Lab 19.1: RH134 review lab — storage, SELinux, schedules and containers

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Doel

Do all tasks on server1 without the summaries — only man, --help and /usr/share/doc. Every result must still work after a reboot. server2 is the NFS server (prepared in "Before you start").

Voordat je begint

server1 with two extra empty disks /dev/vdb (5 GiB) and /dev/vdc (5 GiB). server2 at 192.168.122.20.

On server2, export home folders over NFS (one time preparation):

#dnf install -y nfs-utils
#mkdir -p /srv/nfs/home/{anna,omar}
#echo '/srv/nfs/home 192.168.122.0/24(rw,sync)' > /etc/exports.d/home.exports
#systemctl enable --now nfs-server
#firewall-cmd --add-service=nfs --permanent ; firewall-cmd --reload

Taken

LVM: make the VG vg_lab from /dev/vdb with an extent size of 8 MiB. Make the LV lv_web with 100 extents, XFS, mounted on /srv/web at boot.
Grow lv_web by 200 MiB while it is mounted. Add /dev/vdc to vg_lab.
Swap: make the LV lv_swap of 512 MiB in vg_lab and use it as swap at boot.
SELinux: Apache must serve the content of /srv/web on port 82. Put RH134 review in /srv/web/index.html. SELinux stays enforcing; open the port in the firewall.
Timer: the script /usr/local/bin/stamp.sh (writes date to /var/log/stamp.log) must run every 15 minutes as a systemd timer.
tmpfiles: files older than 2 days in /var/tmp/cache must be deleted automatically; the folder must exist after every boot with rights 0750.
Journal: keep the journal after reboots, use at most 300 MiB.
autofs: the folders of server2 /srv/nfs/home/NAME must appear as /home/remote/NAME when used.
Tuning and boot: use the recommended tuned profile. The system must boot into multi-user.target.
Container: user student runs a rootless container web from registry.access.redhat.com/ubi10/httpd-24 on port 8080 that starts at boot without a login.
Reboot and check every task.

Controleer je werk

#vgs vg_lab -o vg_name,vg_extent_size,pv_count
#lvs vg_lab
$findmnt /srv/web ; swapon --show
$curl -s http://server1:82/
$getenforce
$systemctl list-timers stamp.timer
$ls -ld /var/tmp/cache
$journalctl --list-boots | tail -n 2
$ls /home/remote/anna && findmnt /home/remote/anna
$tuned-adm active ; systemctl get-default
$sudo -u student XDG_RUNTIME_DIR=/run/user/$(id -u student) systemctl --user is-active web.service

vgs shows the extent size 8.00m and 2 PVs; lv_web is 1000 MiB (800 + 200).
curl prints RH134 review, and getenforce prints Enforcing.
journalctl --list-boots shows more than one boot.

Hints

Toon de hints

100 extents × 8 MiB = 800 MiB. lvextend -r grows XFS too.
semanage fcontext + restorecon for the folder, semanage port -a for port 82, Listen 82 in Apache.
A timer needs a .service and a .timer with the same name; enable the timer.
tmpfiles line: d PATH MODE USER GROUP AGE.
autofs: /home/remote /etc/auto.home and * -rw,sync server2:/srv/nfs/home/&.
Quadlet file + loginctl enable-linger student.

Oplossing

Toon de oplossing

and 2. LVM.

#pvcreate /dev/vdb
#vgcreate -s 8M vg_lab /dev/vdb
#lvcreate -n lv_web -l 100 vg_lab
#mkfs.xfs /dev/vg_lab/lv_web
#mkdir -p /srv/web
#echo '/dev/vg_lab/lv_web /srv/web xfs defaults 0 0' >> /etc/fstab
#systemctl daemon-reload ; mount -a
#lvextend -r -L +200M /dev/vg_lab/lv_web
#pvcreate /dev/vdc ; vgextend vg_lab /dev/vdc

Swap on LVM.

#lvcreate -n lv_swap -L 512M vg_lab
#mkswap /dev/vg_lab/lv_swap
#echo '/dev/vg_lab/lv_swap none swap defaults 0 0' >> /etc/fstab
#swapon -a

Apache on port 82 with SELinux.

#dnf install -y httpd
#echo "RH134 review" > /srv/web/index.html
#semanage fcontext -a -t httpd_sys_content_t '/srv/web(/.*)?'
#restorecon -Rv /srv/web
#sed -i 's/^Listen 80$/Listen 82/' /etc/httpd/conf/httpd.conf
#sed -i 's#"/var/www/html"#"/srv/web"#g' /etc/httpd/conf/httpd.conf
#semanage port -a -t http_port_t -p tcp 82
#systemctl enable --now httpd
#firewall-cmd --add-port=82/tcp --permanent ; firewall-cmd --reload

The timer.

#printf '#!/bin/bash\ndate >> /var/log/stamp.log\n' > /usr/local/bin/stamp.sh
#chmod 755 /usr/local/bin/stamp.sh
#printf '[Unit]\nDescription=Write a time stamp\n[Service]\nType=oneshot\nExecStart=/usr/local/bin/stamp.sh\n' > /etc/systemd/system/stamp.service
#printf '[Unit]\nDescription=Time stamp every 15 minutes\n[Timer]\nOnCalendar=*:0/15\n[Install]\nWantedBy=timers.target\n' > /etc/systemd/system/stamp.timer
#systemctl daemon-reload
#systemctl enable --now stamp.timer

tmpfiles.

#echo 'd /var/tmp/cache 0750 root root 2d' > /etc/tmpfiles.d/cache.conf
#systemd-tmpfiles --create /etc/tmpfiles.d/cache.conf

Persistent journal.

#mkdir -p /etc/systemd/journald.conf.d
#printf '[Journal]\nStorage=persistent\nSystemMaxUse=300M\n' > /etc/systemd/journald.conf.d/persistent.conf
#systemctl restart systemd-journald

autofs.

#dnf install -y autofs nfs-utils
#echo '/home/remote /etc/auto.home' > /etc/auto.master.d/home.autofs
#echo '* -rw,sync server2:/srv/nfs/home/&' > /etc/auto.home
#systemctl enable --now autofs

Tuning and default target.

#tuned-adm profile $(tuned-adm recommend)
#systemctl set-default multi-user.target

The rootless container as student (as root: enable linger first).

#loginctl enable-linger student
$mkdir -p ~/.config/containers/systemd
$printf '[Container]\nImage=registry.access.redhat.com/ubi10/httpd-24\nContainerName=web\nPublishPort=8080:8080\n[Install]\nWantedBy=default.target\n' > ~/.config/containers/systemd/web.container
$systemctl --user daemon-reload
$systemctl --user start web.service

Reboot and run the checks.
```
#systemctl reboot
```

Mijn notities

Nog geen notities.

RH134 review lab — storage, SELinux, schedules and containers