CSV файл со списком всех виртуальных маших и выделенных под них ресурсов
pvesh get /cluster/resources --type vm --output-format json > /tmp/vm_exp_list.json
cat vm_exp_list.json | jq -r 'sort_by(.vmid)|.[]|select(.status == "running")| [.vmid, .node, .name, .maxcpu, .maxmem, .maxdisk]|@csv'
Общая схема:
host-sflow -> sFlow -> goflow2 collector -> kafka protobuf -> clickhouse
https://github.com/netsampler/goflow2
NetFlow/IPFIX/sFlow collector in Go
docker run --net=host -ti netsampler/goflow2:latest -transport=kafka -transport.kafka.brokers=localhost:9092 -transport.kafka.topic=nflow -format=pb -format.protobuf.fixedlen=true
CREATE TABLE IF NOT EXISTS nflow.flows_kafka(time_received UInt64,time_flow_start UInt64,sequence_num UInt32,sampling_rate UInt64,sampler_address FixedString(16),src_addr FixedString(16),dst_addr FixedString(16),src_as UInt32,dst_as UInt32,etype UInt32,proto UInt32,src_port UInt32,dst_port UInt32,bytes UInt64,packets UInt64) ENGINE = Kafka()SETTINGSkafka_broker_list = '127.0.0.1:9092',kafka_topic_list = 'nflow',kafka_group_name = 'clickhouse',kafka_format = 'Protobuf',kafka_schema = 'flow.proto:FlowMessage',kafka_skip_broken_messages = 1;CREATE TABLE IF NOT EXISTS nflow.flows_raw(date Date,datetime DateTime,sequence_num UInt32,sampling_rate UInt64,sampler_address String,src_addr String,dst_addr String,src_as UInt32,dst_as UInt32,etype UInt32,proto UInt32,src_port UInt32,dst_port UInt32,bytes UInt64,packets UInt64) ENGINE = MergeTree()PARTITION BY dateORDER BY datetimeTTL date + toIntervalDay(30)SETTINGS index_granularity = 8192;CREATE MATERIALIZED VIEW IF NOT EXISTS nflow.flows_raw_mv TO nflow.flows_rawAS SELECTtoDate(time_received) AS date,time_flow_start AS datetime,sequence_num,sampling_rate,IPv4NumToString(reinterpretAsUInt32(substring(reverse(sampler_address), 13, 4))) AS sampler_address,IPv4NumToString(reinterpretAsUInt32(substring(reverse(src_addr), 13, 4))) AS src_addr,IPv4NumToString(reinterpretAsUInt32(substring(reverse(dst_addr), 13, 4))) AS dst_addr,src_as,dst_as,etype,proto,src_port,dst_port,bytes,packetsFROM nflow.flows_kafka;
Используем host-sflow
cat /etc/hsflowd.conf
sflow {
collector { ip=goflow2.host.example.com udpport=6343 }
# ====== Local configuration ======
pcap { dev = eth0 }
pcap { dev = eth1 }
# ...
}
systemctl enable hsflowd
systemctl start hsflowd
Активные сборщики флоу
select sampler_address,count() from nflow.flows_raw where datetime>now()-24*3600 group by sampler_address limit 100;
Найти источник запросов на список внешних ресурсов
select src_addr,count() from nflow.flows_raw where datetime>now()-24*3600 and dst_addr in ('1.1.1.1','8.8.8.8') group by src_addr order by count() desc limit 100;
Столкнулся с невозможностью подключиться по ssh к нодам k8s под определённым юзером:
ssh user@10.0.0.10
shell request failed on channel 0
Выяснилось, что UID пользователя user был использован в docker image одного из сервисов.
Быстрое решение увеличить лимиты числа процессов для рядовых пользователей в Centos 7, например, на 8192:
/etc/security/limits.d/20-nproc.conf
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.
* soft nproc 4096
root soft nproc unlimited
id 200 - proxmox template
id 201 - VM with Linked Clone disk
zfs list -o name,origin
...
rpool/data/vm-201-disk-0 rpool/data/base-200-disk-0@__base__
nmcli con add type bond con-name bond0 ifname bond0
nmcli con modify bond0 bond.options "mode=802.3ad,xmit_hash_policy=layer2+3,miimon=100,lacp_rate=1"
nmcli con add type ethernet slave-type bond con-name bond0-eno1 ifname "eno1" master bond0
nmcli con add type ethernet slave-type bond con-name bond0-eno2 ifname "eno2" master bond0
nmcli con mod bond0 ipv4.method disabled
nmcli con mod bond0 ipv6.method ignore
nmcli con add type vlan con-name bond0.2222 ifname bond0.2222 dev bond0 id 2222
nmcli con mod bond0.2222 ipv4.addresses '10.0.0.5/24'
nmcli con mod bond0.2222 ipv4.gateway '10.0.0.1'
nmcli con mod bond0.2222 ipv4.dns '8.8.8.8,8.8.4.4'
nmcli con mod bond0.2222 ipv4.method manual
Столкнулся с ошибкой приложения при работе с БД в схеме Percona xtradb cluster + Haproxy при рестарте одной из нод кластера
app.CRITICAL: An exception occurred while executing a query: SQLSTATE[08S01]: Communication link failure: 1047 WSREP has not yet prepared node for application use
backend bk_mysql
mode tcp
option mysql-check user haproxy
default-server slowstart 30s weight 100
server mysql-1 10.0.0.11:3306 check
server mysql-2 10.0.0.12:3306 check
...haproxy после перевода бэкенда в UP за указанный промежуток времени линейно поднимет его вес с 0 до 100%, что значительно снизит число ошибок до перехода ноды в wsrep_ready ON.
RTFM: https://www.haproxy.com/blog/use-haproxy-response-policies-to-stop-threats/#reject
frontend xxx_ft
bind 10.0.0.10:29000
mode tcp
acl whitelist src 10.0.0.0/24
tcp-request connection reject if !whitelist
use_backend xxx_bk
backend xxx_bk
mode tcp
server ctcmedia 10.0.0.20:9000
#!/bin/shИдея скрипта: http://discussions.citrix.com/topic/371712-xenserver-low-root-disk-space-cleaup-script-for-patches/
PATCHLIST=`xe patch-list params=uuid | awk '{print $5}'`
for UUID in $PATCHLIST
do
echo "Cleanup patch $UUID"
xe patch-pool-clean uuid=$UUID
done
# ls /var/patch/Содержимое каталога /var/patch/applied не трогать и не удалять!
applied
.ade, .adp, .bat, .chm, .cmd, .com, .cpl, .exe, .hta, .ins, .isp, .jar, .js, .jse, .lib, .lnk, .mde, .msc, .msp, .mst, .pif, .scr, .sct, .shb, .sys, .vb, .vbe, .vbs, .vxd, .wsc, .wsf, .wsh
.zip, .rar, .7z.
VirusName:ContainerType:ContainerSize:FileNameREGEX:
FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:
Res1:Res2[:MinFL[:MaxFL]]
Полный список http://pastebin.com/Bisxq1ezrules_block_exe:CL_TYPE_MAIL:*:\.[Ee][Xx][Ee]$:*:*:*:*:*:*rules_block_Zip_exe:CL_TYPE_ZIP:*:\.[Ee][Xx][Ee]$:*:*:*:*:*:*rules_block_Rar_exe:CL_TYPE_RAR:*:\.[Ee][Xx][Ee]$:*:*:*:*:*:*
VirusAction: /etc/clamav/script.sh
#!/bin/sh
DOMAIN=domain.com
# Notification receiver
ADMIN=postmaster@domain.com
# E-mail sending function
alert_send() {
( cat <<EOF;
To: $RECIPIENT
Reply-To: $ADMIN
Subject: =?UTF-8?B?`echo -n $SUBJECT | base64`?=
Content-Type: multipart/mixed; boundary=simple boundary
This is a multi-part message in MIME format.
--simple boundary
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
`echo -n $DATA | base64`
--simple boundary
EOF
) | sendmail -t -oi
}
# E-mail to Administrator
SUBJECT="Письмо добавлено в карантин"
DATA="<p><b>Причина блокировки или имя вируса:</b> $VIRUS<br> \
<b>Отправитель:</b> $SENDER<br> \
<b>Получатель:</b> $RECIPIENTS<br><br> \
<b>Перемещено в карантин:</b> $EMAIL<br><br>"
RECIPIENT=$ADMIN
alert_send
# E-mail to User
for RECIPIENT in $RECIPIENTS
do
if [ X`echo $RECIPIENT | egrep @$DOMAIN$` != "X" ];
then
SUBJECT="Письмо добавлено в карантин"
DATA="<p><b>Отправитель:</b> $SENDER<br> \
<b>Получатель:</b> $RECIPIENTS<br><br> \
<b>Перемещено в карантин:</b> $EMAIL<br><br> \
Письмо не доставлено и перемещено в карантин из-за подозрительного вложения.<br> \
Если вы уверены, что это ошибка, свяжитесь с отделом ИТ."
alert_send
fi
done
# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 4.0G 2.2G 1.6G 59% /
# xe patch-list params=uuid
uuid ( RO) : d3c08fcb-daa0-4410-bdb2-c298109e88ad
...
# xe patch-clean uuid=<uuid>
# cd /var/log/
# rm -rf *.gz
# cd /tmp/
# rm -rf *.log
C:\Program Files (x86)\Citrix\XenCenter>xe --nossl -s xen-master -u root -pw password vm-import filename=D:\backup\VM.xva sr-uuid=b3bb3595-02f6-e68f-52fb-d8fb77cb1e53 preserve=trueгде:
cc90231d-e0c6-1249-5a2a-08d877af9df4
$SERVER["socket"] == "0.0.0.0:443" {Информация по HSTS доступна на Wikipedia.
ssl.engine = "enable"
ssl.ca-file = "/etc/lighttpd/pki/ca-certs.crt"
ssl.pemfile = "/etc/lighttpd/pki/ssl.crt"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "enable"
ssl.use-compression = "disable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
}
#Включение HSTS
server.modules += ( "mod_setenv" )
$HTTP["host"] == "domain.net" {
$HTTP["scheme"] == "https" {
setenv.add-response-header = ("Strict-Transport-Security" => "max-age=31536000; includeSubDomains")
}
}
nslookup имя_домена. [опрашиваемый dns]
dig ns1.jixhost.com +noall +answer
; <<>> DiG 9.6.1 <<>> ns1.jixhost.com +noall +answer
;; global options: +cmd
ns1.jixhost.com. 172774 IN A 173.192.14.178
