En effet, sous Linux, on dispose d’une superbe option –date qui permet des choses très simples :

[root@machine ~]# date '+%Y.%m.%d'
2009.10.14
[root@machine ~]# date --date="1 month ago" '+%Y.%m.%d'
2009.09.14
[root@machine ~]# date --date="yesterday" '+%Y.%m.%d'
2009.10.13

Sauf que… sous AIX, on a pas la chance d’avoir une telle commande. Ce qui pose des problèmes.

Il faut donc jouer avec la TimeZone pour décaler le temps d’autant de fois 24H qu’on veut :


echo $TZ
IST-2:00
date
Wed Oct 14 11:10:01 IST 2009
TZ=IST+24
date
Tue Oct 13 09:10:11 IST 2009
TZ=IST-2:00
date
Wed Oct 14 11:10:17 IST 2009


Voici donc une petite fonction qui permet de jouer avec l’offset de manière locale et pas globale pour chaque commande date :

GetDate()
{ # GetDate nDays [format]
# Exemple d'utilisation: export NAMEDIR=$(GetDate -1 '+%Y.%m.%d')

typeset -i nDays=$1; format=$2
eval $(echo $TZ | sed '
s!\([^-0-9]*\)\([-0-9]*\)\(.*\)!typeset -i localOffset=\2;zon1=\1;zon2=\3!')
TZ=$zon1$((localOffset-24*nDays))$zon2 date $format

}

A appeler avec une fonction : Getdate -31 ‘+%Y.%m.%d’ :

GetDate 0 '+%Y.%m.%d'
2009.10.14
GetDate -1 '+%Y.%m.%d'
2009.10.13
GetDate -31 '+%Y.%m.%d'
2009.09.13
GetDate -365 '+%Y.%m.%d'
2008.10.14


#up2date rsh-server
ou
#apt-get install rsh-server

On ajoute rsh comme tty autorisé, et on ajoute la nouvelle machine à faire des synchros :

#echo rsh >> /etc/securetty
#echo NEW root >> /root/.rhosts

ensuite sur la nouvelle machine on va utiliser rsync comme ceci :

rsync -e /usr/bin/rsh -azvP OLD:/dossier/ /dossier/

Explication :
-e indique le rsh à utiliser. Sur Redhat, le rsh par défaut est celui de kerberos, et ensuite rsync peut vouloir utiliser ssh. Donc on indique le chemin vers le rsh standard.
-azvP permet de transférer tout en incrémental (que les fichiers mis à jours transférés (a)), en respectant les permissions (P), compressant à la volée (z), et en indiquant la liste des fichiers transférés (v).

/!\ Attention /!\ : le trailer slash (dossier/) est super important pour ne pas copier le dossier mais seulement son contenu et ne pas avoir sur NEW quelque chose du type /dossier/dossier/contenu

#!/bin/bash
if [ $# -ne 3 ] ; then
echo "Usage : $0 oldname newname number-of-files"
echo "Names are given without dots and extension"
exit 1
else
fichieractuel=$1
nouveaunom=$2
nombrefichiers=$3
compteurd=0
compteuru=1
while [ $compteurd -le 9 -a ${compteurd}${compteuru} -le $nombrefichiers ] ; do
while [ $compteuru -le 9 -a ${compteurd}${compteuru} -le $nombrefichiers ] ; do
if [ ${compteurd}${compteuru} = $nombrefichiers ] ; then
mv "$fichieractuel.0${compteurd}${compteuru}" "$nouveaunom.rar"
else
nouveauchiffre=$(echo $compteuru-1|bc)
mv "$fichieractuel.0${compteurd}${compteuru}" "$nouveaunom.r${compteurd}${nouveauchiffre}"
fi
let $[ compteuru += 1 ]
done
compteuru=1
if [ $compteurd -ne 0 ] ; then
nouvelledizaine=$( echo $compteurd-1|bc)
mv "$fichieractuel.0${compteurd}0" "$nouveaunom.r${nouvelledizaine}9"
fi
let $[ compteurd += 1 ]
done
fi


La commande

rpm -qa

permet d’avoir déjà la liste de tous les packages installés.

