Linux Memory Architecture

To execute a process, the Linux kernel allocates a portion of the memory area to the requesting process. The process uses the memory area as workspace and performs the required work. Today we are faced with the choice of 32-bit systems and 64-bit systems. One of the most important differences for enterprise-class clients is the possibility of virtual memory addressing above 4 GB. From a performance point of view, it is interesting to understand how the Linux kernel maps physical memory into virtual memory on both 32-bit and 64-bit systems.

As you can see in Figure 1 there are obvious differences in the way the Linux kernel has to address memory in 32-bit and 64-bit systems. Exploring the physical-to-virtual
mapping in detail is beyond the scope of this article , so I highlight some specifics in the Linux memory architecture.

On 32-bit architectures such as the IA-32, the Linux kernel can directly address only the first gigabyte of physical memory (896 MB when considering the reserved range). Memory above the so-called ZONE_NORMAL must be mapped into the lower 1 GB. This mapping is completely transparent to applications, but allocating a memory page in ZONE_HIGHMEM causes a small performance degradation.

On the other hand, with 64-bit architectures such as x86-64 (also x64), ZONE_NORMAL extends all the way to 64 GB or to 128 GB in the case of IA-64 systems. As you can see, the overhead of mapping memory pages from ZONE_HIGHMEM into ZONE_NORMAL can be eliminated by using a 64-bit architecture.

Advantages of 64-bit over 32-bit

A common misconception is that 64-bit architectures are no better than 32-bit architectures unless the computer has more than 4 GB of main memory. This is not entirely true.

Some operating systems reserve portions of process address space for OS use, effectively reducing the total address space available for mapping memory for user programs. For instance, Windows XP DLLs and other user mode OS components are mapped into each process’s address space, leaving only 2 to 3 GB (depending on the settings) address space available. This restriction is not present in 64-bit operating systems.

Memory-mapped files are becoming more difficult to implement in 32-bit architectures, especially due to the introduction of relatively cheap recordable DVD technology. A 4 GB file is no longer uncommon, and such large files cannot be memory mapped easily to 32-bit architectures.Some programs such as data encryption software can benefit greatly from 64-bit registers (if the software is 64-bit compiled) and effectively execute 3 to 5 times faster on 64-bit than on 32-bit.

Some complex numerical analysis algorithms are limited in their precision by the errors that can creep in because not all floating point numbers can be accurately represented with a small number of bits.

On 32-bit architectures the maximum address space a single process can access is 4 GB. On the other hand, on 64-bit architecture such as x86_64 and ia64, no such restriction exists.

Each single process can benefit from the vast and huge address space.

Disadvantage of 64-bit

The main disadvantage of 64-bit architectures is that relative to 32-bit architectures the same data occupies more space in memory (due to swollen pointers and possibly other types and alignment padding). This increases the memory requirements of a given process and can have implications for efficient processor cache utilization.

How to identify whether CPU is 64 bit or 32 bit ?

Linux users should type the uname command. Depending on the platform, you may see

[root@server1 ~]$ uname -a
Linux 2.6.11-1.27_FC3 #1 Tue May 17 20:24:57 EDT 2005 x86_64 x86_64 x86_64 GNU/Linux

[root@server2 ~]$ uname -a
Linux 2.6.9-5.0.5.EL #1 SMP Fri Apr 8 14:20:58 EDT 2005 ia64 ia64 ia64 GNU/Linux

[root@server3 ~]$ uname -a
Linux 2.6.10-1.771_FC2smp #1 SMP Mon Mar 28 01:10:51 EST 2005 i686 i686 i386 GNU/Linux

In the above listing, ’server1′ (x86_64 GNU/Linux) and ’server2′ (ia64 GNU/Linux) are 64-bit compliant. While ’server3′ (i386 GNU/Linux) is only a 32-bit platform.

Microsoft Windows Server 2003

Method 1

1.Click Start, click Run, type sysdm.cpl, and then click OK.
2.Click the General tab. The operating system appears as follows:
For a 64-bit version operating system: Microsoft Windows Server 2003 Enterprise x64 Edition appears under System.
For a 32-bit version operating system: Microsoft Windows Server 2003 Enterprise Edition appears under System.

Method 2

1.Click Start, click Run, type winmsd.exe, and then click OK.
2.In the details pane, locate Processor under Item. Note the value.
If the value that corresponds to Processor starts with x86, the computer is running a 32-bit version of the Windows operating system.
If the value that corresponds to Processor starts with EM64T or ia64, the computer is running a 64-bit version of the Windows operating system.

———————————————————————————————————————
References:

Wikepedia.org

Linux Performance and Tuning Guidelines (ibm.com/redbooks)

The /USR partition

1. Restart the httpd service. This might free a little space some times.

2. Check for apache logs like error_log, access_log , suexec_log in /usr/local/apache/logs . These can either be cleared off or if you need the logs then you can take a zipped copy and keep it aside.

3. Same can be done for the files in cPanel logs (/usr/local/cpanel/logs)  as well .

4. Domlogs – Get into  the /usr/local/apache/domlogs/ directory. Run the following command :-

# ls -al -SR | head -10        —> It will list 10 files in the decreasing order according to their size

If the domlog file is too large for a domain then it is possible that awstats is not running . Check whether cpanellogd is running on the server  using  pstree . If not, restart it .
Else, it is possible that awstats for only that particular domain is not updating. Get into the directory /usr/local/cpanel/base and check if any file as ‘awstats.domainname.com.conf’ exists.   If yes , delete that file.

Now,  run /scripts/runweblogs for that user.  It will update the awstats and automatically clear the domlogs file thereafter. Do not delete the domlogs file itself.

5. Remove old and unwanted backups of  ‘apache’  that might have been taken long ago. Also, check for any other duplicate folders that can be removed safely.

6. Remove core files, if any . Normally, some core files (like core.1234) might be present in /usr/local/cpanel/whostmgr/docroot . Check for these and remove them.

—————————————————–

The /HOME partition

1.  Check for unwanted cpmove/tar files for the user accounts in /home and delete them.

2.  Check for any cpmove folders as well in /home

3.  Check the folder ‘cprestore’  in /home for any tar files. Be careful. These should  be deleted only if they are very old,say about 4-5 months.

4. Using find command you can check for unwanted tar files(especially cpmove/backup) in the entire home directory. Check their size. If you think that deleting them will  make considerable difference to the disk space then delete them.

5. Check for core files and delete them.

6.  Search for large accounts and see if they are hosting any prohibited content or violating your company policies. If yes, take appropriate measures as per your policies.

—————————————————–

The /VAR partition

1. Restart the mysql service.

2. Log files in /var/log like exim_mainlog, mailmon.log, messages, mysqld.log, mysql_slow_queries.log  can be deleted after taking backups of the required ones..

Note that there is no point in deleting these log files if the size is very small. Check whether deleting these would make any difference.

If you are deleting them then do re-create the files, or you can use the command ‘echo ” ” > logfile’ to empty the existing files.

3.  Clear Mysql logs like server-name.err or any other  present  in /var/lib/mysql

4. Delete mysql-bin.000* file  in /var/lib/mysql, if present.

5. There might be useless large .sql files   in /var/lib/mysql . Delete them.

6.  Remove unwanted emails from spool. You can use the following code to do that :

exim -bpc
exim -bpru | grep frozen | awk {’print $3′}|xargs exim -Mrm
exim -bpru | grep “<>” | awk {’print $3′}|xargs exim -Mrm
exim -bpru | grep “nobody” | awk {’print $3′}|xargs exim -Mrm
exim -bpru|awk {’print $3′}|xargs exim -Mrm
exiqgrep -o 86400 -i | xargs exim -Mrm
exim -bpc

7. There might be yum cache files inside the /var/cache folder which can take space. To remove them do:
#  yum clear all
#  yum list all

8. Again, search for any core files ( core dump ) like core.12* etc.

—————————————————–

The /BACKUP partition

1. Remove any tar/cpmove files if they are too old and large.

2. Remove any old  configuration backups ( like apache.bkp) or any log file backup , say 3-4 months old.

3. Check for core files and remove them.

These are some of the general steps that can be followed to deal with space issues on the servers.

Now, this client is basically a provider of e-commerce based hosting solutions. They deal with plenty of sensitive and important data. Hence, becoming PCI Compliant was mandatory for them. Recently they were getting too many potential customer queries whether they are PCI Compliant. Achieving this has helped them grow their business by almost 50% in last couple of quarters.

A PCI Scan tells you what could be potentially insecure about your server. This is particularly important where storage of sensitive data occurs. Therefore, PCI Compliance is something which is preferred by most credit-card companies these days.

The PCI Security Standards Council talks about 12 basic requirements broadly divided into 6 categories. This is called the PCI-DSS (Payment Card Industry Data Security Standard)

This is required in order to avoid data frauds where card information is stored.

You can find these details at https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

Following are the important steps that we took in order to ensure that their cPanel servers pass the PCI Scan :-

- Installed a firewall : A server is not likely to pass the PCI Scan if there are unnecessary open ports. We installed CSF on the server. Alternatively, APF can also be used. We closed all the ports except for the ones required for the essential services. Certain standard ports like 2082, 2086 and 2095 could produce a negative result. So, we configured WHM to use the secure ports only.

- Updating the packages : Just run /scripts/upcp to update all the packages. Also, we had to make sure that Apache , PHP and MySQL were running the latest version.

The suggested versions are :

MySQL 4.1.22 or above
PHP 5.2.5 or above
Apache 1.3.39 or above ( Certain scans might require Apache 2.0.x )

OpenSSL 0.9.7j or above

cPanel suggests that you should keep cPAddons up to date as well.

- Disabled mod_userdir : If a site on the server can be accessed as http://serverip/~username

then it means that mod_userdir is ‘enabled’. We can disable it through WHM > Security Center > Apache mod_userdir Tweak

- SSL : At least, one SSL certificate from a recognized certificate authority is required. We

installed SSL for Apache. SSL can be installed for other services as well.

- Apache Setup should not be revealed: We all have seen the ‘404 Error’ page at some point. Information about the Apache Setup

should not be available on that page. This can be achieved by adding the following lines to the ‘httpd.conf’ file :

ServerSignature Off

ServerTokens Prod

FileETag None

- Disable SSLv2 and other weak encryption methods : Some services doesn’t allow you to

choose between SSL protocols but most PCI Scan overlook it.

The Weak SSL cipher issue has been an headache for people who want to pass the scan.

Thankfully, cPanel 11.24 has got an in-built solution for that.

Just go to WHM > Apache Configuration > Global configuration and copy paste the following :

ALL:!ADH:!NULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+SSLv3:+TLSv1

- mod FrontPage – It is likely to cause a scan failure. Therefore, we kept it disabled.

- Separate services – cPanel recommends that you keep services separate like MySQL server on

a local subnet, remote DNS only, no local BIND etc

- 2 factor authentication – This is another suggestion by cPanel that we adopted. A 2-factor

authentication procedure which requires a key and a passphrase.

- Besides all these, another important measure that we took was running the Nessus Scan.

It is a wonderful freely available tool to find any vulnerabilities on your server. You can find the details on the official Nessus website – http://nessus.org

Nessus basically consists of two parts, the server and the client. Once you are done with the two installations you need to add an user for the scanner and then you can start a scan on any remote server. The scan might take a while. It will give you a detailed report about all the package related vulnerabilities and any security loopholes. The best thing about Nessus is that it will also give you suggestions on how to fix those.

Thus, Nessus will tell you almost everything that needs to be done in order to achieve PCI Compliance.

I will be discussing about the installation and working of Nessus in the coming articles.

Let me tell you that different scan companies have a different approach . Hence, the requirements vary and they might have many more than the ones mentioned above. But these are the very basic ones that need to implemented for sure. I hope this article would be helpful for those looking forward to achieving PCI Compliance.

As a trainer, you need to first keep in mind a few basic techniques and formulate a training methodology. The process is independent of what you teach. You could be teaching apache, DNS or walking them through the features of cpanel. But a common teaching methodology is applicable for each of these topics. The following points try to capture the essentials of a training methodology :

1) GETTING STARTED :

a) Organize study material – You need to make sure the trainees are actually using the material prepared for them. They should also find the material convenient to use.

Make the material as modular as possible, and email them the modules, one at a time. This is a far better approach than asking them to use your online tutorials. Most students don’t prefer using online study material. You need to hand it to them directly, and give them only what is required at the time. Don’t email them the entire course manual, as they would simply get lost in a sea of information. There is also a risk of them skimming through all the topics without really focusing on them one at a time.

b) Make them understand the business – Before getting into the technical topics, it is extremely important to make them understand how the hosting business works.

All the components of a hosting operation need to be listed out and connected, preferably using diagrams and examples. They need to be familiarized with the various vendors, contractors and service providers that your company uses, and the relationship and significance of each of these entities.

2) LAYING THE FOUNDATION:

a) Get their basics right – Start with the basic topics and make them understand it thoroughly. Specifics can be taught later.

For instance, it is important to first make sure they understand the basics, such as how apache and DNS works, before teaching them how to compile stuff. Explain how a domain name resolves to IP, how webservers serve pages and how email works. Lay a strong foundation, and build on it.

b) Enter topics quickly – Don’t waste time with introducing the topic and giving prefaces. Keep increasing the “detail level” gradually. Make it easy for the students to enter. Once they’re in, turn up the heat.

While explaining DNS for example, first explain to them that it acts like a database which associates domain names to their corresponding IP addresses. You could then explain the series of events that happen outside a DNS server, during the process of domain name resolution. Next, the structure of a DNS server can be explained. Specific details such as TTL can come much later, after the trainee has understood what DNS is all about.

3) THE PRACTICAL APPROACH:

a) Talk less, do more – Demonstrate how things work.

Your training process should mostly consist of lab sessions. Once you’re done explaining how an email is delivered, show them what actually happens on the server. Try sending email and showing them the complete verbose output, with all the handshakes and transactions that take place. Show them the relevant files that come into play, show them log messages, open the inbox and show them the email itself, walk them through the headers for the complete picture.

b) Make them lose their inhibitions and gain confidence – Set up prototypes for them to work on.

One of your most important objectives as a trainer, is to make your trainees lose their fears. You may find that your trainees are just too inhibited, while working on your servers or while using the admin tools and control panels You may often find them taking too much time doing simple tasks, because they’re too unsure and are low on confidence. Just like you probably were, the first time you entered a live server or tried to modify a real account.

The solution to this is to constantly engage them in practical exercises on prototypes. Avoid using live servers. Instead set up a local server farm in your intranet, complete with domain names (that resolve locally within your intranet), accounts and control panels. Set up as many exercises as possible, so that they become comfortable with the type of work, gain confidence and lose inhibitions. The trainees evolve into productive, efficient employees in quick time through this.

4) TEACHING TIPS

a) Always draw a real life parallel – A real life association helps them understand the subject and ignites interest. For example, instead of spending 10 minutes explaining what Mailman is, tell them it is a sofware that works similar to yahoo groups.

b) Never “lecture” continously for long – Talk in short, crisp sentences, interspersed with questions and similar interactive sessions.

c) Drill it in – Repeat what you said over and over again, in differently packaged sentences and actions. Our memory seems to absorb data more effectively when we encounter it repeatedly.

d) Be passionate about the subjects – The excitement and interest that you arouse in the trainees is directly proportional to what you have towards the subjects.

e) Teach through stories – While explaining a flow of events, package it in the form of a story.

Though a cliched teaching technique, it is also one of the most underestimated ones. Stories bring about an element of liveliness, curiosity and enthusiasm in the teaching sessions. Besides, it also helps memorize information very well because the stories greatly improve association and recall.

5) EXERCISING THE BRAIN

a) Give their brain a tough workout – Devise methods which will ensure that their brains get a lot of exercise.

It is a well known fact that our brain gets more exercise when you throw things at it that don’t meet expectations, as opposed to those that do. So set up as many twisted and unpredictable problems as possible. Don’t help them a lot. Let them wrack their brains and arrive at solutions. Refrain from spoonfeeding.

b) Set up interactive exercises – Organize quizzes, seminars, competitions. Make the whole training programme look like one big tournament. Conventional oral examinations are also highly recommended, preferably on a daily basis. Let there be prizes and trophies, to add the vital elements of appreciation and achievement.

Your organization’s employees are its jewels. But it is not possible to create a jewel without first mining and polishing the gold. All the best with your training efforts!