RHEL 7/Centos 7 Installation: Difference between revisions
| Line 216: | Line 216: | ||
==ssh Configuration== | ==ssh Configuration== | ||
===Configure ssh to Start on an Arbitrary Port=== | ===Configure ssh to Start on an Arbitrary Port=== | ||
{{Internal|Sshd_Configuration#Change_the_Default_Port|Change the Default ssh Port}} | |||
===Install a Public Key for Faster Access=== | ===Install a Public Key for Faster Access=== | ||
Install a public key in .ssh/authorized_keys. | Install a public key in .ssh/authorized_keys. | ||
Revision as of 21:45, 17 November 2021
External
- Red Hat Enterprise Linux 7 Installation Guide: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/index.html
Internal
Overview
This installation procedure has been tested on bare metal (ThinkPad laptops) and on VirtualBox VMs, with Red Hat 7.2 DVD and Centos 7 DVD. The sections that refer to non-virtualized installation are prefixed with Bare Metal and indented. The sections that refer to virtualized installation are prefixed with VirtualBox and indented.
If you need to create a VirtualBox virtual machine, start from here
DVD
Download the RHEL 7 Binary DVD from https://access.redhat.com.
Download Centos 7 Binary ISO DVD https://www.centos.org/download/
Procedure
Create a Bootable USB and Boot with the Image USB
Use:
fdisk -l
or
mount
to list disk devices and identify the correct USB device to use. Then:
dd if=yyyy.iso of=/dev/xxxx
Boot with the Image DVD
Install Red Hat Enterprise Linux 7.2 ... Starting installer, one moment.
Welcome to Red Hat Enterprise Linux 7.2
What language would you like to use during the installation process? English -> English (United States) -> Continue
Installation Summary
First go to "Network & Host Name" to set external access.
Network & Host Name
Turn wireless off.
Virtual Box
- If the hardware configuration was done according to the VirtualBox Linux VM Creation procedure, the NAT adapter is eth1. Turn it "ON" (upper right "button"). This is the VirtualBox NAT network interface, so it should get an IP address from its DHCP server and allow immediate external connectivity during the installation. The interface should show "Connected", get a valid IP address (example IP address 10.0.3.15, default route 10.0.3.2, DNS: a valid DNS or your local router). Then go to eth0 and turn it ON.
Bare Metal
- Turn ethernet (eth0, enp0s25, em1, etc.) ON.
Main Network Interface - Common Configuration Procedure
"Configure..."
General
Automatically connect to this network when it is available.
All users may connect to this network.
Ethernet
Device: eth0/enp0s25/em1
MTU: automatic
Wake on LAN: Ignore
IPv4 Settings
Method: Manual
Addresses: Add
Virtual Box
Pick addresses from the same network the host-only interface belongs to. If you do so, you will avoid complications related to need to add extra routing on the host. For more details, see:
A spreadsheet with currently allocated addresses is available in .../VirtualBox VMs/IP Addresses.xlsx.
Address 172.20.x.x, Netmask 255.255.0.0, Gateway: leave empty. If you plan to use previously created VMs from the same subnet at the same time, pick IP addresses that do not overlap.
Note that the IP address does NOT have to be in the same subnet as the host-only network defined earlier. However, in this case, you will need to configure extra routing, so it's a good idea to stick to that network.
Make sure to Save.
Bare Metal
- Address 192.168.1.8, Netmask 255.255.255.0, Gateway: 192.168.1.1, DNS servers: 192.168.1.1
Make sure you Save.
Connect automatically after reboot
Yes
Apply configuration in installer
Yes
Host Name
DO NOT FORGET
Go to "Host name".
Virtual Box
- Specify the local host name: openshift-master1. If you are planning to use a local DNS server, specify openshift-master1.openshift.local
Bare Metal
- now510.local
Done.
Date & Time
Time Zone.
Network Time: ON
Done.
For a list of NTP Servers see:
Keyboard
English(US)
Installation Source
Local media
Software Selection
Minimal Install
Installation Destination
Virtual Box
- Select the ATA VBOX HARDDISK. You may go for "Automatically configure partitioning" or if you don't want a root and a home partition, choose "I will configure partitioning" and go to Manual Partitioning.
Bare Metal
- If the disk was previously partitioned and want to delete the previous partitions: Partitioning -> Automatically configure partitioning, check "I would like to make additional space available" -> Delete All -> Reclaim Space. If you don't want a root and a home partition, choose "I will configure partitioning" and go to Manual Partitioning.
Done.
The top level menu should show Automatic partitioning selected.
Manual Partitioning
"Click here to create them automatically". This will give a reasonable starting point.
Make sure new mount points will use the following partitioning scheme: LVM.
Simplest configuration:
- "/boot", capacity 500 MiB, device type: Standard Partition, file system "xfs"
- "/", capacity 3140 MiB, device type: LVM, file system xfs, volume group: rhel_lb, name: root
- swap, capacity 409.6 MiB, device type: LVM, file system swap, volume group: rhel_lb, name: swap
Done
For an example of partitioning used for a virtualization host, see RHEL7 Virtualization Host Installation - Storage Provisioning.
Kdump
Disable.
Begin Installation
Begin Installation
User Settings
Root password.
Create users as necessary, depending on the purpose of the box (openshift, wiki, etc)
You may also want create a service user with same name as the machine's.
If you create a service user, go to Advanced and add it to its own group.
Capture credentials in the standard location (Contacts for the host in question).
Reboot
Will eject the DVD by itself.
After reboot, the host should be available for ssh.
Post-Install Tasks
ssh Configuration
Configure ssh to Start on an Arbitrary Port
Install a Public Key for Faster Access
Install a public key in .ssh/authorized_keys.
Turn off ssh DNS Resolution
Enable Network Interfaced to Start at Boot
Sometimes the NAT network interface comes disabled at boot. Set ONBOOT=yes in /etc/sysconfig/network-scripts/ifcfg-eth1.
Reboot and make sure the interface is correctly initialized, and the virtual machine has external connectivity.
For more details configuring a network interface see:
VMWare Fusion Guest Configuration
VMware Fusion guests that are configured with static addressed also need to be configured with a specific gateway to make them able to establish TCP/IP connections. For more details see:
Register with the Subscription Manager
If this is a supported RHEL system, register it with the subscription manager, this will give access to official repositories for update. Instructions are available here
Update All Installed Packages
yum -y update
Install Packages I Need
yum -y install wget zip unzip bind-utils policycoreutils-python net-tools
policycoreutils-python is needed for semanage. See
Configuration
Resolve the Host Name in /etc/hosts
Execute
hostname
and update /etc/hosts to resolve the host name to the main (business) interface of the host.
... 192.168.1.8 now510.local now510
Disable the Network Manager
For hosts on which the configuration is static, disable the Network Manager. Note that if you plan to run OpenShift on this host, Nework Manager must stay in place.
Turn off firewalld and configure the iptables service
- Usually a new system comes with firewalld enabled. Turn it off. This is how you turn the firewall off and remove it from the system.
- Install the iptables service. This is how to install the iptables service.
- Configure the iptables service (both iptables and ip6tables). This is how to configure the iptables service.
- Reboot to make sure you still have ssh access.
Optionally, add additional IPv4 firewall rules depending on the purpose of the host:
- Allow ssh access only from the internal network on a non-standard port. Note this procedure implies reconfiguring the sshd server at the same time, otherwise we may lose remote access.
- Allow web traffic access.
If IPv6 is not explicitly configured and used, best if you block IPv6 access in firewall: block IPv6 inbound traffic.
For a discussion on iptables service and firewalld, see iptables Concepts.
Configure DNS
Configure Log Rotation
Configure root mail Forwarding
Configure the mail system on the host so it can send mail.
Forward root's mail to an account that is read regularly.
See:
Security Hardening
Configure the Host as a NFS Client
This is an optional step.
Enable Multicast
This is an optional step.
Prevent the Computer to Go to Sleep when the Lid is Closed
For laptops only.
Other Optional Settings
Reboot
Reboot one more time, to make sure the system starts after patching and configuration:
init 0
Bare Metal
- Start the system from the power button.
VirtualBox
- Start the system from the VirtualBox console. Start -> Headless start.
Next Steps
VirtualBox
- Continue VirtualBox Installation. If installing in VirtualBox, go back to the VirtualBox guest additions installation procedure.