Last active 7 months ago
Revision 30841391cef5d716d34899de121e5f46d124bbf3
ssh -YC <host>
.ssh/config
Host orion # orion
HostName orion.giran.cyou
User liannnix
SetEnv XDG_CURRENT_DESKTOP=kde
/etc/openssh/sshd_config
AcceptEnv XDG_CURRENT_DESKTOP
btrfs dev add /dev/sda1 /
btrfs balance start -dconvert=raid1 -mconvert=raid1
dd if=/dev/zero of=test1.img bs=5G count=1 oflag=dsync && rm -rf test1.img
apt-get install pki-base pki-ca pki-server dogtag-pki-server-theme
pkispawn
pki pkcs12-import --pkcs12 ~/.dogtag/pki-main/ca_admin_cert.p12 --password-file pass.txt
pki client-cert-import --pkcs12 ~/.dogtag/pki-main/ca_admin_cert.p12 --pkcs12-password-file pass.txt
git worktree
git blame
git merge -s ours
git switch --orphan <branch>
git merge --no-commit --allow-unrelated-histories -s ours <upstream-tag>
git read-tree -u --reset <upstream-tag>
git checkout @ -- .gear package.spec
git commit -a
git add -p
git log --first-parent
apt-get install glusterfs9 glusterfs9-server
systemctl enable --now glusterfssharedstorage.service
systemctl enable --now glusterd.service
gluster peer probe sora.giran.cyou
gluster volume create data replica 3 sora.giran.cyou:/srv/data/brick jarvis.giran.cyou:/srv/data/brick yun.giran.cyou:/srv/data/brick
mount.glusterfs sora:/data /mnt/data/ -o acl
sora.giran.cyou:/data /mnt/data glusterfs acl 0 0
systemctl edit glusterd.service
[Unit]
After=network-online.target
Before=
gluster volume status data
gluster volume heal sysvol info
gluster volume heal
*/2 * * * * /usr/bin/host -W 5 ya.ru 192.168.20.53 2>&1 > /dev/null || /usr/bin/systemctl restart bind
nsupdate -g
server giran.cyou
update delete 10.254.168.192.in-addr.arpa. PTR
update add 10.254.168.192.in-addr.arpa. 300 PTR yun.giran.cyou.
send
quit
echo -e 'server giran.cyou\n update delete 10.254.168.192.in-addr.arpa. PTR\n update add 10.254.168.192.in-addr.arpa. 300 PTR yun.giran.cyou.\n send\n quit
' | nsupdate -g
realm GIRAN.CYOU
update delete 10.254.168.192.in-addr.arpa. in PTR
update add 10.254.168.192.in-addr.arpa. 3600 in PTR yun.giran.cyou.
send
realm GIRAN.CYOU
update delete 7.2.b.0.f.b.e.f.f.f.e.7.d.1.4.a.a.0.0.0.3.0.0.1.0.4.8.e.2.0.a.2.ip6.arpa. in PTR
update add 7.2.b.0.f.b.e.f.f.f.e.7.d.1.4.a.a.0.0.0.3.0.0.1.0.4.8.e.2.0.a.2.ip6.arpa. 3600 in PTR yun.giran.cyou.
send
openssl x509 -in cert.pem -noout -text
ovs-vsctl add-port trunk vlv4ttk_v4ttk tag=201 -- set interface vlv4ttk_v4ttk type=internal
openssl genrsa -out cakey.pem 2048
openssl req -key cakey.pem -new -x509 -out cacert.pem
vim extensions.kdc
[kdc_cert]
basicConstraints=CA:FALSE
keyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage=1.3.6.1.5.2.3.5
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
issuerAltName=issuer:copy
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
[kdc_princ_name]
realm=EXP:0,GeneralString:${ENV::REALM}
principal_name=EXP:1,SEQUENCE:kdc_principal_seq
[kdc_principal_seq]
name_type=EXP:0,INTEGER:2
name_string=EXP:1,SEQUENCE:kdc_principals
[kdc_principals]
princ1=GeneralString:krbtgt
princ2=GeneralString:${ENV::REALM}
openssl genrsa -out kdckey.pem 2048
openssl req -new -out kdc.req -key kdckey.pem
export REALM=DOMAIN.ALT
openssl x509 -req -in kdc.req -CAkey cakey.pem -CA cacert.pem -out kdc.pem -extfile extensions.kdc -extensions kdc_cert -CAcreateserial
cp kdc.pem /var/lib/kerberos/krb5kdc/
cp kdckey.pem /var/lib/kerberos/krb5kdc/
cp cacert.pem /var/lib/kerberos/krb5kdc/
vim /var/lib/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
...
