admin

The Ask How to change the time to wait before failing over to Secondary DNS server in case Primary doesn’t respond? The Solution The parameter timeout:n can be set in the configuration file /etc/resolv.conf to adjust the time taken to fallback to a secondary DNS in case the primary is not reachable. From the Man page of resolve.conf: The "options timeout:n" option sets the amount of time the resolver will wait for a response from a remote name server before retrying the query via a … [Read more...] about How to Change Time Interval to Fall Back to Secondary DNS Server in CentOS/RHEL

A SYSCALL happens whenever a user executes a command that requests that the Linux kernel provide a service. There are several SYSCALL like mount, umount, kill, open etc. These SYSCALLs can be monitored with the auditd system. Let's take "kill" SYSCALL as an example. The user wants to capture who has killed a certain process on the system. This can be easily achieved by writing an auditd rule which can capture the SYSCALL kill whenever it is called. Installing and configuring auditd auditd … [Read more...] about How to use auditd to monitor a specific SYSCALL

The problem We faced this weired issue last week, where the SSH to the servers was too slow. SSH to the Linux servers was taking long time around 30 seconds to 1 minute. SSH got stuck at the below prompt and no option to enter password for 30 seconds and password prompt was displayed but nothing goes further after entering the password. # ssh -vvv [server_ip_address] OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying … [Read more...] about Slow SSH login due to unreachable rsyslog server

The post outlines steps to create a Property-Based Filter to Discard( suppress ) a particular message or redirect program messages to a particular log file. The syntax The systax to write a Property-Based Filter is as shown below: :[Available Properties], [compare-operations], [customized expression] [path/log file] From the man page of rsyslog.conf The Discard Action (~) If the discard action is carried out, the received message is immediately discarded. Discard is just the … [Read more...] about /etc/rsyslog.conf – Setup a Filter to Discard or Redirect Messages

So the ask here is that how do we determine which user or system process is umounting or mounting a particular mount point. The mounting and umounting of a mount point can be monitored with the help of auditd. auditd is a userspace component to the Linux auditing system. This means that system users will be able to run auditd to configure rules and alerts for auditing functionality with the Linux system. One of the best things about auditd is that it is tightly integrated with the kernel, so … [Read more...] about How to monitor the Mounting/Umounting of Mount Points Using Auditd on CentOS/RHEL 6,7

Secure File Transfer Protocol (SFTP) is a great tool for performing secure file transfers. This is a short note to explain how to enable sftp logging without chroot. 1. To enable logging of sftp-server in /var/log/messages, add command-line arguments to the Subsystem sftp line in /etc/ssh/sshd_config # vi /etc/ssh/ssh_config Subsystem sftp /usr/libexec/openssh/sftp-server -l VERBOSE Restart the sshd service for the changes to take effect. # service sshd restart # For CentOS/RHEL … [Read more...] about How to enable SFTP Logging without chroot in CentOS/RHEL

By default, /var/log/messages* are created with read-write permissions for 'root' user only. There might be a requirement to make the log files world readable for eg to allow an application to read and process the data in it. Changing the permissions on such files using 'chmod' might be a temporary solution as they will be recreated with the original permission during the next logrotate cron job. This post will help understand how to set custom permissions (eg 644) on /var/log/messages … [Read more...] about How to Change Default Permission of /var/log/messages in CentOS/RHEL