goroboro/user-documentation
0
0
Fork 0
forked from server/user-documentation
Code Pull requests Activity

Merge branch 'main' into OpenSSH

Browse source
This commit is contained in:
Rowan Puttergill 2026-07-08 17:04:37 +00:00
commit eae8d18810
25 changed files with 965 additions and 962 deletions
Download patch file Download diff file Expand all files Collapse all files

150
modules/ROOT/pages/administration/dnsmasq.adoc
View file

@ -35,9 +35,9 @@ All the necessary interfaces have been installed and fully configured. This incl
+
You should get something like
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer (default)
interfaces: <IF01> ...
<MY_ZONE>
@ -46,32 +46,32 @@ FedoraServer (default)
+
Fix the zone assignments if necessary
+
[source,]
[source,console]
----
[…]# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
[…]# firewall-cmd --reload
# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
# firewall-cmd --reload
----
* **Check auto forwarding**
+
The system should automatically forward between the interfaces. Check the forwarding status and adjust it if necessary.
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 indicates an active forwarding.
+
Otherwise, enable it immediately and configure it permanently.
+
[source,]
[source,console]
----
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
# echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
# vim /etc/sysctl.d/50-enable-forwarding.conf
# local customizations
#
# enable forwarding for dual stack
@ -84,9 +84,9 @@ net.ipv6.conf.all.forwarding=1
The NetworkManager dnsmasq plugin included by default provides a basic configuration skeleton, but does not install the dnsmasq package. Thus, it avoids to uselessly occupy space and to introduce a superfluous and unused binary in case dnsmasq is not going to be in use on the particular server.
In case dnsmasq is not already installed
[source,]
[source,console]
----
[…]# dnf install dnsmasq
# dnf install dnsmasq
----
[IMPORTANT]
@ -111,9 +111,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
1. **Activate the dnsmasq NetworkManager plugin**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# This enables the dnsmasq plugin.
@ -123,9 +123,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
2. **Configuration of the name resolution (DNS) for the internal private network (internal.lan)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
# This file sets up DNS for the private local net domain '<INTERNAL>.lan'
@ -153,16 +153,16 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
+
Provide an empty host file
+
[source,]
[source,console]
----
[…]# touch /etc/dnsmasq-<INTERNAL>.hosts
# touch /etc/dnsmasq-<INTERNAL>.hosts
----
3. **Configuration of the DHCP service for the internal private network (<INTERNAL>.lan)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
# This file sets up DHCP for the private local net domain '<INTERNAL>.lan'
@ -196,9 +196,9 @@ Provide an empty host file
4. **Configuration of the DHCP service for the public network (<PUBLIC.TLD>)**
+
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
# This file sets up DNCP for the public '<PUBLIC.TLD>' domain interface
@ -232,30 +232,30 @@ There is no DNS configuration for the external interface following, assuming tha
5. **Test the dnsmasq configuration**
+
[source,]
[source,console]
----
[…]# dnsmasq --test
# dnsmasq --test
----
6. **Adjusting the firewall**
+
Allow ports for DHCP and DNS (53) service on the public interface.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-services
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
[…]# firewall-cmd --reload
[…]# firewall-cmd --list-all --zone=<YOUR_ZONE>
# firewall-cmd --get-services
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
# firewall-cmd --reload
# firewall-cmd --list-all --zone=<YOUR_ZONE>
----
7. **Restart NetworkManager to start dnsmasq**
+
[source,]
[source,console]
----
[…]# systemctl restart NetworkManager
[…]# ps -ef | grep dnsmasq
# systemctl restart NetworkManager
# ps -ef | grep dnsmasq
dnsmasq 2114 2072 0 08:33 ? 00:00:00 /usr/sbin/dnsmasq --no-resolv ...
----
+
@ -264,10 +264,10 @@ command above.
8. **Restart systemd-resolved**
+
[source,]
[source,console]
----
[…]# systemctl restart systemd-resolved
[…]# resolvectl status
# systemctl restart systemd-resolved
# resolvectl status
----
+
The systemd-resolved should recognize the dnsmasq nameserver attached to interfaces as configured.
@ -276,21 +276,21 @@ The systemd-resolved should recognize the dnsmasq nameserver attached to interfa
a. Test DHCP in the public using a machine without IP address
+
[source,]
[source,console]
----
[…]# ip a # no IPv4 address associated with interface
[…]# dhclient -4 -1 -v eth0
[…]# ip a # expect new IPv4 address associated with interface
[…]# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
[…]# ip a # expect no IPv4 address associated with interface again
# ip a # no IPv4 address associated with interface
# dhclient -4 -1 -v eth0
# ip a # expect new IPv4 address associated with interface
# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
# ip a # expect no IPv4 address associated with interface again
----
b. Try on an other server
+
[source,]
[source,console]
----
[…]# dig app1 @10.10.10.1
[…]# nslookup app1 10.10.10.1
[…]# dhclient -v -d -s 10.10.10.1 enp6s0
# dig app1 @10.10.10.1
# nslookup app1 10.10.10.1
# dhclient -v -d -s 10.10.10.1 enp6s0
----
@ -300,17 +300,17 @@ If machines in the private network need access to the public network, add masque
1. Enabling masquerading for the public zone and for the internal (trusted) trusted zone
+
[source,]
[source,console]
----
[…]# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
success
[…]# firewall-cmd --zone=trusted --add-masquerade --permanent
# firewall-cmd --zone=trusted --add-masquerade --permanent
success
[…]# firewall-cmd --reload
# firewall-cmd --reload
[…]# firewall-cmd --zone=FedoraServer --query-masquerade
# firewall-cmd --zone=FedoraServer --query-masquerade
yes
[…]# firewall-cmd --zone=trusted --query-masquerade
# firewall-cmd --zone=trusted --query-masquerade
yes
----
@ -319,39 +319,39 @@ further to the public network.
+
a. A commonly used way to accomplish this is to set 'rules' in the firewall configuration. Corresponding tutorials are very widespread. And those who are familiar with it may want to continue using it.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer
interfaces: enp1s0
trusted
interfaces: vbr2s0 enp2s0
[…]# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
success
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
success
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
success
----
b. Fedora's firewall daemon, however, offers with release 35 and beyond a more elegant option, so-called 'policies'. These abstract typical targets previously configured by rules.
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
FedoraServer
interfaces: enp1s0
trusted
interfaces: vbr2s0 enp2s0
[…]# firewall-cmd --permanent --new-policy trustedToExt
# firewall-cmd --permanent --new-policy trustedToExt
success
[…]# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
success
[…]# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
success
[…]# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
success
[…]# firewall-cmd --reload
# firewall-cmd --reload
success
----
+
@ -365,9 +365,9 @@ To make it work, just add another configuration file. The example uses libvirt.l
We just add the name resolution (DNS) for the libvirt virtual network (libvirt.lan), leaving the DHCP functionality untouched.
[source,]
[source,console]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
# /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
@ -383,23 +383,23 @@ We just add the name resolution (DNS) for the libvirt virtual network (libvirt.l
+
The format is the same as /etc/hosts .
+
[source,]
[source,console]
----
[…]# vim /etc/dnsmasq.hosts
# vim /etc/dnsmasq.hosts
----
2. Restart NetworkManager to read the modified file.
+
[source,]
[source,console]
----
[…]# systemctl restart NetworkManager
# systemctl restart NetworkManager
----
3. Test the modification
+
[source,]
[source,console]
----
[…]# nslookup {NAME}
[…]# nslookup {NAME}.example.lan
# nslookup {NAME}
# nslookup {NAME}.example.lan
----

30
modules/ROOT/pages/administration/point-to-point-connection.adoc
View file

@ -28,17 +28,17 @@ For an IPv6 configuration, it is sufficient to specify the link address of the g
== Configuration of current Fedora releases
Given an interface enp1s0 with IPv4 address of 192.168.133.100 and the gateway 192.168.133.1 you may configure the interface
[source,]
[source,console]
----
[…]# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
ipv4.gateway '192.168.133.1' ipv4.dns '192.172.1.1'
----
This will result in a configuration file like
[source,]
[source,console]
----
[…]# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
[connection]
id=enp1s0
uuid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
@ -63,7 +63,7 @@ method=manual
----
An alternative notation for the IPv4 part is
[source,]
[source,console]
----
[ipv4]
address1=192.168.133.100/32
@ -72,9 +72,9 @@ route1=0.0.0.0/0,192.168.133.1
----
In any case you get a
[source,]
[source,console]
----
[…]# ip r
# ip r
default via 192.168.133.1 dev enp1s0 proto static metric 100
192.168.133.1 dev enp1s0 proto static scope link metric 100
----
@ -84,9 +84,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
These Fedora releases used _ifcfg-IF_NAME_ files in /etc/sysconfig/network-scripts/. This method dates back to the time before NetworkManager was introduced and network connections were managed with a collection of shell scripts. The shell scripts disappeared with the introduction of NetworkManager, but the configuration files if cfg-NAME was retained as the default configuration method in Release 36 for backward compatibility.
Usually, you configure the interface using a text editor, eg given the above example
[source,]
[source,console]
----
[…]# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
DEVICE=enp1s0
ONBOOT=yes
BOOTPROTO=none
@ -103,18 +103,18 @@ IPV6_DEFAULTDEV=enp1s0
----
Additionally you need a routing table.
[source,]
[source,console]
----
[…]# vim /etc/sysconfig/network-scripts/route-enp1s0
# vim /etc/sysconfig/network-scripts/route-enp1s0
ADDRESS0=0.0.0.0
NETMASK0=0.0.0.0
GATEWAY0=192.168.133.1
----
Both variants result again in a
[source,]
[source,console]
----
[…]# ip r
# ip r
default via 192.168.133.1 dev enp1s0 proto static metric 100
192.168.133.1 dev enp1s0 proto static scope link metric 100
----
@ -122,9 +122,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
== Using systemd-networkd
Some server administrators might prefer systemd-network over NetworkManager. Many of the NetworkManager features are very useful for desktops and laptops, but rather superfluous for servers. The configuration tool is a plain text editor.
[source,]
[source,console]
----
[…]# vim /etc/systemd/network/10-public.network
# vim /etc/systemd/network/10-public.network
[Match]
MACAddress=12:34:56:78:9a:bc # or another identifier

72
modules/ROOT/pages/administration/virtual-routing-bridge.adoc
View file

@ -35,25 +35,25 @@ This article deals with the latter variant.
1. Check the forwarding configuration
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 must be returned. Libvirt will activate IPv4 forwarding, but probably not IPv6. If necessary, activate forwarding temporarily
+
[source,]
[source,console]
----
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
# echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
----
+
The following file must be set up for permanent setup.
+
[source,]
[source,console]
----
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
# vim /etc/sysctl.d/50-enable-forwarding.conf
# local customizations
#
# enable forwarding for dual stack
@ -63,9 +63,9 @@ net.ipv6.conf.all.forwarding=1
2. Checking the existing interfaces
+
[source,]
[source,console]
----
[…]# ip a
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
…
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> … state UP group default qlen 1000
@ -81,10 +81,10 @@ net.ipv6.conf.all.forwarding=1
+
As the listing indicates, the external IPv6 subnet is a common full /64 network. This must be changed to trigger IPv6 forwarding.
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
[…]# nmcli con up enp2s0
# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
# nmcli con up enp2s0
----
4. Creating a routing bridge
@ -93,9 +93,9 @@ The (public) bridge is named vbr1s0, based on the name of the accompanying (publ
+
In the listing of interfaces, the IPv4 address is a point-to-point connection. Therefore, the bridge uses a subnet, if any, the range that is also assigned in DNS. If the IPv4 interface is also created as a subnet, the bridge would be created as a p2p connection instead.
+
[source,]
[source,console]
----
[…]# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
ipv4.method manual ipv4.addresses '148.251.152.29/27' \
ipv6.method manual ipv6.addresses '2a01:4f8:210:512d::2/64' ipv6.addr-gen-mode eui64
----
@ -104,30 +104,30 @@ No zone is specified! Thus the bridge is assigned to the default zone (FedoraSer
+
Finally, for IPv4, the routes must be created and the public addresses of all VMs must be listed
+
[source,]
[source,console]
----
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
----
5. Double check your entries, especially the IP addresses, to avoid incorrect configuration and time-consuming troubleshooting.
6. Activate the routing bridge
+
[source,]
[source,console]
----
[…]# nmcli con up vbr1s0
# nmcli con up vbr1s0
----
7. Installing a VM
+
Use Cockpit or the command line
+
[source,]
[source,console]
----
[…]# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
[…]# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
--os-variant fedora37 --import --disk /var/lib/libvirt/images/vm-01.qcow2,format=qcow2,bus=virtio \
--network bridge=vbr1s0,model=virtio --network bridge=virbr0,model=virtio
----
@ -136,37 +136,37 @@ Complete the First Boot Sceen. Leave the network configuration as it is. It is e
8. Login to the VM and configure the public interface
+
[source,]
[source,console]
----
[…]# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
ipv4.gateway '148.251.152.29' ipv4.dns '213.133.98.98' ipv6.method 'manual' \
ipv6.addresses '2a01:4f8:210:512d::10/64' ipv6.gateway '2a01:4f8:210:512d::2' connection.id enp1s0
[…]# nmcli con up enp1s0
# nmcli con up enp1s0
----
9. If exist adjust the internal interface.
+
[source,bash]
----
[…]# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
[…]# nmcli con up enp2s0
# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
# nmcli con up enp2s0
----
10. Optionally reboot to reinitialize everything
+
[source,bash]
----
[…]# reboot
# reboot
----
=== Testing the configuration
1. Check the forwarding configuration
+
[source,]
[source,console]
----
[…]# cat /proc/sys/net/ipv4/ip_forward
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
# cat /proc/sys/net/ipv4/ip_forward
# cat /proc/sys/net/ipv6/conf/default/forwarding
----
+
In both cases a value of 1 must be returned.
@ -176,9 +176,9 @@ SELinux should be in enforcing mode and firewalld active with zone FedoraServer
+
[source,bash]
----
[…]# getenforce
[…]# firewall-cmd --list-all
[…]# firewall-cmd --get-active-zones
# getenforce
# firewall-cmd --list-all
# firewall-cmd --get-active-zones
----
3. Check IPv6

258
modules/ROOT/pages/containerization/systemd-nspawn-setup.adoc
View file

@ -21,33 +21,33 @@ The systemd-nspawn tools like machinctl look for containers in `/var/lib/machine
Following the Fedora server storage scheme, create a logical volume, create a file system and mount it to `/var/lib/machines`. The tools can use BTRFS properties, so this can be used as a filesystem in this case.
If you don't want to follow the Fedora Server rationale, skip this step.
+
[source,]
[source,console]
----
[…]# dnf install btrfs-progs
[…]# lvcreate -L 20G -n machines {VGNAME}
[…]# mkfs.btrfs -L machines /dev/mapper/{VGNAME}-machines
[…]# mkdir /var/lib/machines
[…]# vim /etc/fstab
# dnf install btrfs-progs
# lvcreate -L 20G -n machines {VGNAME}
# mkfs.btrfs -L machines /dev/mapper/{VGNAME}-machines
# mkdir /var/lib/machines
# vim /etc/fstab
(insert)
/dev/mapper/{VGNAME}-machines /var/lib/machines auto 0 0
[…]# mount -a
# mount -a
----
2. *Check and, if necessary, correct the SELinux labels*
+
Ensure that the directory belongs to root and can only be accessed by root (should be done by the installer).
+
[source,]
[source,console]
----
[…]# restorecon -vFr /var/lib/machines
[…]# chown root:root /var/lib/machines
[…]# chmod 700 /var/lib/machines
# restorecon -vFr /var/lib/machines
# chown root:root /var/lib/machines
# chmod 700 /var/lib/machines
----
3. *Adding configuration for nspawn to the `etc/systemd` directory*
+
[source,]
[source,console]
----
[…]# mkdir /etc/systemd/nspawn
# mkdir /etc/systemd/nspawn
----
== 2. Creating a nspawn container
@ -58,18 +58,18 @@ The creation of a container filesystem or the provision of a corresponding image
1. Creating a BTRFS subvolume with the name of the container
+
[source,]
[source,console]
----
[…]# cd /var/lib/machines
[…]# btrfs subvolume create {ctname}
# cd /var/lib/machines
# btrfs subvolume create {ctname}
----
2. Creating a minimal container directory tree
+
**__Fedora 34 / 35__**
+
[source,]
[source,console]
----
[…]# dnf --releasever=35 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
# dnf --releasever=35 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
install dhcp-client dnf fedora-release glibc glibc-langpack-en glibc-langpack-de iputils less ncurses passwd systemd systemd-networkd systemd-resolved vim-default-editor
----
+
@ -78,9 +78,9 @@ F35 installs 174 packages (270M) and allocates 527M in the file system.
+
**__Fedora 36__**
+
[source,]
[source,console]
----
[…]# dnf --releasever=36 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
# dnf --releasever=36 --best --setopt=install_weak_deps=False --installroot=/var/lib/machines/{CTNAME}/ \
install dhcp-client dnf fedora-release glibc glibc-langpack-en glibc-langpack-de iputils less ncurses passwd systemd systemd-networkd systemd-resolved util-linux vim-default-editor
----
+
@ -90,9 +90,9 @@ F36 installs 171 packages (247M) and allocates 550M in the file system.
+
First create a separate CentOS repository file (e.g. /root/centos.repo) and import CentOS keys.On this basis, perform a standard installation using DNF.
+
[source,]
[source,console]
----
[…]# vim /root/centos8.repo
# vim /root/centos8.repo
<insert>
[centos8-chroot-base]
name=CentOS-8-Base
@ -113,11 +113,11 @@ First create a separate CentOS repository file (e.g. /root/centos.repo) and impo
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
[…]# dnf install http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/Packages/centos-gpg-keys-8-2.el8.noarch.rpm
# dnf install http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/Packages/centos-gpg-keys-8-2.el8.noarch.rpm
[…]# rpm -Uvh --nodeps https:/dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
# rpm -Uvh --nodeps https:/dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
[…]# dnf -c /root/centos8.repo --releasever=8-stream --best --disablerepo=* --setopt=install_weak_deps=False --enablerepo=centos8-chroot-base --enablerepo=centos8-chroot-appstream --enablerepo=epel8-chroot --installroot=/var/lib/machines/{CTNAME} install centos-release dhcp-client dnf glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd systemd-networkd vim-enhanced
# dnf -c /root/centos8.repo --releasever=8-stream --best --disablerepo=* --setopt=install_weak_deps=False --enablerepo=centos8-chroot-base --enablerepo=centos8-chroot-appstream --enablerepo=epel8-chroot --installroot=/var/lib/machines/{CTNAME} install centos-release dhcp-client dnf glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd systemd-networkd vim-enhanced
----
+
@ -130,19 +130,19 @@ The message: `install-info: File or directory not found for /dev/null` appears s
+
This requires temporarily setting SELinux to permissive, otherwise passwd will not make any changes.
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# systemd-nspawn -D /var/lib/machines/{ctname} passwd
[…]# setenforce 1
# setenforce 0
# systemd-nspawn -D /var/lib/machines/{ctname} passwd
# setenforce 1
----
2. Provision of network interfaces for the container within the host
+
If only a connection to an internal, protected network is needed (replace the host bridge interface name accordingly):
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Network]
Bridge=vbr6s0
@ -150,9 +150,9 @@ If only a connection to an internal, protected network is needed (replace the ho
+
If a connection to the external, public network is also required, two corresponding interfaces must be provided, whereby a mac-vlan is used on the interface of the host for the external connection (again, replace the host interface names accordingly).
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Network]
MACVLAN=enp4s0
@ -161,9 +161,9 @@ If a connection to the external, public network is also required, two correspond
3. Configuration of the connection to the internal network within the container
+
[source,]
[source,console]
----
[…]# vim /var/lib/machines/{ctname}/etc/systemd/network/20-host0.network
# vim /var/lib/machines/{ctname}/etc/systemd/network/20-host0.network
(insert)
# {ctname}.localnet
# internal network interface via bridge
@ -186,9 +186,9 @@ If the internal network is also to be used for external access via NAT, the gate
+
In this case, the gateway entry _must_ be commented _out_ in the configuration of the internal network, as mentioned in item 3.
+
[source,]
[source,console]
----
[…]# vim /var/lib/machinec/{ctname}/etc/systemd/network/10-mv.network
# vim /var/lib/machinec/{ctname}/etc/systemd/network/10-mv.network
(insert)
# {ctname}.sowi.uni-bremen.de
# public interface via mac-vlan
@ -228,9 +228,9 @@ Don't forget to adjust interface names and IP addresses accordingly!
+
Check if container boots without error messages
+
[source,]
[source,console]
----
[…]# systemd-nspawn -D /var/lib/machines/{ctname} -b
# systemd-nspawn -D /var/lib/machines/{ctname} -b
OK Spawning container {ctname} on /var/l…01.
OK …
{ctname} login:
@ -239,33 +239,33 @@ Check if container boots without error messages
+
If inactive, activate and start the service.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-networkd
# systemctl status systemd-networkd
…
[…]# systemctl enable systemd-networkd
[…]# systemctl start systemd-networkd
[…]# systemctl status systemd-networkd
# systemctl enable systemd-networkd
# systemctl start systemd-networkd
# systemctl status systemd-networkd
----
7. Check if all network interfaces are available
+
[source,]
[source,console]
----
[…]# ip a
# ip a
----
8. Check for correct routing
+
[source,]
[source,console]
----
[…]# ip route show
# ip route show
----
9. Configure default DNS search path
+
Specify a search domain to appended to a unary hostname without domain part, usually the internal network domain name, e.g. example.lan. Adjust the config file according to the pattern below:
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/resolved.conf
# vim /etc/systemd/resolved.conf
[Resolve]
...
@ -279,49 +279,49 @@ Specify a search domain to appended to a unary hostname without domain part, usu
----
10. Check if name resolution is configured correctly
+
[source,]
[source,console]
----
[…]# ls -al /etc/resolv.conf
# ls -al /etc/resolv.conf
lrwxrwxrwx. 1 root root 39 29. Dez 12:15 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
----
+
If the file is missing or is a text file, correct it.
+
[source,]
[source,console]
----
[…]# cd /etc
[…]# rm -f resolv.conf
[…]# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
[…]# ls -al /etc/resolv.conf
[…]# cd
# cd /etc
# rm -f resolv.conf
# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
# ls -al /etc/resolv.conf
# cd
----
+
Ensure that systemd-resolved service is enabled.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-resolved
# systemctl status systemd-resolved
----
+
Activate the service if necessary.
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-resolved
# systemctl enable systemd-resolved
----
11. Set the intended hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
[…]# hostnamectl set-hostname <FQDN>
# hostnamectl
# hostnamectl set-hostname <FQDN>
----
12. Terminate the container
+
[source,]
[source,console]
----
[…]# <CTRL>+]]]
# <CTRL>+]]]
Container <CTNAME> terminated by signal KILL.
----
@ -331,19 +331,19 @@ Activate the service if necessary.
+
This requires temporarily setting SELinux to permissive, otherwise passwd will not make any changes.
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# systemd-nspawn -D /var/lib/machines/{ctname} passwd
[…]# setenforce 1
# setenforce 0
# systemd-nspawn -D /var/lib/machines/{ctname} passwd
# setenforce 1
----
2. Configuration of container properties
+
Specifying private user configuration and shared network access.
+
[source,]
[source,console]
----
[…]# vim /etc/systemd/nspawn/{ctname}.nspawn
# vim /etc/systemd/nspawn/{ctname}.nspawn
(insert)
[Exec]
PrivateUsers=false
@ -355,9 +355,9 @@ Specifying private user configuration and shared network access.
+
Check if container boots without error messages
+
[source,]
[source,console]
----
[…]# systemd-nspawn -b -D /var/lib/machines/{ctname}
# systemd-nspawn -b -D /var/lib/machines/{ctname}
OK Spawning container {ctname} on /var/l…01.
OK …
{ctname} login:
@ -366,32 +366,32 @@ Check if container boots without error messages
+
If active, deactivate the service.
+
[source,]
[source,console]
----
[…]# systemctl status systemd-networkd
# systemctl status systemd-networkd
…
[…]# systemctl disable systemd-networkd
[…]# systemctl stop systemd-networkd
[…]# systemctl status systemd-networkd
[…]# systemctl status systemd-resolved
# systemctl disable systemd-networkd
# systemctl stop systemd-networkd
# systemctl status systemd-networkd
# systemctl status systemd-resolved
…
[…]# systemctl disable systemd-resolved
[…]# systemctl stop systemd-resolved
[…]# systemctl status systemd-resolved
# systemctl disable systemd-resolved
# systemctl stop systemd-resolved
# systemctl status systemd-resolved
----
+
If file /etc/resolv.conf is a link, remove it.
+
[source,]
[source,console]
----
[…]# rm /etc/resolv.conf
# rm /etc/resolv.conf
----
+
Create (or edit an existing) file /etc/resolv.conf
+
[source,]
[source,console]
----
[…]# vim /etc/resolv.conf
# vim /etc/resolv.conf
nameserver 127.0.0.53
options edns0 trust-ad
@ -399,33 +399,33 @@ search <YOUR_DOMAIN>
----
5. Check if all network interfaces are available
+
[source,]
[source,console]
----
[…]# ip a
# ip a
----
+
You should see the same interfaces and IP addresses as on the host system.
6. Check if name resolution is working correctly
+
[source,]
[source,console]
----
[…]# ping spiegel.de
# ping spiegel.de
PING spiegel.de (128.65.210.8) 56(84) bytes of data.
64 bytes from 128.65.210.8 (128.65.210.8): icmp_seq=1 ttl=59 time=19.8 ms
...
----
7. Set the intended hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
[…]# hostnamectl set-hostname <FQDN>
# hostnamectl
# hostnamectl set-hostname <FQDN>
----
8. Terminate the container
+
[source,]
[source,console]
----
[…]# <CTRL>+]]]
# <CTRL>+]]]
Container <CTNAME> terminated by signal KILL.
----
@ -435,11 +435,11 @@ You should see the same interfaces and IP addresses as on the host system.
+
In this step, a separate UID/GID range is automatically created for the container.
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-nspawn@{ctname}
[…]# systemctl start systemd-nspawn@{ctname}
[…]# systemctl status systemd-nspawn@{ctname}
# systemctl enable systemd-nspawn@{ctname}
# systemctl start systemd-nspawn@{ctname}
# systemctl status systemd-nspawn@{ctname}
----
+
On first boot after installing systemd-container, a SELinux bug currently (Fedora 34/35) blocks execution. The solution is to fix the SELinux label(s).
@ -451,10 +451,10 @@ On first boot after installing systemd-container, a SELinux bug currently (Fedor
+
The proposed solution is roughly as follows:
+
[source,]
[source,console]
----
[…]# ausearch -c 'systemd-machine' --raw | audit2allow -M my-systemdmachine
[…]# semodule -i my-systemdmachine.pp
# ausearch -c 'systemd-machine' --raw | audit2allow -M my-systemdmachine
# semodule -i my-systemdmachine.pp
----
* The operation must be repeated until no SELinux error is reported and the container starts as a service.
+
@ -462,18 +462,18 @@ Alternatively, the SELinux CLI tool can be used, which also suggests these solut
2. Enable automatic start of the container at system startup
+
[source,]
[source,console]
----
[…]# systemctl enable systemd-nspawn@{ctname}
[…]# systemctl status systemd-nspawn@{ctname}
# systemctl enable systemd-nspawn@{ctname}
# systemctl status systemd-nspawn@{ctname}
----
3. Log in to the container
+
[source,]
[source,console]
----
[…]# setenforce 0
[…]# machinectl login {ctname}
# setenforce 0
# machinectl login {ctname}
----
+
When machinectl is called with parameters for the first time, an SELinux bug (Fedora 34/35) also blocks execution. The correction is done in the same way as for the container start.
@ -488,18 +488,18 @@ In case of a CentOS 8-stream container, the epel repository should be installed
+
After finishing all further work inside the container press <ctrl>]]] ( Mac: <ctrl><alt>666) to exit the container and reactivate SELinux.
+
[source,]
[source,console]
----
[…]# setenforce 1
# setenforce 1
----
=== 3.1 Autostart of the container on reboot of the host
An autostart of the container in the "enabled" state fails on Fedora 35 and older. The cause can be seen in a status query after rebooting the host, which issues an error message according to the following example:
[source,]
[source,console]
----
[…]# systemctl status systemd-nspawn@CT_NAME
# systemctl status systemd-nspawn@CT_NAME
systemd-nspawn[802]: Failed to add interface vb-{CT_NAME} to bridge vbr6s0: No such device
----
@ -509,9 +509,9 @@ This means that systemd starts the container before all required network interfa
1. The service file requires an amendment (Bug #2001631). In section [Unit], for the `Wants=` and `After=` configurations, add a target `network-online.target` at the end of each line. The file must then look like this (ignore the commented out marker rows):
+
[source,]
[source,console]
----
[…]# systemctl edit systemd-nspawn@ --full
# systemctl edit systemd-nspawn@ --full
...
[Unit]
Description=Container %i
@ -530,9 +530,9 @@ Important is the character "@" after `nspawn`! In the opening editor make the in
2. Then execute
+
[source,]
[source,console]
----
[…]# systemctl daemon-reload
# systemctl daemon-reload
----
At the next reboot the containers will be started automatically.
@ -541,10 +541,10 @@ At the next reboot the containers will be started automatically.
For such interfaces (usually the bridge virbr0) the addition mentioned above does not help. The container must be started by script in an extra step after Libvirt initialization is complete. For this you can use a hook that Libvirt provides.
[source,]
[source,console]
----
[…]# mkdir -p /etc/libvirt/hooks/network.d/
[…]# vim /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
# mkdir -p /etc/libvirt/hooks/network.d/
# vim /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
(INSERT)
#!/bin/bash
# Check defined nspawn container in /var/lib/machines and
@ -589,7 +589,7 @@ if [ "$network" == "default" ]; then
fi
fi
[…]# chmod +x /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
# chmod +x /etc/libvirt/hooks/network.d/50-start-nspawn-container.sh
----
You may also use the link:{attachmentsdir}/nspawn-autostart-libvirt-hook.tgz[attached script] instead of typing.
@ -603,20 +603,20 @@ For dnf / rpm queries the error message is displayed:
The cause is that Fedora's dfn, which is used for the installation, uses sqlite while CentOS/RHEL use the Berkeley (bdb) format.
Check configuration within the running container:
[source,]
[source,console]
----
[…]# rpm -E "%{_db_backend}"
# rpm -E "%{_db_backend}"
----
The output must be `bdb`. Then fix it executing
[source,]
[source,console]
----
[…]# rpmdb --rebuilddb
# rpmdb --rebuilddb
----
=== 4.2 Error message dev-hugepages
You will find message such as
[source,]
[source,console]
----
dev-hugepages.mount: Mount process exited, code=exited, status=32/n/a
dev-hugepages.mount: Failed with result 'exit-code'.
@ -632,9 +632,9 @@ The messages can be safely ignored.
Some packages, e.g. the `filesystem` package, may not get updated in a container (error message "Error: Transaction failed"), see also https://bugzilla.redhat.com/show_bug.cgi?id=1548403 and https://bugzilla.redhat.com/show_bug.cgi?id=1912155.
Workaround: Run before update:
[source,]
[source,console]
----
[…]# echo '%_netsharedpath /sys:/proc' > /etc/rpm/macros.netshared
# echo '%_netsharedpath /sys:/proc' > /etc/rpm/macros.netshared
----
When an update has already been performed, execute this command and update the package again.

22
modules/ROOT/pages/index.adoc
View file

@ -110,37 +110,37 @@ Fedora 43 updates Postgresql from version 16 directly to version 18, skipping on
+
[source]
----
[…]$ systemctl status postgresql
[…]$ sudo tar -cvJf /var/lib/pgsql/backups/postgres16-bak.tzx /var/lib/pgsql/data/
$ systemctl status postgresql
$ sudo tar -cvJf /var/lib/pgsql/backups/postgres16-bak.tzx /var/lib/pgsql/data/
----
2. Replace installed version 18 by version 17 und use it to update your database
+
[source]
----
[…]$ sudo dnf install postgresql17-server postgresql17-upgrade --allowerasing
[…]$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
$ sudo dnf install postgresql17-server postgresql17-upgrade --allowerasing
$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
----
3. Stop postgres and activate checksums which is a new default in version 18
+
[source]
----
[…]$ systemctl stop postgresql
[…]$ sudo -u postgres pg_checksums -D /var/lib/pgsql/data -e -P
$ systemctl stop postgresql
$ sudo -u postgres pg_checksums -D /var/lib/pgsql/data -e -P
----
4. Reinstall version 18 and update the data again
+
[source]
----
[…]$ mv /var/lib/pgsql/data_old /var/lib/pgsql/data_old_16
[…]$ sudo dnf install postgresql-server postgresql-upgrade --allowerasing
[…]$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
$ mv /var/lib/pgsql/data_old /var/lib/pgsql/data_old_16
$ sudo dnf install postgresql-server postgresql-upgrade --allowerasing
$ sudo -u postgres postgresql-upgrade /var/lib/pgsql/data
----
5. Start postgresql und check if everything works again
+
[source]
----
[…]$ sudo systemctl start postgresql
[…]$ sudo systemctl status postgresql
$ sudo systemctl start postgresql
$ sudo systemctl status postgresql
----
6. Execute the maintenance steps as recommended by the update program and fix collation issues if exist.
7. Done

22
modules/ROOT/pages/installation/index.adoc
View file

@ -104,12 +104,12 @@ In the former case, navigate your browser to _https://fedoraproject.org/server/
In the latter, navigate to the directory where you want to keep the files. We will assume your home directory here. For x86_64 systems, type the following commands line by line.
----
[…]$ mkdir -p ~/tmp && cd ~/tmp
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
[…]$ wget https://fedoraproject.org/fedora.gpg
[…]$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
[…]# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
$ mkdir -p ~/tmp && cd ~/tmp
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
$ wget https://fedoraproject.org/fedora.gpg
$ gpgv --keyring ./fedora.gpg Fedora-Server-41-1.4-x86_64-CHECKSUM
# sha256sum --ignore-missing -c Fedora-Server-41-1.4-x86_64-CHECKSUM
Fedora-Server-dvd-x86_64-41-1.4.iso: OK
sha256sum: WARNING: 17 lines are improperly formatted
----
@ -124,19 +124,19 @@ A installation on bare metal requires to transfer the installation file to a boo
. As a (hard core) server sysadmin to be, you might prefer a fast and efficient CLI tool, the `dd` command. If you are already in a terminal window, connect the USB stick and enter the following command to get a list of connected devices.
+
[source,]
[source,console]
----
[…]# lsblk
# lsblk
----
+
Determine the USB device, e.g. `/dev/sdc`
+
Just in case, umount the device and transfer the downloaded installation file to the device in one go. On the above example use
+
[source,]
[source,console]
----
[…]$ sudo umount /dev/sdc*
[…]$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
$ sudo umount /dev/sdc*
$ dd if=Fedora-Server-dvd-x86_64-41-1.3.iso of=/dev/sdc bs=8M status=progress
----
+
Of course, adjust file and device accordingly! You may receive an error message about parameter `status=progress` not supported. Then you still have an older dd version and have to leave that option off.

2
modules/ROOT/pages/installation/interactive-local.adoc
View file

@ -150,7 +150,7 @@ Fedora uses a GPT partitioning scheme. Thus, on a BIOSboot system you must add a
Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
[source,]
[source,console]
----
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
----

14
modules/ROOT/pages/installation/interactive-remote.adoc
View file

@ -104,7 +104,7 @@ List the connected devices and identify the USB stick
+
[source,bash]
----
[…]$ lsblk
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 596.2G 0 disk
├─sda1 8:1 0 600M 0 part /boot/efi
@ -123,9 +123,9 @@ In the example above, the USB stick is sdb. Just in case it is mounted, unmount
+
[source,bash]
----
[…]$ sudo umount /dev/sdb1
[…]$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
[…]$ sudo mount /dev/sdb1 /mnt
$ sudo umount /dev/sdb1
$ sudo mkfs.vfat -n 'OEMDRV' /dev/sdb1
$ sudo mount /dev/sdb1 /mnt
----
@ -135,7 +135,7 @@ If possible, you should provide a static network configuration, so you'll know t
+
[source,bash]
----
[…]$ sudo vim /mnt/ks.cfg
$ sudo vim /mnt/ks.cfg
<INSERT>
network --bootproto=static --ip=ww.xx.yy.zz --netmask=255.255.255.0 --gateway=ww.xx.yy.gg --ipv6='aaaa:bbbb:cccc:dddd:eeee:ffff:gggg:hhhh/nnn' --hostname='myhost.mydomain.tld' --nameserver=10.0.2.1
rdp --user='SOME_NAME' --password=PASSWORD
@ -163,8 +163,8 @@ b. Scan the network subnet the server is connected to for open port 3389. Adjust
+
[source,bash]
----
[…]# dnf install nmap
[…]# nmap -Pn -p3389 192.168.158.0/24
# dnf install nmap
# nmap -Pn -p3389 192.168.158.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-23 08:18 CEST
Nmap scan report for example.com (192.168.158.1)
Host is up (0.00052s latency).

136
modules/ROOT/pages/installation/postinstallation-tasks.adoc
View file

@ -79,9 +79,9 @@ a. Execute on the local desktop
+
[source]
----
[…]$ mkdir ~/.ssh
[…]$ cd ~/.ssh
[…]$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
$ mkdir ~/.ssh
$ cd ~/.ssh
$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f <outputkeyfile>
----
Although the type rsa is widely used, you may adjust your key type accordingly.
@ -92,50 +92,50 @@ You normally use _ssh-copy-id_ to install the public key on the server. However,
a. Log in to your server via sftp using the unprivileged administration account and transfer the public key file
+
[source,]
[source,console]
----
[…]$ sftp hostmin@example.com
$ sftp hostmin@example.com
sftp> put ~/.ssh/<outputkeyfile>.pub
sftp> quit
----
b. Log in to your server via ssh using the unprivileged administration account again
+
[source,]
[source,console]
----
[…]$ ssh hostmin@example.com
$ ssh hostmin@example.com
----
c. On the server acquire root permissions, move the key file and adjust permissions
+
[source,]
[source,console]
----
[…]$ sudo su -
[…]# mkdir /root/.ssh
[…]# cd /root/.ssh
[…]# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
[…]# chown -R root:root /root/.ssh
[…]# chmod 700 /root/.ssh
[…]# chmod 600 ~/.ssh/*
[…]# restorecon -R -vF /root/.ssh
$ sudo su -
# mkdir /root/.ssh
# cd /root/.ssh
# mv /home/hostmin/<outputkeyfile>.pub /root/.ssh/authorized_keys
# chown -R root:root /root/.ssh
# chmod 700 /root/.ssh
# chmod 600 ~/.ssh/*
# restorecon -R -vF /root/.ssh
----
=== Test and Simplify Access
a. On your local workstation test key file based access:
+
[source,]
[source,console]
----
[…]# ssh -i ~/.ssh/<outputkeyfile> root@example.com
# ssh -i ~/.ssh/<outputkeyfile> root@example.com
----
+
adjust file, file type, and domain name as appropriate.
b. To simplify access create a configuration file on your desktop and define a short name for the connection:
+
[source,]
[source,console]
----
[…]# vi ~/.ssh/config
# vi ~/.ssh/config
# ###########################################################
# my remote server, root account
# ###########################################################
@ -154,9 +154,9 @@ again, replace names accordingly.
c. Check if everything works:
+
[source,]
[source,console]
----
[…]# ssh myhost
# ssh myhost
----
== Double check hostname and time synchronisation
@ -165,40 +165,40 @@ Both are important for trouble-free server operation. Just in case you missed it
a. Check for correct hostname
+
[source,]
[source,console]
----
[…]# hostnamectl
# hostnamectl
----
* Set hostname if required:
+
[source,]
[source,console]
----
[…]# hostnamectl set-hostname <YourFQDN>
# hostnamectl set-hostname <YourFQDN>
----
b. Control of time zone, time synchronisation, time
+
[source,]
[source,console]
----
[…]# timedatectl
# timedatectl
----
* Correct time zone if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-timezone <ZONE>
# timedatectl set-timezone <ZONE>
----
* If necessary, activate time synchronisation:
+
[source,]
[source,console]
----
timedatectl set-ntp true
----
* Correct time if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-time <TIME>
# timedatectl set-time <TIME>
----
== Consolidate network configuration
@ -209,22 +209,22 @@ It sounds trivial, but before any change of the network configuration make sure
a. Check IP addresses, interface and which protocol stack is used
+
[source,]
[source,console]
----
[…]# ip a
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n
...
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER
...
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
enp3s0 dabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet enp3s0
[…]# who am i
# who am i
root pts/5 2021-04-09 21:07 (2003:ca:7f05:xx00:yyyy:zzzz:479a:b36e)
[…]# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
# nmcli -p -f ipv4.method,ipv6.method con show 'enp3s0'
=====================================================================
Connection details (enp3s0)
=====================================================================
@ -238,50 +238,50 @@ ipv6.method: manual
b. Just in case IPv6 is configured as local only (fe80::....) or not static, you may set up a fixed IPv6
+
[source,]
[source,console]
----
[…]# nmcli con mod 'enp3s0' ipv6.method manual \
# nmcli con mod 'enp3s0' ipv6.method manual \
ipv6.addresses <YOUR_IPv6_PREFIX>::2/64 \
ipv6.gateway fe80::1 \
ipv6.dns "2a01:4f8:xx:yy::zzz:8888 2a01:4f8:xx:yy::zzz:9999"
[…]# nmcli con up 'enp3s0'
[…]# nmcli con reload
# nmcli con up 'enp3s0'
# nmcli con reload
----
+
Again, don't forget to adjust names, prefix, and DNS IP addresses. Pay special attention to the gateway. Using a local address of 1 (fe80::1) is a widely used convention.Another is the IPV6 prefix with the address 1. But each provider may have an even different approach.
+
Check connectivity from your local workstation. If that fails, the gateway configuration is the first suspected culprit.
+
[source,]
[source,console]
----
[…]# ping6 <YOUR_IPv6_PREFIX>::2
[…]# # e.g. ping6 2a01:xxx:yyy:zzz::2
# ping6 <YOUR_IPv6_PREFIX>::2
# # e.g. ping6 2a01:xxx:yyy:zzz::2
----
c. Optionally reconfigure IPv4 as static. But make sure the IPv6 address works and don't change both protocol stacks at the same time (and in the worst case drop connectivity at all):
+
[source,]
[source,console]
----
[…]# nmcli con mod 'enp3s0' ipv4.method manual \
# nmcli con mod 'enp3s0' ipv4.method manual \
ipv4.addresses <YOUR_IPv4>/27 \
ipv4.gateway <GATEWAY> \
ipv4.dns "<DNS1_IPv4> <DNS2_IPv4>"
[…]# nmcli con up'enp3s0'
[…]# nmcli con reload
# nmcli con up'enp3s0'
# nmcli con reload
----
+
Again, don't forget to adjust names, prefix, and DNS IP addresses and check connectivity from your local workstation:
+
[source,]
[source,console]
----
[…]# ping <YOUR_IPv4>
# ping <YOUR_IPv4>
----
d. Optionally you may have a look at the NetworkManager configuration file
+
[source,]
[source,console]
----
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
----
Finally reboot now to check everything from ground up
@ -295,26 +295,26 @@ With Fedora 39 the default LVM configuration has changed. The various LVM manage
Listing the registered devices::
Check the list to see whether all expected devices are included, but also whether each device should actually be part of the current system.
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices
$ sudo lvmdevices
Device /dev/sda3 IDTYPE=sys_wwid IDNAME=naa.5000000000000000 DEVNAME=/dev/sda3 PVID=IoUGXYfv74B3YrmCoPfh9ZsWZsDrVKAN PART=3
----
Adding a device (permanently)::
This modifies the devices file in /etc/lvm/devices
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices --adddev /dev/<PART>
$ sudo lvmdevices --adddev /dev/<PART>
----
Removing a device (permanently)::
This modifies the devices file in /etc/lvm/devices
+
[source,]
[source,console]
----
[…]$ sudo lvmdevices --deldev /dev/<PART>
$ sudo lvmdevices --deldev /dev/<PART>
----
@ -357,29 +357,29 @@ The software checks log files for anomalies and compiles a daily report that can
a. Install software
+
[source,]
[source,console]
----
[…]# dnf install logwatch
# dnf install logwatch
----
b. The only configuration required is to enter a real email address for root, the recipient of the report. It is added at the end of the file.
+
[source,]
[source,console]
----
[…]# vi /etc/aliases
# vi /etc/aliases
...
# Person who should get root's mail
#root: marc
root: real@address.for.root
[…]# newaliases
# newaliases
----
== Disable systemd-resolved LLMNR and/or mDNS
You may want to disable LLMNR and/or mDNS depending on your environment. Both protocols are subject to trivial DNS poisoning attacks by a rogue responder.
[source,]
[source,console]
-----
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo touch /etc/systemd/resolved.conf.d/20-disable-llmnr-mdns.conf
@ -408,10 +408,10 @@ include::partial$installation/post-install/manage-dnf-updates.adoc[]
== Finally update system and install additional software
Now that secure administrative access is in place, it's time to update the system and install some useful software. Of course, 'useful software' varies depending on the use case or applications that will be run on Fedora Server. Anyway, a good choice might be vim. With vimdiff e.g. a comparison of updates of configuration files (*.rpmnew) is very comfortable and straightforward.
[source,]
[source,console]
----
[…]# dnf install vim-default-editor --allowerasing
[…]# dnf update
# dnf install vim-default-editor --allowerasing
# dnf update
----
Add to the software list as needed.

2
modules/ROOT/pages/installation/sw-raid-upon-installation.adoc
View file

@ -20,7 +20,7 @@ Before you start with partitioning, you have to determine the boot type of your
NOTE: Just in case you need a DOS/MBR partitioning scheme for some good reason, you can override the GPT default by adding "inst.mbr" to the kernel boot parameter at the initial boot screen.
If you don't know the type of your system for sure, you can check the system now. Open a temporay shell by using `<alt>+<ctrl>+<F2>` and type into the terminal window:
[source,]
[source,console]
----
# [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
----

70
modules/ROOT/pages/server-on-sbc/uboot-installation.adoc
View file

@ -82,17 +82,17 @@ Here we describe the basic steps for creating a customized boot medium (SD card
+
[source,bash]
----
[…]$ sudo dnf -y install arm-image-installer uboot-images-armv8.noarch
$ sudo dnf -y install arm-image-installer uboot-images-armv8.noarch
----
2. Set the download directory as default, fetch a Fedora Server aarch64 system disk raw image, here F43, and check the integrity of the download.
+
[source,bash]
----
[…]$ cd ~/Downloads
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz
[…]$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-43-1.6-aarch64-CHECKSUM
[…]$ sha256sum -c *-CHECKSUM --ignore-missing
$ cd ~/Downloads
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz
$ wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/images/Fedora-Server-43-1.6-aarch64-CHECKSUM
$ sha256sum -c *-CHECKSUM --ignore-missing
Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz: OK
sha256sum: WARNING: 17 lines are improperly formatted
----
@ -103,7 +103,7 @@ The result message includes a complain about some not correct formated lines. It
+
[source,text]
----
[…]$ lsblk
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 596,2G 0 disk
├─sda1 8:1 0 600M 0 part /boot/efi
@ -122,14 +122,14 @@ zram0 252:0 0 7,5G 0 disk [SWAP]
+
[source,bash]
----
[…]$ sudo umount /dev/mmcblk0p1
$ sudo umount /dev/mmcblk0p1
----
5. Identify the name of the support files for your board
+
[source,bash]
----
[…]$ sudo arm-image-installer --supported
$ sudo arm-image-installer --supported
AllWinner Devices:
A10-OLinuXino-Lime A10s-OLinuXino-M A13-OLinuXino A13-OLinuXinoM A20-OLinuXino-Lime A20-OLinuXino-Lime2
A20-OLinuXino-Lime2-eMMC A20-OLinuXino_MICRO A20-Olimex-SOM-EVB Ampe_A76 Auxtek-T003 Auxtek-T004 Bananapi
@ -152,7 +152,7 @@ If you don't find your board, check the _boards.d_ directory directly just in ca
+
[source,bash]
----
[…]$ ls -al /usr/share/arm-image-installer/boards.d | less
$ ls -al /usr/share/arm-image-installer/boards.d | less
----
+
As an example., you will find the PINE64 "ROCKPro64" model as "rockpro64-rk3399"
@ -161,14 +161,14 @@ As an example., you will find the PINE64 "ROCKPro64" model as "rockpro64-rk3399"
+
[source,bash]
----
[…]$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --media=/dev/mmcblk0
$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --media=/dev/mmcblk0
----
+
Just in case you already decided to fill the complete space on disk with the root file system and to dispense with segmentation, you may add the resizefs parameter which would result in an _alternative command line_:
+
[source,bash]
----
[…]$ arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --resizefs --media=/dev/mmcblk0
$ arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro64-rk3399 --resizefs --media=/dev/mmcblk0
----
+
Remember, this is definitely _not a recommended option_ for serious production server operation!
@ -186,7 +186,7 @@ At the SBC terminal, we perform only the minimum, absolutely necessary configura
2. Connect monitor, keyboard and network cable, insert the micro SD card.
3. Connect the SBC to power and wait. After some time a lot of messages scroll across the screen. If the network interface doesn't provide DHCP, in includes a NetworkManager error message. You can safely ignore it for now. It finally ends with a simple, text-based input mask for the first boot configuration.
+
[source,]
[source,console]
----
SoC Rockchip rk3399
Reset cause: POR
@ -214,7 +214,7 @@ The menu is quite simple and a bit old-fashioned, but effective and straightforw
4. The most important item is the configuration of an admin user and their password. Type 5 to enter the submenu.
+
[source,]
[source,console]
----
================================================================================
================================================================================
@ -291,8 +291,8 @@ b. If you are a non-US keyboard user, configure your keyboard mapping. Fist list
+
[source,bash]
----
[…]$ localectl list-keymaps
[…]$ sudo localectl setkeymap de-nodeadkeys
$ localectl list-keymaps
$ sudo localectl setkeymap de-nodeadkeys
----
+
The mapping is imediately active.
@ -301,20 +301,20 @@ c. Configure and activate the network. Adjust the IP, gateway and network settin
+
First, check the existing interfaces.
+
[source,]
[source,console]
----
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
'Wired connection 2' 8d971f49-033f-398a-9714-3a4e848178fb ethernet enp2s0
----
+
Most likely your interfaces are named somewhat awkward way. Let's fix that to make administration of network easier and more comfortable. Don't forget to adjust the naming to your specific installation!
+
[source,]
[source,console]
----
[…]$ sudo nmcli con mod 'Wired connection 1' connection.id end0
$ sudo nmcli con mod 'Wired connection 1' connection.id end0
[…]$ sudo nmcli con mod end0 \
$ sudo nmcli con mod end0 \
ipv4.method manual \
ipv4.address "xxx.xxx.xxx.xxx/yy" \
ipv4.gateway "xxx.xxx.xxx.zzz" \
@ -325,8 +325,8 @@ Most likely your interfaces are named somewhat awkward way. Let's fix that to ma
ipv6.dns "xxxx.xxxx.xxxx.xxxx::vvv" \
connection.zone "FedoraServer"
[…]$ sudo nmcli con up end0
[…]$ sudo systemctl restart NetworkManager
$ sudo nmcli con up end0
$ sudo systemctl restart NetworkManager
----
d. Reboot. You can then disconnect monitor and keyboard. The next steps all happen on the desktop.
@ -405,7 +405,7 @@ Any of the alternatives as above start with the same administrative tasks.
+
[source,bash]
----
[…]$ sudo cfdisk /dev/mmcblk1
$ sudo cfdisk /dev/mmcblk1
----
4. Select partition 3 (Type 8e Linux LVM) using <Cursor down> and then Resize using <Curser left>
+
@ -423,7 +423,7 @@ Select "Write", confirm resizing and quit the program.
+
[source,bash]
----
[…]$ sudo pvresize /dev/mmcblk1p3
$ sudo pvresize /dev/mmcblk1p3
Physical volume "/dev/mmcblk1p3" changed
1 physical volume(s) resized or updated / 0 physical volume(s) not resized
----
@ -440,9 +440,9 @@ For *alternative 3.* select "Grow" and expand the volume to a size that still le
9. Go back to the terminal.
+
[source,]
[source,console]
----
[…]$ sudo df -h
$ sudo df -h
----
+
Confirm that the size of the root file system is now of the specified value.
@ -463,8 +463,8 @@ Because in this case Cockpit is started and active on the device, use your Fedor
+
[source,bash]
----
[…]$ sudo dnf install nmap
[…]$ sudo nmap -Pn -p9090 192.168.158.0/24
$ sudo dnf install nmap
$ sudo nmap -Pn -p9090 192.168.158.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2023-03-23 08:18 CEST
Nmap scan report for fritz.box (192.168.158.1)
Host is up (0.00052s latency).
@ -513,9 +513,9 @@ Beforehand you need to create pair of SSH keys if not already exist. It is best
+
[source,bash]
----
[…]$ cd
[…]$ mkdir ~/.ssh
[…]$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f ~/.ssh/<outputkeyfile>
$ cd
$ mkdir ~/.ssh
$ ssh-keygen -t rsa -b 4096 -C "root@example.com" -f ~/.ssh/<outputkeyfile>
----
+
As an example you may use the name "__id_mysbc_rsa__". Although the type rsa is widely used, you may adjust your key type accordingly.
@ -524,8 +524,8 @@ Turn off the SBC, remove the SD card and connect it to your desktop again as in
+
[source,bash]
----
[…]$ cd
[…]$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro-rk3399 --addkey=~/.ssh/id_mysbc_rsa.pub --media=/dev/mmcblk0
$ cd
$ sudo arm-image-installer --image=Fedora-Server-Host-Generic-43-1.6.aarch64.raw.xz --target=rockpro-rk3399 --addkey=~/.ssh/id_mysbc_rsa.pub --media=/dev/mmcblk0
----
+
When the process has finished, reinstall the CD card in the SBC, and connect to power to start the device again.
@ -534,8 +534,8 @@ Ping the address and as soon as you are connected, use ssh to log in.
+
[source,bash]
----
[…]$ ping 192.168.158.120
[…]$ ssh -i .ssh/id_mysbc_rsa root@192.168.158.172
$ ping 192.168.158.120
$ ssh -i .ssh/id_mysbc_rsa root@192.168.158.172
----
+
You can now create an user account, set the password and add it to group wheel to grant administrative sudo privileges.

113
modules/ROOT/pages/services/filesharing-nfs-installation.adoc
View file

@ -35,9 +35,9 @@ sssd-nfs-idmap::
SSSD plug-in provides a way for rpc.idmapd to call SSSD to map UIDs/GIDs to names and vice versa. It can be also used for mapping principal (user) name to IDs(UID or GID) or to obtain groups which user are member of.
Ensure that these packages are really installed.
[source,]
[source,console]
----
[…]$ rpm -qa | grep nfs
$ rpm -qa | grep nfs
libnfsidmap-2.8.4-0.fc43
sssd-nfs-idmap-2.11.1-4.fc43
nfs-utils-2.8.4-0.fc43
@ -60,9 +60,9 @@ In this guide we will demontrate the latter and create a thin provisioned LV for
1. *Create a nfs export directory in /srv*
+
[source,]
[source,console]
----
[…]$ sudo mkdir /srv/nfs
$ sudo mkdir /srv/nfs
----
+
The created directory is by default readable for everyone, but not writable.
@ -71,9 +71,9 @@ The created directory is by default readable for everyone, but not writable.
+
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
+
[source,]
[source,console]
----
[…]$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /usr/bin/nologin nfs
----
3. *Create and mount the required Logical Volumes*
@ -98,13 +98,13 @@ Again, fill in the form and you are done.
+
For hardcore system administrators with mouse allergy, the whole thing via CLI.
+
[source,]
[source,console]
----
[…]# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
[…]# lvs
[…]# mkfs.xfs /dev/fedora/nfs
[…]# mkdir -p /srv/nfs
[…]# vim /etc/fstab
# lvcreate -L 40G -T fedora/srv -V 30G -T fedora/srv -n nfs
# lvs
# mkfs.xfs /dev/fedora/nfs
# mkdir -p /srv/nfs
# vim /etc/fstab
...
/dev/mapper/fedora-root / xfs defaults 0 0
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
@ -113,27 +113,27 @@ For hardcore system administrators with mouse allergy, the whole thing via CLI.
+
Finallly mount the created filesystem.
+
[source,]
[source,console]
----
[…]# mount -a
# mount -a
----
4. *Create and configure the directories to share*
+
In a typical use case you may create a directory 'common' to widely share data and a directory 'project', in which a team member shares data located in the home directory with the team.
+
[source,]
[source,console]
----
[…]# sudo mkdir -p /srv/nfs/{common,project}
[…]# sudo chown -R nfs.nfs /srv/nfs/*
[…]# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
# sudo mkdir -p /srv/nfs/{common,project}
# sudo chown -R nfs.nfs /srv/nfs/*
# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
----
+
To make the bind mount(s) permanent, add the following entries to the /etc/fstab file:
+
[source,]
[source,console]
----
[…]# vi /etc/fstab
# vi /etc/fstab
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
----
@ -150,9 +150,9 @@ The commented out lines describe the default built in configuration.
1. Configure the NFS basic directory
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/nfs.conf
$ sudo vi /etc/nfs.conf
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
----
@ -162,18 +162,18 @@ The commented out lines describe the default built in configuration.
+
NFS uses port 2049 which is blocked in a Fedora standard installation by defaut.
+
[source,]
[source,console]
----
[…]# firewall-cmd --permanent --add-service=nfs
[…]# firewall-cmd --reload
# firewall-cmd --permanent --add-service=nfs
# firewall-cmd --reload
----
2. *Start NFS enabling autostart at boot time*
+
[source,]
[source,console]
----
[…]# systemctl enable nfs-server --now
[…]# systemctl status nfs-server
# systemctl enable nfs-server --now
# systemctl status nfs-server
----
+
This starts the NFS server only, but not the NFS client. Therefore, the server can not mount file ressources provided by another server. If required, additionally execute at first _`systemctl enable nfs-client.target --now`_. For additional details you may look at _`man 7 nfs.systemd`_.
@ -182,9 +182,9 @@ This starts the NFS server only, but not the NFS client. Therefore, the server c
+
Fedora enables versions 3 and 4.x, version 2 is disabled. The latter is pretty old now. Every machine should provide at least version 3.
+
[source,]
[source,console]
----
[…]# cat /proc/fs/nfsd/versions
# cat /proc/fs/nfsd/versions
-2 +3 +4 +4.1 +4.2
----
+
@ -228,22 +228,23 @@ You can use both options in parallel with the grand configuration file read in f
=== Configuration by example
Example 1::
Example ::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/exports.d/common.exports
$ sudo vi /etc/exports.d/common.exports
<i(nsert)>
/srv/nfs/common *(rw,sync)
----
<<<<<<< HEAD
Example 2::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/exports.d/common.exports
$ sudo vi /etc/exports.d/common.exports
<i(nsert)>
/srv/nfs/common *(rw,sync)
----
@ -251,9 +252,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
Example 3::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/exports.d/common.exports
$ sudo vi /etc/exports.d/common.exports
<i(nsert)>
/srv/nfs/common *(rw,sync)
----
@ -261,9 +262,9 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
Example 4::
Export the directory /srv/nfs/common with everyone, i.e. every network device and every user, can access with Read/Write and Synchronize access
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/exports.d/common.exports
$ sudo vi /etc/exports.d/common.exports
<i(nsert)>
/srv/nfs/common *(rw,sync)
----
@ -271,13 +272,15 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
Example 6::
Export the directory /srv/nfs/projects with all users of a specific network device with Read/Write and Synchronize access
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/exports.d/projects.exports
$ sudo vi /etc/exports.d/projects.exports
<i(nsert)>
/srv/nfs/common *(rw,sync)
----
=======
>>>>>>> maartenl-maartenl-patch-1
==== Connection options
Each default for every exported file system must be explicitly overridden. For example, if the rw option is not specified, then the exported file system is shared as read-only.
@ -345,7 +348,7 @@ An NFSv4 client now has the ability to see all of the exports served by the NFSv
For example, the following commands could be executed on an NFSv4 server:
[source,]
[source,console]
----
mkdir /exports
mkdir /exports/opt
@ -361,7 +364,7 @@ In this example, clients are provided with multiple file systems to mount, by us
Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export configurations are not always compatible. For example, given the following directory tree:
[source,]
[source,console]
----
/home
/home/sam
@ -371,14 +374,14 @@ Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export config
and the export:
[source,]
[source,console]
----
/home *(rw,fsid=0,sync)
----
Using NFS version 2,3 and 4 the following would work:
[source,]
[source,console]
----
mount server:/home /mnt/home
ls /mnt/home/joe
@ -386,7 +389,7 @@ ls /mnt/home/joe
Using v4 the following would work:
[source,]
[source,console]
----
mount -t nfs4 server:/ /mnt/home
ls /mnt/home/joe
@ -394,7 +397,7 @@ ls /mnt/home/joe
The difference being "server:/home" and "server:/". To make the exports configurations compatible for all version, one needs to export (read only) the root filesystem with an fsid=0. The fsid=0 signals the NFS server that this export is the root.
[source,]
[source,console]
----
/ *(ro,fsid=0)
/home *(rw,sync,nohide)
@ -406,30 +409,30 @@ Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs se
== Testing the configuration
On client side:
[source,]
[source,console]
----
[…]# showmount -e 192.168.12.200
# showmount -e 192.168.12.200
----
On client side, try to mount an exported subdirectory:
[source,]
[source,console]
----
[…]# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
# mount 192.168.1.200:/nfsfileshare /mnt/nfsfileshare
----
Display the active mounts
[source,]
[source,console]
----
[…]# mount | grep nfs
# mount | grep nfs
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
nfsd on /proc/fs/nfsd type nfsd (rw,relatime)
192.168.12.5:/nfsfileshare on /mnt/nfsfileshare type nfs4 (rw,relatime,vers=4.1,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.12.7,local_lock=none,addr=192.168.12.5)
----
Check if the NFS mount is writable
[source,]
[source,console]
----
[…]# touch /mnt/nfsfileshare/test
# touch /mnt/nfsfileshare/test
----

62
modules/ROOT/pages/services/httpd-basic-setup.adoc
View file

@ -41,9 +41,9 @@ But in all cases you need a more appropriate alternative data organization. The
_One option_ is to use the `/var/www/` directory to create domain-specific subdirectories and additional appropriate subdirectory within. The advantage of this procedure is that it uses many default httpd configurations, e.g. the SELinux labels. The disadvantage is that the default configuration of the distribution is modified. It is generally better to leave this untouched.
__An alternative option__, in many cases a better fit to FHS compliance is the `/srv` directory. Today you would have many Domains, which are served by one or more applications. According to the FHS, the `/srv` directory is the appropriate place for storing data. You create a domain-specific directory, e.g. example.com, and therein a `htdocs` subdirectory for static html files, a `webapps` subdirectory for your web applicaion, e.g Ruby on Rails, a `mail` subdirectory for a postfix/dovecot mail hub, etc.
__An alternative option__, in many cases a better fit to FHS compliance is the `/srv` directory. Today you would have many Domains, which are served by one or more applications. According to the FHS, the `/srv` directory is the appropriate place for storing data. You create a domain-specific directory, e.g. example.com, and therein a `htdocs` subdirectory for static html files, a `webapps` subdirectory for your web application, e.g Ruby on Rails, a `mail` subdirectory for a postfix/dovecot mail hub, etc.
In this guide we use the latter option. Therefore, we use directories like `/srv/<DOMAINNAME>/` to store all data relevant to a domain, and `/srv/<DOMAINMANE>/htdocs/` for static HTML pages. If you want to use the former option, you can replace `/srv/` by `/var/www/`.
In this guide we use the latter option. Therefore, we use directories like `/srv/<DOMAINNAME>/` to store all data relevant to a domain, and `/srv/<DOMAINNAME>/htdocs/` for static HTML pages. If you want to use the former option, you can replace `/srv/` by `/var/www/`.
== Storage preparation
@ -64,21 +64,21 @@ The easiest way is to create the required volumes with __Cockpit__, the web-base
1. Install the Apache httpd web server. Today, you will almost always need the modules for managing SSL connections and the module for domain monitoring. Everything now runs via https.
+
[source,]
[source,console]
----
[…]$ sudo dnf install httpd mod_ssl mod_md
[…]$ sudo firewall-cmd --add-service=https --permanent
[…]$ sudo firewall-cmd --add-service=http --permanent
[…]$ sudo firewall-cmd --reload
$ sudo dnf install httpd mod_ssl mod_md
$ sudo firewall-cmd --add-service=https --permanent
$ sudo firewall-cmd --add-service=http --permanent
$ sudo firewall-cmd --reload
----
2. Start the web server
+
[source,]
[source,console]
----
[…]$ sudo systemctl start httpd
[…]$ sudo systemctl status httpd
[…]$ sudo systemctl enable httpd
$ sudo systemctl start httpd
$ sudo systemctl status httpd
$ sudo systemctl enable httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
----
@ -88,9 +88,9 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
4. If you plan to manage Let's Encrypt certificates using certbot install
+
[source,]
[source,console]
----
[…]$ sudo dnf install letsencrypt
$ sudo dnf install letsencrypt
----
== Setup a web site
@ -99,28 +99,28 @@ image::services/httpd-basic-setup-030.png[Fedora test page]
+
As discussed above there are several options. In this example we use the /srv alternative and the website base name as base directory.
+
[source,]
[source,console]
----
[…]$ sudo -i
[…]# mkdir -p /srv/SITENAME/htdocs
$ sudo -i
# mkdir -p /srv/SITENAME/htdocs
----
+
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITEMANE/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
It you opt for thinly provisioned volumes use Cockpit to create the volume, format the filesystem and permanently mount it at the base location `/srv/SITENAME/`. Cockpit performs all these steps, you just need to create the htdocs subdirectory.
+
With /srv/ as the base directory you must adjust the SELinux labels.
+
[source,]
[source,console]
----
[…]# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
[…]# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
# /usr/sbin/semanage fcontext -a -t httpd_sys_content_t -s system_u "/srv/SITENAME/htdocs(/.*)?"
# /sbin/restorecon -R -vF /srv/SITENAME/htdocs
Relabeled /srv/SITENAME/htdocs from unconfined_u:object_r:var_t:s0 to system_u:object_r:httpd_sys_content_t:s0
----
+
Create a very basic index page in your document root directory
+
[source,]
[source,console]
----
[…]# vim /srv/SITENAME/htdocs/index.html
# vim /srv/SITENAME/htdocs/index.html
<h1><center>It works!</center></h1>
----
@ -139,9 +139,9 @@ A website using the same name as the server's hostname or its DNS entry, require
+
Edit the copied template file and adjust it as appropriate.
+
[source,]
[source,console]
----
[…]$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
$ sudo vi /etc/httpd/conf.d/zvhost-SITENAME.conf
# Apache vhost configuration for a static html server.
# It manages SSL connections including certificates.
# Initially, a self-signed certificate is active.
@ -195,11 +195,11 @@ Edit the copied template file and adjust it as appropriate.
# We rely on Fedora's systemwide configuration of SSL security.
# By default, certificates are managed by Apache md module (see above)
# In this case, no certificates needs bo be configured here.
# In this case, no certificates needs to be configured here.
# Otherwise, insert proper certificate configuration.
# DEFAULT mod_ssl provided, needed for initial startup.
#==> Comment OUT when module md created a certificate or you use
#==> Comment OUT when module md created a certificate or you use
# custom certificates.
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
@ -341,8 +341,8 @@ Edit the copied template file and adjust it as appropriate.
+
[source,text]
----
[…]# systemctl restart httpd
[…]# systemctl status httpd
# systemctl restart httpd
# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)
Active: active (running) since ...
@ -385,8 +385,8 @@ Unfortunately, the only way to fix this is to modify the distribution provided m
[source,text]
----
[…]# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
[…]# vi /etc/httpd/conf.d/ssl.conf
# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.fc
# vi /etc/httpd/conf.d/ssl.conf
#
# When we also provide SSL we have to listen to the
# standard HTTPS port in addition.
@ -434,7 +434,7 @@ CustomLog logs/ssl_request_log \
#### </VirtualHost> #<======= comment out this line (last line, usually 218)
[…]# systemctl restart httpd
# systemctl restart httpd
----
When the httpd service is up again, everything should work as expected.

80
modules/ROOT/pages/services/postgresql-setup.adoc
View file

@ -24,21 +24,21 @@ A convenient descriptive name for both the logical volume and the file system is
In any case, the system administrator must adapt the following command sequence according to the local requirements! With a Linux LVM and Software raid, XFS can autonomously determine its optimal configuration values. With some hardware raids, intervention by the administrator can also be useful for this.
First, check for the VG name and then adjust the following commands.
[source,]
[source,console]
----
[…]# vgs
# vgs
VG #PV #LV #SN Attr VSize VFree
systemVG 1 1 0 wz--n- 7.55g <4.42g
[…]# lvcreate -L 50G -n pgsql systemVG
# lvcreate -L 50G -n pgsql systemVG
Logical volume "pgsql" created.
[…]# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
meta-data=/dev/mapper/systemVG-pgsql isize=512 agcount=4, agsize=655360 blks
...
Discarding blocks...Done.
[…]# mkdir /var/lib/pgsql
[…]# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
[…]# mount -a
[…]# df -h
# mkdir /var/lib/pgsql
# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
# mount -a
# df -h
----
== 2. Basic installation
@ -46,9 +46,9 @@ First, check for the VG name and then adjust the following commands.
Just one package - postgresql-server - already provides a complete and comprehensive server at your disposal. All the many other Postgresql related packages provide additional options that are only useful or needed for specific special needs.
The package provides the pure server functionality. Fedora additionally loads the packages _postgresql_, a CLI client program granting interactive access to the server, and __postgresql-private-libs__, containing shared libraries used by each of those packages, as dependencies.
[source,]
[source,console]
----
[…]# dnf install postgresql-server
# dnf install postgresql-server
...
==============================================================================
Package Architectur Version
@ -65,9 +65,9 @@ The package provides the pure server functionality. Fedora additionally loads th
----
The installer should have adjusted all SELinux labels in the pgsql directory already created. Check:
[source,]
[source,console]
----
[…]# ls -alZ /var/lib/pgsql/
# ls -alZ /var/lib/pgsql/
drwx------. 4 postgres postgres system_u:object_r:postgresql_db_t:s0 54 ... .
drwxr-xr-x. 45 root root system_u:object_r:var_lib_t:s0 4096 ... ..
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... backups
@ -75,23 +75,23 @@ The installer should have adjusted all SELinux labels in the pgsql directory alr
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... data
----
If the installation program missed something, fix it executing
[source,]
[source,console]
----
[…]# restorecon -vFr /var/lib/pgsql
[…]# ls -alZ /var/lib/pgsql/
# restorecon -vFr /var/lib/pgsql
# ls -alZ /var/lib/pgsql/
----
It is also a prerequisite that exclusively the user postgres has access to the directory pgsql and its subdirectories. Usually the installer takes care of it. Fix it if necessary.
[source,]
[source,console]
----
[…]# chown -R postgres:postgres /var/lib/pgsql
[…]# chmod -R 700 /var/lib/pgsql
# chown -R postgres:postgres /var/lib/pgsql
# chmod -R 700 /var/lib/pgsql
----
When all the requirements are met, perform the initialization of the database cluster. This is a prerequisite for all further activities.
[source,]
[source,console]
----
[…]# postgresql-setup --initdb
# postgresql-setup --initdb
----
== 3. Configuration and initialization
@ -105,8 +105,8 @@ A client can connect to the server either by a Unix socket connection or a TCP/I
If the client does not specify a hostname parameter (-h), a Unix socket connection is established. Postgres uses this method to ensure that root can always securely establish a connection, regardless of password loss, for example. The root user always has permission to assume the identity of the postgresql master user (su - postgres). By default, no other user has this option. As root, you get in any circumstances administrative access to the database.
[source]
----
[…]# su - postgres
[…]$ psql
# su - postgres
$ psql
----
Specifying the host parameter results in an attempt to establish a TCP/IP connection. Postgresql uses port 5432 by default for this purpose. In Fedora, all interfaces are protected by a firewall by default, except for localhost. A connection therefore requires opening a suitable port.
@ -114,8 +114,8 @@ Specifying the host parameter results in an attempt to establish a TCP/IP connec
Fedora abstracts the technical details with Firewalld, so that the administrator does not need to bother with details. For most common uses there are predefined services. So, if you want the database to be accessible via the internal interface assigned to the internal zone, for example, you need just two simple instructions.
[source]
----
[…]$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
[…]$ sudo firewall-cmd --reload
$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
$ sudo firewall-cmd --reload
----
[TIP]
@ -130,9 +130,9 @@ In case of connection issues there is most probably a SELinux configuration miss
For admin access Fedora postgresql is configured to obtain the host's operating system user name from the kernel and using it as the allowed database user name. Therefore, as soon as someone can authentiate on the host as user __postgres__, that person has administrative privileges on the postgresql server without any additional password prompt. The only one who can do that by default, is root. Root can configure additional users to be able to su to postgres. In any case, in a whatever emergency, if any then the system administrator is able to quickly access postgresql server unhindered and salvage what can still get salvaged.
This capability is configured in the ~/data/pg_hba file, together with other properties.
[source,]
[source,console]
----
[…]# vim /var/lib/pgsql/data/pg_hba.conf
# vim /var/lib/pgsql/data/pg_hba.conf
...
# PostgreSQL Client Authentication Configuration File
# ===================================================
@ -151,9 +151,9 @@ If local regulations make it necessary to replace these procedures with a dedica
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking an ident server, that Fedora doesn't install). In most cases you need an authentication based on a password. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
The configuration is done in the file `pg_hba.conf` in the `data` subdirectory. Edit the file to match the pattern below.
[source,]
[source,console]
----
[…]# vim /var/lib/pgsql/data/pg_hba.conf
# vim /var/lib/pgsql/data/pg_hba.conf
# PostgreSQL Client Authentication Configuration File
# ===================================================
...
@ -185,9 +185,9 @@ Some of the possible authentication methods require additional settings for SELi
Now you are allowed to authenticate from machines on the internal network, but you still can't connect from the internal network to the PostgreSQL server. The default configuration restricts connection initially to the local host to avoid any security vulnerabilities in the first place.
Connections granted are configured in ~/data/postgresql.conf. To grant access to VMs on the internal network as well as from local host, edit the file near the beginning to match the pattern below.
[source,]
[source,console]
----
[…]# vim /var/lib/pgsql/data/postgresql.conf
# vim /var/lib/pgsql/data/postgresql.conf
...
#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
@ -210,19 +210,19 @@ An entry of `listen_addresses = '*'` enables connections from any address. It is
== 4. Using PostgreSQL as permanent service
You are now ready to start the PostgreSQL server.
[source,]
[source,console]
----
[…]# systemctl start postgresql
[…]# systemctl status postgresql
# systemctl start postgresql
# systemctl status postgresql
...
... systemd[1]: Started postgresql.service - PostgreSQL database server.
----
If no errors are reported, try to connect as user postgres using the psql cli client. Once connected, start commands with backslash, e.g. \? to get help or \q to quit.
[source,]
[source,console]
----
[…]# su - postgres
[…]$ psql
# su - postgres
$ psql
psql (18.0)
Enter »help« ...
@ -233,14 +233,14 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
postgres-# \q
[…]$ exit
[…]#
$ exit
#
----
If everything works as expected, enable autostart of postgresql,
[source,]
[source,console]
----
[…]# systemctl enable postgresql
# systemctl enable postgresql
----

88
modules/ROOT/pages/tutorials/imagefactory.adoc
View file

@ -49,9 +49,9 @@ _Nested virtualization_ should already work in Fedora, check as described in xre
3. Ensure the _Guestfish suite is installed_ to get the utilities to access and modify generated disk image files. If you follow xref:virtualization/installation.adoc[Adding Virtualization Support] exactly, it is. Otherwise install it.
+
[source,]
[source,console]
----
[…]$ sudo dnf install guestfs-tools
$ sudo dnf install guestfs-tools
----
+
Check to really install `guestfs-tools`, not `libguestfs-tools` (unless you need additional windows guests related software).
@ -87,33 +87,33 @@ image::tutorials/imagefactory-kvm/059-list-volumes-en.png[Cockpit list volumes]
2. _Install Imagefactory_
+
[source,]
[source,console]
----
[…]$ sudo dnf install imagefactory imagefactory-plugins* pykickstart
$ sudo dnf install imagefactory imagefactory-plugins* pykickstart
----
+
This installs about 209 packages (in F38). To be sure, check and restore the SELinux labels for the installation directories.
+
[source,]
[source,console]
----
[…]$ sudo /sbin/restorecon -R -vF /var/lib/imagefactory
[…]$ sudo /sbin/restorecon -R -vF /var/lib/oz
$ sudo /sbin/restorecon -R -vF /var/lib/imagefactory
$ sudo /sbin/restorecon -R -vF /var/lib/oz
----
3. _Adjust Imagefactory configuration_
a. __Enlarge the amount of working memory__ for OZ, the backend used by ImageFactory.
+
[source,]
[source,console]
----
[…]$ sudo sed -i -e 's/# memory = 1024/memory = 2048/' /etc/oz/oz.cfg
$ sudo sed -i -e 's/# memory = 1024/memory = 2048/' /etc/oz/oz.cfg
----
b. Optional: _Switch the image output format_ from the default "raw" type to qcow2 to save disk space. If you have plenty thereof, leave it as is.
+
[source,]
[source,console]
----
[…]$ sudo vim /etc/oz/oz.cfg
$ sudo vim /etc/oz/oz.cfg
(edit)
#image_type = raw
image_type = qcow2
@ -122,9 +122,9 @@ image_type = qcow2
=== Set up a working directory
At a convenient location, create a directory where you will store all your working files, for example, in your home directory.
[source,]
[source,console]
----
[…]$mkdir ~/imagefactory
$ mkdir ~/imagefactory
----
It will primarly used to store the kickstart and the template files. You may use your personal accout and use sudo for all commands. However, it is more convenient to work as root. However, this is only advisable in a dedicated VM as explained above.
@ -135,17 +135,17 @@ The kickstart file describes the content of the disk image to create. Fetch the
1. Fetch the link:{attachmentsdir}/tutorials/imagefactory/fedora-server-kvm-dev.ks[basic kickstart file] and store it into this working directory. In many cases klicking the link stores the file into you default download directory, ~/Downloads in case of Fedora desktops or Macs.
+
[source,]
[source,console]
----
[…]$ mv ~/Downloads/fedora-server-kvm-dev.ks ~/imagefactory/
$ mv ~/Downloads/fedora-server-kvm-dev.ks ~/imagefactory/
----
2. Optional: _Clone the Fedora kickstart repository_ for easy access to reference material.
+
[source,]
[source,console]
----
[…]$ mkdir ~/imagefactory/FedoraKickstarts
[…]$ git clone https://pagure.io/fedora-kickstarts.git -o upstream ~/imagefactory/FedoraKickstarts
$ mkdir ~/imagefactory/FedoraKickstarts
$ git clone https://pagure.io/fedora-kickstarts.git -o upstream ~/imagefactory/FedoraKickstarts
----
+
If you are planning to contribute your VM you should create a fork, too, so you can provide a pull request.
@ -159,9 +159,9 @@ You have to create this file in your working directoy. In this example we name i
The exact content depends entirely on local conditions. The basis is the following sample:
[source,]
[source,console]
----
[…]$ vim ~/imagefactory/fedora-repo.ks
$ vim ~/imagefactory/fedora-repo.ks
# Include the appropriate repo definitions
# uncomment the repo specification to use.
@ -191,9 +191,9 @@ The template file describes meta data of the disk image to create. That includes
Fetch the corresponding link:{attachmentsdir}/tutorials/imagefactory/fedora-server-kvm-dev.tdl[basic template file] and store it into the working directory. In many cases klicking the link stores the file into you default download directory, ~/Downloads in case of Fedora desktops or Macs.
[source,]
[source,console]
----
[…]$ mv ~/Downloads/fedora-server-kvm-dev.tdl ~/imagefactory/
$ mv ~/Downloads/fedora-server-kvm-dev.tdl ~/imagefactory/
----
The version number inside the template file (22) is not necessarily the Fedora target version. For some reason it is best to leave it untouched! But you have to adjust the download URL!
@ -207,24 +207,24 @@ The version number inside the template file (22) is not necessarily the Fedora t
1. prepare and optimize kickstart file with ksflatten:
+
[source,]
[source,console]
----
[…]$ ksflatten -c fedora-server-kvm-dev.ks -o fedora-server-kvm-dev-fl.ks
$ ksflatten -c fedora-server-kvm-dev.ks -o fedora-server-kvm-dev-fl.ks
----
2. Check using ksvalidator
+
[source,]
[source,console]
----
[…]$ ksvalidator -i fedora-server-kvm-dev-fl.ks
$ ksvalidator -i fedora-server-kvm-dev-fl.ks
----
3. Create the image
+
Using a vm and guestfs-tools to adapt the image. This is the _preferred operation_ mode.
+
[source,]
[source,console]
----
[…]$ sudo imagefactory --debug base_image --file-parameter install_script \
$ sudo imagefactory --debug base_image --file-parameter install_script \
fedora-server-kvm-dev-fl.ks fedora-server-kvm-dev.tdl \
--parameter offline_icicle true
----
@ -237,7 +237,7 @@ Additionally, you find loging output in the /var/lib/oz directory. Often specifi
4. Output in case of a successful generation
+
[source,]
[source,console]
----
============ Final Image Details ============
UUID: 4ebde351-e81b-427f-96b7-5acd5680013d
@ -251,17 +251,17 @@ To access the filesystem inside a generated image, use guestfs-tools. Ensure tha
1. Copy the generated vm into the libvirt installation media pool
+
[source,]
[source,console]
----
[…]# qemu-img convert -c -O qcow2 /var/lib/imagefactory/storage/xxx-yyy-zzz.body /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2
# qemu-img convert -c -O qcow2 /var/lib/imagefactory/storage/xxx-yyy-zzz.body /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2
----
2. Check and analyze the file system
+
[source,]
[source,console]
----
[…]# cd /var/lib/libvirt/boot
[…]# guestfish -a fedora-server-kvm-dev.qcow2
# cd /var/lib/libvirt/boot
# guestfish -a fedora-server-kvm-dev.qcow2
Welcome ….
><fs> run
...(wait)
@ -274,34 +274,34 @@ Welcome ….
+
Following the list of file systems above, mount each filesystem and check
+
[source,]
[source,console]
----
[…]# mkdir /mnt/test
[…]# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
# mkdir /mnt/test
# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
----
4. Clean up
+
[source,]
[source,console]
----
[…]# mkdir /mnt/test
[…]# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
# mkdir /mnt/test
# guestmount -a fedora-server-kvm-dev.qcow2 -m /dev/xxx/yyy /mnt/test
----
=== Instantiate and test a created image
1. Copy the generated vm into the libvirt disk image pool
+
[source,]
[source,console]
----
[…]# cp /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2 /var/lib/libvirt/images/vm-test.qcow2
# cp /var/lib/libvirt/boot/fedora-server-kvm-dev.qcow2 /var/lib/libvirt/images/vm-test.qcow2
----
2. Instantiate a VM
+
[source,]
[source,console]
----
[…]# virt-install --name vm-test \
# virt-install --name vm-test \
--memory 4096 --cpu host --vcpus 2 --graphics none\
--os-variant fedora-unknown\
--import \

34
modules/ROOT/pages/tutorials/wordpress-installation.adoc
View file

@ -47,26 +47,26 @@ If not already done install the xref:services/httpd-basic-setup.adoc[Fedora Web
+
[source,bash]
----
[…]# dnf install wordpress
# dnf install wordpress
----
. Add a database and a database user for Wordpress to the MariaDB DB.
+
[source,bash]
----
[…]# mysql -u root
# mysql -u root
MariaDB [(none)]> show databases;
MariaDB [(none)]> CREATE DATABASE wordpress ;
MariaDB [(none)]> CREATE USER 'wordpress' IDENTIFIED BY 'wp-test-proj';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress';
MariaDB [(none)]> quit;
[…]#
#
----
. Check the database connectivity via TCP/IP
+
[source,bash]
----
[…]$ mysql -u wordpress wordpress -p
$ mysql -u wordpress wordpress -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 18
@ -77,7 +77,7 @@ Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.‘
MariaDB [wordpress]> quit
[…]$
$
----
. Configure Wordpress to access the database defined above
@ -86,7 +86,7 @@ Edit the Wordpress configuration file which is _in Fedora_ stored at /etc/wordpr
+
[source,bash]
----
[…]# vim /etc/wordpress/wp-config.php
# vim /etc/wordpress/wp-config.php
define( 'DB_NAME', 'xxxxx' );
define( 'DB_USER', 'xxxx' );
define( 'DB_PASSWORD', 'xxxxxxxx' );
@ -99,7 +99,7 @@ For security reasons, the default configuration restricts access to the local sy
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
Alias /wordpress /usr/share/wordpress
@ -121,7 +121,7 @@ Modify the configuration file further and append at the end:
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
Alias /wordpress /usr/share/wordpress
@ -146,8 +146,8 @@ Provide authentication information
+
[source,bash]
----
[…]# mkdir /etc/httpd/auth.d
[…]# htpasswd -c /etc/httpd/auth.d/validusers {USER}
# mkdir /etc/httpd/auth.d
# htpasswd -c /etc/httpd/auth.d/validusers {USER}
New password:
Re-type new password:
----
@ -156,9 +156,9 @@ Re-type new password:
+
[source,bash]
----
[…]# systemctl enable httpd
[…]# systemctl start httpd
[…]# systemctl status httpd
# systemctl enable httpd
# systemctl start httpd
# systemctl status httpd
----
== Check out and configure your site
@ -202,23 +202,23 @@ Specifically you want to modify the base address of your Wordpress site, from wo
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
## Alias /wordpress /usr/share/wordpress # <== Mod
Alias /mycuteblog /usr/share/wordpress # <== Add
[…]# systemctl restart httpd
# systemctl restart httpd
----
* Alternatively you may want to access the Wordpress pages at your servers base address, example.com in this guide. Again, modify the Wordpress Apache configuration file.
+
[source,bash]
----
[…]# vim /etc/httpd/conf.d/wordpress.conf
# vim /etc/httpd/conf.d/wordpress.conf
## Alias /wordpress /usr/share/wordpress # <== Mod
## Access wordpress via base address instead # <== Add
DocumentRoot /usr/share/wordpress # <== Add
[…]# systemctl restart httpd
# systemctl restart httpd
----

22
modules/ROOT/pages/usecase-gui-addon.adoc
View file

@ -14,7 +14,7 @@ To get an overview of available graphical user interfaces, simply list all insta
+
[source,bash]
----
[…]# dnf group list
# dnf group list
----
You will find
* KDE Plasma Workspaces
@ -33,14 +33,14 @@ You may either use the groups pretty name as shown in the group listing or the c
+
[source,bash]
----
[…]# dnf groupinstall "Cinnamon Desktop"
# dnf groupinstall "Cinnamon Desktop"
----
+
or
+
[source,bash]
----
[…]# dnf install @cinnamon-desktop-environment
# dnf install @cinnamon-desktop-environment
----
3. *Adjustment of systemd to start in graphic mode*
+
@ -48,14 +48,14 @@ To boot into graphical mode by default, you have to adjust the default target.
+
[source,bash]
----
[…]# systemctl set-default graphical.target
# systemctl set-default graphical.target
----
+
With some desktop you may also need:
+
[source,bash]
----
[…]# systemctl enable gdm.service
# systemctl enable gdm.service
----
+
Try it, but you may get a "Service not found" message with some desktops. No need to worry, the installed desktop will come up without that.
@ -63,7 +63,7 @@ Try it, but you may get a "Service not found" message with some desktops. No nee
+
[source,bash]
----
[…]# reboot
# reboot
----
+
Your system will start with the selected graphical desktop.
@ -73,13 +73,13 @@ Your system will start with the selected graphical desktop.
You may install multiple desktops. The utilities `switchdesk` and `switchdesk-gui` can be used to switch the desktop GUI.
[source,bash]
----
[…]# dnf install switchdesk switchdesk-gui
# dnf install switchdesk switchdesk-gui
----
In a terminal window, you can directly switch to another desktop:
[source,bash]
----
[…]# switchdesk cinnamon
# switchdesk cinnamon
----
Without naming the new desktop, a window with the available options will be displayed.
@ -90,12 +90,12 @@ The graphical `_Desktop Switcher_` is included in the Systemadministration menu
You can switch back to booting to a text console:
[source,bash]
----
[…]# systemctl set-default multi-user.target
[…]# reboot
# systemctl set-default multi-user.target
# reboot
----
After having switched back into text mode, you can switch to the selected desktop just for the current session using
[…]# startx
# startx
However, this does not work flawlessly for every available desktop.

102
modules/ROOT/pages/virtualization/installation.adoc
View file

@ -30,7 +30,7 @@ Qemu-kvm in combination with Libvirt management toolkit is the standard virtuali
QEMU / KVM require hardware virtualization support. The first thing to do is to make sure that it is available.
[source,bash]
----
[…]# grep -E --color 'vmx|svm' /proc/cpuinfo
# grep -E --color 'vmx|svm' /proc/cpuinfo
----
The command will return one line per cpu core if virtualization is enabled. If not, you should first check in the BIOS whether virtualization is disabled.
@ -58,21 +58,21 @@ After completion, the file system is immediately available and is also permanent
==== Command line
Some administrators may prefer the command line for easy scripting. Create a Logical Volume of appropriate size, 50 GiB in this esample, either in the system Volume Group (named fedora by default) or in the user data VG if created during installation. Adjust size and VG name as required.
[source,]
[source,console]
----
[…]# lvcreate -L 50G -n libvirt fedora
[…]# mkfs.xfs /dev/fedora/libvirt
[…]# mkdir -p /var/lib/libvirt
[…]# echo "UUID=$(blkid -s UUID -o value /dev/mapper/fedora-libvirt) /var/lib/libvirt xfs defaults 0 0" >> /etc/fstab
# lvcreate -L 50G -n libvirt fedora
# mkfs.xfs /dev/fedora/libvirt
# mkdir -p /var/lib/libvirt
# echo "UUID=$(blkid -s UUID -o value /dev/mapper/fedora-libvirt) /var/lib/libvirt xfs defaults 0 0" >> /etc/fstab
----
== Installing libvirt virtualization software
Installing the software is quite simple.
[source,]
[source,console]
----
[…]# dnf install qemu-kvm-core libvirt virt-install cockpit-machines guestfs-tools
# dnf install qemu-kvm-core libvirt virt-install cockpit-machines guestfs-tools
----
Be sure to install `guestfs-tools`, not `libguestfs-tools` (unless you need additional windows guest related software). The package `guestfs-tools` provides a basic set of various useful tools to maintain virtual disks. Additional packages provide support for specific use cases, e.g. various file systems or forensic support. Use `dnf search guestfs` to get a list of available packages.
@ -81,13 +81,13 @@ Do not install the group `@virtualization` onto a Fedora Server. It includes var
Next check the SELinux labels
[source,bash]
----
[…]# ls -alZ /var/lib/libvirt
# ls -alZ /var/lib/libvirt
----
Usually, installation sets the SELinux labels properly. Otherwise, set them manually.
[source,bash]
----
[…]# restorecon -R -vF /var/lib/libvirt
# restorecon -R -vF /var/lib/libvirt
----
If everything is correct, the next step is to activate autostart after re-boot and start KVM and libvirtd.
@ -98,14 +98,14 @@ With Fedora 35 libvirt switched to a _modular archtecture_ (since version 7.6.0-
Enable automatic startup at boot and start libvirt.
[source,bash]
----
[…]# systemctl enable libvirtd --now
# systemctl enable libvirtd --now
----
By default, libvirt creates a (virtual) bridge with an interface virbr0, the IP 192.168.122.1 and the libvirt-internal name as default. In addition, a separate firewall zone libvirt is set up and assigned to the internal interface. Check if everything is running as expected.
[source,bash]
----
[…]# ip a
[…]# firewall-cmd --get-active-zones
# ip a
# firewall-cmd --get-active-zones
----
=== Activation and startup with Fedora 35 and up
@ -120,21 +120,21 @@ if you are planning to use the virtual network independently from starting virtu
+
[source,bash]
----
[…]# systemctl enable virtnetworkd.service --now
# systemctl enable virtnetworkd.service --now
----
+
Alternatively, you may want to completely discard libvirt's internal network. You'll take this path if you set up an internal network with NetworkManager tools.
+
[source,bash]
----
[…]# systemctl disable virtnetworkd.socket --now
# systemctl disable virtnetworkd.socket --now
----
2. **Activate (start) the required libvirt modular drivers**
+
[source,]
[source,console]
----
[…]# for drv in qemu interface network nodedev nwfilter secret storage ; \
# for drv in qemu interface network nodedev nwfilter secret storage ; \
do systemctl start virt${drv}d{,-ro,-admin}.socket ; done
----
+
@ -146,9 +146,9 @@ The boot process now starts virtualization automatically without administrative
3. *Check successful start via a status query*
+
[source,]
[source,console]
----
[…]# for drv in qemu interface network nodedev nwfilter secret storage ; \
# for drv in qemu interface network nodedev nwfilter secret storage ; \
do systemctl status virt${drv}d{,-ro,-admin}.socket ; done
● virtqemud.socket - libvirt QEMU daemon socket
Loaded: loaded (/usr/lib/systemd/system/virtqemud.socket; enabled; preset: enabled)
@ -189,7 +189,7 @@ The first step is to choose a domain name. A top-level ".local" is explicitly no
Use the libvirt tool to adjust the default network. Replace names and placeholders as required. Delete the line with "forward mode = 'nat'" if you do not want to allow access to the public network via the virtual network.
[source,xml]
----
[…]# virsh net-edit default
# virsh net-edit default
<network>
<name>default</name>
<uuid>aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee</uuid>
@ -216,15 +216,15 @@ Use the libvirt tool to adjust the default network. Replace names and placeholde
Activate the modified configuration.
[source,bash]
----
[…]# virsh net-destroy default
[…]# virsh net-start default
# virsh net-destroy default
# virsh net-start default
----
Check if the DNS resolution works.
[source,bash]
----
[…]# nslookup host 192.168.122.1
[…]# dig @192.168.122.1 host.example.com
# nslookup host 192.168.122.1
# dig @192.168.122.1 host.example.com
----
== Adjusting the hosts DNS resolution configuration
@ -238,10 +238,10 @@ The following procedure doesn't work for Fedora 35-39. Don't use it with these r
1. The name resolver service _systemd-resolved_ introduced with Fedora 33 can do this automatically. But libvirt handles its interfaces on its own and must therefore inform systemd-resolved about it. A script in a hook provided by libvirt can take care of this. You have to adjust the local domain name (${example.lan} in the script below) accordingly!
+
[source,]
[source,console]
----
[…]# mkdir -p /etc/libvirt/hooks/network.d/
[…]# vim /etc/libvirt/hooks/network.d/40-config-resolved.sh
# mkdir -p /etc/libvirt/hooks/network.d/
# vim /etc/libvirt/hooks/network.d/40-config-resolved.sh
#>--INSERT--<#
#!/bin/bash
# Add the internal libvirt interface virbr0 to the
@ -286,7 +286,7 @@ if [ "$network" == "default" ]; then
fi
#>--SAVE&QUIT--<#
[…]# chmod +x /etc/libvirt/hooks/network.d/40-config-resolved.sh
# chmod +x /etc/libvirt/hooks/network.d/40-config-resolved.sh
----
2. Check if /etc/resolv.conf is a link and not a file.
@ -294,24 +294,24 @@ Activate modified local DNS resolving
+
[source,bash]
----
[…]# ls -al /etc/resolv.conf
# ls -al /etc/resolv.conf
----
+
In case it is a file, fix it:
+
[source,bash]
----
[…]# cd /etc
[…]# rm -f resolv.con
[…]# systemctl restart systemd-resolved
[…]# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
# cd /etc
# rm -f resolv.con
# systemctl restart systemd-resolved
# ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf
----
3. Test the hook file
+
[source,bash]
----
[…]# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
P1: default - P2: started - P3: begin @ Mon Mar ...
----
@ -319,17 +319,17 @@ In case it is a file, fix it:
+
[source,bash]
----
[…]# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
# /etc/libvirt/hooks/network.d/40-config-resolved.sh default started begin
P1: default - P2: started - P3: begin @ Mon Mar ...
----
5. Check the functionality of name resolution with internal and external addresses.
[source,bash]
----
[…]# ping host
[…]# ping host.example.lan
[…]# ping host.example.com
[…]# ping guardian.co.uk
# ping host
# ping host.example.lan
# ping host.example.com
# ping guardian.co.uk
----
+
Everything should work fine now.
@ -342,7 +342,7 @@ Activate dnsmasq plugin
[source,bash]
----
[…]# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
# /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
#
# This enabled the dnsmasq plugin.
@ -354,7 +354,7 @@ Define the local domain and DNS service
[source,bash]
----
[…]# vim /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
# vim /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
# /etc/NetworkManager/dnsmasq.d/00-example-lan.conf
#
# This file directs dnsmasq to forward any request to resolve
@ -367,12 +367,12 @@ Activate modified local DNS resolving
[source,bash]
----
[…]# systemctl stop systemd-resolved
[…]# systemctl disable systemd-resolved
[…]# rm /etc/resolv.conf
[…]# nmcli con mod enp3s0 ipv4.dns-search 'example.lan'
[…]# nmcli con mod enp3s0 ipv6.dns-search 'example.lan'
[…]# systemctl restart NetworkManager
# systemctl stop systemd-resolved
# systemctl disable systemd-resolved
# rm /etc/resolv.conf
# nmcli con mod enp3s0 ipv4.dns-search 'example.lan'
# nmcli con mod enp3s0 ipv6.dns-search 'example.lan'
# systemctl restart NetworkManager
----
@ -380,10 +380,10 @@ Check the functionality of name resolution with internal and external addresses.
[source,bash]
----
[…]# ping host
[…]# ping host.example.lan
[…]# ping host.example.com
[…]# ping guardian.co.uk
# ping host
# ping host.example.lan
# ping host.example.com
# ping guardian.co.uk
----

26
modules/ROOT/pages/virtualization/nested-virtualization.adoc
View file

@ -28,18 +28,18 @@ However, that does not mean it should be used as a standard configuration. The t
1. The (physical) host CPU must support nested virtualization.
+
[source,]
[source,console]
----
[…]$ sudo egrep --color 'vmx|svm|ept' /proc/cpuinfo
$ sudo egrep --color 'vmx|svm|ept' /proc/cpuinfo
----
+
The output must include the `vmx` and `ept` flags. This is generally the case on Intel Core-i based CPUs.
2. Ensure that nested virtualization is enabled in the (physical) hosts kernel:
+
[source,]
[source,console]
----
[…]$ sudo cat /sys/module/kvm_intel/parameters/nested
$ sudo cat /sys/module/kvm_intel/parameters/nested
----
+
If the command __returns 1 or Y__, the feature is enabled. Continue with xref:#_setting_up_a_vm_for_nested_virtualization[Setting up a VM for nested virtualization]
@ -48,22 +48,22 @@ If the command _returns 0 or N_ but your system supports nested virtualization,
a. Execute the following commands to enable the nested virtualization feature
+
[source,]
[source,console]
----
[…]$ sudo modprobe -r kvm_intel
[…]$ sudo modprobe kvm_intel nested=1
$ sudo modprobe -r kvm_intel
$ sudo modprobe kvm_intel nested=1
----
b. Ensure the operation is successfull
+
[source,]
[source,console]
----
[…]$ sudo cat /sys/module/kvm_intel/parameters/nested
$ sudo cat /sys/module/kvm_intel/parameters/nested
----
c. To make the change permanent and cope with a restart, edit
+
[source,]
[source,console]
----
[…]$ sudo vim /etc/modprobe.d/kvm.conf
$ sudo vim /etc/modprobe.d/kvm.conf
options kvm_intel nested=1
----
@ -77,9 +77,9 @@ Log in to the virtual server that is to host additional virtual machines.
3. Check the installation
+
[source,]
[source,console]
----
[…]$ sudo virt-host-validate qemu
$ sudo virt-host-validate qemu
QEMU: Checking for hardware virtualization : PASS
QEMU: Checking if device /dev/kvm exists : PASS
QEMU: Checking if device /dev/kvm is accessible : PASS

170
modules/ROOT/pages/virtualization/vm-install-cloudimg-centos9.adoc
View file

@ -48,12 +48,12 @@ But by cloud base image you (usually) don’t get an alternatively built but oth
_It is up to the system administrator to decide whether the functionality is identical to the extent that the advantages outweigh the disadvantages and it makes sense to use a specific cloud image as a virtual machine._
== How to proceed
First of all you need a working Fedora Server Edition including virtualization support added and libvirtd daemon active. We assume an internal network 'default' with virbr0, DHCP, and DNS set up as well (see section 'Add Virtualization Support'). External network connectivity will be provided by macvlan (ethernet interface) rsp. macvtap (libvirt naming).
First of all you need a working Fedora Server Edition including virtualization support added and libvirtd daemon active. We assume an internal network 'default' with virbr0, DHCP, and DNS set up as well (see section 'Add Virtualization Support'). External network connectivity will be provided by macvlan (ethernet interface) resp. macvtap (libvirt naming).
You have various options:
* Using Cockpit graphical interactive tool to perform a quick minimal VM setup
* Using virt-install CLI interactive tool to perform a quick mminimal VM setup based on cloud-init
* Using Cockpit graphical interactive tool to perform a quick minimal VM setup
* Using virt-install CLI interactive tool to perform a quick minimal VM setup based on cloud-init
* Using virt-install CLI interactive tool to perform a elaborate VM setup based on cloud-init
* virt-customize and virt-install CLI tools for a fairly easy, interactive VM setup
* Using any of the CLI tools to perform a script based automated installation
@ -63,25 +63,25 @@ We will only cover the former two variants here. They are so universal that they
== General preparations
Whichever of the presented installation methods is chosen, a cloud image always has to be downloaded and verified. In the case of CentOS, this involves the following steps.
1. Check on the CentOS project site the lastest release of GenericCloud image:
1. Check on the CentOS project site the latest release of GenericCloud image:
https://cloud.centos.org/centos/9-stream/x86_64/images/ At the time of this writing it was CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
2. In the Cockpit terminal window, fetch a CentOS 9-stream generic image file and store it into the directory `/var/lib/libvirt/boot`. This is by convention the libvirt default location of images for installation. Check the integrity of the download.
+
[source,]
[source,console]
----
[…]$ sudo su -
[…]# cd /var/lib/libvirt/boot
[…]# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
[…]# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2.SHA256SUM
[…]# sha256sum --ignore-missing -c *.SHA256SUM
$ sudo su -
# cd /var/lib/libvirt/boot
# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
# wget https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2.SHA256SUM
# sha256sum --ignore-missing -c *.SHA256SUM
----
+
You may want to gather some information about the image
+
[source,bash]
----
[…]# qemu-img info CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
# qemu-img info CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
image: CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2
file format: qcow2
@ -116,7 +116,7 @@ You _must_ enter a root password. This will activate the root account at the sam
====
[IMPORTANT]
====
__NON-US system administrators__: Cloud image usually configures inially a US keyboard, and you can adjust the keyboard layout after the first login at the earliest. Limit the password to matching key positions (and change it later if you want)
__NON-US system administrators__: Cloud image usually configures initially a US keyboard, and you can adjust the keyboard layout after the first login at the earliest. Limit the password to matching key positions (and change it later if you want)
====
Select _Create_ to start the installation.
@ -129,29 +129,29 @@ In the list of running virtual machines click on the newly created box.
image::virtualization/vm-install-cloudimg-centos9-020.png[Cockpit `__Create new virtual machine__` form]
The created runtime environment is rather basic. With cloud image installation, you cannot defer the creation process and fine-tune the runtime configuration, as you can with other installation options. There is a default disk configuration, e.g. a default CDrom and one disk as configured. And there is just one network connection, which uses libvirt&#8217;s default virtual network.
The created runtime environment is rather basic. With cloud image installation, you cannot defer the creation process and fine-tune the runtime configuration, as you can with other installation options. There is a default disk configuration, e.g. a default CDrom and one disk as configured. And there is just one network connection, which uses libvirt&#8217;s default virtual network.
Log in with the root account. If you look around, you will find some resemblance to a CentOS server configuration. Cockpit is installed, but not activated. Firewall installation is completely missing. The virtual disk contains one flat XFS file system. The active network configuration resides in `/etc/sysconfig/network-scripts` (due to cloud-init limitations). Residues of a NetworkManager network configuration exist in `/etc/NetworkManager/system-connections`.
Log in with the root account. If you look around, you will find some resemblance to a CentOS server configuration. Cockpit is installed, but not activated. Firewall installation is completely missing. The virtual disk contains one flat XFS file system. The active network configuration resides in `/etc/sysconfig/network-scripts` (due to cloud-init limitations). Residues of a NetworkManager network configuration exist in `/etc/NetworkManager/system-connections`.
So there is some post-installation work to do.
==== Adjust locale and non-US keyboard layout
Users of a non-US keyborad layout probably want to customize the keyboard layout first of all.
Users of a non-US keyboard layout probably want to customize the keyboard layout first of all.
1. Check the current locale configuration
+
[source,]
[source,console]
----
[…]# localectl
# localectl
System Locale: LANG=en_US.UTF-8
VC Keymap: us
X11 Layout: us
----
2. List available keyboard mappings filtered by your short county code part
2. List available keyboard mappings filtered by your short country code part
+
[source,]
[source,console]
----
[…]# localectl list-keymaps | grep de-
# localectl list-keymaps | grep de-
de-T3
de-deadacute
de-deadgraveacute
@ -167,10 +167,10 @@ de-nodeadkeys
+
[source,bash]
----
[…]# localectl set-keymap de-nodeadkeys
# localectl set-keymap de-nodeadkeys
...
----
The setting is immediately activ.
The setting is immediately active.
==== Network configuration
@ -185,20 +185,20 @@ The latter is now the recommended approach. It acts similar to a bridge, but wit
1. While logged in use the terminal window to set the static hostname. It ensures a correct DNS setup in a DHCP environment.
+
[source,]
[source,console]
----
[…]$ hostnamectl set-hostname vm1-el9.example.com
[…]$ hostnamectl
$ hostnamectl set-hostname vm1-el9.example.com
$ hostnamectl
----
2. If you expanded the terminal window click on the VM name in the breadcrumb to get the default view. Select shutdown to stop the virtual machine.
3. An administrator who sticks to the habit that the first network adapter in the device list establishes the external connection will now edit and rearrange the existing network configuration. Select `__Edit__` to access the Configuration form.
3. An administrator who sticks to the habit that the first network adapter in the device list establishes the external connection will now edit and rearrange the existing network configuration. Select `__Edit__` to access the Configuration form.
+
image::virtualization/vm-install-cloudimg-centos9-030.png[Cockpit `__Virtual ethernet configuration form__`]
+
Replace the interface type by `__Direct attachment__` and select the external physical interface of the host in the `__Source__` field. Leave `__model__` and `__MAC address__` unchanged.
4. If you also want an internal network (and you definitely should in most cases), select `__Add network interface__`. A nearly identical form pops up. Select `__Interface tpye__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` (__Linux, perf__) and `__MAC address__` (__Generate automatically__) unchanged. Click Create to finish to create the network configuration.
4. If you also want an internal network (and you definitely should in most cases), select `__Add network interface__`. A nearly identical form pops up. Select `__Interface type__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` (__Linux, perf__) and `__MAC address__` (__Generate automatically__) unchanged. Click Create to finish to create the network configuration.
5. Start the virtual machine again.
@ -207,9 +207,9 @@ Replace the interface type by `__Direct attachment__` and select the external ph
+
From a terminal window in the host system you should be able to ping your VM using the internal virtual network.
+
[source,]
[source,console]
----
[…]$ ping vm1-el9
$ ping vm1-el9
----
+
If the name service setup in the host is correct, the short name should work. Otherwise try the internal FQDN name (i.e. something like vm1-el9.example.lan). If name resolution doesn&#8217;t work, switch to the VM&#8217;s Cockpit terminal window. Use `ip a` to determine the internal IP and use this to ping the VM.
@ -217,10 +217,10 @@ If the name service setup in the host is correct, the short name should work. Ot
If pinging the IP address works, fix the name resolution. Otherwise check again network configuration.
2. *Check external connections*
+
From a machine on your network try to ping the virtual machinge
From a machine on your network try to ping the virtual machine
+
----
[…]$ ping vm1-el9.example.com
$ ping vm1-el9.example.com
----
+
In case of issues proceed analog to the internal connection.
@ -232,54 +232,54 @@ A Cockpit installation cannot implement the widely used security concept of lock
1. If there is already another user and this user is to be granted administrative rights, the account must be assigned to the wheel group.
+
[source,]
[source,console]
----
[…]# usermod -aG wheel <USERNAME>
# usermod -aG wheel <USERNAME>
----
+
Test if login and sudo work!
2. If you decide to lock the root account, login as your administrative user and execute
+
[source,]
[source,console]
----
[…]# sudo passwd -l root
# sudo passwd -l root
----
+
Log off and try to login as root (e.g. using the host's Cockpit instance). The system should respong with 'Login incorrect'.
Log off and try to login as root (e.g. using the host's Cockpit instance). The system should respond with 'Login incorrect'.
3. If you decide to use the root account and you chose a simple password during installation, you should set a long and secure password. Log in as root and execute
+
[source,]
[source,console]
----
[…]# passwd
# passwd
----
+
If root also needs access via ssh, a key-based login must be set up. Follow step 5 of the xref:installation/postinstallation-tasks.adoc[post-installation guide].
4. Install and activate the firewall
+
[source,]
[source,console]
----
[…]# dnf install firewalld
[…]# systemctl enable firewalld --now
[…]# firewall-cmd --list-all
# dnf install firewalld
# systemctl enable firewalld --now
# firewall-cmd --list-all
----
5. If you want to use Cockpit you have to enable it
+
[source,]
[source,console]
----
[…]# systemctl enable cockpit.socket --now
# systemctl enable cockpit.socket --now
----
+
Cockpit should start up as soon as you connect with your browser.
6. Finally, if you want the virtual machine to start automatically at system startup, check the corresponding box in the Cockpit VM overview. Alternatively execute
+
[source,]
[source,console]
----
[…]# virsh autostart vm1-el9
# virsh autostart vm1-el9
----
== Using virt-install for a CLI interactive minimal effort installation
@ -293,18 +293,18 @@ Essentially, you need to copy the downloaded image file to the libvirt disk imag
1. Copy the disk image from the installation media pool to the disk images pool and choose the intended VM name as target.
+
[source,]
[source,console]
----
[…]$ sudo su -
[…]# cd /var/lib/libvirt/boot
[…]# cp CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2 ../images/vm2-el9.qcow2
$ sudo su -
# cd /var/lib/libvirt/boot
# cp CentOS-Stream-GenericCloud-9-20220315.0.x86_64.qcow2 ../images/vm2-el9.qcow2
----
2. Inspect the disk size and optionally adjust it. The default is about 10 GiB.
+
[source,]
[source,console]
----
[…]# qemu-img info /var/lib/libvirt/images/vm2-el9.qcow2
[…]# qemu-img resize /var/lib/libvirt/images/vm2-el9.qcow2 +10G
# qemu-img info /var/lib/libvirt/images/vm2-el9.qcow2
# qemu-img resize /var/lib/libvirt/images/vm2-el9.qcow2 +10G
----
+
The example above adds 10 GiB to a total size of about 20 GiB.
@ -313,9 +313,9 @@ You can resize the virtual disk later, too. Therefore, there is no reason to pla
=== Installation
Use a terminal window to execute
[source,]
[source,console]
----
[…]# virt-install --name vm2-el9\
# virt-install --name vm2-el9\
--memory 2048 --cpu host --vcpus 2 --graphics none\
--os-variant centos-stream9\
--import \
@ -362,7 +362,7 @@ Log in to the root account giving the password displayed early in the installati
[IMPORTANT]
====
__**NON-US system administrators**__: Cloud Image usually configures a __US keyboard__ first! The easiest way is to copy & paste the password. Limit the new password to matching key positions, choose a rather simple one to minimize the chance ot typos, and change it to a secure password later after keyboard configuration..
__**NON-US system administrators**__: Cloud Image usually configures a __US keyboard__ first! The easiest way is to copy & paste the password. Limit the new password to matching key positions, choose a rather simple one to minimize the chance of typos, and change it to a secure password later after keyboard configuration.
====
==== Post-Installation Tasks
@ -371,18 +371,18 @@ As usual, also in computer science the "law of conservation of energy" applies.
1. Non-US system administrators should adjust the layout first.
a. Check the current locale configuration
+
[source,]
[source,console]
----
[…]# localectl
# localectl
System Locale: LANG=en_US.UTF-8
VC Keymap: us
X11 Layout: us
----
b. List available keyboard mappings filtered by your short county code part. Replaye "de-" by your country, i.e. "<COUNTRYCODE>-"
b. List available keyboard mappings filtered by your short country code part. Replace "de-" with your country, i.e. "<COUNTRYCODE>-"
+
[source,]
[source,console]
----
[…]# localectl list-keymaps | grep de-
# localectl list-keymaps | grep de-
de-T3
de-deadacute
de-deadgraveacute
@ -396,16 +396,16 @@ de-nodeadkeys
+
c. Determine applicable key mapping and apply it
+
[source,]
[source,console]
----
[…]# localectl set-keymap de-nodeadkeys
# localectl set-keymap de-nodeadkeys
...
----
The setting is immediately activ.
The setting is immediately active.
2. Check network connection
+
[source,]
[source,console]
----
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ....
@ -426,20 +426,20 @@ If DHCP was available for all interfaces, a complete interface configuration is
+
Check for connectivity:
+
[source,]
[source,console]
----
[…]# ping guardian.co.uk
[…]# ping <YOUR_EXTERNAL_DEFAULT_GATEWAY_ADDRESS>
[…]# ping 192.168.122.1 # your host system internal virtual network address
# ping guardian.co.uk
# ping <YOUR_EXTERNAL_DEFAULT_GATEWAY_ADDRESS>
# ping 192.168.122.1 # your host system internal virtual network address
----
+
The VM can connect to internal and external destinations. The name resolution for the vm itself can&#8217;t work because the static hostname is not set yet. The external host address is not responding due to Mac vlan technology and the internal name resolution is not working yet.
+
Check the interface devices.
+
[source,]
[source,console]
----
[…]# nmcli dev
# nmcli dev
DEVICE TYPE STATE CONNECTION
eth0 ethernet connected System eth0
eth1 ethernet connected Wired connection 1
@ -451,9 +451,9 @@ The file `/etc/NetworkManager/system-connections/ens3.nmconnection` is a leftove
+
Probably you want to have a persistent configuration file, so can assign a firewall zone to the connection. Just rename the connection.
+
[source,]
[source,console]
----
[…]# nmcli con mod 'Wired connection 1' connection.id eth1
# nmcli con mod 'Wired connection 1' connection.id eth1
----
+
The renaming triggers NetworkManager to create a file `/etc/sysconfig/network-scripts/ifcfg-eth1` with the current configuration.
@ -462,26 +462,26 @@ If DHCP is not available for the external interface, the configuration file is j
3. In case the virtual disk size has been changed, the partition sizes must be adjusted.
+
[source,]
[source,console]
----
[…]# cfdisk /dev/vda
# cfdisk /dev/vda
----
The only partition should already have the adjusted size. Otherwise select resize and then write.
+
Next resize the file system, if not already done. First check the size of the file system, e.g. using df.
+
[source,]
[source,console]
----
[…]# df -h
[…]# resize2fs -p /dev/vda1
# df -h
# resize2fs -p /dev/vda1
----
4. Finally, let&#8217;s set the hostname
+
[source,bash]
----
[…]# ##hostnamectl set-hostname VM_NAME.example.com
[…]# hostnamectl set-hostname vm2-el9.example.com
# ##hostnamectl set-hostname VM_NAME.example.com
# hostnamectl set-hostname vm2-el9.example.com
----
Exit and close the console typing <ctrl>+].
@ -491,13 +491,13 @@ You may reboot the VM and than check /var/lib/libvirt/dnsmasq/virbr0.status agai
If your external DHCP server provides dynamic DNS as well, you should be able to connect to your VM from the public network:
[source,batch]
----
[…]# ping VM_NAME.example.com
# ping VM_NAME.example.com
----
Last action is to enable autostart of the VM.
[source,]
[source,console]
----
[…]# virsh autostart VM_NAME
# virsh autostart VM_NAME
----
Everything is working fine now, nearly out of the box. You would now start configuring the VM in detail according to its intended use. Just as it would be required after a standard installation.
@ -516,7 +516,7 @@ The use of Cloud Base Images to create a distribution's virtual machine installa
=== Short explanation of the virt-install parameter used
--name VM_NAME:: Unique name of the VM to install as shown e.g.in VM list
--name VM_NAME:: Unique name of the VM to install as shown e.g. in VM list
--memory 3074:: Amount of memory to allocate, adjust as appropriate
--cpu host:: same cpu type as host
--vcpus 3:: number of cpus for VM, adjust as appropriate
@ -524,7 +524,7 @@ The use of Cloud Base Images to create a distribution's virtual machine installa
--import:: Fixed, skips installation procedure and boots from the first (virtual) disk as specified by the first disk parameter.
--graphics none:: Fixed, enforces a redirect of the VM login prompt to the host terminal window for immediate access.
--disk /var/lib/libvirt/images/VM_NAME.qcow2, format=qcow2,bus=virtio:: disk image file, adjust VM_NAME
--network direct,source=enpXsY,source_mode=bridge, model=virtio:: specify _external_ netwok (macvlan) __first__, it will get the name eth0 as usual. Adjust interface name as appropriate.
--network direct,source=enpXsY,source_mode=bridge, model=virtio:: specify _external_ network (macvlan) __first__, it will get the name eth0 as usual. Adjust interface name as appropriate.
--network bridge=virbr0,model=virtio:: specify the _internal_ network (libvirt generated bridge) _second_. It will get the name eth1 as usual.
--cloud-init:: Deal with nocloud configuration using defaults

228
modules/ROOT/pages/virtualization/vm-install-diskimg-fedoraserver.adoc
View file

@ -56,15 +56,15 @@ We assume a complete installation of virtualization support according to the xre
1. If not already done, *download the Fedora Server Edition* virtual disk image into the _Installation media_ storage pool and verify the image. This involves the following steps on x86_64 hardware. For ARM machines replace 'x86_64' by 'aarcb64' in the following example.
+
[source,]
[source,console]
----
[…]$ sudo -i
[…]# cd /var/lib/libvirt/boot
[…]# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/images/Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2
[…]# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/iso/Fedora-Server-43-1.6-x86_64-CHECKSUM
[…]# curl -O https://fedoraproject.org/fedora.gpg
[…]# gpgv --keyring ./fedora.gpg Fedora-Server-43-1.6-x86_64-CHECKSUM
[…]# sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
$ sudo -i
# cd /var/lib/libvirt/boot
# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/images/Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2
# wget https://download.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/iso/Fedora-Server-43-1.6-x86_64-CHECKSUM
# curl -O https://fedoraproject.org/fedora.gpg
# gpgv --keyring ./fedora.gpg Fedora-Server-43-1.6-x86_64-CHECKSUM
# sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2: OK
sha256sum: WARNING: 17 lines are improperly formatted
----
@ -73,21 +73,21 @@ You can savely ignore the warning. Important is just the OK status of the image.
+
If you copy or move files directly from elsewhere, you should check the correct SELinux label and correct it if necessary.
+
[source,]
[source,console]
----
[…]# ls -alZ /var/lib/libvirt/boot/*
[…]# restorecon -R -vF /var/lib/libvirt/boot/*
# ls -alZ /var/lib/libvirt/boot/*
# restorecon -R -vF /var/lib/libvirt/boot/*
----
2. *Adjust the image file* to your needs. The maximum disk size of the server VM image file is 10 GiB, of which about 6GB in the root file system is free. This is not intended for productive operation, but as a starting point for customization. The minimal recommended size is about 20G. To save these adjustment steps for further instantiations, create a customized base image. Copy the disk image to an intermediate file and adjust the maximum disk size.
+
[source,]
[source,console]
----
[…]# cd /var/lib/libvirt/boot
[…]# cp Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2 Fedora-Server-43-custom.qcow2
[…]# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
[…]# qemu-img resize /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 40G
[…]# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
# cd /var/lib/libvirt/boot
# cp Fedora-Server-Guest-Generic-43-1.6.x86_64.qcow2 Fedora-Server-43-custom.qcow2
# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
# qemu-img resize /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 40G
# qemu-img info /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2
----
+
The example above expands the maximal capacity to 40 GiB. You can resize the virtual disk later, too. Therefore, there is no reason to plan too generously in terms of size now. Due to the qcow2 format resizing does not affect the current image file size. It is dynamically adjusted as needed up to the maximum specified.
@ -101,10 +101,10 @@ The example above expands the maximal capacity to 40 GiB. You can resize the vir
Copy the customized distribution file into the disk image pool and use virt-install to instantiate the new virtual machine. In the example, we assume that the VM has 2 interfaces, one for connecting to the public network and another for connecting to the internal protected network. Adjust this to your needs. You could even install the VM without any interface. In this case, you must use the virsh console ('virsh console <VM_NAME>) to log in and obtain a terminal window.
[source,]
[source,console]
----
[…]# cp /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
[…]# virt-install --name <VM_NAME> \
# cp /var/lib/libvirt/boot/Fedora-Server-43-custom.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
# virt-install --name <VM_NAME> \
--memory 4096 --cpu host --vcpus 2 --graphics none \
--os-variant fedora-unknown \
--import \
@ -120,7 +120,7 @@ The parameters are quite descriptive and are to be adjusted accordingly. You wil
A lot of messages then scroll across the screen. If the network interface doesn't provide DHCP, in includes a NetworkManager error message. You can safely ignore it for now. It finally ends with a simple, text-based input mask for the first boot configuration.
[source,]
[source,console]
----
Starting install...
Running text console command: virsh --connect qemu:///system console rbox03
@ -215,7 +215,7 @@ You have to use the terminal for this step, whether you performed the instantiat
1. *Complete the first boot configuration*
+
[source,]
[source,console]
----
================================================================================
================================================================================
@ -235,7 +235,7 @@ The clear majority of the input options are already preset with values that corr
+
The selection of a menu item to be edited is made via the digit in front of it. Somewhat unusual in these days and age. The process is unfortunately a bit cumbersome. A "5" navigates to the item "User creation" and a "1" then to the creation of a new user.
+
[source,]
[source,console]
----
================================================================================
================================================================================
@ -257,7 +257,7 @@ quit, 'r' to refresh]:
+
The "[x]" in front of Create user indicates that the user creation process is activ. Accordingly, password authentication is enabled for the new user as well as administrator privileges. Fill in the required information and in any case ensure to activate the adminstrator privileges! It automatically adds "wheel" to Groups.
+
[source,]
[source,console]
----
================================================================================
================================================================================
@ -286,7 +286,7 @@ All non-British users may grab the opportunity to adjust the time zone using opt
+
Another "c" continues with the execution of the entire configuration process. The operation takes some time and then ends in a login prompt.
+
[source,]
[source,console]
----
...
...
@ -315,10 +315,10 @@ The virtual server is up and running now, and ready for log in. The initial conf
+
Users of a non-US keyboard layout probably want to customize the keyboard layout first of all. This facilitates any subsequent operation. First, check the current locale configuration
+
[source,]
[source,console]
----
[…]# sudo -i
[…]# localectl
# sudo -i
# localectl
System Locale: LANG=en_US.UTF-8
VC Keymap: us
X11 Layout: us
@ -327,9 +327,9 @@ System Locale: LANG=en_US.UTF-8
+
List available keyboard mappings filtered by your short county code part
+
[source,]
[source,console]
----
[…]# localectl list-keymaps | grep de-
# localectl list-keymaps | grep de-
de-T3
de-deadacute
de-deadgraveacute
@ -345,7 +345,7 @@ Determine applicable key mapping and apply it
+
[source,bash]
----
[…]# localectl set-keymap de-nodeadkeys
# localectl set-keymap de-nodeadkeys
----
+
The setting is immediately active.
@ -356,42 +356,42 @@ A correct hostname is specifically important for DHCP of the internal network to
+
a. __Check hostname__. You need a correct static hostname.
+
[source,]
[source,console]
----
[…]# hostnamectl
# hostnamectl
----
b. _Set hostname_ if required:
+
[source,]
[source,console]
----
[…]# hostnamectl set-hostname <YourFQDN>
# hostnamectl set-hostname <YourFQDN>
----
4. *Check time zone and time synchronisation* if you missed that previously
a. _Check time settings_
+
[source,]
[source,console]
----
[…]# timedatectl
# timedatectl
----
b. Correct time zone if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-timezone <ZONE>
# timedatectl set-timezone <ZONE>
----
c. If necessary, activate time synchronisation:
+
[source,]
[source,console]
----
[…]# timedatectl set-ntp true
# timedatectl set-ntp true
----
d. Correct time if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-time <TIME>
# timedatectl set-time <TIME>
----
+
If you get a warning about RTC time set to local time, follow the instructions to fix it.
@ -402,9 +402,9 @@ a. At first *check your interfaces*
+
If you followed the example installation above you should find
+
[source,]
[source,console]
----
[…]# ip a
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
@ -422,9 +422,9 @@ If the external interface doesn't provide DHCP you won't find an assigned IP add
b. Next let's *check and fix NetworkManager naming*
+
[source,]
[source,console]
----
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
'Wired connection 2' 8d971f49-033f-398a-9714-3a4e848178fb ethernet enp2s0
'Wired connection 1' 8d971f49-033f-398a-9714-3a4e848178fb ethernet ---
@ -432,19 +432,19 @@ NAME UUID TYPE DEVICE
+
Most likely your interfaces are a named somewhat awkward way. Let's fix that to make administration of network easier and more comfortable. Don't forget to adjust the naming to your specific installation!
+
[source,]
[source,console]
----
[…]# nmcli con mod 'Wired connection 1' connection.id enp1s0
[…]# nmcli con mod 'Wired connection 2' connection.id enp2s0
# nmcli con mod 'Wired connection 1' connection.id enp1s0
# nmcli con mod 'Wired connection 2' connection.id enp2s0
----
c. In case DHCP is missing on an interface, configure a static network connection
+
We take the external interface as an example here.
+
[source,]
[source,console]
----
[…]# nmcli con mod enp1s0 ipv4.method manual \
# nmcli con mod enp1s0 ipv4.method manual \
ipv4.address "xxx.xxx.xxx.xxx/yy" \
ipv4.gateway "xxx.xxx.xxx.zzz" \
ipv4.dns "xxx.xxx.xxx.vvv" \
@ -453,25 +453,25 @@ We take the external interface as an example here.
ipv6.gateway xxxx:xxxx:xxxx:xxxx::zz \
ipv6.dns "xxxx.xxxx.xxxx.xxxx::vvv" \
connection.zone "FedoraServer"
[…]# nmcli con up enp1s0
[…]# systemctl restart NetworkManager
# nmcli con up enp1s0
# systemctl restart NetworkManager
----
d. The interface enp2s0 for the internal libvirt network may show an IPv6 IP, which we don't use. Therefore, you should disable IPv6 on the internal interface
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2s0 ipv6.method disabled \
# nmcli con mod enp2s0 ipv6.method disabled \
connection.zone "trusted"
[…]# nmcli con up enp2s0
[…]# systemctl restart NetworkManager
# nmcli con up enp2s0
# systemctl restart NetworkManager
----
e. Check the default routes if you have 2 interfaces, one with an external public connection, one with the internal network, which uses NAT by default. So you have 2 parallel connection paths to access the public network and will find something like
+
[source,]
[source,console]
----
[…]# ip r
# ip r
default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
default via 192.168.122.1 dev enp2s0 proto dhcp src 192.168.122.107 metric 101
192.168.122.0/24 dev enp2s0 proto kernel scope link src 192.168.122.107 metric 101
@ -480,13 +480,13 @@ default via 192.168.122.1 dev enp2s0 proto dhcp src 192.168.122.107 metric 101
+
Delete the NAT route to avoid issues because of ambigous routes by some application software.
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2s0 ipv4.never-default yes
[…]# nmcli con down enp2s0
[…]# nmcli con up enp2s0
[…]# systemctl reload NetworkManager
[…]# ip r
# nmcli con mod enp2s0 ipv4.never-default yes
# nmcli con down enp2s0
# nmcli con up enp2s0
# systemctl reload NetworkManager
# ip r
default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
192.168.122.0/24 dev enp2s0 proto kernel scope link src 192.168.122.107 metric 101
192.168.158.0/24 dev enp1s0 proto kernel scope link src 192.168.158.160 metric 100
@ -495,38 +495,38 @@ default via 192.168.158.1 dev enp1s0 proto dhcp src 192.168.158.160 metric 100
+
The installer assigns all interfaces to the _FedoraServer_ zone, which limits access to ssh (and Cockpit). For the internal, protected network a broader accessibility may be appropriate, depending on the use case. If appropriate, modify the configuration (check alternative zone and select a suitable one).
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
[…]# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
[…]# firewall-cmd --reload
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
# firewall-cmd --reload
# firewall-cmd --get-active-zones
----
7. Optionally *adjust default editor*
+
By default nano is the default system editor in Fedora. Many experienced system administrators prefer vim. If you are among the latter, adjust the default editor.
+
[source,]
[source,console]
----
[…]# dnf install vim-default-editor --allowerasing
# dnf install vim-default-editor --allowerasing
----
8. *Finally perform an update and reboot*
+
[source,]
[source,console]
----
[…]# dnf update
[…]# reboot
# dnf update
# reboot
----
9. *Close the virsh console mode*
+
You were automatically in virsh's console mode until now. Exit this mode and you will be back on the host system.
+
[source,]
[source,console]
----
[…]# <ctrl>]
# <ctrl>]
Domain creation completed.
[…]#
#
----
If you opted for Cockpit to instantiate the VM you may use Cockpits graphical interface for the last 4 steps.
@ -542,9 +542,9 @@ The distributed disk image features a disk size of about 7 gb. This is not inten
At this point, we have to specify the allocation and adjustment of the intended maximum disc size. Unfortunately, Cockpit doesn't provide graphical support for editing an existing partition table. So we are bound to CLI for the first step.
Login to the virtual machine and use the cfdisk utility to display the space allocation as distributed and adjusted pre installation.
[source,]
[source,console]
----
[…]# cfdisk /dev/vda
# cfdisk /dev/vda
Disk: /dev/vda
Size: 37 GiB, 39728447488 bytes, 77594624 sectors
Label: gpt, identifier: BAD551E3-F483-4FB3-BF4C-EF516A914C13
@ -570,9 +570,9 @@ As you see, on the disk there is unused space, not associated to any partition.
Partition vda3 contains a Volume Group (VG).
[source,]
[source,console]
----
[…]# vgdisplay
# vgdisplay
--- Volume group ---
VG Name sysvg
System ID
@ -589,9 +589,9 @@ As you see, the complete space is occupied by a Logical Volume (LV).
Check the logical volume
[source,]
[source,console]
----
[…]# lvdisplay
# lvdisplay
--- Logical volume ---
LV Path /dev/sysvg/root
LV Name root
@ -619,9 +619,9 @@ As you see, the Logical Volume is of the same size as the Volume Group, about 6
1. Enlarge the LVM partition to fill the disk
+
[source,]
[source,console]
----
[…]# cfdisk /dev/vda
# cfdisk /dev/vda
Disk: /dev/vda
Size: 37 GiB, 39728447488 bytes, 77594624 sectors
Label: gpt, identifier: BAD551E3-F483-4FB3-BF4C-EF516A914C13
@ -649,12 +649,12 @@ Select resize, confirm the suggested maximum size, and then write the change to
2. Enlarge the VG to fill up the partition
+
[source,]
[source,console]
----
[…]# pvresize /dev/vda3
# pvresize /dev/vda3
Physical volume "/dev/vda3" changed
1 physical volume(s) resized or updated / 0 physical volume(s) not resized
[…]# vgdisplay sysvg
# vgdisplay sysvg
--- Volume group ---
VG Name sysvg
System ID
@ -666,14 +666,14 @@ Select resize, confirm the suggested maximum size, and then write the change to
Alloc PE / Size 1535 / <6.00 GiB
Free PE / Size 7680 / 30.00 GiB
...
[…]#
#
----
3. Enlarge the LV. A recommended size is 8 - 15G max, depending on the total disk size. As an example, the new size is 12 G which leaves the rest free for further user data LVs.
+
[source,]
[source,console]
----
[…]# lvextend -L 12G /dev/mapper/sysvg-root
# lvextend -L 12G /dev/mapper/sysvg-root
Size of logical volume sysvg/root changed from <6.00 GiB (1535 extents) to 12.00 GiB (3072 extents).
[ 1337.365631] dm-0: detected capacity change from 12574720 to 25165824
Logical volume sysvg/root successfully resized.
@ -681,15 +681,15 @@ Select resize, confirm the suggested maximum size, and then write the change to
4. Enlarge the XFS root filesystem to fill the LV
+
[source,]
[source,console]
----
[…]# xfs_growfs /dev/mapper/sysvg-root
# xfs_growfs /dev/mapper/sysvg-root
meta-data=/dev/mapper/sysvg-root isize=512 agcount=4, agsize=392960 blks
= sectsz=512 attr=2, projid32bit=1
...
data blocks changed from 1571840 to 3145728
[…]# df -h
# df -h
Filesystem Size Used Avail Use% Mounted on
...
/dev/mapper/sysvg-root 12G 1.8G 11G 15% /
@ -706,20 +706,20 @@ For the last 2 steps you can also switch to __Cockpit__. But the 2 lines may not
3. Create a Physical Volume (PV) in the new partition
+
[source,]
[source,console]
----
[…]# pvcreate /dev/vda4
# pvcreate /dev/vda4
Physical volume "/dev/vda4" successfully created.
----
4. Create a Volume Group (VG) in the new Physical Volume
+
[source,]
[source,console]
----
[…]# vgcreate usrvg /dev/vda4
# vgcreate usrvg /dev/vda4
Volume group "usrvg" successfully created
[…]# vgs
# vgs
VG #PV #LV #SN Attr VSize VFree
sysvg 1 1 0 wz--n- <20.00g <8.00g
usrvg 1 0 0 wz--n- <16.00g <16.00g
@ -738,12 +738,12 @@ You can use either _CLI_ or _Cockpit_ for this step.
. On the host system, create a _new virtual disk_ in /var/lib/libvirt/images
+
[source,]
[source,console]
----
[…]# qemu-img create -f qcow2 /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 20G
# qemu-img create -f qcow2 /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 20G
Formatting '/var/lib/libvirt/images/vm01-test-usr.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=21474836480 lazy_refcounts=off refcount_bits=16
[…]# qemu-img info /var/lib/libvirt/images/${VM_NAME}-usr.qcow2
# qemu-img info /var/lib/libvirt/images/${VM_NAME}-usr.qcow2
file format: qcow2
virtual size: 20 GiB (21474836480 bytes)
disk size: 196 KiB
@ -759,9 +759,9 @@ Format specific information:
. Continue on the host and add the disk to the virtual machine. Use the first available diskname. The system disk is vda, so the next available disk name is vdb. If you are unsure check in the virtual machine, e.g. using '__lsblk__'.
+
[source,]
[source,console]
----
[…]# virsh attach-disk ${VM_NAME} /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 vdb --cache default --persistent --targetbus=virtio --subdriver qcow2
# virsh attach-disk ${VM_NAME} /var/lib/libvirt/images/${VM_NAME}-usr.qcow2 vdb --cache default --persistent --targetbus=virtio --subdriver qcow2
Disk attached successfully
----
+
@ -769,9 +769,9 @@ The command needs the absolute path to the image file as noted. Otherwise it wil
+
If you want to modify something, detach the file first.
+
[source,]
[source,console]
----
[…]# virsh detach-disk ${VM_NAME} vdb --persistent
# virsh detach-disk ${VM_NAME} vdb --persistent
Disk detached successfully
----
@ -779,9 +779,9 @@ Disk detached successfully
+
First, cfdisk displays a list for selecting the partitioning type. Select GPT.
+
[source,]
[source,console]
----
[…]# cfdisk /dev/vdb
# cfdisk /dev/vdb
Disk: /dev/vdb
Size: 192.5 KiB, 197120 bytes, 385 sectors
Label: gpt, identifier: 2842C26B-A2F1-4946-9D89-AB8832E5FCEC
@ -799,17 +799,17 @@ First, cfdisk displays a list for selecting the partitioning type. Select GPT.
. Create a Physical Volume (PV) in the new partition (adjust the device accordingly!)
+
[source,]
[source,console]
----
[…]# pvcreate /dev/vdb1
# pvcreate /dev/vdb1
Physical volume "/dev/vdb1" successfully created.
----
. Create a Volume Group (VG) in the new Physical Volume (adjust the device accordingly!)
+
[source,]
[source,console]
----
[…]# vgcreate usrvg /dev/vdb1
# vgcreate usrvg /dev/vdb1
----
Later, use usrvg to create LVs for user data as needed.

62
modules/ROOT/pages/virtualization/vm-install-diskimg-virtbuilder.adoc
View file

@ -33,7 +33,7 @@ This step does the main work.
To get a CentOS virtual machine image, we use the default image repository, which is maintained by the guests-tools project. First, we need a list of available (CentOS) prebuilt machine images.
[source,bash]
----
[…]$ virt-builder --list | grep centos
$ virt-builder --list | grep centos
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
@ -55,12 +55,12 @@ centosstream-8 x86_64 CentOS Stream 8
centosstream-9 x86_64 CentOS Stream 9
----
The guestfs-tools project provides a fairly complete set of variants available in recent years. Omitting the grep term reveals an impressive list of of distribution images provided.
The guestfs-tools project provides a fairly complete set of variants available in recent years. Omitting the grep term reveals an impressive list of distribution images provided.
We want the latest and greatest CentOS release and would like to get some info about details.
[source,bash]
----
[…]$ virt-builder --notes centosstream-9
$ virt-builder --notes centosstream-9
gpg: checking the trustdb
...
CentOS Stream 9
@ -84,8 +84,8 @@ Even a quick and experimental setup should take the opportunity to set a number
[source,text]
----
[…]$ sudo su -
[…]# virt-builder centosstream-9 \
$ sudo su -
# virt-builder centosstream-9 \
--format qcow2 --output /var/lib/libvirt/images/vm1-el9vb.qcow2 \
--root-password locked:disabled \
--hostname vm1-el9vb.example.com \
@ -94,13 +94,13 @@ Even a quick and experimental setup should take the opportunity to set a number
--firstboot-command 'useradd -m -G wheel -p "" hostmin ; chage -d 0 hostmin'
----
Please, adjust the above example as apropriate!
Please, adjust the above example as appropriate!
Specifically, _US users_ will omit the 6. line ('--firstboot-command 'localectl&#8230;&#8203;`) of the virt-builder command, other will have to adjust the keyboard layout. On your local Fedora Server run `localectl list-keymaps`to get a list of supported keyboard layouts and their identifiers.
If you really are to install a _short term test installation_ you may omit the third line (`--root-password &#8230;&#8203;`) of the virt-builder command for connvenience and work directly as root. The app will automatically generate a password and display it. Don&#8217;t forget to copy and store it safely.
If you really are to install a _short term test installation_ you may omit the third line (`--root-password &#8230;&#8203;`) of the virt-builder command for convenience and work directly as root. The app will automatically generate a password and display it. Don&#8217;t forget to copy and store it safely.
You get a lot ot output. The process takes some time. Be patient.
You get a lot of output. The process takes some time. Be patient.
[source,bash]
----
@ -126,11 +126,11 @@ As you see, the virtual disk size is 6.0 G with 4.3 G at your disposition.
1. As noted above, the maximum disk size is 6 G with about 4 G at your disposition (you may not fill the space 100%). That is not too much and you might want to enlarge it.
+
[source,]
[source,console]
----
[…]# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
[…]# qemu-img resize /var/lib/libvirt/images/vm1-el9vb.qcow2 +10G
[…]# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
# qemu-img resize /var/lib/libvirt/images/vm1-el9vb.qcow2 +10G
# qemu-img info /var/lib/libvirt/images/vm1-el9vb.qcow2
----
+
The example above adds 10 GiB. The maximum virtual disk size of the CentOS image is 16 GiB now. The current (physical) disk size is still about 1 GB, due to the dynamic properties of the qcow2 file format.
@ -144,16 +144,16 @@ You should _not_ increase the maximum virtual disk image size by the _virt-build
Use a terminal window. First, you may check the correct naming for the parameter os-variant.
[source,]
[source,console]
----
[…]# virt-install --osinfo list
# virt-install --osinfo list
----
Import the virtual disk image.
[source,]
[source,console]
----
[…]# virt-install --name vm1-el9vb \
# virt-install --name vm1-el9vb \
--memory 2048 --cpu host --vcpus 2 --graphics none\
--os-variant centos-stream9\
--import \
@ -191,16 +191,16 @@ Log in with the administrative user account (hostmin in this example). You can l
=== Adjust the new VM instance
You did a minimal customization so var and need to do some further adjustments.
You did a minimal customization so far and need to do some further adjustments.
==== Network consolidation
1. Check the available network connections
+
[source,]
[source,console]
----
[…]# ip a
[…]# nmcli con
# ip a
# nmcli con
----
+
Depending on your runtime environment you may have to consolidate the network configuration. In the above example you get 2 connections, one to the public network and another to the internal server network. For details see xref:virtualization/installation.adoc[Adding Virtualization Support].
@ -209,9 +209,9 @@ Depending on your runtime environment you may have to consolidate the network co
+
Sometimes a connection gets named something like 'Wired connection 1'. For ease of administration, change the name, e.g. the device name.
+
[source,]
[source,console]
----
[…]# nmcli con mod 'Wired connection 1' connection.id enp1s0
# nmcli con mod 'Wired connection 1' connection.id enp1s0
----
+
In case of your internal network (virbr0), which provides DHCP, this step persists the network configuration. So you can assign a specific zone. Otherwise the system would create the connection anew with each boot.
@ -220,31 +220,31 @@ In case of your internal network (virbr0), which provides DHCP, this step persis
+
If the external network does not provide DHCP, you get just a minimal configuration without IP addresses. Adjust as appropriate.
+
[source,]
[source,console]
----
[…]# nmcli con mod enp1s0 ipv6.method manual ipv6.addresses '2a01:xxx:yyy:zzz::uu/88' \
# nmcli con mod enp1s0 ipv6.method manual ipv6.addresses '2a01:xxx:yyy:zzz::uu/88' \
ipv6.gateway 'fe80::1' \
ipv6.dns '2a01:xxx:yyy:zzz::uuu:vvv 2a01:xxx:yyy:zzz::uuu:vvv 2a01:xx:yy:zz::uu:vv'
[…]# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 'xx.yy.zz.ww/vv' ipv4.gateway 'xx.yy.zz.ww' ipv4.dns 'xx.yy.zz.uu xx.yy.zz.vv xx.yy.zz.ww'
# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 'xx.yy.zz.ww/vv' ipv4.gateway 'xx.yy.zz.ww' ipv4.dns 'xx.yy.zz.uu xx.yy.zz.vv xx.yy.zz.ww'
----
4. On demand: assign a firewall zone
+
Specifically for the internal interface (usually enp2s0) you might want to assign a specific zone, e.g. trusted or internal. And for the internal interface you might disable IPv6, Adjust as appropriate
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2s0 connection.zone 'internal'
[…]# nmcli con mod enp2s0 ipv6.method 'disabled'
# nmcli con mod enp2s0 connection.zone 'internal'
# nmcli con mod enp2s0 ipv6.method 'disabled'
----
+
5. Finally restart the connections
+
[source,]
[source,console]
----
[…]# nmcli con up enp1s0
[…]# nmcli con up enp2s0
# nmcli con up enp1s0
# nmcli con up enp2s0
----
== Using Cockpit's graphical UI to instantiate the VM

132
modules/ROOT/pages/virtualization/vm-install-fedoraserver-cockpit.adoc
View file

@ -52,16 +52,16 @@ Cockpit offers the option to load an installation medium not only locally, but a
Select `__Terminal__` in the left navigation bar and issue the commands line by line:
[source,]
[source,console]
----
[…]# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
[…]# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
[…]# sudo curl -O https://fedoraproject.org/fedora.gpg | gpg --import
[…]# sudo gpgv --keyring ./fedora.gpg /var/lib/libvirt/boot/*-CHECKSUM
[…]# sudo sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-dvd-x86_64-41-1.4.iso
# sudo wget -P /var/lib/libvirt/boot/ https://download.fedoraproject.org/pub/fedora/linux/releases/41/Server/x86_64/iso/Fedora-Server-41-1.4-x86_64-CHECKSUM
# sudo curl -O https://fedoraproject.org/fedora.gpg | gpg --import
# sudo gpgv --keyring ./fedora.gpg /var/lib/libvirt/boot/*-CHECKSUM
# sudo sh -c ' cd /var/lib/libvirt/boot/ && sha256sum --ignore-missing -c *-CHECKSUM '
----
You can safely ignore the warning of the last command about not correctly formated lines.
You can safely ignore the warning of the last command about not correctly formatted lines.
You can provide additional installation media in an analog way. With everything necessary in place, we can start installing a virtual machine.
@ -73,16 +73,16 @@ This guide uses Cockpit, version 326, and Cockpit machines, version 321. On upda
To start a VM installation, connect your desktop browser to the Cockpit instance of your host server. Consult the xref:installation/postinstallation-tasks.adoc[post-installation guide] to find out the possible connection paths. Log in as root or with your administrative account. In the overview (start) page select `__Virtual Machines__` in the left navigation column and then `__Create VM__` (the button `__Import VM__` next to it refers to the other alternative, using disk images) and fill in the form that opens..
image::virtualization/vm-install-fedoraserver-cockpit-020.png[Cockpit `__Create new virtual machine__` form]
First, specify a name for the virtual machine to be created. It must be unique in the host server’s name space. Select an connection type, usually system. See explanation in the xref:virtualization/installation.adoc[Adding Virtualization Support] guide.
First, specify a name for the virtual machine to be created. It must be unique in the host server’s name space. Select a connection type, usually system. See explanation in the xref:virtualization/installation.adoc[Adding Virtualization Support] guide.
Then select the installation type to be used. The drop down menu offers several alternatives:
Download an OS:: Download from a remote location. You have to choose the Distribution from a drop down menu in the next field. It includes various distributions and version. But you can&#8217;t select the Fedora edition. Not an recommendable option.
Download an OS:: Download from a remote location. You have to choose the Distribution from a drop down menu in the next field. It includes various distributions and version. But you can&#8217;t select the Fedora edition. Not a recommendable option.
Cloud base image:: That refers to the special case of cloud disk images. That is not covered here.
Local install media:: Use a ISO image or a distro install tree stored on the local disk. This is the option we want to use here. Select this option and specify in the next field the fully qulified path and filename.
URL (ISO image or distro install tree):: The same as 'Download an OS', but you can freely specify the exact distribution by download URL in the next field and do not depend on a preset list
Network boot (PXE):: That&#8217;s another special case we don&#8217;t cover here. You need to set up a special install server beforehand.
Local install media:: Use a ISO image or a distro install tree stored on the local disk. This is the option we want to use here. Select this option and specify in the next field the fully qualified path and filename.
URL (ISO image or distro install tree):: The same as 'Download an OS', but you can freely specify the exact distribution by download URL in the next field and do not depend on a preset list
Network boot (PXE):: That&#8217;s another special case we don&#8217;t cover here. You need to set up a special install server beforehand.
As mentioned above choose `__Local install media__` and select in the drop down menu of the following row the fully qualified file name. In our example of Fedora Server 41 it is `/var/lib/libvirt/boot/Fedora-Server-dvd-x86_64-41-1.3.iso`. The drop down menu works a bit unfamiliar. You have to select the target file step by step from subdirectory to subdirectory up to the file name.
@ -118,7 +118,7 @@ image::virtualization/vm-install-fedoraserver-cockpit-040.png[Cockpit `__Virtual
Replace the interface type by `__Direct attachment__` and select the external physical interface of the host in the `__Source__` field. Leave `__model__` and `__MAC address__` unchanged.
Next, if you also want an internal network, select `__Add network interface__`. A nearly identical form pops up. Select `__Interface tpye__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` __virtio (Linux, perf)__ and `__MAC address__` __Generate automatically__ unchanged.
Next, if you also want an internal network, select `__Add network interface__`. A nearly identical form pops up. Select `__Interface type__` as _Virtual network_ if it is not already preselected and _default_ as `__Source__`. Again, leave `__model__` __virtio (Linux, perf)__ and `__MAC address__` __Generate automatically__ unchanged.
Now everything is ready and the installation can begin.
@ -134,15 +134,15 @@ Start with installation as usual. You may basically follow the xref:installation
The installation process will take some time.
If you want to save the disk image for future VM creation, select shutdown, copy the image to `__~/libvirt/boot/__`, and then start the VM anew for post-installation steps. Otherwise restart according the installation program&#8217;s advise and procede with post-install.
If you want to save the disk image for future VM creation, select shutdown, copy the image to `__~/libvirt/boot/__`, and then start the VM anew for post-installation steps. Otherwise restart according the installation program&#8217;s advise and proceed with post-install.
____
*__Excursus__: Save generated virual machine for later reuse*
*__Excursus__: Save generated virtual machine for later reuse*
Sometimes, after selecting __Shutdown__ the machine automatically start again. Login with your administrativ account and perform a shutdown: `sudo shutdown -h now`. Then switch to a host's terminal window and execute:
[source,]
[source,console]
----
[…]# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/boot/fedora-servervm-img.qcow2
# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/boot/fedora-servervm-img.qcow2
----
A comparison of the two image files reveals that the originally created image is about 20 GiB in size, as specified while creating the virtual machine. Thus the dynamic capabilities of the qcow2 format are not used during the installation process. The copied image is only a fraction of that. The conversion process automatically re-uses the dynamic capability and creates a sparse image by masking out unused parts (thin provisioning). The copy could be made even smaller by using the -c parameter and additionally compressing the copied image. However, this may reduce the performance somewhat. In any way, the image will grow during later reuse in the course of operation depending on actual needs.
@ -155,19 +155,19 @@ There are some post-install task that are specific for a virtual machine. Otherw
____
Before you start the post installation tasks you may consider to 'sparsify' the image, i.d. to mask out currently unused space and convert the image to thin provisioning (and so using the dynamic capabilities of the qcow2 image format). You must use a host terminal window. Cockpit doesn't currently support such an operation.
[source,]
[source,console]
----
[…]# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2
[…]# mv /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
# qemu-img convert -O qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2 /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2
# mv /var/lib/libvirt/images/{VM_NAME}-sparse.qcow2 /var/lib/libvirt/images/{VM_NAME}.qcow2
----
____
If you have not already done so, start the virtual machine and log in with the administrator account. You can select __expand__ at a top of the terminal window to increase readability. Selecting "Serial console" on the left above the terminal window instead of "VNC console" further improves readability in some cases. However, on some devices this does not work at all.
All subsequent tasks must be executed with ROOT privileges. If the root account is locked, ROOT privileges should generally be acquired for the sake of simplicity.
[source,]
[source,console]
----
[…]# sudo -i
# sudo -i
[sudo] password for <user>:
----
@ -175,44 +175,44 @@ All subsequent tasks must be executed with ROOT privileges. If the root account
1. *Check hostname and time synchronisation*
+
A correct hostname is specifically important for DHCP of the internal network to work properly. A correct time is important vor various tasks, sopecifically syncronization.
A correct hostname is specifically important for DHCP of the internal network to work properly. A correct time is important for various tasks, specifically synchronization.
+
a. __Check hostname__. You need a correct static hostname.
+
[source,]
[source,console]
----
[…]# hostnamectl
# hostnamectl
----
* Set hostname if required:
+
[source,]
[source,console]
----
[…]# hostnamectl set-hostname <YourFQDN>
# hostnamectl set-hostname <YourFQDN>
----
b. _Check time zone, time synchronisation, time_
+
[source,]
[source,console]
----
[…]# timedatectl
# timedatectl
----
* Correct time zone if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-timezone <ZONE>
# timedatectl set-timezone <ZONE>
----
* If necessary, activate time synchronisation:
+
[source,]
[source,console]
----
[…]# timedatectl set-ntp true
# timedatectl set-ntp true
----
* Correct time if necessary:
+
[source,]
[source,console]
----
[…]# timedatectl set-time <TIME>
# timedatectl set-time <TIME>
----
2. *Consolidate internal network configuration*
@ -223,22 +223,22 @@ Usually, it is useful to resolve a single member name to the internal network, i
a. List the interfaces and determine the name of the internal interface
+
[source,]
[source,console]
----
[…]# nmcli con
# nmcli con
NAME UUID TYPE DEVICE
enp1 47df4730-171e-3bfe-b5d9-4238137e0f70 ethernet enp1
enp2 7627fc10-f1bf-3220-99e2-3bd369837439 ethernet enp2
----
b. Set the DNS serach path for the internal interface
b. Set the DNS search path for the internal interface
+
If enp2 it the internal interface, set dns search and deactivate IPv6 that is not used internally
+
[source,]
[source,console]
----
[…]# nmcli con mod enp2 ipv4.dns-search example.lan ipv6.method disabled
[…]# nmcli con up enp2
[…]# systemctl restart NetworkManager
# nmcli con mod enp2 ipv4.dns-search example.lan ipv6.method disabled
# nmcli con up enp2
# systemctl restart NetworkManager
----
@ -246,41 +246,41 @@ If enp2 it the internal interface, set dns search and deactivate IPv6 that is no
+
Check /etc/resolv.conf
+
[source,]
[source,console]
----
[…]# ls -al /etc/resolv.conf
# ls -al /etc/resolv.conf
----
+
If it is a file instead of a link, you have to fix it.
+
[source,]
[source,console]
----
[…]# rm -f /etc/resolv.conf
[…]# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
[…]# ls -l /etc/resolv.conf
[…]# systemctl restart NetworkManager
[…]# systemctl restart systemd-resolved
# rm -f /etc/resolv.conf
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
# ls -l /etc/resolv.conf
# systemctl restart NetworkManager
# systemctl restart systemd-resolved
----
+
Check whether the name resolution works as desired.
+
[source,]
[source,console]
----
[…]# host vm1.example.com
[…]# host vm1.example.lan
[…]# host vm1
# host vm1.example.com
# host vm1.example.lan
# host vm1
----
4. *Adjust firewall setting of the internal interface*
+
The installer assigns all interfaces to the _FedoraServer_ zone, which limits access to ssh (and Cockpit). For the internal, protected network a broader accessibility may be appropriate, depending on the use case. If appropriate, modify the configuration (check alternative zone and select a suitable one).
+
[source,]
[source,console]
----
[…]# firewall-cmd --get-active-zones
[…]# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
[…]# firewall-cmd --reload
[…]# firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
# firewall-cmd --permanent --zone=trusted --change-interface=<internalIF>
# firewall-cmd --reload
# firewall-cmd --get-active-zones
----
5. *Increase security of Cockpit access*
@ -293,18 +293,18 @@ Refer to the corresponding section in the xref:installation/postinstallation-t
+
If you are a somewhat experienced administrator, you are probably annoyed that Namo, default editor since Fedora 34, always pops up when you want to edit crontab or similar. It is therefore worth reconfiguring right from the start.
+
[source,]
[source,console]
----
[…]# dnf install --allowerasing vim-default-editor
# dnf install --allowerasing vim-default-editor
----
2. *Reconfiguring the external interface as static*
+
Many administrators prefer to configure the external interface statically to ensure connectivity even if the DHCP server fails or is corrupted. Adjust the following example as needed.
+
[source,]
[source,console]
----
[…]# nmcli con mod <IF_NAME> ipv4.method static \clear
# nmcli con mod <IF_NAME> ipv4.method static \clear
ipv4.address "xxx.xxx.xxx.xxx/yy" \
ipv4.gateway "xxx.xxx.xxx.zzz" \
ipv4.dns "xxx.xxx.xxx.vvv" \
@ -319,9 +319,9 @@ Ensure, parameter search-domain is empty!
3. *Remove unnecessary hardware packages*
+
[source,]
[source,console]
----
[…]# dnf remove iwl* linux-firmware* zd1211-firmware* ipw* atmel* alsa-sof-firmware*
# dnf remove iwl* linux-firmware* zd1211-firmware* ipw* atmel* alsa-sof-firmware*
----

22
modules/ROOT/pages/virtualization/vm-management-cockpit.adoc
View file

@ -23,7 +23,7 @@ image::virtualization/vm-management-cockpit-001.png[Cockpit Virtual Machines Ove
If there is no tab "Virtual Machines" the corresponding Cockpit module, cockpit-machines, is not installed yet. Consult the guide xref:virtualization/installation#_finishing_cockpit_machines_configuration[Adding Virtualization Support] for information how to install and prepare the module.
The virtual machines _overview page_ lists in the central area all virtual machines installed along with their current state. In the example above there are 3 virtual machines, 2 of them running. The most frequently executed action, shutdown rsp. launch, is directly accessible as a button. Additional commonly needed functions are offered in a drop-down menu to the right of it. It even offers a (simple) migration to another machine.
The virtual machines _overview page_ lists in the central area all virtual machines installed along with their current state. In the example above there are 3 virtual machines, 2 of them running. The most frequently executed action, shutdown resp. launch, is directly accessible as a button. Additional commonly needed functions are offered in a drop-down menu to the right of it. It even offers a (simple) migration to another machine.
=== Manage a virtual machines basic host runtime environment
@ -56,9 +56,9 @@ In the _Filesystems_ section of the central content area [1] there are 2 file sy
After shutting down vm2, we can increase the virtual disk by 20 GiB to a total of 32 GiB in the _hosts_ Cockpit terminal.
[source,text]
----
[…]# qemu-img resize /var/lib/libvirt/images/vm2.qcow2 +20G
# qemu-img resize /var/lib/libvirt/images/vm2.qcow2 +20G
Image resized.
[…]# qemu-img info /var/lib/libvirt/images/vm2.qcow2
# qemu-img info /var/lib/libvirt/images/vm2.qcow2
file format: qcow2
virtual size: 32 GiB (34359738368 bytes)
disk size: 2.01 GiB
@ -119,7 +119,7 @@ You just have to provide a (descriptive) name and the mount point. After formatt
[source,bash]
----
[…]# df -h
# df -h
Filesystem Size Used Avail Use% Mounted on
...
/dev/mapper/fedora_fedora-root 11G 1.8G 9.3G 16% /
@ -133,7 +133,7 @@ Cockpit handled all the various configuration steps involved on its own. This sa
If you moved files out of the way at the beginning, you can restore them now. To be on the safe side, restore the SELinux labels.
[source,bash]
----
[…]# /sbin/restorecon -R -vF /var/www
# /sbin/restorecon -R -vF /var/www
----
Now is the time to install the appropriate programs. Software provided by Fedora distribution as rpm installs into the appropriate system directories via dnf tool. External software should install in either `/opt` or `/usr/local` to keep it separated from distribution files to prevent any potential mutual interference. In accordance with the storage rationale, you should also create a separate logical volume and mount it under /opt. An example of this would be Wildfly application server, which stores program, configuration and possibly data in a common place.
@ -216,13 +216,13 @@ In the network section of the VMs detail page there is just one interface with 3
image::virtualization/vm-management-cockpit-033.png[Cockpit edit libvirt virtual interface]
The form shows the definition of the current internal network. Just modify the _Interface type_ from "Virtual network" to "Direct attachement" and _Source_ from "default" to "enp1s0", the host physical interface. Save your selection and reboot. Assuming DHCP works, the virtual machine has a perfectly working connection to the public network, including name resolution and default firewall configuration. Otherwise you have to define a static network configuration.
The form shows the definition of the current internal network. Just modify the _Interface type_ from "Virtual network" to "Direct attachment" and _Source_ from "default" to "enp1s0", the host physical interface. Save your selection and reboot. Assuming DHCP works, the virtual machine has a perfectly working connection to the public network, including name resolution and default firewall configuration. Otherwise you have to define a static network configuration.
Even if you need a public interface in addition to the existing internal interface you may prefer to edit the existing interface and later add a new internal interface. That way you follow the common practice of always setting up the public interface as the "first" one, i.e. enp1s0 or eth0.
==== Delete an interface
As an example, the virtual maschine is equipped with two interfaces, a public (enp1s0) and an internal (enp7s0).
As an example, the virtual machine is equipped with two interfaces, a public (enp1s0) and an internal (enp7s0).
image::virtualization/vm-management-cockpit-034.png[Cockpit delete a libvirt virtual interface]
@ -263,15 +263,15 @@ There are several options.
+
[source,BatchFile]
----
[…]# firewall-cmd --permanent --remove-service=cockpit
[…]# firewall-cmd --reload
# firewall-cmd --permanent --remove-service=cockpit
# firewall-cmd --reload
----
+
To use Cockpit you have to ssh into the server and temporarily open the port.
+
[source,BatchFile]
----
[…]# firewall-cmd --add-service=cockpit
# firewall-cmd --add-service=cockpit
----
2. Since you log in via ssh anyway, you can also initialize an ssh tunnel in pone go and use it for Cockpit if needed. As described above you have the Cockpit service from the firewall removed.
+
@ -279,7 +279,7 @@ To use Cockpit log into the server and temporarily open the port.
+
[source,BatchFile]
----
[…]# ssh $user@example.com -i $key -L 9090:example.com:9090
# ssh $user@example.com -i $key -L 9090:example.com:9090
----
+
You can access the Cockpit interface using `https://localhost:9090` in your favorite browser.

6
modules/ROOT/partials/installation/post-install/disable-password-login.adoc
View file

@ -6,9 +6,9 @@ a. On the server, create a configuration file and edit
----
[…]# vi /etc/ssh/sshd_config.d/60-local.conf
# Local custimization: disable password login except for
# one (optionally add some more) user as a fallback option.
PasswordAuthentication no
# Local customization: disable password login except for
# one (optionally add some more) user as a fallback option.
PasswordAuthentication no
Match User hostmin
PasswordAuthentication yes