PHP曝DOS漏洞可致CPU灌满涉及多个PHP版本

近日，PHP被爆出存在远程DOS漏洞，若黑客利用该漏洞构造PoC发起连接，容易导致目标主机CPU被迅速消耗。此漏洞涉及众多PHP版本，因而影响范围极大。

漏洞产生的原因是PHP解析multipart/form-datahttp请求的body part请求头时，重复拷贝字符串导致DOS。而远程攻击者可以通过发送恶意构造的multipart/form-data请求，导致服务器CPU资源被耗尽，从而远程DOS服务器。

另据了解，在今年4月3日就有用户在PHP官网提交了PHP远程DoS漏洞（PHP Multipart/form-data remote dos Vulnerability），代号69364。由于该漏洞涉及PHP的众多版本，故其影响面较大，一经发布迅速引发多方面关注。此后，各种PoC已经在网络上流传。

此次漏洞具备如下特性：

1. 一旦被利用成功，可以在迅速消耗被攻击主机的 CPU 资源，从而达到 DoS 的目的；

2. PHP 在全球的部署量相当大，为攻击者提供了相当多可以攻击的目标；

3. PHP 官方目前仅给出了 5.4 及 5.5 版本的补丁

受此漏洞影响的软件及系统包括 PHP 的如下版本。

• PHP 5.0.0 – 5.0.5

• PHP 5.1.0 – 5.1.6

• PHP 5.2.0 – 5.2.17

• PHP 5.3.0 – 5.3.29

• PHP 5.4.0 – 5.4.40

• PHP 5.5.0 – 5.5.24

• PHP 5.6.0 – 5.6.8

根据绿盟漏洞检测数据显示，在提交了5596个网站中，有1400多个网站存在漏洞，中枪率约为25%。

截止到发稿为止，PHP官方已经提供了PHP 5.4.41、5.5.25、5.6.9 的补丁，而PHP 5.3版本补丁暂未提供，但有网友根据官方补丁，制作了PHP5.3 版本的”民间版”补丁：https://coding.net/u/simapple/p/oldphppatch/git

漏洞检测地址：https://portal.nsfocus.com/vulnerability/list/

Posted in 安全通告.

Tagged with PHPDOS漏洞, 安全通告.

No comments

By C1G – 2015/05/21

开源分布式搜索平台ELK(Elasticsearch+Logstash+Kibana)+Redis+Syslog-ng实现日志实时搜索

logstash + elasticsearch + Kibana+Redis+Syslog-ng

ElasticSearch是一个基于Lucene构建的开源，分布式，RESTful搜索引擎。设计用于云计算中，能够达到实时搜索，稳定，可靠，快速，安装使用方便。支持通过HTTP使用JSON进行数据索引。

logstash是一个应用程序日志、事件的传输、处理、管理和搜索的平台。你可以用它来统一对应用程序日志进行收集管理，提供 Web 接口用于查询和统计。其实logstash是可以被别的替换，比如常见的fluented

Kibana是一个为 Logstash 和 ElasticSearch 提供的日志分析的 Web 接口。可使用它对日志进行高效的搜索、可视化、分析等各种操作。

Redis是一个高性能的内存key-value数据库,非必需安装,可以防止数据丢失.

参考:
http://www.logstash.net/
http://chenlinux.com/2012/10/21/elasticearch-simple-usage/
http://www.elasticsearch.cn
http://download.oracle.com/otn-pub/java/jdk/7u67-b01/jdk-7u67-linux-x64.tar.gz?AuthParam=1408083909_3bf5b46169faab84d36cf74407132bba
http://curran.blog.51cto.com/2788306/1263416
http://storysky.blog.51cto.com/628458/1158707/
http://zhumeng8337797.blog.163.com/blog/static/10076891420142712316899/
http://enable.blog.51cto.com/747951/1049411
http://chenlinux.com/2014/06/11/nginx-access-log-to-elasticsearch/
http://www.w3c.com.cn/%E5%BC%80%E6%BA%90%E5%88%86%E5%B8%83%E5%BC%8F%E6%90%9C%E7%B4%A2%E5%B9%B3%E5%8F%B0elkelasticsearchlogstashkibana%E5%85%A5%E9%97%A8%E5%AD%A6%E4%B9%A0%E8%B5%84%E6%BA%90%E7%B4%A2%E5%BC%95
http://woodygsd.blogspot.com/2014/06/an-adventure-with-elk-or-how-to-replace.html
http://www.ricardomartins.com.br/enviando-dados-externos-para-a-stack-elk/
http://tinytub.github.io/logstash-install.html

http://jamesmcfadden.co.uk/securing-elasticsearch-with-nginx/
https://github.com/elasticsearch/logstash/blob/master/patterns/grok-patterns
http://zhaoyanblog.com/archives/319.html
http://www.vpsee.com/2014/05/install-and-play-with-elasticsearch/

ip说明
118.x.x.x/16 为客户端ip
192.168.0.39和61.x.x.x为ELK的内网和外网ip

安装JDK

http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

tar zxvf jdk-7u67-linux-x64.tar.gz\?AuthParam\=1408083909_3bf5b46169faab84d36cf74407132b
mv jdk1.7.0_67 /usr/local/
cd /usr/local/
ln -s jdk1.7.0_67 jdk
chown -R root:root jdk/

配置环境变量
vi /etc/profile

export JAVA_HOME=/usr/local/jdk
export JRE_HOME=$JAVA_HOME/jre
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib:$CLASSPATH
export PATH=$JAVA_HOME/bin:$PATH
export REDIS_HOME=/usr/local/redis
export ES_HOME=/usr/local/elasticsearch
export ES_CLASSPATH=$ES_HOME/config

变量生效
source /etc/profile

验证版本
java -version

java version "1.7.0_67"
Java(TM) SE Runtime Environment (build 1.7.0_67-b01)
Java HotSpot(TM) 64-Bit Server VM (build 24.65-b04, mixed mode)

如果之前安装过java,可以先卸载
rpm -qa |grep java
java-1.6.0-openjdk-1.6.0.0-1.24.1.10.4.el5
java-1.6.0-openjdk-devel-1.6.0.0-1.24.1.10.4.el5

rpm -e java-1.6.0-openjdk-1.6.0.0-1.24.1.10.4.el5 java-1.6.0-openjdk-devel-1.6.0.0-1.24.1.10.4.el5

安装redis

http://redis.io/

wget http://download.redis.io/releases/redis-2.6.17.tar.gz
tar zxvf redis-2.6.17.tar.gz
mv redis-2.6.17 /usr/local/
cd /usr/local
ln -s redis-2.6.17 redis
cd /usr/local/redis
make
make install

cd utils
./install_server.sh

Please select the redis port for this instance: [6379]
Selecting default: 6379
Please select the redis config file name [/etc/redis/6379.conf]
Selected default - /etc/redis/6379.conf
Please select the redis log file name [/var/log/redis_6379.log]
Selected default - /var/log/redis_6379.log
Please select the data directory for this instance [/var/lib/redis/6379]
Selected default - /var/lib/redis/6379
Please select the redis executable path [/usr/local/bin/redis-server]

