インストールが完了したので初期設定をしていく。
Contents
パッケージの最新化
Rocky LinuxもRHEL系なのでインストール関連はdnfコマンドで実施
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
# cat /etc/redhat-release Rocky Linux release 8.5 (Green Obsidian) # uname -r 4.18.0-348.el8.0.2.x86_64 # dnf update Last metadata expiration check: 0:13:53 ago on Fri 07 Jan 2022 08:16:43 PM JST. Dependencies resolved. ======================================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================================= Installing: kernel x86_64 4.18.0-348.7.1.el8_5 baseos 7.0 M Upgrading: kernel-tools x86_64 4.18.0-348.7.1.el8_5 baseos 7.2 M kernel-tools-libs x86_64 4.18.0-348.7.1.el8_5 baseos 7.0 M kexec-tools x86_64 2.0.20-57.el8_5.1 baseos 513 k libgcc x86_64 8.5.0-4.el8_5 baseos 78 k libgomp x86_64 8.5.0-4.el8_5 baseos 205 k libsss_autofs x86_64 2.5.2-2.el8_5.3 baseos 117 k libsss_certmap x86_64 2.5.2-2.el8_5.3 baseos 154 k libsss_idmap x86_64 2.5.2-2.el8_5.3 baseos 119 k libsss_nss_idmap x86_64 2.5.2-2.el8_5.3 baseos 126 k libsss_sudo x86_64 2.5.2-2.el8_5.3 baseos 115 k libstdc++ x86_64 8.5.0-4.el8_5 baseos 452 k openssl x86_64 1:1.1.1k-5.el8_5 baseos 708 k openssl-libs x86_64 1:1.1.1k-5.el8_5 baseos 1.5 M python3-perf x86_64 4.18.0-348.7.1.el8_5 baseos 7.1 M rocky-gpg-keys noarch 8.5-3.el8 baseos 12 k rocky-release noarch 8.5-3.el8 baseos 21 k rocky-repos noarch 8.5-3.el8 baseos 14 k selinux-policy noarch 3.14.3-80.el8_5.2 baseos 634 k selinux-policy-targeted noarch 3.14.3-80.el8_5.2 baseos 15 M sssd-client x86_64 2.5.2-2.el8_5.3 baseos 204 k sssd-common x86_64 2.5.2-2.el8_5.3 baseos 1.6 M sssd-kcm x86_64 2.5.2-2.el8_5.3 baseos 253 k sssd-nfs-idmap x86_64 2.5.2-2.el8_5.3 baseos 115 k systemd x86_64 239-51.el8_5.3 baseos 3.6 M systemd-libs x86_64 239-51.el8_5.3 baseos 1.1 M systemd-pam x86_64 239-51.el8_5.3 baseos 476 k systemd-udev x86_64 239-51.el8_5.3 baseos 1.6 M Installing dependencies: kernel-core x86_64 4.18.0-348.7.1.el8_5 baseos 38 M kernel-modules x86_64 4.18.0-348.7.1.el8_5 baseos 30 M xkeyboard-config noarch 2.28-1.el8 appstream 781 k Installing weak dependencies: libxkbcommon x86_64 0.9.1-1.el8 appstream 115 k Transaction Summary ======================================================================================================================================================================= Install 5 Packages Upgrade 27 Packages Total download size: 125 M Is this ok [y/N]: |
必須パッケージインストール
gcc, makeインストール
ソースコンパイル用にgccとmakeをインストール
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
# dnf install gcc make Last metadata expiration check: 0:22:46 ago on Fri 07 Jan 2022 08:16:43 PM JST. Dependencies resolved. ======================================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================================= Installing: gcc x86_64 8.5.0-4.el8_5 appstream 23 M make x86_64 1:4.2.1-10.el8 baseos 497 k Installing dependencies: binutils x86_64 2.30-108.el8_5.1 baseos 5.8 M cpp x86_64 8.5.0-4.el8_5 appstream 10 M glibc-devel x86_64 2.28-164.el8 baseos 1.0 M glibc-headers x86_64 2.28-164.el8 baseos 479 k isl x86_64 0.16.1-6.el8 appstream 834 k kernel-headers x86_64 4.18.0-348.7.1.el8_5 baseos 8.3 M libmpc x86_64 1.1.0-9.1.el8 appstream 60 k libpkgconf x86_64 1.4.2-1.el8 baseos 34 k libxcrypt-devel x86_64 4.1.1-6.el8 baseos 24 k pkgconf x86_64 1.4.2-1.el8 baseos 37 k pkgconf-m4 noarch 1.4.2-1.el8 baseos 16 k pkgconf-pkg-config x86_64 1.4.2-1.el8 baseos 14 k Transaction Summary ======================================================================================================================================================================= Install 14 Packages Total download size: 51 M Installed size: 124 M Is this ok [y/N]: |
logrotate, rsyncインストール
minimumインストールではlogrotateとrsyncがインストールされないのでインストールする。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# dnf install logrotate rsync Last metadata expiration check: 3:14:05 ago on Sat 08 Jan 2022 06:02:06 PM JST. Dependencies resolved. ================================================================================================================ Package Architecture Version Repository Size ================================================================================================================ Installing: logrotate x86_64 3.14.0-4.el8 baseos 85 k rsync x86_64 3.1.3-12.el8 baseos 404 k Transaction Summary ================================================================================================================ Install 2 Packages Total download size: 489 k Installed size: 962 k Is this ok [y/N]: |
