maintenance:general:rhel7_installation_guide
LDAP: couldn't connect to LDAP server
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| maintenance:general:rhel7_installation_guide [2022/07/19 09:36] – [Files] yspeerte | maintenance:general:rhel7_installation_guide [2022/07/20 13:55] (current) – [Files] yspeerte | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== Install NetYCE on RHEL/Centos 7 ====== | ||
| + | |||
| + | This installation guide installs NetYCE version 7.x on a Redhat 7 or Centos 7 physical or virtual x86_64 platform. | ||
| + | |||
| + | References to EL or RHEL refer to RedHat Enterprise Linux or CentOS Linux. All OS versions and packages are required to use the x86_64 architecture, | ||
| + | |||
| + | ===== Introduction ===== | ||
| + | |||
| + | The choice of operating system (Redhat or CentOS), disk filesystem layout, installed packages, and security hardening are mostly defined by the customers common practice. NetYCE does have some requirements on disk-usage and directory-trees that may warrant filesystem allocations, | ||
| + | |||
| + | A basic set of packages should be installed which will later be amended by specific NetYCE software. The basic OS installation can easily be realized by the customer, but we recommend the NetYCE software installation and configuration to be a joint effort. | ||
| + | |||
| + | During the first install of the NetYCE software packages, the configuration preferences and details of the NetYCE system and its architecture will be defined and initialized. Subsequent software upgrades and patches can be installed by the application manager using the NetYCE front-end without requiring system privileges. Only on some major upgrades will those be required. | ||
| + | |||
| + | The NetYCE software installation consists of two self-installing packages, YCE and YCEperl, a sample database and a license file. The installation depends on MariaDB (mysql server), apache (http server), fping and some standard distribution packages (openssl, tftp, ftp, ssh, telnet, gtar, etc). Mysecureshell is a non standard distribution package we use for sftp jail functionality. | ||
| + | |||
| + | Please check the [[maintenance: | ||
| + | |||
| + | ==== System specification ==== | ||
| + | |||
| + | The hardware requirements of NetYCE are moderate by itself although much depends on the intended level of use and the application architecture selected. | ||
| + | |||
| + | In general we suggest to deploy two NetYCE servers in different data centers attached to Network Management (NMS) networks. These systems will provide both front-end (user and network facing) functions AND a database function. These functions can be configured to provide live failover and backup services by means of master-master replication. The front-end functions support 10-20 simultaneous users and can execute several thousand config changes per hour. | ||
| + | |||
| + | For such deployments a physical or virtual x86 server needs to have at least two CPU cores and 4 GB of memory, but 4 cores and 8 GB memory is recommended. | ||
| + | |||
| + | Disk space can be local or SAN based and should not exceed 100 GB. This disk space is allotted to a single filesystem or split across several, depending on system management preferences. | ||
| + | |||
| + | |||
| + | < | ||
| + | / - 4 to 15 GB (OS root, bin, usr, lib, opt, etc) | ||
| + | /opt/yce - 500 MB | ||
| + | /opt/nms - 500 MB | ||
