Skip to content

Month: February 2010

Using expect scripts to backup your Cisco configuration

In this short howto I’ll explain how to use expect scripts with Cisco devices. In this example I’m going to use it to backup the current running configuration.

Requirements

  • A working tftp server
  • Expect
  • Lucky for us both requirements are available in all major distro’s.

    The Debian/Ubuntu way:

    sudo apt-get install tftp tftpd expect

    Next on our todo list is configuring the tftp server. This should also be fairly easy:

    # cat /etc/xinetd.d/tftp
    service tftp
    {
        protocol        = udp
        port            = 69
        socket_type     = dgram
        wait            = yes
        user            = nobody
        server          = /usr/sbin/in.tftpd
        server_args     = /tftpboot
        disable         = no
    }
    

    Restart your xinetd server when done.

    # /etc/init.d/xinetd restart

    Make sure the /tftpboot folder exists and is owned by user and group nobody:

    # chown -R nobody:nobody /tftpboot

    You should also create an empty file where you’d like to save your configuration and rerun the above command to adjust permissions.

    # touch /tftpboot/config
    # chown -R nobody:nobody /tftpboot

    You should also create an empty file where you’d like to save your configuration and rerun the above command to adjust permissions.

    # touch /tftpboot/config
    # chown -R nobody:nobody /tftpboot

    We can now test our newly configured tftpd server:
    Create a new file in your home dir called config and put some random text in it.

    # cat /home/user/config
    test 12
    
    # tftp
    tftp> open localhost
    tftp> put config
    Sent 146 bytes in 0.0 seconds
    
    # cat /tftpboot/config
    test 12

    Excellent! We’re ready to receive config files from the Cisco device.

    Below you will find an example script:

    #!/usr/bin/expect
    
    ## TomDV
    ## http://blog.penumbra.be/2010/02/expect-scripts-backup-cisco-config/
    
    # ---------------- configuration ---------------- #
    set device 192.168.0.100    # cisco device
    set tftp 192.168.0.200      # tftp server
    set user someuser           # username
    set pass ultrasecret        # password
    set config                  # config destination
    set timeout 60
    
    # -------------- do not edit below -------------- #
    spawn telnet $device
    expect "Password:"
    send "$pass\n"
    expect ">"
    send "en\n"
    expect "Password:"
    send "$pass\n"
    
    send "copy running-config tftp://$tftp/$config\n\n"
    expect "$tftp"
    send "\n"
    expect "$config"
    send "\n"
    send "exit\n"

    Save it anywhere you like and run it from the shell. You’ll see something like this in your logs:

    user in.tftpd[22304]: connect from 192.168.0.200 (192.168.0.200)
    user tftpd[22305]: tftpd: trying to get file: config
    user tftpd[22305]: tftpd: serving file from /tftpboot

    That’s it. Your current Cisco config has been saved to /tftpboot/config.

    I wouldn’t recommend using this into production without proper firewalling. You can get the same results by using snmp. But that’s however a subject for another howto.

    Monitor DNS blacklist entries with Zabbix

    One of the smaller projects I’ve been working on lately is monitoring Realtime DNS Blacklists (RBL’s) status with Zabbix. I’m confident most of you are already familiar with RBL’s. For those who are not, here’s a small introduction shamelessly stolen from Wikipedia:

    A DNSBL (DNS-based Blackhole  List, Block List, or Blacklist; see below) is a list of IP addresses published through the Internet Domain Name Service in a particular format. DNSBLs are most often used to publish the addresses of computers or networks linked to spamming; most mail server  software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists.

    And that’s exactly what we’re going to monitor. If we are listed on one of those RBL’s we’d like to know about it, don’t we? 

    Let’s get to it then. First of all we need an up to date list of RBL’s which we can use to check whether we’re listed or not. You could try the list I’m maintaining and using for my own monitoring purposes. The most recent version can be found here. It contains a whopping 92 RBL’s to get you started with.

    Now that we have an up-to-date list of common used RBL’s it’s time for some shell scripting:

    #!/bin/bash
    
    ## TomDV
    ## 2010-01-25
    ## http://blog.penumbra.be/2010/02/zabbix-monitor-dns-blacklists/
    
    cd /usr/share/zabbix/
    RBL="`cat rbl_list.txt`"
    
    W=$( echo ${1} | cut -d. -f1 )
    X=$( echo ${1} | cut -d. -f2 )
    Y=$( echo ${1} | cut -d. -f3 )
    Z=$( echo ${1} | cut -d. -f4 )
    
    STATUS=0
    
    for i in $RBL
    do
        RESULT=$( host -t a $Z.$Y.$X.$W.$i 2>&1 )
        if [ $? -eq 0 ]
        then
            #echo “The IP ADDRESS ${1} is listed at $i:\n$RESULT” ## DEBUG
            let "STATUS += 1"
        fi
        #echo $RESULT ## DEBUG
    done
    
    if [ $STATUS -lt 1 ]
    then
        echo 0
    else
        echo $STATUS
    fi

    This script takes the IP address of your server as input.

    I’ve intentionally left the debug code inside the script. This way the output can be used right away within Zabbix. However if you’re listed on one of the blacklists you can run the script with the debug code uncommented and you get a list of all the RBL’s you’re listed in.

    I’ve put this script in /usr/share/zabbix, along with the rbl_list.txt file you can find above.

