Study notes

星期一, 6月 11, 2012

Service Levels For MA 系統維護服務的等級


Service Levels For MA 系統維護服務的等級


這個是網路上找到關於SLA的資料,它通常可以讓我們作為參考最主要還是要看在簽訂服務合約時的內容為主啦~ 下圖可以說明日常在維護時的
流程。

Critical Plus

這個等級適合的系統,其作業環境需要較高的可用性的環境所以這個程度的服務等級提供、一周7天 24回應,且4小時到場服務、一年365天的服務24x7x365

Critical

這個服務等級適合只有部分的系統或營業時間需要高可用性,所以這個等級的服務提供24x5 回應及四小時到場,服務的時間限於一周中的星期一~星期五。

Elite


這個是蠻經濟的選擇,它的服務只提供一般上班時間的八小時及一周中的上班日並排除假日,
這個等級的服務提供8x5 上班的時間回應及四小時到場。


Shared
這個是最省錢的選擇,它的服務提供問題回應及自行服務更換零件。這個等級適合公司本身擁有較有經驗及專業技能員工。

星期五, 6月 08, 2012

Proactive Support 的六個等級

Proactive Support 的六個等級

最近在填一個資料時發現Proactive Support這個名詞,剛開始還以為是什麼Support的等級,後來查了這個資訊時發現這它還有六個等級,看了一下還與我工作上息息相關,每次在執行工作的過程中常會思考這些問題。所以儘量在執行工作前先了解客戶的環境、工作流程、作業方式,加上手邊的產品已知的問題(bug)、可能會有的問題,兩個部分加在一起去思考要如何降低執行工作遇到無法解決問題的風險。儘量在問題發生前提供客戶其它的替代的解決方案來解決客戶的問題。



Level 1 忽略(Ignore):當問題發生時不做任何處置,
Level 2 作出反應(React):當問題發生且客戶提出抱怨時才作出反應
Level 3 提出警告(Alert):當問題發生前先讓客戶知道可能會發生的濳在問題。
Level 4 Self-heal :當客戶提出抱怨前,先提供客戶一些替代的解決方案
Level 5 Pre-empt:在客戶注意到問題前,已經能了解問題所在及提供解決方案。
Level 6 Avoid:在問題發生前就能了解問題所在且修正問題。


 參考資訊
http://experiencematters.wordpress.com/2011/02/07/the-6-levels-of-proactive-support/

星期二, 3月 20, 2012

samba on CentOS 6.2

最近幫朋友重裝Linux Server,在重新移轉服務時遇到了一些其它之前沒遇見的問題,就以Samba來說,雖然設定好之後都能使用但在/var/log/messages裡一直跑出惱人的錯誤訊息。


 錯誤訊息1:   open_socket_in: Address already in use


Mar 20 09:22:40 smbd[16745]:   smbd_open_once_socket: open_socket_in: Address already in use
Mar 20 09:22:40 max smbd[16745]: [2012/03/20 09:22:40.933009,  0] smbd/server.c:500(smbd_open_one_socket)
Mar 20 09:22:40 max smbd[16745]:   smbd_open_once_socket: open_socket_in: Address already in use
Mar 20 09:23:03 max avahi-daemon[1357]: Invalid query packet.


處理方式:在Google大神的幫助下發現這個是個bug ,處理方式是在smb.conf裡加一條設定後就沒有跑出這個訊息了。


         bind interfaces only = yes  




錯誤訊息2: 



Mar 20 09:18:11 max smbd[9426]: [2012/03/20 09:18:11.846538,  0] printing/print_cups.c:468(cups_async_callback)
Mar 20 09:18:11 max smbd[9426]:   failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL
Mar 20 09:18:11 max smbd[9426]: [2012/03/20 09:18:11.846737,  0] smbd/server.c:281(remove_child_pid)
Mar 20 09:18:11 max smbd[9426]:   Could not find child 16659 -- ignoring


處理方式: 因為我沒有裝印表機,每750秒系統會掃描一次,錯誤又會跑出一次,將smb.conf裡加一條設定將這個功能關閉就行了。



       printcap cache time = 0  



我使用的samba版本是samba-3.5.10-114.el6.i686 ,加上這兩條之後清爽多了~恢復之前平靜的日子~~

星期一, 11月 01, 2010

List of raw FTP commands

List of raw FTP commands

(Warning: this is a technical document, not necessary for most FTP use.)

Note that commands marked with a * are not implemented in a number of FTP servers.

Common commands

  • ABOR - abort a file transfer
  • CWD - change working directory
  • DELE - delete a remote file
  • LIST - list remote files
  • MDTM - return the modification time of a file
  • MKD - make a remote directory
  • NLST - name list of remote directory
  • PASS - send password
  • PASV - enter passive mode
  • PORT - open a data port
  • PWD - print working directory
  • QUIT - terminate the connection
  • RETR - retrieve a remote file
  • RMD - remove a remote directory
  • RNFR - rename from
  • RNTO - rename to
  • SITE - site-specific commands
  • SIZE - return the size of a file
  • STOR - store a file on the remote host
  • TYPE - set transfer type
  • USER - send username

Less common commands

  • ACCT* - send account information
  • APPE - append to a remote file
  • CDUP - CWD to the parent of the current directory
  • HELP - return help on using the server
  • MODE - set transfer mode
  • NOOP - do nothing
  • REIN* - reinitialize the connection
  • STAT - return server status
  • STOU - store a file uniquely
  • STRU - set file transfer structure
  • SYST - return system type

ABOR

Syntax: ABOR

Aborts a file transfer currently in progress.

ACCT*

Syntax: ACCT account-info

This command is used to send account information on systems that require it. Typically sent after a PASS command.

ALLO

Syntax: ALLO size [R max-record-size]

Allocates sufficient storage space to receive a file. If the maximum size of a record also needs to be known, that is sent as a second numeric parameter following a space, the capital letter "R", and another space.

APPE

Syntax: APPE remote-filename

Append data to the end of a file on the remote host. If the file does not already exist, it is created. This command must be preceded by a PORT or PASV command so that the server knows where to receive data from.

CDUP

Syntax: CDUP

Makes the parent of the current directory be the current directory.

CWD

Syntax: CWD remote-directory

Makes the given directory be the current directory on the remote host.

DELE

Syntax: DELE remote-filename

Deletes the given file on the remote host.

HELP

Syntax: HELP [command]

If a command is given, returns help on that command; otherwise, returns general help for the FTP server (usually a list of supported commands).

LIST

Syntax: LIST [remote-filespec]

If remote-filespec refers to a file, sends information about that file. If remote-filespec refers to a directory, sends information about each file in that directory. remote-filespec defaults to the current directory. This command must be preceded by a PORT or PASV command.

MDTM

Syntax: MDTM remote-filename

Returns the last-modified time of the given file on the remote host in the format "YYYYMMDDhhmmss": YYYY is the four-digit year, MM is the month from 01 to 12, DD is the day of the month from 01 to 31, hh is the hour from 00 to 23, mm is the minute from 00 to 59, and ss is the second from 00 to 59.

MKD

Syntax: MKD remote-directory

Creates the named directory on the remote host.

MODE

Syntax: MODE mode-character

Sets the transfer mode to one of:

  • S - Stream
  • B - Block
  • C - Compressed
The default mode is Stream.

NLST

Syntax: NLST [remote-directory]

Returns a list of filenames in the given directory (defaulting to the current directory), with no other information. Must be preceded by a PORT or PASV command.

NOOP

Syntax: NOOP

Does nothing except return a response.

PASS

Syntax: PASS password

After sending the USER command, send this command to complete the login process. (Note, however, that an ACCT command may have to be used on some systems.)

PASV

Syntax: PASV

Tells the server to enter "passive mode". In passive mode, the server will wait for the client to establish a connection with it rather than attempting to connect to a client-specified port. The server will respond with the address of the port it is listening on, with a message like:
227 Entering Passive Mode (a1,a2,a3,a4,p1,p2)
where a1.a2.a3.a4 is the IP address and p1*256+p2 is the port number.

PORT

Syntax: PORT a1,a2,a3,a4,p1,p2

Specifies the host and port to which the server should connect for the next file transfer. This is interpreted as IP address a1.a2.a3.a4, port p1*256+p2.

PWD

Syntax: PWD

Returns the name of the current directory on the remote host.

QUIT

Syntax: QUIT

Terminates the command connection.

REIN*

Syntax: REIN

Reinitializes the command connection - cancels the current user/password/account information. Should be followed by a USER command for another login.

REST

Syntax: REST position

Sets the point at which a file transfer should start; useful for resuming interrupted transfers. For nonstructured files, this is simply a decimal number. This command must immediately precede a data transfer command (RETR or STOR only); i.e. it must come after any PORT or PASV command.

RETR

Syntax: RETR remote-filename

Begins transmission of a file from the remote host. Must be preceded by either a PORT command or a PASV command to indicate where the server should send data.

RMD

Syntax: RMD remote-directory

Deletes the named directory on the remote host.

RNFR

Syntax: RNFR from-filename

Used when renaming a file. Use this command to specify the file to be renamed; follow it with an RNTO command to specify the new name for the file.

