Compare commits
13 Commits
a7c7e19eac
...
714f8f2362
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
714f8f2362 | ||
|
|
55f29d96ca | ||
|
|
1b8e2eb5b9 | ||
|
|
eb9228c564 | ||
|
|
ecced9e5bb | ||
|
|
57d07f1f13 | ||
|
|
ba75965206 | ||
|
|
dc581e66da | ||
|
|
e6be20afa9 | ||
|
|
9828da0ee7 | ||
|
|
65a620b912 | ||
|
|
82c0dcbbc1 | ||
|
|
e6f87ebb4d |
@ -1,6 +1,6 @@
|
|||||||
# Package Management with Yum (RHEL Based)
|
# Package Management with Yum (RHEL Based)
|
||||||
|
|
||||||
###1. Introduction to Yum
|
### 1. Introduction to Yum
|
||||||
|
|
||||||
Yum (Yellowdog Updater Modified) is the primary package management tool for Red Hat Enterprise Linux (RHEL) and its derivatives like CentOS and Fedora. It allows you to install, update, and remove software packages while automatically handling dependencies.
|
Yum (Yellowdog Updater Modified) is the primary package management tool for Red Hat Enterprise Linux (RHEL) and its derivatives like CentOS and Fedora. It allows you to install, update, and remove software packages while automatically handling dependencies.
|
||||||
|
|
||||||
|
|||||||
@ -1,27 +0,0 @@
|
|||||||
## In **Linux Mint**, package management is essential for installing, updating, and managing software. Let's explore some key tools and concepts:
|
|
||||||
|
|
||||||
1. **APT (Advanced Packaging Tool)**:
|
|
||||||
- APT is the primary package manager for Debian-based systems, including Linux Mint.
|
|
||||||
- It handles software installation, removal, querying, and upgrades.
|
|
||||||
- Common APT commands:
|
|
||||||
- `sudo apt update`: Refreshes package lists from repositories.
|
|
||||||
- `sudo apt install package-name`: Installs a package.
|
|
||||||
- `sudo apt remove package-name`: Removes a package.
|
|
||||||
- `sudo apt upgrade`: Upgrades installed packages.
|
|
||||||
- `sudo apt search keyword`: Searches for packages.
|
|
||||||
- APT uses `.deb` packages and works alongside `dpkg`, which installs individual `.deb` files.
|
|
||||||
|
|
||||||
2. **Synaptic Package Manager**:
|
|
||||||
- Synaptic is an advanced graphical package management tool.
|
|
||||||
- To install Synaptic:
|
|
||||||
```
|
|
||||||
sudo apt install synaptic
|
|
||||||
```
|
|
||||||
- Launch it from the Applications menu or by typing `synaptic` in the terminal.
|
|
||||||
|
|
||||||
Remember, APT and Synaptic empower you to manage software efficiently in Linux Mint! 😊🚀 ²³
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) How to Install and Update Apps on Linux Mint - UMA Technology.](https://umatechnology.org/how-to-install-and-update-apps-on-linux-mint/.)
|
|
||||||
- [(2) How to Use APT Command in Linux [15 Useful Examples] - UbuntuMint.](https://www.ubuntumint.com/apt-commands/.)
|
|
||||||
- [(3) Package Management Essentials: apt, yum, dnf, pkg.](https://www.digitalocean.com/community/tutorials/package-management-basics-apt-yum-dnf-pkg.)
|
|
||||||
@ -50,7 +50,7 @@ Linux follows a standardized directory structure:
|
|||||||
- /etc: System configuration files
|
- /etc: System configuration files
|
||||||
- /var: Variable data (logs, temporary files)
|
- /var: Variable data (logs, temporary files)
|
||||||
- /boot: Boot loader files
|
- /boot: Boot loader files
|
||||||
- /mnt and /media: Mount points for removable devices
|
- /mnt and /run/media: Mount points for removable devices
|
||||||
|
|
||||||
## 5. Common Disk Management Tools
|
## 5. Common Disk Management Tools
|
||||||
|
|
||||||
@ -60,8 +60,8 @@ Linux provides several tools for disk management:
|
|||||||
- fdisk: Partition table manipulator
|
- fdisk: Partition table manipulator
|
||||||
- parted: Versatile partition tool
|
- parted: Versatile partition tool
|
||||||
- lsblk: List block devices
|
- lsblk: List block devices
|
||||||
- df: Report file system disk space usage
|
- df: Report "disk free" in bytes. add "-h" option for human readable
|
||||||
- du: Estimate file space usage
|
- du: Estimate file space usage for current directory. Add "-h" option for human readable file sizes.
|
||||||
|
|
||||||
### b. Graphical tools:
|
### b. Graphical tools:
|
||||||
- GParted: GNOME Partition Editor
|
- GParted: GNOME Partition Editor
|
||||||
@ -72,6 +72,8 @@ Linux provides several tools for disk management:
|
|||||||
### a. Viewing disk information:
|
### a. Viewing disk information:
|
||||||
```
|
```
|
||||||
lsblk
|
lsblk
|
||||||
|
```
|
||||||
|
```
|
||||||
fdisk -l
|
fdisk -l
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -79,7 +81,7 @@ fdisk -l
|
|||||||
```
|
```
|
||||||
sudo fdisk /dev/sdX
|
sudo fdisk /dev/sdX
|
||||||
```
|
```
|
||||||
(Replace X with the appropriate letter)
|
(Replace X with the appropriate letter). Follow prompts inside fdisk to create new blank partition.
|
||||||
|
|
||||||
### c. Formatting a partition:
|
### c. Formatting a partition:
|
||||||
```
|
```
|
||||||
@ -109,7 +111,7 @@ LVM allows for more flexible disk management, including:
|
|||||||
- Creating snapshots
|
- Creating snapshots
|
||||||
|
|
||||||
### c. RAID (Redundant Array of Independent Disks):
|
### c. RAID (Redundant Array of Independent Disks):
|
||||||
Linux supports software RAID for improved performance and data redundancy.
|
Linux supports software RAID for improved performance and data redundancy in hardware and software formats.
|
||||||
|
|
||||||
### d. Encrypting partitions:
|
### d. Encrypting partitions:
|
||||||
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
Use LUKS (Linux Unified Key Setup) for full-disk encryption.
|
||||||
@ -127,10 +129,3 @@ d. Monitor disk health: Use tools like smartctl to check for potential drive fai
|
|||||||
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
e. Keep your system updated: Regular updates can improve disk management tools and fix bugs.
|
||||||
|
|
||||||
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
f. Be cautious with root privileges: Disk management often requires root access, so be careful to avoid accidental data loss.
|
||||||
|
|
||||||
|
|
||||||
- [(1) How to Install GParted on Linux Mint 21 - Linux Genie.](https://linuxgenie.net/how-to-install-gparted-on-linux-mint-21/.)
|
|
||||||
- [(2) Linux Mint View & Manage System Partitions: A Comprehensive Guide.](https://bytebitebit.com/tips-tricks/linux-mint-view-manage-system-partitions/.)
|
|
||||||
- [(3) Linux Mint View Manage System Partitions: A Comprehensive Guide.](https://www.positioniseverything.net/linux-mint-view-manage-system-partitions/.)
|
|
||||||
- [(4) Mastering Linux Disk Management: LVM and Disk Partitioning.](https://www.linuxjournal.com/content/mastering-linux-disk-management-lvm-and-disk-partitioning.)
|
|
||||||
- [(5) How to Use Fdisk to Manage Partitions on Linux - How-To Geek.](https://www.howtogeek.com/106873/how-to-use-fdisk-to-manage-partitions-on-linux/.)
|
|
||||||
|
|||||||
@ -1,39 +0,0 @@
|
|||||||
## Let's discuss **NTFS (New Technology File System)** and how to work with it in **Linux Mint**.
|
|
||||||
|
|
||||||
1. **Mounting NTFS Partitions**:
|
|
||||||
- NTFS is the default file system for Windows systems, but we can also mount NTFS partitions in Linux to read and write data.
|
|
||||||
- To mount an NTFS partition, follow these steps:
|
|
||||||
- First, create a mount point using the `mkdir` command:
|
|
||||||
```
|
|
||||||
sudo mkdir /mnt/ntfs
|
|
||||||
```
|
|
||||||
- Next, use the `mount` command to mount the partition you want (e.g., `/dev/sdb2`):
|
|
||||||
```
|
|
||||||
sudo mount -t ntfs-3g /dev/sdb2 /mnt/ntfs
|
|
||||||
```
|
|
||||||
- To check if the partition is mounted, run:
|
|
||||||
```
|
|
||||||
df -hT
|
|
||||||
```
|
|
||||||
- Now you have read/write permissions for the NTFS partition you mounted¹².
|
|
||||||
|
|
||||||
2. **Changing File Permissions on NTFS Partitions**:
|
|
||||||
- To apply Linux-compatible file permissions to an NTFS drive, modify the `/etc/fstab` file.
|
|
||||||
- Add the following line to `/etc/fstab`:
|
|
||||||
```
|
|
||||||
/dev/sdb /mnt/ntfs ntfs uid=1000,gid=1000,dmask=022,fmask=133 0 0
|
|
||||||
```
|
|
||||||
This line specifies that the `/dev/sdb` partition should be mounted as NTFS in the `/mnt/ntfs` directory.
|
|
||||||
- Remount the partition or reboot for the changes to take effect².
|
|
||||||
|
|
||||||
Feel free to explore further or ask if you need additional assistance! 😊🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) How to Mount NTFS Partition in Linux - phoenixNAP.](https://phoenixnap.com/kb/mount-ntfs-linux.)
|
|
||||||
- [(2) Changing File Permissions on NTFS Partitions in Linux.](https://linuxconfig.org/changing-file-permissions-on-ntfs-partitions-in-linux.)
|
|
||||||
- [(3) How to Mount and Access Windows NTFS Drives in Linux - MUO.](https://www.makeuseof.com/mount-ntfs-windows-drives-in-linux/.)
|
|
||||||
- [(4) How to Mount an NTFS Partition - Linux Nightly.](https://linuxnightly.com/mount-ntfs-partition/.)
|
|
||||||
- [(5) Linux mount ntfs or Access NTFS partition from Linux - nixCraft.](https://www.cyberciti.biz/faq/linux-mount-ntfs-or-access-ntfs-partition-from-linux/.)
