Do, or do not. There is no ‘try’

#!/bin/sh
# SARG – Daily/Weekly/Monthly Squid usage reports creation tool
# Written by Ugo Viti

# —————————————————————————-
#
# Copyright (C) 2005 Ugo Viti
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# —————————————————————————-

# Thanks for enanchements to:
# – martijn
# – Stas Degteff https://sourceforge.net/users/stas_degteff/

VER=20050202

## What is this?
# sarg-reports (this file) is a simple bash script written to automate
# the SARG (a powerful squid log analyzer) reports and log management.
# Sarg it self, provide to end user a generic interface to create
# reports based on squid access log (begin of log to current date).
# sarg-reports (this script) is useful because it allow you to easly
# create and manage Daily, Weekly and Monthly reports.
# Try it, within 5 minutes you will be ready to rule
# using sarg-reports is very easy, read the following 3 steps to know how

## Requirements
# a) An unix system with bash shell (like GNU/Linux, FreeBSD, etc…)
# b) Squid – http://www.squid-cache.org
# c) Sarg – http://web.onda.com.br/orso/sarg.html

##
## Installation guide and configuration parameters
##

# 1) Download Squid and Sarg, Install, Configure and Tune
# they before continue reading

# 2) In root crontab (crontab -e) insert the following lines:
# (the today report creation time depend mostly of your squid server
# load average, tune it):
#
# — BEGIN ROOT CRONTAB —
# PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
# 00 08-18/1 * * * sarg-reports today
# 00 00 * * * sarg-reports daily
# 00 01 * * 1 sarg-reports weekly
# 30 02 1 * * sarg-reports monthly
# — END ROOT CRONTAB —
#
# REMEMBER: if you use logrotate, configure it to rotate the logs within MONTHLY basis,
# AFTER sarg-reports created the monthly html report.

# 3) Customize the following variables:
# (Please, configure accurately the sarg.conf file before)
#
# (SARG) The sarg executable location
# (CONFIG) The sarg main configuration file location
# (HTMLOUT) Location where will be saved the reports
# (PAGETITLE) The title of main index page
# (LOGOIMG) Image logo to view in main index page
# (LOGOLINK) HTTP web page link of logo
# (DAILY) Word ‘daily’ translation, translate it to your language
# (WEEKLY) Word ‘weekly’ translation, translate it to your language
# (MONTHLY) Word ‘monthly’ translation, translate it to your language
# (EXCLUDELOG1) Exclude text from cron emails
# + (normally, sarg, during cron activity, if it don’t find any valid records,
# (EXCLUDELOG2) it will output an error message (usually on ‘today’ reports).
# I don’t want to be warned by email about this, so, i wrote the ‘text’
# that will be never logged.
# This is useful to receive email of real problems only (enjoy that)

#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## Italian Language
SARG=/usr/bin/sarg
CONFIG=/etc/sarg/sarg.conf
HTMLOUT=/var/www/html/admin/log/proxy
PAGETITLE=”Statistiche Proxy di $(hostname)”
LOGOIMG=http://www.initzero.it/images/initzero-logo.jpg
LOGOLINK=http://www.initzero.it
DAILY=Giornaliero
WEEKLY=Settimanale
MONTHLY=Mensile
EXCLUDELOG1=”SARG: Nessun records trovato.”
EXCLUDELOG2=”SARG: Fine”
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## Russian Language
# SARG=”/usr/bin/sarg”
# CONFIG=/etc/sarg/sarg.conf
# HTMLOUT=/var/www/sarg-reports
# PAGETITLE=”óÔÁÔÉÓÔÉËÁ ÓÅÒ×ÅÒÁ ÐÒÏËÓÉ Squid” # russian koi8-r
# LOGOIMG=http://litek.ru/images/logotop.gif
# LOGOLINK=http://litek.ru
# DAILY=”åÖÅÄÎÅ×ÎÁÑ” # russian koi8-r
# WEEKLY=”åÖÅÎÅÄÅÌØÎÁÑ” # russian koi8-r
# MONTHLY=”åÖÅÍÅÓÑÞÎÁÑ” # russian koi8-r
#EXCLUDELOG1=”SARG: Records in file:”
#EXCLUDELOG2=”SARG: ïÔÞÅÔ ÕÓÐÅÛÎÏ ÓÇÅÎÅÒÉÒÏ×ÁÎ ×” # sarg.conf: language Russian_koi8
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

######################################################################
## The configuration is end, so don’t touch anything bellow

# TEMP Files
TMPFILE=/tmp/sarg-reports.$RANDOM
ERRORS=”${TMPFILE}.errors”

# Date Calc
MANUALDATE=$2
case “$(uname)” in
“FreeBSD”)
TODAY=$(date +%d/%m/%Y)
YESTERDAY=$(date -v-1d +%d/%m/%Y)
WEEKAGO=$(date -v-1w +%d/%m/%Y)
MONTHAGO=$(date -v-1m +01/%m/%Y)-$(date -v-1m +31/%m/%Y)
;;
“OpenBSD”)
TODAY=$(date +%d/%m/%Y)
YESTERDAY=$(date -r $((`date +%s` – 86400 )) +%d/%m/%Y)
WEEKAGO=$(date -r $((`date +%s` – 604800)) +%d/%m/%Y)
MONTHAGO=$(perl -e ‘@t=localtime(time); $y=$t[4]==0?$t[5]+1899:$t[5]+1900; $m=$t[4]==0?12:$t[4]; print “1/$m/$y-”,$m==2?$y%4>0?28:29:$m==4||$m==6||$m==9||$m==11?30:31 ,”/$m/$y\n”;’)
;;
*)
TODAY=$(date –date “today” +%d/%m/%Y)
YESTERDAY=$(date –date “1 day ago” +%d/%m/%Y)
WEEKAGO=$(date –date “1 week ago” +%d/%m/%Y)
MONTHAGO=$(date –date “1 month ago” +01/%m/%Y)-$(date –date “1 month ago” +31/%m/%Y)
;;
esac

# Fix for Red Hat 9 systems and coreutils prior to 5.0 version
export LC_ALL=C

# Main index.html creation
create_index_html ()
{
echo -e “\
\n\
\n\
\n\
\n\
\n\

\n\
\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

\n\

$PAGETITLE
$DAILY
$WEEKLY
$MONTHLY

\n\

\n\
\n\
” > $HTMLOUT/index.html
}

# Functions
exclude_from_log ()
{
cat $ERRORS | grep -v “$EXCLUDELOG1″ | grep -v “$EXCLUDELOG2″
rm -f $TMPFILE*
}

manual ()
{
DAILYOUT=$HTMLOUT/$DAILY
mkdir -p $DAILYOUT
create_index_html
if [ -z "$MANUALDATE" ]
then
echo “No date given, please specify a valid date (DD/MM/YYYY)”
else
$SARG -f $CONFIG -d $MANUALDATE -o $DAILYOUT
fi
}

today ()
{
DAILYOUT=$HTMLOUT/$DAILY
mkdir -p $DAILYOUT
create_index_html
$SARG -f $CONFIG -d $TODAY -o $DAILYOUT >$ERRORS 2>&1
exclude_from_log
}

daily ()
{
DAILYOUT=$HTMLOUT/$DAILY
mkdir -p $DAILYOUT
create_index_html
$SARG -f $CONFIG -d $YESTERDAY -o $DAILYOUT >$ERRORS 2>&1
exclude_from_log
}

weekly ()
{
WEEKLYOUT=$HTMLOUT/$WEEKLY
mkdir -p $WEEKLYOUT
create_index_html
$SARG -f $CONFIG -d $WEEKAGO-$YESTERDAY -o $WEEKLYOUT >$ERRORS 2>&1
exclude_from_log
}

monthly ()
{
MONTHLYOUT=$HTMLOUT/$MONTHLY
mkdir -p $MONTHLYOUT
create_index_html
$SARG -f $CONFIG -d $MONTHAGO -o $MONTHLYOUT >$ERRORS 2>&1
exclude_from_log
}

case $1 in
manual)
manual
;;
today)
today
;;
daily)
daily
;;
weekly)
weekly
;;
monthly)
monthly
;;
*)
echo “SARG – Daily / Weekly / Monthly – Squid proxy usage reports creation tool”
echo “Written by Ugo Viti “
echo “Version: $VER”
echo
echo “Usage: $0 [OPTIONS]“
echo
echo “Allowed options:”
echo ” manual, Create Manual report”
echo ” today, Create Today report”
echo ” daily, Create Daily report”
echo ” weekly, Create Weekly report”
echo ” montly, Create Monthly report”
exit 0
esac

