Compare commits
No commits in common. "714f8f2362d290d40c5eae3df2a71f45befd22c4" and "a7c7e19eaccc4e7ee2beac5913cbd6d411134428" have entirely different histories.
714f8f2362
...
a7c7e19eac
@ -0,0 +1,27 @@
|
||||
## In **Linux Mint**, package management is essential for installing, updating, and managing software. Let's explore some key tools and concepts:
|
||||
|
||||
1. **APT (Advanced Packaging Tool)**:
|
||||
- APT is the primary package manager for Debian-based systems, including Linux Mint.
|
||||
- It handles software installation, removal, querying, and upgrades.
|
||||
- Common APT commands:
|
||||
- `sudo apt update`: Refreshes package lists from repositories.
|
||||
- `sudo apt install package-name`: Installs a package.
|
||||
- `sudo apt remove package-name`: Removes a package.
|
||||
- `sudo apt upgrade`: Upgrades installed packages.
|
||||
- `sudo apt search keyword`: Searches for packages.
|
||||
- APT uses `.deb` packages and works alongside `dpkg`, which installs individual `.deb` files.
|
||||
|
||||
2. **Synaptic Package Manager**:
|
||||
- Synaptic is an advanced graphical package management tool.
|
||||
- To install Synaptic:
|
||||
```
|
||||
sudo apt install synaptic
|
||||
```
|
||||
- Launch it from the Applications menu or by typing `synaptic` in the terminal.
|
||||
|
||||
Remember, APT and Synaptic empower you to manage software efficiently in Linux Mint! 😊🚀 ²³
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) How to Install and Update Apps on Linux Mint - UMA Technology.](https://umatechnology.org/how-to-install-and-update-apps-on-linux-mint/.)
|
||||
- [(2) How to Use APT Command in Linux [15 Useful Examples] - UbuntuMint.](https://www.ubuntumint.com/apt-commands/.)
|
||||
- [(3) Package Management Essentials: apt, yum, dnf, pkg.](https://www.digitalocean.com/community/tutorials/package-management-basics-apt-yum-dnf-pkg.)
|
||||
@ -50,7 +50,7 @@ Linux follows a standardized directory structure:
|
||||
- /etc: System configuration files
|
||||
- /var: Variable data (logs, temporary files)
|
||||
- /boot: Boot loader files
|
||||
- /mnt and /run/media: Mount points for removable devices
|
||||
- /mnt and /media: Mount points for removable devices
|
||||
|
||||
## 5. Common Disk Management Tools
|
||||
|
||||
@ -60,8 +60,8 @@ Linux provides several tools for disk management:
|
||||
- fdisk: Partition table manipulator
|
||||
- parted: Versatile partition tool
|
||||
- lsblk: List block devices
|
||||
- df: Report "disk free" in bytes. add "-h" option for human readable
|
||||
- du: Estimate file space usage for current directory. Add "-h" option for human readable file sizes.
|
||||
- df: Report file system disk space usage
|
||||
- du: Estimate file space usage
|
||||
|
||||
### b. Graphical tools:
|
||||
- GParted: GNOME Partition Editor
|
||||
@ -72,8 +72,6 @@ Linux provides several tools for disk management:
|
||||
### a. Viewing disk information:
|
||||
```
|
||||
lsblk
|
||||
```
|
||||
```
|
||||
fdisk -l
|
||||
```
|
||||
|
||||
@ -81,7 +79,7 @@ fdisk -l
|
||||
```
|
||||
sudo fdisk /dev/sdX
|
||||
```
|
||||
(Replace X with the appropriate letter). Follow prompts inside fdisk to create new blank partition.
|
||||
(Replace X with the appropriate letter)
|
||||
|
||||
### c. Formatting a partition:
|
||||
```
|
||||
@ -111,7 +109,7 @@ LVM allows for more flexible disk management, including:
|
||||
- Creating snapshots
|
||||
|
||||
### c. RAID (Redundant Array of Independent Disks):
|
||||
Linux supports software RAID for improved performance and data redundancy in hardware and software formats.
