ネットワーク設定他

# /etc/fstab
# Created by anaconda on Sat Nov 14 23:13:46 2020
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/cl-root / xfs defaults 0 0
UUID=c72f5956-86d1-4c0f-ad6e-2df2d4dbc925 /boot ext4 defaults 1 2
/dev/mapper/cl-swap swap swap defaults 0 0
/dev/vdb1 /u01 xfs defaults

timedatectl set-timezone Asia/Tokyo

nmcli d
nmcli c

nmcli general hostname firewall
nmcli c delete internet
nmcli c add type ethernet ifname enp1s0 con-name "internet" ethernet.mtu 1500
nmcli c mod internet ipv4.method auto
nmcli c mod internet connection.autoconnect yes
nmcli c up internet

VLAN=vlan_monitor
VLAN_IP=192.168.254.220/24
nmcli c delete $VLAN
nmcli c add type ethernet ifname enp2s0 con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c mod $VLAN ipv4.dns 8.8.8.8
nmcli c mod $VLAN ipv4.gateway 192.168.254.254
nmcli c up $VLAN

VLAN=vlan_global
VLAN_IP1=192.168.220.101/24
VLAN_IP2=192.168.220.102/24
VLAN_IP3=192.168.220.103/24

VLAN_IP4=192.168.220.104/24
nmcli c delete internet_global
nmcli c add type ethernet ifname enp3s0 con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP1
nmcli c mod $VLAN +ipv4.addresses $VLAN_IP2
nmcli c mod $VLAN +ipv4.addresses $VLAN_IP3

nmcli c mod $VLAN +ipv4.addresses $VLAN_IP4
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c up $VLAN

VLAN=vlan_api_front
VLAN_IP=192.168.10.2/24
nmcli c delete $VLAN
nmcli c add type ethernet ifname enp4s0 con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c up $VLAN

VLAN=vlan_web_front
VLAN_IP=192.168.20.2/24
nmcli c delete $VLAN
nmcli c add type ethernet ifname enp5s0 con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c up $VLAN

VLAN=vlan_dmz_front
VLAN_IP=192.168.30.2/24
nmcli c delete $VLAN
nmcli c add type ethernet ifname enp6s0 con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c up $VLAN

# systemctl restart NetworkManager
# ip addr show

Cisco PacketTracer インストール

 https://skillsforall.com/resources/lab-downloads

から、windows版をダウンロード。

ID／PW必要。

Rocky Linux 8.5 インストール

https://rockylinux.org/download
Rocky-8.5-x86_64-dvd1.iso

# timedatectl set-timezone Asia/Tokyo

# gpg --quiet --show-keys /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

# dnf update

# dnf repolist all

# dnf install gnome-tweaks

拡張機能 all on

# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

# dnf --enablerepo=epel install clamav clamav-scanner-systemd clamav-update

# vi /etc/yum.repos.d/google-chrome.repo

[google-chrome]

name=google-chrome

baseurl=http://dl.google.com/linux/chrome/rpm/stable/$basearch

enabled=1

gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub
# dnf update
# dnf install google-chrome-stable

# dnf install amdgpu-install-21.50.2.50002-1.el8.noarch.rpm

# dnf install sshpass

# dnf install xfreerdp

# dnf install setroubleshoot

・その他

【dbeaver】

# rpm -Uvh dbeaver-ce-22.0.2-stable.x86_64.rpm

【vscode】

#  rpm --import https://packages.microsoft.com/keys/microsoft.asc

# vi /etc/yum.repos.d/vscode.repo

[code]

name=Visual Studio Code

baseurl=https://packages.microsoft.com/yumrepos/vscode

enabled=1

gpgcheck=1

gpgkey=https://packages.microsoft.com/keys/microsoft.asc

# dnf install code

日本語化：拡張機能→Japanese Language Pack for Visual studio Code

【libreoffice】

下記からダウンロード

https://ja.libreoffice.org/download/download/?type=rpm-x86_64&version=7.3.2&lang=ja

LibreOffice_7.3.2_Linux_x86-64_rpm.tar.gz

LibreOffice_7.3.2_Linux_x86-64_rpm_helppack_ja.tar.gz

LibreOffice_7.3.2_Linux_x86-64_rpm_langpack_ja.tar.gz

# tar xvzf LibreOffice_7.3.2_Linux_x86-64_rpm.tar.gz

# tar xvzf LibreOffice_7.3.2_Linux_x86-64_rpm_helppack_ja.tar.gz

# tar xvzf LibreOffice_7.3.2_Linux_x86-64_rpm_langpack_ja.tar.gz

# cd LibreOffice_7.3.2.2_Linux_x86-64_rpm/RPMS

# dnf install *.rpm

# cd LibreOffice_7.3.2.2_Linux_x86-64_rpm_langpack_ja/RPMS

# dnf install *.rpm

# cd LibreOffice_7.3.2.2_Linux_x86-64_rpm_helppack_ja/RPMS

# dnf install *.rpm

【gimp/xsane】

# dnf install gimp xsane xsane-gimp

https://wasurenaiyounikaitoko.blogspot.com/search?q=gimp

【ntfs】

# dnf install  ntfs-3g ntfsprogs

【zoom】

https://zoom.us/download?os=linux

# dnf install zoom_x86_64.rpm

Home画面の右上の自アカウントをクリックし、[Help] -> [Switch Languages] -> [日本語]

【dnf】

# vi /etc/yum.conf

proxy=http://192.168.100.254:3128

【HTTP_PROXY】

# vi /etc/profile.d/sh.local

PROXY_URL="proxy.server.world:3128"

or

PROXY_URL=http://192.168.254.254:3128

export HTTP_PROXY=$PROXY_URL

export HTTPS_PROXY=$PROXY_URL

export FTP_PROXY=$PROXY_URL

export http_proxy=$PROXY_URL

export https_proxy=$PROXY_URL

export ftp_proxy=$PROXY_URL

【zabbix client】

https://wasurenaiyounikaitoko.blogspot.com/search?q=zabbix5

【Django/python】

※ RuntimeError: The 'apxs' command appears not to be installed or is not executable.

# dnf install httpd httpd-devel

# mkdir /var/www/wsgi

# firewall-cmd --add-service=http --zone=public --permanent

# firewall-cmd --reload

# vi /etc/httpd/conf.modules.d/20-wsgi.conf
LoadModule wsgi_module /var/www/wsgi/test/myenv/venv36-d324/lib/python3.6/site-packages/mod_wsgi/server/mod_wsgi-py36.cpython-36m-x86_64-linux-gnu.so

# vi /etc/httpd/conf.d/wsgi.conf

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300
WSGIApplicationGroup %{GLOBAL}
WSGISocketPrefix /var/run/wsgi
WSGIDaemonProcess test user=apache group=apache processes=1 threads=100 maximum-requests=10000 \
home=/var/www/wsgi/test \
python-home=/var/www/wsgi/test/myenv/venv36-d324 \
python-path=/var/www/wsgi/test/django:/var/www/wsgi/test/myenv/venv36-d324/lib/python3.6/site-packages \
lang=ja_JP.utf8
WSGIScriptAlias /test /var/www/wsgi/test/Config/wsgi.py process-group=test
Alias /assets/ /var/www/wsgi/test/assets/
Alias /media/ /var/www/wsgi/test/media/
WSGIPassAuthorization on
<Location /test>
WSGIProcessGroup test
</Location>

# vi /etc/httpd/conf/httpd.conf

ServerName websv1:80

※ configure: error: no acceptable C compiler found in $PATH

※ RuntimeError: Failed to build APR.

