CentOS 7: failed to open \efi\centos\grubx64.efi

For some reason one of my CentOS 7 boxes decided to nuke itself yesterday, when I powered it on it prompted me with the following error: “failed to open \efi\centos\grubx64.efi”. What I did to fix it is: Boot up a rescue USB, mount the required partitions and chroot. Add a DNS server: $ echo "nameserver *.*.*.*" >> /etc/resolv.conf Enable networking using ifconfig (in my case it was already enabled). Install some additional grub2 modules: $ yum install grub2-efi-modules Reinstall grub, read “/etc/fstab” or “lsblk” command to find it: $ /sbin/grub2-install /dev/boot/partition Reinstall grub: $ yum reinstall grub-efi shim Rebuild grub.cfg file: $ grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg

Posted on

Configure apcupsd on CentOS

Apcupsd is a powerful daemon that can be used to manage APC UPS, add epel repositories and run: $ yum install apcupsd To configure apcupsd edit the following file: cat /etc/apcupsd/apcupsd.conf" --- ## apcupsd.conf v1.1 ## # # for apcupsd release 3.14.14 (31 May 2016) - redhat # # "apcupsd" POSIX config file # # Note that the apcupsd daemon must be restarted in order for changes to # this configuration file to become active. # # # ========= General configuration parameters ============ # # UPSNAME xxx # Use this to give your UPS a name in log files and such. This # is particulary useful if you have multiple UPSes. This does not # set the EEPROM. It should be 8 characters or less. UPSNAME apcups # UPSCABLE <cable> # Defines the type of cable connecting the UPS to your computer. # # Possible generic choices for <cable> are: # simple, smart, ether, usb # # Or a specific cable model number may be used: # 940-0119A, 940-0127A, 940-0128A, 940-0020B, # 940-0020C, 940-0023A, 940-0024B, 940-0024C, # 940-1524C, 940-0024G, 940-0095A, 940-0095B, # 940-0095C, 940-0625A, M-04-02-2000 # UPSCABLE usb # To get apcupsd to work, in addition to defining the cable # above, you must also define a UPSTYPE, which corresponds to # the type of UPS you have (see the Description for more details). # You must also specify a DEVICE, sometimes referred to as a port. # For USB UPSes, please leave the DEVICE directive blank. For # other UPS types, you must specify an appropriate port or address. # # UPSTYPE DEVICE Description # apcsmart /dev/tty** Newer serial character device, appropriate for # SmartUPS models using a serial cable (not USB). # # usb <BLANK> Most new UPSes are USB. A blank DEVICE # setting enables autodetection, which is # the best choice for most installations. # # net hostname:port Network link to a master apcupsd through apcupsd's # Network Information Server. This is used if the # UPS powering your computer is connected to a # different computer for monitoring. # # snmp hostname:port:vendor:community # SNMP network link to an SNMP-enabled UPS device. # Hostname is the ip address or hostname of the UPS # on the network. Vendor can be can be "APC" or # "APC_NOTRAP". "APC_NOTRAP" will disable SNMP trap # catching; you usually want "APC". Port is usually # 161. Community is usually "private". # # netsnmp hostname:port:vendor:community # OBSOLETE # Same as SNMP above but requires use of the # net-snmp library. Unless you have a specific need # for this old driver, you should use 'snmp' instead. # # dumb /dev/tty** Old serial character device for use with # simple-signaling UPSes. # # pcnet ipaddr:username:passphrase:port # PowerChute Network Shutdown protocol which can be # used as an alternative to SNMP with the AP9617 # family of smart slot cards. ipaddr is the IP # address of the UPS management card. username and # passphrase are the credentials for which the card # has been configured. port is the port number on # which to listen for messages from the UPS, normally # 3052. If this parameter is empty or missing, the # default of 3052 will be used. # # modbus /dev/tty** Serial device for use with newest SmartUPS models # supporting the MODBUS protocol. # modbus <BLANK> Leave the DEVICE setting blank for MODBUS over USB # or set to the serial number of the UPS to ensure # that apcupsd binds to that particular unit # (helpful if you have more than one USB UPS). # UPSTYPE usb DEVICE # POLLTIME <int> # Interval (in seconds) at which apcupsd polls the UPS for status. This # setting applies both to directly-attached UPSes (UPSTYPE apcsmart, usb, # dumb) and networked UPSes (UPSTYPE net, snmp). Lowering this setting # will improve apcupsd's responsiveness to certain events at the cost of # higher CPU utilization. The default of 60 is appropriate for most # situations. POLLTIME 60 # LOCKFILE <path to lockfile> # Path for device lock file. This is the directory into which the lock file # will be written. The directory must already exist; apcupsd will not create # it. The actual name of the lock file is computed from DEVICE. # Not used on Win32. LOCKFILE /var/lock # SCRIPTDIR <path to script directory> # Directory in which apccontrol and event scripts are located. SCRIPTDIR /etc/apcupsd # PWRFAILDIR <path to powerfail directory> # Directory in which to write the powerfail flag file. This file # is created when apcupsd initiates a system shutdown and is # checked in the OS halt scripts to determine if a killpower # (turning off UPS output power) is required. PWRFAILDIR /etc/apcupsd # NOLOGINDIR <path to nologin directory> # Directory in which to write the nologin file. The existence # of this flag file tells the OS to disallow new logins. NOLOGINDIR /etc # # ======== Configuration parameters used during power failures ========== # # The ONBATTERYDELAY is the time in seconds from when a power failure # is detected until we react to it with an onbattery event. # # This means that, apccontrol will be called with the powerout argument # immediately when a power failure is detected. However, the # onbattery argument is passed to apccontrol only after the # ONBATTERYDELAY time. If you don't want to be annoyed by short # powerfailures, make sure that apccontrol powerout does nothing # i.e. comment out the wall. ONBATTERYDELAY 6 # # Note: BATTERYLEVEL, MINUTES, and TIMEOUT work in conjunction, so # the first that occurs will cause the initation of a shutdown. # # If during a power failure, the remaining battery percentage # (as reported by the UPS) is below or equal to BATTERYLEVEL, # apcupsd will initiate a system shutdown. BATTERYLEVEL 5 # If during a power failure, the remaining runtime in minutes # (as calculated internally by the UPS) is below or equal to MINUTES, # apcupsd, will initiate a system shutdown. MINUTES 10 # If during a power failure, the UPS has run on batteries for TIMEOUT # many seconds or longer, apcupsd will initiate a system shutdown. # A value of 0 disables this timer. # # Note, if you have a Smart UPS, you will most likely want to disable # this timer by setting it to zero. That way, you UPS will continue # on batteries until either the % charge remaing drops to or below BATTERYLEVEL, # or the remaining battery runtime drops to or below MINUTES. Of course, # if you are testing, setting this to 60 causes a quick system shutdown # if you pull the power plug. # If you have an older dumb UPS, you will want to set this to less than # the time you know you can run on batteries. TIMEOUT 60 # Time in seconds between annoying users to signoff prior to # system shutdown. 0 disables. #ANNOY 300 ANNOY 0 # Initial delay after power failure before warning users to get # off the system. #ANNOYDELAY 60 ANNOYDELAY 1 # The condition which determines when users are prevented from # logging in during a power failure. # NOLOGON <string> [ disable | timeout | percent | minutes | always ] NOLOGON disable # If KILLDELAY is non-zero, apcupsd will continue running after a # shutdown has been requested, and after the specified time in # seconds attempt to kill the power. This is for use on systems # where apcupsd cannot regain control after a shutdown. # KILLDELAY <seconds> 0 disables KILLDELAY 0 # # ==== Configuration statements for Network Information Server ==== # # NETSERVER [ on | off ] on enables, off disables the network # information server. If netstatus is on, a network information # server process will be started for serving the STATUS and # EVENT data over the network (used by CGI programs). NETSERVER on # NISIP <dotted notation ip address> # IP address on which NIS server will listen for incoming connections. # This is useful if your server is multi-homed (has more than one # network interface and IP address). Default value is 0.0.0.0 which # means any incoming request will be serviced. Alternatively, you can # configure this setting to any specific IP address of your server and # NIS will listen for connections only on that interface. Use the # loopback address (127.0.0.1) to