meisw's blog

rysnc是一个数据镜像及备份工具，具有可使本地和远程两台主机的文件，目录之间，快速同步镜像，远程数据备份等功能。在同步过程中，rsync是根据自己独特的算法，只同步有变化的文件，甚至在一个文件里只同步有变化的部分，所以可以实现快速的同步数据的功能。

第一种：依赖ssh服务同步目录

rsync -aSvH /home/N22/test1/* /home/N22/test2/

参数解释：

a 等同于 -rlptgoD 归档模式，就是保持文件所有属性、权限不变
S 有效的处理零散文件
v verbose模式
H 保持hard links

上面这个表示 将本机的/home/N22/test1/目录下所有的文件，同步到/home/N22/test2/目录下。这种方式我只能同步新增和更新，不能同步删除，不知道原因，修改为

rsync -aSvH –delete /home/N22/test1/* /home/N22/test2/

时，虽然添加了delete仍然不能同步删除的文件。

和其它服务器同步时，需要账户和密码：rsync -aSvH /home/* root@192.168.1.1:/home/

第二种：服务器和客户端

经过测试，这种服务器和客户端的配置能完美解决删除文件和目录的同步功能。

服务器端配置：

1、rysnc一般是通过xinetd进行启动的。

修改/etc/xinetd.d/rsync，只修改一个地方
# default: off
# description: The rsync server is a good addition to am ftp server, as it \
#       allows crc checksumming etc.
service rsync
{
disable = yes  修改为disable = no
socket_type     = stream
wait            = no
user            = root
server          = /usr/bin/rsync
server_args     = –daemon
log_on_failure  += USERID

}

2、接下来编辑配置文件

[root@mailsvr ~] # vi /etc/rsyncd.conf
uid = nobody

gid = nobody

use chroot = no

max connections = 4

pid file = /var/run/rsyncd.pid

lock file = /var/run/rsyncd.lock

log file = /var/log/rsyncd.log

[web]

path = /opt/web

ignore errors

read only = true

list = false

hosts allow = 192.168.0.5  # 允许的IP地址

hosts deny = 0.0.0.0/32    # 禁止的IP 地址

auth users = backup        # 认证用户名,此例是 backup

secrets file = /etc/backup.pass #认证用户的密码文件

3、编辑服务器的密码文件 /etc/backup.pass

vi /etc/backup.pass

backup:123456

4、然后设置权限chmod 400 /etc/backup.pass

客户端配置

1. 编辑rsync连接时的密码文件 /etc/rsync_client.pass

vi /etc/rsync_client.pass

123456                    # 只需要配置连接时使用的密码即可，必须与A服务器上定义的密码相同.

2. chmod 600 /etc/rsync_client.pass

3. 使用 rsync 命令连接服务器,实现文件同步

rsync -vzrtopg –progress –delete –password-file=/etc/rsync_client.passbackup@192.168.1.2::web /opt/test

4. 使用 –execlude= 排除不需要同步的文件后缀名

rsync -vzrtopg –progress –delete –password-file=/etc/rsync_client.pass –exclude=”*.tmp”backup@192.168.1.2::web /home/test

5. 使用 –execlude-from= 排除不需要同步的目录

rsync -vzrtopg –progress –delete –password-file=/etc/rsync_client.pass –exclude-from=/opt/pcdir backup@192.168.1.2::web /home/test

6、定时同步

#vi rsyncd.sh

rsync -aSvH  –delete –password-file=/home/N22/rsync_client.pass backup@192.168.1.252::web /home/N22/test2/

#crontab -e
01 04 * * * /etc/rsyncd.sh
每天凌晨4点01分执行

http://hi.baidu.com/colorsight/blog/item/f0ce3816d874ec104b90a75f.html

一些CentOS等Linux系统启动后可能会出现读进度条等待进入系统的过程，对于学习Linux启动过程非常不利，我们可以将它恢复到显示详细启动过程模式。

使用root用户修改 /boot/grub/grub.conf 文件。

[root@Slyar ~]# vim /boot/grub/grub.conf

找到下面的部分，将"rhgb"去掉，保存即可。其中"rhgb"表示"redhat graphics boot"，就是图形进度条模式。而"quiet"表示在启动过程中只显示重要启动信息，类似硬件自检之类的消息不会显示，可以有选择地选用。

kernel /vmlinuz-2.6.32-71.el6.i686 ro root=UUID=697cb0d9-19f6-414a-90a1-5ceb2f40b03d rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=zh_CN.UTF-8 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto rhgb quiet

Install DAG GPG key

wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt     # download DAG GPG key

rpm --import RPM-GPG-KEY.dag.txt                                # import the key

rm RPM-GPG-KEY.dag.txt                                          # clean up after ourselves
Install yum-priorities

yum install yum-priorities
Download and install package (i386 - 32bit)

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

rpm -Uhv rpmforge-release-0.3.6-1.el5.rf.i386.rpm           # install the rpmforge

yum reporm rpmforge-release-0.3.6-1.el5.rf.i386.rpm                 # clean up after ourselves
Download and install package (x86_64 - 64bit)

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

rpm -Uhv rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm         # install the rpmforge yum reporm rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm               # clean up after ourselves
Set priorities

vim /etc/yum.repos.d/CentOS-Base.repo
[base] or [updates] or [addons] or [extras]
priority=1
[centosplus]
priority=2
vim /etc/yum.repos.d/rpmforge.repo
[rpmforge]
priority=10

 ------------

1. 下载RPMForge rpm包
wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm
wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm

2. 导入GPG Key：
rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt

3. 验证安装包：
rpm -K rpmforge-release-0.5.2-2.el5.rf.i386.rpm
显示rpmforge-release-0.5.2-2.el5.rf.i386.rpm: (sha1) dsa sha1 md5 gpg OK，验证成功

4. 验证成功后，开始安装:
rpm -i rpmforge-release-0.5.2-2.el5.rf.i386.rpm

http://repoforge.org/faq/

linux 支持的 tunnel 有 ipip gre sit 其他非内核隧道这几种。
ipip 需要内核模块 ipip.ko 下面的描述说出了ipip的特点。
简单之极！但是你不能通过IP-in-IP隧道转发广播或者IPv6数据包。你只是连接了两个一般情况下无法直接通讯的IPv4网络而已。至于兼容性，这部分代码已经有很长一段历史了，它的兼容性可以上溯到1.3版的内核。据我所知，Linux的IP-in-IP隧道不能与其他操作系统或路由器互相通讯。它很简单，也很有效。需要它的时候尽管使用，否则就使用GRE。
GRE 需要内核模块 ip_gre.ko
GRE是最初由CISCO开发出来的隧道协议，能够做一些IP-in-IP隧道做不到的事情。比如，你可以使用GRE隧道传输多播数据包和IPv6数据包。
还有一个 sit 我也不知道这个该不该算在隧道里面，他的作用是连接 ipv4 与 ipv6 的网络，这里也我也把他当作隧道的一种吧。
以上所有隧道都需要内核模块 tunnel4.ko 的支持。
在内核之外，还有很多实现隧道的方法，最闻名的当然要数PPP和PPTP，但实际上还有很多(有些是专有的，有些是安全的，有些甚至根本不用IP。

很多人都把隧道描写成一个专用的管子，我觉得这容易造成理解上的误区，当然你看到的结果的确像在一个专用的管子里那样通讯，我更喜欢把隧道看成一个装在大信封里面的一个小信封和一封信。因为不管理论如何，你的数据包还是要实实在在的，通过现有的网络、路由，一步一步的传送过去，这个是不可能省略掉的。
说了这么多，现在就开始从最基本的 ipip 来手工建立一个隧道。

环境：两台linux服务器，分别在两地。并且两台机器都有实ip与互联网向链接，能够互相通讯。每台机器后面都有带着一个LAN 。

图1
————————————-INTERNET————————————
| 192.168.100.0/24 | 211.167.237.218 <------> 123.127.177.195 |192.168.200.0/24 |
|- – – – | | – – – -|
| eth0 | eth1 | | eth1 | eth0 |
———————————————————————————
结构就是这个样子，现在我们就依据上面的结构来建立 tunnel 。

