mirror of
https://github.com/LCTT/TranslateProject.git
synced 2026-08-23 04:03:29 +08:00
struggling
44
sources/news/Let's Encrypt--Entering Public Beta.md
Normal file
44
sources/news/Let's Encrypt--Entering Public Beta.md
Normal file
@@ -0,0 +1,44 @@
|
||||
Let's Encrypt:Entering Public Beta
|
||||
================================================================================
|
||||
We’re happy to announce that Let’s Encrypt has entered Public Beta. Invitations are no longer needed in order to get free
|
||||
certificates from Let’s Encrypt.
|
||||
|
||||
It’s time for the Web to take a big step forward in terms of security and privacy. We want to see HTTPS become the default.
|
||||
Let’s Encrypt was built to enable that by making it as easy as possible to get and manage certificates.
|
||||
|
||||
We’d like to thank everyone who participated in the Limited Beta. Let’s Encrypt issued over 26,000 certificates during the
|
||||
Limited Beta period. This allowed us to gain valuable insight into how our systems perform, and to be confident about moving
|
||||
to Public Beta.
|
||||
|
||||
We’d also like to thank all of our [sponsors][1] for their support. We’re happy to have announced earlier today that
|
||||
[Facebook is our newest Gold sponsor][2]/
|
||||
|
||||
We have more work to do before we’re comfortable dropping the beta label entirely, particularly on the client experience.
|
||||
Automation is a cornerstone of our strategy, and we need to make sure that the client works smoothly and reliably on a
|
||||
wide range of platforms. We’ll be monitoring feedback from users closely, and making improvements as quickly as possible.
|
||||
|
||||
Instructions for getting a certificate with the [Let’s Encrypt client][3] can be found [here][4].
|
||||
|
||||
[Let’s Encrypt Community Support][5] is an invaluable resource for our community, we strongly recommend making use of the
|
||||
site if you have any questions about Let’s Encrypt.
|
||||
|
||||
Let’s Encrypt depends on support from a wide variety of individuals and organizations. Please consider [getting involved][6]
|
||||
, and if your company or organization would like to sponsor Let’s Encrypt please email us at [sponsor@letsencrypt.org][7].
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://letsencrypt.org/2015/12/03/entering-public-beta.html
|
||||
|
||||
作者：[Josh Aas][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://letsencrypt.org/2015/12/03/entering-public-beta.html
|
||||
[1]:https://letsencrypt.org/sponsors/
|
||||
[2]:https://letsencrypt.org/2015/12/03/facebook-sponsorship.html
|
||||
[3]:https://github.com/letsencrypt/letsencrypt
|
||||
[4]:https://letsencrypt.readthedocs.org/en/latest/
|
||||
[5]:https://community.letsencrypt.org/
|
||||
[6]:https://letsencrypt.org/getinvolved/
|
||||
[7]:mailto:sponsor@letsencrypt.org
|
||||
65
sources/share/20151204 Review EXT4 vs. Btrfs vs. XFS.md
Normal file
65
sources/share/20151204 Review EXT4 vs. Btrfs vs. XFS.md
Normal file
@@ -0,0 +1,65 @@
|
||||
Review EXT4 vs. Btrfs vs. XFS
|
||||
================================================================================
|
||||
|
||||
|
||||
To be honest, one of the things that comes last in people’s thinking is to look at which file system on their PC is being used. Windows users as well as Mac OS X users even have less reason for looking as they have really only 1 choice for their operating system which are NTFS and HFS+. Linux operating system, on the other side, has plenty of various file system options, with the current default is being widely used ext4. However, there is another push for changing the file system to something other which is called btrfs. But what makes btrfs better, what are other file systems, and when can we see the distributions making the change?
|
||||
|
||||
Let’s first have a general look at file systems and what they really do, then we will make a small comparison between famous file systems.
|
||||
|
||||
### So, What Do File Systems Do? ###
|
||||
|
||||
Just in case if you are unfamiliar about what file systems really do, it is actually simple when it is summarized. The file systems are mainly used in order for controlling how the data is stored after any program is no longer using it, how access to the data is controlled, what other information (metadata) is attached to the data itself, etc. I know that it does not sound like an easy thing to be programmed, and it is definitely not. The file systems are continually still being revised for including more functionality while becoming more efficient in what it simply needs to do. Therefore, however, it is a basic need for all computers, it is not quite as basic as it sounds like.
|
||||
|
||||
### Why Partitioning? ###
|
||||
|
||||
Many people have a vague knowledge of what the partitions are since each operating system has an ability for creating or removing them. It can seem strange that Linux operating system uses more than 1 partition on the same disk, even while using the standard installation procedure, so few explanations are called for them. One of the main goals of having different partitions is achieving higher data security in the disaster case.
|
||||
|
||||
By dividing your hard disk into partitions, the data may be grouped and also separated. When the accidents occur, only the data stored in the partition which got the hit will only be damaged, while data on the other partitions will survive most likely. These principles date from the days when the Linux operating system didn’t have a journaled file system and any power failure might have led to a disaster.
|
||||
|
||||
The using of partitions will remain for security and the robustness reasons, then the breach on 1 part of the operating system does not automatically mean that whole computer is under risk or danger. This is currently most important factor for the partitioning process. For example, the users create scripts, the programs or web applications which start filling up the disk. If that disk contains only 1 big partition, then entire system may stop functioning if that disk is full. If the users store data on separate partitions, then only that data partition can be affected, while system partitions and the possible other data partitions will keep functioning.
|
||||
|
||||
Mind that to have a journaled file system will only provide data security in case if there is a power failure as well as sudden disconnection of the storage devices. Such will not protect the data against the bad blocks and the logical errors in the file system. In such cases, the user should use a Redundant Array of Inexpensive Disks (RAID) solution.
|
||||
|
||||
### Why Switch File Systems? ###
|
||||
|
||||
The ext4 file system has been an improvement for the ext3 file system that was also an improvement over the ext2 file system. While the ext4 is a very solid file system which has been the default choice for almost all distributions for the past few years, it is made from an aging code base. Additionally, Linux operating system users are seeking many new different features in file systems which ext4 does not handle on its own. There is software which takes care of some of such needs, but in the performance aspect, being able to do such things on the file system level could be faster.
|
||||
|
||||
### Ext4 File System ###
|
||||
|
||||
The ext4 has some limits which are still a bit impressive. The maximum file size is 16 tebibytes (which is roughly 17.6 terabytes) and is much bigger than any hard drive a regular consumer can currently buy. While, the largest volume/partition you can make with ext4 is 1 exbibyte (which is roughly 1,152,921.5 terabytes). The ext4 is known to bring the speed improvements over ext3 by using multiple various techniques. Like in the most modern file systems, it is a journaling file system that means that it will keep a journal of where the files are mainly located on the disk and of any other changes that happen to the disk. Regardless all of its features, it doesn’t support the transparent compression, the data deduplication, or the transparent encryption. The snapshots are supported technically, but such feature is experimental at best.
|
||||
|
||||
### Btrfs File System ###
|
||||
|
||||
The btrfs, many of us pronounce it different ways, as an example, Better FS, Butter FS, or B-Tree FS. It is a file system which is completely made from scratch. The btrfs exists because its developers firstly wanted to expand the file system functionality in order to include snapshots, pooling, as well as checksums among the other things. While it is independent from the ext4, it also wants to build off the ideas present in the ext4 that are great for the consumers and the businesses alike as well as incorporate those additional features that will benefit everybody, but specifically the enterprises. For the enterprises who are using very large programs with very large databases, they are having a seemingly continuous file system across the multiple hard drives could be very beneficial as it will make a consolidation of the data much easier. The data deduplication could reduce the amount of the actual space data could occupy, and the data mirroring could become easier with the btrfs as well when there is a single and broad file system which needs to be mirrored.
|
||||
|
||||
The user certainly can still choose to create multiple partitions so that he does not need to mirror everything. Considering that the btrfs will be able for spanning over the multiple hard drives, it is a very good thing that it can support 16 times more drive space than the ext4. A maximum partition size of the btrfs file system is 16 exbibytes, as well as maximum file size is 16 exbibytes too.
|
||||
|
||||
### XFS File System ###
|
||||
|
||||
The XFS file system is an extension of the extent file system. The XFS is a high-performance 64-bit journaling file system. The support of the XFS was merged into Linux kernel in around 2002 and In 2009 Red Hat Enterprise Linux version 5.4 usage of the XFS file system. XFS supports maximum file system size of 8 exbibytes for the 64-bit file system. There is some comparison of XFS file system is XFS file system can’t be shrunk and poor performance with deletions of the large numbers of files. Now, the RHEL 7.0 uses XFS as the default filesystem.
|
||||
|
||||
### Final Thoughts ###
|
||||
|
||||
Unfortunately, the arrival date for the btrfs is not quite known. But officially, the next-generation file system is still classified as “unstable”, but if the user downloads the latest version of Ubuntu, he will be able to choose to install on a btrfs partition. When the btrfs will be classified actually as “stable” is still a mystery, but users shouldn’t expect the Ubuntu to use the btrfs by default until it’s indeed considered “stable”. It has been reported that Fedora 18 will use the btrfs as its default file system as by the time of its release a file system checker for the btrfs should exist. There is a good amount of work still left for the btrfs, as not all the features are yet implemented and the performance is a little sluggish if we compare it to the ext4.
|
||||
|
||||
So, which is better to use? Till now, the ext4 will be the winner despite the identical performance. But why? The answer will be the convenience as well as the ubiquity. The ext4 is still excellent file system for the desktop or workstation use. It is provided by default, so the user can install the operating system on it. Also, the ext4 supports volumes up to 1 Exabyte and files up to 16 Terabyte in size, so there’s still a plenty of room for the growth where space is concerned.
|
||||
|
||||
The btrfs might offer greater volumes up to 16 Exabyte and improved fault tolerance, but, till now, it feels more as an add-on file system rather than one integrated into the Linux operating system. For example, the btrfs-tools have to be present before a drive will be formatted with the btrfs, which means that the btrfs is not an option during the Linux operating system installation though that could vary with the distribution.
|
||||
|
||||
Even though the transfer rates are so important, there’s more to a just file system than speed of the file transfers. The btrfs has many useful features such as Copy-on-Write (CoW), extensive checksums, snapshots, scrubbing, self-healing data, deduplication, as well as many more good improvements that ensure the data integrity. The btrfs lacks the RAID-Z features of ZFS, so the RAID is still in an experimental state with the btrfs. For pure data storage, however, the btrfs is the winner over the ext4, but time still will tell.
|
||||
|
||||
Till the moment, the ext4 seems to be a better choice on the desktop system since it is presented as a default file system, as well as it is faster than the btrfs when transferring files. The btrfs is definitely worth to look into, but to completely switch to replace the ext4 on desktop Linux might be few years later. The data farms and the large storage pools could reveal different stories and show the right differences between ext4, XCF, and btrfs.
|
||||
|
||||
If you have a different or additional opinion, kindly let us know by commenting on this article.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.unixmen.com/review-ext4-vs-btrfs-vs-xfs/
|
||||
|
||||
作者：[M.el Khamlichi][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.unixmen.com/author/pirat9/
|
||||
@@ -1,3 +1,4 @@
|
||||
[bazz2222]
|
||||
Why did you start using Linux?
|
||||
================================================================================
|
||||
> In today's open source roundup: What got you started with Linux? Plus: IBM's Linux only Mainframe. And why you should skip Windows 10 and go with Linux
|
||||
|
||||
@@ -1,430 +0,0 @@
|
||||
Translating by ivowang
|
||||
Installation Guide for Puppet on Ubuntu 15.04
|
||||
================================================================================
|
||||
Hi everyone, today in this article we'll learn how to install puppet to manage your server infrastructure running ubuntu 15.04. Puppet is an open source software configuration management tool which is developed and maintained by Puppet Labs that allows us to automate the provisioning, configuration and management of a server infrastructure. Whether we're managing just a few servers or thousands of physical and virtual machines to orchestration and reporting, puppet automates tasks that system administrators often do manually which frees up time and mental space so sysadmins can work on improving other aspects of your overall setup. It ensures consistency, reliability and stability of the automated jobs processed. It facilitates closer collaboration between sysadmins and developers, enabling more efficient delivery of cleaner, better-designed code. Puppet is available in two solutions configuration management and data center automation. They are **puppet open source and puppet enterprise**. Puppet open source is a flexible, customizable solution available under the Apache 2.0 license, designed to help system administrators automate the many repetitive tasks they regularly perform. Whereas puppet enterprise edition is a proven commercial solution for diverse enterprise IT environments which lets us get all the benefits of open source puppet, plus puppet apps, commercial-only enhancements, supported modules and integrations, and the assurance of a fully supported platform. Puppet uses SSL certificates to authenticate communication between master and agent nodes.
|
||||
|
||||
In this tutorial, we will cover how to install open source puppet in an agent and master setup running ubuntu 15.04 linux distribution. Here, Puppet master is a server from where all the configurations will be controlled and managed and all our remaining servers will be puppet agent nodes, which is configured according to the configuration of puppet master server. Here are some easy steps to install and configure puppet to manage our server infrastructure running Ubuntu 15.04.
|
||||
|
||||
### 1. Setting up Hosts ###
|
||||
|
||||
In this tutorial, we'll use two machines, one as puppet master server and another as puppet node agent both running ubuntu 15.04 "Vivid Vervet" in both the machines. Here is the infrastructure of the server that we're gonna use for this tutorial.
|
||||
|
||||
puppet master server with IP 44.55.88.6 and hostname : puppetmaster
|
||||
puppet node agent with IP 45.55.86.39 and hostname : puppetnode
|
||||
|
||||
Now we'll add the entry of the machines to /etc/hosts on both machines node agent and master server.
|
||||
|
||||
# nano /etc/hosts
|
||||
|
||||
45.55.88.6 puppetmaster.example.com puppetmaster
|
||||
45.55.86.39 puppetnode.example.com puppetnode
|
||||
|
||||
Please note that the Puppet Master server must be reachable on port 8140. So, we'll need to open port 8140 in it.
|
||||
|
||||
### 2. Updating Time with NTP ###
|
||||
|
||||
As puppet nodes needs to maintain accurate system time to avoid problems when it issues agent certificates. Certificates can appear to be expired if there is time difference, the time of the both the master and the node agent must be synced with each other. To sync the time, we'll update the time with NTP. To do so, here's the command below that we need to run on both master and node agent.
|
||||
|
||||
# ntpdate pool.ntp.org
|
||||
|
||||
17 Jun 00:17:08 ntpdate[882]: adjust time server 66.175.209.17 offset -0.001938 sec
|
||||
|
||||
Now, we'll update our local repository index and install ntp as follows.
|
||||
|
||||
# apt-get update && sudo apt-get -y install ntp ; service ntp restart
|
||||
|
||||
### 3. Puppet Master Package Installation ###
|
||||
|
||||
There are many ways to install open source puppet. In this tutorial, we'll download and install a debian binary package named as **puppetlabs-release** packaged by the Puppet Labs which will add the source of the **puppetmaster-passenger** package. The puppetmaster-passenger includes the puppet master with apache web server. So, we'll now download the Puppet Labs package.
|
||||
|
||||
# cd /tmp/
|
||||
# wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
|
||||
--2015-06-17 00:19:26-- https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
Resolving apt.puppetlabs.com (apt.puppetlabs.com)... 192.155.89.90, 2600:3c03::f03c:91ff:fedb:6b1d
|
||||
Connecting to apt.puppetlabs.com (apt.puppetlabs.com)|192.155.89.90|:443... connected.
|
||||
HTTP request sent, awaiting response... 200 OK
|
||||
Length: 7384 (7.2K) [application/x-debian-package]
|
||||
Saving to: ‘puppetlabs-release-trusty.deb’
|
||||
|
||||
puppetlabs-release-tr 100%[===========================>] 7.21K --.-KB/s in 0.06s
|
||||
|
||||
2015-06-17 00:19:26 (130 KB/s) - ‘puppetlabs-release-trusty.deb’ saved [7384/7384]
|
||||
|
||||
After the download has been completed, we'll wanna install the package.
|
||||
|
||||
# dpkg -i puppetlabs-release-trusty.deb
|
||||
|
||||
Selecting previously unselected package puppetlabs-release.
|
||||
(Reading database ... 85899 files and directories currently installed.)
|
||||
Preparing to unpack puppetlabs-release-trusty.deb ...
|
||||
Unpacking puppetlabs-release (1.0-11) ...
|
||||
Setting up puppetlabs-release (1.0-11) ...
|
||||
|
||||
Then, we'll update the local respository index with the server using apt package manager.
|
||||
|
||||
# apt-get update
|
||||
|
||||
Then, we'll install the puppetmaster-passenger package by running the below command.
|
||||
|
||||
# apt-get install puppetmaster-passenger
|
||||
|
||||
**Note**: While installing we may get an error **Warning: Setting templatedir is deprecated. See http://links.puppetlabs.com/env-settings-deprecations (at /usr/lib/ruby/vendor_ruby/puppet/settings.rb:1139:in `issue_deprecation_warning')** but we no need to worry, we'll just simply ignore this as it says that the templatedir is deprecated so, we'll simply disbale that setting in the configuration. :)
|
||||
|
||||
To check whether puppetmaster has been installed successfully in our Master server not not, we'll gonna try to check its version.
|
||||
|
||||
# puppet --version
|
||||
|
||||
3.8.1
|
||||
|
||||
We have successfully installed puppet master package in our puppet master box. As we are using passenger with apache, the puppet master process is controlled by apache server, that means it runs when apache is running.
|
||||
|
||||
Before continuing, we'll need to stop the Puppet master by stopping the apache2 service.
|
||||
|
||||
# systemctl stop apache2
|
||||
|
||||
### 4. Master version lock with Apt ###
|
||||
|
||||
As We have puppet version as 3.8.1, we need to lock the puppet version update as this will mess up the configurations while updating the puppet. So, we'll use apt's locking feature for that. To do so, we'll need to create a new file **/etc/apt/preferences.d/00-puppet.pref** using our favorite text editor.
|
||||
|
||||
# nano /etc/apt/preferences.d/00-puppet.pref
|
||||
|
||||
Then, we'll gonna add the entries in the newly created file as:
|
||||
|
||||
# /etc/apt/preferences.d/00-puppet.pref
|
||||
Package: puppet puppet-common puppetmaster-passenger
|
||||
Pin: version 3.8*
|
||||
Pin-Priority: 501
|
||||
|
||||
Now, it will not update the puppet while running updates in the system.
|
||||
|
||||
### 5. Configuring Puppet Config ###
|
||||
|
||||
Puppet master acts as a certificate authority and must generate its own certificates which is used to sign agent certificate requests. First of all, we'll need to remove any existing SSL certificates that were created during the installation of package. The default location of puppet's SSL certificates is /var/lib/puppet/ssl. So, we'll remove the entire ssl directory using rm command.
|
||||
|
||||
# rm -rf /var/lib/puppet/ssl
|
||||
|
||||
Then, we'll configure the certificate. While creating the puppet master's certificate, we need to include every DNS name at which agent nodes can contact the master at. So, we'll edit the master's puppet.conf using our favorite text editor.
|
||||
|
||||
# nano /etc/puppet/puppet.conf
|
||||
|
||||
The output seems as shown below.
|
||||
|
||||
[main]
|
||||
logdir=/var/log/puppet
|
||||
vardir=/var/lib/puppet
|
||||
ssldir=/var/lib/puppet/ssl
|
||||
rundir=/var/run/puppet
|
||||
factpath=$vardir/lib/facter
|
||||
templatedir=$confdir/templates
|
||||
|
||||
[master]
|
||||
# These are needed when the puppetmaster is run by passenger
|
||||
# and can safely be removed if webrick is used.
|
||||
ssl_client_header = SSL_CLIENT_S_DN
|
||||
ssl_client_verify_header = SSL_CLIENT_VERIFY
|
||||
|
||||
Here, we'll need to comment the templatedir line to disable the setting as it has been already depreciated. After that, we'll add the following line at the end of the file under [main].
|
||||
|
||||
server = puppetmaster
|
||||
environment = production
|
||||
runinterval = 1h
|
||||
strict_variables = true
|
||||
certname = puppetmaster
|
||||
dns_alt_names = puppetmaster, puppetmaster.example.com
|
||||
|
||||
This configuration file has many options which might be useful in order to setup own configuration. A full description of the file is available at Puppet Labs [Main Config File (puppet.conf)][1].
|
||||
|
||||
After editing the file, we'll wanna save that and exit.
|
||||
|
||||
Now, we'll gonna generate a new CA certificates by running the following command.
|
||||
|
||||
# puppet master --verbose --no-daemonize
|
||||
|
||||
Info: Creating a new SSL key for ca
|
||||
Info: Creating a new SSL certificate request for ca
|
||||
Info: Certificate Request fingerprint (SHA256): F6:2F:69:89:BA:A5:5E:FF:7F:94:15:6B:A7:C4:20:CE:23:C7:E3:C9:63:53:E0:F2:76:D7:2E:E0:BF:BD:A6:78
|
||||
...
|
||||
Notice: puppetmaster has a waiting certificate request
|
||||
Notice: Signed certificate request for puppetmaster
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetmaster at '/var/lib/puppet/ssl/ca/requests/puppetmaster.pem'
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetmaster at '/var/lib/puppet/ssl/certificate_requests/puppetmaster.pem'
|
||||
Notice: Starting Puppet master version 3.8.1
|
||||
^CNotice: Caught INT; storing stop
|
||||
Notice: Processing stop
|
||||
|
||||
Now, the certificate is being generated. Once we see **Notice: Starting Puppet master version 3.8.1**, the certificate setup is complete. Then we'll press CTRL-C to return to the shell.
|
||||
|
||||
If we wanna look at the cert information of the certificate that was just created, we can get the list by running in the following command.
|
||||
|
||||
# puppet cert list -all
|
||||
|
||||
+ "puppetmaster" (SHA256) 33:28:97:86:A1:C3:2F:73:10:D1:FB:42:DA:D5:42:69:71:84:F0:E2:8A:01:B9:58:38:90:E4:7D:B7:25:23:EC (alt names: "DNS:puppetmaster", "DNS:puppetmaster.example.com")
|
||||
|
||||
### 6. Creating a Puppet Manifest ###
|
||||
|
||||
The default location of the main manifest is /etc/puppet/manifests/site.pp. The main manifest file contains the definition of configuration that is used to execute in the puppet node agent. Now, we'll create the manifest file by running the following command.
|
||||
|
||||
# nano /etc/puppet/manifests/site.pp
|
||||
|
||||
Then, we'll add the following lines of configuration in the file that we just opened.
|
||||
|
||||
# execute 'apt-get update'
|
||||
exec { 'apt-update': # exec resource named 'apt-update'
|
||||
command => '/usr/bin/apt-get update' # command this resource will run
|
||||
}
|
||||
|
||||
# install apache2 package
|
||||
package { 'apache2':
|
||||
require => Exec['apt-update'], # require 'apt-update' before installing
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
# ensure apache2 service is running
|
||||
service { 'apache2':
|
||||
ensure => running,
|
||||
}
|
||||
|
||||
The above lines of configuration are responsible for the deployment of the installation of apache web server across the node agent.
|
||||
|
||||
### 7. Starting Master Service ###
|
||||
|
||||
We are now ready to start the puppet master. We can start it by running the apache2 service.
|
||||
|
||||
# systemctl start apache2
|
||||
|
||||
Here, our puppet master is running, but it isn't managing any agent nodes yet. Now, we'll gonna add the puppet node agents to the master.
|
||||
|
||||
**Note**: If you get an error **Job for apache2.service failed. See "systemctl status apache2.service" and "journalctl -xe" for details.** then it must be that there is some problem with the apache server. So, we can see the log what exactly has happened by running **apachectl start** under root or sudo mode. Here, while performing this tutorial, we got a misconfiguration of the certificates under **/etc/apache2/sites-enabled/puppetmaster.conf** file. We replaced **SSLCertificateFile /var/lib/puppet/ssl/certs/server.pem with SSLCertificateFile /var/lib/puppet/ssl/certs/puppetmaster.pem** and commented **SSLCertificateKeyFile** line. Then we'll need to rerun the above command to run apache server.
|
||||
|
||||
### 8. Puppet Agent Package Installation ###
|
||||
|
||||
Now, as we have our puppet master ready and it needs an agent to manage, we'll need to install puppet agent into the nodes. We'll need to install puppet agent in every nodes in our infrastructure we want puppet master to manage. We'll need to make sure that we have added our node agents in the DNS. Now, we'll gonna install the latest puppet agent in our agent node ie. puppetnode.example.com .
|
||||
|
||||
We'll run the following command to download the Puppet Labs package in our puppet agent nodes.
|
||||
|
||||
# cd /tmp/
|
||||
# wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb\
|
||||
|
||||
--2015-06-17 00:54:42-- https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
Resolving apt.puppetlabs.com (apt.puppetlabs.com)... 192.155.89.90, 2600:3c03::f03c:91ff:fedb:6b1d
|
||||
Connecting to apt.puppetlabs.com (apt.puppetlabs.com)|192.155.89.90|:443... connected.
|
||||
HTTP request sent, awaiting response... 200 OK
|
||||
Length: 7384 (7.2K) [application/x-debian-package]
|
||||
Saving to: ‘puppetlabs-release-trusty.deb’
|
||||
|
||||
puppetlabs-release-tr 100%[===========================>] 7.21K --.-KB/s in 0.04s
|
||||
|
||||
2015-06-17 00:54:42 (162 KB/s) - ‘puppetlabs-release-trusty.deb’ saved [7384/7384]
|
||||
|
||||
Then, as we're running ubuntu 15.04, we'll use debian package manager to install it.
|
||||
|
||||
# dpkg -i puppetlabs-release-trusty.deb
|
||||
|
||||
Now, we'll gonna update the repository index using apt-get.
|
||||
|
||||
# apt-get update
|
||||
|
||||
Finally, we'll gonna install the puppet agent directly from the remote repository.
|
||||
|
||||
# apt-get install puppet
|
||||
|
||||
Puppet agent is always disabled by default, so we'll need to enable it. To do so we'll need to edit /etc/default/puppet file using a text editor.
|
||||
|
||||
# nano /etc/default/puppet
|
||||
|
||||
Then, we'll need to change value of **START** to "yes" as shown below.
|
||||
|
||||
START=yes
|
||||
|
||||
Then, we'll need to save and exit the file.
|
||||
|
||||
### 9. Agent Version Lock with Apt ###
|
||||
|
||||
As We have puppet version as 3.8.1, we need to lock the puppet version update as this will mess up the configurations while updating the puppet. So, we'll use apt's locking feature for that. To do so, we'll need to create a file /etc/apt/preferences.d/00-puppet.pref using our favorite text editor.
|
||||
|
||||
# nano /etc/apt/preferences.d/00-puppet.pref
|
||||
|
||||
Then, we'll gonna add the entries in the newly created file as:
|
||||
|
||||
# /etc/apt/preferences.d/00-puppet.pref
|
||||
Package: puppet puppet-common
|
||||
Pin: version 3.8*
|
||||
Pin-Priority: 501
|
||||
|
||||
Now, it will not update the Puppet while running updates in the system.
|
||||
|
||||
### 10. Configuring Puppet Node Agent ###
|
||||
|
||||
Next, We must make a few configuration changes before running the agent. To do so, we'll need to edit the agent's puppet.conf
|
||||
|
||||
# nano /etc/puppet/puppet.conf
|
||||
|
||||
It will look exactly like the Puppet master's initial configuration file.
|
||||
|
||||
This time also we'll comment the **templatedir** line. Then we'll gonna delete the [master] section, and all of the lines below it.
|
||||
|
||||
Assuming that the puppet master is reachable at "puppet-master", the agent should be able to connect to the master. If not we'll need to use its fully qualified domain name ie. puppetmaster.example.com .
|
||||
|
||||
[agent]
|
||||
server = puppetmaster.example.com
|
||||
certname = puppetnode.example.com
|
||||
|
||||
After adding this, it will look alike this.
|
||||
|
||||
[main]
|
||||
logdir=/var/log/puppet
|
||||
vardir=/var/lib/puppet
|
||||
ssldir=/var/lib/puppet/ssl
|
||||
rundir=/var/run/puppet
|
||||
factpath=$vardir/lib/facter
|
||||
#templatedir=$confdir/templates
|
||||
|
||||
[agent]
|
||||
server = puppetmaster.example.com
|
||||
certname = puppetnode.example.com
|
||||
|
||||
After done with that, we'll gonna save and exit it.
|
||||
|
||||
Next, we'll wanna start our latest puppet agent in our Ubuntu 15.04 nodes. To start our puppet agent, we'll need to run the following command.
|
||||
|
||||
# systemctl start puppet
|
||||
|
||||
If everything went as expected and configured properly, we should not see any output displayed by running the above command. When we run an agent for the first time, it generates an SSL certificate and sends a request to the puppet master then if the master signs the agent's certificate, it will be able to communicate with the agent node.
|
||||
|
||||
**Note**: If you are adding your first node, it is recommended that you attempt to sign the certificate on the puppet master before adding your other agents. Once you have verified that everything works properly, then you can go back and add the remaining agent nodes further.
|
||||
|
||||
### 11. Signing certificate Requests on Master ###
|
||||
|
||||
While puppet agent runs for the first time, it generates an SSL certificate and sends a request for signing to the master server. Before the master will be able to communicate and control the agent node, it must sign that specific agent node's certificate.
|
||||
|
||||
To get the list of the certificate requests, we'll run the following command in the puppet master server.
|
||||
|
||||
# puppet cert list
|
||||
|
||||
"puppetnode.example.com" (SHA256) 31:A1:7E:23:6B:CD:7B:7D:83:98:33:8B:21:01:A6:C4:01:D5:53:3D:A0:0E:77:9A:77:AE:8F:05:4A:9A:50:B2
|
||||
|
||||
As we just setup our first agent node, we will see one request. It will look something like the following, with the agent node's Domain name as the hostname.
|
||||
|
||||
Note that there is no + in front of it which indicates that it has not been signed yet.
|
||||
|
||||
Now, we'll go for signing a certification request. In order to sign a certification request, we should simply run **puppet cert sign** with the **hostname** as shown below.
|
||||
|
||||
# puppet cert sign puppetnode.example.com
|
||||
|
||||
Notice: Signed certificate request for puppetnode.example.com
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetnode.example.com at '/var/lib/puppet/ssl/ca/requests/puppetnode.example.com.pem'
|
||||
|
||||
The Puppet master can now communicate and control the node that the signed certificate belongs to.
|
||||
|
||||
If we want to sign all of the current requests, we can use the -all option as shown below.
|
||||
|
||||
# puppet cert sign --all
|
||||
|
||||
### Removing a Puppet Certificate ###
|
||||
|
||||
If we wanna remove a host from it or wanna rebuild a host then add it back to it. In this case, we will want to revoke the host's certificate from the puppet master. To do this, we will want to use the clean action as follows.
|
||||
|
||||
# puppet cert clean hostname
|
||||
|
||||
Notice: Revoked certificate with serial 5
|
||||
Notice: Removing file Puppet::SSL::Certificate puppetnode.example.com at '/var/lib/puppet/ssl/ca/signed/puppetnode.example.com.pem'
|
||||
Notice: Removing file Puppet::SSL::Certificate puppetnode.example.com at '/var/lib/puppet/ssl/certs/puppetnode.example.com.pem'
|
||||
|
||||
If we want to view all of the requests signed and unsigned, run the following command:
|
||||
|
||||
# puppet cert list --all
|
||||
|
||||
+ "puppetmaster" (SHA256) 33:28:97:86:A1:C3:2F:73:10:D1:FB:42:DA:D5:42:69:71:84:F0:E2:8A:01:B9:58:38:90:E4:7D:B7:25:23:EC (alt names: "DNS:puppetmaster", "DNS:puppetmaster.example.com")
|
||||
|
||||
### 12. Deploying a Puppet Manifest ###
|
||||
|
||||
After we configure and complete the puppet manifest, we'll wanna deploy the manifest to the agent nodes server. To apply and load the main manifest we can simply run the following command in the agent node.
|
||||
|
||||
# puppet agent --test
|
||||
|
||||
Info: Retrieving pluginfacts
|
||||
Info: Retrieving plugin
|
||||
Info: Caching catalog for puppetnode.example.com
|
||||
Info: Applying configuration version '1434563858'
|
||||
Notice: /Stage[main]/Main/Exec[apt-update]/returns: executed successfully
|
||||
Notice: Finished catalog run in 10.53 seconds
|
||||
|
||||
This will show us all the processes how the main manifest will affect a single server immediately.
