Red Hat 6 Satellite Training

Just notes from the training I’m attending this week.

First off the Installation and User’s guides will help you if you’ve done it before. There are extra bits that I’m getting in the class that’s really helping me visualize how to initially set up the site.

Installation and Configuration chapters are pretty clear. Couple of notes.

1. Don’t try to sync all the repos you need at one time. It’ll overwhelm the server. I had to rebuild mine after it totally went insane and someone in the class mentioned that as a problem on his side as well.

2. Satellite isn’t initially configured as a kickstart site. You can do it but it’s a configuration you need to do to get to that point.

3. Satellite has a single copy of each RPM. So RHEL 6 Server is the full installation of 6.0. The RHEL 6.1 repo is just the differences between the core installation and 6.1. Same on up to 6.7.

4. I can create a manifest for each Organization. So Ops can have a manifest for the Ops managed systems and Lab can have a manifest (managed by Satellite of course) for their systems.

5. Propose: Each Product is a Host Collection. Host Collections are systems with similar attributes such as OS versions. Since we have to get a BU to approve updates, having a HC for a product lets us update the product.

Posted in Computers | Leave a comment

Building Dice Towers

A Dice Tower is useful in ensuring the rolling of dice is relatively similar and it keeps dice in a controlled location. I’ve checked out various sites over the years so I’ve had an idea of what I was looking for.

Not long ago, I stumbled on a pretty cool looking dice tower that wasn’t too crazy complicated (in my mind) to build. During the build of the Gaming Table, I took some time out to cut and assemble 5 dice towers based on the following site.

Very Cool DIY Dice Tower

I followed the top two links to pictures but the plans pop up with a Permission Denied. I posted a comment but the last one was in 2011. I reverse engineered the plans and recreated it with my 2″x2″ boards I picked up for this purpose (the board is actually 1 1/2″ by 1 1/2″).

The hardest part was the back top corner piece. It has a diagonal down the face at the same angle as the two adjacent pieces. I whipped up a quick and dirty jig and was able to easily make the cut. The bottom part was a three way cut and was the hardest part of the piece. I have a scroll saw but it was complaining the entire way. I’m thinking of snagging a small band saw to make this easier. The rest of the pieces are simple straight or 45* cuts. One of the links above has a 2d plan with measurements in mm. His tower is about 3/4″ bigger all around and probably an inch or two taller but I like this one.

Glued together. You can see the diagonal angled cut here. it’s not perfect but I have 4 or 5 more to make so I’ll get the hang of it before too long 🙂 You can see the lower part of that piece there and the other one in the next picture.

From the back. The top right corner is the harder piece.

I planned on using plexiglass but the local show will only make single cuts, no custom cuts. I need to get some measurements and plan how to get the plexiglass in place. In the mean time I taped some paper over the openings so I could test the dice. I used a box of small dice and dumped them all in, all came out without an issue. I dumped in a set of polyhedrons and no sticking, all came out without an issue. I finally dumped in some d20 and d12 mixes and again, all came out. Without making a statistical run, it seems to work as expected.

I’ll be keeping this one for my Shadowrun game (look at all those 5’s and 6’s 😀 )

Okay, I have five towers done. I stopped in at our local hardware store. “Plexiglass?” I ask the guy at the desk. He pulls out a selection of 3×5 pieces in various thicknesses and says to provide the measurements and they’ll cut them for me. “Really? I was just going to get a few sheets and cut them myself. Let me get the measurements and I’ll come back.”

Later: “Here you go, 10 at 9 1/4″x3″, 5 at 7″x3″ and 5 at 9 1/4″x3″.”

“That’s a lot of labor. And $.73 a piece. Come back in 45 minutes and it’ll be ready, $13.23 total when you pick it up.”

More Later: “Here I am.” I measure the pieces. Not perfect but within error limits, I’m cool.

“If you’re going to do this often, we’ll have to charge you labor.”

😀

I’m looking at getting my own table saw blade though. The cuts were apparently using a knife vs a saw.

Now, assemble the plexiglass. Just using clamps to get a feel for how it lays out plus the sides of the tray. I may rip the sides to shorten them a bit. I have a small sheet of the 1/4″ Poplar which I may also rip to make the sides. We’ll see.

I was going to try and miter saw the edges but the blade is large enough that it really doesn’t work. So I used the scroll saw and did my best keeping it straight.

I tried a couple of different sizes for the fence around the front yard of the dice tower but found the quarter inch was what I liked best. I had a long, about 2″ wide piece so I ripped it to 3/4″ and then used a jig and the miter saw to cut the corners. A little wood glue thinly spread with my fingers and they’re set. I also took the tower itself and ran the bottoms of each completed tower through the miter saw to make the base flat. At least one tower (the one on the right here) the ramp ends a little before the fence.

I used my drill press to gradually increase bit sizes to drill holes. Still I cracked the back of one of the pieces. I tried to sand down the edges of the plexiglass. It sort of worked. I’m still poking at it though.

We used the towers Saturday and Sunday and they worked pretty well even though the plexiglass was just taped in place for now.

Posted in Dice Towers, Woodworking | Leave a comment

Building a Gaming Table

Once the plans were drawn, I started gathering wood from Home Depot. I checked out the available hard woods and went with Poplar. Partly because of the expense and partly because of the color (a mild green). I picked up an Oak board for the Cup Holders and the plywood sheets for the table tops.

The garage is a bit wet, it is December and there’s snow outside. The garage is a touch cold (as in, I can see my breath at times).

I started getting the gear out of the various places I stashed it. The router table from under the window, the miter saw from on top of the table saw, the stand from next to the router table. Just getting stuff out and ready to use. Then start measuring and cutting until all the Poplar has been cut to the proper size.

Posted in Game Table, Woodworking | Leave a comment

Making a Gaming Table

Years and years ago (1989 ish), I had an idea for a gaming table. I had a Toshiba 1100+ which was a very small laptop with a 23 or so line text screen. I’d been programming and was looking at using NETBIOS as a method of chatting with others who might have laptops as a Dungeon Master. The table would have 5 spots for laptops to slide in and the gaming surface itself. In this way notes could be passed without others noticing and the game could be managed without much trouble.

For years since then I’ve checked out various ideas for tables like a taller surface with an underlying cubby-hole setup that included PVC pipe to roll notes to others and tables using old drafting hardware to raise the table itself and smaller board game oriented tables and even tables that look like poker tables.

I’ve done some wood working in the past and a few years ago I snagged a joiner. This is a small cutter that creates a 2″ or so half-oval cut into the side of a board. You’d use it along with the 2″ biscuit to better connect two pieces of flat board together. In my case, in testing this process, I snagged 6 1″x6″x6′ long pine boards and joined them together. I created an ‘X’ base out of plywood. In order to get it upstairs, I had to quickly trim the corners but I ended up with a 6’x5′ table top. The ‘X’ didn’t work very well so I cut the two pieces in half and created a square base about 3’x3′. Under the table I screwed in a 2″ rim about 4″ in from the edge and another 2″ rim for the 3’x3′ base to sit on. You’d then screw the base to the top. Eventually I used some glue and black felted the top plus some left over red paint to paint the base and underside. It’s not too bad in general. Reasonably spacious for my Role Playing purposes. Space on one side for me and all my gear. Space on the other side for a large wet-erase mat and a little space around the edge for people’s stuff.

Recently I was hanging out at my Friendly Local Gaming Store, Atomic Goblin Games in Longmont Colorado, and he had picked up a small 3’x3′ board game demo table. On two sides it had a trough for bits and in the center of each trough, a round holder for a dice cup or drink. This finally gave me an idea for building a table and it was time. I whipped out a paper and drew up my idea with the trough in mind. Using hard woods (which might get expensive), I designed a trough. You can see the side view in the picture below. I wanted a place where you could put a clipboard and it’d be supported at an angle. Hence the route on the top left and the attachment and route on the right outside of the trough. It would hold a 3″x5″ or so piece of wood and you could prop your clipboard into the outside route and lean it on the wood on the right outside. In the center would be 1/4″ strips of plywood which would hold a sliding tray (on the right). The tray could be for dice or pencils or miniatures. The trough itself would be a lower level, same idea though. Pencils, minis, a bunch of dice.

(See here for the rest of the plans.)

One of the bigger ideas was to make it modular. With carrying the big table top downstairs, I didn’t want it to be so large and heavy I couldn’t move it without help, but I did want it to be at least as big as the current table. So modular. It’ll be a base 3’x3′ table that will be attached to other tables to make a 6’x6′ gaming table or since it was modular, a 3’x3′, 3’x6′, 3’x9′, or even 3’x12′ if you put all the tables in a line. Each trough will fit a side of the table. With 8 troughs, you’d have a 6’x6′ table with 8 stations, 2 on each side.

I also wanted it to be taller or shorter. Since it’s modular, I can make the table legs any height. My first run was the height of a kitchen counter or bar. This way you can comfortably sit on a bar stool or stand and play (I prefer standing myself). But later I can create table height legs, or even floor height where you can sit on the floor and game.

I had some ideas for the clipboard support panels as well. I can make them out of nicer wood or even dry erase material and you can write on it for others to see (like your game name, race, things folks would normally see). I also plan cup holders made of oak which attach to the troughs.

Begin!

Posted in Game Table, Woodworking | Leave a comment

Using firewalld for Routing and Firewall

One of the teams at work replaced a group of old, end of life Dell hardware and contacted me (among others) to see if I wanted it. Sure!

System: Dell R710 (Rack Mounted server). Was used as the DMZ Virtualization system.

2 10,000 RPM 146 Gig Drives RAID 1 mirrored.
4 7,200 RPM 750 Gig Drives RAID 5 mirrored

2 8 Core 2.67 GHz CPUs

192 Gigabytes of RAM

Four on board Ethernet ports. Four on a PCI card. Two 10 Gig ports on a PCI card. Two HBA (Fiber) PCI cards.

iDRAC (remote console access).

I determined to use it as a replacement for my existing ancient system running Ubuntu. I’ll be installing CentOS 7 which will let me play with some of the newer tools, important in my line of work.

I installed CentOS 7 and also upgraded the firmware of the system and drives. After a week or so of research, I got my firewall and router configuration working.

In the examples below, I run the command twice. The second time with the –permanent option. That’s because –permanent doesn’t activate the command but it does make it available on reboot or when reloading the firewall (firewall-cmd –reload). I ran them twice when I was working on the system in order to test my work. You can just run the –permanent commands and at the end, run the firewall-cmd –reload command to configure your firewall.

I have 3 Interfaces on my system:

em1 – Zone: external – Need to Enable Masquerading
em2 – Zone: internal
em3 – Zone: dmz – This is for wireless access

To enable routing, set the ipv4 forwarding in the kernel. Normally in /etc/sysctl.conf, in CentOS 7 it’s in a slightly different location:

/etc/sysctl.d/99-forwarding.conf
net.ipv4.ip_forward=1

Set Masquerading:

firewall-cmd –zone=external –masquerade
firewall-cmd –zone=external –masquerade –permanent

The default zone is public. I changed it to be internal.

firewall-cmd –set-default-zone=internal
firewall-cmd –set-default-zone=internal –permanent

Then change the interface zones. All interfaces are in the internal zone by default.

firewall-cmd –change-interface=em1 –zone=external
firewall-cmd –change-interface=em1 –zone=external –permanent
firewall-cmd –change-interface=em3 –zone=dmz
firewall-cmd –change-interface=em3 –zone=dmz –permanent

One of the problems discovered is the permanent setting doesn’t actually save the interface/zone info across network up/down. So a reboot will put all three interfaces into the default zone. There are two solutions:

Set the desired ZONE=[external|internal|dmz] variable in the /etc/sysconfig/network-scripts/ifcfg-em[123] files.

Use the Network Manager to set it:

nmcli conn modify em1 connection.zone external
nmcli conn modify em3 connection.zone dmz

Both the external and dmz zones have the ssh service enabled by default. I removed ssh from both zones.

firewall-cmd –remove-service=ssh –zone=external
firewall-cmd –remove-service=ssh –zone=external –permanent
firewall-cmd –remove-service=ssh –zone=dmz
firewall-cmd –remove-service=ssh –zone=dmz –permanent

I rebooted the system after I was done of course (standard sysadmin stuff 🙂 ) and that’s how I discovered the interfaces weren’t being saved. Note that I didn’t add masquerade to the wireless interface. That’s because the wireless one is simply running through my wifi hotspot to the server and out to the ‘net. Same as this laptop right now 🙂

I ran a test through grc.com (Gibson Research’s Shield’s Up tool). The system isn’t quite the same with the above rules. You can ping the system which I had disabled on the old box and it’s answering to a few queries but no services are running. So there’s some tweaking to get done. But the server is up and everything works.

Posted in Computers | Tagged , , | Leave a comment

Recover root Password

There are multiple methods of changing root’s password. Some of us old timers just boot a bootable system disk, fsck the root file system, mount it, and edit etc/shadow. This may not work correctly with a system configured using SELinux.

In this quickie, I’m talking about Red Hat 7.

Boot the system. At the grub2 menu, hit e to go into edit mode.

On the kernel line, remove the rhgb and quiet keywords. You should do this anyway on a server so you can see the system messages as it boots. Helps to know that a system is running fsck or some crazy DBA has set up an Oracle script to prompt for an answer (ask me how I know).

At the end of the line (Ctrl + e), add rd.break enforcing=0.

Press Ctrl + x to continue booting.

Once it’s done, you’ll be at a prompt. Remount the root file system as read-write. mount -o remount,rw /sysroot

Change the mounted root file system to be a jail. chroot /sysroot. You’ll have a normal prompt.

Run the passwd command to set root’s password.

You’ll need to rescan the drive for SELinux. touch /.autorelabel.

Remount the file system as read only. This flushes any memory to ensure all writes have completed. mount -o remount,ro /

Exit out of the chroot jail. exit

Exit out of emergency mode and continue booting. Depending on the size of the system it can take several minutes. exit

You’ll need restore the context of the /etc/shadow file. restorecon /etc/shadow

Check the current SELinux status. getenforce

If you’re out of enforcing mode, set it. setenforce 1

Check the status once again. getenforce

And done. Reset root’s password once the system is back up and ready to use.

Posted in Computers | Tagged | Leave a comment

RHCE Database Services

RHCE Objectives: Database Services

  • Install and configure MariaDB
  • Backup and restore a database
  • Create a simple database schema
  • Perform simple SQL queries against a database

Installing MariaDB is easy enough; yum install mariadb. This will install the main files, server, and libs.

mariadb-5.5.41-2.el7_0.x86_64
mariadb-server-5.5.41-2.el7_0.x86_64
mariadb-libs-5.5.41-2.el7_0.x86_64

Standard configuration by running mysql_secure_installation and following the prompts.

Use the systemctl commands to enable and start the database.

systemctl enable mariadb.service
systemctl start mariadb.service
systemctl status mariadb.service

To log in, simply type in mysql. If you’ve set up a password for the root user, you’ll need to pass -u root -p or –user=root -p to log in.

Database stuff is pretty easy if you’ve done anything with it.

MariaDB [(none)]> create database username;
Query OK, 1 row affected (0.00 sec)

Piece of cake.

You’ll want to create a table (schema) for querying to satisfy the last requirement.

MariaDB [(none)]> use database username;
Database changed

MariaDB [username]> create table users (
-> usr_id int(10) not null auto_increment,
-> usr_last char(30) not null default ”,
-> usr_first char(30) not null default ”,
-> usr_name char(30) not null default ”,
-> usr_phone char(30) not null default ”,
-> usr_email char(255) not null default ”,
-> primary key (usr_id)
-> );
Query OK, 0 rows affected (0.04 sec)

And you’ll need to add some data

MariaDB [cschelin]> insert into users set usr_id = null,usr_last=’Lastname’,usr_first=’Firstname’,usr_name=’FLastnam’,usr_phone=”303-555-1212″,usr_email=”user@testing.com”;
Query OK, 1 row affected (0.02 sec)

Okay, to perform a simple query, run the following command:

MariaDB [cschelin]> select * from users;
+——–+———-+———–+———-+————–+——————+
| usr_id | usr_last | usr_first | usr_name | usr_phone | usr_email |
+——–+———-+———–+———-+————–+——————+
| 1 | Lastname | Firstname | FLastnam | 303-555-1212 | user@testing.com |
+——–+———-+———–+———-+————–+——————+
1 row in set (0.00 sec)

Again, piece of cake.

Backing up a database is simple as well:

mysqldump --user=root -p username
Enter password: 
-- MySQL dump 10.14  Distrib 5.5.41-MariaDB, for Linux (x86_64)
--
-- Host: localhost    Database: username
-- ------------------------------------------------------
-- Server version	5.5.41-MariaDB

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;

--
-- Table structure for table `users`
--

DROP TABLE IF EXISTS `users`;
/*!40101 SET @saved_cs_client     = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `users` (
  `usr_id` int(10) NOT NULL AUTO_INCREMENT,
  `usr_last` char(30) NOT NULL DEFAULT '',
  `usr_first` char(30) NOT NULL DEFAULT '',
  `usr_name` char(30) NOT NULL DEFAULT '',
  `usr_phone` char(30) NOT NULL DEFAULT '',
  `usr_email` char(255) NOT NULL DEFAULT '',
  PRIMARY KEY (`usr_id`)
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;

--
-- Dumping data for table `users`
--

LOCK TABLES `users` WRITE;
/*!40000 ALTER TABLE `users` DISABLE KEYS */;
INSERT INTO `users` VALUES (1,'Lastname','Firstname','FLastnam','303-555-1212','user@testing.com');
/*!40000 ALTER TABLE `users` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;

/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

-- Dump completed on 2015-08-11 10:06:22

And reloading the data is easy as well. You’ll need to recreate the database first though.

MariaDB [(none)]> drop database username;
Query OK, 1 row affected (0.03 sec)

MariaDB [(none)]> create database username;
Query OK, 1 row affected (0.00 sec)

Exit out and restore your backup. The thing to note is that the data file needs to be where mariadb can get to the file. Saving it to your home directory fails because of the access restrictions. I save to /var/tmp for this but generally I have a mariadb directory in /var/tmp for the daily backups.

mysql –user=root -p username < username.sql

Once done (and after entering your password), log in to mariadb, use username, show tables, select * from users. Done!

Posted in Computers | Tagged | Leave a comment

RHCE NTP

RHCE Objectives: Network services

Network services are an important subset of the exam objectives. RHCE candidates should be capable of meeting the following objectives for each of the network services listed below:

  • Install the packages needed to provide the service
  • Configure SELinux to support the service
  • Use SELinux port labeling to allow services to use non-standard ports
  • Configure the service to start when the system is booted
  • Configure the service for basic operation
  • Configure host-based and user-based security for the service

http://www.certdepot.net/rhel7-use-selinux-port-labelling/

  • Synchronize time using other NTP peers

Install packages: yum install ntp, systemctl start ntpd

Configure SELinux: Should be configured out of the box; ps -e –context | grep ntp

SELinux Port labeling: Use the semanage tool to see the existing ports to be used:

semanage port -l | grep ntp

To use a different port, you’ll need to make sure the target port isn’t different

sepolicy network -p [port number]

If unreserved, then assign it.

semanage port -a -t ntp_port_t -p tcp 60123

Configure to start when booted: systemctl enable ntpd

Configure for basic operation: By default; ntpq -p to review the output.

Configure host-based and user-based security for the service:

Synchronize time using other NTP peers: Start ntpd; systemctl start ntpd. This will start the sync process. If you need to initially set your hardware clock, you can use ntpdate [servername] to manually set the date and time but ntpd can’t be running. So stop ntpd (systemctl stop ntpd), run ntpdate [servername] to sync, and then start ntpd back up (systemctl start ntpd).

Posted in Computers | Tagged | Leave a comment

RHCE SSH

RHCE Objectives: Network services

Network services are an important subset of the exam objectives. RHCE candidates should be capable of meeting the following objectives for each of the network services listed below:

  • Install the packages needed to provide the service
  • Configure SELinux to support the service
  • Use SELinux port labeling to allow services to use non-standard ports
  • Configure the service to start when the system is booted
  • Configure the service for basic operation
  • Configure host-based and user-based security for the service
  • Configure key-based authentication
  • Configure additional options described in documentation

Install: yum install sshd (technically it’s already in place but to satisfy the listing above). You’ll need to add it to the firewall if it’s not there already: firewall-cmd –permanent –add-service=ssh; firewall-cmd –reload

Configure SELinux to support: Should already be there

Use SELinux Port labeling: See NTP. You’ll need to change /etc/ssh/sshd_config port command if you use a different port.

Configure the service to start: systemctl enable sshd

Configure the service for basic operation: again, already started.

Configure host-based and user-based security for the service:

http://www.certdepot.net/rhel7-configure-ssh-key-based-authentication/

Configure key-based authentication: Simple enough. In your home directory, create a .ssh directory chmod 700. Run ssh-keygen -t rsa and hit enter through the prompts. On the second machine, create a .ssh directory also chmod 700 and copy the id_rsa.pub file from server 1 to server to:.ssh/authorized_keys

Configure additional options: Edit the /etc/ssh/sshd_config file. The file itself is pretty clearly documented. Commented out commands show the default option. Restart the service after changes (systemctl restart sshd).

Posted in Computers | Tagged | Leave a comment

RHCE SMTP

RHCE Objectives: Network services

Network services are an important subset of the exam objectives. RHCE candidates should be capable of meeting the following objectives for each of the network services listed below:

  • Install the packages needed to provide the service
  • Configure SELinux to support the service
  • Use SELinux port labeling to allow services to use non-standard ports
  • Configure the service to start when the system is booted
  • Configure the service for basic operation
  • Configure host-based and user-based security for the service

http://www.certdepot.net/rhel7-configure-system-forward-email-central-mail-server/

  • Configure a system to forward all email to a central mail server

Assuming Postfix here vs sendmail (especially with the above article).

Install: yum install postfix

SELinux: Again, with the yum install, the selinux part is already configured.

SELinux Port: See ntp

Configure to start: systemctl enable postfix; systemctl restart postfix;

Configure the service for basic operation: This may be the first block below (the myhostname to mydestination).

Configure host-based and user-based security for the service:

Configure a system to forward all email to a central mail server:

Here we don’t know if there is a central mail server already or if one will be provided. Assuming “send mail to the following IP address or server”

In /etc/postfix/main.cf uncomment/change the following lines:

myhostname = server.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = loopback-only
mydestination =
relayhost = 192.168.1.1

The first parts are to configure your system. Blank mydestination and set relayhost. This will forward mail to the relayhost.

Posted in Computers | Tagged | Leave a comment