Linuxtechi

How to Install and Use Terraform on CentOS 8

Wed, 30 Sep 2020 05:46:48 GMT

In this guide, we will show you how to install and use Terraform on CentOS 8. Before we proceed further, what is Terraform? Created by Hashicorp, Terraform is a free and opensource declarative coding tool that allows you to automate and manage your IT infrastructure and various services that run on servers. In fact, Terraform is popularly referred to as ‘Infrastructure as a Code’ tool.

Terraform makes use of a simple syntax to efficiently and safely provision resources across on-premise and cloud platforms such as Microsoft Azure, Google Cloud Platform and AWS. Where required, it can also re-provision these changes in response to changes in configuration.

Without much further ado, let us walk you through the installation steps.

Installation of Terraform on CentOS 8

First up, head over to the official Terraform download site and download the latest zip file. By the time of writing down this guide, the latest version is Terraform 0.13.3. To download use the wget command as shown

[james@linuxtechi ~]$ wget https://releases.hashicorp.com/terraform/0.13.3/terraform_0.13.3_linux_amd64.zip

Once downloaded, unzip the file to the /usr/local/bin path using the -d switch as shown.

[james@linuxtechi ~]$ sudo unzip terraform_0.13.3_linux_amd64.zip -d /usr/local/bin
Archive:  terraform_0.13.3_linux_amd64.zip
  inflating: /usr/local/bin/terraform
[james@linuxtechi ~]$

Alternatively, you can locally unzip the file in your current working directory and later move the unzipped directory to the /usr/local/bin destination.

[james@linuxtechi ~]$  unzip terraform_0.13.3_linux_amd64.zip
[james@linuxtechi ~]$  mv terraform /usr/local/bin

To confirm that everything went as expected, invoke the following command:

[james@linuxtechi ~]$ terraform -v
Terraform v0.13.3
[james@linuxtechi ~]$

And that’s it! We are done installing Terraform. The output confirms that Terraform is successfully installed on our system. As you can see, installing Terraform is quite a simple and straightforward procedure.

Terraform in action – Deploying a VM in GCP

To get a better understanding of how Terraform can be used to provision resources, we are going to demonstrate how to deploy a vm on Google cloud.

But first, you need to have a Google Cloud account with billing enabled. Usually, you get $300 worth of free credit during your free trial. In this demo, we are using a free trial.

Once you have logged in, click on the cloud shell icon as shown

This will initialize the Google cloud shell at the bottom of your screen. This usually takes a few seconds.

Next, we are going to install Terraform locally using docker to make it more convenient. To make it more persistent on restarts, we will install it into $HOME/bin as shown.

$ docker run -v $HOME/bin:/software sethvargo/hashicorp-installer terraform 0.13.3
$ sudo chown -R $(whoami):$(whoami) $HOME/bin/

Next, add bin to the path as shown

$ export PATH=$HOME/bin:$PATH

At this point, terraform is installed. Next, you need to enable the Cloud Engine API to make the API available for use.

$ gcloud services enable compute.googleapis.com

We are going to download a terraform configuration file from Github. The configuration file initializes a compute instance (virtual machine) that installs Apache webserver with a custom configuration. The compute engine is assigned a unique name and an external IP address that you will use to access the webserver. To download the config file, run:

$ curl -sSfO https://raw.githubusercontent.com/sethvargo/terraform-gcp-examples/master/public-instance-webserver/main.tf

Use cat command to view the contents of main.tf file

$ cat main.tf

Here’s just a snippet of the file.

Using terraform command, proceed and initialize terraform to download Google’s latest version and random providers.

$ terraform init

If all goes well, you will get a notification at the very end showing you that Terraform has been initialized.

To validate the configuration syntax and have a glance of the expected outcome run the command below. In the output, Terraform creates a google compute instance, a google firewall rule together with a random_id resource among other things

$ terraform plan

To apply the changes, issue the apply command as shown.

$ terraform apply

At some point, you will come across the output below. Type ‘Yes’ and press ‘ENTER’ to proceed.

After the completion of the application process, you will get the output shown as a confirmation that everything went on just fine.

Right at the bottom, the external IP address of the compute instance will be displayed. Copy and paste it on your system’s browser and view your instance’s welcome page as shown.

Bravo! We have managed to deploy a virtual instance using Terraform. When you are done and no longer require it, simply invoke the command:

$ terraform destroy

Once again, type in ‘Yes’ when prompted to discard the instance.

That was a brief overview of just how useful Terraform can be in deploying cloud resources. It’s our hope that you can now comfortably install Terraform on CentOS 8 and get started with provisioning your resources and managing different services.

The post How to Install and Use Terraform on CentOS 8 first appeared on Linuxtechi.

How to Setup Private Docker Registry in Kubernetes (k8s)

Mon, 28 Sep 2020 03:53:39 GMT

It is always recommended to have private docker registry or repository in your Kubernetes cluster. Docker private registry allows the developers to push and pull their private container images. Once the application’s containers are pushed to private registry then developers can use the path of their private registry while creating and deploying their yaml files.

In this article, we will learn how we can deploy private docker registry as a deployment on top of Kubernetes cluster. I am assuming Kubernetes cluster is already up and running.

Kubernetes lab details for setting up private docker registry

k8s-master – 192.168.1.40 – CentOS 7
k8s-worker-1 – 192.168.1.41 – CentOS 7
k8s-worker-2 – 192.168.1.42 – CentOS 7
kadmin user with sudo rights
NFS share ‘/opt/certs’ & ‘/opt/registry’

Note: In my case, I have setup nfs server on master node and exported /opt/certs and /opt/registry as nfs share.

Before starting the deployment of private registry, please make sure these nfs shares are mounted on each worker nodes. Run the following commands on each worker node.

$ sudo mkdir /opt/certs /opt/registry
$ sudo mount 192.168.1.40:/opt/certs /opt/certs
$ sudo mount 192.168.1.40:/opt/registry /opt/registry

For permanent mount, add nfs entries in /etc/fstab file.

In place of mounting these nfs shares, we can also create nfs based persistent volumes and later we can use these persistent volumes in yaml file.

Let’s dive into installation and configuration steps of private docker registry in Kubernetes.

Step 1) Generate self-signed certificates for private registry

Login to your control plane or master node and use openssl command to generate self-signed certificates for private docker repository.

[kadmin@k8s-master ~]$ cd /opt
[kadmin@k8s-master opt]$ sudo openssl req -newkey rsa:4096 -nodes -sha256 -keyout ./certs/registry.key -x509 -days 365 -out ./certs/registry.crt

Once the key and certificate file are generated, use ls command to verify them,

[kadmin@k8s-master opt]$ ls -l certs/
total 8
-rw-r--r--. 1 root root 2114 Sep 26 03:26 registry.crt
-rw-r--r--. 1 root root 3272 Sep 26 03:26 registry.key
[kadmin@k8s-master opt]$

Step 2) Deploy private registry as deployment via yaml file

On your master node, create a private-registry.yaml file with the following contents

[kadmin@k8s-master ~]$ mkdir docker-repo
[kadmin@k8s-master ~]$ cd docker-repo/
[kadmin@k8s-master docker-repo]$ vi private-registry.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: private-repository-k8s
  labels:
    app: private-repository-k8s
spec:
  replicas: 1
  selector:
    matchLabels:
      app: private-repository-k8s
  template:
    metadata:
      labels:
        app: private-repository-k8s
    spec:
      volumes:
      - name: certs-vol
        hostPath:
          path: /opt/certs
          type: Directory
      - name: registry-vol
        hostPath:
          path: /opt/registry
          type: Directory

      containers:
        - image: registry:2
          name: private-repository-k8s
          imagePullPolicy: IfNotPresent
          env:
          - name: REGISTRY_HTTP_TLS_CERTIFICATE
            value: "/certs/registry.crt"
          - name: REGISTRY_HTTP_TLS_KEY
            value: "/certs/registry.key"
          ports:
            - containerPort: 5000
          volumeMounts:
          - name: certs-vol
            mountPath: /certs
          - name: registry-vol
            mountPath: /var/lib/registry

save and close the yaml file

Run the following kubectl command deploy the private registry using above created yaml file,

[kadmin@k8s-master docker-repo]$ kubectl create -f private-registry.yaml
deployment.apps/private-repository-k8s created
[kadmin@k8s-master docker-repo]$

Execute below kubectl commands to verify status of registry deployment and its pod.

[kadmin@k8s-master ~]$ kubectl get deployments private-repository-k8s
NAME                     READY   UP-TO-DATE   AVAILABLE   AGE
private-repository-k8s   1/1     1            1           3m32s
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ kubectl get pods | grep -i private-repo
private-repository-k8s-85cf76b9d7-qsjxq   1/1     Running   0          5m14s
[kadmin@k8s-master ~]$

Perfect, above output confirms that registry has been deployed successfully, Now copy the registry certificate file to worker nodes and master node under the folder “/etc/pki/ca-trust/source/anchors“. Execute the following commands on master node and each worker nodes

$ sudo cp /opt/certs/registry.crt /etc/pki/ca-trust/source/anchors/
$ sudo update-ca-trust
$ sudo systemctl restart docker

Step 3) Expose registry deployment as a nodeport service type

To expose registry deployment as a nodeport service type, create the following yaml file with the beneath contents,

[kadmin@k8s-master ~]$ cd docker-repo/
[kadmin@k8s-master docker-repo]$ vi private-registry-svc.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    app: private-repository-k8s
  name: private-repository-k8s
spec:
  ports:
  - port: 5000
    nodePort: 31320
    protocol: TCP
    targetPort: 5000
  selector:
    app: private-repository-k8s
  type: NodePort

save and close the file.

Now deploy the service by running following kubectl command,

[kadmin@k8s-master docker-repo]$ kubectl create -f private-registry-svc.yaml
service/private-repository-k8s created
[kadmin@k8s-master docker-repo]$

Run below kubectl command to verify the service status,

[kadmin@k8s-master ~]$ kubectl get svc private-repository-k8s
NAME                     TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
private-repository-k8s   NodePort   10.100.113.39   <none>        5000:31320/TCP   2m1s
[kadmin@k8s-master ~]$

Step 4) Test and Use private docker registry in k8s

To test private registry, we will download nginx image locally and then will upload that image to private registry, from the master node run the following set of commands,

[kadmin@k8s-master ~]$ sudo docker pull nginx
[kadmin@k8s-master ~]$ sudo docker tag nginx:latest k8s-master:31320/nginx:1.17
[kadmin@k8s-master ~]$ sudo docker push k8s-master:31320/nginx:1.17

Output of above command would like below:

Run below docker command to verify whether nginx is uploaded to private repository or not.

[kadmin@k8s-master ~]$ sudo docker image ls | grep -i nginx
nginx                                latest              7e4d58f0e5f3        2 weeks ago         133MB
k8s-master:31320/nginx               1.17                7e4d58f0e5f3        2 weeks ago         133MB
[kadmin@k8s-master ~]$

Now, let’s deploy a nginx based deployment and in the yaml file specify the image’s path as our private docker registry. Example is shown below:

[kadmin@k8s-master ~]$ vi nginx-test-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx-1-17
        image: k8s-master:31320/nginx:1.17
        ports:
        - containerPort: 80

Save and Close the file

Run following kubectl commands,

[kadmin@k8s-master ~]$ kubectl create -f nginx-test-deployment.yaml
deployment.apps/nginx-test-deployment created
[kadmin@k8s-master ~]$ kubectl get deployments  nginx-test-deployment
NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
nginx-test-deployment   3/3     3            3           13s
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ kubectl get  pods | grep nginx-test-deployment
nginx-test-deployment-f488694b5-2rvmv     1/1     Running   0          80s
nginx-test-deployment-f488694b5-8kb6c     1/1     Running   0          80s
nginx-test-deployment-f488694b5-dgcxl     1/1     Running   0          80s
[kadmin@k8s-master ~]$

Try to describe any pod using ‘kubectl describe‘ command and verify image path

[kadmin@k8s-master ~]$ kubectl describe pod nginx-test-deployment-f488694b5-2rvmv

Output of above command would be,

Above output confirms that container’s image path is our private docker registry, so it means nginx image has been downloaded from private registry. That’s all from this article, I hope these steps help you to setup private docker registry on your Kubernetes cluster. Please do share your feedback and comments in the comments section below.

The post How to Setup Private Docker Registry in Kubernetes (k8s) first appeared on Linuxtechi.

How to Setup Jenkins on CentOS 8 / RHEL 8

Wed, 23 Sep 2020 14:07:25 GMT

In this article, we will acquire a knowledge of how-to setup the Jenkins on CentOS 8 or RHEL 8. We will also go through why there is a need of an additional tool for delivering a project. But before we start with all gun blazing and put this tool to work, we should know what it is exactly and why it is needed.

Jenkins is an open-source software for continuous software development. It is based on Java and it is the only tool which can be used in every part of software development cycle.

What is Jenkins ?

Jenkins is a CI/CD tool. Here CI means continuous integration and CD means continuous delivery. Jenkins is also considered as automation tool or server, It helps to automate software development which are related to building, testing and deploying. It is a server-based tool which runs on servlet containers like Apache Tomcat.

Why do we need Jenkins tool?

As maximum organization is now having agile process. Agile methodology is a practice that promotes both continuous integration and continuous delivery, it has scrum process that can be of 2/3 weeks, which is also known as scripts. In every sprint developers and tester has to do continuous development and testing with continuous integration and continuous delivery. In every sprint client get the privilege to check that the software/application is building according to the given requirement. They also have the leverage to change/update the requirement according to their business needs. This is one of the main reasons why Jenkins is one of the most popular tools in the market nowadays.

Prerequisites:

Minimal CentOS 8 / RHEL 8
User with sudo rights
Stable Internet Connection
For RHEL 8 system, active subscription is required.

Jenkins Lab details:

Host Name: Jenkins.linuxtechi.com
IP Address: 192.168.1.190
SELinux : Enabled
Firewall: Running

Installation Steps of Jenkins on CentOS 8 / RHEL 8

Step 1) Update hosts file and apply updates

Add the following hostname entry in /etc/hosts file, run below echo command:

[pkumar@jenkins ~]$ echo "192.168.1.190   jenkins.linuxtechi.com" | sudo tee -a /etc/hosts

Install all the available updates using the beneath dnf command,

[pkumar@jenkins ~]$ sudo dnf update -y

Once all the updates are installed successfully then reboot your system once.

[pkumar@jenkins ~]$ sudo reboot

Step 2) Enable Jenkins Package Repository

Run the following command to enable Jenkins package repository for CentOS 8 / RHEL 8,

[pkumar@jenkins ~]$ sudo dnf install wget -y
[pkumar@jenkins ~]$ sudo wget http://pkg.jenkins-ci.org/redhat-stable/jenkins.repo -O /etc/yum.repos.d/jenkins.repo

Run below rpm command to import GPG key for Jenkins packages

[pkumar@jenkins ~]$ sudo rpm --import https://pkg.jenkins.io/redhat/jenkins.io.key

Step 3) Install Java and Jenkins with dnf command

Java is one of the perquisites for Jenkins, so run below dnf command to install java

[pkumar@jenkins ~]$ sudo  dnf install -y java-11-openjdk-devel

Verify the java version using below command:

pkumar@jenkins ~]$ java --version

Now install Jenkins using beneath dnf command,

[pkumar@jenkins ~]$ sudo dnf install -y jenkins

Step 4) Start and Enable Jenkins Service via systemctl

Run following systemctl command to start and enable Jenkins service

[pkumar@jenkins ~]$ sudo systemctl start jenkins
[pkumar@jenkins ~]$ sudo systemctl enable jenkins

Verify Jenkins service status by running following command,

[pkumar@jenkins ~]$ sudo systemctl status jenkins

Above output confirms that Jenkins service is active and running.

Step 5) Configure firewall rules for jenkins

Allow 8080 tcp port in OS firewall for Jenkins, run following firewall-cmd commands,

[pkumar@jenkins ~]$ sudo firewall-cmd --permanent --add-port=8080/tcp
[pkumar@jenkins ~]$ sudo firewall-cmd --reload

Step 6) Setting Up Jenkins with Web Portal

In this step, we will setup the Jenkins via its web portal, access its portal from the browser and type the URL:

http://<Server-IP>:8080

The browser displays the unlock Jenkins page. It will ask to enter temporary password. To retrieve this password run following cat command from the terminal,

[pkumar@jenkins ~]$ sudo cat /var/lib/jenkins/secrets/initialAdminPassword
802dffd0fbb74fa2bde9e6c1264a5f10
[pkumar@jenkins ~]$

Copy and paste the password into the password field and then click on continue.

Jenkins will now ask to install plugins. There will be two options ‘Install using suggested plugins‘ or ‘Select plugins to install‘. It is recommended to go with ‘Install using suggested plugins ‘. So Click on the first option

Once all the suggested plugins are installed then setup wizard will prompt us to create admin user.

Click on ‘Save and Continue‘

Click on ‘Save and Finish’

Click on ‘Restart’, Once Jenkins is restarted then we will get following login page:

Use the same user credentials that we have created during the Jenkins setup.

Above screen confirms that Jenkins has been installed successfully. That’s all from this article, please do share your feedback and comments.

The post How to Setup Jenkins on CentOS 8 / RHEL 8 first appeared on Linuxtechi.

9 tee Command Examples in Linux

Mon, 21 Sep 2020 04:37:25 GMT

Linux Tee command is a command line tool, it reads from the standard input and write the result to standard output and files at the same time.In other words, we can say, tee command in Linux used for hitting two birds with one stone: reading from standard input and printing the result on a file and to standard output at the same time. What do we mean by this? In this guide, we shed more light on Linux tee command and use a few examples to demonstrate its usage.

Tee Command Syntax

The tee command syntax is quite simple and takes the following format:

$ tee OPTIONS filename

Here are some of the options that you can use with tee command:

In tee command’s syntax, filename refers to one or more files.

With that in mind let’s check out a few examples on how the command is used.

Example 1) Basic usage of tee command

As described earlier, the main function of the tee command is to display the output of a command (stdout) and save it in a file. In the example below, the command we are inspecting the block devices in our system and piping the results to tee command which display the output to the terminal while simultaneously saving it on a new file called block_devices.txt

$ lsblk | tee block_devices.txt

Feel free to examine the contents of the block_devices.txt file using the cat command as shown:

$ cat block_devices.txt

Example 2) Save command output to multiple files using tee

Additionally, you can write a command’s output to several space-separated files as shown in the syntax below.

$ command | tee file1 file2 file3 . . .

In the following example, we have invoked the hostnamectl command to print the hostname of our system among other details and save the standard output to two files file1.txt, and file2.txt

$ hostnamectl | tee file1.txt file2.txt

Once again, you can confirm the existence of the output in the two files using the cat command as shown:

$ cat file1.txt
$ cat file2.txt

Example 3) Suppress output of tee command

If you want to hide or suppress tee command from printing the output on the screen then redirect the output to /dev/null as shown:

$ command | tee file > /dev/null

For example,

$ df -Th | tee file4.txt > /dev/null

Example 4) Append output to a file with tee command

By default, tee command overwrites the contents of a file. To append the output and prevent the erasure of the current content, use the -a or –append options.

$ command | tee -a file

In the second command, as shown, we have appended the output of date command to file1.txt which already contains the information about the USB devices on the system.

$ date | tee -a file1.txt

Example 5) Use tee together with sudo command

Suppose that as a sudo user, you want to write on a file that is owned by the root user. Naturally, any elevated operation will require that you invoke the sudo user before the command.

To achieve this, simply prefix the tee command with sudo as shown below.

$ echo "10.200.50.20 db-01" | sudo tee -a /etc/hosts/

So, tee receives the output of echo command on the left and elevates this using the sudo command which eventually appends the output to the file.

Example 6) Redirect output of one command to another using tee command

Using tee command, we can easily redirect the output of one command to another command. Here output of first command will act as input for second command. Example is shown below:

$ grep 'root' /etc/passwd | tee /tmp/passwd.tmp | wc -l
2
$ cat /tmp/passwd.tmp
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
$

Example 7) Save changes to a file within vi editor with tee command

Let’s assume you are working as non-root user and you are making changes to root owned file and you forget to put sudo In front of command and now you want to save changes, example is demonstrated below:

$ vi /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
192.168.1.60   mail.linuxtechi.com
192.168.1.50   ns.linuxtechi.com
192.168.1.40    pxe.linuxtechi.com

While saving the changes to the file you will get read-only message,

Now to save the changes to /etc/hosts file within the vi editor, run

:w !sudo tee %

It will prompt you to enter password of the user, if the user has sudo rights then changes will be saved.

Example 8) Ignore Interrupt signal while using tee command

Using ‘-i’ option in tee command can ignore interrupt signal (CTRL-C), example is shown below:

$ ping -c 5 linuxtechi.com  | tee -i /tmp/pingtest.tmp

Example 9) tee command usage in shell script

Tee command is also used frequently in shell scripts, one of common example is listed below:

$ vi basic-script.sh
#!/bin/bash
LOGFILE=/tmp/basic-logs-$(date +%d%m%Y)
FLAVOR=$(cat /etc/*-release  | grep -w 'NAME=' | cut -d"=" -f2 | awk '{print $1}'| sed 's/"//g')
if [ $FLAVOR == CentOS ];
then
   dmesg | grep -i 'error' | tee -a $LOGFILE
   grep -i 'installed' /var/log/dnf.log | tee -a $LOGFILE
else
   echo 'do nothing'
fi

As we can see in above linux shell script, we are using tee command to append the outputs of two commands to a log file only if the OS is CentOS.

Conclusion

This wraps up today’s topic. Feel free to weigh in. Your feedback is most welcome. In this guide, we covered the Linux tee command.

Read Also: 14 Grep Command Examples in Linux

The post 9 tee Command Examples in Linux first appeared on Linuxtechi.

9 Quick chmod Command Examples in Linux

Wed, 16 Sep 2020 03:37:00 GMT

Chmod command in Linux is used to change or assign permissions on files and directories. In Linux / Unix systems, accessibility to files and directories is determined by file ownership and permissions. In a previous article, we looked at how to manage file & directory ownership using the chown command. In this tutorial, we look at the chmod command.

The chmod command, short for change mode is used to manage file and directory permissions and determines who can access them. Let’s now dive in and explore the nature of file & directory permissions and how they can be modified.

Linux permissions

To better understand how the chmod command works, it’s prudent that we study the Linux file permissions model.

In Linux, we have 3 types of file permissions: read (r), write (w) and execute (x) permissions. These permissions determine which users can read, write or execute the files. You can assign these permissions using the text or octal (numeric) notation as we shall later discuss in this tutorial.

Files and directories can belong to either the owner of the file (u), group (g) or others (o)

u – Owner of the file
g – Group
o – Others

File permissions are listed using the ls -l command. The -l flag lists the file permissions. The permissions are arranged in three sets: the user, group and others respectively

To get a better understanding of file permissions, we are going to list the contents of our directory as shown:

$ ls -l

Starting from the extreme left, the first character/symbol indicates the file type. A hyphen (-) indicates that the file is a regular file. The symbol d indicates that it is a directory. Symbol l indicates that it’s a symbolic link.

The remaining nine characters are segmented into 3 triplets each bearing three symbols r(read), w(write) and x(execute). As pointed out earlier, the first segment points to the owner permissions, the second indicates the group permissions and the last portion specifies the permissions that other users have on the file or directory.

From the output, we can see that we have 2 files (hello.txt & reports.zip) and a single directory.

Let’s examine the first file

-rw-rw-r-- 1 linuxtechi linuxtechi   35 Aug 17 15:42 hello.txt

For the first file, the -rw-rw-r– permissions imply that the owner of the file has read and write permissions, the group also bears read & write permissions, while other users only have read permissions. The same permissions also apply for the reports.zip compressed file.

Let’s look at the directory’s permissions:

drwxrwxr-x 2 linuxtechi linuxtechi 4096 Aug 17 15:43 sales

We can see that the owner of the directory and group has all the permissions (read, write and execute) while other users have read and execute permissions only.

The triple hyphen symbols — indicate no permissions have been granted for either the owner of the file, group or other users.

Using chmod command to set file & directory permissions

Having looked at the file permissions and how to view them, let’s no focus on how to modify these permissions.

The chmod command in Linux is used to change file and directory permissions using either text (symbolic) or numeric (octal) notation. It takes the following syntax:

$ chmod [OPTIONS] MODE filename

Only the root user or a regular user with sudo privileges can change file or directory permissions. You can pass more than one file or directory separated by spaces in the command syntax.

Let’s now delve and see different examples of chmod command.

Example 1) Assign permissions using numeric notation

When setting permissions using the numeric style/notation, use the syntax shown below:

$ sudo chmod [OPTIONS] numeric_value filename

The numeric value can take 3 or 4 numbers. However, in most cases, 3 numbers are used. The read, write and execute permissions take the following values:

read permission => 4
write permission => 2
execute permission => 1

The total sum of the values of the permissions i.e. read, write and execute in each of the three segments account for the complete permissions of a given file or directory.

What do we mean by this ?

Let’s assume the owner has read, write and execute permissions, the group has read and execute permissions and other users have read permissions only, this can be broken down as follows:

u : rwx = 7
g : r-x = 5
o : r– = 4

Therefore, we arrive at the value of 754 as the numeric value for the file permissions of the given file.

To assign read, write and execute permissions to the owner, and read permissions only to the group and other users, run the command:

$ chmod 744 devops.txt

To assign all permissions to the owner of the file, read and execute permissions to the group and no permissions at all to other users, execute:

$ chmod 750 coders.txt

To assign all permissions to the owner of the file, read and write permissions to the group and other users run the command:

$ chmod 755 sysadmin.txt

Example 2) Recursively assigning permissions to directories

When assigning permissions to directories, use the -R flag to recursively assign permissions to its files and subfolders. For example:

$ chmod 755 -R directory_name

$ chmod 755 -R /home/linuxtechi/data

Example 3) Assign permissions using text notation

Another way of assigning permissions is by using the text notation. In this method, the chmod command takes flags or symbols which represent the owner, group, others or all users ( u, g , and o) in the syntax.

The method is not as straightforward as the previous method and caution should be taken to avoid assigned the wrong permissions.

Here’s what the syntax looks like

$ chmod [OPTIONS] [ u g o a ] [ – + = ] [ r, w, x ] file

Let’s break this down.

The first group of parameters [ u g o a] specify the category of users whose permissions will changes

u : user
g : group
o : other
a : all ( This includes all the above )

If this set is omitted, then the default option is the a option.

The second set of options – operator options [ – + = ] – determines whether permissions are going to be added or removed from the category of users. The option remove

– : The flag removes the file permissions from a specified user.
+ : This adds/appends permissions to a specified user.
= : This assigns specified users distinct permissions and removes the previous permissions of the user segment.

Let’s have a look at a few examples:

Example 4) Assign read permissions to a file

$ chmod o=r filename

The above command assigns other users denoted by the symbol ‘o’ read permissions only to the file and removes earlier permissions assigned to the ‘others’ segment. Take a file1.txt which has the following permissions

To assign ‘others ( o )’ segment read permissions only run

$ sudo chmod o=r file1.txt

From the output, we can see that the ‘others’ segment has been assigned read permissions while at the same time has lost the execute permissions. This implies that the = operator assigns new permissions while at the same time erases the previous permissions.

Example 5) Assign Execute Permissions to File and Group Owner

$ sudo chmod ug+x filename

The above command adds execute permissions to the owner and the group of the file. Using our file, this becomes:

$ sudo chmod ug+x file1.txt

Example 6) Assign different permissions to file, group and others

$ sudo chmod u=rwx,g=rw,o=r filename

The above command assigns all the permissions to the owner of the file, read and write permissions to the group and only read permissions to other users.

NOTE: If there are no permissions specified after the = operator, then all permissions from the user segment are removed.

Example 7) Remove all permissions for other users

$ sudo chmod o= filename

The command above removes all the permissions from the ‘others’ user segment for the specified file.

The command has the same effect as the command below:

$ sudo chmod o-rwx filename

Example 8) Assign permissions using a reference file

Another handy and convenient way of assigning file permissions is using a reference file. In this method, you make use of the –reference=ref_file option to set the permissions of a file to be the same as those of another reference file. Use the syntax below

$ sudo –reference=ref_file filename

For example, to set file permissions of file2.txt to be the same as those of file1.txt run the command:

$ sudo --reference=file1.txt file2.txt

The reference file is file1.txt while file2.txt is the file that will take up the file permissions for the reference file.

Example 9) Assign execute permission to directories only

Let’s assume we have a directory which has files and sub-directories and we wish to assign execute permission only on directories without touching files. So, this can be achieved by using following chmod command,

$ chmod a+X *

If you have noticed carefully, we have used capital X for execute permission, above command will set execute permission on all directories of our current working directory.

Conclusion

This draws the curtain on our topic. We looked at chmod command and saw various examples in which the command can be used to change file permissions.

The post 9 Quick chmod Command Examples in Linux first appeared on Linuxtechi.

Top 12 Command Line Tools to Monitor Linux

Mon, 14 Sep 2020 02:11:15 GMT

Being a Linux administrator is not an easy job. It takes lot of time, patience, and hard work to keep the systems up and running. But Linux System Admins can take some breather as they have some help in the form of command line monitoring tools. These tools help them to keep a tab on the Linux server performances and fix anything if found abnormal. In this article, we will look at the top 12 command line tools to monitor Linux performance.

1) Top

Without any doubt the top command is the number one command line tool to monitor Linux. It is one of the most widely used commands by Linux system administrators all over the world. It quickly provides details about all running processes in an ordered list. The list also keeps updating in real time. Not only the process names, it also displays the memory usage and CPU usage etc.

Also Read: 25 Top Command Examples to Monitor Linux Server Performance

2 ) vmstat

vmstst is the command line utility that occupies the 2nd position in our list. Its main task is used to display virtual memory statistics. It also helps you to display various information including all system processes, CPU activity, paging, block IO, kernel threads and disks etc. vmstat is the part of default installation in almost all the Linux distribution, so it is available straight way after the installation.

3) lsof

If you want to look at all the files currently opened in the system, then you need to make use of the lsof command. It is also used to monitor all processes currently in use. One of the major advantages of this command is that it helps administrators to see the files currently in use when a disk cannot be unmounted. Using this command, these files can be identified easily. lsof command is not available after the default Linux OS installation, so first we have to install it using following command:

For CentOS / RHEL

$ sudo yum install -y lsof              // CentOS 7 / RHEL 7 or before
$ sudo dnf install -y lsof              // CentOS 8 / RHEL 8

For Ubuntu / Debian

$ apt-get install -y lsof
Or
$ apt-get install -y lsof

To use lsof commmand, type lsof and hit enter

Also Read : 18 Quick ‘lsof’ command examples for Linux Geeks

4) tcpdump

Tcpdump is another command line utility that allows Linux system administrators and network engineers to monitor all TCP/IP packets transferred over a network. Using tcpdump, one can also save all the packets in a separate file for analysis in the future.

Tcpdump is not part of default OS installation, so before start using it first install via following commands:

$ sudo yum install tcpdump -y    // CentOS 7 / RHEL 7 or before
$ sudo dnf install tcpdump -y    //CentOS 8 / RHEL 8
$ sudo apt install tcpdump -y    // Ubuntu / Debian

To Start capturing the packets on specific interface, run the following command,

# tcpdump -i enp0s3

Also Read: How to capture and analyze packets with tcpdump command on Linux

5) netstat

Netstat is one of the oldest command line utility used for network troubleshooting. Using netstat we can easily find network connections, routing tables, Ethernet card statistics and masquerade connections. In other words, we can say, it also helps you troubleshoot any network related issues quickly. In the latest Linux distributions, netstat is not the part of default installation. Use beneath command to install it on different Linux distributions.

