Hohenfels.com

##How Create a Boot ISO##

isolinux is used for booting the Red Hat Enterprise Linux installation CD. To create your own CD-ROM to boot the installation program, use the following instructions:

Copy the isolinux/ directory from the Red Hat Enterprise Linux CD #1 into a temporary directory (referred to here as <path-to-workspace>) using the following command:

cp -r <path-to-cd>/isolinux/<path-to-workspace>

Change directories to the <path-to-workspace> directory you have created:

cd <path-to-workspace>

Make sure the files you have copied have appropriate permissions:

chmod u+w isolinux/*

Finally, issue the following command to create the ISO image file:

mkisofs -o file.iso -b isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -R -J -v -T isolinux/

Burn the resulting ISO image (named file.iso and located in <path-to-workspace>) to a CD-ROM as you normally would.

Burn the iso image you just created to a CD any way you like.

Drop the CD into the computer you want to install, and reboot the machine. When the boot prompt comes up type linux ks=cdrom:filename.cfg

Watch your machine install!

##How Create a Repo##

To install the RPM, you’ll need to type this command:

# yum install createrepo

Create a directory on a web server.

#  mkdir /var/www/html/repo/5/x86_64/

Copy your rpm’s to the directory you just created and run this command to create all the metadata required:

# createrepo /var/www/html/repo/5/x86_64/

Your local YUM repository has been created. Whenever you put in any new RPMs, you’ll have to run the above command, so that the new repository metadata gets updated.

Creating gpg keys for your new repo

# mkdir ~/.gnupg

You might get the error ‘mkdir: cannot create directory `/root/.gnupg’: File exists’

No problem, just means it is already there

# gpg --gen-key

gpg (GnuPG) 1.4.5; Copyright (C) 2006 Free Software Foundation, Inc.

This program comes with ABSOLUTELY NO WARRANTY.

This is free software, and you are welcome to redistribute it

under certain conditions. See the file COPYING for details.

Please select what kind of key you want:

(1) DSA and Elgamal (default)

(2) DSA (sign only)

(5) RSA (sign only)

Your selection?

Select 1

Your selection? 1

DSA keypair will have 1024 bits.

ELG-E keys may be between 1024 and 4096 bits long.

What keysize do you want? (2048)

Press Enter

Requested keysize is 2048 bits

Please specify how long the key should be valid.

0 = key does not expire

<n> = key expires in n days

<n>w = key expires in n weeks

<n>m = key expires in n months

<n>y = key expires in n years

Key is valid for? (0)

Press Enter

Key does not expire at all

Is this correct? (y/N)

Press y and enter

You need a user ID to identify your key; the software constructs the user ID

from the Real Name, Comment and Email Address in this form:

“Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>”

Real name:

As an example I used John Doe

Press Enter

Real name: John Doe

Email address:

Enter the maintainers email address. Example: john.doe@hq38.hohenfels.com

Real name: John Doe

Email address: John.doe@hq38.hohenfels.com

Comment:

Enter “Signing Key for Project Name” replace Project Name with the name of your project.
Press enter

You selected this USER-ID:

“John Doe (Signing Key for Project Name) <john.doe@hq38.hohenfels.com>”

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?

If it is all OK, Press O
Press Enter

Enter passphrase:

Enter your passphrase, you will need to remember this!
Press Enter

Repeat passphrase:

Enter the same passphrase again
Press Enter

We need to generate a lot of random bytes. It is a good idea to perform

some other action (type on the keyboard, move the mouse, utilize the

disks) during the prime generation; this gives the random number

generator a better chance to gain enough entropy.

++++++++++.+++++++++++++++++++++++++..+++++++++++++++..+++++.++++++++++++++++++++++++++++++++++++++++.++++++++++++++++++++….+++++.+++++++++++++++>+++++……>+++++……………………………………………………….+++++

Not enough random bytes available. Please do some other work to give

the OS a chance to collect more entropy! (Need 284 more bytes)

gpg: key 10D9424E marked as ultimately trusted

public and secret key created and signed.

gpg: checking the trustdb

gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model

gpg: depth: 0 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u

pub 1024D/10D9424E 2011-05-12

Key fingerprint = A5CD 97A1 6EA6 DC01 CCC3 0A7B DEA6 CD67 10D9 424E

uid Enoch Root <root@vaausmul1.aac.va.gov>

sub 2048g/93C388B3 2011-05-12

# gpg --export --armor 10D9424E > /tmp/RPM-GPG-KEY-(Project abbreviation)
Example Project Abbreviations: PRE or SLC

Copy your new key to your new repo

# cp /tmp/ RPM-GPG-KEY-(Project abbreviation) /var/www/html/repo/5/x86_64/

# vi /root/.rpmmacros
and insert this at the top %_signature gpg

It should look like this:

%_signature gpg

%_gpg_name John Doe <john.doe.va.gov> (This will be your maintainers name and email address)

If it is not there, create a new file with the above info.

Then you can start resigning your custom channel rpm’s

#rpm –resign /var/www/html/repo/5/x86_64/putty-0.60-6.20100910svn.el5.1.x86_64.rpm

Enter pass phrase:

Done!

To Sync with the Nat Sat we will need the Pub ID marked in red above and the Key fingerprint marked in purple above as well as the URL to your key.

http://spacewalk.hohenfels.com/repo/5/x86_64/

10D9424E

A5CD 97A1 6EA6 DC01 CCC3 0A7B DEA6 CD67 10D9 424E

#Resizing images

mogrify -resize 800x600 *.jpg

##How to remount the file system read write (rw) In maintenance mode##

mount -o remount, rw /

##How to unencrypt PDF documents##

http://www.cyberciti.biz/faq/removing-password-from-pdf-on-linux/

gs -q -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile=/home/erik/Destination.pdf -c .setpdfwrite -f /home/erik/source.pdf

##How to reindex spacewalk postgres database##

I was getting all kinds of weird spacewalk errors that all seemed to point to the database.

$sudo  su postgres

$reindexdb --all

At the end I got the following eror:

NOTICE:  table "rhnpackagedeltaelement" was reindexed
reindexdb: reindexing of database "rhnschema" failed: ERROR:  could not create unique index "rhnchecksum_chsum_uq"
DETAIL:  Table contains duplicated values.

I ended up restoring a backed up VM

##To Find directories and sizes##

du -sch .[!.]* * |sort -h

 ##Removing Old Kernels##

$ sudo yum install yum-utils

$ sudo package-cleanup --oldkernels --count=2

Edit /etc/yum.conf and set installonly_limit:

installonly_limit=2

##Piping a command through mail##

| mail -s "Clam Scan %D" erik@hq38.hohenfels.com

 ##Get a list of rpm’s off a web page for a script##

http://linux.dell.com/repo/hardware/Linux_Repository_14.12.00/platform_independent/rh60_64/srvadmin-x86_64/ | egrep -o "http:.*rpm" |cut -d "/" -f10

##To delete a server from using Spacewalk

##Delete the server from the WebGUI

##On the Client:

sudo vi /etc/yum/pluginconf.d/rhnplugin.conf

##And change:

[main]
enabled = 1

#to

[main]
enabled = 0

##Then

sudo rm -rf /etc/sysconfig/rhn/systemid

##Remove the spacewalk repos if they are there:

sudo rm /etc/yum.repos.d/spacewalk-client*

##SELinux Love

##First install the trouble shooter

sudo yum install setroubleshoot-server setroubleshoot setools

##Then Search the logs:

sudo cat /var/log/messages | grep sealert (CentOS 6)

or

sudo sealert -a /var/log/audit/audit.log (CentOS 7)

You are going to see something like this:

docker setroubleshoot: SELinux is preventing /usr/bin/bash from ioctl access on the file /usr/bin/distro. For complete SELinux messages. run sealert -l f4eed2fe-d681-412f-ab31-55f704a7cf46

##Do what it says, Bolded above

sudo sealert -l f4eed2fe-d681-412f-ab31-55f704a7cf46

##At the top of the output you will see:

If you believe that bash should be allowed ioctl access on the distro file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep distro /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

##Again, do what it says

sudo grep distro /var/log/audit/audit.log | audit2allow -M mypol

##Then

sudo semodule -i mypol.pp

## Grub Edit ##

Make the modifications you want:

$ sudo vi /etc/default/grub

After you edit the above file you need to run:

$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

##Installing RootKit Hunter

http://lintut.com/install-rkhunter-in-centos/

Here is the conf file location.

sudo vi /etc/rkhunter.conf

Add:

##RootKit Check
/usr/bin/rkhunter --update
/usr/bin/rkhunter --checkall

##Firewall Commands

##Add Port:

sudo firewall-cmd --zone=public --add-port=161/udp --permanent

##Add Know Service

sudo firewall-cmd --permanent --zone public --add-service samba

##Restart

sudo systemctl restart firewalld.service

##Install Logwatch

##Install the package

sudo yum install logwatch

##Edit the conf file:

sudo vi /usr/share/logwatch/default.conf/logwatch.conf

##Change to High

Detail = High

##Set to send an email

Output = mail

##ClamAV

1 – Install EPEL 7

After you’ve successfully installed your operating system and applied all the updates. You can install the EPEL 7 repository by running this command:

sudo yum install epel-release

2 – Install and configure the ClamAV packages

sudo yum install clamav clamav-scanner-systemd

Yes, it’s enough. When installing these packages all needed packages will be installed by dependency.

Correct a “bad” file path probably written during the compilation by creating a link to the correct file:

sudo ln -s /etc/clamd.d/scan.conf /etc/clamd.conf

Edit the configuration installed by the clamd-scanner package:

sudo vi /etc/clamd.d/scan.conf

Comment the example line:

#Example

Uncomment the LocalSocket config line to enable it:

LocalSocket /var/run/clamd.scan/clamd.sock

Save and quit the text editor.

3 – Turn on the SELinux boolean for antivirus

sudo setsebool -P antivirus_can_scan_system 1

4 – Start the service and enable it at boot

sudo systemctl start clamd@scan
sudo systemctl enable clamd@scan

5 – Install and configure the ClamAV updater

To automatically get the latest virus updates, you need to install the binary used for this task:

sudo yum install clamav-update

Edit the configuration file:

sudo vi /etc/freshclam.conf

Comment the example line:

#Example

Save and quit the text editor and run the command “freshclam” to update the virus database. If needed you can add a crontab to execute it regularly.

6 – Test your installation

sudo clamdscan --fdpass /var/log/*

Always use the –fdpass to give the correct permission to scan the files with clamdscan binary. In some case the first check mays fail after the installation, a simple reboot can solve this issue.

REF: https://www.adminsys.ch/2015/08/21/installing-clamav-epel-centosred-hat-7-nightmare/ 

##