Installing HA-Proxy on Cent OS 7

This example assumes that firewall and selinux is disabled. We are going to use the following three servers.

Apache1: 192.168.124.2 apache1.example.com
Apache2: 192.168.124.3 apache2.example.com
HAProxy: 192.168.124.10 haproxy.example.com



All three servers should be able to reach each other. Enter the following in the /etc/hosts file in all three nodes

192.168.124.2 apache1.example.com apache1
192.168.124.3 apache2.example.com apache2
192.168.124.10 haproxy.example.com haproxy

Now install apache service on the two apache nodes using the following command

#yum install httpd -y

Create a sample HTML file in the apache nodes in differentiate them and start the httpd service

#systemctl start httpd.service


Install and enable Epel repository on the haproxy node

#yum install epel-release -y

Install HA proxy

#yum install haproxy -y

The default configuration file haproxy.cfg is located in /etc/haproxy/

Lets make a backup of the original file

#cd /etc/haproxy

#cp haproxy.cfg haproxy.cfg.bkp


Now lets edit the configuration file. We need to clear the existing frontend/backend config and create our own config

Delete the following lines in haproxy.cfg

------------------------------------------------------------------------
frontend  main *:5000
    acl url_static       path_beg       -i /static /images /javascript /stylesheets
    acl url_static       path_end       -i .jpg .gif .png .css .js

    use_backend static          if url_static
    default_backend             app

backend static
    balance     roundrobin
    server      static 127.0.0.1:4331 check

backend app
    balance     roundrobin
    server  app1 127.0.0.1:5001 check
    server  app2 127.0.0.1:5002 check
    server  app3 127.0.0.1:5003 check
    server  app4 127.0.0.1:5004 check
------------------------------------------------------------------------

Now add the following lines
-------------------------------------------------------------------------
#webapp1 is the name we give for our frontend
frontend webapp1
#Makes the haproxy service listen on port number 80
bind *:80
#defining the backen name
default_backend webapp1_servers
#send X-Forwarded-For header
option  forwardfor


#Backend configuration
backend webapp1_servers
#Load balencing protocol
balance     roundrobin
server  apache1 192.168.124.89:80 check
server  apache2 192.168.124.51:80 check
-------------------------------------------------------------------------

Note: The X-Forwarded-For request header helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer.





Save the config file and restart haproxy service

#systemctl restart haproxy.service


Now hit the haprosy node's IP address in the browser and it should direct us to one of the web servers.

Install and Configure Nginx with php-fpm on Cent OS 7.

Install Epel repository

#yum install epel-release -y

Install nginx and php

#yum install php php-fpm php-gd nginx -y

#systemctl start nginx.service

#systemctl start php-fpm.service

At this point we should be able to get test page for Nginx server when accessed in the browser. http://localhost

The default document root for nginx is /usr/share/nginx/html/

Now lets create a php info file in /usr/share/nginx/html

#vim phpinfo.php
------------------
<?php phpinfo(); ?>
------------------

Now try to open the file in the browser. http://localhost/phpinfo.php

The file will get downloaded instead of getting executed. To fix this we need to include the following configuration in /etc/nginx/nginx.conf. This will pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 for execution.

-----------------------------------------------
location ~ \.php$ {
        root           /usr/share/nginx/html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
        include        fastcgi_params;
}
-----------------------------------------------


Restart nginx and php-fpm service

#systemctl start nginx.service

#systemctl start php-fpm.service

Now we should be able to open http://localhost/phpinfo.php


Now Lets create another server block with a document root of /var/www/html

Create example.conf  in /etc/nginx/conf.d/example.conf

Include the following config in the example.conf

----------------------------------------------------------------
server {
        listen       80;
        server_name  example.com;
        root         /var/www/html;
        index index.php;

location ~ \.php$ {
        root           /var/www/html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
        include        fastcgi_params;
}

}
-----------------------------------------------------------------

#mkdir -p /var/www/html

#vim /var/www/html/index.php
-----------------------
<? phpinfo(); ?>
------------------------

Save the file and restart nginx service and you should be have the example.com site up and running.

Split large sql file into multiple tables

The below bash script will split a large Mysql dump file into multiple files depending upon the number of tables in it

Usage
#./<script> <dump.sql>


#######################################################################
#!/bin/bash

####
# Split MySQL dump SQL file into one file per table
# based on http://blog.tty.nl/2011/12/28/splitting-a-database-dump
####

if [ $# -ne 1 ] ; then
  echo "USAGE $0 DUMP_FILE"
fi

csplit -s -ftable $1 "/-- Table structure for table/" {*}
mv table00 head

for FILE in `ls -1 table*`; do
      NAME=`head -n1 $FILE | cut -d$'\x60' -f2`
      cat head $FILE > "$NAME.sql"
done

rm head table*

########################################################################

Note: I did not create this, found it online

Cron with Pacemaker

Clustering cron daemon with pacemaker on Cent OS 7

This is a two node cluster with virtual IP and cron daemon as resources. The crontab has to be edited manually in both nodes to have the same task scheduled in it

node1.example.com
node2.example.com

Add the following to the /etc/hosts file in both nodes so that they are able to reach each other

X.X.X.X       node1.example.com        node1
X.X.X.X       node2.example.com        node2

Before starting with the cluster stop and disable the cron service in both nodes

#systemstl stop crond,service

#systemctl disable crond.service

Now install the pre-requisites on both nodes

#yum install -y pcs pacemaker corosync cman wget

Now set password for the hacluster user on both nodes

#passwd hacluster

Now start pcsd service and enable it on both nodes.

#systemctl start pcsd.service
#systemctl enable pcsd.service

Now authorize the cluster nodes. Will ask for username and password. Use "hacluster"

#pcs cluster auth node1 node2

Now create the cluster

#pcs cluster setup --name MYCLUSTER node1 node2
#pcs cluster start --all

Now disable STONITH and quorum as it is not required for a two node setup

#pcs property set stonithpcs resource create CRON systemd:crond-enabled=false

#pcs property set no-quorum-policy=ignore

Now add the resources. We need a virtual IP and tomcat resource

#pcs resource create VirtualIP ocf:heartbeat:IPaddr2 ip=x.x.x.x cidr_netmask=24  op monitor interval=30s

 #pcs resource create CRON systemd:crond

Now to make both resources run in the same node we must have a constraint as follows

# pcs constraint colocation set VirtualIP CRON

Set the order in which the resources has to load

#pcs constraint order set VirtualIP CRON

All done. Now stop the cluster and start it.

#pcs cluster stop --all

#pcs cluster start --all

#pcs status

Installing KVM(libvirt) on Ubuntu 14.04

OS: Ubuntu 14.04 - 64 bit

Install the prerequisites and bridge utils for creating the bridge interface

apt-get install vim aptitude bridge-utils

Now lets configure the bridge interface
Change the eth0 interface to manual, create the bridge interface and link the bridge interface with eth0. After configuring the bridge interface the host machine will be connected to eth0 which inturn will be connected to the bridge. Now any traffic originating from the host machine will go through the bridge interface


vim /etc/network/interfaces
----------------------------------------------------------------
auto eth0
iface eth0 inet manual


auto br0
iface br0 inet static
address        x.x.x.x
netmask        255.x.x.x
gateway x.x.x.x
dns-nameservers        8.8.8.8 4.2.2.2
#bridge configuration
bridge_ports eth0
#turning off spaning tree
bridge_stp off
bridge_maxweight 0
bridge_fd 0
----------------------------------------------------------------

Now lets intall KVM

$aptitude install qemu-kvm qemu-system

Now install the virt-manager

$aptitude install virt-manager

After installation we can start virt manager by issuing the following command

$sudo virt-manager

This will launch the Virtual Machine Manager

OPENVPN - Complete Setup - Bridge Mode

The following setup has been tested with both Windows ( win 7 ) and linux ( Cent OS 6 ) VPN clients.

Open VPN server: 192.168.201.128
Test node : 192.168.201.129

OpenVPN server and the test node are in the same LAN

SERVER CONFIG

On the open vpn server install the following

$yum install epel-release
$yum install openvpn easy-rsa bridge-utils -y

Now its time to configure the open vpn server

move to the easy-rsa directory to create the certificates and keys
$cd /usr/share/easy-rsa/2.0

change the variables to the requirement
$vim vars

# line 64: change to your own environment
export KEY_COUNTRY="JP"
export KEY_PROVINCE="Hiroshima"
export KEY_CITY="Hiroshima"
export KEY_ORG="GTS"
export KEY_EMAIL="root@dlp.server.world"
export KEY_OU="Server_World"

$source ./vars

$./clean-all

Build ca.crt
$./build-ca

Build server key and cert
$./build-key-server server

$./build-dh

To build the client cert and key
$./build-key client

Now copy the keys directory to /etc/openvpn directory

$cp -pR /usr/share/easy-rsa/2.0/keys /etc/openvpn/keys

Now create a user in the VPN server for VPN connection authentication

$useradd client1
$passwd client1

Now copy the sample config file to /etc/openvpn

$cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn/

Make the following changes to server.conf in /etc/openvpn/ directory, or just copy the below contents and paste. ( Change the IP addresses as required)

$vim /etc/openvpn/server.conf


#################################################################################
#Enable plugin for VPN connection authentication
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so login

#change if need (listening port)
port 1194

#uncomment tcp and comment out udp
proto tcp
;proto udp

# change to tap which uses bridge mode
dev tap0
;dev tun

#change path for certificates
ca keys/ca.crt
cert keys/server.crt
key keys/server.key

#change path for certificates
dh keys/dh2048.pem

#uncomment and change ⇒ [VPN server's IP] [subnetmask] [the range of IP for client]
server-bridge 192.168.201.128 255.255.255.0 192.168.201.150 192.168.201.199


# keepalive settings
keepalive 10 120

#enable compress
comp-lzo

# enable persist options
persist-key
persist-tun

#uncomment and specify logs
log /var/log/openvpn.log
log-append /var/log/openvpn.log

# specify log level (0 - 9, 9 means debug lebel)
verb 3
user nobody
group nobody

#################################################################################
Now copy the startup and shutdown scripts to /etc/openvpn directory

$cp /usr/share/doc/openvpn-*/sample/sample-scripts/bridge-start /etc/openvpn/openvpn-startup
$cp /usr/share/doc/openvpn-*/sample/sample-scripts/bridge-stop /etc/openvpn/openvpn-shutdown

Now make them executables
$chmod 755 /etc/openvpn/openvpn-startup /etc/openvpn/openvpn-shutdown

Make the following changes to the start up script
$vim /etc/openvpn/openvpn-startup

#################################################################################
# line 17-20: change
eth="eth0" # change if need
eth_ip="192.168.201.128"# IP for bridge interface
eth_netmask="255.255.255.0"# subnet mask
eth_broadcast="192.168.0.255"# broadcast address
# add follows to the end: define gateway
eth_gw="192.168.201.2" # default gateway in my setup
route add default gw $eth_gw

#################################################################################

Enable IP forwarding via openvpn init script,

vim /etc/rc.d/init.d/openvpn

# line 133: uncomment
echo 1 > /proc/sys/net/ipv4/ip_forward

Now start all the services. In my example i will be stopping the firewall ( Iptables )
service iptables stop
service openvpn start
chkconfig openvpn on


CLIENT CONFIG

Install the openVPN gui for windows from here

In cent os just install epel-release and install openvpn

$yum install epel-release -y

$yum install openvpn -y

Create the config file with the following contents

save the file as ".ovpn"

Replace X.X.X.X with the VPN server IP
#################################################################################
client
auth-user-pass
dev tap
proto tcp
remote X.X.X.X 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
<ca>
contents of ca.crt
</ca>
<cert>
contents of client.crt
</cert>
<key>
contents of client.key

</key>

#################################################################################


In windows copy the config file to "C:\Program Files\OpenVPN\config", and try to connect, it will request for username and password

Once connected you should be able to reach and connect to the test node which is in the same LAN as you VPN server

In Linux client you have to run the following command to connect

$openvpn <configfile.ovpn>

Thats all folks.....

Apache Tomcat Cluster with Pacemaker on Cent OS 6

This is a two node Apache tomcat cluster with virtual IP 10.20.9.225

node1.example.com
node2.example.com

Add the following to the /etc/hosts file in both nodes so that they are able to reach each other

10.20.9.220       node1.example.com        node1
10.20.9.221       node2.example.com        node2


Now install the pre-requisites on both nodes

#yum install -y java-1.7.0-openjdk.x86_64 pcs pacemaker corosync cman wget

Download and extract Apache Tomcat

#cd /usr/local/
#wget http://apache.arvixe.com/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.tar.gz
#tar xvzf apache-tomcat-6.0.43.tar.gz

Now set password for the hacluster user on both nodes

#passwd hacluster

Now start pcsd service on both nodes and add it to startup

#service pcsd start
#chkconfig pcsd on

Now authorize the cluster nodes. Will ask for username and password. Use "hacluster"

#mkdir /etc/cluster
#pcs cluster auth node1 node2

Now create the cluster

#pcs cluster setup --name MYCLUSTER node1 node2
#pcs cluster start --all


Now disable STONITH and quorum as it is not required for a two node setup

#pcs property set stonith-enabled=false

#pcs property set no-quorum-policy=ignore

Now add the resources. We need a virtual IP and tomcat resource

#pcs resource create VirtualIP ocf:heartbeat:IPaddr2 ip=10.20.9.225 cidr_netmask=24  op monitor interval=30s

 #pcs resource create tomcat ocf:heartbeat:tomcat params java_home="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.75.x86_64/jre" catalina_home="/usr/local/apache-tomcat-6.0.43" tomcat_user="root" op monitor interval="15s"

Now to make both resources run in the same node we must have a constraint as follows

# pcs constraint colocation set VirtualIP tomcat

All done. Now stop the cluster and start it.

#pcs cluster stop --all

#pcs cluster start --all

#pcs status

#################################################################################