View package changelog prior to updating

On Redhat/CentOS systems, have a look at the Yum "Changelog" plugin, "yum-plugin-changelog" or "yum-changelog" package

See “man yum-changelog”.


This lets you see what has change on a package between the version that is already installed and the latest available version.

Go to a system, and run “yum  update --changelog”

Or, for a narrower view, try: “yum update kernel --changelog”

We should use this when we patch, to understand what is changing and to scope potential impact, rather than to simply “patch and pray”.  Alone it is not enough (release notes should also be reviewed where available), but it is a good start and may help in flagging potential problems.

In particular, we should look at this on critical infrastructure servers, especially for those that get their software from external repositories where the software changes may be more impactful than standard RedHat/CentOS packages (which generally remain on the same version, with only back-ported bug and security fixes).

Macbook Pro fails

1. Turning the thing on after initial setup. I go to install Firefox.  Firefox opens the first time. ...A dialogue box pops up to "do you want to make Firefox your default browser?"  Immediately, a "tour firefox" box pops up in front of that.  I can't do anything, because the first box must be clicked before the second can be acknowledged.  Can't move either, click on either, etc.  Even though Firefox popped up the dialogues, I blame OS X because I should be able to at least switch windows.  In the end, I could only maximize the main window, which allowed me to click on the "behind" default browser window.
2. Plug and play fail -- plugged in a Microsoft Natural keyboard. ...OS X failed to detect it correctly.  I have to run through steps to get it to detect it correctly. ...and even then, the ctrl, windows/super, and alt keys are all mixed up.
3. Keyboard key mapping fail
1. The "end" key does not move the cursor to the end of a line.
2. The "windows" key / super key acts as the control key; the control key is something else. 
4. SMB DFS namespace does not work... finder will open it up, but browsing to a linked folder stalls indefinitely -- no timeout, no error, no ability to navigate DFS. ...Linux has had this capability for a decade or more.

Protect and access your passwords anywhere

Web sites are regularly compromised and your data may be compromised.  Server applications have as-yet-undiscovered weaknesses, as do even security appliances and encryption protocols.  The Heartbleed vulnerability with the very widely used OpenSSL was recently made public.  The details on how and even whether it may have been used to compromise data are not as clear to me.  However, we know that the vulnerability can allow sensitive data to be stolen from devices that use it for encryption.

In any case, if you haven't rolled your passwords in a while, this could be a good time to do so.  If you're doing so, it should also be a good time to finally start protecting your online and financial identities in this well-connected world the same way you lock the door on your home and perhaps have an alarm on your car.

Others may/will disagree, but here's what I recommend, as a way to (1) always have strong passwords, (2) reduce risk of a compromise of one account meaning other things get compromised, and (3) ensure that you can always get to your passwords in a pinch, any time, from nearly any device.

1. Use a local storage password keeper program, one that never uses unencrypted temporary files and has sensible semantics for automatically backing itself up and locking itself.  I like Password Safe, for example. Download the latest here: http://sourceforge.net/projects/passwordsafe/files/passwordsafe/  (supports Windows, Linux, Android, MacOS X, iOS) 
2. Use a free backup program and service from a reputable (publicly traded, with a lot to lose if they abuse your data,) to sync your encrypted password safe and ensure it survives local hard drive failures.  I use DropBox.  Dropbox lets you have a "dropbox" folder on your local computer (Windows, Linux, Android, MacOS X, iOS) that is automatically backed up to a cloud, and makes the files accessible from other computers (e.g., between yours, mom's laptop, and home PC; even via the web, and from Android and iOS phones).  Once you have run password safe and "saved" your password safe to your "Dropbox" folder, it is backed up automatically.
3. With two exceptions, all of your passwords will be completely random; only your password keeper program and your password safe will have phrases that you can remember, that nobody else could guess, and that are different from each other.
1. I suggest picking a sentence that only you would know for your password, something from your childhood like: "Oh, how I loved camp chatta-wookie as a child." (If you thought to use that exact phrase, repent and sit in the corner for 5.)
2. Better yet, let your spouse choose a phrase that you can both remember. Like a sentence about a great memory -- you get the idea.  Then you can share the same password safe.  If something happens to one of you, the other can still log in to your sites to take care of business.
3. You could use a favorite line from a book, but you need to change it in a way that someone else would not use or guess the exact same phrase; e.g., don't use "For God so loved the world" or "Et tu, Brute?", because those are very common phrases.
4. Create an account with your online backup/sync provider using the pass phrase advice in the last step.  You will need to be able to recall this if you ever want to access it from a computer other than your regular PC/laptop, or if your local hard drive fails.  This is the one password that you may write down somewhere and keep in your safe. Compromise of this phrase will allow someone to get at your synced files, but they won't be able to get your passwords -- those will be encrypted using a different password.
5. Start up the password safe program and assign a different passphrase than the one you used for your online backup/sync provider.  If you forget this pass phrase, you're out of luck.  Save your new password safe data file to the location that your backup provider uses. For drop box, that would be a "Dropbox" folder under your home directory or documents folder.
6. Now, go to each site where you have an account and change the password, recording it in the password safe program and following this method:
1. For Title, use a name of the service so that you can find it quickly in the list. When your list grows large, you'll want something that is meaningful
2. For Username, use the exact username as you use it to log in.
3. For password, click "Generate".  For details on how to configure Password Safe to be naturally stronger, see below.  If you're not going to use strong, unique (if not random) passwords, then nothing else you do will matter too terribly much, and you have left your windows unlocked and inviting.
4. Copy and paste the generated password into your web site in the change password / new password field.
5. URL: specify the web site URL, if it's a web site. This will help you to remember how to get to the exact site, or to search your list of passwords more easily.
6. Use "Notes" to record stuff you'd need to remember. You might record the date you opened the account, or answers to security questions (see below on security question).
7. Click "OK" to apply.  I like to go into password safe and configure it to automatically save every time I change a password. I also like to configure it to *not* use the system tray, so it actually exits and closes when I click the close button.
7. Thoughts on passwords
1. Always let let your password safe program randomly generate passwords for every site where you register.   Perhaps the only exceptions would be your main email account, your password safe "combination", and your data sync/backup site.  Set those to other sentences that you will always remember. 
2. Never, ever use the same password twice.
3. Using random and unique passwords ensures that if a person gets a password or access to one site, they'll have a harder time getting access to another site. Consider that some IT staff and related functions may be able to actually see your passwords that you used to register for sites at companies you deal with; if you use the same passwords, an unscrupulous IT staffer could then simply guess what sites you might use in order to gain access to other accounts and steal your data or impersonate you.
4. Ensure that the passwords are long and complex (10+ characters, including alpha, num, and punctuation where the site permits it).  In Password Safe, you configure the "password policy" using the Manage menu --> Options --> Password Policy.
5. Never write down your passwords elsewhere for any site.  Even silly sites.  Compromising silly sites is one way for someone to socially engineer their way into assuming parts of your identity or learning more about you to compromise the rest.  An exception would be to put the password in your strong home safe (not in a locking drawer that can easily be broken into).
6. Never access services like these from a public or shared computer. Never.
8. Thoughts on security questions:
1. Generally speaking, security questions are a bad idea: they provide in some circumstances a backdoor to bypass the best passwords; and it is too easy for other people to socially engineer in order to take advantage of security questions.
2. How many people know the name of your pet, your first school, the street on which you grew up, your teachers, mother's maiden name?  Too many. Much of it is public knowledge; much can be gleaned by casual strangers from social networking sites.
3. My recommendation for security questions?  Give bogus, random-ish answers, and store those questions and answers in the "Notes" section for that account in your password safe.  If the answer is false and unrelated to real life, it will be much harder for a ne'er do well (old boyfriend, identity thief, etc.) to provide those answers to gain access to an account.
9. Thoughts on the complexity, and the rule of KISS:
1. While I understand that this is not as easy as using a password sync service, I still prefer this methodology, in part because I do not necessarily trust any vendor with a single point of access.
2. Because password safe encrypts the file locally, and that encrypted file is synced to a private dropbox account, there is not a single person that could potentially have access to my data: even if password safe's encryption is compromised (and it will be, like everything), then someone would still have to gain access to the encrypted datafile on my personal dropbox account or on my personal computer. 

Now, if you've done all of this, then you are more protected than otherwise against password guessing and other attacks, and you can get to your passwords from any computer, even an android phone, as long as you remember your password safe account (and your dropbox password, if you don't have any other computer).  

You'll never keep the NSA away from your passwords, data, and accounts, but this should keep organized crime and casual miscreants away.

Using this method, I even have secure access to my passwords from my smart phone when I need them.  And I don't have to actually remember but a couple of passwords.

I welcome your thoughts and critiques. Everybody has blinders, perhaps you've found a problem with this method?

Remote bulk file edits and administration with SSH and SED ( sed examples )

Want to deploy the zabbix agent to a bunch of Ubuntu Linux systems? Easy. But wait... the config file for each needs to be updated. How about this:

for target in host1 host2 host3 host4; do echo $target; ssh -t $target "apt-get -y install zabbix-agent; sed -i.bak -e \"s/Server=localhost/Server=10.10.1.11/g\" -e \"s/Hostname=localhost/Hostname=$target/g\" /etc/zabbix/zabbix_agent.conf /etc/zabbix/zabbix_agentd.conf; update-rc.d zabbix-agent enable; /etc/init.d/zabbix-agent restart"; done

This will:

1. ssh to each host
2. install the agent on that host
3. replace the default "Server=" and the "Hostname=" lines in the two config files zabbix_agent.conf and zabbix_agentd.conf", where 10.10.1.11 is the zabbix server ip address.
4. make a backup of the two config files
5. configure the zabbix_agent to auto-start
6. restart the zabbix agent to pick up the config file changes.

That was easier and more reliable than trying to complete the procedure on 50 systems.

(think about updating fstab and others for a mass of hosts.)

For a simple file in-place edit of one line of a file (such as to comment out a line on all the systems' config files):

for target in host1 host2 host3 host4; do echo $target; ssh $target "sed -i.bak -e 's/^domain mynisdomain server mynismaster.company.com$/g #domain mynisdomain server mynismaster.company.com' /etc/yp.conf"; done

If you have a file to edit, and the line you want to replace has quote marks, you'll need to escape them with \\\ like so:

for target in host1 host2 host3 host4; do ssh $target "sed -i.bak -e \"s/^ENABLED=\\\"false\\\"/ENABLED=\\\"true\\\"/g\" /etc/default/sysstat "; done

PostgreSQL Tips and Tricks


# Log in to a postgreSQL database
psql -U username dbname

# Get list of databases.
SELECT datname FROM pg_database;
# or
\l
# or
psql -l

# Get size of tables, sorted in descending order.
SELECT relname, relpages,reltuples FROM pg_class ORDER BY relpages DESC;

# Show tables in a database.
select * from information_schema.tables where table_schema='public' and table_type='BASE TABLE';
# or
\dt

# Show structure of a table.
\d tablename

psql Commands

General

\c[onnect] [DBNAME|- [USER]]	connect to new database (currently "dfdata")
\cd [DIR]	change the current working directory
\copyright	show PostgreSQL usage and distribution terms
\encoding [ENCODING]	show or set client encoding
\h [NAME]	help on syntax of SQL commands, * for all commands
\q	quit psql
\set [NAME [VALUE]]	set internal variable, or list all if no parameters
\timing	toggle timing of commands (currently off)
\unset NAME	unset (delete) internal variable
\! [COMMAND]	execute command in shell or start interactive shell

