Sv translation |
---|
|
IntroductionThe following steps are performed after OS installation, before a specific ROLE is configured. Cloud Variants Info |
---|
| For Azure Cloud installations, a user is specified when the VM is created. The root password remains hidden. It is, however, possible to change to root using the following command, using the user's own password: |
| title | in the Azure CloudsudoAdditionally, it is necessary to configure the network card(s) in a particular Zone. This is performed by editing the network configuration file(s): |
| title | Netzwerkeinstellungen Azure Cloud | vi /etc/sysconfig/network-scripts/ifcfg-eth0
... (add at end)
ZONE=public
...
service network restart |
|
|
|
---|
Todo .... from here
Make sure that firewalld is running and not iptables. The following commands are used to ensure this. Translations Ignore |
---|
Code Block |
---|
| systemctl disable iptables
systemctl mask iptables
systemctl enable firewalld
systemctl start firewalld
|
|
|
|
...
System UpdateUpdate the system to the newest patch release and install basic packages |
...
. Note, if this fails due to a proxy server being present, skip this step and create the jtel user first. Then configure the proxy as shown here. Note, as most machines require the mysql connector, it is installed directly here. |
Code Block |
---|
language | bash |
---|
title | Update and Installation |
---|
|
yumyumdnf -y install tar nano unzip |
| ntp ntpdate manopenssh-clients screen sysstat nfs-utils cifs-utils |
| policycoreutils-python yum-plugin-versionlock yum-utils nmapnmap bind-utils tcpdump lsof tmux |
|
yum -y install https://repo.ius.io/ius-release-el7.rpm
yum -y install epel-release
# LAG: NO LONGER NEEDED
# Removed 17.09.2018 after feedback from FK
# yum chrony virt-what policycoreutils-python-utils libaio python2 dnf-plugin-versionlock rsyslog
dnf config-manager --disable mysql-connectors-community
dnf config-manager --disable mysql-tools-community
dnf -y module disable mysql
dnf -y install |
| httpmirror1hs-esslingenderepoforge/redhat/el7/en/x86_64/rpmforge/RPMS/rpmforgeget/mysql80-community-release- |
| 0.5.3el7.rf.x86_64.#yum-config-manager --enable rpmforge-extras |
Reboot
-y install mysql-community-client |
|
If a new kernel is installed, then a reboot is required. | title | Reboot |
---|
ipv6 Disabeln
Warning |
---|
|
Falls das yum update scheitert, wegen IPv6, kann ipv6 disabled werden. |
Code Block |
---|
|
vi /etc/sysctl.d/disable-ipv6.conf
# Folgende Zeilen hinzufügen
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# Dann folgendes kommando
sysctl -p
# Dann yum.conf anpassen
vi /etc/yum.conf
# Folgendes hinzufügen
ip_resolve=4
# Dann neustart
reboot |
Mandatory Stepsjtel UserCreate jtel UserCreate the jtel user, and add to the group wheel, which allows the user to run commands with sudo. Status |
---|
colour | Red |
---|
title | Caution Password |
---|
|
Translations Ignore |
---|
Code Block |
---|
| useradd -m jtel
gpasswd -a jtel wheel
printf '<password>\n<password>\n' | passwd jtel |
|
The following command creates a configuration file allowing all users who are members of the wheel group to run commands as root with sudo. Translations Ignore |
---|
Code Block |
---|
| cat <<EOFF > /etc/sudoers.d/wheelers
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
EOFF
|
|
Warning when using git as rootThe following command makes it (intentionally) more difficult to use git as the root user. Translations Ignore |
---|
Code Block |
---|
| cat <<EOFF >> ~/.bashrc
alias git='printf "It looks like you are trying to run GIT as ROOT.\nFor jtel installations, GIT should always be run from the jtel user.\nIf you really want to run git as root, you will need to access it directly, using /usr/bin/git for example.\n"'
EOFF
source ~/.bashrc |
|
