Lab 3 Configuring the kernel
Goal: Develop skills tuning the /proc filesystem.
Gain some experience working with device special files and modules.
Use the tools available to explore hardware resources.
Estimated Duration: 45 minutes
Sequence 1: Turning off ping responses
Scenario: You want to reduce the exposure of a critical system. One of your strategies is to “hide” it from easy discovery by ICMP ECHO requests.
Deliverable: A system that does not respond to ping.
Instructions:
1. Configure your system, so that it does not respond to any ping request. This configuration should survive a reboot.
Hint: Install the kernel-doc package and check the kernel documentation on /usr/share/doc/kernel-doc-2.6.18/Documentation/networking/ipsysctl.txt.
a. Check the present value of /proc/sys/net/ipv4/icmp_echo_ignore_all
# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
It should be currently set to zero which means your system will respond normally to pings.
b. Change the value of /proc/sys/net/ipv4/icmp_echo_ignore_all to a 1 which will prevent other hosts from successfully pinging your host while not affecting your ability to ping them. Verify your work.
# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
c. Now test pinging server1.example.com. Pressing Ctrl-C will stop the ping command and display some statistics for you. You should have been able to ping server1.
d. Next have someone else try pinging your station. They should not receive any responses back from your system. Alternatively, try to ping your own network address. This should not work either.
e. Now reboot your system and try to ping your station again. What happened? Why?
f. Remember that changes to the /proc filesystem are temporary and if you want them to persist across reboots you need to put an entry in /etc/sysctl.conf. Edit /etc/sysctl.conf and put the following line at the bottom:
net.ipv4.icmp_echo_ignore_all=1
g. To activate this change run:
# sysctl -p
h. Check the value in /proc. If it is not set to a 1 then recheck the previous two steps. Next reboot your system and check the value in /proc again.
2. MANDATORY CLEANUP
a. Comment out or remove net.ipv4.icmp_echo_ignore_all=1 from /etc/sysctl.conf
b. Remember that changing this file does not affect the system's current configuration, so you will want to undo your change directly as well:
# echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
This is to prevent other things from breaking during the week and help preserve your and your instructor's sanity.
Optional Sequence 2: Creating a file persistently under /dev/
Scenario: You want to make sure the /dev/myusbdisk filename is available after a reboot and can be used to mount a USB device.
Deliverable: A system that provides /dev/myusbdisk automatically after a reboot.
System Setup: System running in runlevel 5.
Instructions:
1. Modify the udev subsystem in such a way that /dev/myusbdisk gets automatically created at boot time.
Create a file named /etc/udev/rules.d/99-usb.rules and insert the following statement in it:
KERNEL=="sdb1", NAME="myusbdisk"
Note: Systems with IDE harddrives use sda for the first USB disk.
2. Reboot the system.
init 6
Plug a USB key to your system and verify that you now have a file named /dev/myusbdisk.
ls -l /dev/myusbdisk
3. MANDATORY CLEANUP: Remove the file you have created under /etc/udev/rules.d/ and unplug the USB device.
rm /etc/udev/rules.d/99-usb.rules
Sequence 3: Exploring processes, hardware and memory resources
Scenario: You want to determine what processes are running on your system, which hardware devices are available, and how much RAM is left.
Deliverable:
System Setup: System running in runlevel 5.
Instructions:
1. Determine the top-three processes with the largest memory footprint.
# top
Type “M” to sort processes in order of decreasing memory usage. The three processes at the top of the list are the three largest.
2. Determine the top-three processes with the largest cpu usage.
# top
Type “P” to sort processes in order of decreasing CPU usage. The three processes at the top of the list are the three busiest processes.
3. Start a window in which, using vmstat, a memory snapshot will be obtained every 5
seconds.
# vmstat 5
In parallel, start a memory-intensive application and observe the results.
# cat /dev/hda > /dev/null
4. Determine what network card (brand and/or model) is currently connected to your system.
You might first want to take a look at the lspci command.
The hal-device -manager will also display more information about the network interface card.