Blog

BIOS and UEFI explained, all you need to know about.

BIOS and UEFI are two of a kind, but completely different from each other. They serve one major purpose: booting the machine and they do it in different ways and with different options. Without them, all your hardware and the very machine you’re reading this article on, wouldn’t even start. But what are the differences? And why are they mutually exclusive?

What is BIOS?

The Basic Input Output System is the older standard and dates back to old IBM-compatible computers. For almost twenty years, the BIOS has been a de facto standard in common computer implementations. The BIOS is a special software called firmware that is stored in a special chip soldered on the motherboard called ROM (usually EEPROM these days). When you press the power button, the BIOS is the first software that is run on the machine. This software is mostly responsible for three things:

  1. Performing POST: (Power-On Self-Test) in this phase the BIOS checks if the component installed on the motherboard are functioning (mostly CPUs and RAMs).
  2. Providing Basic IO: so that essential peripherals such as the keyboard, the monitor and serial ports can operate to perform basic tasks.
  3. Booting: this step is where all the magic happens, the BIOS tries to boot from the devices connected (SSDs, HDDs, PXE, whatever) in order to provide a better-suited interface (usually an Operating System) to fully make use of the hardware components.

As you can see the BIOS is pretty much a fundamental brick of the boot process and without it you wouldn’t be able to “start” the computer. A BIOS is usually associated with the motherboard and is mostly visible during the first seconds after powering the computer. When you see a great logo from the motherboard/computer manufacturer and (usually) hear beeps, the BIOS is at work.

What the BIOS can and can’t do

BIOS perform quite a strict role and it might appear to you that they always do the same thing. In the past, BIOS were written on plain ROMs (or difficult-to-erase ROMs), without the possibility to write or to erase the ROM, the software couldn’t be programmed or upgraded. Nowadays, BIOS can be updated to support newer hardware/features and can be programmed to perform specific tasks such as:

  • Turning on/off USB ports, Serial ports or IDE/SATA ports;
  • Over/Underclocking CPUs/RAMs frequencies;
  • Regulate motherboard fan controllers;

Although BIOS can perform these task well, they still operate in the 16-bit realm and as such they are limited. The most prominent limitation can be observed when using 2TB+ disks. Most BIOS can only boot from an MBR-partitioned disks, but MBR itself supports up to 2TB partitions meaning it won’t recognize the disk past that. Well there’s GPT that solves the problem of disks bigger than 2TB, but wait… most BIOS can’t boot from GPT. This means that if you have a 3TB disk you have two choices:

  • Use MBR partitioning: you will be able to boot an Operating System but the system will be presented with 2TB only.
  • Use GPT partitioning: you will not be able to boot.

The choice is obvious. But how can a disk larger than 2TB be used as a boot disk?

UEFI the BIOS successor

The Unified Extensible Firmware Interface aims to resolve what BIOS could not. UEFI itself is the second version (2.*), the former being EFI (1.*). If you bought a computer after 2010, you will probably have a UEFI instead of a BIOS. You read correctly, BIOS and UEFI do the same thing, but they are pretty different in how and what they do. A UEFI can (in addition to what a BIOS can):

  • Boot from disks larger than 2TB using GPT (assuming the operating system supports both).
  • Provide the user with a graphical user interface which is easier to use than old terminal user interfaces of BIOS.
  • Provide support for mouse devices (BIOS can rarely do this).
  • Boot securely using a chain-of-trust. (More later on secure boot).
  • Network boot (although most BIOS can do that, that’s not a given).
  • Provide a modular interface which is independent from the CPU architecture.
  • Provide a modular interface for applications and devices based on EFI drivers (commonly called EBCs, EFI Byte-Code).

Do I have a BIOS or a UEFI?

Unless you read your motherboard’s manual, there is no precise way to tell if you’re using a BIOS or a UEFI. But there are a few signs:

  • UEFIs usually have pretty, coloured interfaces.
  • In UEFI you can usually use your mouse.
  • If you bought the computer/motherboard after 2010, chances are you have a UEFI system.

UEFI and boot modes

With the inception of UEFI a new boot mode was born, leaving us with two modes:

  • UEFI mode: the newer boot mode, requires a separate partition (called EFI partition) where bootloaders are stored.
  • BIOS mode: the old way used by the BIOS, the bootloader would be stored on the disks (usually at the beginning of the disk).

This created a lot of confusion, especially among tech enthusiasts. Before UEFI the only way to install an operating system was the BIOS mode, but with UEFI, the UEFI mode was the new standard and the selected default. This, however, messed with Operating Systems: Operating System installed in BIOS mode can’t be booted using UEFI mode and vice versa. This means that if you have installed an operating system in BIOS mode you can’t boot in UEFI mode without modifying the installation or reinstalling the whole system, the same applies with a UEFI installation and a BIOS boot. That’s why many UEFI now support the so-called Legacy Mode.

UEFI and Legacy Mode

Put it simply, the Legacy Mode is UEFI operating as if it was a BIOS. You will lose most of the benefits the UEFI such as the Secure Boot or the Fast Boot, but will retain the graphical user interface. The only difference is that the UEFI will be able to boot from MBR disks (hence without the required EFI partition) and will be able to boot non-UEFI installations. Most motherboards support Legacy Mode nowadays.

I have a UEFI, was my operating system installed in UEFI or Legacy mode?

This can be determined using the Operating system capabilities:

  • Windows: Use the Disk Management tool to check if a “EFI System Partition” exists on the disk where Windows is. If there is one, the system was installed in UEFI mode, if not it was installed in Legacy mode.
  • Linux: check if /sys/firmware/efi exists, if it does the system is installed in UEFI mode.

UEFI and Secure Boot

One of the most discussed features is the so-called Secure Boot (sometimes called Trusted Boot), the secure boot was born to ensure a more secure boot than the past. By denying the execution of unsigned code, Secure Boot enforces protection against malwares that operate in the pre-bootenvironment. This feature, however, had a negative effect on Linux users and vendors. To be able to boot an operating system, the same (more precisely the bootloader) had to be signed by a known key, which had to be recognized by the UEFI. When the first UEFI implementations started shipping it became clear that most Linux vendors weren’t prepared for this inception. Only a few vendors (namely Canonical, SUSE and Red Hat) could sign their operating system to work with Secure Boot. For a short time before UEFI, a fear that hardware vendors tied to Microsoft would enforce Secure Boot without the possibility to turn it off started spreading. Nowadays most UEFIs (albeit not every one) allow turning off Secure Boot. This enables a less-secure boot but allows unsigned operating systems to be booted.

Fast Boot? Quick Boot? Ultra Fast Boot?

All these names are vendor-specific ways to say “boot Windows faster“. These technologies use cache and hibernation files in order to produce a faster boot. This is usually so fast that the user won’t even see the POST screen or be able to boot from USB. Fast boot is a mechanism supported by Windows only.

Tips & tricks : Iptables provides powerful capabilities to control traffic coming in and out of your system.

Modern Linux kernels come with a packet-filtering framework named Netfilter. Netfilter enables you to allow, drop, and modify traffic coming in and going out of a system. The iptables userspace command-line tool builds upon this functionality to provide a powerful firewall, which you can configure by adding rules to form a firewall policy. iptables can be very daunting with its rich set of capabilities and baroque command syntax. Let’s explore some of them and develop a set of iptables tips and tricks for many situations a system administrator might encounter.

Avoid locking yourself out

Scenario: You are going to make changes to the iptables policy rules on your company’s primary server. You want to avoid locking yourself—and potentially everybody else—out. (This costs time and money and causes your phone to ring off the wall.)

Tip #1: Take a backup of your iptables configuration before you start working on it.

Back up your configuration with the command:

/sbin/iptables-save > /root/iptables-works

Tip #2: Even better, include a timestamp in the filename.

Add the timestamp with the command:

/sbin/iptables-save > /root/iptables-works-`date +%F`

You get a file with a name like:

/root/iptables-works-2018-09-11

If you do something that prevents your system from working, you can quickly restore it:

/sbin/iptables-restore < /root/iptables-works-2018-09-11
ln –s /root/iptables-works-`date +%F` /root/iptables-works-latest

Tip #4: Put specific rules at the top of the policy and generic rules at the bottom.

Avoid generic rules like this at the top of the policy rules:

iptables -A INPUT -p tcp --dport 22 -j DROP

The more criteria you specify in the rule, the less chance you will have of locking yourself out. Instead of the very generic rule above, use something like this:

iptables -A INPUT -p tcp --dport 22 –s 10.0.0.0/8 –d 192.168.100.101 -j DROP

This rule appends (-A) to the INPUT chain a rule that will DROP any packets originating from the CIDR block 10.0.0.0/8 on TCP (-p tcp) port 22 (–dport 22) destined for IP address 192.168.100.101 (-d 192.168.100.101).

There are plenty of ways you can be more specific. For example, using -i eth0 will limit the processing to a single NIC in your server. This way, the filtering actions will not apply the rule to eth1.

Tip #5: Whitelist your IP address at the top of your policy rules.

This is a very effective method of not locking yourself out. Everybody else, not so much.

iptables -I INPUT -s <your IP> -j ACCEPT

You need to put this as the first rule for it to work properly. Remember, -I inserts it as the first rule; -A appends it to the end of the list.

Tip #6: Know and understand all the rules in your current policy.

Not making a mistake in the first place is half the battle. If you understand the inner workings behind your iptables policy, it will make your life easier. Draw a flowchart if you must. Also remember: What the policy does and what it is supposed to do can be two different things.

Set up a workstation firewall policy

Scenario: You want to set up a workstation with a restrictive firewall policy.

Tip #1: Set the default policy as DROP.

# Set a default policy of DROP
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

Tip #2: Allow users the minimum amount of services needed to get their work done.

The iptables rules need to allow the workstation to get an IP address, netmask, and other important information via DHCP (-p udp –dport 67:68 –sport 67:68). For remote management, the rules need to allow inbound SSH (–dport 22), outbound mail (–dport 25), DNS (–dport 53), outbound ping (-p icmp), Network Time Protocol (–dport 123 –sport 123), and outbound HTTP (–dport 80) and HTTPS (–dport 443).

# Set a default policy of DROP
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

# Accept any related or established connections
-I INPUT  1 -m state –state RELATED,ESTABLISHED -j ACCEPT
-I OUTPUT 1 -m state –state RELATED,ESTABLISHED -j ACCEPT

# Allow all traffic on the loopback interface
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Allow outbound DHCP request
-A OUTPUT –o eth0 -p udp –dport 67:68 –sport 67:68 -j ACCEPT

# Allow inbound SSH
-A INPUT -i eth0 -p tcp -m tcp –dport 22 -m state –state NEW  -j ACCEPT

# Allow outbound email
-A OUTPUT -i eth0 -p tcp -m tcp –dport 25 -m state –state NEW  -j ACCEPT

# Outbound DNS lookups
-A OUTPUT -o eth0 -p udp -m udp –dport 53 -j ACCEPT

# Outbound PING requests
-A OUTPUT –o eth0 -p icmp -j ACCEPT

# Outbound Network Time Protocol (NTP) requests
-A OUTPUT –o eth0 -p udp –dport 123 –sport 123 -j ACCEPT

# Outbound HTTP
-A OUTPUT -o eth0 -p tcp -m tcp –dport 80 -m state –state NEW -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp –dport 443 -m state –state NEW -j ACCEPT

COMMIT

Restrict an IP address range

Scenario: The CEO of your company thinks the employees are spending too much time on Facebook and not getting any work done. The CEO tells the CIO to do something about the employees wasting time on Facebook. The CIO tells the CISO to do something about employees wasting time on Facebook. Eventually, you are told the employees are wasting too much time on Facebook, and you have to do something about it. You decide to block all access to Facebook. First, find out Facebook’s IP address by using the host and whois commands.

host -t a www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 31.13.65.17
whois 31.13.65.17 | grep inetnum
inetnum:        31.13.64.0 – 31.13.127.255

Then convert that range to CIDR notation by using the CIDR to IPv4 Conversionpage. You get 31.13.64.0/18. To prevent outgoing access to www.facebook.com, enter:

iptables -A OUTPUT -p tcp -i eth0 –o eth1 –d 31.13.64.0/18 -j DROP

Regulate by time

Scenario: The backlash from the company’s employees over denying access to Facebook access causes the CEO to relent a little (that and his administrative assistant’s reminding him that she keeps HIS Facebook page up-to-date). The CEO decides to allow access to Facebook.com only at lunchtime (12PM to 1PM). Assuming the default policy is DROP, use iptables’ time features to open up access.

iptables –A OUTPUT -p tcp -m multiport –dport http,https -i eth0 -o eth1 -m time –timestart 12:00 –timestart 12:00 –timestop 13:00 –d
31.13.64.0/18  -j ACCEPT

This command sets the policy to allow (-j ACCEPT) http and https (-m multiport –dport http,https) between noon (–timestart 12:00) and 13PM (–timestop 13:00) to Facebook.com (–d 31.13.64.0/18).

Regulate by time—Take 2

Scenario: During planned downtime for system maintenance, you need to deny all TCP and UDP traffic between the hours of 2AM and 3AM so maintenance tasks won’t be disrupted by incoming traffic. This will take two iptables rules:

iptables -A INPUT -p tcp -m time –timestart 02:00 –timestop 03:00 -j DROP
iptables -A INPUT -p udp -m time –timestart 02:00 –timestop 03:00 -j DROP

With these rules, TCP and UDP traffic (-p tcp and -p udp ) are denied (-j DROP) between the hours of 2AM (–timestart 02:00) and 3AM (–timestop 03:00) on input (-A INPUT).

Limit connections with iptables

Scenario: Your internet-connected web servers are under attack by bad actors from around the world attempting to DoS (Denial of Service) them. To mitigate these attacks, you restrict the number of connections a single IP address can have to your web server:

iptables –A INPUT –p tcp –syn -m multiport -–dport http,https –m connlimit -–connlimit-above 20 –j REJECT -–reject-with-tcp-reset

Let’s look at what this rule does. If a host makes more than 20 (-–connlimit-above 20) new connections (–p tcp –syn) in a minute to the web servers (-–dport http,https), reject the new connection (–j REJECT) and tell the connecting host you are rejecting the connection (-–reject-with-tcp-reset).

Monitor iptables rules

Scenario: Since iptables operates on a “first match wins” basis as packets traverse the rules in a chain, frequently matched rules should be near the top of the policy and less frequently matched rules should be near the bottom. How do you know which rules are traversed the most or the least so they can be ordered nearer the top or the bottom?

Tip #1: See how many times each rule has been hit.

Use this command:

iptables -L -v -n –line-numbers

The command will list all the rules in the chain (-L). Since no chain was specified, all the chains will be listed with verbose output (-v) showing packet and byte counters in numeric format (-n) with line numbers at the beginning of each rule corresponding to that rule’s position in the chain.

Using the packet and bytes counts, you can order the most frequently traversed rules to the top and the least frequently traversed rules towards the bottom.

Tip #2: Remove unnecessary rules.

Which rules aren’t getting any matches at all? These would be good candidates for removal from the policy. You can find that out with this command:

iptables -nvL | grep -v "0     0"

Note: that’s not a tab between the zeros; there are five spaces between the zeros.

Tip #3: Monitor what’s going on.

You would like to monitor what’s going on with iptables in real time, like with top. Use this command to monitor the activity of iptables activity dynamically and show only the rules that are actively being traversed:

watch --interval=5 'iptables -nvL | grep -v "0     0"'

watch runs ‘iptables -nvL | grep -v “0     0″‘ every five seconds and displays the first screen of its output. This allows you to watch the packet and byte counts change over time.

Report on iptables

Scenario: Your manager thinks this iptables firewall stuff is just great, but a daily activity report would be even better. Sometimes it’s more important to write a report than to do the work.

Use the packet filter/firewall/IDS log analyzer FWLogwatch to create reports based on the iptables firewall logs. FWLogwatch supports many log formats and offers many analysis options. It generates daily and monthly summaries of the log files, allowing the security administrator to free up substantial time, maintain better control over network security, and reduce unnoticed attacks.

Here is sample output from FWLogwatch:

More than just ACCEPT and DROP

We’ve covered many facets of iptables, all the way from making sure you don’t lock yourself out when working with iptables to monitoring iptables to visualizing the activity of an iptables firewall. These will get you started down the path to realizing even more iptables tips and tricks.

How to Create SSH Tunneling or Port Forwarding in Linux

Infiniband Switch upgrades

 
To
From
1.0.x
1.1.x
1.3.x
2.0.x
2.1.2 – 2.1.6
2.1.7 – 2.1.9
1.0.x
Upgrade or Downgrade
Upgrade or Downgrade
1.1.x
Upgrade or Downgrade
Upgrade or Downgrade
Upgrade or Downgrade
1.3.x
Upgrade or Downgrade
Upgrade or Downgrade
Upgrade or Downgrade
Upgrade or Downgrade
  • Upgrade
  • Downgrade to 2.1.6 first
2.0.x
Upgrade or Downgrade
Upgrade or Downgrade
Upgrade or Downgrade
  • Upgrade
  • Downgrade to 2.1.6 first
2.1.2 – 2.1.6
Upgrade or Downgrade
Upgrade or Downgrade
Upgrade or Downgrade
  • Upgrade
  • Downgrade to 2.1.6 first
2.1.7 – 2.1.9
  • Upgrade
  • Downgrade to 2.1.6 first
  • Upgrade
  • Downgrade to 2.1.6 first
  • Upgrade
  • Downgrade to 2.1.6 first
Upgrade or Downgrade

For example, upgrading from firmware version 1.1.2 to 1.3.5 is supported. However, upgrading from firmware version 1.1.2 to 2.1.5 is not. You must first upgrade from firmware version 1.1.2 to 1.3.x, and from firmware version 1.3.x to 2.1.5.

Similarly, downgrading from firmware version 2.1.6 to 2.0.7 is supported. However, downgrading from firmware version 2.1.9 to 2.0.7 is not. You must first downgrade from firmware version 2.1.9 to 2.1.6 using the downgrade version of firmware 2.1.6. Then you can downgrade from 2.1.6 to 2.0.7.

Note –  See Firmware Update Guidelines about upgrading and downgrading firmware.

Upgrade the Switch Firmware (CLI)

Note –  Before upgrading or downgrading the switch firmware, read Firmware Update Guidelines.

Note –  If you are going to downgrade the firmware to a version earlier than 2.1, you must disable secret M_Keys. Refer to the Sun Datacenter InfiniBand Switch 36 Administration Guide for Firmware Version 2.1 for instructions on disabling secret M_Key functionality.

Note –  If you are going to downgrade the firmware to a version earlier than 2.0, you must remove user partitions and depopulate the Subnet Manager nodes list. Refer to the Sun Datacenter InfiniBand Switch 36 Administration Guide for Firmware Version 2.1 for instructions on removing partitions for a firmware downgrade.

    1. Consider your first step:
      • If you are upgrading or downgrading from firmware version 2.0 or newer, go to Step 2.
      • If you are upgrading or downgrading from a firmware version earlier than 2.0, go to Step 5.

    1. Open an SSH session as user ilom-admin and connect to the management controller by specifying the controller’s host name.For example: 
      % ssh -l ilom-admin switch_name
ilom-admin@switch_name's password: password
->

      where switch_name is the host name of the management controller. Initially, the password is ilom-admin.