| + | /opt/ycelib - 800 MB | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | The provided image has an expanding virtual disk of 500G. | ||
| + | ===== Centos ===== | ||
| + | |||
| + | |||
| + | * root password: NetYCE01 | ||
| + | * Group: nms, gid: 8000 | ||
| + | * User: yce, uid: 1000, password: NetYCE01 | ||
| + | * Timezone: Europe/ | ||
| + | * firewall: disabled | ||
| + | |||
| + | ==== partition layout ==== | ||
| + | * sda1: /boot, xfs, 2G, primary | ||
| + | * sda2: lvm, 1x PV, 1x VG | ||
| + | * swap 4G, name: swap | ||
| + | * /, xfs, rest of disk, name: rootvol | ||
| + | |||
| + | ===== After initial OS install ===== | ||
| + | |||
| + | First we make sure the ' | ||
| + | ==== Change user/group ==== | ||
| + | |||
| + | <code bash> | ||
| + | groupadd -g 8000 nms | ||
| + | adduser -g nms -u 1000 -N -p ' | ||
| + | passwd -i -1 yce | ||
| + | |||
| + | # " | ||
| + | usermod -g nms -G '' | ||
| + | # " | ||
| + | groupdel yce | ||
| + | |||
| + | adduser -M -g nms -u 1000 -d / | ||
| + | passwd -i -1 ycicle | ||
| + | </ | ||
| + | |||
| + | |||
| + | Log out and log in with the ' | ||
| + | ==== Packages ==== | ||
| + | < | ||
| + | sudo / | ||
| + | |||
| + | sudo / | ||
| + | |||
| + | sudo / | ||
| + | |||
| + | sudo / | ||
| + | |||
| + | </ | ||
| + | |||
| + | ==== Files ==== | ||
| + | |||
| + | All files have 644 permissions and ' | ||
| + | |||
| + | This is a file, since it contains special characters. | ||
| + | |||
| + | === bash_profile === | ||
| + | |||
| + | / | ||
| + | {{: | ||
| + | |||
| + | === bashrc === | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # .bashrc | ||
| + | |||
| + | # User specific aliases and functions | ||
| + | |||
| + | # Source global definitions | ||
| + | if [ -f /etc/bashrc ]; then | ||
| + | . /etc/bashrc | ||
| + | fi | ||
| + | |||
| + | # Uncomment the following line if you don't like systemctl' | ||
| + | # export SYSTEMD_PAGER= | ||
| + | |||
| + | # Source alias definitions | ||
| + | if [ -f ~/ | ||
| + | . ~/ | ||
| + | fi | ||
| + | </ | ||
| + | |||
| + | === shell_aliases === | ||
| + | / | ||
| + | < | ||
| + | export PAGER=" | ||
| + | export EDITOR=" | ||
| + | alias l='ls -lF' | ||
| + | alias ll='ls -lhF' | ||
| + | alias llt=' | ||
| + | alias lr='ls -latrF' | ||
| + | alias la='ls -ahF' | ||
| + | alias lla=' | ||
| + | alias lc='ls -CaF' | ||
| + | alias p=' | ||
| + | alias pst=' | ||
| + | alias t=' | ||
| + | alias n=' | ||
| + | alias o=' | ||
| + | if [ -x / | ||
| + | alias vi=' | ||
| + | fi | ||
| + | alias grep=' | ||
| + | alias gerp=' | ||
| + | alias ip='ip --color' | ||
| + | alias ip4=' | ||
| + | alias ip6=' | ||
| + | </ | ||
| + | |||
| + | === vimrc === | ||
| + | / | ||
| + | < | ||
| + | set ts=4 | ||
| + | set sw=4 | ||
| + | set ai | ||
| + | set noerrorbells | ||
| + | set formatoptions-=r | ||
| + | </ | ||
| + | |||
| + | === sudo === | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # Yce | ||
| + | Cmnd_Alias YCE = / | ||
| + | |||
| + | # Services | ||
| + | Cmnd_Alias SERVICES = / | ||
| + | |||
| + | # Installation and management of software | ||
| + | Cmnd_Alias SOFTWARE = /bin/rpm, / | ||
| + | |||
| + | # Processes | ||
| + | Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, / | ||
| + | |||
| + | # Networking | ||
| + | Cmnd_Alias NETWORKING = / | ||
| + | |||
| + | # Storage | ||
| + | # Cmnd_Alias STORAGE = / | ||
| + | |||
| + | # Delegating permissions | ||
| + | Cmnd_Alias DELEGATING = / | ||
| + | |||
| + | Defaults | ||
| + | Defaults | ||
| + | Defaults | ||
| + | |||
| + | #==== YCE user group ' | ||
| + | # Below are a few examples. | ||
| + | # For production the MINIMUM profile might be a good start. | ||
| + | # For testing, the MAINTENANCE is regularly used. | ||
| + | |||
| + | # MINIMUM - NO SUDO | ||
| + | # No sudo: No password required for YCE applications, | ||
| + | # %nms ALL = (root) NOPASSWD: | ||
| + | |||
| + | # MINIMUM - WITH SUDO | ||
| + | # Sudo: No password required for YCE applications, | ||
| + | %nms ALL = PASSWD:ALL, NOPASSWD: | ||
| + | |||
| + | # MAINTENANCE | ||
| + | # %nms ALL = PASSWD:ALL, NOPASSWD: | ||
| + | |||
| + | # DEVELOPMENT | ||
| + | # %nms ALL = PASSWD:ALL, NOPASSWD: | ||
| + | # %nms ALL = PASSWD:ALL, NOPASSWD: | ||
| + | </ | ||
| + | |||
| + | === bash_profile (root) === | ||
| + | |||
| + | / | ||
| + | <code bash> | ||
| + | # .bash_profile | ||
| + | # | ||
| + | # NetYCE, 2021 | ||
| + | # | ||
| + | |||
| + | # Get the aliases and functions | ||
| + | if [ -f ~/.bashrc ]; then | ||
| + | . ~/.bashrc | ||
| + | fi | ||
| + | |||
| + | # User specific environment and startup programs | ||
| + | if [ -r "/ | ||
| + | source "/ | ||
| + | else | ||
| + | echo " | ||
| + | fi | ||
| + | |||
| + | PATH=$PATH: | ||
| + | |||
| + | PATH=/ | ||
| + | export PATH | ||
| + | |||
| + | export PS1=' | ||
| + | |||
| + | if [ -f / | ||
| + | alias ls='ls -N --color=tty -T 0 ' | ||
| + | fi | ||
| + | |||
| + | echo " | ||
| + | if [ -x "/ | ||
| + | / | ||
| + | else | ||
| + | echo " | ||
| + | fi | ||
| + | |||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | </ | ||
| + | |||
| + | === bashrc (root) === | ||
| + | |||
| + | / | ||
| + | <code bash> | ||
| + | # .bashrc | ||
| + | |||
| + | # User specific aliases and functions | ||
| + | |||
| + | # alias rm='rm -i' | ||
| + | # alias cp='cp -i' | ||
| + | # alias mv='mv -i' | ||
| + | |||
| + | # Source global definitions | ||
| + | if [ -f /etc/bashrc ]; then | ||
| + | . /etc/bashrc | ||
| + | fi | ||
| + | |||
| + | # Uncomment the following line if you don't like systemctl' | ||
| + | # export SYSTEMD_PAGER= | ||
| + | |||
| + | # Source alias definitions | ||
| + | if [ -f ~/ | ||
| + | . ~/ | ||
| + | fi | ||
| + | </ | ||
| + | |||
| + | ===== General ===== | ||
| + | |||
| + | All files need to be changed with root privileges. | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # or your desired value | ||
| + | SystemMaxUse=200M | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | LANG=en_US.utf-8 | ||
| + | LC_ALL=en_US.utf-8 | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | SYNC_HWCLOCK=yes | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | ZONE=" | ||
| + | UTC=" | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | SELINUX=disabled | ||
| + | </ | ||
| + | ===== Yce dirs ===== | ||
| + | <code bash> | ||
| + | sudo mkdir -p /var/opt | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p /opt | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | |||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p /opt/ycelib | ||
| + | sudo mkdir -p /opt/yce | ||
| + | sudo mkdir -p /opt/nms | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | sudo mkdir -p / | ||
| + | |||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms /opt/ycelib | ||
| + | sudo chown yce:nms /opt/yce | ||
| + | sudo chown yce:nms /opt/nms | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | sudo chown yce:nms / | ||
| + | </ | ||
| + | |||
| + | ===== Repositories ===== | ||
| + | |||
| + | Create the files with root privileges. | ||
| + | |||
| + | / | ||
| + | < | ||
| + | [MySecureShell] | ||
| + | baseurl = http:// | ||
| + | enabled = 1 | ||
| + | gpgcheck = 0 | ||
| + | name = MySecureShell | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | [MariaDB] | ||
| + | baseurl = http:// | ||
| + | enabled = 1 | ||
| + | gpgcheck = 1 | ||
| + | gpgkey = https:// | ||
| + | name = http:// | ||
| + | </ | ||
| + | |||
| + | ===== Packages ===== | ||
| + | < | ||
| + | sudo yum install -y bzip2 crontabs curl dhcp dkms findutils file fping ftp git httpd iproute iputils less man man-pages MariaDB-client MariaDB-server mod_ssl mtr mysecureshell nano net-snmp net-snmp-utils nfs-utils nfs4-acl-tools ntp ntpdate openssh-clients openssh-server openssl php postfix python2-pip python3 python3-pip rpcbind rsync sed sudo syslog-ng syslog-ng-libdbi tar telnet tftp traceroute unzip vim-enhanced vsftpd wget which yum-utils zip | ||
| + | |||
| + | sudo yum remove -y rsyslog | ||
| + | |||
| + | sudo python2 -m pip install -U pip==20.3.4 pexpect | ||
| + | |||
| + | sudo python3 -m pip install -U pip setuptools | ||
| + | |||
| + | </ | ||
| + | |||
| + | as yce user: | ||
| + | < | ||
| + | python3 -m pip install -U xmltodict ncclient PyYAML pexpect pymysql netyce requests | ||
| + | </ | ||
| + | |||
| + | If running VMware: | ||
| + | < | ||
| + | sudo yum install -y open-vm-tools | ||
| + | sudo systemctl enable vmtoolsd | ||
| + | </ | ||
| + | |||
| + | If running HyperV: | ||
| + | |||
| + | / | ||
| + | < | ||
| + | add_drivers+=" | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | sudo dracut -f | ||
| + | </ | ||
| + | |||
| + | ===== yce perl ===== | ||
| + | as yce user: | ||
| + | < | ||
| + | wget https:// | ||
| + | chmod +x / | ||
| + | / | ||
| + | |||
| + | rm / | ||
| + | </ | ||
| + | |||
| + | ===== yce license ===== | ||
| + | < | ||
| + | mkdir / | ||
| + | wget https:// | ||
| + | </ | ||
| + | |||
| + | |||
| + | ===== Install NetYCE ===== | ||
| + | Download the desired version from the [[maintenance: | ||
| + | <code bash> | ||
| + | sh $downloaded_file | ||
| + | |||
| + | rm $downloaded_file | ||
| + | </ | ||
| + | |||
| + | ===== Service setup ===== | ||
| + | < | ||
| + | sudo ln -s / | ||
| + | sudo ln -s / | ||
| + | sudo cp / | ||
| + | sudo chmod 664 / | ||
| + | |||
| + | sudo systemctl daemon-reload | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # Map ' | ||
| + | # Map ' | ||
| + | # | ||
| + | com2sec ConfigUser | ||
| + | com2sec AllUser | ||
| + | |||
| + | # Map ' | ||
| + | # Map ' | ||
| + | # | ||
| + | group | ||
| + | group | ||
| + | |||
| + | # Define ' | ||
| + | # Define ' | ||
| + | # | ||
| + | view SystemView | ||
| + | view SystemView | ||
| + | view AllView | ||
| + | |||
| + | # Give ' | ||
| + | # Give ' | ||
| + | # | ||
| + | access | ||
| + | access | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | @version: | ||
| + | @include " | ||
| + | |||
| + | # RHEL7 syslog-ng configuration file for NetYCE. | ||
| + | # | ||
| + | # This should behave pretty much like the original syslog on RedHat. | ||
| + | # See syslog-ng(8) and syslog-ng.conf(5) for more information. | ||
| + | # | ||
| + | # Note: it also sources additional configuration files (*.conf) | ||
| + | # | ||
| + | |||
| + | options { | ||
| + | flush_lines (0); | ||
| + | time_reopen (10); | ||
| + | log_fifo_size (1000); | ||
| + | chain_hostnames (off); | ||
| + | use_dns (yes); | ||
| + | use_fqdn (yes); | ||
| + | create_dirs (no); | ||
| + | keep_hostname (yes); | ||
| + | keep-timestamp (no); | ||
| + | }; | ||
| + | |||
| + | source net { | ||
| + | tcp(); | ||
| + | udp(); | ||
| + | }; | ||
| + | |||
| + | source s_sys { | ||
| + | system(); | ||
| + | internal(); | ||
| + | # udp(ip(0.0.0.0) port(514)); | ||
| + | }; | ||
| + | |||
| + | destination d_logs { | ||
| + | file( | ||
| + | "/ | ||
| + | owner(" | ||
| + | group(" | ||
| + | perm(0644) | ||
| + | ); | ||
| + | }; | ||
| + | |||
| + | destination d_cons { file("/ | ||
| + | destination d_mesg { file("/ | ||
| + | destination d_auth { file("/ | ||
| + | destination d_mail { file("/ | ||
| + | destination d_spol { file("/ | ||
| + | destination d_boot { file("/ | ||
| + | destination d_cron { file("/ | ||
| + | destination d_kern { file("/ | ||
| + | destination d_mlal { usertty(" | ||
| + | |||
| + | filter f_kernel | ||
| + | filter f_default | ||
| + | level(info..emerg) and | ||
| + | not (facility(mail) | ||
| + | or facility(authpriv) | ||
| + | or facility(cron)); | ||
| + | }; | ||
| + | filter f_auth | ||
| + | filter f_mail | ||
| + | filter f_emergency | ||
| + | filter f_news | ||
| + | facility(uucp) or | ||
| + | (facility(news) | ||
| + | and level(crit..emerg)); | ||
| + | }; | ||
| + | filter f_boot | ||
| + | filter f_cron | ||
| + | |||
| + | log { source(net); | ||
| + | log { source(s_sys); | ||
| + | #log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | log { source(s_sys); | ||
| + | |||
| + | |||
| + | # Source additional configuration files (.conf extension only) | ||
| + | @include "/ | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | / | ||
| + | missingok | ||
| + | notifempty | ||
| + | start 0 | ||
| + | rotate 9 | ||
| + | nodateext | ||
| + | nocompress | ||
| + | maxsize 50M | ||
| + | daily | ||
| + | create 0644 yce nms | ||
| + | postrotate | ||
| + | /bin/kill -HUP `cat / | ||
| + | /bin/kill -USR2 `cat / | ||
| + | endscript | ||
| + | } | ||
| + | |||
| + | </ | ||
| + | / | ||
| + | < | ||
| + | # | ||
| + | # NetYCE 2020 | ||
| + | # see / | ||
| + | # | ||
| + | / | ||
| + | / | ||
| + | { | ||
| + | missingok | ||
| + | notifempty | ||
| + | start 0 | ||
| + | rotate 9 | ||
| + | nodateext | ||
| + | nocompress | ||
| + | maxsize 2M | ||
| + | daily | ||
| + | create 0644 yce nms | ||
| + | postrotate | ||
| + | / | ||
| + | endscript | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | |||
| + | / | ||
| + | < | ||
| + | # | ||
| + | # NetYCE 2016, 2020 | ||
| + | # | ||
| + | anonymous_enable=NO | ||
| + | local_enable=YES | ||
| + | write_enable=YES | ||
| + | local_umask=002 | ||
| + | dirmessage_enable=YES | ||
| + | connect_from_port_20=YES | ||
| + | chroot_list_enable=YES | ||
| + | listen=NO | ||
| + | listen_ipv6=YES | ||
| + | |||
| + | pam_service_name=vsftpd | ||
| + | userlist_enable=YES | ||
| + | tcp_wrappers=YES | ||
| + | |||
| + | xferlog_enable=YES | ||
| + | xferlog_std_format=YES | ||
| + | dual_log_enable=YES | ||
| + | userlist_log=YES | ||
| + | log_ftp_protocol=YES | ||
| + | xferlog_file=/ | ||
| + | vsftpd_log_file=/ | ||
| + | |||
| + | local_root=/ | ||
| + | secure_chroot_dir=/ | ||
| + | chown_username=yce.nms | ||
| + | guest_enable=NO | ||
| + | force_dot_files=NO | ||
| + | hide_file={.yce_prop} | ||
| + | delete_failed_uploads=YES | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | ycicle | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # | ||
| + | |||
| + | # This is the sshd server system-wide configuration file. See | ||
| + | # sshd_config(5) for more information. | ||
| + | |||
| + | # This sshd was compiled with PATH=/ | ||
| + | |||
| + | # The strategy used for options in the default sshd_config shipped with | ||
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| + | |||
| + | #Port 22 | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Disable legacy (protocol version 1) support in the server for new | ||
| + | # installations. In future the default will change to require explicit | ||
| + | # activation of protocol 1 | ||
| + | Protocol 2 | ||
| + | |||
| + | HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | |||
| + | # Lifetime and size of ephemeral version 1 server key | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Logging | ||
| + | # obsoletes QuietMode and FascistLogging | ||
| + | # | ||
| + | SyslogFacility AUTHPRIV | ||
| + | #LogLevel INFO | ||
| + | |||
| + | # Authentication: | ||
| + | |||
| + | # | ||
| + | PermitRootLogin no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # For this to work you will also need host keys in / | ||
| + | # | ||
| + | # similar for protocol version 2 | ||
| + | # | ||
| + | # Change to yes if you don't trust ~/ | ||
| + | # RhostsRSAAuthentication and HostbasedAuthentication | ||
| + | # | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | IgnoreRhosts yes | ||
| + | |||
| + | # To disable tunneled clear text passwords, change to no here! | ||
| + | # | ||
| + | # | ||
| + | PasswordAuthentication yes | ||
| + | |||
| + | # Change to no to disable s/key passwords | ||
| + | # | ||
| + | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # GSSAPI options | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials yes | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set this to ' | ||
| + | # and session processing. If this is enabled, PAM authentication will | ||
| + | # be allowed through the ChallengeResponseAuthentication and | ||
| + | # PasswordAuthentication. | ||
| + | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
| + | # the setting of " | ||
| + | # If you just want the PAM account and session checks to run without | ||
| + | # PAM authentication, | ||
| + | # and ChallengeResponseAuthentication to ' | ||
| + | #UsePAM no | ||
| + | UsePAM yes | ||
| + | |||
| + | # Accept locale-related environment variables | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | X11Forwarding no | ||
| + | # | ||
| + | # | ||
| + | #PrintMotd yes | ||
| + | PrintLastLog yes | ||
| + | # | ||
| + | #UseLogin no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS yes | ||
| + | #PidFile / | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # no default banner path | ||
| + | #Banner none | ||
| + | |||
| + | # Set Ciphers and MACs | ||
| + | Ciphers aes128-ctr, | ||
| + | MACs hmac-ripemd160, | ||
| + | |||
| + | # no reverse lookups | ||
| + | UseDNS no | ||
| + | |||
| + | # override default of no subsystems | ||
| + | Subsystem | ||
| + | # Subsystem sftp internal-sftp | ||
| + | |||
| + | Match User ycicle | ||
| + | AllowTCPForwarding no | ||
| + | X11Forwarding no | ||
| + | # ChrootDirectory / | ||
| + | # ForceCommand internal-sftp | ||
| + | # ForceCommand / | ||
| + | |||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | ## MySecureShell Configuration File ## | ||
| + | #Default rules for everybody | ||
| + | < | ||
| + | GlobalDownload | ||
| + | # o -> bytes k -> kilo bytes m -> mega bytes | ||
| + | GlobalUpload | ||
| + | Download | ||
| + | Upload | ||
| + | StayAtHome | ||
| + | VirtualChroot | ||
| + | LimitConnection | ||
| + | LimitConnectionByUser | ||
| + | LimitConnectionByIP 2 #max connection by ip for the account | ||
| + | #ey Home /home/$USER #overrite home of the user but if you want you can use | ||
| + | # | ||
| + | IdleTimeOut | ||
| + | ResolveIP | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #Add execution right for directory if read right is set | ||
| + | HideNoAccess | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | DefaultRights | ||
| + | # | ||
| + | |||
| + | ShowLinksAsLinks | ||
| + | # | ||
| + | |||
| + | # | ||
| + | #EY | ||
| + | Shell / | ||
| + | Home / | ||
| + | </ | ||
| + | |||
| + | <User ycicle> | ||
| + | Shell / | ||
| + | Home / | ||
| + | VirtualChroot | ||
| + | ResolveIP | ||
| + | IgnoreHidden | ||
| + | ShowLinksAsLinks | ||
| + | </ | ||
| + | |||
| + | #Rules only for group ftp | ||
| + | #<Group ftp> | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #<Group sftp_administrator> | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #<Group old_client> | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #Rules only for group ftpnolimit | ||
| + | #<Group ftpnolimit> | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #< | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #<Group trusted_users> | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #< | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #</ | ||
| + | |||
| + | #Include / | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | [Service] | ||
| + | PrivateTmp=no | ||
| + | </ | ||
| + | |||
| + | ===== MariaDB (MySQL) ===== | ||
| + | copy the {{: | ||
| + | |||
| + | <code bash> | ||
| + | systemctl stop mariadb.service | ||
| + | rm -rf / | ||
| + | tar xzpf mysql_10.3.tgz -C /var/opt | ||
| + | chown -R yce:nms / | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===== net_setup & yce_setup ===== | ||
| + | |||
| + | < | ||
| + | sudo / | ||
| + | |||
| + | / | ||
| + | </ | ||
| + | |||
| + | ===== Service activation ===== | ||
| + | <code bash> | ||
| + | sudo systemctl enable postfix | ||
| + | sudo systemctl enable yce_psmon | ||
| + | sudo systemctl enable sshd | ||
| + | sudo systemctl enable syslog-ng | ||
| + | sudo systemctl enable rpcbind | ||
| + | sudo systemctl enable rpcbind.socket | ||
| + | sudo systemctl enable snmpd | ||
| + | sudo systemctl disable firewalld | ||
| + | sudo systemctl start postfix | ||
| + | sudo systemctl start yce_psmon | ||
| + | sudo systemctl start sshd | ||
| + | sudo systemctl start syslog-ng | ||
| + | sudo systemctl start rpcbind | ||
| + | sudo systemctl start rpcbind.socket | ||
| + | sudo systemctl start snmpd | ||
| + | </ | ||
| + | |||
| + | ===== Mysql repair ===== | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Verify mysql is running else execute again. | ||
| + | |||
| + | ===== Install yce_patches ===== | ||
| + | < | ||
| + | cd / | ||
| + | ./ | ||
| + | </ | ||
| + | |||
| + | ===== csv_api.ini optional ===== | ||
| + | < | ||
| + | wget https:// | ||
| + | </ | ||
| + | |||
| + | ===== cleanup, if needed ===== | ||
| + | < | ||
| + | rm / | ||
| + | </ | ||
| + | |||
| + | ===== reboot ===== | ||
| + | <code bash> | ||
| + | sudo reboot | ||
| + | </ | ||
| + | |||