pkinit_identity = FILE:/var/lib/kerberos/krb5kdc/kdc.pem,/var/lib/kerberos/krb5kdc/kdckey.pem
pkinit_anchors = FILE:/var/lib/kerberos/krb5kdc/cacert.pem
[realms]
DOMAIN.ALT = {
...
default_principal_flags = +preauth
}
kadmin.local -q 'addprinc test'
kadmin.local -q 'modprinc +requires_preauth test'
kadmin.local -q 'addprinc -randkey WELLKNOWN/ANONYMOUS'
vim extensions.client
[client_cert]
basicConstraints=CA:FALSE
keyUsage=digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage=1.3.6.1.5.2.3.4
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
issuerAltName=issuer:copy
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name
[princ_name]
realm=EXP:0,GeneralString:${ENV::REALM}
principal_name=EXP:1,SEQUENCE:principal_seq
[principal_seq]
name_type=EXP:0,INTEGER:1
name_string=EXP:1,SEQUENCE:principals
[principals]
princ1=GeneralString:${ENV::CLIENT}
openssl genrsa -out clientkey.pem 2048
openssl req -new -key clientkey.pem -out client.req
export REALM=DOMAIN.ALT
export CLIENT=test
openssl x509 -CAkey cakey.pem -CA cacert.pem -req -in client.req -extensions client_cert -extfile extensions.client -days 365 -out client.pem
scp cacert.pem test@10.64.172.150:
scp client.pem test@10.64.172.150:
scp clientkey.pem test@10.64.172.150:
systemctl restart krb5kdc.service
cp /home/test/*.pem /var/lib/kerberos/krb5/
vim /etc/krb5.conf
[libdefaults]
...
pkinit_anchors = FILE:/var/lib/kerberos/krb5/cacert.pem
#pkinit_identities = FILE:/var/lib/kerberos/krb5/client.pem,/var/lib/kerberos/krb5/clientkey.pem
/usr/bin/net ads dns register --use-kerberos=required --use-krb5-ccache=FILE:/tmp/ccach pki.giran.cyou
[global]
<...>
host msdfs = yes
[share]
#vfs objects = dfs_samba4
path = /export/dfsroot
msdfs root = yes
mkdir -p /export/dfsroot`
ln -s msdfs:storage0\\share0 linka`
ln -s msdfs:server1\\share,server2\\share linkb`
dcs="10.64.165.10 10.64.165.11 10.64.165.12"
for i in $dcs; do
ssh -i ~/.ssh/robot_key root@$i \
'echo -e "zone \"trust.alt\" {\n type forward;\n forward only;\n forwarders { 10.64.66.46; };\n};\n" >> /etc/bind/named.conf'
done
pip install s-tui
apt-get install stress
s-tui
[Network]
Bridge=vms-priv
[Exec]
## UID/GID mapping delegation for container
PrivateUsers=no # for domain ID's outside nspan 65536 range
## Capabilities
Capability=CAP_SYS_ADMIN # just in case, you can try to remove
#Capability=all # allow all CAP's at once (not recommended)
#Capability=help # list of all avialable CAP's. run systemd-nspawn --capability=help
## Limit for max file descriptors
LimitNOFILE=infinity # samba-common package change ulimit NOFILE to 16384
# /etc/security/limits.d/90-samba.conf
# without this option you can't login to container
## ability to change system call filter
SystemCallFilter=@keyring # allows KEYCTL system calls to work with kernel keyring
# list of all available syscalls: systemd-analyze syscall-filter
LC_ALL=C virt-install --connect qemu:///system --name node-x86_64 --os-type=linux --graphics vnc --ram 4096 --vcpus=12 --network network=default --virt-type=kvm --import --autostart --disk /data/libvirt_images/node-x86_64.qcow2 --network network=node-x86_64-v --hvm
g
n -> 1 -> 2048 -> +1M -> y
t -> 1 -> 4
w
zpool create -o ashift=12 -O compression=lz4 -O normalization=formD -O mountpoint=none main /dev/disk/by-uuid/12407395108911578001
zfs create -V 30G main/system