在ubuntu 設定 apache2 的SSL
安裝OpenSSL
sudo apt install openssl
啟用Apache2的SSL模組
sudo a2enmod ssl
把憑証放到以下目錄
/etc/pki/tls/certs
修改
/etc/apache2/sites-available/default-ssl.conf
SSLCertificateFile /etc/pki/tls/certs/server.cer
SSLCertificateKeyFile /etc/pki/tls/certs/server.key
cd /etc/apache2/sites-enabled
ln -s ../sites-available/default-ssl.conf
systemctl restart apache2
https://20.65.210.123/index.php/2021/05/12/ubuntu-apache-ssl/
最近要求要把所有的網站改成 https
以 centos 7 apache 為例
首先取得憑証
因為單位有買整個domain的
所以直接拿來用
把憑証放到以下目錄
/etc/pki/tls/certs
安裝 mod_ssl
$ yum -y install mod_ssl
$ vi /etc/httpd/conf.d/ssl.conf
修改以下二行
SSLCertificateFile /etc/pki/tls/certs/server.cer
SSLCertificateKeyFile /etc/pki/tls/certs/server.key
重新啟動 Apache
$ systemctl restart httpd.service
若使用nginx
修改 /etc/nginx/nginx.conf 加入以下藍色設定
server {
listen 80 default_server;
listen [::]:80 default_server;
# 加入 SSL 設定
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
# 憑證與金鑰的路徑
ssl_certificate /etc/pki/tls/certs/server.cer;
ssl_certificate_key /etc/pki/tls/certs/server.key;
# ...
}
systemctl restart nginx
https://blog.gtwang.org/linux/nginx-create-and-install-ssl-certificate-on-ubuntu-linux/
proxmox 升到7後
LXC的 Centos 7 無法開机 出現以下錯誤
WARN: old systemd (< v232) detected, container won't run in a pure cgroupv2 environment! Please see documentation -> container -> cgroup version.
TASK WARNINGS: 1
解決方法如下
vi /etc/default/grub
I changed this line from,
GRUB_CMDLINE_LINUX_DEFAULT="quiet"
to
GRUB_CMDLINE_LINUX_DEFAULT="systemd.unified_cgroup_hierarchy=0 quiet"
更新grub
update-grub
重開機
https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#sysboot_edit_kernel_cmdline
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0#Old_Container_and_CGroupv2
https://pve.proxmox.com/pve-docs/chapter-pct.html#pct_cgroup_compat
https://forum.proxmox.com/threads/unified-cgroup-v2-layout-upgrade-warning-pve-6-4-to-7-0.92459/
記錄一下在 ubuntu 20.04 (LXC) 安裝nfsen
OS布署完成後先update
apt update
apt upgrade -y
再來修改時區
timedatectl set-timezone Asia/Taipei
安裝所需 package
apt install -y nfdump rrdtool librrd-dev librrds-perl librrdp-perl libpcap-dev php php-common libsocket6-perl apache2 libapache2-mod-php libmailtools-perl libio-socket-ssl-perl
下載 nfsen
從官方下載的版本在安裝時會出現以下的 bug
Can't use string ("live") as a HASH ref while "strict refs" in use at libexec/NfProfile.pm line 1238.
因此從 https://github.com/p-alik/nfsen/releases/tag/nfsen-1.3.8 下載已修正版本
下載後解壓縮
cd nfsen-nfsen-1.3.8/etc
cp nfsen-dist.conf nfsen.conf
決定安裝路徑在 /opt/nfsen
修改 nfsen.conf
$BASEDIR = "/opt/nfsen";
$PREFIX = '/usr/bin/';
$USER = "www-data";
$WWWUSER = "www-data";
$WWWGROUP = "www-data";
%sources = ( 'upstream1' => {'port'=>'9995','col'=>'#0000ff','type'=>'netflow'}' );
mkdir /opt/nfsen
mkdir /var/www/html/nfsen
adduser netflow
安裝
./install.pl ./etc/nfsen.conf
出現
RRD version '1.7002' not yet supported!
需修改 libexec/NfSenRRD.pm 約在第 76 行 改成 ==> $rrd_version >= 1.2 && $rrd_version < 1.9
再執行一次
./install.pl ./etc/nfsen.conf
啟動
/opt/nfsen/bin/nfsen start
設定開几啟動
cd /etc/systemd/system
ln -s /lib/systemd/system/rc-local.service
vi /etc/rc.local
#!/bin/sh -e
/usr/local/nfsen/bin/nfsen start
exit 0
chmod +x /etc/rc.local
設定開几不啟動nfdump 因為nfsen啟動時會自行呼叫
systemctl disable nfdump.service
重開几
設定 netflow 導到 udp 9995
打開 http://nfsen_ip/nfsen/nfsen.php 確認是否正常
https://sc8log.blogspot.com/2017/06/ubuntu-1604-netflow.html
https://github.com/p-alik/nfsen/releases/tag/nfsen-1.3.8
https://github.com/p-alik/nfsen/issues/1
https://zoomadmin.com/HowToInstall/UbuntuPackage/libsocket6-perl
proxmox 升到7後
centos 7 的 LXC 無法開几
出現以下訊息
WARN: old systemd (< v232) detected, container won't run in a pure cgroupv2 environment! Please see documentation -> container -> cgroup version.
以下連結提供解決方法
不過還是建議升級到centos 8
https://forum.proxmox.com/threads/unified-cgroup-v2-layout-upgrade-warning-pve-6-4-to-7-0.92459/
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0#Old_Container_and_CGroupv2
https://pve.proxmox.com/pve-docs/chapter-pct.html#pct_cgroup_compat
在proxmox上的LXC一直有個問題 今天終於解決了
記錄一下
當部屬完LXC要更新時出現以下的情況
#dnf -y update
Extra Packages for Enterprise Linux 8 - Next - x86_64 0.0 B/s | 0 B 00:00
Errors during downloading metadata for repository 'epel-next':
- Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=epel-next-8&arch=x86_64&infra=stock&content=centos [Could not resolve host: mirrors.fedoraproject.org]
Error: Failed to download metadata for repo 'epel-next': Cannot prepare internal mirrorlist: Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=epel-next-8&arch=x86_64&infra=stock&content=centos [Could not resolve host: mirrors.fedoraproject.org]
檢查一下 /etc/resolv.conf
cat /etc/resolv.conf
# Generated by NetworkManager
search abc.com
發現沒有設定nameserver
可是這個值在佈署LXC時確實有輸入
後來發現可能是 NetworkManager 的問題
導致proxmox 要修改 /etc/resolv.conf 的時候出問題
本來是想直接用 NetworkManager 來處理
直接 nmtui
結果預設沒有安裝
只好再自己裝
# dnf install -y NetworkManager-tui
在 nmtui 裡設定好 nameserver 後重開
在 /etc/resolv.conf 裡還是沒看到 nameserver
手動把nameserver 加入/etc/resolv.conf 也沒用
重開後就會消失了
於是決定把 NetworkManager 停掉
# systemctl stop NetworkManager.service
# systemctl disable NetworkManager.service
再安裝使用 network-scripts
# dnf install -y network-scripts
# systemctl enable network
改完後重開
再看一下 /etc/resolv.conf
# cat /etc/resolv.conf
# --- BEGIN PVE ---
search abc.com
nameserver 8.8.8.8
# --- END PVE ---
醬就正常了
https://forum.proxmox.com/threads/proxmox-6-0-9-dns-host-settings-reset-every-time.59434/
https://www.thegeekdiary.com/how-to-disable-networkmanager-in-centos-rhel-8/
