forked from server/user-documentation
Align console prompts to style guide (installation)
This commit is contained in:
parent
98bafc4ab9
commit
dbffb60ada
5 changed files with 88 additions and 88 deletions
|
|
@ -104,12 +104,12 @@ In the former case, navigate your browser to _https://fedoraproject.org/server/
|
|||
In the latter, navigate to the directory where you want to keep the files. We will assume your home directory here. For x86_64 systems, type the following commands line by line.
|
||||
|
||||
----
|
||||
[…]$ mkdir -p ~/tmp && cd ~/tmp
|
||||
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
|
||||
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
[…]$ wget https://fedoraproject.org/fedora.gpg
|
||||
[…]$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
[…]# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
$ mkdir -p ~/tmp && cd ~/tmp
|
||||
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
|
||||
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
$ wget https://fedoraproject.org/fedora.gpg
|
||||
$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
|
||||
Fedora-Server-dvd-x86_64-41-1.4.iso: OK
|
||||
sha256sum: WARNING: 17 lines are improperly formatted
|
||||
----
|
||||
|
|
@ -124,19 +124,19 @@ A installation on bare metal requires to transfer the installation file to a boo
|
|||
|
||||
. As a (hard core) server sysadmin to be, you might prefer a fast and efficient CLI tool, the `dd` command. If you are already in a terminal window, connect the USB stick and enter the following command to get a list of connected devices.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# lsblk
|
||||
# lsblk
|
||||
----
|
||||
+
|
||||
Determine the USB device, e.g. `/dev/sdc`
|
||||
+
|
||||
Just in case, umount the device and transfer the downloaded installation file to the device in one go. On the above example use
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo umount /dev/sdc*
|
||||
[…]$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
|
||||
$ sudo umount /dev/sdc*
|
||||
$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
|
||||
----
|
||||
+
|
||||
Of course, adjust file and device accordingly! You may receive an error message about parameter `status=progress` not supported. Then you still have an older dd version and have to leave that option off.
|
||||
|
|
|
|||
|
|
@ -150,7 +150,7 @@ Fedora uses a GPT partitioning scheme. Thus, on a BIOSboot system you must add a
|
|||
|
||||
Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
|
||||
----
|
||||
|
|
|
|||
|
|
@ -104,7 +104,7 @@ List the connected devices and identify the USB stick
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]$ lsblk
|
||||
$ lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
|
||||
sda 8:0 0 596.2G 0 disk
|
||||
├─sda1 8:1 0 600M 0 part /boot/efi
|
||||
|
|
@ -123,9 +123,9 @@ In the example above, the USB stick is sdb. Just in case it is mounted, unmount
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]$ sudo umount /dev/sdb1
|
||||
[…]$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
|
||||
[…]$ sudo mount /dev/sdb1 /mnt
|
||||
$ sudo umount /dev/sdb1
|
||||
$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
|
||||
$ sudo mount /dev/sdb1 /mnt
|
||||
----
|
||||
|
||||
|
||||
|
|
@ -135,7 +135,7 @@ If possible, you should provide a static network configuration, so you'll know t
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]$ sudo vim /mnt/ks.cfg
|
||||
$ sudo vim /mnt/ks.cfg
|
||||
<INSERT>
|
||||
network --bootproto=static --ip=ww.xx.yy.zz --netmask=255.255.255.0 --gateway=ww.xx.yy.gg --ipv6='aaaa:bbbb:cccc:dddd:eeee:ffff:gggg:hhhh/nnn' --hostname='myhost.mydomain.tld' --nameserver=10.0.2.1
|
||||
rdp --user='SOME_NAME' --password=PASSWORD
|
||||
|
|
@ -163,8 +163,8 @@ b. Scan the network subnet the server is connected to for open port 3389. Adjust
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# dnf install nmap
|
||||
[…]# nmap -Pn -p3389 192.168.158.0/24
|
||||
# dnf install nmap
|
||||
# nmap -Pn -p3389 192.168.158.0/24
|
||||
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-23 08:18 CEST
|
||||
Nmap scan report for example.com (192.168.158.1)
|
||||
Host is up (0.00052s latency).
|
||||
|
|
|
|||
|
|
@ -79,9 +79,9 @@ a. Execute on the local desktop
|
|||
+
|
||||
[source]
|
||||
----
|
||||
[…]$ mkdir ~/.ssh
|
||||
[…]$ cd ~/.ssh
|
||||
[…]$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
|
||||
$ mkdir ~/.ssh
|
||||
$ cd ~/.ssh
|
||||
$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
|
||||
----
|
||||
|
||||
Although the type rsa is widely used, you may adjust your key type accordingly.
|
||||
|
|
@ -92,50 +92,50 @@ You normally use _ssh-copy-id_ to install the public key on the server. However,
|
|||
|
||||
a. Log in to your server via sftp using the unprivileged administration account and transfer the public key file
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sftp hostmin@example.com
|
||||
$ sftp hostmin@example.com
|
||||
sftp> put ~/.ssh/<outputkeyfile>.pub
|
||||
sftp> quit
|
||||
----
|
||||
|
||||
b. Log in to your server via ssh using the unprivileged administration account again
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ ssh hostmin@example.com
|
||||
$ ssh hostmin@example.com
|
||||
----
|
||||
|
||||
c. On the server acquire root permissions, move the key file and adjust permissions
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo su -
|
||||
[…]# mkdir /root/.ssh
|
||||
[…]# cd /root/.ssh
|
||||
[…]# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
|
||||
[…]# chown -R root:root /root/.ssh
|
||||
[…]# chmod 700 /root/.ssh
|
||||
[…]# chmod 600 ~/.ssh/*
|
||||
[…]# restorecon -R -vF /root/.ssh
|
||||
$ sudo su -
|
||||
# mkdir /root/.ssh
|
||||
# cd /root/.ssh
|
||||
# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
|
||||
# chown -R root:root /root/.ssh
|
||||
# chmod 700 /root/.ssh
|
||||
# chmod 600 ~/.ssh/*
|
||||
# restorecon -R -vF /root/.ssh
|
||||
----
|
||||
|
||||
=== Test and Simplify Access
|
||||
|
||||
a. On your local workstation test key file based access:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ssh -i ~/.ssh/<outputkeyfile> root@example.com
|
||||
# ssh -i ~/.ssh/<outputkeyfile> root@example.com
|
||||
----
|
||||
+
|
||||
adjust file, file type, and domain name as appropriate.
|
||||
|
||||
b. To simplify access create a configuration file on your desktop and define a short name for the connection:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vi ~/.ssh/config
|
||||
# vi ~/.ssh/config
|
||||
# ###########################################################
|
||||
# my remote server, root account
|
||||
# ###########################################################
|
||||
|
|
@ -154,9 +154,9 @@ again, replace names accordingly.
|
|||
|
||||
c. Check if everything works:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ssh myhost
|
||||
# ssh myhost
|
||||
----
|
||||
|
||||
== Double check hostname and time synchronisation
|
||||
|
|
@ -165,40 +165,40 @@ Both are important for trouble-free server operation. Just in case you missed it
|
|||
|
||||
a. Check for correct hostname
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl
|
||||
# hostnamectl
|
||||
----
|
||||
* Set hostname if required:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# hostnamectl set-hostname <YourFQDN>
|
||||
# hostnamectl set-hostname <YourFQDN>
|
||||
----
|
||||
|
||||
b. Control of time zone, time synchronisation, time
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl
|
||||
# timedatectl
|
||||
----
|
||||
* Correct time zone if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-timezone <ZONE>
|
||||
# timedatectl set-timezone <ZONE>
|
||||
----
|
||||
* If necessary, activate time synchronisation:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
timedatectl set-ntp true
|
||||
----
|
||||
* Correct time if necessary:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# timedatectl set-time <TIME>
|
||||
# timedatectl set-time <TIME>
|
||||
----
|
||||
|
||||
== Consolidate network configuration
|
||||
|
|
@ -209,22 +209,22 @@ It sounds trivial, but before any change of the network configuration make sure
|
|||
|
||||
a. Check IP addresses, interface and which protocol stack is used
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip a
|
||||
# ip a
|
||||
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n
|
||||
...
|
||||
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER
|
||||
...
|
||||
|
||||
[…]# nmcli con
|
||||
# nmcli con
|
||||
NAME UUID TYPE DEVICE
|
||||
enp3s0 dabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet enp3s0
|
||||
|
||||
[…]# who am i
|
||||
# who am i
|
||||
root pts/5 2021-04-09 21:07 (2003:ca:7f05:xx00:yyyy:zzzz:479a:b36e)
|
||||
|
||||
[…]# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
|
||||
# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
|
||||
=====================================================================
|
||||
Connection details (enp3s0)
|
||||
=====================================================================
|
||||
|
|
@ -238,50 +238,50 @@ ipv6.method: manual
|
|||
|
||||
b. Just in case IPv6 is configured as local only (fe80::....) or not static, you may set up a fixed IPv6
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'enp3s0' ipv6.method manual \
|
||||
# nmcli con mod 'enp3s0' ipv6.method manual \
|
||||
ipv6.addresses <YOUR_IPv6_PREFIX>::2/64 \
|
||||
ipv6.gateway fe80::1 \
|
||||
ipv6.dns "2a01:4f8:xx:yy::zzz:8888 2a01:4f8:xx:yy::zzz:9999"
|
||||
[…]# nmcli con up 'enp3s0'
|
||||
[…]# nmcli con reload
|
||||
# nmcli con up 'enp3s0'
|
||||
# nmcli con reload
|
||||
----
|
||||
+
|
||||
Again, don't forget to adjust names, prefix, and DNS IP addresses. Pay special attention to the gateway. Using a local address of 1 (fe80::1) is a widely used convention.Another is the IPV6 prefix with the address 1. But each provider may have an even different approach.
|
||||
+
|
||||
Check connectivity from your local workstation. If that fails, the gateway configuration is the first suspected culprit.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ping6 <YOUR_IPv6_PREFIX>::2
|
||||
[…]# # e.g. ping6 2a01:xxx:yyy:zzz::2
|
||||
# ping6 <YOUR_IPv6_PREFIX>::2
|
||||
# # e.g. ping6 2a01:xxx:yyy:zzz::2
|
||||
----
|
||||
|
||||
c. Optionally reconfigure IPv4 as static. But make sure the IPv6 address works and don't change both protocol stacks at the same time (and in the worst case drop connectivity at all):
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'enp3s0' ipv4.method manual \
|
||||
# nmcli con mod 'enp3s0' ipv4.method manual \
|
||||
ipv4.addresses <YOUR_IPv4>/27 \
|
||||
ipv4.gateway <GATEWAY> \
|
||||
ipv4.dns "<DNS1_IPv4> <DNS2_IPv4>"
|
||||
[…]# nmcli con up'enp3s0'
|
||||
[…]# nmcli con reload
|
||||
# nmcli con up'enp3s0'
|
||||
# nmcli con reload
|
||||
----
|
||||
+
|
||||
Again, don't forget to adjust names, prefix, and DNS IP addresses and check connectivity from your local workstation:
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ping <YOUR_IPv4>
|
||||
# ping <YOUR_IPv4>
|
||||
----
|
||||
|
||||
d. Optionally you may have a look at the NetworkManager configuration file
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
|
||||
# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
|
||||
----
|
||||
|
||||
Finally reboot now to check everything from ground up
|
||||
|
|
@ -295,26 +295,26 @@ With Fedora 39 the default LVM configuration has changed. The various LVM manage
|
|||
Listing the registered devices::
|
||||
Check the list to see whether all expected devices are included, but also whether each device should actually be part of the current system.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo lvmdevices
|
||||
$ sudo lvmdevices
|
||||
Device /dev/sda3 IDTYPE=sys_wwid IDNAME=naa.5000000000000000 DEVNAME=/dev/sda3 PVID=IoUGXYfv74B3YrmCoPfh9ZsWZsDrVKAN PART=3
|
||||
----
|
||||
|
||||
Adding a device (permanently)::
|
||||
This modifies the devices file in /etc/lvm/devices
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo lvmdevices --adddev /dev/<PART>
|
||||
$ sudo lvmdevices --adddev /dev/<PART>
|
||||
----
|
||||
|
||||
Removing a device (permanently)::
|
||||
This modifies the devices file in /etc/lvm/devices
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]$ sudo lvmdevices --deldev /dev/<PART>
|
||||
$ sudo lvmdevices --deldev /dev/<PART>
|
||||
----
|
||||
|
||||
|
||||
|
|
@ -357,29 +357,29 @@ The software checks log files for anomalies and compiles a daily report that can
|
|||
|
||||
a. Install software
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install logwatch
|
||||
# dnf install logwatch
|
||||
----
|
||||
|
||||
b. The only configuration required is to enter a real email address for root, the recipient of the report. It is added at the end of the file.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vi /etc/aliases
|
||||
# vi /etc/aliases
|
||||
...
|
||||
# Person who should get root's mail
|
||||
#root: marc
|
||||
root: real@address.for.root
|
||||
|
||||
[…]# newaliases
|
||||
# newaliases
|
||||
----
|
||||
|
||||
== Disable systemd-resolved LLMNR and/or mDNS
|
||||
|
||||
You may want to disable LLMNR and/or mDNS depending on your environment. Both protocols are subject to trivial DNS poisoning attacks by a rogue responder.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
-----
|
||||
sudo mkdir -p /etc/systemd/resolved.conf.d
|
||||
sudo touch /etc/systemd/resolved.conf.d/20-disable-llmnr-mdns.conf
|
||||
|
|
@ -408,10 +408,10 @@ include::partial$installation/post-install/manage-dnf-updates.adoc[]
|
|||
== Finally update system and install additional software
|
||||
|
||||
Now that secure administrative access is in place, it's time to update the system and install some useful software. Of course, 'useful software' varies depending on the use case or applications that will be run on Fedora Server. Anyway, a good choice might be vim. With vimdiff e.g. a comparison of updates of configuration files (*.rpmnew) is very comfortable and straightforward.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install vim-default-editor --allowerasing
|
||||
[…]# dnf update
|
||||
# dnf install vim-default-editor --allowerasing
|
||||
# dnf update
|
||||
----
|
||||
Add to the software list as needed.
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ Before you start with partitioning, you have to determine the boot type of your
|
|||
NOTE: Just in case you need a DOS/MBR partitioning scheme for some good reason, you can override the GPT default by adding "inst.mbr" to the kernel boot parameter at the initial boot screen.
|
||||
|
||||
If you don't know the type of your system for sure, you can check the system now. Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
|
||||
----
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue