Satellite 6.3 to 6.4 Upgrade

References:

• Upgrading Red Hat Satellite
• Upgrading Puppet

For each Organisation in Satellite refresh their manifests.

Check what issues exist before upgrading. I had a couple of thousand old tasks which it offered to cleared out for me. I quit when it found I had to upgrade Puppet first.

foreman-maintain upgrade list-versions
foreman-maintain upgrade check --target-version 6.4

Upgrade Puppet on Satellite

 subscription-manager repos --enable=rhel-7-server-satellite-6.3-puppet4-rpms
 satellite-installer --upgrade-puppet

Replace the “JAVA_ARGS” variable withthe following in /etc/sysconfig/puppetserver:

 JAVA_ARGS="-Xms2G -Xmx2G -XX:MaxPermSize=256m -Djava.io.tmpdir=_/var/tmp_"

Add the following line to /etc/foreman-installer/custom-hiera.yaml:

 puppet::server_jvm_extra_args: '-XX:MaxPermSize=256m -Djava.io.tmpdir=_/var/tmp_'

Restart the Puppet server:

 systemctl restart puppetserver

Go back and re-check with foreman-maintain:

 foreman-maintain upgrade check --target-version 6.4 --whitelist="disk-performance"

All good, lets upgrade:

  foreman-maintain upgrade run --target-version 6.4 --whitelist="disk-performance"

Confirm with “y” at the next two questions that you wish to continue. It is reminding you to make a backup and that the next phase is going to change stuff!

Optional, install the OpenSCAP content:

 foreman-rake foreman_openscap:bulk_upload:default

Post Upgrade Tasks

Review the taks in the upgrade guide:

• Post-upgrade Tasks

I chose to only do the “Removing the Previous Version of the Satellite Tools Repository” task for now.

---

Written with StackEdit.

NFS Setup Scripts

Red Hat provides a web tool to build custom scripts to configure your NFS server or client. Supply the information about your desired NFS service and then download the custom shell script.

• NFS Configuration Tool

Have a look around at the other tools while you are there.

Red Hat Customer Portal Labs – Developed by Red Hat engineers to help you improve performance, troubleshoot issues, identify security problems, and optimize configuration.

---

Written with StackEdit.

Bandwidth Limit Connections

Creating Classes of Network Traffic

…with RHEL 7

References:

• https://serverfault.com/questions/374617/linux-qos-bulk-data-transmission-during-idle-times

• http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm#ceiling

Prioritisation of Outbound Network Traffic

Scenario

1. Any class of traffic may consume all available bandwidth.

2. If there are simultaneous competing traffic classes then:

3. High priority traffic gets to use all the available bandwidth except what is guaranteed to the lower classes.

4. Medium priority traffic gets its guaranteed rate. If there is no high priority traffic then the medium traffic will expand and consume the entire bandwidth available.

5. Low priority traffic gets its guaranteed rate. Only when there is no high or medium priority traffic, the low priority traffic will expand and consume the entire bandwidth available.

6. Low priority traffic classes will loose their additional allocation of bandwidth over their guaranteed bandwidth whenever there is higher priority traffic.

Solution Design

With RHEL 7 Traffic Control to create three classes of traffic:

1. High priority

   • Application traffic
   • Services that directory support the application; dns, ldap, ntp.

2. Medium priority (default class)

   • Infrastructure services; software updates via Red Hat Satellite.
   • Maintenance services; ssh.

3. Low priority

   • Forwarding Logs

The maximum rate of high priority traffic and the ceiling for all three classes of traffic is being set to an unrealistically high number to ensure the server will use all available bandwidth. Just as what would happen if there were no traffic prioritisation rules. It is thought “900mbit” is an unrealistic rate for the target links we intend to use.

The “burst” attribute is used to adjust the responsiveness of maintaining adherence to the rates. The default will be used and the system will set a value which is a little sluggish/lazy but it should affect changes within seconds.

Limitations

1. Only outbound traffic is being limited in this solution. Our focus is on controlling the uploading of “Log” traffic.

Implementation

The “Traffic Control” command “/usr/sbin/tc” comes with the “iproute” package.

Show the Traffic Classes

tc class show ens5
tc -s class show ens5
tc filter show dev ens5 parent 1:

Delete existing traffic control rules

tc qdisc delete dev ens5 root

Create the Traffic Classes and set the default class.

tc qdisc add dev ens5 root handle 1: htb default 20
tc class add dev ens5 parent 1: classid 1:1 htb rate 900mbit
tc class add dev ens5 parent 1:1 classid 1:10 htb rate 900mbit ceil 900mbit prio 1
tc class add dev ens5 parent 1:1 classid 1:20 htb rate 10mbit ceil 900mbit prio 2
tc class add dev ens5 parent 1:1 classid 1:30 htb rate 1kbit ceil 900mbit prio 3

Make the queue scheduling fair to minimise starvation when under heavy load.

tc qdisc add dev ens5 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev ens5 parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev ens5 parent 1:30 handle 30: sfq perturb 10

Select traffic for the High priority class.

tc filter add dev ens5 parent 1: protocol ip u32 match ip dport 53 0xffff flowid 1:10
tc filter add dev ens5 parent 1: protocol ip u32 match ip dport 123 0xffff flowid 1:10
tc filter add dev ens5 parent 1: protocol ip u32 match ip dport 389 0xffff flowid 1:10
tc filter add dev ens5 parent 1: protocol ip u32 match ip dport <application_ports> 0xffff flowid 1:10

Select traffic for the Medium priority class.

tc filter add dev ens5 parent 1: protocol ip u32 match ip dport 22 0xffff flowid 1:20
tc filter add dev ens5 parent 1: protocol ip u32 match ip dst <satellite> 0xffff flowid 1:20

Select traffic for the Low priority class.

tc filter add dev ens5 parent 1: protocol ip u32 match ip dport 514 0xffff flowid 1:30

---

Written with StackEdit.

Tips for libvirt

Connecting to a Remote and NAT-ed Hypervisor

I don’t know how but not only did virt-manager control the remote libvirtd hypervisor but VNC graphical console was also forwarded over the SSH tunnel
Prerequisits:

• RHEL 7
• root user is not permitted SSH login.

Remote Internet Router:

• enable SSH port forwarding from the remote Internet router to the remote hypervisor.

Remote Hypervisor:

• Reference: https://wiki.libvirt.org/page/SSHSetup
  Add the group “libvirt” to your user:
  usermod -a -G libvirt <user>

Uncomment the following 2 lines in /etc/libvirt/libvirtd.conf

unix_sock_group = "libvirt"  
unix_sock_rw_perms = "0770"
systemctl restart libvirtd

Local Graphical Desktop
Load you SSH key for the remote account and test connectivity:

ssh-add <ssh_private_key>
ssh -p <port> <user>@<ip>

Close the SSH session if you want to when you are happy it works correctly.

Start virt-manager with a connection to the remote hypervisor:

• virt-manager -c qemu+ssh://@:/system

---

Written with StackEdit.

Start Stop Zoneminder with systemd timers

Zoneminder records forever as soon as it starts.  For me, I only wanted the backyard monitored in the afternoon/evenings.  This gets real easy as I am using the webcam built into an old laptop running on RHEL 7.

# cat /usr/lib/systemd/system/zoneminder.timer
[Unit]
Description=Start the zoneminder service each day.

[Timer]
OnCalendar=*-*-* 16:00:00
AccuracySec=24h
Persistent=true

[Install]
WantedBy=timers.target

# cat /usr/lib/systemd/system/zoneminder.service

# ZoneMinder systemd unit file for CentOS 7

[Unit]
Description=ZoneMinder CCTV recording and security system
After=network.target mariadb.service httpd.service
Requires=mariadb.service httpd.service
Conflicts=zoneminder-off.service
[Service]
User=apache
Group=apache
Type=forking
ExecStart=/usr/bin/zmpkg.pl start
ExecReload=/usr/bin/zmpkg.pl restart
ExecStop=/usr/bin/zmpkg.pl stop
PIDFile=/var/run/zoneminder/zm.pid
Environment=TZ=/etc/localtime
RuntimeDirectory=zoneminder
RuntimeDirectoryMode=0755

[Install]
WantedBy=multi-user.target

# cat /usr/lib/systemd/system/zoneminder-off.timer
[Unit]
Description=Stop the zoneminder service each day.

[Timer]
OnCalendar=*-*-* 23:00:00
AccuracySec=24h
Persistent=true

[Install]
WantedBy=timers.target

# cat /usr/lib/systemd/system/zoneminder-off.service
[Unit]Description=Conflict service to cause ZoneMinder to shutdown.

[Service]
Type=oneshot
ExecStart=/bin/echo 'Starting zoneminder-off should shutdown zoneminder.'
ExecReload=/bin/echo 'Reloading zoneminder-off does nothing.'
ExecStop=/bin/echo 'Stopping zoneminder-off does nothing as it is oneshot.'
PIDFile=/var/run/zoneminder/zm-off.pid

[Install]
WantedBy=multi-user.target


# systemctl daemon-reload
# system enable zoneminder.timer zoneminder.service zoneminder-off.timer zoneminder-off.service
# systemctl start zoneminder.timer zoneminder-off.timer

pfSense vs Game Consoles

pfSense's NAT is a bit too secure for games consoles such as PS3, PS4, Wii-U and Switch.  It is pfSense's default behavior of randomising the outbound ports that is confusing some of our network orientated games.

Reference:

• https://forum.pfsense.org/index.php?topic=126746.0

Create an Outbound NAT Entry

I have five gaming consoles so I have assigned static IPs to each (via DHCP static mappings) and created an individual outbound port rule for each console.  The must do aspect is ticking the Static Port option when creating the rule.

By creating specific rules for the game console the connections from other devices in the house (TVs, computers, smart devices) continue to be randomised.

Review the OutBound NAT Entries

Note the tick for each console in the Static Port column. 

UPNP is not Required

UPNP appears to be a distraction in the forums and is not required in my experience.  Set up UPNP access for use by specific devices only:

• https://www.reddit.com/r/PFSENSE/comments/2uc645/need_help_getting_open_nat_on_ps4/

Configure Bash Prompt for Git

 git-prompt.sh script shipped with the git package. Add the following lines to your ~/.bashrc file.


source /usr/share/git-core/contrib/completion/git-prompt.sh
export GIT_PS1_SHOWDIRTYSTATE=true
export GIT_PS1_SHOWUNTRACKEDFILES=true
export PS1='[\u@\h \W$(declare -F __git_ps1 &>/dev/null && __git_ps1 " (%s)")]\$ '

For a fancy coloured prompt try this:export $PS1='\[\033[0;32m\]✔\[\033[0;0m\] \[\033[0;33m\]\w\[\033[0;0m\] [\[\033[0;35m\]${GIT_BRANCH}\[\033[0;0m\]|\[\033[0;34m\]✚ 10\[\033[0;0m\]\[\033[0;36m\]…26\[\033[0;0m\]\[\033[0;0m\]] \n\[\033[0;37m\]$(date +%H:%M)\[\
033[0;0m\] $ '