    1. If the Subnet Manager is running on the management controller, disable the Subnet Manager. 
      -> show /SYS/Fabric_Mgmt
NOTE: show on Fabric_Mgmt will launch a restricted Linux shell.
     User can execute switch diagnosis, SM Configuration and IB
     monitoring commands in the shell. To view the list of commands,
     use "help" at rsh prompt.

     Use exit command at rsh prompt to revert back to
     ILOM shell.

FabMan@switch_name->disablesm
Stopping partitiond-daemon.                                [  OK  ]
Stopping IB Subnet Manager..                               [  OK  ]
FabMan@switch_name->exit
exit
->

    1. Go to Step 11.

    1. Open an SSH session as user root and connect to the management controller by specifying the controller’s host name. 
      % ssh -l root switch_name
root@switch_name's password: password
#

      where switch_name is the host name of the management controller. Initially, the password is changeme.

    1. If the Subnet Manager is running on the management controller, disable the Subnet Manager. 
      # disablesm
Stopping partitiond daemon.                                [  OK  ]
Stopping IB Subnet Manager..                               [  OK  ]
#

    1. Verify that there is at least 80 MB available in the / filesystem. 
      # df -h /
Filesystem            Size   Used   Avail  Use%  Mounted on
/dev/hda2             471M   276M   172M   62%   /
#

      In this example, there are 172 MB available. If not enough space is available, you must delete or move files from the / filesystem.

    1. Verify that there is at least 120 MB available in the /tmp directory. 
      # df -h /tmp
Filesystem            Size   Used  Avail  Use%  Mounted on
tmpfs                 250M   240K  249M   1%    /tmp
#

      In this example, there are 249 MB available. If not enough space is available, you must delete files from the /tmp directory.

    1. Verify that there is at least 120 MB free memory available. 
      # free -m
                         total      used       free     shared    buffers    cached
Mem:                     498        104        393      0         12         47
-/+ buffers/cache:       45         453
Swap:                    0          0          0
#

      In the -/+ buffers/cache: row of the free column, there should be at least 120 MB free memory. In this example, there are 453 MB available. If not enough memory is available, you must exit nonessential applications that are running.

    1. Start the Oracle ILOM shell. 
      # spsh
Oracle(R) Integrated Lights Out Manager
Version ILOM 3.0 r47111
Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
->

      You are now in the Oracle ILOM shell.

      You can use the exit command to return to the Linux shell.

    1. Begin the upgrade process. 
      -> load -source URI/pkgname

      where:

      • URI is the uniform resource indicator for the host where the switch firmware package is located. The FTP and HTTP protocols are supported. If you are upgrading from firmware 2.1.2-2 or newer, the TFTP protocol is also supported.
      • pkgname is the name of the firmware package in the transfer directory.

      For example, using the HTTP protocol:

      -> load -source http://123.45.67.89/tmp/sundcs_36p_repository_2.1.9_1.pkg
Downloading firmware image. This will take a few minutes.

      Note –  If you are experiencing version number contention, you can use the –force option to disable version number checking, and force the upgrade.

      The firmware is downloaded. The upgrade begins. A caution is displayed and you are asked to commit to the upgrade.

      NOTE: Firmware upgrade will upgrade the SUN DCS 36p firmware. ILOM will enter a special mode to load
new firmware. No other tasks should be performed in ILOM until the firmware upgrade is complete.

Subnet manager is running on the switch. Proceeding with installation will stop it.
Are you sure you want to load the specified file (y/n)?

    1. Answer y to the prompt to commit to the upgrade.The upgrade begins. 
      Setting up environment for firmware upgrade. This will take few minutes.
Subnet manager has been temporarily disabled on this switch so that firmware upgrade can go on. After the
upgrade is done, please make sure that the SM is running again, using commands sminfo and enablesm.
Starting SUN DCS 36p FW update
========================== 
Performing operation: I4 A 
========================== 
I4 A: I4 is already at the given version. 
=========================== 
Summary of Firmware update 
=========================== 
I4 status                :  FW UPDATE - SUCCESS 
I4 update succeeded on   :  none 
I4 already up-to-date on :  A 
I4 update failed on      :  none 
========================================= 
Performing operation: SUN DCS 36p firmware update 
========================================= 
SUN DCS 36p fw upgrade from 2.1.6-2 to 2.1.9-1: 
Upgrade started... 
Upgrade completed. 
INFO: SUN DCS 36p fw upgrade from 2.1.6-2 to 2.1.9-1 succeeded 
 
Post-install checks started... 
Post-install checks completed. 
Firmware update is complete. 
ILOM will be restarted and will take 2 minutes to come up. 
You will need to reconnect to Integrated Lights Out Manager. 
 
Stopping any already executing ILOM daemons 
Starting event manager 
Starting log manager 
Starting ILOM IPMI stack 
Started ILOM IPMI stack 
Starting lumain 
Starting luproxy 
Starting ealertd 
Starting web server 
Starting SNMP 
Terminated 
#

    1. Exit the Oracle ILOM CLI shell. 
      -> exit
exit
#

    1. Restart the switch to enable the new firmware. 
      -> reset /SP
Are you sure you want to reset /SP (y/n)? y
Performing reset on /SP
Broadcast message from root (Thu Mar 16 14:00:34 2017):
The system is going down for reboot NOW! 
-> Connection to switch_name closed by remote host.
Connection to switch_name closed.

      Note –  The restart process takes between 4 to 5 minutes to complete. The Oracle ILOM stack requires at least 2 minutes to become operational after a reboot.

    1. If the Subnet Manager was previously disabled, log in as the root user and enable the Subnet Manager. 
      % ssh -l root switch_name
root@switch_name's password: password
# enablesm
Starting IB Subnet Manager.                                [  OK  ]
Starting partitiond daemon.                                [  OK  ]
#

    1. Verify the firmware version. 
      # version
SUN DCS 36p version: 2.1.9-1 
Build time: Jan 12 2017 09:16:51
SP board info:
Manufacturing Date: 2013.08.13 
Serial Number: "NCDA00732" 
Hardware Revision: 0x0007 
Firmware Revision: 0x0102
BIOS version: SUN0R100 
BIOS date: 06/22/2010#

      In the first line of the output is SUN DCS 36p version x.y.z-w, where x.y.z–w is the version of the firmware upgraded (or downgraded). For example, 2.1.9-1.

  1. Verify the firmware integrity. 
    # fwverify
Checking all present packages:
........................................................................... OK
Checking if any packages are missing:
........................................................................... OK
Verifying installed files:
........................................................................... OK
Checking FW Coreswitch:
 FW Version: 7.4.3002 OK 
 PSID: SUN_NM2-36p_004 OK 
 Verifying image integrity OK#

How to Install Latest Roundcube Webmail on CentOS 7

Top 10 Linux GUI tools that can make life much easier for a Linux administrator

Linux has become a know how, if you are a system administrator working in a larger environment. Security teams have been deployed by large organizations to keep an eye on vulnerabilities in their systems and take corrective or preventive action as suitable.

In the recent times, many organizations have migrated from Windows, where everything is regulated with a point-and-click GUI. Thankfully, Linux has plenty of GUI tools that can help you keep away from the command line. Linux-based security tools and distributions can be used for penetration testing, reverse engineering, forensics and so on.

Here’s a look at some of the good 10 GUI tools that can make your Linux sysadmin tasks simpler.

1. MySQL Workbench

MySQL Workbench is a visual database design tool that integrates SQLdevelopment, administration, database design, creation and maintenance into a single integrated development environment for the MySQL database system. MySQL Workbench is one of the best tools for working with MySQL databases. Besides managing databases, it also helps you design, develop, and administer MySQL databases. There is a new addition to the MySQL Workbench set of tools, which is the ability to easily migrate Microsoft Access, Microsoft SQL Server, PostgreSQL, Sybase ASE, and other RDBMS tables, objects, and data to MySQL, that alone makes MySQL Workbench worth using.

2. cPanel

cPanel is a Linux based web hosting control panel that provides a GUI and automation tools designed to simplify the process of hosting a web site. It allows you to configure sites, customers’ sites and services, and a lot more. You can also use this tool to configure/manage mail, apps, security, files, domains, apps, databases, logs and many more. However, the only flipside is that cPanel is not available for free. You need to pay to use cPanel.

3. Shorewall

Shorewall is an open source firewall tool for Linux that builds upon the Netfilter (iptables/ipchains) system built into the Linux kernel, making it easier to manage more complex configuration schemes by providing a higher level of abstraction for describing rules using text files. Shorewall is one of the best tops for the server. This security GUI allows you to configure gateways, traffic controlling, VPNs, blacklisting, and much more.

4. Webmin

Webmin is a web-based configuration tool for administering Linux servers. The recent versions can also be installed and run on Windows. Using this tool, you can configure operating system internals, such as users, disk quotas, services or configuration files, as well as modify and control open source apps, such as the Apache HTTP Server, PHP or MySQL. If the default installation does not include what you need, then a large number of third-party modules are available to take up the slack.

5. Apache Directory

Apache Directory is an open source project of the Apache Software Foundation. Though it is designed particularly for Apache Directory Server, it is the only solid GUI tool for managing any LDAP server. It is an Eclipse RCP application and can serve as your LDAP browser, ApacheDS configuration editor, schema editor, ACI editor, LDIF editor and more. The app also contains the latest ApacheDS, which means you can use it to create a DS server in no time.

6. YaST

YaST (Yet another Setup Tool) is a Linux operating system setup and configuration tool for enterprise-grade SUSE and openSUSE. With this all easy-to-use, attractive GUI, you can configure network, hardware, services and tune system security. By default, YaST is installed in all SUSE and openSUSE platforms.

7. Cockpit

Red Hat created Cockpit to make server administration easier. You can handle tasks like journal inspection, storage administration, multiple server monitoring, and starting/stopping services with this web-based GUI. Cockpit will run on Arch Linux, Red Hat Enterprise Linux, Fedora Server, Fedora Atomic, and CentOS Atomic.

