17 KiB
17 KiB
Beelink
Ubuntu and Docker End of July 2024
authorized_keys
sudo -i
cat /root/.ssh/authorized_keys
nano /root/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7khmvc9lTWHALZ/IOMcJNz/1SuvrU53fI43v4PxIJN # 92532396 2023-12-27 mikep@DESKTOP-VP94SPB
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGq7b8qtm4fgNxW2lxm+qoxm8Wz7+1uhLQCg7xSlKYL1 # 92683771 2024-01-01 mikep@DESKTOP-BMV4V66
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqLFW9kYMp9lOTXXYafxLiUADFFKeM5KDzt02E3XeRP # 92691378 2024-01-01 cphar@DESKTOP-KA0LMMJ
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBkS+uvWevmhYNos6MJKVi2auAx6x+xlyOnnvbdEstsz # 92797978 2024-01-03 mikep@DESKTOP-GNECR7R
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKf5fo63+vyYa8E06+HOPg24e9VMsvv/kBsHKGjBBUyz # 92895319 2024-01-05 mike@mike-B365M-DS3H
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGM6ANLH/4dS0YqlsCyoXkznzkgIsDqCTk3YX01XVWd8 # 92909911 2024-01-06 mikep@DESKTOP-H6JG91B
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOwAv1vrRA29GYL0DFSE8nmD5q3gL+vVtFSwhrXObDo4 # 93288214 2024-01-13 infineon\phares@ISCN5CG3256CPS
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH1xPVOisKwW6Xwo/Yh1kx2smt2HJU2/pRjTJf4KdGXo # 97267150 2024-03-28 mike@mike-Default-string
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDz5WqCKsoaxV+LG/kufLNuiE9K3lqp+B3AqeKXGusX # 97442032 2024-04-01 lphar@DESKTOP-1238PEQ
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID09PhrjIpeNBmUeycnT3xKF8F5TcGL3ZKAvU9YdLj7H # 98747144 2024-04-25 mike@mike-Default-string
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaZyTLpafZta8W8Uv6uWpgbbj4QL5dde9Rlf06PfdYc # 98824914 2024-04-26 k0308@DESKTOP-0UJ8DD5
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFpucyp3FAHn8/9cXvfRegi09DkR6XLugoniEyQ9w0T # 98824924 2024-04-26 mille@DESKTOP-QL2HGEH
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOn/Ptg/k3rOJn32GxrL2J3Bazt/3M9fGWjzP+CW1qXK # 100900455 2024-06-03 lphares0907@penguin
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPMIxGucViHMHFXoM2VBPlvLvMgqNi2BUtTE/D4n778M # 101638217 2024-06-14 mikep@DESKTOP-VVO6KCM
exit
Timezone
timedatectl set-timezone America/Phoenix
date
# Thu Jul 25 04:03:08 PM MST 2024
apt-get update
apt upgrade -y
Create Users
adduser pihole
adduser podman
mkdir /home/podman/.ssh
cp /root/.ssh/authorized_keys /home/podman/.ssh/authorized_keys
chown podman:podman -R /home/podman
#
adduser lphares
#
mkdir /home/lphares/.ssh
cp /root/.ssh/authorized_keys /home/lphares/.ssh/authorized_keys
chown lphares:lphares -R /home/lphares
#
adduser bmiller
#
mkdir /home/bmiller/.ssh
cp /root/.ssh/authorized_keys /home/bmiller/.ssh/authorized_keys
chown bmiller:bmiller -R /home/bmiller
Directory Share
adduser bmiller lphares
sudo usermod -a -G lphares bmiller
newgrp lphares
systemctl restart ssh
Podman Quadlet Rootless Example
apt-get install podman -y
apt-cache rdepends podman-compose
apt-get install podman-compose -y
# apt-get remove podman-compose -y
# apt-get purge podman-compose -y
adduser podman sudo
sudo -iu podman
loginctl enable-linger
# 2.
podman --version
# podman version 4.9.3
# https://www.redhat.com/sysadmin/quadlet-podman
cd ~/
mkdir -p .config/containers/systemd/
nano .config/containers/systemd/mysleep.container
[Unit]
Description=The sleep container
After=local-fs.target
[Container]
Image=registry.access.redhat.com/ubi9-minimal:latest
Exec=sleep 1000
[Install]
# Start by default on boot
WantedBy=multi-user.target default.target
exit
exit
reboot
# cp -R /run/user/0/ /run/user/1002/
mkdir -p /run/user/1002/
chown -R podman:podman /run/user/1002/
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
podman ps -a
systemctl --user daemon-reload
systemctl --user enable --now podman.socket
systemctl --user status mysleep.service
systemctl --user start mysleep.service
exit
reboot
Pi-hole
# https://canyoublockit.com/
adduser pihole
cd /tmp
curl -sSL https://install.pi-hole.net | bash
pihole -a -p 484C889D0ED1EA4AB930AA518FE3B15E
exit
reboot
apt install unbound -y
# https://docs.pi-hole.net/guides/dns/unbound/
nano /etc/unbound/unbound.conf.d/pi-hole.conf
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# May be set to yes if you have IPv6 connectivity
do-ip6: no
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
# Terredo tunnels your web browser should favor IPv4 for the same reasons
prefer-ip6: no
# Use this only when you downloaded the list of primary root servers!
# If you use the default dns-root-data package, unbound will find it automatically
#root-hints: "/var/lib/unbound/root.hints"
# Trust glue only if it is within the server's authority
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no
# Reduce EDNS reassembly buffer size.
# IP fragmentation is unreliable on the Internet today, and can cause
# transmission failures when large DNS messages are sent via UDP. Even
# when fragmentation does work, it may not be secure; it is theoretically
# possible to spoof parts of a fragmented DNS message, without easy
# detection at the receiving end. Recently, there was an excellent study
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
# in collaboration with NLnet Labs explored DNS using real world data from the
# the RIPE Atlas probes and the researchers suggested different values for
# IPv4 and IPv6 and in different scenarios. They advise that servers should
# be configured to limit DNS messages sent over UDP to a size that will not
# trigger fragmentation on typical network links. DNS servers can switch
# from UDP to TCP when a DNS response is too big to fit in this limited
# buffer size. This value has also been suggested in DNS Flag Day 2020.
edns-buffer-size: 1232
# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
num-threads: 1
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
so-rcvbuf: 1m
# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
service unbound restart
nano /etc/lighttpd/lighttpd.conf
...
server.port = 8005
...
pihole -up
service lighttpd restart
dig fail01.dnssec.works @127.0.0.1 -p 5335
dig dnssec.works @127.0.0.1 -p 5335
exit
reboot
Log
ln -s /var/log/nginx /var/www/html/log-nginx
ls -la /var/www/html
exit
cp ~/.bash_history /etc/bash_history_2024-07-25.txt
cat /etc/bash_history_2024-07-25.txt
exit
apt install smartmontools
smartctl -i /dev/sda
Device Model: minisforum
Serial Number: L9MLCHC11280472
LU WWN Device Id: 0 000000 000000000
Firmware Version: SBFMJ1.3
User Capacity: 256,060,514,304 bytes [256 GB]
Sector Size: 512 bytes logical/physical
Rotation Rate: Solid State Device
Form Factor: M.2
TRIM Command: Available
Device is: Not in smartctl database 7.3/5528
ATA Version is: ACS-4 (minor revision not indicated)
SATA Version is: SATA 3.2, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is: Thu Jul 25 16:38:33 2024 MST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
Dashkiosk
apt install snapd -y
apt install sudo links unzip nginx git nano ncdu -y
snap install dashkiosk
snap install ubuntu-frame wpe-webkit-mir-kiosk
snap set wpe-webkit-mir-kiosk daemon=true
snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver
exit
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
# ^C
/snap/wpe-webkit-mir-kiosk/current/bin/setup.sh
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
# ^C
snap set ubuntu-frame daemon=true
exit
reboot
Podman Verify
# apt install systemd-container -y
# machinectl --help
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
podman ps -a
systemctl --user daemon-reload
podman image prune
podman volume prune
podman container prune
chown -R podman:podman /home/podman/.config/containers/systemd/
rm -R /home/podman/.config/containers/systemd/*.ignore
rm -R /home/podman/.config/containers/systemd/*.volume
rm -R /home/podman/.config/containers/systemd/*.container
Free File Sync - * Select - A
# sftp://root@free.file.sync.root/etc|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\etc
Backup
- Rescuezilla Fri Jul 26 2024 10:45:27 GMT-0700 (Mountain Standard Time)
Restore
- Rescuezilla Fri Jul 26 2024 10:45:27 GMT-0700 (Mountain Standard Time)
Disable IPv6 (Move up next time!!!)
# https://intercom.help/privatevpn/en/articles/6440374-how-to-disable-ipv6-on-ubuntu-and-fedora-linux
nano /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
sysctl -p
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
exit
reboot
nano /etc/default/grub
# https://opensource.com/article/22/8/disable-ipv6
# GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1 quiet splash"
# GRUB_CMDLINE_LINUX=""
GRUB_CMDLINE_LINUX="ipv6.disable=1"
grub-mkconfig
exit
reboot
Fix Unbond (Move up next time!!!)
service unbound restart
# http://beelink:8005/admin/settings.php?tab=dns
# https://docs.pi-hole.net/guides/dns/unbound/#configure-pi-hole
127.0.0.1#5335
journalctl -fu unbound-resolvconf.service
systemctl disable --now unbound-resolvconf.service
service unbound restart
Cockpit (Move up next time!!!)
# apt install chkservice -y
apt-cache rdepends cockpit
apt install cockpit -y
passwd phares
# https://192.168.11.2:9090
# https://blog.while-true-do.io/podman-web-ui-via-cockpit/
apt-get install cockpit cockpit-podman -y
systemctl enable --now cockpit.socket
Podman Create
# apt install systemd-container -y
# machinectl --help
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
podman ps -a
systemctl --user daemon-reload
podman pull docker.io/dpage/pgadmin4:latest
podman pull docker.io/gitea/act_runner:nightly
podman pull docker.io/gitea/gitea:latest
podman pull docker.io/library/postgres:13
podman pull docker.io/library/postgres:14
podman pull docker.io/library/postgres:16
podman pull docker.io/library/postgres:16
podman pull docker.io/library/redis:6.2-alpine@sha256:d6c2911ac51b289db208767581a5d154544f2b2fe4914ea5056443f62dc6e900
podman pull docker.io/odoo:15.0
podman pull docker.io/odoo:16.0
podman pull docker.io/vaultwarden/server:latest
podman pull ghcr.io/immich-app/immich-machine-learning:release
podman pull ghcr.io/immich-app/immich-server:release
# sftp://root@free.file.sync.root/home/podman|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\home\podman
# ... .service is transient or generated.
# WantedBy=multi-user.target
systemctl --user daemon-reload
systemctl --user start gitea-db
# systemctl --user start gitea-runner
systemctl --user start gitea-server
systemctl --user start immich-db
systemctl --user start immich-learning
systemctl --user start immich-redis
# systemctl --user start immich-server
systemctl --user start odoo-db
systemctl --user start odoo-server
systemctl --user start pgadmin
systemctl --user start vaultwarden-server
podman ps -a --sort names
smartctl -i /dev/sda
Device Model: 256GB SSD
Serial Number: CM42ABH1005410
LU WWN Device Id: 5 3a5a27 0100c22ca
Firmware Version: SN11842
User Capacity: 256,060,514,304 bytes [256 GB]
Sector Size: 512 bytes logical/physical
Rotation Rate: Solid State Device
Form Factor: M.2
TRIM Command: Available, deterministic, zeroed
Device is: Not in smartctl database 7.3/5528
ATA Version is: ACS-4 (minor revision not indicated)
SATA Version is: SATA 3.2, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is: Fri Jul 26 11:55:12 2024 MST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
Copy Slideshow Photos
lvs -a
lsblk -I 8 -o NAME,SIZE,TYPE,FSUSED,FSUSE%
mkdir /mnt/usb
mount /dev/sdb2 /mnt/usb
# cp -R ... ...
# sftp://root@free.file.sync.root/mnt/usb/var/www/html/Images-c9dbce3b-Results/thumbs|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# sftp://root@free.file.sync.root/var/www/html/Images-c9dbce3b-Results/thumbs|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
OS-var-thumbs-server 7/26/2024 11:59:57 AM
Completed successfully
Warnings: 2
Items processed: 156,388 (35.7 GB)
Total time: 01:31:53
Errors and warnings:
11:59:58 AM Warning: The following folders do not yet exist:
sftp://root@free.file.sync.root/var/www/html/Images-c9dbce3b-Results/thumbs
The folders are created automatically when needed.
12:00:30 PM Warning: Database file is not av
umount /mnt/usb
# http://192.168.11.2:9400/admin
# Slideshow
# http://127.0.0.1:8080/slideshow/index.html?nocache=2024-07-01-11-36
# Local
# http://192.168.11.2:8080/slideshow/index.html?nocache=2024-07-01-11-36
Free File Sync - * Select - B
# sftp://root@free.file.sync.root/etc|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\etc
cp ~/.bash_history /etc/bash_history_2024-07-26.txt
exit
reboot
Backup
- Rescuezilla Fri Jul 26 2024 13:35:04 GMT-0700 (Mountain Standard Time)
Common
nginx -t
nginx -s reload
cat /etc/crontab
systemctl restart nginx
cat /etc/ssh/sshd_config
lsof -i -P -n | grep LISTEN
netstat -tulpn | grep LISTEN
lsblk -I 8 -o NAME,SIZE,TYPE,FSUSED,FSUSE%
(echo >/dev/tcp/localhost/5433) &>/dev/null && echo "Open 5433" || echo "Close 5433"