forked from server/user-documentation
Align console prompts to style guide (services)
This commit is contained in:
parent
98bafc4ab9
commit
65c692fffc
3 changed files with 120 additions and 120 deletions
|
|
@ -35,9 +35,9 @@ sssd-nfs-idmap::
|
|||
SSSD plug-in provides a way for rpc.idmapd to call SSSD to map UIDs/GIDs to names and vice versa. It can be also used for mapping principal (user) name to IDs(UID or GID) or to obtain groups which user are member of.
|
||||
|
||||
Ensure that these packages are really installed.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ rpm -qa | grep nfs
|
||||
$ rpm -qa | grep nfs
|
||||
libnfsidmap-2.8.4-0.fc43
|
||||
sssd-nfs-idmap-2.11.1-4.fc43
|
||||
nfs-utils-2.8.4-0.fc43
|
||||
|
|
@ -60,9 +60,9 @@ In this guide we will demontrate the latter and create a thin provisioned LV for
|
|||
|
||||
1. *Create a nfs export directory in /srv*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo mkdir /srv/nfs
|
||||
$ sudo mkdir /srv/nfs
|
||||
----
|
||||
+
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
|
|
@ -71,9 +71,9 @@ The created directory is by default readable for everyone, but not writable.
|
|||
+
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
|
||||
$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
|
||||
----
|
||||
|
||||
3. *Create and mount the required Logical Volumes*
|
||||
|
|
@ -98,13 +98,13 @@ Again, fill in the form and you are done.
|
|||
+
|
||||
For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
|
||||
[…]# lvs
|
||||
[…]# mkfs.xfs /dev/fedora/nfs
|
||||
[…]# mkdir -p /srv/nfs
|
||||
[…]# vim /etc/fstab
|
||||
# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
|
||||
# lvs
|
||||
# mkfs.xfs /dev/fedora/nfs
|
||||
# mkdir -p /srv/nfs
|
||||
# vim /etc/fstab
|
||||
...
|
||||
/dev/mapper/fedora-root / xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
|
|
@ -113,27 +113,27 @@ For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
|||
+
|
||||
Finallly mount the created filesystem.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount -a
|
||||
# mount -a
|
||||
----
|
||||
|
||||
4. *Create and configure the directories to share*
|
||||
+
|
||||
In a typical use case you may create a directory 'common' to widely share data and a directory 'project', in which a team member shares data located in the home directory with the team.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# sudo mkdir -p /srv/nfs/{common,project}
|
||||
[…]# sudo chown -R nfs.nfs /srv/nfs/*
|
||||
[…]# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
# sudo mkdir -p /srv/nfs/{common,project}
|
||||
# sudo chown -R nfs.nfs /srv/nfs/*
|
||||
# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
----
|
||||
+
|
||||
To make the bind mount(s) permanent, add the following entries to the /etc/fstab file:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vi /etc/fstab
|
||||
# vi /etc/fstab
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
|
@ -150,9 +150,9 @@ The commented out lines describe the default built in configuration.
|
|||
|
||||
1. Configure the NFS basic directory
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/nfs.conf
|
||||
$ sudo vi /etc/nfs.conf
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
|
@ -162,18 +162,18 @@ The commented out lines describe the default built in configuration.
|
|||
+
|
||||
NFS uses port 2049 which is blocked in a Fedora standard installation by defaut.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --add-service=nfs
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --permanent --add-service=nfs
|
||||
# firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. *Start NFS enabling autostart at boot time*
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl status nfs-server
|
||||
# systemctl enable nfs-server --now
|
||||
# systemctl status nfs-server
|
||||
----
|
||||
+
|
||||
This starts the NFS server only, but not the NFS client. Therefore, the server can not mount file ressources provided by another server. If required, additionally execute at first _`systemctl enable nfs-client.target --now`_. For additional details you may look at _`man 7 nfs.systemd`_.
|
||||
|
|
@ -182,9 +182,9 @@ This starts the NFS server only, but not the NFS client. Therefore, the server c
|
|||
+
|
||||
Fedora enables versions 3 and 4.x, version 2 is disabled. The latter is pretty old now. Every machine should provide at least version 3.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cat /proc/fs/nfsd/versions
|
||||
# cat /proc/fs/nfsd/versions
|
||||
-2 +3 +4 +4.1 +4.2
|
||||
----
|
||||
+
|
||||
|
|
@ -231,9 +231,9 @@ You can use both options in parallel with the grand configuration file read in f
|
|||
Example 1::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -241,9 +241,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 2::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -251,9 +251,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 3::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -261,9 +261,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 4::
|
||||
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -271,9 +271,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
Example 6::
|
||||
Export the directory /srv/nfs/projects with all users of a specific network device with Read/Write and Synchronize access
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/exports.d/projects.exports
|
||||
$ sudo vi /etc/exports.d/projects.exports
|
||||
<i(nsert)>
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
|
@ -345,7 +345,7 @@ An NFSv4 client now has the ability to see all of the exports served by the NFSv
|
|||
|
||||
For example, the following commands could be executed on an NFSv4 server:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
|
|
@ -361,7 +361,7 @@ In this example, clients are provided with multiple file systems to mount, by us
|
|||
|
||||
Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export configurations are not always compatible. For example, given the following directory tree:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/home
|
||||
/home/sam
|
||||
|
|
@ -371,14 +371,14 @@ Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export config
|
|||
|
||||
and the export:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/home *(rw,fsid=0,sync)
|
||||
----
|
||||
|
||||
Using NFS version 2,3 and 4 the following would work:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mount server:/home /mnt/home
|
||||
ls /mnt/home/joe
|
||||
|
|
@ -386,7 +386,7 @@ ls /mnt/home/joe
|
|||
|
||||
Using v4 the following would work:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
mount -t nfs4 server:/ /mnt/home
|
||||
ls /mnt/home/joe
|
||||
|
|
@ -394,7 +394,7 @@ ls /mnt/home/joe
|
|||
|
||||
The difference being "server:/home" and "server:/". To make the exports configurations compatible for all version, one needs to export (read only) the root filesystem with an fsid=0. The fsid=0 signals the NFS server that this export is the root.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
/ *(ro,fsid=0)
|
||||
/home *(rw,sync,nohide)
|
||||
|
|
@ -406,30 +406,30 @@ Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs se
|
|||
== Testing the configuration
|
||||
|
||||
On client side:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# showmount -e 192.168.12.200
|
||||
# showmount -e 192.168.12.200
|
||||
----
|
||||
|
||||
On client side, try to mount an exported subdirectory:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
|
||||
# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
|
||||
----
|
||||
|
||||
Display the active mounts
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# mount | grep nfs
|
||||
# mount | grep nfs
|
||||
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
|
||||
nfsd on /proc/fs/nfsd type nfsd (rw,relatime)
|
||||
192.168.12.5:/nfsfileshare on /mnt/nfsfileshare type nfs4 (rw,relatime,vers=4.1,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.12.7,local_lock=none,addr=192.168.12.5)
|
||||
----
|
||||
|
||||
Check if the NFS mount is writable
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# touch /mnt/nfsfileshare/test
|
||||
# touch /mnt/nfsfileshare/test
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -64,21 +64,21 @@ The easiest way is to create the required volumes with __Cockpit__, the web-base
|
|||
|
||||
1. Install the Apache httpd web server. Today, you will almost always need the modules for managing SSL connections and the module for domain monitoring. Everything now runs via https.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo dnf install httpd mod_ssl mod_md
