Install rsyslog
dnf install rsyslog -y
Edit the journald log.
vi /etc/systemd/journald.conf
Add, enable, or modify the following lines.
ForwardToSyslog=yes MaxLevelSyslog=debug
Enable and start rsyslog
systemctl enable rsyslog
systemctl start rsyslog
Error Summary ------------- Disk Requirements: At least 28MB more space needed on the /boot filesystem.
The above error is due to the /boot partition being out of space. We can fix this issue by removing older unused Linux kernels. You could also increase the disk space, but that is a little more involved.
First we need to list which kernels we have installed.
rpm -qa | grep kernel
Example output
[incredigeek@apache ~]$ rpm -qa | grep kernel kernel-core-4.18.0-522.el8.x86_64 kernel-tools-4.18.0-529.el8.x86_64 kernel-modules-4.18.0-526.el8.x86_64 kernel-4.18.0-526.el8.x86_64 kernel-modules-4.18.0-529.el8.x86_64 kernel-4.18.0-522.el8.x86_64 kernel-4.18.0-529.el8.x86_64 kernel-core-4.18.0-529.el8.x86_64 kernel-devel-4.18.0-522.el8.x86_64 kernel-core-4.18.0-526.el8.x86_64 kernel-devel-4.18.0-529.el8.x86_64 kernel-tools-libs-4.18.0-529.el8.x86_64 kernel-devel-4.18.0-526.el8.x86_64 kernel-headers-4.18.0-529.el8.x86_64 kernel-modules-4.18.0-522.el8.x86_64
The kernel in bold is the one we will remove.
Next we remove erase the old kernel(s)/items.
sudo rpm -e kernel-4.18.0-522.el8.x86_64 kernel-core-4.18.0-522.el8.x86_64 kernel-devel-4.18.0-522.el8.x86_64 kernel-modules-4.18.0-522.el8.x86_64
And now we continue with our update
sudo dnf update
Helpful links.
Typically you’ll need to reboot a server after an update if the Linux Kernel was updated. It is possible that services need to be restarted.
There is some good information here https://serverfault.com/questions/122178/how-can-i-check-from-the-command-line-if-a-reboot-is-required-on-rhel-or-centos
Install the needs-restarting utility
sudo dnf install -y yum-utils
Once installed, we can check if we need to reboot with
sudo needs-restarting -r
The -r option only reports if a reboot is required.
If we wanted to automatically check and reboot, we could do
sudo needs-restarting -r || sudo shutdown -r
We could alternatively just check the kernel version and if it is different, manually reboot the machine. Note that there could be a couple cases where the kernel didn’t update, but you still need a reboot, or services needed to be restarted View links below for more information.
LAST_KERNEL=$(rpm -q --last kernel | perl -pe 's/^kernel-(\S+).*/$1/' | head -1) CURRENT_KERNEL=$(uname -r) test $LAST_KERNEL = $CURRENT_KERNEL || shutdown -r
Install and enable auditd with
sudo dnf install auditd sudo systemctl enable auditd sudo systemctl start auditd
Add a file or directory to monitor with
auditctl -w /etc/passwd -k password
-w is watch path
-k is a filter key we can use later to search through logs
Now we can search with ausearch
ausearch -k password
There are already some preconfigured rules in /usr/share/audit/sample-rules/
We can copy those to /etc/auditd/rules.d/ and use them.
cd /usr/share/audit/sample-rules/ cp 10-base-config.rules 30-stig.rules 31-privileged.rules 99-finalize.rules /etc/audit/rules.d/ augenrules --load
Note on the 31-privileged.rules file. You’ll need to run the commands in the file which will create a new file. Then we can copy that to “/etc/auditd/rules.d/”
find /bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' > priv.rules
#find /sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#find /usr/bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#find /usr/sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#filecap /bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /usr/bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /usr/sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
And Copy priv.rules to /etc/audit/rules.d/31-privileged.rules. Overwrite the file there if needed.
cp ./priv.rules /etc/audit/rules.d/31-privileged.rules
Load the rules.
augenrules --load
If you are getting the following error
“Couldn’t create temporary archive name.”
Check if you are out of disk space.
df -h
After freeing up some space, you should be able to continue increasing the disk size
lvextend -l +100%FREE /dev/redhat/root xfs_growfs /dev/redhat/root
CentOS/Fedora/RedHat
Add sudo privileges
usermod -a -G wheel LinuxUsername
remove
sudo deluser username wheel
Ubuntu/Debian
Add sudo privileges
usermod -a -G sudo LinuxUsername
remove
sudo deluser username sudo
Install NTP
yum install ntp -y
Enable ntpd service
systemctl enable ntpd
Notes from repairing a Fedora drive.
Mount system in chroot.
If the system is a raid drive and your not able to access it refer to this post. May just need to install the raid utilities.
For mounting the chroot environment refer to this post
Repairing grub
yum install grub2-efi-*
Install grub. Change /sda to your drive, may need to specify the efi partition.
grub2-install /dev/sda
If your boot and efi partitions are mounted.
grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg
Reboot.
The reason is probably because the chrooted environment can’t resolve DNS.
Test it with
ping incredigeek.com
If it is not resolving, edit “/etc/resolv.conf” and change/add your nameserver. Or just replace everything in it with
echo "nameserver 4.2.2.2" > /etc/resolv.conf
It should now be able to resolve and you should be able to use yum, or dnf.
yum update
Install mod_ssl
yum install mod_ssl -y
Create Directory for SSL key.
mkdir /etc/ssl/key chmod 700 /etc/ssl/key
Create certificate.
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/pki/tls/certs/localhost.crt
Fill out the info or what is applicable.
Now edit the LibreNMS Apache config file /etc/httpd/conf.d/librenms.conf
All you have to do is add the following three lines under the VirtualHost and change *:80 to *:443.
SSLEngine on SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSL CertificateKeyFile /etc/pki/tls/private/localhost.key
So when your finished the file should look like this.
<VirtualHost *:443> DocumentRoot /opt/librenms/html/ ServerName server_hostname_or_IP SSLEngine on SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateKeyFile /etc/pki/tls/private/localhost.key CustomLog /opt/librenms/logs/access_log combined ErrorLog /opt/librenms/logs/error_log AllowEncodedSlashes NoDecode <Directory "/opt/librenms/html/"> Require all granted AllowOverride All Options FollowSymLinks MultiViews </Directory> </VirtualHost>
Don’t forget to allow https/port 443 traffic through the firewall. Guide here
If you have any issues, you may need to chmod the key and crt file.
chmod 644 /etc/pki/tls/certs/localhost.crt chmod 644 /etc/pki/tls/private/localhost.key
You should now be able to access LibreNMS using https. Note, you’ll need to allow an exception in your browser for your self signed certificate.
https://LibreNMS_IP_Address