forked from server/user-documentation
Merge branch 'main' into dnsmasq-root
This commit is contained in:
commit
2f360f7221
10 changed files with 454 additions and 454 deletions
|
|
@ -35,9 +35,9 @@ sssd-nfs-idmap::
|
|||
SSSD plug-in provides a way for rpc.idmapd to call SSSD to map UIDs/GIDs to names and vice versa. It can be also used for mapping principal (user) name to IDs(UID or GID) or to obtain groups which user are member of.
|
||||
|
||||
Ensure that these packages are really installed.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ rpm -qa | grep nfs
|
||||
$ rpm -qa | grep nfs
|
||||
libnfsidmap-2.8.4-0.fc43
|
||||
sssd-nfs-idmap-2.11.1-4.fc43
|
||||
nfs-utils-2.8.4-0.fc43
|
||||
|
|
@ -60,9 +60,9 @@ In this guide we will demontrate the latter and create a thin provisioned LV for
|
|||
|
||||
1. *Create a nfs export directory in /srv*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo mkdir /srv/nfs
|
||||
$ sudo mkdir /srv/nfs
|
||||
----
|
||||
+
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
|
|
@ -71,9 +71,9 @@ The created directory is by default readable for everyone, but not writable.
|
|||
+
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
|
||||
$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
|
||||
----
|
||||
|
||||
3. *Create and mount the required Logical Volumes*
|
||||
|
|
@ -98,13 +98,13 @@ Again, fill in the form and you are done.
|
|||
+
|
||||
For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
|
||||
[…]# lvs
|
||||
[…]# mkfs.xfs /dev/fedora/nfs
|
||||
[…]# mkdir -p /srv/nfs
|
||||
[…]# vim /etc/fstab
|
||||
# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
|
||||
# lvs
|
||||
# mkfs.xfs /dev/fedora/nfs
|
||||
# mkdir -p /srv/nfs
|
||||
# vim /etc/fstab
|
||||
...
|
||||
/dev/mapper/fedora-root / xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
|
|
@ -113,27 +113,27 @@ For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
|||
+
|
||||
Finallly mount the created filesystem.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount -a
|
||||
# mount -a
|
||||
----
|
||||
|
||||
4. *Create and configure the directories to share*
|
||||
+
|
||||
In a typical use case you may create a directory 'common' to widely share data and a directory 'project', in which a team member shares data located in the home directory with the team.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo mkdir -p /srv/nfs/{common,project}
|
||||
[…]# sudo chown -R nfs.nfs /srv/nfs/*
|
||||
[…]# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
# sudo mkdir -p /srv/nfs/{common,project}
|
||||
# sudo chown -R nfs.nfs /srv/nfs/*
|
||||
# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
----
|
||||
+
|
||||
To make the bind mount(s) permanent, add the following entries to the /etc/fstab file:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vi /etc/fstab
|
||||
# vi /etc/fstab
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
|
@ -150,9 +150,9 @@ The commented out lines describe the default built in configuration.
|
|||
|
||||
1. Configure the NFS basic directory
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/nfs.conf
|
||||
$ sudo vi /etc/nfs.conf
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
|
@ -162,18 +162,18 @@ The commented out lines describe the default built in configuration.
|
|||
+
|
||||
NFS uses port 2049 which is blocked in a Fedora standard installation by defaut.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --add-service=nfs
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --permanent --add-service=nfs
|
||||
# firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. *Start NFS enabling autostart at boot time*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl status nfs-server
|
||||
# systemctl enable nfs-server --now
|
||||
# systemctl status nfs-server
|
||||
----
|
||||
+
|
||||
This starts the NFS server only, but not the NFS client. Therefore, the server can not mount file ressources provided by another server. If required, additionally execute at first _`systemctl enable nfs-client.target --now`_. For additional details you may look at _`man 7 nfs.systemd`_.
|
||||
|
|
@ -182,9 +182,9 @@ This starts the NFS server only, but not the NFS client. Therefore, the server c
|
|||
+
|
||||
Fedora enables versions 3 and 4.x, version 2 is disabled. The latter is pretty old now. Every machine should provide at least version 3.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cat /proc/fs/nfsd/versions
|
||||
# cat /proc/fs/nfsd/versions
|
||||
-2 +3 +4 +4.1 +4.2
|
||||
----
|
||||
+
|
||||
|
|
@ -231,9 +231,9 @@ You can use both options in parallel with the grand configuration file read in f
|
|||
Example ::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -242,9 +242,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 2::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -252,9 +252,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 3::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -262,9 +262,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 4::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -272,9 +272,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 6::
|
||||
Export the directory /srv/nfs/projects with all users of a specific network device with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/projects.exports
|
||||
$ sudo vi /etc/exports.d/projects.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -348,7 +348,7 @@ An NFSv4 client now has the ability to see all of the exports served by the NFSv
|
|||
|
||||
For example, the following commands could be executed on an NFSv4 server:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
|
|
@ -364,7 +364,7 @@ In this example, clients are provided with multiple file systems to mount, by us
|
|||
|
||||
Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export configurations are not always compatible. For example, given the following directory tree:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/home
|
||||
/home/sam
|
||||
|
|
@ -374,14 +374,14 @@ Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export config
|
|||
|
||||
and the export:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/home *(rw,fsid=0,sync)
|
||||
----
|
||||
|
||||
Using NFS version 2,3 and 4 the following would work:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mount server:/home /mnt/home
|
||||
ls /mnt/home/joe
|
||||
|
|
@ -389,7 +389,7 @@ ls /mnt/home/joe
|
|||
|
||||
Using v4 the following would work:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mount -t nfs4 server:/ /mnt/home
|
||||
ls /mnt/home/joe
|
||||
|
|
@ -397,7 +397,7 @@ ls /mnt/home/joe
|
|||
|
||||
The difference being "server:/home" and "server:/". To make the exports configurations compatible for all version, one needs to export (read only) the root filesystem with an fsid=0. The fsid=0 signals the NFS server that this export is the root.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/ *(ro,fsid=0)
|
||||
/home *(rw,sync,nohide)
|
||||
|
|
@ -409,30 +409,30 @@ Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs se
|
|||
== Testing the configuration
|
||||
|
||||
On client side:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# showmount -e 192.168.12.200
|
||||
# showmount -e 192.168.12.200
|
||||
----
|
||||
|
||||
On client side, try to mount an exported subdirectory:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
|
||||
# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
|
||||
----
|
||||
|
||||
Display the active mounts
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount | grep nfs
|
||||
# mount | grep nfs
|
||||
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
|
||||
nfsd on /proc/fs/nfsd type nfsd (rw,relatime)
|
||||
192.168.12.5:/nfsfileshare on /mnt/nfsfileshare type nfs4 (rw,relatime,vers=4.1,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.12.7,local_lock=none,addr=192.168.12.5)
|
||||
----
|
||||
|
||||
Check if the NFS mount is writable
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# touch /mnt/nfsfileshare/test
|
||||
# touch /mnt/nfsfileshare/test
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -64,21 +64,21 @@ The easiest way is to create the required volumes with __Cockpit__, the web-base
|
|||
|
||||
1. Install the Apache httpd web server. Today, you will almost always need the modules for managing SSL connections and the module for domain monitoring. Everything now runs via https.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo dnf install httpd mod_ssl mod_md
|
||||
[…]$ sudo firewall-cmd --add-service=https --permanent
|
||||
[…]$ sudo firewall-cmd --add-service=http --permanent
|
||||
[…]$ sudo firewall-cmd --reload
|
||||
$ sudo dnf install httpd mod_ssl mod_md
|
||||
$ sudo firewall-cmd --add-service=https --permanent
|
||||
$ sudo firewall-cmd --add-service=http --permanent
|
||||
$ sudo firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. Start the web server
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo systemctl start httpd
|
||||
[…]$ sudo systemctl status httpd
|
||||
[…]$ sudo systemctl enable httpd
|
||||
$ sudo systemctl start httpd
|
||||
$ sudo systemctl status httpd
|
||||
$ sudo systemctl enable httpd
|
||||
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
|
||||
----
|
||||
|
||||
|
|
@ -88,9 +88,9 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
|
|||
|
||||
4. If you plan to manage Let's Encrypt certificates using certbot install
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo dnf install letsencrypt
|
||||
$ sudo dnf install letsencrypt
|
||||
----
|
||||
|
||||
== Setup a web site
|
||||
|
|
@ -99,28 +99,28 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
|
|||
+
|
||||
As discussed above there are several options. In this example we use the /srv alternative and the website base name as base directory.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo -i
|
||||
[…]# mkdir -p /srv/SITENAME/htdocs
|
||||
$ sudo -i
|
||||
# mkdir -p /srv/SITENAME/htdocs
|
||||
----
|
||||
+
|
||||
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITENAME/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
|
||||
+
|
||||
With /srv/ as the base directory you must adjust the SELinux labels.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
|
||||
[…]# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
|
||||
# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
|
||||
# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
|
||||
Relabeled /srv/SITENAME/htdocs from unconfined_u:object_r:var_t:s0 to system_u:object_r:httpd_sys_content_t:s0
|
||||
----
|
||||
+
|
||||
Create a very basic index page in your document root directory
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /srv/SITENAME/htdocs/index.html
|
||||
# vim /srv/SITENAME/htdocs/index.html
|
||||
<h1><center>It works!</center></h1>
|
||||
----
|
||||
|
||||
|
|
@ -139,9 +139,9 @@ A website using the same name as the server's hostname or its DNS entry, require
|
|||
+
|
||||
Edit the copied template file and adjust it as appropriate.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
|
||||
$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
|
||||
# Apache vhost configuration for a static html server.
|
||||
# It manages SSL connections including certificates.
|
||||
# Initially, a self-signed certificate is active.
|
||||
|
|
@ -341,8 +341,8 @@ Edit the copied template file and adjust it as appropriate.
|
|||
+
|
||||
[source,text]
|
||||
----
|
||||
[…]# systemctl restart httpd
|
||||
[…]# systemctl status httpd
|
||||
# systemctl restart httpd
|
||||
# systemctl status httpd
|
||||
● httpd.service - The Apache HTTP Server
|
||||
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)
|
||||
Active: active (running) since ...
