CentOS - Nov 2019 - Post-installation setup script for CentOS 7 servers

Le 17/11/2019 ? 18:56, Jonathan Billings a ?crit?:
> You should never be using ntpdate anymore (which is why the ntp project is
deprecating it, http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate
<http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate> ).  I really only
ever suggest ntpd unless you?re running an NTP server that provides NTP service
to your network, and needs to supported time source hardware.  NTPd actually
worse for laptops and other devices with intermittent/congested connections, and
VMs that experience time jumps during migrations.  Chrony also tends to use less
RAM and power than NTPd due to how it does time management and generally smaller
footprint.
I know ntpdate has officially been deprecated for ages. This being said,
it works reliable when you have some serious lagging on the server.
> 
>> * firewalld: https://github.com/kikinovak/firewall
<https://github.com/kikinovak/firewall>
> Kinda looks like you?ve reinvented the wheel here, breaking down firewall
rules into separate files and managed by a single service.  Plus, firewalld
supports ipsets along side iptables rules in C7, and uses nftables by default in
C8, keeping you with the fastest way of setting up rules.  But I get it, not
everyone cares for firewalld.  On c6, I managed the iptables file with a
template in configuration management, breaking up the individual config files
into separate, role-based chunks.
This is probably my Slackware background, but for many years,
firewalling was essentially a shell script with iptables rules. From
this point of view, firewalld has reinvented the wheel, so I simply
stick with what works and what I'm familiar with. And since Linux obeys
the Great Rule of Herding Cats, along comes nftables. BTW, the file
snippets are just templates meant to be copy/pasted with Vim using split
mode. :o)

> 
>> * NetworkManager: great on laptops, useless on servers
> Untrue.  NM is great for servers.  I think I?ve told this story a dozen
times on this list, but nearly all our servers use NM.  We experienced a power
outage in our datacenter due to some clumsy UPS maintenance people, and when
power was restored to the floor, the servers booted faster than the networking
equipment.  Everything using the old ?network? service booted up, detected no
network, and gave up and completed the boot, with no network at all.  Had to
visit the datacenter to reboot them.  All the NM systems had the network start
fail, and continued with the boot, and as soon as the interface comes online, NM
brings up the network and triggers all network-dependent services to come
online.
Again, this is probably the ex-Slacker in me throwing all the junk out
and just keeping what's really needed.

Cheers & thanks for your detailed explanations. You've tickled my
curiosity, so as soon as I finish writing my current Linux book (around
X-mas I guess) I'll have a deeper look at all that stuff.

Niki


-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Site : https://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32
Mob. : 06 51 80 12 12

Am 17.11.19 um 23:52 schrieb Nicolas Kovacs:
> 
> Le 17/11/2019 ? 18:56, Jonathan Billings a ?crit?:
>> You should never be using ntpdate anymore (which is why the ntp project
is deprecating it, http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate
<http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate> ).  I really only
ever suggest ntpd unless you?re running an NTP server that provides NTP service
to your network, and needs to supported time source hardware.  NTPd actually
worse for laptops and other devices with intermittent/congested connections, and
VMs that experience time jumps during migrations.  Chrony also tends to use less
RAM and power than NTPd due to how it does time management and generally smaller
footprint.
> 
> I know ntpdate has officially been deprecated for ages. This being said,
> it works reliable when you have some serious lagging on the server.
> 
>>
>>> * firewalld: https://github.com/kikinovak/firewall
<https://github.com/kikinovak/firewall>
>> Kinda looks like you?ve reinvented the wheel here, breaking down
firewall rules into separate files and managed by a single service.  Plus,
firewalld supports ipsets along side iptables rules in C7, and uses nftables by
default in C8, keeping you with the fastest way of setting up rules.  But I get
it, not everyone cares for firewalld.  On c6, I managed the iptables file with a
template in configuration management, breaking up the individual config files
into separate, role-based chunks.
> 
> This is probably my Slackware background, but for many years,
> firewalling was essentially a shell script with iptables rules. From
> this point of view, firewalld has reinvented the wheel, so I simply
> stick with what works and what I'm familiar with. And since Linux obeys
> the Great Rule of Herding Cats, along comes nftables. BTW, the file
> snippets are just templates meant to be copy/pasted with Vim using split
> mode. :o)
> 
> 
>>
>>> * NetworkManager: great on laptops, useless on servers
>> Untrue.  NM is great for servers.  I think I?ve told this story a dozen
times on this list, but nearly all our servers use NM.  We experienced a power
outage in our datacenter due to some clumsy UPS maintenance people, and when
power was restored to the floor, the servers booted faster than the networking
equipment.  Everything using the old ?network? service booted up, detected no
network, and gave up and completed the boot, with no network at all.  Had to
visit the datacenter to reboot them.  All the NM systems had the network start
fail, and continued with the boot, and as soon as the interface comes online, NM
brings up the network and triggers all network-dependent services to come
online.
> 
> Again, this is probably the ex-Slacker in me throwing all the junk out
> and just keeping what's really needed.
> 
> Cheers & thanks for your detailed explanations. You've tickled my
> curiosity, so as soon as I finish writing my current Linux book (around
> X-mas I guess) I'll have a deeper look at all that stuff.
> 
I dont see if it was mentioned; but "network scripts" are deprecated
in
C8. So better start the mental migration today before the packages get 
removed totally :-)

--
Leon

Le 18/11/2019 ? 18:06, Leon Fauster via CentOS a ?crit?:
> I dont see if it was mentioned; but "network scripts" are
deprecated in
> C8. So better start the mental migration today before the packages get
> removed totally :-)
I'll tackle that when I make the move to CentOS 8. For the moment I'm
still with CentOS 7.x.

Cheers,

Niki

-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Site : https://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32
Mob. : 06 51 80 12 12

--On Monday, November 18, 2019 6:06 PM +0100 Leon Fauster via CentOS 
<centos at centos.org> wrote:
> I dont see if it was mentioned; but "network scripts" are
deprecated in
> C8. So better start the mental migration today before the packages get
> removed totally :-)
What file holds all those settings, now? As a rule, I prefer to edit text 
files to finding the right GUI/TUI utility to muck with them. I'd also like 
to know how the new and old files interact.

On Sun, Nov 17, 2019, 2:52 PM Nicolas Kovacs <info at microlinux.fr>
wrote:
>
>
> Cheers & thanks for your detailed explanations. You've tickled my
> curiosity, so as soon as I finish writing my current Linux book (around
> X-mas I guess) I'll have a deeper look at all that stuff.
>

So you're writing a book on how Linux used to be?
>

Le 18/11/2019 ? 19:59, John Pierce a ?crit?:
> So you're writing a book on how Linux used to be?
Here you go:

https://www.microlinux.fr/wp-content/uploads/2019/07/administration-linux-par-la-pratique-tome-1-table-des-matieres.pdf

Currently putting the finishing touches to vol. 2 (SELinux, CentOS on
routerboards & on public root servers in France, Dnsmasq, BIND, MariaDB,
Apache, Postfix, Dovecot, Roundcube, OwnCloud, Rsnapshot, Squid, 389
Directory Server, NFS, Samba, ...)

Cheers,

Niki

-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Site : https://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32
Mob. : 06 51 80 12 12