Cisco MARS 推荐使用命令行方式升级

当前Cisco MARS版本为6.0.6.3368,通过Web界面上传csmars-6.0.7.3404.zip升级失败,升级日志中错误一会是“Upgrade package acquisition error.”,一会是“Failed to pass the version dependency test.”,根本不知道到底什么错误。

SSH登陆到MARS后,使用命令行pnupgrade ftp://192.168.1.2/csmars-6.0.7.3404.zip升级,报错则很清晰了:
[Error][check_dependency/547]: minimal allowed version(6.0.6.3368.35) > current version(6.0.6.3368.34).
最后的那个小版本号Cisco的网站上根本不标注的。从Cisco下载最新的 csmars-6.0.6.3368.zip再用pnupgrade ftp://192.168.1.2/csmars-6.0.6.3368.zip升级成功,看到输出信息真是无语啊!csmars-6.0.6.3368.zip更新了Cisco也不说明。

Upgrade………………[MARS]
From……………..[6.0.6.3368.34]
To……………….[6.0.6.3368.35]
……
Current Version……….[6.0.6.3368.34]
Package Version……….[6.0.6.3368.35]

IBM DS3000 单控制器写入缓存问题

IBM DS3000 系列磁盘阵列,在使用单控制器且刷的单控NVSRAM的情况下仍然会出现写入缓存失效的问题。查看Logical Drives配置如下:

Read cache:                            Enabled
Write cache:                           Enabled (currently suspended)
Write cache without batteries:      Disabled
Write cache with mirroring:         Enabled (currently suspended)
Flush write cache after (in seconds):  10.00
Dynamic cache read prefetch:           Enabled

在双控制器的情况下,为了在一个控制器失效时不丢失数据,两个控制器的写缓存需互为镜像,防止丢失写缓存内容。但是在单控制器的情况下,显然是不需要写缓存镜像的,但是控制器却由于无法完成写缓存镜像因此暂停了写缓存,这会导致性能的巨大损失。使用命令“set allLogicalDrives mirrorEnabled=false;”可禁止写缓存镜像,运行后查看Logical Drives配置如下:

Read cache:                            Enabled
Write cache:                           Enabled
Write cache without batteries:      Disabled
Write cache with mirroring:         Disabled
Flush write cache after (in seconds):  10.00
Dynamic cache read prefetch:           Enabled

ProFTPD 1.3.2升级到1.3.3后mod_ifsession mod_tls 的两点改变

mod_ifsession:Directory不能放在If…里面

1.3.2时
<IfUser yaoge>
  MaxHostsPerUser               1
  MaxClientsPerUser             3
  <Directory /ftp>
     <Limit DIRS READ WRITE>
       AllowAll
     </Limit>
  </Directory>
</IfUser>

1.3.3需改为
<IfUser yaoge>
  MaxHostsPerUser               1
  MaxClientsPerUser             3
</IfUser>
<Directory /ftp>
   <Limit DIRS READ WRITE>
      AllowUser OR yaoge
   </Limit>
</Directory>

mod_tls:需添加 TLSOptions NoSessionReuseRequired

一个比较复杂的ProFTPD配置

ProFTPD 1.3.2e的配置文件,1.3.3版本则需要进行一些修改,
ServerName                      “yaoge123 FTP Server”
ServerType                      standalone
DefaultServer                   on
ScoreboardFile                  /var/run/proftpd/proftpd.scoreboard
Port                            21
UseIPv6                         on
Umask                           022
MaxInstances                    100
MaxConnectionsPerHost           10
CommandBufferSize               512
UseReverseDNS                   off
IdentLookups                    off
ServerIdent                     on “Welcome to yaoge123 FTP Server”
User                            nobody
Group                           nogroup
DefaultRoot                     ~
AllowOverwrite                  off
requirevalidshell               off
AllowForeignAddress             on
AllowRetrieveRestart            on
DirFakeUser                     on yaoge123
DirFakeGroup                    on yaoge123
DirFakeMode                     0000
TimeoutLogin                    30
TimeoutIdle                     300
SystemLog                       /var/log/proftpd.log
TransferLog                     /var/log/xferlog
WtmpLog                         on

AdminControlsEngine             on
AdminControlsACLs               all allow user root

BanEngine                       on
BanControlsACLs                 all allow user root
BanOnEvent                      ClientConnectRate 10/00:01:00 01:00:00 “Stop connecting frequently”
BanTable                        /var/run/proftpd/ban.tab
BanLog                          /var/log/proftpd-ban.log
BanMessage                      “%a OR %u has been banned”

#AuthOrder mod_auth_file.c mod_sql.c mod_auth_unix.c
#AuthUserFile /usr/local/etc/proftpd/ftpd.passwd
#AuthGroupFile /usr/local/etc/proftpd/ftpd.group
AuthOrder mod_sql.c
SQLAuthenticate users
SQLAuthTypes crypt plaintext
SQLConnectInfo proftpd@localhost username password
SQLUserInfo users user password userid usergroupid homedir NULL
SQLLogFile /var/log/proftpd-sql.log

SQLLog PASS counter
SQLNamedQuery counter UPDATE “lastloginip=’%a’, lastlogin=now(), logincount=logincount+1 WHERE user=’%u'” users
SQLLog EXIT time_logout
SQLNamedQuery time_logout UPDATE “lastlogout=now() WHERE user=’%u'” users
SQLLog RETR,ERR_RETR download
SQLNamedQuery download UPDATE “downloadbytes=downloadbytes+%b, downloadfiles=downloadfiles+1 WHERE user=’%u'” users
SQLLog STOR,ERR_STOR,APPE,ERR_APPE,STOU,ERR_STOU upload
SQLNamedQuery upload UPDATE “uploadbytes=uploadbytes+%b, uploadfiles=uploadfiles+1 WHERE user=’%u'” users

SQLNamedQuery logincount SELECT “logincount from users where user=’%u'”
SQLNamedQuery lastlogin SELECT “lastlogin from users where user=’%u'”
SQLNamedQuery lastloginip SELECT “lastloginip from users where user=’%u'”
SQLNamedQuery downloadbytes SELECT “ROUND(downloadbytes/1048576) from users where user=’%u'”
SQLNamedQuery downloadfiles SELECT “downloadfiles from users where user=’%u'”
SQLNamedQuery uploadbytes SELECT “ROUND(uploadbytes/1048576) from users where user=’%u'”
SQLNamedQuery uploadfiles SELECT “uploadfiles from users where user=’%u'”
SQLShowInfo PASS “230” “You’ve logged on %{logincount} times”
SQLShowInfo PASS “230” “*** Last login at %{lastlogin}”
SQLShowInfo PASS “230” “*** Last login from %{lastloginip}”
SQLShowInfo PASS “230” “*** Downloaded %{downloadbytes} MB in %{downloadfiles} files”
SQLShowInfo PASS “230” “*** Uploaded %{uploadbytes} MB in %{uploadfiles} files”

<Limit SITE_CHMOD>
  DenyAll
</Limit>

<Directory />
  <Limit ALL>
    DenyAll
  </Limit>
  <Limit PROT>
    AllowAll
  </Limit>
</Directory>

TLSEngine on
TLSLog /var/log/proftpd-tls.log
TLSProtocol SSLv23
TLSRSACertificateFile /usr/local/etc/proftpd/ftpd.cert.pem
TLSRSACertificateKeyFile /usr/local/etc/proftpd/ftpd.key.pem
TLSCACertificateFile /usr/local/etc/proftpd/ftpdca.cert.pem
TLSVerifyClient off
TLSRenegotiate required off

<Anonymous /ftp/anonymous>
  User                          anonymous
  Group                         anonymous
  UserAlias                     guest anonymous
  MaxClients                    10
  MaxClientsPerHost             1
  TransferRate                  RETR 512

  <Limit LOGIN>
    Allow from 172.16.,172.20,172.21
    DenyAll
  </Limit>

  <Limit ALL>
    DenyAll
  </Limit>

  <Limit FEAT DIRS READ>
    AllowAll
  </Limit>
</Anonymous>

<IfUser OR friend1,friend2>
  <Directory /ftp/friend>
    <Limit FEAT DIRS READ>
      AllowAll
    </Limit>
  </Directory>
</IfUser>

<IfUser regex @yaoge123$>
  DisplayLogin .welcome.msg
  MaxHostsPerUser               1
  MaxClientsPerUser             3
  <Directory /ftp/yaoge123>
    HideFiles                  ^\.
    <Limit FEAT DIRS READ>
        AllowAll
    </Limit>
  </Directory>
</IfUser>

sql中的表
CREATE TABLE `users` (
`user` varchar(50) NOT NULL default ”,
`password` varchar(50) NOT NULL default ”,
`username` varchar(50) NOT NULL default ”,
`userid` int(10) unsigned NOT NULL default ‘10000’,
`usergroupid` int(10) unsigned NOT NULL default ‘10000’,
`lastloginip` varchar(22) NOT NULL default ”,
`logincount` int(16) unsigned NOT NULL default ‘0’,
`lastlogin` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`lastlogout` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`downloadbytes` bigint unsigned NOT NULL default ‘0’,
`downloadfiles` int unsigned NOT NULL default ‘0’,
`uploadbytes` bigint unsigned NOT NULL default ‘0’,
`uploadfiles` int unsigned NOT NULL default ‘0’,
`homedir` varchar(50) NOT NULL default ”,
`mark` varchar(10) NOT NULL default ”,
PRIMARY KEY (`userid`)
) ;

配置ProFTPD加密SSL

下载脚本 http://www.castaglia.org/openssl/contrib/cert-tool ,修改cert-tool中openssl的路径,用这个脚本调用OpenSSL自签名颁发一个证书
cert-tool --create-ca=serverca --signing-ca=self
cert-tool --create-cert=server --signing-ca=serverca.cert.pem --signing-key=serverca.key.pem

修改proftpd.conf,增加TLS配置

TLSEngine on #开启TLS
TLSLog /var/log/proftpd-tls.log #TLS日志
TLSProtocol SSLv23 #允许使用SSLv3和TLSv1
TLSRSACertificateFile /usr/local/etc/server.cert.pem #cert-tool生成的证书
TLSRSACertificateKeyFile /usr/local/etc/server.key.pem #cert-tool生成的key
TLSCACertificateFile /usr/local/etc/serverca.cert.pem #cert-tool生成的CA证书
TLSVerifyClient off #不验证客户端证书。如要启用客户端证书验证,则需要用TLSCACertificateFile这个CA来颁发客户端证书
TLSRenegotiate required off #不强制要求重协商

另外加密传输需要使用FTP命令PROT,如果Deny ALL过,需要Allow
DenyAll AllowAll

Apache和ProFTPD的Order区别

Order Allow,Deny Apache ProFTPD
仅匹配Allow Allow Allow
仅匹配Deny Deny Deny
没有匹配 默认Deny 默认Allow
匹配Allow和Deny 最后匹配Deny 首先匹配Allow

Order Deny,Allow Apache ProFTPD
仅匹配Allow Allow Allow
仅匹配Deny Deny Deny
没有匹配 默认Allow 默认Deny
匹配Allow和Deny 最后匹配Allow 首先匹配Deny

参考:
http://httpd.apache.org/docs/1.3/mod/mod_access.html
http://www.proftpd.org/docs/directives/linked/config_ref_Order.html
http://www.proftpd.org/docs/howto/Limit.html

FreeBSD Tomcat 安装后注意事项

编辑 /usr/local/etc/rc.d/tomcat6
在java_command=中增加如下内容禁用IPv6
-Djava.net.preferIPv4Stack="true" \
-Djava.net.preferIPv4Address="true" \

相关版本信息:
Apache/2.2.14 (FreeBSD) mod_ssl/2.2.14 OpenSSL/0.9.8k DAV/2 PHP/5.2.12 with Suhosin-Patch mod_jk/1.2.30
javavmwrapper-2.3.4
diablo-jdk-1.6.0.07.02_8
jdk-1.6.0.3p4_14
tomcat-6.0.24
tomcat-native-1.1.20
mod_jk-ap2-1.2.30_1

SolarWinds Orion NPM 9.5 出现 Polling Engine Down

  服务器启动完毕后,所有 SolarWinds 相关服务 Running ,但是NPM不记录数据,通过Web查看 Admin 中的 Polling Engines,Engine Status 为 Polling Engine Down。临时解决办法是:打开Orion Service Manager 点击 Shutdown Everything 停止所有 SolarWinds 相关服务,杀掉 NetPerfMonService.exe 进程,打开Orion Service Manager 点击 Start Everything 重新启动所有 SolarWinds 相关服务。

Cisco MDS 系列交换机无中断软件升级

整个升级过程业务无任何中断,具体过程如下:

MDS9134# show version
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.

Software
BIOS: version 1.0.15
loader: version N/A
kickstart: version 4.2(1a)
system: version 4.2(1a)
BIOS compile time: 07/16/08
kickstart image file is: bootflash:/m9100-s2ek9-kickstart-mz.4.2.1a.bin
kickstart compile time: 8/10/2009 19:00:00 [09/24/2009 09:51:13]
system image file is: bootflash:/m9100-s2ek9-mz.4.2.1a.bin
system compile time: 8/10/2009 19:00:00 [09/24/2009 11:40:47]

Hardware
cisco MDS UROS 9134 FC (1 Slot) Chassis (“1/2/4 10 Gbps FC/Supervisor-2”)
Motorola, e500v2 with 1036308 kB of memory.
Processor Board ID JAF1326AALD

Device name: MDS9134
bootflash: 509544 kB
Kernel uptime is 80 day(s), 19 hour(s), 32 minute(s), 16 second(s)

Last reset
Reason: Unknown
System version: 4.2(1a)
Service:

MDS9134# show install all impact system tftp://192.168.1.2/m9100-s2ek9-mz.4.2.3.bin kickstart tftp://192.168.1.2/m9100-s2ek9-kickstart-mz.4.2.3.bin
Continue reading