linux | panticz.de

CentOS

Network configuration

/etc/sysconfig/network-scripts/ifcfg-ethX
/etc/sysconfig/network
/etc/resolv.conf
/etc/ntp.conf

# show release
cat /etc/redhat-release

# update packages
yum update
yum upgrade -y

# install ssh
https://www.cyberciti.biz/faq/centos-ssh/
yum install -y openssh-server

# allow sudo for a user
usermod -a -G wheel

# PHP 5.6 on CentOS 7
http://devdocs.magento.com/guides/v2.0/install-gde/prereq/php-centos.html#instgde-prereq-php56-install-centos

Nework configuration

# /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE="eth0"
NM_CONTROLLED="yes"
ONBOOT=yes
HWADDR=00:11:22:33:12:8a
BOOTPROTO=static
NETMASK=255.255.255.0

https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-dhcp-configuring-client.html

# rundeck + ansible
# http://fedoraproject.org/wiki/EPEL#How_can_I_use_these_extra_packages.3F
rpm -Uvh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm
rpm -ivh epel-release-7-8.noarch.rpm
yum repolist
yum --enablerepo=epel info ansible
yum install ansible
yum install -y ansible

yum install -y java-1.8.0
rpm -Uvh http://repo.rundeck.org/latest.rpm
yum install -y rundeck
service rundeckd start

# firewall
systemctl disable firewalld
systemctl stop firewalld
systemctl status firewalld

firewall-cmd --zone=trusted --change-interface=docker0
systemctl restart firewalld
iptables -I INPUT -p tcp -m tcp --dport 8443 -j ACCEPT

firewall-cmd --permanent --zone=public --add‐port=8080/tcp
systemctl restart firewalld.service

# enable EPEL (Extra Packages for Enterprise Linux)
https://kofler.info/der-status-von-epel-8/

rpm ‐‐import https://www.elrepo.org/Y‐elrepo.org
rpm ‐Uvh http://www.elrepo.org/elrepo‐release‐7.0‐3.el7.elrepo.noarch.rpm

Cloud-images
http://cloud.centos.org/centos/7/images/

Install SSH VPN server

export CONTAINER=vpn

# create container
# TODO: configure MAC on create container
wget -q --no-check-certificate https://raw.githubusercontent.com/panticz/lxc/master/create.jessie.sh -O - | bash -s -- -f

# configure container MAC address
sed -i 's|lxc.network.hwaddr = .*|lxc.network.hwaddr = 00:11:22:33:44:5e|' /var/lib/lxc/${CONTAINER}/config

# enable autostart
echo "lxc.start.auto = 1" | tee -a /var/lib/lxc/${CONTAINER}/config

# configure container
##echo "lxc.hook.autodev=/var/lib/lxc/vpn/autodev" >> /var/lib/lxc/${CONTAINER}/config
#echo "lxc.cgroup.devices.allow = c 10:200 rwm" >> /var/lib/lxc/${CONTAINER}/config

# do we need this outside of container?
#cat < /var/lib/lxc/${CONTAINER}/autodev 
##!/bin/bash

# dep
#cd \${LXC_ROOTFS_MOUNT}/dev
#mkdir net
#mknod net/tun c 10 200
#chmod 0666 net/tun
#EOF
#chmod +x /var/lib/lxc/${CONTAINER}/autodev

# configure SSH access
# generating SSH key for root
sudo lxc-attach -n ${CONTAINER} -- ssh-keygen -q -f /root/.ssh/id_rsa -N ''

# disable SSH password login
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|[#]*PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|UsePAM yes|UsePAM no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# configure SSH server
echo "PermitTunnel yes" >> /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/sshd_config
# do we need this?
###sed -i 's|#   Tunnel no|    Tunnel no|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
sed -i 's|#   TunnelDevice any:any|    TunnelDevice any:any|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
#sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# enable forwarding
sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /var/lib/lxc/${CONTAINER}/rootfs/etc/sysctl.conf
# echo "1" > /proc/sys/net/ipv4/ip_forward

# load iptables module (on LXC host)
sudo echo 'ip_tables' >> /etc/modules

LXC: create Ubuntu Trusty container

[embed_url: https://raw.githubusercontent.com/panticz/lxc/master/create.trusty.sh]

Allow root SSH login with password

sed -i 's|PermitRootLogin without-password|PermitRootLogin yes|' /etc/ssh/sshd_config
sed -i 's|PasswordAuthentication no|PasswordAuthentication yes|' /etc/ssh/sshd_config
service ssh restart

)

DMA (Dragonfly Mail Agent)

# ansible role
https://github.com/panticz/ansible/tree/master/roles/dma

# preconfigure
echo "dma dma/relayhost string mail.example.com" | debconf-set-selections
echo "dma dma/mailname string $(hostname -f)" | debconf-set-selections

# install
apt-get install -y dma

# configure relayhost
echo "user|smarthost:password" >> /etc/dma/auth.conf

# send testmail
echo "This is a test message from ${USER}@$(hostname -f) at $(date)" | /usr/sbin/sendmail foo@exaple.com

Configuration files

# /etc/dma/dma.conf
AUTHPATH /etc/dma/auth.conf
SMARTHOST smtp.example.de
PORT 587
MAILNAME example.com
MASQUERADE foo@example.com
SECURETRANSFER
STARTTLS

# /etc/dma/auth.conf
foo@example.com|smtp.example.com:pass1234

view log

journalctl _COMM=sendmail -f

Fix on wheezy

echo "deb http://archive.debian.org/debian squeeze main" > /etc/apt/sources.list.d/squeeze.list
apt-get update

Cleanup domain not found

for MAIL in $(grep "Domain not found" /var/log/mail.log | cut -d"<" -f2 | cut -d">" -f1 | sort -u); do
    for FILE in $(grep -l ${MAIL} /var/spool -r); do
        rm ${FILE}
    done
done

Links
https://wiki.mageia.org/en/Dma_Dragonfly_Mail_Agent

Journalctl

# display logs from current boot
journalctl -b

sudo journalctl --since yesterday
journalctl --since "2015-01-10" --until "2015-01-11 03:00"
journalctl --since 09:00 --until "1 hour ago"

journalctl -u ssh --since "2019-11-04"

journalctl -u nginx.service

# journals disc usage
sudo journalctl --disk-usage

# show errors
journalctl -p err -b
journalctl -p 3 -xb

# show dmesg
journalctl has a --dmesg

journalctl --disk-usage

# Clear systemd journals older than X days
journalctl --vacuum-time=31d

# Clear systemd journals if they exceed X storage
journalctl --vacuum-size=1G

# show NetworkManager logs
journalctl -u NetworkManager

# show cron logs
journalctl -f -u cron

Links
https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs
http://0pointer.de/blog/projects/journalctl.html
http://blog.delouw.ch/2013/07/24/why-journalctl-is-cool-and-syslog-will-survive-for-another-decade/

LXC Containers

# Create Ubuntu 20.04 Focal LXC container
lxc-create --template ubuntu --name focal -- template-options -r focal

# Create Ubuntu 16.04 Xenial LXC container
sudo lxc-create --template ubuntu --name xenial -- template-options -r xenial

# Create Ubuntu 14.04 Trusty LXC container
sudo lxc-create --template ubuntu --name trusty -- template-options -r trusty

# Create Debian 9 Stretch LXC container
sudo lxc-create --template debian --name stretch -- template-options -r stretch


# centos
sudo lxc-create -t centos -n centos -- --release 7

# nested container / docker support
echo "lxc.aa_profile = unconfined" >> /var/lib/lxc/centos/config
echo "lxc.cgroup.devices.allow = a\n" >> /var/lib/lxc/centos/config

# fixme (on first run)
+ preseed
Configuring console-setup

echo "console-setup/layoutcode string UTF-8" | debconf-set-selections

Update LXC container templates filesystem

[embed_url: https://raw.githubusercontent.com/panticz/lxc/master/scripts/lxc-update-templates.sh]

# fix dns
echo "nameserver 8.8.8.8" > /var/cache/lxc/debian/rootfs-wheezy-amd64/etc/resolv.conf

Cronjob

echo "0 13 * * *    root    /usr/bin/wget -q --no-check-certificate https://raw.githubusercontent.com/panticz/lxc/master/scripts/lxc-update-templates.sh -O - | bash -" > /etc/cron.d/lxc_update_template
service cron restart

# fix squeeze repository
sed -i 's|cdn.debian.net|ftp.debian.org|g' /var/cache/lxc/debian/rootfs-squeeze-amd64/etc/apt/sources.list

memcached

install

apt-get install -y memcached
sed -i 's|-l 127.0.0.1|-l 172.29.13.117|g' /etc/memcached.conf
service memcached restart

flush cache

telnet mc.example.com 11211
stats
flush_all
quit

flush all cache in OpenStack

# flush all memcached
for NODE in $(openstack network agent list --agent-type dhcp -c Host -f value); do
    echo ${NODE}
    printf "flush_all\nquit\n" | nc -q -1 ${NODE} 11211
done

memcached reserved memory

stats
...
STAT limit_maxbytes 314572800

btrfs

sudo apt-get install btrfs-tools
# mkfs.btrfs /dev/sdb
sudo mkfs.btrfs -L lxc /dev/sdb1

# list volumes
btrfs filesystem show

# list subvolumes
mount /dev/sdb1 /mnt/
btrfs subvolume list /mnt/

# create subvolume
sudo btrfs subvolume create /mnt/@sub1

# get default subvolume
btrfs subvolume get-default /mnt/

# set default subvolume
btrfs subvolume set-default 299 /mnt/

# mount subvolume
mount -o subvol=new_subvol /dev/sdb1 /tmp/2

btrfs filesystem resize 64g /mnt

# enable comprsssion (mountparameter)
compress

# /etc/fstab
/dev/sda        /       btrfs   rw,autodefrag,compress=lzo,noatime,thread_pool=16       00

# directroy to subvolume?
# mv /var/lib/lxc/installserver /var/lib/lxc/installserver_tmp
# btrfs subvol create /var/lib/lxc/installserver
# time cp -a --reflink /var/lib/lxc/installserver_tmp/rootfs /var/lib/lxc/installserver

# create snapshot
sudo btrfs subvolume snapshot / /@snap1

# list snapshots
btrfs subvolume list /

# delete snapshot
btrfs subvolume delete /@snap1

Links
http://wiki.ubuntuusers.de/Installieren_auf_Btrfs-Dateisystem
http://wiki.ubuntuusers.de/Befehle_Btrfs-Dateisystem

pako

[embed_url: https://raw.githubusercontent.com/panticz/scripts/master/pako.sh]

https://raw.githubusercontent.com/panticz/preseed/master/late_command.sh

linux