp --dport 143 -j LOG --log-prefix "IMAP PREROUTING: "
iptables -t nat -I POSTROUTING -p tcp --dport 143 -j LOG --log-prefix "IMAP POSTROUTING: "

Smokeping on Debian/Ubuntu.

To install smokeping:

root# apt-get install smokeping

Link in the smokeping apache config:

root# cd /etc/apache2/conf-available
root# ln -s ../../smokeping/apache2.conf smokeping.conf

Enable the config and mod_cgi:

root# a2enconf smokeping
root# a2enmod cgid

Reload Apache:

root# /etc/init.d/./apache2 reload

Configuration files can be found here: /etc/smokeping/config.d/

root# ls -la /etc/smokeping/config.d/
total 64
drwxr-xr-x 2 root root 4096 Nov 23 09:06 .
drwxr-xr-x 3 root root 4096 Nov 19 13:07 ..
-rw-r–r– 1 root root 165 Nov 19 12:41 Alerts
-rw-r–r– 1 root root 237 Jul 8 2014 Database
-rw-r–r– 1 root root 509 Nov 19 09:31 General
-rw-r–r– 1 root root 225 Jul 8 2014 pathnames
-rw-r–r– 1 root root 876 Jul 8 2014 Presentation
-rw-r–r– 1 root root 50 Jul 8 2014 Probes
-rw-r–r– 1 root root 147 Jul 8 2014 Slaves
-rw-r–r– 1 root root 9025 Nov 23 09:06 Targets
-rw-r–r– 1 root root 9039 Nov 23 09:00 Targets_okay
-rw-r–r– 1 root root 380 Jul 8 2014 Targets_orig
root#

Discarding unwanted messages in rsyslogd.

There are some messages that you do not want to see in the logs file. In this case I had the following:

Nov 16 14:15:51 nbefa1 nrpe[25429]: Error: Could not complete SSL handshake. 1
Nov 16 14:15:51 nbefa1 nrpe[25431]: Error: Could not complete SSL handshake. 1
Nov 16 14:15:51 nbefa1 nrpe[25435]: Error: Could not complete SSL handshake. 1
Nov 16 14:15:51 nbefa1 nrpe[25437]: Error: Could not complete SSL handshake. 1
Nov 16 14:15:55 nbefa1 nrpe[25446]: Error: Could not complete SSL handshake. 1
Nov 16 14:15:55 nbefa1 nrpe[25448]: Error: Could not complete SSL handshake. 1

To get rid of those unwanted messages add the following to the top of /etc/rsyslogd.conf file:

# Discarding unwanted messages
:msg, contains, "Error: Could not complete SSL handshake. 1" ~

And then restart rsyslogd.

More information: http://www.rsyslog.com/discarding-unwanted-messages/