分类: Linux系统

  • vsftpd简单设置

    cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.bak

    cat /etc/vsftpd/vsftpd.conf
    anonymous_enable=NO
    anon_upload_enable=NO
    no_anon_password=YES
    anon_world_readable_only=NO
    anon_mkdir_write_enable=NO
    anon_other_write_enable=NO
    local_enable=YES
    write_enable=YES
    local_umask=022
    file_open_mode=0755
    chroot_local_user=yes
    dirmessage_enable=YES
    xferlog_enable=YES
    connect_from_port_20=YES
    xferlog_std_format=YES
    ftpd_banner=Welcome to blah FTP service.
    pam_service_name=vsftpd
    userlist_enable=YES
    listen=YES
    tcp_wrappers=YES
    max_per_ip=10

    用户设置
    useradd ftpxxx -G ftp -d /var/xxxx -M
    useradd ftpxxx -G ftp,apache -d /var/www/html/XXXX/ -M
    passwd ftpxxx xxxxxx
    chown ftpxxx.ftp /var/xxxx
    chmod 755 /var/xxxx

  • CentOS Linux安装Atomic源

    CentOS Linux安装Atomic源
    Atomic源支持Fedora,RHEL和CentOS
    wget -q -O – http://www.atomicorp.com/installers/atomic | sh

    Atomic Free Unsupported Archive installer, version 2.0.12

    BY INSTALLING THIS SOFTWARE AND BY USING ANY AND ALL SOFTWARE
    PROVIDED BY ATOMICORP LIMITED YOU ACKNOWLEDGE AND AGREE:

    THIS SOFTWARE AND ALL SOFTWARE PROVIDED IN THIS REPOSITORY IS
    PROVIDED BY ATOMICORP LIMITED AS IS, IS UNSUPPORTED AND ANY
    EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ATOMICORP LIMITED, THE
    COPYRIGHT OWNER OR ANY CONTRIBUTOR TO ANY AND ALL SOFTWARE PROVIDED
    BY OR PUBLISHED IN THIS REPOSITORY BE LIABLE FOR ANY DIRECT,
    INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
    OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
    STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
    OF THE POSSIBILITY OF SUCH DAMAGE.

    ====================================================================
    THIS SOFTWARE IS UNSUPPORTED.  IF YOU REQUIRE SUPPORTED SOFWARE
    PLEASE SEE THE URL BELOW TO PURCHASE A NUCLEUS LICENSE AND DO NOT
    PROCEED WITH INSTALLING THIS PACKAGE.
    ====================================================================

    For supported software packages please purchase a Nucleus license:
    https://www.atomicorp.com/products/nucleus.html
    All atomic repository rpms are UNSUPPORTED.
    Do you agree to these terms? (yes/no) [Default: yes]

    Configuring the [atomic] yum archive for this system

    Installing the Atomic GPG key:
    OK
    Downloading atomic-release-1.0-19.el6.art.noarch.rpm:
    OK

    The Atomic Rocket Turtle archive has now been installed and configured for your system
    The following channels are available:
    atomic          – [ACTIVATED] – contains the stable tree of ART packages
    atomic-testing  – [DISABLED]  – contains the testing tree of ART packages
    atomic-bleeding – [DISABLED]  – contains the development tree of ART packages

  • Linux svn 配置(转)

    http://www.iitshare.com/linux-svn-installation-and-configuration.html

    svn服务器有2种运行方式

    1.独立服务器 (例如:svn://xxx.com/xxx);
    2.借助apache。(例如:http://svn.xxx.com/xxx);
    为了不依赖apache,选择第一种方式-独立的svn服务器。
    svn存储版本数据也有2种方式:
    1.bdb;
    2.fsfs。
    因为BDB方式在服务器中断时,有可能锁住数据(搞ldap时就深受其害,没法根治),所以还是FSFS方式更安全一点,我也选择这种方式。
    我的系统环境:Centos-6.2 + Php-5.4.3 + Nginx-1.3.0 + Mysql-5.5.25 + subversion-1.6.6

    下载相关软件

    wget http://subversion.tigris.org/downloads/subversion-1.6.6.tar.gz
    wget http://subversion.tigris.org/downloads/subversion-deps-1.6.6.tar.gz

    编辑

    1、查看是否安装了svn工具
    命令:rpm -qa | grep subversion
    如果服务器已经安装了则不需要进行安装,如果没有安装可以进行全新的安装
    2、首先检测系统有没有安装SSL:
    find / -name opensslv.h
    如果找不到,就执行如下命令进行安装:
    yum install openssl
    yum install openssl-devel
    安装之后用find / -name opensslv.h命令找到opensslv.h所在的目录,即下列–with-openssl=后面的路径,
    3、解压svn安装文件
    subversion-1.6.6.tar.gz
    subversion-deps-1.6.6.tar.gz
    命令如下:

    12 tar zxvf subversion-1.6.6.tar.gztar zxvf subversion-deps-1.6.6.tar.gz

    tar 为解压命令,zxvf为tar命令的参数,用于解压tar.gz格式压缩的文件。
    解压后生成 subversion-1.6.6 子目录,两个压缩包解压后都会自动放到此目录下,不用手动更改。
    进入解压子目录 cd subversion-1.6.6 进行编译。
    4、编译:

    12 ./configure –prefix=/usr/local/svn –with-openssl=/usr/include/openssl–without-berkeley-db

    后面以svnserve方式运行,所以不加apache编译参数。以fsfs格式存储版本库,不编译berkeley-db
    如果编译时报如下错误:
    no acceptable C compiler found in $PATH
    说明没有gcc库,使用如下命令安装gcc后再编译:
    yum -y install gcc
    如果最后出现下面WARNING,我们直接忽略即可,因为不使用BDB存储。

    123

    4

    5

    6

    7

    8

    configure: WARNING: we have configured without BDB filesystem supportYou don’t seem to have Berkeley DB version 4.0.14 or newerinstalled and linked to APR-UTIL. We have created Makefiles which

    will build without the Berkeley DB back-end; your repositories will

    use FSFS as the default back-end. You can find the latest version of

    Berkeley DB here:

     

    http://www.sleepycat.com/download/index.shtml

    安装

    make
    make install
    如果 make install 出现下面错误:
    /home/upload/subversion-1.6.6/subversion/svnversion/.libs/lt-svnversion: error while loading shared libraries: libiconv.so.2: cannot open shared object file: No such file or directory
    make: *** [revision-install] Error 127
    解决办法:
    1、编辑/etc/ld.so.conf文件
    vi /etc/ld.so.conf
    添加下面一行代码
    /usr/local/lib
    2、保存后运行ldconfig:
    /sbin/ldconfig
    注:ld.so.conf和ldconfig用于维护系统动态链接库。
    3、然后再安装
    make && make install
    测试是否安装成功

    1 /usr/local/svn/bin/svnserve –version

    如果显示如下,svn安装成功:

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    13

    svnserve, version 1.6.6 (r40053)compiled Dec 25 2012, 13:14:38 

    Copyright (C) 2000-2009 CollabNet.

    Subversion is open source software, see http://subversion.tigris.org/

    This product includes software developed by CollabNet

    (http://www.Collab.Net/).

     

    The following repository back-end (FS) modules are available:

     

    * fs_fs : Module for working with a plain file (FSFS) repository.

     

    Cyrus SASL authentication is available.

    4、为了方便下操作,把svn相关的命令添加到环境变量中:
    echo “export PATH=$PATH:/usr/local/svn/bin/” >> /etc/profile
    source /etc/profile

    配置svn

    1、建立SVN的根目录
    mkdir -p /opt/svn/
    2、建立一个产品仓库
    mkdir -p /opt/svn/tshop/
    svnadmin create /opt/svn/tshop/
    如果你们的研发中心有多个产品组,每个产品组可以建立一个SVN仓库
    3、修改版本配置库文件
    vi /opt/svn/tshop/conf/svnserve.conf
    修改后的文件内容如下:

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    13

    14

    15

    16

    17

    18

    19

    20

    21

    22

    23

    24

    25

    26

    27

    28

    29

    30

    31

    32

    33

    34

    35

    36

    37

    38

    39

    40

    41

    42

    43

    44

    45

    46

    47

    ### This file controls the configuration of the svnserve daemon, if you### use it to allow access to this repository.  (If you only allow### access through http: and/or file: URLs, then this file is

    ### irrelevant.)

     

    ### Visit http://subversion.tigris.org/ for more information.

     

    [general]

    ### These options control access to the repository for unauthenticated

    ### and authenticated users.  Valid values are “write”, “read”,

    ### and “none”.  The sample settings below are the defaults.

    anon-access = none # 注意这里必须设置,否则所有用户不用密码就可以访问

    auth-access = write

    ### The password-db option controls the location of the password

    ### database file.  Unless you specify a path starting with a /,

    ### the file’s location is relative to the directory containing

    ### this configuration file.

    ### If SASL is enabled (see below), this file will NOT be used.

    ### Uncomment the line below to use the default password file.

    password-db = passwd

    ### The authz-db option controls the location of the authorization

    ### rules for path-based access control.  Unless you specify a path

    ### starting with a /, the file’s location is relative to the the

    ### directory containing this file.  If you don’t specify an

    ### authz-db, no path-based access control is done.

    ### Uncomment the line below to use the default authorization file.

    authz-db = authz

    ### This option specifies the authentication realm of the repository.

    ### If two repositories have the same authentication realm, they should

    ### have the same password database, and vice versa.  The default realm

    ### is repository’s uuid.

    realm = tshop

     

    [sasl]

    ### This option specifies whether you want to use the Cyrus SASL

    ### library for authentication. Default is false.

    ### This section will be ignored if svnserve is not built with Cyrus

    ### SASL support; to check, run ‘svnserve –version’ and look for a line

    ### reading ‘Cyrus SASL authentication is available.’

    # use-sasl = true

    ### These options specify the desired strength of the security layer

    ### that you want SASL to provide. 0 means no encryption, 1 means

    ### integrity-checking only, values larger than 1 are correlated

    ### to the effective key length for encryption (e.g. 128 means 128-bit

    ### encryption). The values below are the defaults.

    # min-encryption = 0

    # max-encryption = 256

    对用户配置文件的修改是立即生效的,不必重启svn。
    4、开始设置passwd用户账号信息

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    13

    vi /data/svn/repos/conf/passwd修改完之后的内容如下:### This file is an example password file for svnserve.

    ### Its format is similar to that of svnserve.conf. As shown in the

    ### example below it contains one section labelled [users].

    ### The name and password for each user follow, one account per line.

    ### 在下面添加用户和密码,每行一组username = password

    [users]

    # harry = harryssecret

    # sally = sallyssecret

    ###===========下面是我添加的用户信息========#######

    iitshare = password1

    itblood = password2

    5、开始设置authz. 用户访问权限
    vi /data/svn/repos/conf/authz
    修改完之后的内容如下:

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    13

    14

    15

    16

    17

    18

    19

    20

    21

    22

    23

    24

    25

    26

    27

    28

    29

    30

    31

    32

    33

    34

    35

    36

    37

    38

    39

    40

    41

    42

    43

    44

    45

    46

    47

    48

    49

    50

    ### This file is an example authorization file for svnserve.### Its format is identical to that of mod_authz_svn authorization### files.

    ### As shown below each section defines authorizations for the path and

    ### (optional) repository specified by the section name.

    ### The authorizations follow. An authorization line can refer to:

    ###  – a single user,

    ###  – a group of users defined in a special [groups] section,

    ###  – an alias defined in a special [aliases] section,

    ###  – all authenticated users, using the ‘$authenticated’ token,

    ###  – only anonymous users, using the ‘$anonymous’ token,

    ###  – anyone, using the ‘*’ wildcard.

    ###

    ### A match can be inverted by prefixing the rule with ‘~’. Rules can

    ### grant read (‘r’) access, read-write (‘rw’) access, or no access

    ### (”).

     

    [aliases]

    # joe = /C=XZ/ST=Dessert/L=Snake City/O=Snake Oil,

    Ltd./OU=Research Institute/CN=Joe Average

     

    # [groups]

    # harry_and_sally = harry,sally

    # harry_sally_and_joe = harry,sally,&joe

     

    # [/foo/bar]

    # harry = rw

    # &joe = r

    # * =

     

    # [repository:/baz/fuz]

    # @harry_and_sally = rw

    # * = r

     

    ###——————–下面我新加的————————###

    ###屏蔽掉上面的[groups] 因为在下面添加了

     

    [groups]

    devteam = iitshare, itblood #devteam 项目组包括两个用户iitshare,itblood

     

    [/]

    iitshare = rw

    itblood =

    [tshop:/tb2c]

    @devteam = rw

    itblood =

     

    [tshop:/tb2b2c]

    @devteam = rw

    itblood = r

    其中,1个用户组可以包含1个或多个用户,用户间以逗号分隔。
    说明:

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    devteam = iitshare, itblood #devteam 项目组包括两个用户iitshare,itblood[/]iitshare = rw #iitshare 对根目录有读写权限

    itblood = #itblood 对根目录没有任何权限

    ####如果需要配置tb2c、tb2b2c项目的权限,前提条件是tshop仓库下面需要有这两个项目

    ####如果没有的话,tshop都将不能访问

    [tshop:/tb2c] #对tshop仓库的tb2c项目进行权限控制

    @devteam = rw #控制 devteam 组对tb2c项目有读写权限

    itblood = #限制 itblood 所有权限,其它用户有读写权限

    [tshop:/tb2b2c] #对 tshop: 仓库的 tb2b2c 项目进行权限控制

    @devteam = rw #限制 devteam 组对tb2b2c项目有读写权限

    itblood = r #限制 itblood 只有读权限,其它用户有读写权限

    6、注意:
    * 权限配置文件中出现的用户名必须已在用户配置文件中定义。
    * 对权限配置文件的修改立即生效,不必重启svn。
    用户组格式:

    123

    4

    5

    6

    7

    [groups]= ,其中,1个用户组可以包含1个或多个用户,用户间以逗号分隔。

    版本库目录格式:

    [<版本库>:/项目/目录]

    @<用户组名> = <权限>

    <用户名> = <权限>

    其中,方框号内部分可以有多种写法:
    [/],表示根目录及以下,根目录是svnserve启动时指定的,我们指定为/home/svndata,[/]就是表示对全部版本库设置权限。
    [tshop:/] 表示对版本库tshop设置权限;
    [tshop:/abc] 表示对版本库tshop中的abc项目设置权限;
    [tshop:/abc/aaa] 表示对版本库tshop中的abc项目的aaa目录设置权限;
    权限主体可以是用户组、用户或*,用户组在前面加@,*表示全部用户。
    权限可以是w、r、wr和空,空表示没有任何权限。
    7、建立启动svn的用户
    useradd svn
    根据提示,为用户svn设置密码
    允许用户svn访问版本库:
    chown -R svn:svn /opt/svn
    8、启动svn:
    方式一:svnserve -d -r /opt/svn/ #默认的启动端口号为3690
    方式二:su – svn -c “svnserve -d –listen-port 9999 -r /opt/svn/”
    其中:
    su – svn表示以用户svn的身份启动svn;
    -d表示以daemon方式(后台运行)运行;
    –listen-port 9999表示使用9999端口,可以换成你需要的端口。但注意,使用1024以下的端口需要root权限;
    -r /opt/svn 指定根目录是/opt/svn。
    9、检查是否启动
    netstat -tunlp | grep svn
    如果显示以下信息说明启动成功
    tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 10973/svnserve
    10、将svn加入到开机启动
    编辑rc.local文件:vi /etc/rc.d/rc.local
    加入如下启动命令:
    /usr/local/svn/bin/svnserve -d –listen-port 9999 -r /opt/svn
    11、如果想停止svn,则使用如下命令:
    killall svnserve
    12、如果想将svn作为服务:
    在/etc/rc.d/init.d/目录下新建名为svn的文件
    并设置权限为755:chmod 755 /etc/rc.d/init.d/svn
    编辑svn文件:vi /etc/rc.d/init.d/svn, 在里面添加如下代码:

    123

    4

    5

    6

    7

    8

    9

    10

    11

    12

    13

    14

    15

    16

    17

    18

    19

    20

    21

    22

    23

    24

    25

    26

    27

    28

    29

    #!/bin/bash# build this file in /etc/rc.d/init.d/svn# chmod 755 /etc/rc.d/init.d/svn

    # centos下可以用如下命令管理svn: service svn start(restart/stop)

    SVN_HOME=/opt/svn

    if [ ! -f “/usr/local/svn/bin/svnserve” ]

    then

    echo “svnserver startup: cannot start”

    exit

    fi

    case “$1” in

    start)

    echo “Starting svnserve…”

    /usr/local/svn/bin/svnserve -d –listen-port 9999 -r $SVN_HOME

    echo “Finished!”

    ;;

    stop)

    echo “Stoping svnserve…”

    killall svnserve

    echo “Finished!”

    ;;

    restart)

    $0 stop

    $0 start

    ;;

    *)

    echo “Usage: svn { start | stop | restart } ”

    exit 1

    esac

    之后便可以以service svn start(restart/stop)方式启动SVN。
    通过web方式访问svn有很多方法,请参阅配置websvn或配置bsSvnBrowser的方法

    客户端访问

    1、下载安装文件
    window 64位的话下载:TortoiseSVN-1.7.6.22632-x64-svn-1.7.4.msi
    window 32位的话下载:TortoiseSVN-1.6.5.16974-win32-svn-1.6.5.msi
    具体的下载文件可以在网上下载下,一找一大堆
    2、通过客户端进行访问
    地址如下:
    svn://{your-server-ip}:9999/tshop/ 或者 svn://{your-server-ip}:3690/tshop/
    注意:
    不要在浏览器中通过http的方式进行访问,如下地址:
    http://{your-server-ip}:9999/tshop/ 或者 http://{your-server-ip}:3690/tshop/
    那样肯定是不行的,因为你没有配置http的服务,上面是安装独立的SVN服务器

     

    问题:svnserve.conf:12: Option expected

    为什么会出现这个错误呢,就是因为subversion读取配置文件svnserve.conf时,无法识别有前置空格的配置文件,anon-access是顶行的,没问题,而auth-access就存在前置空格,会导致这个错误。
    要避免出现这个错误,应该在去掉这些行前的#时,也要顺手去掉前面的空格

    问题:ERR subversion/svnserve/serve.c 167 170001 Authorization failed

    问题解决:
    http://hi.baidu.com/tianfu_xue/blog/item/9dbfd6fa4d416d839f51462b.html

    出现该问题基本都是三个配置文件的问题,下面把这个文件列出来。

    svnserve.conf:
    [general]
    anon-access = read
    auth-access = write
    password-db = passwd
    authz-db = authz

    passwd:
    [users]
    harry = harryssecret

    authz:
    [groups]
    [/]
    harry = rw

    出现authorization failed异常,一般都是authz文件里,用户组或者用户权限没有配置好,只要设置[/]就可以,代表根目录下所有的资源,如果要限定资源,可以加上子目录即可。

  • RHEL/CentOS 6.x 系统服务详解

    PS:RHEL/CentOS 6.x的系统服务比5.x系列的要多了很多新面孔,估计很多童鞋不甚理解,网上这方面资料也很少。理解这个对运维人员是必要的,因为开启不必要的服务越多,系统就相对越不安全。不需开启的服务尽量关闭。本人结合自己的应用经验做一些讲解说明,有不同理解的童鞋欢迎交流。

    1、下面列表是在RHEL/CentOS 6.x最小化桌面环境安装下显示出来的系统服务,其中红色字体标注的是用官方的minimal ISO最小化安装系统后的服务列表。

    服务名称 功能  默认   建议  备注说明
    NetworkManager 用于自动连接网络,常用在Laptop上 开启 关闭 对服务器无用
    abrt-ccpp 开启 自定 对服务器无用
    abrt-oops 开启 自定 对服务器无用
    abrtd 开启 自定 对服务器无用
    acpid 电源的开关等检测管理,常用在Laptop上 开启 自定 对服务器无用
    atd 在指定时间执行命令 开启 关闭 如果用crond,则可关闭它
    auditd 审核守护进程 开启 开启 如果用selinux,需要开启它
    autofs 文件系统自动加载和卸载 开启 自定 只在需要时开启它,可以关闭
    avahi-daemon 本地网络服务查找 开启 关闭 对服务器无用
    bluetooth 蓝牙无线通讯 开启 关闭 对服务器无用
    certmonger 关闭 关闭
    cpuspeed 调节cpu速度用来省电,常用在Laptop上 开启 关闭 对服务器无用
    crond 计划任务管理 开启 开启 常用,开启
    cups 通用unix打印服务 开启 关闭 对服务器无用
    dnsmasq dns cache 关闭 关闭 DNS缓存服务,无用
    firstboot 系统安装后初始设定 关闭 关闭
    haldaemon 硬件信息收集服务 开启 开启
    ip6tables ipv6防火墙 开启 关闭 用到ipv6网络的就用,一般关闭
    iptables ipv4防火墙 开启 开启 ipv4防火墙服务
    irqbalance cpu负载均衡 开启 自定 多核cup需要
    kdump 硬件变动检测 关闭 关闭 服务器无用
    lvm2-monitor lvm监视 开启 自定 如果使用LVM逻辑卷管理就开启
    matahari-broker 关闭 关闭 此服务不清楚,我关闭
    matahari-host 关闭 关闭 此服务不清楚,我关闭
    matahari-network 关闭 关闭 此服务不清楚,我关闭
    matahari-service 关闭 关闭 此服务不清楚,我关闭
    matahari-sysconfig 关闭 关闭 此服务不清楚,我关闭
    mdmonitor 软raid监视 开启 自定
    messagebus 负责在各个系统进程之间传递消息 开启 开启 如停用,haldaemon启动会失败
    netconsole 关闭 关闭
    netfs 系统启动时自动挂载网络文件系统 开启 关闭 如果使用nfs服务,就开启
    network 系统启动时激活所有网络接口 开启 开启 网络基础服务,必需!
    nfs 网络文件系统 关闭 关闭 nfs文件服务,用到就开启
    nfslock nfs相关 开启 关闭 nfs相关服务,用到就开启
    ntpd 自动对时工具 关闭 自定 网络对时服务,用到就开启
    ntpdate 自动对时工具 关闭 关闭
    oddjobd 与D-BUS相关 关闭 关闭
    portreserve RPC 服务相关 开启 自定 可以关闭
    postfix 替代sendmail的邮件服务器 开启 自定 如果无邮件服务,可关闭
    psacct 负荷检测 关闭 关闭 可以关闭
    qpidd 消息通信 开启 开启
    quota_nld 关闭 关闭 可以关闭
    rdisc 自动检测路由器 关闭 关闭
    restorecond selinux相关 关闭 关闭 如果开启了selinux,就需开启
    rpcbind 开启 开启 关键的基础服务,nfs服务和桌面环境都依赖此服务!相当于CentOS 5.x里面的portmap服务。
    rpcgssd NFS相关 开启 关闭 NFS相关服务,可选
    rpcidmapd RPC name to UID/GID mapper 开启 关闭 NFS相关服务,可选
    rpcsvcgssd NFS相关 关闭 关闭 NFS相关服务,可选
    rsyslog 提供系统的登录档案记录 开启 开启 系统日志关键服务,必需!
    saslauthd sasl认证服务相关 关闭 关闭
    smartd 硬盘自动检测守护进程 关闭 关闭
    spice-vdagentd 开启 开启
    sshd ssh服务端,可提供安全的shell登录 开启 开启 SSH远程登录服务,必需!
    sssd 关闭 关闭
    sysstat 开启 开启 一组系统监控工具的服务,常用
    udev-post 设备管理系统 开启 开启
    wdaemon 关闭 关闭
    wpa_supplicant 无线认证相关 关闭 关闭
    ypbind network information service客户端 关闭

    2、系统服务管理工具:

    chkconfig(所有linux发行版都有),用法很简单,如下:

    usage: chkconfig –list [name]
    chkconfig –add
    chkconfig –del
    chkconfig [–level ] <on|off|reset|resetpriorities>
    ntsysv(Redhat系发行版特有),直接运行选择服务是否自启动。

    3、查看系统服务的相关说明:
    在RHEL/CentOS下这些系统服务都是Shell脚本,我们可以使用rpm的命令参数来查看相应服务的说明。如想查看mysqld服务的说明:

    # rpm -qi $(rpm -qf /etc/init.d/mysqld)
    如图所示:
    mysqld

    [root@CentOS6-x64 ~]# rpm -qi $(rpm -qf /etc/init.d/mysqld )
    Name : mysql-server Relocations: (not relocatable)
    Version : 5.5.25 Vendor: Remi Collet
    Release : 1.el6.remi Build Date: 2012年06月01日 星期五 23时56分58

    Install Date: 2012年06月11日 星期一 04时43分06秒 Build Host: dixsept.famillecollet.
    com
    Group : Applications/Databases Source RPM: mysql-5.5.25-1.el6.remi.src.rpm
    Size : 46861045 License: GPLv2 with exceptions
    Signature : DSA/SHA1, 2012年06月01日 星期五 23时58分04秒, Key ID 004e6f4700f97f56
    Packager : http://blog.famillecollet.com/
    URL : http://www.mysql.com
    Summary : The MySQL server and related files
    Description :
    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a
    client/server implementation consisting of a server daemon (mysqld)
    and many different client programs and libraries. This package contains
    the MySQL server and some accompanying files and directories.

  • Ubuntu Update 404 Not Found

    提示
    W: 无法下载 http://mirrors.aliyun.com/ubuntu/dists/raring-backports/restricted/b inary-i386/Packages 404 Not Found [IP: 112.124.140.210 80]

    Ubuntu 11.04 (Natty) 已经停止支持,但可以使用old-releases源了,先备份源列表文件:
    sudo cp /etc/apt/sources.list /etc/apt/sources.list.backup

    sudo gedit /etc/apt/sources.list
    把里面的内容替换为以下内容:
    deb http://old-releases.ubuntu.com/ubuntu/ natty main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ natty-security main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ natty-updates main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ natty-proposed main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ natty-backports main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ natty main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ natty-security main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ natty-updates main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ natty-proposed main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ natty-backports main restricted universe multiverse

    重载源列表,使配置生效:
    sudo apt-get update

  • Apache2.4虚拟主机设置

    //配置虚拟机主机

    cd/etc/httpd/
    mkdir vhost-conf.d
    添加 配置进 httpd.conf
    echo “Include vhost-conf.d/*.conf” >> conf/httpd.conf

    vi/etc/httpd/vhost-conf.d/vhost-name.conf

    //添加如下内容


    ServerName www.xxx.com
    DocumentRoot /var/www/html/www/


    Requireall granted


    ServerName aaa.xxx.com
    DocumentRoot /var/www/html/aaa/


    Require ip 192.168.188.0/24 //可以设置访问限制

    ##############################################3
    另外一个例子

    #端口自定
    ServerAdmin xxx@mail.com
    DocumentRoot “绝对路径”
    ServerName localadm
    ErrorLog logs/dummy-host.example.com-error_log
    CustomLog logs/dummy-host.example.com-access_log common


    ServerAdmin 邮箱
    DocumentRoot “绝对路径”
    ServerName localadm
    ErrorLog logs/dummy-host.example.com-error_log
    CustomLog logs/dummy-host.example.com-access_log common

  • CentOS 7.0安装配置LAMP服务器(Apache+PHP+MariaDB)

    准备篇:
    CentOS 7.0系统安装配置图解教程
    http://www.osyunwei.com/archives/7829.html
    一、配置防火墙,开启80端口、3306端口
    CentOS 7.0默认使用的是firewall作为防火墙,这里改为iptables防火墙。
    1、关闭firewall:
    systemctl stop firewalld.service #停止firewall
    systemctl disable firewalld.service #禁止firewall开机启动
    2、安装iptables防火墙
    yum install iptables-services #安装
    vi /etc/sysconfig/iptables #编辑防火墙配置文件
    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
    -A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT
    -A INPUT -j REJECT –reject-with icmp-host-prohibited
    -A FORWARD -j REJECT –reject-with icmp-host-prohibited
    COMMIT
    :wq! #保存退出
    systemctl restart iptables.service #最后重启防火墙使配置生效
    systemctl enable iptables.service #设置防火墙开机启动
    二、关闭SELINUX
    vi /etc/selinux/config
    #SELINUX=enforcing #注释掉
    #SELINUXTYPE=targeted #注释掉
    SELINUX=disabled #增加
    :wq! #保存退出
    setenforce 0 #使配置立即生效
    安装篇:
    一、安装Apache

    系统运维  www.osyunwei.com  温馨提醒:qihang01原创内容©版权所有,转载请注明出处及原文链
    yum install httpd #根据提示,输入Y安装即可成功安装
    systemctl start httpd.service #启动apache
    systemctl stop httpd.service #停止apache
    systemctl restart httpd.service #重启apache
    systemctl enable httpd.service #设置apache开机启动
    在客户端浏览器中打开服务器IP地址,会出现下面的界面,说明apache安装成功

    系统运维  www.osyunwei.com  温馨提醒:qihang01原创内容©版权所有,转载请注明出处及原文链
    二、安装MariaDB
    CentOS 7.0中,已经使用MariaDB替代了MySQL数据库
    1、安装MariaDB

    yum install mariadb mariadb-server #询问是否要安装,输入Y即可自动安装,直到安装完成
    systemctl start mariadb.service #启动MariaDB
    systemctl stop mariadb.service #停止MariaDB
    systemctl restart mariadb.service #重启MariaDB
    systemctl enable mariadb.service #设置开机启动
    cp /usr/share/mysql/my-huge.cnf /etc/my.cnf #拷贝配置文件(注意:如果/etc目录下面默认有一个my.cnf,直接覆盖即可)
    2、为root账户设置密码

    mysql_secure_installation
    回车,根据提示输入Y
    输入2次密码,回车
    根据提示一路输入Y
    最后出现:Thanks for using MySQL!
    MySql密码设置完成,重新启动 MySQL:
    systemctl restart mariadb.service #重启MariaDB
    三、安装PHP
    1、安装PHP

    yum install php #根据提示输入Y直到安装完成
    2、安装PHP组件,使PHP支持 MariaDB
    yum install php-mysql php-gd libjpeg* php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-bcmath php-mhash
    #这里选择以上安装包进行安装,根据提示输入Y回车
    systemctl restart mariadb.service #重启MariaDB
    systemctl restart httpd.service #重启apache
    配置篇
    一、Apache配置
    vi /etc/httpd/conf/httpd.conf #编辑文件
    ServerSignature On  #添加,在错误页中显示Apache的版本,Off为不显示
    Options Indexes FollowSymLinks  #修改为:Options Includes ExecCGI FollowSymLinks(允许服务器执行CGI及SSI,禁止列出目录)
    #AddHandler cgi-script .cgi #修改为:AddHandler cgi-script .cgi .pl (允许扩展名为.pl的CGI脚本运行)
    AllowOverride None  #修改为:AllowOverride All (允许.htaccess)
    AddDefaultCharset UTF-8 #修改为:AddDefaultCharset GB2312 (添加GB2312为默认编码)
    #Options Indexes FollowSymLinks   #修改为 Options FollowSymLinks(不在浏览器上显示树状目录结构)
    DirectoryIndex index.html   #修改为:DirectoryIndex index.html index.htm Default.html Default.htm index.php(设置默认首页文件,增加index.php)
    MaxKeepAliveRequests 500  #添加MaxKeepAliveRequests 500 (增加同时连接数)
    :wq! #保存退出
    systemctl restart httpd.service #重启apache
    rm -f /etc/httpd/conf.d/welcome.conf /var/www/error/noindex.html #删除默认测试页
    二、php配置
    vi /etc/php.ini #编辑
    date.timezone = PRC #把前面的分号去掉,改为date.timezone = PRC
    disable_functions = passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,escapeshellcmd,dll,popen,disk_free_space,checkdnsrr,checkdnsrr,getservbyname,getservbyport,disk_total_space,posix_ctermid,posix_get_last_error,posix_getcwd, posix_getegid,posix_geteuid,posix_getgid, posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid, posix_getppid,posix_getpwnam,posix_getpwuid, posix_getrlimit, posix_getsid,posix_getuid,posix_isatty, posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid, posix_setpgid,posix_setsid,posix_setuid,posix_strerror,posix_times,posix_ttyname,posix_uname
    #列出PHP可以禁用的函数,如果某些程序需要用到这个函数,可以删除,取消禁用。
    expose_php = Off #禁止显示php版本的信息
    short_open_tag = ON #支持php短标签
    open_basedir = .:/tmp/  #设置表示允许访问当前目录(即PHP脚本文件所在之目录)和/tmp/目录,可以防止php木马跨站,如果改了之后安装程序有问题(例如:织梦内容管理系统),可以注销此行,或者直接写上程序的目录/data/www.osyunwei.com/:/tmp/
    :wq! #保存退出
    systemctl restart mariadb.service #重启MariaDB
    systemctl restart httpd.service #重启apache
    测试篇
    cd /var/www/html
    vi index.php #输入下面内容

    :wq! #保存退出
    在客户端浏览器输入服务器IP地址,可以看到如下图所示相关的配置信息!

    注意:apache默认的程序目录是/var/www/html
    权限设置:chown apache.apache -R /var/www/html
    至此,CentOS 7.0安装配置LAMP服务器(Apache+PHP+MariaDB)教程完成!

  • CentOS7和之前版本差别(部分)

    一、CentOS的Services使用了systemd来代替sysvinit管理
    systemd是服务管理程序,他整合了service和chkconfig的功能为一体,可以永久性或只在当前会话中启用/禁用服务。

    #查看正在运行的服务
    systemctl
    #以树形列出正在运行的进程,它可以递归显示控制组内容
    systemd-cgls

    #启动,停止,重启服务
    systemctl start foo.service
    systemctl stop foo.service
    systemctl restart foo.service

    #查看一个服务的状态
    systemctl status foo.service
    #开机时启用一个服务
    systemctl enable foo.service

    #开机时关闭一个服务
    systemctl disable foo.service

    #查看服务是否开机启动
    systemctl is-enabled foo.service

    例:开机启动sshd服务
    systemctl enable sshd.service

    启动一个服务:systemctl start postfix.service
    关闭一个服务:systemctl stop postfix.service
    重启一个服务:systemctl restart postfix.service
    显示一个服务的状态:systemctl status postfix.service
    在开机时启用一个服务:systemctl enable postfix.service
    在开机时禁用一个服务:systemctl disable postfix.service
    查看服务是否开机启动:systemctl is-enabled postfix.service;echo $?
    查看已启动的服务列表:systemctl list-unit-files|grep enabled

    说明:启用服务就是在当前“runlevel”的配置文件目录/etc/systemd/system/multi-user.target.wants/里,建立/usr/lib/systemd/system里面对应服务配置文件的软链接;禁用服务就是删除此软链接。
    查看了/usr/lib/systemd/system 里的文件,语法跟旧版/etc/init.d/里的系统服务脚本完全不同了。

    二、修改系统运行级别:

    1、systemd使用比sysvinit的运行级更为自由的target替代。第3运行级用multi-user.target替代。第5运行级用graphical.target替代。runlevel3.target和runlevel5.target分别是指向 multi-user.target和graphical.target的符号链接。
    可以使用下面的命令切换到“运行级别3 ”:
    systemctl isolate multi-user.target或systemctl isolate runlevel3.target
    可以使用下面的命令切换到“运行级别5 ”:
    systemctl isolate graphical.target或systemctl isolate runlevel5.target

    2、如何改变默认运行级别?
    systemd使用链接来指向默认的运行级别。在创建新的链接前,可以通过下面命令删除存在的链接: rm /etc/systemd/system/default.target
    默认启动运行级别3 :
    ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
    默认启动运行级别5 :
    ln -sf /lib/systemd/system/graphical.target/etc/systemd/system/default.target
    systemd不使用/etc/inittab文件。

    3、如何查看当前运行级别?
    旧的runlevel命令在systemd下仍然可以使用。可以继续使用它,尽管systemd使用 ‘target’ 概念(多个的 ‘target’ 可以同时激活)替换了之前系统的runlevel。
    等价的systemd命令是systemctl list-units –type=target

    三、其他配置工具:

    1、setup和ntsysv工具还是保留了,但是功能已大大减弱,以前ntsysv工具可以控制所有系统服务的自启动,现在只能控制少部分服务。
    2、/etc/resolv.conf这个DNS配置文件没变。
    3、/etc/sysconfig/network-scripts/ifcfg-ens192网卡配置文件名字和一些选项有所变化。
    4、引导方式改用grub2引导,grub2有如下特点:1、模块化设计;2、支持多体系硬件架构;3、支持国际化多语言;4、独立内存管理;5、支持脚本语言。

    附:systemd简介
    systemd是Linux下的一种init软件,由Lennart Poettering带头开发,并在LGPL 2.1及其后续版本许可证下开源发布。其开发目标是提供更优秀的框架以表示系统服务间的依赖关系,并依此实现系统初始化时服务的并行启动,同时达到降低Shell的系统开销的效果,最终代替现在常用的System V与BSD风格init程序。
    与多数发行版使用的System V风格init相比,systemd采用了以下新技术:
    采用Socket激活式与总线激活式服务,以提高相互依赖的各服务的并行运行性能;
    用cgroups代替PID来追踪进程,以此即使是两次fork之后生成的守护进程也不会脱离systemd的控制。
    从设计构思上说,由于systemd使用了cgroup与fanotify等组件以实现其特性,所以只适用于Linux。

  • Centos7 yum安装nginx

    安装准备依赖lib库
    yum install gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel

    安装Nginx
    安装之前,检查一下是否已经安装有nginx

    find -name nginx

    如果系统已经安装了nginx,那么就先卸载

    yum remove nginx

    yum安装nginx
    新建
    /etc/yum.repos.d/nginx.repo
    添加以下,以centos7为例

    [nginx]
    name=nginx repo
    baseurl=http://nginx.org/packages/mainline/rhel/7/$basearch/
    gpgcheck=0
    enabled=1

    rpm –import http://nginx.org/keys/nginx_signing.key

    yum install nginx
    /bin/systemctl status nginx.service

  • Ubuntu的crontab命令

    想要让cron执行你指定的任务,首先就要编辑crontab文件。crontab是一个文本文件,用来存放你要运行的命令。你可以以下命令

    crontab -e

    来打开你的用户所属的crontab文件。第一次用这个命令,会让你选择文本编辑器,我选的是vim。选定的编辑器也可以使用

    select-editor

    命令来更改。这点命令行中已经有足够的提示,就不多说了。

    打开后的crontab文件类似这种样子:

    1. # m h  dom mon dow   command
    2. */2 * * * * date >> ~/time.log

    第二行是我为了测试写的一个定期任务,它的意思是,每隔两分钟就执行 date >> ~/time.log 命令(记录当前时间到time.log文件)。你可以把它加入你的crontab中,然后保存退出。

    保存了crontab之后,我们还需要重启cron来应用这个计划任务。使用以下命令:

    1. sudo service cron restart

    下面稍微解释下crontab中每行的含义。crontab中的每一行代表一个定期执行的任务,分为6个部分。前5个部分表示何时执行命令,最后一 个部分表示执行的命令。每个部分以空格分隔,除了最后一个部分(命令)可以在内部使用空格之外,其他部分都不能使用空格。前5个部分分别代表:分钟,小 时,天,月,星期,每个部分的取值范围如下:

    分钟          0 – 59

    小时          0 – 23

    天              1 – 31

    月              1 – 12

    星期          0 – 6       0表示星期天

    除了这些固定值外,还可以配合星号(*),逗号(,),和斜线(/)来表示一些其他的含义:

    星号          表示任意值,比如在小时部分填写 * 代表任意小时(每小时)

    逗号          可以允许在一个部分中填写多个值,比如在分钟部分填写 1,3 表示一分钟或三分钟

    斜线          一般配合 * 使用,代表每隔多长时间,比如在小时部分填写 */2 代表每隔两分钟。所以 */1 和 * 没有区别

    */2 可以看成是能被2整除的任意值。

    以下是一些例子(省略了命令部分):

     

    1. * * * * *                  # 每隔一分钟执行一次任务
    2. 0 * * * *                  # 每小时的0点执行一次任务,比如6:0010:00
    3. 6,10 * 2 * *            # 每个月2号,每小时的6分和10分执行一次任务
    4. */3,*/5 * * * *          # 每隔3分钟或5分钟执行一次任务,比如10:0310:0510:06

    以上就是在cron中加入计划任务的基本知识。因为cron中的任务基本就是执行命令行,所以当然也会有权限问题。以上例子中的任务就是以你当前登录用户的权限执行的,如果你需要以root用户执行某个任务,可以在crontab前加上sudo。

    1. sudo crontab -e

    顺带一提,crontab文件对每个用户都是不同的,所以刚才设置的定期看时间的任务,在这里是看不到的。因为我们没有为root用户增加这样的计划任务。

    原文

    https://help.ubuntu.com/community/CronHowto

    Introduction

    Cron is a system daemon used to execute desired tasks (in the background) at designated times.

    A crontab is a simple text file with a list of commands meant to be run at specified times. It is edited with a command-line utility. These commands (and their run times) are then controlled by the cron daemon, which executes them in the system background. Each user has a crontab file which specifies the actions and times at which they should be executed, these jobs will run regardless of whether the user is actually logged into the system. There is also a root crontab for tasks requiring administrative privileges. This system crontab allows scheduling of systemwide tasks (such as log rotations and system database updates).

    More information can be found:

     man crontab

    or from the OpenGroup specifications.

    On Gnome-based Ubuntu systems Gnome Scheduled tasks tool (from the gnome-schedule package) in Applications –> System Tools provides a graphical interface with prompting for using Cron. The project website is at http://gnome-schedule.sourceforge.net/; the software is installable from the Software Center or by typing

    sudo apt-get install gnome-schedule

    in a terminal.

    Using Cron

    To use cron for tasks meant to run only for your user profile, add entries to your own user’s crontab file. Start the crontab editor from a terminal window:

    crontab -e

    Edit the crontab using the format described in the next sections. Save your changes. (Exiting without saving will leave your crontab unchanged.)

    Note that a great source of information about the format can be found at:

    man 5 crontab

    Commands that normally run with administrative privileges (i.e. they are generally run using sudo) should be added to the root user’s crontab (instead of the user’s crontab):

     sudo crontab -e

    Crontab Sections

    Each of the sections is separated by a space, with the final section having one or more spaces in it. No spaces are allowed within Sections 1-5, only between them. Sections 1-5 are used to indicate when and how often you want the task to be executed. This is how a cron job is laid out:

    minute (0-59), hour (0-23, 0 = midnight), day (1-31), month (1-12), weekday (0-6, 0 = Sunday), command

    01 04 1 1 1 /usr/bin/somedirectory/somecommand

    The above example will run /usr/bin/somedirectory/somecommand at 4:01am on January 1st plus every Monday in January. An asterisk (*) can be used so that every instance (every hour, every weekday, every month, etc.) of a time period is used. Code:

    01 04 * * * /usr/bin/somedirectory/somecommand

    The above example will run /usr/bin/somedirectory/somecommand at 4:01am on every day of every month.

    Comma-separated values can be used to run more than one instance of a particular command within a time period. Dash-separated values can be used to run a command continuously. Code:

    01,31 04,05 1-15 1,6 * /usr/bin/somedirectory/somecommand

    The above example will run /usr/bin/somedirectory/somecommand at 01 and 31 past the hours of 4:00am and 5:00am on the 1st through the 15th of every January and June.

    The “/usr/bin/somedirectory/somecommand” text in the above examples indicates the task which will be run at the specified times. It is recommended that you use the full path to the desired commands as shown in the above examples. Enter which somecommand in the terminal to find the full path to somecommand. The crontab will begin running as soon as it is properly edited and saved.

    You may want to run a script some number of times per time unit. For example if you want to run it every 10 minutes use the following crontab entry (runs on minutes divisible by 10: 0, 10, 20, 30, etc.)

    */10 * * * * /usr/bin/somedirectory/somecommand

    which is also equivalent to the more cumbersome

    0,10,20,30,40,50 * * * * /usr/bin/somedirectory/somecommand

    Crontab Options

    • The -l option causes the current crontab to be displayed on standard output.
    • The -r option causes the current crontab to be removed.
    • The -e option is used to edit the current crontab using the editor specified by the EDITOR environment variable.

    After you exit from the editor, the modified crontab will be checked for accuracy and, if there are no errors, installed automatically. The file is stored in /var/spool/cron/crontabs but should only be edited via the crontab command.

    Enable User Level Cron

    If the /etc/cron.allow file exists, then users must be listed in it in order to be allowed to run the crontab command. If the /etc/cron.allow file does not exist but the /etc/cron.deny file does, then users must not be listed in the /etc/cron.deny file in order to run crontab.

    In the case where neither file exists, the default on current Ubuntu (and Debian, but not some other Linux and UNIX systems) is to allow all users to run jobs with crontab.

    No cron.allow or cron.deny files exist in a standard Ubuntu install, so all users should have cron available by default, until one of those files is created. If a blank cron.deny file has been created, that will change to the standard behavior users of other operating systems might expect: cron only available to root or users in cron.allow.

    Note, userids on your system which do not appear in /etc/shadow will NOT have operational crontabs, if you desire to enter a user in /etc/passwd, but NOT /etc/shadow that user’s crontab will never run. Place an entry in /etc/shadow for the user with a * for the password crypt,ie:

    joeuser:*:15169::::::

    Further Considerations

    Crontab commands are generally stored in the crontab file belonging to your user account (and executed with your user’s level of permissions). If you want to regularly run a command requiring administrative permissions, edit the root crontab file:

    sudo crontab -e

    Depending on the commands being run, you may need to expand the root users PATH variable by putting the following line at the top of their crontab file:

    PATH=/usr/sbin:/usr/bin:/sbin:/bin

    It is sensible to test that your cron jobs work as intended. One method for doing this is to set up the job to run a couple of minutes in the future and then check the results before finalising the timing. You may also find it useful to put the commands into script files that log their success or failure, for example:

    echo "Nightly Backup Successful: $(date)" >> /tmp/mybackup.log

    For more information, see the man pages for cron and crontab (man is detailed on the BasicCommands page). If your machine is regularly switched off, you may also be interested in at and anacron, which provide other approaches to scheduled tasks. For example, anacron offers simple system-wide directories for running commands hourly, daily, weekly, and monthly. Scripts to be executed in said times can be placed in /etc/cron.hourly/, /etc/cron.daily/, /etc/cron.weekly/, and /etc/cron.monthly/. All scripts in each directory are run as root, and a specific order to running the scripts can be specified by prefixing the scripts’ filenames with numbers (see the man page for run-parts for more details). Although the directories contain periods in their names, run-parts will not accept a file name containing a period and will fail silently when encountering them (bug #38022). Either rename the file or use a symlink (without a period) to it instead (see, for example, python + cron without login? and Problems with Hourly Cron Job).

    Troubleshooting and Common Problems

    Edits to a user’s crontab and jobs that are run on their behalf are all logged by default to /var/log/syslog and that’s the first place to check if things are not running as you expect.

    When adding a new entry to a blank crontab, forgetting to add a newline at the end is a common source for the job not running. If the last line in the crontab does not end with a newline, no errors will be reported at edit or runtime, but that line will never run. See man crontab for more information. This has already been suggested as a bug.

    If a user was not allowed to execute jobs when their crontab was last edited, just adding them to the allow list won’t do anything. The user needs to re-edit their crontab after being added to cron.allow before their jobs will run.

    When creating a crontab for the root user, the user name must be specified as a parameter after the date/time parameters. Accidentally including the user name that way in a user-specific crontab will result in trying to run the user’s name as a command, rather than what was expected.