|
||||
Linux supports software RAID for improved performance and data redundancy.
|
||||
|
||||
### d. Encrypting partitions:
|
||||
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
||||
@ -129,3 +127,10 @@ d. Monitor disk health: Use tools like smartctl to check for potential drive fai
|
||||
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
||||
|
||||
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
||||
|
||||
|
||||
- [(1) How to Install GParted on Linux Mint 21 - Linux Genie.](https://linuxgenie.net/how-to-install-gparted-on-linux-mint-21/.)
|
||||
- [(2) Linux Mint View & Manage System Partitions: A Comprehensive Guide.](https://bytebitebit.com/tips-tricks/linux-mint-view-manage-system-partitions/.)
|
||||
- [(3) Linux Mint View Manage System Partitions: A Comprehensive Guide.](https://www.positioniseverything.net/linux-mint-view-manage-system-partitions/.)
|
||||
- [(4) Mastering Linux Disk Management: LVM and Disk Partitioning.](https://www.linuxjournal.com/content/mastering-linux-disk-management-lvm-and-disk-partitioning.)
|
||||
- [(5) How to Use Fdisk to Manage Partitions on Linux - How-To Geek.](https://www.howtogeek.com/106873/how-to-use-fdisk-to-manage-partitions-on-linux/.)
|
||||
|
||||
39
08 - Advanced Linux Administration/Networking File System.md
Normal file
39
08 - Advanced Linux Administration/Networking File System.md
Normal file
@ -0,0 +1,39 @@
|
||||
## Let's discuss **NTFS (New Technology File System)** and how to work with it in **Linux Mint**.
|
||||
|
||||
1. **Mounting NTFS Partitions**:
|
||||
- NTFS is the default file system for Windows systems, but we can also mount NTFS partitions in Linux to read and write data.
|
||||
- To mount an NTFS partition, follow these steps:
|
||||
- First, create a mount point using the `mkdir` command:
|
||||
```
|
||||
sudo mkdir /mnt/ntfs
|
||||
```
|
||||
- Next, use the `mount` command to mount the partition you want (e.g., `/dev/sdb2`):
|
||||
```
|
||||
sudo mount -t ntfs-3g /dev/sdb2 /mnt/ntfs
|
||||
```
|
||||
- To check if the partition is mounted, run:
|
||||
```
|
||||
df -hT
|
||||
```
|
||||
- Now you have read/write permissions for the NTFS partition you mounted¹².
|
||||
|
||||
2. **Changing File Permissions on NTFS Partitions**:
|
||||
- To apply Linux-compatible file permissions to an NTFS drive, modify the `/etc/fstab` file.
|
||||
- Add the following line to `/etc/fstab`:
|
||||
```
|
||||
/dev/sdb /mnt/ntfs ntfs uid=1000,gid=1000,dmask=022,fmask=133 0 0
|
||||
```
|
||||
This line specifies that the `/dev/sdb` partition should be mounted as NTFS in the `/mnt/ntfs` directory.
|
||||
- Remount the partition or reboot for the changes to take effect².
|
||||
|
||||
Feel free to explore further or ask if you need additional assistance! 😊🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) How to Mount NTFS Partition in Linux - phoenixNAP.](https://phoenixnap.com/kb/mount-ntfs-linux.)
|
||||
- [(2) Changing File Permissions on NTFS Partitions in Linux.](https://linuxconfig.org/changing-file-permissions-on-ntfs-partitions-in-linux.)
|
||||
- [(3) How to Mount and Access Windows NTFS Drives in Linux - MUO.](https://www.makeuseof.com/mount-ntfs-windows-drives-in-linux/.)
|
||||
- [(4) How to Mount an NTFS Partition - Linux Nightly.](https://linuxnightly.com/mount-ntfs-partition/.)
|
||||
- [(5) Linux mount ntfs or Access NTFS partition from Linux - nixCraft.](https://www.cyberciti.biz/faq/linux-mount-ntfs-or-access-ntfs-partition-from-linux/.)
|
||||
- [(6) How to mount NTFS partitions using Linux commands.](https://www.computerworld.com/article/1637061/how-to-mount-ntfs-partitions-using-linux-commands.html.)
|
||||
- [(7) NTFS Disk mounting in mint - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/358229/ntfs-disk-mounting-in-mint.)
|
||||
- [(8) How to Mount NFS in Linux: A Step-by-Step Guide - Byte Bite Bit.](https://bytebitebit.com/operating-system/linux/how-to-mount-nfs-in-linux/.)
|
||||
@ -143,3 +143,11 @@ This setup provides the redundancy of RAID 5 with the flexibility of LVM.
|
||||
- Display PV info: `sudo pvdisplay`
|
||||
- Display VG info: `sudo vgdisplay`
|
||||
- Display LV info: `sudo lvdisplay`
|
||||
|
||||
Remember, LVM provides flexibility, scalability, and ease of maintenance, while RAID enhances performance and data protection! 😊🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) Complete Beginner's Guide to LVM in Linux [With Hands-on].](https://linuxhandbook.com/lvm-guide/.)
|
||||
- [(2) Linux Storage Management: LVM and RAID.](https://linuxhall.org/linux-storage-management-lvm-and-raid/.)
|
||||
- [(3) raid - RAIDing with LVM vs MDRAID - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/150644/raiding-with-lvm-vs-mdraid-pros-and-cons.)
|
||||
- [(4) What is better LVM on RAID or RAID on LVM? - Server Fault.](https://serverfault.com/questions/217666/what-is-better-lvm-on-raid-or-raid-on-lvm.)
|
||||
|
||||
@ -7,94 +7,129 @@ journalctl is a command-line utility for querying and displaying logs from the s
|
||||
## 2. Basic Usage
|
||||
|
||||
### To view all logs:
|
||||
`journalctl`
|
||||
```
|
||||
journalctl
|
||||
```
|
||||
|
||||
### To follow new log entries in real-time:
|
||||
`journalctl -f`
|
||||
```
|
||||
journalctl -f
|
||||
```
|
||||
|
||||
## 3. Filtering Logs
|
||||
|
||||
### By time:
|
||||
`journalctl --since "2024-01-01 00:00:00"`
|
||||
|
||||
`journalctl --until "2024-01-31 23:59:59"`
|
||||
|
||||
`journalctl --since "1 hour ago"`
|
||||
|
||||
```
|
||||
journalctl --since "2024-01-01 00:00:00"
|
||||
journalctl --until "2024-01-31 23:59:59"
|
||||
journalctl --since "1 hour ago"
|
||||
```
|
||||
|
||||
### By service unit:
|
||||
`journalctl -u nginx.service`
|
||||
|
||||
`journalctl -u ssh.service`
|
||||
|
||||
```
|
||||
journalctl -u nginx.service
|
||||
journalctl -u ssh.service
|
||||
```
|
||||
|
||||
### By priority level:
|
||||
`journalctl -p err`
|
||||
```
|
||||
journalctl -p err
|
||||
```
|
||||
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
||||
|
||||
### By kernel messages:
|
||||
`journalctl -k`
|
||||
```
|
||||
journalctl -k
|
||||
```
|
||||
|
||||
## 4. Output Formatting
|
||||
|
||||
### JSON output:
|
||||
`journalctl -o json`
|
||||
```
|
||||
journalctl -o json
|
||||
```
|
||||
|
||||
### Short output format:
|
||||
`journalctl -o short`
|
||||
```
|
||||
journalctl -o short
|
||||
```
|
||||
|
||||
### Verbose output:
|
||||
`journalctl -o verbose`
|
||||
```
|
||||
journalctl -o verbose
|
||||
```
|
||||
|
||||
## 5. Boot-specific Logs
|
||||