|
||||
|
||||
If we wanna run a puppet manifest that is not related to the main manifest, we can simply use puppet apply followed by the manifest file path. It only applies the manifest to the node that we run the apply from.
|
||||
|
||||
# puppet apply /etc/puppet/manifest/test.pp
|
||||
|
||||
### 13. Configuring Manifest for a Specific Node ###
|
||||
|
||||
If we wanna deploy a manifest only to a specific node then we'll need to configure the manifest as follows.
|
||||
|
||||
We'll need to edit the manifest on the master server using a text editor.
|
||||
|
||||
# nano /etc/puppet/manifest/site.pp
|
||||
|
||||
Now, we'll gonna add the following lines there.
|
||||
|
||||
node 'puppetnode', 'puppetnode1' {
|
||||
# execute 'apt-get update'
|
||||
exec { 'apt-update': # exec resource named 'apt-update'
|
||||
command => '/usr/bin/apt-get update' # command this resource will run
|
||||
}
|
||||
|
||||
# install apache2 package
|
||||
package { 'apache2':
|
||||
require => Exec['apt-update'], # require 'apt-update' before installing
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
# ensure apache2 service is running
|
||||
service { 'apache2':
|
||||
ensure => running,
|
||||
}
|
||||
}
|
||||
|
||||
Here, the above configuration will install and deploy the apache web server only to the two specified nodes having shortname puppetnode and puppetnode1. We can add more nodes that we need to get deployed with the manifest specifically.
|
||||
|
||||
### 14. Configuring Manifest with a Module ###
|
||||
|
||||
Modules are useful for grouping tasks together, they are many available in the Puppet community which anyone can contribute further.
|
||||
|
||||
On the puppet master, we'll gonna install the **puppetlabs-apache** module using the puppet module command.
|
||||
|
||||
# puppet module install puppetlabs-apache
|
||||
|
||||
**Warning**: Please do not use this module on an existing apache setup else it will purge your apache configurations that are not managed by puppet.
|
||||
|
||||
Now we'll gonna edit the main manifest ie **site.pp** using a text editor.
|
||||
|
||||
# nano /etc/puppet/manifest/site.pp
|
||||
|
||||
Now add the following lines to install apache under puppetnode.
|
||||
|
||||
node 'puppet-node' {
|
||||
class { 'apache': } # use apache module
|
||||
apache::vhost { 'example.com': # define vhost resource
|
||||
port => '80',
|
||||
docroot => '/var/www/html'
|
||||
}
|
||||
}
|
||||
|
||||
Then we'll wanna save and exit it. Then, we'll wanna rerun the manifest to deploy the configuration to the agents for our infrastructure.
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
Finally we have successfully installed puppet to manage our Server Infrastructure running Ubuntu 15.04 "Vivid Vervet" linux operating system. We learned how puppet works, configure a manifest configuration, communicate with nodes and deploy the manifest on the agent nodes with secure SSL certification. Controlling, managing and configuring repeated task in several N number of nodes is very easy with puppet open source software configuration management tool. If you have any questions, suggestions, feedback please write them in the comment box below so that we can improve or update our contents. Thank you ! Enjoy :-)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://linoxide.com/linux-how-to/install-puppet-ubuntu-15-04/
|
||||
|
||||
作者：[Arun Pyasi][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://linoxide.com/author/arunp/
|
||||
[1]:https://docs.puppetlabs.com/puppet/latest/reference/config_file_main.html
|
||||
@@ -1,3 +1,4 @@
|
||||
translated by iov-wang
|
||||
How to Install OsTicket Ticketing System in Fedora 22 / Centos 7
|
||||
================================================================================
|
||||
In this article, we'll learn how to setup help desk ticketing system with osTicket in our machine or server running Fedora 22 or CentOS 7 as operating system. osTicket is a free and open source popular customer support ticketing system developed and maintained by [Enhancesoft][1] and its contributors. osTicket is the best solution for help and support ticketing system and management for better communication and support assistance with clients and customers. It has the ability to easily integrate with inquiries created via email, phone and web based forms into a beautiful multi-user web interface. osTicket makes us easy to manage, organize and log all our support requests and responses in one single place. It is a simple, lightweight, reliable, open source, web-based and easy to setup and use help desk ticketing system.
|
||||
@@ -176,4 +177,4 @@ via: http://linoxide.com/linux-how-to/install-osticket-fedora-22-centos-7/
|
||||
[a]:http://linoxide.com/author/arunp/
|
||||
[1]:http://www.enhancesoft.com/
|
||||
[2]:http://osticket.com/download
|
||||
[3]:https://github.com/osTicket/osTicket-1.8/releases
|
||||
[3]:https://github.com/osTicket/osTicket-1.8/releases
|
||||
|
||||
@@ -1,139 +0,0 @@
|
||||
wyangsun translating
|
||||
How to use Mutt email client with encrypted passwords
|
||||
================================================================================
|
||||
Mutt is an open-source email client written for Linux/UNIX terminal environment. Together with [Alpine][1], Mutt has the most devoted followers among Linux command-line enthusiasts, and for good reasons. Think of anything you expect from an email client, and Mutt has it: multi-protocol support (e.g., POP3, IMAP and SMTP), S/MIME and PGP/GPG integration, threaded conversation, color coding, customizable macros/keybindings, and so on. Besides, terminal-based Mutt is a lightweight alternative for accessing emails compared to bulky web browser-based (e.g., Gmail, Ymail) or GUI-based email clients (e.g., Thunderbird, MS Outlook).
|
||||
|
||||
When you want to use Mutt to access or send emails via corporate SMTP/IMAP servers or replace web mail services, one concern you may have is how to protect your email credentials (e.g., SMTP/IMAP passwords) stored in a plain-text Mutt configuration file (~/.muttrc).
|
||||
|
||||
For those who are security-conscious, there is actually an easy way to **encrypt Mutt configuration** to prevent such risk. In this tutorial, I describe how you can encrypt sensitive Mutt configuration such as SMTP/IMAP passwords using GnuPG (GPG), an open-source implementation of OpenPGP.
|
||||
|
||||
### Step One (Optional): Create GPG Key ###
|
||||
|
||||
Since we are going to use GPG to encrypt Mutt configuration, the first step is to create a GPG key (public/private keypair) if you don't have one. If you do, skip this step.
|
||||
|
||||
To create a new GPG key, type the following.
|
||||
|
||||
$ gpg --gen-key
|
||||
|
||||
Choose the key type (RSA), keysize (2048 bits), and expiration date (0: no expiration). When prompted for a user ID, type your name (Dan Nanni) and email address (myemail@email.com) to be associated with the private/public keypair. Finally, type a passphrase to protect your private key.
|
||||
|
||||
|
||||
|
||||
Generating a GPG key requires a lot of random bytes for entropy, so make sure to perform some random actions on your system (e.g., type on a keyboard, move a mouse or read/write a disk) during key generation. Depending on keysize, it may take a few minutes or more to generate a GPG key.
|
||||
|
||||
|
||||
|
||||
### Step Two: Encrypt Sensitive Mutt Configuration ###
|
||||
|
||||
Next, create a new text file in ~/.mutt directory, and put in the file any sensitive Mutt configuration you want to hide. In this example, I specify SMTP/IMAP passwords.
|
||||
|
||||
$ mkdir ~/.mutt
|
||||
$ vi ~/.mutt/password
|
||||
|
||||
----------
|
||||
|
||||
set smtp_pass="XXXXXXX"
|
||||
set imap_pass="XXXXXXX"
|
||||
|
||||
Now encrypt this file with gpg using your public key as follows.
|
||||
|
||||
$ gpg -r myemail@email.com -e ~/.mutt/password
|
||||
|
||||
This will create ~/.mutt/password.gpg, which is a GPG-encrypted version of the original file.
|
||||
|
||||
Go ahead and remove ~/.mutt/password, leaving only the GPG-encrypted version.
|
||||
|
||||
### Step Three: Create Full Mutt Configuration ###
|
||||
|
||||
Now that you have encrypted sensitive Mutt configuration in a separate file, you can specify the rest of your Mutt configuration in ~/.muttrc. Then add the following line at the end of ~/.muttrc.
|
||||
|
||||
source "gpg -d ~/.mutt/password.gpg |"
|
||||
|
||||
This line will decrypt ~/.mutt/password.gpg when you launch Mutt, and apply the decrypted content to your Mutt configuration.
|
||||
|
||||
The following shows an example of full Mutt configuration which allows you to access Gmail with Mutt, without revealing your SMTP/IMAP passwords. Replace yourgmailaccount with your Gmail ID.
|
||||
|
||||
set from = "yourgmailaccount@gmail.com"
|
||||
set realname = "Your Name"
|
||||
set smtp_url = "smtp://yourgmailaccount@smtp.gmail.com:587/"
|
||||
set imap_user = "yourgmailaccount@gmail.com"
|
||||
set folder = "imaps://imap.gmail.com:993"
|
||||
set spoolfile = "+INBOX"
|
||||
set postponed = "+[Google Mail]/Drafts"
|
||||
set trash = "+[Google Mail]/Trash"
|
||||
set header_cache =~/.mutt/cache/headers
|
||||
set message_cachedir =~/.mutt/cache/bodies
|
||||
set certificate_file =~/.mutt/certificates
|
||||
set move = no
|
||||
set imap_keepalive = 900
|
||||
|
||||
# encrypted IMAP/SMTP passwords
|
||||
source "gpg -d ~/.mutt/password.gpg |"
|
||||
|
||||
### Step Four (Optional): Configure GPG-agent ###
|
||||
|
||||
At this point, you will be able to use Mutt with encrypted IMAP/SMTP passwords. However, every time you launch Mutt, you will first be prompted to enter a GPG passphrase in order to decrypt IMAP/SMTP passwords using your private key.
|
||||
|
||||
|
||||
|
||||
If you want to avoid such GPG passphrase prompts, you can set up gpg-agent. Running as a daemon, gpg-agent securely caches your GPG passphrase, so that gpg automatically obtains your GPG passphrase from gpg-agent without you typing it manually. If you are using Linux desktop, you can use desktop-specific ways to configure something equivalent to gpg-agent, for example, gnome-keyring-daemon for GNOME desktop.
|
||||
|
||||
You can install gpg-agent on Debian-based systems with:
|
||||
|
||||
$ sudo apt-get install gpg-agent
|
||||
|
||||
gpg-agent comes pre-installed on Red Hat based systems.
|
||||
|
||||
Now add the following to your .bashrc file.
|
||||
|
||||
envfile="$HOME/.gnupg/gpg-agent.env"
|
||||
if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
|
||||
eval "$(cat "$envfile")"
|
||||
else
|
||||
eval "$(gpg-agent --daemon --allow-preset-passphrase --write-env-file "$envfile")"
|
||||
fi
|
||||
export GPG_AGENT_INFO
|
||||
|
||||
Reload .bashrc, or simply log out and log back in.
|
||||
|
||||
$ source ~/.bashrc
|
||||
|
||||
Now confirm that GPG_AGENT_INFO environment variable is set properly.
|
||||
|
||||
$ echo $GPG_AGENT_INFO
|
||||
|
||||
----------
|
||||
|
||||
/tmp/gpg-0SKJw8/S.gpg-agent:942:1
|
||||
|
||||
Also, when you type gpg-agent command, you should see the following message.
|
||||
|
||||
$ gpg-agent
|
||||
|
||||
----------
|
||||
|
||||
gpg-agent: gpg-agent running and available
|
||||
|
||||
Once gpg-agent is up and running, it will cache your GPG passphrase the first time you type it at the passphrase prompt. Subsequently when you launch Mutt multiple times, you won't be prompted for a GPG passphrase (as long as gpg-agent is up and the cache entry does not expire).
|
||||
|
||||
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
In this tutorial, I presented a way to encrypt sensitive Mutt configuration such as SMTP/IMAP passwords using GnuPG. Note that if you want to use GnuPG within Mutt to encrypt or sign your email message, you can refer to the [official guide][2] on using GPG with Mutt.
|
||||
|
||||
If you know of any security tips for using Mutt, feel free to share it.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://xmodulo.com/mutt-email-client-encrypted-passwords.html
|
||||
|
||||
作者：[Dan Nanni][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://xmodulo.com/author/nanni
|
||||
[1]:http://xmodulo.com/gmail-command-line-linux-alpine.html
|
||||
[2]:http://dev.mutt.org/trac/wiki/MuttGuide/UseGPG
|
||||
@@ -1,3 +1,5 @@
|
||||
Vic020
|
||||
|
||||
How to use the Linux ftp command to up- and download files on the shell
|
||||
================================================================================
|
||||
In this tutorial, I will explain how to use the Linux ftp command on the shell. I will show you how to connect to an FTP server, up- and download files and create directories. While there are many nice desktops FTP clients available, the FTP command is still useful when you work remotely on a server over an SSH session and e.g. want to fetch a backup file from your FTP storage.
|
||||
@@ -143,4 +145,4 @@ via: https://www.howtoforge.com/tutorial/how-to-use-ftp-on-the-linux-shell/
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
@@ -0,0 +1,175 @@
|
||||
How to Install Laravel PHP Framework on CentOS 7 / Ubuntu 15.04
|
||||
================================================================================
|
||||
Hi All, In this article we are going to setup Laravel on CentOS 7 and Ubuntu 15.04. If you are a PHP web developer then you don't need to worry about of all modern PHP frameworks, Laravel is the easiest to get up and running that saves your time and effort and makes web development a joy. Laravel embraces a general development philosophy that sets a high priority on creating maintainable code by following some simple guidelines, you should be able to keep a rapid pace of development and be free to change your code with little fear of breaking existing functionality.
|
||||
|
||||
Laravel's PHP framework installation is not a big deal. You can simply follow the step by step guide in this article for your CentOS 7 or Ubuntu 15 server.
|
||||
|
||||
### 1) Server Requirements ###
|
||||
|
||||
Laravel depends upon a number of prerequisites that must be setup before installing it. Those prerequisites includes some basic tuning parameter of server like your system update, sudo rights and installation of required packages.
|
||||
|
||||
Once you are connected to your server make sure to configure the fully qualified domain name then run the commands below to enable EPEL Repo and update your server.
|
||||
|
||||
#### CentOS-7 ####
|
||||
|
||||
# yum install epel-release
|
||||
|
||||
----------
|
||||
|
||||
# rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
|
||||
# rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
|
||||
|
||||
----------
|
||||
|
||||
# yum update
|
||||
|
||||
#### Ubuntu ####
|
||||
|
||||
# apt-get install python-software-properties
|
||||
# add-apt-repository ppa:ondrej/php5
|
||||
|
||||
----------
|
||||
|
||||
# apt-get update
|
||||
|
||||
----------
|
||||
|
||||
# apt-get install -y php5 mcrypt php5-mcrypt php5-gd
|
||||
|
||||
### 2) Firewall Setup ###
|
||||
|
||||
System Firewall and SELinux setup is an important part regarding the security of your applications in production. You can make firewall off if you are working on test server and keep SELinux to permissive mode using the below command, so that you installing setup won't be affected by it.
|
||||
|
||||
# setenforce 0
|
||||
|
||||
### 3) Apache, MariaDB, PHP Setup ###
|
||||
|
||||
Laravel installation requires a complete LAMP stack with OpenSSL, PDO, Mbstring and Tokenizer PHP Extensions. If you are already running LAMP server then you can skip this step to move on and just make sure that the required PHP extensions are installed.
|
||||
|
||||
To install AMP stack you can use the below commands on your respective server.
|
||||
|
||||
#### CentOS ####
|
||||
|
||||
# yum install httpd mariadb-server php56w php56w-mysql php56w-mcrypt php56w-dom php56w-mbstring
|
||||
|
||||
To start and enable Apache web and MySQL/Mariadb services at bootup on CentOS 7 , we will use below commands.
|
||||
|
||||
# systemctl start httpd
|
||||
# systemctl enable httpd
|
||||
|
||||
----------
|
||||
|
||||
#systemctl start mysqld
|
||||
#systemctl enable mysqld
|
||||
|
||||
After starting MariaDB service, we will configure its secured password with below command.
|
||||
|
||||
#mysql_secure_installation
|
||||
|
||||
#### Ubuntu ####
|
||||
|
||||
# apt-get install mysql-server apache2 libapache2-mod-php5 php5-mysql
|
||||
|
||||
### 4) Install Composer ###
|
||||
|
||||
Now we are going to install composer that is one of the most important requirement before starting the Laravel installation that helps in installing Laravel's dependencies.
|
||||
|
||||
#### CentOS/Ubuntu ####
|
||||
|
||||
Run the below commands to setup 'composer' in CentOS/Ubuntu.
|
||||
|
||||
# curl -sS https://getcomposer.org/installer | php
|
||||
# mv composer.phar /usr/local/bin/composer
|
||||
# chmod +x /usr/local/bin/composer
|
||||
|
||||
|
||||
|
||||
### 5) Installing Laravel ###
|
||||
|
||||
Laravel's installation package can be downloaded from github using the command below.
|
||||
|
||||
# wget https://github.com/laravel/laravel/archive/develop.zip
|
||||
|
||||
To extract the archived package and move into the document root directory use below commands.
|
||||
|
||||
# unzip develop.zip
|
||||
|
||||
----------
|
||||
|
||||
# mv laravel-develop /var/www/
|
||||
|
||||
Now use the following compose command that will install all required dependencies for Laravel within its directory.
|
||||
|
||||
# cd /var/www/laravel-develop/
|
||||
# composer install
|
||||
|
||||
|
||||
|
||||
### 6) Key Encryption ###
|
||||
|
||||
For encrypter service, we will be generating a 32 digit encryption key using the command below.
|
||||
|
||||
# php artisan key:generate
|
||||
|
||||
Application key [Lf54qK56s3qDh0ywgf9JdRxO2N0oV9qI] set successfully
|
||||
|
||||
Now put this key into the 'app.php' file as shown below.
|
||||
|
||||
# vim /var/www/laravel-develop/config/app.php
|
||||
|
||||
|
||||
|
||||
### 7) Virtua Host and Ownership ###
|
||||
|
||||
After composer installation assign the permissions and apache user ownership to the document root directory as shown.
|
||||
|
||||
# chmod 775 /var/www/laravel-develop/app/storage
|
||||
|
||||
----------
|
||||
|
||||
# chown -R apache:apache /var/www/laravel-develop
|
||||
|
||||
Open the default configuration file of apache web server using any editor to add the following lines at the end file for new virtual host entry.
|
||||
|
||||
# vim /etc/httpd/conf/httpd.conf
|
||||
|
||||
----------
|
||||
|
||||
ServerName laravel-develop
|
||||
DocumentRoot /var/www/laravel/public
|
||||
|
||||
start Directory /var/www/laravel
|
||||
AllowOverride All
|
||||
Directory close
|
||||
|
||||
Now the time is to restart apache web server services as shown below and then open your web browser to check your localhost page.
|
||||
|
||||
#### CentOS ####
|
||||
|
||||
# systemctl restart httpd
|
||||
|
||||
#### Ubuntu ####
|
||||
|
||||
# service apache2 restart
|
||||
|
||||
### 8) Laravel 5 Web Access ###
|
||||
|
||||
Open your web browser and give your server IP or Fully Qualified Domain name and you will see the default web page of Laravel 5 frame work.
|
||||
|
||||
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
Laravel Framework is a great tool to develop your web applications. So, at the end of this article you have learned its installation setup on Ubuntu 15 and CentOS 7 , Now start using this awesome PHP framework that provides you a lot of more features and comfort in your development work. Feel free to comment us back for your valuable suggestions an feedback to guide you in more specific and easiest way.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://linoxide.com/linux-how-to/install-laravel-php-centos-7-ubuntu-15-04/
|
||||
|
||||
作者：[Kashif][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://linoxide.com/author/kashifs/
|
||||
@@ -0,0 +1,60 @@
|
||||
How to Remove Banned IP from Fail2ban on CentOS 6 / CentOS 7
|
||||
================================================================================
|
||||
|
||||
|
||||
[Fail2ban][1] is an intrusion prevention software framework that able to protect your server from brute-force attacks. Fail2ban written in the Python programming language and is widely used by most of the VPS servers. Fail2ban will scan log files and IP blacklists that shows signs of malicious, too many password failures, web server exploitation, WordPress plugin attacks and other vulnerabilities. If you already installed and used fail2ban to protect your web server, you may be wondering how to find the IP banned or blocked by Fail2ban, or you may want to remove banned ip from fail2ban jail on CentOS 6, CentOS 7, RHEL 6, RHEL 7 and Oracle Linux 6/7.
|
||||
|
||||
### How to List of Banned IP address ###
|
||||
|
||||
To see all the blocked ip addresses, run the following command :
|
||||
|
||||
# iptables -L
|
||||
Chain INPUT (policy ACCEPT)
|
||||
target prot opt source destination
|
||||
f2b-AccessForbidden tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-WPLogin tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-ConnLimit tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-ReqLimit tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-NoAuthFailures tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-SSH tcp -- anywhere anywhere tcp dpt:ssh
|
||||
f2b-php-url-open tcp -- anywhere anywhere tcp dpt:http
|
||||
f2b-nginx-http-auth tcp -- anywhere anywhere multiport dports http,https
|
||||
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
|
||||
ACCEPT icmp -- anywhere anywhere
|
||||
ACCEPT all -- anywhere anywhere
|
||||
ACCEPT tcp -- anywhere anywhere tcp dpt:EtherNet/IP-1
|
||||
ACCEPT tcp -- anywhere anywhere tcp dpt:http
|
||||
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
|
||||
|
||||
Chain FORWARD (policy ACCEPT)
|
||||
target prot opt source destination
|
||||
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
|
||||
|
||||
Chain OUTPUT (policy ACCEPT)
|
||||
target prot opt source destination
|
||||
|
||||
|
||||
Chain f2b-NoAuthFailures (1 references)
|
||||
target prot opt source destination
|
||||
REJECT all -- 64.68.50.128 anywhere reject-with icmp-port-unreachable
|
||||
REJECT all -- 104.194.26.205 anywhere reject-with icmp-port-unreachable
|
||||
RETURN all -- anywhere anywhere
|
||||
|
||||
### How to Remove Banned IP from Fail2ban jail ###
|
||||
|
||||
# iptables -D f2b-NoAuthFailures -s banned_ip -j REJECT
|
||||
|
||||
I hope this article gives you some ideas and quick guide on remove banned IP from Fail2ban jail on on CentOS 6, CentOS 7, RHEL 6, RHEL 7 and Oracle Linux 6/7.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.ehowstuff.com/how-to-remove-banned-ip-from-fail2ban-on-centos/
|
||||
|
||||
作者：[skytech][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.ehowstuff.com/author/skytech/
|
||||
[1]:http://www.fail2ban.org/wiki/index.php/Main_Page
|
||||
@@ -0,0 +1,145 @@
|
||||
Install and Configure Munin monitoring server in Linux
|
||||
================================================================================
|
||||
|
||||
|
||||
Munin is an excellent system monitoring tool similar to [RRD tool][1] which will give you ample information about system performance in multiple fronts like **disk, network, process, system and users**. These are some of the default properties Munin monitors.
|
||||
|
||||
### How Munin works? ###
|
||||
|
||||
Munin works in a client-server model. Munin server process on main server try to collect data from client daemon which is running locally(Munin can monitor it’ss own resources) or from remote client(Munin can monitor hundreds of machines) and displays them in graphs on its web interface.
|
||||
|
||||
### Configuring Munin in nutshell ###
|
||||
|
||||
This is of two steps as we have to configure both server and client.
|
||||
1)Install Munin server package and configure it so that it get data from clients.
|
||||
2)Configure Munin client so that server will connect to client daemon for data collocation.
|
||||
|
||||
### Install munin server in Linux ###
|
||||
|
||||
Munin server installation on Ubuntu/Debian based machines
|
||||
|
||||
apt-get install munin apache2
|
||||
|
||||
Munin server installation on Redhat/Centos based machines. Make sure that you [enable EPEL repo][2] before installing Munin on Redhat based machines as by default Redhat based machines do not have Munin in their repos.
|
||||
|
||||
yum install munin httpd
|
||||
|
||||
### Configuring Munin server in Linux ###
|
||||
|
||||
Below are the steps we have to do in order to bring server up.
|
||||
|
||||
1. Add host details which need monitoring in /etc/munin/munin.conf
|
||||
1. Configure apache web server to include munin details.
|
||||
1. Create User name and password for web interface
|
||||
1. Restart apache server
|
||||
|
||||
**Step 1**: Add hosts entry in this file in **/etc/munin/munin.conf**. Go to end of the file and a client to monitor. Here in this example, I added my DB server and its IP address to monitor
|
||||
|
||||
Example:
|
||||
|
||||
[db.linuxnix.com]
|
||||
address 192.168.1.25
|
||||
use_node_name yes
|
||||
|
||||
Save the file and exit.
|
||||
|
||||
**Step 2**: Edit/create munin.conf file in /etc/apache2/conf.d folder to include Munin Apache related configs. In another note, by default other Munin web related configs are kept in /var/www/munin folder.
|
||||
|
||||
vi /etc/apache2/conf.d/munin.conf
|
||||
|
||||
Content:
|
||||
|
||||
Alias /munin /var/www/munin
|
||||
<Directory /var/www/munin>
|
||||
Order allow,deny
|
||||
Allow from localhost 127.0.0.0/8 ::1
|
||||
AllowOverride None
|
||||
Options ExecCGI FollowSymlinks
|
||||
AddHandler cgi-script .cgi
|
||||
DirectoryIndex index.cgi
|
||||
AuthUserFile /etc/munin/munin.passwd
|
||||
AuthType basic
|
||||
AuthName "Munin stats"
|
||||
require valid-user
|
||||
<IfModule mod_expires.c>
|
||||
ExpiresActive On
|
||||
ExpiresDefault M310
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
Save the file and exit
|
||||
|
||||
**Step 3**: Now create a username and password for viewing muning graphs:
|
||||
|
||||
htpasswd -c /etc/munin/munin-htpasswd munin
|
||||
|
||||
**Note**: For Redhat/Centos machines replace “**apache2**” with “**httpd**” in each path to access your config files.
|
||||
|
||||
**Step 3**: Restart Apache server so that Munin configurations are picked-up by Apache.
|
||||
|
||||
#### Ubuntu/Debian based: ####
|
||||
|
||||
service apache2 restart
|
||||
|
||||
#### Centos/Redhat based: ####
|
||||
|
||||
service httpd restart
|
||||
|
||||
### Install and configure Munin client in Linux ###
|
||||
|
||||
**Step 1**: Install Munin client in Linux
|
||||
|
||||
apt-get install munin-node
|
||||
|
||||
**Note**: If you want to monitor your Munin server, then you have to install munin-node on that as well.
|
||||
|
||||
**Step 2**: Configure client by editing munin-node.conf file.
|
||||
|
||||
vi /etc/munin/munin-node.conf
|
||||
|
||||
Example:
|
||||
|
||||
allow ^127\.0\.0\.1$
|
||||
allow ^10\.10\.20\.20$
|
||||
|
||||
----------
|
||||
|
||||
# Which address to bind to;
|
||||
host *
|
||||
|
||||
----------
|
||||
|
||||
# And which port
|
||||
port 4949
|
||||
|
||||
**Note**: 10.10.20.20 is my Munin server and it connections to 4949 port on client to get its data.
|
||||
|
||||
**Step 3**: Restart munin-node on client server
|
||||
|
||||
service munin-node restart
|
||||
|
||||
### Testing connection ###
|
||||
|
||||
check if you are able to connect client from server on 4949 port, other wise you have to open that port on client machine.
|
||||
|
||||
telnet db.linuxnix.com 4949
|
||||
|
||||
Accessing Munin web interface
|
||||
|
||||
http://munin.linuxnix.com/munin/index.html
|
||||
|
||||
Hope this helps to configure basic Munin server.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.linuxnix.com/install-and-configure-munin-monitoring-server-in-linux/
|
||||
|
||||
作者：[Surendra Anne][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.linuxnix.com/author/surendra/
|
||||
[1]:http://www.linuxnix.com/network-monitoringinfo-gathering-tools-in-linux/
|
||||
[2]:http://www.linuxnix.com/how-to-install-and-enable-epel-repo-in-rhel-centos-oracle-scentific-linux/
|
||||
195
sources/tech/20151204 Linux or Unix--jobs Command Examples.md
Normal file
195
sources/tech/20151204 Linux or Unix--jobs Command Examples.md
Normal file
@@ -0,0 +1,195 @@
|
||||
Linux / Unix: jobs Command Examples
|
||||
================================================================================
|
||||
I am new Linux and Unix user. How do I show the active jobs on Linux or Unix-like systems using BASH/KSH/TCSH or POSIX based shell? How can I display status of jobs in the current session on Unix/Linux?
|
||||
|
||||
Job control is nothing but the ability to stop/suspend the execution of processes (command) and continue/resume their execution as per your requirements. This is done using your operating system and shell such as bash/ksh or POSIX shell.
|
||||
|
||||
You shell keeps a table of currently executing jobs and can be displayed with jobs command.
|
||||
|
||||
### Purpose ###
|
||||
|
||||
> Displays status of jobs in the current shell session.
|
||||
|
||||
### Syntax ###
|
||||
|
||||
The basic syntax is as follows:
|
||||
|
||||
jobs
|
||||
|
||||
OR
|
||||
|
||||
jobs jobID
|
||||
|
||||
OR
|
||||
|
||||
jobs [options] jobID
|
||||
|
||||
### Starting few jobs for demonstration purpose ###
|
||||
|
||||
Before you start using jobs command, you need to start couple of jobs on your system. Type the following commands to start jobs:
|
||||
|
||||
## Start xeyes, calculator, and gedit text editor ###
|
||||
xeyes &
|
||||
gnome-calculator &
|
||||
gedit fetch-stock-prices.py &
|
||||
|
||||
Finally, run ping command in foreground:
|
||||
|
||||
ping www.cyberciti.biz
|
||||
|
||||
To suspend ping command job hit the **Ctrl-Z** key sequence.
|
||||
|
||||
### jobs command examples ###
|
||||
|
||||
To display the status of jobs in the current shell, enter:
|
||||
|
||||
$ jobs
|
||||
|
||||
Sample outputs:
|
||||
|
||||
[1] 7895 Running gpass &
|
||||
[2] 7906 Running gnome-calculator &
|
||||
[3]- 7910 Running gedit fetch-stock-prices.py &
|
||||
[4]+ 7946 Stopped ping cyberciti.biz
|
||||
|
||||
To display the process ID or jobs for the job whose name begins with "p," enter:
|
||||
|
||||
$ jobs -p %p
|
||||
|
||||
OR
|
||||
|
||||
$ jobs %p
|
||||
|
||||
Sample outputs:
|
||||
|
||||
[4]- Stopped ping cyberciti.biz
|
||||
|
||||
The character % introduces a job specification. In this example, you are using the string whose name begins with suspended command such as %ping.
|
||||
|
||||
### How do I show process IDs in addition to the normal information? ###
|
||||
|
||||
Pass the -l(lowercase L) option to jobs command for more information about each job listed, run:
|
||||
|
||||
$ jobs -l
|
||||
|
||||
Sample outputs:
|
||||
|
||||
|
||||
Fig.01: Displaying the status of jobs in the shell
|
||||
|
||||
### How do I list only processes that have changed status since the last notification? ###
|
||||
|
||||
First, start a new job as follows:
|
||||
|
||||
$ sleep 100 &
|
||||
|
||||
Now, only show jobs that have stopped or exited since last notified, type:
|
||||
|
||||
$ jobs -n
|
||||
|
||||
Sample outputs:
|
||||
|
||||
[5]- Running sleep 100 &
|
||||
|
||||
### Display lists process IDs (PIDs) only ###
|
||||
|
||||
Pass the -p option to jobs command to display PIDs only:
|
||||
|
||||
$ jobs -p
|
||||
|
||||
Sample outputs:
|
||||
|
||||
7895
|
||||
7906
|
||||
7910
|
||||
7946
|
||||
7949
|
||||
|
||||
### How do I display only running jobs? ###
|
||||
|
||||
Pass the -r option to jobs command to display only running jobs only, type:
|
||||
|
||||
$ jobs -r
|
||||
|
||||
Sample outputs:
|
||||
|
||||
[1] Running gpass &
|
||||
[2] Running gnome-calculator &
|
||||
[3]- Running gedit fetch-stock-prices.py &
|
||||
|
||||
### How do I display only jobs that have stopped? ###
|
||||
|
||||
Pass the -s option to jobs command to display only stopped jobs only, type:
|
||||
|
||||
$ jobs -s
|
||||
|
||||
Sample outputs:
|
||||
|
||||
[4]+ Stopped ping cyberciti.biz
|
||||
|
||||
To resume the ping cyberciti.biz job by entering the following bg command:
|
||||
|
||||
$ bg %4
|
||||
|
||||
### jobs command options ###
|
||||
|
||||
From the [bash(1)][1] command man page:
|
||||
|
||||
注：表格
|
||||
<table border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Option</td>
|
||||
<td>Description</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-l</strong></kbd></td>
|
||||
<td>Show process id's in addition to the normal information.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-p</strong></kbd></td>
|
||||
<td>Show process id's only.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-n</strong></kbd></td>
|
||||
<td>Show only processes that have changed status since the last notification are printed.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-r</strong></kbd></td>
|
||||
<td>Restrict output to running jobs only.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-s</strong></kbd></td>
|
||||
<td>Restrict output to stopped jobs only.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><kbd><strong>-x</strong></kbd></td>
|
||||
<td>COMMAND is run after all job specifications that appear in ARGS have been replaced with the process ID of that job's process group leader./td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### A note about /usr/bin/jobs and shell builtin ###
|
||||
|
||||
Type the following type command to find out whether jobs is part of shell, external command or both:
|
||||
|
||||
$ type -a jobs
|
||||
|
||||
Sample outputs:
|
||||
|
||||
jobs is a shell builtin
|
||||
jobs is /usr/bin/jobs
|
||||
|
||||
In almost all cases you need to use the jobs command that is implemented as a BASH/KSH/POSIX shell built-in. The /usr/bin/jobs command can not be used in the current shell. The /usr/bin/jobs command operates in a different environment and does not share the parent bash/ksh's shells understanding of jobs.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via:
|
||||
|
||||
作者：Vivek Gite
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:http://www.manpager.com/linux/man1/bash.1.html
|
||||
@@ -1,22 +1,16 @@
|
||||
How to Install and Configure Multihomed ISC DHCP Server on Debian Linux
|
||||
debian linux上安装配置 ISC DHCP Server
|
||||
================================================================================
|
||||
Dynamic Host Control Protocol (DHCP) offers an expedited method for network administrators to provide network layer addressing to hosts on a constantly changing, or dynamic, network. One of the most common server utilities to offer DHCP functionality is ISC DHCP Server. The goal of this service is to provide hosts with the necessary network information to be able to communicate on the networks in which the host is connected. Information that is typically served by this service can include: DNS server information, network address (IP), subnet mask, default gateway information, hostname, and much more.
|
||||
动态主机控制协议（DHCP）给网络管理员提供一种便捷的方式，为不断变化的网络主机或是动态网络提供网络层地址。其中最常用的DHCP服务工具是 ISC DHCP Server。DHCP服务的目的是给给主机提供必要的网络信息以便能够和其他连接在网络中的主机互相通信。DHCP服务一般包括以下信息：DNS服务器信息，网络地址（IP），子网掩码，默认网关信息，主机名等等。
|
||||
动态主机控制协议（DHCP）给网络管理员提供一种便捷的方式，为不断变化的网络主机或是动态网络提供网络层地址。其中最常用的DHCP服务工具是 ISC DHCP Server。DHCP服务的目的是给主机提供必要的网络信息以便能够和其他连接在网络中的主机互相通信。DHCP服务一般包括以下信息：DNS服务器信息，网络地址（IP），子网掩码，默认网关信息，主机名等等。
|
||||
|
||||
This tutorial will cover ISC-DHCP-Server version 4.2.4 on a Debian 7.7 server that will manage multiple virtual local area networks (VLAN) but can very easily be applied to a single network setup as well.
|
||||
本节教程介绍4.2.4版的ISC-DHCP-Server如何在Debian7.7上管理多个虚拟局域网（VLAN），但是它也可以非常简单的用于单一网络。
|
||||
本教程介绍4.2.4版的ISC-DHCP-Server如何在Debian7.7上管理多个虚拟局域网（VLAN），它也可以非常容易的配置的用于单一网络。
|
||||
|
||||
The test network that this server was setup on has traditionally relied on a Cisco router to manage the DHCP address leases. The network currently has 12 VLANs needing to be managed by one centralized server. By moving this responsibility to a dedicated server, the router can regain resources for more important tasks such as routing, access control lists, traffic inspection, and network address translation.
|
||||
测试用的网络是通过思科路由器依赖传统的方式来管DHCP租约地址，目前有12个VLANs需要通过路由器的集中式服务器来管理。把DHCP这个责任转移到一个专用的服务器上面，路由器可以回收资源去用到更重要的任务上，比如路由寻址，访问控制列表，流量监测以及网络地址转换等。
|
||||
测试用的网络是通过思科路由器使用传统的方式来管理DHCP租约地址的，目前有12个VLANs需要通过路由器的集中式服务器来管理。把DHCP的任务转移到一个专用的服务器上面，路由器可以收回相应的资源，把资源用到更重要的任务上，比如路由寻址，访问控制列表，流量监测以及网络地址转换等。
|
||||
|
||||
另一个将DHCP服务转移到专用服务器的好处，以后会讲到，它可以建立动态域名服务器（DDNS）这样当主机从服务器请求DHCP地址的时候，新主机的主机名将被添加到DNS系统里面。
|
||||
|
||||
The other benefit to moving DHCP to a dedicated server will, in a later guide, involve setting up Dynamic Domain Name Service (DDNS) so that new host’s host-names will be added to the DNS system when the host requests a DHCP address from the server.
|
||||
另一个将DHCP服务移动到专用服务器的好处，后续会讲到，建立动态域名服务器（DDNS）这样当主机从服务器请求DHCP地址的时候，新主机的主机名将被添加到DNS系统里面。
|
||||
### Step 1: Installing and Configuring ISC DHCP Server ###
|
||||
### 安装和配置ISC DHCP Server###
|
||||
|
||||
1. To start the process of creating this multi-homed server, the ISC software needs to be installed via the Debian repositories using the ‘apt‘ utility. As with all tutorials, root or sudo access is assumed. Please make the appropriate modifications to the following commands.
|
||||
1. 创建这个多宿主服务器的过程中，需要用apt工具来安装Debian软件仓库中的ISC软件。与其他教程一样需要使用root或者sudo访问权限。请适当的修改以使用下面的命令。（译者注：下面中括号里面是注释，使用的时候请删除，#表示使用的root权限）
|
||||
1. 使用apt工具用来安装Debian软件仓库中的ISC软件，来创建这个多宿主服务器。与其他教程一样需要使用root或者sudo访问权限。请适当的修改，以便使用下面的命令。（译者注：下面中括号里面是注释，使用的时候请删除，#表示使用的root权限）
|
||||
|
||||
|
||||
# apt-get install isc-dhcp-server [安装 the ISC DHCP Server 软件]
|
||||
@@ -25,204 +19,136 @@ The other benefit to moving DHCP to a dedicated server will, in a later guide, i
|
||||
|
||||
|
||||
|
||||
2. Now that the server software is confirmed installed, it is now necessary to configure the server with the network information that it will need to hand out. At the bare minimum, the administrator needs to know the following information for a basic DHCP scope:
|
||||
|
||||
2. 现在已经确认服务软件安装完毕，现在需要配置服务器，它将分发网络信息。作为管理员你最起码应该了解DHCP的信息如下：
|
||||
- The network addresses
|
||||
2. 确认服务软件已经安装完成，现在需要一些网络的需求来配置服务器，这样服务器才能够根据我们的需要来分发网络信息。作为管理员最起码需要了解的DHCP信息如下：
|
||||
- 网络地址
|
||||
- The subnet masks
|
||||
- 子网掩码
|
||||
- The range of addresses to be dynamically assigned
|
||||
- 动态分配的地址范围
|
||||
|
||||
Other useful information to have the server dynamically assign includes:
|
||||
|
||||
其他一些使服务器动态分配的有用信息包括：
|
||||
- Default gateway
|
||||
其他一些服务器动态分配的有用信息包括：
|
||||
- 默认网关
|
||||
- DNS server IP addresses
|
||||
- DNS服务器IP地址
|
||||
- The Domain Name
|
||||
- 域名
|
||||
- Host name
|
||||
- 主机名
|
||||
- Network Broadcast addresses
|
||||
- 网络广播地址
|
||||
|
||||
These are merely a few of the many options that the ISC DHCP server can handle. To get a complete list as well as a description of each option, enter the following command after installing the package:
|
||||
|
||||
这只是很少一部分能让ISC DHCP server处理的选项。完整的查看所有选项及其描述需要在安装好软件后输入以下命令：
|
||||
这只是能让ISC DHCP server处理的选项中非常少的一部分。如果你想查看所有选项及其描述需要在安装好软件后输入以下命令：
|
||||
# man dhcpd.conf
|
||||
|
||||
3. Once the administrator has concluded all the necessary information for this server to hand out it is time to configure the DHCP server as well as the necessary pools. Before creating any pools or server configurations though, the DHCP service must be configured to listen on one of the server’s interfaces.
|
||||
3. 一旦管理员已经确定了这台服务器需要分发的需求信息，那么是时候配置服务器并且分配必要的地址池了。在配置任何地址池或服务器配置之前，DHCP服务必须配置好，来侦听这台服务器上面的一个接口。
|
||||
|
||||
3. 一旦管理员已经确定了这台服务器需要分发出去的必要信息，那么是时候配置它和分配必要的地址池了。在配置任何地址池或服务器配置之前，DHCP服务必须配置好，来监听这台服务器上面的一个接口。
|
||||
在这台特定的服务器上，设置好网卡后，DHCP会侦听名称名为`'bond0'`的接口。请适根据你的实际情况来更改服务器以及网络环境。下面的配置都是针对本教程的。
|
||||
|
||||
On this particular server, a NIC team has been setup and DHCP will listen on the teamed interfaces which were given the name `'bond0'`. Be sure to make the appropriate changes given the server and environment in which everything is being configured. The defaults in this file are okay for this tutorial.
|
||||
|
||||
在这台特定的服务器上，一个网卡设置好后，DHCP会监听命名为`'bond0'`的接口。请适确保适当的更改服务器以及网络环境。下面默认的配置都是针对于本次教程的。
|
||||
|
||||
|
||||
This line will instruct the DHCP service to listen for DHCP traffic on the specified interface(s). At this point, it is time to modify the main configuration file to enable the DHCP pools on the necessary networks. The main configuration file is located at /etc/dhcp/dhcpd.conf. Open the file with a text editor to begin:
|
||||
|
||||
这行指定的是DHCP服务监听接口（一个或多个）上的DHCP流量。修改主要的配置文件分派DHCP池配置在所需要的网络上。主要的配置文件的位置在/etc/dhcp/dhcpd.conf。用文本编辑器打开这个文件
|
||||
这行指定的是DHCP服务侦听接口（一个或多个）上的DHCP流量。修改主要的配置文件分配适合的DHCP地址池到所需要的网络上。配置文件所在置/etc/dhcp/dhcpd.conf。用文本编辑器打开这个文件
|
||||
# nano /etc/dhcp/dhcpd.conf
|
||||
|
||||
This file is the configuration for the DHCP server specific options as well as all of the pools/hosts one wishes to configure. The top of the file starts of with a ‘ddns-update-style‘ clause and for this tutorial it will remain set to ‘none‘ however in a future article, Dynamic DNS will be covered and ISC-DHCP-Server will be integrated with BIND9 to enable host name to IP address updates.
|
||||
这个配置文件可以配置我们所需要的地址池/主机。文件顶部有‘ddns-update-style‘这样一句，在本教程中它设置为‘none‘。在以后的教程中动态DNS，ISC-DHCP-Server 将被整合到 BIND9，它能够使主机名更新到IP地址。
|
||||
|
||||
这个配置文件可以配置我们想的地址池/主机。文件顶部有‘ddns-update-style‘这样一句，在本教程中它设置为‘none‘。在以后的教程中动态DNS， ISC-DHCP-Server 将被整合到 BIND9为了能够使主机名更新到IP地址。
|
||||
|
||||
4. The next section is typically the area where and administrator can configure global network settings such as the DNS domain name, default lease time for IP addresses, subnet-masks, and much more. Again to know more about all the options be sure to read the man page for the dhcpd.conf file.
|
||||
|
||||
4. 接下来的部分 是管理员配置全局网络设置，如DNS域名，默认的租约时间，IP地址，子网的掩码，以及更多的区域。想更多地了解所有的选项，阅读man手册dhcpd.conf文件，命令如下：
|
||||
4. 接下来的部分是管理员配置全局网络设置，如DNS域名，默认的租约时间，IP地址，子网的掩码，以及更多的区域。如果你想了解所有的选项，请阅读man手册中的dhcpd.conf文件，命令如下：
|
||||
|
||||
# man dhcpd.conf
|
||||
|
||||
For this server install, there were a couple of global network options that were configured at the top of the configuration file so that they wouldn’t have to be implemented in every single pool created.
|
||||
|
||||
对于这台服务器，我们需要在顶部配置一些全局网络设置，这腰就不用到每个地址池中单独去设置了。
|
||||
对于这台服务器，我们需要在顶部配置一些全局网络设置，这样就不用到每个地址池中去单独设置了。
|
||||
|
||||
|
||||
|
||||
Lets take a moment to explain some of these options. While they are configured globally in this example, all of them can be configured on a per pool basis as well.
|
||||
下面我们花一点时间来解释一下这些选项，在本例中虽然它们是一些全局，但是也可以为每一个地址池配置。
|
||||
|
||||
- option domain-name “comptech.local”; – All hosts that this DHCP server hosts, will be a member of the DNS domain name “comptech.local”
|
||||
- option domain-name “comptech.local”; – 所有使用这台DHCP服务器的主机，将成为DNS域名“comptech.local”的一员
|
||||
- option domain-name-servers 172.27.10.6; DHCP will hand out DNS server IP of 172.27.10.6 to all of the hosts on all of the networks it is configured to host.
|
||||
- option domain-name-servers 172.27.10.6; DHCP 将向所有配置好的网络主机分发DNS服务器地址172.27.10.6
|
||||
- option subnet-mask 255.255.255.0; – The subnet mask handed out to every network will be a 255.255.255.0 or a /24
|
||||
我们花一点时间来解释一下这些选项，在本教程中虽然它们是一些全局设置，但是也可以为单独的为某一个地址池进行配置。
|
||||
|
||||
- option domain-name “comptech.local”; – 所有使用这台DHCP服务器的主机，都将成为DNS域名为“comptech.local”的一员
|
||||
|
||||
- option domain-name-servers 172.27.10.6; DHCP向所有配置这台DHCP服务器的的网络主机分发DNS服务器地址为172.27.10.6
|
||||
|
||||
- option subnet-mask 255.255.255.0; – 分派子网掩码到每一个网络设备 255.255.255.0 或a /24
|
||||
- default-lease-time 3600; – This is the time in seconds that a lease will automatically be valid. The host can re-request the same lease if time runs out or if the host is done with the lease, they can hand the address back early.
|
||||
- default-lease-time 3600; – 有效的地址租约时间，单位是秒。如果租约时间耗尽主机可以重新申请租约。如果租约完成那么相应的地址也将被尽快回收。
|
||||
- max-lease-time 86400; – This is the maximum amount of time in seconds a lease can be held by a host.
|
||||
- max-lease-time 86400; – 这是一个主机最大的租约时间，单位为秒。
|
||||
- ping-check true; – This is an extra test to ensure that the address the server wants to assign out isn’t in use by another host on the network already.
|
||||
- ping-check true; – 这是一个额外的测试，以确保服务器分配出的地址不是一个网络内另一台主机已使用的网络地址。
|
||||
- ping-timeout; – This is how long in second the server will wait for a response to a ping before assuming the address isn’t in use.
|
||||
- ping-timeout; – 假设地址以前没有使用，用这个来检测2个ping值回应之间的时间长度。
|
||||
- ignore client-updates; For now this option is irrelevant since DDNS has been disabled earlier in the configuration file but when DDNS is operating, this option will ignore a hosts to request to update its host-name in DNS.
|
||||
- ignore client-updates; 现在这个选项是可以忽略的，因为DDNS在前面已在配置文件中被禁用，但是当DDNS运行，此选项会忽略一个主机请求的DNS更新其主机名。
|
||||
|
||||
5. The next line in this file is the authoritative DHCP server line. This line means that if this server is to be the server that hands out addresses for the networks configured in this file, then uncomment the authoritative stanza.
|
||||
5. 文件中的下面一行是权威DHCP所在行。这行的意义是如果服务器是为文件中所配置的网络分发地址的服务器，那么就取消注释权威节(uncomment the authoritative stanza.)。
|
||||
- default-lease-time 3600; – 默认有效的地址租约时间（单位是秒）。如果租约时间耗尽，那么主机可以重新申请租约。如果租约完成，那么相应的地址也将被尽快回收。
|
||||
|
||||
This server will be the only authority on all the networks it manages so the global authoritative stanza was un-commented by removing the ‘#’ in front of the keyword authoritative.
|
||||
- max-lease-time 86400; – 这是一台主机最大的租约时间（单位为秒）。
|
||||
|
||||
- ping-check true; – 这是一个额外的测试，以确保服务器分发出的网络地址不是当前网络中另一台主机已使用的网络地址。
|
||||
|
||||
- ping-timeout; – 如果地址以前没有使用过，可以用这个选项来检测2个ping返回值之间的时间长度。
|
||||
|
||||
- ignore client-updates; 现在这个选项是可以忽略的，因为DDNS在前面已在配置文件中已经被禁用，但是当DDNS运行时，这个选项会忽略更新其DNS主机名的请求。
|
||||
|
||||
5. 文件中下面一行是权威DHCP所在行。这行的意义是如果服务器是为文件中所配置的网络分发地址的服务器，那么取消注释权威字节(authoritative stanza)来实现。
|
||||
|
||||
通过去掉关键字authoritative 前面的‘#’，取消注释全局权威字节。这台服务器将是它所管理网络里面的唯一权威。
|
||||
|
||||
通过去掉关键字authoritative 前面的‘#’，取消注释全局权威节。那么该服务器将是它管理网络里面的唯一权威。
|
||||
|
||||
Enable ISC Authoritative
|
||||
开启 ISC Authoritative
|
||||
|
||||
By default the server is assumed to NOT be an authority on the network. The rationale behind this is security. If someone unknowingly configures the DHCP server improperly or on a network they shouldn’t, it could cause serious connectivity issues. This line can also be used on a per network basis. This means that if the server is not the entire network’s DHCP server, the authoritative line can instead be used on a per network basis rather than in the global configuration as seen in the above screen-shot.
|
||||
默认情况下服务器被假定为不是网络上的权威。这样做的理由是为了安全。如果有人因为不了解DHCP服务的配置导致配置不当或在一个不该出现的网络里面，这都将会造成非常严重的重连接问题。这行还可用在每个网络中单独使用。这意味着如果该服务器不是整个网络的DHCP服务器，authoritative行可以用在每个单独的网络中，而不是像上面截图显示中的全局配置那样。
|
||||
默认情况下服务器被假定为不是网络上的权威。之所以这样做是出于安全考虑。如果有人因为不了解DHCP服务的配置，导致配置不当或配置到一个不该出现的网络里面，这都将带来非常严重的重连接问题。这行还可用在每个网络中单独配置使用。也就是说如果这台服务器不是整个网络的DHCP服务器，authoritative行可以用在每个单独的网络中，而不是像上面截图中那样的全局配置。
|
||||
|
||||
6. The next step is to configure all of the DHCP pools/networks that this server will manage. For brevities sake, this guide will only walk through one of the pools configured. The administrator will need to have gathered all of the necessary network information (ie domain name, network addresses, how many addresses can be handed out, etc).
|
||||
6. 这一步是配置服务器将要管理的所有DHCP地址池/网络。简短起见，本教程只配置了地址池。作为管理员需要收集一些必要的网络信息（比如域名，网络地址，有多少地址能够被分发等等）
|
||||
|
||||
6. 下一步是配置所有的服务器将要管理的DHCP地址池/网络。简短起见，这个教程将只配置地址池。作为管理员需要收集所有必要的网络信息（比如域名，网络地址，有多少地址能够被分发等等）
|
||||
For this pool the following information was obtained from the network administrator: network id of 172.27.60.0, subnet mask of 255.255.255.0 or a /24, the default gateway for the subnet is 172.27.60.1, and a broadcast address of 172.27.60.255.
|
||||
This information is important to building the appropriate network stanza in the dhcpd.conf file. Without further ado, let’s open the configuration file again using a text editor and then add the new network to the server. This must be done with root/sudo!
|
||||
以下这个地址池所用到的信息都是管理员收集整理的：网络id 172.27.60.0, 子网掩码 255.255.255.0 or a /24, 默认子网网关172.27.60.1,广播地址 172.27.60.255.0
|
||||
|
||||
以上这些信息用于构建hcpd.conf文件中新的网络非常重要。使用文本编辑器修改配置文件添加新的网络进去，这里我们需要使用root或sudo访问权限。网络非常重要。使用文本编辑器修改配置文件添加新的网络进去，这里我们需要使用root或sudo访问权限。
|
||||
|
||||
以下这个地址池所用到的信息都是管理员收集整理的：网络id 172.27.60.0, 子网掩码 255.255.255.0 or a /24, 默认网关172.27.60.1,广播地址 172.27.60.255.
|
||||
# nano /etc/dhcp/dhcpd.conf
|
||||
|
||||
|
||||
Configure DHCP Pools and Networks
|
||||
配置DHCP的地址池和网络
|
||||
|
||||
This is the sample created to hand out IP addresses to a network that is used for the creation of VMWare virtual practice servers. The first line indicates the network as well as the subnet mask for that network. Then inside the brackets are all the options that the DHCP server should provide to hosts on this network.
|
||||
当前这个例子是给用VMWare创建的虚拟服务器分配IP地址。第一行显示是该网络的子网掩码。括号里面的内容是DHCP服务器应该提供给网络上面主机的所有选项。
|
||||
|
||||
这例子是分配IP地址给用VMWare创建的虚拟服务器。第一行标明是该网络的子网掩码。括号里面是DHCP服务器应该提供给当前网络上主机的所有选项。
|
||||
第一节， range 172.27.60.50 172.27.60.254;这一行显示的是，DHCP服务在这个网络上能够给主机动态分发的地址范围。
|
||||
|
||||
The first stanza, range 172.27.60.50 172.27.60.254;, is the range of dynamically assignable addresses that the DHCP server can hand out to hosts on this network. Notice that the first 49 addresses aren’t in the pool and can be assigned statically to hosts if needed.
|
||||
第二节，option routers 172.27.60.1;这里显示的是网络里面所有的主机分发默认网关地址。
|
||||
|
||||
第一节， range 172.27.60.50 172.27.60.254;是DHCP服务在这个网络上能够给主机动态分发的地址范围。
|
||||
|
||||
The second stanza, option routers 172.27.60.1; , hands out the default gateway address for all hosts on this network.
|
||||
|
||||
第二节，option routers 172.27.60.1;给网络里面所有的主机分发默认网关地址。
|
||||
|
||||
The last stanza, option broadcast-address 172.27.60.255;, indicates what the network’s broadcast address. This address SHOULD NOT be a part of the range stanza as the broadcast address can’t be assigned to a host.
|
||||
|
||||
最后一节， option broadcast-address 172.27.60.255;,说明当前网络的广播地址。这个地址不能被包含在要分发放的地址范围内，因为广播地址不能分配到一个主机上面。
|
||||
Some pointers, be sure to always end the option lines with a semi-colon (;) and always make sure each network created is enclosed in curly braces { }.
|
||||
最后一节， option broadcast-address 172.27.60.255;,显示当前网络的广播地址。这个地址不能被包含在要分发放的地址范围内，因为广播地址不能分配到一个主机上面。
|
||||
|
||||
必须要强调的是每行的结尾必须要用（；)来结束，所有创建的网络必须要在{}里面。
|
||||
|
||||
7. If there are more networks to create, continue creating them with their appropriate options and then save the text file. Once all configurations have been completed, the ISC-DHCP-Server process will need to be restarted in order to apply the new changes. This can be accomplished with the following command:
|
||||
|
||||
7. 如果是创建多个网络，持续的创建它们的相应选项最终保存文本文件。一旦配置完成， ISC-DHCP-Server进程需要重启来使新的更改生效。可以通过下面的命令来完成：
|
||||
7. 如果是创建多个网络，连续的创建完它们的相应选项后保存文本文件即可。配置完成以后如果有更改，ISC-DHCP-Server进程需要重启来使新的更改生效。重启进程可以通过下面的命令来完成：
|
||||
# service isc-dhcp-server restart
|
||||
|
||||
This will restart the DHCP service and then the administrator can check to see if the server is ready for DHCP requests several different ways. The easiest is to simply see if the server is listening on port 67 via the [lsof command][1]:
|
||||
|
||||
这条命令将重启DHCP服务，管理员能够使用几种不同的方式来检查服务器是否已经可以处理dhcp请求。最简单的方法是通过lsof命令[1]来查看服务器是否在监听67端口，命令如下：
|
||||
这条命令将重启DHCP服务，管理员能够使用几种不同的方式来检查服务器是否已经可以处理dhcp请求。最简单的方法是通过lsof命令[1]来查看服务器是否在侦听67端口，命令如下：
|
||||
|
||||
# lsof -i :67
|
||||
|
||||
|
||||
Check DHCP Listening Port
|
||||
检查DHCP监听端口
|
||||
检查DHCP侦听端口
|
||||
|
||||
This output indicates that the DHCPD (DHCP Server daemon) is running and listening on port 67. Port 67 in this output was actually converted to ‘bootps‘ due to a port number mapping for port 67 in /etc/services file.
|
||||
这里输出的结果表明DHCPD（DHCP服务守护进程）正在运行并且侦听67端口。由于/etc/services文件中67端口是端口映射，所以输出中的67端口实际上被转换成了“bootps”。
|
||||
|
||||
这里的输出表明DHCPD（DHCP服务守护进程）正在运行并且监听67端口。由于/etc/services文件中67端口的端口映射，输出中的67端口实际上被转换成了“bootps”。
|
||||
|
||||
This is very common on most systems. At this point, the server should be ready for network connectivity and can be confirmed by connecting a machine to the network and having it request a DHCP address from the server.
|
||||
|
||||
在大多数的系统中这是非常普遍的，此时，服务器应该已经为网络连接做好准备，可以通过将一台主机接入网络请求DHCP地址来验证服务是否正常。
|
||||
|
||||
### Step 2: Testing Client Connectivity ###
|
||||
在大多数的系统中这是非常常见的，现在服务器应该已经为网络连接做好准备，我们可以将一台主机接入网络请求DHCP地址来验证服务是否正常。
|
||||
|
||||
### 测试客户端连接 ###
|
||||
8. Most systems now-a-days are using Network Manager to maintain network connections and as such the device should be pre-configured to pull DHCP when the interface is active.
|
||||
|
||||
8. 现在许多系统使用网络管理器来维护网络连接状态，因此这个装置应该预先配置，当接口是活跃的时候来获取DHCP。
|
||||
8. 现在许多系统使用网络管理器来维护网络连接状态，因此这个设备应该预先配置好的，只要对应的接口处于活跃状态就能够获取DHCP。
|
||||
|
||||
However on machines that aren’t using Network Manager, it may be necessary to manually attempt to pull a DHCP address. The next few steps will show how to do this as well as how to see whether the server is handing out addresses.
|
||||
然而当一台设备无法使用网络管理器时，它可能需要手动获取DHCP地址。下面的几步将演示怎样手动获取以及如何查看服务器是否已经按需要分发地址。
|
||||
|
||||
然而当一台设备无法使用网络管理器时，它可能需要手动获取DHCP地址。下面的几步将展示如何做到这一点以及如何查看服务器是否分发地址。
|
||||
|
||||
The ‘[ifconfig][2]‘ utility can be used to check an interface’s configuration. The machine used to test the DHCP server only has one network adapter and it is called ‘eth0‘.
|
||||
|
||||
‘[ifconfig][2]‘工具能够用来检查接口配置。这台设备被用来监测DHCP服务它只有一个网络适配器（网卡），这块网卡被命名为‘eth0‘。
|
||||
‘[ifconfig][2]‘工具能够用来检查接口的配置。这台被用来测试的DHCP服务器的设备，它只有一个网络适配器（网卡），这块网卡被命名为‘eth0‘。
|
||||
|
||||
# ifconfig eth0
|
||||
|
||||
|
||||
Check Network Interface IP Address
|
||||
检查网络接口IP地址
|
||||
|
||||
From this output, this machine currently doesn’t have an IPv4 address, great! Let’s instruct this machine to reach out to the DHCP server and request an address. This machine has the DHCP client utility known as ‘dhclient‘ installed. The DHCP client utility may very from system to system.
|
||||
|
||||
从输出结果上看，这台设备目前没有一个IPv4地址，很好这样便于测试。让这台设备连接到DHCP服务器并发出一个请求。这台设备上安装了一个名为‘dhclient‘ 的DHCP客户端工具。这个客户端工具会因为系统不同而不同。
|
||||
从输出结果上看，这台设备目前没IPv4地址，这样很好便于测试。我们把这台设备连接到DHCP服务器并发出一个请求。这台设备上已经安装了一个名为‘dhclient‘ 的DHCP客户端工具。因为操作系统各不相同，所以这个客户端软件也是互不一样的。
|
||||
# dhclient eth0
|
||||
|
||||
|
||||
Request IP Address from DHCP
|
||||
从DHCP请求IP地址
|
||||
|
||||
Now the `'inet addr:'` field shows an IPv4 address that falls within the scope of what was configured for the 172.27.60.0 network. Also notice that the proper broadcast address was handed out as well as subnet mask for this network.
|
||||
当前 `'inet addr:'` 字段中显示了属于172.27.60.0网络地址范围内的IPv4地址。值得欣慰的是当前网络还配置了正确的子网掩码并且分发了广播地址。
|
||||
|
||||
现在 `'inet addr:'` 字段显示了属于172.27.60.0网络地址范围内的IPv4地址。另外要注意：目前该网络配置了正确的子网掩码并且分发了广播地址。
|
||||
|
||||
Things are looking promising but let’s check the server to see if it was actually the place where this machine received this new IP address. To accomplish this task, the server’s system log file will be consulted. While the entire log file may contain hundreds of thousands of entries, only a few are necessary for confirming that the server is working properly. Rather than using a full text editor, this time a utility known as ‘tail‘ will be used to only show the last few lines of the log file.
|
||||
|
||||
看起来还不错，让我们来测试一下，看看它是不是这台设备收到新IP地址的地方。我们参照服务器的日志文件来完成这个任务。虽然这个日志的内容有几十万条，但是里面只有几条是用来确定服务器是否正常工作的。这里我们使用一个工具‘tail’，它只显示日志文件的最后几行，而不是使用一个完整的文本编辑器去查看日志文件。命令如下：
|
||||
到这里看起来还都不错，让我们来测试一下，看看这台设备收到新IP地址是不是由服务器发出的。这里我们参照服务器的日志文件来完成这个任务。虽然这个日志的内容有几十万条，但是里面只有几条是用来确定服务器是否正常工作的。这里我们使用一个工具‘tail’，它只显示日志文件的最后几行，这样我们就可以不用拿一个文本编辑器去查看所有的日志文件了。命令如下：
|
||||
|
||||
# tail /var/log/syslog
|
||||
|
||||
|
||||
Check DHCP Logs
|
||||
检查DHCP日志文件
|
||||
|
||||
Voila! The server recorded handing out an address to this host (HRTDEBXENSRV). It is a safe assumption at this point that the server is working as intended and handing out the appropriate addresses for the networks that it is an authority. At this point the DHCP server is up and running. Configure the other networks, troubleshoot, and secure as necessary.
|
||||
OK!服务器记录表明它分发了一个地址给这台主机(HRTDEBXENSRV)。服务器按预期运行，给它充当权威的网络分发适合的网络地址。至此DHCP服务器搭建成功并且运行。如果有需要你可以继续配置其他的网络，排查故障，确保安全。
|
||||
|
||||
OK!服务器记录表明它分发了一个地址给这台主机(HRTDEBXENSRV)。服务器按预期运行，给它充当权威的网络分发适合的网络地址。到这里DHCP服务器搭建成功并且运行起来了。配置其他的网络，排查故障，确保安全。
|
||||
|
||||
Enjoy the newly functioning ISC-DHCP-Server and tune in later for more Debian tutorials. In the not too distant future there will be an article on Bind9 and DDNS that will tie into this article.
|
||||
|
||||
更多新的 ISC-DHCP-Server 的功能在以后的Debian教程中会被提及。不久以后将写一篇关于Bind9和DDNS的教程，插入到这篇文章里面。
|
||||
在以后的Debian教程中我会讲一些新的 ISC-DHCP-Server 功能。有时间的话我将写一篇关于Bind9和DDNS的教程，融入到这篇文章里面。
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/install-and-configure-multihomed-isc-dhcp-server-on-debian-linux/
|
||||
|
||||
@@ -0,0 +1,425 @@
|
||||
如何在Ubuntu 15.04中安装puppet
|
||||
================================================================================
|
||||
|
||||
大家好，本教程将教各位如何在ubuntu 15.04上面安装puppet，用它来管理你的服务器基础环境。puppet是由puppet实验室开发并维护的一款开源软件，它能够帮我们自动的管理配置服务器的基础环境。不管我们管理的是几个服务器还是数以千计的计算机组成的业务报表体系，puppet都能够使管理员从繁琐的手动配置调整中解放出来，腾出时间和精力去提系统的升整体效率。它能够确保所有自动化流程作业的一致性，可靠性以及稳定性。它让管理员和开发者更紧密的联系在一起，使开发者更容易产出付出设计良好，简洁清晰的代码。puppet提供了管理配置和自动化数据中心的2个解决方案。这两个解决方案分别是**puppet开源项目 和 puppet商业版**。puppet开源项目依赖于apache2.0，它是一个非常灵活可随意定制的解决方案，设置初衷是帮助管理员去完成那些重复性操作工作。pupprt商业版是一个全平台复杂IT环境下的成熟解决方案，它除了拥有开源版本所有优势以外还有移动端apps，只有商业版才有的加强支持，以及模块化和集成管理等。Puppet使用SSL证书来认证主机与代理节点之间的通信。
|
||||
|
||||
本教程将要介绍如何在ubuntu 15.04的主机和代理节点上面安装开源版的puppet。在这我们用一台服务器做主机，管理和控制剩余当作puppet的代理节点的服务器，这些代理节点将依据服务器来进行配置。在ubuntu 15.04只需要简单的几步就能安装配置好puppet，用它来管理我们的服务器基础环境非常的方便。（译者注：puppet采用的C/S架构所以必须有至少有一台作为服务端，其他作为客户端处理）
|
||||
### 1.设置主机###
|
||||
在本教程里，我们将使用用2台运行ubuntu 15.04 "Vivid Vervet"的主机，一台作为服务端，另一台作为puppet的代理节点。下面是我们将用到的服务器的基础信息。
|
||||
|
||||
puupet服务器IP：44.55.88.6，主机名： puppetmaster
|
||||
puppet代理节点IP： 45.55.86.39 ，主机名： puppetnode
|
||||
|
||||
我们要在代理节点和服务器这两天机器的hosts里面都添加上相应的条目，使用root或是sudo访问权限来编辑/etc/hosts文件，命令如下：
|
||||
|
||||
|
||||
# nano /etc/hosts
|
||||
|
||||
45.55.88.6 puppetmaster.example.com puppetmaster
|
||||
45.55.86.39 puppetnode.example.com puppetnode
|
||||
|
||||
注意，puppet服务端必使用8140端口来运行，所以请务必保证开启8140端口。
|
||||
|
||||
### 2. 用NTP更新时间 ###
|
||||
|
||||
puppet代理节点所使用系统时间必须要准确，这样可以避免代理证书出现问题。如果有时间差异，那么证书将过期失效，所以服务器与代理节点的系统时间必须互相同步。我们使用NTP（Network Time Protocol，网络时间协议）来同步时间。在服务器与代理节点上面分别运行以下命令来同步时间。
|
||||
|
||||
|
||||
# ntpdate pool.ntp.org
|
||||
|
||||
17 Jun 00:17:08 ntpdate[882]: adjust time server 66.175.209.17 offset -0.001938 sec （译者注：显示类似的输出结果表示运行正常）
|
||||
|
||||
如果没有ntp，请使用下面的命令更新你的软件仓库，安装并运行ntp服务
|
||||
|
||||
# apt-get update && sudo apt-get -y install ntp ; service ntp restart
|
||||
|
||||
### 3. 安装服务器软件 ###
|
||||
|
||||
安装开源版本的puppet有很多的方法。在本教程中我们在puppet实验室官网下载一个名为puppetlabs-release的软件包，安装后它将为我们在软件源里面添加puppetmaster-passenger。puppetmaster-passenger依赖于apache的puppet服务端。我们开始下载这个软件包
|
||||
|
||||
|
||||
# cd /tmp/
|
||||
# wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
|
||||
--2015-06-17 00:19:26-- https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
Resolving apt.puppetlabs.com (apt.puppetlabs.com)... 192.155.89.90, 2600:3c03::f03c:91ff:fedb:6b1d
|
||||
Connecting to apt.puppetlabs.com (apt.puppetlabs.com)|192.155.89.90|:443... connected.
|
||||
HTTP request sent, awaiting response... 200 OK
|
||||
Length: 7384 (7.2K) [application/x-debian-package]
|
||||
Saving to: ‘puppetlabs-release-trusty.deb’
|
||||
|
||||
puppetlabs-release-tr 100%[===========================>] 7.21K --.-KB/s in 0.06s
|
||||
|
||||
2015-06-17 00:19:26 (130 KB/s) - ‘puppetlabs-release-trusty.deb’ saved [7384/7384]
|
||||
|
||||
下载完成，我们来安装它
|
||||
|
||||
# dpkg -i puppetlabs-release-trusty.deb
|
||||
|
||||
Selecting previously unselected package puppetlabs-release.
|
||||
(Reading database ... 85899 files and directories currently installed.)
|
||||
Preparing to unpack puppetlabs-release-trusty.deb ...
|
||||
Unpacking puppetlabs-release (1.0-11) ...
|
||||
Setting up puppetlabs-release (1.0-11) ...
|
||||
|
||||
使用apt包管理命令更新一下本地的软件源
|
||||
|
||||
# apt-get update
|
||||
|
||||
现在我们就可以安装puppetmaster-passenger了
|
||||
|
||||
# apt-get install puppetmaster-passenger
|
||||
|
||||
**提示**: 在安装的时候可能会报错**Warning: Setting templatedir is deprecated.请查看 http://links.puppetlabs.com/env-settings-deprecations (at /usr/lib/ruby/vendor_ruby/puppet/settings.rb:1139:in `issue_deprecation_warning')** 不过不用担心，忽略掉它就好，我们只需要在设置配置文件的时候把这一项disable就行了。
|
||||
|
||||
如何来查看puppet master是否已经安装成功了呢？非常简单，只需要使用下面的命令查看它的版本就可以了。
|
||||
|
||||
|
||||
# puppet --version
|
||||
|
||||
3.8.1
|
||||
|
||||
现在我们已经安装好了puppet master。要想使用puppet master apache服务就必须运行起来，因为puppet master进程的运行是依赖于apache的。
|
||||
在开始之前，我们将apache服务停止，这样puppet muster也会停止运行。
|
||||
|
||||
# systemctl stop apache2
|
||||
|
||||
### 4. 使用Apt工具锁定Master（服务端）版本 ###
|
||||
|
||||
现在已经安装了 3.8.1版的puppet，我们锁定这个版本不让它随意升级，因为升级会造成配置文件混乱。 使用apt工具来锁定它，这里我们需要使用文本编辑器来创建一个新的文件 **/etc/apt/preferences.d/00-puppet.pref**
|
||||
|
||||
# nano /etc/apt/preferences.d/00-puppet.pref
|
||||
|
||||
在新创建的文件里面添加以下内容
|
||||
|
||||
|
||||
# /etc/apt/preferences.d/00-puppet.pref
|
||||
Package: puppet puppet-common puppetmaster-passenger
|
||||
Pin: version 3.8*
|
||||
Pin-Priority: 501
|
||||
|
||||
这样在以后的系统软件升级中puppet master将被锁住不会跟随系统软件一起升级。
|
||||
|
||||
### 5. 配置 Puppet Master###
|
||||
Puppet master作为一个证书发行机构，所有代理证书的请求都将由它来处理。首先我们要删除所有在软件包安装过程中创建出来的ssl证书。本地默认的puppet证书在/var/lib/puppet/ssl。因此我们只需要使用rm命令来移除这些证书就可以了。
|
||||
|
||||
|
||||
# rm -rf /var/lib/puppet/ssl
|
||||
|
||||
现在来配置这些证书，在创建puppet master证书的时候，需要用使用DNS能查找到的代理节点名称。使用文本编辑器来修改服务器的配置文件puppet.conf
|
||||
# nano /etc/puppet/puppet.conf
|
||||
|
||||
输出的结果像下面这样
|
||||
|
||||
[main]
|
||||
logdir=/var/log/puppet
|
||||
vardir=/var/lib/puppet
|
||||
ssldir=/var/lib/puppet/ssl
|
||||
rundir=/var/run/puppet
|
||||
factpath=$vardir/lib/facter
|
||||
templatedir=$confdir/templates
|
||||
|
||||
[master]
|
||||
# These are needed when the puppetmaster is run by passenger
|
||||
# and can safely be removed if webrick is used.
|
||||
ssl_client_header = SSL_CLIENT_S_DN
|
||||
ssl_client_verify_header = SSL_CLIENT_VERIFY
|
||||
|
||||
|
||||
在这我们需要注释掉templatedir 这行使它失效。然后在文件的结尾添加下面的信息。
|
||||
|
||||
|
||||
server = puppetmaster
|
||||
environment = production
|
||||
runinterval = 1h
|
||||
strict_variables = true
|
||||
certname = puppetmaster
|
||||
dns_alt_names = puppetmaster, puppetmaster.example.com
|
||||
|
||||
还有很多你可能用的到的配置选项。 如果你有需要，在Puppet实验室有一份详细的描述文件供你阅读。 [Main Config File (puppet.conf)][1].
|
||||
|
||||
编辑完成后保存退出。
|
||||
|
||||
使用下面的命令来生成一个新的证书。
|
||||
|
||||
|
||||
# puppet master --verbose --no-daemonize
|
||||
|
||||
Info: Creating a new SSL key for ca
|
||||
Info: Creating a new SSL certificate request for ca
|
||||
Info: Certificate Request fingerprint (SHA256): F6:2F:69:89:BA:A5:5E:FF:7F:94:15:6B:A7:C4:20:CE:23:C7:E3:C9:63:53:E0:F2:76:D7:2E:E0:BF:BD:A6:78
|
||||
...
|
||||
Notice: puppetmaster has a waiting certificate request
|
||||
Notice: Signed certificate request for puppetmaster
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetmaster at '/var/lib/puppet/ssl/ca/requests/puppetmaster.pem'
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetmaster at '/var/lib/puppet/ssl/certificate_requests/puppetmaster.pem'
|
||||
Notice: Starting Puppet master version 3.8.1
|
||||
^CNotice: Caught INT; storing stop
|
||||
Notice: Processing stop
|
||||
|
||||
至此，证书已经生成。一旦我们看到 **Notice: Starting Puppet master version 3.8.1**, 表明证书就已经制作好了.我们按下 CTRL-C 回到shell命令行。
|
||||
|
||||
查看新生成证书的信息，可以使用下面的命令。
|
||||
|
||||
# puppet cert list -all
|
||||
|
||||
+ "puppetmaster" (SHA256) 33:28:97:86:A1:C3:2F:73:10:D1:FB:42:DA:D5:42:69:71:84:F0:E2:8A:01:B9:58:38:90:E4:7D:B7:25:23:EC (alt names: "DNS:puppetmaster", "DNS:puppetmaster.example.com")
|
||||
|
||||
### 6. 创建一个Puppet清单 ###
|
||||
|
||||
默认的主要清单是/etc/puppet/manifests/site.pp。 这个主要清单文件定义着控制哪些代理节点。现在我们来创建一个清单文件
|
||||
|
||||
# nano /etc/puppet/manifests/site.pp
|
||||
|
||||
在刚打开的文件里面添加下面这几行
|
||||
|
||||
# execute 'apt-get update'
|
||||
exec { 'apt-update': # exec resource named 'apt-update'
|
||||
command => '/usr/bin/apt-get update' # command this resource will run
|
||||
}
|
||||
|
||||
# install apache2 package
|
||||
package { 'apache2':
|
||||
require => Exec['apt-update'], # require 'apt-update' before installing
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
# ensure apache2 service is running
|
||||
service { 'apache2':
|
||||
ensure => running,
|
||||
}
|
||||
|
||||
以上这几行的意思是给代理节点部署apache web 服务
|
||||
### 7. 运行puppet Master服务 ###
|
||||
|
||||
已经准备好运行puppet master了，那么开启apache服务来让它启动
|
||||
|
||||
# systemctl start apache2
|
||||
|
||||
我们puppet master已经运行，不过它还不能管理任何代理节点。现在我们给puppet master添加代理节点.
|
||||
|
||||
**提示**: 如果报错 **Job for apache2.service failed. 查看"systemctl status apache2.service" and "journalctl -xe" 所给出的信息.** 肯定是apache server有一些问题. 我们可以使用root或是sudo访问权限来运行**apachectl start**查看它输出的日志。 在本教程执行过程中, 我们发现一个证书配置的问题，解决方法如下**/etc/apache2/sites-enabled/puppetmaster.conf**. 修改其中的**SSLCertificateFile /var/lib/puppet/ssl/certs/server.pem 为 SSLCertificateFile /var/lib/puppet/ssl/certs/puppetmaster.pem** 然后注释掉后面这行**SSLCertificateKeyFile** . 然后在命令行启动apache
|
||||
### 8. Puppet客户端安装 ###
|
||||
|
||||
我们已经准备好了puppet的服务端，现在来为代理节点安装客户端。这里我们要给每一个需要管理的节点安装客户端，并且确保这些节点能够通过DNS查询到服务器主机。下面将 puppetnode.example.com作为代理节点安装客户端
|
||||
在代理节点服务器上，使用下面的命令下载puppet实验室提供的软件包。
|
||||
|
||||
|
||||
# cd /tmp/
|
||||
# wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb\
|
||||
|
||||
--2015-06-17 00:54:42-- https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
|
||||
Resolving apt.puppetlabs.com (apt.puppetlabs.com)... 192.155.89.90, 2600:3c03::f03c:91ff:fedb:6b1d
|
||||
Connecting to apt.puppetlabs.com (apt.puppetlabs.com)|192.155.89.90|:443... connected.
|
||||
HTTP request sent, awaiting response... 200 OK
|
||||
Length: 7384 (7.2K) [application/x-debian-package]
|
||||
Saving to: ‘puppetlabs-release-trusty.deb’
|
||||
|
||||
puppetlabs-release-tr 100%[===========================>] 7.21K --.-KB/s in 0.04s
|
||||
|
||||
2015-06-17 00:54:42 (162 KB/s) - ‘puppetlabs-release-trusty.deb’ saved [7384/7384]
|
||||
|
||||
在ubuntu 15.04上我们使用debian包管理系统来安装它，命令如下：
|
||||
|
||||
|
||||
# dpkg -i puppetlabs-release-trusty.deb
|
||||
|
||||
使用apt包管理命令更新一下本地的软件源
|
||||
|
||||
# apt-get update
|
||||
|
||||
通过远程仓库安装
|
||||
# apt-get install puppet
|
||||
|
||||
Puppet客户端默认是不启动的。这里我们需要使用文本编辑器修改/etc/default/puppet文件，使它正常工作。
|
||||
# nano /etc/default/puppet
|
||||
|
||||
更改 **START** 的值改成 "yes" 。
|
||||
|
||||
START=yes
|
||||
|
||||
最后保存并退出。
|
||||
|
||||
### 9. 使用APT工具锁定Agent（客户端）版本 ###
|
||||
|
||||
和上面的步骤一样为防止随意升级造成的配置文件混乱，我们要使用apt工具来把它锁定。具体做法是使用文本编辑器创建一个文件 **/etc/apt/preferences.d/00-puppet.pref**
|
||||
|
||||
# nano /etc/apt/preferences.d/00-puppet.pref
|
||||
|
||||
在新建的文件里面加入如下内容
|
||||
|
||||
# /etc/apt/preferences.d/00-puppet.pref
|
||||
Package: puppet puppet-common
|
||||
Pin: version 3.8*
|
||||
Pin-Priority: 501
|
||||
|
||||
这样puppet就不会随着系统软件升级而随意升级了。
|
||||
|
||||
### 10. 配置puppet代理节点 ###
|
||||
|
||||
我们需要编辑一下代理节点的puppet.conf文件，来使它运行。
|
||||
|
||||
# nano /etc/puppet/puppet.conf
|
||||
|
||||
它看起来和服务端的配置文件完全一样。同样注释掉**templatedir**这行。不同的是在这里我们需要删除掉所有关于[master]的部分。
|
||||
|
||||
|
||||
假定服务端可用，我们的客户端应该是可以和它相互连接通信的。如果不行我们需要使用完整的主机域名puppetmaster.example.com
|
||||
|
||||
[agent]
|
||||
server = puppetmaster.example.com
|
||||
certname = puppetnode.example.com
|
||||
|
||||
在文件的结尾增加上面3行，增加之后文件内容像下面这样。
|
||||
|
||||
[main]
|
||||
logdir=/var/log/puppet
|
||||
vardir=/var/lib/puppet
|
||||
ssldir=/var/lib/puppet/ssl
|
||||
rundir=/var/run/puppet
|
||||
factpath=$vardir/lib/facter
|
||||
#templatedir=$confdir/templates
|
||||
|
||||
[agent]
|
||||
server = puppetmaster.example.com
|
||||
certname = puppetnode.example.com
|
||||
|
||||
最后保存并退出。
|
||||
|
||||
使用下面的命令来启动客户端软件
|
||||
|
||||
# systemctl start puppet
|
||||
|
||||
如果一切顺利的话，我们不会看到命令行有任何输出。 第一次运行的时候,代理节点会生成一个ssl证书并且给服务端发送一个请求，经过签名确认后，两台机器就可以互相通信了。
|
||||
|
||||
**提示**: 如果这是你添加的第一个代理节点,建议你在添加其他节点前先给这个证书签名。一旦能够通过并正常运行，回过头来再添加其他代理节点。
|
||||
|
||||
### 11. 服务器上的签名证书请求 ###
|
||||
|
||||
第一次运行的时候,代理节点会生成一个ssl证并且给服务端发送一个请求。在主服务器给代理节点服务器证书签名之后，主服务器才能和代理服务器通信并且控制代理服务器。
|
||||
|
||||
在主服务器上使用下面的命令来列出当前的证书请求
|
||||
|
||||
# puppet cert list
|
||||
"puppetnode.example.com" (SHA256) 31:A1:7E:23:6B:CD:7B:7D:83:98:33:8B:21:01:A6:C4:01:D5:53:3D:A0:0E:77:9A:77:AE:8F:05:4A:9A:50:B2
|
||||
|
||||
因为只设置了一台代理节点服务器，所以我们将只看到一个请求。
|
||||
注意有没有“+”号在前面，代表这个证书有没有被签名。
|
||||
|
||||
使用**puppet cert sign**到**hostname**这个命令来签署这个签名请求。
|
||||
|
||||
# puppet cert sign puppetnode.example.com
|
||||
Notice: Signed certificate request for puppetnode.example.com
|
||||
Notice: Removing file Puppet::SSL::CertificateRequest puppetnode.example.com at '/var/lib/puppet/ssl/ca/requests/puppetnode.example.com.pem'
|
||||
|
||||
服务端只能控制它签名过的代理节点。
|
||||
|
||||
如想我们想签署所有的请求, 需要使用-all选项，如下所示。
|
||||
|
||||
# puppet cert sign --all
|
||||
|
||||
### 12.删除一个Puppet证书 ###
|
||||
|
||||
如果我们想移除一个主机，或者想重建一个主机然后再添加它。下面的例子里我们将展示如何删除puppet master上面的一个证书。使用的命令如下：
|
||||
|
||||
# puppet cert clean hostname
|
||||
Notice: Revoked certificate with serial 5
|
||||
Notice: Removing file Puppet::SSL::Certificate puppetnode.example.com at '/var/lib/puppet/ssl/ca/signed/puppetnode.example.com.pem'
|
||||
Notice: Removing file Puppet::SSL::Certificate puppetnode.example.com at '/var/lib/puppet/ssl/certs/puppetnode.example.com.pem'
|
||||
|
||||
如果我们想查看所有的签署和未签署的请求，使用下面这条命令
|
||||
|
||||
# puppet cert list --all
|
||||
+ "puppetmaster" (SHA256) 33:28:97:86:A1:C3:2F:73:10:D1:FB:42:DA:D5:42:69:71:84:F0:E2:8A:01:B9:58:38:90:E4:7D:B7:25:23:EC (alt names: "DNS:puppetmaster", "DNS:puppetmaster.example.com")
|
||||
|
||||
|
||||
### 13. 部署代理节点Puppet清单 ###
|
||||
|
||||
当配置并完成主puppet清单后，现在我们需要署代理节点服务器清单。要应用并加载主puppet清单，我们可以在代理节点服务器上面使用下面的命令
|
||||
|
||||
# puppet agent --test
|
||||
|
||||
Info: Retrieving pluginfacts
|
||||
Info: Retrieving plugin
|
||||
Info: Caching catalog for puppetnode.example.com
|
||||
Info: Applying configuration version '1434563858'
|
||||
Notice: /Stage[main]/Main/Exec[apt-update]/returns: executed successfully
|
||||
Notice: Finished catalog run in 10.53 seconds
|
||||
|
||||
这里像我们展示了主清单如何去管理一个单一的服务器。
|
||||
|
||||
如果我们打算运行的puppet清单与主puppet清单没有什么关联，那么需要使用puppet apply 到相应的路径。它仅适用于该代理节点。
|
||||
|
||||
# puppet apply /etc/puppet/manifest/test.pp
|
||||
|
||||
### 14. 配置特殊节点清单 ###
|
||||
|
||||
如果我们想部署一个清单到某个特定的节点，我们需要进行以下操作。
|
||||
|
||||
在主服务器上面使用文本编辑器编辑/etc/puppet/manifest/site.pp
|
||||
|
||||
# nano /etc/puppet/manifest/site.pp
|
||||
|
||||
添加下面的内容进去
|
||||
|
||||
node 'puppetnode', 'puppetnode1' {
|
||||
# execute 'apt-get update'
|
||||
exec { 'apt-update': # exec resource named 'apt-update'
|
||||
command => '/usr/bin/apt-get update' # command this resource will run
|
||||
}
|
||||
|
||||
# install apache2 package
|
||||
package { 'apache2':
|
||||
require => Exec['apt-update'], # require 'apt-update' before installing
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
# ensure apache2 service is running
|
||||
service { 'apache2':
|
||||
ensure => running,
|
||||
}
|
||||
}
|
||||
|
||||
这里的配置显示我们将在名为puppetnode and puppetnode1的2个特殊节点上面安装apache服务. 这里可以添加其他我们需要安装部署的具体节点进去。
|
||||
### 15. 配置清单模块 ###
|
||||
|
||||
模块化组件组是非常实用的，在Puppet社区有很多人贡献自己的模块组件。
|
||||
|
||||
在主puppet服务器上, 我们将使用puppet module命令来安装**puppetlabs-apache** 模块。
|
||||
|
||||
# puppet module install puppetlabs-apache
|
||||
|
||||
**警告**: 千万不要在一个已经部署apache环境的机器上面使用这个模块，否则它将清空你的apache配置。
|
||||
|
||||
现在用文本编辑器来修改 **site.pp**
|
||||
|
||||
# nano /etc/puppet/manifest/site.pp
|
||||
|
||||
添加下面的内容进去，意思是在 puppetnode上面安装apache服务。
|
||||
|
||||
node 'puppet-node' {
|
||||
class { 'apache': } # use apache module
|
||||
apache::vhost { 'example.com': # define vhost resource
|
||||
port => '80',
|
||||
docroot => '/var/www/html'
|
||||
}
|
||||
}
|
||||
|
||||
保存退出。这样为我们的代理服务器重新配置部署基础环境。
|
||||
|
||||
### 总结 ###
|
||||
|
||||
现在我们已经成功的在ubuntu 15.04上面部署并运行puppet来管理代理节点服务器的基础运行环境。我们学习了puppet是如何工作的，编写清单文件，节点与主机间使用ssl证书认证的认证过程。使用puppet管理配置众多的代理节点服务器是非常容易的。如果你有任何的问题，建议，反馈，与我们取得联系，我们将第一时间完善更新，谢谢。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://linoxide.com/linux-how-to/install-puppet-ubuntu-15-04/
|
||||
|
||||
作者：[Arun Pyasi][a]
|
||||
译者：[ivo-wang](https://github.com/ivo-wang)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://linoxide.com/author/arunp/
|
||||
[1]:https://docs.puppetlabs.com/puppet/latest/reference/config_file_main.html
|
||||
@@ -0,0 +1,138 @@
|
||||
如何使用加密过密码的Mutt邮件客户端
|
||||
================================================================================
|
||||
Mutt是一个开源的Linux/UNIX终端环境下的邮件客户端。连同[Alpine][1]，Mutt有充分的理由在Linux命令行热衷者中有最忠诚的追随者。想一下你对邮件客户端的期待的事情，Mutt拥有：多协议支持（e.g., POP3, IMAP and SMTP），S/MIME和PGP/GPG集成，线程会话，颜色编码，可定制宏/快捷键，等等。另外，基于命令行的Mutt相比笨重的web浏览器（如：Gmail，Ymail）或可视化邮件客户端（如：Thunderbird，MS Outlook）是一个轻量访问电子邮件的选择。
|
||||
|
||||
当你想使用Mutt通过公司的SMTP/IMAP服务器访问或发送邮件，或取代网页邮件服务，可能所关心的一个问题是如何保护您的邮件凭据（如：SMTP/IMAP密码）存储在一个纯文本Mutt配置文件（~/.muttrc）。
|
||||
|
||||
对于一些人安全的担忧，确实有一个容易的方法来**加密Mutt配置文件***，防止这种风险。在这个教程中，我描述了如何加密Mutt敏感配置，比如SMTP/IMAP密码使用GnuPG（GPG），一个开源的OpenPGP实现。
|
||||
|
||||
### 第一步 （可选）：创建GPG密钥 ###
|
||||
|
||||
因为我们将要使用GPG加密Mutt配置文件，如果你没有，第一步就是创建一个GPG密钥（公有/私有 密钥对）。如果有，忽略这步。
|
||||
|
||||
创建一个新GPG密钥，输入下面的。
|
||||
|
||||
$ gpg --gen-key
|
||||
|
||||
选择密钥类型（RSA），密钥长度（2048 bits），和过期时间（0，不过期）。当出现用户ID提示时，输入你的名字（Dan Nanni） 和邮箱地址（myemail@email.com）关联到私有/公有密钥对。最后，输入一个密码来保护你的私钥。
|
||||
|
||||
|
||||
|
||||
生成一个GPG密钥需要大量的随机字节熵，所以在生成密钥期间确保在你的系统上执行一些随机行为（如：打键盘，移动鼠标或者读写磁盘）。根据密钥长度决定生成GPG密钥要花几分钟或更多时间。
|
||||
|
||||
|
||||
|
||||
### 第二部：加密Mutt敏感配置 ###
|
||||
|
||||
下一步，在~/.mutt目录创建一个新的文本文件，然后把一些你想隐藏的Mutt敏感配置放进去。这个例子里，我指定了SMTP/IMAP密码。
|
||||
|
||||
$ mkdir ~/.mutt
|
||||
$ vi ~/.mutt/password
|
||||
|
||||
----------
|
||||
|
||||
set smtp_pass="XXXXXXX"
|
||||
set imap_pass="XXXXXXX"
|
||||
|
||||
现在gpg用你的公钥加密这个文件如下。
|
||||
|
||||
$ gpg -r myemail@email.com -e ~/.mutt/password
|
||||
|
||||
这将创建~/.mutt/password.gpg，这个是一个GPG加密原始版本文件。
|
||||
|
||||
继续删除~/.mutt/password，只保留GPG加密版本。
|
||||
|
||||
### 第三部：创建完整Mutt配置文件 ###
|
||||
|
||||
由于你已经在一个单独的文件加密了Mutt敏感配置，你可以在~/.muttrc指定其余的Mutt配置。然后增加下面这行在~/.muttrc末尾。
|
||||
|
||||
source "gpg -d ~/.mutt/password.gpg |"
|
||||
|
||||
当你使用Mutt，这行将解密~/.mutt/password.gpg，然后将解密内容应用到你的Mutt配置。
|
||||
|
||||
下面展示一个完整Mutt配置例子，这允许你用Mutt访问Gmail，没有暴露你的SMTP/IMAP密码。取代你用Gmail ID登陆你的账户。
|
||||
|
||||
set from = "yourgmailaccount@gmail.com"
|
||||
set realname = "Your Name"
|
||||
set smtp_url = "smtp://yourgmailaccount@smtp.gmail.com:587/"
|
||||
set imap_user = "yourgmailaccount@gmail.com"
|
||||
set folder = "imaps://imap.gmail.com:993"
|
||||
set spoolfile = "+INBOX"
|
||||
set postponed = "+[Google Mail]/Drafts"
|
||||
set trash = "+[Google Mail]/Trash"
|
||||
set header_cache =~/.mutt/cache/headers
|
||||
set message_cachedir =~/.mutt/cache/bodies
|
||||
set certificate_file =~/.mutt/certificates
|
||||
set move = no
|
||||
set imap_keepalive = 900
|
||||
|
||||
# encrypted IMAP/SMTP passwords
|
||||
source "gpg -d ~/.mutt/password.gpg |"
|
||||
|
||||
### 第四部（可选）：配置GPG代理 ###
|
||||
|
||||
这时候，你将可以使用加密了IMAP/SMTP密码的Mutt。无论如何，每次你运行Mutt，你都要先被提示输入一个GPG密码来使用你的私钥解密IMAP/SMTP密码。
|
||||
|
||||
|
||||
|
||||
如果你想避免这样的GPG密码提示，你可以部署gpg代理。运行一个后台程序，gpg代理安全的缓存你的GPG密码，无需手工干预gpg自动从gpg代理获得你的GPG密码。如果你正在使用Linux桌面，你可以使用桌面特定方式来配置一些东西等价于gpg代理，例如，GNOME桌面的gnome-keyring-daemon。
|
||||
|
||||
你可以在基于Debian系统安装gpg代理：
|
||||
|
||||
$ sudo apt-get install gpg-agent
|
||||
|
||||
gpg代理是基于Red Hat系统预装的。
|
||||
|
||||
现在增加下面这些道你的.bashrc文件。
|
||||
|
||||
envfile="$HOME/.gnupg/gpg-agent.env"
|
||||
if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
|
||||
eval "$(cat "$envfile")"
|
||||
else
|
||||
eval "$(gpg-agent --daemon --allow-preset-passphrase --write-env-file "$envfile")"
|
||||
fi
|
||||
export GPG_AGENT_INFO
|
||||
|
||||
重载.bashrc，或单纯的登出然后登陆回来。
|
||||
|
||||
$ source ~/.bashrc
|
||||
|
||||
现在确认GPG_AGENT_INFO环境变量已经设置妥当。
|
||||
|
||||
$ echo $GPG_AGENT_INFO
|
||||
|
||||
----------
|
||||
|
||||
/tmp/gpg-0SKJw8/S.gpg-agent:942:1
|
||||
|
||||
并且，当你输入gpg-agent命令时，你应该看到下面的信息。
|
||||
|
||||
$ gpg-agent
|
||||
|
||||
----------
|
||||
|
||||
gpg-agent: gpg-agent running and available
|
||||
|
||||
一旦gpg-agent启动运行，它将会在第一次提示你输入密码时缓存你的GPG密码。随后你运行Mutt多次，你将不会被提示要GPG密码（gpg-agent一直开着，缓存就不会过期）。
|
||||
|
||||
|
||||
|
||||
### 结论 ###
|
||||
|
||||
在这个指导里，我提出一个方法加密Mutt敏感配置如SMTP/IMAP密码使用GnuPG。注意，如果你想在Mutt上使用GnuPG或者登陆你的邮件信息，你可以参考[官方指南][2]在使用GPG与Mutt结合。
|
||||
|
||||
如果你知道任何使用Mutt的安全技巧，随时分享他。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://xmodulo.com/mutt-email-client-encrypted-passwords.html
|
||||
|
||||
作者：[Dan Nanni][a]
|
||||
译者：[wyangsun](https://github.com/wyangsun)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://xmodulo.com/author/nanni
|
||||
[1]:http://xmodulo.com/gmail-command-line-linux-alpine.html
|
||||
[2]:http://dev.mutt.org/trac/wiki/MuttGuide/UseGPG
|
||||
Reference in New Issue
Block a user