Gotchas of the 1&1 base Centos 64 bit cloud server image
- iptables is enabled by default on the minimal centos install. Either configure it, or use an external one (1&1 control panel gives you access to a cisco HW FW), and disable it thusly
- /etc/rc.d/init.d/iptables stop
- service iptables stop
- and to disable from startup:
- chkconfig iptables off
- It only has java 1.4 installed by default.
- Its in BST, not UTC, and ntp is not enabled (so the time will not be exact).
- Swap is only 2GB, even if you ordered 8GB memory. swap should be 16GB in this case.
- zip is installed, but not unzip. The mind boggles.
- sendmail nor postfix is installed. exim is, but its permissions are broken.
Useful utils:
- chkconfig to manage your rcx.d scripts & services. chkconfig --list shows whats installed as a service and what run levels they start at.
Info:
- yum list - shows packages available
- yum list installed - shows packages installed.
- java -version - if its not 1.5 or 1.6, you need to update it.
- free tells you how much mem and swap you have. generally, swap should be twice your mem.
Set new hostname:
- hostname zzz.yyy.co.uk
- edit hostname in: /etc/sysconfig/network
- edit /etc/hosts and add hostname once to external IP:
127.0.0.1 localhost.localdomain localhost
87.106.99.99 zzz.yyy.co.uk zzz
fix mail
- # mkdir /var/log/exim
- # chown exim:exim /var/log/exim
- # service exim restart
- now try to telnet to port 25 from the localhost, should let you in.
Update existing packages
Install apps
Configure the timezone to UTC.
- mv /etc/localtime /etc/localtime.bak
- ln -s /usr/share/zoneinfo/UTC /etc/localtime
- the date command should now say UTC.
- 1&1 recommend this:
Fix the date & time
- date mmddhhmm
- /sbin/hwclock --systohc --utc
- - possibly try this:
- edit /boot/grub/grub.conf and add "noapic nolapic divider=10 nolapic_timer" to end of kernel line and reboot
setup ntp.
- ntp package should already be installed. see if its running with this:
- if it doenst return a process ID, do this:
- That should get it to start on bootup.
- To manually start/stop/restart use this:
- /etc/init.d/ntpd [start|stop|restart]
- ALTERNATIVE INSTRUCTIONS:
- Start the service:
- Auto start service on startup:
- chkconfig --level 345 ntpd on
- chkconfig --level 0126 ntpd off
- chkconfig --list | grep ntpd
- ntpd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
- Check its syncing (look for the offset going down)
Fixing broken 1&1 ntp setup.
If you use their plain centos image, and start ntp, it may quickly go wrong. In your ntp.cof will be the the centos.pool ntp servers. However, with the 1&1 default firewall at least, these are not reachable. In this file are also two 1&1 ntp servers. With this standard ntp.conf file, the time will quickly diverge from the actual time by about half an hour a day. When it is a day out, ntp will kill itself. To fix:
- comment out the centos pool servers.
- in /etc/ntp.conf change this:
- server ntp2.pureserver.info
- server ntp1.pureserver.info
- to this:
- server 212.227.123.64 burst iburst
- server 195.20.224.142 burst iburst
- and comment out the following:
- server 127.127.1.0 # local clock
- fudge 127.127.1.0 stratum 10
Install VNC
- yum install vnc-server
- yum install twm
- yum install xterm
- yum install xsetroot
- useradd myvncuser (insert your username here)
- passwd myvncuser (set pass)
- su - myvncuser
- vncpasswd (set pass)
- edit /etc/sysconfig/vncservers:
- VNCSERVERS="1:myvncuser"
- VNCSERVERARGS[1]="-geometry 800x600"
- NOTE: this is for testing - add the extra security parameters after (e.g. -localhost).
- you can connect to server via browser on 580X where X is the number of the user (e.g. 1 or 2 etc) or on 590X using a vnc viewer app.
- Start vnc as root:
- /sbin/service vncserver start
- or make it start automatcially at run level 3/4/5:
install oracle
net.core.rmem_default = 4194304
net.core.rmem_max = 4194304
net.core.wmem_default = 262144
kernel.sem = 250 32000 100 128
fs.file-max = 6815744
net.ipv4.ip_local_port_range = 9000 65500
net.core.wmem_max = 1048576
fs.aio-max-nr = 1048576
@]
- Add the following lines to /etc/security/limits.conf
oracle soft nproc 2047
oracle hard nproc 16384
oracle soft nofile 1024
oracle hard nofile 65536
- Add the following lines to /etc/pam.d/login (note the pam file is located for me in /lib64/security/, not /lib/security/
- session required pam_limits.so
- Add the following lines to /etc/profile
if [ $USER = "oracle" ]; then
if [ $SHELL = "/bin/ksh" ]; then
ulimit -p 16384
ulimit -n 65536
else
ulimit -u 16384 -n 65536
fi
fi
- pick a mount point that has enough space: /home in my case (as 1&1 don't give enough space in other partitions in their builds)
- # mkdir /home/oracle/app/oracle/product/11.2.0
- # chown -R oracle:oinstall /home/oracle/app
- # chmod -R 775 /home/oracle/app
- As Oracle:
- # su – oracle
- Add this to end of .bash_profile: umask 022
- $ . ./.bash_profile
- unzip the downloaded zip files:
- $ cd /home/oracle
- $ unzip /home/oracle/download/*.zip
- Now you have a new dir: database, in your oracle dir.
- fire up a VNC session, and in an xterm (as oracle user) execute this:
- to manage the enterprise manager:
- $ ./emctl start | stop dbconsole
- hit this URL https://your.server.com:1158/em/console/logon/logon
- Make sure you trust the certificate (assuming you havent bought a real one).
- you can login with SYS asDBA, but I would like to know how to login as a normal admin user.
- setup oracle backups using the em console.
Firewall
Create a new rule set something like this.
Default-Policy: DENY
Number Remote IP Remote Port Local Port Protocol Action Status
1 All Any 80 TCP Allow Active
2 All Any 443 TCP Allow Active
3 All Any 8443 TCP Allow Active
4 80.24.93.213/32 Any 22 TCP Allow Active
5 80.206.160.75/32 Any 22 TCP Allow Active
6 All Any 8080 TCP Allow Active
Confluence.
Installing confluence is a pain because their installation documentation is very poor.
- create an installation dir, and unzip confluence into it. It is unclear if this directory can be deleted after the installation.
- Create a home directory, e.g. /home/confluence.
- increase your min heap, e.g. by adding this to /etc/profile:
export CATALINA_OPTS="-Xms128m -Xmx1024m -XX:MaxPermSize=192m -Djava.awt.headless=true"
- The undocumented secret critical step is you need to change the ownership of this home dir thus:
- chown tomcat:tomcat /home/confluence
- Undocumented Oracle steps:
- (optional) Create a new table space(s), e.g:
CREATE TABLESPACE CONFLUENCE DATAFILE
'/home/oracle/oradata/orcl/confluence.dbf' SIZE 32M AUTOEXTEND ON NEXT 32M MAXSIZE UNLIMITED
LOGGING
ONLINE
PERMANENT
EXTENT MANAGEMENT LOCAL AUTOALLOCATE
BLOCKSIZE 8K
SEGMENT SPACE MANAGEMENT AUTO
FLASHBACK OFF;
- Create a new oracle user, e.g. CONFLUENCE
CREATE USER CONFLUENCE
IDENTIFIED BY <password>
DEFAULT TABLESPACE CONFLUENCE
TEMPORARY TABLESPACE TEMP
PROFILE DEFAULT
ACCOUNT UNLOCK;
-- 1 Tablespace Quota for CONFLUENCE
ALTER USER CONFLUENCE QUOTA UNLIMITED ON CONFLUENCE;
- give it permissions we think confluence needs:
GRANT CONNECT TO CONFLUENCE;
GRANT RESOURCE TO CONFLUENCE;
GRANT CREATE TABLE TO CONFLUENCE;
GRANT CREATE SYNONYM TO CONFLUENCE;
GRANT CREATE ROLE TO CONFLUENCE;
GRANT CREATE TYPE TO CONFLUENCE;
GRANT CREATE SEQUENCE TO CONFLUENCE;
GRANT CREATE TRIGGER TO CONFLUENCE;
GRANT CREATE PROCEDURE TO CONFLUENCE;
GRANT CREATE DATABASE LINK TO CONFLUENCE;
GRANT CREATE VIEW TO CONFLUENCE;
GRANT UNLIMITED TABLESPACE TO CONFLUENCE;
- Now do the undocumented step of copying an oracle ojdbc jar into the confluence installation dirs, e.g:
- # cp /home/oracle/app/oracle/product/11.2.0/dbhome_1/jdbc/lib/ojdbc6.jar /home/downloads/confluence-3.2.1_01/confluence/WEB-INF/lib/
- restart tomcat (service tomcat5 restart).
- go to http://myserver.com:8080/confluence/ and enter your license (you have to go to my.atlassian.com to get this - another undocumented step).
- Next say you want to create a direct DB connection to oracle, and enter the confluence username, connection string password etc.
- Add this to the /etc/exim/exim.conf
fixed_plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = \
${if and {{eq{$auth2}{confluence-email-user}}{eq{$auth3}{confluence-pass}}}}
server_set_id = $auth2
- Use that usr/pass in the confluence mail setup.
- fix the mail library conflicts by deleting or moving:
- mail-1.4.1.jar
- activation-1.0.2.jar
- out of <Confluence-install-dir>/confluence/WEB-INF/lib
- Fix the broken tomcat 5.5.23, buy downloading tomcat 5.5.17, taking out the naming-factory.jar and replacing the one in the /usr/share/tomcat5/lib dir as its missing some classes (tomcat team cant package their own product). https://issues.apache.org/bugzilla/show_bug.cgi?id=40668
backups
on another 1&1 root server (standard plesk install)
- NOTE: stupidly, 1&1 standard centos image has no mounted /home partition, so you cant put anything in /home or it will flood the small / partition.
- # groupadd skillkash
- # useradd -g skillkash -d /var/home/backup -s /bin/bash backup
- # passwd skillkash
- now you can sftp to the box (assuming no fw) with password..
- Edit /etc/ssh/sshd_config on server you connect to and make sure the following lines are uncommented:
RSAAuthentication yes
PubkeyAuthentication yes
- On machine you connect from:
- ssh-keygen -t rsa
- hit enter so you dont set a password.
- On server
- in the target user home dir, create or edit ~/.ssh/authorized_keys
- chmod 700 .ssh
- chmod 600 .ssh/authorized_keys
- Paste in the contents of the ~/.ssh/id_rsa.pub on the client machine into the authorized_keys on the server machine.
- scp away!
