KVM Networking - PNET vs VNET MACs and JUMPStation Host Planning

Used an unused bridge br10 to for external Networking (within guest) as mentioned below:
---


$ cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# VLan 11  interface
iface eno2 inet manual
# Bridge
auto br11
iface br11 inet static
        address 10.1.11.15
        netmask 255.255.255.0
        network 10.1.11.0
        gateway 10.1.11.1
        broadcast 10.1.11.255
        bridge_ports eno2
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        dns-nameservers 8.8.8.8
#VLam10 interface
#iface eno1 inet manual
# Bridge
auto br10
iface br10 inet auto
#        address XX.17.93.156
#        netmask 255.255.255.248
#       network XX.17.93.152
#        gateway XX.17.93.153
#        broadcast XX.17.93.159
#        dns-nameservers 8.8.8.8
#
#        bridge_ports eno1
#        bridge_stp off
#        bridge_fd 0
#       bridge_maxwait 0
#        dns-nameservers 8.8.8.8
#Vlan13 interface
iface eno4 inet manual
# Bridge
auto br13
iface br13 inet static
        address 10.1.13.15
        netmask 255.255.255.0
        network 10.1.13.0
        bridge_ports eno4
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        dns-nameservers 8.8.8.8
#VLan12 Interface
iface eno3 inet manual
# Bridge
auto br12
iface br12 inet static
        address 10.1.12.15
        netmask 255.255.255.0
        network 10.1.12.0
        gateway 10.1.12.1
        broadcast 10.1.12.255
        bridge_ports eno3
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        dns-nameservers 8.8.8.8

stackadmin@Host15:~$ ifconfig |grep HWaddr
br11      Link encap:Ethernet  HWaddr 44:a8:42:13:06:96
br12      Link encap:Ethernet  HWaddr 44:a8:42:13:06:97
br13      Link encap:Ethernet  HWaddr 44:a8:42:13:06:98
eno1      Link encap:Ethernet  HWaddr 44:a8:42:13:06:95
eno2      Link encap:Ethernet  HWaddr 44:a8:42:13:06:96
eno3      Link encap:Ethernet  HWaddr 44:a8:42:13:06:97
eno4      Link encap:Ethernet  HWaddr 44:a8:42:13:06:98
vnet0     Link encap:Ethernet  HWaddr fe:54:00:cd:58:b2
vnet1     Link encap:Ethernet  HWaddr fe:54:00:73:e6:49
vnet2     Link encap:Ethernet  HWaddr fe:54:00:58:b7:d8
vnet3     Link encap:Ethernet  HWaddr fe:54:00:0c:9d:59
vnet4     Link encap:Ethernet  HWaddr fe:54:00:39:f7:ca
vnet5     Link encap:Ethernet  HWaddr fe:54:00:55:b2:90
vnet6     Link encap:Ethernet  HWaddr fe:54:00:7d:af:66
vnet7     Link encap:Ethernet  HWaddr fe:54:00:3e:28:cc
vnet8     Link encap:Ethernet  HWaddr fe:54:00:26:94:7f
vnet9     Link encap:Ethernet  HWaddr fe:54:00:65:11:72
vnet10    Link encap:Ethernet  HWaddr fe:54:00:35:2d:10
vnet11    Link encap:Ethernet  HWaddr fe:54:00:5c:54:4f
vnet12    Link encap:Ethernet  HWaddr fe:a8:42:13:06:95

You can see that Mac addresses in VM nets are vnets (vnet9-12) on Host above as well, same can be created/used on JUMPSTATION host to connect directly to these VMs, ensuring that IPTABLES/FW rules are all set:
------
stackadmin@VM1:~$ ifconfig |grep HWaddr
ens3      Link encap:Ethernet  HWaddr 52:54:00:65:11:72
ens4      Link encap:Ethernet  HWaddr 52:54:00:35:2d:10
ens5      Link encap:Ethernet  HWaddr 52:54:00:5c:54:4f
ens9      Link encap:Ethernet  HWaddr 44:a8:42:13:06:95

Script to fetch HP ILO firmware versions

Script to fetch HP ILO firmware versions
---

cat rilo_hst_ip|while read i; do  rip=$(echo $i|cut -d',' -f2); ver=$(curl https://$rip/xmldata?item=All --insecure|grep FWRI|cut -d'>' -f2 |cut -d'<' -f1) ;echo $i,$ver >> rilo_vers2   ;  done

sshpass remote command execution - password change

for i in $(cat systems_list)
        do
                sshpass -p "oldpassword@2016" ssh -q root@$i "echo "NEwpassword@2017" | passwd root --stdin"
done

Sync task stuck Satellite

Issue       : Sync task stuck from last 8 days.  Unable to cancel it manually.

We executed below commands to resolve issue.

-----------------------------------------------------------------------

 # service foreman-tasks stop

 # foreman-rake console

   > ForemanTasks::Task.where(:label => "Actions::Katello::Repository::Sync", :state => "running").map { |task| task.update_column(:state, "stopped") }

   > ForemanTasks::Task.where(:label => "Actions::Pulp::Consumer::GenerateApplicability", :state => "paused").map { |task| task.update_column(:state, "stopped") }

   > ForemanTasks::Task.where(:label => "Actions::Pulp::Consumer::GenerateApplicability", :state => "running").map { |task| task.update_column(:state, "stopped") }

   > ForemanTasks::Task.where(:label => "Actions::Katello::Host::UploadPackageProfile", :state => "running").map { |task| task.update_column(:state, "stopped") }

   > ForemanTasks::Task.where(:label => "Actions::Katello::Host::UploadPackageProfile", :state => "paused").map { |task| task.update_column(:state, "stopped") }

   > ForemanTasks::Task.where(:state => :paused).where(:label => "Actions::Katello::Repository::Sync").destroy_all

   > ForemanTasks::Task.where(:state => :stopped).where(:label => "Actions::Pulp::Consumer::GenerateApplicability").destroy_all

   > ForemanTasks::Task.where(:state => :stopped).where(:label => "Actions::Katello::Host::UploadPackageProfile").destroy_all

   > exit

 # katello-service restart

-----------------------------------------------------------------------

After completing above steps, we were able to resolve issue.

PowerShell script to add multiple DNS in Windows Servers

Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE -ComputerName . | Format-Table -Property IPAddress

----
$test=Get-NetAdapter |findstr -I up | select -first 1
$index=$test.split()[-22]
Set-DnsClientServerAddress -interfaceIndex $index -ServerAddresses ("172.30.62.21","172.30.62.22","172.28.62.21","172.28.62.22")
Get-DnsClientServerAddress

Linux Chrooted SFTP Solution

Operating system Tested

• Centos 6
• Centos 7

It should work on Fedora and Redhat as well 

Problem

• How to set up sftp to chroot only for specific users
• How to set up sftp so that a user can't get out of their home directory, ensuring no other users are affected
• Preserve normal ssh/sftp functionality for most other users
• Support for sftp/scp account jails in openssh server
• I am facing problems for configuring sftp server and need assistance for the same.

Solution

In order to allow ChrootDirectory functionality on a per-user basis, employ a conditionally-executed sshd configuration (using the "Match" keyword) in the sshd_config file.

This example will use a "Match" block based on group membership, but other criteria may used in a "Match" block to determine which users are restricted to the ChrootDirectory (see "man sshd_config" for more details).

If its not root:root, then the below command should be executed for chroot-sftp operation :-

This is most important step before you start, please do not ignore it 

Raw

# chown root:root /

1. Edit sshd_config
   • Comment the original Subsystem entry for sftp and replace it with a new entry:
   Raw

   #Subsystem      sftp    /usr/libexec/openssh/sftp-server
   Subsystem       sftp    internal-sftp
   

   • Add the following to the end of the /etc/ssh/sshd_config file.
   Raw

           Match Group jailUsers
                   ChrootDirectory /chroots/%u
                   AllowTcpForwarding no
                   ForceCommand internal-sftp
                   X11Forwarding no
   

2. Create a new group to add sftp-only users to (users in this group will not have access to ssh/scp and sftp access will be limited to their chrooted environment.)
   Raw

   # groupadd jailUsers
   

   NOTE: Persons not in this group can still log in to the host via ssh and otherwise interact with openssh normally.
3. Configure or create the accounts of any sftp-only users.  NOTE: the specified home directory is relative to the ChrootDirectory.
   Raw

   # usermod  -g jailUsers -s /bin/false user  

   or
   Raw

   #useradd -d /myhome -M -g jailUsers -s /bin/false user

   In case you newly create the "user", set its pasword
   Raw

   # passwd user
   

4. Create the user's chroot environment and configure directory permissions.  Ensure that this entire path is owned by root and only writable by root.
   Raw

   # mkdir -p /chroots/user ; chmod -R 755 /chroots/user
   

   NOTE: In this case, the chroot directory is set to /chroots/%u (%u is replaced by the username of that user) so that each user will have an individual chroot environment.
   Users will not be able to see other directories located beneath the root of their chrooted environment.
5. Create the user's actual home directory under the ChrootDirectory and chown it to the user and group created/used in Step 3 (above).
   Raw

   # mkdir /chroots/user/myhome ; chown user:jailUsers /chroots/user/myhome

   NOTE: The permission of the user chroot directory that is, /chroots/user/myhome should be 0755.
6. Restart sshd.

Creating Linux SFTP Chrooted Server - Automated Script

Linux SFTP Chrooted Server - Automated Script

---------------------------------------

#!/bin/bash

#Author Mail : rambamal@gmail.com

#Creating config backup to backup system conf files and directories

if ! [ -d "/root/conf-backup" ]

        then mkdir /root/conf-backup

fi

#Taking a backup of /etc/ssh

cp -ar /etc/ssh /root/conf-backup/.

#Deleting existing sftp configurations

sed -i '/^Subsystem/d' /etc/ssh/sshd_config

sed -i '/^PasswordAuthentication/d' /etc/ssh/sshd_config

sed -i '/^ChallengeResponseAuthentication/d' /etc/ssh/sshd_config

sed -i '/^UsePAM/d' /etc/ssh/sshd_config

sed -i '/ChrootDirectory/d' /etc/ssh/sshd_config

sed -i '/X11Forwarding/d' /etc/ssh/sshd_config

sed -i '/AllowTcpForwarding/d' /etc/ssh/sshd_config

sed -i '/ForceCommand/d' /etc/ssh/sshd_config

sed -i '/^Match/d' /etc/ssh/sshd_config

#Creating SFTP Server configuration

cat > /tmp/sftp_conf << END

PasswordAuthentication no

ChallengeResponseAuthentication yes

UsePAM yes

Subsystem       sftp    internal-sftp -l INFO

Match Group sdp

  ChrootDirectory /chroots/%u

  X11Forwarding no

  AllowTcpForwarding no

  ForceCommand internal-sftp -l INFO

END

cat /tmp/sftp_conf >> /etc/ssh/sshd_config

#Creating SFTP User's Home directory /chroots

if ! [ -d "/chroots" ]

        then mkdir /chroots

fi

#Add sdp Group

groupadd sdp

#Remove Temporary files created within script

rm -f /tmp/sftp_conf

#Restart sshd Server

service sshd restart

exit 0