编辑配置文件
vi /etc/redis/6379.conf

daemonize yes
port 6379
timeout 300
tcp-keepalive 60

启动
/etc/init.d/redis_6379 start

exists, process is already running or crashed
如报这个错,需要编辑下/etc/init.d/redis_6379,去除头上的\n

加入自动启动
chkconfig –add redis_6379

安装Elasticsearch

http://www.elasticsearch.org/
http://www.elasticsearch.cn
集群安装只要节点在同一网段下，设置一致的cluster.name，启动的Elasticsearch即可相互检测到对方，组成集群

wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.3.2.tar.gz
tar zxvf elasticsearch-1.3.2.tar.gz
mv elasticsearch-1.3.2 /usr/local/
cd /usr/local/
ln -s elasticsearch-1.3.2 elasticsearch
elasticsearch/bin/elasticsearch -f

[2014-08-20 13:19:05,710][INFO ][node ] [Jackpot] version[1.3.2], pid[19320], build[dee175d/2014-08-13T14:29:30Z]
[2014-08-20 13:19:05,727][INFO ][node ] [Jackpot] initializing ...
[2014-08-20 13:19:05,735][INFO ][plugins ] [Jackpot] loaded [], sites []
[2014-08-20 13:19:10,722][INFO ][node ] [Jackpot] initialized
[2014-08-20 13:19:10,723][INFO ][node ] [Jackpot] starting ...
[2014-08-20 13:19:10,934][INFO ][transport ] [Jackpot] bound_address {inet[/0.0.0.0:9301]}, publish_address {inet[/61.x.x.x:9301]}
[2014-08-20 13:19:10,958][INFO ][discovery ] [Jackpot] elasticsearch/5hUOX-2ES82s_0zvI9BUdg
[2014-08-20 13:19:14,011][INFO ][cluster.service ] [Jackpot] new_master [Jackpot][5hUOX-2ES82s_0zvI9BUdg][Impala][inet[/61.x.x.x:9301]], reason: zen-disco-join (elected_as_master)
[2014-08-20 13:19:14,060][INFO ][http ] [Jackpot] bound_address {inet[/0.0.0.0:9201]}, publish_address {inet[/61.x.x.x:9201]}
[2014-08-20 13:19:14,061][INFO ][node ] [Jackpot] started
[2014-08-20 13:19:14,106][INFO ][gateway ] [Jackpot] recovered [0] indices into cluster_state
[2014-08-20 13:20:58,273][INFO ][node ] [Jackpot] stopping ...
[2014-08-20 13:20:58,323][INFO ][node ] [Jackpot] stopped
[2014-08-20 13:20:58,323][INFO ][node ] [Jackpot] closing ...
[2014-08-20 13:20:58,332][INFO ][node ] [Jackpot] closed

ctrl+c退出

以后台方式运行
elasticsearch/bin/elasticsearch -d

访问默认的9200端口
curl -X GET http://localhost:9200

{
"status" : 200,
"name" : "Steve Rogers",
"version" : {
"number" : "1.3.2",
"build_hash" : "dee175dbe2f254f3f26992f5d7591939aaefd12f",
"build_timestamp" : "2014-08-13T14:29:30Z",
"build_snapshot" : false,
"lucene_version" : "4.9"
},
"tagline" : "You Know, for Search"
}

安装logstash

http://logstash.net/

wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz
tar zxvf logstash-1.4.2.tar.gz
mv logstash-1.4.2 /usr/local
cd /usr/local
ln -s logstash-1.4.2 logstash
mkdir logstash/conf
chown -R root:root logstash

因为java的默认heap size,回收机制等原因,logstash从1.4.0开始不再使用jar运行方式.
以前方式:
java -jar logstash-1.3.3-flatjar.jar agent -f logstash.conf
现在方式:
bin/logstash agent -f logstash.conf

logstash下载即可使用，命令行参数可以参考logstash flags，主要有
http://logstash.net/docs/1.2.1/flags

安装kibana

logstash的最新版已经内置kibana，你也可以单独部署kibana。kibana3是纯粹JavaScript+html的客户端，所以可以部署到任意http服务器上。
http://www.elasticsearch.org/overview/elkdownloads/

wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.0.tar.gz
tar zxvf kibana-3.1.0.tar.gz
mv kibana-3.1.0 /opt/htdocs/www/kibana
vi /opt/htdocs/www/kibana/config.js

配置elasticsearch源
elasticsearch: “http://”+window.location.hostname+”:9200″,

加入iptables
6379为redis端口,9200为elasticsearch端口,118.x.x.x/16为当前测试时的客户端ip

iptables -A INPUT -p tcp -m tcp -s 118.x.x.x/16 --dport 9200 --j ACCEPT

测试运行前端输出
bin/logstash -e ‘input { stdin { } } output { stdout {} }’

输入hello测试
2014-08-20T05:17:02.876+0000 Impala hello

测试运行输出到后端
bin/logstash -e ‘input { stdin { } } output { elasticsearch { host => localhost } }’

访问kibana
http://big.c1gstudio.com/kibana/index.html#/dashboard/file/default.json
Yes- Great! We have a prebuilt dashboard: (Logstash Dashboard). See the note to the right about making it your global default

No results There were no results because no indices were found that match your selected time span

设置kibana读取源
在kibana的右上角有个 configure dashboard,再进入Index Settings
[logstash-]YYYY.MM.DD
这个需和logstash的输出保持一致

elasticsearch 跟 MySQL 中定义资料格式的角色关系对照表如下

MySQL elasticsearch
database index
table type

table schema mapping
row document
field field

ELK整合

syslog-ng.conf

#省略其它内容
# Remote logging syslog
source s_remote {
udp(ip(192.168.0.39) port(514));
};
#nginx log
source s_remotetcp {
tcp(ip(192.168.0.39) port(514) log_fetch_limit(100) log_iw_size(50000) max-connections(50) );
};
filter f_filter12 { program('c1gstudio\.com'); };
#logstash syslog
destination d_logstash_syslog { udp("localhost" port(10999) localport(10998) ); };
#logstash web
destination d_logstash_web { tcp("localhost" port(10997) localport(10996) ); };
log { source(s_remote); destination(d_logstash_syslog); };
log { source(s_remotetcp); filter(f_filter12); destination(d_logstash_web); };

logstash_syslog.conf

input {
udp {
port => 10999
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch {
host => localhost
index => "syslog-%{+YYYY}"
}
}