|
|
||||||
- [(6) How to mount NTFS partitions using Linux commands.](https://www.computerworld.com/article/1637061/how-to-mount-ntfs-partitions-using-linux-commands.html.)
|
|
||||||
- [(7) NTFS Disk mounting in mint - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/358229/ntfs-disk-mounting-in-mint.)
|
|
||||||
- [(8) How to Mount NFS in Linux: A Step-by-Step Guide - Byte Bite Bit.](https://bytebitebit.com/operating-system/linux/how-to-mount-nfs-in-linux/.)
|
|
||||||
@ -143,11 +143,3 @@ This setup provides the redundancy of RAID 5 with the flexibility of LVM.
|
|||||||
- Display PV info: `sudo pvdisplay`
|
- Display PV info: `sudo pvdisplay`
|
||||||
- Display VG info: `sudo vgdisplay`
|
- Display VG info: `sudo vgdisplay`
|
||||||
- Display LV info: `sudo lvdisplay`
|
- Display LV info: `sudo lvdisplay`
|
||||||
|
|
||||||
Remember, LVM provides flexibility, scalability, and ease of maintenance, while RAID enhances performance and data protection! 😊🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) Complete Beginner's Guide to LVM in Linux [With Hands-on].](https://linuxhandbook.com/lvm-guide/.)
|
|
||||||
- [(2) Linux Storage Management: LVM and RAID.](https://linuxhall.org/linux-storage-management-lvm-and-raid/.)
|
|
||||||
- [(3) raid - RAIDing with LVM vs MDRAID - Unix & Linux Stack Exchange.](https://unix.stackexchange.com/questions/150644/raiding-with-lvm-vs-mdraid-pros-and-cons.)
|
|
||||||
- [(4) What is better LVM on RAID or RAID on LVM? - Server Fault.](https://serverfault.com/questions/217666/what-is-better-lvm-on-raid-or-raid-on-lvm.)
|
|
||||||
|
|||||||
@ -7,129 +7,94 @@ journalctl is a command-line utility for querying and displaying logs from the s
|
|||||||
## 2. Basic Usage
|
## 2. Basic Usage
|
||||||
|
|
||||||
### To view all logs:
|
### To view all logs:
|
||||||
```
|
`journalctl`
|
||||||
journalctl
|
|
||||||
```
|
|
||||||
|
|
||||||
### To follow new log entries in real-time:
|
### To follow new log entries in real-time:
|
||||||
```
|
`journalctl -f`
|
||||||
journalctl -f
|
|
||||||
```
|
|
||||||
|
|
||||||
## 3. Filtering Logs
|
## 3. Filtering Logs
|
||||||
|
|
||||||
### By time:
|
### By time:
|
||||||
```
|
`journalctl --since "2024-01-01 00:00:00"`
|
||||||
journalctl --since "2024-01-01 00:00:00"
|
|
||||||
journalctl --until "2024-01-31 23:59:59"
|
`journalctl --until "2024-01-31 23:59:59"`
|
||||||
journalctl --since "1 hour ago"
|
|
||||||
```
|
`journalctl --since "1 hour ago"`
|
||||||
|
|
||||||
|
|
||||||
### By service unit:
|
### By service unit:
|
||||||
```
|
`journalctl -u nginx.service`
|
||||||
journalctl -u nginx.service
|
|
||||||
journalctl -u ssh.service
|
`journalctl -u ssh.service`
|
||||||
```
|
|
||||||
|
|
||||||
### By priority level:
|
### By priority level:
|
||||||
```
|
`journalctl -p err`
|
||||||
journalctl -p err
|
|
||||||
```
|
|
||||||
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
Priority levels: emerg, alert, crit, err, warning, notice, info, debug
|
||||||
|
|
||||||
### By kernel messages:
|
### By kernel messages:
|
||||||
```
|
`journalctl -k`
|
||||||
journalctl -k
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Output Formatting
|
## 4. Output Formatting
|
||||||
|
|
||||||
### JSON output:
|
### JSON output:
|
||||||
```
|
`journalctl -o json`
|
||||||
journalctl -o json
|
|
||||||
```
|
|
||||||
|
|
||||||
### Short output format:
|
### Short output format:
|
||||||
```
|
`journalctl -o short`
|
||||||
journalctl -o short
|
|
||||||
```
|
|
||||||
|
|
||||||
### Verbose output:
|
### Verbose output:
|
||||||
```
|
`journalctl -o verbose`
|
||||||
journalctl -o verbose
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Boot-specific Logs
|
## 5. Boot-specific Logs
|
||||||
|
|
||||||
### Current boot:
|
### Current boot:
|
||||||
```
|
`journalctl -b`
|
||||||
