Oracle: Unbreak my Linux Heart

While developing a script for Oracle Enterprise Manager (OEM) that checks the file system on our servers, I saw the /var on my (NIS) test VM was corrupt. No idea how it had happened but I decided to test my utils out. In doing so, I ran e2fsck -n /dev/mapper/vgsystem-lvvar and it created a whole slew of error messages. Zero inodes, bad dates, orphaned inodes, etc. So I let e2fsck fix them using e2fsck -y /dev/mapper/vgsystem-lvvar ... One of the things I saw run by me was "...erasing journal... device is now ext2" or something. <enter panic mode> thankfully Mandriva has a good Emergency Recovery section . It pointed me to some useful utilities. If you have a bad superblock, try the switch for e2fsck -b 8193 first. There may be a perfectly good backup available. When you delete the ext3 journal, tune2fs -j device recreates it for you and rescuept can scan bad partitions for try to make sense of them...

Found a good site that explains the mrepo configuration on setting up an apt/yum repository from ISO images, online updates, patches and custom packages... Looks to be very cool and much more flexible than Oracle's own ULN local mirror function...

Just thought I'd mention this as this is the first time I ran into this... On Oracle Linux, just as on Fedora, CentOS and Red Hat, you usually install software using either up2date (blah) or yum (much better). However, setting up a local mirror for network installs or local updates, is somewhat daunting. Especially when used to the comfortable ease of Debian-based distos as they have all sources available for free on the net. Therefore it nice to know that some dedicated fellows like Dag Wieers use their time to make life a little easier for you. With tools like mrepo: yum/apt repository mirroring (formerly known as 'yam'). I haven't played with this yet, but I'm gonna look into it for sure!

Just found a great tip to prevent timeouts of PuTTY sessions. I'm fine with timeouts by the host, but in our case the firewall kills sessions after 30 minutes of inactivity... When using PuTTY to ssh to your Linux/Unix servers, be sure to use the feature to send NULL packets to prevent a timeout. I've set it to once every 900 seconds, i.e. 15 minutes... See screenshot on the right.

At last I found a way to debug the usage of sudo and my sudoers file! It was there all along but I must have overlooked it million times... When using the option -l for sudo, you get a listing of the allowed and forbidden commands for that user on that host. Thanks to the [sudo-users] list for showing the light. As there was no mention of the word "debug" anywhere in the man page, I simply overlooked that option all together... *sigh*

While searching the sudo manual for samples and explanations, I discovered that my Oracle Enterprise Linux 4 update 5 uses sudo version 1.6.7p5. The official version is up to version 1.6.9p9. Interesting is, however, that the new version has means to integrate with LDAP! That means, that instead of maintaining a central /etc/sudoers file, you can build your authorization tree in LDAP, where you can also handle your authentication! Cool! Of course, by LDAP I mean OpenLDAP , Novell NDS, Oracle OID or even Microsoft AD...

I had a minor interpretation issue with a paragraph in the Sudoers Manual . So I wrote to the sudo mailinglist and asked a clarification... Here is their answer, which made perfect sense! Thanks! Let's say you have a user, bob, who is a member of a group and sudo has a configuration like: User_Alias ADMINS=bob,mike,tom ADMINS ALL = (ALL) PASSWD: /bin/ps, /bin/ls, /usr/sbin/shutdown -y -g0 -i0 bob ALL = (ALL) PASSWD: /usr/sbin/shutdown This says that bob has multiple entries (in the group and an explicit entry) but the rules say that his last match contradicts the ADMINS. It will give his last match... i.e., he can use shutdown with any argument... if you reverse these entries: bob ALL = (ALL) PASSWD: /usr/sbin/shutdown ADMINS ALL = (ALL) PASSWD: /bin/ps, /bin/ls, /usr/sbin/shutdown -y -g0 -i0 then you have effectively restricted bob to the same command as the other admins. and therefore not given him any special treatment...