Once added the locals exit and telnet back into the server to take the update
### Bash colors and Prompt Bash for root for color edit the following Dependent on ```bash dnf install figlet toilet -y ``` Creating Aliases ```bash sudo cat > /etc/profile.d/custom-aliases.sh << EOF # Common interactive aliases for all users alias rm='rm -i' alias cp='cp -i' alias mv='mv -i' alias vi='vim' alias tailf='tail -f' EOF ``` Server Warning ```bash sudo tee /etc/profile.d/custom-prod-warning.sh > /dev/null << 'EOF' # Colorful PRODUCTION warning banner for interactive logins if [[ -n "$PS1" && -t 0 && -t 1 ]]; then # Interactive terminal with stdin/stdout RED='\033[1;31m' # Bold red YELLOW='\033[1;33m' # Bold yellow NC='\033[0m' # No color echo if command -v figlet >/dev/null 2>&1; then figlet -f big "PRODUCTION" | while IFS= read -r line; do printf '%b%s%b\n' "$RED" "$line" "$NC" done figlet -f big "SERVER" | while IFS= read -r line; do printf '%b%s%b\n' "$RED" "$line" "$NC" done else echo -e "${RED}***** PRODUCTION SERVER!! *****${NC}" fi echo echo -e "${YELLOW} *** EXTREME CAUTION REQUIRED ***${NC}" echo -e "${RED}This is a LIVE PRODUCTION system.${NC}" echo -e "${RED}Unauthorized access is strictly prohibited.${NC}" echo -e "${RED}All activity is logged and monitored.${NC}" echo -e "${YELLOW}Think twice before running commands!${NC}" echo # Pause briefly to ensure user sees the warning read -t 5 -p "Press Enter to continue (auto-continue in 5 seconds)... " || true echo fi EOF ``` Creating Colorful Prompts ```bash sudo tee /etc/profile.d/custom-prompt-and-colors.sh > /dev/null << 'EOF' # Custom LS_COLORS and improved multi-line colored prompt # Vibrant LS_COLORS (directories bold blue on gray, etc.) LS_COLORS='rs=0:di=01;44:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.axa=00;36:*.oga=00;36:*.spx=00;36:*.xspf=00;36:' export LS_COLORS # Color and style variables (cached tput calls for speed) RESET=$(tput sgr0) BOLD=$(tput bold) BG_GRAY=$(tput setab 8) FG_RED=$(tput setaf 1) FG_MAGENTA=$(tput setaf 5) FG_GREEN=$(tput setaf 2) FG_CYAN=$(tput setaf 6) # Multi-line prompt PS1="\n${BOLD}${BG_GRAY}${FG_RED}\\u${FG_MAGENTA}@${FG_RED}\`hostname\`${FG_GREEN} : \`uname\` : ${FG_CYAN}\\d \\t : \${PLANTID:+\$PLANTID }\n${FG_CYAN}[\\w]${RESET}${BOLD} \\\$ ${RESET}" export PS1 EOF ``` ### Database Install and Configuration ### Configure MariaDBOptional: To add the MariadB repo to get the latest revision other then the one that is included in the RedHat
Install the new Repo for MariaDB ```bash curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash ``` This is the location of ```bash vi /etc/yum.repos.d/MariaDB.repo ``` You have to change the yellow below to get the desired version| \[mariadb\] name = MariaDB baseurl = https://rpm.mariadb.org/10.6/rhel/$releasever/$basearch gpgkey= https://rpm.mariadb.org/RPM-GPG-KEY-MariaDB gpgcheck=1 |
Done with Optional
Run the following ```shell systemctl edit mariadb.service ``` Then add the following to the file in between these lines ```shell ### Editing /etc/systemd/system/mariadb.service.d/override.conf ### Anything between here and the comment below will become the new contents of the file [Service] LimitNOFILE=32768 ### Lines below this comment will be discarded ``` Run the following ```shell vi /etc/my.cnf.d/client.cnf ``` Add the following below the **\[client\]** section ```shell socket=/var/lib/mysql/mysql.sock ``` Run the following ```shell vi /etc/my.cnf.d/mariadb-server.cnf ```If you used the optional above use the following link