journalctl -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Previous boot:
|
### Previous boot:
|
||||||
```
|
`journalctl -b -1`
|
||||||
journalctl -b -1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. User-specific Logs
|
## 6. User-specific Logs
|
||||||
|
|
||||||
```
|
`journalctl _UID=1000`
|
||||||
journalctl _UID=1000
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. Disk Usage and Log Rotation
|
## 7. Disk Usage and Log Rotation
|
||||||
|
|
||||||
### View disk usage:
|
### View disk usage:
|
||||||
```
|
`journalctl --disk-usage`
|
||||||
journalctl --disk-usage
|
|
||||||
```
|
|
||||||
|
|
||||||
### Rotate logs:
|
### Rotate logs:
|
||||||
```
|
`journalctl --rotate`
|
||||||
journalctl --rotate
|
|
||||||
```
|
|
||||||
|
|
||||||
### Vacuum old logs:
|
### Vacuum old logs:
|
||||||
```
|
`journalctl --vacuum-time=1week`
|
||||||
journalctl --vacuum-time=1week
|
|
||||||
journalctl --vacuum-size=1G
|
`journalctl --vacuum-size=1G`
|
||||||
```
|
|
||||||
|
|
||||||
## 8. Remote Journal Access
|
## 8. Remote Journal Access
|
||||||
|
|
||||||
To access logs on a remote system:
|
To access logs on a remote system:
|
||||||
```
|
`journalctl -D /path/to/journal/directory`
|
||||||
journalctl -D /path/to/journal/directory
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Persistent Journal Storage
|
## 9. Persistent Journal Storage
|
||||||
|
|
||||||
### Edit /etc/systemd/journald.conf:
|
### Edit /etc/systemd/journald.conf:
|
||||||
```
|
`Storage=persistent`
|
||||||
Storage=persistent
|
|
||||||
```
|
|
||||||
|
|
||||||
### Restart journald:
|
### Restart journald:
|
||||||
```
|
`sudo systemctl restart systemd-journald`
|
||||||
sudo systemctl restart systemd-journald
|
|
||||||
```
|
|
||||||
|
|
||||||
## 10. Forwarding Logs to a Central Server
|
## 10. Forwarding Logs to a Central Server
|
||||||
|
|
||||||
### Install rsyslog:
|
### Install rsyslog:
|
||||||
```
|
`sudo apt install rsyslog`
|
||||||
sudo apt install rsyslog
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configure /etc/rsyslog.conf for forwarding:
|
### Configure /etc/rsyslog.conf for forwarding:
|
||||||
```
|
`*.* @@central-log-server:514`
|
||||||
*.* @@central-log-server:514
|
|
||||||
```
|
|
||||||
|
|
||||||
### Restart rsyslog:
|
### Restart rsyslog:
|
||||||
```
|
`sudo systemctl restart rsyslog`
|
||||||
sudo systemctl restart rsyslog
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Security Considerations
|
## 11. Security Considerations
|
||||||
|
|
||||||
|
|||||||
@ -36,12 +36,3 @@
|
|||||||
- Regularly back up important files to an external location.
|
- Regularly back up important files to an external location.
|
||||||
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
- Use tools like **rsync**, **Deja Dup**, or cloud storage services¹.
|
||||||
|
|
||||||
Remember, a combination of these practices helps maintain a secure Linux Mint environment. Feel free to explore further or ask if you need additional guidance! 😊🔒🚀
|
|
||||||
|
|
||||||
Source: Conversation with Copilot, 7/12/2024
|
|
||||||
- [(1) 10 practical tips for securing your Linux Mint system - FOSS Linux.](https://www.fosslinux.com/103872/secure-your-linux-mint-system.htm.)
|
|
||||||
- [(2) How to reset a forgotten password for any user under Linux Mint 21 ....](https://www.thinkpenguin.com/gnu-linux/how-reset-forgotten-password-any-user-under-linux-mint-21.)
|
|
||||||
- [(3) Linux Mint 20 [Essential Security Guide: Tools & Tweaks].](https://www.securitybind.com/secure-linux-mint/.)
|
|
||||||
- [(4) How to Configure Linux Mint Login Window: A Step-by-Step Guide.](https://bytebitebit.com/tips-tricks/how-to-configure-linux-mint-login-window/.)
|
|
||||||
- [(5) Changes to password policies – The Linux Mint Blog.](https://blog.linuxmint.com/?p=3013.)
|
|
||||||
- [(6) en.wikipedia.org.](https://en.wikipedia.org/wiki/Linux_Mint.)
|
|
||||||
@ -17,18 +17,14 @@ Key features:
|
|||||||
|
|
||||||
On most Linux distributions, eCryptfs can be installed using the package manager:
|
On most Linux distributions, eCryptfs can be installed using the package manager:
|
||||||
|
|
||||||
```bash
|
For Ubuntu/Debian:
|
||||||
# For Ubuntu/Debian:
|
`sudo apt-get install ecryptfs-utils`
|
||||||
sudo apt-get install ecryptfs-utils
|
|
||||||
```
|
For Fedora:
|
||||||
```bash
|
`sudo dnf install ecryptfs-utils`
|
||||||
# For Fedora:
|
|
||||||
sudo dnf install ecryptfs-utils
|
For Arch Linux:
|
||||||
```
|
`sudo pacman -S ecryptfs-utils`
|
||||||
```bash
|
|
||||||
# For Arch Linux:
|
|
||||||
sudo pacman -S ecryptfs-utils
|
|
||||||
```
|
|
||||||
|
|
||||||
## 3. Setting up eCryptfs
|
## 3. Setting up eCryptfs
|
||||||
|
|
||||||
@ -66,15 +62,11 @@ mount -t ecryptfs ~/encrypted ~/encrypted
|
|||||||
|
|
||||||
### - Unmounting:
|
### - Unmounting:
|
||||||
|
|
||||||
```bash
|
`umount ~/encrypted`
|
||||||
umount ~/encrypted
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Checking mount status:
|
### - Checking mount status:
|
||||||
|
|
||||||
```bash
|
`mount | grep ecryptfs`
|
||||||
mount | grep ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Key Management
|
## 5. Key Management
|
||||||
|
|
||||||
@ -82,15 +74,11 @@ eCryptfs uses a passphrase to derive the encryption key. This passphrase is stor
|
|||||||
|
|
||||||
### - Adding a key to the keyring:
|
### - Adding a key to the keyring:
|
||||||
|
|
||||||
```bash
|
`ecryptfs-add-passphrase`
|
||||||
ecryptfs-add-passphrase
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Removing a key from the keyring:
|
### - Removing a key from the keyring:
|
||||||
|
|
||||||
```bash
|
`keyctl purge user ecryptfs`
|
||||||
keyctl purge user ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Advanced Features
|
## 6. Advanced Features
|
||||||
|
|
||||||
@ -98,15 +86,11 @@ keyctl purge user ecryptfs
|
|||||||
|
|
||||||
Create a file containing your mount options:
|
Create a file containing your mount options:
|
||||||
|
|
||||||
```bash
|
`echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc`
|
||||||
echo "passphrase_passwd=your_passphrase" > ~/.ecryptfsrc
|
|
||||||
```
|
|
||||||
|
|
||||||
Then mount using:
|
Then mount using:
|
||||||
|
|
||||||
```bash
|
`mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted`
|
||||||
mount -t ecryptfs -o conf=~/.ecryptfsrc ~/encrypted ~/encrypted
|
|
||||||
```
|
|
||||||
|
|
||||||
### - Using different encryption for different directories:
|
### - Using different encryption for different directories:
|
||||||
|
|
||||||
@ -125,15 +109,11 @@ You can mount multiple eCryptfs directories with different encryption settings b
|
|||||||
|
|
||||||
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
If you can't mount the filesystem, check if the required kernel modules are loaded:
|
||||||
|
|
||||||
```bash
|
`lsmod | grep ecryptfs`
|
||||||
lsmod | grep ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
If not present, load them:
|
If not present, load them:
|
||||||
|
|
||||||
```bash
|
`sudo modprobe ecryptfs`
|
||||||
sudo modprobe ecryptfs
|
|
||||||
```
|
|
||||||
|
|
||||||
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
## !!!If you forget your passphrase, there's no way to recover the data. Always keep secure backups!!!
|
||||||
|
|
||||||
|
|||||||
@ -16,36 +16,28 @@ OpenSSL is a robust, full-featured open-source toolkit that implements the Secur
|
|||||||
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
OpenSSL is available for various operating systems. Here are basic installation instructions:
|
||||||
|
|
||||||
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
- Linux: Most distributions come with OpenSSL pre-installed. If not, use package managers:
|
||||||
```bash
|
`sudo apt-get install openssl libssl-dev # For Debian/Ubuntu`
|
||||||
sudo apt-get install openssl libssl-dev # For Debian/Ubuntu
|
|
||||||
```
|
`sudo yum install openssl openssl-devel # For CentOS/RHEL`
|
||||||
```bash
|
|
||||||
sudo yum install openssl openssl-devel # For CentOS/RHEL
|
|
||||||
```
|
|
||||||
|
|
||||||
- macOS: Use Homebrew:
|
- macOS: Use Homebrew:
|
||||||
```
|
`brew install openssl`
|
||||||
brew install openssl
|
|
||||||
```
|
|
||||||
|
|
||||||
- Windows: Download the installer from the official OpenSSL website.
|
- Windows: Download the installer from the official OpenSSL website.
|
||||||
|
|
||||||
## 4. Basic OpenSSL Commands
|
## 4. Basic OpenSSL Commands
|
||||||
|
|
||||||
- Generate a private key:
|
- Generate a private key:
|
||||||
```bash
|
|
||||||
openssl genrsa -out private.key 2048
|
`openssl genrsa -out private.key 2048`
|
||||||
```
|
|
||||||
|
|
||||||
- Create a Certificate Signing Request (CSR):
|
- Create a Certificate Signing Request (CSR):
|
||||||
```bash
|
|
||||||
openssl req -new -key private.key -out certificate.csr
|
`openssl req -new -key private.key -out certificate.csr`
|
||||||
```
|
|
||||||
|
|
||||||
- Generate a self-signed certificate:
|
- Generate a self-signed certificate:
|
||||||
```bash
|
|
||||||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
|
`openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365`
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Implementing SSL/TLS in Network Applications
|
## 5. Implementing SSL/TLS in Network Applications
|
||||||
|
|
||||||
|
|||||||
@ -11,10 +11,7 @@ Fail2Ban is an intrusion prevention software framework that protects Linux syste
|
|||||||
- Updates firewall rules to block banned IPs
|
- Updates firewall rules to block banned IPs
|
||||||
|
|
||||||
### Installation:
|
### Installation:
|
||||||
```bash
|
`sudo apt-get update && sudo apt-get install fail2ban`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install fail2ban
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configuration:
|
### Configuration:
|
||||||
- Main configuration file: `/etc/fail2ban/jail.conf`
|
- Main configuration file: `/etc/fail2ban/jail.conf`
|
||||||
@ -56,10 +53,7 @@ AIDE is a file and directory integrity checker that detects unauthorized changes
|
|||||||
- Reports any discrepancies, indicating potential security breaches
|
- Reports any discrepancies, indicating potential security breaches
|
||||||
|
|
||||||
### Installation:
|
### Installation:
|
||||||
```bash
|
`sudo apt-get update && sudo apt-get install aide`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install aide
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configuration:
|
### Configuration:
|
||||||
- Main configuration file: /etc/aide/aide.conf
|
- Main configuration file: /etc/aide/aide.conf
|
||||||
|
|||||||
@ -18,17 +18,13 @@ SELinux operates in three modes:
|
|||||||
- Disabled: SELinux is turned off
|
- Disabled: SELinux is turned off
|
||||||
|
|
||||||
To check the current mode:
|
To check the current mode:
|
||||||
```
|
`getenforce`
|
||||||
getenforce
|
|
||||||
```
|
|
||||||
|
|
||||||
To change modes temporarily:
|
To change modes temporarily:
|
||||||
```bash
|
|
||||||
setenforce 0 # Set to permissive
|
`setenforce 0` # Set to permissive
|
||||||
```
|
|
||||||
```bash
|
`setenforce 1` # Set to enforcing
|
||||||
setenforce 1 # Set to enforcing
|
|
||||||
```
|
|
||||||
|
|
||||||
To change modes permanently, edit /etc/selinux/config and reboot.
|
To change modes permanently, edit /etc/selinux/config and reboot.
|
||||||
|
|
||||||
@ -43,10 +39,11 @@ system_u:object_r:httpd_sys_content_t:s0
|
|||||||
```
|
```
|
||||||
|
|
||||||
To view contexts:
|
To view contexts:
|
||||||
```
|
|
||||||
ls -Z # For files
|
`ls -Z` # For files
|
||||||
ps auxZ # For processes
|
|
||||||
```
|
`ps auxZ` # For processes
|
||||||
|
|
||||||
|
|
||||||
## 4. SELinux Policies
|
## 4. SELinux Policies
|
||||||
|
|
||||||
@ -59,84 +56,56 @@ SELinux uses policies to define allowed actions. Two main policy types:
|
|||||||
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
Booleans are on/off switches that allow runtime customization of SELinux policies.
|
||||||
|
|
||||||
To list all booleans:
|
To list all booleans:
|
||||||
```
|
`getsebool -a`
|
||||||
getsebool -a
|
|
||||||
```
|
|
||||||
|
|
||||||
To change a boolean:
|
To change a boolean:
|
||||||
```bash
|
`setsebool httpd_can_network_connect on`
|
||||||
setsebool httpd_can_network_connect on
|
|
||||||
```
|
|
||||||
|
|
||||||
To make the change persistent:
|
To make the change persistent:
|
||||||
```bash
|
`setsebool -P httpd_can_network_connect on`
|
||||||
setsebool -P httpd_can_network_connect on
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Troubleshooting SELinux
|
## 6. Troubleshooting SELinux
|
||||||
|
|
||||||
- Check for denials:
|
- Check for denials:
|
||||||
```
|
`ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent`
|
||||||
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent
|
|
||||||
```
|
|
||||||
|
|
||||||
- Use SELinux troubleshooter:
|
- Use SELinux troubleshooter:
|
||||||
```
|
`sealert -a /var/log/audit/audit.log`
|
||||||
sealert -a /var/log/audit/audit.log
|
|
||||||
```
|
|
||||||
|
|
||||||
- Analyze SELinux logs:
|
- Analyze SELinux logs:
|
||||||
```
|
`grep "SELinux" /var/log/messages`
|
||||||
grep "SELinux" /var/log/messages
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. File and Directory Labeling
|
## 7. File and Directory Labeling
|
||||||
|
|
||||||
To change the SELinux context of a file or directory:
|
To change the SELinux context of a file or directory:
|
||||||
```
|
`chcon -t httpd_sys_content_t /path/to/file`
|
||||||
chcon -t httpd_sys_content_t /path/to/file
|
|
||||||
```
|
|
||||||
|
|
||||||
To restore the default context:
|
To restore the default context:
|
||||||
```
|
`restorecon -v /path/to/file`
|
||||||
restorecon -v /path/to/file
|
|
||||||
```
|
|
||||||
|
|
||||||
## 8. Managing SELinux Modules
|
## 8. Managing SELinux Modules
|
||||||
|
|
||||||
List available modules:
|
List available modules:
|
||||||
```
|
`semodule -l`
|
||||||
semodule -l
|
|
||||||
```
|
|
||||||
|
|
||||||
Enable a module:
|
Enable a module:
|
||||||
```
|
`semodule -e modulename`
|
||||||
semodule -e modulename
|
|
||||||
```
|
|
||||||
|
|
||||||
Disable a module:
|
Disable a module:
|
||||||
```
|
`semodule -d modulename`
|
||||||
semodule -d modulename
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Creating Custom SELinux Policies
|
## 9. Creating Custom SELinux Policies
|
||||||
|
|
||||||
For complex environments, you may need to create custom policies:
|
For complex environments, you may need to create custom policies:
|
||||||
|
|
||||||
- Install policy development tools:
|
- Install policy development tools:
|
||||||
```
|
`yum install selinux-policy-devel`
|
||||||
yum install selinux-policy-devel
|
|
||||||
```
|
|
||||||
|
|
||||||
- Write a policy module (.te file)
|
- Write a policy module (.te file)
|
||||||
- Compile and package the module:
|
- Compile and package the module:
|
||||||
```
|
`make -f /usr/share/selinux/devel/Makefile`
|
||||||
make -f /usr/share/selinux/devel/Makefile
|
|
||||||
```
|
|
||||||
- Install the module:
|
- Install the module:
|
||||||
```
|
`semodule -i mymodule.pp`
|
||||||
semodule -i mymodule.pp
|
|
||||||
```
|
|
||||||
|
|
||||||
## 10. SELinux and Containers
|
## 10. SELinux and Containers
|
||||||
|
|
||||||
@ -145,9 +114,7 @@ SELinux provides strong isolation for containers:
|
|||||||
- Prevents container processes from accessing host resources
|
- Prevents container processes from accessing host resources
|
||||||
|
|
||||||
To run a container with a specific SELinux context:
|
To run a container with a specific SELinux context:
|
||||||
```
|
`docker run --security-opt label=type:svirt_lxc_net_t my_image`
|
||||||
docker run --security-opt label=type:svirt_lxc_net_t my_image
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Best Practices
|
## 11. Best Practices
|
||||||
|
|
||||||
|
|||||||
@ -113,34 +113,22 @@ Basic steps:
|
|||||||
1. Install kubectl (Kubernetes command-line tool)
|
1. Install kubectl (Kubernetes command-line tool)
|
||||||
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
2. Set up a Kubernetes cluster (e.g., using Minikube for local development)
|
||||||
3. Deploy an application:
|
3. Deploy an application:
|
||||||
```
|
`kubectl create deployment my-app --image=my-app-image`
|
||||||
kubectl create deployment my-app --image=my-app-image
|
|
||||||
```
|
|
||||||
4. Expose the deployment:
|
4. Expose the deployment:
|
||||||
```
|
`kubectl expose deployment my-app --type=LoadBalancer --port=8080`
|
||||||
kubectl expose deployment my-app --type=LoadBalancer --port=8080
|
|
||||||
```
|
|
||||||
5. Scale the deployment:
|
5. Scale the deployment:
|
||||||
```
|
`kubectl scale deployment my-app --replicas=3`
|
||||||
kubectl scale deployment my-app --replicas=3
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Setting Up and Using Docker Swarm
|
## 6. Setting Up and Using Docker Swarm
|
||||||
|
|
||||||
Basic steps:
|
Basic steps:
|
||||||
1. Initialize a swarm:
|
1. Initialize a swarm:
|
||||||
```
|
`docker swarm init`
|
||||||
docker swarm init
|
|
||||||
```
|
|
||||||
2. Join worker nodes to the swarm
|
2. Join worker nodes to the swarm
|
||||||
3. Deploy a service:
|
3. Deploy a service:
|
||||||
```
|
`docker service create --name my-service my-image`
|
||||||
docker service create --name my-service my-image
|
|
||||||
```
|
|
||||||
4. Scale the service:
|
4. Scale the service:
|
||||||
```
|
`docker service scale my-service=3`
|
||||||
docker service scale my-service=3
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. Best Practices for Container Orchestration
|
## 7. Best Practices for Container Orchestration
|
||||||
|
|
||||||
|
|||||||
@ -30,9 +30,7 @@ c) QEMU for hardware emulation.
|
|||||||
|
|
||||||
On most Linux distributions, you can install KVM using the package manager:
|
On most Linux distributions, you can install KVM using the package manager:
|
||||||
|
|
||||||
```bash
|
`sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils`
|
||||||
sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Creating and Managing VMs
|
## 6. Creating and Managing VMs
|
||||||
|
|
||||||
|
|||||||
@ -13,17 +13,12 @@ LXC uses Linux kernel features such as cgroups, namespaces, and chroot to create
|
|||||||
## 3. Installation
|
## 3. Installation
|
||||||
To install LXC on most Linux distributions:
|
To install LXC on most Linux distributions:
|
||||||
|
|
||||||
```
|
`sudo apt-get update && sudo apt-get install lxc lxc-templates`
|
||||||
sudo apt-get update
|
|
||||||
sudo apt-get install lxc lxc-templates
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Creating containers
|
## 4. Creating containers
|
||||||
To create a new container:
|
To create a new container:
|
||||||
|
|
||||||
```
|
`sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64`
|
||||||
sudo lxc-create -n mycontainer -t download -- -d ubuntu -r focal -a amd64
|
|
||||||
```
|
|
||||||
|
|
||||||
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
This creates a container named "mycontainer" using the Ubuntu Focal (20.04) template for amd64 architecture.
|
||||||
|
|
||||||
@ -62,9 +57,9 @@ LXC supports multiple storage backends:
|
|||||||
- Use AppArmor or SELinux profiles
|
- Use AppArmor or SELinux profiles
|
||||||
|
|
||||||
## 10. Advanced features
|
## 10. Advanced features
|
||||||
- Snapshots: Create point-in-time copies of containers
|
- Snapshots: Create point-in-time copies of containers
|
||||||
- Live migration: Move running containers between hosts
|
- Live migration: Move running containers between hosts
|
||||||
- Nesting: Run LXC containers inside other LXC containers
|
- Nesting: Run LXC containers inside other LXC containers
|
||||||
|
|
||||||
## 11. LXC vs. Docker
|
## 11. LXC vs. Docker
|
||||||
While both use Linux containerization, they have different focuses:
|
While both use Linux containerization, they have different focuses:
|
||||||
|
|||||||
@ -37,40 +37,28 @@ CMD ["python", "app.py"]
|
|||||||
|
|
||||||
To build an image from a Dockerfile:
|
To build an image from a Dockerfile:
|
||||||
|
|
||||||
```
|
`docker build -t myapp:v1 .`
|
||||||
docker build -t myapp:v1 .
|
|
||||||
```
|
|
||||||
|
|
||||||
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
This command builds an image named "myapp" with the tag "v1" using the Dockerfile in the current directory.
|
||||||
|
|
||||||
## 4. Managing Docker Images
|
## 4. Managing Docker Images
|
||||||
|
|
||||||
List images:
|
List images:
|
||||||
```
|
`docker images`
|
||||||
docker images
|
|
||||||
```
|
|
||||||
|
|
||||||
Remove an image:
|
Remove an image:
|
||||||
```
|
`docker rmi myapp:v1`
|
||||||
docker rmi myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
Tag an image:
|
Tag an image:
|
||||||
```
|
`docker tag myapp:v1 myapp:latest`
|
||||||
docker tag myapp:v1 myapp:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Pushing and Pulling Images
|
## 5. Pushing and Pulling Images
|
||||||
|
|
||||||
Push an image to a registry:
|
Push an image to a registry:
|
||||||
```
|
`docker push username/myapp:v1`
|
||||||
docker push username/myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
Pull an image from a registry:
|
Pull an image from a registry:
|
||||||
```
|
`docker pull username/myapp:v1`
|
||||||
docker pull username/myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Multi-stage Builds
|
## 6. Multi-stage Builds
|
||||||
|
|
||||||
@ -101,14 +89,10 @@ CMD ["myapp"]
|
|||||||
## 8. Docker Image Inspection
|
## 8. Docker Image Inspection
|
||||||
|
|
||||||
Inspect image details:
|
Inspect image details:
|
||||||
```
|
`docker inspect myapp:v1`
|
||||||
docker inspect myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
View image history:
|
View image history:
|
||||||
```
|
`docker history myapp:v1`
|
||||||
docker history myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Optimizing Docker Images
|
## 9. Optimizing Docker Images
|
||||||
|
|
||||||
@ -125,17 +109,13 @@ docker history myapp:v1
|
|||||||
- Azure Container Registry (ACR)
|
- Azure Container Registry (ACR)
|
||||||
|
|
||||||
To use a private registry, log in first:
|
To use a private registry, log in first:
|
||||||
```
|
`docker login myregistry.azurecr.io`
|
||||||
docker login myregistry.azurecr.io
|
|
||||||
```
|
|
||||||
|
|
||||||
## 11. Image Scanning and Security
|
## 11. Image Scanning and Security
|
||||||
|
|
||||||
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
Use tools like Docker Scan, Clair, or Trivy to scan images for vulnerabilities:
|
||||||
|
|
||||||
```
|
`docker scan myapp:v1`
|
||||||
docker scan myapp:v1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 12. Docker Image Versioning
|
## 12. Docker Image Versioning
|
||||||
|
|
||||||
@ -150,9 +130,6 @@ Always tag your images with a specific version and avoid using only the "latest"
|
|||||||
|
|
||||||
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
Use tools like Hadolint to check your Dockerfile for best practices and potential issues:
|
||||||
|
|
||||||
```
|
`hadolint Dockerfile`
|
||||||
hadolint Dockerfile
|
|
||||||
```
|
|
||||||
|
|
||||||
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
|
||||||
|
|
||||||
|
This guide covers the essentials of working with Dockerfiles and images. As you become more comfortable with these concepts, you can explore advanced topics like Docker Compose for multi-container applications and Docker Swarm or Kubernetes for container orchestration.
|
||||||
@ -68,7 +68,7 @@ members of the project's leadership.
|
|||||||
|
|
||||||
## Attribution
|
## Attribution
|
||||||
|
|
||||||
This Code of Conduct is adapted from the [Contributor Covenant Home](hhttps://www.contributor-covenant.org/), version 1.4,
|
This Code of Conduct is adapted from the [Contributor Covenant Home](https://www.contributor-covenant.org/), version 1.4,
|
||||||
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
available at [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
|
||||||
|
|
||||||
For answers to common questions about this code of conduct, see
|
For answers to common questions about this code of conduct, see
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user