vm-toolsインストール
無いと不便なのでvm-toolsをインストール
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
# dnf install open-vm-tools Last metadata expiration check: 0:45:50 ago on Sat 08 Jan 2022 04:24:52 AM JST. Dependencies resolved. ================================================================================================================================== Package Architecture Version Repository Size ================================================================================================================================== Installing: open-vm-tools x86_64 11.2.5-2.el8 appstream 771 k Installing dependencies: fuse x86_64 2.9.7-12.el8 baseos 81 k fuse-common x86_64 3.2.1-12.el8 baseos 20 k libdrm x86_64 2.4.106-2.el8 appstream 166 k libmspack x86_64 0.7-0.3.alpha.el8.4 appstream 69 k libpciaccess x86_64 0.14-1.el8 baseos 31 k libtool-ltdl x86_64 2.4.6-25.el8 baseos 57 k libxslt x86_64 1.1.32-6.el8 baseos 249 k tar x86_64 2:1.30-5.el8 baseos 837 k xmlsec1 x86_64 1.2.25-4.el8 appstream 191 k xmlsec1-openssl x86_64 1.2.25-4.el8 appstream 94 k Transaction Summary ================================================================================================================================== Install 11 Packages Total download size: 2.5 M Installed size: 7.8 M Is this ok [y/N]: |
時刻同期設定
RHEL8系ではChronyが時刻同期のデフォルトになっているけど、
minimumインストールでは導入されていないのでインストールする。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# dnf install chrony Last metadata expiration check: 1:03:27 ago on Sat 08 Jan 2022 04:24:52 AM JST. Dependencies resolved. ================================================================================================================================== Package Architecture Version Repository Size ================================================================================================================================== Installing: chrony x86_64 4.1-1.el8 baseos 326 k Installing weak dependencies: timedatex x86_64 0.5-3.el8 baseos 31 k Transaction Summary ================================================================================================================================== Install 2 Packages Total download size: 357 k Installed size: 710 k Is this ok [y/N]: |
/etc/chrony.confをNTPサーバをnictとmfeedに変更して、right/UTCを削除する。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# cp /etc/chrony.conf /etc/chrony.conf.default # vim /etc/chrony.conf --- 修正作業 --- # diff /etc/chrony.conf /etc/chrony.conf.default 3,4c3 < pool ntp.jst.mfeed.ad.jp iburst < pool ntp.nict.jp iburst --- > pool 2.pool.ntp.org iburst 33c32 < #leapsectz right/UTC --- > leapsectz right/UTC |
chnoryを起動
|
1 2 3 4 5 6 7 8 9 10 11 12 |
# systemctl enable chronyd # systemctl start chronyd # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- ntp3.jst.mfeed.ad.jp 2 6 37 61 -1887us[-1233us] +/- 77ms ^- ntp1.jst.mfeed.ad.jp 2 6 37 59 -2715us[-2715us] +/- 66ms ^- ntp2.jst.mfeed.ad.jp 2 6 37 60 -2545us[-1890us] +/- 61ms ^+ ntp-a3.nict.go.jp 1 6 37 61 +28us[ +682us] +/- 9205us ^+ ntp-k1.nict.jp 1 6 37 60 +414us[+1068us] +/- 6700us ^* ntp-b3.nict.go.jp 1 6 37 60 -274us[ +381us] +/- 8572us ^+ ntp-a2.nict.go.jp 1 6 37 60 -227us[ +428us] +/- 8500us |
初期設定諸々
管理者ユーザー制限
rootやsudoできるユーザを制限する。
まずはwheelグループに管理者権限を与えるユーザを追加
|
1 2 3 4 |
# gpasswd -a [USER NAME] wheel Adding user [USER NAME] to group wheel # getent group wheel wheel:x:10:[USER NAME] |
次に/etc/pam.d/suを編集。
|
1 2 3 4 5 6 7 |
# cp /etc/pam.d/su /etc/pam.d/su.default # vim /etc/pam.d/su # diff /etc/pam.d/su /etc/pam.d/su.default 8,10d7 < #### 2022.01.08 changed ####################################################### < auth required pam_wheel.so use_uid < ############################################################################### |
最終的にはrootのシェルを無効化してログインもsuもできないようにして、
管理者権限が必要なコマンドはsudoしか使えなくするのでsudoコマンドはログを残すようにする。
また、sudoでパスワードを求められないようにする（ログインできてるのであまり意味ないので）
変更はvisudoで行う。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# cp /etc/sudoers /etc/sudoers.default # visudo # diff /etc/sudoers /etc/sudoers.default 107,109c107 < ## 2022.01.08 disabled #################### < #%wheel ALL=(ALL) ALL < ########################################### --- > %wheel ALL=(ALL) ALL 112d109 < ## 2022.01.08 enabled ######################### 114,115d110 < %wheel ALL=(ALL) NOPASSWD: ALL < ############################################### 126,129d120 < < ## 2022.01.08 add ######################### < Defaults logfile=/var/log/sudo/sudo.log < ########################################### |
