Reset MySQL root Password

Did you forget your MySQL root password????

Now lets reset our MySQL root password… [no hacking please]

1. Login into your system to be root admin [you can use SSH from another PC in your network].

2. Stop MySQL service,

# /etc/init.d/mysql stop

Or you can use kill service to stop it,

# ps ax | grep mysql

# kill

3. Restart MySQL service without checking permission user,

# /usr/bin/mysqld_safe –skip-grant-tables

In this article we use Fedora, mysqld_safe file maybe different depend on distribution that you use.

4. Open new console, and connect to MySQL server using MySQL client to access MySQL DB.

# /usr/bin/mysql mysql

5. When MySQL prompt appeared. Type this command to reset the password.

UPDATE user SET Password=PASSWORD(‘your_password’) WHERE Host=’localhost’ AND User=’root’;

FLUSH PRIVILEGES;

exit;

6. Stop mysqld_safe service, and restart your MySQL Server.

# /etc/init.d/mysqld start

Its easy, right??? Have a nice try…

Fedora Directory Server (FDS) + Postfix Mail Server (Part 1)

Every multi-user application have user database to stored user information that have access into application. Postfix Mail Server is multi user application that can be integrated with LDAP Server (FDS). Let’s start to configure.

Ingredients:

· Fedora Directory Server packages (http://directory.fedora.redhat.com).

· Postfix packages, MTA for sending email. (CD/DVD).

· Devecot packages, IMAP Server and also POP3 server. (CD/DVD).

· Squirremail packages, MUA web based. (CD/DVD).

· Mozilla Thunderbird packages, MUA desktop based (http://www.mozilla.com).

· mkntpwd packages, to create SAMBA password (http://www.nomis52.net/data/mkntpwd.tar.gz).

· Apache and PHP packages, for web server. (CD/DVD).

Configuration

· Fedora Directory Server (FDS)

Your FDS in your system is already running with default configuration. Lets configure FDS that can be integrated with Postfix.

o Add object and attribute. Add objectclass “mailgroup” and add two attributes “mail” and “mgrpDeliverTo” to every user account.

o Add sambaLMPassword and sambaNTPassword into ACI self access, if you want to synchronize it with userPassword.

o Add ACI permission in self access (write -> read).

· Postfix

o LDAP aliases (/etc/postfix/ldap-aliases.cf)

In here you can find user email mapping configuration with unix/LDAP user. Setting your server_host and server_base depend on your FDS configuration.

bind = no

version = 3

timeout = 20

size_limit = 1

expansion_limit = 0

start_tls = no

tls_require_cert = no

server_host = ldap://svr6.xx.eu/

search_base = ou=Groups,dc=xx,dc=eu

scope = sub

query_filter = (mail=%s)

result_attribute = mgrpDeliverTo

special_result_filter = %s@%d

o LDAP User (/etc/postfix/ldap-user.cf)

bind = no

version = 3

timeout = 20

size_limit = 1

expansion_limit = 0

start_tls = no

tls_require_cert = no

server_host = ldap://svr6.xx.eu/

scope = sub

search_base = ou=Groups,dc=xx,dc=eu

query_filter = (mail=%s)

o Mail hosting (/etc/postfix/main.cf)

In here you can configure mail server for sending email, receiving email, blocking email, forwarding email, etc. smtp_recipient_restriction use to allow sender to send email only to some destination. always_bcc is use for back-up mail in server.

myhostname = svr6.xx.eu

myorigin = xx.eu

inet_interfaces = all

mydestination = xx.eu

virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf

local_recipient_maps = $alias_maps, ldap:/etc/postfix/ldap-users.cf

unknown_local_recipient_reject_code = 550

mynetworks = 127.0.0.0/28, 10.252.8.0/24, 10.252.9.0/24

alias_maps = hash:/etc/aliases

home_mailbox = Maildir/

smtpd_recipient_restrictions = reject_unauth_destination

always_bcc = archieve@xx.eu

Fedora Directory Server (FDS) + Postfix Mail Server (Part 2)

· Devecot

This application is use to connecting Postfix to FDS using IMAP or POP3 protocols.

o Postfix Connection

To connected into Postfix, devecot using /etc/devecot.conf file configuration. We must add LDAP configuration, because we use FDS to be backend to get DB password and user.

protocols = imap pop3

listen = [::]

default_mail_env = maildir:~/Maildir

auth default {

mechanisms = plain

passdb ldap {

args = /etc/devecot-ldap.conf

}

}

o LDAP Connection

Configure /etc/devecot-ldap.conf.

hosts = svr6.xx.eu

dn = “cn=Directory Manager”

dnpass = “fdsmanagerpasswd”

ldap_version = 3

base = dc=xx, dc=eu

deref = never

scope = subtree

user_filter = (&(objectClass=mailgroup)(mgrpDeliverTo=%u))

pass_filter = (&(objectClass=posixAccount)(uid=%u))

default_pass_scheme = CRYPT

· Apache and PHP

Let it with default configuration.

· Squirremail

After all squirremail already installed, you can configure it (/etc/squirremail) and web application in /etc/share/squirremail. If you want configure it using desktop interface, so you can run /usr/share/squirrelmail/config/conf.pl, and configure this points.

1. Domain, choose Server Setting | Domain in menu.

2. SMTP Address and IMAP Server, choose Server Setting | Update IMAP Setting / Update SMTP Setting.

3. Data Directory and Attachment, choose General Options | Data Directory / Attachment Directory.

4. LDAP Server, choose Address Book | Change LDAP Servers.

5. change_ldappass Plug-in, this plug-in is used to change LDAP account password. To use this service, extract plug-in packages into /usr/share/squirrelmail/plugins, and then edit /usr/share/squirrelmail/plugins/change_ldappass/config.php.

$ldap_server = ‘svr6.xx.eu’;

$ldap_protocol_version = 3;

$ldap_password_field = ‘userPassword’;

$ldap_user_field = ’uid’;

$ldap_base_dn = ‘dc=xx, dc=eu’;

$no_bind_as_user = false;

$change_ldapsmb = true;

$mkntpwd = ‘/usr/bin/mkntdpwd’;

$ldapsmb_lmpassword = ‘sambaLMPassword’;

$ldapsmb_ntpassword = ‘samabaNTPassword’;

$debug = false;

· mkntpwd

This utility is used to create samba password encryption. Install this packages into /usr/local/src. Then, type this few command.

# tar –zxvf mkntpwd.tar.gz

# cd mkntpwd

# make

# cd mkntpwd /usr/bin

So, start this service…

Fedora Directory Server (FDS) + Postfix Mail Server (Part 3)

Test the integration.

Run all service that we already installed into system.

LDAP Server / FDS

# /opt/fedora-ds/slapd-svr6/start-slapd

Check user account and email account in FDS.

# ldapsearch –x | grep user_name

If the result displayed your username/uid and email user, your FDS is running.

Postfix Mail Server

# service postfix start

Type from console,

# mail

We sending text based email. If sending status is “sent”, so your email is already sent. Check your Maildir directory, if your email already stored here so your configuration success.

Dovecot

# service dovecot start

Then, telnet to the dovecot server in port 110, enter your username and password. Check your mailbox using this command,

# stat

# retr

If you can read mail, your dovecot is already.

Apache

# service httpd start

Type http://svr6/ in web browser, if your Fedora Core Test Page displayed. It mean that your web server already running. To test PHP support, do this step :

# touch /var/www/html/phptest.php

# echo “” > /var/www/html/phptest.php

Then, type http://svr6/phptest.php into web server.

Squirrelmail

Type http://svr6/webmail/src/configtest.php and http://svr6/webmail. if you can login into, so your configuration is success.

Setting up LTSP using Ubuntu Distro’s (Edubuntu)

LTSP or Linux Terminal Server Project is an application of thin-client network or diskless. In this article we use Edubuntu distro’s.

1. Install Edubuntu Server.

· Install Edubuntu distro’s into your system, “Install to the harddisk”.

· Choose your language configuration.

· Choose your keyboard configuration.

· Wait a moment for hardware detecting and some driver installation.

· Setting up your IP address

o IP Address : 10.252.0.1

o Netmask : 255.255.255.0

o Gateway :

o DNS Server : your.dns.addr or 127.0.0.1 (Loopback IP)

o Host : your.host.domain

· Configure your partition of your harddisk, min free space of harddisk is 3GB.

· Choose your time zone.

· Create new user account.

· Wait a moment for installation.

· If you have network connection to the internet, fill your proxy. But if you not connected to the network or internet let it blank.

· Then, copy all packages to the harddisk, and install root system for LTSP client in /opt/ltsp/i386.

· Reboot your computer.

2. Configure User and Group.

· Choose System | Administration | User and Groups.

· Give an account user and password.

· Choose User Privileges to control user administration. In here you can allow every user to access server for storing file. And disable your “Administer the System”, if you enable this point, user can access to your system to be root.

· If you want to add new user, you can add user in Advanced tab.

3. Bootdisk for client.

· If you have client with ROM Boot card (PXE), so you can test your LTSP system.

· But if you didn’t have ROM boot card, you can use diskette to be your boot disk. You can download ROM boot from http://www.rom-o-matic.net, choose zdisk extension file (ex : eb-6.4.0-rtl8139.zdsk).

· Copy ROM boot file into your diskette using this command.

# dd if=eb-6.4.0-rtl8139.zdsk of=/dev/fd0

4. Testing LTSP Server.

In this section, we think that your DHCP server is already.

· LTSP Client Using Diskette

o Configure your computer BIOS to boot from floppy disk.

o Insert your diskette into your PC.

o When your computer starts, you will get IP address from server.

o After display manager (ltsp display manager) shown, so client-server is connected. And LTSP service is running successfully.

Have a nice try……

Bandwidth Limiting (Part 3)

OK, when we have configured everything, we must make sure everything under /opt/squid and /cache directories belongs to user 'squid'.

# mkdir /var/log/squid/

# chown squid:squid /var/log/squid/

# chmod 770 /var/log/squid/

# chown −R squid:squid /opt/squid/

# chown −R squid:squid /cache/

Now everything is ready to run Squid. When we do it for the first time, we have to create its cache directories:

# /opt/squid/bin/squid −z

We run Squid and check if everything is working with IPTraf, make sure you have set the appropriate proxy in your web browsers (192.168.1.1, port 8080 in our example):

# /opt/squid/bin/squid

If everything is working, we add /opt/squid/bin/squid line to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local.

You can also copy cachemgr.cgi to the cgi−bin directory of your WWW server, to make use of a useful Cache Manager.

OK, we have installed Squid and configured it to use delay pools. I bet nobody wants to be restricted, especially our clever LAN users. They will likely try to avoid our limitations, just to download their favorite mp3s a little faster (and thus causing your headache).

I assume that you use IP−masquerade on your LAN so that your users could use IRC, ICQ, email, etc. That's OK, but we must make sure that our LAN users will use our delay pooled Squid to access web pages and use ftp. We can solve most of these problems by using ipchains or iptables.

Linux 2.2.x kernels (ipchains)

We must make sure that nobody will try to cheat and use a proxy server other than ours. Public proxies usually run on 3128 and 8080 ports:

/sbin/ipchains −A input −s 192.168.1.1/24 −d ! 192.168.1.1 3128 −p TCP −j REJECT

/sbin/ipchains −A input −s 192.168.1.1/24 −d ! 192.168.1.1 8080 −p TCP −j REJECT

We must also make sure that nobody will try to cheat and connect to the internet directly (IP−masquerade) to download web pages:

/sbin/ipchains −A input −s 192.168.1.1/24 −d ! 192.168.1.1 80 −p TCP −j REDIRECT 8080

If everything is working, we add these lines to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local.

Linux 2.4.x kernels (iptables)

We must make sure that nobody will try to cheat and use a proxy server other than ours. Public proxies usually run on 3128 and 8080 ports:

/sbin/iptables −A FORWARD −s 192.168.1.1/24 −d ! 192.168.1.1 −−dport 3128 −p TCP −j DROP

/sbin/iptables −A FORWARD −s 192.168.1.1/24 −d ! 192.168.1.1 −−dport 8080 −p TCP −j DROP

We must also make sure that nobody will try to cheat and connect to the internet directly (IP−masquerade) to download web pages:

/sbin/iptables −t nat −A PREROUTING −i eth0 −p tcp −−dport 80 −j REDIRECT −−to−port 8080

If everything is working, we add these lines to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local.

