Convert .PEM file into .JKS and Store into Cacerts (TrustStore) in Linux

STEP 1:    Frame the SSL Certificates in .pem format

Get the certificates “Private Key”  “Public Certificate” and “Primary & Secondary Certificates” then frame the certificates as shown below and save it as .pem format

private key = myprivatekey.pem
Public Certificate =  mypublickey.cer
Primary & Secondary Certificates = Issuing.cer & Root.cer 

Syntax:-

cat myprivatekey.pem mypublickey.cer Issuing.cer Root.cer > mycertificate.pem

After you frame the certificate, install in local server stunnel and check the chain using the tool "http://www.sslshopper.com/ssl-checker.html"

You should be able to see the correct certificate chain.

STEP 2:     Convert the .PEM certificate to .P12 certificate as shown below

Syntax:-

openssl pkcs12 -export -in mycertificate.pem -inkey myprivatekey.pem -name myaliasname -out mycertificate.p12

STEP 3:     Convert the .P12 certificate to JKS format certificate as shown below.

Syntax:- 

keytool -v -importkeystore -srckeystore mycertificate.p12 -srcstoretype pkcs12 -destkeystore mycertificate.jks -deststoretype jks

Enter the destination keystore (JKS) password and source keystore (.P12) password

STEP 4:     Verify the JKS file using below command and check the certificate details like common name, expiry date.

Syntax:- 

keytool --list -v -keystore mycertificate.jks

STEP 5:   Import certificate in cacerts

Syntax:- 

keytool -import -trustcacerts -file mycertificate.jks -alias myaliasname  -keystore /etc/pki/java/cacerts

Note:- 

*cacerts & keystore:-   'cacerts' is a truststore. A trust store is used to authenticate peers. A keystore is used to authenticate yourself.  

*openssl:-  it is the tool which deals with cryptography, encryption and security in Linux.

AWS Linux Server Health Monitoring Using CloudWatch

Login In AWS Linux Instance with ec2-user or sudo user 

Install Pre-requesting packages 

1:-   sudo yum install perl-Switch perl-DateTime perl-Sys-Syslog perl-LWP-Protocol-https perl-Digest-SHA zip unzip

2:-   sudo mkdir cloudwatch; cd cloudwatch; ll

Download and Install Monitoring script

4:-    sudo curl http://aws-cloudwatch.s3.amazonaws.com/downloads/CloudWatchMonitoringScripts-1.2.1.zip -O; sudo unzip CloudWatchMonitoringScripts-1.2.1.zip;ll

Entry in Crontab for Every 5 minute

5:-   crontab -e

*/5 * * * * ~/cloudwatch/aws-scripts-mon/mon-put-instance-data.pl --mem-util --disk-space-util --disk-path=/ --from-cron

*/5 * * * * ~/cloudwatch/aws-scripts-mon/mon-put-instance-data.pl --disk-space-util --disk-path=/data2 --from-cron

Now GoTo In EC2 and Select ec2-Instance  and check IAM Role is already created or Not

(If IAM Role is already present like below screenshot then click on role ex:- click on 1-HC-Ambari)

Now Attached Policy {AllowCloudWatch} in IAM Role (1-HC-Ambari)

Then click on Attach Policy

Select AllowCloudWatch  --> Click Attach Policy

Now Goto CloudWatch & Create New Dashboard, Here we are creating with name DEV_INFRA_LINUX

Select Line 

For adding CPU Choose EC2-Per Instance Matrix (Extra)

Add New Role with IAM

IAM-->Roles-->CreateNewRole-->Select AmazonEC2-->AttachPolicy(Now or Later) AllowCloudWatch  -->RoleName

Click on Create New Role---> Select Amazon EC2 

Attach Policy (Not Compulsory Now) --> AllowCloudWatch

Now Attach IAM Role with ec2-Instance (Single or Many)
Attached Role in IAM Role  ( Select Instance-->Action-->Instance Setting-->Attched IAM role )

Install Monitoring Tool CACTI On RHEL CENTOS 6.3

ABOUT CACTI :-

Cacti is an open-source, web-based network monitoring and graphing tool designed as a front-end application for the open-source, industry-standard data logging tool RRDtool. Cacti allows a user to poll services at predetermined intervals and graph the resulting data. It is generally used to graph time-series data of metrics such as CPU load and network bandwidth utilization. A common usage is to monitor network traffic by polling a network switch or router interface via simple network management protocol (SNMP).

Required Packages for Cacti In RPM-based Operating Systems

ü  httpd

ü  php

ü  php-mysql

ü  php-snmp

ü  mysql

ü  mysql-server

ü  net-snmp

    ü  Apache : A Web server to display network graphs created by PHP and RRDTool.

ü  MySQL : A Database server to store cacti information.

ü  PHP : A script module to create graphs using RRDTool.

ü  PHP-SNMP : A PHP extension for SNMP to access data.

ü  NET-SNMP : A SNMP (Simple Network Management Protocol) is used to manage network.

ü  RRDTool : A database tool to manage and retrieve time series data like CPU load, Network Bandwidth etc.

INSTALL THE PRE-REQUIRED PACKAGES (FOR CACTI)

1 :- INSTALL APACHE

# yum install httpd* -y

2 :- INSTALL MYSQL

# yum install mysql* -y

3 :- INSTALL PHP

# yum install php* -y

4 :- INSTALL PHP-SNMP

# yum install php-snmp* -y

5 :- INSTALL NET-SNMP

# yum install net-snmp* -y

6 :- INSTALL RRDTOOL

# yum install rrdtool* -y

STARTING AND CHKCONFIG APACHE , MYSQL AND SNMP SERVICES

# /etc/init.d/httpd restart ; chkconfig httpd on

# /etc/init.d/mysqld restart; chkconfig mysqld on

# /etc/init.d/snmpd restart; chkconfig snmpd on

 NOW INSTALL THE CACTI ON CENTOS , RHEL

DOWNLOAD CACTI FROM :- 

wget  http://www.cacti.net/downloads/cacti-0.8.8a.tar.gz 

Then Install Using RPM 

#rpm -ivh cacti-0.8.8a.  (using tab button)

                           OR

you need to install and enable  EPEL Repository. Once you’ve enabled repository, type the following command to install Cacti application. 

#yum install cacti* -y

CONFIGURE MYSQL SERVER FOR CACTI INSTALLATION

We need to configure MySQL for Cacti, to do this we need to set password for our newly installed MySQL server and then we will create Cacti database with user Cacti. If you’reMySQL is already password protected, then don’t need to set it again.

# mysqladmin -u root password YOUR-MYSQL-PASSWORD

CREATE MYSQL CACTI DATABASE

Login into MySQL server with newly created password and create Cacti database with userCacti and set the password for it

# mysql -u root -p

mysql>  create database cacti;

mysql> GRANT ALL ON cacti.* TO cacti@localhost IDENTIFIED BY 'YOUR-MYSQL-PASSWORD'

mysql> FLUSH privileges;

mysql> quit;

INSTALL CACTI TABLES TO MYSQL

Find out the database file path using RPM command, to install cacti tables into newly createdCacti 

database, use the following command.

# rpm -ql cacti | grep cacti.sql

OUTPUT :-

/usr/share/doc/cacti-0.8.7d/cacti.sql

Now we’ve of the location of Cacti.sql file, type the following command to install tables, here you need to type the Cacti user password

# mysql -u cacti -p cacti < /usr/share/doc/cacti-0.8.7d/cacti.sql

CONFIGURE MYSQL SETTING FOR CACTI

Make the following changes and save the file. Make sure you set password correctly.

# vim /etc/cacti/db.php

CONFIGURE APACHE SERVER FOR CACTI INSTALLATION.

Open the file called /etc/httpd/conf.d/cacti.conf 

#vim /etc/httpd/conf.d/cacti.conf

You need to enabled access to Cacti application for your local network or per IP level. For example we’ve enabled access to our local LAN network 192.168.1.0/24. In your case, it would be different.

Finally, restart the Apache service.

# /etc/init.d/httpd restart;

SETTING CRON FOR CACTI

OPEN file /etc/cron.d/cacti

# vim /etc/cron.d/cacti

Uncomment the following line. The poller.php script runs every 5mins and collects data of known host which is used by Cacti application to display graphs.

Cacti Installer Setup

Finally, Cacti is ready, just go to http://YOUR-SYSTEM-IPADDRESS-HERE/cacti/ & follow the installer instruction through the following screens. Click Next button.

choose installation Type as New Install

Make sure all the following values are correct before continuing. Click  Finish button.

Cacti Login Screen, enter username as admin and password as admin.

Once you’ve entered username and password, it will ask you to enter a new password for cacti.

Cacti Console Screen

_____________________________
_________________________________

Some Important Links

1 For php-snmp package for centos 6.3

http://rpm.pbone.net/index.php3/stat/4/idpl/18075757/dir/scientific_linux_6/com/php-snmp-5.3.3-3.el6_2.8.x86_64.rpm.html

2 To Download The Cacti

http://rpm.pbone.net/index.php3/stat/4/idpl/19569839/dir/redhat_el_6/com/cacti-0.8.8a-2.el6.noarch.rpm.html

3 Cacti Official WebSite

 http://www.cacti.net/

SSH LOGIN WITHOUT PASSWORD USING SSH-KEYGEN

I have 2 machine :-

a) 192.168.1.6 {server.example.com}

b) 192.168.1.110 {station110.example.com}

1 :- Create the key using ssh-keygen on 1st  machine i.e.       {server.example.com(192.168.1.6)}

[root@server ~]# ssh-keygen

Generating public/private rsa key pair. (Press Enter)

Enter file in which to save the key (/root/.ssh/id_rsa) (Press Enter)

Enter passphrase (empty for no passphrase): (Press Enter)

Your identification has been saved in /root/.ssh/id_rsa.

Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:

7f:b9:07:00:57:a0:55:c3:97:3f:f8:2d:36:53:ad:c4 root@server.example.com

The key's randomart image is:

+--[ RSA 2048]----+

|          o=+  . |

|        .o. ..o  |

|        .o   o...|

|          .  .E.+|

|        S  . ..oo|

|         .  ..*..|

|          . oo + |

|           . ..  |

|            ..   |

+-----------------+

2 :- Copy The Key to Second Machine using ssh-copy-id

[root@server ~]# ssh-copy-id -i  /root/.ssh/id_rsa.pub root@192.168.1.110

                                                            or

[root@server ~]# ssh-copy-id -i  /root/.ssh/id_rsa.pub station110.example.com

[root@server ~]#Enter Password  {only one time password entered of 2nd machine i.e. station110.example.com(192.168.1.110)}

Now try logging into the machine, with "ssh 'station110.example.com'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

3 :- Login to Second Machine {i.e. station110.example.com (192.168.1.110)}

[root@server ~]# ssh -Y 192.168.1.110

Last login: Mon Mar 18 02:36:34 2013 from 192.168.1.6 {Now This Time It Will Not Ask Any Password }

[root@station110 ~]# hostname

station110.example.com

[root@station110 ~]#

__________________________________________

If You See Error Like Agent admitted failure to sign using the key then-

This problem will fix using the command #ssh-add

[root@server ~]# ssh-add