goroboro/user-documentation
0
0
Fork 0
forked from server/user-documentation
Code Pull requests Activity

Merge branch 'main' into update-console-prompts-virtualization

Browse source
This commit is contained in:
Brett Weir 2026-07-01 12:54:18 -07:00
commit 5bd1332f26
21 changed files with 513 additions and 510 deletions
Download patch file Download diff file Expand all files Collapse all files

150
modules/ROOT/pages/administration/dnsmasq.adoc
View file

@ -35,9 +35,9 @@ All the necessary interfaces have been installed and fully configured. This incl
+
You should get something like
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer (default)
interfaces: <IF01> ...
<MY_ZONE>
@ -46,32 +46,32 @@ FedoraServer (default)
+
Fix the zone assignments if necessary
+
[source,]
[source,console]
----
[…]# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
[…]# firewall-cmd --reload
# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
# firewall-cmd --reload
----
* **Check auto forwarding**
+
The system should automatically forward between the interfaces. Check the forwarding status and adjust it if necessary.
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 indicates an active forwarding.
+
Otherwise, enable it immediately and configure it permanently.
+
[source,]
[source,console]
----
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
# echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
# vim /etc/sysctl.d/50-enable-forwarding.conf
# local customizations
#
# enable forwarding for dual stack
@ -84,9 +84,9 @@ net.ipv6.conf.all.forwarding=1
The NetworkManager dnsmasq plugin included by default provides a basic configuration skeleton, but does not install the dnsmasq package. Thus, it avoids to uselessly occupy space and to introduce a superfluous and unused binary in case dnsmasq is not going to be in use on the particular server.
In case dnsmasq is not already installed
[source,]
[source,console]
----
[…]# dnf install dnsmasq
# dnf install dnsmasq
----
[IMPORTANT]
@ -111,9 +111,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
1. **Activate the dnsmasq NetworkManager plugin**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# This enables the dnsmasq plugin.
@ -123,9 +123,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
2. **Configuration of the name resolution (DNS) for the internal private network (internal.lan)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# This file sets up DNS for the private local net domain '<INTERNAL>.lan'
@ -153,16 +153,16 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
+
Provide an empty host file
+
[source,]
[source,console]
----
[…]# touch /etc/dnsmasq-<INTERNAL>.hosts
# touch /etc/dnsmasq-<INTERNAL>.hosts
----
3. **Configuration of the DHCP service for the internal private network (<INTERNAL>.lan)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# This file sets up DHCP for the private local net domain '<INTERNAL>.lan'
@ -196,9 +196,9 @@ Provide an empty host file
4. **Configuration of the DHCP service for the public network (<PUBLIC.TLD>)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# This file sets up DNCP for the public '<PUBLIC.TLD>' domain interface
@ -232,30 +232,30 @@ There is no DNS configuration for the external interface following, assuming tha
5. **Test the dnsmasq configuration**
+
[source,]
[source,console]
----
[…]# dnsmasq --test
# dnsmasq --test
----
6. **Adjusting the firewall**
+
Allow ports for DHCP and DNS (53) service on the public interface.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-services
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
[…]# firewall-cmd --reload
[…]# firewall-cmd --list-all --zone=<YOUR_ZONE>
# firewall-cmd --get-services
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
# firewall-cmd --reload
# firewall-cmd --list-all --zone=<YOUR_ZONE>
----
7. **Restart NetworkManager to start dnsmasq**
+
[source,]
[source,console]
----
[…]# systemctl restart NetworkManager
[…]# ps -ef | grep dnsmasq
# systemctl restart NetworkManager
# ps -ef | grep dnsmasq
dnsmasq 2114 2072 0 08:33 ? 00:00:00 /usr/sbin/dnsmasq --no-resolv ...
----
+
@ -264,10 +264,10 @@ command above.
8. **Restart systemd-resolved**
+
[source,]
[source,console]
----
[…]# systemctl restart systemd-resolved
[…]# resolvectl status
# systemctl restart systemd-resolved
# resolvectl status
----
+
The systemd-resolved should recognize the dnsmasq nameserver attached to interfaces as configured.
@ -276,21 +276,21 @@ The systemd-resolved should recognize the dnsmasq nameserver attached to interfa
a. Test DHCP in the public using a machine without IP address
+
[source,]
[source,console]
----
[…]# ip a # no IPv4 address associated with interface
[…]# dhclient -4 -1 -v eth0
[…]# ip a # expect new IPv4 address associated with interface
[…]# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
[…]# ip a # expect no IPv4 address associated with interface again
# ip a # no IPv4 address associated with interface
# dhclient -4 -1 -v eth0
# ip a # expect new IPv4 address associated with interface
# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
# ip a # expect no IPv4 address associated with interface again
----
b. Try on an other server
+
[source,]
[source,console]
----
[…]# dig app1 @10.10.10.1
[…]# nslookup app1 10.10.10.1
[…]# dhclient -v -d -s 10.10.10.1 enp6s0
# dig app1 @10.10.10.1
# nslookup app1 10.10.10.1
# dhclient -v -d -s 10.10.10.1 enp6s0
----
@ -300,17 +300,17 @@ If machines in the private network need access to the public network, add masque
1. Enabling masquerading for the public zone and for the internal (trusted) trusted zone
+
[source,]
[source,console]
----
[…]# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
success
[…]# firewall-cmd --zone=trusted --add-masquerade --permanent
# firewall-cmd --zone=trusted --add-masquerade --permanent
success
[…]# firewall-cmd --reload
# firewall-cmd --reload
[…]# firewall-cmd --zone=FedoraServer --query-masquerade
# firewall-cmd --zone=FedoraServer --query-masquerade
yes
[…]# firewall-cmd --zone=trusted --query-masquerade
# firewall-cmd --zone=trusted --query-masquerade
yes
----
@ -319,39 +319,39 @@ further to the public network.
+
a. A commonly used way to accomplish this is to set 'rules' in the firewall configuration. Corresponding tutorials are very widespread. And those who are familiar with it may want to continue using it.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer
interfaces: enp1s0
trusted
interfaces: vbr2s0 enp2s0
[…]# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
success
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
success
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
success
----
b. Fedora's firewall daemon, however, offers with release 35 and beyond a more elegant option, so-called 'policies'. These abstract typical targets previously configured by rules.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer
interfaces: enp1s0
trusted
interfaces: vbr2s0 enp2s0
[…]# firewall-cmd --permanent --new-policy trustedToExt
# firewall-cmd --permanent --new-policy trustedToExt
success
[…]# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
success
[…]# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
success
[…]# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
success
[…]# firewall-cmd --reload
# firewall-cmd --reload
success
----
+
@ -365,9 +365,9 @@ To make it work, just add another configuration file. The example uses libvirt.l
We just add the name resolution (DNS) for the libvirt virtual network (libvirt.lan), leaving the DHCP functionality untouched.
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
# /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
@ -383,23 +383,23 @@ We just add the name resolution (DNS) for the libvirt virtual network (libvirt.l
+
The format is the same as /etc/hosts .
+
[source,]
[source,console]
----
[…]# vim /etc/dnsmasq.hosts
# vim /etc/dnsmasq.hosts
----
2. Restart NetworkManager to read the modified file.
+
[source,]
[source,console]
----
[…]# systemctl restart NetworkManager
# systemctl restart NetworkManager
----
3. Test the modification
+
[source,]
[source,console]
----
[…]# nslookup {NAME}
[…]# nslookup {NAME}.example.lan
# nslookup {NAME}
# nslookup {NAME}.example.lan
----

30
modules/ROOT/pages/administration/point-to-point-connection.adoc
View file

@ -28,17 +28,17 @@ For an IPv6 configuration, it is sufficient to specify the link address of the g
== Configuration of current Fedora releases
Given an interface enp1s0 with IPv4 address of 192.168.133.100 and the gateway 192.168.133.1 you may configure the interface
[source,]
[source,console]
----
[…]# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
ipv4.gateway '192.168.133.1' ipv4.dns '192.172.1.1'
----
This will result in a configuration file like
[source,]
[source,console]
----
[…]# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
[connection]
id=enp1s0
uuid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
@ -63,7 +63,7 @@ method=manual
----
An alternative notation for the IPv4 part is
[source,]
[source,console]
----
[ipv4]
address1=192.168.133.100/32
@ -72,9 +72,9 @@ route1=0.0.0.0/0,192.168.133.1
----
In any case you get a
[source,]
[source,console]
----
[…]# ip r
# ip r
default via 192.168.133.1 dev enp1s0 proto static metric 100
192.168.133.1 dev enp1s0 proto static scope link metric 100
----
@ -84,9 +84,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
These Fedora releases used _ifcfg-IF_NAME_ files in /etc/sysconfig/network-scripts/. This method dates back to the time before NetworkManager was introduced and network connections were managed with a collection of shell scripts. The shell scripts disappeared with the introduction of NetworkManager, but the configuration files if cfg-NAME was retained as the default configuration method in Release 36 for backward compatibility.
Usually, you configure the interface using a text editor, eg given the above example
[source,]
[source,console]
----
[…]# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
DEVICE=enp1s0
ONBOOT=yes
BOOTPROTO=none
@ -103,18 +103,18 @@ IPV6_DEFAULTDEV=enp1s0
----
Additionally you need a routing table.
[source,]
[source,console]
----
[…]# vim /etc/sysconfig/network-scripts/route-enp1s0
# vim /etc/sysconfig/network-scripts/route-enp1s0
ADDRESS0=0.0.0.0
NETMASK0=0.0.0.0
GATEWAY0=192.168.133.1
----
Both variants result again in a
[source,]
[source,console]
----
[…]# ip r
# ip r
default via 192.168.133.1 dev enp1s0 proto static metric 100
192.168.133.1 dev enp1s0 proto static scope link metric 100
----
@ -122,9 +122,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
== Using systemd-networkd
Some server administrators might prefer systemd-network over NetworkManager. Many of the NetworkManager features are very useful for desktops and laptops, but rather superfluous for servers. The configuration tool is a plain text editor.
[source,]
[source,console]
----
[…]# vim /etc/systemd/network/10-public.network
# vim /etc/systemd/network/10-public.network
[Match]
MACAddress=12:34:56:78:9a:bc # or another identifier

72
modules/ROOT/pages/administration/virtual-routing-bridge.adoc
View file

@ -35,25 +35,25 @@ This article deals with the latter variant.
1. Check the forwarding configuration
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 must be returned. Libvirt will activate IPv4 forwarding, but probably not IPv6. If necessary, activate forwarding temporarily
+
[source,]
[source,console]
----
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
# echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
----
+
The following file must be set up for permanent setup.
+
[source,]
[source,console]
----
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
# vim /etc/sysctl.d/50-enable-forwarding.conf
# local customizations
#
# enable forwarding for dual stack
@ -63,9 +63,9 @@ net.ipv6.conf.all.forwarding=1
2. Checking the existing interfaces
+
[source,]
[source,console]
----
[…]# ip a
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
…
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> … state UP group default qlen 1000
@ -81,10 +81,10 @@ net.ipv6.conf.all.forwarding=1
+
As the listing indicates, the external IPv6 subnet is a common full /64 network. This must be changed to trigger IPv6 forwarding.
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
[…]# nmcli con up enp2s0
# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
# nmcli con up enp2s0
----
4. Creating a routing bridge
@ -93,9 +93,9 @@ The (public) bridge is named vbr1s0, based on the name of the accompanying (publ
+
In the listing of interfaces, the IPv4 address is a point-to-point connection. Therefore, the bridge uses a subnet, if any, the range that is also assigned in DNS. If the IPv4 interface is also created as a subnet, the bridge would be created as a p2p connection instead.
+
[source,]
[source,console]
----
[…]# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
ipv4.method manual ipv4.addresses '148.251.152.29/27' \
ipv6.method manual ipv6.addresses '2a01:4f8:210:512d::2/64' ipv6.addr-gen-mode eui64
----
@ -104,30 +104,30 @@ No zone is specified! Thus the bridge is assigned to the default zone (FedoraSer
+
Finally, for IPv4, the routes must be created and the public addresses of all VMs must be listed
+
[source,]
[source,console]
----
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
----
5. Double check your entries, especially the IP addresses, to avoid incorrect configuration and time-consuming troubleshooting.
6. Activate the routing bridge
+
[source,]
[source,console]
----
[…]# nmcli con up vbr1s0
# nmcli con up vbr1s0
----
7. Installing a VM
+
Use Cockpit or the command line
+
[source,]
[source,console]
----
[…]# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
[…]# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
--os-variant fedora37 --import --disk /var/lib/libvirt/images/vm-01.qcow2,format=qcow2,bus=virtio \
--network bridge=vbr1s0,model=virtio --network bridge=virbr0,model=virtio
----
@ -136,37 +136,37 @@ Complete the First Boot Sceen. Leave the network configuration as it is. It is e
8. Login to the VM and configure the public interface
+
[source,]
[source,console]
----
[…]# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
ipv4.gateway '148.251.152.29' ipv4.dns '213.133.98.98' ipv6.method 'manual' \
ipv6.addresses '2a01:4f8:210:512d::10/64' ipv6.gateway '2a01:4f8:210:512d::2' connection.id enp1s0
[…]# nmcli con up enp1s0
# nmcli con up enp1s0
----
9. If exist adjust the internal interface.
+
[source,bash]
----
[…]# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
[…]# nmcli con up enp2s0
# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
# nmcli con up enp2s0
----
10. Optionally reboot to reinitialize everything
+
[source,bash]
----
[…]# reboot
# reboot
----
=== Testing the configuration
1. Check the forwarding configuration
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 must be returned.
@ -176,9 +176,9 @@ SELinux should be in enforcing mode and firewalld active with zone FedoraServer
+
[source,bash]
----
[…]# getenforce
[…]# firewall-cmd --list-all
[…]# firewall-cmd --get-active-zones
# getenforce
# firewall-cmd --list-all
# firewall-cmd --get-active-zones
----
3. Check IPv6

258
modules/ROOT/pages/containerization/systemd-nspawn-setup.adoc
View file

@ -21,33 +21,33 @@ The systemd-nspawn tools like machinctl look for containers in `/var/lib/machine
Following the Fedora server storage scheme, create a logical volume, create a file system and mount it to `/var/lib/machines`. The tools can use BTRFS properties, so this can be used as a filesystem in this case.
If you don't want to follow the Fedora Server rationale, skip this step.
+
[source,]
[source,console]
----
[…]# dnf install btrfs-progs
[…]# lvcreate -L 20G -n machines {VGNAME}
[…]# mkfs.btrfs -L machines /dev/mapper/{VGNAME}-machines
[…]# mkdir /var/lib/machines
[…]# vim /etc/fstab
# dnf install btrfs-progs
# lvcreate -L 20G -n machines {VGNAME}
# mkfs.btrfs -L machines /dev/mapper/{VGNAME}-machines
# mkdir /var/lib/machines
# vim /etc/fstab
(insert)
/dev/mapper/{VGNAME}-machines /var/lib/machines auto 0 0
[…]# mount -a
# mount -a
----
2. *Check and, if necessary, correct the SELinux labels*
+
Ensure that the directory belongs to root and can only be accessed by root (should be done by the installer).
+
[source,]
[source,console]
----
[…]# restorecon -vFr /var/lib/machines
[…]# chown root:root /var/lib/machines
[…]# chmod 700 /var/lib/machines
# restorecon -vFr /var/lib/machines
# chown root:root /var/lib/machines
# chmod 700 /var/lib/machines
----
3. *Adding configuration for nspawn to the `etc/systemd` directory*
+
[source,]
[source,console]
----
[…]# mkdir /etc/systemd/nspawn
# mkdir /etc/systemd/nspawn
----
== 2. Creating a nspawn container
@ -58,18 +58,18 @@ The creation of a container filesystem or the provision of a corresponding image
1. Creating a BTRFS subvolume with the name of the container
+
[source,]
[source,console]
----
[…]# cd /var/lib/machines
[…]# btrfs subvolume create {ctname}
# cd /var/lib/machines
# btrfs subvolume create {ctname}
----
2. Creating a minimal container directory tree
+
**__Fedora 34 / 35__**
+
[source,]
[source,console]
----
[…]# dnf --releasever=35 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
# dnf --releasever=35 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
install dhcp-client dnf fedora-release glibc glibc-langpack-en glibc-langpack-de iputils less ncurses passwd systemd systemd-networkd systemd-resolved vim-default-editor
----
+
@ -78,9 +78,9 @@ F35 installs 174 packages (270M) and allocates 527M in the file system.
+
**__Fedora 36__**
+
[source,]
[source,console]
----
[…]# dnf --releasever=36 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
# dnf --releasever=36 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
install dhcp-client dnf fedora-release glibc glibc-langpack-en glibc-langpack-de iputils less ncurses passwd systemd systemd-networkd systemd-resolved util-linux vim-default-editor
----
+
@ -90,9 +90,9 @@ F36 installs 171 packages (247M) and allocates 550M in the file system.
+
First create a separate CentOS repository file (e.g. /root/centos.repo) and import CentOS keys.On this basis, perform a standard installation using DNF.
+
[source,]
[source,console]
----
[…]# vim /root/centos8.repo
# vim /root/centos8.repo
<insert>
[centos8-chroot-base]
name=CentOS-8-Base
@ -113,11 +113,11 @@ First create a separate CentOS repository file (e.g. /root/centos.repo) and impo
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
[…]# dnf install http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/Packages/centos-gpg-keys-8-2.el8.noarch.rpm
# dnf install http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/Packages/centos-gpg-keys-8-2.el8.noarch.rpm
[…]# rpm -Uvh --nodeps https:/dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
# rpm -Uvh --nodeps https:/dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
[…]# dnf -c /root/centos8.repo --releasever=8-stream --best --disablerepo=* --setopt=install_weak_deps=False --enablerepo=centos8-chroot-base --enablerepo=centos8-chroot-appstream --enablerepo=epel8-chroot --installroot=/var/lib/machines/{CTNAME} install centos-release dhcp-client dnf glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd systemd-networkd vim-enhanced
# dnf -c /root/centos8.repo --releasever=8-stream --best --disablerepo=* --setopt=install_weak_deps=False --enablerepo=centos8-chroot-base --enablerepo=centos8-chroot-appstream --enablerepo=epel8-chroot --installroot=/var/lib/machines/{CTNAME} install centos-release dhcp-client dnf glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd systemd-networkd vim-enhanced
----
+
@ -130,19 +130,19 @@ The message: `install-info: File or directory not found for /dev/null` appears s
+
This requires temporarily setting SELinux to permissive, otherwise passwd will not make any changes.
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# systemd-nspawn -D /var/lib/machines/{ctname} passwd
[…]# setenforce 1
# setenforce 0
# systemd-nspawn -D /var/lib/machines/{ctname} passwd
# setenforce 1
----
2. Provision of network interfaces for the container within the host
+
If only a connection to an internal, protected network is needed (replace the host bridge interface name accordingly):
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Network]
Bridge=vbr6s0
@ -150,9 +150,9 @@ If only a connection to an internal, protected network is needed (replace the ho
+
If a connection to the external, public network is also required, two corresponding interfaces must be provided, whereby a mac-vlan is used on the interface of the host for the external connection (again, replace the host interface names accordingly).
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Network]
MACVLAN=enp4s0
@ -161,9 +161,9 @@ If a connection to the external, public network is also required, two correspond
3. Configuration of the connection to the internal network within the container
+
[source,]
[source,console]
----
[…]# vim /var/lib/machines/{ctname}/etc/systemd/network/20-host0.network
# vim /var/lib/machines/{ctname}/etc/systemd/network/20-host0.network
(insert)
# {ctname}.localnet
# internal network interface via bridge
@ -186,9 +186,9 @@ If the internal network is also to be used for external access via NAT, the gate
+
In this case, the gateway entry _must_ be commented _out_ in the configuration of the internal network, as mentioned in item 3.
+
[source,]
[source,console]
----
[…]# vim /var/lib/machinec/{ctname}/etc/systemd/network/10-mv.network
# vim /var/lib/machinec/{ctname}/etc/systemd/network/10-mv.network
(insert)
# {ctname}.sowi.uni-bremen.de
# public interface via mac-vlan
@ -228,9 +228,9 @@ Don't forget to adjust interface names and IP addresses accordingly!
+
Check if container boots without error messages
+
[source,]
[source,console]
----
[…]# systemd-nspawn -D /var/lib/machines/{ctname} -b
# systemd-nspawn -D /var/lib/machines/{ctname} -b
OK Spawning container {ctname} on /var/l…01.
OK …
{ctname} login:
@ -239,33 +239,33 @@ Check if container boots without error messages
+
If inactive, activate and start the service.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-networkd
# systemctl status systemd-networkd
…
[…]# systemctl enable systemd-networkd
[…]# systemctl start systemd-networkd
[…]# systemctl status systemd-networkd
# systemctl enable systemd-networkd
# systemctl start systemd-networkd
# systemctl status systemd-networkd
----
7. Check if all network interfaces are available
+
[source,]
[source,console]
----
[…]# ip a
# ip a
----
8. Check for correct routing
+
[source,]
[source,console]
----
[…]# ip route show
# ip route show
----
9. Configure default DNS search path
+
Specify a search domain to appended to a unary hostname without domain part, usually the internal network domain name, e.g. example.lan. Adjust the config file according to the pattern below:
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/resolved.conf
# vim /etc/systemd/resolved.conf
[Resolve]
...
@ -279,49 +279,49 @@ Specify a search domain to appended to a unary hostname without domain part, usu
----
10. Check if name resolution is configured correctly
+
[source,]
[source,console]
----
[…]# ls -al /etc/resolv.conf
# ls -al /etc/resolv.conf
lrwxrwxrwx. 1 root root 39 29. Dez 12:15 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
----
+
If the file is missing or is a text file, correct it.
+
[source,]
[source,console]
----
[…]# cd /etc
[…]# rm -f resolv.conf
[…]# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
[…]# ls -al /etc/resolv.conf
[…]# cd
# cd /etc
# rm -f resolv.conf
# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
# ls -al /etc/resolv.conf
# cd
----
+
Ensure that systemd-resolved service is enabled.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-resolved
# systemctl status systemd-resolved
----
+
Activate the service if necessary.
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-resolved
# systemctl enable systemd-resolved
----
11. Set the intended hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
[…]# hostnamectl set-hostname <FQDN>
# hostnamectl
# hostnamectl set-hostname <FQDN>
----
12. Terminate the container
+
[source,]
[source,console]
----
[…]# <CTRL>+]]]
# <CTRL>+]]]
Container <CTNAME> terminated by signal KILL.
----
@ -331,19 +331,19 @@ Activate the service if necessary.
+
This requires temporarily setting SELinux to permissive, otherwise passwd will not make any changes.
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# systemd-nspawn -D /var/lib/machines/{ctname} passwd
[…]# setenforce 1
# setenforce 0
# systemd-nspawn -D /var/lib/machines/{ctname} passwd
# setenforce 1
----
2. Configuration of container properties
+
Specifying private user configuration and shared network access.
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Exec]
PrivateUsers=false
@ -355,9 +355,9 @@ Specifying private user configuration and shared network access.
+
Check if container boots without error messages
+
[source,]
[source,console]
----
[…]# systemd-nspawn -b -D /var/lib/machines/{ctname}
# systemd-nspawn -b -D /var/lib/machines/{ctname}
OK Spawning container {ctname} on /var/l…01.
OK …
{ctname} login:
@ -366,32 +366,32 @@ Check if container boots without error messages
+
If active, deactivate the service.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-networkd
# systemctl status systemd-networkd
…
[…]# systemctl disable systemd-networkd
[…]# systemctl stop systemd-networkd
[…]# systemctl status systemd-networkd
[…]# systemctl status systemd-resolved
# systemctl disable systemd-networkd
# systemctl stop systemd-networkd
# systemctl status systemd-networkd
# systemctl status systemd-resolved
…
[…]# systemctl disable systemd-resolved
[…]# systemctl stop systemd-resolved
[…]# systemctl status systemd-resolved
# systemctl disable systemd-resolved
# systemctl stop systemd-resolved
# systemctl status systemd-resolved
----
+
If file /etc/resolv.conf is a link, remove it.
+
[source,]
[source,console]
----
[…]# rm /etc/resolv.conf
# rm /etc/resolv.conf
----
+
Create (or edit an existing) file /etc/resolv.conf
+
[source,]
[source,console]
----
[…]# vim /etc/resolv.conf
# vim /etc/resolv.conf
nameserver 127.0.0.53
options edns0 trust-ad
@ -399,33 +399,33 @@ search <YOUR_DOMAIN>
----
5. Check if all network interfaces are available
+
[source,]
[source,console]
----
[…]# ip a
# ip a
----
+
You should see the same interfaces and IP addresses as on the host system.
6. Check if name resolution is working correctly
+
[source,]
[source,console]
----
[…]# ping spiegel.de
# ping spiegel.de
PING spiegel.de (128.65.210.8) 56(84) bytes of data.
64 bytes from 128.65.210.8 (128.65.210.8): icmp_seq=1 ttl=59 time=19.8 ms
...
----
7. Set the intended hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
[…]# hostnamectl set-hostname <FQDN>
# hostnamectl
# hostnamectl set-hostname <FQDN>
----
8. Terminate the container
+
[source,]
[source,console]
----
[…]# <CTRL>+]]]
# <CTRL>+]]]
Container <CTNAME> terminated by signal KILL.
----
@ -435,11 +435,11 @@ You should see the same interfaces and IP addresses as on the host system.
+
In this step, a separate UID/GID range is automatically created for the container.
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-nspawn@{ctname}
[…]# systemctl start systemd-nspawn@{ctname}
[…]# systemctl status systemd-nspawn@{ctname}
# systemctl enable systemd-nspawn@{ctname}
# systemctl start systemd-nspawn@{ctname}
# systemctl status systemd-nspawn@{ctname}
----
+
On first boot after installing systemd-container, a SELinux bug currently (Fedora 34/35) blocks execution. The solution is to fix the SELinux label(s).
@ -451,10 +451,10 @@ On first boot after installing systemd-container, a SELinux bug currently (Fedor
+
The proposed solution is roughly as follows:
+
[source,]
[source,console]
----
[…]# ausearch -c 'systemd-machine' --raw | audit2allow -M my-systemdmachine
[…]# semodule -i my-systemdmachine.pp
# ausearch -c 'systemd-machine' --raw | audit2allow -M my-systemdmachine
# semodule -i my-systemdmachine.pp
----
* The operation must be repeated until no SELinux error is reported and the container starts as a service.
+
@ -462,18 +462,18 @@ Alternatively, the SELinux CLI tool can be used, which also suggests these solut
2. Enable automatic start of the container at system startup
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-nspawn@{ctname}
[…]# systemctl status systemd-nspawn@{ctname}
# systemctl enable systemd-nspawn@{ctname}
# systemctl status systemd-nspawn@{ctname}
----
3. Log in to the container
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# machinectl login {ctname}
# setenforce 0
# machinectl login {ctname}
----
+
When machinectl is called with parameters for the first time, an SELinux bug (Fedora 34/35) also blocks execution. The correction is done in the same way as for the container start.
@ -488,18 +488,18 @@ In case of a CentOS 8-stream container, the epel repository should be installed
+
After finishing all further work inside the container press <ctrl>]]] ( Mac: <ctrl><alt>666) to exit the container and reactivate SELinux.
+
[source,]
[source,console]
----
[…]# setenforce 1
# setenforce 1
----
=== 3.1 Autostart of the container on reboot of the host
An autostart of the container in the "enabled" state fails on Fedora 35 and older. The cause can be seen in a status query after rebooting the host, which issues an error message according to the following example:
[source,]
[source,console]
----
[…]# systemctl status systemd-nspawn@CT_NAME
# systemctl status systemd-nspawn@CT_NAME
systemd-nspawn[802]: Failed to add interface vb-{CT_NAME} to bridge vbr6s0: No such device
----
@ -509,9 +509,9 @@ This means that systemd starts the container before all required network interfa
1. The service file requires an amendment (Bug #2001631). In section [Unit], for the `Wants=` and `After=` configurations, add a target `network-online.target` at the end of each line. The file must then look like this (ignore the commented out marker rows):
+
[source,]
[source,console]
----
[…]# systemctl edit systemd-nspawn@ --full
# systemctl edit systemd-nspawn@ --full
...
[Unit]
Description=Container %i
@ -530,9 +530,9 @@ Important is the character "@" after `nspawn`! In the opening editor make the in
2. Then execute
+
[source,]
[source,console]
----
[…]# systemctl daemon-reload
# systemctl daemon-reload
----
At the next reboot the containers will be started automatically.
@ -541,10 +541,10 @@ At the next reboot the containers will be started automatically.
For such interfaces (usually the bridge virbr0) the addition mentioned above does not help. The container must be started by script in an extra step after Libvirt initialization is complete. For this you can use a hook that Libvirt provides.
[source,]
[source,console]
----
[…]# mkdir -p /etc/libvirt/hooks/network.d/
[…]# vim /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
# mkdir -p /etc/libvirt/hooks/network.d/
# vim /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
(INSERT)
#!/bin/bash
# Check defined nspawn container in /var/lib/machines and
@ -589,7 +589,7 @@ if [ "$network" == "default" ]; then
fi
fi
[…]# chmod +x /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
# chmod +x /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
----
You may also use the link:{attachmentsdir}/nspawn-autostart-libvirt-hook.tgz[attached script] instead of typing.
@ -603,20 +603,20 @@ For dnf / rpm queries the error message is displayed:
The cause is that Fedora's dfn, which is used for the installation, uses sqlite while CentOS/RHEL use the Berkeley (bdb) format.
Check configuration within the running container:
[source,]
[source,console]
----
[…]# rpm -E "%{_db_backend}"
# rpm -E "%{_db_backend}"
----
The output must be `bdb`. Then fix it executing
[source,]
[source,console]
----
[…]# rpmdb --rebuilddb
# rpmdb --rebuilddb
----
=== 4.2 Error message dev-hugepages
You will find message such as
[source,]
[source,console]
----
dev-hugepages.mount: Mount process exited, code=exited, status=32/n/a
dev-hugepages.mount: Failed with result 'exit-code'.
@ -632,9 +632,9 @@ The messages can be safely ignored.
Some packages, e.g. the `filesystem` package, may not get updated in a container (error message "Error: Transaction failed"), see also https://bugzilla.redhat.com/show_bug.cgi?id=1548403 and https://bugzilla.redhat.com/show_bug.cgi?id=1912155.
Workaround: Run before update:
[source,]
[source,console]
----
[…]# echo '%_netsharedpath /sys:/proc' > /etc/rpm/macros.netshared
# echo '%_netsharedpath /sys:/proc' > /etc/rpm/macros.netshared
----
When an update has already been performed, execute this command and update the package again.

22
modules/ROOT/pages/index.adoc
View file

@ -110,37 +110,37 @@ Fedora 43 updates Postgresql from version 16 directly to version 18, skipping on
+
[source]
----
[…]$ systemctl status postgresql
[…]$ sudo tar -cvJf /var/lib/pgsql/backups/postgres16-bak.tzx /var/lib/pgsql/data/
$ systemctl status postgresql
$ sudo tar -cvJf /var/lib/pgsql/backups/postgres16-bak.tzx /var/lib/pgsql/data/
----
2. Replace installed version 18 by version 17 und use it to update your database
+
[source]
----
[…]$ sudo dnf install postgresql17-server postgresql17-upgrade --allowerasing
[…]$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
$ sudo dnf install postgresql17-server postgresql17-upgrade --allowerasing
$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
----
3. Stop postgres and activate checksums which is a new default in version 18
+
[source]
----
[…]$ systemctl stop postgresql
[…]$ sudo -u postgres pg_checksums -D /var/lib/pgsql/data -e -P
$ systemctl stop postgresql
$ sudo -u postgres pg_checksums -D /var/lib/pgsql/data -e -P
----
4. Reinstall version 18 and update the data again
+
[source]
----
[…]$ mv /var/lib/pgsql/data_old /var/lib/pgsql/data_old_16
[…]$ sudo dnf install postgresql-server postgresql-upgrade --allowerasing
[…]$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
$ mv /var/lib/pgsql/data_old /var/lib/pgsql/data_old_16
$ sudo dnf install postgresql-server postgresql-upgrade --allowerasing
$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
----
5. Start postgresql und check if everything works again
+
[source]
----
[…]$ sudo systemctl start postgresql
[…]$ sudo systemctl status postgresql
$ sudo systemctl start postgresql
$ sudo systemctl status postgresql
----
6. Execute the maintenance steps as recommended by the update program and fix collation issues if exist.
7. Done

22
modules/ROOT/pages/installation/index.adoc
View file

@ -104,12 +104,12 @@ In the former case, navigate your browser to _https://fedoraproject.org/server/
In the latter, navigate to the directory where you want to keep the files. We will assume your home directory here. For x86_64 systems, type the following commands line by line.
----
[…]$ mkdir -p ~/tmp && cd ~/tmp
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
[…]$ wget https://fedoraproject.org/fedora.gpg
[…]$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
[…]# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
$ mkdir -p ~/tmp && cd ~/tmp
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
$ wget https://fedoraproject.org/fedora.gpg
$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
Fedora-Server-dvd-x86_64-41-1.4.iso: OK
sha256sum: WARNING: 17 lines are improperly formatted
----
@ -124,19 +124,19 @@ A installation on bare metal requires to transfer the installation file to a boo
. As a (hard core) server sysadmin to be, you might prefer a fast and efficient CLI tool, the `dd` command. If you are already in a terminal window, connect the USB stick and enter the following command to get a list of connected devices.
+
[source,]
[source,console]
----
[…]# lsblk
# lsblk
----
+
Determine the USB device, e.g. `/dev/sdc`
+
Just in case, umount the device and transfer the downloaded installation file to the device in one go. On the above example use
+
[source,]
[source,console]
----
[…]$ sudo umount /dev/sdc*
[…]$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
$ sudo umount /dev/sdc*
$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
----
+
Of course, adjust file and device accordingly! You may receive an error message about parameter `status=progress` not supported. Then you still have an older dd version and have to leave that option off.

2
modules/ROOT/pages/installation/interactive-local.adoc
View file

@ -150,7 +150,7 @@ Fedora uses a GPT partitioning scheme. Thus, on a BIOSboot system you must add a
Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
[source,]
[source,console]
----
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
----

14
modules/ROOT/pages/installation/interactive-remote.adoc
View file

@ -104,7 +104,7 @@ List the connected devices and identify the USB stick
+
[source,bash]
----
[…]$ lsblk
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 596.2G 0 disk
├─sda1 8:1 0 600M 0 part /boot/efi
@ -123,9 +123,9 @@ In the example above, the USB stick is sdb. Just in case it is mounted, unmount
+
[source,bash]
----
[…]$ sudo umount /dev/sdb1
[…]$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
[…]$ sudo mount /dev/sdb1 /mnt
$ sudo umount /dev/sdb1
$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
$ sudo mount /dev/sdb1 /mnt
----
@ -135,7 +135,7 @@ If possible, you should provide a static network configuration, so you'll know t
+
[source,bash]
----
[…]$ sudo vim /mnt/ks.cfg
$ sudo vim /mnt/ks.cfg
<INSERT>
network --bootproto=static --ip=ww.xx.yy.zz --netmask=255.255.255.0 --gateway=ww.xx.yy.gg --ipv6='aaaa:bbbb:cccc:dddd:eeee:ffff:gggg:hhhh/nnn' --hostname='myhost.mydomain.tld' --nameserver=10.0.2.1
rdp --user='SOME_NAME' --password=PASSWORD
@ -163,8 +163,8 @@ b. Scan the network subnet the server is connected to for open port 3389. Adjust
+
[source,bash]
----
[…]# dnf install nmap
[…]# nmap -Pn -p3389 192.168.158.0/24
# dnf install nmap
# nmap -Pn -p3389 192.168.158.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-23 08:18 CEST
Nmap scan report for example.com (192.168.158.1)
Host is up (0.00052s latency).

136
modules/ROOT/pages/installation/postinstallation-tasks.adoc
View file

@ -79,9 +79,9 @@ a. Execute on the local desktop
+
[source]
----
[…]$ mkdir ~/.ssh
[…]$ cd ~/.ssh
[…]$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
$ mkdir ~/.ssh
$ cd ~/.ssh
$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
----
Although the type rsa is widely used, you may adjust your key type accordingly.
@ -92,50 +92,50 @@ You normally use _ssh-copy-id_ to install the public key on the server. However,
a. Log in to your server via sftp using the unprivileged administration account and transfer the public key file
+
[source,]
[source,console]
----
[…]$ sftp hostmin@example.com
$ sftp hostmin@example.com
sftp> put ~/.ssh/<outputkeyfile>.pub
sftp> quit
----
b. Log in to your server via ssh using the unprivileged administration account again
+
[source,]
[source,console]
----
[…]$ ssh hostmin@example.com
$ ssh hostmin@example.com
----
c. On the server acquire root permissions, move the key file and adjust permissions
+
[source,]
[source,console]
----
[…]$ sudo su -
[…]# mkdir /root/.ssh
[…]# cd /root/.ssh
[…]# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
[…]# chown -R root:root /root/.ssh
[…]# chmod 700 /root/.ssh
[…]# chmod 600 ~/.ssh/*
[…]# restorecon -R -vF /root/.ssh
$ sudo su -
# mkdir /root/.ssh
# cd /root/.ssh
# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
# chown -R root:root /root/.ssh
# chmod 700 /root/.ssh
# chmod 600 ~/.ssh/*
# restorecon -R -vF /root/.ssh
----
=== Test and Simplify Access
a. On your local workstation test key file based access:
+
[source,]
[source,console]
----
[…]# ssh -i ~/.ssh/<outputkeyfile> root@example.com
# ssh -i ~/.ssh/<outputkeyfile> root@example.com
----
+
adjust file, file type, and domain name as appropriate.
b. To simplify access create a configuration file on your desktop and define a short name for the connection:
+
[source,]
[source,console]
----
[…]# vi ~/.ssh/config
# vi ~/.ssh/config
# ###########################################################
# my remote server, root account
# ###########################################################
@ -154,9 +154,9 @@ again, replace names accordingly.
c. Check if everything works:
+
[source,]
[source,console]
----
[…]# ssh myhost
# ssh myhost
----
== Double check hostname and time synchronisation
@ -165,40 +165,40 @@ Both are important for trouble-free server operation. Just in case you missed it
a. Check for correct hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
# hostnamectl
----
* Set hostname if required:
+
[source,]
[source,console]
----
[…]# hostnamectl set-hostname <YourFQDN>
# hostnamectl set-hostname <YourFQDN>
----
b. Control of time zone, time synchronisation, time
+
[source,]
[source,console]
----
[…]# timedatectl
# timedatectl
----
* Correct time zone if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-timezone <ZONE>
# timedatectl set-timezone <ZONE>
----
* If necessary, activate time synchronisation:
+
[source,]
[source,console]
----
timedatectl set-ntp true
----
* Correct time if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-time <TIME>
# timedatectl set-time <TIME>
----
== Consolidate network configuration
@ -209,22 +209,22 @@ It sounds trivial, but before any change of the network configuration make sure
a. Check IP addresses, interface and which protocol stack is used
+
[source,]
[source,console]
----
[…]# ip a
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n
...
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER
...
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
enp3s0 dabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet enp3s0
[…]# who am i
# who am i
root pts/5 2021-04-09 21:07 (2003:ca:7f05:xx00:yyyy:zzzz:479a:b36e)
[…]# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
=====================================================================
Connection details (enp3s0)
=====================================================================
@ -238,50 +238,50 @@ ipv6.method: manual
b. Just in case IPv6 is configured as local only (fe80::....) or not static, you may set up a fixed IPv6
+
[source,]
[source,console]
----
[…]# nmcli con mod 'enp3s0' ipv6.method manual \
# nmcli con mod 'enp3s0' ipv6.method manual \
ipv6.addresses <YOUR_IPv6_PREFIX>::2/64 \
ipv6.gateway fe80::1 \
ipv6.dns "2a01:4f8:xx:yy::zzz:8888 2a01:4f8:xx:yy::zzz:9999"
[…]# nmcli con up 'enp3s0'
[…]# nmcli con reload
# nmcli con up 'enp3s0'
# nmcli con reload
----
+
Again, don't forget to adjust names, prefix, and DNS IP addresses. Pay special attention to the gateway. Using a local address of 1 (fe80::1) is a widely used convention.Another is the IPV6 prefix with the address 1. But each provider may have an even different approach.
+
Check connectivity from your local workstation. If that fails, the gateway configuration is the first suspected culprit.
+
[source,]
[source,console]
----
[…]# ping6 <YOUR_IPv6_PREFIX>::2
[…]# # e.g. ping6 2a01:xxx:yyy:zzz::2
# ping6 <YOUR_IPv6_PREFIX>::2
# # e.g. ping6 2a01:xxx:yyy:zzz::2
----
c. Optionally reconfigure IPv4 as static. But make sure the IPv6 address works and don't change both protocol stacks at the same time (and in the worst case drop connectivity at all):
+
[source,]
[source,console]
----
[…]# nmcli con mod 'enp3s0' ipv4.method manual \
# nmcli con mod 'enp3s0' ipv4.method manual \
ipv4.addresses <YOUR_IPv4>/27 \
ipv4.gateway <GATEWAY> \
ipv4.dns "<DNS1_IPv4> <DNS2_IPv4>"
[…]# nmcli con up'enp3s0'
[…]# nmcli con reload
# nmcli con up'enp3s0'
# nmcli con reload
----
+
Again, don't forget to adjust names, prefix, and DNS IP addresses and check connectivity from your local workstation:
+
[source,]
[source,console]
----
[…]# ping <YOUR_IPv4>
# ping <YOUR_IPv4>
----
d. Optionally you may have a look at the NetworkManager configuration file
+
[source,]
[source,console]
----
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
----
Finally reboot now to check everything from ground up
@ -295,26 +295,26 @@ With Fedora 39 the default LVM configuration has changed. The various LVM manage
Listing the registered devices::
Check the list to see whether all expected devices are included, but also whether each device should actually be part of the current system.
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices
$ sudo lvmdevices
Device /dev/sda3 IDTYPE=sys_wwid IDNAME=naa.5000000000000000 DEVNAME=/dev/sda3 PVID=IoUGXYfv74B3YrmCoPfh9ZsWZsDrVKAN PART=3
----
Adding a device (permanently)::
This modifies the devices file in /etc/lvm/devices
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices --adddev /dev/<PART>
$ sudo lvmdevices --adddev /dev/<PART>
----
Removing a device (permanently)::
This modifies the devices file in /etc/lvm/devices
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices --deldev /dev/<PART>
$ sudo lvmdevices --deldev /dev/<PART>
----
@ -357,29 +357,29 @@ The software checks log files for anomalies and compiles a daily report that can
a. Install software
+
[source,]
[source,console]
----
[…]# dnf install logwatch
# dnf install logwatch
----
b. The only configuration required is to enter a real email address for root, the recipient of the report. It is added at the end of the file.
+
[source,]
[source,console]
----
[…]# vi /etc/aliases
# vi /etc/aliases
...
# Person who should get root's mail
#root: marc
root: real@address.for.root
[…]# newaliases
# newaliases
----
== Disable systemd-resolved LLMNR and/or mDNS
You may want to disable LLMNR and/or mDNS depending on your environment. Both protocols are subject to trivial DNS poisoning attacks by a rogue responder.
[source,]
[source,console]
-----
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo touch /etc/systemd/resolved.conf.d/20-disable-llmnr-mdns.conf
@ -408,10 +408,10 @@ include::partial$installation/post-install/manage-dnf-updates.adoc[]
== Finally update system and install additional software
Now that secure administrative access is in place, it's time to update the system and install some useful software. Of course, 'useful software' varies depending on the use case or applications that will be run on Fedora Server. Anyway, a good choice might be vim. With vimdiff e.g. a comparison of updates of configuration files (*.rpmnew) is very comfortable and straightforward.
[source,]
[source,console]
----
[…]# dnf install vim-default-editor --allowerasing
[…]# dnf update
# dnf install vim-default-editor --allowerasing
# dnf update
----
Add to the software list as needed.

2
modules/ROOT/pages/installation/sw-raid-upon-installation.adoc
View file

@ -20,7 +20,7 @@ Before you start with partitioning, you have to determine the boot type of your
NOTE: Just in case you need a DOS/MBR partitioning scheme for some good reason, you can override the GPT default by adding "inst.mbr" to the kernel boot parameter at the initial boot screen.
If you don't know the type of your system for sure, you can check the system now. Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
[source,]
[source,console]
----
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
----

70
modules/ROOT/pages/server-on-sbc/uboot-installation.adoc
View file

@ -82,17 +82,17 @@ Here we describe the basic steps for creating a customized boot medium (SD card
+
[source,bash]
----
[…]$ sudo dnf -y install arm-image-installer uboot-images-armv8.noarch
$ sudo dnf -y install arm-image-installer uboot-images-armv8.noarch
----
2. Set the download directory as default, fetch a Fedora Server aarch64 system disk raw image, here F43, and check the integrity of the download.
+
[source,bash]
----
[…]$ cd ~/Downloads
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-43-1.6-aarch64-CHECKSUM
[…]$ sha256sum -c *-CHECKSUM --ignore-missing
$ cd ~/Downloads
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-43-1.6-aarch64-CHECKSUM
$ sha256sum -c *-CHECKSUM --ignore-missing
Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz: OK
sha256sum: WARNING: 17 lines are improperly formatted
----
@ -103,7 +103,7 @@ The result message includes a complain about some not correct formated lines. It
+
[source,text]
----
[…]$ lsblk
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 596,2G 0 disk
├─sda1 8:1 0 600M 0 part /boot/efi
@ -122,14 +122,14 @@ zram0 252:0 0 7,5G 0 disk [SWAP]
+
[source,bash]
----
[…]$ sudo umount /dev/mmcblk0p1
$ sudo umount /dev/mmcblk0p1
----
5. Identify the name of the support files for your board
+
[source,bash]
----
[…]$ sudo arm-image-installer --supported
$ sudo arm-image-installer --supported
AllWinner Devices:
A10-OLinuXino-Lime A10s-OLinuXino-M A13-OLinuXino A13-OLinuXinoM A20-OLinuXino-Lime A20-OLinuXino-Lime2
A20-OLinuXino-Lime2-eMMC A20-OLinuXino_MICRO A20-Olimex-SOM-EVB Ampe_A76 Auxtek-T003 Auxtek-T004 Bananapi
@ -152,7 +152,7 @@ If you don't find your board, check the _boards.d_ directory directly just in ca
+
[source,bash]
----
[…]$ ls -al /usr/share/arm-image-installer/boards.d | less
$ ls -al /usr/share/arm-image-installer/boards.d | less
----
+
As an example., you will find the PINE64 "ROCKPro64" model as "rockpro64-rk3399"
@ -161,14 +161,14 @@ As an example., you will find the PINE64 "ROCKPro64" model as "rockpro64-rk3399"
+
[source,bash]
----
[…]$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --media=/dev/mmcblk0
$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --media=/dev/mmcblk0
----
+
Just in case you already decided to fill the complete space on disk with the root file system and to dispense with segmentation, you may add the resizefs parameter which would result in an _alternative command line_:
+
[source,bash]
----
[…]$ arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --resizefs --media=/dev/mmcblk0
$ arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --resizefs --media=/dev/mmcblk0
----
+
Remember, this is definitely _not a recommended option_ for serious production server operation!
@ -186,7 +186,7 @@ At the SBC terminal, we perform only the minimum, absolutely necessary configura
2. Connect monitor, keyboard and network cable, insert the micro SD card.
3. Connect the SBC to power and wait. After some time a lot of messages scroll across the screen. If the network interface doesn't provide DHCP, in includes a NetworkManager error message. You can safely ignore it for now. It finally ends with a simple, text-based input mask for the first boot configuration.
+
[source,]
[source,console]
----
SoC Rockchip rk3399
Reset cause: POR
@ -214,7 +214,7 @@ The menu is quite simple and a bit old-fashioned, but effective and straightforw
4. The most important item is the configuration of an admin user and their password. Type 5 to enter the submenu.
+
[source,]
[source,console]
----
================================================================================
================================================================================
@ -291,8 +291,8 @@ b. If you are a non-US keyboard user, configure your keyboard mapping. Fist list
+
[source,bash]
----
[…]$ localectl list-keymaps
[…]$ sudo localectl setkeymap de-nodeadkeys
$ localectl list-keymaps
$ sudo localectl setkeymap de-nodeadkeys
----
+
The mapping is imediately active.
@ -301,20 +301,20 @@ c. Configure and activate the network. Adjust the IP, gateway and network settin
+
First, check the existing interfaces.
+
[source,]
[source,console]
----
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
'Wired connection 2' 8d971f49-033f-398a-9714-3a4e848178fb ethernet enp2s0
----
+
Most likely your interfaces are named somewhat awkward way. Let's fix that to make administration of network easier and more comfortable. Don't forget to adjust the naming to your specific installation!
+
[source,]
[source,console]
----
[…]$ sudo nmcli con mod 'Wired connection 1' connection.id end0
$ sudo nmcli con mod 'Wired connection 1' connection.id end0
[…]$ sudo nmcli con mod end0 \
$ sudo nmcli con mod end0 \
ipv4.method manual \
ipv4.address "xxx.xxx.xxx.xxx/yy" \
ipv4.gateway "xxx.xxx.xxx.zzz" \
@ -325,8 +325,8 @@ Most likely your interfaces are named somewhat awkward way. Let's fix that to ma
ipv6.dns "xxxx.xxxx.xxxx.xxxx::vvv" \
connection.zone "FedoraServer"
[…]$ sudo nmcli con up end0
[…]$ sudo systemctl restart NetworkManager
$ sudo nmcli con up end0
$ sudo systemctl restart NetworkManager
----
d. Reboot. You can then disconnect monitor and keyboard. The next steps all happen on the desktop.
@ -405,7 +405,7 @@ Any of the alternatives as above start with the same administrative tasks.
+
[source,bash]
----
[…]$ sudo cfdisk /dev/mmcblk1
$ sudo cfdisk /dev/mmcblk1
----
4. Select partition 3 (Type 8e Linux LVM) using <Cursor down> and then Resize using <Curser left>
+
@ -423,7 +423,7 @@ Select "Write", confirm resizing and quit the program.
+
[source,bash]
----
[…]$ sudo pvresize /dev/mmcblk1p3
$ sudo pvresize /dev/mmcblk1p3
Physical volume "/dev/mmcblk1p3" changed
1 physical volume(s) resized or updated / 0 physical volume(s) not resized
----
@ -440,9 +440,9 @@ For *alternative 3.* select "Grow" and expand the volume to a size that still le
9. Go back to the terminal.
+
[source,]
[source,console]
----
[…]$ sudo df -h
$ sudo df -h
----
+
Confirm that the size of the root file system is now of the specified value.
@ -463,8 +463,8 @@ Because in this case Cockpit is started and active on the device, use your Fedor
+
[source,bash]
----
[…]$ sudo dnf install nmap
[…]$ sudo nmap -Pn -p9090 192.168.158.0/24
$ sudo dnf install nmap
$ sudo nmap -Pn -p9090 192.168.158.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2023-03-23 08:18 CEST
Nmap scan report for fritz.box (192.168.158.1)
Host is up (0.00052s latency).
@ -513,9 +513,9 @@ Beforehand you need to create pair of SSH keys if not already exist. It is best
+
[source,bash]
----
[…]$ cd
[…]$ mkdir ~/.ssh
[…]$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f ~/.ssh/<outputkeyfile>
$ cd
$ mkdir ~/.ssh
$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f ~/.ssh/<outputkeyfile>
----
+
As an example you may use the name "__id_mysbc_rsa__". Although the type rsa is widely used, you may adjust your key type accordingly.
@ -524,8 +524,8 @@ Turn off the SBC, remove the SD card and connect it to your desktop again as in
+
[source,bash]
----
[…]$ cd
[…]$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro-rk3399 --addkey=~/.ssh/id_mysbc_rsa.pub --media=/dev/mmcblk0
$ cd
$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro-rk3399 --addkey=~/.ssh/id_mysbc_rsa.pub --media=/dev/mmcblk0
----
+
When the process has finished, reinstall the CD card in the SBC, and connect to power to start the device again.
@ -534,8 +534,8 @@ Ping the address and as soon as you are connected, use ssh to log in.
+
[source,bash]
----
[…]$ ping 192.168.158.120
[…]$ ssh -i .ssh/id_mysbc_rsa root@192.168.158.172
$ ping 192.168.158.120
$ ssh -i .ssh/id_mysbc_rsa root@192.168.158.172
----
+
You can now create an user account, set the password and add it to group wheel to grant administrative sudo privileges.

5
modules/ROOT/pages/services/filesharing-nfs-installation.adoc
View file

@ -228,7 +228,7 @@ You can use both options in parallel with the grand configuration file read in f
=== Configuration by example
Example 1::
Example ::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
[source,]
@ -238,6 +238,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
/srv/nfs/common *(rw,sync)
----
<<<<<<< HEAD
Example 2::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
@ -278,6 +279,8 @@ Export the directory /srv/nfs/projects with all users of a specific network devi
/srv/nfs/common *(rw,sync)
----
=======
>>>>>>> maartenl-maartenl-patch-1
==== Connection options
Each default for every exported file system must be explicitly overridden. For example, if the rw option is not specified, then the exported file system is shared as read-only.

12
modules/ROOT/pages/services/httpd-basic-setup.adoc
View file

@ -41,9 +41,9 @@ But in all cases you need a more appropriate alternative data organization. The
_One option_ is to use the `/var/www/` directory to create domain-specific subdirectories and additional appropriate subdirectory within. The advantage of this procedure is that it uses many default httpd configurations, e.g. the SELinux labels. The disadvantage is that the default configuration of the distribution is modified. It is generally better to leave this untouched.
__An alternative option__, in many cases a better fit to FHS compliance is the `/srv` directory. Today you would have many Domains, which are served by one or more applications. According to the FHS, the `/srv` directory is the appropriate place for storing data. You create a domain-specific directory, e.g. example.com, and therein a `htdocs` subdirectory for static html files, a `webapps` subdirectory for your web applicaion, e.g Ruby on Rails, a `mail` subdirectory for a postfix/dovecot mail hub, etc.
__An alternative option__, in many cases a better fit to FHS compliance is the `/srv` directory. Today you would have many Domains, which are served by one or more applications. According to the FHS, the `/srv` directory is the appropriate place for storing data. You create a domain-specific directory, e.g. example.com, and therein a `htdocs` subdirectory for static html files, a `webapps` subdirectory for your web application, e.g Ruby on Rails, a `mail` subdirectory for a postfix/dovecot mail hub, etc.
In this guide we use the latter option. Therefore, we use directories like `/srv/<DOMAINNAME>/` to store all data relevant to a domain, and `/srv/<DOMAINMANE>/htdocs/` for static HTML pages. If you want to use the former option, you can replace `/srv/` by `/var/www/`.
In this guide we use the latter option. Therefore, we use directories like `/srv/<DOMAINNAME>/` to store all data relevant to a domain, and `/srv/<DOMAINNAME>/htdocs/` for static HTML pages. If you want to use the former option, you can replace `/srv/` by `/var/www/`.
== Storage preparation
@ -102,10 +102,10 @@ As discussed above there are several options. In this example we use the /srv al
[source,]
----
[…]$ sudo -i
[…]# mkdir -p /srv/SITENAME/htdocs
[…]# mkdir -p /srv/SITENAME/htdocs
----
+
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITEMANE/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITENAME/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
+
With /srv/ as the base directory you must adjust the SELinux labels.
+
@ -195,11 +195,11 @@ Edit the copied template file and adjust it as appropriate.
# We rely on Fedora's systemwide configuration of SSL security.
# By default, certificates are managed by Apache md module (see above)
# In this case, no certificates needs bo be configured here.
# In this case, no certificates needs to be configured here.
# Otherwise, insert proper certificate configuration.
# DEFAULT mod_ssl provided, needed for initial startup.
#==> Comment OUT when module md created a certificate or you use
#==> Comment OUT when module md created a certificate or you use
# custom certificates.
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