logstash_redis.conf

input {
tcp {
port => 10997
type => web
}
}
filter {
grok {
match => [ "message", "%{SYSLOGTIMESTAMP:syslog_timestamp} (?:%{SYSLOGFACILITY:syslog_facility} )?%{SYSLOGHOST:syslog_source} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{IPORHOST:clientip} - (?:%{USER:remote_user}|-) \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} (?:%{NUMBER:body_bytes_sent}|-) \"(?:%{URI:http_referer}|-)\" %{QS:agent} (?:%{IPV4:http_x_forwarded_for}|-)"]
remove_field => [ '@version','host','syslog_timestamp','syslog_facility','syslog_pid']
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
useragent {
source => "agent"
prefix => "useragent_"
remove_field => [ "useragent_device", "useragent_major", "useragent_minor" ,"useragent_patch","useragent_os","useragent_os_major","useragent_os_minor"]
}
geoip {
source => "clientip"
fields => ["country_name", "region_name", "city_name", "real_region_name", "latitude", "longitude"]
remove_field => [ "[geoip][longitude]", "[geoip][latitude]","location","region_name" ]
}
}
output {
#stdout { codec => rubydebug }
redis {
batch => true
batch_events => 500
batch_timeout => 5
host => "127.0.0.1"
data_type => "list"
key => "logstash:web"
workers => 2
}
}

logstash_web.conf

input {
redis {
host => "127.0.0.1"
port => "6379"
key => "logstash:web"
data_type => "list"
codec => "json"
type => "web"
}
}
output {
elasticsearch {
flush_size => 5000
host => localhost
idle_flush_time => 10
index => "web-%{+YYYY.MM.dd}"
}
#stdout { codec => rubydebug }
}

启动elasticsearch和logstash
/usr/local/elasticsearch/bin/elasticsearch -d

/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_syslog.conf &
/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_redis.conf &
/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_web.conf &

关闭
ps aux|egrep ‘search|logstash’
kill pid

安装控制器elasticsearch-servicewrapper
如果是在服务器上就可以使用elasticsearch-servicewrapper这个es插件，它支持通过参数，指定是在后台或前台运行es，并且支持启动，停止，重启es服务（默认es脚本只能通过ctrl+c关闭es）。使用方法是到https://github.com/elasticsearch/elasticsearch-servicewrapper下载service文件夹，放到es的bin目录下。下面是命令集合：
bin/service/elasticsearch +
console 在前台运行es
start 在后台运行es
stop 停止es
install 使es作为服务在服务器启动时自动启动
remove 取消启动时自动启动

vi /usr/local/elasticsearch/service/elasticsearch.conf
set.default.ES_HOME=/usr/local/elasticsearch

命令示例

查看状态
http://61.x.x.x:9200/_status?pretty=true

集群健康查看
http://61.x.x.x:9200/_cat/health?v
epoch timestamp cluster status node.total node.data shards pri relo init unassign
1409021531 10:52:11 elasticsearch yellow 2 1 20 20 0 0 20

列出集群索引
http://61.x.x.x:9200/_cat/indices?v
health index pri rep docs.count docs.deleted store.size pri.store.size
yellow web-2014.08.25 5 1 5990946 0 3.6gb 3.6gb
yellow kibana-int 5 1 2 0 20.7kb 20.7kb
yellow syslog-2014 5 1 709 0 585.6kb 585.6kb
yellow web-2014.08.26 5 1 1060326 0 712mb 712mb

删除索引
curl -XDELETE ‘http://localhost:9200/kibana-int/’
curl -XDELETE ‘http://localhost:9200/logstash-2014.08.*’

优化索引
$ curl -XPOST ‘http://localhost:9200/old-index-name/_optimize’

查看日志
tail /usr/local/elasticsearch/logs/elasticsearch.log

2.4mb]->[2.4mb]/[273mb]}{[survivor] [3.6mb]->[34.1mb]/[34.1mb]}{[old] [79.7mb]->[80mb]/[682.6mb]}
[2014-08-26 10:37:14,953][WARN ][monitor.jvm ] [Red Shift] [gc][young][71044][54078] duration [43s], collections [1]/[46.1s], total [43s]/[26.5m], memory [384.7mb]->[123mb]/[989.8mb], all_pools {[young] [270.5mb]->[1.3mb]/[273mb]}{[survivor] [34.1mb]->[22.3mb]/[34.1mb]}{[old] [80mb]->[99.4mb]/[682.6mb]}
[2014-08-26 10:38:03,619][WARN ][monitor.jvm ] [Red Shift] [gc][young][71082][54080] duration [6.6s], collections [1]/[9.1s], total [6.6s]/[26.6m], memory [345.4mb]->[142.1mb]/[989.8mb], all_pools {[young] [224.2mb]->[2.8mb]/[273mb]}{[survivor] [21.8mb]->[34.1mb]/[34.1mb]}{[old] [99.4mb]->[105.1mb]/[682.6mb]}
[2014-08-26 10:38:10,109][INFO ][cluster.service ] [Red Shift] removed {[logstash-Impala-26670-2010][av8JOuEoR_iK7ZO0UaltqQ][Impala][inet[/61.x.x.x:9302]]{client=true, data=false},}, reason: zen-disco-node_failed([logstash-Impala-26670-2010][av8JOuEoR_iK7ZO0UaltqQ][Impala][inet[/61.x.x.x:9302]]{client=true, data=false}), reason transport disconnected (with verified connect)
[2014-08-26 10:39:37,899][WARN ][monitor.jvm ] [Red Shift] [gc][young][71171][54081] duration [3.4s], collections [1]/[4s], total [3.4s]/[26.6m], memory [411.7mb]->[139.5mb]/[989.8mb], all_pools {[young] [272.4mb]->[1.5mb]/[273mb]}{[survivor] [34.1mb]->[29.1mb]/[34.1mb]}{[old] [105.1mb]->[109mb]/[682.6mb]}

安装bigdesk
要想知道整个插件的列表，请访问http://www.elasticsearch.org/guide/reference/modules/plugins/ 插件还是很多的，个人认为比较值得关注的有以下几个，其他的看你需求，比如你要导入数据当然就得关注river了。

该插件可以查看集群的jvm信息，磁盘IO，索引创建删除信息等，适合查找系统瓶颈，监控集群状态等，可以执行如下命令进行安装，或者访问项目地址:https://github.com/lukas-vlcek/bigdesk

bin/plugin -install lukas-vlcek/bigdesk

Downloading .........................................................................................................................................................................................................................................................DONE
Installed lukas-vlcek/bigdesk into /usr/local/elasticsearch/plugins/bigdesk
Identified as a _site plugin, moving to _site structure ...

cp -ar plugins/bigdesk/_site/ /opt/htdocs/www/bigdesk
访问
http://localhost/bigdesk

bigdesk

安全优化

1.安全漏洞,影响ElasticSearch 1.2及以下版本 http://bouk.co/blog/elasticsearch-rce/
/usr/local/elasticsearch/config/elasticsearch.yml
script.disable_dynamic: true

2.如果有多台机器，可以以每台设置n个shards的方式，根据业务情况，可以考虑取消replias
这里设置默认的5个shards, 复制为0，shards定义后不能修改,replicas可以动态修改
/usr/local/elasticsearch/config/elasticsearch.yml
index.number_of_shards: 5
index.number_of_replicas: 0

#定义数据目录(可选)
path.data: /opt/elasticsearch

3.内存适当调大，初始是-Xms256M, 最大-Xmx1G,-Xss256k，
调大后，最小和最大一样，避免GC, 并根据机器情况，设置内存大小，
vi /usr/local/elasticsearch/bin/elasticsearch.in.sh
if [ “x$ES_MIN_MEM” = “x” ]; then
#ES_MIN_MEM=256m
ES_MIN_MEM=2g
fi
if [ “x$ES_MAX_MEM” = “x” ]; then
#ES_MAX_MEM=1g
ES_MAX_MEM=2g
fi

4.减少shard刷新间隔
curl -XPUT ‘http://61.x.x.x:9200/dw-search/_settings’ -d ‘{
“index” : {
“refresh_interval” : “-1”
}
}’

完成bulk插入后再修改为初始值
curl -XPUT ‘http://61.x.x.x:9200/dw-search/_settings’ -d ‘{
“index” : {
“refresh_interval” : “1s”
}
}’

/etc/elasticsearch/elasticsearch.yml
tranlog数据达到多少条进行平衡，默认为5000,刷新频率，默认为120s
index.translog.flush_threshold_ops: “100000”
index.refresh_interval: 60s

5.关闭文件的更新时间

/etc/fstab

在文件中添加 noatime,nodiratime
/dev/sdc1 /data1 ext4 noatime,nodiratime 0 0

自启动
chkconfig add redis_6379
vi /etc/rc.local
/usr/local/elasticsearch/bin/elasticsearch -d
/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_syslog.conf &
/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_redis.conf &
/usr/local/logstash/bin/logstash agent -f /usr/local/logstash/conf/logstash_web.conf &
/opt/lemp startnginx

安装问题

==========================================
LoadError: Could not load FFI Provider: (NotImplementedError) FFI not available: null
See http://jira.codehaus.org/browse/JRUBY-4583

一开始我以为是没有FFI,把jruby,ruby gem都装了一遍.
实际是由于我的/tmp没有运行权限造成的,建个tmp目录就可以了,附上ruby安装步骤.

mkdir /usr/local/jdk/tmp

vi /usr/local/logstash/bin/logstash.lib.sh
JAVA_OPTS=”$JAVA_OPTS -Djava.io.tmpdir=/usr/local/jdk/tmp”

===============================
jruby 安装

wget http://jruby.org.s3.amazonaws.com/downloads/1.7.13/jruby-bin-1.7.13.tar.gz
mv jruby-1.7.13 /usr/local/
cd /usr/local/
ln -s jruby-1.7.13 jruby

Ruby Gem 安装
Ruby 1.9.2版本默认已安装Ruby Gem
安装gem 需要ruby的版本在 1.8.7 以上，默认的centos5 上都是1.8.5 版本，所以首先你的升级你的ruby ，

ruby -v
ruby 1.8.5 (2006-08-25) [x86_64-linux]

wget http://cache.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p547.tar.gz
tar zxvf ruby-1.9.3-p547.tar.gz
cd ruby-1.9.3-p547
./configure --prefix=/usr/local/ruby-1.9.3-p547
make && make install
cd /usr/local
ln -s ruby-1.9.3-p547 ruby

vi /etc/profile
export PATH=$JAVA_HOME/bin:/usr/local/ruby/bin:$PATH
source /etc/profile

gem install bundler
gem install i18n
gem install ffi

=======================

elasticsearch 端口安全
绑定内网ip

iptables 只开放内网

前端机反向代理
server
{
listen 9201;
server_name big.c1gstudio.com;
index index.html index.htm index.php;
root /opt/htdocs/www;
include manageip.conf;
deny all;

location / {
proxy_pass http://192.168.0.39:9200;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-Forwarded-For $remote_addr;
add_header X-Cache Cache-156;
proxy_redirect off;
}

access_log /opt/nginx/logs/access.log access;
}

kibana的config.js
elasticsearch: “http://”+window.location.hostname+”:9201″,

Posted in Elasticsearch/Logstash/Kibana, 技术, 日志.

Tagged with Elasticsearch, Kibana, Logstash, redis, syslog-ng, 大数据, 日志.

No comments

By C1G – 2015/02/10

Linux glibc幽灵漏洞检测及修复方案

幽灵漏洞是Linux glibc库上出现的一个严重的安全问题，他可以让攻击者在不了解系统的任何情况下远程获取操作系统的控制权限。目前他的CVE编号为CVE-2015-0235。

什么是glibc

glibc是GNU发布的libc库，即c运行库。glibc是linux系统中最底层的api，几乎其它任何运行库都会依赖于glibc。glibc除了封装linux操作系统所提供的系统服务外，它本身也提供了许多其它一些必要功能服务的实现。glibc 囊括了几乎所有的 UNIX 通行的标准。

出现了什么漏洞

代码审计公司Qualys的研究人员在glibc库中的__nss_hostname_digits_dots()函数中发现了一个缓冲区溢出的漏洞，这个bug可以经过 gethostbyname*()函数被本地或者远程的触发。应用程序主要使用gethostbyname*()函数发起DNS请求，这个函数会将主机名称转换为ip地址。

漏洞危害

这个漏洞造成了远程代码执行，攻击者可以利用此漏洞获取系统的完全控制权。

漏洞证明

在我们的测试中，我们编写了一个POC，当我们发送一封精心构造的电子邮件给服务器后，我们便可以获得远程Linux服务器的shell，这绕过了目前在32位和64位系统的所有保护（如ASLR，PIE和NX）。

我们能做什么？

给操作系统及时打补丁，我们（Qualys）已与Linux发行商紧密合作，会及时发布补丁。

为什么叫做GHOST？

因为他通过GetHOST函数触发。

哪些版本和操作系统受影响？

第一个受影响的版本是GNU C库的glibc-2.2，2000年11月10号发布。我们已找出多种可以减轻漏洞的方式。我们发现他在2013年5月21号（在glibc-2.17和glibc-2.18发布之间）已经修复。不幸的是他们不认为这是个安全漏洞。从而导致许多稳定版本和长期版本暴露在外，其中包括Debian 7 (wheezy)，Red Hat Enterprise，Linux 5 & 6 & 7，CentOS 5 & 6 & 7，Ubuntu 12.04等

修复方案

升级glibc库:

RHEL/CentOS ： sudo yum update glibc

Ubuntu : sudo apt-get update ; sudo apt-get install libc6

漏洞测试方法：

wget https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c
编译：
gcc -o GHOST GHOST.c

执行：
./GHOST

如果输出：
[root@localhost home]# ./GHOST
not vulnerable

表示漏洞已经修复，如果仅输出“vulnerable”字样，表示漏洞依然存在。

脚本测试漏洞

wget -O GHOST-test.sh http://www.cyberciti.biz/files/scripts/GHOST-test.sh.txt
bash GHOST-test.sh
[root@localhost ~]# bash GHOST-test.sh
Vulnerable glibc version <= 2.17-54 Vulnerable glibc version <= 2.5-122 Vulnerable glibc version <= 2.12-1.148 Detected glibc version 2.12 revision 149 Not Vulnerable. 参考: http://blog.chinaunix.net/uid-509190-id-4807958.html

Posted in 安全通告.

Tagged with glibc幽灵漏洞.

No comments

By C1G – 2015/02/05

goaccess分析nginx日志

GoAcces是一款实时日志分析工具.

目前，我们可以通过这款软件查看的统计信息有：

统计概况，流量消耗等
访客排名
动态Web请求
静态web请求，如图片、样式表、脚本等。
来路域名
404 错误
操作系统
浏览器和搜索引擎
主机、DNS和IP地址
HTTP 响应代码
引荐网站
键盘布局
自定义显示
支持超大日志（分析速度很快）

需要用到的几个库文件有：

glib2
GeoIP
ncurses

安装goaccess

yum install glib2 glib2-devel GeoIP-devel ncurses-devel
wget http://sourceforge.net/projects/goaccess/files/0.5/goaccess-0.5.tar.gz/download
tar zxvf goaccess-0.5.tar.gz
cd goaccess-0.5
./configure --enalbe-geoip --enable-utf8
make && make install

GoAccess的基本语法如下：

goaccess [ -b ][ -s ][ -e IP_ADDRESS][ -a ] <-f log_file >
参数说明：

-f – 日志文件名
-b – 开启流量统计，如果希望加快分析速度不建议使用该参数
-s – 开启HTTP响应代码统计
-a – 开启用户代理统计
-e – 开启指定IP地址统计，默认禁用
用法示例：

最简单、常用的命令就是直接调用goaccess命令啦，不带任何影响效率的其他参数

goaccess -f access.log

分析打包文件
zcat access.log.1.gz | goaccess

常见错误:
Your terminal does not support color

vi ~/.bashrc

在最后面添加一行：

export TERM=”xterm-256color”

保存后执行 source ~/.bashrc生效即可

参考:
http://www.linuxde.net/2013/03/12943.html

Posted in 日志.

Tagged with GoAccess, 日志.

No comments

By C1G – 2015/01/27

nagios增加监控网卡速率插件check_ethspeed.sh

服务器上线时间长了,网线可能会老化或接触不良导致达不到工作速率.
增加个nagios插件随机监控网卡速率

参阅:linux查看和改变网卡工作速率

cd /opt/nagios/libexec
vi check_ethspeed.sh

#!/bin/bash
#########################################################################
#
# File: check_ethspeed.sh
# Description: Nagios check plugins to check eth speed in *nix.
# Language: GNU Bourne-Again SHell
# Version: 1.0.1
# Date: 2015-1-23
# Author: C1g
# Bog: http://blog.C1gStudio.com
# Note: Allow nagios to run ethtool commands
# visudo
# #Defaults requiretty
# nagios ALL=NOPASSWD:/sbin/ethtool
#
#########################################################################
path=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
warn_num=100
critical_num=10
eth=eth0
usage(){
echo -e "Usage: $0 -i|--interface interface -w|--warning warning threshold -c|--critical critical threshold"
echo -e "Example:"
echo -e "$0 -i eth0 -w 100 -c 10"
}
select_arg(){
if [ $# -eq 0 ];then
return 1
fi
until [ $# -eq 0 ];do
case $1 in
-i|--interface)
[ $# -lt 2 ] && return 1
if ! cat /var/log/dmesg |grep $2 >/dev/null 2>&1;then
return 1
fi
eth=$2
shift 2
;;
-w|--warning)
[ $# -lt 2 ] && return 1
if ! echo $2 |grep -E -q "^[1-9][0-9]*$";then
return 1
fi
warn_num=$2
shift 2
;;
-c|--critical)
[ $# -lt 2 ] && return 1
if ! echo $2 |grep -E -q "^[1-9][0-9]*$";then
return 1
fi
critical_num=$2
shift 2
;;
*)
return 1
;;
esac
done
return 0
}
select_arg $@
[ $? -ne 0 ] && usage && exit $STATE_UNKNOWN
#echo "warn :$warn_num"
#echo "critical :$critical_num"
if [ $critical_num -gt $warn_num ];then
usage
exit $STATE_UNKNOWN
fi
#ethtool $eth| grep Speed | grep -o '[0-9]\+'
#kernel >=2.6.33
#cat /sys/class/net/$eth/speed
total=`sudo /sbin/ethtool $eth |grep Speed:|awk '{print $2}' |awk -F 'Mb' '{print $1}'`
if [ $total = Unknown! ];then
echo "UNKNOWN STATE $eth maybe not working!"
exit $STATE_UNKNOWN
elif [ $total -gt $warn_num ];then
echo "$eth OK - Speed: $total Mb/s |$eth=$total;$warn_num;$critical_num;0"
exit $STATE_OK
elif [ $total -le $warn_num -a $total -gt $critical_num ];then
echo "$eth WARNING - Speed: $total Mb/s |$eth=$total;$warn_num;$critical_num;0"
exit $STATE_WARNING
elif [ $total -le $critical_num ];then
echo "$eth CRITICAL - Speed: $total Mb/s |$eth=$total;$warn_num;$critical_num;0"
exit $STATE_CRITICAL
else
echo "UNKNOWN STATE"
exit $STATE_UNKNOWN
fi

下载check_ethspeed.sh

chown nagios:nagios check_ethspeed.sh
chmod 775 check_ethspeed.sh

运行ethtool命令需root权限
visudo

Defaults requiretty

注释这一行

添加nagios用户无需密码运行ethtool权限

nagios ALL=NOPASSWD:/sbin/ethtool

客户端nrpe增加监控命令
echo ‘command[check_ethspeed2]=/opt/nagios/libexec/check_ethspeed.sh -i eth2 -w 100 -c 10’ >> /opt/nagios/etc/nrpe.cfg

重启nrpe
kill `cat /var/run/nrpe.pid`
/opt/nagios/bin/nrpe -c /opt/nagios/etc/nrpe.cfg -d

监控端增加监控服务
vi c1gstudio.cfg

define service{
use local-service,srv-pnp ; Name of service template to use
host_name c1gstudio
service_description check_ethspeed eth2
check_command check_ethspeed!eth2!100!10
notifications_enabled 0
}

重启nagios
/etc/init.d/nagios reload

参阅:http://blog.c1gstudio.com/archives/1748

Posted in Nagios.

