DNS Caching and Forwarding with Unbound

This howto shows the steps needed to configure unbound for DNS caching and forwarding from the 192.168.1.0/24 network. It assumes the server’s IP address is 192.168.1.22 and is running RHEL/CentOS 7.

Installation

[root@rhce-server ~]# yum install unbound

Configure Systemd

[root@rhce-server ~]# systemctl enable unbound
ln -s '/usr/lib/systemd/system/unbound.service' '/etc/systemd/system/multi-user.target.wants/unbound.service'
[root@rhce-server ~]# ^enable^start
systemctl start unbound

Configure the Firewall

[root@rhce-server ~]# firewall-cmd --add-service=dns
success
[root@rhce-server ~]# firewall-cmd --add-service=dns --permanent
success

Configure Unbound

Unbound’s configuration is stored in /etc/unbound/unbound.conf.
By default unbound only listens on the loopback interface. Specify which interface you would like to use.

interface: 192.168.1.22

Allow queries from 192.168.1.0/24.

access-control: 192.168.1.0/24 allow

Disable DNSSEC.

domain-insecure: *

Forward uncached requests to OpenDNS.

forward-zone:
    name: *
    forward-addr: 208.67.222.222
    forward-addr: 208.67.220.220

Check Your Configuration

[root@rhce-server ~]# unbound-checkconf 
unbound-checkconf: no errors in /etc/unbound/unbound.conf

Restart the Unbound Service

[root@rhce-server ~]# systemctl restart unbound

Verify it is Working

Test from a different system on the network.

mooose:~ jglemza$ dig fark.com A @192.168.1.22

; <<>> DiG 9.8.3-P1 <<>> fark.com A @192.168.1.22
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60299
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;fark.com.          IN  A

;; ANSWER SECTION:
fark.com.       43200   IN  A   64.191.171.200

;; Query time: 234 msec
;; SERVER: 192.168.1.22#53(192.168.1.22)
;; WHEN: Sat Mar 21 13:16:54 2015
;; MSG SIZE  rcvd: 42

Verify the record is now in unbound’s cache.

[root@rhce-server ~]# unbound-control dump_cache|grep fark.com
ns2.fark.com.   43197   IN  A   23.253.56.58
fark.com.   43197   IN  A   64.191.171.200
ns1.fark.com.   43197   IN  A   64.191.171.194
fark.com.   43197   IN  NS  ns1.fark.com.
fark.com.   43197   IN  NS  ns2.fark.com.
...

RHEL / CentOS 7 Network Teaming

Below is an example on how to configure network teaming on RHEL/CentOS 7. It is assumed that you have at least two interface cards.

Show Current Network Interfaces

[root@rhce-server ~]$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000
    link/ether 00:0c:29:69:bf:87 brd ff:ff:ff:ff:ff:ff
3: eno33554984: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000
    link/ether 00:0c:29:69:bf:91 brd ff:ff:ff:ff:ff:ff

The two devices I will be teaming are eno33554984 and eno16777736.

Create the Team Interface

[root@rhce-server ~]$ nmcli connection add type team con-name team0 ifname team0 config '{"runner": {"name": "activebackup"}}'

This will configure the interface for activebackup. Other runners include broadcast, roundrobin, loadbalance, and lacp.

Configure team0’s IP Address

[root@rhce-server ~]# nmcli connection modify team0 ipv4.addresses 192.168.1.22/24
[root@rhce-server ~]# nmcli connection modify team0 ipv4.method manual

You can also configure IPv6 address by setting the ipv6.addresses field.

Configure the Team Slaves

[root@rhce-server ~]# nmcli connection add type team-slave con-name team0-slave1 ifname eno33554984 master team0 
Connection 'team0-slave1' (4167ea50-7d3a-4024-98e1-3058a4dcf0fa) successfully added.
[root@rhce-server ~]# nmcli connection add type team-slave con-name team0-slave2 ifname eno16777736 master team0 
Connection 'team0-slave2' (d5ed65d1-16a7-4bc7-8c4d-78e17a1ed8b3) successfully added.

Check the Connection

[root@rhce-server ~]# teamdctl team0 state
setup:
  runner: activebackup
ports:
  eno16777736
    link watches:
      link summary: up
          instance[link_watch_0]:
        name: ethtool
        link: up
  eno33554984
    link watches:
      link summary: up
      instance[link_watch_0]:
       name: ethtool
        link: up
runner:
  active port: eno16777736

[root@rhce-server ~]# ping -I team0 192.168.1.1
PING 192.168.1.1 (192.168.1.1) from 192.168.1.24 team0: 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.38 ms
...

