Allow yourself to use virtual machines without using root account. Useful if sshing in from another virt-manager (see annex).
sudo nano /etc/polkit-1/rules.d/80-libvirt.rules
Install zfs. Enabling zfs-testing was necessary at the time of writing.
sudo yum install zfs
Enable zfs services:
sudo systemctl enable zfs-import-cache zfs-import-scan zfs-import.target zfs-mount zfs-share zfs-zed zfs.target
Suggestions on how to create your delicious zpool.
sudo zpool create bread /dev/loop9
sudo zpool create bread /dev/mapper/luks-blahblah
sudo zpool create bread /dev/vdb
Create zfs partiton as desired and take ownership of it.
sudo zfs create bread/qresearch
sudo zfs set compression=on bread/qresearch
sudo zfs set dedup=on bread/qresearch
sudo zfs set snapdir=visible bread/qresearch
sudo chown 1000:1000 /bread/qresearch -R
(Take note the lack of the trailing slash. This seems to own the folder and everything in it versus only owning the files in it.)
Recommended: Install and configure sanoid for auto snapshoting.
sudo yum install perl-Config-IniFiles git
cd /opt/
sudo git clone https:// github.com/jimsalterjrs/sanoid
sudo ln /opt/sanoid/sanoid /usr/sbin/
sudo mkdir -p /etc/sanoid
sudo cp /opt/sanoid/sanoid.conf /etc/sanoid/sanoid.conf
sudo cp /opt/sanoid/sanoid.defaults.conf /etc/sanoid/sanoid.defaults.conf
sudo nano /etc/sanoid/sanoid.conf (see annex)
sudo nano /etc/crontab
*/5 * * * * root /usr/sbin/sanoid –cron #Add to bottom
Secure rsync copy from one to another.
rsync -avzhe ssh /stuff/mountable/bread.qcow2 owner@backend:/var/lib/libvirt/images/bread.qcow2 –progress
Enable rc.local service if mounting image file at boot (see annex).
sudo nano /etc/rc.d/rc.local
sudo chmod +x /etc/rc.d/rc.local
sudo systemctl enable rc-local
Optional: Set up samba server. Do note that the ssh server also acts as a file server.
sudo yum install samba
sudo nano /etc/samba/smb.conf
sudo smbpasswd -a owner
sudo sebool -P samba_enable_home_dirs on
semanage fcontext –at samba_share_t "/bread(/.*)?"
restorecon /bread
sudo systemctl enable smb
sudo systemctl enable nmb
PROTIP: Use virt-manager to create qcow2 files. Use gnome-disks to mount image files temporarily.
PROTIP: Gnome-disks can also be used to create encrypted containers, and to manage an entries’ fstab and crypttab setup
PROTIP: Use scap workbench to analyze your system for DISA-STIG compliance. Deviate as appropriate. Review that and NSA Guide to RHEL 5 and you will quickly become more knowledgeable than the experts who pay thousands of dollars for courses and certifications.
PROTIP: Use a wired keyboard for typing luks passwords on a workstation. On a laptop, disconnect the power cord before typing in luks password.
PROTIP: Seriously if using DISA-STIG edit your issue file. IT IS NOT GOOD TO PRETEND TO BE THE GOVERNMENT WHILE VISITING THIS PART OF THE INTERNET!
PROTIP: Never trust someone who tells you to disable selinux. That’s no good.