For CentOS 8 / RHEL 8

$ sudo dnf install net-tools -y

For Ubuntu / Debian

$ sudo apt install -y net-tools

Run following command to list all tcp connections on your Linux system,

# netstat -tunlp

6) htop

htop command is another feature-rich command line utility that offers real-time monitoring of various vital resources in the Linux system. Compared to the top command, htop is a much-improvised version and even provides color coded output for easier understanding. It also supports both horizontal and vertical viewing and also allows administrators to manage processes as well.

To Install htop on Linux systems, execute following command,

$ sudo yum install -y htop              // CentOS 7 / RHEL 7 or before
$ sudo dnf install -y htop              // CentOS 8 / RHEL 8 or before
$ sudo apt install -y htop              // Ubuntu / Debian

Sample output of htop command:

$ htop

7) iotop

iotop is another free command line utility that allows admins to monitor disk I/O usage details. Even though it is similar to the top and htop command, one of the main advantages of iotop is that it provides a detail for a specific thread or a process in the system. Hence, system administrators can easily identify the process that is causing a lot of I/O rewrites to the server.

To Install iotop on different Linux distributions, run

$ sudo dnf install -y iotop    // CentOS 8 / RHEL 8
$ sudo yum install -y iotop    // CentOS 7 / RHEL 7
$ sudo apt install -y iotop    // Ubuntu / Debian

To start using iotop utility, type iotop on command line and hit enter,

$ iotop

8) iostat

As the name suggests, iostat is a Linux command line tool that provides detailed statistics about the systems input/output for both devices and partitions. Linux system administrators can also use this command line tool to monitor the performance of both local and remote disks (NFS) as well.

Sample output of iostat is shown below:

$ iostat

9) goaccess

Goaccess is an open-source real time log viewer and analyzer command line tool. It is available for almost all Linux distributions. It is can used to view real time logs for all web servers (Nginx , Apache, Amazon S3 and CloudFront etc).

Installation of Goaccess on CentOS 8 / RHEL 8

$ wget https://pkgs.dyn.su/el8/base/x86_64/goaccess-1.3-3.el8.x86_64.rpm
$ sudo dnf localinstall goaccess-1.3-3.el8.x86_64.rpm  -y

For Ubuntu / Debian

$ sudo apt get install goaccess

To analyze real time Apache web server’s log , run following goaccess command

$ sudo goaccess /var/log/httpd/access_log --log-format=COMBINED

10) glances

Glances is a free and cross-platform command line tool to monitor linux system. Glances is available for almost all the Linux distributions and can collect system statistics apart from the monitoring. It is written in python and makes use of psutil library to retrieve useful information from the system. Glances can be used in three different ways:

Standalone command line utility
Client and Server
Web Server

To Install glances on CentOS / RHEL system, run

$ sudo dnf install -y glances            // CentOS 8 / RHEL 8
$ sudo yum install -y glances            // CentOS 7 / RHEL 7

To Install Glances on Ubuntu / Debian system, run

$ sudo apt get install -y glances

To start using glances, type glances command,

$ glances

11) iptraf

Next in our list is iptraf, a command line utility that provides real time monitoring of Ethernet cards and networks. Using iptraf, system and network admins can gather a lot of details including:

TCP traffic summary
ICMP
IP traffic
UDP traffic
Interface activity
Statistical breakdowns
Detailed interface statistics

Compared to other commands like iftop, we can say that iptraf provides a more detailed breakdown and statistics. Iptraf is not the part of default OS installation, so to install it run following command,

For CentOS / RHEL

$ sudo dnf install -y iptraf-ng
Or
$ sudo yum install -y iptraf-ng

For Ubuntu / Debian

$ sudo apt install -y iptraf-ng

To start iptraf utility, type iptraf-ng command and choose the ethernet card,

$ iptraf-ng

12) Iftop

The command line tool that occupies the 12th position in our list is the iftop tool. It is a simple command line tool that shows you bandwidth usage on the Ethernet cards of your Linux system. System and network admins use this tool for bandwidth monitoring. With iftop you can view both the source and destination in the first network interface it listens to.

To install iftop on CentOS / RHEL systems, run following command

$ sudo dnf install -y iftop
$ sudo yum install -y iftop

For Ubuntu / Debian systems, run

$ sudo apt install -y iftop

Type iftop to start this utility, example is shown below:

$ iftop

The post Top 12 Command Line Tools to Monitor Linux first appeared on Linuxtechi.

How to Add Remote Linux Host to Cacti for Monitoring

Wed, 09 Sep 2020 06:20:34 GMT

In the previous guide, we demonstrated how you can install Cacti monitoring server on CentOS 8. This tutorial goes a step further and shows you how you can add and monitor remote Linux hosts on Cacti. We are going to add remote Ubuntu 20.04 LTS and CentOS 8 systems to the cacti server for monitoring.

Let’s begin.

Step 1) Install SNMP service on Linux hosts

SNMP, short for Simple Network Management Protocol is a protocol used for gathering information about devices in a network. Using SNMP, you can poll metrics such as CPU utilization, memory usage, disk utilization, network bandwidth etc. This information will, later on, be graphed in Cacti to provide an intuitive overview of the remote hosts’ performance.

With that in mind, we are going to install and enable SNMP service on both Linux hosts:

On Ubuntu 20.04

To install snmp agent, run the command:

$ sudo apt install snmp snmpd -y

On CentOS 8

$ sudo dnf install net-snmp net-snmp-utils -y

SNMP starts automatically upon installation. To confirm this, confirm the status by running:

$ sudo systemctl status snmpd

If the service is not running yet, start and enable it on boot as shown:

$ sudo systemctl start snmpd

We can clearly see that the service is up and running. By default, SNMP runs listens on UDP port 161, You can verify this using the netstat command as shown.

$ sudo netstat -pnltu | grep snmpd

Step 2) Configuring SNMP service

So far, we have succeeded in installing snmp service and confirmed that it is running as expected. The next course of action is to configure the snmp service so that data can be collected and shipped to the Cacti service.

The configuration file is located at /etc/snmp/snmpd.conf

For Ubuntu 20.04

We need to configure a few parameters. First, locate the sysLocation and sysContact directives. These define your Linux client’s Physical location.

Therefore, feel free to provide your client’s location.

Next, locate the agentaddress directive. This refers to the IP address and the port number that the agent will listen to.

Adjust the directive as shown below where 192.168.2.106 is my client system’s address.

agentaddress  udp:192.168.2.106:161

The directive will now allow the system’s local IP to listen to any snmp requests. Next up, add the view directive below above the other view directives:

view     all      included     .1      80

Next, change the rocommunity attribute shown below

rocommunity  public default -V systemonly
to:
rocommunity  public default -V all

Finally, to ensure the snmp service is working as expected, run the command below on the Linux host.

$ sudo snmpwalk -v 1 -c public -O e 192.168.2.106

You should get some massive output as shown.

For CentOS 8

In CentOS 8, the configuration is slightly different. First, locate the line that begins with the com2sec directive as shown:

We will specify a new security name known as AllUser and delete the notConfigUser as shown:

Next, locate the line that starts with the group directive as shown.

We will modify the second attribute and specify AllGroup as the group name and AllUser as the security name as previously defined.

In the view section, add this line

view    AllView         included        .1

Finally, locate the line beginning with the access directive.

Modify it as shown:

Save the changes and exit the configuration file. Restart snmpd daemon for the changes to take effect

$ sudo systemctl restart snmpd

Also, enable the service to start on boot.

$ sudo systemctl enable snmpd

Once again, verify if the snmp configuration is working as expected using the snmpwalk command:

$ sudo snmpwalk -v 2c -c public -O e 127.0.0.1

Perfect! everything seems to be running as expected.

Step 3) Configure the firewall rules for snmp

Next, we need to open udp port 161 to allow snmp traffic on both the Cacti server and Linux hosts.

For Ubuntu 20.04 host

Run the beneaths commands to allow udp port 161 in firewall,

$ sudo ufw allow 161/udp
$ sudo ufw reload

For CentOS 8 host

For CentOS 8 client and the Cacti server that also runs on CentOS 8, invoke the following commands:

$ sudo firewall-cmd --add-port=161/udp --zone=public --permanent
$ sudo firewall-cmd --reload

Head over to the Cacti server and run the commands shown to confirm that snmp is shipping metrics from the remote clients.

$ sudo snmpwalk -v 1 -c public -O e 192.168.2.106  # Ubuntu
$ sudo snmpwalk -v 2c -c public -O e 192.168.2.104 # CentOS

Great! This confirms that the Cacti server is receiving system metrics from the remote Linux systems.

Step 4) Adding remote Linux host to Cacti

This is the last section where you have to add your remote Linux hosts. So, log in to the Cacti server and click on ‘Create devices’ as shown.

In my case, my Ubuntu remote host was already detected by Cacti and listed as shown.

Click on your device and be keen to notice the SNMP information at the very top as shown.

Next, scroll down and click on the ‘Save’ button.

If your device is not listed, simply click on ‘Create’ > ‘Devices’ and fill out the details of your device like in the CentOS8 host as shown.

Once the device is added, click on the ‘Graphs’ tab.

On the next page, select your device’s name

Scroll all the way to the bottom and click the ‘Create’ button.

Wait about 10-20 minutes for the graphs to start being populated. Finally, you will start noticing the remote host’s statistics being graphed as shown.

And this brings a conclusion to this article. We are glad you were able to follow along the way. Do let us know how it went and we will gladly help out in case of any issues.

The post How to Add Remote Linux Host to Cacti for Monitoring first appeared on Linuxtechi.

How to Install Zimbra Mail Server on CentOS 8 / RHEL 8

Mon, 07 Sep 2020 01:49:29 GMT

Mail server is one of the important server for any organization as all the communication are done via emails. There are number free and enterprise mail servers available in the IT world. Zimbra is one of the high rated mail server that comes in open source and enterprise edition. In this article, we touch base on how to install and configure single node open-source Zimbra mail server on CentOS 8 / RHEL 8 system.

Zimbra is also known as Zimbra Collaboration Suite (ZCS) because it consists numbers of components like MTA (postfix), Database (MariaDB), LDAP and MailboxdUI etc. Below is the architecture of Zimbra

Minimum System Requirements for Open Source Zimbra Mail Server

Minimal CentOS 8/ RHEL 8
8 GB RAM
64-bit Intel / AMD CPU (1.5 GHz)
Separate Partition as /opt with at least 5 GB free space
Fully Qualified Domain Name (FQDN), like ‘zimbra.linuxtechi.com’
Stable Internet Connection with Fixed Internal / Public IP

Following are my Zimbra Lab Setup details:

Hostname: zimbra.linuxtechi.com
Domain: linuxtechi.com
IP address: 192.168.1.60
DNS Server: 192.168.1.51
SELinux : Enabled
Firewall : Enabled

Before jumping into the installation steps of Zimbra, let’s verify DNS records (A & MX) for our Zimbra Server, Login to your CentOS 8 / RHEL 8 system and use dig command to query dns records

Note: In case dig command is not available then install ‘bind-utils’ package

Run following dig command to query A record of our Zimbra server

[root@zimbra ~]# dig -t A zimbra.linuxtechi.com

Run following dig command to query MX record for our domain ‘linuxtechi.com’

[root@zimbra ~]# dig -t MX linuxtechi.com

Above outputs confirm that DNS records are configured correctly for our Zimbra mail server.

Note: Before starting Zimbra installation, please make sure no MTA ( or mail server) configured on the system. In case it is installed then first disable its service and remove its package

# systemctl stop postfix
# dnf remove postfix -y

Let’s dive into Zimbra installation steps,

Step 1) Apply Updates, add entry in hosts file and reboot your system

Add the hostname entry in hosts file, run the following echo command,

[root@zimbra ~]# echo "192.168.1.60  zimbra.linuxtechi.com" >> /etc/hosts

Run the beneath command to apply all the available updates,

[root@zimbra ~]# dnf update -y

Once all the updates have been installed then reboot your system once.

[root@zimbra ~]# reboot

Step 2) Download Open source Zimbra Collaboration suite

As we discussed above, Zimbra comes in two editions, so use the following URLs to download

To Download it from the command line, run following commands,

[root@zimbra ~]# dnf install wget tar perl net-tools nmap-ncat -y
[root@zimbra ~]# wget https://files.zimbra.com/downloads/8.8.15_GA/zcs-8.8.15_GA_3953.RHEL8_64.20200629025823.tgz

Step 3) Start Zimbra Installation via installation script

Once the compressed Zimbra tar file is downloaded in step 2 then extract it in your current working directory using tar command,

[root@zimbra ~]# tar zxpvf zcs-8.8.15_GA_3953.RHEL8_64.20200629025823.tgz
[root@zimbra ~]# ls -l
total 251560
-rw-------. 1 root root      1352 Aug 30 10:46 anaconda-ks.cfg
drwxrwxr-x. 8 1001 1001      4096 Jun 29 11:39 zcs-8.8.15_GA_3953.RHEL8_64.20200629025823
-rw-r--r--. 1 root root 257588163 Jul  1 07:16 zcs-8.8.15_GA_3953.RHEL8_64.20200629025823.tgz
[root@zimbra ~]#

Go to the extracted directory and execute install script to begin the installation

[root@zimbra ~]# cd zcs-8.8.15_GA_3953.RHEL8_64.20200629025823
[root@zimbra zcs-8.8.15_GA_3953.RHEL8_64.20200629025823]# ls -l
total 24
drwxrwxr-x. 2 1001 1001  127 Jun 29 11:39 bin
drwxrwxr-x. 2 1001 1001   31 Jun 29 11:39 data
drwxrwxr-x. 3 1001 1001   34 Jun 29 11:39 docs
-rwxr-xr-x. 1 1001 1001 8873 Jun 29 11:39 install.sh
drwxrwxr-x. 3 1001 1001   18 Jun 29 11:39 lib
drwxrwxr-x. 3 1001 1001 4096 Jun 29 11:39 packages
-rw-rw-r--. 1 1001 1001  369 Jun 29 11:39 readme_binary_en_US.txt
-rw-rw-r--. 1 1001 1001  428 Jun 29 11:39 README.txt
drwxrwxr-x. 3 1001 1001   76 Jun 29 11:39 util
[root@zimbra zcs-8.8.15_GA_3953.RHEL8_64.20200629025823]# ./install.sh

Output of install script would be something like below

Press ‘Y’ to accept the license agreement

In the next screen, press ‘Y’ to configure Zimbra package repository and install its components.

In the next following screen, press ‘Y’ to modify the system,

Once we press ‘Y’, it will start downloading and installing the Zimbra and its components. After the successful installation we will get the following screen:

As we can see above, admin user’s password is not set, so press 7 and then 4 to assign password to admin user.

Once the password is set then press ‘r’ to go previous screen and then press ‘a’ to apply changes.

Once all the configurations are completed and Zimbra services are started successfully then we will get following screen:

Perfect, above confirms that we have successfully installed Zimbra mail server. Before accessing its admin and web client portal, allow the following ports in OS firewall (In case firewall is disabled then you skip this step)

[root@zimbra ~]# firewall-cmd --add-service={http,https,smtp,smtps,imap,imaps,pop3,pop3s} --permanent
success
[root@zimbra ~]# firewall-cmd --add-port 7071/tcp --permanent
success
[root@zimbra ~]# firewall-cmd --add-port 8443/tcp --permanent
success
[root@zimbra ~]# firewall-cmd --reload
success
[root@zimbra ~]#

Step 4) Access Zimbra Mail Server Admin portal and Web Client

To Access Admin Portal, use the following URL:

https://zimbra.linuxtechi.com:7071/

Use the username as ‘admin’ and password that we set during the installation

Click on ‘Sign In’

Note: After Zimbra installation on CentOS 8 / RHEL 8 system, I have found amavis was not running and when I checked Zimbra logs (/var/log/zimbra.log) then I have found below error:

Sep  5 09:53:05 zimbra amavis[29288]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1 with IPv4
Sep  5 09:53:05 zimbra amavis[29288]: Net::Server: Binding to TCP port 10024 on host ::1 with IPv6
Sep  5 09:53:05 zimbra amavis[29288]: (!)Net::Server: 2020/09/05-09:53:05 Can't connect to TCP port 10024 on ::1 [Cannot assign requested address]\n  at line 64 in file /opt/zimbra/common/lib/perl5/Net/Server/Proto/TCP.pm
Sep  5 09:53:05 zimbra amavis[29288]: Net::Server: 2020/09/05-09:53:05 Server closing!