Query Buffer

\e [FILE]	edit the query buffer (or file) with external editor
\g [FILE]	send query buffer to server (and results to file or pipe)
\p	show the contents of the query buffer
\r	reset (clear) the query buffer
\s [FILE]	display history or save it to file
\w FILE	write query buffer to file

Input/Output

\echo [STRING]	write string to standard output
\i FILE	execute commands from file
\o [FILE]	send all query results to file or |pipe
\qecho [STRING]	write string to query output stream (see \o)

Informational||

\d [NAME]	describe table, index, sequence, or view
\d{t|i|s|v|S} [PATTERN] (add "+" for more detail)	list tables/indexes/sequences/views/system tables
\da [PATTERN]	list aggregate functions
\db [PATTERN]	list tablespaces (add "+" for more detail)
\dc [PATTERN]	list conversions
\dC	list casts
\dd [PATTERN]	show comment for object
\dD [PATTERN]	list domains
\df [PATTERN]	list functions (add "+" for more detail)
\dg [PATTERN]	list groups
\dn [PATTERN]	list schemas (add "+" for more detail)
\do [NAME]	list operators
\dl	list large objects, same as \lo_list
\dp [PATTERN]	list table, view, and sequence access privileges
\dT [PATTERN]	list data types (add "+" for more detail)
\du [PATTERN]	list users
\l	list all databases (add "+" for more detail)
\z [PATTERN]	list table, view, and sequence access privileges (same as \dp)

Formatting

\a	toggle between unaligned and aligned output mode
\C [STRING]	set table title, or unset if none
\f [STRING]	show or set field separator for unaligned query output
\H	toggle HTML output mode (currently off)
\pset NAME [VALUE]	set table output option (NAME := {format|border|expanded|fieldsep|footer|null| | |numericlocale|recordsep|tuples_only|title|tableattr|pager})
\t	show only rows (currently off)
\T [STRING]	set HTML tag attributes, or unset if none \x toggle expanded output (currently off) Copy, Large Object \copy ... perform SQL COPY with data stream to the client host \lo_export LOBOID FILE \lo_import FILE [COMMENT] \lo_list \lo_unlink LOBOID large object operations

How to process command-line args in bash scripts

while [ $# -gt 0 ]; do
case $1 in
--somevar)
SOMEVAR=$2
SOMEVARSTR="--somevar $2"
shift; shift
;;
--othervar)
OTHERVAR=$2
shift; shift
;;
--version)
VERSION=$2
shift; shift
;;
--debug)
DEBUGSTR="--debug"
shift
;;
*)
if [ -n "$TARGET" -o ! -d $1 ]; then
usage
fi
TARGET=$1
shift
;;
esac
done

Gathering information on Windows Servers

Some of these tools require you to download the Windows (2003) support tools and install them on a Windows XP or 2003 computer that is a member of the domain; download the tools from http://support.microsoft.com/kb/892777 .

• Remotely get replication info on a Windows server
• repadmin /showattr ncobj:domain:
• Remotely get the OS version and SP level of a Windows server (enter on one line)
  
• repadmin /showattr ncobj:domain: /filter:"(&(objectCategory=computer)(primaryGroupID=516))" /subtree /atts:operatingSystem,operatingSystemVersion,operatingSystemServicePack
• Verify DC replication

• REPADMIN /REPLSUM /BYSRC /BYDEST /SORT:DELTAdcdiag

• Verify DC configuration of all DCs in a forest:
• dcdiag /v /e /n:domain_name
• more to come
• 
  

