Christoffer Reijer's questions

So I have a single machine on which I have installed CentOS Minimal and nothing more. It is completely isolated. This means the following:

• It can never be connected to another server or laptop
• The ONLY thing I can connect to it is a USB-disk.

My goal:

• Run yum install docker on it so it can run containers.

So I googled around on how to download a batch of RPMs and their dependencies, and then install them on an offline system.

So I did this on my macOS laptop:

$ docker run -v $PWD/pkg:/pkg centos:7
# mkdir /tmp/empty
# yum install -y \
  --installroot /tmp/empty \
  --releasever 7 \
  --downloadonly \
  --downloaddir /pkg \
  docker

Now I have lots of RPM files inside a folder. I put that folder on a USB stick and stick it into my isolated CentOS machine. Then I run:

$ yum install /tmp/pkg/*
...
Error: Package: rpm-python-4.11.3-32.el7.x86_64 (installed)
           Requires: rpm = 4.11.3-32.el7
           Removing: rpm-4.11.3-32.el7.x86_64 (installed)
               rpm = 4.11.3-32.el7
           Updated By: rpm-4.11.3-35.el7.x86_64 (/rpm-4.11.3-35.el7.x86_64)
               rpm = 4.11.3-35.el7

I have also tried to make the folder into a repository by running createrepo inside it on my Mac via docker (since I do not have createrepo on the isolated machine and cannot install anything on it). But it gives me the exact same error.

So what are my options here? It looks to me that because of dependency hell I have to actually mirror the whole CentOS repository. If I wanted a package from EPEL I would have to mirror that one as well. That's lots of gigabytes to transfer and store just to install docker on an isolated machine.

Is there any viable solution to this?

Bonus question: What if I run RHEL on the isolated machine instead of CentOS?

I am doing some server provisioning and I need to run a script AFTER installation as it requires the system to be fully functional, include services. So I cannot put it inside the %post section of my kickstart file.

Instead I have created a systemd service which disables itself as the last thing it does.

[Unit]
Description=Prepare the system after installation

[Service]
Type=oneshot
ExecStart=/usr/bin/prepare-system

[Install]
WantedBy=multi-user.target

The problem is that during the first boot, I get to the login prompt and can even login and start using the system, while the "first boot script" is still running.

This gives the Administrator setting up the system the illusion that the system is finished, when it's really not.

I would instead want the service to delay the booting, preferably showing a message like "The system is being prepared, please wait..." and wait there until the script is finished.

Background:

I intend to use Kickstart to automate the deployment/configuration of CentOS 7.

I am trying to generate an appropriate Kickstart file to pre-configure networking for the operating system, using a basic configuration file from a sample install of the operating system as a reference point.

I am not clear about how the network interface names are constructed, which poses a problem; I need to know what the interface name is/will be on deployment, so I can configure the network settings such as IP address/gateway/subnet mask, etc.

I do however have access to the MAC address information for each of the network cards on the hosts which will have the operating system deployed to them.

Question:

Do I have enough information to predict the network interface name and/or is there another approach I should consider?

As the title suggests I am trying to install Exchange 2016 on Windows Server 2016 Standard Edition. In unattended mode, to be specific.

The installation fails with the same error as in Exchange Server 2016 on Windows Server 2016 Technical Preview 4, namely that the component Server-Gui-Mgmt-Infra is missing, even though 1) it doesn't exist and 2) I have a GUI installed on the server (not Core).

It seems that the issue with TP4 and TP5 still persists in the final release.

Has anyone else had any success with this combination? Am I missing something?

I have a list of Windows Feature I want to install with DISM but I only know what their names are when using PowerShell.

Is there a way to quickly "translate" these names? It's more than a handful:

1. NET-Framework-45-Features
2. RPC-over-HTTP-proxy
3. RSAT-Clustering
4. RSAT-Clustering-CmdInterface
5. RSAT-Clustering-Mgmt
6. RSAT-Clustering-PowerShell
7. Web-Mgmt-Console
8. WAS-Process-Model
9. Web-Asp-Net45
10. Web-Basic-Auth
11. Web-Client-Auth
12. Web-Digest-Auth
13. Web-Dir-Browsing
14. Web-Dyn-Compression
15. Web-Http-Errors
16. Web-Http-Logging
17. Web-Http-Redirect
18. Web-Http-Tracing
19. Web-ISAPI-Ext
20. Web-ISAPI-Filter
21. Web-Lgcy-Mgmt-Console
22. Web-Metabase
23. Web-Mgmt-Console
24. Web-Mgmt-Service
25. Web-Net-Ext45
26. Web-Request-Monitor
27. Web-Server
28. Web-Stat-Compression
29. Web-Static-Content
30. Web-Windows-Auth
31. Web-WMI
32. Windows-Identity-Foundation
33. RSAT-ADDS

So I would like something other than toggling the feature with PowerShell and check for changes in the dism command's output. Hopefully there's a better way... :)

I have a Gunicorn socket file: /opt/rtd/gunicorn/run.sock. I need nginx to be able to open this socket and write to it.

When I run sesearch --allow -s httpd_t | grep unix_stream_socket I noticed that httpd_t is allowed to connect to sockets of type httpd_t. But when I try to apply that I get:

# semanage fcontext -a -t httpd_t "/opt/rtd/gunicorn/run.sock"
ValueError: Type httpd_t is invalid, must be a file or device type

I've tried other types I found from sesearch, for example httpd_sys_script_t or even passenger_t. Same result.

What should I set the type to?

I would prefer not to have to create additional policies to allow more than necessary. There must be a way to allow httpd_t to read from a file socket with existing policies in CentOS 7.2, right?

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log which prevents my usual processer from accessing these files, the end result being that I am unable to log in locally:

kernel: type=1400 audit(14958482): avc: denied { open } for pid=12345 comm="agetty" name="/var/log/wtmp" dev="dm-6" ino=134 scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:object_r:svirt_sandbox_file_t:s0 tclass=file

What's the best practice here? Turning off SELinux, while it gets rid of the issue, is not an option.

I want to close all ports but 22 on interface enp0s3. I have netcat listening on port 1234 for testing purposes. Here's where I'm stuck:

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --zone=drop --list-all
drop (default, active)
  interfaces: enp0s3
  sources: 
  services: ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 

$ nmap 10.0.2.15
Starting Nmap 6.40 ( http://nmap.org ) at 2016-02-24 06:36 UTC
Nmap scan report for 10.0.2.15
Host is up (0.00099s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
1234/tcp open  hotline

As you can see, nmap shows port 1234 as open, but I have added the interface to the drop zone in firewalld. What have I missed?

I am trying to setup single-sign on against our Active Directory server for my Apache using the mod_auth_kerb module.

I have the following configuration in Apache:

AuthType      Kerberos
AuthName      "Test"
KrbAuthRealms COMPANY.LOCAL
Krb5Keytab    /etc/apache2/http.keytab

The keytab was created with the following command:

ktpass -out http.keytab \
       -princ HTTP/[email protected] \
       -pass <REDACTED> \
       -mapuser COMPANY\myserver-HTTP \
       -crypto AES256-SHA1 \
       -ptype KRB5_NT_PRINCIPAL

I have verified that the principal in the keytab is also added to the account name.

I have another server with similar configuration where it works; the users are authenticated without a password prompt.

Any ideas on how to further troubleshoot this problem?