In this post, we will try to understand basic terminology used in Puppet which will help us understand Puppet


  • PUPPET MASTER


This is our Puppet server which takes care of puppet clients which connect to it. It serves required data to clients and gets reports from clients once our configurations are done on them. This acts as a centralized machine for all your Puppet activity by default.


  • MASTERLESS PUPPET

Puppet configuration management tool can be deployed in two ways. One is Client-server model and the other is an independent node model or a masterless setup. Depends on your requirement we can use one of these models. Many people may have a question how is it possible to configure Masterless-puppet. For those people, “puppet apply /path/to/my/site.pp” command is the answer. We can apply puppet catalogs if we have puppet manifests locally available using puppet apply command. We will see more about this command in future.


  • PUPPETMASTERD

Running state of Puppet server is called as puppetmasterd


  • PUPPET AGENT

Running state of Puppet client software. This software is useful for

1)  Gathering facts: Getting vast system details like OS type, version, RAM details, CPU details and much  more using installed facter tool.

2)  Send those details to master for getting required compiled configuration details(catalogs)

3) Getting compiled configuration details from puppet master

4) Executing those compiled configurations at a designated time.

5) Collecting and sending reports of this expected configuration on the client.


  • PUPPET NODE

Puppet clients are called as nodes.


  • RESOURCES

These are files/configs which can be used for changing settings at nodes.


  • FACTER

Reporting tool at nodes, which reports about OS/HW/SW types etc to puppet master about the node where it is installed.


  • CLIPPED OUTPUT OF FACTER COMMAND:

architecture => amd64
blockdevices => sda,sdb
boardmanufacturer => Hewlett-Packard
fqdn => linuxnix
gid => root
hardwareisa => x86_64
hostname => linuxnix
id => root
interfaces => eth0,lo,virbr0,virbr0_nic,wlan0
ipaddress => 192.168.122.1
kernel => Linux
kernelmajversion => 4.4
kernelrelease => 4.4.0-31-generic
kernelversion => 4.4.0
memoryfree => 2.41 GB
memorysize => 7.58 GB
memorysize_mb => 7757.53


  • ATTRIBUTE

Attributes are used to specify the state desired for a given configuration resource. We will see more about this in our coming posts.


  • PUPPET MANIFESTS

A file containing code written in the Puppet DSL language, and named with the .pp file extension. All manifests are stored in /etc/puppet/manifests or /etc/puppet/modules//manifests.


  • CATALOGS

Compiled form of manifests.


  • PUPPET MODULES

Modules are a bigger form of manifests. Every manifest in a module should define a single class or defined type.


  • FILES

Physical files you can serve out to your agents through puppet. These are stored in /etc/puppet/files or /etc/puppet/modules//files.


  • TEMPLATES

Template files contain puppet code with variables which can populate variable values depending on node details.


  • CLASSES

Collections of resources


  • DEFINITIONS

Composite collections of resources


Install Ansible


This blog will guide you to install Ansible in your CentOS machine in two easy steps. 
You will also learn how to setup your node machines and I will show you an example of how to install Nginx in your node machine from your control machine. 

Install Ansible on CentOS 6.8

Step 1: Set EPEL Repository
EPEL (Extra Packages for Enterprise Linux) is open source and free community based repository project from Fedora team which provides high quality add-on software packages for Linux distribution including RHEL (Red Hat Enterprise Linux), CentOS, and Scientific Linux.
Ansible package is not available in the default yum repositories, so we will enable EPEL repository for CentOS 6.8 using the command below:
#sudo rpm -ivh http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm

This will download all the necessary packages which will be required to install Ansible.
Step 2: Install Ansible
Now that your EPEL repository has been added, all you have to do now is install Ansible using the command below:
#yum install ansible -y
Installation completed, simple right
Now, if you want to check out your version of Ansible which you have installed, you can use the command below:
#ansible –version

