Minimal CentOS 6.2 Install

Similar to my past attempt to come up with a minimal CentOS 4.x install, I attempted to remove as many unnecessary RPM's from CentOS 6.2 install.  The result is a 183 package install.  You can find the list of minimal CentOS 6.2 RPM's here.

Cheers,
VVK

Minimal CentOS 4.8 Install

I am never satisfied with Red Hat's version of the "minimal" option during an install.  Their version of minimal install comes with unnecessary (IMHO) packages like bluez-*, various PPP and ISDN packages etc.

It is a pain to manually go through and "trim the fat", but I did.  Here is the list of RPM's required for a bare-bones RHEL/CentOS 4.8 install.  Note, to avoid breaking package dependences, I did not use --no-deps.  There are a few packages which could still be removed (mdadm, dmraid, logrotate etc.) but I find them useful, so I decided to keep them.

# rpm -qa | sort | uniq | wc -l
156


You can download the list of minimal RPM's from here.  If I find time, I'll also post the list of minimal RPM's for RHEL/CentOS 5.5.

HTH,
VVK

BackInTime on CentOS 5.x

Back In Time is a simple backup tool geared mostly toward Linux desktop. Only Debian/Ubuntu binary packages are available from the official website.

I like Back In Time because it uses standard Linux tools like rsync,diff and cp to create backups and heavily utilizes hard-links to save space on the backup media.

I wanted to install it on a CentOS 5.x host and decided to create an RPM so others can use it on RPM based distros.

Spec File: backintime-cli.spec
Source RPM: backintime-cli-0.9.26-1.src.rpm
x86 RPM: backintime-cli-0.9.26-1.rhel5.i386.rpm

Configuration
Configuration file is located in /etc/backintime/config. I haven't yet found any useful documentation. The included config file was generated by the KDE4 GUI client. I removed many of the GUI specific configuration lines. If you come across good documentation, please leave a comment.

If you run /usr/bin/backintime as root, it uses /etc/backintime/config for configuration.
If you wish to run backintime as a regular user, copy the /etc/backintime/config file to ~/.config/backintime/config.

Here is what I have managed to figure out from experimenting using the GUI client:

config.version=2
snapshots.automatic_backup_mode=20
snapshots.cron.nice=true

# Manually run snapshots are not removed automatically
snapshots.dont_remove_named_snapshots=true
snapshots.exclude_patterns=*.backup*:*~

# Useful if you have mixed snapshot frequencies
snapshots.expert.per_directory_schedule=true

#0-manual,10-hourly,20-daily,30-weekly,40-monthly
# [file/folder]|[snapshot frequency]
snapshots.include_folders=/etc|30:/home:|20:/root|30:/var/named|40
snapshots.min_free_space.enabled=true

# 10=Mb, 20=Gb
snapshots.min_free_space.unit=20

# Maintain minimum of 1G free space on destination
snapshots.min_free_space.value=1
snapshots.notify.enabled=true

# Backup destination. Create 'backintime' folder manually.
snapshots.path=/backup
snapshots.remove_old_snapshots.enabled=true

# 20=days,30=weeks,80=years
snapshots.remove_old_snapshots.unit=30

# Remove backups older than 27 weeks
snapshots.remove_old_snapshots.value=27

# keep all snapshots from today & yesterday
# keep one snapshot for the last week and one for two weeks ago
# keep one snapshot per month for all previous months of this year
# keep one snapshot per year for all previous years
snapshots.smart_remove=true

Sample run:

[root@lamp32 ~]# backintime -b /etc
Back In Time
Version: 0.9.26

Back In Time comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions; type `backintime --license' for details.

