UFW簡易設定

#開啟
ufw disable
ufw default deny
ufw logging OFF
ufw enable
ufw allow 22/tcp
ufw allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 3260
ufw allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 20000
ufw allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 139
ufw allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 445
ufw allow proto udp from 192.168.1.0/24 to 192.168.1.117 port 137
ufw allow proto udp from 192.168.1.0/24 to 192.168.1.117 port 138


#關閉/刪除 條件
ufw delete allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 3260
ufw delete allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 20000
ufw delete allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 139
ufw delete allow proto tcp from 192.168.1.0/24 to 192.168.1.117 port 445
ufw delete allow proto udp from 192.168.1.0/24 to 192.168.1.117 port 137
ufw delete allow proto udp from 192.168.1.0/24 to 192.168.1.117 port 138

Bonding in Ubuntu

How to Set up Network Bonding in Ubuntu 6.10
Why you may want to do this:
Network Bonding, otherwise known as port trunking allows you to combine multiple network ports into a single group, effectively aggregating the bandwidth of multiple interfaces into a single connection. For example, you can aggregate two gigabyte ports into a two-gigabyte trunk port. Bonding is used primarily to provide network load balancing and fault tolerance. First, we will run two different network tools to check for network connectivity and capability. Run mii-tool to check your interfaces for connectivity:

mii-tool

For our purposes, we will assume you have three interfaces. The result of the mii-tool command is listed below:

eth0: negotiated 100baseTx-HD, link ok
eth1: negotiated 100baseTx-HD, link ok
eth2: negotiated 100baseTx-HD, link ok

Next run ethtool for each interface to check to see what capabilities:

ethtool eth0 && ethtool eth1 && ethtool eth3

The result of the ethtool command is listed below:

Settings for eth0:
Supported ports: [ TP MII ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
Advertised auto-negotiation: Yes
Speed: 100Mb/s
Duplex: Half
Port: MII
PHYAD: 1
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: g
Wake-on: g
Current message level: 0x00000007 (7)
Link detected: yes

Settings for eth1:
Supported ports: [ TP ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised auto-negotiation: Yes
Speed: Unknown! (65535)
Duplex: Unknown! (255)
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: umbg
Wake-on: d
Current message level: 0x00000007 (7)
Link detected: no

Settings for eth3:
Supported ports: [ TP ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised auto-negotiation: Yes
Speed: Unknown! (65535)
Duplex: Unknown! (255)
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: umbg
Wake-on: d
Current message level: 0x00000007 (7)
Link detected: no

Next, we need to install ifenslave. It’s a simple install:

apt-get update && apt-get install ifenslave

Options for mode types:
You can set up your bond interface according to your needs. In order to do this, you simply change the mode type depicted in the examples below (mode=X). There are seven mode types available. They are as follows:

mode=0

This mode uses the Round-robin policy: Transmit packets in sequential order from the first available slave through the last. This mode provides load balancing and fault tolerance.

mode=1

This mode uses an Active-backup policy: Only one slave in the bond is active. A different slave becomes active if, and only if, the active slave fails. The bond's MAC address is externally visible on only one port (network adapter) to avoid confusing the switch. This mode provides fault tolerance. The primary option affects the behavior of this mode.

mode=2

Transmit based on [(source MAC address XOR'd with destination MAC address) modulo slave count]. This selects the same slave for each destination MAC address. This mode provides load balancing and fault tolerance.

mode=3

Broadcast policy: transmits everything on all slave interfaces. This mode provides fault tolerance.

mode=4

IEEE 802.3ad Dynamic link aggregation. Creates aggregation groups that share the same speed and duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification.

*Pre-requisites:

1. Ethtool support in the base drivers for retrieving the speed and duplex of each slave.

2. A switch that supports IEEE 802.3ad Dynamic link aggregation. Most switches will require some type of configuration to enable 802.3ad mode

mode=5

Adaptive transmit load balancing: channel bonding that does not require any special switch support. The outgoing traffic is distributed according to the current load (computed relative to the speed) on each slave. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed receiving slave.

*Prerequisite: Ethtool support in the base drivers for retrieving the speed of each slave.

mode=6

Adaptive load balancing: includes balance-transmit load balancing plus receive load balancing for IPV4 traffic, and does not require any special switch support. The receive load balancing is achieved by ARP negotiation. The bonding driver intercepts the ARP Replies sent by the local system on their way out and overwrites the source hardware address with the unique hardware address of one of the slaves in the bond such that different peers use different hardware addresses for the server.

Now append the following items to your aliases file:

pico /etc/modprob.d/aliases

# Append to the bottom of this file:
alias bond0 bonding
alias eth0 e100
alias eth1 e100
alias eth2 e100
options bonding mode=0 miimon=100

Next, append the following items to your i386 file:

pico /etc/modprob.d/arch/i386

# Append to the bottom of this file:
alias bond0 bonding
options bonding mode=0 miimon=100 downdelay=200 updelay=200

Now we have to modify the interface file. Start off by commenting out any information on the physical interfaces, eth0, eth1, etc, and create a virtual interface such as bond0, configure it similar to below, and be sure to choose a unique hwaddress. Be sure to leave the loopback interface configuration intact.

pico /etc/network/interfaces

It should look something like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
#auto eth0
#iface eth0 inet static
# address 192.168.0.120
# netmask 255.255.255.0
# network 192.168.0.0
# broadcast 192.168.0.255
# gateway 192.168.0.1
auto bond0
iface bond0 inet static
address 192.168.0.120
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
hwaddress ether 00:03:B3:48:50:2C
post-up ifenslave bond0 eth0 eth1

Save the file and then reboot the system:

shutdown -r now

BASH測試條件

VariableName?=VariableValue? ，指定變數。使用 $VariableName? 來取用變數。
使用 \$$VariableName? 來 在變數前加上 $。
可使用 export VariableName?1 VariableName?2 來當作其它的程式的參數使用。
VariableName?=$Command，指定變數為 Command 執行後的結果。

使用 $0 取得執行的指令名稱 。
使用 $1 取得第一個參數，其餘依此類推。
使用 $# 取得參數的總數。
使用 $? 取得上一個指令的傳回值。
使用 $* 或是 $@ 來得到所有的參數，中間以空白隔開。
使用 $Environment 來 取得環境變數。
read VariableName? ， 讓使用者輸入變數的內容。
　
條件測試：

test Expression
echo $?（1 為假，0 為真。和一般的 C 習慣相反。）
　
[Expression]
echo $?
Expression 的類型：

字串運算式，不得使用萬用字元。
String1 = String2 ：如果 String1 和 String2 一樣，則回傳值為真。
String1 == String2 ：如果 String1 和 String2 一樣，則回傳值為真。
String1 != String2 ：如果 String1 和 String2 不一樣，則回傳值為真。
String ：如果 String 不是 Null，則回傳值為真。
-n String ：如果 String 的長度大於 0，則回傳值為真。
-z String ：如果 String 的長度等於 0，則回傳值為真。
數值運算式
integer1 -eq integer2 ：如果 integer1 等於 integer2 ，則回傳值為真。
integer1 -ge integer2 ：如果 integer1 大於等於 integer2 ，則回傳值為真。
integer1 -gt integer2 ：如果 integer1 大於 integer2 ，則回傳值為真。
integer1 -le integer2 ：如果 integer1 小於等於 integer2 ，則回傳值為真。
integer1 -lt integer2 ：如果 integer1 小於 integer2 ，則回傳值為真。
integer1 -ne integer2 ：如果 integer1 不等於 integer2 ，則回傳值為真。
檔案運算式
-d FileName? ：若 FileName? 存在，並且為目錄，則回傳值為真。
-f FileName? ：若 FileName? 存在，並且為一般檔案，則回傳值為真。
-s FileName? ：若 FileName? 存在，並且的長度大於 0，則回傳值為真。
-r FileName? ：若 FileName? 存在，並且可讀取，則回傳值為真。
-w FileName? ：若 FileName? 存在，並且可寫入，則回傳值為真。
-x FileName? ：若 FileName? 存在，並且可執行，則回傳值為真。
-b FileName? ：若 FileName? 存在，並且為 block，則回傳值為真。
-c FileName? ：若 FileName? 存在，並且為 character，則回傳值為真。
-e FileName? ：若 FileName? 存在，則回傳值為真。
-g FileName? ：若 FileName? 存在，並且為 set-group-id，則回傳值為真。
-k FileName? ：若 FileName? 存在，並且設定了 sticky 字元，則回傳值為真。
-L FileName? ：若 FileName? 存在，並且為連結檔，則回傳值為真。
-p FileName? ：若 FileName? 存在，並且為 named pipe (FIFO)，則回傳值為真。
-S FileName? ：若 FileName? 存在，並且為 socket，則回傳值為真。
-u FileName? ：若 FileName? 存在，並且為 set-user-id，則回傳值為真。
邏輯運算式
! Expression ：如果 Expression 的結果值為假，則回傳值為真。
Expression1 -a Expression1 ：將 Expression1 和Expression2 的結果值做And 運算。
Expression1 -o Expression1 ：將 Expression1 和Expression2 的結果值做Or 運算。

MDADM-raid指令

#停止磁碟陣列
mdadm --manage --stop /dev/md0

#啟動磁碟陣列
mdadm --assemble --run /dev/md0

#查看RAID狀態
# mdadm --detail /dev/md0

#建立RAID5
mdadm --create /dev/md1 --level=raid5 --raid-devices=5 --chunk=4 /dev/sd{b,c,d,e,f}1
mdadm --create /dev/md1 --level=raid5 --raid-devices=5 --chunk=4 /dev/sd{g,h,i,j,k}1

#建立 RAID0
mdadm --create /dev/md0 --level=raid0 --raid-devices=3 /dev/sda4 /dev/sdb1 /dev/sdc1
mdadm --create /dev/md0 --level=raid0 --raid-devices=5 /dev/sda1 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde3

#RAID的配置文件
/etc/mdadm.conf 的文件主要提供我們方便管理,編輯這個文件可以讓RAID更好的為我們工作,當然這個步驟不是必要的.不經過編輯配置文件也可以讓RAID工作。
首先掃描系統中的全部陣列

# mdadm --detail -scan

ARRAY /dev/md0 level=raid5 num-devices=3 UUID=37230e69:51bcf476:9889f244:18b07644
devices=/dev/sda,/dev/sdb,/dev/sdd,/dev/sdc
# vi /etc/mdadm.conf
-------------------------------------------------------------------------------------------------------
DEVICE /dev/sdb1 /dev/sdc1 /dev/sdd1
ARRAY /dev/md0 level=raid5 num-devices=3 UUID=37230e69:51bcf476:9889f244:18b07644
devices=/dev/sda,/dev/sdb,/dev/sdd,/dev/sdc
-------------------------------------------------------------------------------------------------------
其中的資料就如同 mdadm --detail -scan 一樣定義了RAID基本資料.
如果你不想手動設定用下面的指令同樣也可以.
mdadm --detail -scan >> /etc/mdadm.conf

#RAID的管理
mdadm /dev/md0 --add /dev/sdd1
mdadm /dev/md0 --fail /dev/sdc1
mdadm /dev/md0 --remove /dev/sdc1
mdadm --manage --run /dev/md0 重建指令 !!小心使用!!

#spare-group

#Multipath
mdadm -C /dev/md0 --level=multipath --raid-devices=2 /dev/sda1 /dev/sdb1


ARRAY /dev/md0 level=raid5 num-devices=5 metadata=00.90 spares=1 UUID=90dcc677:e6ef7c62:9baf8322:4f9d823d
ARRAY /dev/md1 level=raid5 num-devices=5 metadata=00.90 spares=1 UUID=981e1b70:736d1fb5:9baf8322:4f9d823d

VBOX222-ubuntu安裝流程說明

#下載VBOX
# http://www.virtualbox.org/wiki/Linux_Downloads
http://download.virtualbox.org/virtualbox/2.2.2/virtualbox-2.2_2.2.2-46594_Ubuntu_jaunty_i386.deb

#安裝網路橋接原件
sudo apt-get install bridge-utils uml-utilities

#安裝常用套件
sudo apt-get install wget cron openssh-server portmap nfs-common vsftpd gpm

#加入使用者到vboxuser 群組
usermod -G vboxusers -a user name

======== vboxbridge.sh
#!/bin/sh
#/usr/bin/gksudo /root/vboxbridge eth0 tap1 start
#/usr/bin/gksudo /root/vboxbridge eth0 tap2 start
#/usr/bin/gksudo /root/vboxbridge eth0 tap3 start

#Put your username here
USERNAME= user name

TAP_INTERFACE="$2"
HOST_INTERFACE="$1"
BRIDGE_INTERFACE="br0"
TAP_COUNT=`ifconfig | grep -c tap`
case "$3" in
start)
if [ `ifconfig | grep -c $TAP_INTERFACE` = 0 ]; then
#create the bridge if it does not exist
if [ `ifconfig | grep -c $BRIDGE_INTERFACE` = 0 ]; then
brctl addbr $BRIDGE_INTERFACE
#check if we are using DHCP and retrieve configuration if IP is static
if [ `ps ax | grep -c "dhclient $HOST_INTERFACE"` = 2 ]; then
ifconfig $HOST_INTERFACE 0.0.0.0 promisc
brctl addif $BRIDGE_INTERFACE $HOST_INTERFACE
dhclient $BRIDGE_INTERFACE
else
IP_ADDRESS=`ifconfig $HOST_INTERFACE | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
BROADCAST_ADDRESS=`ifconfig $HOST_INTERFACE | grep 'inet addr:' | cut -d: -f3 | awk '{ print $1}'`
SUBNET_MASK=`ifconfig $HOST_INTERFACE | grep 'inet addr:' | cut -d: -f4 | awk '{ print $1}'`
DEFAULT_GATEWAY=`route -n |tail -n1|cut -d' ' -f10`
ifconfig $HOST_INTERFACE 0.0.0.0 promisc
brctl addif $BRIDGE_INTERFACE $HOST_INTERFACE
ifconfig $BRIDGE_INTERFACE $IP_ADDRESS netmask $SUBNET_MASK broadcast $BROADCAST_ADDRESS
route add default gw $DEFAULT_GATEWAY
fi

fi
#add tap interface to bridge
tunctl -t $TAP_INTERFACE -u $USERNAME
brctl addif $BRIDGE_INTERFACE $TAP_INTERFACE
ifconfig $TAP_INTERFACE up
chmod 0666 /dev/net/tun
else
echo "Interface $TAP_INTERFACE already configured"
fi
;;
stop)
if [ `ifconfig | grep -c $TAP_INTERFACE` = 0 ]; then
echo "Interface $TAP_INTERFACE does no exist"
else
#shut down tap interface and remove it from bridge
ifconfig $TAP_INTERFACE down
brctl delif $BRIDGE_INTERFACE $TAP_INTERFACE
tunctl -d $TAP_INTERFACE
#we remove the bridge if this was the last tap interface
if [ $TAP_COUNT = 1 ]; then
brctl delif $BRIDGE_INTERFACE $HOST_INTERFACE
ifconfig $HOST_INTERFACE 0.0.0.0 -promisc
#check if we are using DHCP and retrieve configuration if IP is static
if [ `ps ax | grep -c "dhclient $BRIDGE_INTERFACE"` = 2 ]; then
ifconfig $BRIDGE_INTERFACE down
brctl delbr $BRIDGE_INTERFACE
dhclient $HOST_INTERFACE
else
IP_ADDRESS=`ifconfig $BRIDGE_INTERFACE | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
BROADCAST_ADDRESS=`ifconfig $BRIDGE_INTERFACE | grep 'inet addr:' | cut -d: -f3 | awk '{ print $1}'`
SUBNET_MASK=`ifconfig $BRIDGE_INTERFACE | grep 'inet addr:' | cut -d: -f4 | awk '{ print $1}'`
DEFAULT_GATEWAY=`route -n |tail -n1|cut -d' ' -f10`
ifconfig $BRIDGE_INTERFACE down
brctl delbr $BRIDGE_INTERFACE
ifconfig $HOST_INTERFACE $IP_ADDRESS netmask $SUBNET_MASK broadcast $BROADCAST_ADDRESS
route add default gw $DEFAULT_GATEWAY
fi
fi
fi
;;
*)
echo "Usage: vboxbridge hostinterface tapinterface {start|stop}" >&2
exit 1
;;
esac
==========