Игорь Олемской — практические заметки по системному администрированию Linux CentOS

Это удобнее всего сделать используя tar через ssh:

tar zcvf - /files | ssh root@192.168.0.1 "cat > /files.tar.gz"

I just updated the CentOS RPMs and spec file in my repository for Zabbix 1.8. This is a minor version bump to 1.8.1 of Zabbix. See their changelog for changes to Zabbix. Also, I added some new features based on requests from users…

1. IPMI Support
2. Jabber support
3. NOTE (corrected): SSH did not make it into this one, I will package it in the next release

NOTE: If you have problems installing zabbix-web because of the PHP >= 5.2 dependency, please visit this link: PHP >= 5.2 requirements for zabbix-web

All you need to do if you have my repository is run `yum update` to upgrade your packages, if you don’t know about it yet, visit the link below for more info on my repository!

  Article links:

1. My Yum RPM Repository
2. Zabbix 1.8.1 RPM Spec File
3. Zabbix 1.8r5 Previous RPM update
4. PHP >= 5.2 requirements for zabbix-web

Thanks to a recommendation from Michael and Florian, I've been using dsh with a lot of success for quite some time. In short, dsh is a small application which will allow you to run commands across many servers via ssh very quickly.

You may be wondering: «Why not just use ssh in a for loop?» Sure, you could do something like this in bash:

for i in`cat ~/myhosts.txt`; do ssh $i 'uptime'; done

But dsh allows you to do this:

dsh -g myhosts 'uptime'

In addition, dsh allows you to run the commands concurrently (-c) or one after the other (-w). You can tell it to prepend each line with the machine's name (-M) or it can omit the machine name from the output (-H). If you need to pass extra options, such as which ssh key to use, or an alternative port, you can do that as well (-o). All of these command line options can be tossed into a configuration file if you have a default set of options you prefer.

Another thing that makes dsh more powerful is the groups feature. Let's say you have three groups of servers — some are in California, others in Texas, and still others in New York. You could make three files for the groups:

• ~/.dsh/group/california
• ~/.dsh/group/texas
• ~/.dsh/group/newyork

Inside each file, you just need to list the hosts one after the other. Here's the ~/.dsh/group/texas group file:

db1.tx.mydomain.com
db2.tx.mydomain.com
web1.tx.mydomain.com
web2.tx.mydomain.com
#web3.tx.mydomain.com

As you can see, dsh handles comments in the hosts file. In the above example, the web3 server will be skipped since it's prepended with a comment. Let's say you want to check the uptime on all of the Texas servers as fast as possible:

dsh -c -g texas 'uptime'

That will run the uptime command on all of the servers in the Texas group concurrently. If you need to run it on two groups at once, just pass another group (eg. -g texas -g california) as an argument. You can also run the commands against all of your groups (-a).

The dsh command can really help you if you need to gather information or run simple commands on many remote servers. If you find yourself using it often for systems management, you may want to consider something like puppet.

©2010 Racker Hacker. All Rights Reserved.

.

Для того, чтобы в контейнере OpenVZ под CentOS заработала блокировка iptables вида (разрешается не больше 4 соединений для порта 22 в течение 180 секунд):

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource

Необходимо в файле /etc/vz/vz.conf разрешить следующие iptables-модули:

IPTABLES="iptable_filter ipt_multiport ip_conntrack ipt_REJECT"

По-умолчанию ip_conntrack отсутствует в этом списке, iptables при добавлении приведенных выше правил не ругается, но и ничего не работает.