Compare commits
13 Commits
a7c7e19eac
...
714f8f2362
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
714f8f2362 | ||
|
|
55f29d96ca | ||
|
|
1b8e2eb5b9 | ||
|
|
eb9228c564 | ||
|
|
ecced9e5bb | ||
|
|
57d07f1f13 | ||
|
|
ba75965206 | ||
|
|
dc581e66da | ||
|
|
e6be20afa9 | ||
|
|
9828da0ee7 | ||
|
|
65a620b912 | ||
|
|
82c0dcbbc1 | ||
|
|
e6f87ebb4d |
@ -1,27 +0,0 @@
|
|||||||
## In **Linux Mint**, package management is essential for installing, updating, and managing software. Let's explore some key tools and concepts:
|
|
||||||
|
|
||||||
1. **APT (Advanced Packaging Tool)**:
|
|
||||||
- APT is the primary package manager for Debian-based systems, including Linux Mint.
|
|
||||||
- It handles software installation, removal, querying, and upgrades.
|
|
||||||
- Common APT commands:
|
|
||||||
- `sudo apt update`: Refreshes package lists from repositories.
|
|
||||||
- `sudo apt install package-name`: Installs a package.
|
|
||||||
- `sudo apt remove package-name`: Removes a package.
|
|
||||||
- `sudo apt upgrade`: Upgrades installed packages.
|
|
||||||
- `sudo apt search keyword`: Searches for packages.
|
|
||||||
- APT uses `.deb` packages and works alongside `dpkg`, which installs individual `.deb` files.
|
|
||||||
|
|
||||||
2. **Synaptic Package Manager**:
|
|
||||||
- Synaptic is an advanced graphical package management tool.
|
|
||||||
- To install Synaptic:
|
|
||||||
```
|
|
||||||
sudo apt install synaptic
|
|
||||||
```
|
|
||||||
- Launch it from the Applications menu or by typing `synaptic` in the terminal.
|
|
||||||
|
|
||||||
Remember, APT and Synaptic empower you to manage software efficiently in Linux Mint! 😊🚀 ²³
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) How to Install and Update Apps on Linux Mint - UMA Technology.](https://umatechnology.org/how-to-install-and-update-apps-on-linux-mint/.)
|
|
||||||
- [(2) How to Use APT Command in Linux [15 Useful Examples] - UbuntuMint.](https://www.ubuntumint.com/apt-commands/.)
|
|
||||||
- [(3) Package Management Essentials: apt, yum, dnf, pkg.](https://www.digitalocean.com/community/tutorials/package-management-basics-apt-yum-dnf-pkg.)
|
|
||||||
@ -50,7 +50,7 @@ Linux follows a standardized directory structure:
|
|||||||
- /etc: System configuration files
|
- /etc: System configuration files
|
||||||
- /var: Variable data (logs, temporary files)
|
- /var: Variable data (logs, temporary files)
|
||||||
- /boot: Boot loader files
|
- /boot: Boot loader files
|
||||||
- /mnt and /media: Mount points for removable devices
|
- /mnt and /run/media: Mount points for removable devices
|
||||||
|
|
||||||
## 5. Common Disk Management Tools
|
## 5. Common Disk Management Tools
|
||||||
|
|
||||||
@ -60,8 +60,8 @@ Linux provides several tools for disk management:
|
|||||||
- fdisk: Partition table manipulator
|
- fdisk: Partition table manipulator
|
||||||
- parted: Versatile partition tool
|
- parted: Versatile partition tool
|
||||||
- lsblk: List block devices
|
- lsblk: List block devices
|
||||||
- df: Report file system disk space usage
|
- df: Report "disk free" in bytes. add "-h" option for human readable
|
||||||
- du: Estimate file space usage
|
- du: Estimate file space usage for current directory. Add "-h" option for human readable file sizes.
|
||||||
|
|
||||||
### b. Graphical tools:
|
### b. Graphical tools:
|
||||||
- GParted: GNOME Partition Editor
|
- GParted: GNOME Partition Editor
|
||||||
@ -72,6 +72,8 @@ Linux provides several tools for disk management:
|
|||||||
### a. Viewing disk information:
|
### a. Viewing disk information:
|
||||||
```
|
```
|
||||||
lsblk
|
lsblk
|
||||||
|
```
|
||||||
|
```
|
||||||
fdisk -l
|
fdisk -l
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -79,7 +81,7 @@ fdisk -l
|
|||||||
```
|
```
|
||||||
sudo fdisk /dev/sdX
|
sudo fdisk /dev/sdX
|
||||||
```
|
```
|
||||||
(Replace X with the appropriate letter)
|
(Replace X with the appropriate letter). Follow prompts inside fdisk to create new blank partition.
|
||||||
|
|
||||||
### c. Formatting a partition:
|
### c. Formatting a partition:
|
||||||
```
|
```
|
||||||
@ -109,7 +111,7 @@ LVM allows for more flexible disk management, including:
|
|||||||
- Creating snapshots
|
- Creating snapshots
|
||||||
|
|
||||||
### c. RAID (Redundant Array of Independent Disks):
|
### c. RAID (Redundant Array of Independent Disks):
|
||||||
Linux supports software RAID for improved performance and data redundancy.
|
Linux supports software RAID for improved performance and data redundancy in hardware and software formats.
|
||||||
|
|
||||||
### d. Encrypting partitions:
|
### d. Encrypting partitions:
|
||||||
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
||||||
@ -127,10 +129,3 @@ d. Monitor disk health: Use tools like smartctl to check for potential drive fai
|
|||||||
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
||||||
|
|
||||||
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
||||||
|
|
||||||
|
|
||||||
- [(1) How to Install GParted on Linux Mint 21 - Linux Genie.](https://linuxgenie.net/how-to-install-gparted-on-linux-mint-21/.)
|
|
||||||
- [(2) Linux Mint View & Manage System Partitions: A Comprehensive Guide.](https://bytebitebit.com/tips-tricks/linux-mint-view-manage-system-partitions/.)
|
|
||||||
- [(3) Linux Mint View Manage System Partitions: A Comprehensive Guide.](https://www.positioniseverything.net/linux-mint-view-manage-system-partitions/.)
|
|
||||||
- [(4) Mastering Linux Disk Management: LVM and Disk Partitioning.](https://www.linuxjournal.com/content/mastering-linux-disk-management-lvm-and-disk-partitioning.)
|
|
||||||
- [(5) How to Use Fdisk to Manage Partitions on Linux - How-To Geek.](https://www.howtogeek.com/106873/how-to-use-fdisk-to-manage-partitions-on-linux/.)
|
|
||||||
|
|||||||
@ -1,39 +0,0 @@
|
|||||||
## Let's discuss **NTFS (New Technology File System)** and how to work with it in **Linux Mint**.
|
|
||||||
|
|
||||||
1. **Mounting NTFS Partitions**:
|
|
||||||
- NTFS is the default file system for Windows systems, but we can also mount NTFS partitions in Linux to read and write data.
|
|
||||||
- To mount an NTFS partition, follow these steps:
|
|
||||||
- First, create a mount point using the `mkdir` command:
|
|
||||||
```
|
|
||||||
sudo mkdir /mnt/ntfs
|
|
||||||
```
|
|
||||||
- Next, use the `mount` command to mount the partition you want (e.g., `/dev/sdb2`):
|
|
||||||
```
|
|
||||||
sudo mount -t ntfs-3g /dev/sdb2 /mnt/ntfs
|
|
||||||
```
|
|
||||||
- To check if the partition is mounted, run:
|
|
||||||
```
|
|
||||||
df -hT
|
|
||||||
```
|
|
||||||
- Now you have read/write permissions for the NTFS partition you mounted¹².
|
|
||||||
|
|
||||||
2. **Changing File Permissions on NTFS Partitions**:
|
|
||||||
- To apply Linux-compatible file permissions to an NTFS drive, modify the `/etc/fstab` file.
|
|
||||||
- Add the following line to `/etc/fstab`:
|
|
||||||
```
|
|
||||||
/dev/sdb /mnt/ntfs ntfs uid=1000,gid=1000,dmask=022,fmask=133 0 0
|
|
||||||
```
|
|
||||||
This line specifies that the `/dev/sdb` partition should be mounted as NTFS in the `/mnt/ntfs` directory.
|
|
||||||
- Remount the partition or reboot for the changes to take effect².
|
|
||||||
|
|
||||||
Feel free to explore further or ask if you need additional assistance! 😊🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) How to Mount NTFS Partition in Linux - phoenixNAP.](https://phoenixnap.com/kb/mount-ntfs-linux.)
|
|
||||||
- [(2) Changing File Permissions on NTFS Partitions in Linux.](https://linuxconfig.org/changing-file-permissions-on-ntfs-partitions-in-linux.)
|
|
||||||
- [(3) How to Mount and Access Windows NTFS Drives in Linux - MUO.](https://www.makeuseof.com/mount-ntfs-windows-drives-in-linux/.)
|
|
||||||
- [(4) How to Mount an NTFS Partition - Linux Nightly.](https://linuxnightly.com/mount-ntfs-partition/.)
|
|
||||||
- [(5) Linux mount ntfs or Access NTFS partition from Linux - nixCraft.](https://www.cyberciti.biz/faq/linux-mount-ntfs-or-access-ntfs-partition-from-linux/.)
|
|
||||||
- [(6) How to mount NTFS partitions using Linux commands.](https://www.computerworld.com/article/1637061/how-to-mount-ntfs-partitions-using-linux-commands.html.)
|
|
||||||
- [(7) NTFS Disk mounting in mint - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/358229/ntfs-disk-mounting-in-mint.)
|
|
||||||
- [(8) How to Mount NFS in Linux: A Step-by-Step Guide - Byte Bite Bit.](https://bytebitebit.com/operating-system/linux/how-to-mount-nfs-in-linux/.)
|
|
||||||
@ -143,11 +143,3 @@ This setup provides the redundancy of RAID 5 with the flexibility of LVM.
|
|||||||
- Display PV info: `sudo pvdisplay`
|
- Display PV info: `sudo pvdisplay`
|
||||||
- Display VG info: `sudo vgdisplay`
|
- Display VG info: `sudo vgdisplay`
|
||||||
- Display LV info: `sudo lvdisplay`
|
- Display LV info: `sudo lvdisplay`
|
||||||
|
|
||||||
Remember, LVM provides flexibility, scalability, and ease of maintenance, while RAID enhances performance and data protection! 😊🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) Complete Beginner's Guide to LVM in Linux [With Hands-on].](https://linuxhandbook.com/lvm-guide/.)
|
|
||||||
- [(2) Linux Storage Management: LVM and RAID.](https://linuxhall.org/linux-storage-management-lvm-and-raid/.)
|
|
||||||
- [(3) raid - RAIDing with LVM vs MDRAID - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/150644/raiding-with-lvm-vs-mdraid-pros-and-cons.)
|
|
||||||
- [(4) What is better LVM on RAID or RAID on LVM? - Server Fault.](https://serverfault.com/questions/217666/what-is-better-lvm-on-raid-or-raid-on-lvm.)
|
|
||||||
|
|||||||
@ -7,129 +7,94 @@ journalctl is a command-line utility for querying and displaying logs from the s
|
|||||||
## 2. Basic Usage
|
## 2. Basic Usage
|
||||||
|
|
||||||
### To view all logs:
|
### To view all logs:
|
||||||
```
|
`journalctl`
|
||||||
journalctl
|
|
||||||
```
|
|
||||||
|
|
||||||
### To follow new log entries in real-time:
|
### To follow new log entries in real-time:
|
||||||
```
|
`journalctl -f`
|
||||||
journalctl -f
|
|
||||||
```
|
|
||||||
|
|
||||||
## 3. Filtering Logs
|
## 3. Filtering Logs
|
||||||
|
|
||||||
### By time:
|
### By time:
|
||||||
```
|
`journalctl --since "2024-01-01 00:00:00"`
|
||||||
journalctl --since "2024-01-01 00:00:00"
|
|
||||||
journalctl --until "2024-01-31 23:59:59"
|
`journalctl --until "2024-01-31 23:59:59"`
|
||||||
journalctl --since "1 hour ago"
|
|
||||||
```
|
`journalctl --since "1 hour ago"`
|
||||||
|
|
||||||
|
|
||||||
### By service unit:
|
### By service unit:
|
||||||
```
|
`journalctl -u nginx.service`
|
||||||
journalctl -u nginx.service
|
|
||||||
journalctl -u ssh.service
|
`journalctl -u ssh.service`
|
||||||
```
|
|
||||||
|
|
||||||
### By priority level:
|
### By priority level:
|
||||||
```
|
`journalctl -p err`
|
||||||
journalctl -p err
|
|
||||||
```
|
|
||||||
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
||||||
|
|
||||||
### By kernel messages:
|
### By kernel messages:
|
||||||
```
|
`journalctl -k`
|
||||||
journalctl -k
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Output Formatting
|
## 4. Output Formatting
|
||||||
|
|
||||||
### JSON output:
|
### JSON output:
|
||||||
```
|
`journalctl -o json`
|
||||||
journalctl -o json
|
|
||||||
```
|
|
||||||
|
|
||||||
### Short output format:
|
### Short output format:
|
||||||
```
|
`journalctl -o short`
|
||||||
journalctl -o short
|
|
||||||
```
|
|
||||||
|
|
||||||
### Verbose output:
|
### Verbose output:
|
||||||
```
|
`journalctl -o verbose`
|
||||||
journalctl -o verbose
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Boot-specific Logs
|
## 5. Boot-specific Logs
|
||||||
|
|
||||||
### Current boot:
|
### Current boot:
|
||||||
```
|
`journalctl -b`
|
||||||
journalctl -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Previous boot:
|
### Previous boot:
|
||||||
```
|
`journalctl -b -1`
|
||||||
journalctl -b -1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. User-specific Logs
|
## 6. User-specific Logs
|
||||||
|
|
||||||
```
|
`journalctl _UID=1000`
|
||||||
journalctl _UID=1000
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. Disk Usage and Log Rotation
|
## 7. Disk Usage and Log Rotation
|
||||||
|
|
||||||
### View disk usage:
|
### View disk usage:
|
||||||
```
|
`journalctl --disk-usage`
|
||||||
journalctl --disk-usage
|
|
||||||
```
|
|
||||||
|
|
||||||
### Rotate logs:
|
### Rotate logs:
|
||||||
```
|
`journalctl --rotate`
|
||||||
journalctl --rotate
|
|
||||||
```
|
|
||||||
|
|
||||||
### Vacuum old logs:
|
### Vacuum old logs:
|
||||||
```
|
`journalctl --vacuum-time=1week`
|
||||||
journalctl --vacuum-time=1week
|
|
||||||
journalctl --vacuum-size=1G
|
`journalctl --vacuum-size=1G`
|
||||||
```
|
|
||||||
|
|
||||||
## 8. Remote Journal Access
|
## 8. Remote Journal Access
|
||||||
|
|
||||||
To access logs on a remote system:
|
To access logs on a remote system:
|
||||||
```
|
`journalctl -D /path/to/journal/directory`
|
||||||
journalctl -D /path/to/journal/directory
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Persistent Journal Storage
|
## 9. Persistent Journal Storage
|
||||||
|
|
||||||
### Edit /etc/systemd/journald.conf:
|
### Edit /etc/systemd/journald.conf:
|
||||||
```
|
`Storage=persistent`
|
||||||
Storage=persistent
|
|
||||||
```
|
|
||||||
|
|
||||||
### Restart journald:
|
### Restart journald:
|
||||||
```
|
`sudo systemctl restart systemd-journald`
|
||||||
sudo systemctl restart systemd-journald
|
|
||||||
```
|
|
||||||
|
|
||||||
## 10. Forwarding Logs to a Central Server
|
## 10. Forwarding Logs to a Central Server
|
||||||
|
|
||||||
### Install rsyslog:
|
### Install rsyslog:
|
||||||
```
|
`sudo apt install rsyslog`
|
||||||
sudo apt install rsyslog
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configure /etc/rsyslog.conf for forwarding:
|
### Configure /etc/rsyslog.conf for forwarding:
|
||||||
```
|
`*.* @@central-log-server:514`
|
||||||
*.* @@central-log-server:514
|
|
||||||
```
|
|
||||||
|
|
||||||
### Restart rsyslog:
|
### Restart rsyslog:
|
||||||
```
|
`sudo systemctl restart rsyslog`
|
||||||
sudo systemctl restart rsyslog
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Security Considerations
|
## 11. Security Considerations
|
||||||
|
|
||||||
|
|||||||
@ -36,12 +36,3 @@
|
|||||||
- Regularly back up important files to an external location.
|
- Regularly back up important files to an external location.
|
||||||
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
||||||
|
|
||||||
Remember, a combination of these practices helps maintain a secure Linux Mint environment. Feel free to explore further or ask if you need additional guidance! 😊🔒🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) 10 practical tips for securing your Linux Mint system - FOSS Linux.](https://www.fosslinux.com/103872/secure-your-linux-mint-system.htm.)
|
|
||||||
- [(2) How to reset a forgotten password for any user under Linux Mint 21 ....](https://www.thinkpenguin.com/gnu-linux/how-reset-forgotten-password-any-user-under-linux-mint-21.)
|
|
||||||
- [(3) Linux Mint 20 [Essential Security Guide: Tools & Tweaks].](https://www.securitybind.com/secure-linux-mint/.)
|
|
||||||
- [(4) How to Configure Linux Mint Login Window: A Step-by-Step Guide.](https://bytebitebit.com/tips-tricks/how-to-configure-linux-mint-login-window/.)
|
|
||||||
- [(5) Changes to password policies – The Linux Mint Blog.](https://blog.linuxmint.com/?p=3013.)
|
|
||||||
- [(6) en.wikipedia.org.](https://en.wikipedia.org/wiki/Linux_Mint.)
|
|
||||||
@ -17,18 +17,14 @@ Key features:
|
|||||||
|
|
||||||
On most Linux distributions, eCryptfs can be installed using the package manager:
|
On most Linux distributions, eCryptfs can be installed using the package manager:
|
||||||
|
|
||||||
```bash
|
For Ubuntu/Debian:
|
||||||
# For Ubuntu/Debian:
|
`sudo apt-get install ecryptfs-utils`
|
||||||
sudo apt-get install ecryptfs-utils
|
|
||||||
```
|
For Fedora:
|
||||||
```bash
|
`sudo dnf install ecryptfs-utils`
|
||||||
# For Fedora:
|
|
||||||
sudo dnf install ecryptfs-utils
|
For Arch Linux:
|
||||||
```
|
`sudo pacman -S ecryptfs-utils`
|
||||||
```bash
|
|
||||||
# For Arch Linux:
|
|
||||||
sudo pacman -S ecryptfs-utils
|
|
||||||
```
|
|
||||||
|
|
||||||
## 3. Setting up eCryptfs
|
## 3. Setting up eCryptfs
|
||||||
|
|
||||||
@ -66,15 +62,11 @@ mount -t ecryptfs ~/encrypted ~/encrypted
|
|||||||
|
|
||||||
### - Unmounting:
|
### - Unmounting:
|
||||||
|
|
||||||
```bash
|
`umount ~/encrypted`
|
||||||
umount ~/encrypted
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Checking mount status:
|
### - Checking mount status:
|
||||||
|
|
||||||
```bash
|
`mount | grep ecryptfs`
|
||||||
mount | grep ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Key Management
|
## 5. Key Management
|
||||||
|
|
||||||
@ -82,15 +74,11 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
|||||||
|
|
||||||
### - Adding a key to the keyring:
|
### - Adding a key to the keyring:
|
||||||
|
|
||||||
```bash
|
`ecryptfs-add-passphrase`
|
||||||
ecryptfs-add-passphrase
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Removing a key from the keyring:
|
### - Removing a key from the keyring:
|
||||||
|
|
||||||
```bash
|
`keyctl purge user ecryptfs`
|
||||||
keyctl purge user ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Advanced Features
|
## 6. Advanced Features
|
||||||
|
|
||||||
@ -98,15 +86,11 @@ keyctl purge user ecryptfs
|
|||||||
|
|
||||||
Create a file containing your mount options:
|
Create a file containing your mount options:
|
||||||
|
|
||||||
```bash
|
`echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc`
|
||||||
echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc
|
|
||||||
```
|
|
||||||
|
|
||||||
Then mount using:
|
Then mount using:
|
||||||
|
|
||||||
```bash
|
`mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted`
|
||||||
mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Using different encryption for different directories:
|
### - Using different encryption for different directories:
|
||||||
|
|
||||||
@ -125,15 +109,11 @@ You can mount multiple eCryptfs directories with different encryption settings b
|
|||||||
|
|
||||||
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
||||||
|
|
||||||
```bash
|
`lsmod | grep ecryptfs`
|
||||||
lsmod | grep ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
If not present, load them:
|
If not present, load them:
|
||||||
|
|
||||||
```bash
|
`sudo modprobe ecryptfs`
|
||||||
sudo modprobe ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
||||||
|
|
||||||
|
|||||||
@ -16,36 +16,28 @@ OpenSSL is a robust, full-featured open-source toolkit that implements the Secur
|
|||||||
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
||||||
|
|
||||||
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
||||||
```bash
|
`sudo apt-get install openssl libssl-dev # For Debian/Ubuntu`
|
||||||
sudo apt-get install openssl libssl-dev # For Debian/Ubuntu
|
|
||||||
```
|
`sudo yum install openssl openssl-devel # For CentOS/RHEL`
|
||||||
```bash
|
|
||||||
sudo yum install openssl openssl-devel # For CentOS/RHEL
|
|
||||||
```
|
|
||||||
|
|
||||||
- macOS: Use Homebrew:
|
- macOS: Use Homebrew:
|
||||||
```
|
`brew install openssl`
|
||||||
brew install openssl
|
|
||||||
```
|
|
||||||
|
|
||||||
- Windows: Download the installer from the official OpenSSL website.
|
- Windows: Download the installer from the official OpenSSL website.
|
||||||
|
|
||||||
## 4. Basic OpenSSL Commands
|
## 4. Basic OpenSSL Commands
|
||||||
|
|
||||||
- Generate a private key:
|
- Generate a private key:
|
||||||
```bash
|
|
||||||
openssl genrsa -out private.key 2048
|
`openssl genrsa -out private.key 2048`
|
||||||
```
|
|
||||||
|
|
||||||
- Create a Certificate Signing Request (CSR):
|
- Create a Certificate Signing Request (CSR):
|
||||||
```bash
|
|
||||||
openssl req -new -key private.key -out certificate.csr
|
`openssl req -new -key private.key -out certificate.csr`
|
||||||
```
|
|
||||||
|
|
||||||
- Generate a self-signed certificate:
|
- Generate a self-signed certificate:
|
||||||
```bash
|
|
||||||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
|
`openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365`
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Implementing SSL/TLS in Network Applications
|
## 5. Implementing SSL/TLS in Network Applications
|
||||||
|
|
||||||
|
|||||||
@ -11,10 +11,7 @@ Fail2Ban is an intrusion prevention software framework that protects Linux syste
|
|||||||
- Updates firewall rules to block banned IPs
|
- Updates firewall rules to block banned IPs
|
||||||
|
|
||||||
### Installation:
|
### Installation:
|
||||||
```bash
|
`sudo apt-get update && sudo apt-get install fail2ban`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install fail2ban
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configuration:
|
### Configuration:
|
||||||
- Main configuration file: `/etc/fail2ban/jail.conf`
|
- Main configuration file: `/etc/fail2ban/jail.conf`
|
||||||
@ -56,10 +53,7 @@ AIDE is a file and directory integrity checker that detects unauthorized changes
|
|||||||
- Reports any discrepancies, indicating potential security breaches
|
- Reports any discrepancies, indicating potential security breaches
|
||||||
|
|
||||||
### Installation:
|
### Installation:
|
||||||
```bash
|
`sudo apt-get update && sudo apt-get install aide`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install aide
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configuration:
|
### Configuration:
|
||||||
- Main configuration file: /etc/aide/aide.conf
|
- Main configuration file: /etc/aide/aide.conf
|
||||||
|
|||||||
@ -18,17 +18,13 @@ SELinux operates in three modes:
|
|||||||
- Disabled: SELinux is turned off
|
- Disabled: SELinux is turned off
|
||||||
|
|
||||||
To check the current mode:
|
To check the current mode:
|
||||||
```
|
`getenforce`
|
||||||
getenforce
|
|
||||||
```
|
|
||||||
|
|
||||||
To change modes temporarily:
|
To change modes temporarily:
|
||||||
```bash
|
|
||||||
setenforce 0 # Set to permissive
|
`setenforce 0` # Set to permissive
|
||||||
```
|
|
||||||
```bash
|
`setenforce 1` # Set to enforcing
|
||||||
setenforce 1 # Set to enforcing
|
|
||||||
```
|
|
||||||
|
|
||||||
To change modes permanently, edit /etc/selinux/config and reboot.
|
To change modes permanently, edit /etc/selinux/config and reboot.
|
||||||
|
|
||||||
@ -43,10 +39,11 @@ system_u:object_r:httpd_sys_content_t:s0
|
|||||||
```
|
```
|
||||||
|
|
||||||
To view contexts:
|
To view contexts:
|
||||||
```
|
|
||||||
ls -Z # For files
|
`ls -Z` # For files
|
||||||
ps auxZ # For processes
|
|
||||||
```
|
`ps auxZ` # For processes
|
||||||
|
|
||||||
|
|
||||||
## 4. SELinux Policies
|
## 4. SELinux Policies
|
||||||
|
|
||||||
@ -59,84 +56,56 @@ SELinux uses policies to define allowed actions. Two main policy types:
|
|||||||
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
||||||
|
|
||||||
To list all booleans:
|
To list all booleans:
|
||||||
```
|
`getsebool -a`
|
||||||
getsebool -a
|
|
||||||
```
|
|
||||||
|
|
||||||
To change a boolean:
|
To change a boolean:
|
||||||
```bash
|
`setsebool httpd_can_network_connect on`
|
||||||
setsebool httpd_can_network_connect on
|
|
||||||
```
|
|
||||||
|
|
||||||
To make the change persistent:
|
To make the change persistent:
|
||||||
```bash
|
`setsebool -P httpd_can_network_connect on`
|
||||||
setsebool -P httpd_can_network_connect on
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Troubleshooting SELinux
|
## 6. Troubleshooting SELinux
|
||||||
|
|
||||||
- Check for denials:
|
- Check for denials:
|
||||||
```
|
`ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent`
|
||||||
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent
|
|
||||||
```
|
|
||||||
|
|
||||||
- Use SELinux troubleshooter:
|
- Use SELinux troubleshooter:
|
||||||
```
|
`sealert -a /var/log/audit/audit.log`
|
||||||
sealert -a /var/log/audit/audit.log
|
|
||||||
```
|
|
||||||
|
|
||||||
- Analyze SELinux logs:
|
- Analyze SELinux logs:
|
||||||
```
|
`grep "SELinux" /var/log/messages`
|
||||||
grep "SELinux" /var/log/messages
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. File and Directory Labeling
|
## 7. File and Directory Labeling
|
||||||
|
|
||||||
To change the SELinux context of a file or directory:
|
To change the SELinux context of a file or directory:
|
||||||
```
|
`chcon -t httpd_sys_content_t /path/to/file`
|
||||||
chcon -t httpd_sys_content_t /path/to/file
|
|
||||||
```
|
|
||||||
|
|
||||||
To restore the default context:
|
To restore the default context:
|
||||||
```
|
`restorecon -v /path/to/file`
|
||||||
restorecon -v /path/to/file
|
|
||||||
```
|
|
||||||
|
|
||||||
## 8. Managing SELinux Modules
|
## 8. Managing SELinux Modules
|
||||||
|
|
||||||
List available modules:
|
List available modules:
|
||||||
```
|
`semodule -l`
|
||||||
semodule -l
|
|
||||||
```
|
|
||||||
|
|
||||||
Enable a module:
|
Enable a module:
|
||||||
```
|
`semodule -e modulename`
|
||||||
semodule -e modulename
|
|
||||||
```
|
|
||||||
|
|
||||||
Disable a module:
|
Disable a module:
|
||||||
```
|
`semodule -d modulename`
|
||||||
semodule -d modulename
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Creating Custom SELinux Policies
|
## 9. Creating Custom SELinux Policies
|
||||||
|
|
||||||
For complex environments, you may need to create custom policies:
|
For complex environments, you may need to create custom policies:
|
||||||
|
|
||||||
- Install policy development tools:
|
- Install policy development tools:
|
||||||
```
|
`yum install selinux-policy-devel`
|
||||||
yum install selinux-policy-devel
|
|
||||||
```
|
|
||||||
|
|
||||||
- Write a policy module (.te file)
|
- Write a policy module (.te file)
|
||||||
- Compile and package the module:
|
- Compile and package the module:
|
||||||
```
|
`make -f /usr/share/selinux/devel/Makefile`
|
||||||
make -f /usr/share/selinux/devel/Makefile
|
|
||||||
```
|
|
||||||
- Install the module:
|
- Install the module:
|
||||||
```
|
`semodule -i mymodule.pp`
|
||||||
semodule -i mymodule.pp
|
|
||||||
```
|
|
||||||
|
|
||||||
## 10. SELinux and Containers
|
## 10. SELinux and Containers
|
||||||
|
|
||||||
@ -145,9 +114,7 @@ SELinux provides strong isolation for containers:
|
|||||||
- Prevents container processes from accessing host resources
|
- Prevents container processes from accessing host resources
|
||||||
|
|
||||||
To run a container with a specific SELinux context:
|
To run a container with a specific SELinux context:
|
||||||
```
|
`docker run --security-opt label=type:svirt_lxc_net_t my_image`
|
||||||
docker run --security-opt label=type:svirt_lxc_net_t my_image
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Best Practices
|
## 11. Best Practices
|
||||||
|
|
||||||
|
|||||||
@ -113,34 +113,22 @@ Basic steps:
|
|||||||
1. Install kubectl (Kubernetes command-line tool)
|
1. Install kubectl (Kubernetes command-line tool)
|
||||||
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
||||||
3. Deploy an application:
|
3. Deploy an application:
|
||||||
```
|
`kubectl create deployment my-app --image=my-app-image`
|
||||||
kubectl create deployment my-app --image=my-app-image
|
|
||||||
```
|
|
||||||
4. Expose the deployment:
|
4. Expose the deployment:
|
||||||
```
|
`kubectl expose deployment my-app --type=LoadBalancer --port=8080`
|
||||||
kubectl expose deployment my-app --type=LoadBalancer --port=8080
|
|
||||||
```
|
|
||||||
5. Scale the deployment:
|
5. Scale the deployment:
|
||||||
```
|
`kubectl scale deployment my-app --replicas=3`
|
||||||
kubectl scale deployment my-app --replicas=3
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Setting Up and Using Docker Swarm
|
## 6. Setting Up and Using Docker Swarm
|
||||||
|
|
||||||
Basic steps:
|
Basic steps:
|
||||||
1. Initialize a swarm:
|
1. Initialize a swarm:
|
||||||
```
|
`docker swarm init`
|
||||||
docker swarm init
|
|
||||||
```
|
|
||||||
2. Join worker nodes to the swarm
|
2. Join worker nodes to the swarm
|
||||||
3. Deploy a service:
|
3. Deploy a service:
|
||||||
```
|
`docker service create --name my-service my-image`
|
||||||
docker service create --name my-service my-image
|
|
||||||
```
|
|
||||||
4. Scale the service:
|
4. Scale the service:
|
||||||
```
|
`docker service scale my-service=3`
|
||||||
docker service scale my-service=3
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. Best Practices for Container Orchestration
|
## 7. Best Practices for Container Orchestration
|
||||||
|
|
||||||
|
|||||||
@ -30,9 +30,7 @@ c) QEMU for hardware emulation.
|
|||||||
|
|
||||||
On most Linux distributions, you can install KVM using the package manager:
|
On most Linux distributions, you can install KVM using the package manager:
|
||||||
|
|
||||||
```bash
|
`sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils`
|
||||||
sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Creating and Managing VMs
|
## 6. Creating and Managing VMs
|
||||||
|
|
||||||
|
|||||||
@ -13,17 +13,12 @@ LXC uses Linux kernel features such as cgroups, namespaces, and chroot to create
|
|||||||
## 3. Installation
|
## 3. Installation
|
||||||
To install LXC on most Linux distributions:
|
To install LXC on most Linux distributions:
|
||||||
|
|
||||||
```
|
`sudo apt-get update && sudo apt-get install lxc lxc-templates`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install lxc lxc-templates
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Creating containers
|
## 4. Creating containers
|
||||||
To create a new container:
|
To create a new container:
|
||||||
|
|
||||||
```
|
`sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64`
|
||||||
sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64
|
|
||||||
```
|
|
||||||
|
|
||||||
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
||||||
|
|
||||||
|
|||||||
@ -37,40 +37,28 @@ CMD ["python", "app.py"]
|
|||||||
|
|
||||||
To build an image from a Dockerfile:
|
To build an image from a Dockerfile:
|
||||||
|
|
||||||
```
|
`docker build -t myapp:v1 .`
|
||||||
docker build -t myapp:v1 .
|
|
||||||
```
|
|
||||||
|
|
||||||
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
||||||
|
|
||||||
## 4. Managing Docker Images
|
## 4. Managing Docker Images
|
||||||
|
|
||||||
List images:
|
List images:
|
||||||
```
|
`docker images`
|
||||||
docker images
|
|
||||||
```
|
|
||||||
|
|
||||||
Remove an image:
|
Remove an image:
|
||||||
```
|
`docker rmi myapp:v1`
|
||||||
docker rmi myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
Tag an image:
|
Tag an image:
|
||||||
```
|
`docker tag myapp:v1 myapp:latest`
|
||||||
docker tag myapp:v1 myapp:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Pushing and Pulling Images
|
## 5. Pushing and Pulling Images
|
||||||
|
|
||||||
Push an image to a registry:
|
Push an image to a registry:
|
||||||
```
|
`docker push username/myapp:v1`
|
||||||
docker push username/myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
Pull an image from a registry:
|
Pull an image from a registry:
|
||||||
```
|
`docker pull username/myapp:v1`
|
||||||
docker pull username/myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Multi-stage Builds
|
## 6. Multi-stage Builds
|
||||||
|
|
||||||
@ -101,14 +89,10 @@ CMD ["myapp"]
|
|||||||
## 8. Docker Image Inspection
|
## 8. Docker Image Inspection
|
||||||
|
|
||||||
Inspect image details:
|
Inspect image details:
|
||||||
```
|
`docker inspect myapp:v1`
|
||||||
docker inspect myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
View image history:
|
View image history:
|
||||||
```
|
`docker history myapp:v1`
|
||||||
docker history myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Optimizing Docker Images
|
## 9. Optimizing Docker Images
|
||||||
|
|
||||||
@ -125,17 +109,13 @@ docker history myapp:v1
|
|||||||
- Azure Container Registry (ACR)
|
- Azure Container Registry (ACR)
|
||||||
|
|
||||||
To use a private registry, log in first:
|
To use a private registry, log in first:
|
||||||
```
|
`docker login myregistry.azurecr.io`
|
||||||
docker login myregistry.azurecr.io
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Image Scanning and Security
|
## 11. Image Scanning and Security
|
||||||
|
|
||||||
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
||||||
|
|
||||||
```
|
`docker scan myapp:v1`
|
||||||
docker scan myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 12. Docker Image Versioning
|
## 12. Docker Image Versioning
|
||||||
|
|
||||||
@ -150,9 +130,6 @@ Always tag your images with a specific version and avoid using only the "latest"
|
|||||||
|
|
||||||
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
||||||
|
|
||||||
```
|
`hadolint Dockerfile`
|
||||||
hadolint Dockerfile
|
|
||||||
```
|
|
||||||
|
|
||||||
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
||||||
|
|
||||||
|
|||||||
@ -68,7 +68,7 @@ members of the project's leadership.
|
|||||||
|
|
||||||
## Attribution
|
## Attribution
|
||||||
|
|
||||||
This Code of Conduct is adapted from the [Contributor Covenant Home](hhttps://www.contributor-covenant.org/), version 1.4,
|
This Code of Conduct is adapted from the [Contributor Covenant Home](https://www.contributor-covenant.org/), version 1.4,
|
||||||
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
||||||
|
|
||||||
For answers to common questions about this code of conduct, see
|
For answers to common questions about this code of conduct, see
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user