Rootop 服务器运维与web架构

2011-05-26
发表者 Venus
暂无评论

extmail升级1.2 500 Internal Server Error错误

     因为emos1.5默认的extmail版本，在通讯录的“组”中，姓名如果是中文的话，选中组，发邮件时，变为乱码，原因是extmail中的一个bug，只好升级到extmail1.2，在虚拟机下测试访问时遇到错误：

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, root@localhost and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/2.2.3 (Red Hat) Server at mail.nq.com Port 80

检查日志：

[root@emos extmail]# vi /var/log/httpd/error_log
[Thu May 26 19:35:04 2011] [error] [client 1.1.1.1] Premature end of script headers: index.cgi
[Thu May 26 19:35:05 2011] [error] [client 1.1.1.1] suexec policy violation: see suexec log for more details
提示我们检查suexec日志

[root@emos extmail]# vi /var/log/httpd/suexec.log

[2011-05-26 19:34:09]: uid: (1000/vuser) gid: (1000/1000) cmd: index.cgi
[2011-05-26 19:34:09]: file has no execute permission: (/var/www/extsuite/extmail/cgi/index.cgi)

执行：

[root@emos extmail]# chmod -R 755 cgi/

再次访问，ok了~   （不要忘记cgi 和tmp属主属组皆为vuser vgroup，否则访问时会报另一个错误）

2011-05-26
发表者 Venus
暂无评论

asp.net web.config 配置连接数据库字符串

  <appSettings>
    <!– 连接字符串是否加密 –>
    <add key=”ConStringEncrypt” value=”false”/>
    <!– 连接字符串,(可以扩展支持不同数据库)如果是加密方式，上面一项要设置为true，如果是明文server=127.0.0.1;database=codematic;uid=sa;pwd=,上面设置为false –>
    <add key=”ConnectionString” value=”server=.;database=EnterprisesWebsite;uid=NQ;pwd=NQ“/>
       
  </appSettings>

server=部分可以写为数据库名称、IP、（localhost）、或者是点“.”

EG:

server=.     server=127.0.0.1/172.17.1.19 (可以写回环IP或者是实际IP)    server=(localhost)    server=NQ

2011-05-26
发表者 Venus
暂无评论

mssql2008R2 无法启动 通常每个套接字地址(协议/网络地址/端口)只允许使用一次

启动服务的时候，报如下错误:

 

开始检查日志：

SQL Server 无法生成 FRunCM 线程。请查看 SQL Server 错误日志和 Windows 事件日志，获取有关可能发生的相关问题的信息。

由于网络库中存在内部错误，所以无法启动网络库。要确定原因，请查看错误日志中紧位于此错误之前的那些错误。

TDSSNIClient 初始化失败，出现错误 0x2740，状态代码 0x1。原因: 初始化失败，出现基础结构错误。请检查以前的错误。 通常每个套接字地址(协议/网络地址/端口)只允许使用一次。

TDSSNIClient 初始化失败，出现错误 0x2740，状态代码 0xa。原因: 无法初始化 TCP/IP 侦听器。 通常每个套接字地址(协议/网络地址/端口)只允许使用一次。

服务器 TCP 提供程序无法在 [ ‘any’ <ipv4> 1433] 上侦听。TCP 端口已在使用中。

服务器正在侦听 [‘any’ <ipv6> 1433]。

Mysql日志：

2011-05-26 09:46:58.25 Server      Microsoft SQL Server 2008 R2 (RTM) – 10.50.1600.1 (X64)

         Apr  2 2010 15:48:46

         Copyright (c) Microsoft Corporation

         Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7600: )

2011-05-26 09:46:58.25 Server      (c) Microsoft Corporation.

2011-05-26 09:46:58.25 Server      All rights reserved.

2011-05-26 09:46:58.25 Server      Server process ID is 7864.

2011-05-26 09:46:58.25 Server      System Manufacturer: ‘OEM’, System Model: ‘OEM’.

2011-05-26 09:46:58.25 Server      Authentication mode is MIXED.

2011-05-26 09:46:58.25 Server      Logging SQL Server messages in file ‘C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\ERRORLOG’.

2011-05-26 09:46:58.25 Server      This instance of SQL Server last reported using a process ID of 7576 at 2011/5/26 9:45:21 (local) 2011/5/26 1:45:21 (UTC). This is an informational message only; no user action is required.

2011-05-26 09:46:58.25 Server      Registry startup parameters:

          -d C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\master.mdf

          -e C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\ERRORLOG

          -l C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\mastlog.ldf

2011-05-26 09:46:58.27 服务器         SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.

2011-05-26 09:46:58.27 服务器         Detected 2 CPUs. This is an informational message; no user action is required.

2011-05-26 09:46:58.29 服务器         Using dynamic lock allocation.  Initial allocation of 2500 Lock blocks and 5000 Lock Owner blocks per node.  This is an informational message only.  No user action is required.

2011-05-26 09:46:58.34 服务器         Node configuration: node 0: CPU mask: 0x0000000000000003:0 Active CPU mask: 0x0000000000000003:0. This message provides a description of the NUMA configuration for this computer. This is an informational message only. No user action is required.

2011-05-26 09:46:58.36 spid7s      Starting up database ‘master’.

2011-05-26 09:46:58.47 spid7s      Resource governor reconfiguration succeeded.

2011-05-26 09:46:58.47 spid7s      SQL Server Audit is starting the audits. This is an informational message. No user action is required.

2011-05-26 09:46:58.47 spid7s      SQL Server Audit has started the audits. This is an informational message. No user action is required.

2011-05-26 09:46:58.48 spid7s      FILESTREAM: effective level = 0, configured level = 0, file system access share name = ‘MSSQLSERVER’.

2011-05-26 09:46:58.51 spid7s      SQL Trace ID 1 was started by login “sa”.

2011-05-26 09:46:58.51 spid7s      Starting up database ‘mssqlsystemresource’.

2011-05-26 09:46:58.55 spid7s      The resource database build version is 10.50.1600. This is an informational message only. No user action is required.

2011-05-26 09:46:58.63 spid10s     Starting up database ‘model’.

2011-05-26 09:46:58.63 spid7s      Server name is ‘NQ’. This is an informational message only. No user action is required.

2011-05-26 09:46:58.78 服务器         A self-generated certificate was successfully loaded for encryption.

2011-05-26 09:46:58.78 服务器         Server is listening on [ ‘any’ <ipv6> 1433].

2011-05-26 09:46:58.78 服务器         错误: 26023，严重性: 16，状态: 1。

2011-05-26 09:46:58.78 服务器         Server TCP provider failed to listen on [ ‘any’ <ipv4> 1433]. Tcp port is already in use.

2011-05-26 09:46:58.79 服务器         错误: 17182，严重性: 16，状态: 1。

2011-05-26 09:46:58.79 服务器         TDSSNIClient initialization failed with error 0x2740, status code 0xa. Reason: 无法初始化 TCP/IP 侦听器。 通常每个套接字地址(协议/网络地址/端口)只允许使用一次。

2011-05-26 09:46:58.79 服务器         错误: 17182，严重性: 16，状态: 1。

2011-05-26 09:46:58.79 服务器         TDSSNIClient initialization failed with error 0x2740, status code 0x1. Reason: 初始化失败，出现基础结构错误。请检查以前的错误。 通常每个套接字地址(协议/网络地址/端口)只允许使用一次。

2011-05-26 09:46:58.79 服务器         错误: 17826，严重性: 18，状态: 3。

2011-05-26 09:46:58.79 服务器         Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately preceding this one in the error log.

2011-05-26 09:46:58.79 服务器         错误: 17120，严重性: 16，状态: 1。

2011-05-26 09:46:58.79 服务器         SQL Server could not spawn FRunCM thread. Check the SQL Server error log and the Windows event logs for information about possible related problems.

2011-05-26 09:46:58.81 spid10s     Clearing tempdb database.

2011-05-26 09:46:59.00 spid13s     A new instance of the full-text filter daemon host process has been successfully started.

2011-05-26 09:46:59.11 spid13s     Starting up database ‘msdb’.

 协议/IP可以被程序多次利用，但是端口只能被单一程序进程占用。想想吧，最近在服务器上安装过什么？

查看端口被哪个无耻的进程占用了！！！

命令提示符：

C:\>netstat -ano | find “1433” 

  TCP    127.0.0.1:1433         127.0.0.1:3308         ESTABLISHED     1988

  TCP    127.0.0.1:3308         127.0.0.1:1433         ESTABLISHED     2024

C:\>

C:\>tasklist | find “1988”

MuseMailSvr.exe               1988 Services                   0      7,664 K

今早上刚安装了一个邮件服务器软件，就它了，先卸载吧。之后再次启动mssql服务，OK了~

2011-05-25
发表者 Venus
暂无评论

samba 的安全上下文 selinux(samba_share_t)

       当我们在与linux中交换文件的时候，内网之间一般是用samba这个服务来实现，那我们也会遇到或多或少的阻碍，比如不能访问了，没权限啊，selinux 的问题等等。这次说一下selinux，我们总不能把selinux关掉吧，毕竟找出根本原因是最好方法，也能学习知识不是麽。

我共享了根目录下的backup文件夹，里面放的是系统自动备份的资料，selinux为强制状态，当我访问samba时，能进入到samba列表，但是打不开smb这个共享的文件夹，提示“找不到网络路径”。好，检查服务器日志：

May 25 08:53:33 rhel smbd[3364]:   ‘/backup’ does not exist or permission denied when connecting to [smb] Error was 权限不够

接着下面：

May 25 08:47:46 rhel setroubleshoot: SELinux is preventing samba (smbd) “search” to ./backup (default_t). For complete SELinux messages. run sealert -l 65266ca9-18cb-49e1-8c83-d8a8f9dedf0a

提示我们执行红色部分语句查看具体错误信息。

[root@rhel ~]# sealert -l 65266ca9-18cb-49e1-8c83-d8a8f9dedf0a

摘要:

SELinux is preventing samba (smbd) “search” to ./backup (default_t).

详细的描述:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux denied samba access to ./backup. If you want to share this directory
with samba it has to have a file context label of samba_share_t. If you did not
intend to use ./backup as a samba repository it could indicate either a bug or
it could signal a intrusion attempt.

正在允许访问:

You can alter the file context by executing chcon -R -t samba_share_t ‘./backup’
You must also change the default file context files on the system in order to
preserve them even on a full relabel. “semanage fcontext -a -t samba_share_t
‘./backup'”

以下命令将允许这个权限:

chcon -R -t samba_share_t ‘./backup’

附加的信息:

源上下文                  root:system_r:smbd_t
目标上下文               root:object_r:default_t
目标对象                  ./backup [ dir ]
Source                        smbd
Source Path                   /usr/sbin/smbd
Port                          <未知的>
Host                          rhel
Source RPM Packages           samba-3.0.33-3.28.el5
Target RPM Packages
策略 RPM                    selinux-policy-2.4.6-279.el5
Selinux 激活                True
策略类型                  targeted
MLS 激活                    True
强制模式                  Permissive
插件名称                  samba_share
主机名                     rhel
平台                        Linux rhel 2.6.18-194.el5 #1 SMP Tue Mar 16
                              21:52:39 EDT 2010 x86_64 x86_64
警告记数                  3
First Seen                    Wed May 11 11:33:14 2011
Last Seen                     Wed May 25 08:47:44 2011
Local ID                      65266ca9-18cb-49e1-8c83-d8a8f9dedf0a
行数

原始 Audit 消息

host=rhel type=AVC msg=audit(1306284464.893:47): avc:  denied  { search } for  pid=3590 comm=”smbd” name=”backup” dev=sda1 ino=2505890 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:default_t:s0 tclass=dir

host=rhel type=SYSCALL msg=audit(1306284464.893:47): arch=c000003e syscall=80 success=yes exit=0 a0=2ad998a50580 a1=2ad998a50580 a2=2ad994ffdb90 a3=ea items=0 ppid=3584 pid=3590 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=”smbd” exe=”/usr/sbin/smbd” subj=root:system_r:smbd_t:s0 key=(null)

好多废话，那么主要的还是smb安全上下文的原因，在此，我知道samba的安全上下文是：samba_share_t (我为什么知道？学的呗）

[root@rhel ~]# chcon -R -t samba_share_t /backup/

再次访问，ok了~

2011-05-25
发表者 Venus
暂无评论

fstab 丢失及恢复方法 Starting system logger：

先来几张报错的图片瞅瞅，虚拟机下测试的：

只要启动系统时，发现出现”Read-Only file system”，congratulations，你fstab文件丢失，要不就是遭到破坏了。

然后就会停留在”starting system logger:”

下面说下解决办法：

拿安装光盘，启动到引导界面后输入：linux rescue 进入救援模式，根据提示一步步到终端模式下。

1、fdisk -l   查看一下系统中的分区信息 ，我就俩分区，一个根分区，一个交换分区，根分区为/dev/sda1。        2、用e2label /dev/sda1 确定其卷标是/，下面要手动编辑/etc/fstab文件，fstab位于sda1分区中，那么现在此分区是没有被挂载的，手动创建个目录挂载它，这一步不写了就，大家都会，然后再编辑fstab，加入代码：

LABEL=/                   /                        ext3             defaults         1  1

我本机就一个分区需要挂载，所以添加一条，根据实际情况来决定。

保存退出，重启系统。OK了~