LinuxTech - happyman - 博客大巴

2007-01-22

nfs优化

1.设置块大小
mount命令的risize和wsize指定了server端和client端的传输的块大小。如果没有指定，那么，系统根据nfs的版本来设置缺省的risize和wsize大小。大多数情况是4K（4096bytes），对于nfs v2，最大是8K，对于v3，在server端设置risize和wsize的限制，最大块大小在kernel的常量NFSSVC_MAXBLKSIZE,该常量在usr/src/linux2.4/include/linux/nfsd/const.h.所有的2.4的的client都支持最大32K的传输块。系统缺省的块可能会太大或者太小，这主要取决于你的kernel和你的网卡，太大或者太小都有可能导致nfs速度很慢。具体的可以使用Bonnie，Bonnie++，iozone等benchmark来测试不同risize和wsize下nfs的速度。当然，也可以使用dd来测试。
＃time dd if=/dev/zero of=/testfs/testfile bs=8k count=1024这是来测试nfs写
＃time dd if=/testfs/testfile of=/dev/null bs=8k 这是测试nfs读
测试时文件的大小至少时系统RAM的两倍，每次测试都使用umount 和mount对/testfs进行挂载，通过比较不同的块大小，得到优化的块大小。
2.网络传输包的大小
网络在包传输过程，对包要进行分组，过大或者过小都不能很好的利用网络的带宽，所以对网络要进行测试和调优。可以使用ping -s 2048 -f hostname进行 ping，尝试不同的package size，这样可以看到包的丢失情况。同时，可以使用nfsstat －o net 测试nfs使用udp传输时丢包的多少。
因为统计不能清零，所以要先运行此命令记住该值，然后可以再次运行统计。如果，经过上面的统计丢包很多。那么可以看看网络传输包的大小。使用下面的命令：
#tracepath node1/端口号
#ifconfig eth0
比较网卡的mtu和刚刚的pmtu，使用#ifconfig eth0 mtu 16436设置网卡的mtu和测试的一致。

当然如果risize和wsize比mtu的值大，那么的话，server端的包传到client端就要进行重组，这是要消耗client端的cpu资源。此外，包重组可能导致网络的不可信和丢包，任何的丢包都会是的rpc请求重新传输，rpc请求的重传有会导致超时，严重降低nfs的性能。可以通过查看/proc/sys/net/ipv4/ipfrag_high_thresh和/proc/sys/net/ipv4/ipfrag_low_thresh了解系统可以处理的包的数目，如果网络包到达了ipfrag_high_thresh，那么系统就会开始丢包，直到包的数目到达ipfrag_low_thresh。
3.nfs挂载的优化

timeo:如果超时，客户端等待的时间，以十分之一秒计算。
retrans：超时尝试的次数。
bg：后台挂载，很有用
hard：如果server端没有响应，那么客户端一直尝试挂载。
wsize：写块大小
rsize：读块大小
intr：可以中断不成功的挂载
noatime：不更新文件的inode访问时间，可以提高速度。
async：异步读写。
4.nfsd的个数
缺省的系统在启动时，有8个nfsd进程。
#ps -efl|grep nfsd
通过查看/proc/net/rpc/nfsd文件的th行，第一个是nfsd的个数，后十个是线程是用的时间数，第二个到第四个值如果很大，那么就需要增加nfsd的个数。
具体如下：
#vi /etc/init.d/nfs
找到RPCNFSDCOUNT,修改该值，一般和client端数目一致。
然后，重启服务。
#service nfs restart
#mount -a
5.nfsd的队列长度
对于8个nfsd进程，系统的nfsd队列长度是64k大小，如果是多于8个，就要相应的增加相应的队列大小，具体的在/proc/sys/net/core/【rw】mem_default和/proc/sys/net/core/【rw】mem_max。队列的长度最好是每一个nfsd有8k的大小。这样，server端就可以对client的请求作排队处理。如果要永久更改此值
#vi /etc/sysctl.conf
加入
net.core.【rw】mem_max=数目
net.core.【rw】mem_default=数目
#service nfs restart

Tag：LinuxTech

brucectl 发表于23:45:27 | 阅读全文 | 评论 0 | 编辑 | 分享 0
2006-10-09

How to setup the secure shell daemon on a Windows 2000/2003 server
1. Create the destination folder (C:\cygwin or D:\cygwin as appropriate). Default permissions will be for administrators and SYSTEM only. Add SERVER\Users with modify control to the list. These permissions will be inherited to the rest of the folder as it is populated.
2. Create a directory to locally store the cygwin packages e.g. C:\temp\cygwinarchive. Open a browser window to the following URL http://www.cygwin.com/setup.exe and save the installation file setup.exe to the archive directory just created (C:\temp\cygwinarchive in this example)
1. Double click on the downloaded cygwin setup program. The current version is 2.510.2.2 (February 3rd, 2006). Click 'Next' and answer the prompts :
2. Leave default "install from internet"

Install to root directory c:\cygwin
leave default "install for all users"
leave default text file type "unix / binary"
Set local package directory to c:\temp\cygwinarchive (the directory created in step 2 above). This should be the default.
Leave the default "direct connection"
Select a mirror (any of the ones with starting with http://mirror in the name). The package list will be downloaded.
The 'Select Packages' window can be stretched. Click on the plus sign to expand the categories. Install at least the following list of packages.
- From Admin, select all packages.
- From Archive, select unzip and zip packages.
- From Base, leave the default, select all packages.
- From Doc, leave the default, man and 'cygwin doc' packages.
- From Editors, select vim package.
- From Net, select openssh (openssl will get checked automatically), rsync and tcp_wrappers packages.
When you've selected these packages, click 'Next'. The installation tells you which packages it is installing as it progresses.
Uncheck 'Create desktop icon'. Leave default 'Add to start menu'. Click 'Finish'.
A post install script runs a few final commands. Then you should see a message saying 'Installation complete'. Click 'OK'.

Edit C:\cygwin\cygwin.bat. Make sure it contains these lines - you will need to add the line setting the CYGWIN environment variable.
```
@echo off
set CYGWIN=binmode tty ntsec
C:
chdir \cygwin\bin

bash --login -i
```

1. Test cygwin to make sure it works. Start, Programs, Cygnus Solutions, Cygwin Bash Shell - should get a command window with a prompt saying 'Administrator@servername'. This is a bash shell and you can use unix or DOS / NT type commands e.g.
2. 'ls /bin' to see the cygwin bin directory

'dir c:' to see the contents of the C: directory

Type "control d" or "logout" to exit the shell.
If you get a message saying 'cannot create /home/userid', run this command from the cygwin window "mkpasswd -l >/etc/passwd".
While you're in the cygwin shell window, run this command to change the mount prefix from "/cygdrive" to "/".
```
mount -s --change-cygdrive-prefix /
```

1. Also, create a home directory where you can place user startup files. The default location is the "Documents and Settings" folder. Creating a /home directory and using the -p switch to assign the home directory when adding a new user keeps all the cygwin files under the c:\cygwin directory.
2. mkdir -p /home
3. Installing the SSH daemon service
4. From a cygwin prompt (Start, All Programs, Cygwin ?), run ssh-host-config to create the service, set up the ssh host keys and create the sshd_config file in /etc/. Note that 2 local users are created, one called sshd to handle privilege separation and one that is required on Windows 2003 called sshd_server that runs the service in order to use public key authentication. You should see output like this:
```
$ ssh-host-config
Generating /etc/ssh_host_key
Generating /etc/ssh_host_rsa_key
Generating /etc/ssh_host_dsa_key
Overwrite existing /etc/ssh_config file? (yes/no) yes
Generating /etc/ssh_config file
Overwrite existing /etc/sshd_config file? (yes/no) yes
Privilege separation is set to yes by default since OpenSSH 3.3.
However, this requires a non-privileged account called 'sshd'.
For more info on privilege separation read
/usr/share/doc/openssh/README.privsep.

Should privilege separation be used? (yes/no) yes
Warning: The following function requires administrator privileges!
Should this script create a local user 'sshd' on this machine? (yes/no) yes
Generating /etc/sshd_config file
Added ssh to C:\WINDOWS\system32\drivers\etc\services


Warning: The following functions require administrator privileges!

Do you want to install sshd as service?
(Say "no" if it's already installed as service) (yes/no) yes

You appear to be running Windows 2003 Server or later.  On 2003 and
later systems, it's not possible to use the LocalSystem account
if sshd should allow passwordless logon (e. g. public key authentication).
If you want to enable that functionality, it's required to create a new
account 'sshd_server' with special privileges, which is then used to run
the sshd service under.

Should this script create a new local account 'sshd_server' which has
the required privileges? (yes/no) yes

Please enter a password for new user 'sshd_server'.  Please be sure that
this password matches the password rules given on your system.
Entering no password will exit the configuration.  PASSWORD=xxxxxxx

User 'sshd_server' has been created with password 'xxxxxxxx'.
If you change the password, please keep in mind to change the password
for the sshd service, too.

Also keep in mind that the user sshd_server needs read permissions on all
users' .ssh/authorized_keys file to allow public key authentication for
these users!.  (Re-)running ssh-user-config for each user will set the
required permissions correctly.


Which value should the environment variable CYGWIN have when
sshd starts? It's recommended to set at least "ntsec" to be
able to change user context without password.
Default is "ntsec".  CYGWIN=binmode ntsec tty

The service has been installed under sshd_server account.
To start the service, call net start sshd' or cygrunsrv -S sshd'.

Host configuration finished. Have fun!
```
- You can start the service from the services MMC panel, or using either of the commands listed above ("net start sshd" or "cygrunsrv -S sshd").
1. Generating public/private SSH keys for a user
2. If you need to generate ssh public and private keys for a user on this machine who will be uploading data or logging in to a remote machine, you will need to carry out this step. Sign on as the user who needs the keys created. They will automatically be in their home directory. Run ssh-user-config to setup the ssh keys. Create only an SSH2 RSA identity (use a null passphrase - just press return). Output should be similar to this :
```
   cygwinadmin@HICKORY ~
   $ ssh-user-config
   Shall I create an SSH1 RSA identity file for you? (yes/no) no
   Shall I create an SSH2 RSA identity file for you? (yes/no)  (yes/no) yes
   Generating /home/pswander/.ssh/id_rsa
   Enter passphrase (empty for no passphrase):Press ENTER
   Enter same passphrase again:Press ENTER
   Do you want to use this identity to login to this machine? (yes/no) yes
   Shall I create an SSH2 DSA identity file for you? (yes/no)  (yes/no) no

   Configuration finished. Have fun!
```
- Update the file /home/userid/.ssh/authorized_keys with any public keys from other users who you wish to be able to connect to this user's account. Refer to this document for more information. Make sure each entry you add is all on one line.
- Make sure the service is running (state 4 = running)
```
$ sc query sshd

SERVICE_NAME: sshd 
        TYPE               : 10  WIN32_OWN_PROCESS  
        STATE              : 4  RUNNING 
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
```
- Test the service from the cygwin prompt using "ssh -v localhost". You will get challenged with the new host key and will have to enter your password as you connect. You should see output like this:
```
The authenticity of host 'localhost (127.0.0.1)' can't be established.
RSA key fingerprint is 75:8a:67:20:0d:75:dd:06:64:04:d0:ac:23:c7:74:ba.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (RSA) to the list of known hosts.

The last line is:
You are successfully logged in to this server!!!
```
- Test the service from a remote host. You can now update the authorized_keys file with the public key file from the user and host you want to connect from. Then test your connection from that host by issuing the command "ssh userid@servername dir c:\"
1. Adding and removing users from the passwd file
2. You can add domain or local users using the mkpasswd command. Test what would be added for a domain user with this command:
```
mkpasswd -d domain_name -u joeuser
```
- You can add an ads domain user to the passwd file and give him a home directory in /home with this command:
```
mkpasswd -d ads -p /home -u kscully >>/etc/passwd
```
- You can add local users using the -l switch instead of the -d switch. Be careful not to use the -d domain_name switch without specifying a user or you will get entries for ALL doamin users in the passwd file.
- Users can be removed and both users and groups can be updated by starting a cygwin shell and using vi to edit the /etc/passwd and /etc/group files.
1. Restricting SSH access to specific servers
2. Working on a netsh script to restrict access to specific servers.
3. cygrunsrv --install sshd --path '/usr/sbin/sshd' --env 'PATH=/bin;/sbin' --env 'CYGWIN=ntsec tty' -a -D
4. Switching the user who runs the service
5. In a normal installation, the ssh-host-config script creates a local user called sshd_server under whose credentials the ssh daemon runs. This is fine for local shell access to the server and secure file transfers to and from the server, but it is not possible to access any network resources while the service is running under the local user account.
6. The solution is to run the service under a domain user account - one that has access to the shares or servers remote from the server running sshd. In order to switch the service to run under a different user, these steps must be carried out :
7. Open "Computer Management", open the Services tab, right click on the "Cygwin sshd" service and stop the service.
- Right click on the "Cygwin sshd" service again and select properties. Under the 'Log On' tab, switch the name of the account the service is running from ".\sshd_server" to domain\userid, where domain and userid correspond to a userid with access to the resources you require in the domain. You will be prompted for this user's password.
- Open Control Panel -> Administratice Tools -> Local Security Settings -> Local Policies. Then click on 'User Rights Assignment'. Make sure the domain user you specified in step one is in the list for these 4 rights :
  1. Adjust memory quotas for a process
  2. Create a token object
  3. Log on as a service (already granted if you completed step 1)
  4. Replace a process level token
- Add the domain user to the local password file
```
    mkpasswd -d domain -u userid >> /etc/passwd
    
```
- Change to ownership of the files required by the sshd service owner. Open a cygwin bash session and run these commands for your userid
```
    $ chown userid /var/log/sshd.log
    $ chown -R userid /var/empty
    $ chown userid /etc/ssh*
    
```
- In the services tab again, right click on the 'Cygwin sshd' service and select 'start'. Check the event log for a successful start, or for errors in case the service does not start successfully.

## Configuration File for SrvReport # Receiver of the mail-report（接收srvreport报告的电子邮件地址） MailReport = webmaster@myschool.org # 20041116130854.htm for saving the html-report（保存HTML报告的文件名） # may contain %%YYYY, %MM, %DD, which will be replaced with # the apropriate values （%YYYY, %MM, %DD分别表示年、月、日。一般由srvreport自动生成） FileReport = ../web/html/%%YYYY-%%MM-%%DD.html # path where the images are located（图片文件所保存的路径） FileReportImgPath = ../../images/ # If you want an up-to-date file, then you should set this to 1 （如果你需要最新的文件报告，可以将FileReportCreateAlways和ReportWithTime的值设置为1） FileReportCreateAlways = 1 ReportWithTime = 1 # This defines the order of the report （定义srvreport所要监控的Linux服务器所提供的服务） order = Traffic CPUUsage WebServer FTPServer FTPLogs Postfix Warnings LastLogins ChkRootKit

ip_conntrack	the cache name
3024	the number of currently active objects
4090	the total number of available objects
384	the size of each object in bytes
409	the number of pages with at least one active object
409	the total number of allocated pages
1	the number of pages per slab are given

2816	192.168.1.100
14	163.30.85.129
6	220.132.142.175
6	127.0.0.1
4	218.187.5.223

happyman

2007-01-22

nfs优化

2006-10-09

How to setup the secure shell daemon on a Windows 2000/2003 server

Installing the SSH daemon service

Generating public/private SSH keys for a user

Adding and removing users from the passwd file

Restricting SSH access to specific servers

Switching the user who runs the service

2006-09-29

基于AS4配置时间服务器

2006-04-12

Linux下面查看硬件信息的工具dmidecode的介绍

2006-03-27

解決 Linux ip_conntrack: table full 的方法

2006-03-21

用SrvRepor远程监控Linux服务器

2006-02-05

scp和rsync的使用

2006-01-18

linux笔记

2006-01-18

用OpenVPN构建安全VPN

2005-12-22

精通RPM之--制作篇

2005-12-22

Linux文件系统的反删除方法

个人资料

brucectl

日历

搜索

文章分类

Tag

最新文章

最新评论

链接

存档

$ dmesg 命令不是很简介方便吗？
robinswan 评论于：2006-03-28 22:47:33 （219.136.73.★）

2007-01-22

2006-10-09

Installing the SSH daemon service

Generating public/private SSH keys for a user

Adding and removing users from the passwd file

Restricting SSH access to specific servers

Switching the user who runs the service

2006-09-29

2006-04-12

2006-03-27

2006-03-21

2006-02-05

2006-01-18

2006-01-18

2005-12-22

2005-12-22

个人资料

日历

搜索

管理

文章分类

Tag

最新文章

最新评论

链接

存档