vyos [ vyatta ]

期盼了很久 Vyatta 的社群版終於出現了.
 [vyatta community edition next ... Vyos ?? ]
自從 Brocade 收編了 Vyatta 之後,
已經沒有 open source 版的 vyatta 可供更新與使用.
還好在 wiki 看到了一則訊息,就是 Vyos 的誔生!


about  vyatta

http://en.wikipedia.org/wiki/Vyatta

Vyatta Core
The free community Vyatta Core software(VC) is an
open source network operating system
providing advanced IPv4 and IPv6 routing, stateful firewalling,
 secure communication through both an IPSec based VPN
as well as through the SSL based OpenVPN.[5]

In October 2013 an independent group started a fork of Vyatta Core under VyOS name.[6]


http://vyos.net/wiki/User_Guide


Introduction

VyOS is a Linux-based network operating system that provides software-based
networkrouting, firewall, and VPN functionality.
The VyOS project was started in late 2013 as a community fork of the GPL
portions of Vyatta Core 6.6R1 with the goal of maintaining a free and open source
network operating system in response to the decision to discontinue the community
edition of Vyatta.
VyOS is primarily based on Debian GNU/Linux and the Quagga routing engine. It's
configuration syntax and command-line interface are loosely derived from Juniper
JUNOS as modeled by the XORP project (which was the original routing engine Vyatta
was based upon). Vyatta changed to the Quagga routing engine for release 4.0.



http://vyos.net/wiki/Migrating_from_Vyatta


Migrating from Vyatta LAB 


vyatta@vyatta:~$ show system image 
The system currently has the following image(s) installed:

   1: VC6.6R1 (default boot)

vyatta@vyatta:~$ show ver 
Version:      VC6.6R1
Description:  Vyatta Core 6.6 R1
Copyright:    2006-2013 Vyatta, Inc.
Built by:     autobuild@vyatta.com
Built on:     Tue Apr 30 21:18:42 UTC 2013
Build ID:     1304302121-de93a07
System type:  Intel 32bit
Boot via:     image
Hypervisor:   VMware
HW model:     VMware Virtual Platform
HW S/N:       VMware-56 4d 0a 12 df 64 2e 88-1c 4c 89 e2 cb 05 78 f4
HW UUID:      564D0A12-DF64-2E88-1C4C-89E2CB0578F4
Uptime:       11:56:19 up 12 min,  2 users,  load average: 0.24, 0.14, 0.08

vyatta@vyatta:~$ show configuration commands
set interfaces ethernet eth0 address '192.168.100.99/24'
set interfaces ethernet eth0 hw-id '00:0c:29:05:78:f4'
set interfaces ethernet eth1 hw-id '00:0c:29:05:78:fe'
set interfaces ethernet eth2 hw-id '00:0c:29:05:78:08'
set interfaces loopback 'lo'
set service ssh port '22'
set system config-management commit-revisions '20'
set system console device ttyS0 speed '9600'
set system login user vyatta authentication encrypted-password '$1$EtTv8/b4$0wgW4lkykvMSOoXN/8gKH.'
set system login user vyatta level 'admin'
set system ntp server '0.vyatta.pool.ntp.org'
set system ntp server '1.vyatta.pool.ntp.org'
set system ntp server '2.vyatta.pool.ntp.org'
set system package repository community components 'main'
set system package repository community distribution 'stable'
set system package repository community url 'http://packages.vyatta.com/vyatta'
set system syslog global facility all level 'notice'
set system syslog global facility protocols level 'debug'

vyatta@vyatta:~$ add system image http://192.168.100.200/vyos-1.0.4-i586.iso
Trying to fetch ISO file from http://192.168.100.200/vyos-1.0.4-i586.iso
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  213M  100  213M    0     0  5383k      0  0:00:40  0:00:40 --:--:-- 5583k
ISO download succeeded.
Checking for digital signature file...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 404
Unable to fetch digital signature file.
Do you want to continue without signature check? (yes/no) [yes]
Checking MD5 checksums of files on the ISO image...OK.
Done!
What would you like to name this image? [1.0.4]:
OK.  This image will be named: 1.0.4
Installing "1.0.4" image.
Copying new release files...
Would you like to save the current configuration
directory and config file? (Yes/No) [Yes]:
Copying current configuration...
Would you like to save the SSH host keys from your
current configuration? (Yes/No) [Yes]:
Copying SSH keys...
Setting up grub configuration...
Done.


vyatta@vyatta:~$ reboot
Proceed with reboot? (Yes/No) [No] yes

Broadcast message from root@vyatta (pts/0) (Sat Sep 13 11:59:42 2014):

The system is going down for reboot NOW!
vyatta@vyatta:~$

以 SSH 登入後的驗證畫面

但還是沒有 web UI

 

直接新安裝的畫面

以 SSH 登入後的畫面

Welcome to VyOS
Linux vyatta 3.3.8-1-586-vyatta #1 SMP Sun Nov 17 02:19:52 CET 2013 i686
Welcome to VyOS.
This system is open-source software. The exact distribution terms for
each module comprising the full system are described in the individual
files in /usr/share/doc/*/copyright.
Last login: Sat Sep 13 12:39:45 2014 from 192.168.100.200
vyos@vyos:~$ show system image 
The system currently has the following image(s) installed:

   1: 1.0.4 (default boot)

vyos@vyos:~$ show ver 
Version:      VyOS 1.0.4
Description:  VyOS 1.0.4 (hydrogen)
Copyright:    2014 SO3 Group
Built by:     maintainers@vyos.net
Built on:     Mon Jun 16 16:01:30 UTC 2014
Build ID:     1406161601-32e5690
System type:  x86 32-bit
Boot via:     image
Hypervisor:   VMware
HW model:     VMware Virtual Platform
HW S/N:       VMware-56 4d 0a 12 df 64 2e 88-1c 4c 89 e2 cb 05 78 f4
HW UUID:      564D0A12-DF64-2E88-1C4C-89E2CB0578F4
Uptime:       12:40:30 up 3 min,  2 users,  load average: 0.15, 0.18, 0.08

vyos@vyos:~$ show configuration commands 
set interfaces ethernet eth0 address '192.168.100.99/24'
set interfaces ethernet eth0 hw-id '00:0c:29:05:78:f4'
set interfaces ethernet eth1 hw-id '00:0c:29:05:78:fe'
set interfaces ethernet eth2 hw-id '00:0c:29:05:78:08'
set interfaces loopback 'lo'
set service ssh port '22'
set system config-management commit-revisions '20'
set system console device ttyS0 speed '9600'
set system login user vyos authentication encrypted-password '$1$PytHQR0S$s8xrM13kk/YVbW0KR6s4n/'
set system login user vyos level 'admin'
set system ntp server '0.pool.ntp.org'
set system ntp server '1.pool.ntp.org'
set system ntp server '2.pool.ntp.org'
set system package repository community components 'main'
set system package repository community distribution 'hydrogen'
set system package repository community url 'http://packages.vyos.net/vyos'
set system syslog global facility all level 'notice'
set system syslog global facility protocols level 'debug'
vyos@vyos:~$

Logstash Shipper and Indexer

http://logstash.net/docs/1.2.2/tutorials/getting-started-centralized-overview-diagram.png

logstash shipper configuration  

[root@CentOS6 init.d]# pwd
/etc/init.d
[root@CentOS6 init.d]# cat logstash-agent
#!/bin/bash
# From The Logstash Book
# The original of this file can be found at: http://logstashbook.com/code/index.html
#
#
# Logstash Start/Stop logstash
#
# chkconfig: 345 99 99
# description: Logstash
# processname: logstash

name="logstash-agent"
logstash_bin="/opt/logstash/bin/logstash"
logstash_conf="/etc/logstash/shipper.conf"
logstash_log="/var/log/logstash/shipper.log"

find_logstash_process () {
    PIDTEMP=`ps ux | grep logstash | grep java | awk '{ print $2 }'`
    # Pid not found
    if [ "x$PIDTEMP" = "x" ]; then
        PID=-1
    else
        PID=$PIDTEMP
    fi
}

start () {
    LOG_DIR=`dirname ${logstash_log}`
    if [ ! -d $LOG_DIR ]; then
      echo "Log dir ${LOG_DIR} doesn't exist. Creating"
      mkdir $LOG_DIR
    fi
    nohup ${logstash_bin} agent --verbose -f ${logstash_conf} --log ${logstash_log} > /dev/null 2>&1 &
}

stop () {
    find_logstash_process
    if [ $PID -ne -1 ]; then
        kill $PID
    fi
}

case $1 in
start)
        start
        ;;
stop)
        stop
        exit 0
        ;;
reload)
        stop
        sleep 2
        start
        ;;
restart)
        stop
        sleep 2
        start
        ;;
status)
        find_logstash_process
        if [ $PID -gt 0 ]; then
          echo "logstash running: $PID"
          exit 0
        else
          echo "logstash not running"
          exit 1
        fi
        ;;
*)
        echo $"Usage: $0 {start|stop|restart|reload|status}"
        RETVAL=1
esac
exit 0
[root@CentOS6 init.d]# cat /etc/logstash/shipper.conf 
input {
file {
        type => "syslog"
path => ["/syslog/apache/mod_jk*.log","/syslog/tomcat/*.log"]
        tags => "tomcat"
}
}


output {
       redis {
       host => "192.168.1.145"
       data_type => "list"
       key => "logstash"
       }
}
[root@CentOS6 init.d]#

Logstash Indexer configuration 


[root@Test-Logstash conf.d]# pwd
/etc/logstash/conf.d
[root@Test--Logstash conf.d]# cat syslog.conf 
input {
  tcp {
    type => "syslog"
    port => 514
  }
  udp {
    type => "syslog"
    port => 514
  }
  redis {
host => "127.0.0.1"
type => "redis-input"
data_type => "list"
key => "logstash"
# codec => "json"
 }
}


filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
  if [type] == "apache" {
    grok {
      # See the following URL for a complete list of named patterns
      # logstash/grok ships with by default:
      # https://github.com/logstash/logstash/tree/master/patterns
      #
      # The grok filter will use the below pattern and on successful match use
      # any captured values as new fields in the event.
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    date {
      # Try to pull the timestamp from the 'timestamp' field (parsed above with
      # grok). The apache time format looks like: "18/Aug/2011:05:44:34 -0700"
      match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
  }
}


output {
  elasticsearch {
    embedded => true
  }
}

[root@Test-Logstash conf.d]#

Logstash + Elasticsearch + Kibana

Logstash  + Elasticsearch + Kibana
類似 Splunk 的功能 OpenSource

Logstash 的使用結合  Elasticsearch  與  Kibana

Logstash + Elasticsearch + Kibana

角色說明:

(0) rsyslog [Remote linux server ]
(1) syslog collector [ Logstash ]
(2) search server [Elasticsearch ]
(3) web ui [ Kibana ]

官方實用說明
http://www.logstash.net/docs/1.4.2/tutorials/10-minute-walkthrough/
http://logstash.net/docs/1.4.2/tutorials/getting-started-with-logstash


分別使用 rpm & yum 安裝必要的軟體

(Logstash)

官網上下載該 rpm 安裝即可
 (  http://www.elasticsearch.org/overview/elkdownloads/  )
[root@Test-Logstash syslog]# rpm -qa | grep logstash
logstash-contrib-1.4.2-1_efd53ef.noarch
logstash-1.4.2-1_2c0f5a1.noarch

