Outils pour utilisateurs

Outils du site


blog

Notes LVM

Voir :

lv_attrs

man 8 lvs

Extents are the smallest units of space that you can allocate in LVM. Physical extents (PE) and logical extents (LE) has the default size of 4 MiB that you can configure. All extents have the same size. When you create a logical volume (LV) within a VG, LVM allocates physical extents on the PVs

Création LVs

lvcreate -l 100%FREE -n newlv vg_data

Script - get size lv_size & vgfree space

lvs --readonly --noheadings --nosuffix --units=m /dev/mapper/applivg-lv_plop -o lv_size
vgs --readonly --noheadings --nosuffix --units=m applivg -o vgfree

Pb

# pvcreate /dev/sda3
  Device /dev/sda3 not found (or ignored by filtering).
# pvcreate -vvv /dev/sda3 2>&1 | grep '/dev/sda3'
        /dev/sda3: Skipping: Too small to hold a PV

Tags

vgchange --deltag T9 --deltag T10 --addtag T13 --addtag T14 grant
 
pvs -o pv_tags /dev/sda2
vgs -o vg_tags /dev/VolGroup00
lvs -o lv_tags /dev/VolGroup00/LogVol00

Use the following command to list all the logical volumes with the database tag

lvs @database

Use the following command to list the currently active host tags

lvm tags

Autres

Resize the PV when some data was allocated at the end of the LVM.

pvs -v --segments /dev/sda5
pvmove --alloc anywhere /dev/sda5:yyyy-end
pvs -v --segments /dev/sda5
2025/03/24 15:06

Notes luks cryptsetup

Voir aussi :

Add a new passphrase

cryptsetup luksAddKey /dev/nvme0n1p3
cryptsetup luksDump /dev/sda2

Upgrade your LUKS key derivation function

Source :

lsblk
sudo cryptsetup luksHeaderBackup /dev/whatever --header-backup-file /tmp/luksheader

Copy that to a USB stick or something. If something goes wrong here you'll be able to boot a live image and run

sudo cryptsetup luksHeaderRestore /dev/whatever --header-backup-file luksheader

to restore it.

(Edit to add: Once everything is working, delete this backup! It contains the old weak key, and someone with it can potentially use that to brute force your disk encryption key using the old KDF even if you've updated the on-disk KDF.)

Next, run

sudo cryptsetup luksDump /dev/whatever

and look for the Version: line. If it's version 1, you need to update the header to LUKS2. Run

sudo cryptsetup convert /dev/whatever --type luks2

and follow the prompts. Make sure your system still boots, and if not go back and restore the backup of your header. Assuming everything is ok at this point, run

sudo cryptsetup luksDump /dev/whatever

again and look for the PBKDF: line in each keyslot (pay attention only to the keyslots, ignore any references to pbkdf2 that come after the Digests: line). If the PBKDF is either pbkdf2 or argon2i you should convert to argon2id. Run the following:

sudo cryptsetup luksConvertKey /dev/whatever --pbkdf argon2id

and follow the prompts. If you have multiple passwords associated with your drive you'll have multiple keyslots, and you'll need to repeat this for each password.

Distributions! You should really be handling this sort of thing on upgrade. People who installed their systems with your encryption defaults several years ago are now much less secure than people who perform a fresh install today. Please please please do something about this.

2025/03/24 15:06

Notes LUA

Voir :

Voir aussi :

  • OpenWRT
  • Nginx

FIXME

2025/03/24 15:06

Notes logrotate

Voir :

Voir aussi :

/etc/cron.daily/logrotate

#!/bin/sh
 
/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

Exemple de conf

/opt/atom/apache-tomcat-*/logs/catalina.out
{
	copytruncate
	weekly
	rotate 52
	compress
	missingok
	size 5M
}

/var/log/cups/*_log {
    missingok
    notifempty
    sharedscripts
}

/var/log/dracut.log {
    missingok
    notifempty
    size 30k
    yearly
    create 0600 root root
}

/var/log/clamav/freshclam.log {
        missingok
        notifempty
        create 644 clam clam
} 

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

/var/log/numad.log {
    compress
    copytruncate
    maxage 60
    missingok
    rotate 5
    size 1M
} 

# Rotate OCS Inventory NG agent logs daily, only if not empty
# Save 7 days old logs under compressed mode
/var/log/ocsinventory-agent/*.log {
        daily
        rotate 7
        compress
        notifempty
        missingok
}


/var/account/pacct {
#prerotate loses accounting records, let's no
#   prerotate
#       /usr/sbin/accton
#   endscript
    compress
    delaycompress
    notifempty
    daily
    rotate 31
    create 0600 root root
    postrotate
       /usr/sbin/accton /var/account/pacct
    endscript
} 

/var/log/sssd/*.log {
    weekly
    missingok
    notifempty
    sharedscripts
    rotate 2
    compress
    postrotate
        /bin/kill -HUP `cat /var/run/sssd.pid  2>/dev/null`  2> /dev/null || true
    endscript
} 

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

/var/log/yum.log {
    missingok
    notifempty
    size 30k
    yearly
    create 0600 root root
}

Test

logrotate -df /etc/logrotate.d/plop
2025/03/24 15:06

Notes logiciels réseaux - Software Defined Network SDN - Network Operating System NOS

NOS :

  • Cloonix
  • VyOS (parefeux / firewall routeur)
  • OpenWrt
  • pfSense
  • Junos OS
  • Arista Networks
  • FreshTomato

Voir : https://docs.ansible.com/ansible/latest/network/user_guide/index.html

SDN:

Voir aussi :

Virtual routing and forwarding (VRF)

OpenvSwitch

2025/03/24 15:06
blog.txt · Dernière modification : de 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki