Red Hat Linux Networking , System Administration (P7) pps

■■ mnt— This directory is the location of the mount point for temporaryfile systems, such as those on floppies or CDs, which traditionally havebeen manually mounted.. ■■ sys— This direct

■■ media— This directory contains the mount points for removablemedia such as floppy drives, CD-ROM drives, and USB devices such asflash memory sticks, which are typically automounted by the system

■■ mnt— This directory is the location of the mount point for temporaryfile systems, such as those on floppies or CDs, which traditionally havebeen manually mounted

■■ opt— This directory and its subdirectories are often used to holdapplications installed on the system

■■ proc— This directory is a mount point for virtual information aboutcurrently running system processes This directory is empty until theproc file system is mounted

■■ root— This is the home directory of the root user Don’t confuse thiswith the / directory, which has the same name

■■ sbin— Contained in this directory are system binaries used by thesystem administrator or the root user

■■ selinux— This directory is similar to the /proc directory in that itcontains information about the selinux stored in the memory of the running kernel

■■ srv— This directory is intended to hold site-specific data for systemprovided services

■■ sys— This directory is the mount point for a virtual file system of typesysfsthat is used to hold information about the system and devices

■■ tmp— This directory contains temporary files used by the system

■■ usr— This directory is often mounted on its own partition It containsshareable, read-only data Subdirectories can be used for applications,typically under /usr/local

■■ var— Subdirectories and files under var contain variable information,such as system logs and print queues

C A U T I O N Never remove the /initrd/ directory The system will not boot, and you will see a kernel panic error message.

Working with Linux-Supported File Systems

Linux is a very flexible operating system that has a long history of ability with other systems on a number of different hardware platforms A

interoper-consequence of this friendliness to other operating systems is that Linux canread and write to several different file systems that originated with other oper-ating systems much different from Linux This section details the different filesystems supported and where they originated.

One reason that Linux supports so many file systems is the design of its tual File Systems (VFS) layer The VFS layer is a data abstraction layer betweenthe kernel and the programs in userspace that issue file system commands

Vir-N OT E Programs that run inside the kernel are in kernelspace Programs that don’t run inside the kernel are in userspace.

The VFS layer avoids duplication of common code between all file systems

It provides a fairly universal backward compatible method for programs toaccess all of the different forms of file support Only one common, small APIset accesses each of the file system types, to simplify programming file systemsupport

Support for these file systems comes standard in Red Hat Enterprise Linux.They are compiled into the kernel by default If for some reason your kerneldoes not currently support these file systems, a kernel recompile with theproper options turned on should enable you to access all these file systems

ext3

The extended 3 file system is a new file system introduced in Red Hat 7.2.ext3provides all the features of ext2, and also features journaling and back-ward compatibility with ext2 The backward compatibility enables you tostill run kernels that are only ext2-aware with ext3 partitions You can alsouse all of the ext2 file system tuning, repair, and recovery tools with ext3

You can upgrade an ext2 file system to an ext3 file system without losingany of your data This upgrade can be done during an update to the operatingsystem

ext3support comes in kernels provided with the latest Fedora and Red Hatdistributions If you download a kernel from somewhere else, you need topatch the kernel to make it ext3 aware, with the kernel patches that come fromthe Red Hat FTP site It is much easier to just stick with kernels from Red Hat

ext3’s journaling feature speeds up the amount of time it takes to bring thefile system back to a sane state if it’s not been cleanly unmounted (that is, in theevent of a power outage or a system crash)

Under ext2, when a file system is uncleanly mounted, the whole file systemmust be checked This takes a long time on large file systems On an ext3 sys-tem, the system keeps a record of uncommitted file transactions and appliesonly those transactions when the system is brought back up So, a complete filesystem check is not required, and the system will come back up much faster

A cleanly unmounted ext3 file system can be mounted and used as anext2file system This capability can come in handy if you need to revert to anolder kernel that is not aware of ext3 The kernel sees the ext3 file system as

an ext2 file system

ext3’s journaling feature involves a small performance hit to maintain thefile system transaction journal Therefore, it’s recommended that you useext3mostly for your larger file systems, where the ext3 journaling perfor-mance hit is made up for in time saved by not having to run fsck on a hugeext2file system

ext2

ext2was the standard file system for Linux until the introduction of ext3.The ext2 implementation has not changed much since it was introduced withthe 1.0 kernel back in 1993 Since then, a few new features have been added.One of these was sparse super blocks, which increase file system performance.ext2was designed to make it easier for new features to be added, so that itcan constantly evolve into a better file system Users can take advantage ofnew features without reformatting their old ext2 file systems ext2 has theadded bonus of being designed to be POSIX-compliant New features that arestill in the development phase are access control lists, undelete, and on-the-flycompression

ext2is flexible, can handle file systems up to 4 TB, and supports long names up to 1012 characters In case user processes fill up a file system, ext2normally reserves about 5 percent of disk blocks for exclusive use by root sothat root can easily recover from that situation Modern Red Hat boot and res-cue diskettes now use ext2 instead of minix

file-reiserfs

The Reiser file system is a journaling file system designed for fast server formance, especially in directories containing thousands of files It is morespace efficient than most other file systems, because it does not take up a min-imum of one block per file If you write a bunch of really small files to disk,reiserfs squeezes them all into one block instead of writing one small file to oneblock like other file systems do reiserfs also does not have fixed space allo-cation for inodes, which saves about 6 percent of your disk space

Linux currently provides read support for SystemV partitions, and write port is experimental The SystemV file system driver currently supportsAFS/EAFS/EFS, Coherent FS, SystemV/386 FS, Version 7 FS, and Xenix filesystems

N OT E Do not confuse a FAT file system with a FAT32 file system They are named similarly but are two different beasts!

NTFS

NTFS is the next generation of HPFS It comes with all versions of Microsoftoperating systems beginning with Windows NT Unlike FAT, it is a b-tree filesystem, meaning it has a performance and reliability advantage, includingjournaling, and support for encryption and compression, over FAT

in the future

SGI XFS

SGI’s Extended File System (XFS) is SGI’s newest file system for all SiliconGraphics systems, from workstations to its supercomputer line (before it soldthat line to Terra computers.) It has been available for use on Linux sinceMay 2001

XFS is designed for high performance It rapidly recovers from systemcrashes and can support extremely large disk farms (it can handle files as large

as a million terabytes.) It is one of a few journaling file systems that have had

a proven track record in production environments for several years now

N OT E Its other features include access control lists, volume management, guaranteed rate I/O, and journaling for faster recovery XFS can be backed up while still in use, which comes in handy since it reduces system administration time This is a fast file system, and now you can read and write to and from it with your Red Hat Linux machine

Nonstandard Linux File Systems

Support for these file systems needs to be explicitly compiled into the Linuxkernel, since kernel support for them is not configured by default

FREEVxFS

VxFS is the Veritas file system developed by the Veritas Corporation It is used

in SCO UnixWare, HP-UX, Solaris, and other systems Some of its featuresinclude access control lists, journaling, online backup, and support for files up

to 2 TB

Three different versions of VxFS are in use Version 1 is the original VxFS,which is not commonly used anymore Version 2 includes support for filesetsand dynamic inode allocation Version 4 is the latest version, and it supportsquotas and large files

GNU utilities available for Linux called VxTools can read VxFS versions 2and 4 The tools included in the VxTools package are vxmount, vxumount,vxls, vxcat, vxidump, vxcd, and vxpwd Currently there is only read sup-port in Linux for VxFS file systems

GFS

GFS is Sistina’s Global File System It is a clustered journaling file system forSANs that enables multiple servers to have read/write access to a single filesystem on shared SAN devices

GFS is scalable, since storage devices and servers can be added without ing the system down or taking the disks offline It also makes a single image ofall the data in the SAN, so that if a server fails it can be removed and replacedwhile the load is rebalanced amongst the remaining servers.

tak-In a proper cluster setup, all nodes in the cluster share the same storagedevices through a fiber channel, SCSI hookup, or network block device Eachnode sees the file system as being local to their machine, and GFS synchronizesfiles across the cluster GFS is fully symmetric, so no server is a bottleneck orsingle point of failure GFS uses regular UNIX-style file semantics

Memory and Virtual File Systems

These file systems do not exist on disk in the same way that traditional file tems do They either exist entirely in system memory or they are virtual,because they are an interface to system devices, for example

sys-cramfs

cramfsis designed to cram a file system onto a small flash memory device, so

it is small, simple, and able to compress things well The largest file size is 16

MB, and the largest file system size is 256 MB

Since cramfs is so compressed, it isn’t instantly updateable The mkcramfstool needs to be run to create or update a cramfs disk image The image is cre-ated by compressing files one page at a time, so this enables random pageaccess The metadata is not compressed, but it has been optimized to take upmuch less space than other file systems For example, only the low 8 bits of theGID are stored This saves space but also presents a potential security issue

tmpfs

tmpfsis structured around the idea that whatever is put in the /tmp file tem is accessed again shortly tmpfs exists solely in memory, so what you put

sys-in /tmp doesn’t persist between reboots

Mounting a special-purpose file system on /tmp as an in-memory file tem is a performance boost but is rarely done in Linux because of the perfor-mance available from the traditional Linux file system But for those who feelthat they need the performance gains from storing /tmp in memory, thisoption is now available in Linux

The romfs file system is created with a program called genromfs.

proc

procis a virtual file system that acts as an interface to the kernel’s internaldata structures proc can be used to get detailed information about a system’shardware and to change kernel parameters at runtime Even the process listingcommand, ps, gets its information from the proc file system The kernel para-meters can be changed with the sysctl command

Proc Software Information

The /proc directory contains a great deal of information about your currentlyrunning system software If you look at the /proc directory on Linux, you seeone subdirectory for each process running on the system The subdirectoriesare named after the process’s ID (PID) number Each of those subdirectories hasseveral standard files, and each of them gives you a different set of information.The status file in those proc directories contains process status in human-readable format So, if you want to see the status of your ssh server, you firstneed to know the ssh server’s PID number You can find this number in a fewdifferent ways One easy way is to look at a process listing and grep for thestring ssh The output should look like the lines shown in Listing 7-1

[terry@main terry]$ ps -elf | grep ssh

140 S root 933 1 0 69 0 - 664 do_sel Oct23 ? 00:00:01 /usr/sbin/sshd

140 S root 14807 933 0 69 0 - 882 do_sel 18:36 ? 00:00:00 /usr/sbin/sshd

000 S vnavrat 14883 14808 0 71 0 - 434 pipe_w 18:52 pts/10 00:00:00 grep ssh

Listing 7-1 Finding the process ID (PID) number.

The process table contains multiple hits for ssh, since there is a master sshdprocess, and one sshd process is spawned for each ssh session currently open.The first line is the master sshd server process You can tell because its parentprocess ID is 1, also known as the init process that spawns all processes at boottime, and is responsible for respawning important server processes that die dur-ing runtime The second line is an ssh daemon handling an incoming ssh con-nection, evident because it lists the previous ssh process as its parent The finalline lists the grep process that you just ran, so you can disregard that line

You should look at the status of the master ssh daemon, which, as you sawpreviously, is running with a PID of 933 So, cd to the /proc/933 directory, andtake a look at the status file in that directory The output appears in Listing 7-2

[terry@main terry]$ less /proc/933/status Name: sshd

State: S (sleeping) Pid: 933

PPid: 1 TracerPid: 0 Uid: 0 0 0 0 Gid: 0 0 0 0 FDSize: 32

Groups:

VmSize: 2656 kB VmLck: 0 kB VmRSS: 1236 kB VmData: 116 kB VmStk: 16 kB VmExe: 240 kB VmLib: 2176 kB SigPnd: 0000000000000000 SigBlk: 0000000000000000 SigIgn: 8000000000001000 SigCgt: 0000000000016005 CapInh: 0000000000000000 CapPrm: 00000000fffffeff CapEff: 00000000fffffeff

Listing 7-2 Viewing the status information of a running process.

Other useful files in the /proc/PID directory and their contents are:

■■ cmdline— Contains the process’s command line arguments

■■ cpu— Contains the current and last CPU on which the process wasexecuted

■■ cwd— Contains a link to the process’s current working directory

■■ environ— Contains values of the process’s environmental variables

■■ exe— Contains a link to the process’s executable

■■ fd— A directory that contains all the process’s file descriptors

■■ maps— Contains memory maps to the process’s executables andlibrary files

■■ mem— Contains the memory held by this process

■■ root— Contains a link to the root directory of the process

■■ stat— Contains the process status

■■ statm— Contains the process memory status information

■■ status— Contains the process status in human-readable format

Proc Hardware Information

As mentioned previously, the /proc directory also contains some useful ware information This information comes in handy when you compile a newkernel If you’ve forgotten the specific details about your hardware, you canlook through the files in the /proc directory to get information about what’sinstalled and running on your Linux machine

hard-If you suspect that you’re having hardware problems due to an interruptrequest (IRQ) conflict, you can also see your hardware’s interrupts by looking

at the /proc/interrupts file

The interrupts file from my desktop machine at work is shown below Eachnumber corresponds to an IRQ The acronyms at the end of the IRQ listing areNMI (Non-Maskable Interrupt), LOC (local interrupt counter of the internalAPIC of each CPU), and ERR ERR is a counter that starts out at 0 at boot timeand is incremented each time there is an error in the IO-APIC bus The IO-APIC bus connects the CPUs in an SMP system When an error happens, theinformation is immediately retransmitted, so you shouldn’t worry toomuch about a moderate number of errors in this field Listing 7-3 shows the/proc/interruptsinformation

[terry@main terry]$ less /proc/interrupts

CPU0 0: 9720704 XT-PIC timer 1: 30515 XT-PIC keyboard 2: 0 XT-PIC cascade 5: 9869566 XT-PIC Crystal audio controller 8: 1 XT-PIC rtc

11: 1233943 XT-PIC usb-uhci, eth0 12: 682220 XT-PIC PS/2 Mouse 14: 77739 XT-PIC ide0 15: 2694731 XT-PIC ide1 NMI: 0

LOC: 9720557 ERR: 0 MIS: 0

Listing 7-3 Viewing the /proc/interrupts information.

In the main /proc directory, quite a few files contain detailed information

on your system hardware The kind of details listed are things such as whathardware it is, the model, and the manufacturer

Listing 7-4 shows the contents of the cpuinfo file in proc This tells youwhat kind of processor you have, and most importantly, how fast it is

[terry@main terry]$ less /proc/cpuinfo processor : 0

vendor_id : AuthenticAMD cpu family : 6

model : 6 model name : AMD Athlon(tm) XP 1800+

stepping : 2 cpu MHz : 1535.822 cache size : 256 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 1

wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov

pat pse36 mmx fxsr sse bogomips : 3022.84

Listing 7-4 Viewing the contents of the /proc/cpuinfo file.

Some important /proc files are:

■■ /proc/cpuinfo— Contains info about the CPU

■■ /proc/interrupts— Tells you what interrupts are in use

■■ /proc/scsi— A directory that contains information about SCSIdevices

■■ /proc/parport— Contains info about the parallel ports on your system

■■ /proc/tty— A directory that contains info about ttys that are able and in use

avail-■■ /proc/acpi— Contains power management information

■■ /proc/bus— A directory that contains bus-specific information

■■ /proc/devices— Lists available character and block devices

■■ /proc/dma— Lists used DMS channels

■■ /proc/filesystems— Lists supported file systems

■■ /proc/fs— A directory that contains file system parameters

■■ /proc/ide— A directory that contains information about the IDEsubsystem

■■ /proc/ioports— Contains information about system I/O port usage

■■ /proc/modules— Contains a list of currently loaded modules

■■ /proc/net— Contains networking information

■■ /proc/uptime— Contains the system uptime

■■ /proc/version— Contains the system version

/dev/pts

/dev/ptsis a lightweight version of devfs Instead of having all the devicefiles supported in the virtual file system, it provides support for only virtualpseudoterminal device files /dev/pts was implemented before devfs

devfs

The Device File System (devfs) is another way to access “real” character andblock special devices on your root file system The old way used major andminor numbers to register devices devfs enables device drivers to registerdevices by name instead devfs is deprecated in the 2.6 kernel in favor of udev

sysfsis a virtual file system that acts as an interface to the kernel’s internaldata structures Information is stored in the /sys directory and can be used toget details about a system’s hardware and to change kernel parameters at run-time Information in the /sys directory is similar to the information provided

in the /proc directory and can be accessed in a similar fashion

Linux Disk Management

This section explains some basics about disk partitioning and disk ment under Linux To see how your Linux disks are currently partitioned andwhat file systems are on them, look at the /etc/fstab file

manage-In Figure 7-2, you can see what a simple /etc/fstab file looks like

T I P To see how your Linux disks are currently partitioned and what file systems are on them, look at the /etc/fstab file You could also use the

fdisk -lcommand to obtain partition information about your disks.

Figure 7-2 The contents of the /etc/fstab file.

Disk Partitioning on an x86 Machine

When disk partitioning on an x86 PC, you need to be mindful of the limitationspresent in the x86 architecture You are allowed to create four primary parti-tions Primary partitions are the only partitions that are bootable You can cre-ate more partitions if you make extended partitions

Extended partitions are set into a primary partition So, if you choose tomake extended partitions, you are allowed to make only three primary parti-tions for operating system use, and the fourth partition is dedicated to hostingthe extended partitions

Mounting Other OS Partitions/Slices

Not only can Linux read other operating systems’ file systems; it can mountdisk drives from other systems and work with their partition tables However,

it is necessary to compile two options into the kernel to do this You must havethe file system support and the file partitioning support turned on in the ker-nel Usually file system support is compiled as a module by default, but diskpartition support usually has to be explicitly compiled

Some common partitioning schemes that Linux supports are x86 partitions,BSD disklabel, Solaris x86, Unixware, Alpha, OSF, SGI, and Sun

Mounting other operating systems’ partitions is helpful if you need to put aSun hard disk into a Linux machine, for example You may need to do this ifthe original Sun system has gone bad, and you need to recover the informationthat was on its disk, or if it’s the target of a forensic computer crime investiga-tion, and you need to copy the disk contents to another machine to preserveevidence This method takes advantage of the fact that copying a large amount

of data is much faster across a SCSI connection than across a network

If you need to copy a large amount of raw disk data across a network, youcan use the Network Block Device, which enables other machines to mount adisk on your machine as if it were on their machine

T I P When running the Network Block Device, make sure that you have the appropriate partition support compiled into the kernel For more information about NBD refer to it.uc3m.es/~ptb/nbd.

Metadevices

Virtual block devices that are made up of other block devices are referred to inthis book as a metadevice An example of a metadevice is a disk array thatmakes many disks look like one large disk When a disk that’s mounted as a

regular block device dies, then the data on it becomes unavailable If a diskdies in a metadevice, the metadevice is still up As long as the criteria are metfor the minimum number of working devices in the metadevice, the metade-vice still functions.

Logical Volumes

Logical Volume Manager (LVM) enables you to be much more flexible withyour disk usage than you can be with conventional old-style file partitions.Normally if you create a partition, you have to keep the partition at that sizeindefinitely

For example, if your system logs have grown immensely, and you’ve runout of room on your /var partition, increasing a partition size without LVM is

a big pain You would have to get another disk drive, create a /var mountpoint on there too, and copy all your data from the old /var to the new /vardisk location With LVM in place, you could add another disk, create a physi-cal volume, and then add the physical volume to the volume group that con-tains the /var partition Then you’d use the LVM file system resizing tool toincrease the file system size to match the new partition size

Normally, you might think of disk drives as independent entities, each taining some data space When you use LVMs, you need a new way of thinkingabout disk space First, you have to understand that space on any disk can beused by any file system A Volume Group is the term used to describe variousdisk spaces (either whole disks or parts of disks) that have been groupedtogether into one volume

con-The way it works is like this First you need to have a physical volumewhich is then divided into Volume groups that are then combined to form log-ical volumes Logical volumes are akin to the historic idea of partitions Youcan then use a file system creation tool such as fdisk to create a file system onthe logical volume The Linux kernel sees a logical volume in the same way itsees a regular partition

N OT E When the system is installed, LVM is enabled by default and you will need to use the LVM tools described here to make changes to your logical volumes You can, if you desire, choose not to use logical volumes during the system installation.

In Fedora Core and Enterprise Linux, LVM has been updated to LVM2 Thebasic syntax for using the lvm command is:

lvm <command> file

There are many commands available when using LVM You can obtain acomplete listing of the commands by entering lvm help at a commandprompt You will see the list shown in Listing 7-5.

dumpconfig Dump active configuration formats List available metadata formats help Display help for commands lvchange Change the attributes of logical volume(s) lvcreate Create a logical volume

lvdisplay Display information about a logical volume lvextend Add space to a logical volume

lvmdiskscan List devices that may be used as physical volumes lvmsadc Collect activity data

lvmsar Create activity report lvreduce Reduce the size of a logical volume lvremove Remove logical volume(s) from the system lvrename Rename a logical volume

lvresize Resize a logical volume lvs Display information about logical volumes lvscan List all logical volumes in all volume groups pvchange Change attributes of physical volume(s) pvcreate Initialize physical volume(s) for use by LVM pvdata Display the on-disk metadata for physical volume(s) pvdisplay Display various attributes of physical volume(s) pvmove Move extents from one physical volume to another pvremove Remove LVM label(s) from physical volume(s) pvresize Resize a physical volume in use by a volume group pvs Display information about physical volumes pvscan List all physical volumes

segtypes List available segment types vgcfgbackup Backup volume group configuration(s) vgcfgrestore Restore volume group configuration vgchange Change volume group attributes vgck Check the consistency of volume group(s) vgconvert Change volume group metadata format vgcreate Create a volume group

vgdisplay Display volume group information vgexport Unregister volume group(s) from the system vgextend Add physical volumes to a volume group vgimport Register exported volume group with system vgmerge Merge volume groups

vgmknodes Create special volume group file devices in /dev vgreduce Remove physical volume(s) from a volume group vgremove Remove volume group(s)

vgrename Rename a volume group vgs Display information about volume groups vgscan Search for all volume groups

vgsplit Move physical volumes into a new volume group version Display software and driver version information

Listing 7-5 Output from the lvm help command