Sysadmin OpenVZ 7 Kernel info

@jcat you mentioned OpenVZ 7 kernel supports IPSET unlike OpenVZ 6 so wondering if you can provide some information for outputs for these commands

Code (Text):

echo "$(uname -r) ($(uname -r | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'))"

Code (Text):

find /lib/modules/`uname -r` -name 'ipset'

Example

Code (Text):

find /lib/modules/`uname -r` -name 'ipset'
/lib/modules/3.10.0-957.10.1.el7.x86_64/kernel/net/netfilter/ipset

echo "$(uname -r) ($(uname -r | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'))"
2.6.32-042stab127.2 (2006032002)

echo "$(uname -r) ($(uname -r | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'))"
3.10.0-957.10.1.el7.x86_64 (3010000010)

echo "$(uname -r) ($(uname -r | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'))"
5.0.7-1.el7.elrepo.x86_64 (5000007000)

With this info, will be adding proper IPSET detection support to Centmin Mod 123.09beta01 for OpenVZ7 systems like I already do for non-OpenVZ6 systems (KVM/XEN etc)

---

 

Should be fine, I updated 123.09beta01 code to just use kernel version + /proc/user_beancounters file existence to determine if IPSET on OpenVZ7 is supported so should have CSF Firewall auto enabling IPSET support when OpenVZ 7 with 3.10 kernel is detected like Centmin Mod does for KVM/XEN and bare metal dedicated servers

 

Ah yes !!!!

edit: oh already has a check for that

Code (Text):

        # openvz7's 3.10 linux kernels support IPSET
        if [[ ! -f /usr/sbin/ipset ]]; then
            # CSF now has ipset support to offload large IP address numbers 
            # from iptables so uses less server resources to handle many IPs
            # does not work with OpenVZ VPS so only implement for non-OpenVZ
            yum -q -y install ipset ipset-devel
            sed -i 's/LF_IPSET = \"0\"/LF_IPSET = \"1\"/' /etc/csf/csf.conf
            setiplimits
        elif [[ -f /usr/sbin/ipset ]]; then
            sed -i 's/LF_IPSET = \"0\"/LF_IPSET = \"1\"/' /etc/csf/csf.conf
            setiplimits
        fi

but adding one to installers too

 

I swear probably 30-50% of centmin mod's code is just extra logic to make things smarter than plain bash script