CentOS/RHEL Shrink Partitions

Increasing LVM partition sizes in CentOS/RHEL 5.X is infinitely easier than shrinking them, but in the rare instance where you might have to, here's a quick guide on a couple of gotchas. If you need to shrink the / partition (probably the rarest occurrence), you're stuck booting off a LiveCD and hoping for the best.

Now I bet you're saying something along the lines of "but all the other partitions should be easy, right?" Uh, no, particularly /usr. Why? Well, someone decided that the LVM utilities should reside under /usr. Not a big deal, they provide a static /sbin/lvm.static, which, while the syntax is slightly different, provides most (all?) of the functionality you are used to from the LVM utils.

Great, problem solved, right?! Nope, not quite. While /bin/bash (default root shell) doesn't depend on libraries under /usr, it does hold open files from the /usr tree. That prevents you from un-mounting /usr.

To shrink "system" partitions (except /, see above), you will likely need to be in single user mode, but before you do that, run chsh:

[root@centos5 ~]# chsh
Changing shell for root.
New shell [/bin/bash]: /bin/sh
Shell changed.
[root@centos5 ~]#

to change the login shell for the root user. After you are done, you can switch it back. Now reboot into single user mode.

Once in single user mode, you'll notice the prompt has now changed to:

sh-3.2#

or similar. Even though /bin/sh is just a symlink to /bin/bash, bash detects that it's being run as sh, runs with a reduced feature set, which doesn't require it to open files on /usr.

To shrink the /usr partition:

• umount /usr 
• e2fsck -f /dev/path/to/lvm/partition 
• resize2fs /dev/path/to/lvm/partition  [new size slightly smaller than desired final result]
• lvm.static lvmreduce -L [new size] /dev/path/to/lvm/partition
• resize2fs /dev/path/to/lvm/partition
• e2fsck -f /dev/path/to/lvm/partition
• mount /usr  

Wash, rinse, repeat for other partitions.

Enjoy. -R

Don't miss SANS Network Security 2012, September 16-24 in Las Vegas, your annual mega-networking opportunity. Choose from over 35 courses, huge vendor expo, riveting bonus sessions, and a thrilling NetWars competition. Sign up today! http://www.sans.org/info/107529

Sguil RPMS and YUM Repository

In an effort to improve the install process for Sguil, I've created and maintain a Sguil YUM repository for RHEL/CentOS 4/5 systems at:

http://synfulpacket.net/sguil (Sguil version 0.6.1)

or

http://synfulpacket.net/sguilcvs (Sguil version 0.7.0)

From the readme:

This is a *beta* Sguil 0.7.0 repo, so use at your own risk. It's intended to
work on CentOS 4 and 5.

In order to use this yum repo, you'll need to do the following:

1. Create a yum.conf entry. For CentOS 4+, create /etc/yum.repos.d/synful-sguilcvs.repo
with the following contents:
------------------ Below this line ------------------------

[sguil]
name=Sguil Repo at synfulpacket.net
baseurl=http://synfulpacket.net/sguilcvs/$releasever
gpgcheck=0

------------------ Above this line ------------------------

$releasever will expand to 5Client on RHEL5 Desktop installs,
I've placed a symlink to allow those installs to work.

2. Add the following line to CentOS - Extras:

exclude=libnet*



Now you should be able to run:

yum -y install sguil-server
yum -y install sguil-sensor
yum -y install sguil-client

and have the neccessary software download and installed.

Please report ANY issues to rfifarek *AT* synfulpacket *DOT* net, as this is completely
maintained by me.

Enjoy.

Richard H. Fifarek
rfifarek *AT* synfulpacket *DOT* net

In order to use the Sguil 0.6.1 repository, replace sguilcvs with sguil.

Thanks!