accept connections only from the # local machine. NISIP 127.0.0.1 # NISPORT <port> default is 3551 as registered with the IANA # port to use for sending STATUS and EVENTS data over the network. # It is not used unless NETSERVER is on. If you change this port, # you will need to change the corresponding value in the cgi directory # and rebuild the cgi programs. NISPORT 3551 # If you want the last few EVENTS to be available over the network # by the network information server, you must define an EVENTSFILE. EVENTSFILE /var/log/apcupsd.events # EVENTSFILEMAX <kilobytes> # By default, the size of the EVENTSFILE will be not be allowed to exceed # 10 kilobytes. When the file grows beyond this limit, older EVENTS will # be removed from the beginning of the file (first in first out). The # parameter EVENTSFILEMAX can be set to a different kilobyte value, or set # to zero to allow the EVENTSFILE to grow without limit. EVENTSFILEMAX 10 # # ========== Configuration statements used if sharing ============= # a UPS with more than one machine # # Remaining items are for ShareUPS (APC expansion card) ONLY # # UPSCLASS [ standalone | shareslave | sharemaster ] # Normally standalone unless you share an UPS using an APC ShareUPS # card. UPSCLASS standalone # UPSMODE [ disable | share ] # Normally disable unless you share an UPS using an APC ShareUPS card. UPSMODE disable # # ===== Configuration statements to control apcupsd system logging ======== # # Time interval in seconds between writing the STATUS file; 0 disables STATTIME 0 # Location of STATUS file (written to only if STATTIME is non-zero) STATFILE /var/log/apcupsd.status # LOGSTATS [ on | off ] on enables, off disables # Note! This generates a lot of output, so if # you turn this on, be sure that the # file defined in syslog.conf for LOG_NOTICE is a named pipe. # You probably do not want this on. LOGSTATS off # Time interval in seconds between writing the DATA records to # the log file. 0 disables. DATATIME 0 # FACILITY defines the logging facility (class) for logging to syslog. # If not specified, it defaults to "daemon". This is useful # if you want to separate the data logged by apcupsd from other # programs. #FACILITY DAEMON # # ========== Configuration statements used in updating the UPS EPROM ========= # # # These statements are used only by apctest when choosing "Set EEPROM with conf # file values" from the EEPROM menu. THESE STATEMENTS HAVE NO EFFECT ON APCUPSD. # # UPS name, max 8 characters #UPSNAME UPS_IDEN # Battery date - 8 characters #BATTDATE mm/dd/yy # Sensitivity to line voltage quality (H cause faster transfer to batteries) # SENSITIVITY H M L (default = H) #SENSITIVITY H # UPS delay after power return (seconds) # WAKEUP 000 060 180 300 (default = 0) #WAKEUP 60 # UPS Grace period after request to power off (seconds) # SLEEP 020 180 300 600 (default = 20) #SLEEP 180 # Low line voltage causing transfer to batteries # The permitted values depend on your model as defined by last letter # of FIRMWARE or APCMODEL. Some representative values are: # D 106 103 100 097 # M 177 172 168 182 # A 092 090 088 086 # I 208 204 200 196 (default = 0 => not valid) #LOTRANSFER 208 # High line voltage causing transfer to batteries # The permitted values depend on your model as defined by last letter # of FIRMWARE or APCMODEL. Some representative values are: # D 127 130 133 136 # M 229 234 239 224 # A 108 110 112 114 # I 253 257 261 265 (default = 0 => not valid) #HITRANSFER 253 # Battery charge needed to restore power # RETURNCHARGE 00 15 50 90 (default = 15) #RETURNCHARGE 15 # Alarm delay # 0 = zero delay after pwr fail, T = power fail + 30 sec, L = low battery, N = never # BEEPSTATE 0 T L N (default = 0) #BEEPSTATE T # Low battery warning delay in minutes # LOWBATT 02 05 07 10 (default = 02) #LOWBATT 2 # UPS Output voltage when running on batteries # The permitted values depend on your model as defined by last letter # of FIRMWARE or APCMODEL. Some representative values are: # D 115 # M 208 # A 100 # I 230 240 220 225 (default = 0 => not valid) #OUTPUTVOLTS 230 # Self test interval in hours 336=2 weeks, 168=1 week, ON=at power on # SELFTEST 336 168 ON OFF (default = 336) #SELFTEST 336 The configuration I use is pretty simple, basically shutdown the server if the power is down for more than one minute. ANNOY flag is also disabled (set to 0) because I do not need it on headless servers. …

Posted on

APC UPS and HP server gen8 not restarting automatically when power goes back online after shutdown procedure is already starded but not completed

I have got my hands on an APC UPS and some HP gen8 server, installed apcupsd on CentOS 7, connected the USB cable and everything was working fine except for this very annoying issue I had: * power goes down (pull the UPS power cord). after some minutes the UPS battery threshold is triggered and the server shutdown procedure is launched by apcupsd. power goes back up (plug in the power cord) while the server is already shutting down but the shutdown sequence is not yet completed. RESULT: the server will not power itself up even if the correct setting is selected in BIOS (last power state or always on). If the power stays offline for enough time for the server to completely shutdown and for the UPS to also shutdown once the power goes back online the server starts up automatically like it is supposed to do. The only workaround I could think of to solve the issue is running a cron job on the router, which is running OpenWRT, to trigger wake-on-LAN for the server. I don’t really like this solution, it feels hackish but still I could not find a better way to make the damn server power on automatically all by himself. As for OpenWRT and wake-on-LAN, first of all install etherwake from LuCI or opkg: …

Posted on

Nginx, PHP-FPM, SELinux and sendmail

Since I am a real master at forgiving things I am writing this one down. PHP mail function relies on sendmail but SELinux by default block webservers from sending emails, the usual error that pop-out is: cat /var/log/maillog"> --- sendmail[16328]: NOQUEUE: SYSERR(nginx): /etc/mail/sendmail.cf: line 0: cannot open: Permission denied Allow webservers to send email is as easy as editing the appropriate SELinux boolean: setsebool -P httpd_can_sendmail 1 Use sestatus to check SELinux booleans: …

Posted on

Zabbix and XMPP alerts

Zabbix should theoretically be able out of the box to send alerts via XMPP. For some reason this functionality does not work as intended, luckily it is possible to specify a custom script to send alerts; combining the aforementioned script with the Perl library sendxmpp is the easiest way to enable Zabbix from sending notifications via XMPP. $ yum install sendxmpp Create a bash script, this will be invoked by Zabbix to send notifications: …

Posted on

Zabbix server on CentOS 7 and SELinux

Zabbix is an open source resource and network monitoring system, more info: zabbix.com. The official wiki is missing some important bits regarding the installation of the tool on CentOS 7 systems. First of all, let’s add Zabbix repository and then proceed to with the installation of Zabbix and some required dependecies: $ rpm -ivh http://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-1.el7.centos.noarch.rpm $ yum install mariadb mariadb-server httpd zabbix-server-mysql zabbix-web-mysql setroubleshoot Configure MariaDB Login to MariaDB shell, change root’s password, create a new database for Zabbix and add a new user: …

Posted on

CentOS and yum - Error: rpmdb open failed

Today I had Ansible reporting an error on one of my CentOS machines while performing the usual upgrade procedure. I SSH’d into the host to check what was wrong and run yum clean all && yum update manually just to be greeted with the following error: rpmdb: PANIC: fatal region error detected; run recovery error: db3 error(-30974) from dbenv->open: DB_RUNRECOVERY: Fatal error, run database recovery error: cannot open Packages index using db3 - (-30974) error: cannot open Packages database in /var/lib/rpm CRITICAL:yum.main: Error: rpmdb open failed The solution to the issue luckily was fairly simple and quick: …

Posted on

Ejabberd HTTP File Upload (XEP-0363)

XMPP module HTTP File Upload (formerly XEP-0363) provides a way to share files between XMPP clients, it works transparently and even in multi user chats. The sender uploads a file on an HTTP(S) server that will then generate an URI, this is sent to each one of the recipients that can then download it. The interesting bits about this XEP are various: File sharing now works even in multi-user chats (MUC), in any case the file is only uploaded a single time even if the recipients are more than one. Peer-to-peer file transfer, be it in-band (XEP-0234: Jingle File Transfer) or out-of-band (XEP-0065: SOCKS5 Bytestreams), is slow, unreliable, does not work in MUC and does not work if the recipient is offline. HTTP File Upload supports both client-server encryption (HTTPS) and end-to-end encryption when used in conjunction with OMEMO encryption (as per today this is supported by Conversations on Android and Gajim desktop client). 3.1. When using OMEMO encryption the files are stored encrypted on the server, this makes it impossibile for ejabberd to create a thumbnail if the file sent is a picture. To enable HTTP File Upload module with HTTPS enabled in ejabberd edit ejabberd.yml configuration file: > listen: - port: 5443 ip: "0.0.0.0" module: ejabberd_http request_handlers: "upload": mod_http_upload tls: true protocol_options: 'TLS_OPTIONS' dhfile: 'DH_FILE' ciphers: 'TLS_CIPHERS' modules: mod_http_upload: docroot: "/home/ejabberd/upload" # this must be a valid path, user ownership and SELinux flags must be set accordingly put_url: "https://@HOST@:5443/upload" access: local max_size: 25000000 #25 MByte thumbnail: false file_mode: "0644" dir_mode: "0744" mod_http_upload_quota: max_days: 2 shaper: soft_upload_quota: - 250: all # MiB hard_upload_quota: - 10000: all # MiB define_macro: 'TLS_CIPHERS': "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256" 'TLS_OPTIONS': - "no_sslv2, no_sslv3, no_tlsv1" - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256" - "no_compression" 'DH_FILE': "/usr/local/etc/ejabberd/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 4096 Add an iptables rule to allow traffic coming from port TCP 5443: …

Posted on