RNTO

Syntax: RNTO to-filename

Used when renaming a file. After sending an RNFR command to specify the file to rename, send this command to specify the new name for the file.

SITE*

Syntax: SITE site-specific-command

Executes a site-specific command.

SIZE

Syntax: SIZE remote-filename

Returns the size of the remote file as a decimal number.

STAT

Syntax: STAT [remote-filespec]

If invoked without parameters, returns general status information about the FTP server process. If a parameter is given, acts like the LIST command, except that data is sent over the control connection (no PORT or PASV command is required).

STOR

Syntax: STOR remote-filename

Begins transmission of a file to the remote site. Must be preceded by either a PORT command or a PASV command so the server knows where to accept data from.

STOU

Syntax: STOU

Begins transmission of a file to the remote site; the remote filename will be unique in the current directory. The response from the server will include the filename.

STRU

Syntax: STRU structure-character

Sets the file structure for transfer to one of:

  • F - File (no structure)
  • R - Record structure
  • P - Page structure
The default structure is File.

SYST

Syntax: SYST

Returns a word identifying the system, the word "Type:", and the default transfer type (as would be set by the TYPE command). For example: UNIX Type: L8

TYPE

Syntax: TYPE type-character [second-type-character]

Sets the type of file to be transferred. type-character can be any of:

  • A - ASCII text
  • E - EBCDIC text
  • I - image (binary data)
  • L - local format
For A and E, the second-type-character specifies how the text should be interpreted. It can be:
  • N - Non-print (not destined for printing). This is the default if second-type-character is omitted.
  • T - Telnet format control (, , etc.)
  • C - ASA Carriage Control
For L, the second-type-character specifies the number of bits per byte on the local system, and may not be omitted.

USER

Syntax: USER username

Send this command to begin the login process. username should be a valid username on the system, or "anonymous" to initiate an anonymous login.

星期三, 6月 27, 2007

幫朋友設定VSFTPD--取消ftp用戶的刪除權限

最近朋友在設定vsftpd時有個需求,就是讓所有user只能上傳,但是不能刪除檔案,後來我加入這樣的設定:
chown_uploads=YES
chown_username=ftp
guest_enable=yes
guest_username=test
但這樣所以的user都被對映到anonymous,且所有的使用者都會對映到test這個帳號的家目錄,也可以滿足讓所有user只能上傳不能刪檔的需求,但他要的是每個user要不同目錄,所以只要想其它的方式了。

後來只好用man vsftpd.conf 見到一個參數cmds_allowed之後開始有了一線生機。這個參數是說讓vsftp server能夠接受那些指令。就是將指定可用的ftp指令加到等號後面就行了(指令之間以逗號分隔)。
cmds_allowed=PASV,RETR,QUIT,REST,TYPE,USER,PASS,
LIST,CWD,CDUP,STOR,SIZE,PWD,MKD

上面是我觀查出一般ftp client會用到的指令,我們要的是讓user不能刪檔,DELE這個指令不要加上去就好了。這樣就可以達到我朋友的要求了!!

另外我想到cmds_allowed=是site wide的,但如果我某些user要能有全部的權限,有些不能刪檔怎麼辨,可以利用user_config_dir 來專為特定的使用者設定不同的設定。
以下是man vsftpd.conf 中cmds_allowed及user_config_dir 的原文:
cmds_allowed
This options specifies a comma separated list of allowed FTP commands (post login. USER, PASS and QUIT are always allowed pre-login). Other commands are rejected. This is a powerful method of really locking down an FTP server. Example: cmds_allowed=PASV,RETR,QUIT

user_config_dir
This powerful option allows the override of any config option specified in the manual page, on a per-user basis. Usage is simple, and is best illustrated with an example. If you set user_config_dir to be /etc/vsftpd_user_conf and then log on as the user "chris", then vsftpd will apply the settings in the file /etc/vsftpd_user_conf/chris for the duration of the session. The format of this file is as detailed in this manual page! PLEASE NOTE that not all settings are effective on a per-user basis. For example, many settings only prior to the user's session being started. Examples of settings which will not affect any behviour on a per-user basis include listen_address, banner_file, max_per_ip, max_clients, xferlog_file, etc.



標籤:

星期四, 5月 10, 2007

如何使用iptables來阻檔msn

最近受到朋友請託,要我讓他們公司的員工不能上msn,他們公司使用msn的情形已經到影響到工作了。剛好他們有台linux伺服器是當他們上網的gateway加上email伺服器。下面是他們公司的網路概圖:


基本上他們已經在使用iptables來做防火牆和NAT來保護伺服器以及讓所以電腦上網。我利用netstat
來找出來msn登入時所需要的伺服器位置及埠號,msn登入所需要的埠號是80,443,1863三個的其中一個,但不管怎麼樣檔,總不能把80埠給擋掉吧!如果擋了80埠搞得大家不能上網也是不行的,但開了80埠msn 還是可以登入的,那怎麼辨呢?所以我加入阻擋msn 伺服器的位置,另外還有一個就是web msn 現在也有很多web msn的站台,也要去阻擋那些網站。基本上只要加入在防火牆FORWARD Chain就行了,下面是我iptables的規則:

# 讓那些client可以使用msn,這裡是使用ip 也可以加入-m mac --mac-source 00:90:cc:26:a5:57 去鎖定網卡
iptables -A FORWARD -p tcp -s 192.168.0.201 -d login.passport.net -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.0.201 -d login.passport.com -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.0.201 -d login.live.com -j ACCEPT

# allow msn port 1863
iptables -A FORWARD -p tcp -s 192.168.0.201 --dport 1863 -j ACCEPT

# allow msn http server
iptables -A FORWARD -p tcp -s 192.168.0.201 -d 207.46.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.0.202 -d 207.46.0.0/16 -j ACCEPT

##其它的人一律阻擋
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d 207.46.0.0/16 -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 --dport 1863 -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d login.passport.net -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d login.passport.com -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d webmessenger.msn.com -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d login.live.com -j DROP

#other web msn server 這個部分可以去知識家找找還有那些免費的web msn
#I love IM
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -d www.iloveim.com -j DROP

其中270.46.0.0這個網段有很多msn登入的伺服器,我是抱著寧可錯殺也不可放過的心態去設定的,如果可以的話也可以用nslookup 一一去找出來,一一阻擋。其中login.live.com 有很多微軟的服務都會使用他們登入,以前是使用login.passport.net, 所以阻擋這些後相關的服務都無法使用喔。

另外yahoo messager 相關的規則如下:

iptables -A FORWARD -p tcp -i eth1 --dport 5050 -j DROP
iptables -A FORWARD -p tcp -i eth1 --dport 5101 -j DROP
iptables -A FORWARD -p all -i eth1 -d cs9.msg.dcn.yahoo.com -j DROP

記得要阻檔相關的登入的伺服器他們的主機名稱如下:
cs1.msg.dcn.yahoo.com
cs2.msg.dcn.yahoo.com
.
.
中間略過
.
.
cs50.msg.dcn.yahoo.com


結論:

這裡是用一些現成的工具像是netstat 及 nslookup 去觀察msn及yahoo messager的運作狀態,再加以使用iptables來阻擋。如果想要更進階的資訊可以去下列網站找到相關的資料:
http://tw.messenger.yahoo.com/index.php
http://www.microsoft.com

標籤:

星期三, 1月 25, 2006

設定Backup MX for postfix

好久沒上來了,我花了近三個月的時間準備LPIC level 1&2 ,最後終於讓我考完了,一切順利。

今天發生家裡的網路斷線,這已經不是第一次了,通常不是我妹沒去繳adsl的錢,要不然就是ip分享器的問題例如,插頭被拔了…。想說發生這樣的事,我家裡的mail server 不是就中斷了跟外面的連線嗎,外面的信就無法送到我的mail server了。但我又不想少收到信,後來就去www.postfix.org找到了一些資料。還滿簡單的。

更改的地方有
1.dns 要多設定一組mx record 是backup mail server 用的。
2.備援主機上postfix的main.cf ,postfix的版本 要2.0以上。

設定dns

在dns中 abc.com.tw的zone裡頭多設定一組mx 記錄,偏好值設大一點,

例如
@INNStest.abc.com.tw.
testINA11.22.33.44
mailINA22.33.44.55
mail2INA33.44.55.66
@INMX 10mail
@INMX 50mail2;BACKUP MX
所以當mail.abc.com.tw 離線的時候,所以abc.com.tw的信就會轉到mail2去。
設定postfix的main.cf
在main.cf裡的要設定relay_domains 、permit_mx_backup_networks
及permit_mx_backup。
  1. relay_domains -- 它的預設值是$mydestination,在後面加入你要的收那個domain的信,例如 abc.com.tw relay_domains = $mydestination abc.com.tw
  2. permit_mx_backup_networks -- 預設值是空白的,加入你要備援的主機的domain,permit_mx_backup_networks = abc.com.tw
  3. 在smtpd_recipient_restrictions、smtpd_client_restrictions中加入permit_mx_backup,例如:smtpd_recipient_restrictions=permit_mynetworks permit_mx_backup設定好之後,重新啟動name及postfix就完成了。