    Entries in cron may not run with the same environment, in particular the PATH, as you expect them to. Try using full paths to files and programs if they’re not being located as you expect.

    The “%” character is used as newline delimiter in cron commands. If you need to pass that character into a script, you need to escape it as “\%”.

    If you’re having trouble running a GUI application using cron, see the GUI Applications section below.

    Advanced Crontab

    The Crontabs discussed above are user crontabs. Each of the above crontabs is associated with a user, even the system crontab which is associated with the root user. There are two other types of crontab.

    Firstly, as mentioned above anacron uses the run-parts command and /etc/cron.hourly, /etc/cron.weekly, and /etc/cron.monthly directories. However anacron itself is invoked from the /etc/crontab file. This file could be used for other cron commands, but probably shouldn’t be. Here’s an example line from a ficticious /etc/crontab:

    00 01 * * * rusty /home/rusty/rusty-list-files.sh

    This would run Rusty’s command script as user rusty from his home directory. However, it is not usual to add commands to this file. While an experienced user should know about it, it is not recommended that you add anything to /etc/crontab. Apart from anything else, this could cause problem if the /etc/crontab file is affected by updates! Rusty could lose his command.

    The second type of crontab is to be found in /etc/cron.d. Within the directory are small named crontabs. The directory is often used by packages, and the small crontabs allows a user to be associated with the commands in them.

    Instead of adding a line to /etc/crontab which Rusty knows is not a good idea, Rusty might well add a file to /etc/cron.d with the name rusty, containing his cron line above. This would not be affected by updates but is a well known location.

    When would you use these alternate crontab locations? Well, on a single user machine or a shared machine such as a school or college server, a user crontab would be the way to go. But in a large IT department, where several people might look after a server, then /etc/cron.d is probably the best place to install crontabs – it’s a central point and saves searching for them!

    You may not need to look at /etc/crontab or /etc/cron.d, let alone edit them by hand. But an experienced user should perhaps know about them and that the packages that he/she installs may use these locations for their crontabs.

    Special strings

    Cron also offers some special strings:

    • string

      meaning

      @reboot

      Run once, at startup.

      @yearly

      Run once a year, “0 0 1 1 *”.

      @annually

      (same as @yearly)

      @monthly

      Run once a month, “0 0 1 * *”.

      @weekly

      Run once a week, “0 0 * * 0”.

      @daily

      Run once a day, “0 0 * * *”.

      @midnight

      (same as @daily)

      @hourly

      Run once an hour, “0 * * * *”.

    Usage: “@reboot /path/to/execuable1” will execute /path/to/executable1 when the system starts. See “man 5 crontab” for more info.

    GUI Applications

    It is possible to run gui applications via cronjobs. This can be done by telling cron which display to use.

    00 06 * * * env DISPLAY=:0 gui_appname

    The env DISPLAY=:0 portion will tell cron to use the current display (desktop) for the program “gui_appname”.

    And if you have multiple monitors, don’t forget to specify on which one the program is to be run. For example, to run it on the first screen (default screen) use :

    00 06 * * * env DISPLAY=:0.0 gui_appname

    The env DISPLAY=:0.0 portion will tell cron to use the first screen of the current display for the program “gui_appname”.

    Note: GUI users may prefer to use gnome-schedule (aka “Scheduled tasks”) to configure GUI cron jobs. In gnome-schedule, when editing a GUI task, you have to select “X application” in a dropdown next to the command field.

    Note: In Karmic(9.10), you have to enable X ACL for localhost to connect to for GUI applications to work.

     ~$ xhost +local:
    non-network local connections being added to access control list
     ~$ xhost
    access control enabled, only authorized clients can connect
    LOCAL:
    ...

    Tips

    crontab -e uses the EDITOR environment variable. to change the editor to your own choice just set that. You may want to set EDITOR in you .bashrc because many commands use this variable. Let’s set the EDITOR to nano a very easy editor to use:

    export EDITOR=nano

    There are also files you can edit for system-wide cron jobs. The most common file is located at /etc/crontab, and this file follows a slightly different syntax than a normal crontab file. Since it is the base crontab that applies system-wide, you need to specify what user to run the job as; thus, the syntax is now:

    minute(s) hour(s) day(s)_of_month month(s) day(s)_of_week user command

    It is recommended, however, that you try to avoid using /etc/crontab unless you need the flexibility offered by it, or if you’d like to create your own simplified anacron-like system using run-parts for example. For all cron jobs that you want to have run under your own user account, you should stick with using crontab -e to edit your local cron jobs rather than editting the system-wide /etc/crontab.

    Crontab Example

    Below is an example of how to setup a crontab to run updatedb, which updates the slocate database: Open a term, type “crontab -e” (without the double quotes) and press enter. Type the following line, substituting the full path of the application you wish to run for the one shown below, into the editor:

    45 04 * * * /usr/bin/updatedb

    Save your changes and exit the editor.

    Crontab will let you know if you made any mistakes. The crontab will be installed and begin running if there are no errors. That’s it. You now have a cronjob setup to run updatedb, which updates the slocate database, every morning at 4:45.

    Note: The double-ampersand (&&) can also be used in the “command” section to run multiple commands consecutively, but only if the previous command exits successfully. A string of commands joined by the double-ampersand will only get to the last command if all the previous commands are run successfully. If exit error-checking is not of a concern, string commands together, separated with a semi-colon (;)

    45 04 * * * /usr/sbin/chkrootkit && /usr/bin/updatedb

    The above example will run chkrootkit followed by updatedb at 4:45am daily – providing you have all listed apps installed. If chkrootkit fails, updatedb will NOT be run.

    How Anacron is Arranged

    On Ubuntu 9.10 (and presumably, on later versions), anacron seems to be set up as follows:

    There is a Upstart task, located in /etc/init/anacron.conf, which runs all the jobs in /etc/anacrontab. It is set to run on startup.

    There is a cron.d file (/etc/cron.d/anacron) which causes the Upstart task to be started every day at 7:30 AM.

    There is a file /etc/apm/event.d/anacron, which causes the Upstart task to be started when a laptop is plugged in to A/C power, or woken up.

    In the system crontab (/etc/crontab), if anacron is not execuatable, run-parts is used to run the files in cron.daily, cron.weekly, and cron.monthly at 6:25 AM, 6:47 AM and 6:52 AM, respectively.

    In /etc/anacrontab, run-parts is used to run cron.daily 5 minutes after anacron is started, and cron.weekly after 10 minutes (once a week), and cron.monthly after 15 (once a month).

    Within the cron.daily, weekly, and monthly directories ( /etc/cron.daily, etc.) there is a 0anacron file that sets the timestamps for anacron, so it will know they have been run, even if it didn’t run them.

    So it appears anacron is run on every startup, wake up, plug-in, and at 7:30 AM every day. Looking at the respective Changelogs and package databases, it looks like this setup is directly from Debian, and hasn’t been changed since at least 2009.