I resolved amavis issue by adding the following parameter in /opt/zimbra/conf/amavisd.conf file

$inet_socket_bind = '127.0.0.1';

and restarted the amavis service using following command,

[zimbra@zimbra ~]$ zmamavisdctl restart

To access web client, use the following URL:

https://zimbra.linuxtechi.com

After Entering credentials, click on ‘Sign In’

Step 5) Manage Zimbra from Command Line

All most all the Linux geeks prefer command line to manage their servers, so Zimbra can also be managed from command line with zmcontrol utility. All Zimbra related admin and operations task are performed with Zimbra user.

[root@zimbra ~]# su - zimbra
Last login: Sat Sep  5 09:51:41 BST 2020 on pts/1
[zimbra@zimbra ~]$ zmcontrol status
Host zimbra.linuxtechi.com
        amavis                  Running
        antispam                Running
        antivirus               Running
        dnscache                Running
        imapd                   Running
        ldap                    Running
        logger                  Running
        mailbox                 Running
        memcached               Running
        mta                     Running
        opendkim                Running
        proxy                   Running
        service webapp          Running
        snmp                    Running
        spell                   Running
        stats                   Running
        zimbra webapp           Running
        zimbraAdmin webapp      Running
        zimlet webapp           Running
        zmconfigd               Running
[zimbra@zimbra ~]$

If you want to restart Zimbra service then run,

[zimbra@zimbra ~]$ zmcontrol restart

Zimbra logs are stored in ‘/var/log/zimbra.log’ file. We should always refer this file while troubleshooting. Log files for individual components are stored under ‘/opt/zimbra/log’ directory.

[zimbra@zimbra ~]$ ls -l /opt/zimbra/log | more
total 6244
-rw-r-----. 1 zimbra zimbra  194710 Sep  5 12:40 access_log.2020-09-05
-rw-r-----. 1 zimbra zimbra       0 Sep  5 09:11 activity.log
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:58 amavis-mc.pid
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:58 amavisd.pid
-rw-r-----. 1 zimbra zimbra   16112 Sep  5 12:40 audit.log
-rw-r-----. 1 zimbra zimbra   10999 Sep  5 12:49 clamd.log
-rw-rw-r--. 1 zimbra zimbra       6 Sep  5 09:53 clamd.pid
-rw-r-----. 1 zimbra zimbra       0 Sep  5 09:11 ews.log
-rw-r-----. 1 zimbra zimbra    3427 Sep  5 11:54 freshclam.log
-rw-rw----. 1 zimbra zimbra       6 Sep  5 09:53 freshclam.pid
-rw-r-----. 1 root   root    553466 Sep  5 12:47 gc.log
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:54 httpd.pid
-rw-r-----. 1 zimbra zimbra    1241 Sep  5 09:54 httpd_error.log.2020-09-05
-rw-r-----. 1 zimbra zimbra       0 Sep  5 09:13 imapd-audit.log
-rw-r-----. 1 zimbra zimbra  247177 Sep  5 12:49 imapd.log
-rw-r-----. 1 zimbra zimbra     159 Sep  5 09:54 imapd.out
-rw-r-----. 1 zimbra zimbra       5 Sep  5 09:54 imapd.pid
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:51 logswatch.pid
-rw-r-----. 1 zimbra zimbra  584562 Sep  5 12:48 mailbox.log
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:51 memcached.pid
-rw-rw----. 1 zimbra zimbra   40340 Sep  5 12:48 myslow.log
-rw-rw----. 1 zimbra zimbra       6 Sep  5 09:51 mysql.pid
-rw-rw----. 1 zimbra zimbra   18266 Sep  5 09:51 mysql_error.log
-rw-r-----. 1 zimbra zimbra   20130 Sep  5 12:24 nginx.access.log
-rw-r-----. 1 zimbra zimbra   12652 Sep  5 12:24 nginx.log
-rw-r--r--. 1 root   root         6 Sep  5 09:51 nginx.pid
-rw-r-----. 1 zimbra zimbra       6 Sep  5 09:53 opendkim.pid
-rw-r-----. 1 zimbra zimbra       0 Sep  5 09:11 searchstat.log

Step 6) Uninstallation of Zimbra Server

For any reasons, if you wish to uninstall Zimbra server from your CentOS 8 / RHEL 8 system then go to Zimbra extracted folder and execute install script with ‘-u’ parameter, example is shown below:

[root@zimbra ~]# cd zcs-8.8.15_GA_3953.RHEL8_64.20200629025823
[root@zimbra zcs-8.8.15_GA_3953.RHEL8_64.20200629025823]# ./install.sh -u

That’s all from this tutorial, I hope you manage to install open source Zimbra server on your system by referring these steps. Please do share your feedback and comments.

The post How to Install Zimbra Mail Server on CentOS 8 / RHEL 8 first appeared on Linuxtechi.

How to Install Cacti Monitoring Tool on CentOS 8 / RHEL 8

Wed, 02 Sep 2020 07:18:13 GMT

Cacti is a free and open source front-end network monitoring tool used to monitor and graph time-series metrics of various IT resources in your LAN. It uses the RRDtool to poll services at specified intervals and thereafter represent them on intuitive graphs.

Cacti monitors various metrics such as CPU, memory and bandwidth utilization, disk space, filesystems and running processes to mention a few. You can monitor devices such as servers, routers, switches and even firewalls. Additionally, you can configure alerts such that in case of system downtime, you can receive notifications on email. In this guide, we will walk you through the installation of the Cacti monitoring tool on CentOS 8 / RHEL 8. At the time of penning down this tutorial, the latest Cacti version is version 1.2.14.

Step 1) Install Apache web server

Cacti is a web-based graphing tool, and therefore, we need to install a web server on which the monitoring tool will run on. Here, we are going to install the Apache web server. To do so, execute the command:

$ sudo dnf install httpd -y

Step 2 ) Install PHP and additional PHP extensions

The front-end of the Cacti monitoring tool is purely PHP driven and with that, we need to install PHP and the required PHP modules. Therefore, execute the command:

$ sudo dnf install -y php php-xml php-session php-sockets php-ldap php-gd php-json php-mysqlnd php-gmp php-mbstring php-posix php-snmp php-intl

Step 3) Install MariaDB database server

During installation, Cacti requires its own database to store its files. Additionally, it needs a database for storing all the required data that is needed in populating graphs.

MariaDB is a fork and a drop-in replacement for MySQL. It’s considered more robust and feature-rich and while MySQL would still work, MariaDB comes highly recommended. To install the MariaDB server, run the command:

$ sudo dnf install -y mariadb-server mariadb

Step 4) Install SNMP and RRD tool

Next, we are going to install SNMP and RRDtool which are essential in gathering and processing system metrics.

$ sudo dnf install -y net-snmp net-snmp-utils net-snmp-libs rrdtool

Step 5) Start and enable services

Having installed all the necessary services required for Cacti to run, we are going to start them as shown:

$ sudo systemctl start httpd
$ sudo systemctl start snmpd
$ sudo systemctl start mariadb

Additionally, ensure to enable them on boot, such that they automatically start upon booting or a reboot.

$ sudo systemctl enable httpd
$ sudo systemctl enable snmpd
$ sudo systemctl enable mariadb

Step 6) Create a database for Cacti

In this step, we are going to create a database and user for cacti and later grant all privileges to the cacti user. Run the following commands:

CREATE DATABASE cactidb;
GRANT ALL ON cactidb.* TO cacti_user@localhost IDENTIFIED  BY ‘cactipassword’;
FLUSH PRIVILEGES;
EXIT;

Be sure to note down the database name, user and password as these will be required later on in the installation process.

Next, we need to import the mysql_test_data_timezone.sql to mysql database as shown.

$ mysql -u root -p mysql < /usr/share/mariadb/mysql_test_data_timezone.sql

Then log in to mysql database and grant the cacti user access to the mysql.time_zone_name table.

GRANT SELECT ON mysql.time_zone_name TO cacti_user@localhost;
FLUSH PRIVILEGES;
EXIT;

Some database tuning is recommended for optimum performance. Append the following lines in the mariadb-server.cnf file under the [ mysqld ] section as shown.

$ sudo vi /etc/my.cnf.d/mariadb-server.cnf
............
collation-server=utf8mb4_unicode_ci
character-set-server=utf8mb4
max_heap_table_size=32M
tmp_table_size=32M
join_buffer_size=64M
# 25% Of Total System Memory
innodb_buffer_pool_size=1GB
# pool_size/128 for less than 1GB of memory
innodb_buffer_pool_instances=10
innodb_flush_log_at_timeout=3
innodb_read_io_threads=32
innodb_write_io_threads=16
innodb_io_capacity=5000
innodb_file_format=Barracuda
innodb_large_prefix=1
innodb_io_capacity_max=10000
..............

Save and exit the configuration file

Step 7) Installing and configuring Cacti monitoring tool

With the database in place and all the other prerequisites having been fulfilled, let’s now install Cacti.

Cacti package is not available in default CentOS 8 / RHEL 8 repositories, it is available in EPEL repository. So run below command to enable epel repo

$ sudo dnf install epel-release -y

To install Cacti monitoring tool, run the command:

$ sudo dnf install cacti -y

After the installation, you can confirm the installation of cacti by running the command:

$ rpm -qi cacti

You should get a detailed output showing the version, release, size and Vendor to mention a few of the Cacti package.

Next, import the default cacti database tables to the cacti database that was created earlier in step 6. To find out the path of the default database, run:

$ rpm -ql cacti | grep cacti.sql

Once you get the path, import the default database using the command:

$ mysql -u root -p cactidb < /usr/share/doc/cacti/cacti.sql

Next, edit the cacti configuration file and specify the database details as shown:

$ sudo vim /usr/share/cacti/include/config.php

Set the database name, username and password and leave the rest of the options as they are.

Save the changes and exit the configuration file. Thereafter, set the timezone by editing the php.ini file as shown.

$ sudo vim /etc/php.ini
................................. 
date.timezone = Asia/Dubai
memory_limit = 512M
max_execution_style = 60
.................................

Save and exit the file.

Next, edit the cron entry as shown

$ sudo vim /etc/cron.d/cacti

Uncomment this line to ensure the Cacti polls data every 5 minutes and save the configuration

*/5 * * * *   apache /usr/bin/php /usr/share/cacti/poller.php > /dev/null 2>&1

Next, modify Apache’s configuration file to enable remote installation of Cacti.

$ sudo vim /etc/httpd/conf.d/cacti.conf

Modify the following httpd ACLs to grant access to remote users

Change Require host localhost to Require all granted

Modify Allow from localhost to Allow from [network subnet]

For the network subnet, be sure to specify your own network subnet. For our case, the subnet is 192.168.2.0/24

For all the changes made to come into effect, execute:

$ sudo systemctl restart httpd
$ sudo systemctl restart php-fpm

Step 8) Configure firewall rules for Cacti

Before finally setting up Cacti, allow HTTP service on your firewall as shown:

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --reload

Step 9) Set up Cacti via the browser

To finish setting up Cacti, visit your server’s IP as shown

http://server-ip/cacti

You will get the page displayed as shown. Log in using the credentials shown

Username: admin

Password: admin

Click ‘Login’ to proceed.

Next, you will be required to change the default login password by providing a password of your own. Be sure that you provide a strong password (with a combination of uppercase, lowercase, numeric and special characters). Then click ‘Save’.

In the next step, check off the ‘Accept GPL license agreement’ checkbox and click on ‘Begin’.

Cacti will perform pre-installation checks, confirming if the required PHP modules are installed and the correct database settings have been configured. If everything looks good, click on ‘Next’. If something’s amiss, click on the ‘Previous’ button and go back to the configuration file and add what’s missing.

Thereafter, select the ‘New Primary Server’ option for installation and also ensure that the database connection details are correct before proceeding.

The next step probes for any directory issues and ensures that the correct permissions are in place. If all is good, click ‘Next’, otherwise click ‘Previous’ and rectify any issues.

Next, the installer checks to see if all the binary paths of the necessary packages are installed.

The latest version of Cacti has introduced another crucial step and that is the validation of data input methods. This gives you a few steps to follow after the installation of cacti to whitelist data input methods. Read through the instructions carefully and check the ‘I have read this statement’ button.

In the next step, select the cron interval for scanning devices and define your network subnet as shown. Then click ‘Next’.

Cacti ships with templates that give you the ability to monitor and graph an assortment of devices in your network including Cisco devices (routers and switches), Linux and Windows machines. By default, all options are checked to include all the templates that you would require. If you are happy with that, simply click ‘Next’.

Thereafter, the installer will check if the database collation is UTF8 compliant. Click ‘Next’.

To begin the installation, click on the ‘Confirm Installation’ checkbox and click on ‘Install’.

The installation of Cacti will begin and will take roughly 5 minutes. Feel free to take a break and do a bit of stretching,

Once the installation of the required packages is complete, click on the ‘Get Started’ button.

This will take you directly to the Cacti dashboard as shown.

Cacti will, by default, create resource utilization graphs for your local server on which Cacti is installed. To access the graphs, navigate through:

Graph –> Default Tree –> Local –> Choose Your Device.

Wait for about 10 minutes for the graphs to be populated.

And this brings us to the end of this tutorial. Personally, I have used Cacti to monitor a range of devices and I can attest to its efficiency in monitoring several devices and sending alerts in the event of system downtime.

The post How to Install Cacti Monitoring Tool on CentOS 8 / RHEL 8 first appeared on Linuxtechi.

How to Change File/Group Owner with chown Command in Linux

Mon, 31 Aug 2020 04:52:52 GMT

Short for change ownership, Chown command is a command-line utility that is used to change the user or group ownership of a file or directory and even links. The Linux philosophy is such that every file or directory is owned by a specific user or group with certain access rights.

Using different examples, we will try and see the various use cases of the chown command. Chown command employs quite a simple and straight forward syntax.

$ chown OPTIONS USER: GROUP file(s)

Let’s briefly flesh out the parameters:

The attribute USER refers to the username of the user that will own the file. You can specify either the username or the UID ( User ID). Meanwhile, the GROUP option indicates the name of the new group that the file will acquire after running the command. The file option represents a regular file or a directory or even a symbolic link. These are the three entities whose permissions can be altered.

A few points to note:

1) When the USER option is specified alone, ownership of the file/directory changes to that of the specified user while the group ownership remains unchanged. Here’s an example:

$ chown john file1.txt

In the above command, user ownership of the file file1.txt changes from the current user to the user john.

2) If the USER option is proceeded by a full colon i.e. USER: and the group name is not provided, then the user takes ownership of the file but the file’s group ownership switches to the user’s login group. For example:

$ chown john: file1.txt

In this example, the user john takes ownership of the file file1.txt, but the group ownership of the file changes to john’s login group.

3) When both the user and group options are specified separated by a colon i.e USER:GROUP – without any spaces therein – the file takes ownership of the new user and the group as specified

$ chown john:john file1.txt

In the above example, the file takes the user and group ownership of user john.

4) When the USER option is left out and instead the group option is preceded by the full colon :GROUP then, only the group ownership of the file changes.

How to view file permissions

To view file permissions, simply use the ls -l command followed by the file name

$ ls -l filename

For example:

$ ls -l file1.txt

From the output, we can see that the file is owned by user linuxtechi which and belongs to the group linuxtechi in the 3rd and 4th columns respectively.

How to change file owner with chown command

Before changing permissions, always invoke sudo if you are not working as the root user. This gives you elevated privileges to change user and group ownership of a file.

To change file ownership, use the syntax:

$ sudo chown user filename

For example,

$ sudo chown james file1.txt

From the output, you can clearly see that the ownership of the file has changed from linuxtechi to user james.

Alternatively, instead of using the username, you can pass the UID of the user instead. To get the UID, view the /etc/passwd file.

$ cat /etc/passwd | grep username

From the example below, we can see that the UID of user linuxtechi is 1002

To change the file ownership back to linuxtechi user, we shall execute the command:

$ sudo chown 1002 file1.txt

How to change the group owner with chown command

As earlier discussed, to change the group owner of a file, omit the user and simply prefix the group name with a full colon.

$ sudo chown :group file

For example, to change the group owner of file1.txt from linuxtechi to docker, we executed the command:

$ sudo chown :docker file1.txt

How to change both file owner and group owner of a file

If you want to change both the owner and group that a file belongs to, specify both the user and group options separated by a full colon as shown in the syntax below. Be sure that there are no spaces between the options and the colon.

$ sudo chown user:group filename

For example, the following command changes the ownership of the file file1.txt to user james and group redis as verified using the ls command.

$ sudo chown james:redis file1.txt

How to recursively change file ownership

When applying permissions to directories, you might want to apply changes recursively i.e make the ownership changes to descend and apply to files and sub-directories. To achieve this, user the recursive option -R or –recursive directive.

$ sudo chown -R user:group directory

For example, the command below assigns all files and folders in the /var/www directory ownership to the www-data group.

$ sudo chown -R :www-data /var/www

The example below assigns ownership of the directory reports alongside all the files and folders in the directory to the user linuxtechi.

$ sudo chown -R linuxtechi reports

How to change ownership using a reference file

Lastly, there’s a nifty way that you can use to change ownership of a file, and that is by using a reference file. Using the chown command, you can change the user and group ownership of a file using another file as the point of reference.

The syntax is shown below:

$ chown –reference=ref_file file

Suppose you want to assign user and group ownership of file1.txt to another file file2.txt. How would you go about it? This is illustrated in the command below.

$ chown --reference=file1.txt file2.txt

The output above confirms that file2.txt inherits the user and group ownership of file1.txt.In the command, file1.txt is the reference file.

Conclusion

Chown command is a powerful tool that is used for managing file and directory ownership. For additional information, check out the chown man pages.

$ man chown

Also Read : Linux Zip and Unzip Command with Examples

The post How to Change File/Group Owner with chown Command in Linux first appeared on Linuxtechi.

How to Configure NFS based Persistent Volume in Kubernetes

Wed, 26 Aug 2020 06:07:17 GMT

It is recommended to place pod’s data into some persistent volume so that data will be available even after pod termination. In Kubernetes (k8s), NFS based persistent volumes can be used inside the pods. In this article we will learn how to configure persistent volume and persistent volume claim and then we will discuss, how we can use the persistent volume via its claim name in k8s pods.

I am assuming we have a functional k8s cluster and NFS Server. Following are details for lab setup,

NFS Server IP = 192.168.1.40
NFS Share = /opt/k8s-pods/data
K8s Cluster = One master and two worker Nodes

Note: Make sure NFS server is reachable from worker nodes and try to mount nfs share on each worker once for testing.

Create a Index.html file inside the nfs share because we will be mounting this share in nginx pod later in article.

[kadmin@k8s-master ~]$ echo "Hello, NFS Storage NGINX" > /opt/k8s-pods/data/index.html

Configure NFS based PV (Persistent Volume)

To create an NFS based persistent volume in K8s, create the yaml file on master node with the following contents,

[kadmin@k8s-master ~]$ vim nfs-pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfs-pv
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Recycle
  storageClassName: nfs
  mountOptions:
    - hard
    - nfsvers=4.1
  nfs:
    path: /opt/k8s-pods/data
    server: 192.168.1.40

Save and exit the file

Now create persistent volume using above created yaml file, run

[kadmin@k8s-master ~]$ kubectl create -f nfs-pv.yaml
persistentvolume/nfs-pv created
[kadmin@k8s-master ~]$

Run following kubectl command to verify the status of persistent volume

[kadmin@k8s-master ~]$ kubectl get pv
NAME     CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM   STORAGECLASS   REASON   AGE
nfs-pv   10Gi       RWX            Recycle          Available           nfs                     20s
[kadmin@k8s-master ~]$

Above output confirms that PV has been created successfully and it is available.

Configure Persistent Volume Claim

To mount persistent volume inside a pod, we have to specify its persistent volume claim. So,let’s create persistent volume claim using the following yaml file

[kadmin@k8s-master ~]$ vi nfs-pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nfs-pvc
spec:
  storageClassName: nfs
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi

Save and exit file.

Run the beneath kubectl command to create pvc using above yaml file,

[kadmin@k8s-master ~]$ kubectl create -f nfs-pvc.yaml
persistentvolumeclaim/nfs-pvc created
[kadmin@k8s-master ~]$

After executing above, control plane will look for persistent volume which satisfy the claim requirement with same storage class name and then it will bind the claim to persistent volume, example is shown below:

[kadmin@k8s-master ~]$ kubectl get pvc nfs-pvc
NAME      STATUS   VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGE
nfs-pvc   Bound    nfs-pv   10Gi       RWX            nfs            3m54s
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ kubectl get pv nfs-pv
NAME     CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM             STORAGECLASS   REASON   AGE
nfs-pv   10Gi       RWX            Recycle          Bound    default/nfs-pvc   nfs                     18m
[kadmin@k8s-master ~]$

Above output confirms that claim (nfs-pvc) is bound with persistent volume (nfs-pv).

Now we are ready to use nfs based persistent volume nside the pods.

Use NFS based Persistent Volume inside a Pod

Create a nginx pod using beneath yaml file, it will mount persistent volume claim on ‘/usr/share/nginx/html’

[kadmin@k8s-master ~]$ vi nfs-pv-pod
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pv-pod
spec:
  volumes:
    - name: nginx-pv-storage
      persistentVolumeClaim:
        claimName: nfs-pvc
  containers:
    - name: nginx
      image: nginx
      ports:
        - containerPort: 80
          name: "nginx-server"
      volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: nginx-pv-storage

Save and close the file.

Now create the pod using above yaml file, run

[kadmin@k8s-master ~]$ kubectl create -f nfs-pv-pod.yaml
pod/nginx-pv-pod created
[kadmin@k8s-master ~]$
[kadmin@k8s-master ~]$ kubectl get pod nginx-pv-pod -o wide
NAME           READY   STATUS    RESTARTS   AGE   IP              NODE           NOMINATED NODE   READINESS GATES
nginx-pv-pod   1/1     Running   0          66s   172.16.140.28   k8s-worker-2   <none>           <none>
[kadmin@k8s-master ~]$

Note: To get more details about pod , kubectl describe pod <pod-name>

Above commands output confirm that pod has been created successfully. Now try to access nginx page using curl command

[kadmin@k8s-master ~]$ curl http://172.16.140.28
Hello, NFS Storage NGINX
[kadmin@k8s-master ~]$

Perfect, above curl command’s output confirms that persistent volume is mounted correctly inside pod as we are getting the contents of index.html file which is present on NFS share.

This concludes the article, I believe you guys got some basic idea on how to configure and use NFS based persistent volume inside Kubernetes pods.

Also Read : How to Setup Highly Available Kubernetes Cluster with Kubeadm

The post How to Configure NFS based Persistent Volume in Kubernetes first appeared on Linuxtechi.

How to Install Cockpit Web Console on Ubuntu 20.04 Server

Mon, 24 Aug 2020 03:18:10 GMT

Cockpit is a free and open source web console tool for Linux administrators and used for day to day administrative and operations tasks. Initially Cockpit was only available for RHEL based distributions but now a days it is available for almost for all Linux distributions. In this article we will demonstrate how to install Cockpit on Ubuntu 20.04 LTS Server (focal fossa) and what administrative tasks can be performed with Cockpit Web Console.

Installation of Cockpit on Ubuntu 20.04 LTS Server

Since Ubuntu 17.04, cockpit package is available in the default package repositories. So the installation has become straight forward using apt command,

$ sudo apt update
$ sudo apt install cockpit -y

Once cockpit package is installed successfully then start its service using the following systemctl command,

$ sudo systemctl start cockpit

Run the following to verify the status of cockpit service,

$ sudo systemctl status cockpit

Above output confirms that cockpit has been started successfully.

Access Cockpit Web Console

Cockpit listen its service on 9090 tcp port, in case firewall is configured on your Ubuntu server 20.04 then you have to allow 9090 port in firewall.

pkumar@ubuntu-20-04-server:~$ ss -tunlp | grep 9090
tcp   LISTEN  0       4096                  *:9090               *:*
pkumar@ubuntu-20-04-server:~$

Run following ‘ufw’ command to allow cockpit port in OS firewall,

pkumar@ubuntu-20-04-server:~$ sudo ufw allow 9090/tcp
Rule added
Rule added (v6)
pkumar@ubuntu-20-04-server:~$

Now access Cockpit web console using following url:

https://<Your-Server-IP>:9090

Use the root credentials or sudo user credentials to login, in my case ‘pkumar’ is the sudo user for my setup.

Perfect above screen confirms that we have successfully able to access and login cockpit dashboard. Let’s see what are the different administrative task that can be performed from this dashboard.

Administrative Task from Cockpit Web Console on Ubuntu 20.04 LTS Server

When we first time login to dashboard, it shows basic information about our system like package updates, RAM & CPU utilization and Hardware and system configuration etc.

1) Apply System Updates

One of important administrative task is to apply system updates, from cockpit web console we can easily do this, go to the ‘System Updates’ option where we you will get the available updates for your system, example is shown below,

If you wish to install all available updates, then click on “Install All Updates” option

We will get the message on the screen to reboot the system after applying the updates. So, go ahead and click on “Restart System”

2) Managing KVM Virtual Machine with cockpit

It is also possible that we can manage KVM VMs using cockpit web console but by default ‘Virtual Machine’ option is not enabled. To enable this option install ‘cockpit-machines’ using apt command,

$ sudo apt install cockpit-machines -y

Once the package is installed then logout and login to Cockpit console.

3) View System Logs

From the ‘Logs’ tab we can view our system logs. System logs can also be viewed based on its severity.

4) Manage Networking with Cockpit

System networking can easily be managed via networking tab from cockpit web console. Here we can view our system Ethernet cards speed. We have the features like creating bonding and bridge interface. Apart from this we can also add VLAN tagged interfaces on our system.

5) Manage System and Application services

From the ‘services’ tab we can restart, stop and enable system and application services. If you wish to manage any service, just click on that service

6) Manage Local Accounts

If you want to manage local account then choose ‘Accounts’ tab from web console, here you can create new local accounts and change the parameters of existing users like password reset, roles and lock account.

7) Terminal Access

If you wish to access terminal of your system from cockpit dashboard then choose “Terminal” tab.

That’s all from this tutorial, I hope you got an idea on how to install and use Cockpit Web console effectively on Ubuntu 20.04 LTS Server. Please don’t hesitate to share your valuable feedback and comments.

The post How to Install Cockpit Web Console on Ubuntu 20.04 Server first appeared on Linuxtechi.

How to Install and Configure Jenkins on Ubuntu 20.04

Thu, 20 Aug 2020 07:51:05 GMT

Automation of tasks can be quite tricky especially where multiple developers are submitting code to a shared repository. Poorly executed automation processes can often lead to inconsistencies and delays. And this is where Jenkins comes in. Jenkins is a free and opensource continuous integration tool that’s predominantly used in the automation of tasks. It helps to streamline the continuous development, testing and deployment of newly submitted code.

In this guide, we will walk you through the installation and configuration of Jenkins on Ubuntu 20.04 LTS system.

Step 1: Install Java with apt command

Being a Java application, Jenkins requires Java 8 and later versions to run without any issues. To check if Java is installed on your system, run the command:

$ java --version

If Java is not installed, you will get the following output.

To install Java on your system, execute the command:

$ sudo apt install openjdk-11-jre-headless

After the installation, once again verify that Java is installed:

$ java --version

Perfect! We now have OpenJDK installed. We can now proceed.

Step 2: Install Jenkins via its official repository

With Java installed, we can now proceed to install Jenkins. The second step is to import the Jenkins GPG key from Jenkins repository as shown:

$ wget -q -O - https://pkg.jenkins.io/debian/jenkins.io.key | sudo apt-key add -

Next, configure Jenkins repository to the sources list file as shown.

$ sudo sh -c 'echo deb http://pkg.jenkins.io/debian-stable binary/ > /etc/apt/sources.list.d/jenkins.list'

Next, update the system’s package list.

$ sudo apt update

And install Jenkins as follows.

$ sudo apt install jenkins

Once the installation is complete, Jenkins should start automatically. To confirm this, run the command:

$ sudo systemctl status jenkins

If by any chance Jenkins is not running, execute the following command to start it.

$ sudo systemctl start jenkins

Step 3: Configuring the firewall rules for Jenkins

As we have seen, Jenkins natively listens on port 8080, and if you have installed Jenkins on a server with UFW enabled, you need to open that port to allow traffic.

To enable firewall on Ubuntu 20.04 LTS run,

$ sudo ufw enable

To open port 8080 on ufw firewall, run the command:

$ sudo ufw allow 8080/tcp

Then reload the firewall to effect the changes.

$ sudo ufw reload

To confirm that port 8080 is open on the firewall, execute the command:

$ sudo ufw status

From the output, we can clearly see that Port 8080 has been opened on the system.

Step 4: Configure Jenkins with GUI

We are almost done now. The only thing remaining is to set up Jenkins using your favorite browser. So, head over to the URL bar and browse your server’s address as shown:

http://server-IP:8080

To check your server’s IP address, use the ifconfig command.

You will get the page similar to what we have below prompting you to provide the Administrator’s password. As per the instructions, the password is located in the file:

/var/lib/jenkins/secrets/initialAdminPassword

To view the password, simply switch to root user and use the cat command as shown:

$ cat /var/lib/jenkins/secrets/initialAdminPassword

Copy the password and paste it in the text field shown and click the “Continue” button.

In the next step, select ‘Install suggested plugin‘ for simplicity’s sake.

Thereafter, the installation of the necessary plugin required by Jenkins will commence.

When the installation of plugins is complete, the installer will take you to the next section where you will be required to create an Admin user and click on the ‘Save and Continue’ button.

The next step will populate the default URL for your Jenkin’s instance. No action is required, simply click ‘Save and Finish’.

Finally, click on the ‘Start using Jenkins’ button to gain access to Jenkins.

This ushers you to Jenkin’s dashboard as shown.

And there you have it. We have successfully managed to install Jenkins on Ubuntu 20.04 LTS.

Linux Zip and Unzip Command with Examples

Tue, 18 Aug 2020 05:52:20 GMT

In this tutorial, we touch base on the zip and unzip commands and how they are used in Linux. Zip is a command used for creating an archive file or a zipped file. This allows you to compress your files and create more space for other files on your hard drive or removable drive. Additionally, zipping your files/directories makes them more portable and easier to upload, download or even attach and send them via email.The opposite of zipping is unzipping, and here we use the unzip command to decompress the files and access them individually.

Before start discussing zip and unzip command, let’s see how these commands can be installed from command line,

Install zip & unzip command on Ubuntu / Debian / Linux Mint

Open the terminal and run the following apt command,

$ sudo apt install -y zip unzip
or
$ sudo apt-get install -y zip unzip

Install zip & unzip command on CentOS / RHEL / Fedora

Open the terminal and execute the beneath command,

$ sudo yum install -y zip unzip
or
$ sudo dnf install -y zip unzip

Let’s dive in and see how to zip and unzip files and directories in Linux with zip and unzip command with examples.

Zip command in Linux

Zipping a file is as easy as ABC. The syntax is quite straightforward:

$ zip OPTIONS archive.zip file

A few points to take into consideration before you proceed:

You need to have write permissions on the file you are zipping and the directory location before zipping a file.
When you unzip or extract a file, the user owns the file/directory.

Example 1) Zipping a single file and multiple files with zip command

Let’s assume you have a text file – reports1.txt – in your current directory and you want to zip it into an archive called reports.zip.

The command for this operation will be:

$ zip reports.zip reports1.txt

Additionally, you can zip multiple files at a go into an archive as shown:

$ zip archive.zip file1 file2 file3

Again, let’s assume that we have 3 text files reports1.txt, reports2.txt and reports3.txt. To zip them into the archive reports.zip, run the command:

$ zip reports.zip reports1.txt reports2.txt reports3.txt

Example 2) Adding a file to a zip archive (-u)

At times, you may find the need to add a file to a zip archive. To do so, use the -u flag. For example, to add another file reports4.txt, run:

$ zip -u reports.zip report4.txt

Example 3) View contents of a zipped file

To view contents of a zipped file, use the command as shown:

$ zipinfo archive.zip

Example 4) Zipping all the files in the current directory (* )

If you have multiple files in your current directory, you can zip all of them at a go using the wildcard symbol as shown in the syntax below:

$ zip archive.zip *

For example, to compress all files in the home directory to home.zip archive, execute the command below. Be sure that you are working in the home directory.

$ zip home.zip *

Example 5) Delete a file from an archive (-d)

To remove a file from an archive, invoke the -d flag. For instance, to remove reports4.txt from the zipped file, run:

$ zip -d reports.zip reports4.txt

Example 6) Delete files after zipping (-m)

As you may have noted, the original files remain even after zipping or archiving them.

If you prefer you get rid of them during archival and conserve space, invoke the -m option during archival as shown:

$ zip -m reports.zip reports1.txt reports2.txt reports3.txt

Example 7) How to zip a directory (-r)

We have so far seen how to zip files. Often, you will be tasked with zipping directories since they take up more space for the most time.

To zip a folder, use the syntax below. The -r option zipped the folder recursively.

$ zip -r archive.zip folder

For example, to zip a directory data to an archive data.zip, execute:

$ zip -r data.zip data

As with files, you can also zip several folders concurrently as shown:

$ zip -r archive.zip folder1 folder2 folder3

Example 8) Zip a file to a different destination

To zip a file to a different destination other than the current directory simply specify the path to the zipped archive in your syntax as shown:

$ zip /path/to/destination/archive.zip file

For example, the file hello.txt is archived to file.zip file in the Documents/data/sales path.

Example 9) Zip both files and directories into their own archives

If, for whatever reason, you want to compress files and directories in the current directory into their individual zip archives, use the for loop as shown:

$ for i in *; do zip -r "${i%}.zip" "$i"; done

For example, the example below compresses the file hello.txt and folder sales into their own archives hello.zip and sales.zip respectively.

Unzip command in Linux

Let’s now shift gears and focus on unzip command. The command is used to unzip or decompress zipped files and directories. Let’s take a look at a few example usages of the command:

Example 1) How to view the contents of a zipped file (-l)

Before you are unzipping a file or directory, you can view the archive’s contents using the -l option as shown:

$ unzip -l archive.zip

For example:

$ unzip -l data.zip

Example 2) How to view detailed contents of a zipped file (-Z)

To view more detailed information about the file such as file permissions and the total size of the files in the archive, use the -Z option as shown:

$ unzip -Z data.zip

Example 3) How to unzip/decompress a zipped file (-d)

In its basic and simplest syntax, unzipping a zipped file takes the syntax below and occurs in the current working directory.

$ unzip archive.zip

For example:

$ unzip data.zip

Example 4) Unzip a file to another directory

To extract or unzip an archive to a different destination, use the -d flag and specify the destination path as shown

$ unzip archive.zip -d /path/to/destination/folder

For example.

$ unzip data.zip -d /home/linuxtechi/Documents

Example 5) Unzip one or more files from an archive

Oftentimes, you will have a compressed file with multiple files. Instead of uncompressing the archive entirely, you may opt to just extract one or two files. To achieve this, specify the file(s) as shown in the syntax:

$ unzip archive.zip file1 file2

For example, to extract a file called hello.txt from the archive home.zip run

$ unzip home.zip hello.txt

Additionally, you can extract the file to a different destination folder instead of the current directory. For example, the command below extracts the hello.txt file to the Documents/data/sales directory.

$ unzip home.zip hello.txt -d Documents/data/sales

Example 6) Exclude certain files from being decompressed (- x)

Just as you can extract a specific file(s) from an archive, so can you exclude certain files from being decompressed. This is possible using the ( -x) option in the syntax shown

$ unzip archive.zip -x file1

For example, the example below excludes files file1.txt & file2.txt from being extracted.

$ unzip archive.zip -x file1.txt file2.txt

Example 7) How to suppress the output of unzip command (-q)

As you may have noted, details of the unzip operation showing the location of the extraction and files being extracted is printed on the terminal. To suppress this info, use the -q switch as shown:

$ unzip -q data.zip

Example 8) How to overwrite existing files (-o)

When you run the unzip command twice in the same directory, you will be prompted whether to replace, ignore the extraction or rename the existing files as shown in the output below.

If you want to overwrite the existing file, without being prompted, use the -o option as shown:

$ unzip -o data.zip

Example 9) Unzip multiple files

Finally, to unzip multiple files at a go, use a wildcard in the syntax shown:

$ unzip '*.txt'

Take note of the single quote enclosing the *.txt parameter.

Conclusion

This brings us to the end of this guide; we have showcased the usage of the zip and unzip commands and that various options you can use. For more information about their usage, feel free to visit their man pages. We hope you have a firm grip of the usage of both commands and that you can comfortably zip and unzip your files.

Also Read : How to Create Hard and Soft (symlink) Links on Linux Systems

How to Enforce Password Policies in Linux (Ubuntu / CentOS)

Wed, 12 Aug 2020 12:41:39 GMT

As much as Linux is considered a secure operating system, its security is just as good as the password strength of login users. Password policies exist to ensure that a strong password is set for users and as a Linux user, you should be mindful to enforce these policies to make it difficult for breaches to occur. You surely don’t want users configuring weak or guessable passwords which can be brute forced by hackers in a matter of seconds.

In this article, we touch base on how to enforce password policies in Linux, more specifically CentOS and Ubuntu. We will cover enforcing password policies such as password expiration period, password complexity and password length.

Enforce Password Policies in Ubuntu / Debian

There are 2 main ways that you can enforce password policies. Let’s take a look at each in detail.

1) Configure the maximum number of days that a password can be used

For start, you can configure a password policy that requires users to change their passwords after a certain number of days. Best practice dictates that a password should be changed periodically to keep malicious users off-kilter and make it harder for them to breach your system. This applies not just in Linux but in other systems such as Windows and macOS.

To achieve this In Debian/Ubuntu, you need to modify the /etc/login.defs file and be on the lookout for the PASS_MAX_DAYS attribute.

By default, this is set to 99,999 days as shown.

You can modify this to a reasonable duration, say, 30 days. Simply set the current value to 30 as shown and save the changes. Upon lapsing of the 30 days, you will be compelled to create another password.

2) Configure Password complexity with pam

Ensuring that password meets a certain degree of complexity is equally crucial and further thwarts any attempts by hackers to infiltrate your system using brute force.

As a general rule, a strong password should have a combination of Uppercase, lowercase, numeric and special characters and should be at least 12-15 characters long.

To enforce password complexity in Debian / Ubuntu systems, you need to install the libpam-pwquality package as shown:

$ sudo apt install libpam-pwquality

Once installed, head out to the /etc/pam.d/common-password file from where you are going to set the password policies. Be default, the file appears as shown:

Locate the line shown below

password   requisite   pam_pwquality.so retry=3

Add the following attributes to the line:

minlen=12 maxrepeat=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 difok=4 reject_username enforce_for_root

The entire line should appear as shown:

Let’s flesh out what these directives stand for:

retry=3: This option will prompt the user 3 times before exiting and returning an error.
minlen=12: This specifies that the password cannot be less than 12 characters.
maxrepeat=3: This allows implies that only a maximum of 3 repeated characters can be included in the password.
ucredit=-1: The option requires at least one uppercase character in the password.
lcredit=-1: The option requires at least one lowercase character in the password.
dcredit=-1: This implies that the password should have at last a numeric character.
ocredit=-1: The option requires at least one special character included in the password.
difok=3: This implies that only a maximum of 3 character changes in the new password should be present in the old password.
reject_username: The option rejects a password if it consists of the username either in its normal way or in reverse.
enforce_for_root: This ensures that the password policies are adhered to even if it’s the root user configuring the passwords.

Enforce Password Policies in CentOS / RHEL

For Debian and Ubuntu systems, we enforced the password policy by making changes to the /etc/pam.d/common-password configuration file.

For CentOS 7 and other derivatives, we are going to modify the /etc/pam.d/system-auth or /etc/security/pwquality.conf configuration file.

So, proceed and open the file:

$ sudo vim /etc/pam.d/system-auth

Locate the line shown below

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

Append the options in the line as shown.

minlen=12 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root

You will end up having the line below:

Once done, save the password policies and exit the file.

Once again, when you try creating a user with a weak password that doesn’t adhere to the enforced policies, you will encounter the error shown in the terminal.

Conclusion

As you have seen, enforcing a password policy is quite easy and serves as a superb way of preventing users from setting up weak passwords which may easy to guess or prone to brute-force attacks. By enforcing these policies, you can rest assured that you have fortified your system’s security and made it more difficult for hackers to compromise your system.

How to Access Google Drive on Ubuntu 20.04 (Focal Fossa)

Mon, 10 Aug 2020 04:18:27 GMT

Google Drive is a cloud storage option that provides an excellent backup solution for all your files and folders. We cannot emphasize enough the importance of having backup copies of your files. Anything can happen at any time and when it does, you want to ensure that you are on the safe side and can log in to Google Drive and recover your lost documents.

That said, Having Google Drive sync capability on your Linux PC is of utmost importance. With Google Drive, you will get free 15GB to get you started and thereafter, you will pay according to the amount of space you need to secure your files. In this guide, you will learn different ways that you can use to access Google Drive on your Ubuntu 20.04 LTS Desktop (Focal Fossa).

Mount / Access Google Drive using the Online accounts feature

This is by far the easiest way of accessing Google Drive on your system. To start off, search for the ‘Online accounts’ option in the application menu as shown. Then click on the ‘Online Accounts’ option as shown.

This ushers you to the ‘Online Accounts’ section displaying various options that you can access and connect with. Since we are interested in accessing Google Drive, we will click on the ‘Google’ option as shown:

Next, you will be required to sign into your Google Account, Firstly, provide your Gmail email address.

Press the ‘ENTER’ button to proceed to the next step where you will be required to provide your password:

Then press the ‘ENTER’ button. If you have secured your Google Account with a 2-step verification method, you will be required to act accordingly to access your account.

Next, GNOME will request your permission to access your Google Account and gain access to your Gmail account, Google Drive among other things as shown.

Scroll down and click ‘Allow’

In the next step, you can choose to select the features that you’d want to sync between your PC and your Google account. In this case, I have opted to turn on all the settings.

At this point, your Google account will be attached or associated with this PC. To access your Google Drive directory, head out to the file manager as shown.

In the ‘Files’ window, scroll down and double-click on the Google Drive icon as shown below to mount the Google Drive folder and access your files and folders.

From there, you can copy and paste files to the mounted Google Drive folder and sync with your online Google Drive account. Just place a file on the mounted folder and head over to Google Drive and confirm if it exists.

Access Google Drive using Insyc

Insync is a cross-platform client that allows you to access and manage your Google Drive and OneDrive files and folders straight from your PC. It’s free for 14 days upon which you will be required to pay according to your preferred subscription.

To get started, head out to Insync downloads page

Select to download the Linux Debian package that corresponds to Ubuntu 20.04.

Once you have downloaded the Debian package, install Insync by executing the command shown:

$ sudo dpkg -i isync_3.2.4.40856-focal_amd64.deb

Upon successful installation, the following pop-up will be displayed on your screen. To launch the application, click on the ‘Start Insync’ button.

Alternatively, you can search for it using the application menu as shown:

Insync will present you with two options: either to add Google Drive or One Drive. In this case, select ‘Add Google Drive’ option as shown.

In the next 2 steps, you will be required to sign in to your Gmail account. First, provide your email address and hit ‘ENTER’ or click ‘Next’.

Next, provide the corresponding password to your Gmail account.

Thereafter, allow Insync to have access to your Google Account by clicking on the ‘Allow’ button.

If the credentials are all good, you will get the notification below on your web browser.

Exit the browser, and head back to Insync client. Click on the ‘Next’ button as shown.

By default, Insync will suggest the base folder for your Google Drive location on your PC. IF you are okay with the default selection, click on the ‘Next’ button. Otherwise, if you prefer to define your own path, click on the ‘change’ button.

The next selection gives you an option to start syncing your files immediately or to perform additional steps. For now, simply click ‘Not now’

And finally, the Google Drive folder will be attached or mounted to your PC and you will have access to all your files and folders as shown. You can either upload or download files and the changes will be synced on your online Google Drive account.

Final thoughts

As you have seen, mounting Google Drive on your PC is quite an easy and straight forward task and just takes a few steps to have Google Drive mounted on your system. As always, it’s recommended to upload or copy crucial files onto the Google Drive folder for backup purposes such that if your PC crashes, you can always log in to your Google account and retrieve your files.

How to Install and Configure Checkmk on CentOS 8 / RHEL 8

Wed, 05 Aug 2020 04:21:12 GMT

Developed in Python & C++ languages, Checkmk is an open-source monitoring server that is an improvement of Nagios operating system with enhanced plugins and monitoring capabilities. Checkmk uses agents to collect and ship remote systems’ metrics to the server. The agents are available for both Linux and Windows systems in 32 & 64-bit architectures.

Checkmk is used in monitoring applications, servers and even cloud infrastructure such as AWS and Azure. In this guide, we will walk you through how to install and configure Checkmk on CentOS 8 and later on, see how you can add both Linux and Windows hosts to checkmk server for monitoring.

We will install Checkmk using the OMD (Open Monitoring Distribution) bundle. This bundle ships with Nagios and all the necessary plugins required for monitoring various services.

Lab Setup details for Checkmk

This will be our set up

Checkmk Server – CentOS 8
Host 1 – CentOS 8
Host 2 – Windows Server 2019

Step 1) Update the system

To start off, it’s always advisable to update your package lists to start on a clean slate. Therefore, log in to the Checkmk server and run the off command below.

$ sudo dnf update -y

Once the update is completed successfully and reboot the system once.

Step 2) Install prerequisite packages

Once the update is complete, you need to install a couple of packages for the installation of Checkmk monitoring tool to go smoothly.

First, you need to install EPEL. This is short for Extra Packages for Enterprise Linux. This is a package repository that provides additional packages that are not present in the default AppStream repositories for CentOS 8. This will prove beneficial as some of the packages required by OMD are contained in EPEL.

To install the EPEL repository, execute the command:

$ sudo dnf install epel-release

Press ‘y’ on the keyboard and hit ENTER to proceed with the installation.

Next, ensure that you install xinetd and OpenSSL packages. Therefore, run the command:

$ sudo dnf install xinetd openssl -y

Also, ensure that Python 3 is installed (It comes preinstalled by default on CentOS 8). In case it is not installed on your CentOS 8 / RHEL 8 system then run following command to install it,

$ sudo dnf install python3 -y

Run following command to verify the python version

[linuxtechi@checkmk ~]$ python3 -V
Python 3.6.8
[linuxtechi@checkmk ~]$

Don not forget to install ‘graphiz-gd’ package from PowerTools repository, run the following dnf command

$ sudo dnf --enablerepo=PowerTools install graphviz-gd -y

Step 3) Set SELinux and firewall rules for checkmk

SELinux is a kernel security module that enhances the security of your CentOS 8 and RHEL 8 system. Set the following selinux rule to allow web server to access network interfaces,

$ sudo setsebool -P httpd_can_network_connect 1

Now allow http service or its port in firewall, run

$ sudo firewall-cmd --zone=public --add-service=http --permanent
$ sudo firewall-cmd --reload

Note: You can skip this only if Selinux and firewalld is disabled on your system.

Step 4) Installing Checkmk monitoring tool

With all the prerequisites out of the way, it’s time now to install Checkmk First, download the RPM package from the Official site.

$ wget https://checkmk.com/support/1.6.0p14/check-mk-raw-1.6.0p14-el8-38.x86_64.rpm

Once downloaded install Checkmk rpm package with –nogpgcheck option to avoid signing of the package which might result in errors later on during the installation process.

$ sudo dnf install --nogpgcheck check-mk-raw-1.6.0p14-el8-38.x86_64.rpm -y

The next thing you need to do is to create an OMD instance. We are going to create one for testing purpose (sandbox).

Note: You can replace the OMD instance name that suits to your setup.

$ sudo omd create sandbox

You should get the output shown below:

What the command does is that it creates a new omd instance together with a user and a group called ‘sandbox’ alongside the user’s home directory which is created in the ‘/omd/sites/sandbox’ path.

To start the instance, switch to either the omd user or the root user and run the command:

$ omd start

To access the Check_MK front end interface, open your web browser and browser the URL shown:

http://server-IP/sandbox

Click the ‘Login’ button to access the dashboard which is shown below.

Step 5) Add a remote Linux host to Checkmk for monitoring

Having successfully installed and set up Checkmk, We are going to demonstrate how you can monitor various hosts. First, we are going to add a Linux host, in this case, a CentOS 8 system, which requires you to install the Checkmk agent.

There are 2 ways to go about this. You can download the Checkmk agent from the server by browsing shown.

http://server-ip/sandbox/check_mk/agents

Append the agent’s name to the URL and download using the wget command as shown

$ wget http://server-ip/sandbox/check_mk/agents/check-mk-agent-1.6.0p14-1.noarch.rpm

Replace the server-ip that suits to your setup, in my case it would be ’35.222.59.10’

The other way is to directly download the agent from the official site.

$ wget https://checkmk.com/support/1.6.0p14/check-mk-raw-1.6.0p14-el8-38.x86_64.rpm

Once you have downloaded the agent, install it using the rpm command as shown:

$ rpm -ivh check-mk-agent-1.6.0p14-1.noarch.rpm

Then install xinetd daemon.

$ sudo dnf install xinetd -y

The Checkmk agent listens on port 6556, and so we need to open the port on the firewall so that it can ship the Linux host’s metrics to the Checkmk server.

To open the port and effect the changes on the firewall, run the command:

$ sudo firewall-cmd --permanent --add-port=6556/tcp
$ sudo firewall-cmd --reload

Now head over to the Checkmk dashboard and navigate to ‘WATO Configuration’ –> ‘Hosts’ –> ‘Create New Host’

In the next page, fill out the details of the host such as the hostname, IP address, and remember to check off the checkmk agent checkbox.

Then click on ‘Save and Finish’

Shortly after, a list of the host’s services will be populated as shown

Let’s now have a look at how you can add a Windows host system.

Step 6) Add a remote Windows host to checkmk for monitoring

Adding a Windows host is very similar to adding a Linux host. To get started, browse the following URL

http://server-ip/sandbox/check_mk/agents/windows/

To download the Windows agent, click on either check_mk_agent.msi or check_mk_agent-64.exe package.

Once downloaded, run the installer as shown using the install Wizard.

Once done, head over to the services Window and confirm that the agent is running as shown.

Equally important, ensure that you have allowed the checkmk service across Windows Firewall as shown.

Finally, head over to the Checkmk server and add the Windows host system the same way we added the Linux host. When you are done, the host’s services will be populated as shown,

Awesome! We have managed to install the Checkmk monitoring server and successfully managed to add the Linux and Windows host systems for monitoring. We hope this guide was beneficial. The ball is now in your court. Give it a try and let us know how it went.

Top 7 Security Hardening Tips for CentOS 8 / RHEL 8 Server

Mon, 03 Aug 2020 10:02:08 GMT

Once you have installed your CentOS 8 / RHEL 8 server, securing it to prevent unauthorized access and intrusions comes second. As the adage goes , “Prevention is better than cure” so is prevention of hacks better that taking remediation attempts.

Let explore a few steps that you can take to harden and secure CentOS 8 / RHEL 8 server and thwart hacking attempts.

1) Set up a firewall

As a security-minded Linux user, you wouldn’t just allow any traffic into your CentOS 8 / RHEL 8 system for security reasons. In fact, setting up a firewall is one of the initial server setup tasks that a systems administrator needs to perform to only open specific ports and allow services currently in use.

By default, CentsO8 / RHEL 8 system ship with firewalld firewall which can be started and enabled on startup by running the commands:

$ sudo systemctl start firewalld
$ sudo systemctl enable firewalld

To check the services allowed on the firewall, simply run the command:

$ sudo firewall-cmd --list all

To open a port on the firewall e.g port 443, execute the command:

$ sudo firewall-cmd --add-port=443/tcp --zone=public --permanent

To allow a service e.g ssh , use the command:

$ sudo firewall-cmd --add-service=ssh  --zone=public --permanent

To remove a port and a service , use the –remove-port and –remove-service attributes respectively.

For the changes to take effect , always reload the firewall as shown.

$ sudo firewall-cmd --reload

2) Disable unused / undesirable services

It’s always advised to turn off unused or unnecessary services on your server. This is because the higher the number of services running, the more the number of ports open on your system which can be exploited by an attacker to gain entry to your system. Additionally, desist from using old and insecure service like telnet which send traffic in plain text

Best security practices recommend disabling unused services and getting rid of all the insecure services running on your system. You can use the nmap tool to scan your system and check which ports are open and being listened to.

3) Secure critical files

It’s essential to lock down critical files to prevent accidental deletion or editing. Such files include the /etc/passwd and /etc/gshadow which contain hashed passwords. To make the files immutable ( i.e prevent modification or accidental deletion ) use the chattr command as shown:

$ sudo chattr +i /etc/passwd
$ sudo chattr +i /etc/shadow

This ensures that a hacker cannot change any of the users’ password or delete them leading to denial of login to the system.

4) Secure SSH protocol

SSH protocol is a popularly used protocol for remote logins. By default , the protocol has native weaknesses that can be exploited by a hacker.

By default, SSH allows remote login by the root user. This is a potential loophole and if a hacker can get a hold of the root’s password to your system, your server is pretty much at their mercy. To prevent this, it’s advisable to deny remote root login and instead create a login regular user with sudo privileges. You can effect this by modifying the SSH configuration file /etc/ssh/sshd_config and disable root login as shown:

PermitRootLogin

Another way you can secure SSH is by setting up SSH passwordless authentication by use of ssh keys. Instead of using password authentication which is prone to brute force attacks, SSH keys are preferred as they only allow entry to users with the ssh key to login to the remote server and block out any other user. The first step in enabling passwordless authentication is generating a key pair using the command:

$ ssh-keygen

This generates a public and private key pair. The private key resides on the host while the public key is copied to the remote system or server. Once the ssh-key pair is copied, you can effortlessly login to the remote system without being prompted for a password. Next, disable password authentication by modifying the /etc/ssh/sshd_config configuration file and setting this value:

PasswordAuthentication no

Once you have made the changes be sure to restart the SSH service for the changes to take effect.

$ sudo systemctl restart sshd

5 ) Define a limit for password attempts

To further harden your server, you might consider limiting the number of password attempts when logging via SSH to deter brute force attacks. Again, head over to the SSH configuration file, scroll and locate the “MaxAuthTries” parameter. Uncomment it and set a value , for example 3 as shown.

MaxAuthTries 3

This implies that after 3 incorrect password attempts, the session will be closed. This comes in handy especially when you want to block robotic scripts/programs trying to gain access to your system.

6) Set up an intrusion prevention system (IPS)

So far, we have covered the basic steps you can take to harden your CentOS 8 / RHEL 8 server. To add another layer, it’s recommended that you install an intrusion detection system. A perfect example of an IPS is Fail2ban.

Fail2ban is a free and open source intrusion prevention system that shields servers from brute force attacks by banning IP addresses after a certain number of login attempts which can be specified in its configuration file. Once blocked, the malicious or unauthorized user cannot even initiate an SSH login attempt.

7) Regularly update your server

This article would not be complete without emphasizing how critical it is to update your server regularly. This ensures that your server gets the latest feature and security updates which are essential in addressing existing security issues.

You can set up automatic updates using cockpit utility which is a GUI-based server management tool that also performs a host of other tasks. This is ideal especially if you intend to go on a long stay or vacation without access to the server.

How to Setup Highly Available Kubernetes Cluster with Kubeadm

Wed, 29 Jul 2020 04:24:51 GMT

When we setup Kubernetes (k8s) cluster on-premises for production environment then it is recommended to deploy it in high availability. Here high availability means installing Kubernetes master or control plane in HA. In this article I will demonstrate how we can setup highly available Kubernetes cluster using kubeadm utility.

For the demonstration, I have used five CentOS 7 systems with following details:

k8s-master-1 – Minimal CentOS 7 – 192.168.1.40 – 2GB RAM, 2vCPU, 40 GB Disk
k8s-master-2 – Minimal CentOS 7 – 192.168.1.41 – 2GB RAM, 2vCPU, 40 GB Disk
k8s-master-3 – Minimal CentOS 7 – 192.168.1.42 – 2GB RAM, 2vCPU, 40 GB Disk
k8s-worker-1 – Minimal CentOS 7 – 192.168.1.43 – 2GB RAM, 2vCPU, 40 GB Disk
k8s-worker-2 – Minimal CentOS 7 – 192.168.1.44 – 2GB RAM, 2vCPU, 40 GB Disk

Note: etcd cluster can also be formed outside of master nodes but for that we need additional hardware, so I am installing etcd inside my master nodes.

Minimum requirements for setting up Highly K8s cluster

Install Kubeadm, kubelet and kubectl on all master and worker Nodes
Network Connectivity among master and worker nodes
Internet Connectivity on all the nodes
Root credentials or sudo privileges user on all nodes

Let’s jump into the installation and configuration steps

Step 1) Set Hostname and add entries in /etc/hosts file

Run hostnamectl command to set hostname on each node, example is shown for k8s-master-1 node,

$ hostnamectl set-hostname "k8s-master-1"
$ exec bash

Similarly, run above command on remaining nodes and set their respective hostname. Once hostname is set on all master and worker nodes then add the following entries in /etc/hosts file on all the nodes.

192.168.1.40   k8s-master-1
192.168.1.41   k8s-master-2
192.168.1.42   k8s-master-3
192.168.1.43   k8s-worker-1
192.168.1.44   k8s-worker-2
192.168.1.45   vip-k8s-master

I have used one additional entry “192.168.1.45 vip-k8s-master” in host file because I will be using this IP and hostname while configuring the haproxy and keepalived on all master nodes. This IP will be used as kube-apiserver load balancer ip. All the kube-apiserver request will come to this IP and then the request will be distributed among backend actual kube-apiservers.

Step 2) Install and Configure Keepalive and HAProxy on all master / control plane nodes

Install keepalived and haproxy on each master node using the following yum command,

$ sudo yum install haproxy keepalived -y

Configure Keepalived on k8s-master-1 first, create check_apiserver.sh script will the following content,

[kadmin@k8s-master-1 ~]$ sudo vi /etc/keepalived/check_apiserver.sh
#!/bin/sh
APISERVER_VIP=192.168.1.45
APISERVER_DEST_PORT=6443

errorExit() {
    echo "*** $*" 1>&2
    exit 1
}

curl --silent --max-time 2 --insecure https://localhost:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://localhost:${APISERVER_DEST_PORT}/"
if ip addr | grep -q ${APISERVER_VIP}; then
    curl --silent --max-time 2 --insecure https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/"
fi

save and exit the file.

Set the executable permissions

$ sudo chmod +x /etc/keepalived/check_apiserver.sh

Take the backup of keepalived.conf file and then truncate the file.

[kadmin@k8s-master-1 ~]$ sudo cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf-org
[kadmin@k8s-master-1 ~]$ sudo sh -c '> /etc/keepalived/keepalived.conf'

Now paste the following contents to /etc/keepalived/keepalived.conf file

[kadmin@k8s-master-1 ~]$ sudo vi /etc/keepalived/keepalived.conf
! /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    router_id LVS_DEVEL
}
vrrp_script check_apiserver {
  script "/etc/keepalived/check_apiserver.sh"
  interval 3
  weight -2
  fall 10
  rise 2
}

vrrp_instance VI_1 {
    state MASTER
    interface enp0s3
    virtual_router_id 151
    priority 255
    authentication {
        auth_type PASS
        auth_pass P@##D321!
    }
    virtual_ipaddress {
        192.168.1.45/24
    }
    track_script {
        check_apiserver
    }
}

Save and close the file.

Note: Only two parameters of this file need to be changed for master-2 & 3 nodes. State will become SLAVE for master 2 and 3, priority will be 254 and 253 respectively.

Configure HAProxy on k8s-master-1 node, edit its configuration file and add the following contents:

[kadmin@k8s-master-1 ~]$ sudo cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg-org

Remove all lines after default section and add following lines

[kadmin@k8s-master-1 ~]$ sudo vi /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------
# apiserver frontend which proxys to the masters
#---------------------------------------------------------------------
frontend apiserver
    bind *:8443
    mode tcp
    option tcplog
    default_backend apiserver
#---------------------------------------------------------------------
# round robin balancing for apiserver
#---------------------------------------------------------------------
backend apiserver
    option httpchk GET /healthz
    http-check expect status 200
    mode tcp
    option ssl-hello-chk
    balance     roundrobin
        server k8s-master-1 192.168.1.40:6443 check
        server k8s-master-2 192.168.1.41:6443 check
        server k8s-master-3 192.168.1.42:6443 check

Save and exit the file

Now copy theses three files (check_apiserver.sh , keepalived.conf and haproxy.cfg) from k8s-master-1 to k8s-master-2 & 3

Run the following for loop to scp these files to master 2 and 3

[kadmin@k8s-master-1 ~]$ for f in k8s-master-2 k8s-master-3; do scp /etc/keepalived/check_apiserver.sh /etc/keepalived/keepalived.conf root@$f:/etc/keepalived; scp /etc/haproxy/haproxy.cfg root@$f:/etc/haproxy; done

Note: Don’t forget to change two parameters in keepalived.conf file that we discuss above for k8s-master-2 & 3

In case firewall is running on master nodes then add the following firewall rules on all three master nodes

$ sudo firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
$ sudo firewall-cmd --permanent --add-port=8443/tcp
$ sudo firewall-cmd --reload

Now Finally start and enable keepalived and haproxy service on all three master nodes using the following commands :

$ sudo systemctl enable keepalived --now
$ sudo systemctl enable haproxy --now

Once these services are started successfully, verify whether VIP (virtual IP) is enabled on k8s-master-1 node because we have marked k8s-master-1 as MASTER node in keepalived configuration file.

Perfect, above output confirms that VIP has been enabled on k8s-master-1.

Step 3) Disable Swap, set SELinux as permissive and firewall rules for Master and worker nodes

Disable Swap Space on all the nodes including worker nodes, Run the following commands

$ sudo swapoff -a 
$ sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

Set SELinux as Permissive on all master and worker nodes, run the following commands,

$ sudo setenforce 0
$ sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

Firewall Rules for Master Nodes:

In case firewall is running on master nodes, then allow the following ports in the firewall,

Run the following firewall-cmd command on all the master nodes,

$ sudo firewall-cmd --permanent --add-port=6443/tcp
$ sudo firewall-cmd --permanent --add-port=2379-2380/tcp
$ sudo firewall-cmd --permanent --add-port=10250/tcp
$ sudo firewall-cmd --permanent --add-port=10251/tcp
$ sudo firewall-cmd --permanent --add-port=10252/tcp
$ sudo firewall-cmd --permanent --add-port=179/tcp
$ sudo firewall-cmd --permanent --add-port=4789/udp
$ sudo firewall-cmd --reload
$ sudo modprobe br_netfilter
$ sudo sh -c "echo '1' > /proc/sys/net/bridge/bridge-nf-call-iptables"
$ sudo sh -c "echo '1' > /proc/sys/net/ipv4/ip_forward"

Firewall Rules for Worker nodes:

In case firewall is running on worker nodes, then allow the following ports in the firewall on all the worker nodes

Run the following commands on all the worker nodes,

$ sudo firewall-cmd --permanent --add-port=10250/tcp
$ sudo firewall-cmd --permanent --add-port=30000-32767/tcp                                                   
$ sudo firewall-cmd --permanent --add-port=179/tcp
$ sudo firewall-cmd --permanent --add-port=4789/udp
$ sudo firewall-cmd --reload
$ sudo modprobe br_netfilter
$ sudo sh -c "echo '1' > /proc/sys/net/bridge/bridge-nf-call-iptables"
$ sudo sh -c "echo '1' > /proc/sys/net/ipv4/ip_forward"

Step 4) Install Container Run Time (CRI) Docker on Master & Worker Nodes

Install Docker (Container Run Time) on all the master nodes and worker nodes, run the following command,

$ sudo yum install -y yum-utils
$ sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
$ sudo yum install docker-ce -y

Run following systemctl command to start and enable docker service, (Run this command too on all master and worker nodes)

$ sudo systemctl enable docker --now

Now, let’s install kubeadm , kubelet and kubectl in the next step

Step 5) Install Kubeadm, kubelet and kubectl

Install kubeadm, kubelet and kubectl on all master nodes as well as worker nodes. Before installing these packages first, we must configure Kubernetes repository, run the following command on each master and worker nodes,

cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

Now run below yum command to install these packages,

$ sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes

Run following systemctl command to enable kubelet service on all nodes ( master and worker nodes)

$ sudo systemctl enable kubelet --now

Step 6) Initialize the Kubernetes Cluster from first master node

Now move to first master node / control plane and issue the following command,

[kadmin@k8s-master-1 ~]$ sudo kubeadm init --control-plane-endpoint "vip-k8s-master:8443" --upload-certs

In above command, –control-plane-endpoint set dns name and port for load balancer (kube-apiserver), in my case dns name is “vip-k8s-master” and port is “8443”, apart from this ‘–upload-certs’ option will share the certificates among master nodes automatically,

Output of kubeadm command would be something like below:

Great, above output confirms that Kubernetes cluster has been initialized successfully. In output we also got the commands for other master and worker nodes to join the cluster.

Note: It is recommended to copy this output to a text file for future reference.

Run following commands to allow local user to use kubectl command to interact with cluster,

[kadmin@k8s-master-1 ~]$ mkdir -p $HOME/.kube
[kadmin@k8s-master-1 ~]$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[kadmin@k8s-master-1 ~]$ sudo chown $(id -u):$(id -g) $HOME/.kube/config
[kadmin@k8s-master-1 ~]$

Now, Let’s deploy pod network (CNI – Container Network Interface), in my case I going to deploy calico addon as pod network, run following kubectl command

[kadmin@k8s-master-1 ~]$ kubectl apply -f https://docs.projectcalico.org/v3.14/manifests/calico.yaml

Once the pod network is deployed successfully, add remaining two master nodes to cluster. Just copy the command for master node to join the cluster from the output and paste it on k8s-master-2 and k8s-master-3, example is shown below

[kadmin@k8s-master-2 ~]$ sudo kubeadm join vip-k8s-master:8443 --token tun848.2hlz8uo37jgy5zqt  --discovery-token-ca-cert-hash sha256:d035f143d4bea38d54a3d827729954ab4b1d9620631ee330b8f3fbc70324abc5 --control-plane --certificate-key a0b31bb346e8d819558f8204d940782e497892ec9d3d74f08d1c0376dc3d3ef4

Output would be:

Also run the same command on k8s-master-3,

[kadmin@k8s-master-3 ~]$ sudo kubeadm join vip-k8s-master:8443 --token tun848.2hlz8uo37jgy5zqt  --discovery-token-ca-cert-hash sha256:d035f143d4bea38d54a3d827729954ab4b1d9620631ee330b8f3fbc70324abc5 --control-plane --certificate-key a0b31bb346e8d819558f8204d940782e497892ec9d3d74f08d1c0376dc3d3ef4

Output would be:

Above output confirms that k8s-master-3 has also joined the cluster successfully. Let’s verify the nodes status from kubectl command, go to master-1 node and execute below command,

[kadmin@k8s-master-1 ~]$ kubectl get nodes
NAME           STATUS   ROLES    AGE     VERSION
k8s-master-1   Ready    master   31m     v1.18.6
k8s-master-2   Ready    master   10m     v1.18.6
k8s-master-3   Ready    master   3m47s   v1.18.6
[kadmin@k8s-master-1 ~]$

Perfect, all our three master or control plane nodes are ready and join the cluster.

Step 7) Join Worker nodes to Kubernetes cluster

To join worker nodes to cluster, copy the command for worker node from output and past it on both worker nodes, example is shown below:

[kadmin@k8s-worker-1 ~]$ sudo kubeadm join vip-k8s-master:8443 --token tun848.2hlz8uo37jgy5zqt --discovery-token-ca-cert-hash sha256:d035f143d4bea38d54a3d827729954ab4b1d9620631ee330b8f3fbc70324abc5

[kadmin@k8s-worker-2 ~]$ sudo kubeadm join vip-k8s-master:8443 --token tun848.2hlz8uo37jgy5zqt --discovery-token-ca-cert-hash sha256:d035f143d4bea38d54a3d827729954ab4b1d9620631ee330b8f3fbc70324abc5

Output would be something like below:

Now head to k8s-master-1 node and run below kubectl command to get status worker nodes,

[kadmin@k8s-master-1 ~]$ kubectl get nodes
NAME           STATUS   ROLES    AGE     VERSION
k8s-master-1   Ready    master   43m     v1.18.6
k8s-master-2   Ready    master   21m     v1.18.6
k8s-master-3   Ready    master   15m     v1.18.6
k8s-worker-1   Ready    <none>   6m11s   v1.18.6
k8s-worker-2   Ready    <none>   5m22s   v1.18.6
[kadmin@k8s-master-1 ~]$

Above output confirms that both workers have also joined the cluster and are in ready state.

Run below command to verify the status infra pods which are deployed in kube-system namespace.

[kadmin@k8s-master-1 ~]$ kubectl get pods -n kube-system

Step 8) Test Highly available Kubernetes cluster

Let’s try to connect to the cluster from remote machine (CentOS system) using load balancer dns name and port. On the remote machine first, we must install kubectl package. Run below command to set kubernetes repositories.

cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

$ sudo yum install -y  kubectl --disableexcludes=kubernetes

Now add following entry in /etc/host file,

192.168.1.45   vip-k8s-master

Create kube directory and copy /etc/kubernetes/admin.conf file from k8s-master-1 node to $HOME/.kube/config ,

$ mkdir -p $HOME/.kube
$ scp root@192.168.1.40:/etc/kubernetes/admin.conf $HOME/.kube/config
$ sudo chown $(id -u):$(id -g) $HOME/.kube/config

Now run “kubectl get nodes” command,

[kadmin@localhost ~]$ kubectl get nodes
NAME           STATUS   ROLES    AGE    VERSION
k8s-master-1   Ready    master   3h5m   v1.18.6
k8s-master-2   Ready    master   163m   v1.18.6
k8s-master-3   Ready    master   157m   v1.18.6
k8s-worker-1   Ready    <none>   148m   v1.18.6
k8s-worker-2   Ready    <none>   147m   v1.18.6
[kadmin@localhost ~]$

Let’s create a deployment with name nginx-lab with image ‘nginx’ and then expose this deployment as service of type “NodePort”

[kadmin@localhost ~]$ kubectl create deployment nginx-lab --image=nginx
deployment.apps/nginx-lab created
[kadmin@localhost ~]$
[kadmin@localhost ~]$ kubectl get deployments.apps nginx-lab
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
nginx-lab   1/1     1            1           59s
[kadmin@localhost ~]$ kubectl get pods
NAME                         READY   STATUS    RESTARTS   AGE
nginx-lab-5df4577d49-rzv9q   1/1     Running   0          68s
test-844b65666c-pxpkh        1/1     Running   3          154m
[kadmin@localhost ~]$

Let’s try to scale replicas from 1 to 4, run the following command,

[kadmin@localhost ~]$ kubectl scale deployment nginx-lab --replicas=4
deployment.apps/nginx-lab scaled
[kadmin@localhost ~]$
[kadmin@localhost ~]$ kubectl get deployments.apps nginx-lab
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
nginx-lab   4/4     4            4           3m10s
[kadmin@localhost ~]$

Now expose the deployment as service, run

[kadmin@localhost ~]$ kubectl expose deployment nginx-lab --name=nginx-lab --type=NodePort --port=80 --target-port=80
service/nginx-lab exposed
[kadmin@localhost ~]$

Get port details and try to access nginx web server using curl,

[kadmin@localhost ~]$ kubectl get svc nginx-lab
NAME        TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
nginx-lab   NodePort   10.102.32.29   <none>        80:31766/TCP   60s
[kadmin@localhost ~]$

To access nginx web server we can use any master or worker node IP and port as “31766”

[kadmin@localhost ~]$ curl http://192.168.1.44:31766

Output would be something like below:

Perfect, that’s confirm we have successfully deployed highly available Kubernetes cluster with kubeadm on CentOS 7 servers. Please don’t hesitate to share your valuable feedback and comments.

Also Read : How to Setup NGINX Ingress Controller in Kubernetes

How to Dual Boot Linux Mint 20 with Windows 10

Mon, 27 Jul 2020 04:02:10 GMT

Linux Mint 20, also referred to as Ulyana, was released in June 2020 and packs with a basket of new features and enhancements to improve your overall user experience. If you have Windows 10 already on your PC and would like to reap the full benefits of the latest Mint release, you can install it alongside Windows 10.

Upon booting, you will be presented with the option of booting into either Linux Mint 20 or Windows 10. In this guide, we show you how to dual boot Windows 10 and Linux Mint 20.

Prerequisites

Before embarking on configuring the dual-boot setup, ensure that the following requirements are met:

A bootable installation medium of Linux Mint 20 (Either USB or DVD)
A fast and stable internet connection

Note : In Windows 10, we can make a bootable USB drive from ISO file using Rufus software. Use the following URL to download Linux Mint 20:

Download Linux Mint 20

Step 1) Create a free partition on Windows for Linux installation

To start off, we need to partition the hard drive and create a separate partition for installation of Linux Mint. So, launch the disk management utility by pressing ‘Windows key + R’ to open the run dialogue. Then type diskmgmt.msc and hit ‘ENTER’.

The Disk Management utility lists all the hard drives attached to the PC and their partitions. In our example, we only have a single hard drive with one partition. We are going to shrink this partition and create a free partition for our Linux Mint 20 installation. Right click on the partition and select the ‘Shrink’ option

On the pop-up that appears, specify the amount of space that you’d like to shrink the partition to. In this case, we have allocated 15593 MB to the partition that we are going to install Linux Mint on. Once done, click on the ‘Shrink’ button to shrink the volume and create the free partition.

The unallocated space is now ready to be used for the installation of Linux Mint.

All you have to do now is to plug in your bootable USB drive and reboot your PC. Be sure to change the BIOS settings and assign your USB/DVD medium the highest boot priority. Thereafter, save the changes and once again, reboot your system.

Step 2) Begin the Installation of Linux Mint 20

Upon rebooting, a grub menu will be displayed with a list of options shown. Select the first option to begin the installation.

This ushers you to the Linux Mint 20 desktop. Mint gives you an option to try out Mint without necessarily installing it. You can explore the new look and various features. But since we are interested in installing Mint, simply click on the ‘Install Linux Mint’ icon as shown.

Step 3) Choose Language and Keyboard Layout

On the welcome page, select your preferred installation language and click on the ‘Continue’ button.

Next, select your keyboard layout as shown and click ‘Continue’.

Step 4) Choose to ‘Install multimedia codecs’ during the installation

In the this step, check off the ‘Install multimedia codecs’ checkbox to install the latest multimedia codecs to enable you to play specific video formats such as MPEG-4, AVI and WMA.

Step 5) Choose Installation type

This step gives you 3 options of how you’d like to install Linux Mint.

The first option allows you to Install Linux Mint alongside Windows 10. The installer will intelligently partition the hard drive to accommodate all the Linux partitions and reserve the NTFS partitions used by Windows 10. Select this option if you are not familiar with manual partitioning.

The second option – ‘Erase Disk and install Linux Mint’ – entirely erases the hard drive and lets you install Linux Mint. But that’s not what we want. We want to have a dual-boot setup where we shall have an option of booting into either Windows or Linux Mint upon rebooting. So steer clear from this option.

The last option ‘Something else’ , allows you to manually partition the hard drive. It gives you the flexibility to determine which partitions to create for your Mint installation and the disk space to assign those partitions. This opt is recommended for seasoned Linux users who are familiar with manual partitioning.

For this guide, we will go with this option since the first option is fairly easy. So click on ‘Something else’ and click the ‘Continue’ button.

The next window will list all the partitions on your hard drive. As you will notice, you already have the Windows 10 NTFS partition and the free space we created earlier on by shrinking the hard drive.

We will use the free space to create partitions for Linux Mint 20. Therefore, select the free space entry and click on the plus sign [ + ] button.

We are going to create the following mount points (Partitions)

Root partition – / – 10340 MB
Boot partition – /boot – 2000 MB
Swap filesystem – 4000 MB

On the ‘create partition’ pop-up, specify the size of the root partition, filesystem to be used and mount point ( / ). Then Click ‘OK’

If you look closely, the root partition, labelled /dev/sda5 has been created.

To create the boot partition, repeat the same procedure by clicking the plus sign [ + ] and once again specifying the size of the partition, file system and choosing the partition type as /boot as shown.

The boot partition will be created labelled as /dev/sda6.

Finally create the swap filesystem. Swap is a virtual space that is created on the hard disk and comes in handy when the RAM is almost getting depleted. It supplements the RAM and avoids instances of processes getting killed when the RAM is overwhelmed.

The complete partition table should resemble what we have below with both Windows and Linux partitions. To proceed with the installation click the ‘Install Now’ button.

Next, you will be prompted to write changes to the disk. Click on the ‘Continue’ button to save the partitions on your hard drive.

Step 6) Choose your preferred language and user credentials

In this step, you will be required to select your location on the world map. If you are connected to the internet during the installation process, your location will be auto-detected. Otherwise, simply click on the world map provided to select your location and click on the ‘Continue’ button.

Thereafter, create a default user account by providing your username, your PC’s name and your preferred password. Then click ‘Continue’.

Step 7) Linux Mint 20 Installation begins

The installer will begin downloading, copying and installing software packages on your system. This will take a while, and this would be an awesome moment to take a break and grab a cup of tea.

Once the installation is complete, click on the ‘Restart Now’ button to reboot the system.

Step 8) Choose Operating System to boot (Windows or Linux Mint 20)

Upon rebooting, notice that you now have 2 operating systems you can pick to boot into: Linux Mint 20 and Windows 10. Feel free to scroll up and down using the up/down arrow keys to select the OS you want to boot into.

To boot into Linux, simply hit ‘ENTER’

Provide your password and hit ‘ENTER’ to log into the system.

And this wraps up this guide on how to dual boot Windows 10 and Linux Mint 20. We do hope that you can now comfortably set up a dual boot system on your PC. Your feedback is much appreciated.