## HISTORY:
# 20050502 – Stas Degteff added support for non latin Charset and added support for OpenBSD
# 20030826 – FreeBSD support (thanks to martijn to let me coding on your FreeBSD server )
# 20030715 – Some cleanups
# 20030623 – Manual report creation
# 20030620 – Main Index creation
# 20030619 – Solved ’sort’ bug on Red Hat 9 systems
# 20030618 – First Version

## TODO:
# – Smarty weekly recognition…
# Like “begin of last week to end of last week”,
# doesn’t like this script do: “7 days ago to yesterday”
# – Monthly recognition isn’t so elegant (is very ugly, i know)
# – Suggestions are welcome
# – If you Rotate the squid logs before sarg-reports will run,
# it will not create any html reports
# (TIPS: Rotate the logs after sarg-reports)

A machine connected to the Internet that isn’t behind a firewall is a disaster waiting to happen. And you won’t have to wait long. A recent study by the Internet Storm Center has shown that unpatched Windows computers only lasted 20 minutes before they were infected by some malware. If you’re running Linux, you’re going to have more time, but something bad is bound to happen. The most likely outcome of being out there unprotected is a denial of service attack. Script kiddies are not picky about whose machine they knock off line. If fact, most of these young cyber hoodlums don’t even know how how they’re able to do it. They just know that the cute toys they download will do it. If you don’t want to have your box at the mercy of some anti-social kid who bathes much less frequently than you, it’s time to learn how to get a firewall going.
Netfilter and iptables

The best tool currently available to create a firewall is the Netfilter/iptables combination. Netfilter is software that works with the kernel in order to control network packets. iptables lets you create rules to filter packets and packet content based on a number of criteria. You will need to install the iptables package. This is available as an RPM on Fedora based systems, as a Debian package and, of course, in the source code form from: http://www.netfilter.org/

Packet filtering involves the kernel directly, so that means that we’re going to have to configure and compile a new kernel to get it working. Although the latest major Linux distributions usually give you a kernel with some Netfilter options enabled, a person with advanced Linux knowledge should really get in there and give it a few extra tweaks. We won’t go into all the steps to compiling a kernel here, but we will show you the options you need to enable in order to run your firewall with Netfilter/iptables.
Kernel Options
Note

At the time of this writing, the latest major version of the kernel is 2.6. The kernel settings we talk about will be referring to this kernel.

At this point, you should have downloaded the latest version of the 2.6 kernel from http://www.kernel.org. I find the easiest way to configure the kernel is to use the command: make menuconfig This brings up the traditional interface based on ncurses. There are other more modern looking interfaces to the kernel configuration tools, but I find this one the best (and frankly, I’m used to it). If you have experience compiling kernel versions previous to this one, the options related to iptables/Netfilter might be a little harder to find, but they’re there. In the main menu, just follow: Device Drivers —> Networking support —> Networking options —> Network packet filtering (replaces ipchains) —> IP: Netfilter Configuration —> and there you’ll find the mail options. In my experience, I have found that most of the options we need are selected as modules by default. If they aren’t, you can either select them as modules (m) or have them built into the kernel (*).

Now you’re ready to build the new kernel. For those of you familiar with the 2.4 series and earlier, when you build a 2.6 kernel, there is no longer a ‘make dep’ command. We go straight to build with ‘make bzImage’. Assuming you haven’t got any errors, when you’ve finished compiling, do ‘make modules’ and ‘make modules_install’ to both compile and install those options you compiled as modules. Now place your new kernel in /boot and depending on whether you use ‘grub’ or ‘lilo’, make the appropriate changes in grub.conf or lilo.conf. Those who use ‘lilo’ should type ‘lilo’ at this point to ready the new kernel for use.
Starting with iptables

We assume now that you’ve rebooted and you’re all set to go with your new kernel. To start off, let’s try a very simple command to list the firewall rules you currently have on your system. At this point, there shouldn’t be any rules active, so running this command:

iptables -L

should show you output like this:

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

This essentially means that you’re not running a firewall. This isn’t good, so we need to get some basic rules running so you’re not vulnerable to attack.
A Simple Firewall Script

Below you’ll find a simple firewall script. It contains explanatory comments for every rules. Study it for a bit and then we’ll discuss it after.