(Java)

yum 安裝即可
[root@Test-Logstash syslog]# rpm -qa | grep java
tzdata-java-2014e-1.el6.noarch
java-1.7.0-openjdk-1.7.0.65-2.5.1.2.el6_5.x86_64

(Elasticsearch)

官網上下載該 rpm 安裝即可
 ( http://www.elasticsearch.org/overview/elkdownloads/ )
[root@Test-Logstash src]# rpm -qa | grep elasticsearch
elasticsearch-1.3.2-1.noarch

(Kinaba)

kibana 官網上下載該檔案即可
 ( http://www.elasticsearch.org/overview/elkdownloads/ )
kibana-3.1.0.tar.gz 並解壓縮後放置於 /var/www/html 內即可,目錄名稱可自行命名之

(Remote Syslog Client)

修改 rsyslog.conf 並重啟該服務即可
最簡單的設定方式

在最下方加入
*.* @xxx.xxx.xxx
or
*.* @@xxx.xxx.xxx




設定 logstash 的 conf

[root@Test-Logstash conf.d]# pwd
/etc/logstash/conf.d
[root@Test-Logstash conf.d]# cat syslog.conf 
input {
  tcp {
    type => "syslog"
    port => 514
  }
  udp {
    type => "syslog"
    port => 514
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}


output {
  elasticsearch {
    embedded => true
  }
}

[root@Test-Logstash conf.d]#


將 logstash 服務改由 root 身份啟動

[root@Test-Logstash init.d]# pwd
/etc/init.d
[root@Test-Logstash init.d]# cat logstash
#!/bin/sh
# Init script for logstash
# Maintained by Elasticsearch
# Generated by pleaserun.
# Implemented based on LSB Core 3.1:
#   * Sections: 20.2, 20.3
#
### BEGIN INIT INFO
# Provides:          logstash
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description:
# Description:        Starts Logstash as a daemon.
### END INIT INFO

PATH=/sbin:/usr/sbin:/bin:/usr/bin
export PATH

if [ `id -u` -ne 0 ]; then
   echo "You need root privileges to run this script"
   exit 1
fi

name=root
pidfile="/var/run/$name.pid"

LS_USER=root
LS_GROUP=root


設定 Kibana config  內的 elasticsearch 的 url

[root@Test-Logstash syslog]# pwd
/var/www/html/syslog
[root@Test-Logstash syslog]# cat config.js
/** @scratch /configuration/config.js/1
 *
 * == Configuration
 * config.js is where you will find the core Kibana configuration. This file contains parameter that
 * must be set before kibana is run for the first time.
 */
define(['settings'],
function (Settings) {


  /** @scratch /configuration/config.js/2
   *
   * === Parameters
   */
  return new Settings({

    /** @scratch /configuration/config.js/5
     *
     * ==== elasticsearch
     *
     * The URL to your elasticsearch server. You almost certainly don't
     * want +http://localhost:9200+ here. Even if Kibana and Elasticsearch are on
     * the same host. By default this will attempt to reach ES at the same host you have
     * kibana installed on. You probably want to set it to the FQDN of your
     * elasticsearch host
     *
     * Note: this can also be an object if you want to pass options to the http client. For example:
     *
     *  +elasticsearch: {server: "http://localhost:9200", withCredentials: true}+
     *
     */
    elasticsearch: "http://192.168.111.145:9200",


Demo

elasticsearch test 

Kibana

Rsyslog + Elasticsearch + Kibana

類似 Splunk 的功能 OpenSource

rsyslog 的進階使用結合  Elasticsearch  與  Kibana

Rsyslog + Elasticsearch + Kibana

角色說明:
(0) rsyslog [Remote linux server ]
(1) rsyslog collector [ Rsyslog ]
(2) search server [Elasticsearch ]
(3) web ui [ Kibana ]


(1)升級並安裝 rsyslog 8.x等必要套件

[root@Rsyslog yum.repos.d]# pwd
/etc/yum.repos.d
[root@Rsyslog yum.repos.d]# cat rsyslog.repo
[rsyslog_v8]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v8-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=0
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1
[root@Rsyslog yum.repos.d]#

yum update rsyslog
yum install rsyslog-debuginfo rsyslog-libdbi rsyslog-mysql rsyslog-relp rsyslog-snmp rsyslog-elasticsearch rsyslog-mmanon rsyslog-mmfields rsyslog-mmjsonparse rsyslog-mmnormalize rsyslog-mmutf8fix rsyslog-ommail

[root@Rsyslog rsyslog.d]# rpm -qa | grep rsyslog
rsyslog-8.2.2-1.el6.x86_64
rsyslog-mmfields-8.2.2-1.el6.x86_64
rsyslog-relp-8.2.2-1.el6.x86_64
rsyslog-snmp-8.2.2-1.el6.x86_64
rsyslog-ommail-8.2.2-1.el6.x86_64
rsyslog-mmjsonparse-8.2.2-1.el6.x86_64
rsyslog-mysql-8.2.2-1.el6.x86_64
rsyslog-debuginfo-8.2.2-1.el6.x86_64
rsyslog-mmutf8fix-8.2.2-1.el6.x86_64
rsyslog-mmnormalize-8.2.2-1.el6.x86_64
rsyslog-mmanon-8.2.2-1.el6.x86_64
rsyslog-elasticsearch-8.2.2-1.el6.x86_64
rsyslog-libdbi-8.2.2-1.el6.x86_64
[root@Rsyslog rsyslog.d]#

(2)安裝 java & Elasticsearch

http://www.elasticsearch.org/overview/elkdownloads/

wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.3.2.noarch.rpm

rpm 安裝即可

(3)安裝 Kibana ( search web api )
wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.0.tar.gz
放在 web -root 即可

其它重要設定

vi /etc/rsyslog.conf

新增 rsyslog  listen port

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514


新增與 Elasticsearch 介接設定 syslog.conf

[root@Rsyslog rsyslog.d]# pwd
/etc/rsyslog.d
[root@Rsyslog rsyslog.d]# cat syslog.conf
module(load="omelasticsearch") # for outputting to Elasticsearch

# this is for index names to be like: logstash-YYYY.MM.DD
template(name="logstash-index" type="list") {
 constant(value="logstash-")
 property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
 constant(value=".")
 property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
 constant(value=".")
 property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
}

# this is for formatting our syslog in JSON with @timestamp
 template(name="plain-syslog" type="list") {
 constant(value="{")
 constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
 constant(value="\",\"@host\":\"")       property(name="hostname")
 constant(value="\",\"@severity\":\"")   property(name="syslogseverity-text")
 constant(value="\",\"@facility\":\"")   property(name="syslogfacility-text")
 constant(value="\",\"@syslogtag\":\"")  property(name="syslogtag" format="json")
 constant(value="\",\"@message\":\"")    property(name="msg" format="json")
 constant(value="\"}")
 }
# this is where we actually send the logs to Elasticsearch (localhost:9200 by default)
action(type="omelasticsearch" template="plain-syslog" searchIndex="logstash-index" dynSearchIndex="on")

參考 url http://blog.sematext.com/2013/07/01/recipe-rsyslog-elasticsearch-kibana/

demo

rsyslog 的進階使用,將一般文字檔重導到 log server 內. ( InputFileName )

rsyslog 的進階使用,將一般文字檔重導到 log server 內.

使用環境 CentOS 6.5  rsyslog-5.8.10-8.el6.x86_64

[root@CentOS6 rsyslog.d]# pwd
/etc/rsyslog.d
[root@CentOS6 rsyslog.d]# cat messagesystem.conf

$ModLoad imfile
$WorkDirectory /var/spool/rsyslog


#Add a tag for tomcat events
$template LogglyFormatTomcat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [ MessageSystme tag=\"tomcat\"] %msg%\n"

# MessageSystem Log

$InputFileName /syslog/tomcat/MessageSystem.log
$InputFileTag messagesystem-log
$InputFileStateFile messagesystem-log
$InputFileSeverity info
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
if $programname == 'messagesystem-log' then @192.168.1.1:514;LogglyFormatTomcat
if $programname == 'messagesystem-log' then ~

其它參考設定可自行參閱 https://www.loggly.com/docs/sending-apache-logs/
或使用參數 http://www.rsyslog.com/doc/property_replacer.html

Juniper VSRX ( Juniper SRX 虛擬機 )

繼 Olive 之後，Juniper又釋出 VSRX 的虛擬機供人試用，日前網上看到是

12.1X44-D20 以下 LAB 用的則是 junos-vsrx-12.1X44-D10.4-domestic.ova

https://www.juniper.net/support/downloads/?p=firefly#sw

可使用 VMware 的軟體將其載入為 GuestOS,

即然是 juniper srx 的模擬器，當然只可使用 com port 連入做初使化作業，

開機畫面跟 Olive 差不了多少，只是傳統的 Olive 是 Router 模擬器，而 vSRX 則是 Firewall 模擬器．在開機之後可使用 root 直接 login不需密碼，接下來就是開始設定 root 密碼，指令如下:

set system root-authentication plain-text-password 

如從未使用過 Junos 的人可參考下面這份中文手冊．以了解  Juniper  Junos 的作業系統

http://www.juniper.net/tw/tc/local/pdf/design-guides/JSF1_DO_JUNOS_CLI.pdf

當然也可以透過 start shll 的方式回到 OS 底層去修改 loader.conf 讓 vSRX 可以支援螢幕顯示．

vi  /boot/loader.conf

console="comconsole"　原始 console 設定 改為 console="vidconsole" 如下所示

root@% vi /boot/loader.conf 

kernel="/kernel"

bootfile="/kernel;/kernel.old"

autoboot_delay="2"

console="vidconsole"

libmbpool_load="YES"

if_em_vjx_load="YES"

kern.maxusers="16"

kern.maxfiles="1500"

kern.ipc.nmbclusters="640"

kern.maxdsiz="1073741824"

kern.lockable_mem_ratio="1"

kern.lapic_timer_use_hz="1"

kern.aps_lapic_timer_interrupt_enable="0"

kern.bsp_handle_all_interrupts="1"

kern.hz="500"

retype="129"

machdep.hyperthreading_allowed="1"

.

或者直接將 IP 設定上，用 web 或 ssh 直入

設定好 root 密碼與 ge-0/0/0 ip 時的 configuration 

root> show configuration | display set 

set version 12.1X44.4

set system root-authentication encrypted-password "$1$A0TymRZw$VZAOq32ZmadEQCfksmp.m."

