Cpanel Introduction
--------------------
Cpanel Important directories.
/usr/local/cpanel
/var/cpanel
/scripts
/usr/local/cpanel
---------------
cpsrvd
cpsrvd-ssl
cpkeyclt
/usr/local/cpanel/bin
-------------------
*Houses only scripts and binaries which provide installation
and configuration of many cPanel managed services
Notable Contents:
eximstats
checkperlmodules
/usr/local/cpanel/logs
--------------------
CPSRVD -------access_log, error_log
CPANELLOGD---stats_log
CPKEYCLT------license_lo
/usr/local/cpanel/base
--------------------
frontend-------x, x2,xmail,monsoon
webmail-------x, monsoon
neomail
horde
3rdparty-------squirrelmail, phpPgAdmin, phpMyAdmin
/usr/local/cpanel/etc
-------------------
init -----------start | stop cpsrvd AND start | stop AND start | stop cppop
exim----------cf, perl
ftptemplates ---proftpd
httptemplates --apache1--default, ssldefault
zonetemplates--simple, standard, standardvirtualftp
/usr/local/cpanel/3rdparty
-----------------------
bin------php, stunnel, analog, awstats, webalizer
etc------php.ini, ixed, ioncube
/var/cpanel
----------
Houses proprietary configuration data for cPanel, including:
● Primary cPanel configuration
● User configurations
● Reseller configurations
● Accounting, conversion, and update logs
● Bandwidth data
● Customized service templates
/var/cpanel
----------
cpanel.conf
resellers
accounting.log
features--packages--logs
updatelogs--bandwidth--zone templates
users---mainips
/var/cpanel/cpanel.config
-----------------------
● The primary cPanel configuration file
● Each variable within influences the way cPanel behaves
● Variables are line delimited, with variables separated by an equal sign
● If file does not exist, cpanel falls back to defaults
/var/cpanel/resellers
------------------
Lists each reseller with a comma-delimited list of WHM
resources that reseller has access to.
/var/cpanel/accounting.log
------------------------
Contains a list of accounting functions performed through
WHM, including account removal and creation.
/var/cpanel/bandwidth
--------------------
● Files contain a list of the bandwidth history for each account.
Each named after their respective user.
● History files are stored in human-readable format, while actual
bandwidth data are stored in round robin databases.
/var/cpanel/features
------------------
● File name is inherited from the feature list name
● Contains a line delimited list of feature variables and a zero or
one value
● Variables control what cPanel resources are available to users
/var/cpanel/packages
-------------------
● Contains a list of packages, named after the packages they represent
● If package belongs to reseller, file name is prefixed with reseller name
● Each of these values determines the values created in cPanel user file
/var/cpanel/users
----------------
● Contains a list of cPanel user configuration files, named after the user
they pertain to.
● Variables define account resources, themes, domains, etc.
Other notable /var/cpanel directories
--------------------------------
● LOGS
– This directory contains logs from account copies/transfers.
Training Seminar 2006
● UPDATELOGS
– Contains the output of each cPanel update executed on the server.
● MAINIPS
– Named after the respective reseller users they represent, each
contains only the IP address which should be used as that
resellersmain shared ip
● ZONETEMPLATES
– Contains customized DNS zone templates created inWHM
/scripts
-------
This directory houses a large number of scripts which serve
as building blocks for many cPanel/WHM features.
The scripts can be used to:
● Update cPanel, and many of the services of which it
manages
● Customize account creation routines
● Perform backups of cPanel accounts
● Install and update cPanel managed services
cPanel Services
-------------
Services
● CPSRVD
● CHKSERVD
● CPANELLOGD
● CPBACKUP
● EXIMSTATS
cpsrvd
------
● cpsrvd is the 'master' process for cPanel.
● Handles and dispatches all requests made through the cPanel,
WHM, and Webmail interfaces.
● Logs to access_log and error_log
cpsrvd and stunnel relationship
---------------------------
CPSRVD--2082-->cpanel<--2083<--stunnel
CPSRVD--2086-->WHM<--2087<--stunnel
CPSRVD--2095-->Webmail<--2096<--stunnel
SSL Certificates
-------------
● Default certificate and key are stored in /
usr/local/cpanel/etc/cpanel.pem
● User installed cert and cabundle are stored in:
– /usr/local/cpanel/etc/mycpanel.pem
– /usr/local/cpanel/etc/mycpanel.cabundle
cPanel Startup
------------
● The following services are controlled by the cPanel
init script
– cpsrvd, both plain and secure
– cPanel POP Services
– cPanel Log Services
– Eximstats
– Chat Services
– Mailman
– Interchange
● Verify if ports are in use
– netstat -lnp | egrep '20(8|9)'
Troubleshooting Startup Issues(SSL)
-------------------------------
● If SSL services are not available
– execute /usr/local/cpanel/startstunnel
– check /usr/local/cpanel/3rdparty/bin/stunnel.log
● If cpsrvd is not available
– execute it directly `/usr/local/cpanel/cpsrvd`
– check /usr/local/cpanel/logs/error_log
Licensing
--------
● License requests are handled by /usr/local/cpanel/cpkeyclt
● Requests are transmitted to auth.cpanel.net over port 2089
● License requests are logged to license_log
● License key is stored at /usr/local/cpanel/cpanel.lisc
A valid license request:
root@server [~]# /
usr/local/cpanel/cpkeyclt
Updating Internal cPanel
Information.....Done
root@server [~]#
Troubleshooting License Issues
---------------------------
CHECKLIST:
● Verify if license is active for main server IP at http://verify.cpanel.net
● Check if server can establish connection to auth.cpanel.net over port 2089
● If the previous steps fail, check license_log for notable errors.
● If license is active, but refused with no notable errors, lodge support request.
root@server [~]# telnet auth.cpanel.net 2089
Trying 198.66.78.9...
Connected to auth.cpanel.net (198.66.78.9).
Escape character is '^]'.
200 cPanel License Service Version 12.0
root@server [~]#
cPanel Requests
--------------
cPanel Requests
● Logins are authenticated against the system passwd and shadow files.
● Documents root is /usr/local/cpanel/base
● Theme is defined by RS variable in user's cPanel configuration file.
● Resources are limited by the feature list of assigned to the given user.
WHM Requests
-------------
WHM Requests
● Root password will authenticate any reseller user
● Document root is /usr/local/cpanel/whostmgr/docroot/
● Reseller resources are limited by Access Control List
– Defined in WHM > Resellers > Reseller Center > Edit
Privileges/Nameservers
– Privileges are stored in /var/cpanel/resellers
cPanel Services
--------------
Services
● CPSRVD
● CHKSERVD
● CPANELLOGD
● CPBACKUP
● EXIMSTATS
Service Monitoring
----------------
● Located at /usr/local/cpanel/libexec/chkservd
● chkservd is a scalable connection and process based service monitoring
tool
● Provides monitoring of CPU, Memory, and Disk usage
● chkservd scans services once every eight minutes
– Logs to /var/log/chkservd.log
● Alerts are dispatched to server contact defined in Basic cPanel/WHM
Setup
chkservd Configuration
--------------------
● Monitored services are determined by values stored in /
etc/chkserv.d/chkservd.conf.
– Syntax: servicename:0 for no monitoring, servicename:1 for
monitoring
● Actions, expected responses, and failure events are defined in
service configuration files stored in /etc/chkserv.d/{servicename}
● Status files are stored in /var/run/chkservd/{servicename}
– Plus (+) sign for active, Minus (-) sign for failed
cpanellogd
----------
● cpanellogd is responsible for parsing and updating bandwidth logs, and dispatching
statistics generators on each account, per their individual configurations.
● Configured through Statistics Software Configuration and Tweak Settings in WHM
● Statistics are compiled and stored for each account in /home/{username}/tmp, with
each respective statistics application being assigned it's own individual subdirectory.
/home/{username}/tmp ----webalizer, analog, awstats, urchin
● Optional server-wide statistics configurations are stored in /
etc/stats.conf, while user-specific configurations may reside in /home/
{username}/tmp.
● Notable Variables in /etc/stats.conf:
– BLACKHOURS: Comma separated list of numeric values, which
specify hours that logs may not be parsed.
– VALIDUSERS:Users which are allowed to supply their own
combination of statistics generators. By default users are
restricted to the generators defined by the administrator.
Calling cpanellogd
----------------
● cpanellogd is started with the cPanel service, but can be executed
directly with:
– No Argument: Daemonize, and wait for a suitable time to scan
logs
– One Argument (username): Execute an immediate statistics run
for the specified user, and exit once completed.