|
||||
### Current boot:
|
||||
`journalctl -b`
|
||||
```
|
||||
journalctl -b
|
||||
```
|
||||
|
||||
### Previous boot:
|
||||
`journalctl -b -1`
|
||||
```
|
||||
journalctl -b -1
|
||||
```
|
||||
|
||||
## 6. User-specific Logs
|
||||
|
||||
`journalctl _UID=1000`
|
||||
```
|
||||
journalctl _UID=1000
|
||||
```
|
||||
|
||||
## 7. Disk Usage and Log Rotation
|
||||
|
||||
### View disk usage:
|
||||
`journalctl --disk-usage`
|
||||
```
|
||||
journalctl --disk-usage
|
||||
```
|
||||
|
||||
### Rotate logs:
|
||||
`journalctl --rotate`
|
||||
```
|
||||
journalctl --rotate
|
||||
```
|
||||
|
||||
### Vacuum old logs:
|
||||
`journalctl --vacuum-time=1week`
|
||||
|
||||
`journalctl --vacuum-size=1G`
|
||||
|
||||
```
|
||||
journalctl --vacuum-time=1week
|
||||
journalctl --vacuum-size=1G
|
||||
```
|
||||
|
||||
## 8. Remote Journal Access
|
||||
|
||||
To access logs on a remote system:
|
||||
`journalctl -D /path/to/journal/directory`
|
||||
```
|
||||
journalctl -D /path/to/journal/directory
|
||||
```
|
||||
|
||||
## 9. Persistent Journal Storage
|
||||
|
||||
### Edit /etc/systemd/journald.conf:
|
||||
`Storage=persistent`
|
||||
```
|
||||
Storage=persistent
|
||||
```
|
||||
|
||||
### Restart journald:
|
||||
`sudo systemctl restart systemd-journald`
|
||||
```
|
||||
sudo systemctl restart systemd-journald
|
||||
```
|
||||
|
||||
## 10. Forwarding Logs to a Central Server
|
||||
|
||||
### Install rsyslog:
|
||||
`sudo apt install rsyslog`
|
||||
```
|
||||
sudo apt install rsyslog
|
||||
```
|
||||
|
||||
### Configure /etc/rsyslog.conf for forwarding:
|
||||
`*.* @@central-log-server:514`
|
||||
```
|
||||
*.* @@central-log-server:514
|
||||
```
|
||||
|
||||
### Restart rsyslog:
|
||||
`sudo systemctl restart rsyslog`
|
||||
```
|
||||
sudo systemctl restart rsyslog
|
||||
```
|
||||
|
||||
## 11. Security Considerations
|
||||
|
||||
|
||||
@ -36,3 +36,12 @@
|
||||
- Regularly back up important files to an external location.
|
||||
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
||||
|
||||
Remember, a combination of these practices helps maintain a secure Linux Mint environment. Feel free to explore further or ask if you need additional guidance! 😊🔒🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) 10 practical tips for securing your Linux Mint system - FOSS Linux.](https://www.fosslinux.com/103872/secure-your-linux-mint-system.htm.)
|
||||
- [(2) How to reset a forgotten password for any user under Linux Mint 21 ....](https://www.thinkpenguin.com/gnu-linux/how-reset-forgotten-password-any-user-under-linux-mint-21.)
|
||||
- [(3) Linux Mint 20 [Essential Security Guide: Tools & Tweaks].](https://www.securitybind.com/secure-linux-mint/.)
|
||||
- [(4) How to Configure Linux Mint Login Window: A Step-by-Step Guide.](https://bytebitebit.com/tips-tricks/how-to-configure-linux-mint-login-window/.)
|
||||
- [(5) Changes to password policies – The Linux Mint Blog.](https://blog.linuxmint.com/?p=3013.)
|
||||
- [(6) en.wikipedia.org.](https://en.wikipedia.org/wiki/Linux_Mint.)