Pour avoir la date en plus, on va devoir utiliser l’option –queryformat

Voici le résultat :

rpm -qa --queryformat '%{NAME}-%{VERSION}-%{RELEASE} was installed on %{INSTALLTIME:date}\n'

Voici ce que ça donne :

# rpm -qa --queryformat '%{NAME}-%{VERSION}-%{RELEASE} was installed on %{INSTALLTIME:date}\n'|grep mysql
mysql-4.1.22-2.el4 was installed on ven 19 déc 2008 12:05:09 CET
mysql-devel-4.1.22-2.el4 was installed on mar 06 jan 2009 15:33:20 CET

Il faut juste taper

# reset

pour remettre le shell d’aplomb )

#cat listemachines.txt
machine1
machine2
machine3
machine4

un petit script du genre :

#!/bin/bash

while read machine ; do
adresseip=$(nslookup $machine | grep "Address: 1"| awk -F' ' '{ print $2 }')
cat >> ldifhostadd.ldif << EOF
#Machine $machine
dn: cn=$machine,ou=Hosts,dc=mondomaine,dc=com
objectClass : device
objectClass : ipHost
cn : $machine
ipHostNumber : $adresseip

EOF
done < listemachines.txt


et une petite commande du genre :

/opt/openldap/bin/ldapadd -f ldifhostadd.ldif -H ldap://localhost/ -D cn=root-ldap,dc=mondomaine,dc=com -x -W -c

apt-get install dante

Le configurer (cf code)

Utiliser IPTABLES pour rediriger le port 443 vers le port ouvert pour le proxy :

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 1111

# cat /etc/danted.conf
# $Id: sockd.conf,v 1.41 2001/12/12 13:56:41 karls Exp $
#
# A sample sockd.conf
#
#
# The configfile is divided into two parts; first serversettings,
# then the rules.
#
# The recommended order is:
# Serversettings:
# logoutput
# internal
# external
# method
# clientmethod
# users
# compatibility
# extension
# connecttimeout
# iotimeout
# srchost
#
# Rules:
# client block/pass
# from to
# libwrap
# log
#
# block/pass
# from to
# method
# command
# libwrap
# log
# protocol
# proxyprotocol

# the server will log both via syslog, to stdout and to /var/log/lotsoflogs
#logoutput: syslog stdout /var/log/lotsoflogs
logoutput: stderr

# The server will bind to the address 10.1.1.1, port 1080 and will only
# accept connections going to that address.
#internal: 10.1.1.1 port = 1080
# Alternatively, the interface name can be used instead of the address.
internal: eth0 port = 1080

# all outgoing connections from the server will use the IP address
# 195.168.1.1
external: 88.191.93.215

# list over acceptable methods, order of preference.
# A method not set here will never be selected.
#
# If the method field is not set in a rule, the global
# method is filled in for that rule.
#

# methods for socks-rules.
#method: username none #rfc931

# methods for client-rules.
#clientmethod: none

#or if you want to allow rfc931 (ident) too
#method: username rfc931 none

#or for PAM authentification
#method: pam

#
# An important section, pay attention.
#

# when doing something that can require privilege, it will use the
# userid:
user.privileged: proxy

# when running as usual, it will use the unprivileged userid of:
user.notprivileged: nobody

# If you compiled with libwrap support, what userid should it use
# when executing your libwrap commands? « libwrap ».
user.libwrap: nobody

#
# some options to help clients with compatibility:
#

# when a client connection comes in the socksserver will try to use
# the same port as the client is using, when the socksserver
# goes out on the clients behalf (external: IP address).
# If this option is set, Dante will try to do it for reserved ports aswell.
# This will usually require user.privileged to be set to « root ».
#compatibility: sameport

# If you are using the bind extension and have trouble running servers
# via the server, you might try setting this. The consequences of it
# are unknown.
#compatibility: reuseaddr

#
# The Dante server supports some extensions to the socks protocol.
# These require that the socks client implements the same extension and
# can be enabled using the « extension » keyword.
#
# enable the bind extension.
#extension: bind

#
#
# misc options.
#

# how many seconds can pass from when a client connects til it has
# sent us it’s request? Adjust according to your network performance
# and methods supported.
#connecttimeout: 30 # on a lan, this should be enough if method is « none ».

# how many seconds can the client and it’s peer idle without sending
# any data before we dump it? Unless you disable tcp keep-alive for
# some reason, it’s probably best to set this to 0, which is
# « forever ».
#iotimeout: 0 # or perhaps 86400, for a day.

# do you want to accept connections from addresses without
# dns info? what about addresses having a mismatch in dnsinfo?
#srchost: nounknown nomismatch

#
# The actual rules. There are two kinds and they work at different levels.
#
# The rules prefixed with « client » are checked first and say who is allowed
# and who is not allowed to speak/connect to the server. I.e the
# ip range containing possibly valid clients.
# It is especially important that these only use IP addresses, not hostnames,
# for security reasons.
#
# The rules that do not have a « client » prefix are checked later, when the
# client has sent its request and are used to evaluate the actual
# request.
#
# The « to: » in the « client » context gives the address the connection
# is accepted on, i.e the address the socksserver is listening on, or
# just « 0.0.0.0/0″ for any address the server is listening on.
#
# The « to: » in the non- »client » context gives the destination of the clients
# socksrequest.
#
# « from: » is the source address in both contexts.
#

# the « client » rules. All our clients come from the net 10.0.0.0/8.
#

# Allow our clients, also provides an example of the port range command.
#client pass {
# from: 10.0.0.0/8 port 1-65535 to: 0.0.0.0/0
# method: rfc931 # match all idented users that also are in passwordfile
#}

# This is identical to above, but allows clients without a rfc931 (ident)
# too. In practise this means the socksserver will try to get a rfc931
# reply first (the above rule), if that fails, it tries this rule.
#client pass {
# from: 10.0.0.0/8 port 1-65535 to: 0.0.0.0/0
#}

# drop everyone else as soon as we can and log the connect, they are not
# on our net and have no business connecting to us. This is the default
# but if you give the rule yourself, you can specify details.
#client block {
# from: 0.0.0.0/0 to: 0.0.0.0/0
# log: connect error
#}

# the rules controlling what clients are allowed what requests
#

# you probably don’t want people connecting to loopback addresses,
# who knows what could happen then.
#block {
# from: 0.0.0.0/0 to: 127.0.0.0/8
# log: connect error
#}

# the people at the 172.16.0.0/12 are bad, no one should talk to them.
# log the connect request and also provide an example on how to
# interact with libwrap.
#block {
# from: 0.0.0.0/0 to: 172.16.0.0/12
# libwrap: spawn finger @%a
# log: connect error
#}

# unless you need it, you could block any bind requests.
#block {
# from: 0.0.0.0/0 to: 0.0.0.0/0
# command: bind
# log: connect error
#}

# or you might want to allow it, for instance « active » ftp uses it.
# Note that a « bindreply » command must also be allowed, it
# should usually by from « 0.0.0.0/0″, i.e if a client of yours
# has permission to bind, it will also have permission to accept
# the reply from anywhere.
#pass {
# from: 10.0.0.0/8 to: 0.0.0.0/0
# command: bind
# log: connect error
#}

# some connections expect some sort of « reply », this might be
# the reply to a bind request or it may be the reply to a
# udppacket, since udp is packetbased.
# Note that nothing is done to verify that it’s a « genuine » reply,
# that is in general not possible anyway. The below will allow
# all « replies » in to your clients at the 10.0.0.0/8 net.
#pass {
# from: 0.0.0.0/0 to: 10.0.0.0/8
# command: bindreply udpreply
# log: connect error
#}

# pass any http connects to the example.com domain if they
# authenticate with username.
# This matches « example.com » itself and everything ending in « .example.com ».
#pass {
# from: 10.0.0.0/8 to: .example.com port = http
# log: connect error
# method: username
#}

# block any other http connects to the example.com domain.
#block {
# from: 0.0.0.0/0 to: .example.com port = http
# log: connect error
#}

# everyone from our internal network, 10.0.0.0/8 is allowed to use
# tcp and udp for everything else.
#pass {
# from: 10.0.0.0/8 to: 0.0.0.0/0
# protocol: tcp udp
#}

# last line, block everyone else. This is the default but if you provide
# one yourself you can specify your own logging/actions
pass {
from: 0.0.0.0/0 port 1-65535 to: 0.0.0.0/0
protocol: tcp udp
}