mirror of
https://github.com/IntenseWebs/servercode.git
synced 2026-11-04 13:17:21 -06:00
Update Network, Firewall & Proxmox Template Syspreps
This commit is contained in:
IntenseWebs committed
1 parent
1400d9284f
commit
fb3a7c31d4
3 files changed
+142
-48
No files matched your search
@@ -31,6 +31,10 @@ firewall-cmd --runtime-to-permanent
|
||||
firewall-cmd --add-service=cockpit --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
#BIND 9 DNS
|
||||
firewall-cmd --add-port=53/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
# VNC
|
||||
firewall-cmd --zone=public --add-port 5901/tcp --permanent
|
||||
firewall-cmd --zone=public --add-service=vnc-server --permanent
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
# Bind 9 DNS CHEAT SHEET IS BASED ON DEBIAN - REDHAT / FEDORA use completely different folder structure than DEBIAN for bind:
|
||||
https://www.isc.org/bind/
|
||||
# Bind 9 DNS CHEAT SHEET IS BASED ON DEBIAN - REDHAT/FEDORA use different folder structure bind: https://www.isc.org/bind/
|
||||
|
||||
# DEBIAN # /etc/bind # /var/lib/bind
|
||||
https://wpcademy.com/how-to-install-bind9-dns-server-on-ubuntu-step-by-step/
|
||||
@@ -13,26 +12,27 @@ https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/ne
|
||||
https://www.cyberciti.biz/faq/linux-unix-bind9-named-configure-views/
|
||||
https://www.zytrax.com/books/dns/ch4/#split
|
||||
|
||||
# Misc re-used commands
|
||||
# INSTALL
|
||||
apt update && apt upgrade -y
|
||||
apt install -y bind9 bind9utils bind9-doc dnsutils
|
||||
cd /etc/bind
|
||||
|
||||
# Misc re-used commands # EXECUTE ALL AS ROOT (su - root)
|
||||
named -v
|
||||
dig -t txt -c chaos VERSION.BIND @192.168.1.140
|
||||
rndc flush
|
||||
sudo systemctl status named
|
||||
sudo systemctl restart bind9
|
||||
sudo systemctl status bind9
|
||||
systemctl status named
|
||||
systemctl restart bind9
|
||||
systemctl status bind9
|
||||
suso systemctl restart bind9.service
|
||||
sudo service bind9 restart
|
||||
sudo named-checkconf
|
||||
sudo named-checkzone intensewebs.com /var/lib/bind/db.intensewebs.com
|
||||
sudo tail -f /var/log/syslog
|
||||
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
sudo apt install -y bind9 bind9utils bind9-doc dnsutils
|
||||
cd /etc/bind
|
||||
service bind9 restart
|
||||
named-checkconf
|
||||
named-checkzone intensewebs.com /var/lib/bind/db.intensewebs.com
|
||||
tail -f /var/log/syslog
|
||||
|
||||
# Copy/Backup your files
|
||||
sudo cp /etc/bind/named.conf.options /etc/bind/named.conf.options.backup
|
||||
sudo vi /etc/bind/named.conf.options
|
||||
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.backup
|
||||
vi /etc/bind/named.conf.options
|
||||
|
||||
acl trustedclients {
|
||||
localhost;
|
||||
@@ -67,43 +67,51 @@ options {
|
||||
|
||||
# 4) Define zone files backup the existing file named.conf.local e.g.
|
||||
|
||||
sudo cp -f /etc/bind/named.conf.local /etc/bind/bak.named.conf.local.bak
|
||||
sudo vi named.conf.local
|
||||
cp -f /etc/bind/named.conf.local /etc/bind/bak.named.conf.local.bak
|
||||
vi named.conf.local
|
||||
so it looks something like this
|
||||
|
||||
zone "intensewebs.com" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.intensewebs.com";
|
||||
allow-transfer { 192.168.1.141; };
|
||||
also-notify { 192.168.1.141; };
|
||||
allow-transfer { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
also-notify { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
};
|
||||
|
||||
zone "nukvm.org" {
|
||||
zone "iweb.corp" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.nukvm.org";
|
||||
allow-transfer { 192.168.1.141; };
|
||||
also-notify { 192.168.1.141; };
|
||||
file "/var/lib/bind/db.iweb.corp";
|
||||
allow-transfer { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
also-notify { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
};
|
||||
|
||||
zone "iweb.city" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.iweb.city";
|
||||
allow-transfer { 192.168.1.141; };
|
||||
also-notify { 192.168.1.141; };
|
||||
allow-transfer { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
also-notify { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
};
|
||||
|
||||
zone "nukvm.org" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.nukvm.org";
|
||||
allow-transfer { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
also-notify { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
};
|
||||
|
||||
zone "1.168.192.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.1.168.192";
|
||||
allow-transfer { 192.168.1.141; };
|
||||
also-notify { 192.168.1.141; };
|
||||
allow-transfer { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
also-notify { 192.168.1.141; 192.168.1.142; 192.168.1.143;};
|
||||
};
|
||||
|
||||
check the file for errors
|
||||
sudo named-checkconf
|
||||
named-checkconf
|
||||
|
||||
# 5) Create a forward lookup zone in /var/lib/bind. Copy an existing file to one with the name used before e.g.
|
||||
# sudo cp /etc/bind/db.local /var/lib/bind/db.intensewebs.com
|
||||
# sudo vi db.intensewebs.com
|
||||
# cp /etc/bind/db.local /var/lib/bind/db.intensewebs.com
|
||||
# vi db.intensewebs.com
|
||||
|
||||
$ORIGIN intensewebs.com.
|
||||
$TTL 604800
|
||||
@@ -154,11 +162,11 @@ ipa1 IN A 192.168.1.124
|
||||
ipa2 IN A 192.168.1.125
|
||||
_____________________________________________________________________ex
|
||||
# check the file syntax
|
||||
sudo named-checkzone intensewebs.com db.intensewebs.com
|
||||
named-checkzone intensewebs.com db.intensewebs.com
|
||||
|
||||
6) Create a reverse lookup zone
|
||||
using same name specified in named- edit the file e.g.
|
||||
sudo vi db.1.168.192
|
||||
vi db.1.168.192
|
||||
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.intensewebs.com. dns.intensewebs.com. (
|
||||
@@ -187,7 +195,7 @@ ns2.intensewebs.com. IN A 192.168.1.141
|
||||
222 IN PTR sd.intensewebs.com
|
||||
223 IN PTR superdog.intensewebs.com
|
||||
|
||||
sudo named-checkzone 1.168.192.in-addr.arpa db.1.168.192
|
||||
named-checkzone 1.168.192.in-addr.arpa db.1.168.192
|
||||
|
||||
7) Edit the server's DNS entry to use it's own DNS server
|
||||
|
||||
@@ -199,13 +207,13 @@ nameserver 192.168.1.141
|
||||
|
||||
|
||||
8) Start and test DNS
|
||||
sudo systemctl start named
|
||||
sudo systemctl enable named
|
||||
systemctl start named
|
||||
systemctl enable named
|
||||
|
||||
sudo systemctl start bind9
|
||||
systemctl start bind9
|
||||
|
||||
sudo systemctl status bind9
|
||||
sudo systemctl status named
|
||||
systemctl status bind9
|
||||
systemctl status named
|
||||
|
||||
test DNS is working e.g.
|
||||
host git.intensewebs.com
|
||||
@@ -214,18 +222,19 @@ sudo systemctl start bind9
|
||||
|
||||
---------------------------------------
|
||||
|
||||
SECONDARY
|
||||
sudo vi /etc/bind/named.conf.local
|
||||
SECONDARY - update networking 'resolv.conf and /etc/network/interfaces * files with new DNS servers. ADD FIREWALL Settings i.e. firewall-cmd --permanent --add-service=dns && firewall-cmd --reload
|
||||
|
||||
vi /etc/bind/named.conf.local
|
||||
|
||||
zone "intensewebs.com" {
|
||||
type slave;
|
||||
file "/var/lib/bind/db.intensewebs.com";
|
||||
masters { 192.168.1.140; };
|
||||
masters { 192.168.1.140; };
|
||||
};
|
||||
|
||||
zone "nukvm.org" {
|
||||
zone "iweb.corp" {
|
||||
type slave;
|
||||
file "/var/lib/bind/db.nukvm.org";
|
||||
file "/var/lib/bind/db.iweb.corp";
|
||||
masters { 192.168.1.140; };
|
||||
};
|
||||
|
||||
@@ -235,16 +244,24 @@ zone "iweb.city" {
|
||||
masters { 192.168.1.140; };
|
||||
};
|
||||
|
||||
zone "nukvm.org" {
|
||||
type slave;
|
||||
file "/var/lib/bind/db.nukvm.org";
|
||||
masters { 192.168.1.140; };
|
||||
};
|
||||
|
||||
zone "1.168.192.in-addr.arpa" {
|
||||
type slave;
|
||||
file "/var/lib/bind/db.1.168.192";
|
||||
masters { 192.168.1.140; };
|
||||
masters { 192.168.1.140; };
|
||||
};
|
||||
|
||||
sudo systemctl restart bind9
|
||||
sudo systemctl status bind9
|
||||
systemctl restart bind9
|
||||
systemctl status bind9
|
||||
|
||||
sudo vi /etc/bind/named.conf.options
|
||||
# Copy/Backup your files
|
||||
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.backup
|
||||
vi /etc/bind/named.conf.options
|
||||
|
||||
acl trustedclients {
|
||||
localhost;
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
cd /usr/share/javascript/proxmox-widget-toolkit
|
||||
cp proxmoxlib.js proxmoxlib.js.bak
|
||||
nano proxmoxlib.js
|
||||
CTRL-W (find): if (res ==
|
||||
|
||||
Hit return and this should take you to a line like this (backspace it out)
|
||||
if (res === null || res === undefined || !res || res
|
||||
.data.status.toLowerCase() !== 'active') {
|
||||
|
||||
Replace the line with this
|
||||
if (false) {
|
||||
|
||||
systemctl daemon-reload
|
||||
|
||||
# UPDATE HOST > REPOSITORIES - DISABLE BOTH ENTERPRISE REPOSITORIES & ADD pve-no-subscription
|
||||
|
||||
# DISABLE ROOT SSH REMOTE LOGIN - see 02-ssh-help.txt
|
||||
|
||||
# DPDK requires hugepages. I reserved 4 * 1GB hugepages on the host. ENABLE INTEL IOMMU and Hugepages
|
||||
vi /etc/default/grub
|
||||
# GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt default_hugepagesz=1G hugepagesz=1G hugepages=4"
|
||||
|
||||
I use the `vfio-pci` driver for DPDK, so SR-IOV should be enabled on the host. Other drivers like `igb_uio` or `uio_pci_generic` don't need this IOMMU. For more information about Linux drivers for DPDK, see https://doc.dpdk.org/guides/linux_gsg/linux_drivers.html.
|
||||
|
||||
DPDK requires hugepages. I reserved 4 * 1GB hugepages on the host.
|
||||
|
||||
- Make sure IOMMU and SR-IOV are enabled in BIOS.
|
||||
- Edit /etc/default/grub, on the line GRUB_CMDLINE_LINUX_DEFAULT, add `intel_iommu=on iommu=pt default_hugepagesz=1G hugepagesz=1G hugepages=4`.
|
||||
- Apply the change by running `grub-mkconfig -o /boot/grub/grub.cfg`.
|
||||
|
||||
update-grub
|
||||
update-initramfs -u
|
||||
|
||||
## Auto-load `vfio-pci` on boot
|
||||
|
||||
Run `echo vfio-pci >> /etc/modules-load.d/modules.conf`.
|
||||
|
||||
## Reboot and verification
|
||||
|
||||
- After rebooting, check if IOMMU is functioning by reading driver message:
|
||||
```sh
|
||||
dmesg | grep -e DMAR -e IOMMU
|
||||
```
|
||||
|
||||
- Check if hugepages are reserved:
|
||||
|
||||
```sh
|
||||
apt install libhugetlbfs-bin
|
||||
hugeadm --explain
|
||||
```
|
||||
|
||||
https://www.xda-developers.com/these-6-scripts-are-a-godsend-for-my-proxmox-home-lab/
|
||||
_____________________________________________________
|
||||
# DISABLE NAG & CHANGE REPOSITORIES TO COMMUNITY
|
||||
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/post-pve-install.sh)"
|
||||
_____________________________________________________
|
||||
Proxmox Clean Orphaned LVM
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/clean-orphaned-lvm.sh)"
|
||||
_____________________________________________________
|
||||
PVE Privilege Converter
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/pve-privilege-converter.sh)"
|
||||
_____________________________________________________
|
||||
Proxmox VE Cron LXC Updater
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/cron-update-lxcs.sh)"
|
||||
_____________________________________________________
|
||||
Proxmox Update Repositories
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-repo.sh)"
|
||||
_____________________________________________________
|
||||
Proxmox VE LXC IP-Tag
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/add-lxc-iptag.sh)"
|
||||
_____________________________________________________
|
||||
|
||||
Reference in new issue
Block a user