IndianGNU.org

Secure FTP using rssh or scponly with chroot

Arun Bagul — Wed, 18 Aug 2010 05:45:59 +0000

Introduction -

In this article we will setup SFTP using rssh with chroot ….

A] How to configure rssh + chroot for SFTP

Step 1) Install RSSH Shell ~

* Ubuntu -

root@me:/home/arunb# apt-get install scponly rssh coreutils17

* Redhat/CentOS

[root@arun.me chroot]# yum install rssh
[root@arun.me chroot]# rpm -qa | grep rssh
rssh-2.3.2-1.2.el5.rf
[root@arun.me chroot]#

Step 2) Your Chroot Setting -Similar Posts:

Happy Independence Day ~ 2010

Arun Bagul — Sun, 15 Aug 2010 12:30:26 +0000

Similar Posts:

How to change Xsplash theme in Ubuntu

Arun Bagul — Thu, 20 May 2010 16:35:08 +0000

Introduction –

Xsplash is the theme which you will see during ubuntu booting process!

Step 1] Go to the directory – “/usr/share/images/xsplash”

root@me:~# cd /usr/share/images/xsplash
root@me:/usr/share/images/xsplash#

*** Take backup of original theme -

root@me:/usr/share/images/xsplash# cp -fr /usr/share/images/xsplash/ /usr/share/images/xsplash-original

Step 2] Download Xsplash themes -

URL – “http://gnome-look.org/content/show.php/Fusion-GX-v00+%5B200911-21%5D?content=115833” OR “http://espiralx.org/05-Compartir/09-Gnome.html”

Step 3] Copy this theme files to /usr/share/images/xsplash/ directory and check the xsplash using ‘xsplash’ command.

root@me:~# xsplash

Thank you,
Arun BagulSimilar Posts:

Xen virtualization on CentOS linux

Arun Bagul — Fri, 14 May 2010 06:02:59 +0000

Introduction ~

What is Virtualization? ~ virtualization is technique of running multiple operating system (OS) on same physical hardware at same time.
There are three types of Virtualization technologies

1) Full virtualization -
a) Hardware emulation – KQEMU
b) Binary translation – VirtualBox
c) Classic virtualization – OpenVZ
2) Para-virtualization
3) OS-level virtualization – Linux-VServer and OpenVZ

** Xen is an open-source para-virtualizing virtual machine monitor (VMM), or “hypervisor”,for a variety of processor. Xen can securely execute multiple virtual machines on a single physical system with near native performance.

** Xen Prerequisites -

1) iproute2 package
2) Linux bridge-utils (/sbin/brctl)
3) Linux hotplug system (/sbin/hotplug and related scripts)

Step 1) How to install Xen on Centos ~

[root@arun ~]# yum install xen.i386 xen-devel.i386 xen-libs.i386 libvirt.i386 libvirt-devel.i386 libvirt-python.i386 virt-manager.i386 virt-clone.i386

Step 2) How to install Xen Kernel for Centos ~

[root@arun ~]# yum install kernel-xen.i686 kernel-xen-devel.i686

* Once installation is completed; Please check the CentOS boot loader configuration file ie “/boot/grub/grub.conf”… and make sure that the first boot entry should look like this…

title CentOS (2.6.18-164.15.1.el5xen)
root (hd0,4)
kernel /boot/xen.gz-2.6.18-164.15.1.el5
module /boot/vmlinuz-2.6.18-164.15.1.el5xen ro root=LABEL=/ rhgb quiet
module /boot/initrd-2.6.18-164.15.1.el5xen.img

Step 3) Reboot the system so that system will boot with Xen Kernel….

That’s it Xen infrastructure is installed on CentOS.

[[root@arun ~]# rpm -qa | egrep “xen|virt” | sort
kernel-xen-2.6.18-164.15.1.el5
kernel-xen-devel-2.6.18-164.15.1.el5
libvirt-0.6.3-20.1.el5_4
libvirt-devel-0.6.3-20.1.el5_4
libvirt-python-0.6.3-20.1.el5_4
python-virtinst-0.400.3-5.el5
virt-manager-0.6.1-8.el5
xen-3.0.3-94.el5_4.3
xen-devel-3.0.3-94.el5_4.3
xen-libs-3.0.3-94.el5_4.3
[[root@arun ~]#
Step 4 ) Test Xen setup – make sure that “libvirtd” service is running

Step 5) Install first Guest CentOS -

* Create Disk as file as shown below….

[[root@arun ~]# dd if=/dev/zero of=/var/xen-disk/centOS.hdd bs=4k seek=2048k count=0
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000191 seconds, 0.0 kB/s
[[root@arun ~]# mke2fs -j /var/xen-disk/centOS.hdd
mke2fs 1.39 (29-May-2006)
/var/xen-disk/centOS.hdd is not a block special device.
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
1048576 inodes, 2097152 blocks
104857 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=2147483648
64 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 30 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
[[root@arun ~]# mount -o loop /var/xen-disk/centOS.hdd /mnt/
[[root@arun ~]# df -h
Filesystem            Size Used Avail Use% Mounted on
/dev/sda5              55G   12G   41G 22% /
tmpfs                 829M   12K 829M   1% /dev/shm
/dev/sda2              23G   15G 7.8G 65% /mydata
none                  829M 104K 829M   1% /var/lib/xenstored
/var/xen-disk/centOS.hdd
7.9G 147M 7.4G   2% /mnt
[[root@arun ~]#

* We are going to install guestOS from CD/DVD image so we will export this image via FTP so let us
configure ftp server….

* We have copied Centos CD/DVD in “/home/CentOS5.0/” location….

[root@arun ~]# ls /home/CentOS5.0/
CentOS            RELEASE-NOTES-cz.html RELEASE-NOTES-fr       RELEASE-NOTES-nl.html     repodata
EULA              RELEASE-NOTES-de       RELEASE-NOTES-fr.html RELEASE-NOTES-pt          RPM-GPG-KEY-beta
GPL               RELEASE-NOTES-de.html RELEASE-NOTES-it       RELEASE-NOTES-pt_BR       RPM-GPG-KEY-CentOS-5
images            RELEASE-NOTES-en       RELEASE-NOTES-it.html RELEASE-NOTES-pt_BR.html TRANS.TBL
isolinux          RELEASE-NOTES-en.html RELEASE-NOTES-ja       RELEASE-NOTES-pt.html
NOTES             RELEASE-NOTES-es       RELEASE-NOTES-ja.html RELEASE-NOTES-ru
RELEASE-NOTES-cz RELEASE-NOTES-es.html RELEASE-NOTES-nl       RELEASE-NOTES-ru.html
[root@arun ~]#

* I have changed anonymous FTP home from default one to “/home/CentOS5.0/” Please details below….

[root@arun ~]# grep ftp /etc/passwd
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
[root@arun ~]# vi /etc/passwd
[root@arun ~]# grep ftp /etc/passwd
ftp:x:14:50:FTP User:/home/CentOS5.0:/sbin/nologin
[root@arun ~]#

* Now, restart FTP server and try to access to ftp with IPaddress assigned to bridge “virbr0″. In my case it is “ftp://192.168.122.1″

* Start installation now using “virt-install”

[root@arun ~]# virt-install –name arunOS –os-type=linux –ram=300 –file /var/xen-disk/centOS.hdd –location ftp://192.168.122.1 –nographics –bridge=virbr0

Starting install…

* Welcome to CentOS

/ between elements | selects | next screen

* Welcome to CentOS

/ between elements | selects | next screen

* Welcome to CentOS

,<+>,<-> selection | Add drive | next screen

* Welcome to CentOS

+—————————-+ Partitioning +—————————-+
|                                                                        |
|      Device        Start    End     Size       Type     Mount Point    |
| /dev/xvda                                                            ^ |
|   Free space            1    1045    8192M Free space               # |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      v |
|                                                                        |
|    +—–+   +——+   +——–+   +——+   +—-+   +——+      |
|    | New |   | Edit |   | Delete |   | RAID |   | OK |   | Back |      |
|    +—–+   +——+   +——–+   +——+   +—-+   +——+      |
|                                                                        |
|                                                                        |
+————————————————————————+

F1-Help F2-New F3-Edit F4-Delete F5-Reset F12-OK

* Welcome to CentOS

+—————————-+ Partitioning +—————————-+
|                                                                        |
|      Device        Start    End     Size       Type     Mount Point    |
| /dev/xvda                                                            ^ |
|   xvda1                 1     829    6502M ext3        /            # |
|   xvda2               830     893     502M swap                     : |
|   Free space          894    1044    1184M Free space               : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      : |
|                                                                      v |
|                                                                        |
|    +—–+   +——+   +——–+   +——+   +—-+   +——+      |
|    | New |   | Edit |   | Delete |   | RAID |   | OK |   | Back |      |
|    +—–+   +——+   +——–+   +——+   +—-+   +——+      |
|                                                                        |
|                                                                        |
+————————————————————————+

F1-Help F2-New F3-Edit F4-Delete F5-Reset F12-OK

* Same way configure TZ,root password,packages,boot loader options etc…

* Welcome to CentOS

+———————+ Formatting +———————-+
|                                                         |
| Formatting / file system…                             |
|                                                         |
|                           70%                           |
|                                                         |
+———————————————————+

/ between elements | selects | next screen

That’s it!

Thank you,
Arun BagulSimilar Posts:

What’s new in GRUB-2?

Arun Bagul — Mon, 19 Apr 2010 15:10:39 +0000

Introduction ~ GRUB is perfect boot loader for Linux/Unix system! GRUB-2 supports several features that are important for every system admin.

* Platform support - GRUB 2 is intended to work across a wider range of architectures.
* Partition tables - GRUB-2 supports MBR partitioning scheme and GUID Partition Table (GPT).
* RAID and LVM - Now GRUB is supports both redundant array of independent disks (RAID) and Logical Volume Manager (LVM).
* File system support - GRUB 2 supports some additional non-Linux file systems, such as Apple’s Hierarchical File System Plus, NTFS and ZFS file systems…

* Configuring GRUB 2 -

GRUB 2 configuration file is different from legacy GRUB….

The default location for the GRUB 2 configuration file is /boot/grub/grub.cfg

* Sample GRUB 2 configuration file

root@me:~# cat /boot/grub/grub.cfg

set timeout=10
set default=0

menuentry “Ubuntu, Linux 2.6.31-20-generic” {
set quiet=1
insmod ext2
set root=(hd0,6)
search –no-floppy –fs-uuid –set 7699852c-2a04-4da2-82e8-a69969f16bf2
linux /boot/vmlinuz-2.6.31-20-generic root=UUID=7699852c-2a04-4da2-82e8-a69969f16bf2 ro quiet splash
initrd /boot/initrd.img-2.6.31-20-generic
}

Thanks,
Arun BagulSimilar Posts:

How to install GNOME themes in Ubuntu

Arun Bagul — Tue, 09 Mar 2010 04:53:15 +0000

Introduction – There are many beautiful GNOME desktop themes available for Ubuntu and other linux….

Step 1] Add repository –

root@me:~# add-apt-repository ppa:bisigi/ppa

*** Add following two lines in “/etc/apt/sources.list” file.

root@me:~# vi /etc/apt/sources.list

deb http://ppa.launchpad.net/bisigi/ppa/ubuntu karmic main
deb-src http://ppa.launchpad.net/bisigi/ppa/ubuntu karmic main

Step 2] Add the gpg key of repository –

root@me:~# gpg –keyserver hkp://keyserver.ubuntu.com:11371 –recv-key 881574DE && gpg -a –export 881574DE | apt-key add -

Step 3] Update the repo list and install the themes….

root@me:~# apt-get update

* To install all available themes plz run this command….

root@me:~# apt-get install bisigi-themes

* To install indivisual themes.. (few best themes)

root@me:~# apt-get install showtime-theme

root@me:~# apt-get install balanzan-theme
root@me:~# apt-get install infinity-theme
root@me:~# apt-get install wild-shine-theme
root@me:~# apt-get install tropical-theme
root@me:~# apt-get install ubuntu-sunrise-theme
root@me:~# apt-get install aquadreams-theme

Step 4] How to activate/select theme.