set system login user juniper uid 100

set system login user juniper class super-user
set system login user juniper authentication encrypted-password "$1$E/kbFUN8$MytyvxTbYA29DY5v2kZ7X1"

set system services ssh

set system services web-management http interface ge-0/0/0.0

set system syslog user * any emergency

set system syslog file messages any any

set system syslog file messages authorization info

set system syslog file interactive-commands interactive-commands any

set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval

set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.100/24

set security screen ids-option untrust-screen icmp ping-death

set security screen ids-option untrust-screen ip source-route-option

set security screen ids-option untrust-screen ip tear-drop

set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024

set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200

set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024

set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048

set security screen ids-option untrust-screen tcp syn-flood queue-size 2000

set security screen ids-option untrust-screen tcp syn-flood timeout 20

set security screen ids-option untrust-screen tcp land

set security policies from-zone trust to-zone trust policy default-permit match source-address any

set security policies from-zone trust to-zone trust policy default-permit match destination-address any

set security policies from-zone trust to-zone trust policy default-permit match application any

set security policies from-zone trust to-zone trust policy default-permit then permit

set security policies from-zone trust to-zone untrust policy default-permit match source-address any

set security policies from-zone trust to-zone untrust policy default-permit match destination-address any

set security policies from-zone trust to-zone untrust policy default-permit match application any

set security policies from-zone trust to-zone untrust policy default-permit then permit

set security policies from-zone untrust to-zone trust policy default-deny match source-address any

set security policies from-zone untrust to-zone trust policy default-deny match destination-address any

set security policies from-zone untrust to-zone trust policy default-deny match application any

set security policies from-zone untrust to-zone trust policy default-deny then deny

set security zones security-zone trust tcp-rst

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services http

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services https

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services telnet

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services dhcp

set security zones security-zone untrust screen untrust-screen

 root> show version 

Model: junosv-firefly

JUNOS Software Release [12.1X44-D10.4]

root> 

30天試用 想學 srx 可由這開始

   

DNS Server 的 SPF record

設定 SPF record 的工具網站

http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/

依據網站指示即可產出 DNS 的 SPF record
如
v=spf1 a mx:mail.xxxx.com.tw mx:mail2.xxxx.com.tw mx:xxxx.com.tw ~all
or
v=spf1 ip4:xxx.xxx.xxx.xxx mx:mail.xxxx.com.tw mx:mail2.xxxx.com.tw ~all

接下來是在 DNS  Server 上宣告使用以 PowerDNS 為例:

Poweradmin

SPF Type 的說明

http://doc.powerdns.com/html/types.html

CentOS 6.4 64 bit w3af_gui 無法執行 ( w3af )

w3af 請參考

http://xrcd2.blogspot.tw/2012/07/w3af-waf-for-apache.html


root@w3af w3af]# ./w3af_gui                          
On Debian systems please install the following operating system packages before running the pip installer:                                                   
   
       sudo apt-get install build-essential python-setuptools git python-pip graphviz python2.7-dev libsqlite3-dev libxslt1-dev python-gtksourceview2 python-gtk2 libxml2-dev                                                                     

Your python installation needs the following modules to run w3af:
    clamd github git.util esmre phply chardet pdfminer concurrent.futures guess_language cluster msgpack ntlm xdot                                             

After installing any missing operating system packages, use pip to install the remaining modules:                                                            
    sudo pip install clamd PyGithub GitPython esmre chardet pdfminer futures guess-language cluster msgpack-python python-ntlm xdot                          
    sudo pip install -e git+git://github.com/ramen/phply.git#egg=phply         
A script with these commands has been created for you at /tmp/w3af_dependency_install.sh 


=======================

python-setuptools
Easy Install  是一個 Python的模組化工具 (easy_install)，是包含在 setuptools rpm 中，提供Python自動化程式下載、編譯、安裝和管理的模組。
使用方法 #easy_install [套件名稱]
如 easy_install pip
或使用 #pip [套件名稱] 也行


更詳細的介紹請自行參閱
http://www.openfoundry.org/tw/tech-column/8536-introduction-of-python-extension-management-tools

簡單的 linux H.A 架構 keepalived (linux vrrp) Part III

延續 簡單的 linux H.A 架構 這個主題,
Part I
http://xrcd2.blogspot.tw/2013/04/linux-ha-keepalived-linux-vrrp.html
Part II
http://xrcd2.blogspot.tw/2013/05/linux-ha-keepalived-linux-vrrp-part-ii.html

加入 notify shell

notify_master   "/etc/keepalived/notify_master.sh"   #變成 master 時執行的 shell
notify_backup  "/etc/keepalived/notify_backup.sh"  #變成 backup 時執行的 shell
notify_fault      "/etc/keepalived/notify_fault.sh"       #故障時執行的 shell
notify                "/etc/keepalived/notify.sh"                # 狀態轉換時執行的 shell 


加入的位置如下:

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 1
    priority 100
    advert_int 3
    smtp_alert
    authentication {
        auth_type PASS
        auth_pass 1234
    }
    virtual_ipaddress {
        192.168.1.1
    }
    notify_master "/etc/keepalived/notify_master.sh"
    notify_backup "/etc/keepalived/notify_backup.sh"
    track_script {
     check_shell
     chk_httpd
     chk_http_port
     chk_https_port
     chk_8080_port
    }
    track_interface{
     eth0   
    }

}

perl , ssh2 , vyatta , vbash and remote executio

perl , ssh2 , vyatta , vbash and remote executio

如何使用 perl 寫一支 shell 連入 vyatta OS 內,並下指令 show ????,
並將 結果 自動以 E-Mail 方式寄回給網管人員!

About vyatta

www.vyatta.com or www.vyatta.org

or 我以前發表過的文章如下:
http://www.pczone.com.tw/vbb3/thread/16/147986/


程式範列如下,可依需要自行修改之:

 [xrcd2@centos shell]# cat ssh2-vyatta-show.pl
    
#!/usr/bin/perl
use Net::SSH2;
$ssh=Net::SSH2->new() or die "couldn't make SSH object\n";
#$ssh->debug(1);
$ssh->blocking(1);
print "\n made SSH object\n";
$ssh->connect('xxx.xxx.xxx.xxx') or die "couldn't connect to host\n";
print "\n connected to vyatta-host\n";
$ssh->auth_password('vyatta-id','vyatta-pwd') or die "couldn't authenticate \n";
print "\n \n authenticated vyatta-id \n \n";
print " \n ================== send command ====================== \n ";
$command1 = $ssh->channel();
$command1->exec('vbash -i -c "show version "');
$buflen = 10000;
$show = '0' x $buflen;
$command1->read($show, $buflen);
chomp($show);
print "\n $show";
print " \n \n  =================  end  ============================== \n \n ";

$ssh->disconnect or die "couldn't disconnect\n";

get_mail();

sub get_mail{
 use Encode qw(decode encode_utf8);
 use Encode qw(encode);
 use MIME::Base64;
 use MIME::Lite;
 $foot0=' 自動使用SSH2 到 Vyatta OS 的 Shell ( ssh2 vyatta vbash )  ';
 use Encode qw/from_to/;
 from_to($foot0, "utf8", "big5");
 $line='=====================================================';

 $msg = MIME::Lite->new(
     From     =>'vyatta@xrcd2.com.tw',
     To       =>'xrcd2@xrcd2.com.tw',
     Subject => "show vyatta version ",
     Encoding => 'base64',
     Data     =>"$foot0 \n\n $line \n\n $show \n\n $line\n\n"
 );
 $msg->get_length;
 $msg->attr("content-type.charset" => "UTF8");
 $msg->send('smtp','x.x.x.x');
 print $Mail::SendMail::Error eq "" ? "\n\n send ok! \n\n" : $Mail::SendMail::Error;
}

[root@centos63 shell]# perl  blog-ssh.pl
      
 made SSH object

 connected to vyatta-host


 authenticated vyatta-id


 ================== send command ======================

 Version:      VC6.5R1
Description:  Vyatta Core 6.5 R1
Copyright:    2006-2012 Vyatta, Inc.
Built by:     autobuild@vyatta.com
Built on:     Fri Nov 16 16:39:16 UTC 2012
Build ID:     1211161646-334fb58
System type:  Intel 32bit
Boot via:     disk
Hypervisor:   VMware
HW model:     VMware Virtual Platform
HW S/N:       VMware-56 4d 5b da 3e 1c d1 93-43 38 03 40 4a 5c e9 29
HW UUID:      564D5BDA-3E1C-D193-4338-03404A5CE929
Uptime:       16:58:35 up  2:11,  1 user,  load average: 0.00, 0.01, 0.05


  =================  end  ==============================
 
send ok!
 [xrcd2@centos shell]#

簡單的 linux H.A 架構 keepalived (linux vrrp) Part II

透過 keepalived 達成簡單的 linux H.A 架構. (linux vrrp)
http://www.keepalived.org/
延續這個主題.
http://xrcd2.blogspot.tw/2013/04/linux-ha-keepalived-linux-vrrp.html
加入切換條件, 如 track_script































Master config 如下

! Configuration File for keepalived
vrrp_script check_sh {
    script "/etc/keepalived/chk_ftp.sh"
    interval 2                       # check every 2 seconds
    weight -30                       # default prio: -30
    fall 2                           # require 2 failures
    rise 2                           # require 2 successes
}
vrrp_script chk_httpd {
            script "killall -0 httpd"      
            interval 2                    
            weight -30                      
            fall 2                         
            rise 2                         
}
vrrp_script chk_8080_port {
 script "</dev/tcp/127.0.0.1/8080"
 interval 1
 weight -30
 fall   2    
 rise   2    
}
global_defs {
   notification_email {
     xrcd2@xrcd2.com.tw
   }
   notification_email_from keepalived@xrcd2.com.tw
   smtp_server 192.168.1.100
   smtp_connect_timeout 30
   router_id NodeA
}
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 1
    priority 100
    advert_int 1
    smtp_alert
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.1.3
    }
    track_script {
     check_sh
     chk_httpd
     chk_8080_port
    }
    track_interface{
     eth0   
    }

}

DIY 檢查的 shell
======================
cat /etc/keepalived/chk_ftp.sh
#!/bin/bash
chktcp21=`nmap 127.0.0.1 | grep '21/tcp' | wc -l`
if [ $chktcp21 = 1 ]
then
 #echo "============="
 #echo " FTPD Is Up "
 #echo "============="
 exit 0
else
 #echo "============="
 #echo " FTPD Is Down "
 #echo "============="
 exit 1
fi
=====================

Backup config 如下

! Configuration File for keepalived
vrrp_script check_sh {
    script "/etc/keepalived/chk_ftp.sh"
    interval 2                      # check every 2 seconds
    weight -30                      # default prio: -30
    fall 2                          # require 2 failures
    rise 2                          # require 2 successes
}
vrrp_script chk_httpd {
            script "killall -0 httpd"       
            interval 2                     
            weight -30                     
            fall 2                          
            rise 2                          
}
vrrp_script chk_8080_port {
 script "</dev/tcp/127.0.0.1/8080"
 interval 1
 weight -30
 fall   2   
 rise   2   
}
global_defs {
   notification_email {
     xrcd2@xrcd2.com.tw
   }
   notification_email_from keepalived@xrcd2.com.tw
   smtp_server 192.168.1.100
   smtp_connect_timeout 30
   router_id NodeB
}
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 1
    priority 90
    advert_int 1
    smtp_alert
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.1.3
    }
    track_script {
     check_sh
     chk_httpd
     chk_8080_port
    }
    track_interface{
     eth0   
    }

}

運作通知!

切換通知!

簡單的 linux H.A 架構 keepalived (linux vrrp)

透過 keepalived 達成簡單的 linux H.A 架構. (linux vrrp)
http://www.keepalived.org/

[root@Test-Tomcat1 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
   notification_email {
     xrcd2@xrcd2.com.tw
   }
   notification_email_from keepalived@xrcd2.com.tw
   smtp_server 192.168.1.100
   smtp_connect_timeout 30
   router_id NodeA
}
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 1
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1234
    }
    virtual_ipaddress {
        192.168.1.3
    }
}

[root@Test-Tomcat2 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
   notification_email {
     xrcd2@xrcd2.com.tw
   }
   notification_email_from keepalived@xrcd2.com.tw
   smtp_server 192.168.1.100
   smtp_connect_timeout 30
   router_id NodeB
}
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 1
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1234
    }
    virtual_ipaddress {
        192.168.1.3
    }
}

JDK 1.6.0_43 64 Bit 無法使用 jvm snmp

JDK 1.6.0_43 64 Bit 無法使用 jvm snmp ,一定要使用檔案的方式宣告方可使用.
之前使用直寫的方式,在 java 32 Bit 的版本是沒問題的.

另外一個問題是 /etc/hosts 一定要將主機名稱寫入,要不然 jmx 是無法使用
-Djava.rmi.server.hostname=192.168.x.x 這個參數!

java snmp 以檔案方式宣告如下:

tomcat startup.sh

export JAVA_OPTS="-Xms1024m -Xmx1024m  -XX:PermSize=128m -XX:MaxPermSize=256m -Dcom.sun.management.config.file=/usr/local/tomcat/bin/snmp.properties -Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=192.168.x.x. -Dcom.sun.management.jmxremote.port=9012 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false"


[root@Test-Tomcat bin]# cat snmp.acl
acl = {
  {
    communities = public
    access = read-only
    managers = localhost
  }
}
[root@Test-Tomcat bin]# cat snmp.properties
com.sun.management.snmp.interface=0.0.0.0
com.sun.management.snmp.port=1610
com.sun.management.snmp.acl=/usr/local/tomcat/bin/snmp.acl


直寫方式如下:

export JAVA_OPTS="="-Xms1024m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m -Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=192.168.xx.xx -Dcom.sun.management.jmxremote
.port=9012 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.managemen
t.snmp.port=1610 -Dcom.sun.management.snmp.acl.file=/tmp/snmp.acl -Dcom.sun.management.snmp.interface=0.0.0.0"

apache 整合 tomcat 的二種方式

tomcat-connectors

http://tomcat.apache.org/connectors-doc/

#wget http://www.apache.org/dist/tomcat/tomcat-connectors/jk/tomcat-connectors-1.2.37-src.tar.gz
#tar -zvxf tomcat-connectors-1.2.37-src.tar.gz
#cd tomcat-connectors-1.2.37-src/native
#./buildconf.sh
#./configure --with-apxs=/usr/sbin/apxs
#make
#make install
#vi workers.properties
#vi jk_mode.conf
#vi ssl.conf
#service httpd restart

jk_module

workers.properties

 

worker.list=worker1

worker.worker1.type=ajp13

worker.worker1.host=localhost

worker.worker1.port=8009

worker.worker1.connection_pool_timeout=600

worker.worker1.socket_keepalive=1

worker.worker1.socket_timeout=60

 

jk_mod.conf

 

LoadModule jk_module modules/mod_jk.so

JkWorkersFile conf/workers.properties

JkLogFile /tmp/mod_jk.log

JkMount /test1/*.jsp    worker1

JkMount /manager/*      worker1

 

ssl.conf

.......

JkMount /test1/*.jsp    worker1

JkMount /manager/*      worker1

</VirtualHost>  

Proxy_ajp

 

proxy_ajp.conf

LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

 

#

# When loaded, the mod_proxy_ajp module adds support for

# proxying to an AJP/1.3 backend server (such as Tomcat).

# To proxy to an AJP backend, use the "ajp://" URI scheme;

# Tomcat is configured to listen on port 8009 for AJP requests

# by default.

 

# Uncomment the following lines to serve the ROOT webapp

# under the /tomcat/ location, and the jsp-examples webapp

# under the /examples/ location.

#

 

#ProxyPass /tomcat/ ajp://localhost:8009/

#ProxyPass /examples/ ajp://localhost:8009/jsp-examples/

 

ProxyPass /test1/ ajp://localhost:8009/test1/

ProxyPass /manager/ ajp://localhost:8009/manager/

使用 perl 做 scp 的二種方式

使用 perl 做 scp 的二種方式

#yum install  libssh2-devel
#yum install   libssh2
#yum install   perl-Net-SSH2
#yum install perl-Net-SFTP

========================================================
#!/usr/bin/perl
use Net::SFTP;
$sftp = Net::SFTP->new('xxx.xxx.xxx.xxx',user=>'userID',password=>'userPWD');
$sftp->get("/xxx/xxx", "/xxx/xxx");
========================================================
#!/usr/bin/perl
@ip=qw
(
 192.168.1.1
 192.168.1.2
);
@host=qw
(
 server1
 server2
);

@list=qw
(
 server1.txt
 server1.txt
);

for ($x=0;$x<=$#ip;$x++) {
     print " \n $x SCP IP :  $ip[$x]  HostName :  $host[$x] DFCHK_File : $df[$x] \n";
     sshget();
}
sub sshget {
 use Net::SSH2;
 use Net::SSH2::Dir;
 $ssh=Net::SSH2->new() or die "couldn't make SSH object\n";
 #$ssh->debug(1);
 $ssh->blocking(1);
 print "made SSH object\n";
 $ssh->connect("$ip[$x]") or die "couldn't connect to host\n";
 print "connected to $host[$x] $ip[$x] \n";
 $ssh->auth_password('userID','userPWD') or die "couldn't authenticate user \n";
 print "authenticated UserID\n";
 $ssh->scp_get("/xxx/$list[$x]","/xxx/$list[$x]") or warn "couldn't get file in $list[$x] \n ";
 print "\n Download  Successfully \n";
 $ssh->disconnect or die "couldn't disconnect\n";
}
========================================================

md5deep reporting to E-mail ( 使用 perl )

程式需求說明,對某一個目錄做 MD5 檢核!並將檢核結果以 E-Mail 方式自動通知!

md5deep
http://md5deep.sourceforge.net/

md5deep.exe -h
md5deep.exe version 4.3 by Jesse Kornblum and Simson Garfinkel.
C:\> md5deep.exe [OPTION]... [FILES]...
See the man page or README.txt file or use -hh for the full list of options
-p <size> - piecewise mode. Files are broken into blocks for hashing
-r        - recursive mode. All subdirectories are traversed
-e        - show estimated time remaining for each file
-s        - silent mode. Suppress all error messages
-z        - display file size before hash
-m <file> - enables matching mode. See README/man page
-x <file> - enables negative matching mode. See README/man page
-M and -X are the same as -m and -x but also print hashes of each file
-w        - displays which known file generated a match
-n        - displays known hashes that did not match any input files
-a and -A add a single hash to the positive or negative matching set
-b        - prints only the bare name of files; all path information is omitted
-l        - print relative paths for filenames
-t        - print GMT timestamp (ctime)
-i/I <size> - only process files smaller/larger than SIZE
-v        - display version number and exit
-d        - output in DFXML; -u - Escape Unicode; -W FILE - write to FILE.
-j <num>  - use num threads (default 2)
-Z - triage mode;   -h - help;   -hh - full help

#!/usr/bin/perl
#md5filenameok 這個陣列是用來是用來檢核並列出MD5正常的檔案
@md5filenameok=`c:\\perl-shell\\md5deep.exe -r -m c:\\perl-shell\\md5\\syslog.md5 d:\\backup\\*.*`;
#md5filenameoknumber 這個陣列是用來是用來檢核並列出MD5正常的檔案的檔案數量
$md5filenameoknumber=`c:\\perl-shell\\md5deep.exe -r -m c:\\perl-shell\\md5\\syslog.md5 d:\\backup\\*.* |  find /c "d:\"`;
#下面這個方式是在 windows command mode 對目錄做出 MD5的檢核檔
#system(`c:\perl-shell\md5deep -l -r d:\backup > c:\perl-shell\md5\syslog.md5`);
#這個陣列是用來是用來檢核並列出MD5異常的檔案
@md5filename=`c:\\perl-shell\\md5deep.exe -r -x c:\\perl-shell\\md5\\syslog.md5 d:\\backup\\*.*`;
#這個陣列是用來是用來檢核並列出MD5異常的檔案的檔案數量
$md5number=`c:\\perl-shell\\md5deep.exe -r -x c:\\perl-shell\\md5\\syslog.md5 d:\\backup\\*.* | find /c "d:\" `;
chomp($md5filenameoknumber);
chomp($md5number);
print '=============== 正常 ===============';
print "\n\n";
print "\n ＭＤ５比對正確的檔案清單如下: \n\n @md5filenameok \n";
print "比對正確的檔案數量合計共有 $md5filenameoknumber 個 \n\n";
print '=============== 異常 ===============';
print "\n\n";
print "ＭＤ５比對異常的檔案清單如下: \n\n  @md5filename \n";
print "比對異常的檔案數量合計共有 $md5number 個 \n ";
@message1="\n ＭＤ５比對正確的檔案清單如下: \n\n @md5filenameok \n 比對正確的檔案數量合計共有: $md5filenameoknumber  \n\n";
@message2="\n ＭＤ５比對異常的檔案清單如下: \n\n  @md5filename  \n 比對異常的檔案數量合計共有: $md5number  \n\n";

#可自行選擇在何種條件才寄出郵件通知!

if ($md5number==0){
 print "\n  ----> ＭＤ５ 比對異常的檔案數量為 ０ 不寄出郵件通知！ \n";
 $status='[ Normal ]';
 get_mail();
}
else {
 print " \n ----> ＭＤ５ 比對異常出郵件通知 \n ";
 $status='[ --->Error ]';
 get_mail();
}

sub get_mail{
 use Encode qw(decode encode_utf8);
 use Encode qw(encode);
 use MIME::Base64;
 use MIME::Lite;
 ($sec,$min,$hour,$day,$mon,$year,$mday)=localtime(time);
 $mon++;
 if (length ($mon) == 1) {$mon = '0'.$mon;}
 if (length ($day) == 1) {$day = '0'.$day;}
 if (length ($hour) == 1) {$hour = '0'.$hour;}
 if (length ($min) == 1) {$min = '0'.$min;}
 if (length ($sec) == 1) {$sec = '0'.$sec;}
 $year+=1900;
 $clock=" $status Syslog-Server md5 CheckMail $year/$mon/$day/$hour:$min/";
 @foot0=' Syslog-Server D:\BACKUP ＭＤ５自動檢查通知程式!';
 use Encode qw/from_to/;
 from_to(@foot0, "utf8", "big5");
 from_to(@message1, "utf8", "big5");
 from_to(@message2, "utf8", "big5");
 from_to($clock, "utf8", "big5");
 $line='=====================================================';


 $msg = MIME::Lite->new(
     From     =>'Syslog-MD5@xrcd2.com.tw',
     To       =>'xrcd2@xrcd2.com.tw',
     Subject => "$clock",
     Encoding => 'base64',
     Data     =>"@foot0 \n\n $line \n\n @message1 \n\n $line\n\n @message2 \n\n  $line \n\n"
 );

 $msg->get_length;
 $msg->attr("content-type.charset" => "UTF8");
 $msg->send('smtp','smpt.server.ip.address');
 print $Mail::SendMail::Error eq "" ? "\n send ok!\n" : $Mail::SendMail::Error; 
}