Tag: rhel

list all versions of an available package using yum/dnf

dnf list <packagename> --showduplicates

Example:

[ec2-user@ip-172-31-39-90 ~]$ sudo dnf list kmod-kvdo --showduplicates

 Updating Subscription Management repositories.
 Unable to read consumer identity
 This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
 Last metadata expiration check: 0:04:00 ago on Thu 03 Jun 2021 23:54:45 UTC.
 Available Packages
 kmod-kvdo.x86_64  6.2.0.293-50.el8  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.0.293-52.el8_0  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.0.293-53.el8_0  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.1.138-57.el8  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.1.138-58.el8_1  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.2.117-65.el8  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.3.114-74.el8  rhel-8-baseos-rhui-rpms
 kmod-kvdo.x86_64  6.2.4.26-77.el8  rhel-8-baseos-rhui-rpms

[ec2-user@ip-172-31-39-90 ~]$

4 June 2021

selinux prevents mounted directories for serving content for httpd
error message
```
(13)Permission denied: [client <ipaddress>:<port>] AH00035: access to /index.html denied (filesystem path '/opt/rh/httpd24/root/var/www/html/index.html') because search permissions are missing on a component of the path
```
fix

run this on the host directory serving the content
```
chcon  --user system_u --type httpd_sys_content_t -Rv <dir>
```
if you’ve worked with selinux before, you will realise that chcon is a temporary but a faster way to apply contexts to a file. they will be reset in the next relabel. good to use in places where you do not care too much, for example containers.

if you wish to apply contexts to the file/directory permanently, probably to a directory which is being shared by several containers, file servers, where it doesn’t make much sense to have an extra command to set the security context each time a new container is spun up, then use the following command. you run it one time, and the virtual machines or containers will be able to serve the content correctly.
```
semanage fcontext -a -s system_u -t httpd_sys_content_t <dir>
```
the above command will make an entry for the file’s context in the /etc/selinux/targeted/contexts/files/file_contexts.local file, which is used to relabel the files in the future. the above command does not apply the context immediately. you will have to do it manually.
```
restorecon -RvF <dir>
```
reason

selinux needs the correct context to serve the content

courtesy –

https://superuser.com/questions/882594/permission-denied-because-search-permissions-are-missing-on-a-component-of-the-p

https://unix.stackexchange.com/questions/297701/how-to-label-a-newly-created-file-with-system-u
12 January 2021

setup and use nfs server on rhel 8

default nfs version in rhel 8 is version 4

install nfs-server

dnf -y install nfs-server nfs-utils

most probably the nfs-utils package is there on your server already.

ensure nfs server starts up automatically

systemctl enable --now nfs-server

firewall stuff

firewall-cmd --add-service=nfs --add-service=rpc-bind --add-servicemountd --permanent

firewall-cmd --reload

add directories to share on the nfs server

file controlling the exports is /etc/exports

check out the man page for exports for more details

man exports

example content for /etc/exports file (pasted from the exports man page)

EXAMPLE
# sample /etc/exports file
/               master(rw) trusty(rw,no_root_squash)
/projects       proj*.local.domain(rw)
/usr            *.local.domain(ro) @trusted(rw)
/home/joe       pc001(rw,all_squash,anonuid=150,anongid=100)
/pub            *(ro,insecure,all_squash)
/srv/www        -sync,rw server @trusted @external(ro)
/foo            2001:db8:9:e54::/64(rw) 192.0.2.0/24(rw)
/build          buildhost[0-9].local.domain(rw)
 

The first line exports the entire filesystem to machines master and trusty.  In addition to write access, all uid squashing is turned off for host trusty. The second and third entry show examples for wildcard hostnames and netgroups (this is the entry `@trusted'). The fourth line shows  the  entry  for the PC/NFS client discussed above. Line 5 exports the public FTP directory to every host in the world, executing all requests under the nobody account. The insecure option in this entry also allows clients with NFS implementations that don't use a reserved port for NFS.  The sixth line exports a directory read-write to the machine 'server' as well as the `@trusted' netgroup, and read-only to netgroup `@external', all three mounts with the `sync' option enabled. The seventh line exports a directory to both an IPv6 and an IPv4 subnet. The eighth line demonstrates a character class wildcard match.

mount nfs shared directories on your machine

you’ve got 2 options – root mount, and directory mount.

root mount – if you mount the / of the nfs server, then all the shared directories with you will appear in this mount.

otherwise you may check what directories are shared with you using:

showmount --exports <server_address>

now mount them individually using the mount command

notes for adding an entry in the fstab

version may be specified using the nfsvers= argument

important – remember to add the _netdev to the options to mount the nfs share after the networking has started on the machine, else…

example /etc/fstab entry for a nfs share

nfshost:/   /nfs-share   nfs   defaults,_netdev   0 0

resolving permissions issue while using nfs

try chown‘ing the nfs shared directories to nobody

monitoring nfs server

nfsstat and nfsiostat

9 January 2021