Go to “System” –> “Preferences” –> “Appearance” and select your theme!!

** Enjoy

Thank you,
Arun BagulSimilar Posts:

How to use socat with haproxy stat

Ravi Bhure — Thu, 25 Feb 2010 10:28:48 +0000

*** Introduction –

All you know about the haproxy, that its the one of the good opensource load balancing software and to check the fun stats of haproxy here we using ‘socat’ – Multipurpose relay (SOcket CAT)

* What is socat?

Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. Because the streams can be constructed from a large set of different types of data sinks and sources (see address types), and because lots of address options may be applied to the streams, socat can be used for many different purposes. (see more info at ‘man socat’ or at http://www.dest-unreach.org/socat/)
* How to use ‘socat’ with haproxy stat

Step 1) Download ‘socat’ from http://www.dest-unreach.org/socat/download/ latest version ~ “socat-2.0.0-b3.tar.gz”

ravi@arun:~$ wget http://www.dest-unreach.org/socat/download/socat-1.7.1.2.tar.gz

ravi@arun:~$ tar xvzf socat-1.7.1.2.tar.gz

ravi@arun:~$ cd socat-1.7.1.2

NOTE ~ No need to install the ‘fipsld’ package if you got the below msg after running the ‘make’ just following steps for

compiling socat….

FIPSLD_CC=gcc fipsld -O -D_GNU_SOURCE -Wall -Wno-parentheses -DHAVE_CONFIG_H -I. -I. -c -o socat.o socat.c
/bin/sh: fipsld: command not found
make: *** [socat.o] Error 127

ravi@arun:~$ ./configure –disable-fips
ravi@arun:~$ make

To install it login as root
ravi@arun:~$ su -

ravi@arun:~# make install

Step 2) Now you need to add stats socket PATH in Haproxy configuration and restart haproxy as per shown in following example,

where I have added it under in ‘global’ setting -

ravi@arun:~# more /etc/haproxy/myhaproxy.cfg

#———–Start of haproxy Config file————–
global
log 127.0.0.1   local0
log 127.0.0.1   local1 notice
#log loghost    local0 info
maxconn 25000
#debug
#quiet
user ravi
group ravi
stats socket    /tmp/haproxy
defaults
option          contstats
timeout         connect 5s
timeout         client 25s
timeout         server 25s
maxconn         100

listen ravitestbed      0.0.0.0:80 ##ravi.com IP
mode            tcp
balance         roundrobin
server          web1 192.168.19.117
server          web2 192.168.19.122

listen stats
bind            0.0.0.0:8081
mode            http
#stats          uri /stat #Comment this if you need to specify diff stat path for viewing stat page
stats enable
stats auth admin:admin ##Auth user pass

#———–End of haproxy Config file————–

Step 3) Used /tmp/haproxy. Now you can send the commands to get stats from HAProxy -

Now time to use socat

ravi@arun:~# echo “” | socat unix-connect:/tmp/haproxy stdio
Unknown command. Please enter one of the following commands only :
show info   : report information about the running process
show stat   : report counters for each proxy and server
show errors : report last request and response errors for each proxy
show sess   : report the list of current sessions

This will dump (possibly huge) info about all know sessions.