INFO: Lock
INFO: Include folders: ['/etc']
INFO: Ignore folders: []
INFO: Last snapshots: {}
INFO: Compare with old snapshot: 20100320-181730
INFO: Command "rsync -aEAX -i --dry-run --chmod=Fa-w,D+w --whole-file --delete --exclude="/backup" --exclude="/root/.
local/share/backintime" --include="/etc/" --exclude="*.backup*" --exclude="*~" --include="/etc/**" --exclude="*" / "/bac
kup/backintime/20100320-181730/backup/"" returns 0
INFO: Create hard-links
INFO: Command "cp -al "/backup/backintime/20100320-181730/backup/"* "/backup/backintime/new_snapshot/backup/"" returns 0
INFO: Call rsync to take the snapshot
INFO: Command "rsync -aEAX -v --delete-excluded --chmod=Fa-w,D+w --whole-file --delete --exclude="/backup" --exclude="/root/.local/share/backintime" --include="/etc/" --exclude="*.backup*" --exclude="*~" --include="/etc/**" --exclude="*" / "/backup/backintime/new_snapshot/backup/"" returns 0
INFO: Save permissions
INFO: Remove backups older than: 20090907-000000
INFO: [smart remove] keep all >= 20100319-000000
INFO: [smart remove] keep first >= 20100308-000000 and <>= 20100301-000000 and <>= 20100101-000000 and <>= 20100201-000000 and <>

Hope this helps someone looking to run backintime on RHEL/CentOS.

Cheers,
VVK

Unintrusive RPM Distro Audit

As a consultant, I am often faced with an unfamiliar Linux system (usually RHEL). I always find it useful to understand which files that shipped with rpm packages have been modified, since it is usually a good indicator of what customizations have been performed on the system. To determine the modified files, I simply run:

% rpm -qa | xargs rpm --verify --nomtime | less

# Sample output:

missing /usr/local/src
.M...... /bin/ping6
.M...... /usr/bin/chage
.M...... /usr/bin/gpasswd
....L... c /etc/pam.d/system-auth
.M...... /usr/bin/chfn
.M...... /usr/bin/chsh
S.5..... c /etc/rc.d/rc.local
S.5..... c /etc/sysctl.conf
S.5..... c /etc/ssh/sshd_config
S.5..... c /etc/updatedb.conf

The following is taken from the rpm man pages (Verify Options section):



c %config configuration file.
d %doc documentation file.
g %ghost file (i.e. the file contents are not
included in the package payload).
l %license license file.
r %readme readme file.

S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs

Using this trick, I can quickly determine what configuration files have been modified as well as any metadata modifications (ownership, link etc.).

Cheers,
VVK

3rd Party RPM Packages

While auditing an RPM based system, I started wondering what would be the easiest way to determine all the packages installed from 3rd party repositories, such as rpmforge.  Such knowledge is often useful, since some of these repositories contain packages which replace standard packages (example: php packages from remi repository).

I did not find any RPM query flags to query based on Vendor or Packager.  Which meant, extracting the information using queryformat and then parsing the output.

rpm --querytags provides a list of tags you can request in your queries.  For my purposes, I could use VENDOR and PACKAGER.

To find all 3rd party packages you can run:

~]# rpm -qa --queryformat '%{NAME}: %{VENDOR}\n' | grep -v ": CentOS"
gpg-pubkey: (none)
rpmforge-release: Dag Apt Repository, http://dag.wieers.com/apt/
gpg-pubkey: (none)
ncftp: Fedora Project
segatex: Dag Apt Repository, http://dag.wieers.com/apt/
python-xattr: Dag Apt Repository, http://dag.wieers.com/apt/
gpg-pubkey: (none)
gpg-pubkey: (none)
ipython: Fernando Perez


As you can see from the output above, I have ignored packages vended by CentOS.

Similarly, to select packages packaged by Dag Wieers, you can run:

~]# rpm -qa --queryformat '%{NAME}: %{PACKAGER}\n' | grep Dag
rpmforge-release: Dag Wieers
python-xattr: Dag Wieers


Cheers,
VVK

Zabbix & libcurl on x86_64 platform

While building Zabbix 1.6.3 from source on CentOS 5 on x86_64 architecture, I ran into a very strange issue. The following configure line kept giving me errors about libcurl not found.