#!/bin/sh

IPTABLES=/sbin/iptables

# start by flushing the rules
$IPTABLES -F

## allow packets coming from the machine
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

# allow outgoing traffic
$IPTABLES -A OUTPUT -o eth0 -j ACCEPT

# block spoofing
$IPTABLES -A INPUT -s 127.0.0.0/8 -i ! lo -j DROP
$IPTABLES -A INPUT -s 192.168.0.3 -j DROP

# stop bad packets
$IPTABLES -A INPUT -m state –state INVALID -j DROP

# NMAP FIN/URG/PSH
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL FIN,URG,PSH -j DROP
# stop Xmas Tree type scanning
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL ALL -j DROP
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# stop null scanning
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL NONE -j DROP
# SYN/RST
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags SYN,RST SYN,RST -j DROP
# SYN/FIN
/sbin/iptables -A INPUT -i eth0 -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP
# stop sync flood
/sbin/iptables -N SYNFLOOD
/sbin/iptables -A SYNFLOOD -p tcp –syn -m limit –limit 1/s -j RETURN
/sbin/iptables -A SYNFLOOD -p tcp -j REJECT –reject-with tcp-reset
/sbin/iptables -A INPUT -p tcp -m state –state NEW -j SYNFLOOD
# stop ping flood attack
/sbin/iptables -N PING
/sbin/iptables -A PING -p icmp –icmp-type echo-request -m limit –limit 1/second -j RETURN
/sbin/iptables -A PING -p icmp -j REJECT
/sbin/iptables -I INPUT -p icmp –icmp-type echo-request -m state –state NEW -j PING

#################################
## What we allow
#################################

# tcp ports

# smtp
$IPTABLES -A INPUT -p tcp -m tcp –dport 25 -j ACCEPT
# http
$IPTABLES -A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
# pop3
$IPTABLES -A INPUT -p tcp -m tcp –dport 110 -j ACCEPT
# imap
$IPTABLES -A INPUT -p tcp -m tcp –dport 143 -j ACCEPT
# ldap
$IPTABLES -A INPUT -p tcp -m tcp –dport 389 -j ACCEPT
# https
$IPTABLES -A INPUT -p tcp -m tcp –dport 443 -j ACCEPT
# smtp over SSL
$IPTABLES -A INPUT -p tcp -m tcp –dport 465 -j ACCEPT
# line printer spooler
$IPTABLES -A INPUT -p tcp -m tcp –dport 515 -j ACCEPT
# cups
$IPTABLES -A INPUT -p tcp -m tcp –dport 631 -j ACCEPT

## restrict some tcp things ##

# ssh
$IPTABLES -A INPUT -p tcp -m tcp -s 192.168.0.0/16 –dport 22 -j ACCEPT
# samba (netbios)
$IPTABLES -A INPUT -p tcp -m tcp -s 192.168.0.0/16 –dport 137:139 -j ACCEPT
# ntop
$IPTABLES -A INPUT -p tcp -m tcp -s 192.168.0.0/16 –dport 3000 -j ACCEPT
# Hylafax
$IPTABLES -A INPUT -p tcp -m tcp -s 192.168.0.0/16 –dport 4558:4559 -j ACCEPT
# webmin
$IPTABLES -A INPUT -p tcp -m tcp -s 192.168.0.0/16 –dport 10000 -j ACCEPT

# udp ports
# DNS
$IPTABLES -A INPUT -p udp -m udp –dport 53 -j ACCEPT
# DHCP
$IPTABLES -A INPUT -p udp -m udp –dport 67:68 -j ACCEPT
# NTP
$IPTABLES -A INPUT -p udp -m udp –dport 123 -j ACCEPT
# SNMP
$IPTABLES -A INPUT -p udp -m udp –dport 161:162 -j ACCEPT

## restrict some udp things ##

# Samba (Netbios)
$IPTABLES -A INPUT -p udp -m udp -s 192.168.0.0/16 –dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp –sport 137:138 -j ACCEPT

# finally – drop the rest

/sbin/iptables -A INPUT -p tcp –syn -j DROP

In the first part of the script, what we do is handle the ‘administrative’ tasks of the firewall. These include, as you can see from the comments, flushing the rules, to rid the system of any leftover rules that may conflict with the ones in the firewall script. After, we let packets move freely if generated by the machine itself (indicated by ‘lo’ or localhost). Then we allow packets to leave the machine on our network card (in this case, eth0).

Next, we start to prevent some of the most common network vulnerabilities. The first one is spoofing, or the ability to make packets appears as if they’re coming from your machine or your network. As it’s common practice to be a bit more tolerant toward those on your own network, those intent on breaking in will first try the spoofing routine. Next, we block any bad packets – period. Another way of attacking a network is to overwhelm it with junk. Here we’ll control this. To end off this section of the firewall, we’ve added protection against various popular attack methods such as the so-called ‘ping of death’, syn-fin attacks and others mentioned in the comments.

The second part of the firewall deals with allowing and controlling access to certain services running on the machine. The comments above each rule show which services are dealt with with each one. We control access to both tcp and udp traffic. Some services are offered to the public and some are not. You will note that toward the end, we restrict access to ssh, samba and some others to the local network. In this particular case, no one from the outside should have access to those and in your case you may choose to limit more or fewer services but the point is that iptables also offers us the possibility of doing IP address based restrictions.

Finally with the last rule we drop all packets that aren’t destined for the ports that we allow. This is a good basic rule of thumb for security. That which is not allowed is prohibited.

Though this is a basic script, it affords good protection. You may also want to enhance is and add rules. We’ll deal with that next.
Adding Rules

What we’ve done with the script above is ‘append’ rules to the firewall as it’s loading. That’s what the ‘-A’ switch stands for. However, there may be times when you want to add rules to a running firewall. Let’s say that some lousy spammer is running a dictionary attack on you and you see from your mail server logs that he’s connecting to you from 222.111.222.111. Now, in our firewall script, we let anybody connect to our mail server (port 25). That’s only normal. You never know where mail is going to come from, so that port is generally left open to the public. However, if we see that someone’s abusing the service, like a spammer, then we can shut off his access to it so he won’t be able to connect to our mail server (until, of course, he switches his IP address). What we would do is ‘insert’ a rule into our running firewall to deal with this unforeseen situation. The rule is basically the same, but instead of the ‘-A’ option, we’ll use the ‘-I’ (for insert) option:

iptables -I INPUT -p tcp –syn -s 222.111.222.111 -j DROP

Actually, this rule doesn’t specify port 25, although that was where the trouble was coming from. This rule denies access to all packets coming to our machine coming from that IP address. That’s really what the spammer deserves. The drawback is that if there is any legitimate traffic coming from that IP address (though it’s doubtful in this case), they would be blocked. If you were able to isolate a netblock where spammers frequently operated from (from zombied PCs, for example), you could insert a rule to deal with specific ports

iptables -I INPUT -p tcp –syn -s 222.111.222.0/24 –dport 25 -j DROP

That would block connections to the mail server while preserving all of the other public services. That way, the collateral damage, so to speak, isn’t so great. We don’t want to lump the guilty in with the blameless.
Removing Rules

Let’s say that you’ve decided to dedicate an entire machine to serving web pages. Then you’re firewall rules need to be changed. You can do this temporarily, until you’ve rebooted the machine, by first deleting the rule providing access to ports 80 and 443 and then by inserting a rule dropping packets whose destination are those ports. To delete, we use the ‘-D’ switch:

iptables -D INPUT -p tcp –dport 25 -j ACCEPT
iptables -D INPUT -p tcp –dport 443 -j ACCEPT

These are the same rules that gave access to these services. We’ve just substituted the ‘-D’ switch, as you can see. Now we drop packets to those ports:

iptables -I INPUT -p tcp –dport 25 -j DROP
iptables -I INPUT -p tcp –dport 443 -j DROP

Once above rules are setup you can test your firewall with nmap or hping2 command:
# nmap -v -f FIREWALL-IP
# nmap -v -sX FIREWALL-IP
# nmap -v -sN FIREWALL-IP
# hping2 -X FIREWALL-IP

This article is focusing installing and configure MRTG with CPU,Memory and Disk Usage Graphs examples for Debian Ubuntu and Kubuntu Users and may be work for some debian based distributions.

