-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathlinux.html
5014 lines (3403 loc) · 163 KB
/
linux.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<html>
<!-- vim: tabstop=8 shiftwidth=8 noexpandtab paste
browser render tab as 8 spaces for html PRE
-->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Pocket Survival Guide - Linux</title>
<link rel="stylesheet" href="psg.css" type="text/css">
<LINK REL="SHORTCUT ICON" HREF="favicon.ico" type="image/x-icon"/>
<META NAME="description" content="System Administrator Pocket Survival Guide - A series of notes for Sys Admin"/>
<META NAME="keyword" content="Sys Admin, System Administrator, Solaris, HP-UX, AIX, Linux, Note, Notes, Pocket, Survival, Guide, psg, data center, power, electrical, plug, LYS, LKS, LAPPLAPP"/>
<MEA NAME="Robots" CONTENT="all"/>
<META NAME="Author" CONTENT="Tin Ho"/>
</head>
<body>
<div class="navheader">
<table summary="Navigation header" width="100%">
<tbody>
<tr>
<th colspan="16" align="center">
<A HREF="http://tin6150.github.io/psg/linux.html">Sys Admin Pocket Survival Guide - Linux</A>
</th>
</tr>
<tr>
<td align="left"><a accesskey="H" href="psg.html">Home</a></td>
<td align="center"><a accesskey="F" href="firewall.html">Firewall</a></td>
<td align="center"><a accesskey="s" href="sourceControl.html">sourceControl</a></td>
<td align="center"><a accesskey="g" href="git.html">git</a></td>
<td align="center"><a accesskey="t" href="tool.html">tool</a></td>
<td align="center"><a accesskey="I" href="infiniband.html">Infiniband</a></td> <!--alt-sh-i is chrome shortcut for feedback -->
<td align="center"><a accesskey="l" href="lsf.html">lsf/slurm</a></td>
<td align="center"><a accesskey="b" href="bios.html">BIOS</a></td>
<td align="center"><a accesskey="s" href="sol.html">Solaris</a></td>
<td align="center"><a accesskey="a" href="aix.html">AIX</a></td>
<td align="center"><a accesskey="n" href="netapp.html">NetApp</a></td>
<td align="center"><a accesskey="e" href="emc.html">EMC</a></td>
<td align="center"><a accesskey="i" href="isilon.html">Isilon</a></td>
<td align="center"><a accesskey="L" href="ldap.html">LDAP</a></td>
<td align="center"><a accesskey="v" href="vagrant.html">vagrant</a>(VirtualBox)</td>
<td align="right"><a accesskey="A" href="https://github.com/tin6150/inet-dev-class/tree/master/ansible">Ansible</a></td>
<!-- most accesskey defined in psg2.html and linux.html 2020.1218. use alt+LETTER for quick link out -->
</tr>
</tbody>
</table>
<hr></div>
<div class="chapter" lang="en">
<div class="titlepage">
</div>
</div>
<!---------------------------------------------------->
<div align="CENTER">
<A HREF="http://www.explainxkcd.com/wiki/index.php/456"><IMG SRC="fig/xkcd_cautionary.png"></A>
</div>
<BR>
This Linux guide is my own notes on Linux, for stuff that I did not like to
documents that I have found on the internet. It is RedHat centric. <BR>
<A HREF="centos.org">CentOS</A> is supposed to be a "rebadged/un-commercialized" version of RHEL, keeping binary-level compatibilities at major release level, thus the discussion should apply equally to CentOS and Scientifi Linux.
<BR>
Ubuntu is conquering the world now, so there are some Debian things here and there. What is Linux anyway? :)
<BR>
<BR>
funny/ugly/stupid chars when pasting? See
<A HREF="vnc.html#bracketed_paste_mode">bracketed_paste_mode</A>
<BR>
<BR>
<H1>HOW-TO</H1>
<p> </p>
<H2>RHEL vs CentOS vs Scientific Linux vs Rocky Linux</H2>
<UL>
<LI> RedHat you have to pay. CentOS is free. Beyond that, both are largely identical. Except...
<LI> RedHat provides commercial tech support
<LI> RedHat provides a yum-security plugin that allows machine to be patched with only security update via yum (and keep the OS at the same level). See
<A HREF="https://access.redhat.com/solutions/10021">Solution 10021</A>.
<LI> CentOS does not provide this info. updateinfo.xml.gz is empty, thus commands like <BR>
<TT> yum updateinfo list security all</TT> <BR>
<TT> yum updateinfo RHSA-2014:0159</TT> <BR>
in the past, this did <EM>NOT</EM> work in CentOS. They
results in a noop on CentOS machines. Lack of action in output does NOT mean security patches aren't needed! See <A HREF="https://www.centos.org/forums/viewtopic.php?t=59369">CentOS forum</A>
<BR>
But... CentOS pivot to upstream, and Fedora marking some update as security... may not be comprehensive?
but yum-cron with security only on CentOS and Rocky would be safer than without it.
<PRE>
update /etc/yum/yum-cron*conf
updates should be logged to /var/log/yum.log
yum updateinfo list security all
yum --security upgrade # install only rpm that are needed to fix security issues. *just use this*
yum info-sec # list avail security update, with description. somehow slightly diff result list than yum --security upgrade or yum list-sec
yum --security check-update # a very long list, include already installed fixes.
yum list-sec # list rpm with sec update avail, they may or may not have been applied already.
yum list-security
</PRE>
<LI> Oracle Linux (is it still around?) is essentially RHEL, but support is provided from Oracle directly. Oracle DBAs probably like it.
<LI> Scientific Linux has 'fastbugs' and 'security' updates. Security updates are enabled by default.
See <A HREF="https://www.scientificlinux.org/documentation/faq/faq-updates/">SL FAQ from Fermilab</A> and
<A HREF="https://serverfault.com/questions/369833/automatically-check-for-security-updates-on-centos-or-scientific-linux">serverfault</A>
<LI>
<LI> Amazon Linux is based on RHEL/CentOS 7, but have their own tweaks. eg for EPEL, has aws cli pre-installed.
</UL>
<H2>Linux Admin 101</H2>
Linux init mode are not "cumulative". So, if default init is 5, script in run level 3 would not be run. If adding a Start script, may want to add them in both in rc3.d and rc5.d, unless it is really only wished to be available at one of the run level and not the other.
Kill script should be placed in rc6.d, which shutdown/reboot scan.
<BR>
<BR>
RHEL3 - binary compatible with FC2 (but FC2 is EOL)
<BR>
RHEL4 - binary compatible with FC3 (and maybe FC4)
<BR>
<H4>Single User Mode RHEL 6</H4>
<PRE>
To boot into single user mode for maintenance,
enter "linux single" or "linux emergency" at the LILO boot: prompt.
If using GRUB, then, at the menu for choosing kernel, do:
hit 'e'
then arrow down to the kernel line
hit 'e' again
add 'single' to the end of the line
hit enter
hit 'b' to boot
lather, rinse, repeat
</PRE>
<H4>Single User Mode RHEL 7</H4>
https://docs.fedoraproject.org/en-US/Fedora/19/html/Installation_Guide/s1-grub-targets.html
<PRE>
linux16 /vmlinux... ro rd.lvm.lv=...
linux16 /vmlinux... rw init=/sysboot/bin/bash
linux /vmlinux... systemd.unit=multi-user.target
remove rhgb quiet
rhgh is redhat splash
quiet remove most verbose msg
/etc/default/grub
GRUB_TIMEOUT=60
GRUB_CMDLINE_Linux=... (remove rhgb quiet)
grub2-mkconfig
</PRE>
<H4>Single User Mode RHEL 7 with pxe boot with chrooted env</H4>
ln -sf /lib/systemd/system/rescue.target /etc/systemd/system/default.target
<H4>Old days Core dump</H4>
<PRE>
Linux kernel panic does not core dump to a file.
it will print output of the kernel core dump result to the stdout device:
a vga screen or a serial console.
To setup serial console, do:
console=ttyS0,115200 console=tty0
but this would mean console boot/shutdown/panic message will no longer
be send to the VGA, but to serial port. VGA may get a spawned
login prompt after OS is up.
</PRE>
<H4>kdump</H4>
<PRE>
yum install kexec-tools
chkconfig kdump on
</PRE>
/etc/kdump.conf ::
<PRE class="cf">
core_collector makedumpfile -c --message-level 1 -d 31
# -d specify the dump filter (stuff to exclude)
# 1 Zero pages
# 2 Cache pages
# 4 Cache private
# 8 User pages
# 16 Free pages
# -c to enable compression
#
sshkey /etc/acs/kdump/id_rsa-sa_kdump
path /data/kdump/
blacklist pvscsi
blacklist vmmemctl
</PRE>
<PRE>
/boot/grub/grub.conf : add crashkernel clause
kernel /boot/vmlinuz-2.6.18-371.11.1.el5 ro root=LABEL=/ crashkernel=768M@32M
test. this WILL CRASH the machine:
echo 1 > /proc/sys/kernel/sysrq
echo c > /proc/sysrq-trigger
</PRE>
To look at vmcore file:
<PRE>
yum install crash
debuginfo-install kernel # to install necessary "decoder" to analyze the crash file
crash /var/crash/.../vmcore /usr/lib/debug/lib/modules/.../vmlinux # need matching kernel file
log
bt # for backtrace
ps # display processes
vm
files # lsof
help
</PRE>
somewhat helpful shell function to see if there are recent core dumps
<PRE class="cf">
lsdump () {
for entry in $(ls /kdump|grep ^[1-9]); do
ip=$(echo $entry|cut -d- -f1)
hostname=$(dig +short -x $ip)
date=$(echo $entry|cut -d- -f2-)
echo "$date $hostname ($ip)"
done | sort
}
</PRE>
<H4>console in serial port</H4>
<PRE>
--kargs="nopti console=tty0 console=ttyS1,115200n8"
</PRE>
<H2>Linux "deviation" from Solaris</H2>
Some of the most notable things that Linux does rather differently than
Solaris or traditional Unix.
<UL>
<LI>xinetd
<LI>Gnome/KDE for Display Manager (see <A HREF="#XDMCP">XDMCP</A>).
<LI>
</UL>
<BR/>
<A NAME="centos_vs_ubuntu"></A>
<A NAME="rhel_vs_ubuntu"></A>
<A NAME="vs"></A>
<H2>RHEL/CentOS/Scientific Linux vs Ubuntu</H2>
Ubuntu is Debian-based. Some of the more often run-into diff for sys admin:
<BR><BR>
<TABLE border="solid black">
<TR>
<TH></TH> <TH>RHEL</TH> <TH>Ubuntu</TH>
</TR>
<TR>
<TD>nic</TD>
<TD>/etc/sysconfig/network-scripts/ifcfg-NIC</TD>
<TD>/etc/network/interfaces</TD>
</TR>
<TR>
<TD>Firewall</TD>
<TD>systemctl enable/start/status iptables <BR>
systemctl enable/start/status firewalld <BR>
</TD>
<TD>ufw enable/start/status</TD>
</TR>
</TABLE>
<BR>
Most of this doc is CentOS centric.
<A NAME="64-bit"></A>
<H2>64-bit Platforms</H2>
RHEL 3.0 and 4.0 maintains simultaneous relese/update levels for 64-bit platforms as their popular 32-bit x86 OS. Just need to get the "special" distro ISO to install on the 64-bit hardware and it will be good to go. Not all the AS/ES/WS flavor maybe available to all platform.
<BR>
<PRE>
RHEL 4.0
rhel-ia64-as-4 Red Hat Enterprise Linux AS (v. 4 for 64-bit Intel Itanium)
rhel-x86_64-as-4 Red Hat Enterprise Linux AS (v. 4 for 64-bit AMD64/Intel EM64T)
rhel-ppc-as-4 Red Hat Enterprise Linux AS (v. 4 for 64-bit IBM POWER)
rhel-s390-as-4 Red Hat Enterprise Linux AS (v. 4 for 31-bit IBM S/390)
rhel-s390x-as-4 Red Hat Enterprise Linux AS (v. 4 for 64-bit IBM zSeries)
rhel-i386-as-4 Red Hat Enterprise Linux AS (v. 4 for 32-bit x86) [typical intel pentium 4/80x86 release]
rhel-i386-ws-4 Red Hat Enterprise Linux WS (v. 4 for 32-bit x86)
RHEL 3.0
rhel-ia64-as-3 Red Hat Enterprise Linux AS (v. 3 for Itanium)
rhel-x86_64-as-3 Red Hat Enterprise Linux AS (v. 3 for AMD64/Intel EM64T)
rhel-ppc-as-3 Red Hat Enterprise Linux AS (v. 3 for iSeries and pSeries)
</PRE>
Commands for 64-bit info:<BR>
<PRE>
ld -V # shows supported emulation for a given machine
# eg: elf_x86_64 elf_i386 i386linux
</PRE>
<A HREF="64bit_and_rpm"></A>
<H4>64-bit and rpm</H4>
AMD64 RedHat Linux utilize lots of rpm that has ARCH set to x86_64 (instead of
the traditional i386). rpm -q by default won't tell you. Use something like
<BR>
<BR>
<TT>rpm -q --qf '%{NAME} %{VERSION} %{RELEASE} (%{ARCH})\n' <I>Package_Name</I> </TT>
<BR>
<BR>
to see which one you have installed. In 64-bit machines, most of the packages
are x86_64. But quite often you will have a matching package of the same
name, but is i386 ARCH. Some apps don't understand 64bit libs, so these older
libs are sometime needed. There are also some compat libs. My friend Vic says:
<PRE class=quote>
* Compatibility Arch Support
Crapload of i386 binaries and libraries that run on x86_64 RedHat systems
* Compatibility Arch Development Support
You'll need some packages in Compatibility Arch Development Support to build
i386 RPMs or compile 32 bit binaries on an x86_64 system.
I find it annoying to install the Compatibility Arch Support group, though.
For instance, let's say you have an x86_64 arch server. You want some i386
compatibility for some random library. Let's say zlib.i386 for whatever
reason. Maybe some 3rd party application needs to run as a 32 bit binary and
requires zlib's /usr/lib/libz.so.1 instead of zlib.x86_64's
/usr/lib64/libz.so.1
You can just install Compatibility Arch Support and not worry about it, or go
back an install zlib.i386 specifically. If you install the whole
Compatibility Arch Support group, you are going to end up with all the
freakin' i386 packages designed to run on x86_64 systems. Which means, you'll
get a lot of crap you don't want to be living on a light weight server. For
instance, kdebase.i386, gnome-blah.i386 and such.
One thing that is very useful to have is firefox.i386 or mozilla.i386 on an
x86_64 system.
Most plugins don't play well with 64-bit browsers.
So, in short -- you can remove what you don't need :)
</PRE>
<A ID="endian"></A>
<A ID="endianness"></A>
<H3>Endianness</H3>
<PRE>
network byte order: big-endian
intel: little-endian (just think of intel being an @$$)
most RISC were big-endian?
new POWER is configurable.
arm is said to be either, but not sure if it was a silicon level or firmware level change.
amazon linux using aarch64 is apparently little endian
To determine byte order, use one of:
python:
from sys import byteorder
print(byteorder)
perl:
perl -e 'use Config; print $Config{byteorder}'
</PRE>
for the purist, there is a C/C++ code in this
<A HREF="https://stackoverflow.com/questions/4181951/how-to-check-whether-a-system-is-big-endian-or-little-endian">stack overflow post</A>. I was just too lazy to compile things. Perl one liner was just perfect for this :D
<BR>
<A ID=RHEL_vs_glibc"></A>
<A ID="compatibility"></A>
<H3>Compatibility</H3>
Torvals ensure linux kernel update does not break user space. glibc, which make lots of system calls, has to be kept very stable.
Let the distro manage upgrade of kernel and glibc. <BR>
gcc does NOT come with glibc! :) <BR>
gcc and g++ come and use libstdc++ , which provide fn like new and delete, which maps to C API system calls like malloc(), thus only glibc need to be very stable, whereas compiler and libstdc++ can upgrade and have multiple versions.
<BR>
Useful info in this
<A HREF="https://www.reddit.com/r/linuxquestions/comments/1tghjd/what_is_the_relationship_between_gcc_libstdc/">reddit post</A>
<BR>
<BR>
<!-- app that need specific version of glibc cannot be resolved by loading a new Software Module Farm with newer gcc version
but potentially one can compile an ADDITIONAL glibc in alternate path and set LD_LIBRARY_PATH ? -->
<PRE>
System Release kernel glibc gcc compat-glibc
---------------------------- ------------- ------------- ----------------- -------------
SuSE SLUS 9 (patch 3) 2.6.11.7 2.3.3-98.94 3.3.3-43.54
SuSE SLUS 10 (patch 10) 2.6.16.27-0.9 2.4-31.5 4.1.2_20070115-0.11
RHEL 3 2.4.21 3.2
RHEL 4.5 (WS) 2.6.9-55 2.3.4-2.36 3.4.6-8 2.3.2-95.30
RHEL 5 2.6.18 2.5 4.1
RHEL 5.9 2.6.18-348 2.5-107 4.1.2-54
Fedora Core 3 2.6.9
Fedora Core 6 2.6.19-1 2.5-10.fc6 4.1.1-51.fc6
Fedora 8 2.6.23
RHEL 7.9 3.10.0-1160.49 2.17-325 4.8.5 n/a?
Amazon Linux 2.3 4.14.281-212 2.26-60 7.3.1
RHEL 8.1 4.18.0-147.3.1 2.28-72 8.3.1-4.5
RHEL 2.1, 3, 4. Increasing support cost: WS, WS HPC, ES (2 socket max), AS
5. Desktop + workstation, HPC Compute Nodes, Server, Advance Platform
</PRE>
For RH, each category has separation of basic, std, premium. HPC has a 4 socket version.
See <A HREF="http://www.redhat.com/rhel/compare/">comparison chat</A>.
<BR>
Compatibility table of GCC vs binutils (but NOT glibc)
from
<A HREF="https://wiki.osdev.org/Cross-Compiler_Successful_Builds">osdev</A>
<BR>
<BR>
<A NAME="upgradability"></A>
<H2>Upgradability</H2>
<PRE>
RHEL 7.9 can use leapp to do in-place upgrade to RHEL 8.9 (so that content of FS is preserved).
The process works, but some el7 packages won't be upgraded. mostly those from EPEL.
My experience was that epel has to be disabled after the upgrade.
Mate, caja from el7 have rpm that remains in system, binary still work.
/etc/yum.repos.d/epel.repo has to be set to disable
else yum update may have unresolvable dependencies:
Error:
Problem 1: cannot install the best update candidate for package libidn2-2.2.0-1.el8.x86_64
- nothing provides libunistring.so.0()(64bit) needed by libidn2-2.3.7-1.el7.x86_64 from epel
Problem 2: cannot install the best update candidate for package lua-expat-1.3.0-12.el8.1.x86_64
- nothing provides lua(abi) = 5.1 needed by lua-expat-1.4.1-1.el7.x86_64 from epel
Problem 6: brotli-1.0.6-3.el8.i686 from @System does not belong to a distupgrade repository
- cannot install both brotli-1.0.9-10.el7.x86_64 from epel and brotli-1.0.6-3.el8.x86_64 from @System
- cannot install both brotli-1.0.6-3.el8.x86_64 from rhel-8-for-x86_64-baseos-rpms and brotli-1.0.9-10.el7.x86_64 from epel
- cannot install the best update candidate for package brotli-1.0.6-3.el8.i686
- cannot install the best update candidate for package brotli-1.0.6-3.el8.x86_64
Problem 7: package fuse3-3.6.1-2.el7.x86_64 from epel conflicts with fuse-common < 3.4.2-4 provided by fuse-common-3.3.0-17.el8.x86_64 from @System
- cannot install the best update candidate for package fuse3-3.3.0-17.el8.x86_64
- cannot install the best update candidate for package fuse-common-3.3.0-17.el8.x86_64
</PRE>
<A NAME="setup"></A>
<H2>Initial Setup</H2>
Things to keep in mind when installing Linux. <BR><BR>
For RHEL 3 and 4, once the OS is installed, additional international language support cannot be added (easily), RH recommends a reinstall. So, if you might need to support any given natural language, install it when you do the system install! <BR>
Starting with Fedora Core 4, additional language can be added from system-configure-packages.
<BR> <BR>
<H5>CentOS Network Install CD</H5>
<PRE>
Use Web as source of rpm.
Server: mirror.stanford.edu (no http:// prefix)
Directory: yum/pub/centos/5.1/os/x86_64/ (leading slash should not matter)
or
Server: mirror.centos.org
Directory: /centos/5.2/os/x85_64
But unfortunately don't support proxy, so likely have to setup something locally.
</PRE>
The dir containing images sub dir is the right one,
it need to have the rpm available rather than just .iso
<BR>
Essentially, same as internal network install, but the web server is over the WAN, and not using a pre-defined kickstart.cfg file :)
<BR>
Other mirror can be used, but some of them only offer ISO files.
<BR><BR>
<A NAME="kickstart"></A>
<H1>Kickstart</H1>
A step-by-step command listing for setting up kickstart,
(hopefully easier to read than Red Hat kickstart instructions,
once it is working, tweaking it is much easier to comprehend).
...
<BR>
Here is a rough outline:
<BR><BR>
<PRE>
</PRE>
<OL>
<LI> iso loopback mount DVD or copy all content of CD/DVD to a dir
<LI>cretae a dir on web server to host the ks.cfg file, make file accessible as http://apache/ks/ks.cfg
<LI>ks.cfg uses http or nfs install, indicating path where rpm can be retrieved. eg: <BR>
nfs --server=10.140.91.44 --dir=/mnt/loopback/rhel-5.1-server-x86_64-dvd <BR>
or <BR>
url --url http://10.140.91.44/ks/serv51-64/dvd1 <BR>
<LI>client, use cd 1, at boot prompt, enter: <BR>
linux ks=http://10.140.91.44/ks/serv51-64/ks.cfg <BR>
</OL>
running commands after kickstart rpm are installed,
everything is masked as ran from /:
<PRE class="code">
%post
#!/bin/bash
LOGFILE=/var/log/my-kickstart.log
echo "manual log to execution ran on post section of kickstart " > ${LOGFILE}
pwd >> ${LOGFILE}
# Add yum repos (rpm from original dvd for easy install via yum)
echo "[rhel5]
name=RHEL5 Kickstart Server
baseurl=file:///net/apache/mnt/loopback/rhel-5.3-server-x86_64-dvd/Server/
enabled=1
gpgcheck=0" > /etc/yum.repos.d/rhel5.repo
# install additional packages
yum -y install j2re AdobeReader_enu
# Create symlink for java browser plugin
ln -s /usr/java/j2re1.4.2_07/plugin/i386/ns610-gcc32/libjavaplugin_oji.so /usr/lib/mozilla/plugins/
# Local services
chkconfig ntpd on
echo "nfserver:/export/home /nfshome nfs rw,soft,intr,tcp,rsize=32768,wsize=32768,vers=3 0 0
" >> /etc/fstab
mkdir /nfshome/
touch /nfshome/MOUNT+PENDING
mount /nfshome
ln -s /bin/csh /usr/bin/csh
ln -s /bin/tcsh /usr/bin/tcsh
echo "sn ALL=(ALL) ALL" >> /etc/sudoers
mv /etc/yp.conf /etc/yp.conf.orig
wget http://apache/conf/yp.conf -O /etc/yp.conf
# Modify SSHD allowed protocols to use only ssh v2:
# sed -i.bak -c "s/#Protocol 2,1/Protocol 2/" /etc/ssh/sshd_config
## NFSv4 seems more friendly with firewall, streamlined the rpc port usage eg for file locking
## test file lock
flock -x ./local-lock-file echo 'cmd ran after obtaining file lock'
echo $?
# if lock doesn't work, the echo command should not run, exit code likely non zero
</PRE>
<H2>Updating OS</H2>
<PRE>
RHEL 4.x - Use up2date
RHEL 5.x - Use yum
rhn_register # automatically prompt for root password when run as user, X-based.
RHEL 8.x - Use did not finish, i mean dnf (yum alias to it)
SuSE - Use rug
</PRE>
Version numbers with dots matter for kernel, glibc, etc. Only version number after dash are bug fixes and don't change behaviour.
See <A HREF="#compatibility">compatibility</A> section for more details.
<H1>Quick Ref</H1>
<A ID="hwcmd"></A>
<A ID="hw"></A>
<H2>Hardware related command</H2>
see also
<LI> <A HREF="#perf">performance</A> section
<LI> <A HREF="bios.html">bios.html</A>
<PRE>
lspci # list pci info
lscpu
hwclock # date hw clock as seen by bios. if wrong, system reboot will get wrong time. there is NO timezone!
date --set 0900 # HHMM (and HH:MM) is acceptable default format for setting time.
hwclock --systohc # sync system "software" clock to the bios, so next reboot will have correct time!
lsmod # display all kernel loaded modules.
modprobe -l # display all kernel loaded modules. now lsmod.
hwbrowser # GUI hardware browser, in /usr/bin (RH9, RHEL 4)
/dev/mic* # many integrated core, for Phi cpu when setup as co-processor, accelerator (NOT the Dell C6320p which has Phi as main cpu)
# https://portal.tacc.utexas.edu/documents/13601/1041435/23-Intel_Xeon_Phi_Intro_Part_1.pdf/eeaf5f85-93d3-4de3-b523-b5f9ec906299
udev # some hw persisten naming thing, eg for hd that may change name due to san multipath, etc.
</PRE>
<H2>Random Tidbits</H2>
<A ID="timezone"></A>
<A ID="tz"></A>
<H5>Timezone</H5>
<UL>
<LI> While EST is Easter Standard Time, PST isn't always Pacific Standard Time. See <A HREF="http://geekyap.blogspot.com/2014/03/pst-is-not-pacific-standard-time-bug-in.html">blogspot</A> post for detailed example.
<LI> <TT>date +%Z</TT> gives timezone name as displayed by the date command, but it is not always the correct string to set for TZ. See <A HREF="https://bugzilla.redhat.com/show_bug.cgi?id=1411150">bugzilla 1411150</A> at redhat.
<LI> Do NOT set <strike><TT>TZ=$(date +%Z)</TT></strike>. PST does not have a corresponding file in /usr/share/zoneinfo (it is only listed as PST8PDT).
<LI> Use <TT>TZ=$(tail -1 /etc/localtime)</TT> instead. <TT>TZ</TT> will become something like <TT>PST8PDT,M3.2.0,M11.1.0</TT>, which would then produce the correct time when <TT>date</TT> is issued.
<LI> PST, CST, AKST cannot be used for TZ. It would not map to a known timezone. <TT>date</TT> will think it is a custom defined timezone with 0 hours offset from GMT, and display the string but the time will be in GMT :(
<LI> EST, MST, HST does work correctly. Can use CST5CDT, PST8PDT, AKST9AKDT if just want to setting something manually.
</UL>
<H5>Changing Timezone</H5>
<UL>
<LI> <TT>cp /usr/share/zoneinfo/US/Pacific /etc/localtime</TT>
<LI> <TT>cp /usr/share/zoneinfo/PST8PDT /etc/localtime</TT>
<LI> Ubuntu: <TT>dpkg-reconfigure tzdata</TT>
</UL>
<H5>logrotate</H5>
<PRE>
/etc/cron.daily/logrotate # cronjob that runs daily
/etc/logrotate.d/syslog # where /var/log/messages is stated to get rotated, compression, etc.
/var/lib/logrotate/logrotate.status # when a given log was last rotated. new entry may have to wait eg 1 week before it get rotated
/usr/sbin/logrotate -v /etc/logrotate.conf # manually invoke logrotate with verbose output, stating why file are rotated or not.
</PRE>
<A NAME="xdmcp"></A>
<H2>XDMCP</H2>
<PRE>
enabling XDMCP will allow program like X Manager to use browser and login via virtual screen,
fully X Manager, Remote Display Manager style, rather than having to login
using ssh and start VNC first. However, VNC is nicer in that
the session stays on the server, XDMCP, if client is a laptop and disconnect,
session will be reset.
Note that botyh XDMCP and VNC are insecure by default!
vi /etc/X11/fs/config
# don't listen to TCP ports by default for security reasons
###no-listen = tcp
### commented out line above to enable XDMCP
service xfs restart
vi /etc/X11/xdm/xdm-config
! SECURITY: do not listen for XDMCP or Chooser requests
! Comment out this line if you want to manage X terminals with xdm
!!!DisplayManager.requestPort: 0
!!!Line above commented out to enable XDMCP
vi /etc/X11/xdm/Xaccess
# * #any host can get a login window
* # have start by itself will allow all host to get login window
vi /etc/X11/gdm/gdm.conf
[xdmcp]
###Enable=false
Enable=true
### XDMCP is enabled using the above clause
### this file need to be updated when GNOME is default windows manager/Display Manager
vi /etc/kde/kdm/kderc
[Xdmcp]
###Enable=false
Enable=true
### XDMCP is enabled using the above clause
### this file need to be updated when KDE is default windows manager/Display Manager
chmod 444 /etc/X11/xdm/Xservers # probably correct already
chmod 755 /etc/X11/xdm/Xsetup_0
older config need to update /etc/X11/XF86Config, but circa 2003
most distro use Xorg,
check /etc/X11/xorg.conf
and ensure FontPath uses Xserver:
FontPath "unix/:7100"
restart X:
- killall gdm-binary # if running GNOME by default
- ctrl+alt+bacckspace # if in front of maching/keyboard
- init 3; init 5 # This may work
- reboot # :)
xorg pci BusID when multiple GPU is present and want to specify which one to use to accelearate video (virtual, VNC)
nvidia-xconfig --query-gpu-info
returned pci BusID for each GPU card.
</PRE>
<!--
nvidia-xconfig - -query-gpu-info
to figure out which pci-{blah} to use.
The query will give you the BusIDs, the {blah} part of the pci-{blah} file to provision corresponds to those GPU busids
wwsh provision set ...
-->
<BR><BR>
<A NAME="gnome"></A>
<H2>GNOME</H2>
<PRE>
gnome-terminal, configure to source .login/.cshrc when launched:
Edit menu, Current Profile... Titles and Command tab,
check "Run command as a login shell".
This should be saved in the user's config file somewhere under the user's home dir.
# to view user's setting.
gconftool-2 --get /apps/gnome-terminal/profiles/Default/login_shell
# command line to set to source login shell, per user.
gconftool-2 --type boolean --set /apps/gnome-terminal/profiles/Default/login_shell true
# read system wide setting
gconftool-2 --direct --config-source xml:read:/etc/gconf/gconf.xml.defaults --get /apps/gnome-terminal/profiles/Default/login_shell
# set global settings as root, to source login when term opens.
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.defaults --type boolean --set /apps/gnome-terminal/profiles/Default/login_shell true
</PRE>
<A ID="pam.d"></A>
<A ID="pamd"></A>
<A ID="pam"></A>
<H1>pam</H1>
Ref:
<UL>
<LI><A HREF="https://www.redhat.com/sysadmin/pluggable-authentication-modules-pam">PAM intro</A> From RedHat articles</LI>
<LI><A HREF="https://www.linuxjournal.com/article/2120">The orig article about PAM</A> from Linux journal, some 20 years ago. arch and basic working remains the same.</LI>
<LI><A HREF="https://aplawrence.com/Basics/understandingpam.html">Understanding PAM</A> with eg of adding time module governing ssh and local login</LI>
<LI></LI>
<LI><A HREF="https://superuser.com/questions/881815/how-to-control-users-login-on-linux-machine-according-to-configuration-file">
https://superuser.com/questions/881815/how-to-control-users-login-on-linux-machine-according-to-configuration-file</A></LI>
<LI></LI>
</UL>
Check to allow user login is really a convoluted matrix of many different combinations.
All the different "if ssh, if user is foo, login in from bar, etc etc" is typically some sort of modules and config in pam.
<BR>
authconfig, authselect and other tools make changes to pam.
<BR>
/etc/nsswitch.conf is high level director
<BR>
/etc/sssd/sssd.conf is backend for the "sss" clause in nsswitch.conf, it is a cache daemon.
<BR>
/etc/security
<BR>
<BR>
Whether ssh keys are allowed as authentication source is set in: <BR>
- sshd.conf (if certain users are allowed to use ssh key, others are not) <BR>
- pam sshd config (forcing interactive login?) (if config is same for all users) ?? <BR>
<BR>
<H2>/etc/pam.d/ Files</H2>
pam.d/ config really governs how things are done.
<BR>
Each file correspond to configuration used for that specific service.
<BR>
<PRE>
sshd # used when ssh in to the machine
login # used to /bin/login (eg, local console login as dumb terminal?)
# when physically in front of machine (? ie GUI, text login, and also su once logged in)
gdm-password # gdm based Display Manager use this pam.d config ?
su # when running su command
sudo # when running sudo command
system-auth # often refered by other config file to use it. think of this as C's #include.
password-auth
config-util # refered by many system config tools, such as system-config-network
clause:
pam_stack.so service=system-auth # this is like "import" system-auth.
??
vnc # most vnc use a local .vncpasswd, not relying on amp
realvnc #
screensaver lock?
</PRE>
<H2>AAA</H2>
<PRE>
aaa =
authentication -- you are who you claim you are
authorization -- you are in the allowed-list for access
accounting -- log that you have accessed the system, duration, etc.
pam.d/ files have these configurable controls
auth - verify user credentials. ? so here talk to ldap, nis, or sssd/local passwd
account - user allowed to connect, password not expired?
password - ? write to shadow file about last login info
session - long duration session info, update wtmp, write when logout too
</PRE>
<H2>Levels</H2>
In increasing mandatory necessity:
<PRE>
optional ?
sufficient - eg login or su, allow use of radius credentials for login in console
auth sufficient pam_radius_auth.so conf=/etc/raddb/server
substack ? like import?
auth substack password-auth
include
use content of another config file (eg system-auth, config-util)
think of #include of C
required
Failure also results in denial of authentication,
although PAM will still call all the other modules listed for this service
before denying authentication.
*** think of it as mandatory but keep checking anyway ??!! ***
requisite
Failure to authenticate via this module results in immediate denial of authentication.
*** think of as mandatory, waste no more time, fail right away ***
</PRE>
<H2>modules</H2>
<PRE>
# Use a radius authentication server listed in a config file
auth required pam_radius_auth.so conf=/etc/raddb/server
# When SELinux operates in Permissive mode,
# disable linux user login for users listed in /etc/security/sepermit.conf
# If user not listed, would still be allowed to login when selinux is disabled or in permissive mode
auth required pam_sepermit.so
# if file /etc/nologin exist, user not allowed to login
account required pam_nologin.so
# use/allow for system password auth ??
account include password-auth
# traditional unix auth, usually /etc/passwd, /etc/shadow
pam_unix.so
</PRE>
<A NAME="authconfig"></A>
<A NAME="authentication_configuration"></A>
<H2>authconfig -- RHEL 7 authentication configuration tool</H2>
<TT>authconfig</TT> is the tool to use to configure authentication services in RHEL7/CentOS7. Manually changing nsswtich.conf isn't enough. There are pam.d, selinux, firewall updates. <BR>
<TT>authconfig-tui</TT> is being deprecated, so for interactive config would need to rely on <TT>authconfig-gtk</TT> or <TT>system-config-authentication</TT>. <BR>
See also <TT>ipa-client-install</TT> and <TT>realmd</TT> <BR>
<BR>
<TT>sssd</TT> is the daemon for System Security Services. It provides a unified interface to manage cache daamon, etc. <TT>nsswitch.conf</TT> refer this as <TT>sss</TT>.
<PRE>
/etc/sysconfig/authconfig # config file (multiple server use space as delimiter)
authconfig --test # show/test current auth service
authconfig ... --update # for any changes, always end with --update!
authconfig --enablenis --nisdomain=research --nisserver=nis1,nis2 --disableldap --update
# change authentication method of system to use nis, not ldap
# this thing may fail silently...
# or other config in file not expressed in the cli doesn't get changed
# and affect final behavior :(
# run test a/o check the resulting config file to be sure.
authselect # replaced authconfig in rhel8
authselect list
authselect show sssd
sss_cache -E # flush all cache
sss_cache -u bob # flush entry for specific user
</PRE>
Ref:
<UL>
<LI><A HREF="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/authconfig-install.html#tips-for-authconfig">RHEL7 authentication</A>
<LI><A HREF="https://www.certdepot.net/sys-understand-authconfig/">certdepot authentication</A>
</UL>
<A NAME="authselect"></A>
<H2>authselect -- RHEL 8 authentication configuration</H2>
<PRE>