Showing posts with label CentOS. Show all posts
Showing posts with label CentOS. Show all posts

Monday, March 19, 2018

Create Local YUM repository on CentOS 7 / RHEL 7 using DVD and FTP or HTTP

YUM is the package management tool that helps you to install or update the package through the network or local, at the same time it provides an easy method to install a package with its dependent packages.
Repository sources can be created either using the createrepo package or mounting the DVD on the directory. Mounting the DVD/CD ROM will lead to saving the space on HDD used by being copied to HDD.

Local YUM with DVD

Create Source

Mount the CD/DVD ROM on any directory of your wish. For testing, mount it on /cdrom.
# mkdir /cdrom
# mount /dev/cdrom /cdrom

Create Repo file

Before creating a repo file, move your existing repo files present in /etc/yum.repos.d directory, if not required.

mv /etc/yum.repos.d/*.repo /tmp/
Create the new repo file called cdrom.repo under /etc/repos.d directory.
# vi /etc/yum.repos.d/local.repo
Add the following details.
[LocalRepo]
name=LocalRepository
baseurl=file:///cdrom
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Where,
[LocalRepo] – Name of the Section.
name = Name of the repository
baseurl = Location of the package
Enabled = Enable repository
gpgcheck= Enable secure installation
gpgkey = Location of the key
gpgcheck is optional (If you set gpgcheck=0, there is no need to mention gpgkey)

Install Package from Local DVD YUM repository

Clear the repository cache by issuing the following command.
# yum clean all
Let’s install the vsftpd package from the local repository.
# yum install vsftpd
The output will be like below; it will try to cache the package information. When you give yes to download the package, it will prompt you to accept gpg signing key.
Loaded plugins: fastestmirror
LocalRepo                                                | 3.6 kB     00:00
(1/2): LocalRepo/group_gz                                  | 157 kB   00:00
(2/2): LocalRepo/primary_db                                | 2.7 MB   00:00
Determining fastest mirrors
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.x86_64 0:3.0.2-9.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package         Arch            Version               Repository          Size
================================================================================
Installing:
vsftpd          x86_64          3.0.2-9.el7           LocalRepo          165 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 165 k
Installed size: 343 k
Is this ok [y/d/N]: y
Downloading packages:
warning: /cdrom/Packages/vsftpd-3.0.2-9.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Public key for vsftpd-3.0.2-9.el7.x86_64.rpm is not installed
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
Userid     : "CentOS-7 Key (CentOS 7 Official Signing Key) <security@centos.org>"
Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
Package    : centos-release-7-0.1406.el7.centos.2.3.x86_64 (@anaconda)
From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Is this ok [y/N]: y
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : vsftpd-3.0.2-9.el7.x86_64                                    1/1
Verifying  : vsftpd-3.0.2-9.el7.x86_64                                    1/1

Installed:
vsftpd.x86_64 0:3.0.2-9.el7

Complete!</security@centos.org>
You have successfully configured the local repository on the machine, but it is limited to a single machine where the CD or DVD is mounted.

Local YUM with FTP or HTTP

If you have quite number machines and all of them connected over intranet, then this is the best option for you.

Host RPM Packages

Normally YUM server uses FTP or Apache as the medium to transfer packages. So, install either FTP or Apache on your yum server.
You can use either FTP or Apache, not both.

Mount the DVD on /cdrom.
mkdir /cdrom;mount /dev/cdrom /cdrom
Copy packages from DVDROM to /var/ftp or /var/www/html receptively for FTP and Apache.

FTP

Copy the packages from the DVD-ROM to FTP folder.
cp -a /cdrom/Packages/* /var/ftp

Apache

Copy packages from the DVD-ROM to Apache home directory.
cp -a /cdrom/Packages/* /var/www/html/
Edit Apache configuration file to enable the indexes.
vi /etc/httpd/conf/httpd.conf
From
Options Indexes FollowSymLinks
To
Options All Indexes FollowSymLinks
Remove the welcome page.
rm -rf /etc/httpd/conf.d/welcome.conf
 
Restart service.
### FTP ### systemctl restart vsftpd ### Apache ### systemctl restart httpd

Firewall

You need to allow FTP and HTTP port on the firewall so that client machines can able to get packages from YUM server.
### For HTTP ### firewall-cmd --permanent --add-port=80/tcp firewall-cmd --reload ### For FTP ### firewall-cmd --permanent --add-port=21/tcp firewall-cmd --reload

SELinux

Consider disabling SELinux on CentOS / RHEL.

Verify Services

Verify the accessibility using the web browser by visiting respective service.
FTP:
ftp://ip-address
Apache:
http://ip-address

Creating Repository

After hosting the packages, we need to create the repository of packages that we have copied from the disc. createrepo is the tool that helps you to create the XML based rpm meta-structure repository, like an index file that points to rpm files.
cd /cdrom/Packages
rpm -ivh createrepo-*el7.noarch.rpm libxml2-python-*.x86_64.rpm deltarpm-*.el7.x86_64.rpm python-deltarpm-*el7.x86_64.rpm

FTP

createrepo /var/ftp

Apache

createrepo /var/www/html

Create Repo File

Once created the repository, just go on to the client machine and add the repository file under the /etc/yum.repos.d directory.
Before creating a repo file, move the existing repo files present in /etc/yum.repos.d directory, if not required.
mv /etc/yum.repos.d/*.repo /tmp/ Create remote.repo file.
vi /etc/yum.repos.d/remote.repo Create a repo entry like below, depends on the protocol you are using. Change ipadress to your server ip address.

FTP

[remote]
name=RHEL FTP
baseurl=ftp://192.168.1.10
enabled=1
gpgcheck=0

Apache

[remote] name=RHEL Apache
baseurl=http://192.168.1.10
enabled=1
gpgcheck=0

Install Package from Local YUM repository

Now you can install packages using the yum command.
yum install mysql-server
 

Wednesday, February 28, 2018

How to Install GUI (Gnome 3) Using CD/DVD on RHEL/CentOS 7

As a Linux administrator for more than 6 yrs, I spend most of my time working on terminals, but there are some situations where I need a GUI instead of terminal. By default, RHEL/CentOS 7 server installed as minimal without any Graphical Desktop support. So, to install GUI on the top of minimal installation, we have two options:
  1. The First method is, installing GUI (i.e. Gnome 3) using default base repository, it will download and install packages from Internet.
  2. The second method is, installing GUI using RHEL/CentOS 7 ISO image via local CD/DVD device, this will avoid downloading of packages from internet.
The first method is time taking process, as it downloads packages from internet and install it on the system, if you have a fastest internet connection you can simply type the following command on the terminal to install GUI in no time.
# yum groupinstall "GNOME Desktop"        [On CentOS 7]
# yum groupinstall "Server with GUI"      [On RHEL 7]
But, those who have a slower connection, they can follow CD/DVD method, here the packages are installed from your local CD/DVD device, and the installation is much quicker than the first method.
Note: The installation instructions for GUI are same for both methods, but here our main goal is to avoid downloading of packages from internet and minimize time.
Those who are following CD/DVD method, they must have full RHEL/CentOS 7 DVD ISO (download and burn image to CD/DVD) with them, because we use this image to create a local yum repository. So that, during GUI installation, the packages are taken from your CD/DVD.
Note: For the demonstration purpose, I’ve used RHEL/CentOS 7 DVD ISO image to install Gnome 3, but the same instructions also works on RHEL 7 with minor changes in commands.

Step 1: Creating Local Yum Repository

1. Before creating a local yum repository, insert your CentOS 7 DVD ISO image your CD/DVD drive and mount it using the following commands.
First, create a empty ‘cdrom‘ directory under ‘/mnt/‘ location and mount the ‘cdrom‘ (/dev/cdrom is the default name of your device) under ‘/mnt/cdrom‘ path.
[root@tecmint ~]# mkdir /mnt/cdrom
[root@tecmint ~]# mount /dev/cdrom /mnt/cdrom
2. Once the ‘cdrom‘ mounted, you can verify the files under /mnt/cdrom using ls command.
[root@tecmint ~]# cd /mnt/cdrom/
[root@tecmint ~]# $ ls -l
total 607
-rw-r--r-- 1 tecmint tecmint     14 Jul  4 21:31 CentOS_BuildTag
drwxr-xr-x 3 tecmint tecmint   2048 Jul  4 21:29 EFI
-rw-r--r-- 1 tecmint tecmint    611 Jul  4 21:31 EULA
-rw-r--r-- 1 tecmint tecmint  18009 Jul  4 21:31 GPL
drwxr-xr-x 3 tecmint tecmint   2048 Jul  4 21:29 images
drwxr-xr-x 2 tecmint tecmint   2048 Jul  4 21:29 isolinux
drwxr-xr-x 2 tecmint tecmint   2048 Jul  4 21:29 LiveOS
drwxr-xr-x 2 tecmint tecmint 581632 Jul  5 15:56 Packages
drwxr-xr-x 2 tecmint tecmint   4096 Jul  5 16:13 repodata
-rw-r--r-- 1 tecmint tecmint   1690 Jul  4 21:31 RPM-GPG-KEY-CentOS-7
-rw-r--r-- 1 tecmint tecmint   1690 Jul  4 21:31 RPM-GPG-KEY-CentOS-Testing-7
-r--r--r-- 1 tecmint tecmint   2883 Jul  6 23:02 TRANS.TBL
3. Next, create a new local yum repository file under ‘/etc/yum.repos.d/‘ using your favorite editor, here I am using Vi editor.

On CentOS 7

[root@tecmint ~]# vi /etc/yum.repos.d/centos7.repo 
Add the following lines to it, save and quit the file.
[centos7]
name=centos7
baseurl=file:///mnt/cdrom/
enabled=1
gpgcheck=0

On RHEL 7

[root@tecmint ~]# vi /etc/yum.repos.d/rhel7.repo 
Add the following lines to it, save and quit the file.
[rhel7]
name=rhel7
baseurl=file:///mnt/cdrom/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Some explanation about the above lines.
  1. [centos7]: Name of the new repo section.
  2. name: Name of the new repository.
  3. baseurl: The current location of the packages.
  4. Enabled: Enabled repository, value ‘1’ means enable and ‘0’ means disable.
  5. gpgcheck: Check the signature of the packages, before installing them.
  6. gpgkey: Location of the key.
4. Now, check the newly created local repository is available from yum repost list, but before that you must clear the yum cache and verify the local repo.
[root@tecmint ~]# yum clean all
[root@tecmint ~]# yum repolist all
Sample Output
[root@localhost Desktop]# yum repolist all
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: centosmirror.go4hosting.in
* extras: centosmirror.go4hosting.in
* updates: centosmirror.go4hosting.in
repo id                      repo name                            status
base/7/x86_64                CentOS-7 - Base                      enabled: 8,465
base-source/7                CentOS-7 - Base Sources              disabled
centos7                      centos7                              enabled: 3,538
centosplus/7/x86_64          CentOS-7 - Plus                      disabled
centosplus-source/7          CentOS-7 - Plus Sources              disabled
debug/x86_64                 CentOS-7 - Debuginfo                 disabled
extras/7/x86_64              CentOS-7 - Extras                    enabled:    80
extras-source/7              CentOS-7 - Extras Sources            disabled
updates/7/x86_64             CentOS-7 - Updates                   enabled: 1,459
updates-source/7             CentOS-7 - Updates Sources           disabled
repolist: 13,542
Note: Did you see in the above output highlighted in red color, that means our local repo is enabled and available to install packages.
But, you will also find multiple repositories are enabled in the above output, if you try to install any package it will take CentOS Base as default repository.
For example, let’s try to install ‘httpd‘ package using yum command.
[root@tecmint ~]# yum install httpd
Sample Output
============================================================================================================================================
Package                          Arch                        Version                                    Repository                    Size
============================================================================================================================================
Installing:
httpd                            x86_64                      2.4.6-18.el7.centos                        updates                      2.7 M
Installing for dependencies:
apr                              x86_64                      1.4.8-3.el7                                base                         103 k
apr-util                         x86_64                      1.5.2-6.el7                                base                          92 k
httpd-tools                      x86_64                      2.4.6-18.el7.centos                        updates                       77 k
mailcap                          noarch                      2.1.41-2.el7                               base                          31 k
Transaction Summary
============================================================================================================================================
Install  1 Package (+4 Dependent packages)
Total download size: 3.0 M
Installed size: 10 M
Is this ok [y/d/N]:
Note: You see in the above output, the package ‘httpd‘ is installing from CentOS base repository, even if you force yum to install packages from local repository by adding ‘–enablerepo‘ option, it still uses CentOS Base as its default repo. Give it a try and see the results, you will get same result as above.
[root@tecmint ~]# yum --enablerepo=centos7 install httpd
So, to install packages from our local repository, we need to use options ‘–disablerepo‘ to disable all repos and ‘–enablerepo‘ to enable centos7 or rhel7 repo.

Step 2: Installing Gnome 3 in RHEL/CentOS 7

5. To install GUI (Gnome 3) on RHEL/CentOS 7 minimal installation server, run the following yum command.

On CentOS 7

[root@tecmint ~]# yum --disablerepo=* --enablerepo=centos7 groupinstall "GNOME Desktop"

On RHEL 7

[root@tecmint ~]# yum --disablerepo=* --enablerepo=rhel7 groupinstall "Server with GUI"
The above command will install and resolve all the dependent packages using local repository, during installation it will ask for the confirmation press “Y” to continue..
6. When the installation finishes, make the system to boot automatically to the Graphical Interface, here we no more using ‘/etc/inittab‘ file to change runlevel, because RHEL/CentOS 7 switched to systemd and here we use ‘targets‘ to change or set default runlevels.
Run the following command to tell the system to boot Gnome Desktop automatically at system startup.
[root@tecmint ~]# ln -sf /lib/systemd/system/runlevel5.target /etc/systemd/system/default.target
7. Once you set the default ‘targets‘ for the GUI, now reboot the server to get into Gnome Desktop.
Install Gnome in Centos 7
Install Gnome in RHEL/Centos 7
8. Once Gnome 3 installed, unmount the CD/DVD device.
[root@tecmint ~]# umount /mnt/cdrom

Tuesday, December 30, 2014

MAC based filtering in squid

MAC based filtering is useful for networks using DHCP to assign ip addresses to systems. As we know MAC is hard coded on NIC and can’t be changed but IP addresses assigned by DHCP may change on next ip assignment. This tutorial will help you to how to Configure Squid Proxy Server Mac Address Based Filtering.
If you do not have Squid installed, Go to below link for installing squid on CentOS/RHEL/Fedorasystems.
ACL rules are need to add in squid configuration file /etc/squid/squid.conf. Remember that squid Squid always applied first matching rules from top to down order and ignore other after matching any rule

1. Block All Sites For Single MAC Address

Following configuration will block all the sites to system having MAC address 01:23:45:AB:CD:EF.
Squid ACL Rule:
acl pcmac1 arp 01:23:45:AB:CD:EF
http_access deny pcmac1

2. Block Single Site for Single MAC Address

Following configuration will block www.example.com site to system having MAC address 01:23:45:AB:CD:EF.
Squid ACL Rule:
acl blocksite1 dstdomain www.example.com
acl pcmac1 arp 01:23:45:AB:CD:EF
http_access deny blocksite1 pcmac1 

3. Block All Sites for Multiple MAC Addresses

Following configuration will block all the sites to systems having MAC addresses 01:23:45:AB:CD:EF and AB:CD:EF:01:23:45.
MAC Addresses List
# cat /etc/squid/mac-addrs.lst
01:23:45:AB:CD:EF
AB:CD:EF:01:23:45
Squid ACL Rule:
acl pcmacs arp "/etc/squid/mac-addrs.lst"
http_access deny pcmacs

4. Block Single Site for Multiple MAC Addresses

Following configuration will block www.example.com to systems having MAC addresses 01:23:45:AB:CD:EF and AB:CD:EF:01:23:45.
MAC Addresses List
# cat /etc/squid/mac-addrs.lst
01:23:45:AB:CD:EF
AB:CD:EF:01:23:45
Squid ACL Rule:
acl blocksite1 dstdomain www.example.com
acl pcmacs arp "/etc/squid/mac-addrs.lst"
http_access deny blocksite1 pcmacs

5. Allow Specific Site for Single MAC Address

Following configuration will allow www.example.com to system having MAC address 01:23:45:AB:CD:EF and deny other sites.
Squid ACL Rule:
acl pcmac1 arp 01:23:45:AB:CD:EF
acl allowsite1 dstdomain www.example.in
http_access allow allowsite1 pcmac1
http_access deny pcmac1

6. Allow Multiple Sites for Single MAC Address

Following configuration will allow all sites added in /etc/squid/allowsites.lst to system having MAC address 01:23:45:AB:CD:EF and deny other sites.
Allowed Sites List
# cat /etc/squid/allowsites.lst
www.google.co.in
yahoo.com
in.yahoo.com
Squid ACL Rule:
acl pcmac1 arp 01:23:45:AB:CD:EF
acl allowsite1 dstdomain "/etc/squid/allowsites.lst"
http_access allow allowsite1 pcmac1
http_access deny pcmac1

7. Allow Specific Site for Multiple MAC Addresses

Following configuration will allow www.example.com to systems having MAC address 01:23:45:AB:CD:EF and and AB:CD:EF:01:23:45 and deny other sites.
MAC Addresses List
# cat /etc/squid/mac-addrs.lst
01:23:45:AB:CD:EF
AB:CD:EF:01:23:45
Squid ACL Rule:
acl blocksite1 dstdomain www.example.com
acl pcmacs arp "/etc/squid/mac-addrs.lst"
http_access allow blocksite1 pcmacs
http_access deny pcmacs

8. Allow Multiple Sites for Multiple MAC Addresses

Following configuration will allow all the sites listed in /etc/squid/allowsites.lst to all systems having MAC address listed in /etc/squid/mac-addrs.lst and deny other sites.
MAC Addresses List
# cat /etc/squid/mac-addrs.lst
01:23:45:AB:CD:EF
AB:CD:EF:01:23:45
Allowed Sites List
# cat /etc/squid/allowsites.lst
www.google.co.in
yahoo.com
in.yahoo.com
Squid ACL Rule:
acl pcmacs arp "/etc/squid/mac-addrs.lst"
acl allowsites dstdomain "/etc/squid/allowsites.lst"
http_access allow allowsites pcmacs
http_access deny pcmacs

Friday, December 19, 2014

DHCP configuration file ( dhcpd.conf)

#
# DHCP Server Configuration file.
#   see /usr/share/doc/dhcp*/dhcpd.conf.sample
#   see 'man 5 dhcpd.conf'
#

ddns-update-style ad-hoc;
ddns-update-style interim;

#allow booting;
#allow bootp;
#ingnore client-updates;

default-lease-time 600;
max-lease-time 7200;

#log-fecility local7;

subnet 192.168.0.0 netmask 255.255.255.0 {
option broadcast-address 192.168.0.255;
range 192.168.0.10 192.168.0.100;
option domain-name-servers 218.248.255.145 , 14.139.5.5 , 8.8.8.8 , 8.8.4.4;
option routers 192.168.0.1;
default-lease-time 600;
max-lease-time 7200;
}
}

Wednesday, December 17, 2014

Internet Sharing with NAT using two NICs in CentOS

Configure two NICS

2. Active now screen
2.1. eth0 config
3. eth3 config

3.1 Change NIC, on which DHCP has to configure

gedit /etc/sysconfig/dhcpd



4. DHCP server config
5. subnet config
6. Edit client options
 
7. eth3 NIC config
8. Enable Ip forwarding in nano /etc/sysctl.conf

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

9. Save Ip forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

10. FireWall settings NAT


iptables -A FORWARD -o eth0 -i eth3 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -F POSTROUTING

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

/sbin/service iptables save

OR


iptables -A FORWARD -o eth0 -i eth3 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables-save | sudo tee /etc/iptables.sav
/etc/sysconfig/iptables.save
/sbin/service iptables save