**ONLY CHANGE FOR OLDER SSH ALGORYTHM IF NEEDED FOR LEGACY DEVICES**
[Legacy ssh connections](https://docs.sflservicesllc.com/books/linux/page/linux-server-install-redhat-9-ssh-configuration "Legacy ssh connections")**CONTINUE HERE IF SSH LEGACY IS NOT NEEDED**
Enable Time Synchronization run the the following and add your domain time server ```shell vi /etc/chrony.conf ``` Add your server below the following and make sure you change the domain name from **sflservicesllc.com** ```shell # These servers were defined in the installation: #server _gateway iburst server domain.sflserviesllc.com iburst prefer ``` Enable Time Synchronization ```shell systemctl enable --now chronyd ``` Note: Time-zone changes are made with the command ```shell timedatectl ``` Make the following changes within the file ```shell sudo sed -i 's/^anonymous_enable=.*/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf sudo sed -i 's/^local_umask=.*/local_umask=002/' /etc/vsftpd/vsftpd.conf sudo sed -i 's/^#ascii_upload_enable=.*/ascii_upload_enable=YES/' /etc/vsftpd/vsftpd.conf sudo sed -i 's/^#ascii_download_enable=.*/ascii_download_enable=YES/' /etc/vsftpd/vsftpd.conf ``` Start and Enable FTP for transfer in and out for us or other vendors ```shell systemctl enable --now vsftpd.service ```**ONLY CHANGE THE FOLLOWING IF YOU HAVE REMOTE LOGGING**
If you have a remote logging server setup then edit the following command ```shell vi /etc/rsyslog.conf ``` Then add the following at the end of the file but make sure you update the IP address and replace the XXX's ```shell *.* @192.168.XXX.XXX:514 # use @ for UDP Protocal *.* @@192.168.XXX.XXX:514 # use @@ for TCP Protocal auth.* @192.168.XXX.XXX:514 # only for authentication based records ``` Optional: you can change this and run to add at the end ``` echo -e "*.* @192.168.253.70:514 # use @ for UDP Protocal\n*.* @@192.168.253.70:514 # use @@ for TCP Protocal\nauth.* @192.168.253.70:514 # only for authentication based records" | sudo tee -a /etc/rsyslog.conf ```**CONTINUE HERE IF NOT REMOTE LOGGING**
Enable Rsyslog to enable logging locally and remotely ```shell systemctl enable --now rsyslog ``` Backup the original file ```shell cp /etc/postfix/main.cf /etc/postfix/main.cf.bak vi /etc/postfix/main.cf ``` Configure Postfix for Email run the following ```shell vi /etc/postfix/main.cf ``` Update the following with your email server ```shell relayhost = [ENTER IP or SMTP SERVER] or [sflservicesllc-com.mail.protection.outlook.com]:25 ```**OPTIONAL IF YOU WANT TO HARDCODE A DOMAIN NAME (Server not attached to AD)**
Update the following with a remote or local email server and make sure you change the domain name from **sflservicesllc.com** ```shell myhostname = sflservicesllc.com mydomain = sflservicesllc.com mydestination = $myhostname, localhost.$mydomain, localhost relayhost = [ENTER IP or SMTP SERVER] or [sflservicesllc-com.mail.protection.outlook.com]:25 ```CONTINUE HERE IF NO NEED FOR HARDCODED DOMAIN
**OPTIONAL IF YOU HAVE NO EMAIL SERVER**
Update the following for no email server and make sure you change the domain name from **sflservicesllc.com** and only allow certain networks ``` myhostname = sflservicesllc.com mydomain = sflservicesllc.com mail_spool_directory = /var/mail mynetworks = 127.0.0.0/8, 168.100.189.0/28 ```CONTINUE HERE IF YOU HAVE A EMAIL SERVER
Enable Postfix ```shell systemctl enable --now postfix ``` Test your config this way ```shell echo "Install of Linux Rocks $HOSTNAME" | sendmail steve.ling@sflservicesllc.com ``` Locale add-ons to make sure that ANSI applications display correctly so edit the following and replace all of the values with the following Edit the following: ```shell sudo cat > /etc/locale.conf << EOF LANG="en_US" SUPPORTED="en_GB:en_GB-.UTF-8:en_US:en_US.UTF-8:de_DE:de_DE.UTF-8" SYSFONT="latarcyrheb-sun16" EOF ```**ONCE ADDED THE ABOVE CONFIGURATION THEN EXIT AND LOG BACK IN**
