Limiting CPU and Memory usage to users/groups(CGroups)

In this post we are going to see : Limiting CPU and Memory usage to users/groups.

In large environments, there is a chance to access single system by more than one users at a time. So, user’s can access the resources highly.

For our exercise going to use RHEL7 Operating System.

CGroups will help us to limit the resources by group of users.

We have below users created already to do practise.

[root@server ~]# grep home /etc/passwd
lbcuser1:x:1005:1007::/home/lbcuser1:/bin/bash
lbcuser2:x:1006:1008::/home/lbcuser2:/bin/bash
lbcuser3:x:1007:1009::/home/lbcuser3:/bin/bash
lbcuser:x:1008:1011::/home/lbcuser:/bin/bash

Users are assigned to below mentioned groups.

Groups:    lbcgroup, finance, admin

[root@server ~]# grep "lbcuser" /etc/group
finance:x:1003:lbcuser2
lbcgroup:x:1010:lbcuser1,lbcuser
admin:x:1012:lbcuser3

To work on this, lbcgroup package should be installed and will use /etc/cgconfig.conf and /etc/cgrules.conf to apply the rules overs the users to limit the resources use.

follow the below steps to apply rules by per Group:

[root@server ~]# vi /etc/cgconfig.conf
mount {
 cpu = /cgroup/cpu_and_mem;
 cpuacct = /cgroup/cpu_and_mem;
 memory = /cgroup/cpu_and_mem;
}

group finance {
 cpu {
 cpu.shares="250";
 }
 cpuacct {
 cpuacct.usage="0";
 }
 memory {
 memory.limit_in_bytes="1G";
 memory.memsw.limit_in_bytes="2G";
 }
}

group lbcgroup {
 cpu {
 cpu.shares="250";
 }
 cpuacct {
 cpuacct.usage="0";
 }
 memory {
 memory.limit_in_bytes="1G";
 memory.memsw.limit_in_bytes="2G";
 }
}

group admin {
 cpu {
 cpu.shares="500";
 }
 cpuacct {
 cpuacct.usage="0";
 }
 memory {
 memory.limit_in_bytes="1G";
 memory.memsw.limit_in_bytes="2G";
 }
}

While starting the server, above configuration file will mount cpu, cpuacct and memory subsystems to a cpu_and _memory cgroup.

CPU:

cpu-shares parameter used to assign the the CPU resources which is available to each and every processes. Assigning parameter values as 250, 250 and 500 for finance, lbcgroup and admin groups in cgroup will split the CPU resources in 1:1:2 ratio. If only one process is running, it doesn’t matter in which cgroup it falls. CPU limitation will be applied, when there is more than one process running.

cpuacct:

cpuacct.usage=”0″ this value is used to reset the CPU usage on cpuacct.usage and cpuacct_percpu files. These files contains the total CPU utilized time by all the process.

Memory:

memory.limit_in_bytes=”1G” parameter says that how much memory allowed to use by a cgroup.

memory.memsw.limit_in_bytes=”2G” parameter says that how much swap space allowed to use by a cgroup

cgrulesengd:

Start this daemon using below command:

[root@server ~]# systemctl start cgred

This daemon will help to move process to specific cgroup and for that we need to configure /etc/cgrules.conf like below

[root@server ~]# vi /etc/cgrules.conf
# /etc/cgrules.conf
#The format of this file is described in cgrules.conf(5)
#manual page.

@finance  cpu,memory finance
@lbcgroup cpu,memory lbcgroup
@admin    cpu        admin

Like above will assign rules to group.

In this, process will be moved to cgroup based on which user started this process and belongs to which group.

For example, Process detects the limitations from lbcgroup cgroup, which is started by lbcuser1 user and it will move to /cgroup/cpu_and_mem/lbcgroup/tasks file.

cgconfig:

Start this daemon to create hierarchy of cgroup to set the required parameters  in all cgroups.

[root@server ~]# systemctl start cgconfig

and to make all changes persistent across reboot, configure both(cgred, cgconfig) services to be started by default.

[root@server ~]# systemctl enable cgred

[root@server ~]# systemctl enable cgconfig

 

Reference: Red Hat official documentation

How to install Graphical user Interface/GUI on RedHat 7 Linux

In this post going to see How to install Graphical user Interface/GUI on RedHat Linux.

We have 7 run levels in RedHat and in that, runlevel 5 is used for GUI.

Use below command to change from current runlevel to GUI(before changing to graphical mode, make sure GNOME package installed):

[root@server ~]# init 5

To set GUI as default runlevel, use the below command and reboot the machine.

[root@server ~]# systemctl set-default graphical.target

If without any error runlevel switched to GUI, than package is already installed in your machine.

If you are receiving any error, than you should install the GNOME package.

Let’s see how to install the GUI in RedHat 7.

We will use yum package manager to install the GUI.

We have two types of repository that, one is online and another one is local repository.First decide which repository going to use to install GNOME package.

If you’re machine connected with internet, register in redhat repository using below command.

[root@server ~]# subscription-manager register
[root@server ~]# subscription-manager refresh
[root@server ~]# subscription-manager attach --auto

To use local repository make sure its already configured in your machine. Click here to know how to configure local yum repository.

Use the below command to check the group name for GNOME installation.

[root@server ~]# yum grouplist
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use su bscription-manager to register.
There is no installed groups file.
Maybe run: yum groups mark convert (see man yum)
Available Environment Groups:
 Minimal Install
 Infrastructure Server
 File and Print Server
 Basic Web Server
 Virtualization Host
 Server with GUI
Available Groups:
 Compatibility Libraries
 Console Internet Tools
 Development Tools
 Graphical Administration Tools
 Legacy UNIX Compatibility
 Scientific Support
 Security Tools
 Smart Card Support
 System Administration Tools
 System Management
Done

We should install “Server with GUI” using yum like below.

[root@server ~]# yum -y groupinstall "Server with GUI"

Now successfully installed GUI in our machine. Try to switch using “init 5” command.

Thanks for reading this post.

Reference: Red Hat Discussion

Bash shell script to run more commands which is stored in a file

Bash shell script to run more commands which is stored in a file

You might be tired by finding the right Bash shell script to run more commands which are stored in a file. Here is the script which you are searching…

In this example going to use below commands in the file to execute using the script.

df -h

uname -a

ls -l

netstat

As next step, we are going to create a file with above commands assigned to a variable. If we are using this commands directly without assigning to a variable, the script will not execute the commands properly. Because of space(df -h) which we used in between commands will be taken as a separator by the script. So that only we are saving the commands in a variable.

[root@server ~]# cat > cmd.lst
DF=`df -h`
UNAME=`uname -a`
CAT=`cat /etc/resolv.conf`
NET=`netstat` 
^c
[root@server ~]# 

Then create the script to run the commands which are stored in cmd.lst file

[root@server ~]# cat > cmdscritp.sh
#!/bin/bash
sh cmd.lst
for comm in `cat cmd.lst`
do
 for cmd in `cat cmd.lst | awk -F "=" {'print $1'}`
 do
 echo "Going to execute:" $cmd
 eval $cmd
 if [[ $? -eq "0" ]]
 then
 echo $cmd "executed successfully..."
 else
 echo "last command didn't executed properly. So, Exiting from the script..."
 exit
 fi
 done
done

and now provide the execute permission using chmod command for both files.

[root@server ~]# chmod +x cmd.lst
[root@server ~]# chmod +x cmdscritp.sh

[root@server ~]# ll | grep cmd
-rwxr-xr-x. 1 root root 69 Dec 28 23:58 cmd.lst
-rwxr-xr-x. 1 root root 326 Dec 28 23:58 cmdscritp.sh

Now run the script

[root@server ~]# ./cmdscript.sh 
cmd.txt: line 4: netstat: command not found
cmdscript.sh cmd.txt diff2.sh diff.sh lvcheck.txt post pre sh
Goind to execute: df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 10474496 2097740 8376756 21% /
devtmpfs 1887604 0 1887604 0% /dev
tmpfs 1894500 0 1894500 0% /dev/shm
tmpfs 1894500 8444 1886056 1% /run
tmpfs 1894500 0 1894500 0% /sys/fs/cgroup
tmpfs 378900 0 378900 0% /run/user/0
tmpfs 378900 0 378900 0% /run/user/1000
df executed successfully...
Goind to execute: uname
Linux
uname executed successfully...
Goind to execute: ls
cmdscript.sh cmd.txt diff2.sh diff.sh lvcheck.txt post pre sh
ls executed successfully...
Goind to execute: net
./cmdscript.sh: line 8: net: command not found
last command didnt executed properly. So, Exiting from the script...

 

Script working successfully. Thanks for reading the post and support.

No supported authentication methods available

Error:

Disconnected: No supported authentication methods available (server sent: publickey,gssapi-keyex,gssapi-with-mic)

No supported authentication methods available

Receiving error When trying to access Linux server through putty or other tool using ssh service.

Solution:

  1. Edit /etc/ssh/sshd_config configuration file using vi editor.
        [root@server ~]# vi /etc/ssh/sshd_config
  2. Check and replace with yes for below entry
     PasswordAuthentication no

    changed 

    PasswordAuthentication yes
  3. save and exit from the file using :wq
  4. Than restart the ssh service using below command.
    systemctl restart sshd
  5. Restart the network service using below command.
    systemctl restart network
  6. Now try to access the server and sure it will work. Still if you are facing error in accessing the server, that there might be issue with firewall configuration.

Reference: Super user

Permission handling in Linux

In this post we are going to see(Permission handling in Linux) how to set permission for files and directories in linux/unix.

Before set/unset permission we should check the existing permission for a file usinf ll <filename> command like below.

[root@server ~]# ll abu
-rwxrwxrwx. 1 abu root 113 Dec 11 20:22 abu

We can assign permission based on below categories and same has been display while executing ll or ls –l command.

User:    u

Group:  g

Others:  o

Numeric values used for changing/identifying the permissions:

Read:       4, r

Write:      2, w

Execute:  1, x

Command used for changing file permission:

#Chmod 655 <filename>

Example:

Command to set permission:

We are going to set permission for file abu from 777 to 755 using below command. 755 will have full permission for user, read and execute for group and others.

[root@server ~]# chmod 755 abu
[root@server ~]# ll abu
-rwxr-xr-x. 1 abu root 113 Dec 11 20:22 abu

Also will set the permissions usings characters like below.

Read:        r

Write:       w

Execute:  x

Example:

Command to set permission using characters:

In the below example going to set execute permission alone to others

[root@server ~]# ll abu1
-rwxr-xr--. 1 root abu 0 Dec 11 20:17 abu1
[root@server ~]# chmod o+x abu1
[root@server ~]# ll abu1
-rwxr-xr-x. 1 root abu 0 Dec 11 20:17 abu1

Changing ownership of a file or directory:

#Chwon user:group <filename>

example:

In below example going to change owner of the directory as lbcuser for lbc directory. User has been created already.

Note: Existing owner and group will be root.

before changing owhership:

[root@server ~]# mkdir lbc
[root@server ~]# ll | grep lbc
drwxr-xr-x. 2 root root 6 Dec 16 20:33 lbc

after changing ownership:

[root@server ~]# chown lbcuser lbc
[root@server ~]# ll | grep lbc
drwxr-xr-x. 2 lbcuser root 6 Dec 16 20:33 lbc

using chown command will change group as well like below.

Going to change group as finance.

[root@server ~]# chown :finance lbc
[root@server ~]# ll | grep lbc
drwxr-xr-x. 2 lbcuser finance 6 Dec 16 20:33 lbc

Will change the group alone using chgrp command:

[root@server ~]# mkdir lbc1
[root@server ~]# chgrp finance lbc1
[root@server ~]# ll | grep lbc1
drwxr-xr-x. 2 root finance 6 Dec 16 20:47 lbc1

 

Reference: RedHat Document

ACL in RHEL7/Cent OS 7

In this post we are going to securing files and directories using ACL in RHEL7/Cent OS 7.

In this post we are going to see how to secure files and directories using ACL.

As first step need to check kernel compatibility for ACL using below command.

[root@server ~]# grep -i acl /boot/config*
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_GENERIC_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CIFS_ACL=y

Above output will says that this kernel is compatible with ACL access since we could see all are marked as yes POSIX_ACL=y. 

If it is set as N. Than we need to rebuild the kernel.

Next need to install the packages.

Required packages for ACL:

acl

nfs4-acl-tools

libacl

Now install all the above three packages using yum:

Link to see how to configure yum locally click here

[root@server ~]# yum -y install nfs4-acl* acl libacl

Will assign read, write and execute permission to files and directories using ACL and will mention characters ugo/rwx  in commands for permissions respectively.

Now will see a example which will help us to understand clearly.

Create three users and one group respectively like below.

[root@server ~]# useradd lbcuser1
[root@server ~]# useradd lbcuser2
[root@server ~]# useradd lbcuser3
[root@server ~]# groupadd lbcgroup
[root@server ~]# passwd lbcuser1
Changing password for user lbcuser1.
New password:
BAD PASSWORD: The password is a palindrome
Retype new password:
passwd: all authentication tokens updated successfully.

Above screen password has been generated for only lbcuser1.Same like that need to set password for other 2 users.

Now add the lbcgroup group as secondry group for lbcuser1 and lbcuser2 users.

[root@server ~]# usermod -aG lbcgroup lbcuser1
[root@server ~]# usermod -aG lbcgroup lbcuser2

Create a directory and a file inside of that directory to assign and check permissions using acl.

[root@server ~]# mkdir /tmp/data
[root@server ~]# touch /tmp/data/testfile.txt

Now change the group as lbcgroup to the file like below.

[root@server ~]# chown :lbcgroup /tmp/data/testfile.txt
[root@server ~]# ll /tmp/data/testfile.txt
-rw-r--r--. 1 root lbcgroup 0 Dec 15 21:14 /tmp/data/testfile.txt

set the permission 770 using chmod command to the testfile.txt.

Now we can login as lbcuser1 and lbcuser2 and than will try to insert content in testfile.txt.

Sure both users can able to insert content in the file. Because, both users and files group is same(lbcgroup).

[root@server ~]# su lbcuser1
[lbcuser1@server root]$ echo "My name is lbcuser1..." > /tmp/data/testfile.txt
[lbcuser1@server root]$ exit
exit
[root@server ~]# su lbcuser2
[lbcuser2@server root]$ echo "My name is lbcuser2..." > /tmp/data/testfile.txt
[lbcuser2@server root]$ exit
exit
[root@server ~]#

and now will try to insert content as lbcuser3. It will give error. Since, its not the owner and member of lbcgroup for that file.

[root@server ~]# su lbcuser3
[lbcuser3@server root]$ echo "My name is lbcuser3..." > /tmp/data/testfile.txt
bash: /tmp/data/testfile.txt: Permission denied

So, now will provide read and write permission using ACL without adding the lbcuser3 in lbcgroup and will check it again to insert content into the file.

[root@server ~]# setfacl -R -m u:lbcuser3:rw /tmp/data/testfile.txt
[root@server ~]# su lbcuser3
[lbcuser3@server root]$ echo "My name is lbcuser3..." > /tmp/data/testfile.txt
[lbcuser3@server root]$ cat /tmp/data/testfile.txt
My name is lbcuser3...

Since we user single > symbol to redirect the echo command out into the file, its showing our last content which is “My name is lbcuser3…”

To set permission for group will use in above command where we used and groupname where we given username like below.

[root@server ~]# setfacl -R -m g:lbcgroup:rw /tmp/data/testfile.txt

To check the existing ACL permission of a file use getfacl command.

[root@server ~]# getfacl /tmp/data/testfile.txt
getfacl: Removing leading '/' from absolute path names
# file: tmp/data/testfile.txt
# owner: root
# group: lbcgroup
user::rwx
user:lbcuser3:rw-
group::rwx
mask::rwx
other::---

Same like file will set permission to directory as well.

Command to set permission for directory:

below command will help us to set read permission alone for other users which is not owner/group of the directory.

[root@server ~]# setfacl -m d:o:r /tmp/data
[root@server ~]# getfacl /tmp/data
getfacl: Removing leading '/' from absolute path names
# file: tmp/data
# owner: root
# group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::r-x
default:other::r--

 

User/Group disk quota enabling in Linux/Unix

Now we are going to see how to enable User/Group disk quota enabling in Linux/Unix in this post. Sometimes we might have low space in on local disk. To avoid this will allocate disk size to Users/Groups by enabling and configuring quota in /home directory.

As a first step we should enable quota in Filesystem.

by editing and adding usrquota and grpquota in home directory entry at /etc/fstab file will enable quota.

 

[root@server ~]# vi /etc/fstab

# /etc/fstab
# Created by anaconda on Fri Nov 24 17:31:25 2017
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/rhel-root / xfs defaults 0 0
UUID=2f2c635e-e5fb-4c81-823a-855a334ca04c /boot xfs defaults 0 0
/dev/mapper/rhel-swap swap swap defaults 0 0
/dev/rootvg/lv_tmp1 /home xfs defaults,usrquota,grpquota 0 0

save and exit from the file.

Now remount the filesystem using below command.

[root@server ~]# mount -o remount /home

Then check whether the quota has been enabled or not in /home mountpoint.

[root@server ~]# mount | grep /home
 /dev/mapper/rootvg-lv_tmp1 on /home type ext4 (rw,relatime,seclabel,quota,usrquota,grpquota,data=ordered)

Creating database using below command

[root@server ~]# quotacheck -cugv /home

C:     Key to create new quota file

U:     User quota

G:     Group quota

V:     Verbose mode

And now turn on the quota in /home directory using below command

[root@server ~]# quotaon /home

Now will assign quota using edquota command to User/Group

Syntax to create quota on user:

#edquota -u <username>

Syntax to create quota on group:

#edquota -g <groupname>

Will see a example of creating quota on user called abu

[root@server ~]# edquota -u abu

Now the above command will open quota file like below

Disk quotas for user abu (uid 1001):
 Filesystem                 blocks soft hard inodes soft hard
 /dev/mapper/rootvg-lv_tmp1    0   5000 6000   0      0    0

Above data has two quota limits. One is based on blocks and another one based on inode.

For block usage:

Soft:    Soft limit will warn the user if the user exceeds the limit. But, user allowed to write data in home directory till reaching the hard limit. In above example, we have provided 5000KB(nearby 5MB)

hard:    Hard limit will not allow user to write data in home directory once reached hard limit. In above example, we have provided 6000KB(6MB) as hard limit.

Will login and try to create 8MB of file using dd command to check the quota on user.

[root@server ~]# su abu
[abu@server ~]$ dd if=/dev/zero of=bgfile bs=1M count=8
dm-3: warning, user block quota exceeded.
dm-3: write failed, user block limit reached.
dd: error writing ‘bgfile’: Disk quota exceeded
6+0 records in
5+0 records out
6127616 bytes (6.1 MB) copied, 0.00498719 s, 1.2 GB/s

Command to display report on user quota:

[root@server ~]# repquota -as
*** Report for user quotas on device /dev/mapper/rootvg-lv_tmp1
Block grace time: 7days; Inode grace time: 7days
 Space limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 20K 0K 0K 2 0 0
abu +- 6000K 5000K 6000K 6days 6 0 0

Will configure grace period for the user quota. Once grace period has been reached than the soft limit will be come hard limit.

Command to create grace period:

[root@server ~]# edquota -t

Grace period before enforcing soft limits for users:
Time units may be: days, hours, minutes, or seconds
 Filesystem Block grace period Inode grace period
 /dev/mapper/rootvg-lv_tmp1 7days 7days

Grace period also has two types which based on blocks and inodes.

 

Thanks for reading this post.

Directory structure in Linux

We are going to see Directory structure in Linux/ Unix and what was the use of those directories.

Directory structure in Linux

/: Root

Root is a parent directory for all the directories and files.

Each and every directories and files will comes under root only.

Only root user only will do any changes in this directory.

For root user /root is the home directory and for others home directory will comes under /home

/home

All the users home directory will be created under /home to store their files. Ex: /home/user

/boot

This directory contains boot loader information.

Boot loader file contains kernel and initramfs image details.

/bin

Contains all the executable binary files which are

commands which we are using in linux/unix.

/sbin

/sbin also contains binary files like same as /bin.

But, this commands are typically used by system administrator.

/etc

Contains configuration files of all the application/programs used in Linux/Unix.

and startup scripts also stored in this location.

/dev

This directory contains all the device files and drivers as well. Like CD Drive, HDD, USB, tty

/tmp

This directory is for temporary use only. All the temps files and directories stored here  which is created by user or system.

Files will be deleted after reboot of the system.

/opt 

Stands for optional.

This directory contains applications installed which all are separate vendor.

/var

Contains all the variable files and logs and  this can be grow in future based on the usage.

Ex:  /var/log/dmesg, /var/log/secure,etc…

/mnt

This will be used to mount devices temporary purpose.

/usr

This directory contains libraries, variables, binaries. /usr/bin directory contains binary files for user level programs and /usr/sbin contains binary files foe system administrator levels.

 

 

Help command and Data Types in Python

In this post we are going to see Help command and Data Types in Python.

Use help along with command which you want need to know more that command.

Here is the example:

Below command will shows the help about print command.

[root@server ~]# python
Python 2.7.5 (default, Aug 2 2016, 04:20:16)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-4)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> help ('print')

 

Data types:

  1. Numbers
  2. Strings
  3. Lists
  4. Tuple
  5. Dictionary

Numbers:

Three types of numbers data type available in Python.

Integers: 10

Floating point: 2.1, 3.45

Complex numbers: (4+1J), (3.6 – 5.4a).

If..else.. statement in Bash shell scripting

If..else.. statement in Bash shell scripting

We are going to see if statement in bash shell scripting in Linux/UNIX environment.

If statement is playing the most important role in bash shell scripting and other programming languages. Its working based on condition and we can write another if statement inside of an if statement.

Syntax of If statement:

if [ condition..]
then
  < commands...>
else
  < commands... >
fi

Basic if statement says that, if a condition if valid then, it will execute the single/ set of commands which is comes under then will execute and if a condition not valid then, it will execute the single/ set of commands which comes under else. Finally, it will be ended.

We have some operator which is useful in if statement conditions for validation. Below they are.

Operator Description
 =, ==, -eq  This is to check string/numeric value is equal to another string/ numeric value.
 !=,-ne  This is to check string/numeric value is not equal to another string/ numeric value.
 <=, -le  This is to check string/numeric value is less than or equal to another string/ numeric value.
 >=, -ge  This is to check string/numeric value is greater than or equal to another string/ numeric value.
 <, -lt  This is to check string/numeric value is less than to another string/ numeric value.
 >, -gt  This is to check string/numeric value is greater than to another string/ numeric value.

Example:

[root@server ~]# vi newscript.sh

#!/bin/bash
if [[ $1 -gt "100" ]]
then
 echo "Given values is greater than 100.."
else
 echo "Given value is equal to or less than 100..."
fi

Then provide the execute permission to the script using chmod command.

[root@server ~]# chmod +x newscript.sh

Now will run the script by passing a parameter

[root@server ~]# ./newscript.sh 101
Given values is greater than 100..