Tagged with check_ethspeed.sh, 网卡, Nagios.

No comments

By C1G – 2015/01/23

给nagios增加监控当前php进程数的插件,并用pnp出图

脚本说明
脚本默认监控为php-fpm 以TCP方式运行在本机的端口php
php-fpm.conf例

<value name="listen_address">127.0.0.1:9000/value>

其它地址需在脚本中修改相应地址127.0.0.1:9000

最终输出的$total processes为当前正在执行或等待的php数,此数为0或越少越好.

vi check_phpprocs.sh

#!/bin/bash
#########################################################################
#
# File: check_phpprocs.sh
# Description: Nagios check plugins to check php process in *nix.
# Language: GNU Bourne-Again SHell
# Version: 1.0.0
# Date: 2015-1-16
# Author: C1g
# Bog: http://blog.C1gStudio.com
#########################################################################
path=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
warn_num=100
critical_num=200
usage(){
echo -e "Usage: $0 -w|--warning warning threshold -c|--critical critical threshold"
}
select_arg(){
if [ $# -eq 0 ];then
return 1
fi
until [ $# -eq 0 ];do
case $1 in
-w|--warning)
[ $# -lt 2 ] && return 1
if ! echo $2 |grep -E -q "^[1-9][0-9]*$";then
return 1
fi
warn_num=$2
shift 2
;;
-c|--critical)
[ $# -lt 2 ] && return 1
if ! echo $2 |grep -E -q "^[1-9][0-9]*$";then
return 1
fi
critical_num=$2
shift 2
;;
*)
return 1
;;
esac
done
return 0
}
select_arg $@
[ $? -ne 0 ] && usage && exit $STATE_UNKNOWN
#echo "warn :$warn_num"
#echo "critical :$critical_num"
if [ $critical_num -lt $warn_num ];then
usage
exit $STATE_UNKNOWN
fi
total=`netstat -n | grep 127.0.0.1:9000 | wc -l`
if [ $total -lt $warn_num ];then
echo "PHP OK - $total processes |PHP=$total;$warn_num;$critical_num;0"
exit $STATE_OK
elif [ $total -ge $warn_num -a $total -lt $critical_num ];then
echo "PHP WARNING - $total processes |PHP=$total;$warn_num;$critical_num;0"
exit $STATE_WARNING
elif [ $total -ge $critical_num ];then
echo "PHP CRITICAL - $total processes |PHP=$total;$warn_num;$critical_num;0"
exit $STATE_CRITICAL
else
echo "UNKNOWN STATE"
exit $STATE_UNKNOWN
fi

增加执行权限,宫户端nrpe路径为/opt/nagios/
chown nagios:nagios check_phpprocs.sh
chmod 755 check_phpprocs.sh
mv ./check_phpprocs.sh /opt/nagios/libexec/

编辑宫户端nrpe.cfg增加监控命令,这里设置waring阀值为100,critical阀值为200
vi /opt/nagios/etc/nrpe.cfg

command[check_phpprocs]=/opt/nagios/libexec/check_phpprocs.sh -w 100 -c 200

重启宫户端nrpe

kill `cat /var/run/nrpe.pid`
/opt/nagios/bin/nrpe -c /opt/nagios/etc/nrpe.cfg -d

编辑监控端主机文件c1gstudio.cfg,添加监控服务
vi /usr/local/nagios/etc/objects/c1gstudio.cfg

define service{
use local-service,srv-pnp ; Name of service template to use
host_name c1gstudio
service_description PHP Processes
check_command check_nrpe!check_phpprocs
notifications_enabled 1
}
pnp4nagios已配好,srv-pnp为配好的模板可以直接出图
templates.cfg

define service {
name srv-pnp
register 0
action_url /pnp/index.php?host=$HOSTNAME$&srv=$SERVICEDESC$
process_perf_data 1

参见:http://blog.c1gstudio.com/archives/552

重启nagios
/etc/init.d/nagios reload

查看状态

下载check_phpprocs.zip check_phpprocs

参考:http://blog.csdn.net/xluren/article/details/17724043

Posted in Nagios.

Tagged with check_phpprocs, Nagios, PHP, plugin.

No comments

By C1G – 2015/01/16

用js创建隐藏来源不带referer的超链接

最直接的是用window.open,对IE9以下有效,Firefox无效

function openwin2(strurl){
window.open(strurl, "newwin", "height=650,width=778,scrollbars=10,resizable=yes");
}

进阶版,IE6会报错

function open_new_window(full_link){
window.open('javascript:window.name;', '<script>location.replace("'+full_link+'")<\/script>');
}

高级版,用基于HTML5标准rel=”noreferrer” 并配合noreferrer.js
可以自动识别浏览器并选择最优方案
分为prototype.js

和jquery版

external link

注意将nofrerrer.js中的google地址改成百度的.
http://www.baidu.com/link?url?q

参考:
http://zhongfox.github.io/blog/javascript/2013/08/16/remove-referer-using-js/
https://github.com/knu/noreferrer

Posted in JavaScript/DOM/XML.

Tagged with 隐藏referer, JavaScript.

No comments

By C1G – 2014/12/09

解决discuzx3.2论坛群发短消息(pm)

一开始以为是程序有漏洞,看了source\include\spacecp\spacecp_pm.php代码才知道有开关可以控制.

后台->站点功能->其它->
全站是否默认只接受好友短消息:
是否
选择“是”将在个人短消息设置中，默认只接收好友的短消息

选择”是”

用户->用户组->(选择起始的几个用户组)->基本设置->允许发送短消息:
是否可以给任何人发短消息:
是否
选择否的话，当对方设置为只接受好友短消息，将无法对其发送短消息

选择”否”

并可以相应结合24小时内发布短消息最大数,并设置发送短消息需消耗积分能设置.

Posted in Discuz/Uchome/Ucenter.

Tagged with 短消息群发, discuz.

No comments

By C1G – 2014/11/21

使用HAProxy给MySQL slave群进行负载均衡和状态监控

一.安装haproxy

haproxy机器
http://haproxy.1wt.deu
需翻墙

tar zxvf haproxy-1.4.25.tar.gz
cd haproxy-1.4.25
make TARGET=linux26
make install
mkdir -p /usr/local/haproxy/
chown nobody:nobody /usr/local/haproxy/
mkdir /etc/haproxy/
cp examples/haproxy.cfg /etc/haproxy/
cp examples/haproxy.init /etc/init.d/haproxy
chown root:root /etc/init.d/haproxy
chmod 700 /etc/init.d/haproxy

修改haproxy启动脚本

/usr/sbin/$BASENAME
改成
/usr/local/sbin/$BASENAME

sed -i -r 's|/usr/sbin|/usr/local/sbin|' /etc/init.d/haproxy

编辑配置文件
vi /etc/haproxy/haproxy.cfg

global
#log 127.0.0.1 local0
log 127.0.0.1 local3 info
#log loghost local0 info
maxconn 4096
chroot /usr/local/haproxy
uid nobody
gid nobody
daemon
debug
#quiet
defaults
log global
mode tcp
#option httplog
option dontlognull
retries 3
option redispatch
maxconn 2000
contimeout 5000
clitimeout 50000
srvtimeout 50000
frontend mysql
bind 192.168.0.107:3306
maxconn 3000
default_backend mysql_slave
backend mysql_slave
#cookie SERVERID rewrite
mode tcp
balance roundrobin
#balance source
#balance leastconn
contimeout 10s
timeout check 2s
option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www
server mysql_192_168_0_104_3306 192.168.0.104:3306 weight 1 check port 9300 inter 5s rise 2 fall 3
server mysql_192_168_0_104_3307 192.168.0.104:3307 weight 1 check port 9301 inter 5s rise 2 fall 3
#server mysql_192_168_0_106_3306 192.168.0.106:3306 weight 1 check port 9300 inter 5s rise 2 fall 3
listen admin_status
mode http
bind 192.168.0.107:8000
option httplog
log global
stats enable
stats refresh 30s
stats hide-version
stats realm Haproxy\ Statistics
stats uri /admin-status
stats auth admin:123456
stats admin if TRUE

打开监控的iptables

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 8000 -j ACCEPT

添加自启动并启动haproxy服务

chkconfig –add haproxy
chkconfig haproxy on
service haproxy start

被监控机上

我这里是单机双实例,所以有2个脚本,单机只需一个脚本和一个服务端口就行
编辑mysql检测3306脚本
vi /opt/shell/mysqlchk_status_3306.sh

#!/bin/bash
#
# /usr/local/bin/mysqlchk_status.sh
#
# This script checks if a mysql server is healthy running on localhost. It will
# return:
#
# "HTTP/1.x 200 OK\r" (if mysql is running smoothly)
#
# – OR –
#
# "HTTP/1.x 503 Internal Server Error\r" (else)
#
MYSQL_HOST="localhost"
MYSQL_PORT="3306"
MYSQL_USERNAME="mysqlcheck"
MYSQL_PASSWORD="paSSword"
MYSQL_PATH="/opt/mysql/bin/"
#
# We perform a simple query that should return a few results
#${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show slave status\G;" >/tmp/rep${MYSQL_PORT}.txt
${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show full processlist;" >/tmp/processlist${MYSQL_PORT}.txt
${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show slave status\G;" >/tmp/rep${MYSQL_PORT}.txt
iostat=`grep "Slave_IO_Running" /tmp/rep${MYSQL_PORT}.txt |awk '{print $2}'`
sqlstat=`grep "Slave_SQL_Running" /tmp/rep${MYSQL_PORT}.txt |awk '{print $2}'`
result=$(cat /tmp/processlist${MYSQL_PORT}.txt|wc -l)
echo iostat:$iostat and sqlstat:$sqlstat
# if slave_IO_Running and Slave_sql_Running ok,then return 200 code
if [ "$result" -gt "3" ] && [ "$iostat" = "Yes" ] && [ "$sqlstat" = "Yes" ];
then
# mysql is fine, return http 200
/bin/echo -e "HTTP/1.1 200 OK\r\n"
else
# mysql is down, return http 503
/bin/echo -e "HTTP/1.1 503 Service Unavailable\r\n"
fi

vi /opt/shell/mysqlchk_status_3307.sh

#!/bin/bash
#
# /usr/local/bin/mysqlchk_status.sh
#
# This script checks if a mysql server is healthy running on localhost. It will
# return:
#
# "HTTP/1.x 200 OK\r" (if mysql is running smoothly)
#
# – OR –
#
# "HTTP/1.x 503 Internal Server Error\r" (else)
#
MYSQL_HOST="localhost"
MYSQL_PORT="3307"
MYSQL_USERNAME="mysqlcheck"
MYSQL_PASSWORD="paSSword"
MYSQL_PATH="/opt/mysql/bin/"
#
# We perform a simple query that should return a few results
#${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show slave status\G;" >/tmp/rep${MYSQL_PORT}.txt
${MYSQL_PATH}mysql -S/data/mysql/mysql.sock -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show full processlist;" >/tmp/processlist${MYSQL_PORT}.txt
${MYSQL_PATH}mysql -S/data/mysql/mysql.sock -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e "show slave status\G;" >/tmp/rep${MYSQL_PORT}.txt
iostat=`grep "Slave_IO_Running" /tmp/rep${MYSQL_PORT}.txt |awk '{print $2}'`
sqlstat=`grep "Slave_SQL_Running" /tmp/rep${MYSQL_PORT}.txt |awk '{print $2}'`
result=$(cat /tmp/processlist${MYSQL_PORT}.txt|wc -l)
#echo iostat:$iostat and sqlstat:$sqlstat
echo $result
# if slave_IO_Running and Slave_sql_Running ok,then return 200 code
if [ "$result" -gt "3" ] && [ "$iostat" = "Yes" ] && [ "$sqlstat" = "Yes" ];
then
# mysql is fine, return http 200
/bin/echo -e "HTTP/1.1 200 OK\r\n"
else
# mysql is down, return http 503
/bin/echo -e "HTTP/1.1 503 Service Unavailable\r\n"
fi

chmod 775 /opt/shell/mysqlchk_status_3306.sh
chmod 775 /opt/shell/mysqlchk_status_3307.sh

在mysql slave另行建立一个具有process和slave_client权限的账号。

CREATE USER 'mysqlcheck'@'localhost' IDENTIFIED BY 'PaSSword';
GRANT PROCESS , REPLICATION CLIENT ON * . * TO 'mysqlcheck'@'localhost' IDENTIFIED BY 'PaSSword' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ;
flush privileges;

测试脚本
./mysqlchk_status_3306.sh

添加服务
绑定内网ip,运行于930端口,只开放给192.168.0内网
yum install -y xinetd
vim /etc/xinetd.d/mysql_status

service mysqlchk_status3306
{
flags = REUSE
socket_type = stream
bind = 192.168.0.104
port = 9300
wait = no
user = nobody
server = /opt/shell/mysqlchk_status_3306.sh
log_type = FILE /dev/null
log_on_failure += USERID
disable = no
only_from = 192.168.0.0/24
}
service mysqlchk_status3307
{
flags = REUSE
socket_type = stream
bind = 192.168.0.104
port = 9301
wait = no
user = nobody
server = /opt/shell/mysqlchk_status_3307.sh
log_type = FILE /dev/null
log_on_failure += USERID
disable = no
only_from = 192.168.0.0/24
}

bind和only_from的ip地址要有haproxy能请求的权限,使用drbd用0.0.0.0
user要用server脚本的执行权限
port端口要在/etc/service 中声明

chattr -i /etc/services
vi /etc/services

mysqlchk_status3306 9300/tcp #haproxy mysql check
mysqlchk_status3307 9301/tcp #haproxy mysql check

services中的mysqlchk_status3306 要和xinetd.d中service名对应

打开iptables

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 9300 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 9301 -j ACCEPT

/etc/init.d/iptables save

添加自启动及启动服务
chkconfig xinetd –level 345 on
/etc/init.d/xinetd start

查看是否运行
netstat -lntp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:9300 0.0.0.0:* LISTEN 4863/xinetd
tcp 0 0 0.0.0.0:9301 0.0.0.0:* LISTEN 4863/xinetd

如果没有的话注意检测下bind地址及服务端口

在监控机运行测试
telnet 192.168.0.104 9300

Trying 192.168.0.104...
Connected to 192.168.0.104 (192.168.0.104).
Escape character is '^]'.
/opt/shell/mysqlchk_status_3306.sh: line 24: /tmp/processlist3306.txt: Permission denied
/opt/shell/mysqlchk_status_3306.sh: line 25: /tmp/rep3306.txt: Permission denied
HTTP/1.1 200 OK
Connection closed by foreign host.

之前用root运行过所以报错,在被监控机删除临时文件

rm -f /tmp/processlist3306.txt /tmp/processlist3307.txt
rm -f /tmp/rep3306.txt /tmp/rep3307.txt

没有输出则需检查mysqlchk_status_3306.sh脚本执行权限

启动后/var/log/messages 中会有很多日志

Oct 23 14:37:00 lova xinetd[11057]: START: mysqlchk_status3306 pid=11464 from=192.168.0.22
Oct 23 14:37:00 lova xinetd[11057]: EXIT: mysqlchk_status3306 status=0 pid=11464 duration=0(sec)
Oct 23 14:37:05 lova xinetd[11057]: START: mysqlchk_status3306 pid=11494 from=192.168.0.22
Oct 23 14:37:05 lova xinetd[11057]: EXIT: mysqlchk_status3306 status=0 pid=11494 duration=0(sec)

在haproxy配置中将日志输出到黑洞
log_type = FILE /dev/null

查看监控

直接访问localhost是503
http://localhost/
503 Service Unavailable

No server is available to handle this request.

加上admin-status
http://localhost/admin-status

应用时需在slave mysql上的mysql添加通过haproxy的用户权限

haproxy的命令
/etc/init.d/haproxy
Usage: haproxy {start|stop|restart|reload|condrestart|status|check}

附
优化time_wait,防止端口耗尽
vi /etc/sysctl.conf

net.ipv4.ip_local_port_range = 1025 65000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_tw_buckets = 35000

sysctl -p

使用nginx反向代理haprox后台

#省略
listen admin_status
mode http
bind 192.168.0.107:8000
option httplog
log global
stats enable
stats refresh 30s
stats hide-version
stats realm Haproxy\ Statistics
#stats uri /admin-status
stats uri /haproxy/
#stats auth admin:123456
#stats admin if TRUE

nginx.conf

#省略
location ~* ^/haproxy/
{
proxy_pass http://192.168.0.107:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-Forwarded-For $remote_addr;
proxy_redirect off;
}
#省略

参考:
http://linux.die.net/man/5/xinetd.conf
http://adslroot.blogspot.com/2013/12/haproxy-mysql.html
http://sssslide.com/www.slideshare.net/Severalnines/haproxy-mysql-slides

Posted in haproxy/Atlas, 技术.

Tagged with 集群, 负载均衡, haproxy, mysql.

No comments

By C1G – 2014/11/07

linux查看和改变网卡工作速率

同一机柜其它机器都在千兆模式但有几台却是百兆,调整速度后还自动降速到百兆.
最后让机房换了网线立马解决问题,数据库的进程排队也降低了

查看网卡信息,网卡支持千兆但工作在百兆.
ethtool eth2

Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised pause frame use: No
Advertised auto-negotiation: Yes
Speed: 100Mb/s
Duplex: Full

调整到千兆
ethtool -s eth2 speed 1000 duplex full

tail /var/log/messages

Oct 23 10:17:22 C1g kernel: e1000e: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
Oct 23 10:17:23 C1g kernel: e1000e: eth2 NIC Link is Down
Oct 23 10:17:33 C1g kernel: e1000e: eth2 NIC Link is Up 100 Mbps Full Duplex, Flow Control: None
Oct 23 10:17:33 C1g kernel: 0000:03:00.1: eth2: 10/100 speed: disabling TSO

又变回到百兆

ethtool备注
ethtool ethX //查询ethX网口基本设置
ethtool –h //显示ethtool的命令帮助(help)
ethtool –i ethX //查询ethX网口的相关信息
ethtool –d ethX //查询ethX网口注册性信息
ethtool –r ethX //重置ethX网口到自适应模式
ethtool –S ethX //查询ethX网口收发包统计
ethtool –s ethX [speed 10|100|1000]\ //设置网口速率10/100/1000M
[duplex half|full]\ //设置网口半/全双工
[autoneg on|off]\ //设置网口是否自协商

PHP曝DOS漏洞可致CPU灌满涉及多个PHP版本

开源分布式搜索平台ELK(Elasticsearch+Logstash+Kibana)+Redis+Syslog-ng实现日志实时搜索

安装JDK

安装redis

安装Elasticsearch

安装logstash

安装kibana

ELK整合

命令示例

安全优化

安装问题

Linux glibc幽灵漏洞检测及修复方案

goaccess分析nginx日志

nagios增加监控网卡速率插件check_ethspeed.sh

给nagios增加监控当前php进程数的插件,并用pnp出图

用js创建隐藏来源不带referer的超链接

解决discuzx3.2论坛群发短消息(pm)

使用HAProxy给MySQL slave群进行负载均衡和状态监控

一.安装haproxy

linux查看和改变网卡工作速率

About C1G军火库

日历

分类目录

文章归档

功能

近期文章

近期评论

经管类

设计体验

WAP开发

博客互联

安全

技术论坛

收藏夹

架构研发

2019年三月
一	二	三	四	五	六	日
« 3月
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31

安装JDK

安装redis

安装Elasticsearch

安装logstash

安装kibana

ELK整合

命令示例

安全优化

安装问题

一.安装haproxy

Subscribe

About C1G军火库

日历

分类目录

文章归档

功能

近期文章

近期评论

标签

经管类

设计体验

WAP开发

博客互联

安全

技术论坛

收藏夹

架构研发