Chrony is a newer (better) replacement for ntpd. It is configured in a similar way, however the commands used to check the synchronisation are slightly different. For further information, check out this link: https://opensource.com/article/18/12/manage-ntp-chrony Setup chronydThe following commands modify the basic chrony.conf file to remove usage of the default pool and any configured servers, and replace this with the 3 (very reliable) time servers from the German PTB. Translations Ignore |
---|
Code Block |
---|
| # Replace all existing servers
sed -i -e "s/^server /# server /" /etc/chrony.conf
# Replace pool setting
sed -i -e "s/^pool /# pool /" /etc/chrony.conf
# Add PTB Servers
cat << EOFF >> /etc/chrony.conf
# Servers to use
server ptbtime1.ptb.de iburst
server ptbtime2.ptb.de iburst
server ptbtime3.ptb.de iburst
EOFF
# Enable chronyd
systemctl enable chronyd
# Stop (just in case it was started), then start and get status
systemctl stop chronyd
systemctl start chronyd |
|
Check chronyd Translations Ignore |
---|
Code Block |
---|
| # Check the status of the service
systemctl status chronyd
# Check the sources it is using
chronyc sources |
|
Remove Anacron, Install CronThe jtel system requires that cron jobs are performed at a particular time. jtel servers will usually run continuously. The anacron service (which is installed by default) may run a cron job later if the machine has been powered off. However, on a jtel system there is no point doing this, and sometimes this can be destructive. Therefore the anacron service is removed and replaced with the normal cron service. Translations Ignore |
---|
Code Block |
---|
| dnf -y install cronie-noanacron
dnf -y remove cronie-anacron |
|
The hypervisor tools make support from the hypervisor console better, when performing operations such as snapshots, starting and stopping and resetting the virtual machine. It is important that the correct tools are installed. Warning |
---|
Note: you will not need to and should not do this in most cloud environments! |
Detect the HypervisorVMWareThe tools are installed as follows: Translations Ignore |
---|
Code Block |
---|
| dnf -y install open-vm-tools |
|
Hyper-V Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | Installing Hyper-V Tools |
---|
| dnf -y install hyperv-daemons |
|
KVM Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | Installing KVM (qemu) Guest Tools |
---|
| dnf -y install qemu-guest-agent
systemctl enable qemu-guest-agent
systemctl start qemu-guest-agent |
|
Other HypervisorsConsult the manufacturer for further detals. Hosts FilePrepare the hosts file. See here for further details: Hosts File - All OS (CentOS8/Win2019). Optional StepsSSH KeysSSH keys can be added, to enable login to the jtel user via an ssh key. Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | SSH Keys |
---|
| mkdir -p /home/jtel/.ssh
cat << EOFF > /home/jtel/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAgJWox9vkWssx24V6m+VB/9cfFUznUnVJqHeSnQFcE+ANzH+lgv90jQYXRf8XLSaKA4HZGO7SFUwLz7eNHk0lIS+TG+WKGrjl3GRvzNoYVAapeKUV7HjbeagQPNOCKTr6G8Vi/GVMyOx8XhJAgpr5gjyW9GdMdqnOS9uxd83BCh/UiAP9oVUbLiIIxbtmLAzyfJdjnbFP9sJXw96Vl040Fe4aoLofrkPyPu7cst6TPJx5myDhORG31nD/2iwUNLfv58m9ABMsePfhqzSp/Hi2XY/e5gikDh3xUxoBmL9fWwbiFb92AFW08rP1CtoCEtOe2nJkdtRzt0GiE+A+zgdDjw== support@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuP5DEZDI6/CITTqk8qburqDuKNj6jnQ9Zbjz6BO+5P8MlrS8KT7y56u/PSqdO3OzD58D2JS0yNvM5RbBGYDUD1ng7VSJLFLfErbuCzJ/Q+BSRaee+7MhLWXdVSc/EY2B4qUcZGRL/NXHtAY/3KvSSU3wnhI4edLYMAzuxAhNEPRkmniq1CAuykDdHvm0kVQzaSShYDBQWIlbWIMG6jsCmMpZR7v+v6gKWeowQkM4T4XZ1f2K5zlQXd6FHGY8C/+XICefum2qgQtqgjfQMoqIQbnmfKDGIHPvkas287tdCbU4y1lTsJbTiT7INkd6QbiVUayVxVwwoV+G2F7WofN4nw== root@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArTi8N08gDz1CvDriZNALa1tHky/1+QNP0WU43dI7hkn2zH7fz9bXAs32z7dRjfgxaYXWPmClcDLDb0xwjGfMXK0HABPtp0bxh/58Y0QowBUJkcNi6hUphT+ArGkpjQb5CJcArnbLO727R8jJFgE1QpiWdehd5t3ec0wOL0NhnIE63S+DUm7+bQW6Z8Kmzl0+opGyoURLf8hxeAIUJwdeMFN7AIVPZlyuPobowwjGDXD9YpwXZ2oPtg6XISwW/O1fsetzmGkgD4gedxJxjc5x5ByZX98UsNJORrG5R5slLqQTJkJzGBLpH8kC9WLIEW0RduVR2mrQzOBRgA92i5ZUFw== lewis.graham@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9W40vFohIPQsH6Q5Rfef7xiC4WRHOkMaMsUXxLCnTCDGI0PDib23NBUTevcnAc+OrCUITRmwngRbcItbR9QM1qNhzrwS8ZI00psZVVnBUwVVpX4UJtmX0CDrtVwH1yz51/WnZVeS17JqoMjVMB3p+n1CjViwh6qlRTI/9F/KfaOfiLEiHnvcnmSq67R7o5wP65TR00xqA20E569M1lcdn43xL2GylkwHuWw+XcusKqf+lnaawFWhdZUTOuF3ZB+ssuEbXSyZEGtc5/HNUG8rg9tutzAfq3fNWc5Y5pY+B048g4oDyAQpwMB7i9OwNNk1IEZA+rmqIImf7XLVKIsNn andrey.tsvetkov@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkBiz9SsIXMO/a+7hCxNGQuQ4s/gqUZ6pyxDxjpDTD+bewxumyhn5aITbBSuHpx0n05JL4nGGdROii54ATildm3Uhi8JSljGy5uv97Sw8Kpy0eO314tOLU3NkAe2YOH1aUeArne4bYPebKBq0r1oln1Gu2+TFvCmMqu3FmleMv1xvw/waTwO57hSBPN83gOaJR7w6lOUp5HjYLSA0zRs1Os3g6ldQkHeGBknJ6jChqFXJHGl0KYzZGv3Q46fVTptS7NACxZs+ARUzJjbGjxnpHYK8rmSoTfoBS4qlN5+LxYKG341Hmq7cOsaISwUFbE/CbFOqUtjBviI1c7RLgtGnJQ== serge.djomo@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuh3ZLgQo2e9Uv1vAQxxCGxe9D3u8DWh4egeteUAPj4b7tOxQ6to3zAlGytUR9R6sANL/CIP3nEA2d3r4km0FQWQ4QFCLTFjyXl0Kvsn1ahN8DljJ6mRlwtvN2r5mBIEy1ClGCh+Jvchzf4ZhXrWxOTYYO77O8wjj9Zbk0Y6wI2qBnE6TaxsRQ7Z61zTe80xfLPQLKjgQ/5Hdk0z0HAx3jEsZRo9CqMLb44UD+6jVCih1JPMFcnUu0uxRQdOHrg243tqAUmuqICWompZNO75v3HjIIXOebxVGBXugrYc2xR1q964/EE0ZR7JMWM+HJ47V8WJKkE126n9ZElCqNGIR+Q== heidi.mueller@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAilON3Cn1bZPBYtv67Bv63llD1KMTTH52/ioPLm+qYYDV80mSHSb+PHD9awXNKNv5iTecaQ/a56CkK0z+KI5zvJb3EiRZaRe70cIqdflHmTcasVPVk1hAma5xc5UOCr+dKokqMQGwpDRrDvdS3atflQznvlR8+qoxPjlKC4KDx0GOUeSOIPBO6DdYGPlFX6ohMVRE7p/vHIRAOfehmG1xFtfk+rGPmgiblPWWWklKYQUfMnHI0pqFJwrPW46nqdUlQwtknATZC2cuKe931zstFhuDsm218yS4hTTlcjw5i/DH7PFr9Y58BtY6ZTy8khwTUeMPpSxE7i2WYoqoJ7DXcw== sou@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA0czZLbpaxo/EY9iHDq9n6EWTALeYB7GVmp/mLwp66zeV4DbvTm+3FDUJSD9rqMJzJkAAEicFe+II/ZdIeZzG4JdYf66M/Y6k0w0Y8jJqDtsdgUf3OJ1hJ53Z+BwFqy1vD/a7N2hxlEKD2rzyAfVb+xzTzhJTjpX1kNiUxDMXRZs4ytW0CbOqZSpTJ3eT9NS9gH188KFTvHN8rPzDAxRKcexO2fSzNa7e+dYsfImOQoYlxFBX5YU74Ay9F5b7K95Cxe8EstvKNVmjkNWgnNWuS2d7eabepC1jv3z0FdOGiVoZ1SDgqKz8ysBa6Rzkt5L5peHYAKyH8TedeUk7kRIwZQ== dhia@jtel.de
EOFF
restorecon -R -v /home/jtel/.ssh
chown -R jtel:jtel /home/jtel/.ssh
chmod 0700 /home/jtel/.ssh
chmod 0644 /home/jtel/.ssh/authorized_keys |
|
Note, login by ssh key only must be enabled (this is not discussed here, and a word of caution - make sure you have recorded the root password before you do this so at least you can access the machine via the console). Proxy ServerIf a proxy server is used, the following commands will configure the proxy server for root and the jtel user. The top 5 lines should be modified. Status |
---|
colour | Red |
---|
title | Caution Password |
---|
|
Translations Ignore |
---|
Code Block |
---|
|
PROXY_USERNAME=
PROXY_PASSWORD=
PROXY_SERVER=proxy.example.de
PROXY_PORT=3128
PROXY_EXCEPTIONS=.example.de,.local,10.
if [ -n "$PROXY_USERNAME" ] && [ -n "$PROXY_PASSWORD" ]
then
PROXY="http://$USERNAME:$PASSWORD@$PROXY_SERVER:$PROXY_PORT"
elif [ -n "$PROXY_USERNAME" ]
then
PROXY="http://$USERNAME@$PROXY_SERVER:$PROXY_PORT"
else
PROXY="http://$PROXY_SERVER:$PROXY_PORT"
fi
cat <<EOFF >> ~/.bashrc
export ALL_PROXY=$PROXY
export HTTP_PROXY=$PROXY
export HTTPS_PROXY=$PROXY
export FTP_PROXY=$PROXY
export RSYNC_PROXY=$PROXY
export http_proxy=$PROXY
export https_proxy=$PROXY
export ftp_proxy=$PROXY
export rsync_proxy=$PROXY
export NO_PROXY=$PROXY_EXCEPTIONS
EOFF
cat <<EOFF >> /home/jtel |
|
|
Grundkonfiguration
Sicherstellen, dass firewalld läuft (Benötigt für Azure Cloud Installation)
Die nachfolgende Befehle stellen sicher, dass firewalld läuft;
Code Block |
---|
language | bash |
---|
title | firewalld configuration |
---|
|
systemctl disable iptables
systemctl mask iptables
systemctl enable firewalld
systemctl start firewalld
|
User jtel erzeugen
Die nachfolgende Befehle erzeugen den Benutzer jtel
, fügen ihn der Gruppe wheel
zu und geben ihm das Passwort <password>
:
Code Block |
---|
language | bash |
---|
title | jtel Benutzer |
---|
|
useradd -m jtel
gpasswd -a jtel wheel
printf '<password>\n<password>\n' | passwd jtel |
SSH Schlüssel eintragen
Als nächstes werden die SSH-Schlüssel der jtel-Projekt-Techniker eingetragen, so dass ein gesichertes Login ohne separate Passworteingabe möglich wird. Standardmäßig existiert im Home-Verzeichnis von root
weder das SSH-Konfigurationsverzeichnis noch die entsprechende Konfigurationsdatei. Dies alles wird mit den Befehlen im Nachfolgenden Code-Block erzeugt:
Code Block |
---|
language | bash |
---|
title | SSH Keys |
---|
|
mkdir -p /home/jtel/.ssh
cat << EOFF > /home/jtel/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAgJWox9vkWssx24V6m+VB/9cfFUznUnVJqHeSnQFcE+ANzH+lgv90jQYXRf8XLSaKA4HZGO7SFUwLz7eNHk0lIS+TG+WKGrjl3GRvzNoYVAapeKUV7HjbeagQPNOCKTr6G8Vi/GVMyOx8XhJAgpr5gjyW9GdMdqnOS9uxd83BCh/UiAP9oVUbLiIIxbtmLAzyfJdjnbFP9sJXw96Vl040Fe4aoLofrkPyPu7cst6TPJx5myDhORG31nD/2iwUNLfv58m9ABMsePfhqzSp/Hi2XY/e5gikDh3xUxoBmL9fWwbiFb92AFW08rP1CtoCEtOe2nJkdtRzt0GiE+A+zgdDjw== support@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuP5DEZDI6/CITTqk8qburqDuKNj6jnQ9Zbjz6BO+5P8MlrS8KT7y56u/PSqdO3OzD58D2JS0yNvM5RbBGYDUD1ng7VSJLFLfErbuCzJ/Q+BSRaee+7MhLWXdVSc/EY2B4qUcZGRL/NXHtAY/3KvSSU3wnhI4edLYMAzuxAhNEPRkmniq1CAuykDdHvm0kVQzaSShYDBQWIlbWIMG6jsCmMpZR7v+v6gKWeowQkM4T4XZ1f2K5zlQXd6FHGY8C/+XICefum2qgQtqgjfQMoqIQbnmfKDGIHPvkas287tdCbU4y1lTsJbTiT7INkd6QbiVUayVxVwwoV+G2F7WofN4nw== root@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArTi8N08gDz1CvDriZNALa1tHky/1+QNP0WU43dI7hkn2zH7fz9bXAs32z7dRjfgxaYXWPmClcDLDb0xwjGfMXK0HABPtp0bxh/58Y0QowBUJkcNi6hUphT+ArGkpjQb5CJcArnbLO727R8jJFgE1QpiWdehd5t3ec0wOL0NhnIE63S+DUm7+bQW6Z8Kmzl0+opGyoURLf8hxeAIUJwdeMFN7AIVPZlyuPobowwjGDXD9YpwXZ2oPtg6XISwW/O1fsetzmGkgD4gedxJxjc5x5ByZX98UsNJORrG5R5slLqQTJkJzGBLpH8kC9WLIEW0RduVR2mrQzOBRgA92i5ZUFw== lewis.graham@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9W40vFohIPQsH6Q5Rfef7xiC4WRHOkMaMsUXxLCnTCDGI0PDib23NBUTevcnAc+OrCUITRmwngRbcItbR9QM1qNhzrwS8ZI00psZVVnBUwVVpX4UJtmX0CDrtVwH1yz51/WnZVeS17JqoMjVMB3p+n1CjViwh6qlRTI/9F/KfaOfiLEiHnvcnmSq67R7o5wP65TR00xqA20E569M1lcdn43xL2GylkwHuWw+XcusKqf+lnaawFWhdZUTOuF3ZB+ssuEbXSyZEGtc5/HNUG8rg9tutzAfq3fNWc5Y5pY+B048g4oDyAQpwMB7i9OwNNk1IEZA+rmqIImf7XLVKIsNn andrey.tsvetkov@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkBiz9SsIXMO/a+7hCxNGQuQ4s/gqUZ6pyxDxjpDTD+bewxumyhn5aITbBSuHpx0n05JL4nGGdROii54ATildm3Uhi8JSljGy5uv97Sw8Kpy0eO314tOLU3NkAe2YOH1aUeArne4bYPebKBq0r1oln1Gu2+TFvCmMqu3FmleMv1xvw/waTwO57hSBPN83gOaJR7w6lOUp5HjYLSA0zRs1Os3g6ldQkHeGBknJ6jChqFXJHGl0KYzZGv3Q46fVTptS7NACxZs+ARUzJjbGjxnpHYK8rmSoTfoBS4qlN5+LxYKG341Hmq7cOsaISwUFbE/CbFOqUtjBviI1c7RLgtGnJQ== serge.djomo@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuh3ZLgQo2e9Uv1vAQxxCGxe9D3u8DWh4egeteUAPj4b7tOxQ6to3zAlGytUR9R6sANL/CIP3nEA2d3r4km0FQWQ4QFCLTFjyXl0Kvsn1ahN8DljJ6mRlwtvN2r5mBIEy1ClGCh+Jvchzf4ZhXrWxOTYYO77O8wjj9Zbk0Y6wI2qBnE6TaxsRQ7Z61zTe80xfLPQLKjgQ/5Hdk0z0HAx3jEsZRo9CqMLb44UD+6jVCih1JPMFcnUu0uxRQdOHrg243tqAUmuqICWompZNO75v3HjIIXOebxVGBXugrYc2xR1q964/EE0ZR7JMWM+HJ47V8WJKkE126n9ZElCqNGIR+Q== heidi.mueller@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAilON3Cn1bZPBYtv67Bv63llD1KMTTH52/ioPLm+qYYDV80mSHSb+PHD9awXNKNv5iTecaQ/a56CkK0z+KI5zvJb3EiRZaRe70cIqdflHmTcasVPVk1hAma5xc5UOCr+dKokqMQGwpDRrDvdS3atflQznvlR8+qoxPjlKC4KDx0GOUeSOIPBO6DdYGPlFX6ohMVRE7p/vHIRAOfehmG1xFtfk+rGPmgiblPWWWklKYQUfMnHI0pqFJwrPW46nqdUlQwtknATZC2cuKe931zstFhuDsm218yS4hTTlcjw5i/DH7PFr9Y58BtY6ZTy8khwTUeMPpSxE7i2WYoqoJ7DXcw== sou@jtel.de
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA0czZLbpaxo/EY9iHDq9n6EWTALeYB7GVmp/mLwp66zeV4DbvTm+3FDUJSD9rqMJzJkAAEicFe+II/ZdIeZzG4JdYf66M/Y6k0w0Y8jJqDtsdgUf3OJ1hJ53Z+BwFqy1vD/a7N2hxlEKD2rzyAfVb+xzTzhJTjpX1kNiUxDMXRZs4ytW0CbOqZSpTJ3eT9NS9gH188KFTvHN8rPzDAxRKcexO2fSzNa7e+dYsfImOQoYlxFBX5YU74Ay9F5b7K95Cxe8EstvKNVmjkNWgnNWuS2d7eabepC1jv3z0FdOGiVoZ1SDgqKz8ysBa6Rzkt5L5peHYAKyH8TedeUk7kRIwZQ== dhia@jtel.de
EOFF
restorecon -R -v /home/jtel/.ssh
chown -R jtel:jtel /home/jtel/.ssh
chmod 0700 /home/jtel/.ssh
chmod 0644 /home/jtel/.ssh/authorized_keys |
Hinweis: alle anderen SSH keys nicht mehr verwenden.