    # cat /etc/zabbix/zabbix_agent.d/rbl.conf
    UserParameter=rbl.mx1,/usr/share/zabbix/zabbix-rbl.sh 1.2.3.4
    UserParameter=rbl.mx2,/usr/share/zabbix/zabbix-rbl.sh 5.6.7.8

    I also have the following line in /etc/zabbix/zabbix_agentd.conf and /etc/zabbix/zabbix_agent.conf to load custom config files:

    Include=/etc/zabbix/zabbix_agent.d/

    And that’s about it. Let’s see if we’re listed in any of the RBL’s:

    # zabbix_agent -t rbl.mx1; zabbix_agent -t rbl.mx2;
    rbl.mx1                                    [t|0]
    rbl.mx2                                    [t|0]

    Any value above zero means you’re listed. I guess we’re safe.
    If you’re listed just uncomment the debug code. It will show you which RBL’s you’re in.

    Happy monitoring! 🙂

    Install Xen and libvirt on Debian Lenny

    This should be an easy to follow guide about how to install Xen on Debian 5. You should be able to copy/paste most parts of on your shell. Please run this only on a clean and up-to-date Debian system.

    Alright let’s get to it quick ‘n dirty.

    First of all make sure your Debian install actually is up-to-date:

    # apt-get update; apt-get upgrade

    Let’s see which Xen kernel images are available and pick the most recent one to install:

    # apt-cache search xen | grep image | awk '{print $1}'
    linux-image-2.6-xen-amd64
    linux-image-xen-amd64
    linux-image-2.6.26-1-xen-amd64
    linux-image-2.6.26-2-xen-amd64
    xen-linux-system-2.6.26-1-xen-amd64
    xen-linux-system-2.6.26-2-xen-amd64
    
    # apt-get install `apt-cache search xen-linux-system \
    | sort | tail -1 | awk '{print $1}'`

    Once this is done reboot your system, login again and run:

    # uname -a
    Linux elysium 2.6.26-2-xen-amd64 #1 SMP Thu Feb 11 02:57:18 UTC 2010 x86_64 GNU/Linux

    As you can see, the system is running kernel 2.6.26-2 with the xen-amd64 patch set.
    As of now we should have Dom-0 available:

    # xm list
    Name                   ID   Mem VCPUs      State   Time(s)
    Domain-0               0  3885     2     r-----      8.5

    Perfection!

    Let’s move on to the network. By default there is no bridge available from the virtual machines towards the external network. It’s fairly easy to accomplish though:

    # vim /etc/xen/xend-config.sxp

    Look for the following line and uncomment it:

    (network-script network-bridge)

    And while we’re editing the xend-config.sxp file, change the following line:

    (xend-unix-server no)

    Into:

    (xend-unix-server yes)

    Be sure to reload the new settings:

    # /etc/init.d/xend restart

    If you don’t edit this line or if you don’t reload, you obviously won’t be able to install or manage your virtual machines. You’d get to see errors like this:

    ERROR    internal error failed to connect to xend
    Traceback (most recent call last):
      File "/usr/bin/virt-install", line 693, in
        main()
      File "/usr/bin/virt-install", line 508, in main
        conn = cli.getConnection(options.connect)
      File "/var/lib/python-support/python2.5/virtinst/cli.py", line 123, in getConnection
        return libvirt.open(connect)
      File "/usr/lib/python2.5/site-packages/libvirt.py", line 140, in open
        if ret is None:raise libvirtError('virConnectOpen() failed')
    libvirtError: internal error failed to connect to xend

    There are more options available to connect to xend.: xend-http-server, xend-tcp-xmlrpc-server, xend-unix-xmlrpc-server, xend-relocation-server.

    The reason why I chose xend-unix-server over anything else is pretty straight forward. It only listens on the Unix socket layer which doesn’t need any other networking protocol to operate. You could compare it to connecting to localhost, but without the need for a networking device (e.g. lo0).

    If you want to be able to manage this Xen server from a central node, be sure to change the appropriate management protocol. It’s beyond the scope of this howto, but I might post an howto on this subject later on this blog.

    On to installing a virtual machine!

    I for one am a big fan of abstraction layers. It makes life for a SysAdmin or DevOp so much easier if you’re able to run the same commands on different operating systems, platforms or architectures in general. That’s why I use libvirt. It’s a collection of libraries and tools that can be used to deploy virtual machines on different types of virtualization systems. Including but not limited to Xen, KVM and Qemu.

    It’s also available as a Debian package, so installing it is very straight forward:

    # apt-get install libvirt-bin virtinst

    Once this is done we can install our first virtual machine:

    # virt-install \
    --name=test-debian-install \
    --ram=1024 \
    --file-size=10 \
    --nographics \
    --paravirt \
    --file=/var/lib/xen/images/test-debian-install.img \
    --location=http://ftp.belnet.be/debian/dists/lenny/main/\
    installer-i386

    It’s probably a good idea to store this as a shell script on your Xen host for future reference.
    You should see a familiar installer within seconds after invoking the command.

    Once the install has completed you should be greeted with your new virtual machine’s login prompt:

    Debian GNU/Linux 5.0 test-debian-install hvc0
    
    test-debian-install login:

    To exit your virtual machine’s console, simply press Ctrl-]

    Enjoy!

    Looking for open source projects that need help with packaging

    In follow up to a friend’s recent blogpost “Bored Java Dev looking for Open Source project” I’m also looking for an open source project to contribute to. I’m not that much of a developer but I’d like to get more familiar with Linux distribution packaging. I have basic experience creating
    Gentoo ebuilds, Debian DEB and CentOS RPM packages, but I want to learn and to get more involved.

    Anyone with a promising new open source project feel free to send me a request at
    tom [at] penumbra.be. I do however have some prerequisites:

    • Free and Open Source Software only, no exceptions
    • Non-commercial projects only
    • Preferably not limited to one (Linux) distribution
    • No Qt (KDE) applications due to personal preferences

    What I can offer:

    • Spare time
    • Dedication
    • Build farm on x86, x86-64 and UltraSparc64

    What I can’t offer: