Questions[fedora-server](server)

So I have 2 VMs (Fedora 24 Server and its Client).

I am trying to run DNS in Server and get output in Client.

The DNS of my client is IP of Server, All of them are on same Class of network with is 192.168.95.0/24

IP of Server - 192.168.95.1 IP of Client - 192.168.95.50

DNS is ON in Server and firewall is disable in both VM

I have changed named.conf file as well Check Screenshot named.conf file

I am getting >>this error while passing command in Fedora Client ->Error Image in Client

Please someone assist me.

After walking down the garden path of reading the documentation, and being led astray - in particular, by the materials I found here - out of pure frustration I eventually found my way to the "official Wiki", which is here, and it pointed me to the "missing" Command Line Interface (CLI) utilities. They're found, on my installation, at /lib/mailman/bin. However, they don't work!

For example, running as user mailman:

$ add_members -h
Traceback (most recent call last):
  File "/lib/mailman/bin/add_members", line 89, in <module>
    from Mailman import i18n
ImportError: No module named Mailman

I'm sure someone will ask, so:

Fedora Server 32 running mailman3-3.2.2-1.fc32.noarch ...And some 153 or so Python3 packages... A python3 --version command says it's 3.8.5.

BTW, I used DNF to install Mailman3. I have no idea if I was supposed to install more than just that, but normally DNF will complain if there are unresolved dependencies and it didn't complain.

...I really need to get these working and am NOT a Python programmer, by any means. Nor do I really want to take the time to learn it now... Why mention that? Keep reading:

As a "bread-crumb" (as in the Hansel and Gretel folk tale) for those who might follow along later, from the documentation at the previously cited site, APPARENTLY, again, according to THAT source, you have to get into a Python shell, write your own Python functions and, in short, become a Python AND Mailman library expert just to use what they call a CLI interface. Crazy!

If going that route, you su to mailman (to get the right user context) then:

$ PYTHONSTARTUP= mailman3 shell

And you get a python prompt >>> and from there you have to do things like:

>>> from mailman.testing.documentation import cli
>>> command = cli('mailman.commands.cli_withlist.shell')
>>> command('mailman shell --details')

And, there's a LOT possible from here, All of which requires a lot of typing AND knowing Python far better than I presently do. There's documentation for this over here. ...All I really want to do is import a file containing people's names and email addresses saved from the previous version and add them to a list, but it's a LOT of typing to do that in this environment.

Happily, that all DOES work, best I could tell from my not-fully-informed attempts at trying it.

It should be "very easy" to write scripts that would emulate the older mailman 2.x utilities, so perhaps you can see how I was frustrated before I found the utilities STILL DO exist, they just don't work! ...I'm 100% sure I could learn Python and the mailman3 library and write my own, but I have no time for that. ...SO, I need to get these other utilities working.

I followed these instructions: https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller

These instructions didn't work exactly as they read. There was one step I didn't get a result because samba was stopped and it needed to be running (for dns) to get the result in the guide but other than that, everything happens as this guide says but when I try to join the domain from a vm I created. I have just one dc at this time. I've created a Fedora Server 35 vm to add as another dc after I get it working solo bc that's how I really want to use it.

$ realm join test-server.lan -U Administrator

Password for Administrator:
See: journalctl REALMD_OPERATION=r1171585.2732805
realm: Couldn't join realm: Failed to join the domain**

$ journalctl REALMD_OPERATION=r1171585.2732805

-- Journal begins at Fri 2021-10-01 15:39:25 EDT, ends at Mon 2021-10-04 22:26:45 EDT. --
Oct 04 22:24:21 fedora realmd[2732808]:  * Resolving: _ldap._tcp.test-server.lan
Oct 04 22:24:21 fedora realmd[2732808]:  * Performing LDAP DSE lookup on: 10.0.0.10
Oct 04 22:24:21 fedora realmd[2732808]:  * Successfully discovered: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli
Oct 04 22:24:30 fedora realmd[2732808]:  * LANG=C /usr/sbin/adcli join --verbose --domain test-server.lan --domain-realm TEST-SERVER.LAN --domain-controller 10.0.0.10 --login-type user --login-user Administrator --stdin-password
Oct 04 22:24:30 fedora realmd[2732808]:  * Using domain name: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Calculated computer account name from fqdn: FEDORA
Oct 04 22:24:30 fedora realmd[2732808]:  * Using domain realm: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Sending NetLogon ping to domain controller: 10.0.0.10
Oct 04 22:24:46 fedora realmd[2732808]:  * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-OMYnX1/krb5.d/adcli-krb5-conf-lTV3xU
Oct 04 22:24:46 fedora realmd[2732808]:  ! Couldn't authenticate as: [email protected]: Client '[email protected]' not found in Kerberos database
Oct 04 22:24:46 fedora realmd[2732808]: adcli: couldn't connect to test-server.lan domain: Couldn't authenticate as: [email protected]: Client '[email protected]' not found in Kerberos database
Oct 04 22:24:46 fedora realmd[2732808]:  ! Failed to join the domain

/etc/samba/smb.conf:

# Global parameters
[global]
dns forwarder = 10.0.0.1
netbios name = FS34
realm = TEST-SERVER.LAN
server role = active directory domain controller
workgroup = TEST-SERVER
idmap_ldb:use rfc2307 = yes

[sysvol]
path = /var/lib/samba/sysvol
read only = No

[netlogon]
path = /var/lib/samba/sysvol/test-server.lan/scripts
read only = No

[homes]
comment = Home Directories
browseable = no
writable = yes
valid users = %S
; valid users = MYDOMAIN\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons:
; [netlogon]
; comment = Network Logon Service
; path = /var/lib/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no

# Un-comment the following to provide a specific roaming profile share.
# The default is to use the user's home directory:
; [Profiles]
; path = /var/lib/samba/profiles
; browseable = no
; guest ok = yes

# A publicly accessible directory that is read only, except for users in the
# "staff" group (which have write permissions):
; [public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; writable = no
; printable = no
; write list = +staff

[Photos]
comment = Photos
path = /multimedia/Photos

browseable = Yes
read only = No
inherit acls = Yes

[Videos]
comment = Videos
path = /multimedia/Videos

browseable = Yes
read only = No
inherit acls = Yes

[Movies]
comment = Videos
path = /multimedia/Movies

browseable = Yes
read only = No
inherit acls = Yes

[Music]
comment = Videos
path = /multimedia/Music

browseable = Yes
read only = No
inherit acls = Yes

[seagate]
comment = Videos
path = /media/seagate

browseable = Yes
read only = No
inherit acls = Yes

/etc/krb5.conf:

[libdefaults]
default_realm = TEST-SERVER.LAN
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h

[realms]
TEST-SERVER.LAN = {
default_domain = test-server.lan
kdc = test-server.lan
}

[domain_realm]
fs34 = TEST-SERVER.LAN
dc01 = TEST-SERVER.LAN
.test-server = TEST-SERVER.LAN
.test-server.lan = TEST-SERVER.LAN
dc01.test-server.lan = TEST-SERVER.LAN

I am able to access the shares and I have mounted them (as a user I've added).

//test-server.lan/Photos  2.7T  1.8T  926G  66% /home/user/mnt/Photos
//test-server.lan/Videos  2.8T  1.9T  926G  68% /home/user/mnt/Videos
//test-server.lan/Movies  2.8T  1.9T  926G  68% /home/user/mnt/Movies

# smbclient -L test-server.lan -U user

Enter TEST-SERVER\user's password:

Sharename       Type      Comment
---------       ----      -------
sysvol          Disk      
netlogon        Disk      
Photos          Disk      Photos
Videos          Disk      Videos
Movies          Disk      Videos
Music           Disk      Videos
seagate         Disk      Videos
IPC$            IPC       IPC Service (Samba 4.14.7)
SMB1 disabled -- no workgroup available

I'm trying to implement a pretty simple firewall in Fedora, where the public internet can access SSH, HTTP, HTTPS and Cockpit, but nothing else. Meanwhile, the servers run microservices via Docker that can talk to each other on ports 8000-8999.

I set this up on a fresh Fedora Server install with the following commands:

firewall-cmd --zone=public --add-service=cockpit
firewall-cmd --zone=public --add-service=http
firewall-cmd --zone=public --add-service=https

firewall-cmd --zone=internal --add-source=192.168.1.65
firewall-cmd --zone=internal --add-source=192.168.1.66

firewall-cmd --zone=internal --add-port=8000-8999/tcp

firewall-cmd --runtime-to-permanent

When I check my config with --list-all, everything looks correct:

> firewall-cmd --list-all --zone=internal
internal (active)
  target: default
  icmp-block-inversion: no
  interfaces:
  sources: 192.168.1.65 192.168.1.66
  services: dhcpv6-client ssh
  ports: 8000-8999/tcp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

> firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp2s0
  sources:
  services: cockpit dhcpv6-client http https ssh
  ports:
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

However, when I test this, I'm able to hit http://192.168.1.65:8080. I can hit it from a machine on the same internal network (192.168.128.128), as well as a public request from an external machine. Since neither was listed in internal's sources, I assumed that firewalld would not allow the requests through.

I have an auto-configured docker zone with the docker0 interface, but removing that doesn't seem to change my ability to hit the internal port.

Why am I able to successfully request :8080 from sources that are not listed on internal?

I've got a server running Fedora 28 that is primarily an RDBS host running PostgreSQL 10.7-1:

[Fedora 28]$ dnf list postgresql-server
Last metadata expiration check: 0:20:19 ago on Mon 12 Jul 2021 09:39:03 AM MDT.
Installed Packages
postgresql-server.x86_64                                                                                    10.7-1.fc28                                                                                    @updates

For reasons, we'd like to migrate that machine to CentOS 8 Stream, which, nicely, happens to be currently supporting 10.17.1:

[CentOS 8 Stream]$ dnf list postgresql-server
Last metadata expiration check: 0:00:08 ago on Mon 12 Jul 2021 09:58:15 AM MDT.
Available Packages
postgresql-server.x86_64                                                                       10.17-1.module_el8.5.0+827+770862af                                                                        appstream

It seems to me that I may be able to replace the Fedora 28 repos with CentOS 8 Stream repos and do dnf upgrades, followed by a reboot.

Is this a huge risk? I'd like to preserve the Postgres data layout and simply fire it up again (perhaps with a few tweaks) rather than have to do a clean install from ISO.