./configure --prefix=/opt/zabbix --enable-server --with-mysql --with-net-snmp --with-jabber --with-libcurl --enable-agent --disable-ipv6 --with-ldap --with-openipmi
...
...
checking for the version of libcurl... 7.15.5
checking for libcurl >= version 7.13.1... yes
checking for main in -lcurl... no
configure: error: Not found libcurl library

I checked to make sure I had curl and curl-devel installed and sure enough I did. Not only did I have curl - 7.15.5-2.1.el5_3.4.x86_64 & curl-devel - 7.15.5-2.1.el5_3.4.x86_64, but I also had the i386 version.

It took me a long time to figure out that mixing i386 and x86_64 packages is not a good idea. To resolve the issue, I went back and uninstall every i386 package I had installed, many of which were pulled in as dependencies. The problem started when I started to install package without specifying the architecture. For example, instead of running "yum install package", try "yum install package.x86_64". Following are the list of i386 rpms I had to manually remove and install the x86_64 version of them.

[root@crash ~]# cat /var/log/yum.log | grep "Apr 02" | grep i386
Apr 02 20:33:27 Updated: e2fsprogs-libs - 1.39-20.el5.i386
Apr 02 20:33:48 Updated: libselinux - 1.33.4-5.1.el5.i386
Apr 02 20:33:55 Updated: krb5-libs - 1.6.1-31.el5.i386
Apr 02 20:34:05 Installed: mysql - 5.0.45-7.el5.i386
Apr 02 20:34:10 Installed: e2fsprogs-devel - 1.39-20.el5.i386
Apr 02 20:34:13 Installed: libsepol-devel - 1.15.2-1.el5.i386
Apr 02 20:34:15 Installed: libselinux-devel - 1.33.4-5.1.el5.i386
Apr 02 20:34:18 Installed: keyutils-libs-devel - 1.2-1.el5.i386
Apr 02 20:34:22 Installed: krb5-devel - 1.6.1-31.el5.i386
Apr 02 20:34:29 Installed: zlib-devel - 1.2.3-3.i386
Apr 02 20:34:43 Installed: openssl-devel - 0.9.8e-7.el5.i386
Apr 02 20:34:50 Installed: mysql-devel - 5.0.45-7.el5.i386
Apr 02 20:36:17 Updated: elfutils-libelf - 0.137-3.el5.i386
Apr 02 20:36:23 Updated: popt - 1.10.2.3-9.el5.i386
Apr 02 20:36:25 Updated: net-snmp-libs - 1:5.3.2.2-5.el5.i386
Apr 02 20:36:45 Updated: rpm-libs - 4.4.2.3-9.el5.i386
Apr 02 20:37:17 Installed: net-snmp-devel - 1:5.3.2.2-5.el5.i386
Apr 02 20:37:54 Installed: gnutls - 1.4.1-3.el5_2.1.i386
Apr 02 20:42:02 Updated: libgcc - 4.1.2-44.el5.i386
Apr 02 20:43:49 Installed: libidn - 0.6.5-1.1.i386
Apr 02 20:43:51 Installed: curl - 7.15.5-2.1.el5_3.4.i386
Apr 02 20:43:54 Installed: cyrus-sasl-lib - 2.1.22-4.i386
Apr 02 20:43:57 Installed: openldap - 2.3.43-3.el5.i386
Apr 02 20:44:01 Installed: cyrus-sasl-devel - 2.1.22-4.i386
Apr 02 20:44:06 Installed: glib2 - 2.12.3-4.el5_3.1.i386
Apr 02 20:44:08 Installed: gdbm - 1.8.0-26.2.1.i386
Apr 02 20:44:22 Installed: OpenIPMI-libs - 2.0.6-11.el5.i386
Apr 02 20:44:29 Installed: openldap-devel - 2.3.43-3.el5.i386
Apr 02 20:44:35 Installed: curl-devel - 7.15.5-2.1.el5_3.4.i386
Apr 02 20:44:42 Installed: OpenIPMI-devel - 2.0.6-11.el5.i386

After fixing the packages, I ran "make clean" and then ran the ./configure line again for a successful compile.

Bottom line, don't mix x86_64 and i386 packages, unless you absolutely have to.

Cheers,
VVK

jpackage-utils incompatibility

If you receive the following error on CentOS 5 or RHEL 5 machine, chance are you have installed jpackage-utils from jpackage17-generic repository.

---> Package java-1.4.2-gcj-compat.x86_64 0:1.4.2.0-40jpp.115 set to be updated
--> Processing Dependency: /usr/bin/rebuild-security-providers for package: java-1.4.2-gcj-compat
--> Processing Dependency: /usr/bin/rebuild-security-providers for package: java-1.4.2-gcj-compat
--> Finished Dependency Resolution
Error: Missing Dependency: /usr/bin/rebuild-security-providers is needed by package java-1.4.2-gcj-compat

You have to pick either the jpackage-utils provided by the distro or the jpackage repo version due to incompatibility ( see http://www.redhat.com/archives/rhl-devel-list/2006-March/msg00723.html).

Try (at your own risk):
# rpm -e --nodeps jpackage-utils
# yum --disablerepo=jpackage-generic install jpackage-utils

Keep in mind, any packages which depend on the jpackage repo version of jpackage-utils might not work after the above change.

Cheers,
VVK

librelp RPM spec

If you are planning to use relp feature in rsyslog, then you must install librelp. Here is my configure line for rsyslog-4.1.3:


./configure RELP_LIBS=-L/usr/local/librelp/lib -lrelp -lrt RELP_CFLAGS=-I/usr/local/librelp/include --prefix=/usr/local/rsyslog --enable-gnutls --enable-relp


and librelp spec file.


%define product_name librelp
%define product_version 0.1.1
%define rpm_release 1%{?dist}

%define product_nameversion %{product_name}-%{product_version}
%define product_source_dir %{product_nameversion}
%define product_tarball %{product_nameversion}.tar.gz
%define product_prefix /usr/local/librelp

Summary: Rsyslog librelp support library
Name: %{product_name}
Version: %{product_version}
Release: %{rpm_release}
License: GPLv3
Packager: VVK
Group: System Environment/Libraries
URL: http://www.librelp.com
Source0: http://download.rsyslog.com/librelp/%{product_tarball}
BuildRoot: %{_tmppath}/%{product_nameversion}-build-root

%description
librelp is an easy to use library for the RELP protocol. RELP in turn provides reliable event logging over the network (and consequently RELP stands for Reliable Event Logging Protocol).
RELP (and hence) librelp assures that no message is lost, not even when connections break and a peer becomes unavailable. The current version of RELP has a minimal window of opportunity for message duplication after a session has been broken due to network problems. In this case, a few messages may be duplicated (a problem that also exists with plain tcp syslog). Future versions of RELP will address this shortcoming.

%prep
rm -rf ${RPM_BUILD_ROOT}
%setup -q -n %{product_nameversion}

%build
umask 022
./configure --prefix=%{product_prefix}
make

%install
umask 022
mkdir -p ${RPM_BUILD_ROOT}/etc/ld.so.conf.d
make install DESTDIR=${RPM_BUILD_ROOT}
echo "/usr/local/librelp/lib" > ${RPM_BUILD_ROOT}/etc/ld.so.conf.d/librelp.conf
%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig

%clean
rm -rf ${RPM_BUILD_ROOT}

%files
%defattr(-,root,root,-)
%{product_prefix}
/etc/ld.so.conf.d

%changelog
* Sat Sep 01 2007 VVK - 0.1.1-1
- Initial build.
- Built on CentOS 5


I did not build an RPM for rsyslog, because I decided to go with the 2.x series, and there is already an RPM for it in the CentOS repo. I did not want to waste the effort I put into compiling rsyslog-4.1.3 and librelp, so I decided to turn it into a blog post...maybe someone out there will find it useful :-)

Cheers,
VVK