Post Installation

After installing Ansible you need to add servers which you want to manage through Ansible. For that I have created another CentOS VM which will act as my node machine.
The first task is to setup password-less SSH authentication with nodes on my Control machine.
Step 1: Generate SSH key on the Ansible Control Machine. In order to do that, use the command below:
#ssh-keygen
As you can see in the above snapshot a public SSH key has been generated.
Step 2: Now, check the IP addresses of your nodes because you will need to specify it in the Ansible inventory later. To do that, type in the command ifconfig on your node terminal. 
Step 3: After the key is generated, the next task is to copy public key of Ansible server to its nodes. Use the command below:
#ssh-copy-id -i root@
Step 4: Now, you can use any editor to write your inventory or specify the IP addresses of your nodes grouped under ‘test-servers’ (or whatever you want your group name to be). I am using the vi editor.
use the following command:
#vi /etc/ansible/hosts
After you have added the IP address under ‘test-servers’, save the file and then exit.
Step 5: You might want to check if the IP address of your host has been added or not. To sample output of the host files using the following command:
#cat /etc/ansible/hosts
You can see the IP address of my host being displayed in the snapshot above. 
Step 6: Let us now perform a simple ping operation to test the connectivity using Ansible. To do that, just type the following command:
#ansible -m ping ‘test-servers’

Now, that you have checked the connection with your host machines, you are ready to manage them with Ansible.
Let me show you few shell command examples using Ansible.
  • Check uptime of your node machines
Uptime is a measure of the availability and working time of a computer. In order to check that use the following command:
#ansible -m command -a “uptime” ‘test-servers’
  • Check kernel version of your nodes
It can be useful to know the version number of the kernel (i.e., the core of the operating system). Use the command below:
#ansible -m command -a “uname -r” ‘test-servers’
Now, let us install Nginx into my node machine from my control machine using Ansible.

Deploy Nginx Using Ansible

Nginx is software to provide a web server. It can act as a reverse proxy server for TCP, UDP, HTTP, HTTPS, SMTP, POP3, and IMAP protocols, as well as a load balancer and an HTTP cache.
I am deploying Nginx using Ansible in just one node. You can deploy it in multiple nodes too using the same way. All you have to do is list out the IP addresses of the nodes under ‘test-servers’.
Use the following command in your control machine:
#ansible test-servers -m yum -a “name=nginx state=installed”

Now to check if it is installed in your node machine, type the following command in your node:
#ps waux | grep nginx


AIDE:

AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker

It creates a database from the regular expression rules that it finds from the config file(s). Once this database is initialized it can be used to verify the integrity of the files. It has several message digest algorithms (see below) that are used to check the integrity of the file. All of the usual file attributes can also be checked for inconsistencies.

Installation Procedure:
1. Install AIDE package on CentOS/RHEL:
# yum install -y aide
2. Check and adjust aide configuration file to fulfill your needs:
# vim /etc/aide.conf
3. Initialize AIDE database - it will scan all the files in folders that were included in the config file and save their hash as well as attributes info
aide --init
Once initialized we may see below line
### AIDE database at /var/lib/aide/aide.db.new.gz initialized.
4. we need to modify newly created database with mv command
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz


5. Check the database before making any changes
aide --check
6. Make any changes Ex : touch /usr/sbin/mytestfile.txt(just relating any file to test)
again check aide database fro notify changes by running below command
aide --check


7. You may consider keeping golden copy of AIDE database (default is set to /var/lib/aide/aide.db.gz) is secure and read-only location. It will allow you to compare current system integrity to the golden copy.
To check what changed run:
# aide -C



A popular host-based intrusion detection system on Linux is tripwire. This software can keep track of many different filesystem data points in order to detect whether unauthorized changes have occurred.

In this article, we will discuss how to install and configure tripwire and Commands for installation


Install Tripwire.
# yum install tripwire -y

Creating site and local keyfile pass-phrases
# tripwire-setup-keyfiles

Initializing Tripwire Database
# tripwire --init

Modifying Tripwire policy file
# vi /etc/tripwire/twpol.txt

Once modifying all the files, update the tripwire policy file.
# tripwire --update-policy --secure-mode low /etc/tripwire/twpol.txt

Checking for any changes in files/directories
# tripwire --check --interactive

It will ask you to enter passwords

Now let us add a new file called Anil.
# touch Anil

Now check this file with tripwire ?check ?interactive command. You may find the file Anil under the Added section in the result
# tripwire --check --interactive

OR

# tripwire --check
It will not ask you to enter password

Viewing the tripwire report file
All tripwire report files having extension .twr are stored in /var/lib/tripwire/report/ directory. These are not text files, so you can?t view them using any editor. First convert them using the following command to human readable format.
# twprint --print-report --twrfile /var/lib/tripwire/report/server.ostechnix.com-20130510-124159.twr > /tmp/twrreport.txt

Now open the file using any editor.
# vi /tmp/twrreport.txt 

Viewing tripwire configuration and policy file locations
To view the policy file locations enter the following command.

#twadmin --print-polfile

To view the configuration files enter the following command.
# twadmin --print-cfgfile

Scheduling Tripwire Check
You may find a cron file tripwire-check might be created automatically in the /etc/cron.daily/ directory. If it isn?t created, open your crontab file and add lines as shown below. The following example will execute the tripwire daily at 5 am.

# vi /etc/crontab 
# Tripwire Monitor process
00 5 * * * /usr/sbin/tripwire  --check

OR

0 7 * * * /usr/sbin/tripwire --check > /mnt/tripwire
0 8 * * * /bin/mail -s "Tripwire" amullapudi@ciphercloud.com  < /tmp/tripwire

It will check system at 7 AM of everyday,everyweek,every month,every year and it will send an email on same.

========================================================================


Let’s consider the following for easy understanding of tutorial


DB DB Name: admindb
DB UserName: postgres


DB Backup:


Backup:  $ pg_dump -U postgres admindb -f admindb.sql
Config DB Restore:


Restore: $ psql -U postgres -d admindb-f admindb.sql
Backup a single postgres table:
Example: test.sql and test1.sql from admindb                                          
pg_dump --table test -U postgres admindb -f  test.sql
pg_dump --table test1 -U postgres admindb -f test1.sql
Restore a single table to config DB(admindb):
psql admindb <  test.sql
psql admindb < test1.sql
========================================================================












Hi friends in this article we shall talk about Linux operating system file system(Directory Structure). File system in Linux is categorized based on the based on nature of files or
directories.

Files are categorized into following types:  


/bin user binaries
/sbin system binaries
/etc configuration files
/dev device files
/proc process files
/var variable files
/tmp temporary files
/usr user programs
/home home directory
/boot boot loader files
/lib library files
/opt optional-add-on apps
/mnt mount directory
/media removable devices

/sv		 service data

In Linux operating system  "/"  represents root directory which means it is a parent directory for Linux file system.

/bin: This directory contains binary executable s,  Common Linux commands you need
        to use in single-user modes are located under this directory.
Ex :   


/sbin:  This directory contains binary executable s, But  the linux commands located  
           under this directory are used typically by system administrator for system 
           maintenance purpose.
Ex :   


/etc:  This directory contains configuration files required by all programs ,This also   
         contains startup and shutdown shell scripts used to start/stop individual programs.
/Ex : 

 
/dev:  This directory contains device files and also contains files for handling removable 
          devices.
/Ex :  

 
   /proc:  This directory Contains information about system.This is a pseudo filesystem 
             process contains information about running process.
   /Ex :    

     
                                                                                      

/var: Variable means it contains variable length records. which means Content of the files          that are expected to grow can be found under this directory.
/Ex :  

   
                                                                                                                      

/tmp: Directory that contains temporary files created by system and users.Files under 
         this are get deleted when system rebooted.     
                 
/user: Contains binaries, libraries, documentation, and source-code for second level
          programs. It has also sub directories like bellow image.


/home: Home directories for all users to store their personal files.

/boot:  Contains boot loader related files like bellow image.


/lib    :   Contains library files that supports the binaries located under /bin and /sbin  

                                                                                                                                
/opt  : opt stands for optional,Contains add-on applications from individual vendors.

/mnt : Temporary mount directory where sysadmins can mount filesystems.

/media :  Temporary mount directory for removable devices.

/srv: srv stands for service Contains server specific services related data.