CareersNG

Hi,
I am looking for 4 Linux engineers!
One of the leading broad band ISP/VPN service provider in Nigeria is looking is for atleast 2 Linux admins and i am asked to refer them.
Are you the person
please just reply this post telling us what you do with Linux!

Regards

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

I am not ready for the job yet but would definitely be back soon!!!

Hello,

i am a Unix/ Linux System and Network Administrator. i have more than 6 years experience uisng Linux as User and as administrator. I have implemented lots of servers such as DNS, Mail Server (Sendmail) Squid Proxy cache server, Apache, FTP, MYSQL and IPTABLES on linux platforms. I am also a certified HPUX system administrator who also doubles as a SUN Solaris Administrator and SUN Microsystems Engineer

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

Hi LNAs,
Please quickly indicate your interest if you are interested in this opportunity.
My friend (Head of Eng) in this company is seriously on my neck to recommend someone.. and its urgent..
Infact if you are close to VI i wld just ask you to goto the office today and do your interview and start tomorrow.
I also learnt the salary is competitive its in the range of 200k =< pay < 350k

Ping Me asap!

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

i) how do you filter unwanted URLs on Squid ?
Please find the answers to the questions as below:


Unwanted URLs can be filtered out using Squid ACL and can be combined with SquidGuard

ii) you have your Squid installed on a 160GB HD and a 16GB RAM hardware. How would you optimally configure squid's cache size and your cache_mem size when; (a) you have about 200 subscribers browsing on your network. (b) you have 2000 subscribers
160MB cache_mem size and 64GB cache_dir should be be optimal

iii) whats Squid's default port number ? and what can you change it to ?
Squid default port is 3128
it can be changed to any desired port outside the standard IANA ports

iv) whats the difference between your resolve.conf file and your hosts.conf file.
resolv.conf file contains the nameserver (dns ip_address) which are used to translate domain names to ip_address and reverse name lookup as well
hosts.conf contains a mapping of ipaddress to hosts that will not require name service lookup, it can also contain the alias to the hosts.

Fowe, He has answered o. Oya give him the job.

_________________
http://segun-kosoko.blogspot.com/
segla

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

which kind recruiter you be sef?

I understand you want him to do some cal and justify why he would configure squid for those number of users but for number (iii) it depends on why you don't want 3128 to be accessible. either cause of some iptables or firewall rules or probably another priority application would be using that port, hence, you decide on what you want your masqueraded port should be. for (iv) what stories again do you want then what is in the book?


In summary the guy knows what is doing, recommend him jare...

_________________
http://segun-kosoko.blogspot.com/
segla

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

Well, i'm new here, a friend referred me when he saw this post so i thought it good to reply. Hope you guys will permit me to join this thread.
I'm a 2yrs linux freelancer and have done freelance jobs developing automated apps for bash shell. Also worked for SQL star int'l for 6months last year as a junior sys admin. I am an RHCE from Redhat India.. Not replying coz of the job, just sharing knowledge, that's wht i love to do.

1) To filter unwanted URLs
create a file in /etc/squid, list all unwanted URLs in that single file and create an ACL of http_access deny for that filename. If you want to block IPs instead, list the ip addresses and do the ACL as said. When done, restart the squid service. To know if there are errors, do squid -S.

2) Well, this question has got several tunes to it. Basically, it depends what other services are running on the squid server that determines what space quota that will be allotted to /var/spool/squid. A wise configuration however is to write a small bash script to clear the cache whenever the cache use has reached 70% or thereabout of the size. This works, irrespective of the number of subscribers, it is a sufficient solution.

3) Well, basically, we all change default port numbers for security purposes. Thinking from a security point of view, an attacker might find it easier to exploit default ports than customized port numbers. However, as much as it is advisable to use customized ports for services, it comes at a cost wc is complexity! As a near standard practice among engineers however, we often change squid's port to http port 8080, which makes it easier to remember. The http_port variable makes life even easier by allowing you define even more port numbers for the same squid service. In all, engineers should remember my favorite quote "you are not paid for the number of hours spent at work or the complexities involved, but only for those services that work", so il'd rather leave the default port 3128 alone!!!

4) I feel AYTope's response about host file and resolv.conf is good enough for this forum, for additional info, pls check the linux documentation!

Thx for readin, hope we've learnt something!

Olukorede Aguda!

Hey koredyte,
good to know you love sharing knowledge.. good to find another LNA that we share thesame values

i like your responses..

i) good answer
ii)i dis-agree not quite!
iii)very good answer
vi) yes i agree..

.. i saw you talking about bash, can you please let me know all you have done with programming .. ?
this job actually prefere an LNA who can also code and systems level, network level and even some OOP in any high level programming language.

Regards ...
-Fowe

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

@ question 2.

the basic thing is to reselve about 40-60% of disk space as disk_cache while cache_mem is 10MB for every 1GB RAM.

other things u may consider are the level of sub directory but the default rule works fine.

@question 3
port 8080 can be exploited as easily as any other port (3128). it is a matter of security put in place (firewall, port filtering etc). i dont think 8080 is any easier to remember than 3128. it is just a question of what you decide to use.

@question 4

when you configure DNS, the entries are written to /etc/resolv.conf

while your /etc/hosts contains basically host on d network you would prefer to refer to by an alias or hostname rather than ip_addr

Nice posts...
(ii) is subjective ..
since there are two caching functionality that Squid gives you.. one is Disk caching and another is memory caching.
memory caching is smaller but faster request-response.. while disk caching is larger but slower to build and slower response too.
what i am thinking is that having a 16GB RAM gives u d chance to increase your cache_mem significantly (breaking default rules) and optimize squid performance drastically for bandwidth savings..
another config variable i xpect to be mentioned in explaining (ii) is maximum_object_size_in_memory field.. which helps u tune the types of files that can be stored in memory.. so i wld change the play-safe default 8KB value to like 2MB.. so as to catch some popular downloads in memory and safe bandwidth...., i wld come up with more questions soon..

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

Fowe,

For 3rd question, the idea is that port 8080 is often a target of most intruders. Most of them go into it with the motive of attacking httpd, but to their surprise, they see squid there which isn't often a target service. In all though, try to be smart! Like you said, it's a question of what you decide to use, as long as it is >1023 !

You asked what i've done with programming....lots!

I have a very solid programming background, and have developed front end apps following standardized OOP approaches.

Right now, i am working on a project where i am interfacing a framework I built in Perl/CGI with bash scripts running at the background to provide interfaces for some sample network services. Something similar to webmin but with an additional feature which provides a higher abstraction to the shell by making it possible to access the shell from a web front end...i'm enjoying it for now, just that when i get stucked, it becomes uninteresting and then, i take some time out to play some soccer, since i'm not a good chess player...

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

@Fowe

this ur question , u sure say na this same nigeria this bloke one dey work so?.. with the amount of linux technical requirements expected, this don't make me wanna be a linux admin. Click and Click the microsoft way seems easy.. Some of all this requirements can only be attained via experience working in the field. what happens if this is the persons first job as a linux admin...

_________________

Well Fowe, i'm primarily not a hardware person, all i do is soft and soft alone. However, my specialization compels me to understand the basics of tcp/ip. Also, i am a firewall admin so from that perspective, i will try to answer you.

1) TFTP...like the name implies is trivial, thus it uses minimal amount of memory compared to ftp. This is why it is used to bootup machines that has no large storage to store OSes e.g routers and x-terminals. Also, i know it uses UDP unlike ftp which uses TCP, thus it is faster but delivery is often not guaranteed. U know the other details of TCP and UDP don't u?

2) Custom comms. protocols...don't think i understand that, i know ppl write customized protocols, but not sure i've done that before, or maybe i just didn't know what it's called when i did it... ... but in terms of optimizing bandwidths, i can provide solutions software wise, the rest lies with the network guyz...i know networking principles in and out, but i don't like to touch the cables how much more the crimping tool...my bad!

3) /proc/sys/net/ipv4/ folder in general is used to configure options for ipv4. From ipv4 forwarding down to ip redirection/routing...but hands on wise, i've used it basically for ip forwarding. Since every other stuffs about ipv4 lies there, i can always find my way. Besides, i feel it's in a rare case that you'll find a linux OS being used for ip forwarding when a h/w router can do it comfortably without any burden on the OS, it's possible anyway!

4) TCPDump? Ask me about Wireshark instead. I know engineers from redhat support used to tell my boss then how effective TCPdump is compared to any other traffic analysis tool, but for me, i still got stuck to wireshark that it was pretty difficult changing coz of the GUI. Besides, i didn't have any cogent need to change. Personally, i still havn't seen what tcpdump would do that wireshark would not including viewing login IDs and passwords, URLs and content of websites being viewed, or any other info not sent in an encrypted format. Sorry, i'm not that good with TCPdump but i can always work with it when need arises.

5) Usually, being that i double as a firewall admin, il'd always recommend a firewalls to create tunnels rather than a linux box or even a hardware router. I'm a kind of admin that prefers to allow the enterprise spend money and get the best than use one single box for everything ending up in a crappy configuration. But for the rare case, here is a basic configuration of an IP tunnel in RHEL 5
DEVICE=fowe_tun
TYPE="GRE Tunnel"
DEVICETYPE=gre
BOOTPROTO=none
ONBOOT=yes
USERCTL=no

MY_IPADDR=ur ip here
PEER_IPADDR=peer's ip here
PEER_PRIVATE_NET=peer's valid network here.

have tried it countless times on my vmware with two different networks and it works just fine. Try it out!

6) Not so sure, but i feel the routed daemon would help do that automatically. Not done that before really, but i don't see any challenge in doing that. Once a dynamic routing protocol e.g RIP has being configured on another device, i feel it should be easier to get another device use it...i'll play around with the routed daemon tonight ok.

7) tc...taraffic control i guess? I surrender... Really, i've not worked along that line before, will work around it soon ok.

Have fun!

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

Resume...i've got none.... will pm u anyway!

As regards Zebra, never heard it before, but as i write, i already have it downloaded...will try some tweaks with it.
Saw what you posted on TCPdump, Wireshark would do it well, but u hv a point there...it's not economical when it comes to bandwidth as it is graphical...

Whao! Interview on the web? Tell me its a joke, please. Ah, that's better, thanks.

_________________
More twisted than dreadlocks

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.

OK ooooo wey dem!

Nokia Nigeria is looking for a young Linux & TCP/IP person.. + post NYSC
If you understand all that has been discussed in this thread... then send me a PM and i would share u my email addy to send me your CV!

Thanks!

_________________
Fowe.
Choices make or mar Chances ... add extra care to your choices today.