Test Failover

[root@rhce-server ~]# nmcli device disconnect eno16777736
[root@rhce-server ~]# teamdctl team0 state
setup:
  runner: activebackup
ports:
  eno33554984
    link watches:
      link summary: up
      instance[link_watch_0]:
        name: ethtool
        link: up
runner:
  active port: eno33554984

Configuring Postfix as a Local Network Relay

This howto assumes that the relay server’s IP address is 192.168.1.22 and is running RHEL/CentOS 7. Only mail from the 192.168.1.0/24 network should be accepted and relayed.

Install Postfix

[root@rhce-server ~]# yum install postfix

Configure Systemd

[root@rhce-server ~]# systemctl enable postfix
[root@rhce-server ~]# ^enable^start

Configure the Firewall

[root@rhce-server ~]# firewall-cmd --add-service=smtp
success
[root@rhce-server ~]# firewall-cmd --add-service=smtp --permanent 
success

Configure Postfix

Postfix’s main configuration file is located at /etc/postfix/main.cf.
Configure Postfix to listen on the correct interface.

inet_interfaces = all

Configure the trusted network.

mynetworks = 192.168.1.0/24

Configure the list of domains that this Postfix service should consider itself the final destination for. In my case the server is named rhce-server.

mydestination = rhce-server, localhost.localdomain, localhost

Configure all mail not destined for this server to be relayed to another SMTP server. I am using Time Warner Cable’s SMTP server for Northeast Ohio. The brackets tell Postfix to turn off MX lookups.

relayhost = [smtp-server.neo.rr.com]

Restart Postfix

[root@rhce-server postfix]# systemctl restart postfix

Send a Test Email

[root@rhce-server postfix]# mail -s "rhce-server test" josh@example.com
testing our null postfix configuration
.
EOT

With any luck we should be all set. You can verify the mail was successfully relayed in /var/log/maillog.

Running pfSense in Proxmox/KVM with PCI Passthrough

Below is how I was able to get pfSense 2.2 running under Proxmox 3.3 with PCI passthrough for two Intel NICs. My first attempts were trying to utilize VirtIO and e1000 network devices but the performance was abysmal. With PCI passthrough I was able to achieve native throughput in my environment.
I am assuming that you have Proxmox running and a pfSense virtual machine already created.

Configure the Proxmox Test Repository

The first thing we need to do is enable the Proxmox test repository so that we may install the 3.10 kernel.

echo 'deb http://download.proxmox.com/debian wheezy pvetest' >> /etc/apt/sources.list

Install the 3.10 Kernel

apt-get install pve-kernel-3.10.0-6

Edit Grub Configuration

We need to pass a kernel flag to enable IOMMU. In my case I am using an AMD processor and added amd_iommu=on to the following line in /etc/default/grub. If you are using an Intel processor you would add intel_iommu=on.

GRUB_CMDLINE_LINUX_DEFAULT="quiet amd_iommu=on"

Update the Grub configuration

update-grub

Reboot the server. By default the 3.10 kernel should be selected.

Identify Your NICs

Identify the PCI devices you want to passthrough to your virtual machine.

lspci

In my case I was looking for my Intel NICs.

lspci | grep Intel

03:00.0 Ethernet controller: Intel Corporation 82541PI Gigabit Ethernet Controller (rev 05)
04:00.0 Ethernet controller: Intel Corporation 82541PI Gigabit Ethernet Controller (rev 05)

You will need to note their addresses.

Edit the Virtual Machine Configuration

Below is an example of my working configuration. You can find these configurations in /etc/pve/qemu-server/. The file you are looking for will correspond with the virtual machine ID. In my case 100.conf.

boot: cdn
bootdisk: ide0
cores: 2
cpu: qemu32
hostpci0: 03:00.0,pcie=1,driver=vfio
hostpci1: 04:00.0,pcie=1,driver=vfio
ide0: local:100/vm-100-disk-1.qcow2,format=qcow2,size=16G
ide2: local:iso/pfSense-LiveCD-2.2-RELEASE-i386.iso,media=cdrom,size=206916K
machine: pc-q35-2.0
memory: 1024
name: pfSense
onboot: 1
ostype: other
smbios1: uuid=0f590e3e-88a0-4084-8a6f-f5a2380a01fa
sockets: 2
tablet: 0

Notice that I added the hostpci0, hostpci1, and machine options. The hostpciX options identify which PCI devices we want to passthrough. As we found above I was looking for my NICs at 03:00.0 and 04:00.0. The machine must be set to pc-q35-2.0 for PCI passthrough to work with FreeBSD from my experience.

Conclusion

With those options set you should be able to boot your pfSense virtual machine and see your PCI devices natively.

Using Apache as a Reverse Proxy with SiteMinder for Authentication

When using Apache as a reverse proxy to pass authentication to another application from SiteMinder you may need to send the header variable to your application. By default Apache is not passing these variables on and you need to set them up for your proxy.

RequestHeader set REMOTE_USER %{HTTP:UID}s

Above is an example of the variable UID being returned by SiteMinder and being assigned to the variable REMOTE_USER that will be provided to the end application.

Detect a New Disk and Grow a Filesystem in Linux without Rebooting

If you have ever wanted to add a new hard disk to a Linux VMware guest without rebooting here is the solution. After running this command you should be able to use the new disk as you please. This is really useful for growing an LVM filesystem on the fly.
Run this command after adding the new disk to you VMware configuration. This will allow your Linux guest to detect the new disk and assign it as a device.

ls /sys/class/scsi_host/ | while read host ; do echo "- - -" > /sys/class/scsi_host/$host/scan ; done

Once you have ran this command you can grow the LVM filesystem as usual. (Where X is the new device added.)

# Create a new partition on the new disk. Assign it the type of Linux LVM, 8e.
fdisk /dev/sdX

# Create the new physical volume.
pvcreate /dev/sdX1

# Extend the volume group of your choice.
vgextend /dev/VolumeGroupName /dev/sdX1

# Confirm the new physical extents are available and take note of the number.
vgdisplay

# Extend a logical volume where 1234 is the number of PEs you would like to add.
lvextend -l +1234 /dev/VolumeGroupName/LogVolName

# Resize the EXT filesystem.
resize2fs /dev/VolumeGroupName/LogVolName

# Confirm the new space is available.
df -h

Once complete you should have extra space on your Linux guest.

Recursive Directory/File Permissions

I’m constantly needing to recursively set different permissions on files and directories to make suPHP happy. I’m posting this here for easy reference.

# Directories
find . -type d -exec chmod 755 {} +

# Files
find . -type f -exec chmod 644 {} +

Why I Chose Unraid for my Home Storage Solution

Unraid

Description

Unraid is a Slackware Linux based operating system that provides an easy way to create network attached redundant storage. It's best suited for archival purposes. It allows for the loss of one disk without losing data.

Unraid has three different licenses you can use, Basic (free), Plus ($69), and Pro ($119). Look at the license page for a description on how they differ.

Advantages

• Runs off of a USB flash drive. You don't lose a SATA port or disk for the operating system.
• Mix and match hard drives and sizes. You can put drives of any size in the array. You only lose the largest disk in the array for parity. (Similar to a Drobo)
• Web interface. A simple web interface lets you configure everything.
• Supports various protocols including SMB, AFP, and NFS.
• No vendor lock-in. Although you're using the proprietary Unraid system, all data is stored on the disks in the ReiserFS filesystem
• Since it's using ReiserFS, if you lose more than one disk at a time you'll be able to get data off the rest of the disks in the broken array.
• Use your own hardware. I built a little server with an Atom processor for less than the price of the cheapest Drobo.
• Set it and forget it. I've had my system running for almost two years
• Stable. I set mine up and have basically forgotten about it. It just works and has been since May 2011 when I configured it.
• Spins down drives when not in use, unlike RAID-5.
• Support and community. There's a very active forum and wiki to help you with any issues, add additional functionality, and much more.

Disadvantages

• Price could be. I purchased the $70 license. If you only have 3 disks and don't require some of the extra features, there is a free version.
• Write speeds. If you have the need to push stuff to the server at more than 30MB/sec, this may not be the best choice. If you're just archiving stuff, it really is not an issue. You can also speed the writes up with a cache drive.

Why I Chose Unraid

Throughout my history of having redundant storage at home I've had two previous setups that really failed me.

Linux Software RAID-5

Linux software RAID is great, but I had two drives fail at once. I lost everything. With Unraid I would've been able to recover some of the data on the drives that had not failed. You also cannot mix and match drive sizes and the disks never spin down.

Drobo

I had the second generation Firewire 800 Drobo. Transfer speeds were horrible. It still needed a computer running to serve data. I accidentally plugged the wrong power supply into it and it stopped working. I was now stuck buying another expensive Drobo to get my data or coming up with another solution. That is when I found Unraid.

The Drobo is actually a really nice device. The newer ones are supposed to be a lot faster and some even have sharing capabilities. It's just too expensive and they've got you with vendor lock-in.

Links

If I haven't sold it to you yet, here's a few links to learn more about Unraid.

• Guide: Unraid Server
• Non-standard RAID Levels
• Unraid Me: How to build your own Unraid box

MySQL: Change Collation on an Existing Table

I recently ran across an issue where a table's collation was set to latin1_swedish_ci and it really should have been utf8_unicode_ci. Just changing the collation didn't seem to be doing the trick because some characters were still messed up. That's when I realized you need to convert the current character set to UTF8. After doing this everything worked as expected.

ALTER TABLE table_name CONVERT TO CHARACTER SET utf8 COLLATE utf8_unicode_ci

Configure PhpStorm to Auto-complete CakePHP Models, Views, and Controllers

After playing around a bit today I finally figured out how to get PhpStorm to auto-complete methods for models and controllers. Here's what you need to do.

Removing Multiple Definitions

First, let's tackle the multiple definitions problem that we see below.

There are multiple places defining AppController. We need to remove the ones that are included in the following locations from our 'Directories' in the project's settings.

The two locations are:

• $CAKEHOME/cake/console
• $CAKEHOME/cake/tests

Next we need to mark the following file as plain text.

• $CAKEHOME/cake/libs/controllers/app_controller.php

You should now see that PhpStorm is no longer complaining about multiple definitions. If it is you may want to check your plugins/components to see if they're mucking it up. If they are, just mark the file with the definition as plain text.

Auto-completion should now work for the controller. However, it's still not working correctly on our model.

Adding the Model

To fix the model we need to add a magic property to the class.

 /**  
 *@property ModelName $ModelName  
 */  

Here's an example from the controller we've been working in.

 We can now auto-complete on our models in the controller.

Defining Model Relationships

Lastly, we need to add magic properties to our models to define its relationships with other models. Basically, for each "belongs to" relationship defined in the model's file you need to add the magic property comment.

We can now auto-complete these relationships.

Setting Up Helper Auto-completion in Views

To get auto-completion working in views we need to include a file created by junichi11 over at GitHub.

Download this file and save it in a directory somewhere outside of your current project. I did this so I could use the same file on multiple projects.

• CakePHP Helper Code Completion

Now add that directory to your current project.

Open a view file and add the following variable definition.

 /**  
 *@var $this View  
 */  

You should now be able to auto-complete helpers in your view!

Core Component Auto-Completion

Add the following to your app_controller.php file and this will add component auto-completion.

 /**  
  * CakePHP Component & Model Code Completion  
  * @author junichi11  
  *  
  * ==============================================  
  * CakePHP Core Components  
  * ==============================================  
  * @property AuthComponent $Auth  
  * @property AclComponent $Acl  
  * @property CookieComponent $Cookie  
  * @property EmailComponent $Email  
  * @property RequestHandlerComponent $RequestHandler  
  * @property SecurityComponent $Security  
  * @property SessionComponent $Session  
  */  

SABnzbd URL Bookmarklet (NZBMatrix)

Here's a simple bookmarklet that will take the URL of the current page you're on and tell SABnzbd to download it. It works great if you're using NZBMatrix and on the page for the post you're wanting to download. Perfect for your mobile browser.

javascript:location.href='http://yourhost:8080/api?mode=addurl&name='+encodeURIComponent(location.href)+'&apikey=yourapikey';  

Be sure to insert your SABnzbd API key and hostname (or IP address) into the bookmarklet's code.

Perl Find and Replace One Liner

I'm constantly needing a way to easily change a line in a bunch of configuration files. I thought I'd share the way I do it here.

perl -p -i -e 's/oldstring/newstring/g' *

This allows you to use a regular expression and perform the find and replace.

HOWTO: Set the SSHD Idle Timeout

Here's something that I usually forget to change from the default and then get annoyed when my terminal hangs.

1. As root open your sshd_config file in an editor.
   

   su -  
   vim /etc/ssh/sshd_config  
   



2. Add the following lines.
   

    ClientAliveInterval 600  
    ClientAliveCountMax 3



3. Restart the sshd process.
   

    service sshd restart

That's it. That will keep you logged in for 30 minutes at a time without activity. (600 seconds x 3)

M3U Playlist Copy Script

A couple of months ago I picked up a Garmin Nuvi 760 on the cheap. As it turns out this great GPS unit can also play music quite well, especially for riding on the motorcycle. The only problem was there was no good way to get playlists on the device that I could find. Enter the following bash script. This script will read an m3u file, copy all associated mp3 files, and generate a new m3u file. Now all I have to do is specifiy m3u files that I exported from Mozilla Songbird and the path to the Garmin's SD card.

 #!/bin/bash  
 # April 4, 2009  
 # m3u_cp.sh  
 #  
 # Take an m3u file and copy all associated mp3 files  
 # to a destination directory and generate a new m3u.  
 #  
 # Used to copy m3u playlists from computer to Garmin.  
 if [ $# -lt 2 ]; then  
 echo "Usage: m3u_cp.sh some.m3u /dst"  
 exit 0  
 fi  
 # Read the m3u file into an array  
 declare -a M3U  
 exec 10<"$1"  
 let count=0  
 while read LINE <&10; do  
 M3U[$count]=$LINE  
 ((count++))  
 done  
 exec 10>&-  
 # Determine the m3u's filename  
 if [[ $1 =~ [^/]*m3u ]]; then  
 m3u_path="$2/$BASH_REMATCH"  
 fi  
 # If playlist arleady exists, delete it  
 if [ -f "$m3u_path" ]; then  
 rm -f "$m3u_path"  
 fi  
 # Loop through the m3u lines  
 i=0  
 while [ $i -lt ${#M3U[@]} ]; do  
 # The current line is a comment, do nothing with it  
 if [ ${M3U[$i]:0:1} = "#" ]; then  
 echo ${M3U[$i]} >> "$m3u_path"  
 #Current line is a path to an mp3 file  
 else  
 # Get the current songs filename  
 if [[ ${M3U[$i]} =~ [^/]*mp3 ]]; then  
 song=$BASH_REMATCH  
 mpath=$( echo ${M3U[$i]} | tr -d '\r' )  
 # if the song doesn't exist, copy it to the desitnation folder  
 if [ -f "$2/$song" ]; then  
 echo File Exists -- $song  
 else  
 echo Copying -- $song  
 cp "$mpath" "$2/$song"  
 fi  
 # Write the song in the m3u file  
 echo $song >> "$m3u_path"  
 else  
 echo "The regex for finding the song's filename is fraked up."  
 fi  
 fi  
 let i=i+1  
 done  
 exit 0  

In the middle of writing this I really started wondering why I used bash. Perl would've been a lot easier.

SVN+SSH Howto: Subversion Quick and Simple

Here's a quick and simple way to create a Subversion repository while maintaining security by using SSH and the filesystem permissions.

1. Create users and add them to a group. There are a bunch of different ways to do this. I am only showing you how to create a group.

   groupadd svn-users



2. Make a directory to house the repository.

   mkdir /var/lib/project



3. Create the repository.

   svnadmin create /var/lib/project



4. Change permissions to allow the group read/write access.

   cd /var/lib/project
   chgrp svn-users db db/transactions db/write-lock db/revs db/revprops hooks locks
   chmod 2770 db db/transactions db/revs db/revprops
   chmod 660 db/write-lock
   chmod 750 hooks
   chmod 770 locks

You can now have your users access the repository over SSH.

svn+ssh://username@server.example.com/var/lib/project

If your clients are on Windows, I recommend using TortoiseSVN.

Credit goes to the Carnival of Technology.

HTTP to HTTPS Forwards Please

Why do some sites that require a secure connection not automatically forward you to the secure site? How hard is it to do? Not very! (with Apache at least)

 #How about a simple .htaccess file in the webroot?  
 #Force SSL for example.hwarf.com  
 RewriteEngine On  
 RewriteBase /  
 RewriteCond %{HTTPS} !=on  
 RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

Hopefully some sites will pay attention to this. I'm not mentioning any URLs.

Time Warner Cable / Road Runner - The Rip Off

After 6 months with Time Warner Cable's Road Runner Internet service at home I was hit with a nice surprise. Month 7th would cost me $70.95, instead of the $44.95 that was/is advertised on their site. For some reason my location does not get their standard pricing. While my initial service was great, below I've identified some issues I have with Time Warner that has led me to cancel my account.

• Their 800 Number - Whenever I try to call their customer support number I have to call at least five to ten times to get through. For some reason I keep getting a busy signal. Annoying!


• Hold Times - It takes about 10-15 minutes to get someone on the phone. I really wish I would've bought a speakerphone.


• Getting Bounced Around - During my first of three calls I was bounced around to three different operators that could not help me. However, before I reached the third person I was conveniently lost in phone-space and had to call back.


• Lack of Logic - There was no good explanation as to why the Road Runner service costs so much more in my area than someone who lives a couple miles from me.


• Customer Support Staff - While the staff was very nice, they were unable to help me. It was quite frustrating having someone tell me, "I agree that $70.95 is ridiculous and I have no idea why it is priced that way. I can understand why you would want to cancel."

As of next week I will no longer be a Road Runner customer and have since signed up with the Windstream Greenstreak service. The biggest disappointment about their DSL service is that they claim I only qualify for 3Mbps service. After living with 7Mbps and 15Mbps for the last year and a half, 3Mbps is going to feel pretty slow. I guess no more streaming HD movies from the iTunes store to the AppleTV.

Googlebot and FreeDNS from afraid.org

Back on January 8th I canceled my Dreamhost account and began hosting my site off of my cable modem. Only receiving ~15 hits a day I figured I might as well save myself $120 a year. So I chose freedns.afraid.org to host my DNS. They were free and had all the options that I wanted, including working with Tomato.

After the switch I noticed that my traffic had declined dramatically, down to ~1 hit per day. So I starting doing a bit of investigating and found that Google was no longer crawling my site and had deleted my previous results. Logging into the Google Webmaster Tools I found that Google was having DNS issues connecting to my site. Well, after pulling my hair out for an evening I found that FreeDNS was blocking the googlebot from crawling my site.

Solution: I have switched my DNS provider to ZoneEdit. ZoneEdit offers similar features to that of FreeDNS. Now Google can access my site again, but I'm no longer in the results for some searches. I guess it will take some time. Yahoo and Live search were totally unaffected by FreeDNS.

So this is a warning to all people using FreeDNS and want Google to crawl their site.

Installing Netbackup Enterprise Server 6.5 on CentOS 5 / RHEL 5 withSELinux

It took me almost a whole day to come up with this solution. This should get Veritas Netbackup Enterprise Server 6.5 up and running on a CentOS 5 / RHEL 5 box with SELinux enabled.


HOWTO: Server

1. Install a couple of dependencies:
   

   yum install compat-libstdc++-296 xinetd libXp 



2. Make sure that the hostname is set correctly. This is very important.


3. Temporarily disable SELinux:
   

   setenforce 0



4. Untar the installation files:
   

   tar xvf NetBackup_6.5_LinuxRedhat2.6.tar.gz
   tar xvf NetBackup_6.5_ICS_LinuxX86.tar.gz



5. Start the installation:
   

    ./NB_65_LinuxR_x86_20070723/install
   .....
   #ICS Directory: ./NB_65_ICS_1.4.37.0_LinuxX86/

   
   


6. Fix SELinux:
   

   chcon -t textrel_shlib_t /usr/openv/lib/*
   setenforce 1

   
   


7. Start Netbackup:
   

   /etc/init.d/netbackup start

HOWTO: Client

1. Untar the installation file:
   

   tar xvf NetBackup_6.5_CLIENTS2.tar.gz



2. Start the installation:
   

   NB_65_CLIENTS2_20070723/install



3. Fix SELinux issues:
   

   chcon -t textrel_shlib_t /usr/openv/lib/*



4. Start the client:
   

   /etc/init.d/nbclient start

SELinux, Apache, phpMyAdmin, and a Remote MySQL Server

Today I ran into a little problem with phpMyAdmin talking to a remote MySQL server on a CentOS 5 machine. When I would try to connect to the server it would say that the host could not be reached. However, if I used the mysql cli I was able to connect. It turns out that the SELinux policy was prohibiting me from accomplishing this.

To fix this problem you need to modify the policy with the following command.

setsebool -P httpd_can_network_connect=1

This change is instant and persistent, so it will survive a reboot.