ravi@arun:~$ echo “show sess” | socat unix-connect:/tmp/haproxy stdio
0x9ee3520: proto=tcpv4 src=192.168.19.117:4721 fe=ravitestbed be=ravitestbed srv=arun as=0 ts=08 age=4s calls=3
rq[f=009202h,l=0,an=00h,rx=20s,wx=,ax=] rp[f=009202h,l=0,an=00h,rx=20s,wx=,ax=] s0=[7,8h,fd=1,ex=] s1=[7,8h,fd=2,ex=] exp=20s
0x9eeb8e8: proto=tcpv4 src=192.168.19.117:4723 fe=ravitestbed be=ravitestbed srv=arun as=0 ts=08 age=4s calls=3
rq[f=009000h,l=0,an=00h,rx=20s,wx=,ax=] rp[f=009202h,l=0,an=00h,rx=20s,wx=,ax=] s0=[7,8h,fd=8,ex=] s1=[7,8h,fd=9,ex=] exp=20s
0x9ef3d08: proto=tcpv4 src=192.168.19.117:4725 fe=ravitestbed be=ravitestbed srv=arun as=0 ts=08 age=4s calls=3
rq[f=009000h,l=0,an=00h,rx=20s,wx=,ax=] rp[f=009202h,l=0,an=00h,rx=20s,wx=,ax=] s0=[7,8h,fd=12,ex=] s1=[7,8h,fd=13,ex=]
exp=20s
0x9f04548: proto=unix_stream as=2 ts=09 age=0s calls=2 rq[f=00e042h,l=10,an=20h,rx=10s,wx=,ax=]

rp[f=048060h,l=716,an=00h,rx=,wx=10s,ax=] s0=[7,0h,fd=3,ex=] s1=[0,0h,fd=-1,ex=] exp=9s

This will give you information about the running HAProxy process such as pid, uptime and etc.

ravi@arun:~$ echo “show info” | socat unix-connect:/tmp/haproxy stdio
Name: HAProxy
Version: 1.3.23
Release_date: 2010/01/28
Nbproc: 1
Process_num: 1
Pid: 11829
Uptime: 0d 0h42m53s
Uptime_sec: 2573
Memmax_MB: 0
Ulimit-n: 50013
Maxsock: 50013
Maxconn: 25000
Maxpipes: 0
CurrConns: 1
PipesUsed: 0
PipesFree: 0
Tasks: 1
Run_queue: 1
node: ravi.world
description:

This will give you stats on all of your backends and frontends, some of the same stuff you see on the stats page enabled by the stats uri configuration. As an added bonus it’s all in CSV.

ravi@arun:~$ echo “show stat” | socat unix-connect:/tmp/haproxy stdio
#
pxname,svname,qcur,qmax,scur,smax,slim,stot,bin,bout,dreq,dresp,ereq,econ,eresp,wretr,wredis,status,weight,act,bck,chkfail,ch
kdown,lastchg,downtime,qlimit,pid,iid,sid,throttle,lbtot,tracked,type,rate,rate_lim,rate_max,
ravitestbed,FRONTEND,,,0,5,100,30,32582,50616,0,0,0,,,,,OPEN,,,,,,,,,1,1,0,,,,0,0,0,5,
ravitestbed,trupti,0,0,0,2,,15,7020,22722,,0,,0,0,0,0,no check,1,1,0,,,,,,1,1,1,,15,,2,0,,2,
ravitestbed,arun,0,0,0,5,,15,25562,27894,,0,,0,0,0,0,no check,1,1,0,,,,,,1,1,2,,15,,2,0,,3,
ravitestbed,BACKEND,0,0,0,5,100,30,32582,50616,0,0,,0,0,0,0,UP,2,2,0,,0,2710,0,,1,1,0,,30,,1,0,,5,
stats,FRONTEND,,,0,1,100,21,9605,152357,0,0,0,,,,,OPEN,,,,,,,,,1,2,0,,,,0,0,0,9,
stats,BACKEND,0,0,0,1,100,5,9605,152357,0,0,,5,0,0,0,UP,0,0,0,,0,2710,0,,1,2,0,,0,,1,0,,4,

show errors will give you a capture of last error on each backend/frontend.

ravi@arun:~$ echo “show errors” | socat unix-connect:/tmp/haproxy stdio

Reffer:

http://www.dest-unreach.org/socat/

http://haproxy.1wt.eu/download/1.3/doc/configuration.txt

Thanks to Joe (http://www.joeandmotorboat.com)

Thank you,
RaviSimilar Posts:

How to use TCP Wrappers for system security

Manoj Chauhan — Mon, 22 Feb 2010 13:01:33 +0000

Introduction:-

Access control to services compiled with TCP wrappers support is implemented by the /etc/hosts.allow and /etc/hosts.deny files. When a connection attempt is made, the hosts.allow file is checked. If a line is matched, the connection is allowed. Then the hosts.deny file is consulted, if a line is matched, the connection is denied. If no matches have occurred in either file, the connection is allowed.

Create Authorized Use Only Banners-

If configured as described below, TCP wrappers will display a warning banner to any user attempting to connect to a service it monitors. The following set of commands generate the directory /etc/banners, and the files therein contain warning banner text for each service. In this example, the banner text is “Use of this system is restricted to authorized users.” Note that exact wording of a warning banner is site specific; however, it should at least emphasize that the use of the system is restricted to authorized persons and that consent to monitor activities is implied by logging in to the system.

[root@localhost]# /bin/mkdir -p /etc/banners
[root@localhost]# /bin/echo “Use of this system is restricted to authorized users” > /etc/banners/
prototype
[root@localhost]# cd /etc/banners ; /usr/bin/make -f /usr/share/doc/tcp_wrappers-7.6/Banners.Makefile

Deny Everything Except What is Explicitly Allowed-

In order to implement the security best practice stance of deny everything except what is explicitly allowed, issue the following command.
[root@localhost]# echo ‘ALL: ALL: spawn (/bin/echo -e ‘/bin/date’”\n%c attempted connection to %s
and was denied” \
> | /bin/mail -s “Connection attempt to %s” root) &’ > /etc/hosts.deny

Any connection attempt not listed in the hosts.allow file will be denied, a message will be logged to the syslog auth facility, and an email will be sent to root.
Allow Access to Those Who Require It

Edit the hosts.allow file and add a line for each service to which access should be allowed. A few examples are shown below (See the man pages for hosts.allow for more detail).

ALL: LOCAL : banners /etc/banners # All services from local clients (hostnames with no “.”)
sshd: 10.1.1.0/255.255.254.0 : banners /etc/banners # SSH connections from host IP addresses between 10.1.1.0 and 10.1.2.0

Thanks
Manoj ChauhanSimilar Posts:

Good practices for apache & php

Manoj Chauhan — Fri, 19 Feb 2010 15:40:14 +0000

Introduction –

To conclude the discussion about session management, here are some best practices to demonstrate that a robust scheme requires serious thinking:
•   Create a session token upon first visit.
•   When performing authentication, destroy the old session and create a new one.
•   Limit session lifetime to a short period (a few hours).
•   Destroy inactive sessions regularly.
•   Destroy sessions after users log out.
•   Ask users to re-authenticate before an important task is performed (e.g., an order is placed).
•   Do not use the same session for a non-SSL part of the site as for the SSL part of the site because non-SSL traffic can be intercepted and the session token obtained from it. Treat them as two different servers.
•   If cookies are used to transport session tokens in an SSL application, they should be marked “secure.” Secure cookies are never sent over a non-SSL connection.
•   Regenerate session tokens from time to time.
•   Monitor client parameters (IP address, the User-Agent request header) and send warnings to the error log when they change. Some information (e.g., the contents of the User-Agent header) should not change for the lifetime of a session. Invalidate the session if it does.
•   If you know where your users are coming from, attach each session to a single IP address, and do not allow the address to change.
•   If you can, do not accept users coming through web proxies. This will be difficult to do for most public sites but easier for internal applications.
•   If you can, do not accept users coming through open web proxies. Open proxies are used when users want to stay anonymous or otherwise hide their tracks. You can detect which proxies are open by extracting the IP address of the proxy from each proxied request and having a script automatically test whether the proxy is open or not.
•   If you do allow web proxies, consider using Java applets or Flash movies (probably a better choice since such movies can pretend to be regular animations) to detect the users’ real IP addresses. It’s a long shot but may work in some cases.
•   Web users can upload only jpeg, gif, png files not php extension
•   We can place a blank index page in each directory in question and users can not execute php etc scripts from the image folders or image/document upload folders.
•   Upgrade apache current version (2.0) to newer version (2.2)