Xen Tips and Tricks

• Xen can host Linux, Solaris, and OpenBSD domU's with a modified kernel in each. If the CPU's have built-in hardware virtualization technology (Intel's VT chips, and AMD Pacific), then you may run unmodified OS'es, including Windows.
• When you assign a MAC address to a domU, be sure the second digit is an even number – 00 or AA or some such. This is because 16th bit of the MAC address as a "1" (which makes that an odd number) designates a "multicast" MAC address; your stuff won't work, you won't be able to figure out why, and it will generally be very frustrating. Also, as PIX ARP entries don't expire for 30 minutes, you'll probably save yourself some grief if the MAC mimics the ip address, e.g., IP of 172.31.17.136 = MAC of 00:23:11:71:36 . That way, each domU has a unique MAC, and a re-IP of a system gives it a new MAC, which the PIX will immediately recognize.
• The easiest to install Xen (for me) has been the from-source install. This has the following prerequisites, which may be installed with "yum install" followed by the names below:
  • ncurses-devel
  • ncurses
  • bridge-utils
  • gcc
  • zlib-devel
  • python-devel
  • iproute
  • bison
  • flex
• It is possible to present specific PCI devices directly to domU's, and to mask specific PCI devices from the dom0. Read the manual for details.
• For a source install of Xen, follow the README at the top level of the source. It is short, easy, and works. Don't forget to run the depmod and initrd as instructed at the end of the file.
• /etc/modprobe.conf: The name of the kernel module that drives the LSI SCSI controllers in some servers (notably Sun v20z and v40z) was changed. you need lines something like the following in your /etc/modprobe.conf before you run the mkinitrd; remove the other "mpt" lines in /etc/modprobe.conf and add these:
  {{alias scsi_hostadapter mptbase
  alias scsi_hostadapter1 mptspi}}
• Xen is very slow if it uses the native tls libraries. To make it not use those, rename/move the tls libraries in the dom0 and the domU:
  mv /lib/tls /lib/tls.disabled
  ...and on a 64-bit dom0 also run:
  mv /lib64/tls /lib64/tls.disabled
  The other "gotcha" is that updating the OS may cause new versions of those libraries to be installed. Check often and rename them, or, better yet, make a cron script to notify you if they appear again.
• VMware cannot be installed on a Xen domU or dom0. This is because there is at least one kernel module for VMware that expects to run at CPU ring 0; Xen dom0's and domU's do not run at ring0 – only Xen itself runs at ring0, and the VMware module is not compatible with Xen. It may work with virtualization-enabled CPU's, though.
• i386 (32-bit) and x86_64 (64-bit) domU's can be mixed on an x86_64 dom0, but a x86_64 domU cannot run on an i386 dom0.
• Live migration of domU's is only supported if the domU's filesystems are either:
  • present as the same local device (e.g. /dev/sdc1) on both the source and destination dom0, with for example, drbd or dom0 iSCSI initiators and/or a clustered filesystem.
  • accessible over the network at the same address from both dom0's, as with an iSCSI, GFS, or NFS root.
• Always leave the non-Xen and the last-used Xen kernel on the system and in grub.conf; this way, if there's a problem, your system is still bootable from the hard disk.
• Change the line in your dom0 /etc/sysconfig/kernel to UPDATEDEFAULT=no so that your Xen kernel won't be replaced in the grub.conf each time yum updates the kernel.
• Dom0 security – The dom0 is a critical host, as it offers access to console, filesystems, and other resources of all of the domU's it hosts.
  • selinux – selinux appears to work fine in dom0 without hindering domU's. Go ahead and set it in "active" mode.
  • iptables – You should probably enable iptables on the dom0, and only allow ssh inbound. Add specific ports only if you want to allow, for example, live migration; even those should only accept connections from certain ip addresses.
  • root login over ssh – probably better to create an external access account and disable root logins in /etc/ssh/sshd_config.
    *kernel download/build time – the Xen source install will download a version of the Linux kernel (for Xen 3.0.2-2, it downloads kernel 2.6.16), and compile it completely. The kernel download is about 40-50 MB, so it will take at least 10 minutes probably; building the kernels – Xen and xen-modified Linux kernel – will take another 20-50 minutes. Just know that it will take a little while.
    *python-twisted – The Xen management tools use the Python "twisted" libraries for XML communication. If you use python-twisted-1.3.0-1.2.el4.rf.i386.rpm , which is on rootstore under software\Xen, you can get away without having to install additional dependencies. If you go for a more recent python twisted, you'll find yourself in dependency hell.
• DomU template – It can be handy to create a domU template, stripped of non-essential packages, with your admin scripts and configuration info already entered. You can then make an archive of the template, and each time you need to add a new server, just copy the template to the domU's filesystems.
• In order to use 2 or more virtual network interfaces (with Xen bridge) on your domU, add a script "my-network-script" such as the following to /etc/xen/scripts, and be sure to run chmod +x /etc/xen/my-network-script to make it executable:
  #!/bin/sh
  # start bridges on both eth0 and eth1
  XENDIR="/etc/xen/scripts"
  $XENDIR/network-bridge "$@" netdev=eth0 bridge=xenbr0 vifnum=0
  $XENDIR/network-bridge "$@" netdev=eth1 bridge=xenbr1 vifnum=1
  #$XENDIR/network-bridge "$@" netdev=eth2 bridge=xenbr2 vifnum=2
  ...and change this line in /etc/xen/xend-config.sxp:
  (network-script my-network-script)
• After Xen is installed, here is a summary of commands that may prove useful; each must be run as root:

  Command	Use / Notes
  xm list	see running domains (vm's), their status, memory usage, domain ID, and what ports to telnet to (e.g. 9607) to get a console on each.
  xm console	attach to the console on a domU.
  xm create -c	start a domain and view its console, then type "^]" to disconnect. Note: Be sure to log off root before disconnecting!!!
  xm top	list realtime auto-updating stats on each domain's cpu, memory, and network usage, as well as other info.
  xm create	start a domU. Note that this should actually be a file name (e.g., /etc/xen/www3), not a domU name.
  xm shutdown	shut a domU down.

• It doesn't work well to lvm-snapshot a domU filesystem from a dom0. This is because the lvm snapshot mechanism uses the dm-snapshot module, which upon snapshot creation, sends a "sync" to the filesystem driver to cause the filesystem to flush out its cache. The filesystem of a domU is not accessible by the dom0 kernel, where the snapshot would be created. You can, however, make snapshots within a domU of that domU's filesystems. However, it seems to be easier and just as clean to do a rsync --archive --stats --delete --hard-links --numeric-ids --exclude=/tmp/** --exclude=/proc/** --exclude=/sys/** root@domU_name:/ Local_path/domU_name/ to back up the domU filesystem from the dom0 or another host.
• Certain enabled-by-default services don't make much sense in a Xen domU, and some probably hurt. Here are some services you probably want to disable (or uninstall, if possible) in your domU's:
  • acpid, auditd, autofs, cpuspeed, diskdump, gpm, haldaemon, ipmi, irqbalance, kudzu, mdmonitor, mdmpd, messagebus, microcode_ctl, netfs, netplugd, ntpd, openibd, portmap, readahead, readahead_early, xinetd
• Kernel modules in domU's – some processes will log an error when they can't find the proper kernel module. An example might be httpd trying to load an IPv6 module by default. Most domU's seem to do okay without having the kernel modules available, but if you want to keep the logs cleaner or have an additional capability that requires the kernel module, you may have to rsync /lib/modules/ from dom0 to domU (rsync and preserve hardlinks, to keep the kernel modules tree from growing a lot).
• NTP / Time – domU's use the same hwclock as the dom0, and therefore have the potential to screw things up if they access it directly.
  • Don't run ntpd or ntpdate on domU's. Instead, run it in the dom0 and that will keep all your domU's up to date automatically.
  • In each domU, replace /sbin/hwclock with an executable script that has only the line /bin/true. You'll have to watch this, as some OS updates may replace it with a new binary, and you'll need to make it the script again. Try making it read-only(?).
• On CentOS 5 beta, you have to mkinitrd and include and preload certain xen devices (networking and block device, respectively), else you won't be able to mount your root partition if you're exporting a partition / LV directly from dom0 to domU.
• 
  

Selinux tips

Here are some really good SElinux resources:

http://www.linuxsecurity.com/content/view/120567/49/
http://www.linuxsecurity.com/content/view/120622/49/
http://www.linuxsecurity.com/content/view/120700/49/
http://www.linuxsecurity.com/content/view/120837/169/
http://www.it-observer.com/articles.php?id=1013

Touch up a folder for apache to access (change file context labels recursively):
chcon -R -t httpd_sys_content_t

Touch up a folder for samba to access (change file context labels recursively):
chcon -R -t samba_share_t /backups


To reset the labels on all mounted filesystems:
restorecon -Rv /

If you need the filesystems to be relabeled on bootup, do this and then reboot:
touch /.autorelabel

To boot once with SELinux enforcement disabled, add the enforcing=0 flag to the kernel boot line.

To get the kernel's enforcement status:
getenforce

To change the kernel's enforcement status to "permissive" (aka log-only):
setenforce 0
To change the kernel's enforcement status to "Enforcing" (aka block access):
setenforce 1
(edit /etc/selinux/config to make the changes persistent across reboots)



MySQL recipes

To perform any of these, log in to the server with credentials that are authorized to perform the commands on the databases you want to look at:
mysql -u username -p

• show databases on a server:
  

show databases;

• show status of a database server:

show status;

• get user account info for a database server:

select User,Host,Grant_Priv,Super_Priv from mysql.user;

• show tables in a database:

show tables in database_name;

• get information about a table in a database:

describe database_name.table_name;

• get all contents of a table in a database:

select * from database_name.table_name;

• get the number of rows of a table in a database:

select count(*) from database_name.table_name;

• create an account on database with a given password:

grant all on database_name.* to username@hostname identified by 'password';

• Change user's password

SET PASSWORD FOR foo@localhost=PASSWORD('rubberchicken');
SET PASSWORD FOR foo=PASSWORD('rubberchicken');

• Flush / reload grant tables (after changing table permissions):

flush privileges;

• Conditionally drop a table, if it exists:

drop table if exists database_name.table_name;

• Create a database:

create database database_name;

• Copy a table from one database to another:

CREATE TABLE new_table_name LIKE old_database_name.table_name;
INSERT new_table_name SELECT * FROM old_database_name.table_name;

• Rename a table name:

RENAME TABLE old_table_name TO new_table_name;

• Eliminate duplicate results from a SELECT:

SELECT DISTINCT party FROM presidents;

• Use Regular Expressions in a SELECT:

SELECT selection FROM table_name WHERE column_name REGEXP 'regularexpression'

• Drop a column from a table:

ALTER TABLE 'table_name' DROP 'column_name'

• Check consistency of MyISAM database tables (must be in data dir), first flush the tables, then make sure nobody is accessing the tables, then run the command below (see http://www.lampspot.net/linux/how-to-guide-database-table-corruption-recognise-repair-and-prevent-by-jeng/):
  

myisamchk --update-state --key_buffer_size=256M --sort_buffer_size=256M --read_buffer_size=1M --write_buffer_size=1M *.MYI

• Flush database tables:

flush tables

• Check database table status:

check table database_name.table_name

• Switch MyISAM tables to InnoDB tables (or switch to MyISAM if you have problems with InnoDB). (You must of course start mysqld with InnoDB support, which can be done by adding innodb options from the distributed my-medium.cnf file to your my.cnf file. This can be done with your table as long as you are not using two part autoincrement or FULLTEXT indexes.):
  

ALTER TABLE problem_table TYPE=INNODB

Get mysql version:
mysql -V

Dump all contents of a database to a .sql file; will prompt for password:
mysqldump -u username -p database_name > /tmp/backup.sql

Restore all contents of a database from a .sql file (user must have access to do so; database must exist but be empty, I think; if tables already exist, this will not overwrite them):
mysql -u username -p database_name < /tmp/backup.sql

Change your mysql password (hostname matters?), will prompt for old password:
mysqladm -u username -p password newpassword