※ sh: make: コマンドが見つかりません

# dnf install gcc make

※ OSError: mysql_config not found

# dnf remove mysql*

# dnf remove Mariadb*

# curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash

# dnf  install MariaDB-client MariaDB-common MariaDB-devel MariaDB-shared

※ MySQLdb/_mysql.c:46:10: 致命的エラー: Python.h: そのようなファイルやディレクトリはありません

# dnf install python36-devel

※  Unable to find zbar shared library

# dnf install zbar

※ /var/www/wsgi/にpyton仮想環境構築

# mkdir /var/log/python

# chown  apache:apache /var/log/python

# httpd -t

# systemctl start httpd

# systemctl enable httpd

※mod_wsgi-py36.cpython-36m-x86_64-linux-gnu.so がロードできない。

     →setenforce 0 (暫定）

CentOS8 kvm 仮想macインストール

cd ~/KVMimage/macos

wget https://github.com/foxlet/macOS-Simple-KVM/archive/refs/heads/master.zip
unzip master.zip

python3 -m venv myenv

. ./myenv/bin/activate

 pip3 install --upgrade pip

./jumpstart.sh

# dnf -y install qemu-kvm qemu-img libvirt virt-install libvirt-client

# qemu-img create -f qcow2 mac_os.qcow2 64G

# vi basic.sh

  1 #!/bin/bash

  2 

  3 OSK="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"

  4 VMDIR=$PWD

  5 OVMF=$VMDIR/firmware

  6 #export QEMU_AUDIO_DRV=pa

  7 #QEMU_AUDIO_DRV=pa

  8 

  9 qemu-system-x86_64 \                           →/usr/libexec/qumu-kvm

 10   ¦ -enable-kvm \

 11   ¦ -m 2G \

 12   ¦ -machine q35,accel=kvm \

 13   ¦ -smp 4,cores=2 \

 14   ¦ -cpu Penryn,vendor=GenuineIntel,kvm=on,+sse3,+sse4.2,+aes,+xsave,+avx,+xsaveopt,+xsavec,+xgetbv1,+avx2,+bmi2,+smep,+bmi1,+fma,+movbe,+invtsc \

 15   ¦ -device isa-applesmc,osk="$OSK" \

 16   ¦ -smbios type=2 \

 17   ¦ -drive if=pflash,format=raw,readonly,file="$OVMF/OVMF_CODE.fd" \

 18   ¦ -drive if=pflash,format=raw,file="$OVMF/OVMF_VARS-1024x768.fd" \

 19   ¦ -vga qxl \

 20   ¦ -device ich9-intel-hda -device hda-output \

 21   ¦ -usb -device usb-kbd -device usb-mouse \

 22   ¦ -netdev user,id=net0 \

 23   ¦ -device e1000-82545em,netdev=net0,id=net0,mac=52:54:00:c9:18:27 \

 24   ¦ -device ich9-ahci,id=sata \

 25   ¦ -drive id=ESP,if=none,format=qcow2,file=ESP.qcow2 \

 26   ¦ -device ide-hd,bus=sata.2,drive=ESP \

 27   ¦ -drive id=InstallMedia,format=raw,if=none,file=BaseSystem.img \

 28   ¦ -device ide-hd,bus=sata.3,drive=InstallMedia \

 29   ¦ -drive id=SystemDisk,if=none,file=mac_os.qcow2

 30   ¦ -device ide-hd,bus=sata.4,drive=SystemDisk

【参考】

https://github.com/foxlet/macOS-Simple-KVM

https://chirashi.twittospia.com/%E6%8A%80%E8%A1%93/ubuntulinux%E3%81%AE%E4%BB%AE%E6%83%B3%E3%83%9E%E3%82%B7%E3%83%B3%E3%81%ABmacos%E3%82%92%E3%82%A4%E3%83%B3%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AB%E3%81%99%E3%82%8B%E6%96%B9%E6%B3%95/2021-04-20/

selinux インストール

#-------------------------------------------------------------------------------------------------------

sudo dnf install policycoreutils-gui

sudo system-config-selinux

sudo dnf install setroubleshoot

sudo dnf install setroubleshoot-server setroubleshoot-plugins

#------------------------------------------------------------------------------------------------------

# dnf install libselinux.x86_64 libselinux-devel.x86_64 libselinux-utils.x86_64 python3-libselinux.x86_64
# dnf install policycoreutils policycoreutils-gui libselinux-utils setools-console checkpolicy
# dnf install policycoreutils-python-utils selinux-policy-*

# dnf install setroubleshoot

# sestatus

SELinux status:                 enabled

SELinuxfs mount:                /sys/fs/selinux

SELinux root directory:         /etc/selinux

Loaded policy name:             targeted

Current mode:                   permissive

Mode from config file:          disabled

Policy MLS status:              enabled

Policy deny_unknown status:     allowed

Memory protection checking:     actual (secure)

Max kernel policy version:      33

# vi /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these three values:

#     targeted - Targeted processes are protected,

#     minimum - Modification of targeted policy. Only selected processes are protected.

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted
# vi /var/log/audit/audit.log
# audit2allow -w -a

# seinfo

# sesearch --allow 

# sesearch --neverallow

# sesearch --auditallow

# sesearch --dontaudit

# getsebool -a

# semanage export

# grep denied /var/log/audit/audit.log | tail -10 | audit2allow

# tail -f /var/log/httpd/error_log

# semodule -DB                              #  dontauditルール無効

# semodule -B                                 # dontauditルール有効

# tail -f /var/log/audit/audit.log | grep denied

# find / -inum 17350933 # inodeからファイル名

#  chcon -t httpd_sys_script_exec_t /var/www/html/hello.sh      # ラベル付与

# semanage fcontext -l | grep httpd_sys_script_exec_t

・httpd_sys_content_t : 読み取りのみ
・httpd_sys_script_exec_t : 実行可能
・httpd_sys_rw_content_t : 読み書き可能

# semanage fcontext -l | grep /var/www/

# ps -efZ | grep httpd

# ls  -lZ

# ls  -ldZ

#  sealert -l "*"

# matchpathcon /var/www/html /var/test_www/html

# semanage fcontext -a -e /var/www /var/test_www

# restorecon -Rv /var/

【エラー発生】

#  semodule -X 300 -i my-zabbixserver.pp

Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/300/my-04iscsi/cil:2

semodule:  Failed!

# bzip2 -d  /var/lib/selinux/targeted/tmp/modules/300/my-04iscsi/cil

# cat cil.out

(typeattributeset cil_gen_require systemd_systemctl_exec_t)

(typeattributeset cil_gen_require NetworkManager_dispatcher_t)

(typeattributeset cil_gen_require passwd_file_t)

(allow NetworkManager_dispatcher_t passwd_file_t (file (getattr open read)))

(allow NetworkManager_dispatcher_t systemd_systemctl_exec_t (file (execute_no_trans)))

(allow NetworkManager_dispatcher_t systemd_systemctl_exec_t (file (execute getattr open read)))

# seinfo -t|grep  NetworkManager_dispatcher_t

無い！！

【参考】

すごく読み易い。感謝です。

https://www.tohoho-web.com/ex/selinux.html

firewall-cmd

# dnf install firewalld
# systemctl start firewalld
# systemctl enable firewalld
# systemctl status firewalld
# firewall-cmd --add-service=http --zone=public --permanent
# firewall-cmd --add-port=10050/tcp --zone=public --permanent
# firewall-cmd --add-port=10051/tcp --zone=public --permanent
# firewall-cmd --reload

# firewall-cmd --list-all

# firewall-cmd --version

0.9.3

curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

相手のサーバがDH Key 1024しかさポーﾄしていない。
（openssl デフォルトは2048)

# update-crypto-policies --set LEGACY
# curl -I https://service.xxxxxx.co.jp/ArcwService/Default.aspx
あくまでも自己責任で！！


# update-crypto-policies --set DEFAULT
# update-crypto-policies --show

# cd /usr/share/crypto-policies/policies/modules

# ls -l

合計 20

-rw-r--r--. 1 root root  318 11月 16 22:46 AD-SUPPORT.pmod

-rw-r--r--. 1 root root  121 11月 16 22:46 ECDHE-ONLY.pmod

-rw-r--r--. 1 root root   90 11月 16 22:46 NO-CAMELLIA.pmod

-rw-r--r--. 1 root root  123 11月 16 22:46 NO-SHA1.pmod

-rw-r--r--. 1 root root 1986 11月 16 22:46 OSPP.pmod