Firewall configuration in CentOS 7

CentOS 7 introduced firewalld to replace iptables. As a result, the "system-config-firewall-tui" command no longer works (unless you re-install iptables).

The equivalent way of adding in a couple of ports to the firewall rules is as follows:

sudo firewall-cmd --add-port=4505/tcp
sudo firewall-cmd --add-port=4506/tcp

The above will add rules to open the ports, but the change won't survive a reboot. To make the changes permanent, just add the "--permanent" flag to the command.

Configuring PostgreSQL to listen on all IPs

Tested on CentOS 6. Modify the line:

listen_addresses = '*'

In the /var/lib/pgsql/data/postgresql.conf file.

Setting root password on CentOS MySQL install

After installing and starting up mysqld run the following commands to set the root password:

# /usr/bin/mysqladmin -u root password '[password here]'
# /usr/bin/mysqladmin -u root -h [hostname here] password '[password here]'

Common SELinux problems and tasks

List current selinux context labels on files:

[root@machine1:/var/www/html]# ls -alZ
total 124K
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ./
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ../
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 administrator/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 bin/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 cache/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 cli/
...


Change the selinux context:

[root@machine1:/var/www/html]# chcon -Rv --type=httpd_sys_content_t ./*
changing security context of `./administrator/templates/hathor/less/forms.less'
changing security context of `./administrator/templates/hathor/less/buttons.less'
...


Enable Apache to make outbound database connections:

[root@machine1:/var/www/html]# setsebool -P httpd_can_network_connect=1

Enable Apache to use sendmail:

[root@machine1:/var/www/html]# setsebool httpd_can_sendmail 1

Finding the CWD (current working directory) of a running process

Luckily, due to the UNIX philosophy of "everything" is a file, makes it rather trivial to find what the current working directory is. You just need to look at the symbolic "cwd" link under the process directory:

# ls -al /proc/[process number here]/cwd lrwxrwxrwx 1 build build 0 Oct 18 12:29 /proc/2506/cwd /root/run

Gerrit and ActiveDirectory

We've recently started testing out Gerrit at work and one of the tasks when setting it up was to integrate the authentication with ActiveDirectory.

The process was fairly straight forward. For reference here is an example AD configuration:

[ldap]
 server = ldap://dc.company.org:389

 accountBase = ou=People,dc=company,dc=org
 accountPattern = (&(objectCategory=Person)(sAMAccountName=${username}))
 accountFullName = displayName
 accountEmailAddress = mail

 groupBase = ou=Groups,ou=People,dc=company,dc=org
 groupMemberPattern = (&(objectClass=group)(member=${dn}))

 username = cn=Gerrit User,ou=People,dc=company,dc=org
 password = ********

The username/password are for the "bind" user that will be used to query the server. More information can be found on the Gerrit auth documentation page.

Simple Perl and CGI example

This is probably the simplest possible example to get Perl working through cgi on Apache HTTPD. Instructions are for Ubuntu 12.04.

Install apache httpd:

sudo apt-get install apache2

Add the following "hello.pl" script to the /usr/lib/cgi-bin directory:

#!/usr/bin/perl

print "Content-type: text/html\n\n";
print "Hello World!";
exit;

Point your browser at http://localhost/cgi-bin/hello.pl and that's it!