### Bash colors and Prompt Bash for root for color edit the following: Dependent on ```bash dnf install figlet toilet -y ``` Creating Aliases ```bash sudo cat > /etc/profile.d/custom-aliases.sh << EOF # Common interactive aliases for all users alias rm='rm -i' alias cp='cp -i' alias mv='mv -i' alias vi='vim' alias tailf='tail -f' EOF ``` Server Warning ```bash sudo tee /etc/profile.d/custom-prod-warning.sh > /dev/null << 'EOF' # Colorful PRODUCTION warning banner for interactive logins if [[ -n "$PS1" && -t 0 && -t 1 ]]; then # Interactive terminal with stdin/stdout RED='\033[1;31m' # Bold red YELLOW='\033[1;33m' # Bold yellow NC='\033[0m' # No color echo if command -v figlet >/dev/null 2>&1; then figlet -f big "PRODUCTION" | while IFS= read -r line; do printf '%b%s%b\n' "$RED" "$line" "$NC" done figlet -f big "SERVER" | while IFS= read -r line; do printf '%b%s%b\n' "$RED" "$line" "$NC" done else echo -e "${RED}***** PRODUCTION SERVER!! *****${NC}" fi echo echo -e "${YELLOW} *** EXTREME CAUTION REQUIRED ***${NC}" echo -e "${RED}This is a LIVE PRODUCTION system.${NC}" echo -e "${RED}Unauthorized access is strictly prohibited.${NC}" echo -e "${RED}All activity is logged and monitored.${NC}" echo -e "${YELLOW}Think twice before running commands!${NC}" echo # Pause briefly to ensure user sees the warning read -t 5 -p "Press Enter to continue (auto-continue in 5 seconds)... " || true echo fi EOF ``` Creating Colorful Prompts ```bash sudo tee /etc/profile.d/custom-prompt-and-colors.sh > /dev/null << 'EOF' # Custom LS_COLORS and improved multi-line colored prompt # Vibrant LS_COLORS (directories bold blue on gray, etc.) LS_COLORS='rs=0:di=01;44:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.axa=00;36:*.oga=00;36:*.spx=00;36:*.xspf=00;36:' export LS_COLORS # Color and style variables (cached tput calls for speed) RESET=$(tput sgr0) BOLD=$(tput bold) BG_GRAY=$(tput setab 8) FG_RED=$(tput setaf 1) FG_MAGENTA=$(tput setaf 5) FG_GREEN=$(tput setaf 2) FG_CYAN=$(tput setaf 6) # Multi-line prompt PS1="\n${BOLD}${BG_GRAY}${FG_RED}\\u${FG_MAGENTA}@${FG_RED}\`hostname\`${FG_GREEN} : \`uname\` : ${FG_CYAN}\\d \\t : \${PLANTID:+\$PLANTID }\n${FG_CYAN}[\\w]${RESET}${BOLD} \\\$ ${RESET}" export PS1 EOF ``` ### Database Install and Configuration ### Configure MariaDB**OPTIONAL ADD THE MARIADB REPO TO GET THE LATES REVISION**
**MARIADB REPORTED A PROBLEM WITH 10.5, YOU SHOULD CONSIDER UPGRADING TO 10.11**
Install the new Repo for MariaDB ```bash curl -sLS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash ``` This is the location of ```bash cat /etc/yum.repos.d/mariadb.repo ``` You have to change the yellow below to get the desired version10.11 Revision
| \[mariadb-main\] name = MariaDB Server baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.11/yum/rhel/9/x86\_64 gpgkey = file:///etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY gpgcheck = 1 enabled = 1 module\_hotfixes = 1 \[mariadb-maxscale\] \# To use the latest stable release of MaxScale, use "latest" as the version \# To use the latest beta (or stable if no current beta) release of MaxScale, use "beta" as the version name = MariaDB MaxScale baseurl = https://dlm.mariadb.com/repo/maxscale/latest/yum/rhel/9/x86\_64 gpgkey = file:///etc/pki/rpm-gpg/MariaDB-MaxScale-GPG-KEY gpgcheck = 1 enabled = 1 |
BELOW IS FOR SERVER 8CPU AND 64GIG MEMORY
```shell #Custom performance_schema = ON tmpdir = /run/mariadb thread_cache_size = 4 table_open_cache = 16384 table_definition_cache = 8384 sql_mode = ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION query_cache_type = 0 query_cache_size = 0 query_cache_limit = 128M query_cache_strip_comments = 1 tmp_table_size = 512M max_heap_table_size = 512M max_connections = 750 max_allowed_packet = 24M sort_buffer_size = 24M join_buffer_size = 48M innodb_buffer_pool_size = 48G # 65-75% of RAM for InnoDB cache --> Keeping some for VUE innodb_buffer_pool_instances = 6 # One instance per CPU core --> Keeping some for VUE 2 out of 8 innodb_flush_method = O_DIRECT # Reduce I/O overhead innodb_flush_log_at_trx_commit = 2 # Balance performance and durability innodb_log_buffer_size = 16M # Buffer for transaction logs innodb_thread_concurrency = 0 # Let MySQL manage threads (0 = unlimited) innodb_io_capacity = 2000 # Adjust based on storage IOPS innodb_io_capacity_max = 4000 # Max IOPS for bursts innodb_use_native_aio = 1 innodb_flush_log_at_trx_commit = 2 # Balance performance and durability --> Changed from 0 innodb_file_per_table innodb_log_file_size = 2G # Larger logs for better write performance --> Changed from 512 #Optional configuration for transaction logging Change for mysql or mariadb #log_bin = /var/log/mariadb/mariadb.log #expire_logs_days = 2 ``` Reload the changes ```shell systemctl daemon-reload ``` Enable and start MySQL/MariaDB on boot ```shell systemctl enable --now mariadb.service ``` Run the following ```shell mysql ``` Then execute the following statements also make sure to (**change passwords as needed XXXXXXXXXX but NOT the users names**) ```shell CREATE USER 'kiwisql'@'%' IDENTIFIED BY 'XXXXXXXXXX'; GRANT all ON *.* TO 'kiwisql'@'%' WITH GRANT OPTION; CREATE USER 'kiwisql'@'localhost' IDENTIFIED BY 'XXXXXXXXXX'; GRANT all ON *.* TO 'kiwisql'@'localhost' WITH GRANT OPTION; CREATE USER 'kiwilive'@'localhost' IDENTIFIED BY 'XXXXXXXXXX'; GRANT all ON *.* TO 'kiwilive'@'localhost'; CREATE USER 'remuser'@'localhost' IDENTIFIED BY 'XXXXXXXXXX'; GRANT all ON *.* TO 'remuser'@'localhost' WITH GRANT OPTION; CREATE USER 'reports'@'%' IDENTIFIED BY 'XXXXXXXXXX'; GRANT SHOW DATABASES, SELECT, EXECUTE, PROCESS, SHOW VIEW ON *.* TO 'reports'@'%'; FLUSH PRIVILEGES; Quit ``` ### Build skeleton for the Kiwiplan Environment ### Command to Run Setup the user environment Remember to change the **remuser** & **esp** password ESP username password is the global password store in ESP to let it connect and is *unfortunately *visible to an admin user but please make sure to (**change passwords as needed XXXXXXXXXX but NOT the users names**) ``` groupadd kiwiplan mkdir /opt/kiwi ln -s /opt/kiwi/ /KIWI mkdir /opt/kiwi/{home,rev} mkdir /opt/kiwi/rev/{map,mes} useradd -g kiwiplan -G wheel -d /KIWI/home/remuser/ remuser echo XXXXXXXXXX | passwd --stdin remuser useradd -g kiwiplan -d /KIWI/home/esp/ esp echo XXXXXXXXXX | passwd --stdin esp chown -R remuser:kiwiplan /opt/kiwi mkdir /etc/kiwiplan chown remuser:kiwiplan /etc/kiwiplan ``` ### Systemd Socket Implementation For KIDD ### Configure kidd.stocket Remember your **:set paste** command Create a socket file and the following ```shell vi /lib/systemd/system/kidd.socket ``` Then add the following ```shell [Unit] Description=KIDD [Socket] ListenStream=2326 Accept=yes [Install] WantedBy=sockets.target ``` Create a service file by editing the following ```shell vi /lib/systemd/system/kidd@.service ``` Then add the following ```shell [Unit] Description=Kidd Server [Service] ExecStart=/KIWI/rev/current/progs/kidd -a -p -F 1 User=root Group=root StandardInput=socket StandardOutput=socket # Resource configuration LimitNOFILE=8192 LimitNPROC=4096 # MaxConnections=nnn - The maximum number of connections to simultaneously run services instances for # when Accept=true is set. nnn should be sized accordingly for the implementation. MaxConnections=200 # The maximum number of connections for a service per source IP address. # This is very similar to the MaxConnections= directive above. Disabled by default. MaxConnectionsPerSource=80 ``` Start the service and enable on reboot ```shell systemctl start kidd.socket systemctl enable kidd.socket ``` This will only work once you have the Kiwiplan environment configured/installed ### VUE Installation Configurations ### Adjust system limits for VUE products Edit the following ```shell vi /etc/security/limits.d/20-nproc.conf ``` Add the following ```shell @kiwiplan soft nproc 32768 ``` Edit the following ```shell vi /etc/security/limits.conf ``` Then add the following before the **\#End of file** ```shell @kiwiplan - nofile 32768 ``` ### Installing MsSQL Tool #### Configure MsSQL tools Install the repo for the MsSQL service/connection ```shell curl https://packages.microsoft.com/config/rhel/8/prod.repo > /etc/yum.repos.d/msprod.repo ``` This will only work once you have the Kiwiplan environment configured/installed Install the packages make sure you answer/type **YES** to all ```shell dnf remove mssql-tools unixODBC-utf16-devel dnf install mssql-tools unixODBC-devel -y ``` ## STOP HERE FOR YOUR TEMPLATE BUILD ## RESTART FROM HERE AFTER TEMPLATE BUILD #### Linux RedHat Registration Re-Register the server with RedHat if you entered initial credentials to add the server You need to run the **nmtui** command to bring up the menu from above in this documentation and then simply change the IP and also the hostname Run the following and this will change the subscription details ```shell subscription-manager register --force subscription-manager attach --auto ``` ### Activate Directory Setup #### Using SSSD Install the following packages ```shell yum install sssd sssd-tools realmd samba-common-tools oddjob oddjob-mkhomedir adcli samba -y ``` Run this just in-case your domain is still using RC4 ```shell update-crypto-policies --set DEFAULT:AD-SUPPORT ``` #### Configure KRB5 Edit the following file and make sure the following is added/changed ```shell vi /etc/krb5.conf ``` Add or changed the following below| \# To opt out of the system crypto-policies configuration of krb5, remove the \# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ \[logging\] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log \[libdefaults\] dns\_lookup\_realm = true ticket\_lifetime = 24h renew\_lifetime = 7d forwardable = true rdns = true pkinit\_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake\_preauth\_groups = edwards25519 dns\_canonicalize\_hostname = fallback qualify\_shortname = "" default\_realm = ONLING.COM default\_ccache\_name = KEYRING:persistent:%{uid} udp\_preference\_limit = 0 \[realms\] ONLING.COM = { kdc = domain\_controller..onling.com admin\_server = domain\_controller..onling.com } \[domain\_realm\] .onling.com = ONLING.COM onling.com = ONLING.COM |
For the join you may need to specify the -OU's for the specific location
| \# realm discover onling.com \# realm join -U [administrator@ONLING.COM](mailto:administrator@ONLING.COM) --verbose domain\_controller.onling.com \# authselect select sssd with-mkhomedir \# authselect apply-changes |
| \[sssd\] domains = onling.com config\_file\_version = 2 services = nss, pam \[domain/onling.com\] default\_shell = /bin/bash ad\_server = sfl-dom-001.onling.com krb5\_store\_password\_if\_offline = True cache\_credentials = True krb5\_realm = ONLING.COM realmd\_tags = manages-system joined-with-adcli id\_provider = ad fallback\_homedir = /home/%d/%u ad\_domain = onling.com use\_fully\_qualified\_names = false ldap\_id\_mapping = True access\_provider = ad override\_gid = 1000 ad\_gpo\_ignore\_unreadable = true ad\_gpo\_access\_control = disabled timeout = 300 |
| simple\_allow\_groups = sssd-users OR simple\_allow\_groups = gg-C3193???-KiwiTS\_access |