Compare commits
No commits in common. "714f8f2362d290d40c5eae3df2a71f45befd22c4" and "a7c7e19eaccc4e7ee2beac5913cbd6d411134428" have entirely different histories.
714f8f2362
...
a7c7e19eac
@ -1,6 +1,6 @@
|
||||
# Package Management with Yum (RHEL Based)
|
||||
|
||||
### 1. Introduction to Yum
|
||||
###1. Introduction to Yum
|
||||
|
||||
Yum (Yellowdog Updater Modified) is the primary package management tool for Red Hat Enterprise Linux (RHEL) and its derivatives like CentOS and Fedora. It allows you to install, update, and remove software packages while automatically handling dependencies.
|
||||
|
||||
|
||||
@ -0,0 +1,27 @@
|
||||
## In **Linux Mint**, package management is essential for installing, updating, and managing software. Let's explore some key tools and concepts:
|
||||
|
||||
1. **APT (Advanced Packaging Tool)**:
|
||||
- APT is the primary package manager for Debian-based systems, including Linux Mint.
|
||||
- It handles software installation, removal, querying, and upgrades.
|
||||
- Common APT commands:
|
||||
- `sudo apt update`: Refreshes package lists from repositories.
|
||||
- `sudo apt install package-name`: Installs a package.
|
||||
- `sudo apt remove package-name`: Removes a package.
|
||||
- `sudo apt upgrade`: Upgrades installed packages.
|
||||
- `sudo apt search keyword`: Searches for packages.
|
||||
- APT uses `.deb` packages and works alongside `dpkg`, which installs individual `.deb` files.
|
||||
|
||||
2. **Synaptic Package Manager**:
|
||||
- Synaptic is an advanced graphical package management tool.
|
||||
- To install Synaptic:
|
||||
```
|
||||
sudo apt install synaptic
|
||||
```
|
||||
- Launch it from the Applications menu or by typing `synaptic` in the terminal.
|
||||
|
||||
Remember, APT and Synaptic empower you to manage software efficiently in Linux Mint! 😊🚀 ²³
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) How to Install and Update Apps on Linux Mint - UMA Technology.](https://umatechnology.org/how-to-install-and-update-apps-on-linux-mint/.)
|
||||
- [(2) How to Use APT Command in Linux [15 Useful Examples] - UbuntuMint.](https://www.ubuntumint.com/apt-commands/.)
|
||||
- [(3) Package Management Essentials: apt, yum, dnf, pkg.](https://www.digitalocean.com/community/tutorials/package-management-basics-apt-yum-dnf-pkg.)
|
||||
@ -50,7 +50,7 @@ Linux follows a standardized directory structure:
|
||||
- /etc: System configuration files
|
||||
- /var: Variable data (logs, temporary files)
|
||||
- /boot: Boot loader files
|
||||
- /mnt and /run/media: Mount points for removable devices
|
||||
- /mnt and /media: Mount points for removable devices
|
||||
|
||||
## 5. Common Disk Management Tools
|
||||
|
||||
@ -60,8 +60,8 @@ Linux provides several tools for disk management:
|
||||
- fdisk: Partition table manipulator
|
||||
- parted: Versatile partition tool
|
||||
- lsblk: List block devices
|
||||
- df: Report "disk free" in bytes. add "-h" option for human readable
|
||||
- du: Estimate file space usage for current directory. Add "-h" option for human readable file sizes.
|
||||
- df: Report file system disk space usage
|
||||
- du: Estimate file space usage
|
||||
|
||||
### b. Graphical tools:
|
||||
- GParted: GNOME Partition Editor
|
||||
@ -72,8 +72,6 @@ Linux provides several tools for disk management:
|
||||
### a. Viewing disk information:
|
||||
```
|
||||
lsblk
|
||||
```
|
||||
```
|
||||
fdisk -l
|
||||
```
|
||||
|
||||
@ -81,7 +79,7 @@ fdisk -l
|
||||
```
|
||||
sudo fdisk /dev/sdX
|
||||
```
|
||||
(Replace X with the appropriate letter). Follow prompts inside fdisk to create new blank partition.
|
||||
(Replace X with the appropriate letter)
|
||||
|
||||
### c. Formatting a partition:
|
||||
```
|
||||
@ -111,7 +109,7 @@ LVM allows for more flexible disk management, including:
|
||||
- Creating snapshots
|
||||
|
||||
### c. RAID (Redundant Array of Independent Disks):
|
||||
Linux supports software RAID for improved performance and data redundancy in hardware and software formats.
|
||||
Linux supports software RAID for improved performance and data redundancy.
|
||||
|
||||
### d. Encrypting partitions:
|
||||
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
||||
@ -129,3 +127,10 @@ d. Monitor disk health: Use tools like smartctl to check for potential drive fai
|
||||
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
||||
|
||||
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
||||
|
||||
|
||||
- [(1) How to Install GParted on Linux Mint 21 - Linux Genie.](https://linuxgenie.net/how-to-install-gparted-on-linux-mint-21/.)
|
||||
- [(2) Linux Mint View & Manage System Partitions: A Comprehensive Guide.](https://bytebitebit.com/tips-tricks/linux-mint-view-manage-system-partitions/.)
|
||||
- [(3) Linux Mint View Manage System Partitions: A Comprehensive Guide.](https://www.positioniseverything.net/linux-mint-view-manage-system-partitions/.)
|
||||
- [(4) Mastering Linux Disk Management: LVM and Disk Partitioning.](https://www.linuxjournal.com/content/mastering-linux-disk-management-lvm-and-disk-partitioning.)
|
||||
- [(5) How to Use Fdisk to Manage Partitions on Linux - How-To Geek.](https://www.howtogeek.com/106873/how-to-use-fdisk-to-manage-partitions-on-linux/.)
|
||||
|
||||
39
08 - Advanced Linux Administration/Networking File System.md
Normal file
39
08 - Advanced Linux Administration/Networking File System.md
Normal file
@ -0,0 +1,39 @@
|
||||
## Let's discuss **NTFS (New Technology File System)** and how to work with it in **Linux Mint**.
|
||||
|
||||
1. **Mounting NTFS Partitions**:
|
||||
- NTFS is the default file system for Windows systems, but we can also mount NTFS partitions in Linux to read and write data.
|
||||
- To mount an NTFS partition, follow these steps:
|
||||
- First, create a mount point using the `mkdir` command:
|
||||
```
|
||||
sudo mkdir /mnt/ntfs
|
||||
```
|
||||
- Next, use the `mount` command to mount the partition you want (e.g., `/dev/sdb2`):
|
||||
```
|
||||
sudo mount -t ntfs-3g /dev/sdb2 /mnt/ntfs
|
||||
```
|
||||
- To check if the partition is mounted, run:
|
||||
```
|
||||
df -hT
|
||||
```
|
||||
- Now you have read/write permissions for the NTFS partition you mounted¹².
|
||||
|
||||
2. **Changing File Permissions on NTFS Partitions**:
|
||||
- To apply Linux-compatible file permissions to an NTFS drive, modify the `/etc/fstab` file.
|
||||
- Add the following line to `/etc/fstab`:
|
||||
```
|
||||
/dev/sdb /mnt/ntfs ntfs uid=1000,gid=1000,dmask=022,fmask=133 0 0
|
||||
```
|
||||
This line specifies that the `/dev/sdb` partition should be mounted as NTFS in the `/mnt/ntfs` directory.
|
||||
- Remount the partition or reboot for the changes to take effect².
|
||||
|
||||
Feel free to explore further or ask if you need additional assistance! 😊🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) How to Mount NTFS Partition in Linux - phoenixNAP.](https://phoenixnap.com/kb/mount-ntfs-linux.)
|
||||
- [(2) Changing File Permissions on NTFS Partitions in Linux.](https://linuxconfig.org/changing-file-permissions-on-ntfs-partitions-in-linux.)
|
||||
- [(3) How to Mount and Access Windows NTFS Drives in Linux - MUO.](https://www.makeuseof.com/mount-ntfs-windows-drives-in-linux/.)
|
||||
- [(4) How to Mount an NTFS Partition - Linux Nightly.](https://linuxnightly.com/mount-ntfs-partition/.)