在 211.167.237.218 上创建：

modprobe ipip
ip tunnel add tun1 mode ipip remote 123.127.177.195 local 211.167.237.218 ttl 64
ip link set tun1 mtu 1480 up
ip address add 192.168.200.253 brd 255.255.255.255 peer 123.127.177.195 dev tun1
ip route add 192.168.200.0/24 via 192.168.200.253

在 123.127.177.195 上创建：

modprobe ipip
ip tunnel add tun1 mode ipip remote 211.167.237.218 local 123.127.177.195 ttl 64
ip link set tun1 mtu 1480 up
ip address add 192.168.100.253 brd 255.255.255.255 peer 211.167.237.218 dev tun1
ip route add 192.168.100.0/24 via 192.168.100.253

上面的命令里出现了几个关键字，需要我们注意的地方：
1、mtu隧道会增加协议开销，因为它需要一个额外的IP包头。一般应该是每个包增加20个字节，所以如果一个网络的MTU是1500字节的话，使用隧道技术后，实际的IP包长度最长只能有1480字节了。这倒不是什么原则性的问题，但如果你想使用隧道技术构建一个比较大规模的网络的话，最好仔细研究一下关于IP包的分片和汇聚的知识。
2、ttl 数据包的生存期。设置为64是安全的。如果你的网络规模巨大就提高这个值。不要因为好玩而这么做，那样会产生有害的路由环路。实际上，在很多情况下你要考虑能否减小这个值。
3、ip 要写对端的内网ip，因为这可以减少vpn服务器不是默认网关的麻烦。对方看到的数据包实际是你本地绑定在 tun1 上的ip地址。
4、设置路由后就可以通讯了。
5、这样你已经可以和 你拨入的机器的内网卡通讯了，为了让你拨入方的其他机器也可以和你通讯，你需要增加一个 arp 的响应机制及打开ip转发功能。
arp -Ds source_ip -i lan_eth pub
sysctl -w net.ipv4.ip_forward=1
让你的内网卡可以响应这个ip的arp回应。
到此为止，一简单的 ip tunnel 已经完成了。当然如果你不想使用 ipip 你更喜欢gre 那你可以在开头简单的改成
moprobe ip_gre
ip tunnel add tun1 mode gre … …
来实现，而后面的参数基本上不需要改变。

上面是一个简单的没有任何加密的隧道建立过程，这样通讯可能会带来安全隐患，毕竟我们访问的是内网吗。
要搞隧道加密就搞ipsec吧,没玩过,ipsec 是一个复杂的东西.

先介绍配置 ipip 隧道
　
　　在 /etc/sysconfig/network-scripts 下建立 ifcfg-tunl1 文件
　
　　内容如下：
　
　　DEVICE=tunl1
　
　　TYPE=IPIP
　
　　PEER_OUTER_IPADDR=219.216.98.110
　
　　MY_INNER_IPADDR=10.0.1.1/24
　
　　而配置 gre 隧道就是建立一个 ifcfg-gre1 文件
　
　　内容如下：
　
　　DEVICE=gre1
　
　　TYPE=GRE
　
　　PEER_OUTER_IPADDR=219.216.98.110
　
　　MY_INNER_IPADDR=10.0.0.1/24
　
　　然后使用 ifup tunl1|gre1 则可以了。

转

在linux上用TUN/TAP构建6to4隧道

http://www.lostriver.net/linux-userspace-6to4-tun/

就以公司的环境来测试：
局域网网段为192.168.0.0/24  公司linux网关服务址器地绑定两块网卡  内网为192.168.0.3（作为局域网的网关）公网IP地址为：111.111.111.111  机房内网网段为10.10.0.0/16   一台服务器绑有两块网卡 内网地址为：10.10.254.253  公网地址为:222.222.222.222

net192 为公司内部网络    net10 为机房内部网络

公司网关服务器：
1 modprobe ipip   (开启模块)
   modprobe ip_gre
   ip tunnel add net10 mode gre remote 222.222.222.222 local 111.111.111.111 ttl 255   (ttl 255 有些文档上没有)
新增了一个 tunnel 设备﹐称之为 net10 让它使用 GRE 协议(mode gre)﹐其远程地址为222.222.222.222 (于另一端的 router)﹐这样我们的 tunneling 封包将从111.111.111.111从出(您的 router 在网络 C 上可以具有好几个 IP 地址﹐并由您决定用哪一个(222.222.222.222)来做 tunneling)﹐而且﹐封包的 TTL 字段被设定为 255 (ttl 255)。

2 ip link set net10 up  我们将这个设备启动起来。

3  ip addr add 192.168.0.3  dev ne10       新增的界面 netb 设定一个地址为192.168.0.3。用这个在小网络上也未尝不可﹐只是当您踏上采金旅程之际﹐您或需用其它 IP 范围来给 tunneling 界面就是了(例如在此范例中﹐您可以使用 10.0.1.0)。

4 ip route add 10.10.0.0/24 dev net10 添加一条去往10.10.0.0的路由

5 ifconfig net10 192.168.0.3 pointopoint 10.10.254.253  配置p-t-P网卡参数 (公司配置的是ifconfig net10 192.168.0.3 pointopoint 192.168.0.3）不过应该没有什么关系


机房222.222.222.222 服务器设置如下
ip tunnel add net192 mode gre remote 111.111.111.111 local 222.222.222.222 ttl 255

ip link set net192 up

ip addr add 10.10.254.253 dev net192

ip route add 192.168.0.0/24 dev net192

ifconfig net10 10.10.254.253 pointopoint 192.168.0.3

假如您要拿掉公司网关机器上的 tunnel﹐则﹕

ip link set net10 down

ip tunnel del net10


如果要系统启动自动加载，把上述所有命令写成一个文件   然后在/etc/rc.d/rc.local里添加下列内容
/bin/wenjian 保存就可以了。
#!/bin/sh
modprobe ipip
ip tunnel add net10 mode ipip remote 118.144.82.160  local 124.207.47.150 ttl 255
ip link set net10 up
ip addr add 192.168.0.3 dev net10
ip route add 10.10.0.0/16 dev net10

端口转发映射的程序叫rinetd，启动方法rinetd -c /etc/rinetd.conf 。

把1.1.1.1的11端口映射到2.2.2.2的3389端口，配置文件如下

[root@localhost iso]# cat /etc/rinetd.conf
1.1.1.1 11 2.2.2.1 3389
1.1.1.1 12 2.2.2.2 3389
1.1.1.1 13 2.2.2.3 22
1.1.1.1 14 2.2.2.4 80
allow *.*.*.*
logfile /var/log/rinetd.log

http://www.boutell.com/rinetd/

Name

tcpshow - decode a tcpdump savefile

Synopsis

tcpshow [ -b ] [ -sb ] [ -w width ] [ -nolink ] [ -noip ]

[ -nodata ] [ -data ] [ -track ] [ -terse ]

[ -cooked ] [ -pp ] [ -s ] [ -h ]

[ expression ]

Description

tcpshow reads a tcpdump(1) savefile and provides a reasonably complete decode of Ethernet, IP, ICMP, UDP and TCP headers, in packets that match the boolean expression. The data belonging to these packets is displayed in ASCII.

Currently, protocol data is not decoded. This is not considered a serious problem for applications that use ASCII data streams.

Also, IP and TCP options are not decoded.

The input file must be in the format produced by tcpdump -enx. This file can be generated from
1. a prior run of tcpdump -w file
2. a live run of tcpdump (without -w)
3. any other program that produces a correctly formatted
trace
See under EXAMPLES for each of these different methods, plus a description of the format the input file needs to be in.

Except when -cooked is used, tcpdump(1) is required to be on your PATH, to process the raw savefile.

Options

The following options can be used in just about any sane combination.

-b

break long lines so they don't wrap

This produces a neater, more readable display of the application data. The default width is 60 columns. See the -w flag for how to change this default.

-sb

show line breaks

When -b is used, it may be useful to see exactly where tcpshow wrapped each line, in its display of application data. This option causes the string ''<break>'' to be displayed at the end of each wrapped line. (Lines which were not wrapped, but terminated before the page width, are not so marked.)

-w width

set pagewidth to width columns

This determines where tcpshow will fold long lines, when the -b switch is used.

-nolink

don't decode the link header

The data link header (Ethernet header) is not decoded and displayed.

-noip

don't decode the IP header

The IP header is not decoded and displayed.

-nodata

don't show the data

The protocol data is not displayed (a count of data bytes is shown).

-data

display only the data

The data, plus a minimal decode of the IP and transport/ICMP headers, is displayed.

-track

track TCP sequence numbers

An additional field is produced in the output which shows the TCP acknowledgement number which this side of the connection should receive once the current packet has been received by its peer.

-terse

show the header decode in compact format

Without this option, the display of the decoded header is verbose, occupying a lot of display-space real-estate. With this option, the decoded header information is much more compact and terse. Once you're familiar with the meanings of the header fields, you'll probably always use this option. (Maybe this should be the default, with a -verbose flag to get long-winded header decodes?)

-cooked

don't run tcpdump(1) to pre-process the input

If the input file is already in the expected format, this option must be used. See EXAMPLES below of where this flag is appropriate.

-pp

point-to-point link

If the input file was collected from data travelling over a point-to-point link (one which doesn't make an Ethernet header available), this option needs to be used.

-s

also display a hex dump of spurious data at packet-end

For a reason unknown to the author, tcpdump(1) output sometimes contains data at the end of packets which don't belong to those packets. This spurious data is suppressed from the output, except when this option is used.

-h

display a help summary

This list of options is displayed, with one-liner descriptions.

expression

filter the input file using a tcpdump(1) expression

If the -cooked option is not used, then tcpdump(1) is required to be on your PATH. It is used to read the raw savefile, producing output in the format tcpshow expects. The expression should be a valid tcpdump(1) expression. It is not parsed or interpreted by tcpshow, but passed on to tcpdump(1) for its consumption.

Examples

In the following examples, where tcpdump(1) is used, the flag -s 1518 is used to be sure of saving the complete Ethernet frame.

Also, where tcpdump(1) expressions are used, these could equally have been given to tcpdump(1) directly, if it was known at this time what data you're interested in.

Capture a raw savefile and decode it later.

# tcpdump -s 1518 -w savefile
# tcpshow < savefile

Decode the data as quickly as tcpdump(1) gives it to us.

# tcpdump -s 1518 -lenx | tcpshow

Display headers only.

# tcpshow -nodata < savefile

Display data only (minimal header decode).

# tcpshow -data

Display a decode of Telnet traffic only, omitting the link and IP headers.

# tcpdump -s 1518 -w savefile
# tcpshow -nolink -noip tcp port telnet < savefile

Give a compact display of the TCP headers, and a full display of the data, for all packets going into or coming from the host "sam" -- this host is on a LAN accessible through a PPP link.

# tcpdump -i ppp0 -s 1518 -w savefile
# tcpshow -pp -terse host sam < savefile

Show all SMTP mail transfers, omitting the headers and wrapping the message bodies to make it easy to read them (you're not supposed to do this).

# tcpdump -s 1518 -w savefile
# tcpshow -b -w 40 -data port smtp < savefile

To display a decode of data not captured via tcpdump(1), you would typically use the application that captured the trace to dump that trace into a file in ASCII-hex format. You feed that file into a Perl/sh/awk script (that you write), which produces a file in the format tcpshow expects. Such scripts are easy to write. For example, if your application is "capture" and your script is "convert", then tcpshow might be used as follows.

# capture -hexoutput | convert | tcpshow

A loose definition of the format tcpshow expects is: the 1st line of each packet must begin in column 1. All other lines must begin with a TAB. The hex bytes can be separated from each other by any amount of whitespace, including none.
When using -cooked, the first field should be the time the packet was captured (or a string like "no-time-recorded" if the time isn't available). The remaining fields should be the bytes of the IP datagram.
When -cooked is not used, the first field should be as above, with the next three fields being the Ethernet source address, the Ethernet destination address and the DIX Ethernet Type field.

Files

tcpshow reads from standard input and writes to standard output.

See Also

tcpdump(1), nit(4P), bpf(4)