Thanks
Manoj ChauhanSimilar Posts:

Haproxy + apache dropping the connections

Ravi Bhure — Sun, 24 Jan 2010 17:14:35 +0000

Many times haproxy and apache does not reliable to serve the connections without tune or we say we need to set system as well some kernel parameters to work it better.

Here haproxy gives an errors to connect to apache, at that time it logs the errors into ‘dmesg | tail’ or in ‘/var/log/messages’ “kernel: ip_conntrack: table full, dropping packet” that is related to ip_conntrack kernel module.

Conntrack table is hash table (hash map) of fixed size (8192 entries by default), which is used for primary lookup. When the slot in the table is found it points to list of conntrack structures, so secondary lookup is done using list traversal. 65536/8192 gives 8 – the average list length. You may want to experiment with this value on heavily loaded systems.

If this error founds into /var/log/messages or dmesg you have to apply following steps to resolve.

Here I have done this to changes and added few settings in kernel also we will do it to set apache MPM and Haproxy tunning with sysctl.conf

Note: I have tried all this workaround and apply on CentOS-5.2, but don’t worry ip_conntrack module is default in kernel 2.6 +

1) To check ip_contrack is compiled with your kernel

[root@ravi.com ~]# modinfo ip_conntrack
filename:       /lib/modules/2.6.18-128.el5/kernel/net/ipv4/netfilter/ip_conntrack.ko
license:        GPL
srcversion:     F1390E605BBFB05078B78E8
depends:        nfnetlink
vermagic:       2.6.18-128.el5 SMP mod_unload gcc-4.1
module_sig:     883f350497747c575ed35fe9471dce112565509f4b58f4f3e440c6bcc05c2fba9bbdd224bdeb8209e293da385133a876e44a7b449ba59a882a8282b

2) Probe ip_conntrack kernel module or add it in /etc/modprobe.conf

[root@ravi.com ~]# modprobe ip_conntrack hashsize=131072

open /etc/modprobe.conf and add below lines at the end of file

options ip_conntrack hashsize=131072

3) before go to apply the 4th step, just check the ip_conntrack setting is into /etc/sysctl.conf

grep “ip_conntrack” /etc/sysctl.conf

if its found then apply 4th step or edit the /etc/sysctl.conf and add the given two lines at the end of file and save it then go for 4th step
(the value is compare to your RAM and set it to below)

net.ipv4.ip_conntrack_max = 16777216
net.ipv4.netfilter.ip_conntrack_max = 16777216

4) To apply the sysctl parameters run ‘sysctl -p’

[root@ravi.com ~]# sysctl -p

5) Now check the ip_conntrack is logging the connections and check not dropping any more

[root@ravi.com ~]# cat /proc/slabinfo | grep conn
ip_conntrack_expect 0 0 136 28 1 : tunables 120 60 8 : slabdata 0 0 0
ip_conntrack 216053 231335 304 13 1 : tunables 54 27 8 : slabdata 17795 17795 216

6) Also you can check how much memory utilized by ip_conntrack module per connection.

[root@ravi.com ~]# grep ip_conntrack /var/log/messages

/var/log/messages.2:Jan 14 21:46:04 ravi kernel: ip_conntrack version 2.4 (8192 buckets, 65536 max) – 304 bytes per conntrack

1M connections would require 304MB of kernel memory.

Thanks
RaviSimilar Posts: