Tech Support Notes
introduction
1. Topic 01: Firewalls
- 1.1. CSF
- 1.2. APF
- 1.3. IPtables
- 1.4. UFW
- 1.5. Windows Firewall
2. Topic 02: Package Management
- 2.1. Yum
- 2.2. rpm
- 2.3. rpm2cpio
- 2.4. Apt
- 2.5. dpkg
3. Topic 03: Networking
- 3.1. mtr/traceroute
- 3.2. pathping
- 3.3. ipv6
- 3.4. nmap
- 3.5. telnet/netcat
- 3.6. netstat/ss
- 3.7. Bandwidth and Speed Testing
- 3.8. Assigning IP's
4. Topic 04: DNS
- 4.1. Dns overview
- 4.2. dig
- 4.3. host
5. Topic 5: Configuration Files
- 5.1. ssh
- 5.2. apache
- 5.3. samba
- 5.4. bind/named
- 5.5. exim
- 5.6. postfix
- 5.7. vsftpd
6. Topic 6: Mysql
- 6.1. to sort
7. Topic 7: Apache
- 7.1. to sort
8. Topic 8: Memory
- 8.1. free / vmstat
9. Topic 9: Process Tracking
- 9.1. ps
- 9.2. lsof
- 9.3. windows
10. Topic 10: Partitions/Filesystems
- 10.1. Basic Layout
- 10.2. creating / modifying
- 10.3. fdisk / parted
- 10.4. fstab / mount
- 10.5. labels / uuid
- 10.6. LVM Part One
- 10.7. LVM Part Two
11. Topic 11: Devices/shares
- 11.1. samba / nfs / nas
- 11.2. iscsi
12. Topic 12: Space and drive usage
- 12.1. du / df / inodes
- 12.2. iostat
- 12.3. smartctl
13. Topic 13: Logging
- 13.1. logging configuration
- 13.2. general system logs
- 13.3. plesk logs
- 13.4. cpanel logs
14. Topic 14: Finding Exploits
- 14.1. maldet
- 14.2. rootkit hunter
- 14.3. windows
15. Topic 15: Email
- 15.1. general troubleshooting
- 15.2. exim
- 15.3. qmail
- 15.4. postfix
- 15.5. spam
16. Topic 16: Find
- 16.1. find examples
17. Topic 17: Rescue Layer/Live Environment
- 17.1. mounting filesystem / chroot
- 17.2. cloning
18. Topic 18: Permissions/users/groups
- 18.1. permissions
- 18.2. users
- 18.3. groups
19. Topic 19: Cpanel
- 19.1. general
- 19.2. Moving Mysql
20. Topic 20: Plesk
- 20.1. general
21. Topic 21: Windows
- 21.1. windows to sort
- 21.2. hyper-v
22. Topic 22: Freebsd
- 22.1. installing packages
- 22.2. networking
- 22.3. drive management
23. Topic 23: Dumping ground
- 23.1. sed / awk
- 23.2. gdb
- 23.3. curl / wget
- 23.4. compress / uncompress
- 23.5. rsync / scp
- 23.6. Random commands

Tech Support Notes

Assigning IP's to a server

If you need to add an IP to a VM or server that is missing a public IP or is set to use DHCP here are the steps needed.

Centos/RHEL

Using the 'ip' command

[root@networktest ~]# ip link |grep eth1
3: eth1:  mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000

[root@networktest ~]# ip addr|grep eth1
3: eth1:  mtu 1500 qdisc pfifo_fast state DOWN qlen 1000

[root@networktest ~]# ping -c2 8.8.8.8
connect: Network is unreachable

[root@networktest ~]# ip addr add 192.168.1.100/27 dev eth1

[root@networktest ~]# ip addr|grep eth1
3: eth1:  mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    inet 192.168.1.100/27 scope global eth1
[root@networktest ~]# ip route add default via 192.168.1.100
RTNETLINK answers: Network is unreachable

[root@networktest ~]# ifup eth1

[root@networktest ~]# ip route add default via 192.168.1.99

[root@networktest ~]# ping -c2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=0.814 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=0.689 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.689/0.751/0.814/0.068 ms

[root@networktest ~]# ip route
default via 192.168.1.99 dev eth1
10.0.0.0/8 via 10.106.254.1 dev eth0
10.106.254.0/26 dev eth0  proto kernel  scope link  src 10.106.254.2
192.168.1.98/27 dev eth1  proto kernel  scope link  src 192.168.1.100
169.254.0.0/16 dev eth0  scope link  metric 1002
169.254.0.0/16 dev eth1  scope link  metric 1003

Now that we have the routing added and the IP assigned we need to update the interfaces file so that the IP is bound at reboot.

[root@networktest ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
BOOTPROTO=dhcp
ONBOOT=yes
HWADDR=06:b8:7f:6d:01:24

[root@networktest ~]# cp -v /etc/sysconfig/network-scripts/ifcfg-eth1 ~/
‘/etc/sysconfig/network-scripts/ifcfg-eth1’ -> ‘/root/ifcfg-eth1’

Now you can use your favorite text editor to add the missing entries to the ifcfg-eth1 file. The lines you need to add are:

IPADDR=x.x.x.x
NETMASK=x.x.x.x
GATEWAY=x.x.x.x

[root@networktest ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
BOOTPROTO=static
ONBOOT=yes
HWADDR=06:b8:7f:6d:01:24
IPADDR=192.168.1.100
NETMASK=255.255.255.224
GATEWAY=192.168.1.99

[root@networktest ~]# ifdown eth1
[root@networktest ~]# ping 8.8.8.8
connect: Network is unreachable
[root@networktest ~]# /etc/init.d/network restart
Restarting network (via systemctl):                        [  OK  ]
[root@networktest ~]# ping -c2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=1.42 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=0.618 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.618/1.022/1.427/0.405 ms

Using the ifconfig command

[root@cheftest]# ifconfig
eth0      Link encap:Ethernet  HWaddr 06:F9:54:F3:AE:C6
          inet addr:10.76.16.94  Bcast:10.76.16.127  Mask:255.255.255.192
          inet6 addr: fe80::4f9:54ff:fef3:aec6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23855 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15031 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3833546 (3.6 MiB)  TX bytes:1240973 (1.1 MiB)
          Interrupt:246

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

[root@cheftest]# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 06:F9:54:F3:AE:C6
          inet addr:10.76.16.94  Bcast:10.76.16.127  Mask:255.255.255.192
          inet6 addr: fe80::4f9:54ff:fef3:aec6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23873 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15038 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3837264 (3.6 MiB)  TX bytes:1242715 (1.1 MiB)
          Interrupt:246

eth1      Link encap:Ethernet  HWaddr 06:0B:9E:56:F6:08
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:222478 errors:0 dropped:0 overruns:0 frame:0
          TX packets:245815 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:29297066 (27.9 MiB)  TX bytes:43617723 (41.5 MiB)
          Interrupt:245

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)


[root@cheftest ~]# ifconfig eth1 up

[root@cheftest ~]# ipcalc -b -m -n 192.168.1.100/27
NETMASK=255.255.255.224
BROADCAST=192.168.1.127
NETWORK=192.168.1.96

[root@cheftest ~]# ifconfig eth1 192.168.1.100 netmask 255.255.255.224 broadcast 192.168.1.127

[root@cheftest ~]# ping -c2 8.8.8.8
connect: Network is unreachable

[root@cheftest ~]# route add default gw 192.168.1.97 eth1

 [root@cheftest ~]# ping -c2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=6.26 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=5.09 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1006ms
rtt min/avg/max/mdev = 5.091/5.679/6.267/0.588 ms

Ubuntu/Debian

root@networktest:~# root@networktest:~# ip link
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default
              link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0:  mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
              link/ether 06:07:ae:8d:1d:a8 brd ff:ff:ff:ff:ff:ff
3: eth1:  mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
              link/ether 06:b8:7f:6d:01:24 brd ff:ff:ff:ff:ff:ff

root@networktest:~# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 06:07:ae:8d:1d:a8
          inet addr:10.106.254.2  Bcast:10.106.254.63  Mask:255.255.255.192
          inet6 addr: fe80::407:aeff:fe8d:1da8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:146 errors:0 dropped:0 overruns:0 frame:0
          TX packets:114 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:13291 (13.2 KB)  TX bytes:17283 (17.2 KB)

eth1      Link encap:Ethernet  HWaddr 06:b8:7f:6d:01:24
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
            RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

root@networktest:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

auto lo
# The loopback network interface
iface lo inet loopback

# eth0
auto eth0
allow-hotplug eth0
iface eth0 inet static
        address 10.106.254.2
        netmask 255.255.255.192
        post-up route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.106.254.1

The process to add an IP is the same as for RHEL/Centos. The only difference is the file that we need to update after adding the IP. Additionally sometimes Ubuntu/Debian based systems need to be rebooted after adding IP's or adjusting networking.

root@networktest:~# ping -c2 8.8.8.8
connect: Network is unreachable        

root@networktest:~# ip link set eth1 up

root@networktest:~# ip addr add 192.168.1.100/27 dev eth1

root@networktest:~# ipcalc -b 192.168.1.100/27
Address:   192.168.1.100
Netmask:   255.255.255.224 = 27
Wildcard:  0.0.0.31
=>
Network:   192.168.1.96/27
HostMin:   192.168.1.97 << Gateway
HostMax:   192.168.1.126
Broadcast: 192.168.1.127
Hosts/Net: 30                    Class C, Private Internet

root@networktest:~# ip route add default via 192.168.1.100 dev eth1

root@networktest:~# ping -c2 -q 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.831/0.987/1.143/0.156 ms

Now we need to update the file /etc/network/interfaces with the public NIC details

root@networktest:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

auto lo
# The loopback network interface
iface lo inet loopback

# eth0
auto eth0
allow-hotplug eth0
iface eth0 inet static
        address 10.106.254.2
        netmask 255.255.255.192
        post-up route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.106.254.1

# eth1
auto eth1
allow-hotplug eth1
iface eth1 inet static
        address 192.168.1.100
        netmask 255.255.255.224
        gateway 192.168.1.99

Windows

This applies to 2008R2 and above.

You can get the current adapters by using the netsh interface ipv4 show inter command in Powershell

PS C:\Users\Administrator> netsh interface ipv4 show inter

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 14          20        1500  connected     PrivateNetwork-A
 15          10        1500  connected     PublicNetwork-A

 PS C:\Users\Administrator> Get-NetAdapter | fl name,interfacedescription,macaddress,linkspeed

 name                 : PublicNetwork-A
 interfacedescription : Citrix PV Ethernet Adapter #1
 MacAddress           : 06-DA-85-E8-C3-B1
 LinkSpeed            : 1 Gbps

 name                 : PrivateNetwork-A
 interfacedescription : Citrix PV Ethernet Adapter #0
 MacAddress           : 06-F9-58-BA-E0-90
 LinkSpeed            : 1 Gbps

In our scenerio the server has accidently been set to DHCP for the Public NIC. To resolve this and assign a static IP we must first remove the 'Autoconfiguration' IP that was assigned by Windows.

PS C:\Users\Administrator> ipconfig

Windows IP Configuration

Ethernet adapter PublicNetwork-A:
Connection-specific DNS Suffix  . :
IPv6 Address. . . . . . . . . . . : 2607:f0d0:1202:a0:8dfd:3d07:5865:ac65
Link-local IPv6 Address . . . . . : fe80::8dfd:3d07:5865:ac65%15
Autoconfiguration IPv4 Address. . : 169.254.172.101
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::e25f:b9ff:fee1:28c0%15

Now we will run the netsh interface ipv4 show inter command to see the InterfaceIndex assigned to the Public Adapter.

We now use the netsh command again to remove the autoconfiguration setting for the Public NIC.

PS C:\Users\Administrator> netsh interface ipv4 set interface 15 dadtransmits=0 store=persistent
    Ok.
PS C:\Users\Administrator>

Time to actually assign the IP

PS C:\Users\Administrator> New-NetIPAddress –InterfaceIndex 15 –IPAddress 184.173.23.189 -PrefixLength 27 -DefaultGatewa
y 184.173.23.161


IPAddress         : 184.173.23.189
InterfaceIndex    : 15
InterfaceAlias    : PublicNetwork-A
AddressFamily     : IPv4
Type              : Unicast
PrefixLength      : 27
PrefixOrigin      : Manual
SuffixOrigin      : Manual
AddressState      : Tentative
ValidLifetime     : Infinite ([TimeSpan]::MaxValue)
PreferredLifetime : Infinite ([TimeSpan]::MaxValue)
SkipAsSource      : False
PolicyStore       : ActiveStore

PS C:\Users\Administrator> ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 time=5ms TTL=58
Reply from 8.8.8.8: bytes=32 time=5ms TTL=58

Ping statistics for 8.8.8.8:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 5ms, Maximum = 5ms, Average = 5ms
Control-C
PS C:\Users\Administrator>

We can also assign the Resolvers for the public interface.

PS C:\Users\Administrator> Set-DnsClientServerAddress –InterfaceIndex 15 -ServerAddresses 8.8.8.8, 4.2.2.2
    Ok.
PS C:\Users\Administrator>

PS C:\Users\Administrator>  Get-DnsClientServerAddress | where { $_.Interfaceindex -eq "15" } | fl


InterfaceAlias  : PublicNetwork-A
InterfaceIndex  : 15
AddressFamily   : IPv4
ServerAddresses : {8.8.8.8, 4.2.2.2}

InterfaceAlias  : PublicNetwork-A
InterfaceIndex  : 15
AddressFamily   : IPv6
ServerAddresses : {}