Archy's Blog

Since I started this blog I've mostly been covering the server-side of Linux, not so much the desktop side. My recent switch from Ubuntu(LTS) to Fedora as my main Distro on the Desktop(s) gave me the idea to write about that. Now, I know that this kind of comparison has been done probably a thousand times but I thought I write about my experiences with these 2 great distros. First of all, why Fedora? Well, by now I know the Red Hat Ecosystem fairly good and Fedora is pretty stable while maintaining very recent versions of almost any software that I deal with. While Canonical delivers a new version of its OS every 6 months, same as Red Hat with Fedora, I found it to be not as stable and reliable as Fedora. What are the differences between Fedora and Ubuntu? From a visual point of view, it's probably the Desktop Appearance. Since I'm using GNOME as my desktop, I'm only able to compare it within these 2 distros. Fedora ships a more basic and default setup...

So, I've recently completed the RHCSA and RHCE exams successfully and I wanted to share my experience with it. Here are a few of my thoughts about both exams. Time: There's plenty of it on RHCSA but not so much on RHCE. If you know what you are doing on the topics, you'll be done in under 1 hour (in case of the RHCSA) assuming you are decently fast in typing. However, that's not the case with RHCE. For passing RHCE, you'll need to have good time management and eventually skip tasks that you get stuck on since you might not be completing the rest of the tasks. Tasks: Take a minute and read through all the tasks first. Map your own 'Big Picture' on how the system has to look like in the end. This includes the configuration of SELinux, Firewalld and systemctl. Note that your changes and configurations have to be persistent between reboots. If you can do the labs without too much of a hassle, you should be good to go. What you want to avoid however is ...

While I was practicing for RHCSA, I noticed, that for me, the automount part is the most difficult. For making this thing more memorable, I decided to write a short guide to what I did to get this working and share my knowledge. Maybe this will actually help someone understanding it :) I'll work with two nodes, nfssrv.archyslife.lan and nfsclnt.archyslife.lan. The names are kind of obvious what the servers will do. First, let's set up the server which will share it's files: [root@nfssrv ~]# yum -y install nfs-utils [root@nfssrv ~]# vim /etc/exports /storage 172.31.100.0/24 (rw,secure,sync,no_subtree_check) [root@nfssrv ~]# mkdir /storage [root@nfssrv ~]# systemctl enable nfs.service [root@nfssrv ~]# systemctl start nfs.service This set of commands will install the nfs-server software, configure your /storage directory to be shared using nfs to the network 172.31.100.0/24 and start the nfs-service on boot. Now the client-side: ...

Elasticsearch along with Logstash and Kibana is a great combination for aggregating and enriching log files, splitting them into different fields and visualizing them. For this setup, I will set up a 3 Node Cluster with every node operating every role. The recommended Setup would be separating master-eligible nodes and data nodes, as well as ingest nodes (depending on your workload).  Quick Note on the software components: Elasticsearch: Elasticsearch is a distributed search backend using the lucene engine for searching its shards and saved data. The Data indexed into this will be in the json-format. Logstash: Logstash takes your data, passes it through the grok filters you wrote, enriches them if you've configured to do so and indexes them into elasticsearch. Kibana: With Kibana you can control and manage your cluster as well as configure pipelines. Kibana will also give you a fancy frontend to search your data and build graphs. Since I'm only going to go...

There's a newer version covering EL8 I'll be using a plain CentOS 7 minimal install with the latest updates for this installation. First up, let's install the packages we need to make the Host a hypervisor: [archy@hyv01 ~]$ sudo yum install qemu-kvm libvirt libvirt-python libguestfs-tools virt-install tuned [archy@hyv01 ~]$ sudo systemctl enable libvirtd.service [archy@hyv01 ~]$ sudo systemctl start libvirtd.service [archy@hyv01 ~]$ sudo tuned-adm profile virtual-host NOTE: Tuned is optional but might squeeze out a little bit more performance and optimize the host for virtualization workloads. More info can be found by using 'man tuned-profiles'. Next, the network Configuratin. I'll use 4 Interfaces for the bond itself which will then again be a slave interface to the bridge which the VMs on this host will connect to. The Network Interfaces for the Bond will be: - ens2f0 - ens2f1 - ens2f2 - ens2f3 [archy@hyv01 ~]$ sudo nmcli connecti...

I recently went over my network configuration and noticed that the dhcp-leases were not pushed into the IPA-DNS yet. So I thought, why not do it now. The setup is very similar to setting it up on a single bind instance not managed by IPA (I've already written a guide about this here ). My setup is done with the following hosts: ipa01.archyslife.lan - 172.31.0.1 inf01.archyslife.lan - 172.31.0.5 First of all, create a rndc-key: [archy@ipa01 ~]$ sudo rndc-confgen -a -b 512 This will create the following file '/etc/rndc-key' [archy@ipa01 ~]$ sudo cat /etc/rndc.key key "rndc-key" { algorithm hmac-md5; secret "secret_key_here=="; }; We also need to make named aware of the rndc-key and allow our remote dhcp server to write dns entries: [archy@ipa01 ~]$ sudo vim /etc/named.conf ... include "/etc/rndc-key"; controls { inet 172.31.0.1 port 953 allow { 172.31.0.5; } keys ...

There are various ways to back up files in linux and most of them are possible through already onboard applications like rsync and tar. I will demonstrate how to backup files using both, tar and rsync with remote and local destination. I will also show how to restore files in case you need it. So let's begin with tar. Options and their meanings will be shown below. Create the archive using tar to a local directory: [archy@host ~]$ tar -cvpzf backup-homedir.tar.gz --exclude=backup-homedir.tar.gz ./* options: c - create a new archive v - verbose output p - preserve permissions z - compression with gzip f - the filename for the new archive Extracting the archive using tar from a local directory: [archy@host ~]$ tar -xvpzf backup-homedir.tar.gz -C /path/to/destination options: x - create new archive v - verbose output p - preserve permissions z - uncompress with gzip f - the filename of the archive If you just need to keep directories in sync. For archiving...

NGINX is a lightweight webserver with much more features than just being a webserver, but I'm just going to dig a bit deeper into the webserver functionality for now. As the title says, this is about redirecting traffic from http to https using nginx. I'll be hosting the site on the nginx directly. This is how a simple config for serving static html might look like: [archy@websrv ~]$ sudo cat /etc/nginx/sites-available/http_example.com.conf server { listen 80; server_name www.example.com; root /var/www/html; index index.html index.htm index.nginx-debian.html; location / { try_files $uri $uri/ = 404; } } If you want to redirect traffic from http to https, you'll have to do just minor changes to the config: [archy@websrv ~]$ sudo cat /etc/nginx/sites-available/http_example.com.conf server { listen 80; server_name ...

I recently had to set up LDAP-Authentication for Icinga2   Even though the Documentation on the user-setup is quite good, the Documentation about groups and ldap is missing some informations. So here is what I had to do, to get this working. In this environment I already had two IPA-Servers set up with replication. These will take care of LDAP and DNS for me. My Client is joined to the IPA-Domain. First, let's create a resouce for our ldap-connection, the parameters are pretty self explanatory. [archy@icinga2 ~]$ sudo vim /etc/icingaweb2/resources.ini ... [auth-ipa] type = "ldap" hostname = "ipasrv02.archyslife.lan" port = "636" root_dn = "dc=archyslife,dc=lan" bind_dn = "uid=icinga-bind,cn=users,cn=accounts,dc=archyslife,dc=lan" bind_pw = "some_secret_password" encryption = "ldaps" ... Next, let's take care of the user-authentication using our LDAP-Connection...

I recently decided to change my internal monitoring at home from nagios to Zabbix. The main reason was that I won't have to write config files with zabbix. I used a raspberry pi 3 running raspbian 9 which I had idling around and for homeuse this should be enough since I will only monitor around 4-5 devices using the agent. The shown steps should be the same on a updated debian9 system. Anyway, I'd suggest to push the database (in my case postgresql) to a separate HDD or anything else not on the sd-card since the db will have a lot of write-cycles which will tear the flash down very quickly. I checked the internet for some good HowTo's but even the documentation on the zabbix page was missing some information. So I decided to write down the steps it took me to get up and running with zabbix. First you'll have to install the zabbix-server-pgsql package and if you want the webfrontend, also install the zabbix-webfrontend-php package. [archy@zabbix ~]$ sudo apt-...

The apache webserver is currently (at the date of writing this (08/2018)) the most popular web server for serving content on the internet. The Functionality we'll look at in this article is called 'Virtual Hosts'. A virtual host is essential another domain running on the same server instance of apache. For this demonstration, I'm going to use a CentOS 7.5. First, update your system: [archy@websrv ~]$ sudo yum -y update Next install apache on the server: [archy@websrv ~]$ sudo yum -y install httpd By default, the webserver will not start on boot so we'll change that and start it for now: [archy@websrv ~]$ sudo systemctl enable httpd.service [archy@websrv ~]$ sudo systemctl start httpd.service By now your webserver is already serving the default-welcome page. This can be checked by curl or simply pointing your browser to the server's address. But since I don't have any firewall-rules set up yet, I'm going to use cur...

NFS does not encrypt the traffic in its nativ state. Encryption can be added by kerberizing the NFS-Server. I'll use the following setup: IPA-Server: - CentOS 7.5 - SELinux and firewalld enabled - Provides IPA-Services to NFS-Server and NFS-Client - IP-Address: 172.31.0.10/24 - Hostname: ipa-server.archyslife.lan NFS-Server: - CentOS 7.5 - SELinux and firewalld enabled - Joined to the IPA-Domain - Provides kerberized and normal NFS-Shares to the Client - IP-Address: 172.31.0.20/24 - Hostname: nfs-server.archyslife.lan NFS-Client: - CentOS 7.5 - SELinux and firewalld enabled - Joined to the IPA-Domain - Mounts the Shares from NFS-Server - IP-Address: 172.31.0.30/24 - Hostname: nfs-client.archyslife.lan I'm not going to go through the installation of the FreeIPA-Server since I've already covered this topic here: Installing a FreeIPA-Server Create the kerberos principals for the nfs-service on the ipa-server: [archy@ipa-server ~]$ ipa service-a...