RH134
文章目录
1. ks
anaconda-ks.cfg
install method
ID | site | type |
---|---|---|
1 | local | cdrom, hard |
2 | remote | http, ftp, nfs |
bootloader
ID | soft |
---|---|
1 | grub2 |
2 | grub |
3 | lilo |
zerombr
# dd if=/dev/zero of=/dev/vda bs=446 count=1
part
ID | type | comments |
---|---|---|
1 | / | must |
2 | /boot | kernel |
3 | swap | performance |
script
%post
useradd tom
echo ttt | passwd --stdin tom
%end
packages
%packages
@core
chrony
-NetworkManager
%end
system-config-kickstart
[foundation0]
# yum -y install system-config-kickstart
# system-config-kickstart --generate ks-gen.cfg
# system-config-kickstart /root/anaconda-ks.cfg
Topology
ID | host | role | s1 | s2 | file | s3 | ks |
---|---|---|---|---|---|---|---|
1 | classroom | server | dhcp | tftp | syslinux | http+cdrom | ks.cfg |
2 | desktop | client | ip | img |
[foundation0]
$ scp ~kiosk/Desktop/ks.cfg root@c:/var/www/html/pub
$ ssh root@c 'chmod o+r /var/www/html/pub/ks.cfg'
$ ssh root@c 'ls -l /var/www/html/pub/ks.cfg'
$ rht-vmctl view desktop
[desktop0]
Restart
Esc, 4
Select Install Red Hat Enterprise 7.0
Tab, Spaceks=http://c/pub/ks.cfgEnter
note:
# ssh root@c 'ls /var/lib/tftpboot/pxelinux.cfg/default'
2. grep
# cat /etc/fstab
# grep UUID /etc/fstab
-n
# grep -n UUID /etc/fstab
# grep -n UUID /etc/fstab | grep xfs
.*
# grep UUID.*xfs /etc/fstab
-i
# grep -i uuid /etc/fstab
-r
# grep -r BOOTPRO /usr/share/doc/
-A, -B, -C
# ip a s eth0
# ip a s eth0 | grep 'inet '
# ip a s eth0 | grep -A 1 'inet '
# ip a s eth0 | grep -B 1 'inet '
# ip a s eth0 | grep -C 1 'inet '
# lspci
# lspci -vv
# lspci -vv | grep Ether
# lspci -vv | grep -A 10 Ether
^, $
# grep ^$ /etc/fstab
# cat /etc/selinux/config | tee file | grep -v ^$ | grep -v \#
expression
# grep ^root /etc/passwd; grep tom /etc/passwd
# grep -e ^root -e tom /etc/passwd
# grep -E '^root|tom' /etc/passwd
# egrep '^root|tom' /etc/passwd
3. vim
pkg
# yum list vim-common vim-enhanced vim-minimal
config
# ls /etc/vimrc ~/.vimrc
# echo set number >> ~/.vimrc
# vim /etc/selinux/config
history
# vim ~/.viminfo
# vim
:help
:help I
O
I12i3a45A
o
delete | yank | paste | |
---|---|---|---|
c | x | vy | P,p |
w | dw | yw | |
l | dd | yy | |
m | 3dd | 3yy | 10p |
^ | d^ | y^ | |
$ | d$ | y$ | |
gg | dgg | ||
G | dG |
# vim
:help usr_08.txt
:split
:split /etc/fstab
:vsplit
Ctrl+w, h|j|k|l
ID | key | |
---|---|---|
1 | v, hjkl | visual |
2 | Ctrl+v, j, I, #Space, Esc | 多行注释 |
3 | Ctrl+v, j, x | 多行注释删除 |
4 | R | 连续替换 |
5 | w | 光标跳到前一个单词 |
6 | b | 光标跳到后一个单词 |
7 | q: | 查询末行模式历史 |
lastline
# vim
:set
:set number
:set nonumber
:set sw=4 ts=4
:syntax off
:syntax on
:nohl
:w path/file
:e /etc/fstab
:e!
:x
:s/#/$
:s/#/$/g
:3,5s/#/$/g
:3,$s/#/$/g
:3,$s/#/$/gc
:!command
:r /etc/selinux/config
:r!grep ^SELINUX= /etc/selinux/config
4. cron
at
# systemctl status atd
# at now +1 min
mkdir /folder
touch /folder/$(date +%H%M).txt
<Ctrl+D>
# date
# atq
# ls -ld /folder/{.,*}
# echo "mkdir wjj && touch wjj/wj.txt" | at now +5 min
# atq
# date
# ls /var/spool/at/a00002018ad51e
# tail /var/spool/at/a00002018ad51e
# atrm 2
# atq
cron
# systemctl status crond
- file=root
# ls -l /etc/crontab
# vim /etc/crontab
...
30 14 * * * tom echo haha
- cmd=user
# man 5 crontab
# crontab -e
40 14 * * * echo hehe
1 */1 * * * echo xia ke over
# crontab -l
# ls /var/spool/cron/root
# tail /var/spool/cron/root
# su - student
$ crontab -e
1 */1 * * * echo xia ke
$ crontab -l
$ <Ctrl+D>
# crontab -l -u student
cron.deny
# echo student >> /etc/cron.deny
# su - student -c 'crontab -e'
5. nice
renice
# ps ef
# ps efo pid,nice,command
# dd if=/dev/zero of=/dev/null bs=1K &
# ps efo pid,nice,command
# renice -n 19 31763
# ps efo pid,nice,command
# renice -n -20 8891
# ps efo pid,nice,command
# renice -n 10 31763
# ps efo pid,nice,command
# kill -9 31763
nice
# nice -n 19 dd if=/dev/zero of=/dev/null bs=2K &
# ps efo pid,nice,command
# killall dd
6. facl
getfacl
# ls -ld /folder
# getfacl /folder
# setfacl -m u:tom:rwx /folder
# ls -ld /folder
# getfacl /folder
setfacl
-m
# getfacl /folder/
# chmod o=rwx /folder/
# getfacl /folder/
# setfacl -m o::rx /folder/
# getfacl /folder/
# setfacl -m u:tom:rx,g:tom:x,o::- /folder/
# getfacl /folder/
-x
# setfacl -x u:tom /folder/
# getfacl /folder/
-b
# setfacl -b /folder/
# getfacl /folder/
-d, d: (default=future)
# getfacl /folder/
# setfacl -m u:tom:rwx /folder/
# getfacl /folder/
# mkdir /folder/wjj
# getfacl /folder/wjj
# setfacl -m d:u:tom:rwx /folder
# getfacl /folder
# mkdir /folder/wjj.new
# ls -l /folder/
# getfacl /folder/wjj.new/
# setfacl -d -m g:tom:rwx /folder
# getfacl /folder
# mkdir /folder/wjj.group
# getfacl /folder/wjj.new/
# setfacl -R -m u:tom:rwx,g:tom:rwx /folder/
# getfacl /folder/*
mask
# getfacl /folder/
# setfacl -m m::rx /folder/
# getfacl /folder/
# setfacl -m u:student:rwx /folder/
# getfacl /folder/
7. selinux
ID | type | selinux | |
---|---|---|---|
1 | filesystem | chmod, chown, setfacl | semanage fcontext … |
2 | service | vim /etc/*.conf | setsebool -P … |
3 | firewall | firewall-cmd | semanage port … |
4 | selinux | 1+2+3 | vim /etc/selinux/config |
config
# ps auxZ
# ps auxZ | head -n 2
# vim /etc/selinux/config
...
SELINUX=permissive
# getenforce
# setenforce
# setenforce 0
# getenforce
# vim /etc/selinux/config
...
SELINUX=enforcing
# getenforce
# setenforce 1
# getenforce
OPERATION:
/per, yw, /=, p, D, ZZ
fcontext
[classroom]
# ls -Z /var/www/html/pub/ .
# echo hello > index.html
# ls -Z index.html
# cp index.html /var/www/html/pub/cp.html
# mv index.html /var/www/html/pub/mv.html
# ls -Z /var/www/html/pub/*.html
[foundation0]
Alt+F2, http://c/pub
semanage fcontext
[desktop0]
# yum search samba
# yum -y install samba samba-common samba-client
# rpm -qc samba-common
# mkdir /common
# vim /etc/samba/smb.conf
...
[game]
path = /common
public = yes
# rpm -ql samba | grep service
# systemctl restart smb
# systemctl enable smb
# smbclient -L //d0 -N
# smbclient //d0/game -N
smb: \> ls
smb: \> quit
# grep chcon /etc/samba/smb.conf
# man semanage fcontext | grep \#
# semanage fcontext -a -t samba_share_t "/common(/.*)?"
# restorecon -R -v /common
# smbclient //d0/game -N
smb: \> ls
smb: \> quit
setsebool
[desktop0]
# smbclient -L //d0 -N
# smbpasswd -a student
ss
ss
# smbclient -L //d0 -U student%ss
# smbclient //d0/student -U student%ss
smb :\> ls
smb :\> quit
# getsebool -a
# getsebool -a | grep samba
# getsebool samba_enable_home_dirs
# setsebool -P samba_enable_home_dirs on
# smbclient //d0/student -U student%ss
smb :\> ls
smb :\> quit
semanage port
[desktop0]
# yum search http
# yum list httpd
# yum -y install httpd
# rpm -qc httpd
# vim /etc/httpd/conf/httpd.conf
# egrep -n '^Listen|^DocumentRoot|^ .*DirectoryIndex' /etc/httpd/conf/httpd.conf
# echo Hello > /var/www/html/index.html
# systemctl restart httpd
# systemctl enable httpd
# curl http://d0
# sed -i '/^Listen/s/80/8089/' /etc/httpd/conf/httpd.conf
# egrep -n '^Listen|^DocumentRoot|^ .*DirectoryIndex' /etc/httpd/conf/httpd.conf
# systemctl restart httpd || echo no
# systemctl status httpd
# systemctl status httpd -l
# vim /var/log/messages
<G>, <Ctrl>+<F>
# man semanage port
/-a, /EXAM
# semanage port -l
# semanage port -l | grep 80
# semanage port -l | grep 80 | grep http
# man semanage port | grep \#
# semanage port -a -t http_port_t -p tcp 8089
# systemctl restart httpd
# curl http://d0:8089
8. ldap
Topology
ID | host | role | user |
---|---|---|---|
1 | classroom | ldap-server | ldapuser{0…20} |
2 | desktop | ldap-client |
ldap+ldap (GUI)
[foundation0]
$ ssh -X root@d0
[desktop0]
# firefox &
# yum search auth
# yum list authconfig-gtk
# yum -y install authconfig-gtk
# authconfig-gtk &
User Account Congiguration
User Account Database:LDAP
InstallInstallForce Install,
InstallInstallForce Install,
Cancel
User Account Congiguration
User Account Database:LDAP
LDAP Search Base DN:dc=example,dc=com
LDAP Server:ldap://classroom.example.com
- use TLS to encrypt connections
Download CA Certificate… /
http://classroom.example.com/pub/example-ca.crt
Authentication Configuration
Authentication Method:
LDAP password
Apply
# getent passwd ldapuser0
# id ldapuser0
# ssh ldapuser0@localhost
password
$
ldap+kerberos (GUI)
[desktop0]
Authentication Configuration
Authentication Method: Kerberos password
Realm: EXAMPLE.COM
KDC: classroom.example.com
Admin Servers: classroom.example.com
-
Use DNS to locate KDCs for realms
Apply
# id ldapuser0
# ssh ldapuser0@localhost
kerberos
$
ldap+kerberos (CLI)
[desktop0]
# authconfig \
--enableldap \
--enableldaptls \
--ldapserver=ldaps://classroom.example.com \
--ldapbasedn=dc=example,dc=com \
--ldaploadcacert=http://classroom.example.com/pub/example-ca.crt \
--enablekrb5 \
--krb5realm=EXAMPLE.COM \
--krb5kdc=classroom.example.com \
--krb5adminserver=classroom.example.com \
--enablesssd \
--enablesssdauth \
--enablemkhomedir \
--update
9. disk
type
ID | 2TB | sum | primary | extend*1 | Logical | |
---|---|---|---|---|---|---|
1 | mbr | < | 15 | 4 | pri*(4-1)+ext*1 | |
2 | gpt | >= | 128 | 128 | - | - |
ID | cmd | arg | comment |
---|---|---|---|
1 | lsblk | - | 判断硬盘 |
2 | fdisk | /dev/vda | 分区 |
3 | mkfs.xfs | mkswap | /dev/vda1 | 格式化分区 |
4 | mkdir | /mnt/folder | 挂载点 |
5 | vim | /etc/fstab | 永久生效 |
6 | mount | swapon | -a | 立即生效 |
7 | df | free | -h | 确认 |
xfs
[desktop0]
# lsblk
# fdisk /dev/vda
m,
n, Enter, Enter, Enter, +2G,
p, w
# mkfs.xfs /dev/vda1
# blkid /dev/vda1
mouse select ,Ctrl+Shift+C
# mkdir /mnt/xfs
# man fstab
# vim /etc/fstab
...
<Ctrl+Shift+V> /mnt/xfs xfs defaults 1 2
# mount -a
# df -h /mnt/xfs
swap - partition
# lsblk
# fdisk /dev/vda
n, Enter, Enter, Enter, +3G
t, Enter, l, 82
p, w
# partprobe
# partprobe /dev/vda
# mkswap /dev/vda2
mouse select, Ctrl+Shift+C
# vim /etc/fstab
...
<Ctrl+Shift+V> swap swap defaults 0 0
# free -h && echo no
# swapon -a
# free -h
swap - file
# df -h
# dd if=/dev/zero of=/pagefile.sys bs=40M count=10
# mkswap /pagefile.sys
# vim /etc/fstab
...
/pagefile.sys none swap defaults 0 0
# swapon -a
# free -h
# swapoff /pagefile.sys
# free -h
# chmod 600 /pagefile.sys
# swapon -a
# free -h
# swapon -s
10. lvm
ID | ||
---|---|---|
1 | lv | partition |
2 | vg | disk |
3 | pv | slice |
4 | disk | partition |
create
# lsblk
# fdisk /dev/vda << EOF
n
e
n
+1G
w
EOF
# partprobe
# pvcreate -h
# pvcreate /dev/vda5
# pvs
# pvscan
# pvdisplay
# vgcreate -h
# vgcreate datastorage /dev/vda5
# vgs
# vgscan
# vgdisplay
# vgremove datastorage
# vgcreate -s 16M datastorage /dev/vda5
# vgdisplay
# vgchange -s 8M datastorage
# vgchange -s 32M datastorage || echo no
# vgdisplay
# vgchange -s 16M datastorage
# vgs
# pvs
# lvcreate -h
# lvcreate -l 50 datastorage
# lvs
# lvscan
# lvdisplay
# lvremove /dev/datastorage/lvol0
# lvdisplay
# lvcreate -l 50 -n database datastorage
# lvdisplay
# mkfs.ext4 /dev/datastorage/database
# blkid /dev/datastorage/database
# mkdir /mnt/measure
# vim /etc/fstab
...
UUID="C843-99C4" /mnt/measure ext4 defaults 0 2
# mount -a
# df -h /mnt/measure/
extend
# vgdisplay
# lsblk
# echo -e "n\nl\n\n+300M\nw\n" | fdisk /dev/vda
# partprobe
# lsblk
# pvcreate /dev/vda6
# vgextend -h
# vgextend datastorage /dev/vda6
# vgs
# lvextend -h
# lvextend -L 1200M /dev/datastorage/database
# lvdisplay
# df -h /mnt/measure/ && echo no
# blkid /dev/mapper/datastorage-database
-ext4
# resize2fs -h
# resize2fs /dev/datastorage/database
# df -h /mnt/measure
-xfs
# xfs_growfs -h
# xfs_growfs /mnt/measure
# df -h /mnt/measure
remove
# umount /mnt/measure/
# sed -i '/ext4/d' /etc/fstab
# rm -rf /mnt/measure/
# lvs
# lvremove /dev/datastorage/database
# lvs
# vgs
# vgreduce datastorage /dev/vda5 /dev/vda6
# vgremove datastorage
# vgs
# pvs
# pvremove /dev/vda[56]
# pvs
# echo -e "d\nd\nd\nd\n\w\n" | fdisk /dev/vda
# partprobe
11. nfs
ID | nfs | samba |
---|---|---|
1 | like Unix, host | Windows, user |
2 | directory | directory |
m3 | showmount -e ip | smbclient -L //ip -N |
c4 | mount ip:sharename /folder1 | mount //ip/sharename /folder2 |
c5 | - | smbclient //ip/share -N |
m1 | /etc/fstab | /etc/fstab |
m2 | autofs | autofs |
Topo
ID | host | role | dns |
---|---|---|---|
1 | classroom | server | c |
2 | desktop | client | d0 |
mount
[desktop0]
# showmount -e c
# mkdir /mnt/m1
# mount c:/home/guests /mnt/m1
# findmnt /mnt/m1
# ls /mnt/m1
# mount | grep m1
# umount /mnt/m1
# findmnt /mnt/m1
fstab
[desktop0]
# showmount -e classroom
# mkdir /mnt/m2
# man fstab
# vim /etc/fstab
...
classroom:/home/guests /mnt/m2 nfs sync 0 0
# mount -a
# findmnt /mnt/m2
# umount /mnt/m2
# sed -i '/m2/d' /etc/fstab
# cat -n /etc/fstab
autofs
[desktop0]
ldap+ldap
# yum -y install authconfig sssd krb5-workstation
authconfig \
--enableldap \
--enableldaptls \
--ldapserver=ldaps://classroom.example.com \
--ldapbasedn=dc=example,dc=com \
--ldaploadcacert=http://classroom.example.com/pub/example-ca.crt --enableldapauth \
--enablesssd \
--enablesssdauth \
--update
# id ldapuser19
# getent passwd ldapuser19
# ssh ldapuser19@localhost
yes
password
$ <Ctrl+D>
autofs
# yum search autofs
# yum list autofs
# yum -y install autofs
# yum list autofs
# rpm -qc autofs
# vim /etc/auto.master
...
/home/guests /etc/auto.ldap
# cp /etc/auto.misc /etc/auto.ldap
# vim /etc/auto.ldap
* -vers=3 classroom:/home/guests/&
# rpm -ql autofs | grep service
# systemctl list-unit-files | grep autofs
# systemctl restart autofs
# systemctl enable autofs
# ssh ldapuser0@localhost
kerberos
$ findmnt /home/guests
$ findmnt /home/guests/ldapuser0
$ <Ctrl+D>
# ssh ldapuser8@localhost
kerberos
$ findmnt /home/guests
$ findmnt /home/guests/ldapuser8
$ <Ctrl+D>
12. samba
ID | host | role | pkg | |
---|---|---|---|---|
1 | classroom | server | -N | samba, samba-common |
2 | desktop | client | guest | samba-client, cifs-utils |
[classroom]
yum -y install samba
mkdir /devops
semanage fcontext -a -t samba_share_t "/devops(/.*)?"
restorecon -R -v /devops
chmod o+w /devops/
cat >> /etc/samba/smb.conf <<EOF
[devops]
path = /devops
public = yes
writable = yes
EOF
systemctl restart smb
systemctl enable smb
firewall-cmd --permanent --add-service=samba --zone=classroom
firewall-cmd --reload
[desktop0]
smbclient
# yum provides smbclient
# yum list samba-client
# yum -y install samba-client
# smbclient -L //c -N
# smbclient //c/devops -N
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
smb: \> put anaconda-ks.cfg
smb: \> ls
smb: \> exit
fstab
# yum search cifs
# yum list cifs-utils
# yum -y install cifs-utils
# yum list cifs-utils
# man mount.cifs
/guest
# mkdir /mnt/smb
# vim /etc/fstab
...
//c/devops /mnt/smb cifs guest 0 0
# mount -a
# findmnt /mnt/smb
# cp /etc/fstab /mnt/smb/
# ssh root@c 'ls -l /devops'
autofs
# vim /etc/auto.master
...
/samba /etc/auto.samba
# cp /etc/auto.misc /etc/auto.samba
# vim /etc/auto.samba
devops -fstype=cifs,guest ://c/devops
# systemctl restart autofs
# ls /samba/
# ls /samba/devops
# findmnt /samba/devops
13. boot
systemctl target
# systemctl get-default
# systemctl set-default multi-user.target
# systemctl get-default
# reboot
# systemctl set-default graphical.target
# systemctl get-default
# init 6
# systemctl isolate multi-user.target
# systemctl isolate graphical.target
single
<Restart>
<upArrow>
<e>
linux16 ...<Space>rd.break console=tty0
<Ctrl>+<x>
# mount | grep sysroot
# mount -o remount,rw /sysroot
# mount | grep sysroot
# chroot /sysroot
# echo mima | passwd --stdin root
# touch /.autorelabel
# <Ctrl>+<D>
# <Ctrl>+<D>
root%mima
# ls -a /.autorelabel || echo no
rescue
destroy
# lsblk
# dd if=/dev/zero of=/dev/vda bs=446 count=1
Tip: Booting from Hard Disk ...
restore
Ctrl+Alt+Del
Esc, 4
Troubleshooting
Rescue a Red Hat Enterprise Linux system
Continue, OK, OK
# chroot /mnt/sysimage
# lsblk
# grub2-install /dev/vda
# <Ctrl>+<D>
# <Ctrl>+<D>
Note: 512/0=446/mbr+64/dpt+2
14. firewall
firewall-cmd
# ss -antup | grep 22
# systemctl status firewalld
# firewall-cmd --get-active-zones
# firewall-cmd --get-default-zone
# firewall-cmd --list-all
# firewall-cmd --permanent --add-service=samba
# firewall-cmd --permanent --add-service=nfs --add-service=rpc-bind --add-service=mountd
# firewall-cmd --permanent --add-service=http --add-service=https
# firewall-cmd --permanent --add-port=8089/tcp
# firewall-cmd --permanent --add-port=3260/tcp
# vim /etc/firewalld/zones/public.xml
# firewall-cmd --list-all --permanent
# firewall-cmd --list-all
# firewall-cmd --reload
# firewall-cmd --list-all
# firewall-cmd --permanent --remove-service=samba
# firewall-cmd --permanent --remove-service=nfs --remove-service=rpc-bind --remove-service=mountd
# firewall-cmd --permanent --remove-service=http --remove-service=https
# firewall-cmd --permanent --remove-port=8089/tcp
# firewall-cmd --permanent --remove-port=3260/tcp
# firewall-cmd --reload
# firewall-cmd --list-all
firewall-conf
Configuration: `Permanent`
Options: `reload`
Configuration: `Runtime`
Append
Internet
[foundation0]
NIC2: NAT
ens38: connect
# nmcli dev status
# ip a s ens38 | grep inet.*213
# grep "nameserver.*213" /etc/resolv.conf
# ping -c 4 www.easthome.com
EPEL
[foundation0]
# yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
# yum repolist
# yum search mail
# yum list | grep -i ^ev
grub2.cfg
destroy
# rpm -qc grub2
# rm -rf /boot/grub2.grub.cfg
Tip: grub>
restore
rescue
# grub2-mkconfig -o /boot/grub2/grub.cfg
sed
-add,insert
# cat -n /etc/selinux/config
# sed '/^SELINUX=/aoneline' /etc/selinux/config
# cat /etc/selinux/config
# sed -i '/^SELINUX=/aoneline' /etc/selinux/config
# cat /etc/selinux/config
# sed -i '/^SELINUX=/iupline' /etc/selinux/config
# cat /etc/selinux/config
# sed -i '1i firstline' /etc/selinux/config
# cat /etc/selinux/config -n
# sed -i.bk '$a lastline' /etc/selinux/config
# cat -n /etc/selinux/config
# ls /etc/selinux/config*
# diff /etc/selinux/config.bk /etc/selinux/config
-delete
# sed -i '1d' /etc/selinux/config
# head /etc/selinux/config
# sed -i '/line/d' /etc/selinux/config
# cat /etc/selinux/config -n
-switch
# sed -i '/^SELINUX=/s/=.*/=permissive/' /etc/selinux/config
# grep ^SELINUX= /etc/selinux/config
# sed -i '/^SELINUX=/s/$/ hehe/' /etc/selinux/config
# grep ^SELINUX= /etc/selinux/config
# sed -i '/^SELINUX=/s/ hehe//' /etc/selinux/config
# grep ^SELINUX= /etc/selinux/config