88
modules/ROOT/pages/tutorials/imagefactory.adoc
View file

@ -49,9 +49,9 @@ _Nested virtualization_ should already work in Fedora, check as described in xre
3. Ensure the _Guestfish suite is installed_ to get the utilities to access and modify generated disk image files. If you follow xref:virtualization/installation.adoc[Adding Virtualization Support] exactly, it is. Otherwise install it.
+
[source,]
[source,console]
----
[…]$ sudo dnf install guestfs-tools
$ sudo dnf install guestfs-tools
----
+
Check to really install `guestfs-tools`, not `libguestfs-tools` (unless you need additional windows guests related software).
@ -87,33 +87,33 @@ image::tutorials/imagefactory-kvm/059-list-volumes-en.png[Cockpit list volumes]
2. _Install Imagefactory_
+
[source,]
[source,console]
----
[…]$ sudo dnf install imagefactory imagefactory-plugins* pykickstart
$ sudo dnf install imagefactory imagefactory-plugins* pykickstart
----
+
This installs about 209 packages (in F38). To be sure, check and restore the SELinux labels for the installation directories.
+
[source,]
[source,console]
----
[…]$ sudo /sbin/restorecon -R -vF /var/lib/imagefactory
[…]$ sudo /sbin/restorecon -R -vF /var/lib/oz
$ sudo /sbin/restorecon -R -vF /var/lib/imagefactory
$ sudo /sbin/restorecon -R -vF /var/lib/oz
----
3. _Adjust Imagefactory configuration_
a. __Enlarge the amount of working memory__ for OZ, the backend used by ImageFactory.
+
[source,]
[source,console]
----
[…]$ sudo sed -i -e 's/# memory = 1024/memory = 2048/' /etc/oz/oz.cfg
$ sudo sed -i -e 's/# memory = 1024/memory = 2048/' /etc/oz/oz.cfg
----
b. Optional: _Switch the image output format_ from the default "raw" type to qcow2 to save disk space. If you have plenty thereof, leave it as is.
+
[source,]
[source,console]
----
[…]$ sudo vim /etc/oz/oz.cfg
$ sudo vim /etc/oz/oz.cfg
(edit)
#image_type = raw
image_type = qcow2
@ -122,9 +122,9 @@ image_type = qcow2
=== Set up a working directory
At a convenient location, create a directory where you will store all your working files, for example, in your home directory.
[source,]
[source,console]
----
[…]$mkdir ~/imagefactory
$ mkdir ~/imagefactory
----
It will primarly used to store the kickstart and the template files. You may use your personal accout and use sudo for all commands. However, it is more convenient to work as root. However, this is only advisable in a dedicated VM as explained above.
@ -135,17 +135,17 @@ The kickstart file describes the content of the disk image to create. Fetch the
1. Fetch the link:{attachmentsdir}/tutorials/imagefactory/fedora-server-kvm-dev.ks[basic kickstart file] and store it into this working directory. In many cases klicking the link stores the file into you default download directory, ~/Downloads in case of Fedora desktops or Macs.
+
[source,]
[source,console]
----
[…]$ mv ~/Downloads/fedora-server-kvm-dev.ks ~/imagefactory/
$ mv ~/Downloads/fedora-server-kvm-dev.ks ~/imagefactory/
----
2. Optional: _Clone the Fedora kickstart repository_ for easy access to reference material.
+
[source,]
[source,console]
----
[…]$ mkdir ~/imagefactory/FedoraKickstarts
[…]$ git clone https://pagure.io/fedora-kickstarts.git -o upstream ~/imagefactory/FedoraKickstarts
$ mkdir ~/imagefactory/FedoraKickstarts
$ git clone https://pagure.io/fedora-kickstarts.git -o upstream ~/imagefactory/FedoraKickstarts
----
+
If you are planning to contribute your VM you should create a fork, too, so you can provide a pull request.
@ -159,9 +159,9 @@ You have to create this file in your working directoy. In this example we name i
The exact content depends entirely on local conditions. The basis is the following sample:
[source,]
[source,console]
----
[…]$ vim ~/imagefactory/fedora-repo.ks
$ vim ~/imagefactory/fedora-repo.ks
# Include the appropriate repo definitions
# uncomment the repo specification to use.
@ -191,9 +191,9 @@ The template file describes meta data of the disk image to create. That includes
Fetch the corresponding link:{attachmentsdir}/tutorials/imagefactory/fedora-server-kvm-dev.tdl[basic template file] and store it into the working directory. In many cases klicking the link stores the file into you default download directory, ~/Downloads in case of Fedora desktops or Macs.
[source,]
[source,console]
----
[…]$ mv ~/Downloads/fedora-server-kvm-dev.tdl ~/imagefactory/
$ mv ~/Downloads/fedora-server-kvm-dev.tdl ~/imagefactory/
----
The version number inside the template file (22) is not necessarily the Fedora target version. For some reason it is best to leave it untouched! But you have to adjust the download URL!
@ -207,24 +207,24 @@ The version number inside the template file (22) is not necessarily the Fedora t
1. prepare and optimize kickstart file with ksflatten:
+
[source,]
[source,console]
----
[…]$ ksflatten -c fedora-server-kvm-dev.ks -o fedora-server-kvm-dev-fl.ks
$ ksflatten -c fedora-server-kvm-dev.ks -o fedora-server-kvm-dev-fl.ks
----
2. Check using ksvalidator
+
[source,]
[source,console]
----
[…]$ ksvalidator -i fedora-server-kvm-dev-fl.ks
$ ksvalidator -i fedora-server-kvm-dev-fl.ks
----
3. Create the image
+
Using a vm and guestfs-tools to adapt the image. This is the _preferred operation_ mode.
+
[source,]
[source,console]
----
[…]$ sudo imagefactory --debug base_image --file-parameter install_script \
$ sudo imagefactory --debug base_image --file-parameter install_script \
fedora-server-kvm-dev-fl.ks fedora-server-kvm-dev.tdl \
--parameter offline_icicle true
----
@ -237,7 +237,7 @@ Additionally, you find loging output in the /var/lib/oz directory. Often specifi
4. Output in case of a successful generation
+
[source,]
[source,console]
----
============ Final Image Details ============
UUID: 4ebde351-e81b-427f-96b7-5acd5680013d
@ -251,17 +251,17 @@ To access the filesystem inside a generated image, use guestfs-tools. Ensure tha
1. Copy the generated vm into the libvirt installation media pool
+
[source,]
[source,console]
----
[…]# qemu-img convert -c -O qcow2 /var/lib/imagefactory/storage/xxx-yyy-zzz.body /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2
# qemu-img convert -c -O qcow2 /var/lib/imagefactory/storage/xxx-yyy-zzz.body /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2
----
2. Check and analyze the file system
+
[source,]
[source,console]
----
[…]# cd /var/lib/libvirt/boot
[…]# guestfish -a fedora-server-kvm-dev.qcow2
# cd /var/lib/libvirt/boot
# guestfish -a fedora-server-kvm-dev.qcow2
Welcome ….
><fs> run
...(wait)
@ -274,34 +274,34 @@ Welcome ….
+
Following the list of file systems above, mount each filesystem and check
+
[source,]
[source,console]
----
[…]# mkdir /mnt/test
[…]# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
# mkdir /mnt/test
# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
----
4. Clean up
+
[source,]
[source,console]
----
[…]# mkdir /mnt/test
[…]# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
# mkdir /mnt/test
# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
----
=== Instantiate and test a created image
1. Copy the generated vm into the libvirt disk image pool
+
[source,]
[source,console]
----
[…]# cp /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2 /var/lib/libvirt/images/vm-test.qcow2
# cp /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2 /var/lib/libvirt/images/vm-test.qcow2
----
2. Instantiate a VM
+
[source,]
[source,console]
----
[…]# virt-install --name vm-test \
# virt-install --name vm-test \
--memory 4096 --cpu host --vcpus 2 --graphics none\
--os-variant fedora-unknown\
--import \

34
modules/ROOT/pages/tutorials/wordpress-installation.adoc
View file

@ -47,26 +47,26 @@ If not already done install the xref:services/httpd-basic-setup.adoc[Fedora Web
+
[source,bash]
----
[…]# dnf install wordpress
# dnf install wordpress
----
. Add a database and a database user for Wordpress to the MariaDB DB.
+
[source,bash]
----
[…]# mysql -u root
# mysql -u root
MariaDB [(none)]> show databases;
MariaDB [(none)]> CREATE DATABASE wordpress ;
MariaDB [(none)]> CREATE USER 'wordpress' IDENTIFIED BY 'wp-test-proj';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress';
MariaDB [(none)]> quit;
[…]#
#
----
. Check the database connectivity via TCP/IP
+
[source,bash]
----
[…]$ mysql -u wordpress wordpress -p
$ mysql -u wordpress wordpress -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 18
@ -77,7 +77,7 @@ Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.‘
MariaDB [wordpress]> quit
[…]$
$
----
. Configure Wordpress to access the database defined above
@ -86,7 +86,7 @@ Edit the Wordpress configuration file which is _in Fedora_ stored at /etc/wordpr
+
[source,bash]
----
[…]# vim /etc/wordpress/wp-config.php
# vim /etc/wordpress/wp-config.php
define( 'DB_NAME', 'xxxxx' );
define( 'DB_USER', 'xxxx' );
define( 'DB_PASSWORD', 'xxxxxxxx' );
@ -99,7 +99,7 @@ For security reasons, the default configuration restricts access to the local sy
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
Alias /wordpress /usr/share/wordpress
@ -121,7 +121,7 @@ Modify the configuration file further and append at the end:
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
Alias /wordpress /usr/share/wordpress
@ -146,8 +146,8 @@ Provide authentication information
+
[source,bash]
----
[…]# mkdir /etc/httpd/auth.d
[…]# htpasswd -c /etc/httpd/auth.d/validusers {USER}
# mkdir /etc/httpd/auth.d
# htpasswd -c /etc/httpd/auth.d/validusers {USER}
New password:
Re-type new password:
----
@ -156,9 +156,9 @@ Re-type new password:
+
[source,bash]
----
[…]# systemctl enable httpd
[…]# systemctl start httpd
[…]# systemctl status httpd
# systemctl enable httpd
# systemctl start httpd
# systemctl status httpd
----
== Check out and configure your site
@ -202,23 +202,23 @@ Specifically you want to modify the base address of your Wordpress site, from wo
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
## Alias /wordpress /usr/share/wordpress # <== Mod
Alias /mycuteblog /usr/share/wordpress # <== Add
[…]# systemctl restart httpd
# systemctl restart httpd
----
* Alternatively you may want to access the Wordpress pages at your servers base address, example.com in this guide. Again, modify the Wordpress Apache configuration file.
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
## Alias /wordpress /usr/share/wordpress # <== Mod
## Access wordpress via base address instead # <== Add
DocumentRoot /usr/share/wordpress # <== Add
[…]# systemctl restart httpd
# systemctl restart httpd
----

22
modules/ROOT/pages/usecase-gui-addon.adoc
View file

@ -14,7 +14,7 @@ To get an overview of available graphical user interfaces, simply list all insta
+
[source,bash]
----
[…]# dnf group list
# dnf group list
----
You will find
* KDE Plasma Workspaces
@ -33,14 +33,14 @@ You may either use the groups pretty name as shown in the group listing or the c
+
[source,bash]
----
[…]# dnf groupinstall "Cinnamon Desktop"
# dnf groupinstall "Cinnamon Desktop"
----
+
or
+
[source,bash]
----
[…]# dnf install @cinnamon-desktop-environment
# dnf install @cinnamon-desktop-environment
----
3. *Adjustment of systemd to start in graphic mode*
+
@ -48,14 +48,14 @@ To boot into graphical mode by default, you have to adjust the default target.
+
[source,bash]
----
[…]# systemctl set-default graphical.target
# systemctl set-default graphical.target
----
+
With some desktop you may also need:
+
[source,bash]
----
[…]# systemctl enable gdm.service
# systemctl enable gdm.service
----
+
Try it, but you may get a "Service not found" message with some desktops. No need to worry, the installed desktop will come up without that.
@ -63,7 +63,7 @@ Try it, but you may get a "Service not found" message with some desktops. No nee
+
[source,bash]
----
[…]# reboot
# reboot
----
+
Your system will start with the selected graphical desktop.
@ -73,13 +73,13 @@ Your system will start with the selected graphical desktop.
You may install multiple desktops. The utilities `switchdesk` and `switchdesk-gui` can be used to switch the desktop GUI.
[source,bash]
----
[…]# dnf install switchdesk switchdesk-gui
# dnf install switchdesk switchdesk-gui
----
In a terminal window, you can directly switch to another desktop:
[source,bash]
----
[…]# switchdesk cinnamon
# switchdesk cinnamon
----
Without naming the new desktop, a window with the available options will be displayed.
@ -90,12 +90,12 @@ The graphical `_Desktop Switcher_` is included in the Systemadministration menu
You can switch back to booting to a text console:
[source,bash]
----
[…]# systemctl set-default multi-user.target
[…]# reboot
# systemctl set-default multi-user.target
# reboot
----
After having switched back into text mode, you can switch to the selected desktop just for the current session using
[…]# startx
# startx
However, this does not work flawlessly for every available desktop.

38
modules/ROOT/pages/virtualization/vm-install-cloudimg-centos9.adoc
View file

@ -48,12 +48,12 @@ But by cloud base image you (usually) don’t get an alternatively built but oth
_It is up to the system administrator to decide whether the functionality is identical to the extent that the advantages outweigh the disadvantages and it makes sense to use a specific cloud image as a virtual machine._
== How to proceed
First of all you need a working Fedora Server Edition including virtualization support added and libvirtd daemon active. We assume an internal network 'default' with virbr0, DHCP, and DNS set up as well (see section 'Add Virtualization Support'). External network connectivity will be provided by macvlan (ethernet interface) rsp. macvtap (libvirt naming).
First of all you need a working Fedora Server Edition including virtualization support added and libvirtd daemon active. We assume an internal network 'default' with virbr0, DHCP, and DNS set up as well (see section 'Add Virtualization Support'). External network connectivity will be provided by macvlan (ethernet interface) resp. macvtap (libvirt naming).
You have various options:
* Using Cockpit graphical interactive tool to perform a quick minimal VM setup
* Using virt-install CLI interactive tool to perform a quick mminimal VM setup based on cloud-init
* Using Cockpit graphical interactive tool to perform a quick minimal VM setup
* Using virt-install CLI interactive tool to perform a quick minimal VM setup based on cloud-init
* Using virt-install CLI interactive tool to perform a elaborate VM setup based on cloud-init
* virt-customize and virt-install CLI tools for a fairly easy, interactive VM setup
* Using any of the CLI tools to perform a script based automated installation
@ -63,7 +63,7 @@ We will only cover the former two variants here. They are so universal that they
== General preparations
Whichever of the presented installation methods is chosen, a cloud image always has to be downloaded and verified. In the case of CentOS, this involves the following steps.
1. Check on the CentOS project site the lastest release of GenericCloud image:
1. Check on the CentOS project site the latest release of GenericCloud image:
https://cloud.centos.org/centos/9-stream/x86_64/images/ At the time of this writing it was CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
2. In the Cockpit terminal window, fetch a CentOS 9-stream generic image file and store it into the directory `/var/lib/libvirt/boot`. This is by convention the libvirt default location of images for installation. Check the integrity of the download.
@ -116,7 +116,7 @@ You _must_ enter a root password. This will activate the root account at the sam
====
[IMPORTANT]
====
__NON-US system administrators__: Cloud image usually configures inially a US keyboard, and you can adjust the keyboard layout after the first login at the earliest. Limit the password to matching key positions (and change it later if you want)
__NON-US system administrators__: Cloud image usually configures initially a US keyboard, and you can adjust the keyboard layout after the first login at the earliest. Limit the password to matching key positions (and change it later if you want)
====
Select _Create_ to start the installation.
@ -129,14 +129,14 @@ In the list of running virtual machines click on the newly created box.
image::virtualization/vm-install-cloudimg-centos9-020.png[Cockpit `__Create new virtual machine__` form]
The created runtime environment is rather basic. With cloud image installation, you cannot defer the creation process and fine-tune the runtime configuration, as you can with other installation options. There is a default disk configuration, e.g. a default CDrom and one disk as configured. And there is just one network connection, which uses libvirt&#8217;s default virtual network.
The created runtime environment is rather basic. With cloud image installation, you cannot defer the creation process and fine-tune the runtime configuration, as you can with other installation options. There is a default disk configuration, e.g. a default CDrom and one disk as configured. And there is just one network connection, which uses libvirt&#8217;s default virtual network.
Log in with the root account. If you look around, you will find some resemblance to a CentOS server configuration. Cockpit is installed, but not activated. Firewall installation is completely missing. The virtual disk contains one flat XFS file system. The active network configuration resides in `/etc/sysconfig/network-scripts` (due to cloud-init limitations). Residues of a NetworkManager network configuration exist in `/etc/NetworkManager/system-connections`.
Log in with the root account. If you look around, you will find some resemblance to a CentOS server configuration. Cockpit is installed, but not activated. Firewall installation is completely missing. The virtual disk contains one flat XFS file system. The active network configuration resides in `/etc/sysconfig/network-scripts` (due to cloud-init limitations). Residues of a NetworkManager network configuration exist in `/etc/NetworkManager/system-connections`.
So there is some post-installation work to do.
==== Adjust locale and non-US keyboard layout
Users of a non-US keyborad layout probably want to customize the keyboard layout first of all.
Users of a non-US keyboard layout probably want to customize the keyboard layout first of all.
1. Check the current locale configuration
+
@ -147,7 +147,7 @@ System Locale: LANG=en_US.UTF-8
VC Keymap: us
X11 Layout: us
----
2. List available keyboard mappings filtered by your short county code part
2. List available keyboard mappings filtered by your short country code part
+
[source,console]
----
@ -170,7 +170,7 @@ de-nodeadkeys
# localectl set-keymap de-nodeadkeys
...
----
The setting is immediately activ.
The setting is immediately active.
==== Network configuration
@ -192,13 +192,13 @@ $ hostnamectl
----
2. If you expanded the terminal window click on the VM name in the breadcrumb to get the default view. Select shutdown to stop the virtual machine.
3. An administrator who sticks to the habit that the first network adapter in the device list establishes the external connection will now edit and rearrange the existing network configuration. Select `__Edit__` to access the Configuration form.
3. An administrator who sticks to the habit that the first network adapter in the device list establishes the external connection will now edit and rearrange the existing network configuration. Select `__Edit__` to access the Configuration form.
+
image::virtualization/vm-install-cloudimg-centos9-030.png[Cockpit `__Virtual ethernet configuration form__`]
+
Replace the interface type by `__Direct attachment__` and select the external physical interface of the host in the `__Source__` field. Leave `__model__` and `__MAC address__` unchanged.
4. If you also want an internal network (and you definitely should in most cases), select `__Add network interface__`. A nearly identical form pops up. Select `__Interface tpye__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` (__Linux, perf__) and `__MAC address__` (__Generate automatically__) unchanged. Click Create to finish to create the network configuration.
4. If you also want an internal network (and you definitely should in most cases), select `__Add network interface__`. A nearly identical form pops up. Select `__Interface type__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` (__Linux, perf__) and `__MAC address__` (__Generate automatically__) unchanged. Click Create to finish to create the network configuration.
5. Start the virtual machine again.
@ -217,7 +217,7 @@ If the name service setup in the host is correct, the short name should work. Ot
If pinging the IP address works, fix the name resolution. Otherwise check again network configuration.
2. *Check external connections*
+
From a machine on your network try to ping the virtual machinge
From a machine on your network try to ping the virtual machine
+
----
$ ping vm1-el9.example.com
@ -246,7 +246,7 @@ Test if login and sudo work!
# sudo passwd -l root
----
+
Log off and try to login as root (e.g. using the host's Cockpit instance). The system should respong with 'Login incorrect'.
Log off and try to login as root (e.g. using the host's Cockpit instance). The system should respond with 'Login incorrect'.
3. If you decide to use the root account and you chose a simple password during installation, you should set a long and secure password. Log in as root and execute
+
@ -362,7 +362,7 @@ Log in to the root account giving the password displayed early in the installati
[IMPORTANT]
====
__**NON-US system administrators**__: Cloud Image usually configures a __US keyboard__ first! The easiest way is to copy & paste the password. Limit the new password to matching key positions, choose a rather simple one to minimize the chance ot typos, and change it to a secure password later after keyboard configuration..
__**NON-US system administrators**__: Cloud Image usually configures a __US keyboard__ first! The easiest way is to copy & paste the password. Limit the new password to matching key positions, choose a rather simple one to minimize the chance of typos, and change it to a secure password later after keyboard configuration.
====
==== Post-Installation Tasks
@ -378,7 +378,7 @@ System Locale: LANG=en_US.UTF-8
VC Keymap: us
X11 Layout: us
----
b. List available keyboard mappings filtered by your short county code part. Replaye "de-" by your country, i.e. "<COUNTRYCODE>-"
b. List available keyboard mappings filtered by your short country code part. Replace "de-" with your country, i.e. "<COUNTRYCODE>-"
+
[source,console]
----
@ -401,7 +401,7 @@ c. Determine applicable key mapping and apply it
# localectl set-keymap de-nodeadkeys
...
----
The setting is immediately activ.
The setting is immediately active.
2. Check network connection
+
@ -516,7 +516,7 @@ The use of Cloud Base Images to create a distribution's virtual machine installa
=== Short explanation of the virt-install parameter used
--name VM_NAME:: Unique name of the VM to install as shown e.g.in VM list
--name VM_NAME:: Unique name of the VM to install as shown e.g. in VM list
--memory 3074:: Amount of memory to allocate, adjust as appropriate
--cpu host:: same cpu type as host
--vcpus 3:: number of cpus for VM, adjust as appropriate
@ -524,7 +524,7 @@ The use of Cloud Base Images to create a distribution's virtual machine installa
--import:: Fixed, skips installation procedure and boots from the first (virtual) disk as specified by the first disk parameter.
--graphics none:: Fixed, enforces a redirect of the VM login prompt to the host terminal window for immediate access.
--disk /var/lib/libvirt/images/VM_NAME.qcow2, format=qcow2,bus=virtio:: disk image file, adjust VM_NAME
--network direct,source=enpXsY,source_mode=bridge, model=virtio:: specify _external_ netwok (macvlan) __first__, it will get the name eth0 as usual. Adjust interface name as appropriate.
--network direct,source=enpXsY,source_mode=bridge, model=virtio:: specify _external_ network (macvlan) __first__, it will get the name eth0 as usual. Adjust interface name as appropriate.
--network bridge=virbr0,model=virtio:: specify the _internal_ network (libvirt generated bridge) _second_. It will get the name eth1 as usual.
--cloud-init:: Deal with nocloud configuration using defaults

10
modules/ROOT/pages/virtualization/vm-install-diskimg-virtbuilder.adoc
View file

@ -55,7 +55,7 @@ centosstream-8 x86_64 CentOS Stream 8
centosstream-9 x86_64 CentOS Stream 9
----
The guestfs-tools project provides a fairly complete set of variants available in recent years. Omitting the grep term reveals an impressive list of of distribution images provided.
The guestfs-tools project provides a fairly complete set of variants available in recent years. Omitting the grep term reveals an impressive list of distribution images provided.
We want the latest and greatest CentOS release and would like to get some info about details.
[source,bash]
@ -94,13 +94,13 @@ $ sudo su -
--firstboot-command 'useradd -m -G wheel -p "" hostmin ; chage -d 0 hostmin'
----
Please, adjust the above example as apropriate!
Please, adjust the above example as appropriate!
Specifically, _US users_ will omit the 6. line ('--firstboot-command 'localectl&#8230;&#8203;`) of the virt-builder command, other will have to adjust the keyboard layout. On your local Fedora Server run `localectl list-keymaps`to get a list of supported keyboard layouts and their identifiers.
If you really are to install a _short term test installation_ you may omit the third line (`--root-password &#8230;&#8203;`) of the virt-builder command for connvenience and work directly as root. The app will automatically generate a password and display it. Don&#8217;t forget to copy and store it safely.
If you really are to install a _short term test installation_ you may omit the third line (`--root-password &#8230;&#8203;`) of the virt-builder command for convenience and work directly as root. The app will automatically generate a password and display it. Don&#8217;t forget to copy and store it safely.
You get a lot ot output. The process takes some time. Be patient.
You get a lot of output. The process takes some time. Be patient.
[source,bash]
----
@ -191,7 +191,7 @@ Log in with the administrative user account (hostmin in this example). You can l
=== Adjust the new VM instance
You did a minimal customization so var and need to do some further adjustments.
You did a minimal customization so far and need to do some further adjustments.
==== Network consolidation

24
modules/ROOT/pages/virtualization/vm-install-fedoraserver-cockpit.adoc
View file

@ -61,7 +61,7 @@ Select `__Terminal__` in the left navigation bar and issue the commands line by
# sudo sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
----
You can safely ignore the warning of the last command about not correctly formated lines.
You can safely ignore the warning of the last command about not correctly formatted lines.
You can provide additional installation media in an analog way. With everything necessary in place, we can start installing a virtual machine.
@ -73,16 +73,16 @@ This guide uses Cockpit, version 326, and Cockpit machines, version 321. On upda
To start a VM installation, connect your desktop browser to the Cockpit instance of your host server. Consult the xref:installation/postinstallation-tasks.adoc[post-installation guide] to find out the possible connection paths. Log in as root or with your administrative account. In the overview (start) page select `__Virtual Machines__` in the left navigation column and then `__Create VM__` (the button `__Import VM__` next to it refers to the other alternative, using disk images) and fill in the form that opens..
image::virtualization/vm-install-fedoraserver-cockpit-020.png[Cockpit `__Create new virtual machine__` form]
First, specify a name for the virtual machine to be created. It must be unique in the host server’s name space. Select an connection type, usually system. See explanation in the xref:virtualization/installation.adoc[Adding Virtualization Support] guide.
First, specify a name for the virtual machine to be created. It must be unique in the host server’s name space. Select a connection type, usually system. See explanation in the xref:virtualization/installation.adoc[Adding Virtualization Support] guide.
Then select the installation type to be used. The drop down menu offers several alternatives:
Download an OS:: Download from a remote location. You have to choose the Distribution from a drop down menu in the next field. It includes various distributions and version. But you can&#8217;t select the Fedora edition. Not an recommendable option.
Download an OS:: Download from a remote location. You have to choose the Distribution from a drop down menu in the next field. It includes various distributions and version. But you can&#8217;t select the Fedora edition. Not a recommendable option.
Cloud base image:: That refers to the special case of cloud disk images. That is not covered here.
Local install media:: Use a ISO image or a distro install tree stored on the local disk. This is the option we want to use here. Select this option and specify in the next field the fully qulified path and filename.
URL (ISO image or distro install tree):: The same as 'Download an OS', but you can freely specify the exact distribution by download URL in the next field and do not depend on a preset list
Network boot (PXE):: That&#8217;s another special case we don&#8217;t cover here. You need to set up a special install server beforehand.
Local install media:: Use a ISO image or a distro install tree stored on the local disk. This is the option we want to use here. Select this option and specify in the next field the fully qualified path and filename.
URL (ISO image or distro install tree):: The same as 'Download an OS', but you can freely specify the exact distribution by download URL in the next field and do not depend on a preset list
Network boot (PXE):: That&#8217;s another special case we don&#8217;t cover here. You need to set up a special install server beforehand.
As mentioned above choose `__Local install media__` and select in the drop down menu of the following row the fully qualified file name. In our example of Fedora Server 41 it is `/var/lib/libvirt/boot/Fedora-Server-dvd-x86_64-41-1.3.iso`. The drop down menu works a bit unfamiliar. You have to select the target file step by step from subdirectory to subdirectory up to the file name.
@ -118,7 +118,7 @@ image::virtualization/vm-install-fedoraserver-cockpit-040.png[Cockpit `__Virtual
Replace the interface type by `__Direct attachment__` and select the external physical interface of the host in the `__Source__` field. Leave `__model__` and `__MAC address__` unchanged.
Next, if you also want an internal network, select `__Add network interface__`. A nearly identical form pops up. Select `__Interface tpye__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` __virtio (Linux, perf)__ and `__MAC address__` __Generate automatically__ unchanged.
Next, if you also want an internal network, select `__Add network interface__`. A nearly identical form pops up. Select `__Interface type__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` __virtio (Linux, perf)__ and `__MAC address__` __Generate automatically__ unchanged.
Now everything is ready and the installation can begin.
@ -134,10 +134,10 @@ Start with installation as usual. You may basically follow the xref:installation
The installation process will take some time.
If you want to save the disk image for future VM creation, select shutdown, copy the image to `__~/libvirt/boot/__`, and then start the VM anew for post-installation steps. Otherwise restart according the installation program&#8217;s advise and procede with post-install.
If you want to save the disk image for future VM creation, select shutdown, copy the image to `__~/libvirt/boot/__`, and then start the VM anew for post-installation steps. Otherwise restart according the installation program&#8217;s advise and proceed with post-install.
____
*__Excursus__: Save generated virual machine for later reuse*
*__Excursus__: Save generated virtual machine for later reuse*
Sometimes, after selecting __Shutdown__ the machine automatically start again. Login with your administrativ account and perform a shutdown: `sudo shutdown -h now`. Then switch to a host's terminal window and execute:
[source,console]
@ -175,7 +175,7 @@ All subsequent tasks must be executed with ROOT privileges. If the root account
1. *Check hostname and time synchronisation*
+
A correct hostname is specifically important for DHCP of the internal network to work properly. A correct time is important vor various tasks, sopecifically syncronization.
A correct hostname is specifically important for DHCP of the internal network to work properly. A correct time is important for various tasks, specifically synchronization.
+
a. __Check hostname__. You need a correct static hostname.
+
@ -230,7 +230,7 @@ NAME UUID TYPE DEVICE
enp1 47df4730-171e-3bfe-b5d9-4238137e0f70 ethernet enp1
enp2 7627fc10-f1bf-3220-99e2-3bd369837439 ethernet enp2
----
b. Set the DNS serach path for the internal interface
b. Set the DNS search path for the internal interface
+
If enp2 it the internal interface, set dns search and deactivate IPv6 that is not used internally
+

6
modules/ROOT/pages/virtualization/vm-management-cockpit.adoc
View file

@ -23,7 +23,7 @@ image::virtualization/vm-management-cockpit-001.png[Cockpit Virtual Machines Ove
If there is no tab "Virtual Machines" the corresponding Cockpit module, cockpit-machines, is not installed yet. Consult the guide xref:virtualization/installation#_finishing_cockpit_machines_configuration[Adding Virtualization Support] for information how to install and prepare the module.
The virtual machines _overview page_ lists in the central area all virtual machines installed along with their current state. In the example above there are 3 virtual machines, 2 of them running. The most frequently executed action, shutdown rsp. launch, is directly accessible as a button. Additional commonly needed functions are offered in a drop-down menu to the right of it. It even offers a (simple) migration to another machine.
The virtual machines _overview page_ lists in the central area all virtual machines installed along with their current state. In the example above there are 3 virtual machines, 2 of them running. The most frequently executed action, shutdown resp. launch, is directly accessible as a button. Additional commonly needed functions are offered in a drop-down menu to the right of it. It even offers a (simple) migration to another machine.
=== Manage a virtual machines basic host runtime environment
@ -216,13 +216,13 @@ In the network section of the VMs detail page there is just one interface with 3
image::virtualization/vm-management-cockpit-033.png[Cockpit edit libvirt virtual interface]
The form shows the definition of the current internal network. Just modify the _Interface type_ from "Virtual network" to "Direct attachement" and _Source_ from "default" to "enp1s0", the host physical interface. Save your selection and reboot. Assuming DHCP works, the virtual machine has a perfectly working connection to the public network, including name resolution and default firewall configuration. Otherwise you have to define a static network configuration.
The form shows the definition of the current internal network. Just modify the _Interface type_ from "Virtual network" to "Direct attachment" and _Source_ from "default" to "enp1s0", the host physical interface. Save your selection and reboot. Assuming DHCP works, the virtual machine has a perfectly working connection to the public network, including name resolution and default firewall configuration. Otherwise you have to define a static network configuration.
Even if you need a public interface in addition to the existing internal interface you may prefer to edit the existing interface and later add a new internal interface. That way you follow the common practice of always setting up the public interface as the "first" one, i.e. enp1s0 or eth0.
==== Delete an interface
As an example, the virtual maschine is equipped with two interfaces, a public (enp1s0) and an internal (enp7s0).
As an example, the virtual machine is equipped with two interfaces, a public (enp1s0) and an internal (enp7s0).
image::virtualization/vm-management-cockpit-034.png[Cockpit delete a libvirt virtual interface]

6
modules/ROOT/partials/installation/post-install/disable-password-login.adoc
View file

@ -6,9 +6,9 @@ a. On the server, create a configuration file and edit
----
[…]# vi /etc/ssh/sshd_config.d/60-local.conf
# Local custimization: disable password login except for
# one (optionally add some more) user as a fallback option.
PasswordAuthentication no
# Local customization: disable password login except for
# one (optionally add some more) user as a fallback option.
PasswordAuthentication no
Match User hostmin
PasswordAuthentication yes