8. CUPS

CUPS (an acronym for Common Unix Printing System) is a modular printing system for Unix-like computer operating systems which allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. It is also possible to enable remote administration and Kerberos authentication. The good part about the GUI is its built-in help system using which you can learn almost everything that you need to manage your print server.

9. Zenmap

Zenmap is the official Nmap Security Scanner GUI. It is a multi-platform (Linux, Windows, Mac OS X, BSD, etc.) free and open source application which aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. Scan results can be saved and viewed later. Even though you may not use this tool to directly administer your system, it will become invaluable in the quest for discovering network-related issues.

10. phpMyAdmin

phpMyAdmin is a free and open source tool written in PHP intended to handle the administration of MySQL with the use of a web browser. It can perform various tasks such as creating, modifying or deleting databases, tables, fields or rows; executing SQL statements; or managing users and permissions. You can create and manage MySQL databases with phpMyAdmin via a standard web browser. It means you can install phpMyAdmin on a headless Linux server and connect to it through any browser that has access to the machine.

The above GUI tools are taken in a random manner. If you are a SysAdmin working on Linux workstations, kindly put your favourite GUI in the comments section below.

mount and unmount iso images in linux

An ISO image or .iso (International Organization for Standardization) file is an archive file that contains a disk image called ISO 9660 file system format. Every ISO file have .ISO extension has defined format name taken from the ISO 9660 file system and specially used with CD/DVD Rom’s. In simple words an iso file is a disk image.

This article describes how to mount and unmount an ISO image on a Linux Operating system to access and list the content of files.

How to Mount an ISO Image

To mounting an ISO image on Linux (RedHat, CentOS, Fedora or Ubuntu), you must be logged in as “root” user or switch to “sudo” and run the following commands from a terminal to create a mount point.

# mkdir /mnt/iso
OR
$ sudo mkdir /mnt/iso

Once you created mount point, use the “mount” command to mount an iso file called “Fedora-18-i386-DVD.iso“.

# mount -t iso9660 -o loop /home/norbertk/Fedora-18-i386-DVD.iso /mnt/iso/
OR
$ sudo mount -t iso9660 -o loop /home/norbertk/Fedora-18-i386-DVD.iso /mnt/iso/

After the ISO image mounted successfully, go the mounted directory at /mnt/iso and list the content of an ISO image. It will only mount in read-only mode, so none of the files can be modified.

# cd /mnt/iso
# ls -l

You will see the list of files of an ISO image, that we have mounted in the above command. For example, the directory listing of an Fedora-18-i386-DVD.iso image would look like this.

total 16
drwxrwsr-x  3 root 101737 2048 Jan 10 01:00 images
drwxrwsr-x  2 root 101737 2048 Jan 10 01:00 isolinux
drwxrwsr-x  2 root 101737 2048 Jan 10 01:00 LiveOS
drwxrwsr-x 28 root 101737 4096 Jan 10 00:38 Packages
drwxrwsr-x  2 root 101737 4096 Jan 10 00:43 repodata
-r--r--r--  1 root root   1538 Jan 10 01:00 TRANS.TBL

How to Unmount an ISO Image

Simply run the following command from the terminal either “root” or “sudo” to unmount an mounted ISO image.

# umount /mnt/iso
OR
$ sudo umount /mnt/iso
Where Options
  1. -t : This argument is used to indicate the given filesystem type.
  2. ISO 9660 : It describes standard and default filesystem structure to be used on CD/DVD ROMs.
  3. -o : Options are necessary with a -o argument followed by a separated comma string of options.
  4. loop: The loop device is a pseudo-device that often used for mounting CD/DVD ISO image and makes those files accessible as a block device.

Oracle Linux 7 version for the Raspberry pi

Some time ago the people from the Oracle Linux team have taken the time to build a Oracle Linux 7 version for the Raspberry pi. The Raspberry Pi is a series of small single-board computers developed in the United Kingdom by the Raspberry Pi Foundation to promote the teaching of basic computer science in schools and in developing countries. The original model became far more popular than anticipated, selling outside its target market for uses such as robotics. It does not include peripherals (such as keyboards, mice and cases).

The operating system you use will have to be placed on a single Micro SD card. Using a mac the below command was useful to place the downloaded Oracle Linux 7 distribution for the Raspberry Pi on the Micro SD card:

sudo dd bs=1m if=/var/tmp/rpi3-ol7.3-image.img of=/dev/disk2 conv=sync

If you face the issue of the below error, you most likely have mounted the SD card to your operating system. You will have to unmount it (via the disk utility app) and retry the command. Do note this could take some time to complete.

dd: /dev/disk2: Resource busy

A bit of care is needed when executing the command. If your Micro SD card is NOT mounted on /dev/disk2 you might run into the issue that you damage an existing other disk. Meaning, you need to check if /dev/disk2 is indeed the SD card in your case. Using a Mac you can use the below command to check your disks:

diskutil list

When your dd command is finished and you place the SD card in your Raspberry Pi and start it you should end up with a running Oracle Linux 7 operating system on your Raspberry Pi.

How to Install and Enable Bash Auto Completion in CentOS/RHEL

Crontab – Quick Reference

Setting up cron jobs in Unix, Solaris & Linux

cron is a unix, solaris, Linux utility that allows tasks to be automatically run in the background at regular intervals by the cron daemon. 

cron meaning – There is no definitive explanation but most accepted answers is reportdly from Ken Thompson ( author of unix cron ), name cron comes from chron ,the Greek prefix for ‘time.’.
What is cron ? – Cron is a daemon which runs at the times of system boot from /etc/init.d scripts. If needed it can be stopped/started/restart using init script or with command service crond start in Linux systems.

This document covers following aspects of Unix, Linux cron jobs to help you understand and implement cronjobs successfully

  1. What is crontab?
  2. What is a cron job or cron schedule?
  3. Crontab Restrictions
  4. Crontab Commands
  5. Crontab file – syntax
  6. Crontab Example
  7. Crontab Environment
  8. Disable Email
  9. Generate log file for crontab activity
  10. Crontab file location

1. What is crontab?

Crontab (CRON TABle) is a file which contains the schedule of cron entries to be run and at specified times. File location varies by operating systems, See Crontab file location at the end of this document.

2.What is a cron job or cron schedule?

Cron job or cron schedule is a specific set of execution instructions specifing day, time and command to execute. crontab can have multiple execution statments.

3. Crontab Restrictions

You can execute crontab if your name appears in the file /usr/lib/cron/cron.allow. If that file does not exist, you can use
crontab if your name does not appear in the file /usr/lib/cron/cron.deny.
If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.

4. Crontab Commands

export EDITOR=vi ;to specify a editor to open crontab file.

crontab -e    Edit crontab file, or create one if it doesn’t already exist.
crontab -l    crontab list of cronjobs , display crontab file contents.
crontab -r    Remove your crontab file.
crontab -v    Display the last time you edited your crontab file. (This option is only available on a few systems.)

5. Crontab file

Crontab syntax :
A crontab file has five fields for specifying day , date and time followed by the command to be run at that interval.

*     *     *   *    *        command to be executed
-     -     -   -    -
|     |     |   |    |
|     |     |   |    +----- day of week (0 - 6) (Sunday=0)
|     |     |   +------- month (1 - 12)
|     |     +--------- day of        month (1 - 31)
|     +----------- hour (0 - 23)
+------------- min (0 - 59)

* in the value field above means all legal values as in braces for that column.
The value column can have a * or a list of elements separated by commas. An element is either a number in the ranges shown above or two numbers in the range separated by a hyphen (meaning an inclusive range).
Notes
A. ) Repeat pattern like /2 for every 2 minutes or /10 for every 10 minutes is not supported by all operating systems. If you try to use it and crontab complains it is probably not supported.

B.) The specification of days can be made in two fields: month day and weekday. If both are specified in an entry, they are cumulative meaning both of the entries will get executed .

6. Crontab Examples

A line in crontab file like below removes the tmp files from /home/someuser/tmp each day at 6:30 PM.

30     18     *     *     *         rm /home/someuser/tmp/*

Changing the parameter values as below will cause this command to run at different time schedule below :

min hour day/month month day/week Execution time
30 0 1 1,6,12 * — 00:30 Hrs  on 1st of Jan, June & Dec.
0 20 * 10 1-5 –8.00 PM every weekday (Mon-Fri) only in Oct.
0 0 1,10,15 * * — midnight on 1st ,10th & 15th of month
5,10 0 10 * 1 — At 12.05,12.10 every Monday & on 10th of every month
:

Note : If you inadvertently enter the crontab command with no argument(s), do not attempt to get out with Control-d. This removes all entries in your crontab file. Instead, exit with Control-c.

7. Crontab Environment

cron invokes the command from the user’s HOME directory with the shell, (/usr/bin/sh).
cron supplies a default environment for every shell, defining:
HOME=user’s-home-directory
LOGNAME=user’s-login-id
PATH=/usr/bin:/usr/sbin:.
SHELL=/usr/bin/sh

Users who desire to have their .profile executed must explicitly do so in the crontab entry or in a script called by the entry.

8. Disable Email

By default cron jobs sends a email to the user account executing the cronjob. If this is not needed put the following command At the end of the cron job line .

>/dev/null 2>&1

9. Generate log file

To collect the cron execution execution log in a file :

30 18 * * * rm /home/someuser/tmp/* > /home/someuser/cronlogs/clean_tmp_dir.log

10. Crontab file location

User crontab files are stored by the login names in different locations in different Unix and Linux flavors. These files are useful for backing up, viewing and restoring but should be edited only with crontab command by the users.

  • Mac OS X
    /usr/lib/cron/tabs/
  • BSD Unix 
    /var/cron/tabs/
  • Solaris, HP-UX, Debian, Ubuntu
    /var/spool/cron/crontabs/
  • AIX, Red Hat Linux, CentOS, Ferdora
    /var/spool/cron/

Categories