|
||||
[…]$ sudo firewall-cmd --add-service=https --permanent
|
||||
[…]$ sudo firewall-cmd --add-service=http --permanent
|
||||
[…]$ sudo firewall-cmd --reload
|
||||
$ sudo dnf install httpd mod_ssl mod_md
|
||||
$ sudo firewall-cmd --add-service=https --permanent
|
||||
$ sudo firewall-cmd --add-service=http --permanent
|
||||
$ sudo firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. Start the web server
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo systemctl start httpd
|
||||
[…]$ sudo systemctl status httpd
|
||||
[…]$ sudo systemctl enable httpd
|
||||
$ sudo systemctl start httpd
|
||||
$ sudo systemctl status httpd
|
||||
$ sudo systemctl enable httpd
|
||||
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
|
||||
----
|
||||
|
||||
|
|
@ -88,9 +88,9 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
|
|||
|
||||
4. If you plan to manage Let's Encrypt certificates using certbot install
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo dnf install letsencrypt
|
||||
$ sudo dnf install letsencrypt
|
||||
----
|
||||
|
||||
== Setup a web site
|
||||
|
|
@ -99,28 +99,28 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
|
|||
+
|
||||
As discussed above there are several options. In this example we use the /srv alternative and the website base name as base directory.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo -i
|
||||
[…]# mkdir -p /srv/SITENAME/htdocs
|
||||
$ sudo -i
|
||||
# mkdir -p /srv/SITENAME/htdocs
|
||||
----
|
||||
+
|
||||
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITEMANE/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
|
||||
+
|
||||
With /srv/ as the base directory you must adjust the SELinux labels.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
|
||||
[…]# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
|
||||
# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
|
||||
# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
|
||||
Relabeled /srv/SITENAME/htdocs from unconfined_u:object_r:var_t:s0 to system_u:object_r:httpd_sys_content_t:s0
|
||||
----
|
||||
+
|
||||
Create a very basic index page in your document root directory
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /srv/SITENAME/htdocs/index.html
|
||||
# vim /srv/SITENAME/htdocs/index.html
|
||||
<h1><center>It works!</center></h1>
|
||||
----
|
||||
|
||||
|
|
@ -139,9 +139,9 @@ A website using the same name as the server's hostname or its DNS entry, require
|
|||
+
|
||||
Edit the copied template file and adjust it as appropriate.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
|
||||
$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
|
||||
# Apache vhost configuration for a static html server.
|
||||
# It manages SSL connections including certificates.
|
||||
# Initially, a self-signed certificate is active.
|
||||
|
|
@ -341,8 +341,8 @@ Edit the copied template file and adjust it as appropriate.
|
|||
+
|
||||
[source,text]
|
||||
----
|
||||
[…]# systemctl restart httpd
|
||||
[…]# systemctl status httpd
|
||||
# systemctl restart httpd
|
||||
# systemctl status httpd
|
||||
● httpd.service - The Apache HTTP Server
|
||||
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)
|
||||
Active: active (running) since ...
|
||||
|
|
@ -385,8 +385,8 @@ Unfortunately, the only way to fix this is to modify the distribution provided m
|
|||
|
||||
[source,text]
|
||||
----
|
||||
[…]# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
|
||||
[…]# vi /etc/httpd/conf.d/ssl.conf
|
||||
# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
|
||||
# vi /etc/httpd/conf.d/ssl.conf
|
||||
#
|
||||
# When we also provide SSL we have to listen to the
|
||||
# standard HTTPS port in addition.
|
||||
|
|
@ -434,7 +434,7 @@ CustomLog logs/ssl_request_log \
|
|||
|
||||
#### </VirtualHost> #<======= comment out this line (last line, usually 218)
|
||||
|
||||
[…]# systemctl restart httpd
|
||||
# systemctl restart httpd
|
||||
----
|
||||
|
||||
When the httpd service is up again, everything should work as expected.
|
||||
|
|
|
|||
|
|
@ -24,21 +24,21 @@ A convenient descriptive name for both the logical volume and the file system is
|
|||
In any case, the system administrator must adapt the following command sequence according to the local requirements! With a Linux LVM and Software raid, XFS can autonomously determine its optimal configuration values. With some hardware raids, intervention by the administrator can also be useful for this.
|
||||
|
||||
First, check for the VG name and then adjust the following commands.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vgs
|
||||
# vgs
|
||||
VG #PV #LV #SN Attr VSize VFree
|
||||
systemVG 1 1 0 wz--n- 7.55g <4.42g
|
||||
[…]# lvcreate -L 50G -n pgsql systemVG
|
||||
# lvcreate -L 50G -n pgsql systemVG
|
||||
Logical volume "pgsql" created.
|
||||
[…]# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
|
||||
# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
|
||||
meta-data=/dev/mapper/systemVG-pgsql isize=512 agcount=4, agsize=655360 blks
|
||||
...
|
||||
Discarding blocks...Done.
|
||||
[…]# mkdir /var/lib/pgsql
|
||||
[…]# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
|
||||
[…]# mount -a
|
||||
[…]# df -h
|
||||
# mkdir /var/lib/pgsql
|
||||
# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
|
||||
# mount -a
|
||||
# df -h
|
||||
----
|
||||
|
||||
== 2. Basic installation
|
||||
|
|
@ -46,9 +46,9 @@ First, check for the VG name and then adjust the following commands.
|
|||
Just one package - postgresql-server - already provides a complete and comprehensive server at your disposal. All the many other Postgresql related packages provide additional options that are only useful or needed for specific special needs.
|
||||
|
||||
The package provides the pure server functionality. Fedora additionally loads the packages _postgresql_, a CLI client program granting interactive access to the server, and __postgresql-private-libs__, containing shared libraries used by each of those packages, as dependencies.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install postgresql-server
|
||||
# dnf install postgresql-server
|
||||
...
|
||||
==============================================================================
|
||||
Package Architectur Version
|
||||
|
|
@ -65,9 +65,9 @@ The package provides the pure server functionality. Fedora additionally loads th
|
|||
----
|
||||
|
||||
The installer should have adjusted all SELinux labels in the pgsql directory already created. Check:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ls -alZ /var/lib/pgsql/
|
||||
# ls -alZ /var/lib/pgsql/
|
||||
drwx------. 4 postgres postgres system_u:object_r:postgresql_db_t:s0 54 ... .
|
||||
drwxr-xr-x. 45 root root system_u:object_r:var_lib_t:s0 4096 ... ..
|
||||
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... backups
|
||||
|
|
@ -75,23 +75,23 @@ The installer should have adjusted all SELinux labels in the pgsql directory alr
|
|||
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... data
|
||||
----
|
||||
If the installation program missed something, fix it executing
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# restorecon -vFr /var/lib/pgsql
|
||||
[…]# ls -alZ /var/lib/pgsql/
|
||||
# restorecon -vFr /var/lib/pgsql
|
||||
# ls -alZ /var/lib/pgsql/
|
||||
----
|
||||
|
||||
It is also a prerequisite that exclusively the user postgres has access to the directory pgsql and its subdirectories. Usually the installer takes care of it. Fix it if necessary.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# chown -R postgres:postgres /var/lib/pgsql
|
||||
[…]# chmod -R 700 /var/lib/pgsql
|
||||
# chown -R postgres:postgres /var/lib/pgsql
|
||||
# chmod -R 700 /var/lib/pgsql
|
||||
----
|
||||
|
||||
When all the requirements are met, perform the initialization of the database cluster. This is a prerequisite for all further activities.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# postgresql-setup --initdb
|
||||
# postgresql-setup --initdb
|
||||
----
|
||||
|
||||
== 3. Configuration and initialization
|
||||
|
|
@ -105,8 +105,8 @@ A client can connect to the server either by a Unix socket connection or a TCP/I
|
|||
If the client does not specify a hostname parameter (-h), a Unix socket connection is established. Postgres uses this method to ensure that root can always securely establish a connection, regardless of password loss, for example. The root user always has permission to assume the identity of the postgresql master user (su - postgres). By default, no other user has this option. As root, you get in any circumstances administrative access to the database.
|
||||
[source]
|
||||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
# su - postgres
|
||||
$ psql
|
||||
----
|
||||
|
||||
Specifying the host parameter results in an attempt to establish a TCP/IP connection. Postgresql uses port 5432 by default for this purpose. In Fedora, all interfaces are protected by a firewall by default, except for localhost. A connection therefore requires opening a suitable port.
|
||||
|
|
@ -114,8 +114,8 @@ Specifying the host parameter results in an attempt to establish a TCP/IP connec
|
|||
Fedora abstracts the technical details with Firewalld, so that the administrator does not need to bother with details. For most common uses there are predefined services. So, if you want the database to be accessible via the internal interface assigned to the internal zone, for example, you need just two simple instructions.
|
||||
[source]
|
||||
----
|
||||
[…]$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
|
||||
[…]$ sudo firewall-cmd --reload
|
||||
$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
|
||||
$ sudo firewall-cmd --reload
|
||||
----
|
||||
|
||||
[TIP]
|
||||
|
|
@ -130,9 +130,9 @@ In case of connection issues there is most probably a SELinux configuration miss
|
|||
For admin access Fedora postgresql is configured to obtain the host's operating system user name from the kernel and using it as the allowed database user name. Therefore, as soon as someone can authentiate on the host as user __postgres__, that person has administrative privileges on the postgresql server without any additional password prompt. The only one who can do that by default, is root. Root can configure additional users to be able to su to postgres. In any case, in a whatever emergency, if any then the system administrator is able to quickly access postgresql server unhindered and salvage what can still get salvaged.
|
||||
|
||||
This capability is configured in the ~/data/pg_hba file, together with other properties.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
...
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
|
|
@ -151,9 +151,9 @@ If local regulations make it necessary to replace these procedures with a dedica
|
|||
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking an ident server, that Fedora doesn't install). In most cases you need an authentication based on a password. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
|
||||
|
||||
The configuration is done in the file `pg_hba.conf` in the `data` subdirectory. Edit the file to match the pattern below.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
...
|
||||
|
|
@ -185,9 +185,9 @@ Some of the possible authentication methods require additional settings for SELi
|
|||
Now you are allowed to authenticate from machines on the internal network, but you still can't connect from the internal network to the PostgreSQL server. The default configuration restricts connection initially to the local host to avoid any security vulnerabilities in the first place.
|
||||
|
||||
Connections granted are configured in ~/data/postgresql.conf. To grant access to VMs on the internal network as well as from local host, edit the file near the beginning to match the pattern below.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/postgresql.conf
|
||||
# vim /var/lib/pgsql/data/postgresql.conf
|
||||
...
|
||||
#------------------------------------------------------------------------------
|
||||
# CONNECTIONS AND AUTHENTICATION
|
||||
|
|
@ -210,19 +210,19 @@ An entry of `listen_addresses = '*'` enables connections from any address. It is
|
|||
== 4. Using PostgreSQL as permanent service
|
||||
|
||||
You are now ready to start the PostgreSQL server.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl start postgresql
|
||||
[…]# systemctl status postgresql
|
||||
# systemctl start postgresql
|
||||
# systemctl status postgresql
|
||||
...
|
||||
... systemd[1]: Started postgresql.service - PostgreSQL database server.
|
||||
----
|
||||
|
||||
If no errors are reported, try to connect as user postgres using the psql cli client. Once connected, start commands with backslash, e.g. \? to get help or \q to quit.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
# su - postgres
|
||||
$ psql
|
||||
psql (18.0)
|
||||
Enter »help« ...
|
||||
|
||||
|
|
@ -233,14 +233,14 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
|
|||
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
|
||||
|
||||
postgres-# \q
|
||||
[…]$ exit
|
||||
[…]#
|
||||
$ exit
|
||||
#
|
||||
----
|
||||
|
||||
If everything works as expected, enable autostart of postgresql,
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl enable postgresql
|
||||
# systemctl enable postgresql
|
||||
----
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue