My two ¢'s » Linux

Inbound Traffic Shaping made (pretty) easy

daniel — Wed, 28 Jan 2009 17:50:40 +0000

It’s not that easy to get trafic shaping done with Linux especially when it comes to inbound traffic. After some serious research i found this howto which is a excellent starting point. The supplied script can be easily customized and works pretty good. If there’s interest i can post my version for incoming traffic only.

You have to apply the IMQ patch (can be found here) to your kernel to get this working. IMQ is necessary because Linux can only limit outgoing traffic with builtin kernel settings.

Qualcomm MSM6275 UMTS Vodafone card

daniel — Tue, 02 Dec 2008 21:06:56 +0000

Preferences

First of all make sure UMTS card is recognized by your system. You need PCMCIA support enabled in your kernel. If you compiled it as modules load the modules.

deathstar ~ # lspci ... 04:00.0 Network controller: Option N.V. Qualcomm MSM6275 UMTS chip ...

Nozomi – Accessing the card

Download und build the Nozomi kernel module. You can get it here.

cd nozomi_2.21alpha_060917 mkdir -p /lib/modules/KERNEL_VERSION/kernel/drivers/pci/hotplug (if it doesn't exists) make depmod modprobe nozomi

After you succeeded in loading the nozomi module you should see something like this in dmesg:

nozomi 0000:04:00.0: Nozomi driver nozomi_tty Initializing Nozomi driver 2.21alpha (build date: Jun 9 2008 15:00:29) nozomi 0000:04:00.0: Version of card: 3 nozomi 0000:04:00.0: Initialization OK!

PPP Configuration

You have to supply the PIN to your SIM-card. There are two ways to accomplish this:

Add “AT+CPIN=MY_SIM_PIN” to your chat script
Use a little Perl script (for example if you use a PIN app)

#!/usr/bin/perl
 
use strict;
use warnings;
 
$SIG{ALRM} = sub { die("timeout: no response from modem $modem\n"); };
 
my §pin   = shift;
my $modem = '/dev/noz0';
 
open(MODEM, "+<", $modem) or die("Failed to open modem $modem: $!");
print(MODEM "AT+CPIN=\"$pin\"\n\r");
while () {
    if (m/OK/) {
        close(MODEM);
        print("PIN accepted\n");
        exit(0);
    }
    if (m/ERROR/) {
        close(MODEM);
        print("PIN rejected\n");
        exit(1);
    }
}
 
exit(0);

Now it’s time to create the PPP config and chat scripts.

/etc/ppp/peers/umts

# Most GPRS phones don't reply to LCP echo's lcp-echo-failure 0 lcp-echo-interval 0 # Keep pppd attached to the terminal: # Comment this to get daemon mode pppd nodetach # Debug info from pppd: # Comment this off, if you don't need more info debug # Connect script: # scripts to initialize the UMTS modem and start the connection, connect /etc/ppp/peers/umts-connect-chat # Disconnect script: # AT commands used to 'hangup' the UMTS connection. disconnect /etc/ppp/peers/umts-disconnect-chat # Serial device to which the UMTS card is connected: /dev/noz0 # Serial port line speed 115200 # Hardware flow control: # Use hardware flow control with cable, Bluetooth and USB but not with IrDA. crtscts # serial cable, Bluetooth and USB, on some occations with IrDA too #nocrtscts # IrDA # Ignore carrier detect signal from the modem: local # IP addresses: # - accept peers idea of our local address and set address peer as 10.0.0.1 # (any address would do, since IPCP gives 0.0.0.0 to it) # - if you use the 10. network at home or something and pppd rejects it, # change the address to something else 0.0.0.0:0.0.0.0 # pppd must not propose any IP address to the peer! noipdefault # Accept peers idea of our local address ipcp-accept-local # Add the ppp interface as default route to the IP routing table defaultroute # DNS servers from the phone: # some phones support this, some don't. usepeerdns # ppp compression: # ppp compression may be used between the phone and the pppd, but the # serial connection is usually not the bottleneck in GPRS, so the # compression is useless (and with some phones need to disabled before # the LCP negotiations succeed). novj nobsdcomp novjccomp nopcomp noaccomp # The phone is not required to authenticate: noauth mtu 1500 mru 1500

/etc/ppp/peers/umts-connect-chat

exec chat \ TIMEOUT 5 \ ECHO ON \ ABORT '\nBUSY\r' \ ABORT '\nERROR\r' \ ABORT '\nNO ANSWER\r' \ ABORT '\nNO CARRIER\r' \ ABORT '\nNO DIALTONE\r' \ ABORT '\nRINGING\r\n\r\nRINGING\r' \ '' \rAT \ TIMEOUT 12 \ SAY "Press CTRL-C to close the connection at any stage!" \ SAY "\ndefining PDP context...\n" \ OK ATH \ OK ATE1 \ OK 'AT+CGDCONT=1,"IP","web.vodafone.de","",0,0' \ OK ATD*99# \ TIMEOUT 22 \ SAY "\nwaiting for connect...\n" \ CONNECT "" \ SAY "\nConnected." \ SAY "\nIf the following ppp negotiations fail,\n" \ SAY "try restarting the phone.\n"

/etc/ppp/peers/umts-disconnect-chat

exec /usr/sbin/chat -V -s -S \ ABORT "BUSY" \ ABORT "ERROR" \ ABORT "NO DIALTONE" \ SAY "\nSending break to the modem\n" \ "" "\K" \ "" "+++ATH" \ SAY "\nPDP context detached\n"

Time to go online

deathstar ~ # pppd call gprs Press CTRL-C to close the connection at any stage! defining PDP context... AT OK ATH OK ATE1 OK AT+CGDCONT=1,"IP","web.vodafone.de","",0,0 OK waiting for connect... ATD*99# CONNECT Connected. If the following ppp negotiations fail, try restarting the phone. Serial connection established. using channel 1 Using interface ppp0 Connect: ppp0 <--> /dev/noz0 sent [LCP ConfReq id=0x1 ] rcvd [LCP ConfReq id=0x0 ] No auth is possible sent [LCP ConfRej id=0x0 ] rcvd [LCP ConfAck id=0x1 ] rcvd [LCP ConfReq id=0x1 ] sent [LCP ConfAck id=0x1 ] sent [CCP ConfReq id=0x1 ] sent [IPCP ConfReq id=0x1 ] rcvd [LCP DiscReq id=0x2 magic=0x90ae7a2e] rcvd [LCP ProtRej id=0x3 80 fd 01 01 00 0c 1a 04 78 00 18 04 78 00] rcvd [IPCP ConfNak id=0x1 ] sent [IPCP ConfReq id=0x2 ] rcvd [IPCP ConfNak id=0x2 ] sent [IPCP ConfReq id=0x3 ] rcvd [IPCP ConfNak id=0x3 ] sent [IPCP ConfReq id=0x4 ] rcvd [IPCP ConfReq id=0x0] sent [IPCP ConfNak id=0x0 ] rcvd [IPCP ConfNak id=0x4 ] sent [IPCP ConfReq id=0x5 ] rcvd [IPCP ConfAck id=0x5 ] rcvd [IPCP ConfReq id=0x1] sent [IPCP ConfAck id=0x1] Could not determine remote IP address: defaulting to 10.64.64.64 local IP address 77.24.36.100 remote IP address 10.64.64.64 primary DNS address 139.7.30.125 secondary DNS address 139.7.30.126 Script /etc/ppp/ip-up started (pid 8494) Script /etc/ppp/ip-up finished (pid 8494), status = 0x1

Welcome to mobile Internet using your Vodafone UMTS card

If you have any trouble don’t hesitate to contact me: daniel@linuxaddicted.de

Nagios Plugins

daniel — Tue, 02 Dec 2008 20:53:00 +0000

These are some of the Nagios plugins i wrote which may be useful for you. You may download them via http://www.nagiosexchange.org too. All plugins are released under GPLv2 license.

check_imap_mailbox

Details

This plugin monitors a given IMAP mailbox for new mail. When a new mail arrived a CRITICAL error will be returned. No new mail(s) will result in OK

Depencies

Mail::IMAPClient from CPAN
Getopt::Long from CPAN

Usage

Usage: check_imap_mailbox [PARAMETERS]
 
Parameters:
 
  --host=[HOSTNAME]      : Name or IP address of IMAP server
  --user=[USERNAME]      : Username to connect with
  --pass=[PASSWORD]      : Password to connect with
  --folder=[IMAP FOLDER] : The IMAP folder to check

Download latest version:

check_imap_mailbox / version 0.1 / size 1.25 kB / dlcount 407

check_jk_status

Details

Check the current status of a given JK loadbalancer. The status is fetched from the management URL (jkstatus). The plugin returns CRITICAL as soon as a cluster node has failed.

Depencies

XML::Simple from CPAN
Getopt::Long from CPAN
wget from gnu.org

Usage

Usage: check_jk_status [PARAMETERS]
 
Parameters:
  --host=[HOSTNAME]        : Name or IP address of JK management interface
  --balancer=[JK BALANCER] : Name of the JK balancer

Download latest version:

check_jk_status / version 0.1 / size 1.72 kB / dlcount 319

check_foundry_ports

Details

Compare the port status of Foundry switches against a given list and returns CRITICAL if any of the ports has status different from the defined value. May indicate that a switch/server failed or a new unauthorized connection took place.

Depencies

Getopt::Long from CPAN
snmpget from net-snmp.sourceforge.net

Usage

Usage: check_foundry_ports [PARAMETERS]
 
Parameters:
	    --host=[HOSTNAME]            : Hostname or IP-Address of Foundry device
	    --community=[SNMP COMMUNITY] : SNMP community string
	    --port=[INTERFACE NR]        : The interface number to check (1,2,3,22,...)

Download latest version:

check_foundry_ports / version 0.9 / size 1.91 kB / dlcount 250

Tipps & Tricks

daniel — Tue, 02 Dec 2008 18:35:12 +0000

Foundry Edgelron 24G-A Spanning Tree

Intensive Tests haben gezeigt das es keinen Sinn macht auf dem Foundry Switch 24G-A “Spanning Tree per VLAN” zu verwenden. Bei meiner letzten Installation war die Last durch die 15+X VLAN’s zu hoch. Es kam immer wieder zu Ausfällen dieser Switches die dann auch immer die anderen 24G-A’s in Mitleidenschaft gezogen haben. Es empfiehlt sich dann im Regelfall (wenn das Netz nicht zu groß ist) einen SPT über alle Komponenten zu legen.

Bondig + STP

In den Defaults der meisten Switches kommt es zu Problemen beim bonding von Interfaces. Das zeigt sich durch eine extrem lange Zeitspanne bis das Interface aktiv wird. Eine mögliche Ursache ist die Spanning-Tree Einstellung auf dem Switch. Es sollte eigentlich jeder Port bei dem bekannt ist, dass keine weiteren aktiven Netzwerkkomponenten angeschlossen sind, als Edge-Port definiert werden.
Das hat den Vorteil das der Port sofort aktiviert wird und falls sich doch eine aktive Komponente dahinter verbirgt ist dieser dennoch voll nutzbar. Das gilt zumindest für Foundry Komponenten. Ich hatte bisher noch keine Möglichkeit es bei anderen Herstellern zu verifizieren.

Linux – LDAP Timeout Probleme

Bei der Anbindung von Linux Servern gibt es einiges zu beachten:

OpenSSH ( > 4.7) + LPK Patch

Das Verhalten hat sich mit dieser Version grundlegend geändert. Nach dem Update der OpenSSH hat die LDAP Anmeldung nicht mehr funktioniert. Die Fehlermeldung deutete darauf hin, dass der User nicht in der passenden Gruppe war. Ein lokaler switch auf den User war aber ohne Probleme möglich und zeigte auch die richtige Gruppenzugehörigkeit. Nach intensiver Suche und einiger Zeit im IRC hat sich folgende Lösung ergeben.

In der Konfiguration von sshd (/etc/ssh/sshd_config) müssen folgende Parameter **
entfernt** werden:

LpkSearchTimelimit 3 LpkBindTimelimit 3

Bind Policy in /etc/ldap.conf

Die bind_policy in /etc/ldap.conf sollte auf jeden Fall auf soft gesetzt werden. Anderenfalls kommt es zu endlosen Timeouts. Sollte der Connect fehlschlagen wird bei jeder Anfrage dennoch ein Reconnect gemacht.

bind_policy soft

LDAP Timeout bei Routing Problemen

Sämtliche Einstellung die den Timeout beeinflussen sollen sind hinfällig wenn der LDAP-Server nicht durch eine der Routen erreichbar ist. Dann kommt der volle Timeout zum Tragen.

OpenGear Key Sequences

Folgende Key Sequences könnten für die Administration von OpenGear Console Server’s hilfreich sein.

~. : Close Session ~b : Send Brake ~h : Show History

OpenGear Security

Bis heute ist es nicht ohne Modifikationen möglich Public Key Authentication mit OpenGear Console Servers zu nutzen. Hier der Workaround:

#########################################
##  Modify Root's home directory
#########################################
 
# vi /etc/conf/passwd
--> Change root homedir to /etc/conf/users/root
 
#########################################
## Create directory and fix permissions
#########################################
 
# mkdir /etc/conf/users/root/.ssh
# chmod 0700 /etc/conf/users/root/.ssh
 
#########################################
## Copy ssh key to console server
#########################################
 
# cat [PATH]/id_dsa.pub | ssh root@xyz "cat - > /etc/conf/users/root/.ssh/authorized_keys"

BigIP Sessions via Console

Die BigIP’s von F5 können fast komplett per SSH/Console gemanaged werden. Das Linux System sorgt dafür das man sich sofort heimisch fühlt. Um sich alle aktuellen Verbindungen anzusehen hilft das “Swiss Army Knife” bigpipe:

[root@bigip:Active] admin # bigpipe conn all show 1.2.3.4:21606 <-> any:any <-> 192.168.1.4:8 icmp 11.22.33.44:10465 <-> 167.2.3.4:https <-> 192.168.33.2:webcache tcp ...

ePower Switches per Console schalten

Die ePower Switches sind im Prinzip schaltbare Steckdosen. Normalerweise werden einzelne Ports über ein Webfrontend geschaltet (siehe dazu: **[[dev:admin_toolbox|Admin Toolbox]]**. Das Ganze funktioniert aber auch über die serielle Schnittstelle. Und zwar so:

In die höchste Ebene wechseln (/RS und dann **nicht** TAB drücken)
Die Syntax ist: Pxy=z (x=Steckdosenleiste, y=Port, z=Status)
Stati (0=aus, 1=an, r=reboot, t=toggle)
ENTER

SSH Key Exchange Einzeiler

# cat ~/.ssh/id_dsa.pub | ssh USER@TARGET "cat - >> ~/.ssh/authorized_keys"

HA Linux Router

daniel — Mon, 27 Oct 2008 21:32:38 +0000

This howto describes the setup of a HA Linux router based on Gentoo and Keepalived. I’m writing this because there’s not really a good documentation on this topic so far. At least as i searched for it.

Requirement

The intended router requires this config and tools:

Kernel with activcated VLAN support(CONFIG_VLAN_8021Q=y)
Keepalived installed
vconfig installed
Optionally bonding support in Kernel and ifenslave installed

Network Configuration

This configuration example is designed for 8 NIC’s and 20 VLAN’s. The following config is split to make it more readable but belongs completely to /etc/conf.d/net.

VLAN-Interface-Mapping

Depending on your network and traffic you have to find a VLAN-interface-mapping that matches your environment.

#######################################################
## VLAN <--> Interface Mapping
#######################################################
 
## eth0: VLAN 20 - 22
vlans_eth0="20 21 22"
 
## eth1: VLAN 22
vlans_eth1="22"
 
## eth2: VLAN 23 - 24
vlans_eth2="23 24"
 
## eth3: VLAN 25 26 27 28
vlans_eth3="25 26 27 28"
 
## eth4: VLAN 29
vlans_eth4="29"
 
## eth5: VLAN 30 - 34
vlans_eth5="30 31 32 33 34"
 
## eth6: VLAN 35 - 38 
vlans_eth6="35 36 37 38"
 
## eth7: VLAN 39 - 40
vlans_eth7="39 40"

VLAN Settings

This VLAN setup will lead to interfaces named vlanXX. See the manpage of vconfig if you prefer a different setup. Then it’s time to disable the “parent interfaces”. You can’t use a interface in mixed mode: VLAN’s or single interface.

#######################################################
## VLAN Interface naming scheme
#######################################################
 
vconfig_eth0=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth1=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth2=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth3=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth4=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth5=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth6=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
vconfig_eth7=( "set_name_type VLAN_PLUS_VID_NO_PAD" )
 
#######################################################
## Disable interfaces for "normal" use
#######################################################
 
config_eth0=( "null" )
config_eth1=( "null" )
config_eth2=( "null" )
config_eth3=( "null" )
config_eth4=( "null" )
config_eth5=( "null" )
config_eth6=( "null" )
config_eth7=( "null" )

IP Adresses

Now it’s time to assign addresses to our VLAN interfaces. I myself prefer the last 3 adresses of every subnet as router addresses.

|xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx|
|            192.168.45.0/25
|xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx|
| Router-VIP  ==> 192.168.45.254 Cluster IP
| Router-A    ==> 192.168.45.253 Real-IP Node A
| Router-B    ==> 192.168.45.252 Real-IP Node B
 
config_vlan20=( "10.1.20.0/24" )
config_vlan21=( "10.1.21.0/24" )
config_vlan22=( "10.1.22.0/24" )
config_vlan23=( "10.1.23.0/24" )
config_vlan24=( "10.1.24.0/24" )
config_vlan25=( "10.1.25.0/24" )
config_vlan26=( "10.1.26.0/24" )
config_vlan27=( "10.1.27.0/24" )
config_vlan28=( "10.1.28.0/24" )
config_vlan29=( "10.1.29.0/24" )
config_vlan30=( "10.1.30.0/24" )
...

Routing

If you’re familiar with Gentoo’s routing syntax you shouldn’t be surprised to see how it works.

routes_vlan21=("192.168.99.0/27 via 10.1.21.5")
routes_vlan31=("default via 10.1.31.1")

Keepalived Configuration

MASTER: /etc/keepalived/keepalived.conf

## Unique identifier for every router
global_defs {
   router_id router-a
}
 
## Sync Group
vrrp_sync_group SG_A {
  group {
          VI_21 # VLAN 21
          VI_22 # VLAN 22
          VI_23 # VLAN 23
          VI_24 # VLAN 24
          VI_25 # VLAN 25
          VI_26 # VLAN 26
          VI_27 # VLAN 27
          VI_28 # VLAN 28
          VI_29 # VLAN 29
          VI_30 # VLAN 30
          VI_31 # VLAN 31
 
          ...
        }
}
 
## VLAN 21
vrrp_instance VI_21 {
    interface vlan21
    state MASTER
    virtual_router_id 21
    priority 80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass >FreakShow_<
    }
    virtual_ipaddress {
        10.1.21.254
    }
}
 
## VLAN 22
vrrp_instance VI_22 {
    interface vlan22
    state MASTER
    virtual_router_id 22
    priority 80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass >FreakShow_<
    }
    virtual_ipaddress {
        10.1.22.254
    }
}
 
...

SLAVE: /etc/keepalived/keepalived.conf

## Unique identifier for every router
global_defs {
   router_id router-b
}
 
## Sync Group
vrrp_sync_group SG_B {
  group {
          VI_21 # VLAN 21
          VI_22 # VLAN 22
          VI_23 # VLAN 23
          VI_24 # VLAN 24
          VI_25 # VLAN 25
          VI_26 # VLAN 26
          VI_27 # VLAN 27
          VI_28 # VLAN 28
          VI_29 # VLAN 29
          VI_30 # VLAN 30
          VI_31 # VLAN 31
 
          ...
        }
}
 
## VLAN 21
vrrp_instance VI_21 {
    interface vlan21
    state SLAVE
    virtual_router_id 21
    priority 50
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass >FreakShow_<
    }
    virtual_ipaddress {
        10.1.21.254
    }
}
 
## VLAN 22
vrrp_instance VI_22 {
    interface vlan22
    state SLAVE
    virtual_router_id 22
    priority 50
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass >FreakShow_<
    }
    virtual_ipaddress {
        10.1.22.254
    }
}
 
...

Documentation

daniel — Mon, 27 Oct 2008 21:13:17 +0000

This are some some howto’s i wrote. Please leave a comment if these documents were helpful for you.

Tipps & Tricks