```bash vi /etc/my.cnf.d/server.cnf ```Done with Optional
Add the following below the **\[mysqld\]** section and you will have to use the **:set paste** command or it will not paste correctly ```shell #Custom performance_schema = ON tmpdir = /run/mariadb thread_cache_size = 4 table_open_cache = 16384 table_definition_cache = 8384 sql_mode = ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION query_cache_type = 0 query_cache_size = 0 query_cache_limit = 128M query_cache_strip_comments = 1 tmp_table_size = 512M max_heap_table_size = 512M max_connections = 512 max_allowed_packet = 24M sort_buffer_size = 24M join_buffer_size = 48M innodb_buffer_pool_size = 4G innodb_buffer_pool_instances = 4 innodb_use_native_aio = 1 innodb_flush_log_at_trx_commit = 0 innodb_file_per_table innodb_log_file_size = 512M #Optional configuration for transaction loggin log_bin = /var/log/mariadb/mariadb.log expire_logs_days = 2 ``` Reload the changes ```shell systemctl daemon-reload ``` Enable and start MySQL/MariaDB on boot ```shell systemctl enable --now mariadb.service echo > /etc/logrotate.d/mariadb ``` Run the following ```shell mysql ``` Then execute the following statements also make sure to (**change passwords as needed XXXXXXXXXX but NOT the users names**) ```shell CREATE USER 'kiwisql'@'%' IDENTIFIED BY '800486kiwi'; GRANT all ON *.* TO 'kiwisql'@'%' WITH GRANT OPTION; CREATE USER 'kiwisql'@'localhost' IDENTIFIED BY '800486kiwi'; GRANT all ON *.* TO 'kiwisql'@'localhost' WITH GRANT OPTION; CREATE USER 'kiwilive'@'localhost' IDENTIFIED BY '5541500kiwi'; GRANT all ON *.* TO 'kiwilive'@'localhost'; CREATE USER 'remuser'@'localhost' IDENTIFIED BY '5541500kiwi'; GRANT all ON *.* TO 'remuser'@'localhost' WITH GRANT OPTION; CREATE USER 'reports'@'%' IDENTIFIED BY 'readonly'; GRANT SHOW DATABASES, SELECT, EXECUTE, PROCESS, SHOW VIEW ON *.* TO 'reports'@'%'; FLUSH PRIVILEGES; Quit ``` ### Build skeleton for the Kiwiplan Environment ### Command to Run Setup the user environment Remember to change the **remuser** & **esp** password ESP username password is the global password store in ESP to let it connect and is *unfortunately *visible to an admin user but please make sure to (**change passwords as needed XXXXXXXXXX but NOT the users names**) ``` groupadd kiwiplan mkdir /opt/kiwi ln -s /opt/kiwi/ /KIWI mkdir /opt/kiwi/{home,rev} mkdir /opt/kiwi/rev/{map,mes} useradd -g kiwiplan -G wheel -d /KIWI/home/remuser/ remuser echo NewDssP@$$RemRhel193 | passwd --stdin remuser useradd -g kiwiplan -d /KIWI/home/esp/ esp echo esp2map | passwd --stdin esp chown -R remuser:kiwiplan /opt/kiwi mkdir /etc/kiwiplan chown remuser:kiwiplan /etc/kiwiplan ``` ### Systemd Socket Implementation For KIDD ### Configure kidd.stocket Remember your **:set paste** command Create a socket file and the following ```shell vi /lib/systemd/system/kidd.socket ``` Then add the following ```shell [Unit] Description=KIDD [Socket] ListenStream=2326 Accept=yes [Install] WantedBy=sockets.target ``` Create a service file by editing the following ```shell vi /lib/systemd/system/kidd@.service ``` Then add the following ```shell [Unit] Description=Kidd Server [Service] ExecStart=/KIWI/rev/current/progs/kidd -a -p -F 1 User=root Group=root StandardInput=socket StandardOutput=socket # Resource configuration LimitNOFILE=8192 LimitNPROC=4096 # MaxConnections=nnn - The maximum number of connections to simultaneously run services instances for # when Accept=true is set. nnn should be sized accordingly for the implementation. MaxConnections=200 # The maximum number of connections for a service per source IP address. # This is very similar to the MaxConnections= directive above. Disabled by default. MaxConnectionsPerSource=80 ``` Start the service and enable on reboot ```shell systemctl start kidd.socket systemctl enable kidd.socket ``` This will only work once you have the Kiwiplan environment configured/installed ### VUE Installation Configurations ### Adjust system limits for VUE products Edit the following ```shell vi /etc/security/limits.d/20-nproc.conf ``` Add the following ```shell @kiwiplan soft nproc 32768 ``` Edit the following ```shell vi /etc/security/limits.conf ``` Then add the following before the **\#End of file** ```shell @kiwiplan - nofile 32768 ``` ### Installing MsSQL Tool #### Configure MsSQL tools Install the repo for the MsSQL service/connection ```shell curl https://packages.microsoft.com/config/rhel/9/prod.repo > /etc/yum.repos.d/msprod.repo ``` This will only work once you have the Kiwiplan environment configured/installed Install the packages make sure you answer/type **YES** to all ```shell dnf remove mssql-tools unixODBC-utf16-devel dnf install mssql-tools unixODBC-devel -y ``` ### Activate Directory Setup #### Using SSSD Install the following packages ```shell yum install sssd sssd-tools realmd samba-common-tools oddjob oddjob-mkhomedir adcli samba -y ``` Run this just in-case your domain is still using RC4 ```shell update-crypto-policies --set DEFAULT:AD-SUPPORT ``` #### Configure KRB5 Edit the following file and make sure the following is added/changed ```shell vi /etc/krb5.conf ``` Add or changed the following below| \# To opt out of the system crypto-policies configuration of krb5, remove the \# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ \[logging\] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log \[libdefaults\] dns\_lookup\_realm = true ticket\_lifetime = 24h renew\_lifetime = 7d forwardable = true rdns = true pkinit\_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake\_preauth\_groups = edwards25519 dns\_canonicalize\_hostname = fallback qualify\_shortname = "" default\_realm = ONLING.COM default\_ccache\_name = KEYRING:persistent:%{uid} udp\_preference\_limit = 0 \[realms\] ONLING.COM = { kdc = domain\_controller.onling.com admin\_server = domain\_controller.onling.com } \[domain\_realm\] .onling.com = ONLING.COM onling.com = ONLING.COM |
For the join you may need to specify the -OU's for the specific location
| \# realm discover onling.com \# realm join -U [administrator@ONLING.COM](mailto:administrator@ONLING.COM) --verbose domain\_controller.onling.com \# authselect select sssd with-mkhomedir \# authselect apply-changes |
| \[sssd\] domains = onling.com config\_file\_version = 2 services = nss, pam \[domain/onling.com\] default\_shell = /bin/bash ad\_server = sfl-dom-001.onling.com krb5\_store\_password\_if\_offline = True cache\_credentials = True krb5\_realm = ONLING.COM realmd\_tags = manages-system joined-with-adcli id\_provider = ad fallback\_homedir = /home/%d/%u ad\_domain = onling.com use\_fully\_qualified\_names = false ldap\_id\_mapping = True access\_provider = ad override\_gid = 1000 ad\_gpo\_ignore\_unreadable = true ad\_gpo\_access\_control = disabled timeout = 300 |
| simple\_allow\_groups = sssd-users OR simple\_allow\_groups = gg-C3193???-KiwiTS\_access |