|
||||
- [(5) Linux mount ntfs or Access NTFS partition from Linux - nixCraft.](https://www.cyberciti.biz/faq/linux-mount-ntfs-or-access-ntfs-partition-from-linux/.)
|
||||
- [(6) How to mount NTFS partitions using Linux commands.](https://www.computerworld.com/article/1637061/how-to-mount-ntfs-partitions-using-linux-commands.html.)
|
||||
- [(7) NTFS Disk mounting in mint - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/358229/ntfs-disk-mounting-in-mint.)
|
||||
- [(8) How to Mount NFS in Linux: A Step-by-Step Guide - Byte Bite Bit.](https://bytebitebit.com/operating-system/linux/how-to-mount-nfs-in-linux/.)
|
||||
@ -143,3 +143,11 @@ This setup provides the redundancy of RAID 5 with the flexibility of LVM.
|
||||
- Display PV info: `sudo pvdisplay`
|
||||
- Display VG info: `sudo vgdisplay`
|
||||
- Display LV info: `sudo lvdisplay`
|
||||
|
||||
Remember, LVM provides flexibility, scalability, and ease of maintenance, while RAID enhances performance and data protection! 😊🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) Complete Beginner's Guide to LVM in Linux [With Hands-on].](https://linuxhandbook.com/lvm-guide/.)
|
||||
- [(2) Linux Storage Management: LVM and RAID.](https://linuxhall.org/linux-storage-management-lvm-and-raid/.)
|
||||
- [(3) raid - RAIDing with LVM vs MDRAID - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/150644/raiding-with-lvm-vs-mdraid-pros-and-cons.)
|
||||
- [(4) What is better LVM on RAID or RAID on LVM? - Server Fault.](https://serverfault.com/questions/217666/what-is-better-lvm-on-raid-or-raid-on-lvm.)
|
||||
|
||||
@ -7,94 +7,129 @@ journalctl is a command-line utility for querying and displaying logs from the s
|
||||
## 2. Basic Usage
|
||||
|
||||
### To view all logs:
|
||||
`journalctl`
|
||||
```
|
||||
journalctl
|
||||
```
|
||||
|
||||
### To follow new log entries in real-time:
|
||||
`journalctl -f`
|
||||
```
|
||||
journalctl -f
|
||||
```
|
||||
|
||||
## 3. Filtering Logs
|
||||
|
||||
### By time:
|
||||
`journalctl --since "2024-01-01 00:00:00"`
|
||||
|
||||
`journalctl --until "2024-01-31 23:59:59"`
|
||||
|
||||
`journalctl --since "1 hour ago"`
|
||||
|
||||
```
|
||||
journalctl --since "2024-01-01 00:00:00"
|
||||
journalctl --until "2024-01-31 23:59:59"
|
||||
journalctl --since "1 hour ago"
|
||||
```
|
||||
|
||||
### By service unit:
|
||||
`journalctl -u nginx.service`
|
||||
|
||||
`journalctl -u ssh.service`
|
||||
|
||||
```
|
||||
journalctl -u nginx.service
|
||||
journalctl -u ssh.service
|
||||
```
|
||||
|
||||
### By priority level:
|
||||
`journalctl -p err`
|
||||
```
|
||||
journalctl -p err
|
||||
```
|
||||
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
||||
|
||||
### By kernel messages:
|
||||
`journalctl -k`
|
||||
```
|
||||
journalctl -k
|
||||
```
|
||||
|
||||
## 4. Output Formatting
|
||||
|
||||
### JSON output:
|
||||
`journalctl -o json`
|
||||
```
|
||||
journalctl -o json
|
||||
```
|
||||
|
||||
### Short output format:
|
||||
`journalctl -o short`
|
||||
```
|
||||
journalctl -o short
|
||||
```
|
||||
|
||||
### Verbose output:
|
||||
`journalctl -o verbose`
|
||||
```
|
||||
journalctl -o verbose
|
||||
```
|
||||
|
||||
## 5. Boot-specific Logs
|
||||
|
||||
### Current boot:
|
||||
`journalctl -b`
|
||||
```
|
||||
journalctl -b
|
||||
```
|
||||
|
||||
### Previous boot:
|
||||
`journalctl -b -1`
|
||||
```
|
||||
journalctl -b -1
|
||||
```
|
||||
|
||||
## 6. User-specific Logs
|
||||
|
||||
`journalctl _UID=1000`
|
||||
```
|
||||
journalctl _UID=1000
|
||||
```
|
||||
|
||||
## 7. Disk Usage and Log Rotation
|
||||
|
||||
### View disk usage:
|
||||
`journalctl --disk-usage`
|
||||
```
|
||||
journalctl --disk-usage
|
||||
```
|
||||
|
||||
### Rotate logs:
|
||||
`journalctl --rotate`
|
||||
```
|
||||
journalctl --rotate
|
||||
```
|
||||
|
||||
### Vacuum old logs:
|
||||
`journalctl --vacuum-time=1week`
|
||||
|
||||
`journalctl --vacuum-size=1G`
|
||||
|
||||
```
|
||||
journalctl --vacuum-time=1week
|
||||
journalctl --vacuum-size=1G
|
||||
```
|
||||
|
||||
## 8. Remote Journal Access
|
||||
|
||||
To access logs on a remote system:
|
||||
`journalctl -D /path/to/journal/directory`
|
||||
```
|
||||
journalctl -D /path/to/journal/directory
|
||||
```
|
||||
|
||||
## 9. Persistent Journal Storage
|
||||
|
||||
### Edit /etc/systemd/journald.conf:
|
||||
`Storage=persistent`
|
||||
```
|
||||
Storage=persistent
|
||||
```
|
||||
|
||||
### Restart journald:
|
||||
`sudo systemctl restart systemd-journald`
|
||||
```
|
||||
sudo systemctl restart systemd-journald
|
||||
```
|
||||
|
||||
## 10. Forwarding Logs to a Central Server
|
||||
|
||||
### Install rsyslog:
|
||||
`sudo apt install rsyslog`
|
||||
```
|
||||
sudo apt install rsyslog
|
||||
```
|
||||
|
||||
### Configure /etc/rsyslog.conf for forwarding:
|
||||
`*.* @@central-log-server:514`
|
||||
```
|
||||
*.* @@central-log-server:514
|
||||
```
|
||||
|
||||
### Restart rsyslog:
|
||||
`sudo systemctl restart rsyslog`
|
||||
```
|
||||
sudo systemctl restart rsyslog
|
||||
```
|
||||
|
||||
## 11. Security Considerations
|
||||
|
||||
|
||||
@ -36,3 +36,12 @@
|
||||
- Regularly back up important files to an external location.
|
||||
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
||||
|
||||
Remember, a combination of these practices helps maintain a secure Linux Mint environment. Feel free to explore further or ask if you need additional guidance! 😊🔒🚀
|
||||
|
||||
Source: Conversation with Copilot, 7/12/2024
|
||||
- [(1) 10 practical tips for securing your Linux Mint system - FOSS Linux.](https://www.fosslinux.com/103872/secure-your-linux-mint-system.htm.)
|
||||
- [(2) How to reset a forgotten password for any user under Linux Mint 21 ....](https://www.thinkpenguin.com/gnu-linux/how-reset-forgotten-password-any-user-under-linux-mint-21.)
|
||||
- [(3) Linux Mint 20 [Essential Security Guide: Tools & Tweaks].](https://www.securitybind.com/secure-linux-mint/.)
|
||||
- [(4) How to Configure Linux Mint Login Window: A Step-by-Step Guide.](https://bytebitebit.com/tips-tricks/how-to-configure-linux-mint-login-window/.)
|
||||
- [(5) Changes to password policies – The Linux Mint Blog.](https://blog.linuxmint.com/?p=3013.)
|
||||
- [(6) en.wikipedia.org.](https://en.wikipedia.org/wiki/Linux_Mint.)
|
||||
@ -17,14 +17,18 @@ Key features:
|
||||
|
||||
On most Linux distributions, eCryptfs can be installed using the package manager:
|
||||
|
||||
For Ubuntu/Debian:
|
||||
`sudo apt-get install ecryptfs-utils`
|
||||
|
||||
For Fedora:
|
||||
`sudo dnf install ecryptfs-utils`
|
||||
|
||||
For Arch Linux:
|
||||
`sudo pacman -S ecryptfs-utils`
|
||||
```bash
|
||||
# For Ubuntu/Debian:
|
||||
sudo apt-get install ecryptfs-utils
|
||||
```
|
||||
```bash
|
||||
# For Fedora:
|
||||
sudo dnf install ecryptfs-utils
|
||||
```
|
||||
```bash
|
||||
# For Arch Linux:
|
||||
sudo pacman -S ecryptfs-utils
|
||||
```
|
||||
|
||||
## 3. Setting up eCryptfs
|
||||
|
||||
@ -62,11 +66,15 @@ mount -t ecryptfs ~/encrypted ~/encrypted
|
||||
|
||||
### - Unmounting:
|
||||
|
||||
`umount ~/encrypted`
|
||||
```bash
|
||||
umount ~/encrypted
|
||||
```
|
||||
|
||||
### - Checking mount status:
|
||||
|
||||
`mount | grep ecryptfs`
|
||||
```bash
|
||||
mount | grep ecryptfs
|
||||
```
|
||||
|
||||
## 5. Key Management
|
||||
|
||||
@ -74,11 +82,15 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
||||
|
||||
### - Adding a key to the keyring:
|
||||
|
||||
`ecryptfs-add-passphrase`
|
||||
```bash
|
||||
ecryptfs-add-passphrase
|
||||
```
|
||||
|
||||
### - Removing a key from the keyring:
|
||||
|
||||
`keyctl purge user ecryptfs`
|
||||
```bash
|
||||
keyctl purge user ecryptfs
|
||||
```
|
||||
|
||||
## 6. Advanced Features
|
||||
|
||||
@ -86,11 +98,15 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
||||
|
||||
Create a file containing your mount options:
|
||||
|
||||
`echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc`
|
||||
```bash
|
||||
echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc
|
||||
```
|
||||
|
||||
Then mount using:
|
||||
|
||||
`mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted`
|
||||
```bash
|
||||
mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted
|
||||
```
|
||||
|
||||
### - Using different encryption for different directories:
|
||||
|
||||
@ -109,11 +125,15 @@ You can mount multiple eCryptfs directories with different encryption settings b
|
||||
|
||||
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
||||
|
||||
`lsmod | grep ecryptfs`
|
||||
```bash
|
||||
lsmod | grep ecryptfs
|
||||
```
|
||||
|
||||
If not present, load them:
|
||||
|
||||
`sudo modprobe ecryptfs`
|
||||
```bash
|
||||
sudo modprobe ecryptfs
|
||||
```
|
||||
|
||||
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
||||
|
||||
|
||||
@ -16,28 +16,36 @@ OpenSSL is a robust, full-featured open-source toolkit that implements the Secur
|
||||
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
||||
|
||||
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
||||
`sudo apt-get install openssl libssl-dev # For Debian/Ubuntu`
|
||||
|
||||
`sudo yum install openssl openssl-devel # For CentOS/RHEL`
|
||||
```bash
|
||||
sudo apt-get install openssl libssl-dev # For Debian/Ubuntu
|
||||
```
|
||||
```bash
|
||||
sudo yum install openssl openssl-devel # For CentOS/RHEL
|
||||
```
|
||||
|
||||
- macOS: Use Homebrew:
|
||||
`brew install openssl`
|
||||
```
|
||||
brew install openssl
|
||||
```
|
||||
|
||||
- Windows: Download the installer from the official OpenSSL website.
|
||||
|
||||
## 4. Basic OpenSSL Commands
|
||||
|
||||
- Generate a private key:
|
||||
|
||||
`openssl genrsa -out private.key 2048`
|
||||
```bash
|
||||
openssl genrsa -out private.key 2048
|
||||
```
|
||||
|
||||
- Create a Certificate Signing Request (CSR):
|
||||
|
||||
`openssl req -new -key private.key -out certificate.csr`
|
||||
```bash
|
||||
openssl req -new -key private.key -out certificate.csr
|
||||
```
|
||||
|
||||
- Generate a self-signed certificate:
|
||||
|
||||
`openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365`
|
||||
```bash
|
||||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
|
||||
```
|
||||
|
||||
## 5. Implementing SSL/TLS in Network Applications
|
||||
|
||||
|
||||
@ -11,7 +11,10 @@ Fail2Ban is an intrusion prevention software framework that protects Linux syste
|
||||
- Updates firewall rules to block banned IPs
|
||||
|
||||
### Installation:
|
||||
`sudo apt-get update && sudo apt-get install fail2ban`
|
||||
```bash
|
||||
sudo apt-get update
|
||||
sudo apt-get install fail2ban
|
||||
```
|
||||
|
||||
### Configuration:
|
||||
- Main configuration file: `/etc/fail2ban/jail.conf`
|
||||
@ -53,7 +56,10 @@ AIDE is a file and directory integrity checker that detects unauthorized changes
|
||||
- Reports any discrepancies, indicating potential security breaches
|
||||
|
||||
### Installation:
|
||||
`sudo apt-get update && sudo apt-get install aide`
|
||||
```bash
|
||||
sudo apt-get update
|
||||
sudo apt-get install aide
|
||||
```
|
||||
|
||||
### Configuration:
|
||||
- Main configuration file: /etc/aide/aide.conf
|
||||
|
||||
@ -18,13 +18,17 @@ SELinux operates in three modes:
|
||||
- Disabled: SELinux is turned off
|
||||
|
||||
To check the current mode:
|
||||
`getenforce`
|
||||
```
|
||||
getenforce
|
||||
```
|
||||
|
||||
To change modes temporarily:
|
||||
|
||||
`setenforce 0` # Set to permissive
|
||||
|
||||
`setenforce 1` # Set to enforcing
|
||||
```bash
|
||||
setenforce 0 # Set to permissive
|
||||
```
|
||||
```bash
|
||||
setenforce 1 # Set to enforcing
|
||||
```
|
||||
|
||||
To change modes permanently, edit /etc/selinux/config and reboot.
|
||||
|
||||
@ -39,11 +43,10 @@ system_u:object_r:httpd_sys_content_t:s0
|
||||
```
|
||||
|
||||
To view contexts:
|
||||
|
||||
`ls -Z` # For files
|
||||
|
||||
`ps auxZ` # For processes
|
||||
|
||||
```
|
||||
ls -Z # For files
|
||||
ps auxZ # For processes
|
||||
```
|
||||
|
||||
## 4. SELinux Policies
|
||||
|
||||
@ -56,56 +59,84 @@ SELinux uses policies to define allowed actions. Two main policy types:
|
||||
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
||||
|
||||
To list all booleans:
|
||||
`getsebool -a`
|
||||
```
|
||||
getsebool -a
|
||||
```
|
||||
|
||||
To change a boolean:
|
||||
`setsebool httpd_can_network_connect on`
|
||||
```bash
|
||||
setsebool httpd_can_network_connect on
|
||||
```
|
||||
|
||||
To make the change persistent:
|
||||
`setsebool -P httpd_can_network_connect on`
|
||||
```bash
|
||||
setsebool -P httpd_can_network_connect on
|
||||
```
|
||||
|
||||
## 6. Troubleshooting SELinux
|
||||
|
||||
- Check for denials:
|
||||
`ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent`
|
||||
```
|
||||
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent
|
||||
```
|
||||
|
||||
- Use SELinux troubleshooter:
|
||||
`sealert -a /var/log/audit/audit.log`
|
||||
```
|
||||
sealert -a /var/log/audit/audit.log
|
||||
```
|
||||
|
||||
- Analyze SELinux logs:
|
||||
`grep "SELinux" /var/log/messages`
|
||||
```
|
||||
grep "SELinux" /var/log/messages
|
||||
```
|
||||
|
||||
## 7. File and Directory Labeling
|
||||
|
||||
To change the SELinux context of a file or directory:
|
||||
`chcon -t httpd_sys_content_t /path/to/file`
|
||||
```
|
||||
chcon -t httpd_sys_content_t /path/to/file
|
||||
```
|
||||
|
||||
To restore the default context:
|
||||
`restorecon -v /path/to/file`
|
||||
```
|
||||
restorecon -v /path/to/file
|
||||
```
|
||||
|
||||
## 8. Managing SELinux Modules
|
||||
|
||||
List available modules:
|
||||
`semodule -l`
|
||||
```
|
||||
semodule -l
|
||||
```
|
||||
|
||||
Enable a module:
|
||||
`semodule -e modulename`
|
||||
```
|
||||
semodule -e modulename
|
||||
```
|
||||
|
||||
Disable a module:
|
||||
`semodule -d modulename`
|
||||
```
|
||||
semodule -d modulename
|
||||
```
|
||||
|
||||
## 9. Creating Custom SELinux Policies
|
||||
|
||||
For complex environments, you may need to create custom policies:
|
||||
|
||||
- Install policy development tools:
|
||||
`yum install selinux-policy-devel`
|
||||
```
|
||||
yum install selinux-policy-devel
|
||||
```
|
||||
|
||||
- Write a policy module (.te file)
|
||||
- Compile and package the module:
|
||||
`make -f /usr/share/selinux/devel/Makefile`
|
||||
```
|
||||
make -f /usr/share/selinux/devel/Makefile
|
||||
```
|
||||
- Install the module:
|
||||
`semodule -i mymodule.pp`
|
||||
```
|
||||
semodule -i mymodule.pp
|
||||
```
|
||||
|
||||
## 10. SELinux and Containers
|
||||
|
||||
@ -114,7 +145,9 @@ SELinux provides strong isolation for containers:
|
||||
- Prevents container processes from accessing host resources
|
||||
|
||||
To run a container with a specific SELinux context:
|
||||
`docker run --security-opt label=type:svirt_lxc_net_t my_image`
|
||||
```
|
||||
docker run --security-opt label=type:svirt_lxc_net_t my_image
|
||||
```
|
||||
|
||||
## 11. Best Practices
|
||||
|
||||
|
||||
@ -113,22 +113,34 @@ Basic steps:
|
||||
1. Install kubectl (Kubernetes command-line tool)
|
||||
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
||||
3. Deploy an application:
|
||||
`kubectl create deployment my-app --image=my-app-image`
|
||||
```
|
||||
kubectl create deployment my-app --image=my-app-image
|
||||
```
|
||||
4. Expose the deployment:
|
||||
`kubectl expose deployment my-app --type=LoadBalancer --port=8080`
|
||||
```
|
||||
kubectl expose deployment my-app --type=LoadBalancer --port=8080
|
||||
```
|
||||
5. Scale the deployment:
|
||||
`kubectl scale deployment my-app --replicas=3`
|
||||
```
|
||||
kubectl scale deployment my-app --replicas=3
|
||||
```
|
||||
|
||||
## 6. Setting Up and Using Docker Swarm
|
||||
|
||||
Basic steps:
|
||||
1. Initialize a swarm:
|
||||
`docker swarm init`
|
||||
```
|
||||
docker swarm init
|
||||
```
|
||||
2. Join worker nodes to the swarm
|
||||
3. Deploy a service:
|
||||
`docker service create --name my-service my-image`
|
||||
```
|
||||
docker service create --name my-service my-image
|
||||
```
|
||||
4. Scale the service:
|
||||
`docker service scale my-service=3`
|
||||
```
|
||||
docker service scale my-service=3
|
||||
```
|
||||
|
||||
## 7. Best Practices for Container Orchestration
|
||||
|
||||
|
||||
@ -30,7 +30,9 @@ c) QEMU for hardware emulation.
|
||||
|
||||
On most Linux distributions, you can install KVM using the package manager:
|
||||
|
||||
`sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils`
|
||||
```bash
|
||||
sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils
|
||||
```
|
||||
|
||||
## 6. Creating and Managing VMs
|
||||
|
||||
|
||||
@ -13,12 +13,17 @@ LXC uses Linux kernel features such as cgroups, namespaces, and chroot to create
|
||||
## 3. Installation
|
||||
To install LXC on most Linux distributions:
|
||||
|
||||
`sudo apt-get update && sudo apt-get install lxc lxc-templates`
|
||||
```
|
||||
sudo apt-get update
|
||||
sudo apt-get install lxc lxc-templates
|
||||
```
|
||||
|
||||
## 4. Creating containers
|
||||
To create a new container:
|
||||
|
||||
`sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64`
|
||||
```
|
||||
sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64
|
||||
```
|
||||
|
||||
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
||||
|
||||
@ -57,9 +62,9 @@ LXC supports multiple storage backends:
|
||||
- Use AppArmor or SELinux profiles
|
||||
|
||||
## 10. Advanced features
|
||||
- Snapshots: Create point-in-time copies of containers
|
||||
- Live migration: Move running containers between hosts
|
||||
- Nesting: Run LXC containers inside other LXC containers
|
||||
- Snapshots: Create point-in-time copies of containers
|
||||
- Live migration: Move running containers between hosts
|
||||
- Nesting: Run LXC containers inside other LXC containers
|
||||
|
||||
## 11. LXC vs. Docker
|
||||
While both use Linux containerization, they have different focuses:
|
||||
|
||||
@ -37,28 +37,40 @@ CMD ["python", "app.py"]
|
||||
|
||||
To build an image from a Dockerfile:
|
||||
|
||||
`docker build -t myapp:v1 .`
|
||||
```
|
||||
docker build -t myapp:v1 .
|
||||
```
|
||||
|
||||
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
||||
|
||||
## 4. Managing Docker Images
|
||||
|
||||
List images:
|
||||
`docker images`
|
||||
```
|
||||
docker images
|
||||
```
|
||||
|
||||
Remove an image:
|
||||
`docker rmi myapp:v1`
|
||||
```
|
||||
docker rmi myapp:v1
|
||||
```
|
||||
|
||||
Tag an image:
|
||||
`docker tag myapp:v1 myapp:latest`
|
||||
```
|
||||
docker tag myapp:v1 myapp:latest
|
||||
```
|
||||
|
||||
## 5. Pushing and Pulling Images
|
||||
|
||||
Push an image to a registry:
|
||||
`docker push username/myapp:v1`
|
||||
```
|
||||
docker push username/myapp:v1
|
||||
```
|
||||
|
||||
Pull an image from a registry:
|
||||
`docker pull username/myapp:v1`
|
||||
```
|
||||
docker pull username/myapp:v1
|
||||
```
|
||||
|
||||
## 6. Multi-stage Builds
|
||||
|
||||
@ -89,10 +101,14 @@ CMD ["myapp"]
|
||||
## 8. Docker Image Inspection
|
||||
|
||||
Inspect image details:
|
||||
`docker inspect myapp:v1`
|
||||
```
|
||||
docker inspect myapp:v1
|
||||
```
|
||||
|
||||
View image history:
|
||||
`docker history myapp:v1`
|
||||
```
|
||||
docker history myapp:v1
|
||||
```
|
||||
|
||||
## 9. Optimizing Docker Images
|
||||
|
||||
@ -109,13 +125,17 @@ View image history:
|
||||
- Azure Container Registry (ACR)
|
||||
|
||||
To use a private registry, log in first:
|
||||
`docker login myregistry.azurecr.io`
|
||||
```
|
||||
docker login myregistry.azurecr.io
|
||||
```
|
||||
|
||||
## 11. Image Scanning and Security
|
||||
|
||||
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
||||
|
||||
`docker scan myapp:v1`
|
||||
```
|
||||
docker scan myapp:v1
|
||||
```
|
||||
|
||||
## 12. Docker Image Versioning
|
||||
|
||||
@ -130,6 +150,9 @@ Always tag your images with a specific version and avoid using only the "latest"
|
||||
|
||||
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
||||
|
||||
`hadolint Dockerfile`
|
||||
```
|
||||
hadolint Dockerfile
|
||||
```
|
||||
|
||||
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
||||
|
||||
|
||||
@ -68,7 +68,7 @@ members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant Home](https://www.contributor-covenant.org/), version 1.4,
|
||||
This Code of Conduct is adapted from the [Contributor Covenant Home](hhttps://www.contributor-covenant.org/), version 1.4,
|
||||
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
||||
|
||||
For answers to common questions about this code of conduct, see
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user