Dealing with Other Bandwidth consuming Protocols Using CBQ

We must remember that our LAN users can spoil our efforts if they use Napster, Kazaa or RealAudio. We must also remember that we didn't block ftp traffic. We will achieve it in a different way −− not by limiting downloading directly, but rather, indirectly. If our internet device is ppp0 and LAN device is eth0, we will limit outgoing traffic on interface eth0, and thus, limit incoming traffic to ppp0.

To do it, we will get familiar with CBQ and cbq.init script. Download cbq.init−v0.6.2 and put it in /etc/rc.d/. You will also need iproute2 installed. Now look in your /etc/sysconfig/cbq/ directory. There, you should have an example file, which should work with cbq.init. If it isn't there, you probably don't have it compiled in your kernel or it isn’t present as modules. Well, in any case, just make that directory, put example files provided below, and see if it'd work for you.

Bandwidth Limiting (Part 2)

Configure our squid.conf file (located under /opt/squid/etc/squid.conf):

#squid.conf

…

#The ports our Squid will listen on.

http_port 8080

icp_port 3130

…

acl QUERY urlpath_regex cgi−bin \?

no_cache deny QUERY

#Memory the Squid will use. Well, Squid will use far more than that.

cache_mem 16 MB

#250 means that Squid will use 250 megabytes of disk space.

cache_dir ufs /cache 250 16 256

#Places where Squid's logs will go to.

cache_log /var/log/squid/cache.log

cache_access_log /var/log/squid/access.log

cache_store_log /var/log/squid/store.log

cache_swap_log /var/log/squid/swap.log

#How many times to rotate the logs before deleting them.

#See the FAQ for more info.

logfile_rotate 10

redirect_rewrites_host_header off

cache_replacement_policy GDSF

acl localnet src 192.168.1.0/255.255.255.0

acl localhost src 127.0.0.1/255.255.255.255

acl Safe_ports port 80 443 210 119 70 20 21 1025−65535

acl CONNECT method CONNECT

acl all src 0.0.0.0/0.0.0.0

http_access allow localnet

http_access allow localhost

http_access deny !Safe_ports

http_access deny CONNECT

http_access deny all

maximum_object_size 3000 KB

store_avg_object_size 50 KB

httpd_accel_host virtual

httpd_accel_port 80

httpd_accel_with_proxy on

httpd_accel_uses_host_header on

#all our LAN users will be seen by external web servers

#as if they all used Mozilla on Linux. :)

anonymize_headers deny User−Agent

fake_user_agent Mozilla/5.0 (X11; U; Linux i686; en−US; rv:0.9.6+) Gecko/20011122

…

cache_mgr your@email

cachemgr_passwd secret_password all

#This is a name of a user our Squid will work as.

cache_effective_user squid

cache_effective_group squid

log_icp_queries off

buffered_logs on

#####DELAY POOLS

#This is the most important part for shaping incoming traffic with Squid

#For detailed description see squid.conf file or docs at http://www.squid−cache.org

#We don't want to limit downloads on our local network.

acl magic_words1 url_regex −i 192.168

#We want to limit downloads of these type of files

#Put this all in one line

acl magic_words2 url_regex −i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .ram .rm .iso .raw .wav .mov

#We don't block .html, .gif, .jpg and similar files, because they

#generally don't consume much bandwidth

#We want to limit bandwidth during the day, and allow

#full bandwidth during the night

#Caution! with the acl below your downloads are likely to break

#at 23:59. Read the FAQ in this bandwidth if you want to avoid it.

acl day time 09:00−23:59

#We have two different delay_pools

#View Squid documentation to get familiar

#with delay_pools and delay_class.

delay_pools 2

#First delay pool

#We don't want to delay our local traffic.

#There are three pool classes; here we will deal only with the second.

#First delay class (1) of second type (2).

delay_class 1 2

#−1/−1 mean that there are no limits.

delay_parameters 1 −1/−1 −1/−1

#magic_words1: 192.168 we have set before

delay_access 1 allow magic_words1

#Second delay pool.

#we want to delay downloading files mentioned in magic_words2.

#Second delay class (2) of second type (2).

delay_class 2 2

#The numbers here are values in bytes;

#we must remember that Squid doesn't consider start/stop bits

#5000/150000 are values for the whole network

#5000/120000 are values for the single IP

#after downloaded files exceed about 150000 bytes,

#(or even twice or three times as much)

#they will continue to download at about 5000 bytes/s

delay_parameters 2 5000/150000 5000/120000

#We have set day to 09:00−23:59 before.

delay_access 2 allow day

delay_access 2 deny !day

delay_access 2 allow magic_words2

#EOF

Bandwidth Limiting (Part 1)

Introduction

The purpose of this guide is to provide an easy solution for limiting incoming traffic, thus preventing our LAN users from consuming all the bandwidth of our internet link. This is useful when our internet link is slow or our LAN users download tons of mp3s and the newest Linux distro's *.iso files.

Before We Start

Let's imagine the following situation:

We have 115,2 kbits/s ppp (modem) internet link (115,2/10 = 11,5 Kbytes/s). Note: with eth connections (network card) we would divide 115,2 by 8; with ppp we divide by 10, because of start/stop bits (8 + 1 + 1 = 10).

· We have some LAN stations and their users are doing bulk downloads all the time.

· We want web pages to open fast, no matter how many downloads are happening.

· Our internet interface is ppp0.

· Our LAN interface is eth0.

· Our network is 192.168.1.0/24

Believe it or not, shaping the incoming traffic is an easy task and you don't have to read tons of books about routing or queuing algorithms. To make it work, we need at least Squid proxy; if we want to fine tune it, we will have to get familiar with ipchains or iptables and CBQ. To test our efforts, we can install IPTraf.

Squid is probably the most advanced HTTP proxy server available for Linux. It can help us save bandwidth in two ways:

The first is a main characteristic of proxy servers −− they keep downloaded web pages, pictures, and other objects in memory or on a disk. So, if two people are requesting the same web page, it isn't downloaded from the internet, but from the local proxy.

The second apart from normal caching, Squid has a special feature called delay pools. It is possible to limit internet traffic in a reasonable way, depending on so-called 'magic words', existing in any given URL. For example, a magic word could be *.mp3, *.exe or *.avi*, etc. Any distinct part of a URL (such as *.avi) can be defined as a magic word.

We can tell the Squid to download these kinds of files at a specified speed (in our example, it will be about 5 Kbytes/s). If our LAN users download files at the same time, they will be downloaded at about 5 Kbytes/s altogether, leaving remaining bandwidth for web pages, email, news, IRC, etc. Of course, the Internet is not only used for downloading files via web pages (http or ftp). Later on, we will deal with limiting bandwidth for Napster, RealAudio, and other possibilities.

Here, I will explain how to install the necessary software so that we can limit and test the bandwidth usage.

Installing Squid with the delay pools feature

Squid has a feature called delay pools, which allows us to control download bandwidth. Unfortunately, in most distributions, Squid is shipped without that feature.

So if you have Squid already installed, I must disappoint you −− you need to uninstall it and do it once again with delay pools enabled in the way I explain below.

· To get maximum performance from our Squid proxy, it's best to create a separate partition for its cache, called /cache/. Its size should be about 300 megabytes, depending on our needs.

If you don't know how to make a separate partition, you can create the /cache/ directory on a main partition, but Squid performance can suffer a bit.

· We add a safe 'squid' user:

# useradd −d /cache/ −r −s /dev/null squid >/dev/null 2>&1

No one can log in as squid, including root.

· We download Squid sources from http://www.squid−cache.org.

· We unpack everything to /var/tmp

# tar xzpf squid−2.4.STABLE1−src.tar.gz

· We compile and install Squid (everthing is in one line):

# ./configure −−prefix=/opt/squid −−exec−prefix=/opt/squid −−enable−delay−pools −−enable−cache−digests −−enable−poll

−−disable−ident−lookups −−enable−truncate −−enable−removal−policies

# make all

# make install