Damit diese auch korrekt funktionieren, müssen die SELINUX-Security-Labels korrekt angepasst werden. Dies erledigt der Befehl am Ende des Code-Blocks.
History Funktion verbessern
Der Nachfolgende Befehl generiert eine Konfigurationsdatei zur Verbesserung der History-Funktion der Shell:
Code Block |
---|
language | bash |
---|
title | History Funktion |
---|
|
cat <<EOFF > ~/.inputrc
"\e[A": history-search-backward
"\e[B": history-search-forward
set show-all-if-ambiguous on
set completion-ignore-case on
EOFF |
Screen Multiplexer verbessern
Der Nachfolgende Befehl verbessert die Darstellung des screen-Multiplexers.
Code Block |
---|
language | bash |
---|
title | Screen Multiplexer |
---|
|
cat <<EOFF >> /etc/screenrc
# JTEL:Added
startup_message off
vbell off
hardstatus alwayslastline "%{kw} %{b}%H%{K} < %-w%{Wb} %n %t %{-}%+w >"
# This lets work all functions keys in midnight commander
# termcapinfo xterm 'k1=\E[11~:k2=\E[12~:k3=\E[13~:k4=\E[14~'
EOFF
|
Wheel (sudo) Konfiguration
Der Nachfolgende Befehl erzeugt eine Konfigurationskomponente, um den Benutzern der Gruppe wheel
das Recht zu geben, Befehle als root
mittels des Tools sudo
auszuführen:
Code Block |
---|
language | bash |
---|
title | Sudo Berechtigung |
---|
|
cat <<EOFF > /etc/sudoers.d/wheelers
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
EOFF
|
Shell Konfiguration auf jtel übertragen
Die nachfolgende Befehle replizieren die Shell-Konfiguration vom Benutzer root
in den Benutzer jtel
:
Code Block |
---|
language | bash |
---|
title | Konfiguration jtel Benutzer |
---|
|
cp -a /root/.inputrc /home/jtel
chown -R jtel:jtel /home/jtel/.inputrc
|
Root hinweis für GIT
Die nachfolgende Befehle machen das Ausführen von GIT als root schwieriger, da dies immer im Kontext vom jtel user geschehen soll:
Code Block |
---|
language | bash |
---|
title | root Hinweis für GIT |
---|
|
cat <<EOFF >> ~/.bashrc
alias git='printf "It looks like you are trying to run GIT as ROOT.\nFor jtel installations, GIT should always be run from the jtel user.\nIf you really want to run git as root, you will need to access it directly, using /usr/bin/git for example.\n"'
EOFF
source ~/.bashrc |
SSH Keys auf root übertragen
Die nachfolgende Befehle replizieren die SSH Keys vom Benutzer jtel
in den Benutzer root
:
Code Block |
---|
language | bash |
---|
title | Konfiguration jtel Benutzer |
---|
|
cp -a /home/jtel/.ssh /root
chown -R root:root /root/.ssh |
NTP auf PTB einstellen
Die nachfolgende Befehle tragen die offiziellen Zeitserver der Physikalisch-Technischen-Bundesanstalt in die Konfigurationsdatei des Zeitsynchonisationsdienstes ein, konfigurieren den Dienst so, dass er automatisch startet, synchronisieren die Zeit einmalig mit einem der PTB-Server und starten den Dienst.
Code Block |
---|
language | bash |
---|
title | Zeitsynchonisation |
---|
|
sed -i -e "s/^server 0.centos.pool.ntp.org iburst$/server ptbtime1.ptb.de iburst\nserver ptbtime2.ptb.de iburst\nserver ptbtime3.ptb.de iburst\nserver 0.centos.pool.ntp.org iburst/" /etc/ntp.conf
chkconfig ntpd on
ntpdate ptbtime2.ptb.de
service ntpd start
|
NTP Prüfen
Siehe hier:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-Checking_the_Status_of_NTP.html
für eine Erklärung.
Code Block |
---|
language | bash |
---|
title | Zeitsyncrhonisation prüfen |
---|
|
ntpq -p |
Deinstallation anacron, Installation cron
Da der anacron Dienst stehen bleibt, wenn einer der Wartungsskripte nicht durchläuft, wird dieser deinstalliert, und der cron dienst installiert:
Code Block |
---|
language | bash |
---|
title | Deinstallation anacron, Installation cron |
---|
|
sudo yum -y install cronie-noanacron
sudo yum -y remove cronie-anacron |
VMWare / Hyper-V / Virtualisierungs-Tools (NICHT BEI AZURE)
VMWare Tools installieren
Code Block |
---|
language | bash |
---|
title | VMWare Tools Installieren |
---|
|
yum -y install open-vm-tools |
Hyper-V
Code Block |
---|
language | bash |
---|
title | Hyper-V Tools Installieren |
---|
|
yum -y install hyperv-daemons |
Andere Virtualisierungsumgebungen
Den jeweiligen Hersteller kontaktieren.
Proxy Server Eintrag
Falls ein Proxyserver verwendet wird, dann folgende Befehle nutzen um dies für root und den jtel user einzurichten - die oberen Zeilen bitte anpassen:
Code Block |
---|
language | bash |
---|
title | Proxy Server Einrichten |
---|
|
PROXY_USERNAME=
PROXY_PASSWORD=
PROXY_SERVER=proxy.example.de
PROXY_PORT=3128
PROXY_EXCEPTIONS=.example.de,.local,10.200.21.
if [ -n "$PROXY_USERNAME" ] && [ -n "$PROXY_PASSWORD" ]
then
PROXY="http://$USERNAME:$PASSWORD@$PROXY_SERVER:$PROXY_PORT"
elif [ -n "$PROXY_USERNAME" ]
then
PROXY="http://$USERNAME@$PROXY_SERVER:$PROXY_PORT"
else
PROXY="http://$PROXY_SERVER:$PROXY_PORT"
fi
cat <<EOFF >> ~/.bashrc
export ALL_PROXY=$PROXY
export HTTP_PROXY=$PROXY
export HTTPS_PROXY=$PROXY
export FTP_PROXY=$PROXY
export RSYNC_PROXY=$PROXY
export http_proxy=$PROXY
export https_proxy=$PROXY
export ftp_proxy=$PROXY
export rsync_proxy=$PROXY
export NO_PROXY=$PROXY_EXCEPTIONS
EOFF
|
| cat <<EOFF >> /home/jtel/.bashrc
export ALL_PROXY=$PROXY
export HTTP_PROXY=$PROXY
export HTTPS_PROXY=$PROXY
export FTP_PROXY=$PROXY
export RSYNC_PROXY=$PROXY
export http_proxy=$PROXY
export https_proxy=$PROXY
export ftp_proxy=$PROXY
export rsync_proxy=$PROXY
export NO_PROXY=$PROXY_EXCEPTIONS
EOFF
source ~/.bashrc
|
Sicherstellen der Namensauflösung
...
Sv translation |
---|
|
Status |
---|
colour | Red |
---|
title | THIS PAGE IS ONLY AVAILABLE IN ENGLISH |
---|
|
|
Sv translation |
---|
|
IntroductionLes étapes suivantes sont effectuées après l'installation du système d'exploitation, avant qu'un RÔLE spécifique ne soit configuré. Variantes cloud Info |
---|
| Pour les installations du nuage d'azur, un utilisateur est spécifié lors de la création de la VM. Le mot de passe root reste caché. Il est cependant possible de passer en root à l'aide de la commande suivante, en utilisant le mot de passe propre à l'utilisateur : |
|
title | /etc/hosts |
---|
En outre, il est nécessaire de configurer la ou les cartes réseau dans une zone particulière. Pour ce faire, il faut éditer le(s) fichier(s) de configuration du réseau : Translations Ignore |
---|
Code Block |
---|
| vi /etc/sysconfig/network-scripts/ifcfg-eth0 ... (add at end) ZONE=public ... service network restart |
|
S'assurer que firewalld est en cours d'exécution et non pas iptables. Les commandes suivantes sont utilisées pour s'en assurer. Translations Ignore |
---|
Code Block |
---|
| systemctl disable iptables systemctl mask iptables systemctl enable firewalld systemctl start firewalld |
|
|
Mise à jour du systèmeMettez à jour le système avec la dernière version de patch et installez les paquets de base. Notez que si cela échoue en raison de la présence d'un serveur proxy, ignorez cette étape et créez d'abord l'utilisateur jtel. Ensuite, configurez le proxy comme indiqué Ici. Notez que, comme la plupart des machines nécessitent le connecteur mysql, il est installé directement ici. Translations Ignore |
---|
Code Block |
---|
| dnf -y update dnf -y install tar nano unzip wget rsync sysstat nfs-utils cifs-utils nmap bind-utils tcpdump lsof tmux chrony virt-what policycoreutils-python-utils libaio python2 dnf-plugin-versionlock rsyslog dnf config-manager --disable mysql-connectors-community dnf config-manager --disable mysql-tools-community dnf -y module disable mysql dnf -y install https://dev.mysql.com/get/mysql80-community-release-el8-1.noarch.rpm dnf -y install mysql-community-client |
|
Si un nouveau noyau est installé, un redémarrage est nécessaire. Étapes obligatoiresutilisateur jtelCréer un utilisateur jtelCréer l'utilisateur jtel , et ajouter au groupe wheel, qui permet à l'utilisateur d'exécuter des commandes avec sudo. Status |
---|
colour | Red |
---|
title | Mot de passe de précaution |
---|
|
Translations Ignore |
---|
Code Block |
---|
| useradd -m jtel gpasswd -a jtel wheel printf '<password>\n<password>\n' | passwd jtel |
|
La commande suivante crée un fichier de configuration permettant à tous les utilisateurs qui sont membres du groupe de roues d'exécuter des commandes comme root avec sudo. Translations Ignore |
---|
Code Block |
---|
| cat <<EOFF > /etc/sudoers.d/wheelers ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL EOFF |
|
Avertissement lors de l'utilisation de git comme racineLa commande suivante rend (intentionnellement) plus difficile l'utilisation de git en tant qu'utilisateur root. Translations Ignore |
---|
Code Block |
---|
| cat <<EOFF >> ~/.bashrc alias git='printf "Il semble que vous essayez d'exécuter GIT en tant que ROOT.\nPour les installations jtel, GIT devrait toujours être exécuté par l'utilisateur jtel.\nSi vous voulez vraiment exécuter git en tant que root, vous devrez y accéder directement, en utilisant /usr/bin/git par exemple.\n"' EOFF source ~/.bashrc |
|
Chrony est un nouveau (meilleur) remplacement de ntpd. Il est configuré de manière similaire, mais les commandes utilisées pour vérifier la synchronisation sont légèrement différentes. Pour plus d'informations, consultez ce lien : https://opensource.com/article/18/12/manage-ntp-chrony Les commandes suivantes modifient le fichier chrony.conf de base pour supprimer l'utilisation du pool par défaut et de tout serveur configuré, et le remplacer par les 3 serveurs de temps (très fiables) du PTB allemand. Translations Ignore |
---|
Code Block |
---|
| # Replace all existing servers sed -i -e "s/^server /# server /" /etc/chrony.conf # Replace pool setting sed -i -e "s/^pool /# pool /" /etc/chrony.conf # Add PTB Servers cat << EOFF >> /etc/chrony.conf # Servers to use server ptbtime1.ptb.de iburst server ptbtime2.ptb.de iburst server ptbtime3.ptb.de iburst EOFF # Enable chronyd systemctl enable chronyd # Stop (just in case it was started), then start and get status systemctl stop chronyd systemctl start chronyd |
|
Vérifier le chronyd Translations Ignore |
---|
Code Block |
---|
| # Vérifier l'état du service systemctl status chronyd # Vérifier les sources qu'il utilise chronyc sources |
|
Désinstaller Anacron, Installer cronLe système jtel exige que les tâches cron soient effectuées à un moment précis. Les serveurs jtel fonctionnent généralement en continu. Le service anacron (qui est installé par défaut) peut exécuter une tâche cron plus tard si la machine a été mise hors tension. Cependant, dans un système de jtel, cela ne sert à rien, et cela peut parfois être destructeur. Par conséquent, le service anacron est supprimé et remplacé par le service cron normal. Translations Ignore |
---|
Code Block |
---|
| dnf -y install cronie-noanacron dnf -y remove cronie-anacron |
|
Installer les outils de l'hyperviseurLes outils de l'hyperviseur permettent de mieux prendre en charge la console de l'hyperviseur lors d'opérations telles que les clichés, le démarrage, l'arrêt et la réinitialisation de la machine virtuelle. Il est important que les bons outils soient installés. Warning |
---|
Remarque : vous n'aurez pas besoin de le faire et ne devriez pas le faire dans la plupart des environnements en nuage ! |
Détecter l'hyperviseurVMWareLes outils sont installés comme suit : Translations Ignore |
---|
Code Block |
---|
| dnf -y install open-vm-tools |
|
Hyper-V Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | Installer les outils Hyper-V |
---|
| dnf -y install hyperv-daemons |
|
KVM Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | Installing KVM (qemu) Guest Tools |
---|
| dnf -y install qemu-guest-agent systemctl enable qemu-guest-agent systemctl start qemu-guest-agent |
|
Autres hyperviseursConsultez le fabricant pour plus de détails. Fichier d'hôtesPréparez le fichier d'hôtes. Voir ici pour plus de détails: Hosts File - All OS (CentOS8/Win2019). Étapes facultativesClés SSHDes clés SSH peuvent être ajoutées, pour permettre la connexion à l'utilisateur jtel via une clé ssh. Translations Ignore |
---|
Code Block |
---|
language | bash |
---|
title | Clés SSH |
---|
| mkdir -p /home/jtel/.ssh cat << EOFF > /home/jtel/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAgJWox9vkWssx24V6m+VB/9cfFUznUnVJqHeSnQFcE+ANzH+lgv90jQYXRf8XLSaKA4HZGO7SFUwLz7eNHk0lIS+TG+WKGrjl3GRvzNoYVAapeKUV7HjbeagQPNOCKTr6G8Vi/GVMyOx8XhJAgpr5gjyW9GdMdqnOS9uxd83BCh/UiAP9oVUbLiIIxbtmLAzyfJdjnbFP9sJXw96Vl040Fe4aoLofrkPyPu7cst6TPJx5myDhORG31nD/2iwUNLfv58m9ABMsePfhqzSp/Hi2XY/e5gikDh3xUxoBmL9fWwbiFb92AFW08rP1CtoCEtOe2nJkdtRzt0GiE+A+zgdDjw== support@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuP5DEZDI6/CITTqk8qburqDuKNj6jnQ9Zbjz6BO+5P8MlrS8KT7y56u/PSqdO3OzD58D2JS0yNvM5RbBGYDUD1ng7VSJLFLfErbuCzJ/Q+BSRaee+7MhLWXdVSc/EY2B4qUcZGRL/NXHtAY/3KvSSU3wnhI4edLYMAzuxAhNEPRkmniq1CAuykDdHvm0kVQzaSShYDBQWIlbWIMG6jsCmMpZR7v+v6gKWeowQkM4T4XZ1f2K5zlQXd6FHGY8C/+XICefum2qgQtqgjfQMoqIQbnmfKDGIHPvkas287tdCbU4y1lTsJbTiT7INkd6QbiVUayVxVwwoV+G2F7WofN4nw== root@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArTi8N08gDz1CvDriZNALa1tHky/1+QNP0WU43dI7hkn2zH7fz9bXAs32z7dRjfgxaYXWPmClcDLDb0xwjGfMXK0HABPtp0bxh/58Y0QowBUJkcNi6hUphT+ArGkpjQb5CJcArnbLO727R8jJFgE1QpiWdehd5t3ec0wOL0NhnIE63S+DUm7+bQW6Z8Kmzl0+opGyoURLf8hxeAIUJwdeMFN7AIVPZlyuPobowwjGDXD9YpwXZ2oPtg6XISwW/O1fsetzmGkgD4gedxJxjc5x5ByZX98UsNJORrG5R5slLqQTJkJzGBLpH8kC9WLIEW0RduVR2mrQzOBRgA92i5ZUFw== lewis.graham@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9W40vFohIPQsH6Q5Rfef7xiC4WRHOkMaMsUXxLCnTCDGI0PDib23NBUTevcnAc+OrCUITRmwngRbcItbR9QM1qNhzrwS8ZI00psZVVnBUwVVpX4UJtmX0CDrtVwH1yz51/WnZVeS17JqoMjVMB3p+n1CjViwh6qlRTI/9F/KfaOfiLEiHnvcnmSq67R7o5wP65TR00xqA20E569M1lcdn43xL2GylkwHuWw+XcusKqf+lnaawFWhdZUTOuF3ZB+ssuEbXSyZEGtc5/HNUG8rg9tutzAfq3fNWc5Y5pY+B048g4oDyAQpwMB7i9OwNNk1IEZA+rmqIImf7XLVKIsNn andrey.tsvetkov@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkBiz9SsIXMO/a+7hCxNGQuQ4s/gqUZ6pyxDxjpDTD+bewxumyhn5aITbBSuHpx0n05JL4nGGdROii54ATildm3Uhi8JSljGy5uv97Sw8Kpy0eO314tOLU3NkAe2YOH1aUeArne4bYPebKBq0r1oln1Gu2+TFvCmMqu3FmleMv1xvw/waTwO57hSBPN83gOaJR7w6lOUp5HjYLSA0zRs1Os3g6ldQkHeGBknJ6jChqFXJHGl0KYzZGv3Q46fVTptS7NACxZs+ARUzJjbGjxnpHYK8rmSoTfoBS4qlN5+LxYKG341Hmq7cOsaISwUFbE/CbFOqUtjBviI1c7RLgtGnJQ== serge.djomo@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAuh3ZLgQo2e9Uv1vAQxxCGxe9D3u8DWh4egeteUAPj4b7tOxQ6to3zAlGytUR9R6sANL/CIP3nEA2d3r4km0FQWQ4QFCLTFjyXl0Kvsn1ahN8DljJ6mRlwtvN2r5mBIEy1ClGCh+Jvchzf4ZhXrWxOTYYO77O8wjj9Zbk0Y6wI2qBnE6TaxsRQ7Z61zTe80xfLPQLKjgQ/5Hdk0z0HAx3jEsZRo9CqMLb44UD+6jVCih1JPMFcnUu0uxRQdOHrg243tqAUmuqICWompZNO75v3HjIIXOebxVGBXugrYc2xR1q964/EE0ZR7JMWM+HJ47V8WJKkE126n9ZElCqNGIR+Q== heidi.mueller@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAilON3Cn1bZPBYtv67Bv63llD1KMTTH52/ioPLm+qYYDV80mSHSb+PHD9awXNKNv5iTecaQ/a56CkK0z+KI5zvJb3EiRZaRe70cIqdflHmTcasVPVk1hAma5xc5UOCr+dKokqMQGwpDRrDvdS3atflQznvlR8+qoxPjlKC4KDx0GOUeSOIPBO6DdYGPlFX6ohMVRE7p/vHIRAOfehmG1xFtfk+rGPmgiblPWWWklKYQUfMnHI0pqFJwrPW46nqdUlQwtknATZC2cuKe931zstFhuDsm218yS4hTTlcjw5i/DH7PFr9Y58BtY6ZTy8khwTUeMPpSxE7i2WYoqoJ7DXcw== sou@jtel.de ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA0czZLbpaxo/EY9iHDq9n6EWTALeYB7GVmp/mLwp66zeV4DbvTm+3FDUJSD9rqMJzJkAAEicFe+II/ZdIeZzG4JdYf66M/Y6k0w0Y8jJqDtsdgUf3OJ1hJ53Z+BwFqy1vD/a7N2hxlEKD2rzyAfVb+xzTzhJTjpX1kNiUxDMXRZs4ytW0CbOqZSpTJ3eT9NS9gH188KFTvHN8rPzDAxRKcexO2fSzNa7e+dYsfImOQoYlxFBX5YU74Ay9F5b7K95Cxe8EstvKNVmjkNWgnNWuS2d7eabepC1jv3z0FdOGiVoZ1SDgqKz8ysBa6Rzkt5L5peHYAKyH8TedeUk7kRIwZQ== dhia@jtel.de EOFF restorecon -R -v /home/jtel/.ssh chown -R jtel:jtel /home/jtel/.ssh chmod 0700 /home/jtel/.ssh chmod 0644 /home/jtel/.ssh/authorized_keys |
|
Notez que la connexion par clé ssh uniquement doit être activée (ceci n'est pas abordé ici, et un mot de prudence - assurez-vous d'avoir enregistré le mot de passe root avant de le faire afin de pouvoir au moins accéder à la machine via la console). Serveur proxySi un serveur proxy est utilisé, les commandes suivantes permettront de configurer le serveur proxy pour l'utilisateur root et l'utilisateur jtel. Les 5 premières lignes doivent être modifiées. Status |
---|
colour | Red |
---|
title | Mot de passe de précaution |
---|
|
Translations Ignore |
---|
Code Block |
---|
| PROXY_USERNAME= PROXY_PASSWORD= PROXY_SERVER=proxy.example.de PROXY_PORT=3128 PROXY_EXCEPTIONS=.example.de,.local,10. if [ -n "$PROXY_USERNAME" ] && [ -n "$PROXY_PASSWORD" ] then PROXY="http://$USERNAME:$PASSWORD@$PROXY_SERVER:$PROXY_PORT" elif [ -n "$PROXY_USERNAME" ] then PROXY="http://$USERNAME@$PROXY_SERVER:$PROXY_PORT" else PROXY="http://$PROXY_SERVER:$PROXY_PORT" fi cat <<EOFF >> ~/.bashrc export ALL_PROXY=$PROXY export HTTP_PROXY=$PROXY export HTTPS_PROXY=$PROXY export FTP_PROXY=$PROXY export RSYNC_PROXY=$PROXY export http_proxy=$PROXY export https_proxy=$PROXY export ftp_proxy=$PROXY export rsync_proxy=$PROXY export NO_PROXY=$PROXY_EXCEPTIONS EOFF cat <<EOFF >> /home/jtel/.bashrc export ALL_PROXY=$PROXY export HTTP_PROXY=$PROXY export HTTPS_PROXY=$PROXY export FTP_PROXY=$PROXY export RSYNC_PROXY=$PROXY export http_proxy=$PROXY export https_proxy=$PROXY export ftp_proxy=$PROXY export rsync_proxy=$PROXY export NO_PROXY=$PROXY_EXCEPTIONS EOFF source ~/.bashrc |
| 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.10 acd-lb acd-lb.example.com
192.168.1.10 acd-store acd-store.example.com
192.168.1.21 acd-dbm acd-dbm.example.com
192.168.1.22 acd-dbs acd-dbs.example.com
192.168.1.22 acd-dbr acd-dbr.example.com
192.168.1.31 acd-jb1 acd-jb1.example.com
192.168.1.32 acd-jb2 acd-jb2.example.com
192.168.1.40 acd-tel1 acd-tel1.example.com
|