● Two scripts are available to provide these functions as well:
– /scripts/runlogsnow - Execute a full log run immediately
– /scripts/runweblogs {username} - Execute a log run for a single
user
Bandwidth Statistics
-----------------
● Bandwidth statistics are accumulated from a combination of the
following cPanel managed services:
– HTTP
– EXIM
– IMAP / POP
– FTP
● Bandwidth data is logged to /usr/local/apache/domlogs/*bytes_log
● Parsed bandwidth data is stored in /var/cpanel/bandwidth
COMMON ISSUES
● Bandwidth parsing is taking an exceedingly long time to complete
– First check the size of the logs being parsed. Excessively large
log files can and typically will take a long time to complete.
– Additionally, if RRDtool is not installed, bandwidth parsing
performance will drop signifigantly.
● RRDtool can be installed by executing `/scripts/rrdtoolinstall`
Log Processing
-------------
● Statistics are parsed for each child domain of the given account.
● Will be influenced by variables in /var/cpanel/cpanel.config
– Skip statistics generator
● skip{generator_name}
– Logs will be retained or deleted based on
● keeplogs – keep logs at the end of the month.
● dumplogs – dump logs after parsing
Common cpanellogd Issues
------------------------
● Statistics are stalling, or are taking unreasonable amounts of
time.
– Usually indiates that the server load average is consistently
exceeding the defined load limit.
● Limit is defined as 'extracpus' in /var/cpanel/cpanel.config
– Restrictive BLACKHOUR definitions in WHM > Statistics Software
Configuration.
– All other issues should be present in /
usr/local/cpanel/logs/stats_log
cPanel Backups
-------------
GENERAL INFORMATION
● Backup configuration is performed in WHM > Backup > Configure
Backup
● cPanel backups are performed by /scripts/cpbackup, which is
configured by default to execute at 1:00 AM in the root crontab.
● Backup archives are created using the /scripts/pkgacct utility, and
may be restored using /scripts/restorepkg respectfully.
● Uses CPU resource limits based upon extracpus definition in
cpanel.config
Backup Configuration
-------------------
BACKUP INTERVALS
● Backup script can be configured to operate in daily, weekly, and monthly intervals.
● Each interval is given it's own respective directory within the backup root.
● Backup intervals are executed when the current time minus the last modification time
of the interval directory is less than or equal to zero.
BACKUP METHODS
----------------
Three backup methods are available:
● Standard: This method entails archiving the accounts, and storing
them at the specified path/mount point. This is the default method
used by the backup script.
● Incremental: This method uses rsync to incrementally backup user
data. This option will only operate locally, storing the data at the
specified path/mount point.
● Remote: This method transmits account archives to a specified ftp
server. Remote backups are typically more time consuming, and
more error prone when transmitting large accounts.
Common Backup Issues
--------------------
● Backup intervals are not executed when expected.
– Modification times are incorrect or not functional
– System time is incorrect.
– Backups have not been defined to run on that day.
● Backups stall, or take an exceedingly long time to complete.
– Verify that the transmission rate to remote server is suitable
– Verify that server load average has not exceeded defined
resource limit.
● Can't call method "login" on an undefined value
This indicates the host or passive setting is not properly
defined for remote backups.
● Unable to login to remote FTP server.
This indicates that either the username and password
were not specified, or are incorrect in the backup configuration.
● Can't call method "prepare" on an undefined value
The password stored for the root mysql user in /root/.my.cnf is
incorrect. Reset or correct this password, and re-execute the backup
script.
eximstats
---------
● The eximstats daemon is responsible for harvesting bandwidth
information from exim transactions.
● Continually monitors the exim_mainlog, and stores information in the
eximstats database, including host and sender information, message
size, and transaction times.
● Is started with the cPanel service, but can be called directly at /
usr/local/cpanel/bin/eximstats
● Heavily mysql dependent
– data is stored in the 'eximstats' database.
● 'eximstats' mysql user password is stored in /var/cpanel/eximstatspass.
– password is generated by /usr/local/cpanel/bin/eximstatspass
● Database can be installed by running /
usr/local/cpanel/bin/updateeximstats
cPanel Maintenance
-----------------
● Update configuration
● Update scripts
● Applying updates
● By default, cPanel applies nightly updates at 2:13AM in the root crontab.
● /scripts/upcp dispatches these updates, using the following key
components:
– /scripts/updatenow - synchronize /scripts directory
– /scripts/sysup - updates cPanel managed rpms
– /scripts/rpmup - all other system updates
● Updates are logged to timestamped files in /var/cpanel/updatelogs
● Update configuration is stored in /etc/cpupdate.conf.
/etc/cpupdate.conf
-----------------
● The following variables are available in cpupdate.conf:
– CPANEL = [ manual- ] stable | release | current | edge
This variable controls which update branch is used for
cPanel updates, and controls whether the updates are applied
manually or automatically (Default value: release)
– SYSUP = never (all other values are assumed true)
– RPMUP = never (all other values are assumed true)
CPANEL=current
RPMUP=daily
SYSUP=daily
● cPanel updates can be called outside of the regularly scheduled cron
time simply by executing /scripts/upcp.
● If cPanel components are missing or corrupted that were not replaced
with the regular cPanel update, they can be replaced by executing /
scripts/upcp –force
Components of upcp
------------------
● /scripts/cpanelsync
● /scripts/updatenow
● /scripts/sysup
● /scripts/rpmup
/scripts/cpanelsync
-----------------
● /scripts/cpanelsync is called upon by /scripts/updatenow and /
scripts/upcp
● Provides md5sum based synchronization with update servers
● md5sum table is stored in /destination_directory/.cpanelsync
● Accepts three arguments host, remote path, local path :
/scripts/cpanelsync 'httpupdate.cpanel.net'
'/cpanelsync/RELEASE/scripts' '/scripts'
/scripts/updatenow
-----------------
Calls cpanelsync to update contents of scripts
directory, which then stores it's md5sum table
at /scripts/.cpanelsync
● Should only be run from upcp, but can be
executed from command line when '--fromupcp'
is passed.
● Is the first update script called upon from /scripts/upcp
UPCP-->updatenow-->FTPUP-->EXIMUP-->MYSQLUP-->BANDMINUP-->COURIERUP-->RPMUP
RPMUP
--------
● Calls the underlying package manager to apply system package
updates
● The package manager which is used is determined by the presence
of:
– /var/cpanel/useup2date (Redhat)
– /var/cpanel/useyum (CentOS,Fedora)
– /var/cpanel/useapt (Debian)
– /var/cpanel/useswup (Trustix)
– /var/cpanel/userug (SuSE)
cPanel Updates
----------------
● After updatenow, sysup, and rpmup complete, cpanelsync is used to
complete the cPanel updates based on md5sum table stored at /
usr/local/cpanel/.cpanelsync
● If any special configurations are required on server after updates,
they can be applied in /scripts/postupcp, which is executed if such a
file exists and is executable.
● Once updates complete, all cPanel services are restarted for changes
to take effect
cPanel Scripts
--------------
● Account Management
● Package Management
● Service Update and Configuration
– MySQL
– Exim
– Named
– Apache
● cPanel and System
Account Management Scripts
------------------------------
● /scripts/wwwacct (account creation)
Accounts can be created via the command line using the following
syntax: /scripts/wwwacct exampledomain.com username password 0
x n
● /scripts/killacct (account termination)
Takes a single argument of the user to terminate.
● /scripts/suspendacct (account suspension)
Will suspend an account from accessing all cPanel managed
services.
● /scripts/unsuspendacct
Will reinstate any account suspended via suspendacct
● /scripts/addpop (Create pop account)
Handles creation of virtual mail accounts. Accepts either no
arguments, or two arguments consisting of the e-mail address and
password.
● /scripts/updateuserdomains
Updates the user:owner and user:domain tables stored in:
– /etc/userdomains
– /etc/trueuserdomains
– /etc/trueuserowners
– These tables are used to enumerate and keep track of accounts
and their owners.
Package Management
----------------------
● /scripts/ensurerpm
Takes argument list of rpms, which are then passed to the
underlying package manager
● /scripts/ensurepkg
The equivalent of ensurerpm for FreeBSD. Updates specified
packages from ports.
● /scripts/realperlinstaller
Takes argument list of perl modules to install via CPAN
● Each of the aforementioned scripts can accept an argument of '--force'
to force package installations.
● /scripts/mysqlup
Can be called to apply MySQL updates independent of upcp
● /scripts/cleanupmysqlprivs
Will clean up the default MySQL privilege tables, by installing
a more restrictive privilege schema.
● /scripts/mysqlconnectioncheck
Will verify that mysql is accessible with password stored in /root/.my.cnf,
and force a reset with a random 16 character string if inaccessible.
● /scripts/restartsrv_mysql
● /scripts/eximup
Can be called to apply exim updates independent of upcp
● /scripts/buildeximconf
Will rebuild exim.conf, and merge local, distribution, and cPanel
configurations
● /scripts/restartsrv_exim
● /scripts/rebuildnamedconf
Rebuild named.conf based on existing zone files
● /scripts/restartsrv_bind
● /scripts/easyapache
Download, extract, and execute apache build script
● /scripts/rebuildhttpdconf
Rebuilds httpd.conf based on DNS entries found in each
cPanel user configuration
● /scripts/restartsrv_httpd
cPanel Scripts
--------------
Useful Scripts – cPanel and System
● /scripts/restartsrv_{servicename}
The majority of cPanel managed service can be scripts named
appropriately.
● /scripts/makecpphp
Will rebuild the PHP interpreter used internally by cpsrvd
● /usr/local/cpanel/bin/checkperlmodules
Will scan for and install any Perl modules required by cPanel.
● /scripts/fullhordereset
Updates horde and resets the horde mysql user password
● /scripts/fixquotas
Will attempt to rebuild quota database per information stored in /
etc/quota.conf
Sunday, January 27, 2008
Saturday, January 26, 2008
Hotlink Protection using .htacess
For httpd servers
------------------
In the webmaster community, "hot linking" is a curse phrase. Also known as "bandwidth stealing" by the angry site owner, it refers to linking directly to non-html objects not on one own's server, such as images, .js files etc. The victim's server in this case is robbed of bandwidth (and in turn money) as the violator enjoys showing content without having to pay for its deliverance. The most common practice of hot linking pertains to another site's images
Using .htaccess, you can disallow hot linking on your server, so those attempting to link to an image or CSS file on your site, for example, is either blocked (failed request, such as a broken image) or served a different content (ie: an image of an angry man) . Note that mod_rewrite needs to be enabled on your server in order for this aspect of .htaccess to work. Inquire your web host regarding this.
With all the pieces in place, here's how to disable hot linking of certain file types on your site, in the case below, images, JavaScript (js) and CSS (css) files on your site. Simply add the below code to your .htaccess file, and upload the file either to your root directory, or a particular subdirectory to localize the effect to just one section of your site:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]
Serving alternate content when hot linking is detected
You can set up your .htaccess file to actually serve up different content when hot linking occurs. This is more commonly done with images, such as serving up an Angry Man image in place of the hot linked one. The code for this is:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/angryman.gif [R,L]
Same deal- replace mydomain.com with your own, plus angryman.gif.
Time to pour a bucket of cold water on hot linking!
------------------
In the webmaster community, "hot linking" is a curse phrase. Also known as "bandwidth stealing" by the angry site owner, it refers to linking directly to non-html objects not on one own's server, such as images, .js files etc. The victim's server in this case is robbed of bandwidth (and in turn money) as the violator enjoys showing content without having to pay for its deliverance. The most common practice of hot linking pertains to another site's images
Using .htaccess, you can disallow hot linking on your server, so those attempting to link to an image or CSS file on your site, for example, is either blocked (failed request, such as a broken image) or served a different content (ie: an image of an angry man) . Note that mod_rewrite needs to be enabled on your server in order for this aspect of .htaccess to work. Inquire your web host regarding this.
With all the pieces in place, here's how to disable hot linking of certain file types on your site, in the case below, images, JavaScript (js) and CSS (css) files on your site. Simply add the below code to your .htaccess file, and upload the file either to your root directory, or a particular subdirectory to localize the effect to just one section of your site:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]
Serving alternate content when hot linking is detected
You can set up your .htaccess file to actually serve up different content when hot linking occurs. This is more commonly done with images, such as serving up an Angry Man image in place of the hot linked one. The code for this is:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/angryman.gif [R,L]
Same deal- replace mydomain.com with your own, plus angryman.gif.
Time to pour a bucket of cold water on hot linking!
Thursday, January 24, 2008
VPS OpenVZ Installation
OPENVZ VPS
1.1. What is VPS?
A virtual private server or virtual dedicated server (VPS or VDS)is a server run through virtualization. It is used to partition a single physical server into many isolated virtual private servers. Each virtual private server looks and behaves exactly like a real networked server system, complete with its own set of init scripts, users, processes, filesystems, etc.,It fills the gap between shared hosting and dedicated hosting.
1.2. What is openvz?
OpenVZ is an operating system-level virtulization technology based on the Linux kernel and operating system. OpenVZ allows a physical server to run multiple isolated operating system instances, known as Virtual Private Servers (VPS) or Virtual Environments (VE).
OpenVZ offers the least flexibility in the choice of operating system: both the guest and host OS must be Linux (although Linux distributions can be different in different VEs). However, OpenVZ's operating system-level virtulization provides better performance, scalability, density, dynamic resource management, and ease of administration than the alternatives.
OpenVZ kernel is a modified Linux kernel which adds support for Virtual Environments (VE).So it is easy to create and configure a VPS using openvz.
2. Requirements
2.1. Software Requirements
The Hardware Node should run either Red Hat Enterprise Linux 3 or 4, or Fedora Core 3 or 4, or CentOS 3.4 or 4. The detailed instructions on installing these operating systems for the best performance of OpenVZ are provided in the next sections.
This requirement does not restrict the ability of OpenVZ to provide other Linux versions as an operating system for Virtual Private Servers. The Linux distribution installed in a Virtual Private Server may differ from that of the host OS.
2.2. Hardware Requirements
The Hardware Node requirements for the standard 32-bit edition of OpenVZ are the following:
The computer should satisfy the Red Hat Enterprise Linux or Fedora Core hardware requirements.
i)IBM PC-compatible computer.
ii)CPUs: Intel Celeron, Pentium II, Pentium III, Pentium 4, Xeon, or AMD Athlon CPU. The more Virtual Private Servers you plan to run simultaneously, the more CPUs you need.
iii)Memory: Atleast 128 MB of RAM.The more memory you have, the more Virtual Private Servers you can run. The exact figure depends on the number and nature of applications you are planning to run in your Virtual Private Servers. However, on the average, at least 1 GB of RAM is recommended for every 20-30 Virtual Private Servers.
iv)HDD: Atleast 4 GB of free disk space. Each Virtual Private Server occupies 400-600 MB of hard disk space for system files in addition to the user data inside the Virtual Private Server (for example, website content). You should consider it when planning disk partitioning and the number of Virtual Private Servers to run.
v)NIC: Network card will be either Intel EtherExpress100 (i82557-, i82558- or i82559-based) or 3Com(3c905 or 3c905B or 3c595) or RTL8139-based are recommended.
A typical 2-way Dell PowerEdge 1650 1u-mountable server with 1 GB of RAM and 36 GB of hard drives is suitable for hosting 30 Virtual Private Servers.
3.Installation And Configuration
3.1. Pre-Setup
The first step before starting installation is to set up the openvz yum repository.
# cd /etc/yum.repos.d
# wget http://download.openvz.org/openvz.repo
# rpm --import http://download.openvz.org/RPM-GPG-Key-OpenVZ
# yum update
Now create a separate hard disk partition having atleast 4GB of space and mount it in /vz
3.2. Kernel Installation
You can install the kernel using yum.
yum install ovzkernel[-flavor]
Here [-flavor] is optional, and can be -smp or -enterprise.
But it will be not good always.
So here you can compile an optimized kernel by yourself.
Before kernel compilation you may need to check the hardware type that installed in your server.
# cat /proc/cpuinfo
This will give you the information about processor.
# lspci
This will give you the list of main other hardwares installed in your system.
Now we can start to build the vps kernel from source. So we need to download a kernel source.
# cd /usr/src
# wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.16.tar.bz2
Now to download the appropriate patch from openvz.
# wget http://download.openvz.org/kernel/devel/026test018.1/patches/patch-026test018-combined.gz
The kernel configs are also available from openvz.
#wget http://download.openvz.org/kernel/devel/026test018.1/configs/kernel-2.6.16-026test018-i686-smp.config.ovz
Let us start the buiding...
# tar xvjf linux-2.6.16.tar.bz2
# cd linux-2.6.16
# mv ../patch-026test018-combined.gz
# gzip -dc patch-026test018-combined.gz | patch -p1
# cp ../kernel-2.6.16-026test018-i686-smp.config.ovz .config
# make menuconfig
Now you can select the options depend on your server configuration.
# make all
# make modules_install
# make
# make install
Now the VPS host kernel was successfully compiled and installed. So go to configure the boot loader either (grub or lilo).
3.3. Boot Loader Configuration
If GRUB is used as boot loader, it will configure automatically. Lines similar to following will be added to the grub.conf file.
# cat /boot/grub/grub.conf
Now you can find the following lines in grub.conf
title Fedora Core (2.6.16-026test018)
root (hd0,0)
kernel /vmlinuz-2.6.16-026test018 ro root=LABEL=/ rhgb quiet
initrd /initrd-2.6.16-026test018.img
Now edit this file as follows. (It is not necessary and just for understanding)
# vi /boot/grub/grub.conf
title VPS-openvz(2.6.16-026test018)
root (hd0,0)
kernel /vmlinuz-2.6.16-026test018 ro root=LABEL=/ rhgb quiet panic=5
initrd /initrd-2.6.16-026test018.img
Now set the "default" value to the newly edited image (in most case it will be '0'). Then save grub.config.If you are installing a remote server please add the following to the grub.
# grub --no-floppy
grub> savedefault --default=0 --once
grub> quit
Don't reboot the system now. We must need to configure some more files too.
3.4. Sysctl
We need to set the following contents in sysctl.conf for its good working
# vi /etc/sysctl.conf
Now add the following parameters.
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
3.5. SELinux
SELinux should be disabled.
# vi /etc/sysconfig/selinux
Add the following line to this file.
SELINUX=disabled
3.6. Conntracks
In the stable OpenVZ kernels (those that are 2.6.8-based) netfilter connection tracking for VE0 is disabled by default. If you have a stateful firewall enabled on the host node you should either disable it, or enable connection tracking for VE0.
To enable conntracks for VE0 please edit the file /etc/modprobe.conf
# vi /etc/modprobe.conf
Now add the following.
options ip_conntrack ip_conntrack_enable_ve0=1
In kernels later than 2.6.8, connection tracking is enabled by default.
3.7. Rebooting Into VPS
Now reboot the server. If it is loaded successfully we can proceed to installing the user-level tools for OpenVZ
3.8. Install Utilities
Now we need to install three basic utility packages .
vzctl: it is used to perform different operations on the OpenVZ VPS (eg : create, destroy, start, stop, set parameters etc.)
vzquota: This package is used to manage the VPS quotas.
vzpkg: this package is used to work with OpenVZ templates
Let us install this packages as follows
# yum install vzctl
# yum install vzquota
# yum install vzpkg
Now check the virtual ethernet device
# ifconfig
If it is not there use the following command to make it up.
# ifconfig venet0 up
Now reboot the server
# reboot
3.9. Install OS Templates
Now you need to install at leaset one os template.
# yum install vztmpl-fedora-core
Also you need to download a template package for creating vps .
# cd /vz/template/cache/
# wget http://download.openvz.org/template/precreated/fedora-core-4-i386-default.tar.gz
Alternative: use precreated template cache
As an alternative to creating a cache using template metadata, you can use precreated template cache taken from Downloads » Templates » Precreated, or directly from download.openvz.org/template/precreated, or from one of the mirrors.
Precreated templates can be easily updated using the following algorithm:
1. create temporary VE based on template
2. update VE using OS-specific tools (yum, apt or similar)
3. pack VE as a new template
Examples of this procedure are described in details at Updating Ubuntu template, Updating Debian template, Fedora template update
In order to use precreated template cache files, download files for chosen OS distributions and place them as-is (no unpacking needed) to the /vz/template/cache directory.
4. Usages
4.1. Create VPS
First you need to select a vps id. The id 0 is used for the hardware node itself.
# vzlist -a
This command list all the vps in the host.
You can create a vps using the default template or you can define a template package and a configuration. The default creation is as follows,
# vzctl create 101
If you want to create a vps using a OS template as follows
# vzctl create 101 --ostemplate fedora-core-4 -i --config vps.basic
101: is the vp id
fedora-core-4: is the OS template
vps.basic: is the configurations defined in vps.basic.conf
4.2. Configure VPS
Now we need to configure our vps. In this process we need to set up the following parameters.
i) Set the startup parameters
ii) Set the network parameters
iii) Set the root(user) password
So do the following commands in the host server.
# vzctl stop 101
# vzctl set 101 --onboot yes --save
# vzctl set 101 --hostname cyborg.com --save
# vzctl set 101 --ipadd 192.168.1.169 --save
# vzctl set 101 --nameserver 192.168.1.9 --save
# vzctl set 101 --userpasswd root:qwerty
# vzctl start 101
Now our vps will automatically start at the boot time of host. Also it have the host name "cyborg.com" with ip 192.168.1.169 and nameserver 192.168.1.9. The root password was set to "qwerty". Now do the following
# vzlist -a
VEID NPROC STATUS IP_ADDR HOSTNAME
1 17 running 192.168.1.166 localhost
101 31 running 192.168.1.169 cyborg.com
4.3. Start,Stop and Restart
Now you need to do the following operations in your vps
i) start
ii)stop
iii)restart
iv)status
So run the following commands.
# vzctl stop 101
# vzctl start 101
# vzctl restart 101
# vzctl status 101
In my server it shows the following output.
# vzctl stop 101
Stopping VE ...
VE was stopped
VE is unmounted
# vzctl start 101
Starting VE ...
VE is mounted
Adding IP address(es): 192.168.1.169
Setting CPU units: 1000
Set hostname: cyborg.com
File resolv.conf was modified
VE start in progress...
# vzctl restart 101
Restarting VE
Stopping VE ...
VE was stopped
VE is unmounted
Starting VE ...
VE is mounted
Adding IP address(es): 192.168.1.169
Setting CPU units: 1000
Set hostname: cyborg.com
File resolv.conf was modified
VE start in progress...
# vzctl status 101
VEID 101 exist mounted running
4.4. Delete VPS
To delete a vps node we use the "destroy" command.
# vzctl stop 101
# vzctl destroy 101
Now the vps node 101 is deleted.You can check the status of this node. My server give the following output on the status operation.
# vzctl status 101
VPS 101 deleted unmounted down
5. Commands & Tools
5.1. Running Commands In VPS
We can run commands in a VPS through the host using "exec".
# vzctl exec 101
An example is given below.
# vzctl exec 101 ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:27 errors:0 dropped:0 overruns:0 frame:0
TX packets:26 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3118 (3.0 KiB) TX bytes:3720 (3.6 KiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.1.169 P-t-P:192.168.1.169 Bcast:192.168.1.169 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
5.2. OS Template Management
In this section we can see the list of cached and other templates.
To list the OS templates in the host please do the following commands.
# vzpkgls
To see the cached templates ,do the folowing
# vzpkgls --cached
To see the template used by a vps do the following,
# vzpkgls 101
The above commands give the following results in my server.
# vzpkgls
fedora-core-4-i386-default
fedora-core-4-i386-minimal
# vzpkgls --cached
fedora-core-4-i386-default
# vzpkgls 101
fedora-core-4-i386-default
5.3. Operations in VPS
To update the vps do the folllowing
# vzyum 101 update
To install a package (eg: php) do the following.
# vzyum 101 install php
To install an rpm(eg: MySQL-shared-3.23.57-1.i386.rpm) from the host ,do it as follows
# vzrpm 101 -ihv MySQL-shared-3.23.57-1.i386.rpm
6. Resource Management
This section is main important . The main goal of resource control in a VPS is to prevent a particular VPS from malicious or accidental usage of hardware resources.
6.1 Configuration Files
We can control the resource through a set of control parameters.All of these parameters placed in the openvz global configuration file or in the respective VPS configuration file.
The global configuration file is located in " /etc/sysconfig/vz " and the individual configuration file is located in " /etc/sysconfig/vz-scripts/VPSID.conf "
6.2 Disk Quota Management
There are a set of parameters determines disk quota in OpenVZ. The OpenVZ disk quota is realized on two levels:the per-VPS level and the per-user/group level. You can turn on/off disk quota on any level and configure its settings.
The main parameters are DISK_QUOTA, DISKSPACE,DISKINODES, QUOTATIME,QUOTAUGIDLIMIT.
DISK_QUOTA : Indicates whether first-level quotas are on or off for all VPSs or for a separate VPS.If is defined in the global configuration file (GF).
# grep DISK_QUOTA /etc/sysconfig/vz
DISK_QUOTA=yes
DISKSPACE : Total size of disk space the VPS may consume, in 1-Kb blocks.It is defined in the separate configuration file(SF).
# grep DISKSPACE /etc/sysconfig/vz-scripts/101.conf
DISKSPACE="2000000:2200000"
DISKINODES : Total number of disk inodes (files, directories, and symbolic links) the Virtual Private Server can allocate.It is defined in the separate configuration file(SF).
# grep DISKINODES /etc/sysconfig/vz-scripts/101.conf
DISKINODES="200000:220000"
QUOTATIME : The grace period for the disk quota overusage defined in seconds. The Virtual Private Server is allowed to temporarily exceed its quota soft limits for no more than the QUOTATIME period.It is defined in SF.
# grep QUOTATIME /etc/sysconfig/vz-scripts/101.conf
QUOTATIME="0"
QUOTAUGIDLIMIT : Number of user/group IDs allowed for the VPS internal disk quota. If set to 0, the UID/GID quota will not be enabled.It is defined in SF.
Turning on/off per vps disk quota:Now to turning on per vps disk quota do the following.
Edit the separate configuration file
# vi /etc/sysconfig/vz-scripts/101.conf
Add the following,
DISK_QUOTA=yes
If you set the above value to "no". The quota will be off.
# vzctl restart 101
# vzctl exec 101 df -h
Set up per vps disk quota:Now to set up per vps disk quota(eg : for a nod 102) we need to set up the following parameters DISKSPACE ,DISKINODES ,QUOTATIME
# vzctl set 102 --diskspace 1000000:1100000 --save
# vzctl set 102 --diskinodes 90000:91000 --save
# vzctl set 102 --quotatime 600 --save
# vzctl restart 102
# vzctl exec 102 df -h
Turning On/Off Second-Level Quotas for Virtual Private Server:The parameter that controls the second-level disk quotas is QUOTAUGIDLIMIT in the VPS configuration file. By default, the value of this parameter is zero and this corresponds to disabled per-user/group quotas.
Enabling per-user/group quotas for a Virtual Private Server requires restarting the VPS. The value for it should be carefully chosen; the bigger value you set, the bigger kernel memory overhead this Virtual Private Server creates. This value must be greater than or equal to the number of entries in the VPS /etc/passwd and /etc/group files.
# cat /etc/passwd|wc -l
55
# cat /etc/group|wc -l
66
# vzctl set 102 --quotaugidlimit 100 --save
# vzctl restart 102
Setting Up Second-Level Disk Quota Parameters:first to check the required packages are there in the vps.
# vzctl exec 102 rpm -q quota
Then ssh to the node 102
Now to edit the quota for the root do the following,
# edquota root
To report the quota do the folowing,
# repquota -a
This command gives the following output in my test vps.
# repquota -a
*** Report for user quotas on device /dev/simfs
Block grace time: 00:00; Inode grace time: 00:00
Block limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 455028 0 0 19878 0 0
smmsp -- 8 0 0 2 0 0
named -- 40 0 0 10 0 0
apache -- 8 0 0 2 0 0
rpm -- 9472 0 0 75 0 0
mysql -- 1332 0 0 163 0 0
To check the quota stats do the following operation in the host server.
# vzquota stat 102 -t
6.3 CPU Sharing
We can set up the cpu utilization of a vps as follows.
# vzcpucheck
# vzctl set 102 --cpuunits 1500 --cpulimit 4 --save
# vzctl restart 102
DOWNLOADS
Linux kernel repository: http://www.kernel.org/pub/linux/kernel/
OpenVZ kernels,patches and configs: http://download.openvz.org/kernel/devel/
OpenVZ utilities: http://download.openvz.org/utils/
Os templates: http://download.openvz.org/template/
Other downloads: http://download.openvz.org
References
http://openvz.org/
http://forum.openvz.org/
http://blog.openvz.org/
http://wiki.openvz.org/
1.1. What is VPS?
A virtual private server or virtual dedicated server (VPS or VDS)is a server run through virtualization. It is used to partition a single physical server into many isolated virtual private servers. Each virtual private server looks and behaves exactly like a real networked server system, complete with its own set of init scripts, users, processes, filesystems, etc.,It fills the gap between shared hosting and dedicated hosting.
1.2. What is openvz?
OpenVZ is an operating system-level virtulization technology based on the Linux kernel and operating system. OpenVZ allows a physical server to run multiple isolated operating system instances, known as Virtual Private Servers (VPS) or Virtual Environments (VE).
OpenVZ offers the least flexibility in the choice of operating system: both the guest and host OS must be Linux (although Linux distributions can be different in different VEs). However, OpenVZ's operating system-level virtulization provides better performance, scalability, density, dynamic resource management, and ease of administration than the alternatives.
OpenVZ kernel is a modified Linux kernel which adds support for Virtual Environments (VE).So it is easy to create and configure a VPS using openvz.
2. Requirements
2.1. Software Requirements
The Hardware Node should run either Red Hat Enterprise Linux 3 or 4, or Fedora Core 3 or 4, or CentOS 3.4 or 4. The detailed instructions on installing these operating systems for the best performance of OpenVZ are provided in the next sections.
This requirement does not restrict the ability of OpenVZ to provide other Linux versions as an operating system for Virtual Private Servers. The Linux distribution installed in a Virtual Private Server may differ from that of the host OS.
2.2. Hardware Requirements
The Hardware Node requirements for the standard 32-bit edition of OpenVZ are the following:
The computer should satisfy the Red Hat Enterprise Linux or Fedora Core hardware requirements.
i)IBM PC-compatible computer.
ii)CPUs: Intel Celeron, Pentium II, Pentium III, Pentium 4, Xeon, or AMD Athlon CPU. The more Virtual Private Servers you plan to run simultaneously, the more CPUs you need.
iii)Memory: Atleast 128 MB of RAM.The more memory you have, the more Virtual Private Servers you can run. The exact figure depends on the number and nature of applications you are planning to run in your Virtual Private Servers. However, on the average, at least 1 GB of RAM is recommended for every 20-30 Virtual Private Servers.
iv)HDD: Atleast 4 GB of free disk space. Each Virtual Private Server occupies 400-600 MB of hard disk space for system files in addition to the user data inside the Virtual Private Server (for example, website content). You should consider it when planning disk partitioning and the number of Virtual Private Servers to run.
v)NIC: Network card will be either Intel EtherExpress100 (i82557-, i82558- or i82559-based) or 3Com(3c905 or 3c905B or 3c595) or RTL8139-based are recommended.
A typical 2-way Dell PowerEdge 1650 1u-mountable server with 1 GB of RAM and 36 GB of hard drives is suitable for hosting 30 Virtual Private Servers.
3.Installation And Configuration
3.1. Pre-Setup
The first step before starting installation is to set up the openvz yum repository.
# cd /etc/yum.repos.d
# wget http://download.openvz.org/openvz.repo
# rpm --import http://download.openvz.org/RPM-GPG-Key-OpenVZ
# yum update
Now create a separate hard disk partition having atleast 4GB of space and mount it in /vz
3.2. Kernel Installation
You can install the kernel using yum.
yum install ovzkernel[-flavor]
Here [-flavor] is optional, and can be -smp or -enterprise.
But it will be not good always.
So here you can compile an optimized kernel by yourself.
Before kernel compilation you may need to check the hardware type that installed in your server.
# cat /proc/cpuinfo
This will give you the information about processor.
# lspci
This will give you the list of main other hardwares installed in your system.
Now we can start to build the vps kernel from source. So we need to download a kernel source.
# cd /usr/src
# wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.16.tar.bz2
Now to download the appropriate patch from openvz.
# wget http://download.openvz.org/kernel/devel/026test018.1/patches/patch-026test018-combined.gz
The kernel configs are also available from openvz.
#wget http://download.openvz.org/kernel/devel/026test018.1/configs/kernel-2.6.16-026test018-i686-smp.config.ovz
Let us start the buiding...
# tar xvjf linux-2.6.16.tar.bz2
# cd linux-2.6.16
# mv ../patch-026test018-combined.gz
# gzip -dc patch-026test018-combined.gz | patch -p1
# cp ../kernel-2.6.16-026test018-i686-smp.config.ovz .config
# make menuconfig
Now you can select the options depend on your server configuration.
# make all
# make modules_install
# make
# make install
Now the VPS host kernel was successfully compiled and installed. So go to configure the boot loader either (grub or lilo).
3.3. Boot Loader Configuration
If GRUB is used as boot loader, it will configure automatically. Lines similar to following will be added to the grub.conf file.
# cat /boot/grub/grub.conf
Now you can find the following lines in grub.conf
title Fedora Core (2.6.16-026test018)
root (hd0,0)
kernel /vmlinuz-2.6.16-026test018 ro root=LABEL=/ rhgb quiet
initrd /initrd-2.6.16-026test018.img
Now edit this file as follows. (It is not necessary and just for understanding)
# vi /boot/grub/grub.conf
title VPS-openvz(2.6.16-026test018)
root (hd0,0)
kernel /vmlinuz-2.6.16-026test018 ro root=LABEL=/ rhgb quiet panic=5
initrd /initrd-2.6.16-026test018.img
Now set the "default" value to the newly edited image (in most case it will be '0'). Then save grub.config.If you are installing a remote server please add the following to the grub.
# grub --no-floppy
grub> savedefault --default=0 --once
grub> quit
Don't reboot the system now. We must need to configure some more files too.
3.4. Sysctl
We need to set the following contents in sysctl.conf for its good working
# vi /etc/sysctl.conf
Now add the following parameters.
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
3.5. SELinux
SELinux should be disabled.
# vi /etc/sysconfig/selinux
Add the following line to this file.
SELINUX=disabled
3.6. Conntracks
In the stable OpenVZ kernels (those that are 2.6.8-based) netfilter connection tracking for VE0 is disabled by default. If you have a stateful firewall enabled on the host node you should either disable it, or enable connection tracking for VE0.
To enable conntracks for VE0 please edit the file /etc/modprobe.conf
# vi /etc/modprobe.conf
Now add the following.
options ip_conntrack ip_conntrack_enable_ve0=1
In kernels later than 2.6.8, connection tracking is enabled by default.
3.7. Rebooting Into VPS
Now reboot the server. If it is loaded successfully we can proceed to installing the user-level tools for OpenVZ
3.8. Install Utilities
Now we need to install three basic utility packages .
vzctl: it is used to perform different operations on the OpenVZ VPS (eg : create, destroy, start, stop, set parameters etc.)
vzquota: This package is used to manage the VPS quotas.
vzpkg: this package is used to work with OpenVZ templates
Let us install this packages as follows
# yum install vzctl
# yum install vzquota
# yum install vzpkg
Now check the virtual ethernet device
# ifconfig
If it is not there use the following command to make it up.
# ifconfig venet0 up
Now reboot the server
# reboot
3.9. Install OS Templates
Now you need to install at leaset one os template.
# yum install vztmpl-fedora-core
Also you need to download a template package for creating vps .
# cd /vz/template/cache/
# wget http://download.openvz.org/template/precreated/fedora-core-4-i386-default.tar.gz
Alternative: use precreated template cache
As an alternative to creating a cache using template metadata, you can use precreated template cache taken from Downloads » Templates » Precreated, or directly from download.openvz.org/template/precreated, or from one of the mirrors.
Precreated templates can be easily updated using the following algorithm:
1. create temporary VE based on template
2. update VE using OS-specific tools (yum, apt or similar)
3. pack VE as a new template
Examples of this procedure are described in details at Updating Ubuntu template, Updating Debian template, Fedora template update
In order to use precreated template cache files, download files for chosen OS distributions and place them as-is (no unpacking needed) to the /vz/template/cache directory.
4. Usages
4.1. Create VPS
First you need to select a vps id. The id 0 is used for the hardware node itself.
# vzlist -a
This command list all the vps in the host.
You can create a vps using the default template or you can define a template package and a configuration. The default creation is as follows,
# vzctl create 101
If you want to create a vps using a OS template as follows
# vzctl create 101 --ostemplate fedora-core-4 -i --config vps.basic
101: is the vp id
fedora-core-4: is the OS template
vps.basic: is the configurations defined in vps.basic.conf
4.2. Configure VPS
Now we need to configure our vps. In this process we need to set up the following parameters.
i) Set the startup parameters
ii) Set the network parameters
iii) Set the root(user) password
So do the following commands in the host server.
# vzctl stop 101
# vzctl set 101 --onboot yes --save
# vzctl set 101 --hostname cyborg.com --save
# vzctl set 101 --ipadd 192.168.1.169 --save
# vzctl set 101 --nameserver 192.168.1.9 --save
# vzctl set 101 --userpasswd root:qwerty
# vzctl start 101
Now our vps will automatically start at the boot time of host. Also it have the host name "cyborg.com" with ip 192.168.1.169 and nameserver 192.168.1.9. The root password was set to "qwerty". Now do the following
# vzlist -a
VEID NPROC STATUS IP_ADDR HOSTNAME
1 17 running 192.168.1.166 localhost
101 31 running 192.168.1.169 cyborg.com
4.3. Start,Stop and Restart
Now you need to do the following operations in your vps
i) start
ii)stop
iii)restart
iv)status
So run the following commands.
# vzctl stop 101
# vzctl start 101
# vzctl restart 101
# vzctl status 101
In my server it shows the following output.
# vzctl stop 101
Stopping VE ...
VE was stopped
VE is unmounted
# vzctl start 101
Starting VE ...
VE is mounted
Adding IP address(es): 192.168.1.169
Setting CPU units: 1000
Set hostname: cyborg.com
File resolv.conf was modified
VE start in progress...
# vzctl restart 101
Restarting VE
Stopping VE ...
VE was stopped
VE is unmounted
Starting VE ...
VE is mounted
Adding IP address(es): 192.168.1.169
Setting CPU units: 1000
Set hostname: cyborg.com
File resolv.conf was modified
VE start in progress...
# vzctl status 101
VEID 101 exist mounted running
4.4. Delete VPS
To delete a vps node we use the "destroy" command.
# vzctl stop 101
# vzctl destroy 101
Now the vps node 101 is deleted.You can check the status of this node. My server give the following output on the status operation.
# vzctl status 101
VPS 101 deleted unmounted down
5. Commands & Tools
5.1. Running Commands In VPS
We can run commands in a VPS through the host using "exec".
# vzctl exec 101
An example is given below.
# vzctl exec 101 ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:27 errors:0 dropped:0 overruns:0 frame:0
TX packets:26 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3118 (3.0 KiB) TX bytes:3720 (3.6 KiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.1.169 P-t-P:192.168.1.169 Bcast:192.168.1.169 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
5.2. OS Template Management
In this section we can see the list of cached and other templates.
To list the OS templates in the host please do the following commands.
# vzpkgls
To see the cached templates ,do the folowing
# vzpkgls --cached
To see the template used by a vps do the following,
# vzpkgls 101
The above commands give the following results in my server.
# vzpkgls
fedora-core-4-i386-default
fedora-core-4-i386-minimal
# vzpkgls --cached
fedora-core-4-i386-default
# vzpkgls 101
fedora-core-4-i386-default
5.3. Operations in VPS
To update the vps do the folllowing
# vzyum 101 update
To install a package (eg: php) do the following.
# vzyum 101 install php
To install an rpm(eg: MySQL-shared-3.23.57-1.i386.rpm) from the host ,do it as follows
# vzrpm 101 -ihv MySQL-shared-3.23.57-1.i386.rpm
6. Resource Management
This section is main important . The main goal of resource control in a VPS is to prevent a particular VPS from malicious or accidental usage of hardware resources.
6.1 Configuration Files
We can control the resource through a set of control parameters.All of these parameters placed in the openvz global configuration file or in the respective VPS configuration file.
The global configuration file is located in " /etc/sysconfig/vz " and the individual configuration file is located in " /etc/sysconfig/vz-scripts/VPSID.conf "
6.2 Disk Quota Management
There are a set of parameters determines disk quota in OpenVZ. The OpenVZ disk quota is realized on two levels:the per-VPS level and the per-user/group level. You can turn on/off disk quota on any level and configure its settings.
The main parameters are DISK_QUOTA, DISKSPACE,DISKINODES, QUOTATIME,QUOTAUGIDLIMIT.
DISK_QUOTA : Indicates whether first-level quotas are on or off for all VPSs or for a separate VPS.If is defined in the global configuration file (GF).
# grep DISK_QUOTA /etc/sysconfig/vz
DISK_QUOTA=yes
DISKSPACE : Total size of disk space the VPS may consume, in 1-Kb blocks.It is defined in the separate configuration file(SF).
# grep DISKSPACE /etc/sysconfig/vz-scripts/101.conf
DISKSPACE="2000000:2200000"
DISKINODES : Total number of disk inodes (files, directories, and symbolic links) the Virtual Private Server can allocate.It is defined in the separate configuration file(SF).
# grep DISKINODES /etc/sysconfig/vz-scripts/101.conf
DISKINODES="200000:220000"
QUOTATIME : The grace period for the disk quota overusage defined in seconds. The Virtual Private Server is allowed to temporarily exceed its quota soft limits for no more than the QUOTATIME period.It is defined in SF.
# grep QUOTATIME /etc/sysconfig/vz-scripts/101.conf
QUOTATIME="0"
QUOTAUGIDLIMIT : Number of user/group IDs allowed for the VPS internal disk quota. If set to 0, the UID/GID quota will not be enabled.It is defined in SF.
Turning on/off per vps disk quota:Now to turning on per vps disk quota do the following.
Edit the separate configuration file
# vi /etc/sysconfig/vz-scripts/101.conf
Add the following,
DISK_QUOTA=yes
If you set the above value to "no". The quota will be off.
# vzctl restart 101
# vzctl exec 101 df -h
Set up per vps disk quota:Now to set up per vps disk quota(eg : for a nod 102) we need to set up the following parameters DISKSPACE ,DISKINODES ,QUOTATIME
# vzctl set 102 --diskspace 1000000:1100000 --save
# vzctl set 102 --diskinodes 90000:91000 --save
# vzctl set 102 --quotatime 600 --save
# vzctl restart 102
# vzctl exec 102 df -h
Turning On/Off Second-Level Quotas for Virtual Private Server:The parameter that controls the second-level disk quotas is QUOTAUGIDLIMIT in the VPS configuration file. By default, the value of this parameter is zero and this corresponds to disabled per-user/group quotas.
Enabling per-user/group quotas for a Virtual Private Server requires restarting the VPS. The value for it should be carefully chosen; the bigger value you set, the bigger kernel memory overhead this Virtual Private Server creates. This value must be greater than or equal to the number of entries in the VPS /etc/passwd and /etc/group files.
# cat /etc/passwd|wc -l
55
# cat /etc/group|wc -l
66
# vzctl set 102 --quotaugidlimit 100 --save
# vzctl restart 102
Setting Up Second-Level Disk Quota Parameters:first to check the required packages are there in the vps.
# vzctl exec 102 rpm -q quota
Then ssh to the node 102
Now to edit the quota for the root do the following,
# edquota root
To report the quota do the folowing,
# repquota -a
This command gives the following output in my test vps.
# repquota -a
*** Report for user quotas on device /dev/simfs
Block grace time: 00:00; Inode grace time: 00:00
Block limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 455028 0 0 19878 0 0
smmsp -- 8 0 0 2 0 0
named -- 40 0 0 10 0 0
apache -- 8 0 0 2 0 0
rpm -- 9472 0 0 75 0 0
mysql -- 1332 0 0 163 0 0
To check the quota stats do the following operation in the host server.
# vzquota stat 102 -t
6.3 CPU Sharing
We can set up the cpu utilization of a vps as follows.
# vzcpucheck
# vzctl set 102 --cpuunits 1500 --cpulimit 4 --save
# vzctl restart 102
DOWNLOADS
Linux kernel repository: http://www.kernel.org/pub/linux/kernel/
OpenVZ kernels,patches and configs: http://download.openvz.org/kernel/devel/
OpenVZ utilities: http://download.openvz.org/utils/
Os templates: http://download.openvz.org/template/
Other downloads: http://download.openvz.org
References
http://openvz.org/
http://forum.openvz.org/
http://blog.openvz.org/
http://wiki.openvz.org/
How Do I Enable remote access to MySQL database server?
Enable Remote connections To MySql Server
By default, MySQL database server remote access disabled for security reasons. However, some time you need to provide the remote access to database server from home or from web server.
Step # 6: Test it
By default, MySQL database server remote access disabled for security reasons. However, some time you need to provide the remote access to database server from home or from web server.
Step # 1: Login over ssh if server is outside your IDC
First, login over ssh to remote MySQL database server
Step # 2: Enable networking
Once connected you need edit the mysql configuration file my.cfg using text editor such as vi.
- If you are using Debian Linux file is located at /etc/mysql/my.cnf location
- If you are using Red Hat Linux/Fedora Linux file is located at /etc/my.cnf location
- If you are using FreeBSD you need to create a file /var/db/mysql/my.cnf
# vi /etc/my.cnf
Step # 3: Once file open, locate line that read as
[mysqld]
Make sure line skip-networking is commented (or remove line) and add following line
bind-address=YOUR-SERVER-IP
For example, if your MySQL server IP is 65.55.55.2 then entire block should be look like as follows:[mysqld]Where,
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
language = /usr/share/mysql/English
bind-address = 65.55.55.2
# skip-networking
....
..
....
- bind-address : IP address to bind to.
- skip-networking : Don’t listen for TCP/IP connections at all. All interaction with mysqld must be made via Unix sockets. This option is highly recommended for systems where only local requests are allowed. Since you need to allow remote connection this line should removed from file or put it in comment state.
Step# 4 Save and Close the file
Restart your mysql service to take change in effect:# /etc/init.d/mysql restart
Step # 5 Grant access to remote IP address
# mysql -u root -p mysqlGrant access to new database
If you want to add new database called foo for user bar and remote IP 202.54.10.20 then you need to type following commands at mysql> prompt:mysql> CREATE DATABASE foo;
mysql> GRANT ALL ON foo.* TO bar@'202.54.10.20' IDENTIFIED BY 'PASSWORD';
How Do I Grant access to existing database?
Let us assume that you are always making connection from remote IP called 202.54.10.20 for database called webdb for user webadmin, To grant access to this IP address type the following command At mysql> prompt for existing database:mysql> update db set Host='202.54.10.20' where Db='webdb';
mysql> update user set Host='202.54.10.20' where user='webadmin';
Step # 5: Logout of MySQL
Type exit command to logout mysql:mysql> exit
Step # 6: Test it
From remote system type command:
$ mysql -u webadmin –h 65.55.55.2 –p
Where,
- -u webadmin: webadmin is MySQL username
- -h IP or hostname: 65.55.55.2 is MySQL server IP address or hostname (FQDN)
- -p : Prompt for password
You can also use telnet to connect to port 3306 for testing purpose:$ telnet 65.55.55.2 3306
MySql Remote connection Using Navicat
What is Navicat?
Navicat is a set of graphical database management, reporting and monitoring tools for MySQL database systems. It allows to to perform all database management functions from a comfortable interface, rather than the command line. You can create tables, manage data, set user permissions, run queries and much more. Also includes comes a backup options, server monitoring and tools to create reports and more. The included Import Wizard allows you to import data from various sources, including MS Access database, Excel, text files and many other formats. MySQL Studio is an extremely useful package for anyone that is either administering or using MySQL server on a regular basis, since it not only makes day-today routine jobs a lot easier, but also provides an overall much easier way to manage advanced MySQL functionality.
You can download Navicat from
http://www.topshareware.com/Navicat-download-40530.htm
http://www.navicat.com/download.html
Connection Settings.
--------------------
Host name : yourdomain name/server IP
Port : 3306
Username : database user name (for cpanel server it is cpanel-username_dbuser
Password : dbuser password.
Also you should have to check whether the server allowing remote connection to the server. If not please check my topic about enabling remote connection in the server.
Navicat is a set of graphical database management, reporting and monitoring tools for MySQL database systems. It allows to to perform all database management functions from a comfortable interface, rather than the command line. You can create tables, manage data, set user permissions, run queries and much more. Also includes comes a backup options, server monitoring and tools to create reports and more. The included Import Wizard allows you to import data from various sources, including MS Access database, Excel, text files and many other formats. MySQL Studio is an extremely useful package for anyone that is either administering or using MySQL server on a regular basis, since it not only makes day-today routine jobs a lot easier, but also provides an overall much easier way to manage advanced MySQL functionality.
You can download Navicat from
http://www.topshareware.com/Navicat-download-40530.htm
http://www.navicat.com/download.html
Connection Settings.
--------------------
Host name : yourdomain name/server IP
Port : 3306
Username : database user name (for cpanel server it is cpanel-username_dbuser
Password : dbuser password.
Also you should have to check whether the server allowing remote connection to the server. If not please check my topic about enabling remote connection in the server.
VPS Faqs
What is VPS?
A Virtual Private Server or VPS (also known as a virtual dedicated server, a VDS, or virtual server) is a method of partitioning one physical server into multiple servers. Each one of these servers has the appearance and capabilities (with it's own allocated resource) as it if were running it's own dedicated server. Each VPS can run its own full-fledged operating system, and each server can be independently rebooted.
A virtual private server is the most economical way to get "guaranteed" resources for your web hosting environment.
Why should I consider VPS, when I can buy or lease a dedicated server?
VPS (Virtual Private Server) allows for better hardware utilization via lesser power utilization than a physical server.
However, maintenance of VPS servers may be marginally expensive. It might be difficult to make backup of one arbitrary software. Security issues are more complex in VPS providers than in dedicated server providers. There are two layers of security : both physical server security and VPS security. VPS monitoring might be more difficult than dedicated server monitoring.
VPS requires more expensive drivers like multi-port network adapters and more physical connections than dedicated server. There are some more management problems since you will use more Ethernet cables and network equipment like switches.
VPS providers tend to need more IP addresses than dedicated providers. If you have only 100 physical computers with 20 VPS on each it is still 2000 IP addresses. Physical systems that have more VPSs might have very high number of packets per second (PPS) though network. It is difficult to manage large number of IP addresses, MAC addresses etc.
There are sometimes software licensing advantages when running VPS. Some software licenses are by number of physical processors or physical computers and therefore they are cheaper when you can divide its price by number of VPS on one physical computer.
VPS performance is better nowadays with overhead less than 5% using modern virtualization software like Virtuozzo. But, disk I/O performances might have bottlenecks due to more disk fragmentation.
All in all, VPS technology should be selected after careful study of its advantages and disadvantages.
Current VPS technologies in market?
Most Popular technologies in the market are Xen, OpenVZ, VMWare.
What is OpenVZ ?
OpenVZ is a complete server automation and virtualization solution.
OpenVZ is an Operating System-level server virtualization solution, built on Linux. OpenVZ creates isolated, secure virtual environments — VEs (otherwise known as virtual private servers, or VPSs) on a single physical server enabling better server utilization and ensuring that applications do not conflict. Each VE performs and executes exactly like a stand-alone server; VEs can be rebooted independently and have root access, users, IP addresses, memory, processes, files, applications, system libraries and configuration files.
What is Virtuozzo?
Virtuozzo is a proprietary operating system virtualization product produced by SWsoft, Inc. Virtuozzo creates isolated virtual environments (VE) or containers on a single physical server and OS instance.
- Intelligent Partitioning - Division of a server into as many as hundreds of VEs with full server functionality.
- Complete Isolation - VEs are secure and have full functional, fault and
performance isolation. - Dynamic Resource Allocation - CPU, memory, network, disk and I/O can be changed without re-booting.
- Live Migration - Business continuity capabilities including live migration
ensure data is available and recoverable. - Mass Management - Suite of tools and templates for automated, multi-VE and multi-server administration.
Understanding SOA records
Understanding SOA records
To an Internet Administrator, there is nothing more peaceful than a stable and optimized DNS server. The moment there is a wrong configuration, the server wakes up and starts crying, sites and email goes down. An important part of keeping DNS that way is properly setting up the SOA records.What are DNS Records. DNS records or Zone files are used for mapping URLs to an IPs. Located on servers called the DNS servers, these records are typically the connection of your website with the outside world. Requests for your website are forwarded to your DNS servers and then get pointed to the WebServers that serve the website or to Email servers that handle the incoming email.
This is how a typical Zone file (containing many common DNS records) looks like.
;
; Zone file for mydomain.com
mydomain.com. 14400 IN SOA ns.mynameserver.com. root.ns.mynameserver.com.(
2004123001
86000
7200
3600000
600 )
mydomain.com. 14400 IN NS ns.mynameserver.com.
mydomain.com. 14400 IN NS ns2.mynameserver.com.
mydomain.com. 14400 IN NS ns3.mynameserver.com.
mydomain.com. 14400 IN A 216.34.94.184
localhost.mydomain.com. 14400 IN A 127.0.0.1
mydomain.com. 14400 IN MX 0 mydomain.com.
mail 14400 IN CNAME mydomain.com.
www 14400 IN CNAME mydomain.com.
ftp 14400 IN CNAME mydomain.com.
In the rest of this article, we'll analyze the various parts of this DNS record, starting from the top.
SOA Records
An SOA(State of Authority) Record is the most essential part of a Zone file. The SOA record is a way for the Domain Administrator to give out simple information about the domain like, how often it is updated, when it was last updated, when to check back for more info, what is the admins email address and so on. A Zone file can contain only one SOA Record.
A properly optimized and updated SOA record can reduce bandwidth between nameservers, increase the speed of website access and ensure the site is alive even when the primary DNS server is down.
Here is the SOA record. Notice the starting bracket ``(``. This has to be on the same line, otherwise the record gets broken.
; name TTL class rr Nameserver email-address
mydomain.com. 14400 IN SOA ns.mynameserver.com. root.ns.mynameserver.com. (
2004123001 ; Serial number
86000 ; Refresh rate in seconds
7200 ; Update Retry in seconds
3600000 ; Expiry in seconds
600 ; minimum in seconds )
mydomain.com. 14400 IN SOA ns.mynameserver.com. root.ns.mynameserver.com.(
can also be written as
;@ 14400 IN SOA ns.mynameserver.com. root.ns.mynameserver.com. (
or
14400 IN SOA ns.mynameserver.com. root.ns.mynameserver.com. (
- name - mydomain.com is the main name in this zone.
- TTL - 14400 - TTL defines the duration in seconds that the record may be cached by client side programs. If it is set as 0, it indicates that the record should not be cached. The range is defined to be between 0 to 2147483647 (close to 68 years !)
- Class - IN - The class shows the type of record. IN equates to Internet. Other options are all historic. So as long as your DNS is on the Internet or Intranet, you must use IN.
- Nameserver - ns.nameserver.com. - The nameserver is the server which holds the zone files. It can be either an external server in which case, the entire domain name must be specified followed by a dot. In case it is defined in this zone file, then it can be written as ``ns'' .
- Email address - root.ns.nameserver.com. - This is the email of the domain name administrator. Now, this is really confusing, because people expect an @ to be in an email address. However in this case, email is sent to root@ns.nameserver.com, but written as root.ns.nameserver.com . And yes, remember to put the dot behind the domain name.
- Serial number - 2004123001 - This is a sort of a revision numbering system to show the changes made to the DNS Zone. This number has to increment , whenever any change is made to the Zone file. The standard convention is to use the date of update YYYYMMDDnn, where nn is a revision number in case more than one updates are done in a day. So if the first update done today would be 2005301200 and second update would be 2005301201.
- Refresh - 86000 - This is time(in seconds) when the slave DNS server will refresh from the master. This value represents how often a secondary will poll the primary server to see if the serial number for the zone has increased (so it knows to request a new copy of the data for the zone). It can be written as ``23h88M'' indicating 23 hours and 88 minutes. If you have a regular Internet server, you can keep it between 6 to 24 hours.
- Retry - 7200 - Now assume that a slave tried to contact the master server and failed to contact it because it was down. The Retry value (time in seconds) will tell it when to get back. This value is not very important and can be a fraction of the refresh value.
- Expiry - 3600000 - This is the time (in seconds) that a slave server will keep a cached zone file as valid, if it can't contact the primary server. If this value were set to say 2 weeks ( in seconds), what it means is that a slave would still be able to give out domain information from its cached zone file for 2 weeks, without anyone knowing the difference. The recommended value is between 2 to 4 weeks.
- Minimum - 600 - This is the default time(in seconds) that the slave servers should cache the Zone file. This is the most important time field in the SOA Record. If your DNS information keeps changing, keep it down to a day or less. Otherwise if your DNS record doesn't change regularly, step it up between 1 to 5 days. The benefit of keeping this value high, is that your website speeds increase drastically as a result of reduced lookups. Caching servers around the globe would cache your records and this improves site performance.
Reducing DNS bandwidth
There is constant bandwidth usage between primary and secondary(backup DNS) servers. This depends a lot on the Refresh value. If the refresh value is say 3 hours, your secondary server is polling your primary server every 3 hours and updating the cache. Lets assume you have a 1000 zone files, each with 3 hours refresh rate. You can imagine the bandwidth that must be getting used. This is especially true if the servers are on 2 separate physical servers.
An increase in the Refresh rate can effectively reduce bandwidth usage between the primary and secondary server.
Increasing site speed
The time it takes to access a website on a browser includes the time it takes to look it up on the domain name server. By increasing the ``Minimum'' value, we're telling the contacting clients to keep their copies of the zone file for a longer time. In effect, reducing the lookups to the nameserver. By reducing the number of times a client has to lookup, we're increasing the site speed.
However, this also means that if you make changes to the DNS record, it will take longer to propagate. If you require to make frequent updates to your DNS records, make sure your Minimum value is lesser than 1 day. That means longer lookup times, but accurate information for the clients
If you are planning a major update on the DNS zone file(say moving to another server or hosting service), reduce the Minimum value a couple of days prior to the change. Then make the change and then jack up the minimum value again. This way the caching clients all over the world will pick up the changes quicker and yet you do not need to sacrifice on site speed thereafter.
How to improve backup
Always keep a secondary DNS server and keep a higher Expiry value. This will mean that even if the Primary server goes down, the secondary will have the cached copy(for as long as the Expiry value stands) and it will keep serving lookups. Keeping a secondary server but a low expiry value defeats the purpose of a Backup.
How to test SOA records
You have set the new SOA values, and you want to know whether the update has taken place. ``Dig'' is a good tool to troubleshoot and check for DNS information.
For example to check out the SOA records of yahoo.com from all the nameservers, primary and secondary, all you need to do is
# dig yahoo.com +nssearch
SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2005122907 3600 300 604800 600 from server ns2.yahoo.com in 0 ms.
SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2005122907 3600 300 604800 600 from server ns3.yahoo.com in 0 ms.
SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2005122907 3600 300 604800 600 from server ns1.yahoo.com in 239 ms.
SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2005122907 3600 300 604800 600 from server ns4.yahoo.com in 280 ms.
Subscribe to:
Posts (Atom)