MRTG is Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic load on network links. MRTG generates HTML pages containing PNG images which provide a LIVE visual representation of this traffic.

MRTG Requirements

Apache webserver with perl support
NET-SNMP
GD
Libpng
zlib

If you want to download MRTG you can download from here

Preparing you System for MRTG Instalaltion

First you need to install the required compilers

#apt-get install gcc make g++

Apache 2 Installation with perl support

Follow these instructions to install apache2 with perl support

MRTG Installation

Now we need to install mrtg and snmp

Installing MRTG in Debian, Ubuntu and Kubuntu

#apt-get install mrtg snmpd

The installation will create an mrtg subdirectory where the Apache Web pages reside. On your Debian,ubnutu,kubuntu systems the path of this subdirectory is:

/var/www/mrtg

Now you need to edit the mrtg configuration file to edit the some of the settings

File is located at /etc/mrtg.cfg you need to change the global settings as follows

# Global Settings

RunAsDaemon: yes
EnableIPv6: no
WorkDir: /var/www/mrtg
Options[_]: bits,growright
WriteExpires: Yes

Title[^]: Traffic Analysis for

You will find a crontab running every 5 minutes as user root

# cat /etc/cron.d/mrtg
0-55/5 * * * * root if [ -x /usr/bin/mrtg ] && [ -r /etc/mrtg.cfg ]; then env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log 2>&1; fi

Now we need to assign the snmp community name in snmp configration file /etc/snmp/snmpd.conf

# sec.name source community
# com2sec paranoid default public
com2sec readonly default public
#com2sec readwrite default private

Now you need to restart the snmp service

#/etc/init.d/snmpd restart

The configuration file creating using

#cfgmaker public@localhost > /etc/mrtg.cfg

Creating a configuration file for a device using cfgmaker

#cfgmaker public@192.168.0.1 >> /etc/mrtg.cfg

With the configuration file created correctly there’s only one other thing you have to do and that’s to use the indexmaker utility to create the summary home page. Since you have to re-run this command every time you make certain changes to the /etc/mrtg.cfg configuration file.

Creating index file for the webserver using indexmaker

#indexmaker /etc/mrtg.cfg > /var/www/mrtg/index.html

Now you need to reboot your system wait for five minutes or so and then take a look at your summary home page. If your Debian,ubuntu,kubuntu system’s IP address is 192.168.0.1 then you’d type in the following in the address bar of a browser running on a system on the same network:

http://192.168.0.1/mrtg/

Your summary home page should come up with a graph for each target entry in the configuration file. If a graph looks like there’s no data on it, click on it and check the statistics to see if any traffic is being seen. Small amounts of traffic won’t show up on the graphs because we used the Unscaled statement

Some of examples how to monitor cpu , memory , Disk usage

CPU Usage

/etc/mrtg/cpu.cfg

WorkDir: /var/www/mrtg
LoadMIBs: /usr/share/snmp/mibs/UCD-SNMP-MIB.txt
Target[localhost.cpu]:ssCpuRawUser.0&ssCpuRawUser.0:public@127.0.0.1+ ssCpuRawSystem.0&ssCpuRawSystem.0:public@127.0.0.1+
ssCpuRawNice.0&ssCpuRawNice.0:public@127.0.0.1
RouterUptime[localhost.cpu]: public@127.0.0.1
MaxBytes[localhost.cpu]: 100
Title[localhost.cpu]: CPU Load
PageTop[localhost.cpu]: Active CPU Load %
Unscaled[localhost.cpu]: ymwd
ShortLegend[localhost.cpu]: %
YLegend[localhost.cpu]: CPU Utilization
Legend1[localhost.cpu]: Active CPU in % (Load)
Legend2[localhost.cpu]:
Legend3[localhost.cpu]:
Legend4[localhost.cpu]:
LegendI[localhost.cpu]: Active
LegendO[localhost.cpu]:
Options[localhost.cpu]: growright,nopercent

Memory Usage

/etc/mrtg/mem.cfg

LoadMIBs: /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt
Target[localhost.mem]: .1.3.6.1.4.1.2021.4.6.0&.1.3.6.1.4.1.2021.4.6.0:public@localhost
PageTop[localhost.mem]:Free Memory
WorkDir: /var/www/mrtg
Options[localhost.mem]: nopercent,growright,gauge,noinfo
Title[localhost.mem]: Free Memory
MaxBytes[localhost.mem]: 1000000
kMG[localhost.mem]: k,M,G,T,P,X
YLegend[localhost.mem]: bytes
ShortLegend[localhost.mem]: bytes
LegendI[localhost.mem]: Free Memory:
LegendO[localhost.mem]:
Legend1[localhost.mem]: Free memory, not including swap, in bytes

Memory Monitoring (Total Versus Available Memory)

/etc/mrtg/memfree.cfg

LoadMIBs: /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt
Target[server.memory]: memAvailReal.0&memTotalReal.0:public@localhost
Title[server.memory]: Free Memory
PageTop[server.memory]: < H1 >Free Memory< /H1 >
MaxBytes[server.memory]: 100000000000
ShortLegend[server.memory]: B
YLegend[server.memory]: Bytes
LegendI[server.memory]: Free
LegendO[server.memory]: Total
Legend1[server.memory]: Free memory, not including swap, in bytes
Legend2[server.memory]: Total memory
Options[server.memory]: gauge,growright,nopercent
kMG[server.memory]: k,M,G,T,P,X

Memory Monitoring (Percentage usage)

/etc/mrtg/mempercent.cfg

LoadMIBs: /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt
Title[server.mempercent]: Percentage Free Memory
PageTop[server.mempercent]: < H1 >Percentage Free Memory< /H1 >
Target[server.mempercent]: ( memAvailReal.0&memAvailReal.0:publicy@localhost ) * 100 / ( memTotalReal.0&memTotalReal.0:public@localhost )
options[server.mempercent]: growright,gauge,transparent,nopercent
Unscaled[server.mempercent]: ymwd
MaxBytes[server.mempercent]: 100
YLegend[server.mempercent]: Memory %
ShortLegend[server.mempercent]: Percent
LegendI[server.mempercent]: Free
LegendO[server.mempercent]: Free
Legend1[server.mempercent]: Percentage Free Memory
Legend2[server.mempercent]: Percentage Free Memory

Disk Usage

/etc/mrtg/disk.cfg

LoadMIBs: /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt
Target[server.disk]: dskPercent.1&dskPercent.2:public@localhost
Title[server.disk]: Disk Partition Usage
PageTop[server.disk]: < H1 >Disk Partition Usage /home and /var< /H1 >
MaxBytes[server.disk]: 100
ShortLegend[server.disk]: %
YLegend[server.disk]: Utilization
LegendI[server.disk]: /home
LegendO[server.disk]: /var
Options[server.disk]: gauge,growright,nopercent
Unscaled[server.disk]: ymwd

Creating jobs for CPU , Memory and Disk Usage

CPU

/etc/cron.mrtg/cpu

#!/bin/sh
/usr/bin/mrtg /etc/mrtg/cpu.cfg

Memory

/etc/cron.mrtg/mem

#!/bin/sh
/usr/bin/mrtg /etc/mrtg/mem.cfg

Memory Free

/etc/cron.mrtg/memfree

#!/bin/sh
/usr/bin/mrtg /etc/mrtg/memfree.cfg

Memory Percentage

/etc/cron.mrtg/mempercent

#!/bin/sh
/usr/bin/mrtg /etc/mrtg/mempercent.cfg

Disk

/etc/cron.mrtg/disk

#!/bin/sh
/usr/bin/mrtg /etc/mrtg/disk.cfg

Run each script 3 times (disregard the warnings)

/etc/cron.mrtg/cpu
/etc/cron.mrtg/mem
/etc/cron.mrtg/memfree
/etc/cron.mrtg/mempercent
/etc/cron.mrtg/disk

Make the Index Files

#/usr/bin/indexmaker –output=/var/www/mrtg/index.html \
–title=”Memory and CPU Usage ” \
–sort=name \
–enumerate \
/etc/mrtg/cpu.cfg \
/etc/mrtg/mem.cfg \
/etc/cron.mrtg/memfree \
/etc/cron.mrtg/mempercent \
/etc/cron.mrtg/disk

Make the mrtg.cfg file

#cfgmaker –global “WorkDir: /var/www/mrtg/” \
–global “Options[_]: growright,bits” \
–ifref=ip \
public@localhost > /etc/mrtg/mrtg.conf

Cronjob setup

/bin/cat >> /var/spool/cron/crontabs/root
*/5 * * * * /bin/run-parts /etc/cron.mrtg 1> /dev/null

Now you logon to your web browser http://192.168.0.1/mrtg/ and Now you should see CPU,Memory and Disk Usage graphs.

htaccess tutorial
by DJG, djg@linuxhelp.net
Created on November 29th, 1999.
Last updated on December 19th, 1999.

htaccess is a way to password protect directories. It can also be used to give user or group specific access to directories. This guide will tell you how to setup apache for htaccess and to set up basic protection. Let’s begin.

First, I assume you have Apache installed. If you don’t, get the rpm, deb, or tarball, etc…

Now, you’ll have to know what directory you want to be able to use htaccess. Let’s say that you want to be able to use it in the /var/www directory.

In your apache config file, access.conf, (Mine is located in /etc/apache/access.conf, locations may vary. Try locate access.conf). Please note that in some cases when installing Apache 1.3.9 from the tarball, all the config files will be combined into one file called httpd.conf. Open up access.conf or httpd.conf and find the lines that look like the following:

Options Indexes FollowSymLinks

AllowOverride None

order allow,deny
allow from all

Note: This is machine specific. I am working from a default Debian Apache install. In order to use htaccess, you’ll need to change the line

AllowOverride None

to

AllowOverride AuthConfig

If you have a different options in the AllowOverride line, but not AuthConfig, add it, if you have “All” then you won’t need it.

Now restart apache for the changes to take effect.

I use /etc/init.d/apache restart for that, Red Hat Linux users may use /etc/rc.d/init.d/httpd restart. Just look around your system. Also, killall -HUP httpd will restart the server.

Now that the directory and its subdirectories are htaccess enabled, you’ll need to setup the actual files.

Create a file in the dir you want to protect called .htaccess

Here’s an example .htaccess file:

AuthUserFile /var/www/.htpasswd
AuthGroupFile /www.null
AuthName “Authorization Required”
AuthType Basic

require valid-user

AuthUserFile is the path to the password file which we will create in a minute.

AuthGroupFile is the path to the group password file, for simple user protection, this is not needed, so simply send the requests for it to /www.null

AuthName Is a message to appear, I just used Authorization Required. Change it to what you’d like.

AuthType Just set this to Basic

Now, inside the tag, you have who is allowed to have access to the page. valid-user represents any valid user in the password file, you could specify a user, changing the line to:

require user djg

Now that .htaccess is set up, you’ll need to create the password file. To do this, use the program htpasswd.

To create an initial .htpasswd file, use the -c tag.

The syntax is: htpasswd passwordfilename user (add -c if you’re creating the file)

So, we would use:

htpasswd -c /var/www/.htpasswd djg

It would then prompt me for a password.

To create new users in the same file, simply drop the -c.

htpasswd /var/www/.htpasswd anotherusername

When running htpasswd it will ask you for that username’s password. Now, everything should be set up, and your directory should be protected.

haven’t use linux for a while, now cum back and got few messages like this when install pakage.

solution?

WARNING: The following packages cannot be authenticated!

foo bar baz

Install these packages without verification [y/N]?

I noticed today that google doesn’t turn up good hits for the fix. The fix is really simple:

apt-get install debian-archive-keyring

apt-get update

That’s it. You now have secure packages from Debian. Nice, eh?

# apt-get install debian-keyring debian-archive-keyring
Reading package lists… Done
Building dependency tree… Done
debian-keyring is already the newest version.
debian-archive-keyring is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 146 not upgraded.
#apt-get update
# apt-get upgrade
Reading package lists… Done
Building dependency tree… Done
The following packages will be upgraded:
adduser apt apt-utils base-files bash bsdmainutils bsdutils busybox
console-common console-data coreutils cron dash debconf debconf-i18n