PSEiBlog » PHP http://www.pseiko.nl/blog Lalalala… uh… huh??? Fri, 07 May 2010 14:02:27 +0000 http://wordpress.org/?v=abc en hourly 1 Automatically remove duplicate IP’s in Iptables http://www.pseiko.nl/blog/375/automatically-remove-duplicate-ips-in-iptables http://www.pseiko.nl/blog/375/automatically-remove-duplicate-ips-in-iptables#comments Wed, 09 Dec 2009 15:01:58 +0000 Remco http://www.pseiko.nl/blog/?p=375 Many scripts like my Persistent Iptables bans from Fail2Ban script add a bunch of DROP statements to Iptables chains.

I noticed that quite a lot of people ask questions on mailing lists and forums requesting a method to automatically remove any duplicate IP’s that might exist within a given chain.

Well, that’s quite easy to accomplish really, just run this little PHP script I created as root, and your Iptables is once again clean as a whistle!

/**
 * Configuration
 */
$chain = "Blocklist";
$safelist = array("x.x.x.x"
                 ,"y.y.y.y"
                 ,"z.z.z.z");
 
$data = shell_exec('iptables -S '.$chain);
$iparr = explode(' ',$data);
$j = 0;
$ref = array();
for($i=0;$i<sizeof($iparr);$i++) {
        if(substr_count($iparr[$i],".")==3) {
                $ref[$j] = $iparr[$i];
                $j++;
        }
}
sort($ref);
 
for($i=0;$i<sizeof($ref);$i++) {
        $ip = $ref[$i];
        $ref[$i] = "";
        if(stristr($ip,"0.0.0.0")) $ip="";
        if(strlen($ip)>2 && !in_array($ip,$safelist) && in_array($ip,$ref)) {
                echo "Duplicate IP found: $ip\r\n";
                while(in_array($ip,$ref)) {
                        shell_exec('iptables -D '.$chain.' -s '.$ip.' -j DROP');
                        $ref[array_search($ip,$ref)] = "";
                }
        }
 
}
]]> http://www.pseiko.nl/blog/375/automatically-remove-duplicate-ips-in-iptables/feed 0 Munin plugins for Dell IPMI fan speeds and temperatures http://www.pseiko.nl/blog/349/munin-plugins-for-dell-ipmi-fan-speeds-and-temperatures http://www.pseiko.nl/blog/349/munin-plugins-for-dell-ipmi-fan-speeds-and-temperatures#comments Tue, 20 Oct 2009 15:22:26 +0000 Remco http://www.pseiko.nl/blog/?p=349 It is possible to monitor fan speeds and temperatures on Dell Poweredge servers under Linux. You can achieve this by reading out the IPMI data that is available on the system.
I used the steps on this website to buffer the data gathered by IPMI to use in Cacti.

However, in addition to Cacti I also use Munin to monitor various system parameters. Wouldn’t it be nice to incorporate graphs for fan speeds and temperatures in Munin? I thought so, so I developed a way to do this.

In this case the solution consists out of 2 munin plugins and a PHP script that formats the IPMI values for graphing use. This could also be done directly in the plugins, but since I’m not such an awk and sed expert I chose to let a PHP script handle the transformation, so I’d be done sooner (time is money my friends!).

First up, the PHP script:

/usr/bin/ipmi.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#!/usr/bin/php
<?php
$handle = fopen("/dev/shm/dell.ipmi","r");
while(!feof($handle)) {
  $line = fgets($handle);
  if(preg_match("/AmbientTemp/",$line)) echo "tambi.value ".fgets($handle);
  if(preg_match("/CPU1Temp/",$line)) echo "tcpu1.value ".fgets($handle);
  if(preg_match("/CPU2Temp/",$line)) echo "tcpu2.value ".fgets($handle);
  if(preg_match("/Fan1/",$line)) echo "fan1.value ".fgets($handle);
  if(preg_match("/Fan2/",$line)) echo "fan2.value ".fgets($handle);
  if(preg_match("/Fan3/",$line)) echo "fan3.value ".fgets($handle);
  if(preg_match("/Fan4/",$line)) echo "fan4.value ".fgets($handle);
  if(preg_match("/Fan5/",$line)) echo "fan5.value ".fgets($handle);
  if(preg_match("/Fan6/",$line)) echo "fan6.value ".fgets($handle);
  if(preg_match("/PlanarTemp/",$line)) echo "tplan.value ".fgets($handle);
  if(preg_match("/RiserTemp/",$line)) echo "trise.value ".fgets($handle);
}
fclose($handle);
?>

With the SHM values now being prefixed with matching Munin values, we can graph them in 2 plugins:

/etc/munin/plugins/ipmitemps

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#!/bin/sh
 
if [ "$1" = "autoconf" ]; then
        if [ -r /dev/shm/dell.ipmi ]; then
                echo yes
                exit 0
        else
                echo no
                exit 1
        fi
fi
 
if [ "$1" = "config" ]; then
 
        echo 'graph_title Dell 2850 IPMI Temperatures'
        echo 'graph_order tcpu1 tcpu2 tambi tplan trise'
        echo 'graph_vlabel Temperature (Deg C)'
        echo 'graph_scale yes'
        echo 'graph_info This graph shows sensor temperatures'
        echo 'graph_category system'
        echo 'tcpu1.label CPU1'
        echo 'tcpu1.warning 80'
        echo 'tcpu1.critical 90'
        echo 'tcpu1.info XEON CPU 1 Temperature'
        echo 'tcpu2.label CPU2'
        echo 'tcpu2.warning 80'
        echo 'tcpu2.critical 90'
        echo 'tcpu2.info XEON CPU 2 Temperature'
        echo 'tambi.label Ambient'
        echo 'tambi.warning 80'
        echo 'tambi.critical 90'
        echo 'tambi.info Ambient Temperature'
        echo 'tplan.label Planar'
        echo 'tplan.warning 80'
        echo 'tplan.critical 90'
        echo 'tplan.info Planar Temperature'
        echo 'trise.label Riser'
        echo 'trise.warning 80'
        echo 'trise.critical 90'
        echo 'trise.info Riser Temperature'
        exit 0
fi
/usr/bin/ipmi.php

and

/etc/munin/plugins/ipmifans

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/bin/sh
 
if [ "$1" = "autoconf" ]; then
        if [ -r /dev/shm/dell.ipmi ]; then
                echo yes
                exit 0
        else
                echo no
                exit 1
        fi
fi
 
if [ "$1" = "config" ]; then
 
        echo 'graph_title Dell 2850 IPMI Fanspeeds'
        echo 'graph_order fan1 fan2 fan3 fan4 fan5 fan6'
        echo 'graph_vlabel Fanspeed (RPM)'
        echo 'graph_scale yes'
        echo 'graph_info This graph shows fanspeeds'
        echo 'graph_category system'
        echo 'fan1.label Fan1'
        echo 'fan1.info Fan1 speed'
        echo 'fan2.label Fan2'
        echo 'fan2.info Fan2 speed'
        echo 'fan3.label Fan3'
        echo 'fan3.info Fan3 speed'
        echo 'fan4.label Fan4'
        echo 'fan4.info Fan4 speed'
        echo 'fan5.label Fan5'
        echo 'fan5.info Fan5 speed'
        echo 'fan6.label Fan6'
        echo 'fan6.info Fan6 speed'
        exit 0
fi
/usr/bin/ipmi.php

restart your munin-node, run the munin crons, and voila, graphs!
With these settings they will look like this:

Dell IPMI Temperatures

Dell IPMI Temperatures

Dell IPMI Fan Speeds

Dell IPMI Fan Speeds

You can modify the params to change the graphs ofcourse.

]]> http://www.pseiko.nl/blog/349/munin-plugins-for-dell-ipmi-fan-speeds-and-temperatures/feed 0 Persistent Iptables bans from Fail2Ban http://www.pseiko.nl/blog/288/persistent-iptables-bans-from-fail2ban http://www.pseiko.nl/blog/288/persistent-iptables-bans-from-fail2ban#comments Tue, 18 Aug 2009 13:53:23 +0000 Remco http://www.pseiko.nl/blog/?p=288 On my servers I use the nifty program Fail2Ban to perform logbased automatic fire walling of ‘bad’ ip’s.

The idea behind this is easy: Some IP performs an action I don’t approve of. This can be any number of things, e.g. requesting pages in Apache that are commonly accessed by bots and/or scanners, or trying to log in to SSH with accounts that do not exist on the system. This bad behavior gets logged, and Fail2Ban keeps tabs on those logs, and using a number of rules it determines if a host is ‘bad’ enough to temporarily or permanently ban all access to the server. It does so by adding a few chains to Iptables (one for each thing it checks for), and dynamically adding/removing IP’s to/from these chains.

This all works perfectly. However, there’s one issue; When Iptables gets reloaded, it restores its default rules, removing the Fail2Ban chains and all the rules they contain, even if the ip’s in the chain were marked as permanent.

I created a workaround for this problem, consisting of two simple steps:
- When a ‘bad’ ip gets banned, it’s added to the Iptables chain, but also written to a file, containing all collected ‘bad’ ip’s. (I use /etc/shitlist for this purpose).
- Whenever Iptables gets reloaded, I run a PHP script that checks the /etc/shitlist file for ’safe’ and duplicate ip’s, and writes all other ip’s to the permanent Blocklist chain. (The checking for ’safe’ ip’s might be a bit unneeded, but with my Fail2Ban rules it’s possible that one of my own ip’s gets banned for 10 minutes if a SSH login attempt fails for 5 times. Though it’s a temporary ban, the ip will still get written to the shitlist, and would end up in the permanent Blocklist).

To make this work, I made the following changes:

Every ‘jail’ in Fail2Ban uses an ‘action.d’ script to perform (un)banning. I defaulted all actions to an action script called ‘iptables-allports.conf’. Basically this action drops everything in Iptables if a package originates from the ‘bad’ IP.
I updated the ban action such that:

1
2

actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
                 echo <ip> >> /etc/shitlist

After that I created a PHP script that updates Iptables with the ip’s contained in the shitlist:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

<?php
/** script that loads a shitlist file into iptables
*/
 
//CONFIG
$shitlists = array("/root/list.txt","/etc/shitlist");
$chain = "Blocklist";
$safelist = array("x.x.x.x"
                 ,"y.y.y.y"
                 ,"z.z.z.z");
echo "Reading current IPTABLES state\r\n";
$data = shell_exec('iptables -S '.$chain);
$iparr = explode(' ',$data);
$j = 0;
$ref = array();
for($i=0;$i<sizeof($iparr);$i++) {
        if(substr_count($iparr[$i],".")==3) {
                        $ref[$j] = $iparr[$i];
                        $j++;
        }
}
sort($ref);
$total = 0;
foreach($shitlists as $shitlist) {
        echo "Reading shitlist at $shitlist\r\n";
        //READ FILE
        $fh = fopen($shitlist,'r');
        if($fh) {
                $itt = 0;
                $iparr = array();
                while(!feof($fh)) {
                        $ip = trim(fgets($fh));
                        if(strlen($ip)>6) {
                                if(array_search($ip,$iparr)===false&&array_search($ip,$safelist)===false&&array_search($ip."/32",$ref)===false) {
                                        $iparr[] = $ip;
                                        echo "Now adding $ip to $chain\r\n";
                                        $ins = 18+$itt;
                                        shell_exec("iptables -I ".$chain." ".$ins." -s ".$ip."/32 -j DROP");
                                        $itt++;
                                }
                        }
                }
                fclose($fh);
        echo "Finished adding $itt ip's from list $shitlist to chain $chain . Bye!\r\n";
        $total = $total + $itt;
 
        } else {
                echo "Could not open shitlist file $shitlist . Skipping this list\r\n";
        }
}
echo "Finished adding $total ip's to chain $chain from ".sizeof($shitlists)." shitlists.\r\n";
?>

You can run the script from the commandline (as root!) simply by stating “php shitlist.php”, or add it to the startup script of your Iptables installation.

Hope this helps keeping your NIC’s available for VALID traffic!

Update: Made some changes to the script to check for already existing bans, to keep your chains clean!
Update 2: Little tweak to the script so it now loads an array of lists, in case you have various sources.

]]> http://www.pseiko.nl/blog/288/persistent-iptables-bans-from-fail2ban/feed 1 PRNG test using PHP http://www.pseiko.nl/blog/154/prng-test-using-php http://www.pseiko.nl/blog/154/prng-test-using-php#comments Tue, 26 May 2009 11:54:40 +0000 Remco http://www.pseiko.nl/blog/?p=154 Every programmer uses them.. PRNG’s, better known as pseido-random number generators, in PHP represented by the rand(min,max) function.
Unlike true random number generators (TRNG’s) that use true random data like atmospheric noise to create their numbers, PRNG’s rely on software algorithms to come up with seemingly random numbers.. but are they? And is there a difference between Linux and Windows PRNG results?

I decided to give it a little try, and came up with the following, very simple but yet quite test:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

<?php
//init
$h = 500;
$w = 1000;
$colors = hexdec("FFFFFF");
$col = $colors/10;
$img = imagecreatetruecolor($w,$h);
$nul = 0;
$een = 0;
$twee = 0;
$drie = 0;
$vier = 0;
$vijf = 0;
$zes = 0;
$zeven = 0;
$acht = 0;
$negen = 0;
$tien = 0;
$tp = 0;
 
 
//cols
for($i=0;$i<$h;$i++) {
	//rows
	for($j=0;$j<$w;$j++) {
		$k = rand(0,10);
		imagesetpixel($img,$j,$i,($col*$k));
		$tp++;
		switch($k) {
			case(0): $nul++; break;
			case(1): $een++; break;
			case(2): $twee++; break;
			case(3): $drie++; break;
			case(4): $vier++; break;
			case(5): $vijf++; break;
			case(6): $zes++; break;
			case(7): $zeven++; break;
			case(8): $acht++; break;
			case(9): $negen++; break;
			case(10): $tien++; break;
		}
	}
}
$bl = imagecolorallocate($img,0,0,0);
$or = imagecolorallocate($img,220,210,60);
imagefilledrectangle($img,5,5,150,230,$bl);
imagestring($img,3,10,10,"Nul: $nul (".round(($nul/($tp/100)),2)."%)",$or);
imagestring($img,3,10,30,"Een: $een (".round(($een/($tp/100)),2)."%)",$or);
imagestring($img,3,10,50,"Twee: $twee (".round(($twee/($tp/100)),2)."%)",$or);
imagestring($img,3,10,70,"Drie: $drie (".round(($drie/($tp/100)),2)."%)",$or);
imagestring($img,3,10,90,"Vier: $vier (".round(($vier/($tp/100)),2)."%)",$or);
imagestring($img,3,10,110,"Vijf: $vijf (".round(($vijf/($tp/100)),2)."%)",$or);
imagestring($img,3,10,130,"Zes: $zes (".round(($zes/($tp/100)),2)."%)",$or);
imagestring($img,3,10,150,"Zeven: $zeven (".round(($zeven/($tp/100)),2)."%)",$or);
imagestring($img,3,10,170,"Acht: $acht (".round(($acht/($tp/100)),2)."%)",$or);
imagestring($img,3,10,190,"Negen: $negen (".round(($negen/($tp/100)),2)."%)",$or);
imagestring($img,3,10,210,"Tien: $tien (".round(($tien/($tp/100)),2)."%)",$or);
header("Content-type: image/png");
imagepng($img);
imagedestroy($img);
?>

Running this script will result in a noisy image, which when everything goes well, should be patternless (otherwise the results wouldn’t be as random as they should be!). For convenience I added a few counters, to display the spread of the numbers.

PRNG Test

In my test results on both Windows and Linux, the results came up about equal each time:
There are no patterns in the images, significantly decreasing the chance of predicting the next number the PRNG will produce. (Which is important for various obvious matters).
Though there are no visible patterns, the number spread seems to be about equal each run.. 9% for each of the 11 possibilities..

I have my doubts about the randomness of such an equal spread.. but I’m not drawing any conclusions just yet.. perhaps when I feel like investigating this further ;-)

]]> http://www.pseiko.nl/blog/154/prng-test-using-php/feed 1 Annoyance while setting up horde-imp on Gentoo http://www.pseiko.nl/blog/114/annoyance-while-setting-up-horde-imp-on-gentoo http://www.pseiko.nl/blog/114/annoyance-while-setting-up-horde-imp-on-gentoo#comments Thu, 07 May 2009 13:49:12 +0000 Remco http://www.pseiko.nl/blog/?p=114 While configuring your MTA and additional services on a Gentoo machine, you are likely to follow the handbook at http://www.gentoo.org/doc/en/qmail-howto.xml .
Though this guide is pretty good, at one point you will encounter a rather large annoyance.
Once you’re ready to set up webmail, by means of horde imp, it seems the only thing you have to do is
emerge horde-imp what should do the trick.
Usually this is true, except for the fact that imp heavily relies on a load of PEAR modules. These PEAR modules will be merged prior to merging imp, and this is where all goes to hell.
You probably had PHP preinstalled on the system, and each PEAR module (there’s about 25 of them for imp) will try to use your premerged PHP installation. If you used a default PHP merge, nearly every single one of them will break, because PHP was compiled without a USE flag that the module needs.
So you’ll find yourself adding the USE flag to your /etc/make.conf, re-emering php, and trying to re-emerge horde-imp afterwards, which results in the module installing, and the process breaking on the next module once more, forcing you to repeat the process. This can take you quite a while, since PHP isn’t quite the smallest package and even on a quite powerful server it takes nearly 10 minutes each run.

So.. how can you avoid a solid 3 hour emerge stint? By learning from my trial-and-error-process, and adding all of the needed USE flags to your /etc/make.conf:
pam tcpd ssl mysql apache2 cli pcre xml zlib ftp ctype pcre session imap
afterwards emerge php and emerge horde-imp and you’re good to go.

]]> http://www.pseiko.nl/blog/114/annoyance-while-setting-up-horde-imp-on-gentoo/feed 0