|
||||
@ -17,14 +17,18 @@ Key features:
|
||||
|
||||
On most Linux distributions, eCryptfs can be installed using the package manager:
|
||||
|
||||
For Ubuntu/Debian:
|
||||
`sudo apt-get install ecryptfs-utils`
|
||||
|
||||
For Fedora:
|
||||
`sudo dnf install ecryptfs-utils`
|
||||
|
||||
For Arch Linux:
|
||||
`sudo pacman -S ecryptfs-utils`
|
||||
```bash
|
||||
# For Ubuntu/Debian:
|
||||
sudo apt-get install ecryptfs-utils
|
||||
```
|
||||
```bash
|
||||
# For Fedora:
|
||||
sudo dnf install ecryptfs-utils
|
||||
```
|
||||
```bash
|
||||
# For Arch Linux:
|
||||
sudo pacman -S ecryptfs-utils
|
||||
```
|
||||
|
||||
## 3. Setting up eCryptfs
|
||||
|
||||
@ -62,11 +66,15 @@ mount -t ecryptfs ~/encrypted ~/encrypted
|
||||
|
||||
### - Unmounting:
|
||||
|
||||
`umount ~/encrypted`
|
||||
```bash
|
||||
umount ~/encrypted
|
||||
```
|
||||
|
||||
### - Checking mount status:
|
||||
|
||||
`mount | grep ecryptfs`
|
||||
```bash
|
||||
mount | grep ecryptfs
|
||||
```
|
||||
|
||||
## 5. Key Management
|
||||
|
||||
@ -74,11 +82,15 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
||||
|
||||
### - Adding a key to the keyring:
|
||||
|
||||
`ecryptfs-add-passphrase`
|
||||
```bash
|
||||
ecryptfs-add-passphrase
|
||||
```
|
||||
|
||||
### - Removing a key from the keyring:
|
||||
|
||||
`keyctl purge user ecryptfs`
|
||||
```bash
|
||||
keyctl purge user ecryptfs
|
||||
```
|
||||
|
||||
## 6. Advanced Features
|
||||
|
||||
@ -86,11 +98,15 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
||||
|
||||
Create a file containing your mount options:
|
||||
|
||||
`echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc`
|
||||
```bash
|
||||
echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc
|
||||
```
|
||||
|
||||
Then mount using:
|
||||
|
||||
`mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted`
|
||||
```bash
|
||||
mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted
|
||||
```
|
||||
|
||||
### - Using different encryption for different directories:
|
||||
|
||||
@ -109,11 +125,15 @@ You can mount multiple eCryptfs directories with different encryption settings b
|
||||
|
||||
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
||||
|
||||
`lsmod | grep ecryptfs`
|
||||
```bash
|
||||
lsmod | grep ecryptfs
|
||||
```
|
||||
|
||||
If not present, load them:
|
||||
|
||||
`sudo modprobe ecryptfs`
|
||||
```bash
|
||||
sudo modprobe ecryptfs
|
||||
```
|
||||
|
||||
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
||||
|
||||
|
||||
@ -16,28 +16,36 @@ OpenSSL is a robust, full-featured open-source toolkit that implements the Secur
|
||||
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
||||
|
||||
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
||||
`sudo apt-get install openssl libssl-dev # For Debian/Ubuntu`
|
||||
|
||||
`sudo yum install openssl openssl-devel # For CentOS/RHEL`
|
||||
```bash
|
||||
sudo apt-get install openssl libssl-dev # For Debian/Ubuntu
|
||||
```
|
||||
```bash
|
||||
sudo yum install openssl openssl-devel # For CentOS/RHEL
|
||||
```
|
||||
|
||||
- macOS: Use Homebrew:
|
||||
`brew install openssl`
|
||||
```
|
||||
brew install openssl
|
||||
```
|
||||
|
||||
- Windows: Download the installer from the official OpenSSL website.
|
||||
|
||||
## 4. Basic OpenSSL Commands
|
||||
|
||||
- Generate a private key:
|
||||
|
||||
`openssl genrsa -out private.key 2048`
|
||||
```bash
|
||||
openssl genrsa -out private.key 2048
|
||||
```
|
||||
|
||||
- Create a Certificate Signing Request (CSR):
|
||||
|
||||
`openssl req -new -key private.key -out certificate.csr`
|
||||
```bash
|
||||
openssl req -new -key private.key -out certificate.csr
|
||||
```
|
||||
|
||||
- Generate a self-signed certificate:
|
||||
|
||||
`openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365`
|
||||
```bash
|
||||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
|
||||
```
|
||||
|
||||
## 5. Implementing SSL/TLS in Network Applications
|
||||
|
||||
|
||||
@ -11,7 +11,10 @@ Fail2Ban is an intrusion prevention software framework that protects Linux syste
|
||||
- Updates firewall rules to block banned IPs
|
||||
|
||||
### Installation:
|
||||
`sudo apt-get update && sudo apt-get install fail2ban`
|
||||
```bash
|
||||
sudo apt-get update
|
||||
sudo apt-get install fail2ban
|
||||
```
|
||||
|
||||
### Configuration:
|
||||
- Main configuration file: `/etc/fail2ban/jail.conf`
|
||||
@ -53,7 +56,10 @@ AIDE is a file and directory integrity checker that detects unauthorized changes
|
||||
- Reports any discrepancies, indicating potential security breaches
|
||||
|
||||
### Installation:
|
||||
`sudo apt-get update && sudo apt-get install aide`
|
||||
```bash
|
||||
sudo apt-get update
|
||||
sudo apt-get install aide
|
||||
```
|
||||
|
||||
### Configuration:
|
||||
- Main configuration file: /etc/aide/aide.conf
|
||||
|
||||
@ -18,13 +18,17 @@ SELinux operates in three modes:
|
||||
- Disabled: SELinux is turned off
|
||||
|
||||
To check the current mode:
|
||||
`getenforce`
|
||||
```
|
||||
getenforce
|
||||
```
|
||||
|
||||
To change modes temporarily:
|
||||
|
||||
`setenforce 0` # Set to permissive
|
||||
|
||||
`setenforce 1` # Set to enforcing
|
||||
```bash
|
||||
setenforce 0 # Set to permissive
|
||||
```
|
||||
```bash
|
||||
setenforce 1 # Set to enforcing
|
||||
```
|
||||
|
||||
To change modes permanently, edit /etc/selinux/config and reboot.
|
||||
|
||||
@ -39,11 +43,10 @@ system_u:object_r:httpd_sys_content_t:s0
|
||||
```
|
||||
|
||||
To view contexts:
|
||||
|
||||
`ls -Z` # For files
|
||||
|
||||
`ps auxZ` # For processes
|
||||
|
||||
```
|
||||
ls -Z # For files
|
||||
ps auxZ # For processes
|
||||
```
|
||||
|
||||
## 4. SELinux Policies
|
||||
|
||||
@ -56,56 +59,84 @@ SELinux uses policies to define allowed actions. Two main policy types:
|
||||
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
||||
|
||||
To list all booleans:
|
||||
`getsebool -a`
|
||||
```
|
||||
getsebool -a
|
||||
```
|
||||
|
||||
To change a boolean:
|
||||
`setsebool httpd_can_network_connect on`
|
||||
```bash
|
||||
setsebool httpd_can_network_connect on
|
||||
```
|
||||
|
||||
To make the change persistent:
|
||||
`setsebool -P httpd_can_network_connect on`
|
||||
```bash
|
||||
setsebool -P httpd_can_network_connect on
|
||||
```
|
||||
|
||||
## 6. Troubleshooting SELinux
|
||||
|
||||
- Check for denials:
|
||||
`ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent`
|
||||
```
|
||||
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent
|
||||
```
|
||||
|
||||
- Use SELinux troubleshooter:
|
||||
`sealert -a /var/log/audit/audit.log`
|
||||
```
|
||||
sealert -a /var/log/audit/audit.log
|
||||
```
|
||||
|
||||
- Analyze SELinux logs:
|
||||
`grep "SELinux" /var/log/messages`
|
||||
```
|
||||
grep "SELinux" /var/log/messages
|
||||
```
|
||||
|
||||
## 7. File and Directory Labeling
|
||||
|
||||
To change the SELinux context of a file or directory:
|
||||
`chcon -t httpd_sys_content_t /path/to/file`
|
||||
```
|
||||
chcon -t httpd_sys_content_t /path/to/file
|
||||
```
|
||||
|
||||
To restore the default context:
|
||||
`restorecon -v /path/to/file`
|
||||
```
|
||||
restorecon -v /path/to/file
|
||||
```
|
||||
|
||||
## 8. Managing SELinux Modules
|
||||
|
||||
List available modules:
|
||||
`semodule -l`
|
||||
```
|
||||
semodule -l
|
||||
```
|
||||
|
||||
Enable a module:
|
||||
`semodule -e modulename`
|
||||
```
|
||||
semodule -e modulename
|
||||
```
|
||||
|
||||
Disable a module:
|
||||
`semodule -d modulename`
|
||||
```
|
||||
semodule -d modulename
|
||||
```
|
||||
|
||||
## 9. Creating Custom SELinux Policies
|
||||
|
||||
For complex environments, you may need to create custom policies:
|
||||
|
||||
- Install policy development tools:
|
||||
`yum install selinux-policy-devel`
|
||||
```
|
||||
yum install selinux-policy-devel
|
||||
```
|
||||
|
||||
- Write a policy module (.te file)
|
||||
- Compile and package the module:
|
||||
`make -f /usr/share/selinux/devel/Makefile`
|
||||
```
|
||||
make -f /usr/share/selinux/devel/Makefile
|
||||
```
|
||||
- Install the module:
|
||||
`semodule -i mymodule.pp`
|
||||
```
|
||||
semodule -i mymodule.pp
|
||||
```
|
||||
|
||||
## 10. SELinux and Containers
|
||||
|
||||
@ -114,7 +145,9 @@ SELinux provides strong isolation for containers:
|
||||
- Prevents container processes from accessing host resources
|
||||
|
||||
To run a container with a specific SELinux context:
|
||||
`docker run --security-opt label=type:svirt_lxc_net_t my_image`
|
||||
```
|
||||
docker run --security-opt label=type:svirt_lxc_net_t my_image
|
||||
```
|
||||
|
||||
## 11. Best Practices
|
||||
|
||||
|
||||
@ -113,22 +113,34 @@ Basic steps:
|
||||
1. Install kubectl (Kubernetes command-line tool)
|
||||
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
||||
3. Deploy an application:
|
||||
`kubectl create deployment my-app --image=my-app-image`
|
||||
```
|
||||
kubectl create deployment my-app --image=my-app-image
|
||||
```
|
||||
4. Expose the deployment:
|
||||
`kubectl expose deployment my-app --type=LoadBalancer --port=8080`
|
||||
```
|
||||
kubectl expose deployment my-app --type=LoadBalancer --port=8080
|
||||
```
|
||||
5. Scale the deployment:
|
||||
`kubectl scale deployment my-app --replicas=3`
|
||||
```
|
||||
kubectl scale deployment my-app --replicas=3
|
||||
```
|
||||
|
||||
## 6. Setting Up and Using Docker Swarm
|
||||
|
||||
Basic steps:
|
||||
1. Initialize a swarm:
|
||||
`docker swarm init`
|
||||
```
|
||||
docker swarm init
|
||||
```
|
||||
2. Join worker nodes to the swarm
|
||||
3. Deploy a service:
|
||||
`docker service create --name my-service my-image`
|
||||
```
|
||||
docker service create --name my-service my-image
|
||||
```
|
||||
4. Scale the service:
|
||||
`docker service scale my-service=3`
|
||||
```
|
||||
docker service scale my-service=3
|
||||
```
|
||||
|
||||
## 7. Best Practices for Container Orchestration
|
||||
|
||||
|
||||
@ -30,7 +30,9 @@ c) QEMU for hardware emulation.
|
||||
|
||||
On most Linux distributions, you can install KVM using the package manager:
|
||||
|
||||
`sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils`
|
||||
```bash
|
||||
sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils
|
||||
```
|
||||
|
||||
## 6. Creating and Managing VMs
|
||||
|
||||
|
||||
@ -13,12 +13,17 @@ LXC uses Linux kernel features such as cgroups, namespaces, and chroot to create
|
||||
## 3. Installation
|
||||
To install LXC on most Linux distributions:
|
||||
|
||||
`sudo apt-get update && sudo apt-get install lxc lxc-templates`
|
||||
```
|
||||
sudo apt-get update
|
||||
sudo apt-get install lxc lxc-templates
|
||||
```
|
||||
|
||||
## 4. Creating containers
|
||||
To create a new container:
|
||||
|
||||
`sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64`
|
||||
```
|
||||
sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64
|
||||
```
|
||||
|
||||
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
||||
|
||||
|
||||
@ -37,28 +37,40 @@ CMD ["python", "app.py"]
|
||||
|
||||
To build an image from a Dockerfile:
|
||||
|
||||
`docker build -t myapp:v1 .`
|
||||
```
|
||||
docker build -t myapp:v1 .
|
||||
```
|
||||
|
||||
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
||||
|
||||
## 4. Managing Docker Images
|
||||
|
||||
List images:
|
||||
`docker images`
|
||||
```
|
||||
docker images
|
||||
```
|
||||
|
||||
Remove an image:
|
||||
`docker rmi myapp:v1`
|
||||
```
|
||||
docker rmi myapp:v1
|
||||
```
|
||||
|
||||
Tag an image:
|
||||
`docker tag myapp:v1 myapp:latest`
|
||||
```
|
||||
docker tag myapp:v1 myapp:latest
|
||||
```
|
||||
|
||||
## 5. Pushing and Pulling Images
|
||||
|
||||
Push an image to a registry:
|
||||
`docker push username/myapp:v1`
|
||||
```
|
||||
docker push username/myapp:v1
|
||||
```
|
||||
|
||||
Pull an image from a registry:
|
||||
`docker pull username/myapp:v1`
|
||||
```
|
||||
docker pull username/myapp:v1
|
||||
```
|
||||
|
||||
## 6. Multi-stage Builds
|
||||
|
||||
@ -89,10 +101,14 @@ CMD ["myapp"]
|
||||
## 8. Docker Image Inspection
|
||||
|
||||
Inspect image details:
|
||||
`docker inspect myapp:v1`
|
||||
```
|
||||
docker inspect myapp:v1
|
||||
```
|
||||
|
||||
View image history:
|
||||
`docker history myapp:v1`
|
||||
```
|
||||
docker history myapp:v1
|
||||
```
|
||||
|
||||
## 9. Optimizing Docker Images
|
||||
|
||||
@ -109,13 +125,17 @@ View image history:
|
||||
- Azure Container Registry (ACR)
|
||||
|
||||
To use a private registry, log in first:
|
||||
`docker login myregistry.azurecr.io`
|
||||
```
|
||||
docker login myregistry.azurecr.io
|
||||
```
|
||||
|
||||
## 11. Image Scanning and Security
|
||||
|
||||
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
||||
|
||||
`docker scan myapp:v1`
|
||||
```
|
||||
docker scan myapp:v1
|
||||
```
|
||||
|
||||
## 12. Docker Image Versioning
|
||||
|
||||
@ -130,6 +150,9 @@ Always tag your images with a specific version and avoid using only the "latest"
|
||||
|
||||
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
||||
|
||||
`hadolint Dockerfile`
|
||||
```
|
||||
hadolint Dockerfile
|
||||
```
|
||||
|
||||
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
||||
|
||||
|
||||
@ -68,7 +68,7 @@ members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant Home](https://www.contributor-covenant.org/), version 1.4,
|
||||
This Code of Conduct is adapted from the [Contributor Covenant Home](hhttps://www.contributor-covenant.org/), version 1.4,
|
||||
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
||||
|
||||
For answers to common questions about this code of conduct, see
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user