|
||||
|
|
@ -385,8 +385,8 @@ Unfortunately, the only way to fix this is to modify the distribution provided m
|
|||
|
||||
[source,text]
|
||||
----
|
||||
[…]# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
|
||||
[…]# vi /etc/httpd/conf.d/ssl.conf
|
||||
# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
|
||||
# vi /etc/httpd/conf.d/ssl.conf
|
||||
#
|
||||
# When we also provide SSL we have to listen to the
|
||||
# standard HTTPS port in addition.
|
||||
|
|
@ -434,7 +434,7 @@ CustomLog logs/ssl_request_log \
|
|||
|
||||
#### </VirtualHost> #<======= comment out this line (last line, usually 218)
|
||||
|
||||
[…]# systemctl restart httpd
|
||||
# systemctl restart httpd
|
||||
----
|
||||
|
||||
When the httpd service is up again, everything should work as expected.
|
||||
|
|
|
|||
|
|
@ -24,21 +24,21 @@ A convenient descriptive name for both the logical volume and the file system is
|
|||
In any case, the system administrator must adapt the following command sequence according to the local requirements! With a Linux LVM and Software raid, XFS can autonomously determine its optimal configuration values. With some hardware raids, intervention by the administrator can also be useful for this.
|
||||
|
||||
First, check for the VG name and then adjust the following commands.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vgs
|
||||
# vgs
|
||||
VG #PV #LV #SN Attr VSize VFree
|
||||
systemVG 1 1 0 wz--n- 7.55g <4.42g
|
||||
[…]# lvcreate -L 50G -n pgsql systemVG
|
||||
# lvcreate -L 50G -n pgsql systemVG
|
||||
Logical volume "pgsql" created.
|
||||
[…]# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
|
||||
# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
|
||||
meta-data=/dev/mapper/systemVG-pgsql isize=512 agcount=4, agsize=655360 blks
|
||||
...
|
||||
Discarding blocks...Done.
|
||||
[…]# mkdir /var/lib/pgsql
|
||||
[…]# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
|
||||
[…]# mount -a
|
||||
[…]# df -h
|
||||
# mkdir /var/lib/pgsql
|
||||
# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
|
||||
# mount -a
|
||||
# df -h
|
||||
----
|
||||
|
||||
== 2. Basic installation
|
||||
|
|
@ -46,9 +46,9 @@ First, check for the VG name and then adjust the following commands.
|
|||
Just one package - postgresql-server - already provides a complete and comprehensive server at your disposal. All the many other Postgresql related packages provide additional options that are only useful or needed for specific special needs.
|
||||
|
||||
The package provides the pure server functionality. Fedora additionally loads the packages _postgresql_, a CLI client program granting interactive access to the server, and __postgresql-private-libs__, containing shared libraries used by each of those packages, as dependencies.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install postgresql-server
|
||||
# dnf install postgresql-server
|
||||
...
|
||||
==============================================================================
|
||||
Package Architectur Version
|
||||
|
|
@ -65,9 +65,9 @@ The package provides the pure server functionality. Fedora additionally loads th
|
|||
----
|
||||
|
||||
The installer should have adjusted all SELinux labels in the pgsql directory already created. Check:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ls -alZ /var/lib/pgsql/
|
||||
# ls -alZ /var/lib/pgsql/
|
||||
drwx------. 4 postgres postgres system_u:object_r:postgresql_db_t:s0 54 ... .
|
||||
drwxr-xr-x. 45 root root system_u:object_r:var_lib_t:s0 4096 ... ..
|
||||
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... backups
|
||||
|
|
@ -75,23 +75,23 @@ The installer should have adjusted all SELinux labels in the pgsql directory alr
|
|||
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... data
|
||||
----
|
||||
If the installation program missed something, fix it executing
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# restorecon -vFr /var/lib/pgsql
|
||||
[…]# ls -alZ /var/lib/pgsql/
|
||||
# restorecon -vFr /var/lib/pgsql
|
||||
# ls -alZ /var/lib/pgsql/
|
||||
----
|
||||
|
||||
It is also a prerequisite that exclusively the user postgres has access to the directory pgsql and its subdirectories. Usually the installer takes care of it. Fix it if necessary.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# chown -R postgres:postgres /var/lib/pgsql
|
||||
[…]# chmod -R 700 /var/lib/pgsql
|
||||
# chown -R postgres:postgres /var/lib/pgsql
|
||||
# chmod -R 700 /var/lib/pgsql
|
||||
----
|
||||
|
||||
When all the requirements are met, perform the initialization of the database cluster. This is a prerequisite for all further activities.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# postgresql-setup --initdb
|
||||
# postgresql-setup --initdb
|
||||
----
|
||||
|
||||
== 3. Configuration and initialization
|
||||
|
|
@ -105,8 +105,8 @@ A client can connect to the server either by a Unix socket connection or a TCP/I
|
|||
If the client does not specify a hostname parameter (-h), a Unix socket connection is established. Postgres uses this method to ensure that root can always securely establish a connection, regardless of password loss, for example. The root user always has permission to assume the identity of the postgresql master user (su - postgres). By default, no other user has this option. As root, you get in any circumstances administrative access to the database.
|
||||
[source]
|
||||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
# su - postgres
|
||||
$ psql
|
||||
----
|
||||
|
||||
Specifying the host parameter results in an attempt to establish a TCP/IP connection. Postgresql uses port 5432 by default for this purpose. In Fedora, all interfaces are protected by a firewall by default, except for localhost. A connection therefore requires opening a suitable port.
|
||||
|
|
@ -114,8 +114,8 @@ Specifying the host parameter results in an attempt to establish a TCP/IP connec
|
|||
Fedora abstracts the technical details with Firewalld, so that the administrator does not need to bother with details. For most common uses there are predefined services. So, if you want the database to be accessible via the internal interface assigned to the internal zone, for example, you need just two simple instructions.
|
||||
[source]
|
||||
----
|
||||
[…]$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
|
||||
[…]$ sudo firewall-cmd --reload
|
||||
$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
|
||||
$ sudo firewall-cmd --reload
|
||||
----
|
||||
|
||||
[TIP]
|
||||
|
|
@ -130,9 +130,9 @@ In case of connection issues there is most probably a SELinux configuration miss
|
|||
For admin access Fedora postgresql is configured to obtain the host's operating system user name from the kernel and using it as the allowed database user name. Therefore, as soon as someone can authentiate on the host as user __postgres__, that person has administrative privileges on the postgresql server without any additional password prompt. The only one who can do that by default, is root. Root can configure additional users to be able to su to postgres. In any case, in a whatever emergency, if any then the system administrator is able to quickly access postgresql server unhindered and salvage what can still get salvaged.
|
||||
|
||||
This capability is configured in the ~/data/pg_hba file, together with other properties.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
...
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
|
|
@ -151,9 +151,9 @@ If local regulations make it necessary to replace these procedures with a dedica
|
|||
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking an ident server, that Fedora doesn't install). In most cases you need an authentication based on a password. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
|
||||
|
||||
The configuration is done in the file `pg_hba.conf` in the `data` subdirectory. Edit the file to match the pattern below.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
...
|
||||
|
|
@ -185,9 +185,9 @@ Some of the possible authentication methods require additional settings for SELi
|
|||
Now you are allowed to authenticate from machines on the internal network, but you still can't connect from the internal network to the PostgreSQL server. The default configuration restricts connection initially to the local host to avoid any security vulnerabilities in the first place.
|
||||
|
||||
Connections granted are configured in ~/data/postgresql.conf. To grant access to VMs on the internal network as well as from local host, edit the file near the beginning to match the pattern below.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/postgresql.conf
|
||||
# vim /var/lib/pgsql/data/postgresql.conf
|
||||
...
|
||||
#------------------------------------------------------------------------------
|
||||
# CONNECTIONS AND AUTHENTICATION
|
||||
|
|
@ -210,19 +210,19 @@ An entry of `listen_addresses = '*'` enables connections from any address. It is
|
|||
== 4. Using PostgreSQL as permanent service
|
||||
|
||||
You are now ready to start the PostgreSQL server.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl start postgresql
|
||||
[…]# systemctl status postgresql
|
||||
# systemctl start postgresql
|
||||
# systemctl status postgresql
|
||||
...
|
||||
... systemd[1]: Started postgresql.service - PostgreSQL database server.
|
||||
----
|
||||
|
||||
If no errors are reported, try to connect as user postgres using the psql cli client. Once connected, start commands with backslash, e.g. \? to get help or \q to quit.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
# su - postgres
|
||||
$ psql
|
||||
psql (18.0)
|
||||
Enter »help« ...
|
||||
|
||||
|
|
@ -233,14 +233,14 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
|
|||
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
|
||||
|
||||
postgres-# \q
|
||||
[…]$ exit
|
||||
[…]#
|
||||
$ exit
|
||||
#
|
||||
----
|
||||
|
||||
If everything works as expected, enable autostart of postgresql,
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl enable postgresql
|
||||
# systemctl enable postgresql
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ Qemu-kvm in combination with Libvirt management toolkit is the standard virtuali
|
|||
QEMU / KVM require hardware virtualization support. The first thing to do is to make sure that it is available.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# grep -E --color 'vmx|svm' /proc/cpuinfo
|
||||
# grep -E --color 'vmx|svm' /proc/cpuinfo
|
||||
----
|
||||
The command will return one line per cpu core if virtualization is enabled. If not, you should first check in the BIOS whether virtualization is disabled.
|
||||
|
||||
|
|
@ -58,21 +58,21 @@ After completion, the file system is immediately available and is also permanent
|
|||
==== Command line
|
||||
|
||||
Some administrators may prefer the command line for easy scripting. Create a Logical Volume of appropriate size, 50 GiB in this esample, either in the system Volume Group (named fedora by default) or in the user data VG if created during installation. Adjust size and VG name as required.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lvcreate -L 50G -n libvirt fedora
|
||||
[…]# mkfs.xfs /dev/fedora/libvirt
|
||||
[…]# mkdir -p /var/lib/libvirt
|
||||
[…]# echo "UUID=$(blkid -s UUID -o value /dev/mapper/fedora-libvirt) /var/lib/libvirt xfs defaults 0 0" >> /etc/fstab
|
||||
# lvcreate -L 50G -n libvirt fedora
|
||||
# mkfs.xfs /dev/fedora/libvirt
|
||||
# mkdir -p /var/lib/libvirt
|
||||
# echo "UUID=$(blkid -s UUID -o value /dev/mapper/fedora-libvirt) /var/lib/libvirt xfs defaults 0 0" >> /etc/fstab
|
||||
----
|
||||
|
||||
|
||||
== Installing libvirt virtualization software
|
||||
|
||||
Installing the software is quite simple.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install qemu-kvm-core libvirt virt-install cockpit-machines guestfs-tools
|
||||
# dnf install qemu-kvm-core libvirt virt-install cockpit-machines guestfs-tools
|
||||
----
|
||||
Be sure to install `guestfs-tools`, not `libguestfs-tools` (unless you need additional windows guest related software). The package `guestfs-tools` provides a basic set of various useful tools to maintain virtual disks. Additional packages provide support for specific use cases, e.g. various file systems or forensic support. Use `dnf search guestfs` to get a list of available packages.
|
||||
|
||||
|
|
@ -81,13 +81,13 @@ Do not install the group `@virtualization` onto a Fedora Server. It includes var
|
|||
Next check the SELinux labels
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ls -alZ /var/lib/libvirt
|
||||
# ls -alZ /var/lib/libvirt
|
||||
----
|
||||
|
||||
Usually, installation sets the SELinux labels properly. Otherwise, set them manually.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# restorecon -R -vF /var/lib/libvirt
|
||||
# restorecon -R -vF /var/lib/libvirt
|
||||
----
|
||||
If everything is correct, the next step is to activate autostart after re-boot and start KVM and libvirtd.
|
||||
|
||||
|
|
@ -98,14 +98,14 @@ With Fedora 35 libvirt switched to a _modular archtecture_ (since version 7.6.0-
|
|||
Enable automatic startup at boot and start libvirt.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# systemctl enable libvirtd --now
|
||||
# systemctl enable libvirtd --now
|
||||
----
|
||||
|
||||
By default, libvirt creates a (virtual) bridge with an interface virbr0, the IP 192.168.122.1 and the libvirt-internal name as default. In addition, a separate firewall zone libvirt is set up and assigned to the internal interface. Check if everything is running as expected.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ip a
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# ip a
|
||||
# firewall-cmd --get-active-zones
|
||||
----
|
||||
|
||||
=== Activation and startup with Fedora 35 and up
|
||||
|
|
@ -120,21 +120,21 @@ if you are planning to use the virtual network independently from starting virtu
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# systemctl enable virtnetworkd.service --now
|
||||
# systemctl enable virtnetworkd.service --now
|
||||
----
|
||||
+
|
||||
Alternatively, you may want to completely discard libvirt's internal network. You'll take this path if you set up an internal network with NetworkManager tools.
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# systemctl disable virtnetworkd.socket --now
|
||||
# systemctl disable virtnetworkd.socket --now
|
||||
----
|
||||
|
||||
2. **Activate (start) the required libvirt modular drivers**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# for drv in qemu interface network nodedev nwfilter secret storage ; \
|
||||
# for drv in qemu interface network nodedev nwfilter secret storage ; \
|
||||
do systemctl start virt${drv}d{,-ro,-admin}.socket ; done
|
||||
----
|
||||
+
|
||||
|
|
@ -146,9 +146,9 @@ The boot process now starts virtualization automatically without administrative
|
|||
|
||||
3. *Check successful start via a status query*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# for drv in qemu interface network nodedev nwfilter secret storage ; \
|
||||
# for drv in qemu interface network nodedev nwfilter secret storage ; \
|
||||
do systemctl status virt${drv}d{,-ro,-admin}.socket ; done
|
||||
● virtqemud.socket - libvirt QEMU daemon socket
|
||||
Loaded: loaded (/usr/lib/systemd/system/virtqemud.socket; enabled; preset: enabled)
|
||||
|
|
@ -189,7 +189,7 @@ The first step is to choose a domain name. A top-level ".local" is explicitly no
|
|||
Use the libvirt tool to adjust the default network. Replace names and placeholders as required. Delete the line with "forward mode = 'nat'" if you do not want to allow access to the public network via the virtual network.
|
||||
[source,xml]
|
||||
----
|
||||
[…]# virsh net-edit default
|
||||
# virsh net-edit default
|
||||
<network>
|
||||
<name>default</name>
|
||||
<uuid>aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee</uuid>
|
||||
|
|
@ -216,15 +216,15 @@ Use the libvirt tool to adjust the default network. Replace names and placeholde
|
|||
Activate the modified configuration.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# virsh net-destroy default
|
||||
[…]# virsh net-start default
|
||||
# virsh net-destroy default
|
||||
# virsh net-start default
|
||||
----
|
||||
|
||||
Check if the DNS resolution works.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# nslookup host 192.168.122.1
|
||||
[…]# dig @192.168.122.1 host.example.com
|
||||
# nslookup host 192.168.122.1
|
||||
# dig @192.168.122.1 host.example.com
|
||||
----
|
||||
|
||||
== Adjusting the hosts DNS resolution configuration
|
||||
|
|
@ -238,10 +238,10 @@ The following procedure doesn't work for Fedora 35-39. Don't use it with these r
|
|||
|
||||
1. The name resolver service _systemd-resolved_ introduced with Fedora 33 can do this automatically. But libvirt handles its interfaces on its own and must therefore inform systemd-resolved about it. A script in a hook provided by libvirt can take care of this. You have to adjust the local domain name (${example.lan} in the script below) accordingly!
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mkdir -p /etc/libvirt/hooks/network.d/
|
||||
[…]# vim /etc/libvirt/hooks/network.d/40-config-resolved.sh
|
||||
# mkdir -p /etc/libvirt/hooks/network.d/
|
||||
# vim /etc/libvirt/hooks/network.d/40-config-resolved.sh
|
||||
#>--INSERT--<#
|
||||
#!/bin/bash
|
||||
# Add the internal libvirt interface virbr0 to the
|
||||
|
|
@ -286,7 +286,7 @@ if [ "$network" == "default" ]; then
|
|||
fi
|
||||
#>--SAVE&QUIT--<#
|
||||
|
||||
[…]# chmod +x /etc/libvirt/hooks/network.d/40-config-resolved.sh
|
||||
# chmod +x /etc/libvirt/hooks/network.d/40-config-resolved.sh
|
||||
----
|
||||
|
||||
2. Check if /etc/resolv.conf is a link and not a file.
|
||||
|
|
@ -294,24 +294,24 @@ Activate modified local DNS resolving
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ls -al /etc/resolv.conf
|
||||
# ls -al /etc/resolv.conf
|
||||
----
|
||||
+
|
||||
In case it is a file, fix it:
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# cd /etc
|
||||
[…]# rm -f resolv.con
|
||||
[…]# systemctl restart systemd-resolved
|
||||
[…]# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
|
||||
# cd /etc
|
||||
# rm -f resolv.con
|
||||
# systemctl restart systemd-resolved
|
||||
# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
|
||||
----
|
||||
|
||||
3. Test the hook file
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
|
||||
# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
|
||||
P1: default - P2: started - P3: begin @ Mon Mar ...
|
||||
----
|
||||
|
||||
|
|
@ -319,17 +319,17 @@ In case it is a file, fix it:
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
|
||||
# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
|
||||
P1: default - P2: started - P3: begin @ Mon Mar ...
|
||||
----
|
||||
|
||||
5. Check the functionality of name resolution with internal and external addresses.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ping host
|
||||
[…]# ping host.example.lan
|
||||
[…]# ping host.example.com
|
||||
[…]# ping guardian.co.uk
|
||||
# ping host
|
||||
# ping host.example.lan
|
||||
# ping host.example.com
|
||||
# ping guardian.co.uk
|
||||
----
|
||||
+
|
||||
Everything should work fine now.
|
||||
|
|
@ -342,7 +342,7 @@ Activate dnsmasq plugin
|
|||
|
||||
[source,bash]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
# /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
#
|
||||
# This enabled the dnsmasq plugin.
|
||||
|
|
@ -354,7 +354,7 @@ Define the local domain and DNS service
|
|||
|
||||
[source,bash]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
|
||||
# vim /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
|
||||
# /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
|
||||
#
|
||||
# This file directs dnsmasq to forward any request to resolve
|
||||
|
|
@ -367,12 +367,12 @@ Activate modified local DNS resolving
|
|||
|
||||
[source,bash]
|
||||
----
|
||||
[…]# systemctl stop systemd-resolved
|
||||
[…]# systemctl disable systemd-resolved
|
||||
[…]# rm /etc/resolv.conf
|
||||
[…]# nmcli con mod enp3s0 ipv4.dns-search 'example.lan'
|
||||
[…]# nmcli con mod enp3s0 ipv6.dns-search 'example.lan'
|
||||
[…]# systemctl restart NetworkManager
|
||||
# systemctl stop systemd-resolved
|
||||
# systemctl disable systemd-resolved
|
||||
# rm /etc/resolv.conf
|
||||
# nmcli con mod enp3s0 ipv4.dns-search 'example.lan'
|
||||
# nmcli con mod enp3s0 ipv6.dns-search 'example.lan'
|
||||
# systemctl restart NetworkManager
|
||||
----
|
||||
|
||||
|
||||
|
|
@ -380,10 +380,10 @@ Check the functionality of name resolution with internal and external addresses.
|
|||
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ping host
|
||||
[…]# ping host.example.lan
|
||||
[…]# ping host.example.com
|
||||
[…]# ping guardian.co.uk
|
||||
# ping host
|
||||
# ping host.example.lan
|
||||
# ping host.example.com
|
||||
# ping guardian.co.uk
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -28,18 +28,18 @@ However, that does not mean it should be used as a standard configuration. The t
|
|||
|
||||
1. The (physical) host CPU must support nested virtualization.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo egrep --color 'vmx|svm|ept' /proc/cpuinfo
|
||||
$ sudo egrep --color 'vmx|svm|ept' /proc/cpuinfo
|
||||
----
|
||||
+
|
||||
The output must include the `vmx` and `ept` flags. This is generally the case on Intel Core-i based CPUs.
|
||||
|
||||
2. Ensure that nested virtualization is enabled in the (physical) hosts kernel:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo cat /sys/module/kvm_intel/parameters/nested
|
||||
$ sudo cat /sys/module/kvm_intel/parameters/nested
|
||||
----
|
||||
+
|
||||
If the command __returns 1 or Y__, the feature is enabled. Continue with xref:#_setting_up_a_vm_for_nested_virtualization[Setting up a VM for nested virtualization]
|
||||
|
|
@ -48,22 +48,22 @@ If the command _returns 0 or N_ but your system supports nested virtualization,
|
|||
|
||||
a. Execute the following commands to enable the nested virtualization feature
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo modprobe -r kvm_intel
|
||||
[…]$ sudo modprobe kvm_intel nested=1
|
||||
$ sudo modprobe -r kvm_intel
|
||||
$ sudo modprobe kvm_intel nested=1
|
||||
----
|
||||
b. Ensure the operation is successfull
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo cat /sys/module/kvm_intel/parameters/nested
|
||||
$ sudo cat /sys/module/kvm_intel/parameters/nested
|
||||
----
|
||||
c. To make the change permanent and cope with a restart, edit
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vim /etc/modprobe.d/kvm.conf
|
||||
$ sudo vim /etc/modprobe.d/kvm.conf
|
||||
options kvm_intel nested=1
|
||||
----
|
||||
|
||||
|
|
@ -77,9 +77,9 @@ Log in to the virtual server that is to host additional virtual machines.
|
|||
|
||||
3. Check the installation
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo virt-host-validate qemu
|
||||
$ sudo virt-host-validate qemu
|
||||
QEMU: Checking for hardware virtualization : PASS
|
||||
QEMU: Checking if device /dev/kvm exists : PASS
|
||||
QEMU: Checking if device /dev/kvm is accessible : PASS
|
||||
|
|
|
|||
|
|
@ -68,20 +68,20 @@ https://cloud.centos.org/centos/9-stream/x86_64/images/ At the time of this writ
|
|||
|
||||
2. In the Cockpit terminal window, fetch a CentOS 9-stream generic image file and store it into the directory `/var/lib/libvirt/boot`. This is by convention the libvirt default location of images for installation. Check the integrity of the download.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo su -
|
||||
[…]# cd /var/lib/libvirt/boot
|
||||
[…]# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
|
||||
[…]# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2.SHA256SUM
|
||||
[…]# sha256sum --ignore-missing -c *.SHA256SUM
|
||||
$ sudo su -
|
||||
# cd /var/lib/libvirt/boot
|
||||
# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
|
||||
# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2.SHA256SUM
|
||||
# sha256sum --ignore-missing -c *.SHA256SUM
|
||||
----
|
||||
+
|
||||
You may want to gather some information about the image
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# qemu-img info CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
|
||||
# qemu-img info CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
|
||||
|
||||
image: CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
|
||||
file format: qcow2
|
||||
|
|
@ -140,18 +140,18 @@ Users of a non-US keyboard layout probably want to customize the keyboard layout
|
|||
|
||||
1. Check the current locale configuration
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl
|
||||
# localectl
|
||||
System Locale: LANG=en_US.UTF-8
|
||||
VC Keymap: us
|
||||
X11 Layout: us
|
||||
----
|
||||
2. List available keyboard mappings filtered by your short country code part
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl list-keymaps | grep de-
|
||||
# localectl list-keymaps | grep de-
|
||||
de-T3
|
||||
de-deadacute
|
||||
de-deadgraveacute
|
||||
|
|
@ -167,7 +167,7 @@ de-nodeadkeys
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# localectl set-keymap de-nodeadkeys
|
||||
# localectl set-keymap de-nodeadkeys
|
||||
...
|
||||
----
|
||||
The setting is immediately active.
|
||||
|
|
@ -185,10 +185,10 @@ The latter is now the recommended approach. It acts similar to a bridge, but wit
|
|||
|
||||
1. While logged in use the terminal window to set the static hostname. It ensures a correct DNS setup in a DHCP environment.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ hostnamectl set-hostname vm1-el9.example.com
|
||||
[…]$ hostnamectl
|
||||
$ hostnamectl set-hostname vm1-el9.example.com
|
||||
$ hostnamectl
|
||||
----
|
||||
2. If you expanded the terminal window click on the VM name in the breadcrumb to get the default view. Select shutdown to stop the virtual machine.
|
||||
|
||||
|
|
@ -207,9 +207,9 @@ Replace the interface type by `__Direct attachment__` and select the external ph
|
|||
+
|
||||
From a terminal window in the host system you should be able to ping your VM using the internal virtual network.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ ping vm1-el9
|
||||
$ ping vm1-el9
|
||||
----
|
||||
+
|
||||
If the name service setup in the host is correct, the short name should work. Otherwise try the internal FQDN name (i.e. something like vm1-el9.example.lan). If name resolution doesn’t work, switch to the VM’s Cockpit terminal window. Use `ip a` to determine the internal IP and use this to ping the VM.
|
||||
|
|
@ -220,7 +220,7 @@ If pinging the IP address works, fix the name resolution. Otherwise check again
|
|||
From a machine on your network try to ping the virtual machine
|
||||
+
|
||||
----
|
||||
[…]$ ping vm1-el9.example.com
|
||||
$ ping vm1-el9.example.com
|
||||
----
|
||||
+
|
||||
In case of issues proceed analog to the internal connection.
|
||||
|
|
@ -232,54 +232,54 @@ A Cockpit installation cannot implement the widely used security concept of lock
|
|||
|
||||
1. If there is already another user and this user is to be granted administrative rights, the account must be assigned to the wheel group.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# usermod -aG wheel <USERNAME>
|
||||
# usermod -aG wheel <USERNAME>
|
||||
----
|
||||
+
|
||||
Test if login and sudo work!
|
||||
|
||||
2. If you decide to lock the root account, login as your administrative user and execute
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo passwd -l root
|
||||
# sudo passwd -l root
|
||||
----
|
||||
+
|
||||
Log off and try to login as root (e.g. using the host's Cockpit instance). The system should respond with 'Login incorrect'.
|
||||
|
||||
3. If you decide to use the root account and you chose a simple password during installation, you should set a long and secure password. Log in as root and execute
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# passwd
|
||||
# passwd
|
||||
----
|
||||
+
|
||||
If root also needs access via ssh, a key-based login must be set up. Follow step 5 of the xref:installation/postinstallation-tasks.adoc[post-installation guide].
|
||||
|
||||
4. Install and activate the firewall
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install firewalld
|
||||
[…]# systemctl enable firewalld --now
|
||||
[…]# firewall-cmd --list-all
|
||||
# dnf install firewalld
|
||||
# systemctl enable firewalld --now
|
||||
# firewall-cmd --list-all
|
||||
----
|
||||
|
||||
5. If you want to use Cockpit you have to enable it
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl enable cockpit.socket --now
|
||||
# systemctl enable cockpit.socket --now
|
||||
----
|
||||
+
|
||||
Cockpit should start up as soon as you connect with your browser.
|
||||
|
||||
6. Finally, if you want the virtual machine to start automatically at system startup, check the corresponding box in the Cockpit VM overview. Alternatively execute
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virsh autostart vm1-el9
|
||||
# virsh autostart vm1-el9
|
||||
----
|
||||
|
||||
== Using virt-install for a CLI interactive minimal effort installation
|
||||
|
|
@ -293,18 +293,18 @@ Essentially, you need to copy the downloaded image file to the libvirt disk imag
|
|||
|
||||
1. Copy the disk image from the installation media pool to the disk images pool and choose the intended VM name as target.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo su -
|
||||
[…]# cd /var/lib/libvirt/boot
|
||||
[…]# cp CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2 ../images/vm2-el9.qcow2
|
||||
$ sudo su -
|
||||
# cd /var/lib/libvirt/boot
|
||||
# cp CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2 ../images/vm2-el9.qcow2
|
||||
----
|
||||
2. Inspect the disk size and optionally adjust it. The default is about 10 GiB.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# qemu-img info /var/lib/libvirt/images/vm2-el9.qcow2
|
||||
[…]# qemu-img resize /var/lib/libvirt/images/vm2-el9.qcow2 +10G
|
||||
# qemu-img info /var/lib/libvirt/images/vm2-el9.qcow2
|
||||
# qemu-img resize /var/lib/libvirt/images/vm2-el9.qcow2 +10G
|
||||
----
|
||||
+
|
||||
The example above adds 10 GiB to a total size of about 20 GiB.
|
||||
|
|
@ -313,9 +313,9 @@ You can resize the virtual disk later, too. Therefore, there is no reason to pla
|
|||
|
||||
=== Installation
|
||||
Use a terminal window to execute
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virt-install --name vm2-el9\
|
||||
# virt-install --name vm2-el9\
|
||||
--memory 2048 --cpu host --vcpus 2 --graphics none\
|
||||
--os-variant centos-stream9\
|
||||
--import \
|
||||
|
|
@ -371,18 +371,18 @@ As usual, also in computer science the "law of conservation of energy" applies.
|
|||
1. Non-US system administrators should adjust the layout first.
|
||||
a. Check the current locale configuration
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl
|
||||
# localectl
|
||||
System Locale: LANG=en_US.UTF-8
|
||||
VC Keymap: us
|
||||
X11 Layout: us
|
||||
----
|
||||
b. List available keyboard mappings filtered by your short country code part. Replace "de-" with your country, i.e. "<COUNTRYCODE>-"
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl list-keymaps | grep de-
|
||||
# localectl list-keymaps | grep de-
|
||||
de-T3
|
||||
de-deadacute
|
||||
de-deadgraveacute
|
||||
|
|
@ -396,16 +396,16 @@ de-nodeadkeys
|
|||
+
|
||||
c. Determine applicable key mapping and apply it
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl set-keymap de-nodeadkeys
|
||||
# localectl set-keymap de-nodeadkeys
|
||||
...
|
||||
----
|
||||
The setting is immediately active.
|
||||
|
||||
2. Check network connection
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
# ip a
|
||||
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ....
|
||||
|
|
@ -426,20 +426,20 @@ If DHCP was available for all interfaces, a complete interface configuration is
|
|||
+
|
||||
Check for connectivity:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ping guardian.co.uk
|
||||
[…]# ping <YOUR_EXTERNAL_DEFAULT_GATEWAY_ADDRESS>
|
||||
[…]# ping 192.168.122.1 # your host system internal virtual network address
|
||||
# ping guardian.co.uk
|
||||
# ping <YOUR_EXTERNAL_DEFAULT_GATEWAY_ADDRESS>
|
||||
# ping 192.168.122.1 # your host system internal virtual network address
|
||||
----
|
||||
+
|
||||
The VM can connect to internal and external destinations. The name resolution for the vm itself can’t work because the static hostname is not set yet. The external host address is not responding due to Mac vlan technology and the internal name resolution is not working yet.
|
||||
+
|
||||
Check the interface devices.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli dev
|
||||
# nmcli dev
|
||||
DEVICE TYPE STATE CONNECTION
|
||||
eth0 ethernet connected System eth0
|
||||
eth1 ethernet connected Wired connection 1
|
||||
|
|
@ -451,9 +451,9 @@ The file `/etc/NetworkManager/system-connections/ens3.nmconnection` is a leftove
|
|||
+
|
||||
Probably you want to have a persistent configuration file, so can assign a firewall zone to the connection. Just rename the connection.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'Wired connection 1' connection.id eth1
|
||||
# nmcli con mod 'Wired connection 1' connection.id eth1
|
||||
----
|
||||
+
|
||||
The renaming triggers NetworkManager to create a file `/etc/sysconfig/network-scripts/ifcfg-eth1` with the current configuration.
|
||||
|
|
@ -462,26 +462,26 @@ If DHCP is not available for the external interface, the configuration file is j
|
|||
|
||||
3. In case the virtual disk size has been changed, the partition sizes must be adjusted.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cfdisk /dev/vda
|
||||
# cfdisk /dev/vda
|
||||
----
|
||||
The only partition should already have the adjusted size. Otherwise select resize and then write.
|
||||
+
|
||||
Next resize the file system, if not already done. First check the size of the file system, e.g. using df.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# df -h
|
||||
[…]# resize2fs -p /dev/vda1
|
||||
# df -h
|
||||
# resize2fs -p /dev/vda1
|
||||
----
|
||||
|
||||
4. Finally, let’s set the hostname
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# ##hostnamectl set-hostname VM_NAME.example.com
|
||||
[…]# hostnamectl set-hostname vm2-el9.example.com
|
||||
# ##hostnamectl set-hostname VM_NAME.example.com
|
||||
# hostnamectl set-hostname vm2-el9.example.com
|
||||
----
|
||||
|
||||
Exit and close the console typing <ctrl>+].
|
||||
|
|
@ -491,13 +491,13 @@ You may reboot the VM and than check /var/lib/libvirt/dnsmasq/virbr0.status agai
|
|||
If your external DHCP server provides dynamic DNS as well, you should be able to connect to your VM from the public network:
|
||||
[source,batch]
|
||||
----
|
||||
[…]# ping VM_NAME.example.com
|
||||
# ping VM_NAME.example.com
|
||||
----
|
||||
|
||||
Last action is to enable autostart of the VM.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virsh autostart VM_NAME
|
||||
# virsh autostart VM_NAME
|
||||
----
|
||||
|
||||
Everything is working fine now, nearly out of the box. You would now start configuring the VM in detail according to its intended use. Just as it would be required after a standard installation.
|
||||
|
|
|
|||
|
|
@ -56,15 +56,15 @@ We assume a complete installation of virtualization support according to the xre
|
|||
|
||||
1. If not already done, *download the Fedora Server Edition* virtual disk image into the _Installation media_ storage pool and verify the image. This involves the following steps on x86_64 hardware. For ARM machines replace 'x86_64' by 'aarcb64' in the following example.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo -i
|
||||
[…]# cd /var/lib/libvirt/boot
|
||||
[…]# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/images/Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2
|
||||
[…]# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/iso/Fedora-Server-43-1.6-x86_64-CHECKSUM
|
||||
[…]# curl -O https://fedoraproject.org/fedora.gpg
|
||||
[…]# gpgv --keyring ./fedora.gpg Fedora-Server-43-1.6-x86_64-CHECKSUM
|
||||
[…]# sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
|
||||
$ sudo -i
|
||||
# cd /var/lib/libvirt/boot
|
||||
# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/images/Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2
|
||||
# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/iso/Fedora-Server-43-1.6-x86_64-CHECKSUM
|
||||
# curl -O https://fedoraproject.org/fedora.gpg
|
||||
# gpgv --keyring ./fedora.gpg Fedora-Server-43-1.6-x86_64-CHECKSUM
|
||||
# sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
|
||||
Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2: OK
|
||||
sha256sum: WARNING: 17 lines are improperly formatted
|
||||
----
|
||||
|
|
@ -73,21 +73,21 @@ You can savely ignore the warning. Important is just the OK status of the image.
|
|||
+
|
||||
If you copy or move files directly from elsewhere, you should check the correct SELinux label and correct it if necessary.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ls -alZ /var/lib/libvirt/boot/*
|
||||
[…]# restorecon -R -vF /var/lib/libvirt/boot/*
|
||||
# ls -alZ /var/lib/libvirt/boot/*
|
||||
# restorecon -R -vF /var/lib/libvirt/boot/*
|
||||
----
|
||||
|
||||
2. *Adjust the image file* to your needs. The maximum disk size of the server VM image file is 10 GiB, of which about 6GB in the root file system is free. This is not intended for productive operation, but as a starting point for customization. The minimal recommended size is about 20G. To save these adjustment steps for further instantiations, create a customized base image. Copy the disk image to an intermediate file and adjust the maximum disk size.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cd /var/lib/libvirt/boot
|
||||
[…]# cp Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2 Fedora-Server-43-custom.qcow2
|
||||
[…]# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
|
||||
[…]# qemu-img resize /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 40G
|
||||
[…]# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
|
||||
# cd /var/lib/libvirt/boot
|
||||
# cp Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2 Fedora-Server-43-custom.qcow2
|
||||
# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
|
||||
# qemu-img resize /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 40G
|
||||
# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
|
||||
----
|
||||
+
|
||||
The example above expands the maximal capacity to 40 GiB. You can resize the virtual disk later, too. Therefore, there is no reason to plan too generously in terms of size now. Due to the qcow2 format resizing does not affect the current image file size. It is dynamically adjusted as needed up to the maximum specified.
|
||||
|
|
@ -101,10 +101,10 @@ The example above expands the maximal capacity to 40 GiB. You can resize the vir
|
|||
|
||||
Copy the customized distribution file into the disk image pool and use virt-install to instantiate the new virtual machine. In the example, we assume that the VM has 2 interfaces, one for connecting to the public network and another for connecting to the internal protected network. Adjust this to your needs. You could even install the VM without any interface. In this case, you must use the virsh console ('virsh console <VM_NAME>) to log in and obtain a terminal window.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cp /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
|
||||
[…]# virt-install --name <VM_NAME> \
|
||||
# cp /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
|
||||
# virt-install --name <VM_NAME> \
|
||||
--memory 4096 --cpu host --vcpus 2 --graphics none \
|
||||
--os-variant fedora-unknown \
|
||||
--import \
|
||||
|
|
@ -120,7 +120,7 @@ The parameters are quite descriptive and are to be adjusted accordingly. You wil
|
|||
|
||||
A lot of messages then scroll across the screen. If the network interface doesn't provide DHCP, in includes a NetworkManager error message. You can safely ignore it for now. It finally ends with a simple, text-based input mask for the first boot configuration.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
Starting install...
|
||||
Running text console command: virsh --connect qemu:///system console rbox03
|
||||
|
|
@ -215,7 +215,7 @@ You have to use the terminal for this step, whether you performed the instantiat
|
|||
|
||||
1. *Complete the first boot configuration*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
================================================================================
|
||||
================================================================================
|
||||
|
|
@ -235,7 +235,7 @@ The clear majority of the input options are already preset with values that corr
|
|||
+
|
||||
The selection of a menu item to be edited is made via the digit in front of it. Somewhat unusual in these days and age. The process is unfortunately a bit cumbersome. A "5" navigates to the item "User creation" and a "1" then to the creation of a new user.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
================================================================================
|
||||
================================================================================
|
||||
|
|
@ -257,7 +257,7 @@ quit, 'r' to refresh]:
|
|||
+
|
||||
The "[x]" in front of Create user indicates that the user creation process is activ. Accordingly, password authentication is enabled for the new user as well as administrator privileges. Fill in the required information and in any case ensure to activate the adminstrator privileges! It automatically adds "wheel" to Groups.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
================================================================================
|
||||
================================================================================
|
||||
|
|
@ -286,7 +286,7 @@ All non-British users may grab the opportunity to adjust the time zone using opt
|
|||
+
|
||||
Another "c" continues with the execution of the entire configuration process. The operation takes some time and then ends in a login prompt.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
...
|
||||
...
|
||||
|
|
@ -315,10 +315,10 @@ The virtual server is up and running now, and ready for log in. The initial conf
|
|||
+
|
||||
Users of a non-US keyboard layout probably want to customize the keyboard layout first of all. This facilitates any subsequent operation. First, check the current locale configuration
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo -i
|
||||
[…]# localectl
|
||||
# sudo -i
|
||||
# localectl
|
||||
System Locale: LANG=en_US.UTF-8
|
||||
VC Keymap: us
|
||||
X11 Layout: us
|
||||
|
|
@ -327,9 +327,9 @@ System Locale: LANG=en_US.UTF-8
|
|||
+
|
||||
List available keyboard mappings filtered by your short county code part
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# localectl list-keymaps | grep de-
|
||||
# localectl list-keymaps | grep de-
|
||||
de-T3
|
||||
de-deadacute
|
||||
de-deadgraveacute
|
||||
|
|
@ -345,7 +345,7 @@ Determine applicable key mapping and apply it
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# localectl set-keymap de-nodeadkeys
|
||||
# localectl set-keymap de-nodeadkeys
|
||||
----
|
||||
+
|
||||
The setting is immediately active.
|
||||
|
|
@ -356,42 +356,42 @@ A correct hostname is specifically important for DHCP of the internal network to
|
|||
+
|
||||
a. __Check hostname__. You need a correct static hostname.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl
|
||||
# hostnamectl
|
||||
----
|
||||
b. _Set hostname_ if required:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl set-hostname <YourFQDN>
|
||||
# hostnamectl set-hostname <YourFQDN>
|
||||
----
|
||||
|
||||
4. *Check time zone and time synchronisation* if you missed that previously
|
||||
|
||||
a. _Check time settings_
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl
|
||||
# timedatectl
|
||||
----
|
||||
b. Correct time zone if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-timezone <ZONE>
|
||||
# timedatectl set-timezone <ZONE>
|
||||
----
|
||||
c. If necessary, activate time synchronisation:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-ntp true
|
||||
# timedatectl set-ntp true
|
||||
----
|
||||
d. Correct time if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-time <TIME>
|
||||
# timedatectl set-time <TIME>
|
||||
----
|
||||
+
|
||||
If you get a warning about RTC time set to local time, follow the instructions to fix it.
|
||||
|
|
@ -402,9 +402,9 @@ a. At first *check your interfaces*
|
|||
+
|
||||
If you followed the example installation above you should find
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip a
|
||||
# ip a
|
||||
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
|
||||
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
|
||||
inet 127.0.0.1/8 scope host lo
|
||||
|
|
@ -422,9 +422,9 @@ If the external interface doesn't provide DHCP you won't find an assigned IP add
|
|||
|
||||
b. Next let's *check and fix NetworkManager naming*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con
|
||||
# nmcli con
|
||||
NAME UUID TYPE DEVICE
|
||||
'Wired connection 2' 8d971f49-033f-398a-9714-3a4e848178fb ethernet enp2s0
|
||||
'Wired connection 1' 8d971f49-033f-398a-9714-3a4e848178fb ethernet ---
|
||||
|
|
@ -432,19 +432,19 @@ NAME UUID TYPE DEVICE
|
|||
+
|
||||
Most likely your interfaces are a named somewhat awkward way. Let's fix that to make administration of network easier and more comfortable. Don't forget to adjust the naming to your specific installation!
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'Wired connection 1' connection.id enp1s0
|
||||
[…]# nmcli con mod 'Wired connection 2' connection.id enp2s0
|
||||
# nmcli con mod 'Wired connection 1' connection.id enp1s0
|
||||
# nmcli con mod 'Wired connection 2' connection.id enp2s0
|
||||
----
|
||||
|
||||
c. In case DHCP is missing on an interface, configure a static network connection
|
||||
+
|
||||
We take the external interface as an example here.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp1s0 ipv4.method manual \
|
||||
# nmcli con mod enp1s0 ipv4.method manual \
|
||||
ipv4.address "xxx.xxx.xxx.xxx/yy" \
|
||||
ipv4.gateway "xxx.xxx.xxx.zzz" \
|
||||
ipv4.dns "xxx.xxx.xxx.vvv" \
|
||||
|
|
@ -453,25 +453,25 @@ We take the external interface as an example here.
|
|||
ipv6.gateway xxxx:xxxx:xxxx:xxxx::zz \
|
||||
ipv6.dns "xxxx.xxxx.xxxx.xxxx::vvv" \
|
||||
connection.zone "FedoraServer"
|
||||
[…]# nmcli con up enp1s0
|
||||
[…]# systemctl restart NetworkManager
|
||||
# nmcli con up enp1s0
|
||||
# systemctl restart NetworkManager
|
||||
----
|
||||
|
||||
d. The interface enp2s0 for the internal libvirt network may show an IPv6 IP, which we don't use. Therefore, you should disable IPv6 on the internal interface
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp2s0 ipv6.method disabled \
|
||||
# nmcli con mod enp2s0 ipv6.method disabled \
|
||||
connection.zone "trusted"
|
||||
[…]# nmcli con up enp2s0
|
||||
[…]# systemctl restart NetworkManager
|
||||
# nmcli con up enp2s0
|
||||
# systemctl restart NetworkManager
|
||||
----
|
||||
|
||||
e. Check the default routes if you have 2 interfaces, one with an external public connection, one with the internal network, which uses NAT by default. So you have 2 parallel connection paths to access the public network and will find something like
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip r
|
||||
# ip r
|
||||
default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
|
||||
default via 192.168.122.1 dev enp2s0 proto dhcp src 192.168.122.107 metric 101
|
||||
192.168.122.0/24 dev enp2s0 proto kernel scope link src 192.168.122.107 metric 101
|
||||
|
|
@ -480,13 +480,13 @@ default via 192.168.122.1 dev enp2s0 proto dhcp src 192.168.122.107 metric 101
|
|||
+
|
||||
Delete the NAT route to avoid issues because of ambigous routes by some application software.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp2s0 ipv4.never-default yes
|
||||
[…]# nmcli con down enp2s0
|
||||
[…]# nmcli con up enp2s0
|
||||
[…]# systemctl reload NetworkManager
|
||||
[…]# ip r
|
||||
# nmcli con mod enp2s0 ipv4.never-default yes
|
||||
# nmcli con down enp2s0
|
||||
# nmcli con up enp2s0
|
||||
# systemctl reload NetworkManager
|
||||
# ip r
|
||||
default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
|
||||
192.168.122.0/24 dev enp2s0 proto kernel scope link src 192.168.122.107 metric 101
|
||||
192.168.158.0/24 dev enp1s0 proto kernel scope link src 192.168.158.160 metric 100
|
||||
|
|
@ -495,38 +495,38 @@ default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
|
|||
+
|
||||
The installer assigns all interfaces to the _FedoraServer_ zone, which limits access to ssh (and Cockpit). For the internal, protected network a broader accessibility may be appropriate, depending on the use case. If appropriate, modify the configuration (check alternative zone and select a suitable one).
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
[…]# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
|
||||
[…]# firewall-cmd --reload
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
|
||||
# firewall-cmd --reload
|
||||
# firewall-cmd --get-active-zones
|
||||
----
|
||||
|
||||
7. Optionally *adjust default editor*
|
||||
+
|
||||
By default nano is the default system editor in Fedora. Many experienced system administrators prefer vim. If you are among the latter, adjust the default editor.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install vim-default-editor --allowerasing
|
||||
# dnf install vim-default-editor --allowerasing
|
||||
----
|
||||
8. *Finally perform an update and reboot*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf update
|
||||
[…]# reboot
|
||||
# dnf update
|
||||
# reboot
|
||||
----
|
||||
9. *Close the virsh console mode*
|
||||
+
|
||||
You were automatically in virsh's console mode until now. Exit this mode and you will be back on the host system.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# <ctrl>]
|
||||
# <ctrl>]
|
||||
Domain creation completed.
|
||||
[…]#
|
||||
#
|
||||
----
|
||||
|
||||
If you opted for Cockpit to instantiate the VM you may use Cockpits graphical interface for the last 4 steps.
|
||||
|
|
@ -542,9 +542,9 @@ The distributed disk image features a disk size of about 7 gb. This is not inten
|
|||
At this point, we have to specify the allocation and adjustment of the intended maximum disc size. Unfortunately, Cockpit doesn't provide graphical support for editing an existing partition table. So we are bound to CLI for the first step.
|
||||
|
||||
Login to the virtual machine and use the cfdisk utility to display the space allocation as distributed and adjusted pre installation.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cfdisk /dev/vda
|
||||
# cfdisk /dev/vda
|
||||
Disk: /dev/vda
|
||||
Size: 37 GiB, 39728447488 bytes, 77594624 sectors
|
||||
Label: gpt, identifier: BAD551E3-F483-4FB3-BF4C-EF516A914C13
|
||||
|
|
@ -570,9 +570,9 @@ As you see, on the disk there is unused space, not associated to any partition.
|
|||
|
||||
|
||||
Partition vda3 contains a Volume Group (VG).
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vgdisplay
|
||||
# vgdisplay
|
||||
--- Volume group ---
|
||||
VG Name sysvg
|
||||
System ID
|
||||
|
|
@ -589,9 +589,9 @@ As you see, the complete space is occupied by a Logical Volume (LV).
|
|||
|
||||
Check the logical volume
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lvdisplay
|
||||
# lvdisplay
|
||||
--- Logical volume ---
|
||||
LV Path /dev/sysvg/root
|
||||
LV Name root
|
||||
|
|
@ -619,9 +619,9 @@ As you see, the Logical Volume is of the same size as the Volume Group, about 6
|
|||
|
||||
1. Enlarge the LVM partition to fill the disk
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cfdisk /dev/vda
|
||||
# cfdisk /dev/vda
|
||||
Disk: /dev/vda
|
||||
Size: 37 GiB, 39728447488 bytes, 77594624 sectors
|
||||
Label: gpt, identifier: BAD551E3-F483-4FB3-BF4C-EF516A914C13
|
||||
|
|
@ -649,12 +649,12 @@ Select resize, confirm the suggested maximum size, and then write the change to
|
|||
|
||||
2. Enlarge the VG to fill up the partition
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# pvresize /dev/vda3
|
||||
# pvresize /dev/vda3
|
||||
Physical volume "/dev/vda3" changed
|
||||
1 physical volume(s) resized or updated / 0 physical volume(s) not resized
|
||||
[…]# vgdisplay sysvg
|
||||
# vgdisplay sysvg
|
||||
--- Volume group ---
|
||||
VG Name sysvg
|
||||
System ID
|
||||
|
|
@ -666,14 +666,14 @@ Select resize, confirm the suggested maximum size, and then write the change to
|
|||
Alloc PE / Size 1535 / <6.00 GiB
|
||||
Free PE / Size 7680 / 30.00 GiB
|
||||
...
|
||||
[…]#
|
||||
#
|
||||
----
|
||||
|
||||
3. Enlarge the LV. A recommended size is 8 - 15G max, depending on the total disk size. As an example, the new size is 12 G which leaves the rest free for further user data LVs.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lvextend -L 12G /dev/mapper/sysvg-root
|
||||
# lvextend -L 12G /dev/mapper/sysvg-root
|
||||
Size of logical volume sysvg/root changed from <6.00 GiB (1535 extents) to 12.00 GiB (3072 extents).
|
||||
[ 1337.365631] dm-0: detected capacity change from 12574720 to 25165824
|
||||
Logical volume sysvg/root successfully resized.
|
||||
|
|
@ -681,15 +681,15 @@ Select resize, confirm the suggested maximum size, and then write the change to
|
|||
|
||||
4. Enlarge the XFS root filesystem to fill the LV
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# xfs_growfs /dev/mapper/sysvg-root
|
||||
# xfs_growfs /dev/mapper/sysvg-root
|
||||
meta-data=/dev/mapper/sysvg-root isize=512 agcount=4, agsize=392960 blks
|
||||
= sectsz=512 attr=2, projid32bit=1
|
||||
...
|
||||
data blocks changed from 1571840 to 3145728
|
||||
|
||||
[…]# df -h
|
||||
# df -h
|
||||
Filesystem Size Used Avail Use% Mounted on
|
||||
...
|
||||
/dev/mapper/sysvg-root 12G 1.8G 11G 15% /
|
||||
|
|
@ -706,20 +706,20 @@ For the last 2 steps you can also switch to __Cockpit__. But the 2 lines may not
|
|||
|
||||
3. Create a Physical Volume (PV) in the new partition
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# pvcreate /dev/vda4
|
||||
# pvcreate /dev/vda4
|
||||
Physical volume "/dev/vda4" successfully created.
|
||||
----
|
||||
|
||||
4. Create a Volume Group (VG) in the new Physical Volume
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vgcreate usrvg /dev/vda4
|
||||
# vgcreate usrvg /dev/vda4
|
||||
Volume group "usrvg" successfully created
|
||||
|
||||
[…]# vgs
|
||||
# vgs
|
||||
VG #PV #LV #SN Attr VSize VFree
|
||||
sysvg 1 1 0 wz--n- <20.00g <8.00g
|
||||
usrvg 1 0 0 wz--n- <16.00g <16.00g
|
||||
|
|
@ -738,12 +738,12 @@ You can use either _CLI_ or _Cockpit_ for this step.
|
|||
|
||||
. On the host system, create a _new virtual disk_ in /var/lib/libvirt/images
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# qemu-img create -f qcow2 /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 20G
|
||||
# qemu-img create -f qcow2 /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 20G
|
||||
Formatting '/var/lib/libvirt/images/vm01-test-usr.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=21474836480 lazy_refcounts=off refcount_bits=16
|
||||
|
||||
[…]# qemu-img info /var/lib/libvirt/images/${VM_NAME}-usr.qcow2
|
||||
# qemu-img info /var/lib/libvirt/images/${VM_NAME}-usr.qcow2
|
||||
file format: qcow2
|
||||
virtual size: 20 GiB (21474836480 bytes)
|
||||
disk size: 196 KiB
|
||||
|
|
@ -759,9 +759,9 @@ Format specific information:
|
|||
|
||||
. Continue on the host and add the disk to the virtual machine. Use the first available diskname. The system disk is vda, so the next available disk name is vdb. If you are unsure check in the virtual machine, e.g. using '__lsblk__'.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virsh attach-disk ${VM_NAME} /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 vdb --cache default --persistent --targetbus=virtio --subdriver qcow2
|
||||
# virsh attach-disk ${VM_NAME} /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 vdb --cache default --persistent --targetbus=virtio --subdriver qcow2
|
||||
Disk attached successfully
|
||||
----
|
||||
+
|
||||
|
|
@ -769,9 +769,9 @@ The command needs the absolute path to the image file as noted. Otherwise it wil
|
|||
+
|
||||
If you want to modify something, detach the file first.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virsh detach-disk ${VM_NAME} vdb --persistent
|
||||
# virsh detach-disk ${VM_NAME} vdb --persistent
|
||||
Disk detached successfully
|
||||
----
|
||||
|
||||
|
|
@ -779,9 +779,9 @@ Disk detached successfully
|
|||
+
|
||||
First, cfdisk displays a list for selecting the partitioning type. Select GPT.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cfdisk /dev/vdb
|
||||
# cfdisk /dev/vdb
|
||||
Disk: /dev/vdb
|
||||
Size: 192.5 KiB, 197120 bytes, 385 sectors
|
||||
Label: gpt, identifier: 2842C26B-A2F1-4946-9D89-AB8832E5FCEC
|
||||
|
|
@ -799,17 +799,17 @@ First, cfdisk displays a list for selecting the partitioning type. Select GPT.
|
|||
|
||||
. Create a Physical Volume (PV) in the new partition (adjust the device accordingly!)
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# pvcreate /dev/vdb1
|
||||
# pvcreate /dev/vdb1
|
||||
Physical volume "/dev/vdb1" successfully created.
|
||||
----
|
||||
|
||||
. Create a Volume Group (VG) in the new Physical Volume (adjust the device accordingly!)
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vgcreate usrvg /dev/vdb1
|
||||
# vgcreate usrvg /dev/vdb1
|
||||
----
|
||||
|
||||
Later, use usrvg to create LVs for user data as needed.
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ This step does the main work.
|
|||
To get a CentOS virtual machine image, we use the default image repository, which is maintained by the guests-tools project. First, we need a list of available (CentOS) prebuilt machine images.
|
||||
[source,bash]
|
||||
----
|
||||
[…]$ virt-builder --list | grep centos
|
||||
$ virt-builder --list | grep centos
|
||||
|
||||
gpg: checking the trustdb
|
||||
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
|
||||
|
|
@ -60,7 +60,7 @@ The guestfs-tools project provides a fairly complete set of variants available i
|
|||
We want the latest and greatest CentOS release and would like to get some info about details.
|
||||
[source,bash]
|
||||
----
|
||||
[…]$ virt-builder --notes centosstream-9
|
||||
$ virt-builder --notes centosstream-9
|
||||
gpg: checking the trustdb
|
||||
...
|
||||
CentOS Stream 9
|
||||
|
|
@ -84,8 +84,8 @@ Even a quick and experimental setup should take the opportunity to set a number
|
|||
|
||||
[source,text]
|
||||
----
|
||||
[…]$ sudo su -
|
||||
[…]# virt-builder centosstream-9 \
|
||||
$ sudo su -
|
||||
# virt-builder centosstream-9 \
|
||||
--format qcow2 --output /var/lib/libvirt/images/vm1-el9vb.qcow2 \
|
||||
--root-password locked:disabled \
|
||||
--hostname vm1-el9vb.example.com \
|
||||
|
|
@ -126,11 +126,11 @@ As you see, the virtual disk size is 6.0 G with 4.3 G at your disposition.
|
|||
|
||||
1. As noted above, the maximum disk size is 6 G with about 4 G at your disposition (you may not fill the space 100%). That is not too much and you might want to enlarge it.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
|
||||
[…]# qemu-img resize /var/lib/libvirt/images/vm1-el9vb.qcow2 +10G
|
||||
[…]# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
|
||||
# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
|
||||
# qemu-img resize /var/lib/libvirt/images/vm1-el9vb.qcow2 +10G
|
||||
# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
|
||||
----
|
||||
+
|
||||
The example above adds 10 GiB. The maximum virtual disk size of the CentOS image is 16 GiB now. The current (physical) disk size is still about 1 GB, due to the dynamic properties of the qcow2 file format.
|
||||
|
|
@ -144,16 +144,16 @@ You should _not_ increase the maximum virtual disk image size by the _virt-build
|
|||
|
||||
Use a terminal window. First, you may check the correct naming for the parameter os-variant.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virt-install --osinfo list
|
||||
# virt-install --osinfo list
|
||||
----
|
||||
|
||||
Import the virtual disk image.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# virt-install --name vm1-el9vb \
|
||||
# virt-install --name vm1-el9vb \
|
||||
--memory 2048 --cpu host --vcpus 2 --graphics none\
|
||||
--os-variant centos-stream9\
|
||||
--import \
|
||||
|
|
@ -197,10 +197,10 @@ You did a minimal customization so far and need to do some further adjustments.
|
|||
|
||||
1. Check the available network connections
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip a
|
||||
[…]# nmcli con
|
||||
# ip a
|
||||
# nmcli con
|
||||
----
|
||||
+
|
||||
Depending on your runtime environment you may have to consolidate the network configuration. In the above example you get 2 connections, one to the public network and another to the internal server network. For details see xref:virtualization/installation.adoc[Adding Virtualization Support].
|
||||
|
|
@ -209,9 +209,9 @@ Depending on your runtime environment you may have to consolidate the network co
|
|||
+
|
||||
Sometimes a connection gets named something like 'Wired connection 1'. For ease of administration, change the name, e.g. the device name.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'Wired connection 1' connection.id enp1s0
|
||||
# nmcli con mod 'Wired connection 1' connection.id enp1s0
|
||||
----
|
||||
+
|
||||
In case of your internal network (virbr0), which provides DHCP, this step persists the network configuration. So you can assign a specific zone. Otherwise the system would create the connection anew with each boot.
|
||||
|
|
@ -220,31 +220,31 @@ In case of your internal network (virbr0), which provides DHCP, this step persis
|
|||
+
|
||||
If the external network does not provide DHCP, you get just a minimal configuration without IP addresses. Adjust as appropriate.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp1s0 ipv6.method manual ipv6.addresses '2a01:xxx:yyy:zzz::uu/88' \
|
||||
# nmcli con mod enp1s0 ipv6.method manual ipv6.addresses '2a01:xxx:yyy:zzz::uu/88' \
|
||||
ipv6.gateway 'fe80::1' \
|
||||
ipv6.dns '2a01:xxx:yyy:zzz::uuu:vvv 2a01:xxx:yyy:zzz::uuu:vvv 2a01:xx:yy:zz::uu:vv'
|
||||
|
||||
[…]# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 'xx.yy.zz.ww/vv' ipv4.gateway 'xx.yy.zz.ww' ipv4.dns 'xx.yy.zz.uu xx.yy.zz.vv xx.yy.zz.ww'
|
||||
# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 'xx.yy.zz.ww/vv' ipv4.gateway 'xx.yy.zz.ww' ipv4.dns 'xx.yy.zz.uu xx.yy.zz.vv xx.yy.zz.ww'
|
||||
----
|
||||
|
||||
4. On demand: assign a firewall zone
|
||||
+
|
||||
Specifically for the internal interface (usually enp2s0) you might want to assign a specific zone, e.g. trusted or internal. And for the internal interface you might disable IPv6, Adjust as appropriate
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp2s0 connection.zone 'internal'
|
||||
[…]# nmcli con mod enp2s0 ipv6.method 'disabled'
|
||||
# nmcli con mod enp2s0 connection.zone 'internal'
|
||||
# nmcli con mod enp2s0 ipv6.method 'disabled'
|
||||
----
|
||||
+
|
||||
5. Finally restart the connections
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con up enp1s0
|
||||
[…]# nmcli con up enp2s0
|
||||
# nmcli con up enp1s0
|
||||
# nmcli con up enp2s0
|
||||
----
|
||||
|
||||
== Using Cockpit's graphical UI to instantiate the VM
|
||||
|
|
|
|||
|
|
@ -52,13 +52,13 @@ Cockpit offers the option to load an installation medium not only locally, but a
|
|||
|
||||
Select `__Terminal__` in the left navigation bar and issue the commands line by line:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
|
||||
[…]# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
[…]# sudo curl -O https://fedoraproject.org/fedora.gpg | gpg --import
|
||||
[…]# sudo gpgv --keyring ./fedora.gpg /var/lib/libvirt/boot/*-CHECKSUM
|
||||
[…]# sudo sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
|
||||
# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
|
||||
# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
# sudo curl -O https://fedoraproject.org/fedora.gpg | gpg --import
|
||||
# sudo gpgv --keyring ./fedora.gpg /var/lib/libvirt/boot/*-CHECKSUM
|
||||
# sudo sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
|
||||
----
|
||||
|
||||
You can safely ignore the warning of the last command about not correctly formatted lines.
|
||||
|
|
@ -139,10 +139,10 @@ If you want to save the disk image for future VM creation, select shutdown, copy
|
|||
____
|
||||
*__Excursus__: Save generated virtual machine for later reuse*
|
||||
|
||||
Sometimes, after selecting __Shutdown__ the machine automatically start again. Login with your administrative account and perform a shutdown: `sudo shutdown -h now`. Then switch to a host's terminal window and execute:
|
||||
[source,]
|
||||
Sometimes, after selecting __Shutdown__ the machine automatically start again. Login with your administrativ account and perform a shutdown: `sudo shutdown -h now`. Then switch to a host's terminal window and execute:
|
||||
[source,console]
|
||||
----
|
||||
[…]# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/boot/fedora-servervm-img.qcow2
|
||||
# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/boot/fedora-servervm-img.qcow2
|
||||
----
|
||||
A comparison of the two image files reveals that the originally created image is about 20 GiB in size, as specified while creating the virtual machine. Thus the dynamic capabilities of the qcow2 format are not used during the installation process. The copied image is only a fraction of that. The conversion process automatically re-uses the dynamic capability and creates a sparse image by masking out unused parts (thin provisioning). The copy could be made even smaller by using the -c parameter and additionally compressing the copied image. However, this may reduce the performance somewhat. In any way, the image will grow during later reuse in the course of operation depending on actual needs.
|
||||
|
||||
|
|
@ -155,19 +155,19 @@ There are some post-install task that are specific for a virtual machine. Otherw
|
|||
|
||||
____
|
||||
Before you start the post installation tasks you may consider to 'sparsify' the image, i.d. to mask out currently unused space and convert the image to thin provisioning (and so using the dynamic capabilities of the qcow2 image format). You must use a host terminal window. Cockpit doesn't currently support such an operation.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2
|
||||
[…]# mv /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
|
||||
# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2
|
||||
# mv /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
|
||||
----
|
||||
____
|
||||
|
||||
If you have not already done so, start the virtual machine and log in with the administrator account. You can select __expand__ at a top of the terminal window to increase readability. Selecting "Serial console" on the left above the terminal window instead of "VNC console" further improves readability in some cases. However, on some devices this does not work at all.
|
||||
|
||||
All subsequent tasks must be executed with ROOT privileges. If the root account is locked, ROOT privileges should generally be acquired for the sake of simplicity.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo -i
|
||||
# sudo -i
|
||||
[sudo] password for <user>:
|
||||
----
|
||||
|
||||
|
|
@ -179,40 +179,40 @@ A correct hostname is specifically important for DHCP of the internal network to
|
|||
+
|
||||
a. __Check hostname__. You need a correct static hostname.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl
|
||||
# hostnamectl
|
||||
----
|
||||
* Set hostname if required:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl set-hostname <YourFQDN>
|
||||
# hostnamectl set-hostname <YourFQDN>
|
||||
----
|
||||
|
||||
b. _Check time zone, time synchronisation, time_
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl
|
||||
# timedatectl
|
||||
----
|
||||
* Correct time zone if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-timezone <ZONE>
|
||||
# timedatectl set-timezone <ZONE>
|
||||
----
|
||||
* If necessary, activate time synchronisation:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-ntp true
|
||||
# timedatectl set-ntp true
|
||||
----
|
||||
* Correct time if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-time <TIME>
|
||||
# timedatectl set-time <TIME>
|
||||
----
|
||||
|
||||
2. *Consolidate internal network configuration*
|
||||
|
|
@ -223,9 +223,9 @@ Usually, it is useful to resolve a single member name to the internal network, i
|
|||
|
||||
a. List the interfaces and determine the name of the internal interface
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con
|
||||
# nmcli con
|
||||
NAME UUID TYPE DEVICE
|
||||
enp1 47df4730-171e-3bfe-b5d9-4238137e0f70 ethernet enp1
|
||||
enp2 7627fc10-f1bf-3220-99e2-3bd369837439 ethernet enp2
|
||||
|
|
@ -234,11 +234,11 @@ b. Set the DNS search path for the internal interface
|
|||
+
|
||||
If enp2 it the internal interface, set dns search and deactivate IPv6 that is not used internally
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp2 ipv4.dns-search example.lan ipv6.method disabled
|
||||
[…]# nmcli con up enp2
|
||||
[…]# systemctl restart NetworkManager
|
||||
# nmcli con mod enp2 ipv4.dns-search example.lan ipv6.method disabled
|
||||
# nmcli con up enp2
|
||||
# systemctl restart NetworkManager
|
||||
----
|
||||
|
||||
|
||||
|
|
@ -246,41 +246,41 @@ If enp2 it the internal interface, set dns search and deactivate IPv6 that is no
|
|||
+
|
||||
Check /etc/resolv.conf
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ls -al /etc/resolv.conf
|
||||
# ls -al /etc/resolv.conf
|
||||
----
|
||||
+
|
||||
If it is a file instead of a link, you have to fix it.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# rm -f /etc/resolv.conf
|
||||
[…]# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
||||
[…]# ls -l /etc/resolv.conf
|
||||
[…]# systemctl restart NetworkManager
|
||||
[…]# systemctl restart systemd-resolved
|
||||
# rm -f /etc/resolv.conf
|
||||
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
||||
# ls -l /etc/resolv.conf
|
||||
# systemctl restart NetworkManager
|
||||
# systemctl restart systemd-resolved
|
||||
----
|
||||
+
|
||||
Check whether the name resolution works as desired.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# host vm1.example.com
|
||||
[…]# host vm1.example.lan
|
||||
[…]# host vm1
|
||||
# host vm1.example.com
|
||||
# host vm1.example.lan
|
||||
# host vm1
|
||||
----
|
||||
|
||||
4. *Adjust firewall setting of the internal interface*
|
||||
+
|
||||
The installer assigns all interfaces to the _FedoraServer_ zone, which limits access to ssh (and Cockpit). For the internal, protected network a broader accessibility may be appropriate, depending on the use case. If appropriate, modify the configuration (check alternative zone and select a suitable one).
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
[…]# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
|
||||
[…]# firewall-cmd --reload
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
|
||||
# firewall-cmd --reload
|
||||
# firewall-cmd --get-active-zones
|
||||
----
|
||||
|
||||
5. *Increase security of Cockpit access*
|
||||
|
|
@ -293,18 +293,18 @@ Refer to the corresponding section in the xref:installation/postinstallation-t
|
|||
+
|
||||
If you are a somewhat experienced administrator, you are probably annoyed that Namo, default editor since Fedora 34, always pops up when you want to edit crontab or similar. It is therefore worth reconfiguring right from the start.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install --allowerasing vim-default-editor
|
||||
# dnf install --allowerasing vim-default-editor
|
||||
----
|
||||
|
||||
2. *Reconfiguring the external interface as static*
|
||||
+
|
||||
Many administrators prefer to configure the external interface statically to ensure connectivity even if the DHCP server fails or is corrupted. Adjust the following example as needed.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod <IF_NAME> ipv4.method static \clear
|
||||
# nmcli con mod <IF_NAME> ipv4.method static \clear
|
||||
ipv4.address "xxx.xxx.xxx.xxx/yy" \
|
||||
ipv4.gateway "xxx.xxx.xxx.zzz" \
|
||||
ipv4.dns "xxx.xxx.xxx.vvv" \
|
||||
|
|
@ -319,9 +319,9 @@ Ensure, parameter search-domain is empty!
|
|||
|
||||
3. *Remove unnecessary hardware packages*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf remove iwl* linux-firmware* zd1211-firmware* ipw* atmel* alsa-sof-firmware*
|
||||
# dnf remove iwl* linux-firmware* zd1211-firmware* ipw* atmel* alsa-sof-firmware*
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -56,9 +56,9 @@ In the _Filesystems_ section of the central content area [1] there are 2 file sy
|
|||
After shutting down vm2, we can increase the virtual disk by 20 GiB to a total of 32 GiB in the _hosts_ Cockpit terminal.
|
||||
[source,text]
|
||||
----
|
||||
[…]# qemu-img resize /var/lib/libvirt/images/vm2.qcow2 +20G
|
||||
# qemu-img resize /var/lib/libvirt/images/vm2.qcow2 +20G
|
||||
Image resized.
|
||||
[…]# qemu-img info /var/lib/libvirt/images/vm2.qcow2
|
||||
# qemu-img info /var/lib/libvirt/images/vm2.qcow2
|
||||
file format: qcow2
|
||||
virtual size: 32 GiB (34359738368 bytes)
|
||||
disk size: 2.01 GiB
|
||||
|
|
@ -119,7 +119,7 @@ You just have to provide a (descriptive) name and the mount point. After formatt
|
|||
|
||||
[source,bash]
|
||||
----
|
||||
[…]# df -h
|
||||
# df -h
|
||||
Filesystem Size Used Avail Use% Mounted on
|
||||
...
|
||||
/dev/mapper/fedora_fedora-root 11G 1.8G 9.3G 16% /
|
||||
|
|
@ -133,7 +133,7 @@ Cockpit handled all the various configuration steps involved on its own. This sa
|
|||
If you moved files out of the way at the beginning, you can restore them now. To be on the safe side, restore the SELinux labels.
|
||||
[source,bash]
|
||||
----
|
||||
[…]# /sbin/restorecon -R -vF /var/www
|
||||
# /sbin/restorecon -R -vF /var/www
|
||||
----
|
||||
|
||||
Now is the time to install the appropriate programs. Software provided by Fedora distribution as rpm installs into the appropriate system directories via dnf tool. External software should install in either `/opt` or `/usr/local` to keep it separated from distribution files to prevent any potential mutual interference. In accordance with the storage rationale, you should also create a separate logical volume and mount it under /opt. An example of this would be Wildfly application server, which stores program, configuration and possibly data in a common place.
|
||||
|
|
@ -263,15 +263,15 @@ There are several options.
|
|||
+
|
||||
[source,BatchFile]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --remove-service=cockpit
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --permanent --remove-service=cockpit
|
||||
# firewall-cmd --reload
|
||||
----
|
||||
+
|
||||
To use Cockpit you have to ssh into the server and temporarily open the port.
|
||||
+
|
||||
[source,BatchFile]
|
||||
----
|
||||
[…]# firewall-cmd --add-service=cockpit
|
||||
# firewall-cmd --add-service=cockpit
|
||||
----
|
||||
2. Since you log in via ssh anyway, you can also initialize an ssh tunnel in pone go and use it for Cockpit if needed. As described above you have the Cockpit service from the firewall removed.
|
||||
+
|
||||
|
|
@ -279,7 +279,7 @@ To use Cockpit log into the server and temporarily open the port.
|
|||
+
|
||||
[source,BatchFile]
|
||||
----
|
||||
[…]# ssh $user@example.com -i $key -L 9090:example.com:9090
|
||||
# ssh $user@example.com -i $key -L 9090:example.com:9090
|
||||
----
|
||||
+
|
||||
You can access the Cockpit interface using `https://localhost:9090` in your favorite browser.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue