Thứ Năm, 16 tháng 10, 2014
Juniper switch ex2200 how to find port from ip address ?
run ping <ip> count 1
run show arp no-resolve hostname <ip>
run show ethernet-switching table | match <MAC from the ARP output>
Thứ Sáu, 10 tháng 10, 2014
17 Squid Proxy Server Interview Questions & Answers
Q:1 What is Proxy Server and why it is used ?
Ans: Squid is proxy server for UNIX like operating system, A Squid proxy server filters Web traffic and caches frequently accessed files. A proxy server limits Internet bandwidth usage, speeds up Web access, and lets you filter URLs. Centrally blocking advertisements and dangerous downloads is cost effective and transparent for the end user. Squid is a high per-formance implementation of a free Open-Source, full-featured proxy caching server.
Q:3 What is the default configuration file of Squid ?
Ans: ‘/etc/squid/squid.conf‘ is the default configuration file of Squid.
Q:4 What is the default port of Squid and how to change it ?
Ans: Default port of squid is 3128 and we can change the default port by the editing the file /etc/squid/squid.conf :
http_port 3128
Change this port according to your setup. After editing the file one should restart the squid service.
Q:5 How to restart the squid service in CentOS & RHEL ?
Ans: Service squid restart or /etc/init.d/squid restart
Q:6 What are the different filters that we can apply using squid ?
Ans: Some of the filters are listed below :
Ans: ACL stands for Access Control List , using ACL access to internet can be controlled in terms of access during particular time interval, caching, access to particular or group of sites, etc.Squid access control has two different components i.e. ACL elements and access list. An access list infact allows or deny the access to the service.
Q:8 What are the important ACL elements in Squid ?
Ans: A few important type of ACL elements are listed below
Ans: Edit the config file /etc/squid/squid.conf :
Q:10 Allow Internet access during particular period of time ?
Ans: Edit the file ‘/etc/squid/squid.conf’ and add the below rules :
Q:11 How to enable multiple time Internet access to different clients in squid ?
Ans: Edit the config file and add below rules :
Q:12 How to block websites using squid ?
Ans: Squid can prevent the access to a particular site or to sites which contain a particular word. This can be implemented by adding the below rules in the ‘/etc/squid/squid.conf’ file.
Q:13 How to limit the number of connections from a client machine in squid ?
Ans: Squid can limit number the of connections from the client machine and this is possible through the maxconn element. To use this option, client_db feature should be enabled first.
Q:14 What is reverse proxy ?
Ans: A reverse proxy is a type of proxy server or ‘webserver acceleration’ (using http_port 80 accel vhost) , in this type of proxy server , the cache serves an unlimited number of clients for a limited number of or just one web server.
Q:15 What is transparent proxy ?
Ans: Transparent proxy is a type of proxy server where clients are not aware that their requests are processed through the proxy. The main benefit of setting transparent proxy is that system admins do not have to setup up individual browsers to work with proxies, squid will transparently pick up the appropriate packets and cache requests.
Q:16 How to clear Squid Cache ?
Ans: To clear the squid cache , first stop the squid service and run below command :
Ans: To see the live logs of squid use the below command :
Ans: A proxy
server provides Internet access to different users at same time i.e by
sharing a single Internet connection. A good proxy server also provides
for caching of the requests, which helps to access data from local
resources rather fetching the data from web thus reducing access time
and bandwidth.
Q:2 What is Squid and its features ?Ans: Squid is proxy server for UNIX like operating system, A Squid proxy server filters Web traffic and caches frequently accessed files. A proxy server limits Internet bandwidth usage, speeds up Web access, and lets you filter URLs. Centrally blocking advertisements and dangerous downloads is cost effective and transparent for the end user. Squid is a high per-formance implementation of a free Open-Source, full-featured proxy caching server.
Q:3 What is the default configuration file of Squid ?
Ans: ‘/etc/squid/squid.conf‘ is the default configuration file of Squid.
Q:4 What is the default port of Squid and how to change it ?
Ans: Default port of squid is 3128 and we can change the default port by the editing the file /etc/squid/squid.conf :
http_port 3128
Change this port according to your setup. After editing the file one should restart the squid service.
Q:5 How to restart the squid service in CentOS & RHEL ?
Ans: Service squid restart or /etc/init.d/squid restart
Q:6 What are the different filters that we can apply using squid ?
Ans: Some of the filters are listed below :
- domains of client or server
- IP subnets of client or server
- URL path
- Full URL including parameters
- keywords
- ports
- protocols: HTTP, FTP
- methods: GET, POST, HEAD, CONNECT
Ans: ACL stands for Access Control List , using ACL access to internet can be controlled in terms of access during particular time interval, caching, access to particular or group of sites, etc.Squid access control has two different components i.e. ACL elements and access list. An access list infact allows or deny the access to the service.
Q:8 What are the important ACL elements in Squid ?
Ans: A few important type of ACL elements are listed below
- src : Source i.e. client’s IP addresses
- dst : Destination i.e. server’s IP addresses
- srcdomain : Source i.e. client’s domain name
- dstdomain : Destination i.e. server’s domain name
- time : Time of day and day of week
- url_regex : URL regular expression pattern matching
- urlpath_regex: URL-path regular expression pattern matching, leaves out the protocol and hostname
- proxy_auth : User authentication through external processes
- maxconn : Maximum number of connections limit from a single client IP address
acl acl_element_name type_of_acl_element values_to_aclQ:9 Write a rule allowing only selected machines to have access to the Internet ?
Ans: Edit the config file /etc/squid/squid.conf :
acl allowed_clients src 192.168.1.10 192.168.1.20 192.168.1.30 http_access allow allowed_clients http_access deny !allowed_clientsAbove rule will allow only machine whose IPs are 192.168.1.10,192.168.1.20 & 192.168.1.30 to have access to Internet and the rest of IP addresses (not listed ) are denied the service. After editing the file don’t forget to restart the squid service.
Q:10 Allow Internet access during particular period of time ?
Ans: Edit the file ‘/etc/squid/squid.conf’ and add the below rules :
acl allowed_clients src 192.168.1.1/255.255.255.0 acl regular_days time MTWHF 10:00-16:00 http_access allow allowed_clients regular_days http_access deny allowed_clientsThis will allow the access to all the clients in network 192.168.1.1 to access the net from Monday to Friday from 10:00am to 4:00 pm.
Q:11 How to enable multiple time Internet access to different clients in squid ?
Ans: Edit the config file and add below rules :
acl hosts1 src192.168.1.10 acl hosts2 src 192.168.1.20 acl hosts3 src 192.168.1.30 acl morning time 10:00-13:00 acl lunch time 13:30-14:30 acl evening time 15:00-18:00 http_access allow host1 morning http_access allow host1 evening http_access allow host2 lunch http_access allow host3 evening http_access deny allThe above rule will allow host1 access during both morning as well as evening hours; where as host2 and host3 will be allowed access only during lunch and evening hours respectively.
Q:12 How to block websites using squid ?
Ans: Squid can prevent the access to a particular site or to sites which contain a particular word. This can be implemented by adding the below rules in the ‘/etc/squid/squid.conf’ file.
acl allowed_clients src 192.168.1.1/255.255.255.0 acl banned_sites url_regex "/etc/banned.list" http_access deny banned_sites http_access allow allowed_clientsCreate a file /etc/banned.list , add all the sites that you want to block.
Q:13 How to limit the number of connections from a client machine in squid ?
Ans: Squid can limit number the of connections from the client machine and this is possible through the maxconn element. To use this option, client_db feature should be enabled first.
acl mynetwork 192.168.1.1/255.255.255.0 acl numconn maxconn 5 http_access deny mynetwork numconnmaxconn ACL uses less-than comparison. This ACL is matched when the number of connections is greater than the specified value. This is the main reason for which this ACL is not used with the http_access allow rule.
Q:14 What is reverse proxy ?
Ans: A reverse proxy is a type of proxy server or ‘webserver acceleration’ (using http_port 80 accel vhost) , in this type of proxy server , the cache serves an unlimited number of clients for a limited number of or just one web server.
Q:15 What is transparent proxy ?
Ans: Transparent proxy is a type of proxy server where clients are not aware that their requests are processed through the proxy. The main benefit of setting transparent proxy is that system admins do not have to setup up individual browsers to work with proxies, squid will transparently pick up the appropriate packets and cache requests.
Q:16 How to clear Squid Cache ?
Ans: To clear the squid cache , first stop the squid service and run below command :
# service squid stop # rm -rf /var/lib/squid/cache/*Now create swap directories :
# squid –zQ:17 How to check live running logs of squid ?
Ans: To see the live logs of squid use the below command :
# tailf /var/log/squid/access.log
Thứ Tư, 8 tháng 10, 2014
Auto switch Gateway on Centos
I have Centos server, how to auto check status connect Internet any times ? , if it lost connect to ISP 1 then it auto connect to ISP 2 and reverse.
I created script to auto check and switch ISP for this problem:
import os, smtplib
from threading import Thread
def sendmail(subject):
"Sends an email to the specified recipent "
username = 'xxxxx@gmail.com'
password = 'abcdefgh'
server = smtplib.SMTP('smtp.gmail.com:25')
server.starttls()
server.login(username, password)
fromAddr ='xxxxx@gmail.com'
toAddr2 = 'yyyyyy@gmail.com'
header = 'To: ' + toAddr2 + '\n' + 'From: ' + fromAddr + '\n' + 'Subject: ' + subject + '\n'
msg = header + '\nCheck it now!\n'
server.sendmail(fromAddr, toAddr2, msg)
server.close()
def FPT():
ip = '/root/ChangeGW/ISP'
ret = os.system('ping -c 4 118.70.127.130 &> /dev/null')
fr = open(ip,"r")
str = fr.read(3)
fr.close()
if ret != 0 and str == "FPT":
message = 'ADSL FPT has been DOWN and switch to ADSL VT'
os.system('/root/ChangeGW/GWVT')
fo1 = open(ip,"w")
fo1.write("VTL")
fo1.close()
sendmail(message)
print message
def VT():
ip = '/root/ChangeGW/ISP'
ret = os.system('ping -c 4 118.70.127.130 &> /dev/null')
fr = open(ip,"r")
str = fr.read(3)
fr.close()
if ret == 0 and str == "VTL":
message = 'ADSL FPT has been Up and Restored ADSL VT to ADSL FPT'
os.system('/root/ChangeGW/GWFPT')
fo1 = open(ip,"w")
fo1.write("FPT")
fo1.close()
sendmail(message)
print message
def checkGW():
FPT()
VT()
t = Thread(target=checkGW)
t.start()
#!/bin/bash
echo NETWORKING=yes > /etc/sysconfig/network
echo HOSTNAME=wgproxy >> /etc/sysconfig/network
echo GATEWAY=192.168.1.2 >> /etc/sysconfig/network
echo NOZEROCONF=yes >> /etc/sysconfig/network
/sbin/service network restart
#!/bin/bash
echo NETWORKING=yes > /etc/sysconfig/network
echo HOSTNAME=wgproxy >> /etc/sysconfig/network
echo GATEWAY=192.168.10.1 >> /etc/sysconfig/network
echo NOZEROCONF=yes >> /etc/sysconfig/network
/sbin/service network restart
FPT #begin set content FPT, default using FPT network
I created script to auto check and switch ISP for this problem:
root@wgproxy [~] # mkdir /root/ChangeGW
root@wgproxy [~] # cd /root/ChangeGW/
root@wgproxy [~/ChangeGW] # vi checkGW.py
#!/usr/bin/pythonimport os, smtplib
from threading import Thread
def sendmail(subject):
"Sends an email to the specified recipent "
username = 'xxxxx@gmail.com'
password = 'abcdefgh'
server = smtplib.SMTP('smtp.gmail.com:25')
server.starttls()
server.login(username, password)
fromAddr ='xxxxx@gmail.com'
toAddr2 = 'yyyyyy@gmail.com'
header = 'To: ' + toAddr2 + '\n' + 'From: ' + fromAddr + '\n' + 'Subject: ' + subject + '\n'
msg = header + '\nCheck it now!\n'
server.sendmail(fromAddr, toAddr2, msg)
server.close()
def FPT():
ip = '/root/ChangeGW/ISP'
ret = os.system('ping -c 4 118.70.127.130 &> /dev/null')
fr = open(ip,"r")
str = fr.read(3)
fr.close()
if ret != 0 and str == "FPT":
message = 'ADSL FPT has been DOWN and switch to ADSL VT'
os.system('/root/ChangeGW/GWVT')
fo1 = open(ip,"w")
fo1.write("VTL")
fo1.close()
sendmail(message)
print message
def VT():
ip = '/root/ChangeGW/ISP'
ret = os.system('ping -c 4 118.70.127.130 &> /dev/null')
fr = open(ip,"r")
str = fr.read(3)
fr.close()
if ret == 0 and str == "VTL":
message = 'ADSL FPT has been Up and Restored ADSL VT to ADSL FPT'
os.system('/root/ChangeGW/GWFPT')
fo1 = open(ip,"w")
fo1.write("FPT")
fo1.close()
sendmail(message)
print message
def checkGW():
FPT()
VT()
t = Thread(target=checkGW)
t.start()
root@wgproxy [~/ChangeGW] # vi GWFPT
#!/bin/bash
echo NETWORKING=yes > /etc/sysconfig/network
echo HOSTNAME=wgproxy >> /etc/sysconfig/network
echo GATEWAY=192.168.1.2 >> /etc/sysconfig/network
echo NOZEROCONF=yes >> /etc/sysconfig/network
/sbin/service network restart
root@wgproxy [~/ChangeGW] # vi GWVT
#!/bin/bash
echo NETWORKING=yes > /etc/sysconfig/network
echo HOSTNAME=wgproxy >> /etc/sysconfig/network
echo GATEWAY=192.168.10.1 >> /etc/sysconfig/network
echo NOZEROCONF=yes >> /etc/sysconfig/network
/sbin/service network restart
root@wgproxy [~/ChangeGW] # vi ISP
FPT #begin set content FPT, default using FPT network
root@wgproxy [~/ChangeGW] # chmod +x checkGW.py
root@wgproxy [~/ChangeGW] # chmod +x GWFPT
root@wgproxy [~/ChangeGW] # chmod +x GWVT
insert crontab run after about 1 minute:
* * * * * /root/ChangeGW/checkGW.py > /dev/null 2>&1
# run 1 minute
OK Done, let's go test it
insert crontab run after about 1 minute:
* * * * * /root/ChangeGW/checkGW.py > /dev/null 2>&1
# run 1 minute
OK Done, let's go test it
Thứ Ba, 7 tháng 10, 2014
How-To configure a DHCP Server running on multiple network interfaces
This post will explain how to configure a DHCP Server running on
Ubuntu Server 9.04 (Jaunty Jackalope) for more than one interfaces and
more than one network.
This post assume you have :
– A private network with 192.168.123.0/24
Three network on which you have to assign dinamic IP Addresses, for example a LAB network, an SUP Network (Support) and a WIFI network with the following subnet.
– 192.168.124.0/24 (sup)
– 192.168.125.0/24 (lab)
– 192.168.127.0/24 (wifi)
This post also assume you have a system running ubuntu (or debian) with four (4) NIC each one connected to one of the network above, and you will have the following configuration :
SUP network
Server IP Address : 192.168.124.1
DHCP Scope : 192.168.124.100 – 192.168.124.200
Gateway : 192.168.124.254
LAB network
Server IP Address : 192.168.125.1
DHCP Scope : 192.168.125.100 – 192.168.125.200
Gateway : 192.168.125.254
WIFI network
Server IP Address : 192.168.127.1
DHCP Scope : 192.168.127.100 – 192.168.127.200
Gateway : 192.168.127.254
The name server for all the networks will be a server in the internal network (192.168.123.2).
First of all you have to install DHCP server, for doing so, type :
Note that eth0 on the internal network is configured for obtaining a dinamic ip address from another DHCP server, but if you want you should assign to it a static ip address.
You can do it by editing /etc/default/dhcp3-server as follow :
Bye
Riccardo
source: http://www.riccardoriva.info/blog/?p=693
This post assume you have :
– A private network with 192.168.123.0/24
Three network on which you have to assign dinamic IP Addresses, for example a LAB network, an SUP Network (Support) and a WIFI network with the following subnet.
– 192.168.124.0/24 (sup)
– 192.168.125.0/24 (lab)
– 192.168.127.0/24 (wifi)
This post also assume you have a system running ubuntu (or debian) with four (4) NIC each one connected to one of the network above, and you will have the following configuration :
SUP network
Server IP Address : 192.168.124.1
DHCP Scope : 192.168.124.100 – 192.168.124.200
Gateway : 192.168.124.254
LAB network
Server IP Address : 192.168.125.1
DHCP Scope : 192.168.125.100 – 192.168.125.200
Gateway : 192.168.125.254
WIFI network
Server IP Address : 192.168.127.1
DHCP Scope : 192.168.127.100 – 192.168.127.200
Gateway : 192.168.127.254
The name server for all the networks will be a server in the internal network (192.168.123.2).
First of all you have to install DHCP server, for doing so, type :
sudo apt-get install dhcp3-serverAfter this you have to check your network interfaces configuration by editing the /etc/network/interfaces as the following.
Note that eth0 on the internal network is configured for obtaining a dinamic ip address from another DHCP server, but if you want you should assign to it a static ip address.
# The primary network interfaceNow you have to declare on which interfaces the DHCP server will listen for DHCP request, default is eth0 only.
auto eth0
iface eth0 inet dhcp
# The SUP network interface
auto eth1
iface eth1 inet static
address 192.168.124.1
netmask 255.255.255.0
network 192.168.124.0
broadcast 192.168.124.255
# The LAB network interface
auto eth2
iface eth2 inet static
address 192.168.125.1
netmask 255.255.255.0
network 192.168.125.0
broadcast 192.168.125.255
# The WIFI network interface
auto eth3
iface eth3 inet static
address 192.168.127.1
netmask 255.255.255.0
network 192.168.127.0
broadcast 192.168.127.255
You can do it by editing /etc/default/dhcp3-server as follow :
INTERFACES=”eth1 eth2 eth3″At this point you have “only” to configure your DHCP Scope to assign IP on all networks by editing /etc/dhcp3/dhcpd.conf as following :
ddns-update-style none;Hope this help
default-lease-time 600;
max-lease-time 7200;
authoritative;
log-facility local7;
# Avoid to serve anythings on INTERNAL network
subnet 192.168.123.0 netmask 255.255.255.0 {
}
# The SUP network scope
subnet 192.168.124.0 netmask 255.255.255.0 {
range 192.168.124.100 192.168.124.200;
option routers 192.168.124.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.124.255;
option domain-name-servers 194.168.123.2;
option domain-name “damatc.local”;
option ntp-servers 194.168.123.2;
option netbios-name-servers 194.168.123.2;
option netbios-node-type 2;
default-lease-time 86400;
max-lease-time 86400;
}
# The LAB network scope
subnet 192.168.125.0 netmask 255.255.255.0 {
range 192.168.125.100 192.168.125.200;
option routers 192.168.125.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.125.255;
option domain-name-servers 194.168.123.2;
option domain-name “damlab.local”;
option ntp-servers 194.168.123.2;
option netbios-name-servers 194.168.123.2;
option netbios-node-type 2;
default-lease-time 86400;
max-lease-time 86400;
}
# The WIFI network scope
subnet 192.168.127.0 netmask 255.255.255.0 {
range 192.168.127.100 192.168.127.200;
option routers 192.168.127.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.127.255;
option domain-name-servers 194.168.123.2;
option domain-name “damwifi.local”;
option ntp-servers 194.168.123.2;
option netbios-name-servers 194.168.123.2;
option netbios-node-type 2;
default-lease-time 86400;
max-lease-time 86400;
}
Bye
Riccardo
source: http://www.riccardoriva.info/blog/?p=693
Configuring DHCP Server on CentOS/RHEL 6
DHCP ( Dynamic Host Configuration Protocol ) is a network protocol
used for assigning IP address to network clients dynamically from
predefined IP pool. It is useful for LAN network, but not generally used
for production servers. This article will help you for Configuring DHCP
Server on CentOS, Red Hat System. Read more about dhcp here.
So as a first part, copy content of sample configuration file to main configuration file. Sample configuration file may be changed as per version you have installed on your system.
Let’s restart network services on client system. You will get that dhcp server assigned an ip address from defined subnet. If you have connected to client pc from remote login, Your session can be disconnect.
Step 1: Install DHCP Package
First install dhcp packages using package manager yum on CentOS, Redhat system.# yum install dhcp
Step 2: Edit /etc/sysconfig/dhcpd file
Firstly we need to set ethernet interface name as DHCPDARGS in /etc/sysconfig/dhcpd file. Edit this configuration file and update the ethernet name.DHCPDARGS=eth1
Step 3: Configuring DHCP
DHCP creates an empty configuration file /etc/dhcp/dhcpd.conf. Also it provides a sample configuration file at /usr/share/doc/dhcp*/dhcpd.conf.sample, which is very useful for configuring the DHCP server.So as a first part, copy content of sample configuration file to main configuration file. Sample configuration file may be changed as per version you have installed on your system.
# cp /usr/share/doc/dhcp-4.1.1/dhcpd.conf.sample /etc/dhcp/dhcpd.conf
3.1 – Parameter Configuration
First configure the basic options which is common to all supported networks.option domain-name "tecadmin.net"; option domain-name-servers ns1.tecadmin.net, ns2.tecadmin.net; default-lease-time 600; max-lease-time 7200; authoritative; log-facility local7;
3.2 – IP Subnet Declaration
First edit dhcp configuration file and update subnet details as per your network. For this example we are configuring DHCP for 192.168.1.0/24 LAN network.subnet 192.168.1.0 netmask 255.255.255.0 {
option routers 192.168.1.254;
option subnet-mask 255.255.255.0;
option domain-search "tecadmin.net";
option domain-name-servers 192.168.1.1;
option time-offset -18000; # Eastern Standard Time
range 192.168.1.10 192.168.1.100;
}
3.3 -Assign Static IP Address to Host
In some cases we need to assign a fixed ip to an interface each time it requested from dhcp. We can also assign a fixed ip on basis of MAC address (hardware ethernet) of that interface. Setup host-name is optional to set up.host station1 {
option host-name "station1.example.com";
hardware ethernet 00:11:1A:2B:3C:AB;
fixed-address 192.168.1.100;
}
Step 4: Restart DHCP
After making all above changes, lets start dhcp service using following command.# service dhcp startSimilarly to stop and restart dhcp service use following commands.
# service dhcp stop # service dhcp restart
Step 5: Setup Client System
At this stage we have a running dhcp server which is ready for accepting requests and assign them a proper ip. but to verify I have another CentOS machine running on same LAN. Now login to that client machine and edit ethernet configuration file.# vim /etc/sysconfig/network-scripts/ifcfg-eth1 DEVICE=eth1 BOOTPROTO=dhcp TYPE=Ethernet ONBOOT=yesMake sure BOOTPROTO is set to dhcp.
Let’s restart network services on client system. You will get that dhcp server assigned an ip address from defined subnet. If you have connected to client pc from remote login, Your session can be disconnect.
# service network restart
Đăng ký:
Bài đăng (Atom)