ログファイルを作成し、logrotateできるようにする。
|
1 2 3 4 5 6 7 8 9 10 |
# mkdir /var/log/sudo # vim /etc/logrotate.d/sudo /var/log/sudo/*.log { missingok compress delaycompress copytruncate create 0600 root root } # logrotate /etc/logrotate.conf |
EPELリポジトリ追加
拡張リポジトリEPELを利用できるように設定。
ただし、デフォルトでは無効とし、使用したい時に”–enablerepo=epel”オプションを使うことにする。
まずはインストール。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# dnf install epel-release Last metadata expiration check: 0:55:16 ago on Mon 10 Jan 2022 09:57:07 PM JST. Dependencies resolved. ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Installing: epel-release noarch 8-13.el8 extras 23 k Transaction Summary ==================================================================================================================================== Install 1 Package Total download size: 23 k Installed size: 35 k Is this ok [y/N]: |
epel.repoとepel-modular.内の[epel], [epel-modular]をそれぞれ無効にする。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
# cp /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.default # vim /etc/yum.repos.d/epel.repo # diff /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.default 7,10c7 < #### 2022.01.10 changed #### < #enabled=1 < enabled=0 < ############################ --- > enabled=1 # cp /etc/yum.repos.d/epel-modular.repo /etc/yum.repos.d/epel-modular.repo.default # vim /etc/yum.repos.d/epel-modular.repo # diff /etc/yum.repos.d/epel-modular.repo /etc/yum.repos.d/epel-modular.repo.default 7,10c7 < ## 2022.01.10 changed #### < #enabled=1 < enabled=0 < ########################## --- > enabled=1 # dnf --enablerepo=epel repolist repo id repo name appstream Rocky Linux 8 - AppStream baseos Rocky Linux 8 - BaseOS epel Extra Packages for Enterprise Linux 8 - x86_64 extras Rocky Linux 8 - Extras |
セキュリティ対策
アンチウイルスソフト Clamavインストール
ClamavはEPELリポジトリからインストールする。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# dnf --enablerepo=epel install clamav clamd clamav-update Last metadata expiration check: 0:00:28 ago on Mon 10 Jan 2022 11:00:05 PM JST. Dependencies resolved. ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Installing: clamav x86_64 0.103.4-1.el8 epel 2.7 M clamav-update x86_64 0.103.4-1.el8 epel 129 k clamd x86_64 0.103.4-1.el8 epel 124 k Installing dependencies: clamav-filesystem noarch 0.103.4-1.el8 epel 46 k clamav-lib x86_64 0.103.4-1.el8 epel 862 k libprelude x86_64 5.2.0-1.el8 epel 326 k Transaction Summary ==================================================================================================================================== Install 6 Packages Total download size: 4.1 M Installed size: 180 M Is this ok [y/N]: |
バージョン確認
|
1 2 |
# clamd --version ClamAV 0.103.4 |
SELinux有効時にアンチウイルスがスキャンできるようにする。
|
1 2 3 4 5 |
# getsebool antivirus_can_scan_system antivirus_can_scan_system --> off # setsebool -P antivirus_can_scan_system 1 # getsebool antivirus_can_scan_system antivirus_can_scan_system --> on |
データベース更新
インストール直後はclamav-freshclamサービスは動いていないはずだけど、念のため停止
|
1 |
# systemctl stop clamav-freshclam |
freshclam.confを編集する。
– Exampleがコメントアウトされていることを確認
– ログ有効化
– 日本のミラーサイトを追加
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# cp /etc/freshclam.conf /etc/freshclam.conf.default # vim /etc/freshclam.conf # diff /etc/freshclam.conf /etc/freshclam.conf.default 17d16 < ## 2022.01.10 changed ######################## 19,20d17 < UpdateLogFile /var/log/clamav/freshclam.log < ############################################## 33d29 < ## 2022.01.10 changed #### 35,36d30 < LogTime yes < ########################## 81,83d74 < ## 2022.01.10 add ##################### < DatabaseMirror db.jp.clamav.net < ####################################### |
ログディレクトリをclamupdate:clamupdateで作成。
|
1 2 3 4 |
# mkdir /var/log/clamav # chown -R clamupdate:clamupdate /var/log/clamav # ls -l /var/log | grep clamav drwxr-xr-x. 2 clamupdate clamupdate 6 Jan 10 23:59 clamav |
freshclam実行。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
# freshclam ClamAV update process started at Mon Jan 10 23:09:06 2022 daily database available for download (remote version: 26418) Time: 40.0s, ETA: 0.0s [========================>] 54.84MiB/54.84MiB Testing database: '/var/lib/clamav/tmp.c4df3b5d92/clamav-391045a3e321942542ad3b1e98fa9fb1.tmp-daily.cvd' ... Database test passed. daily.cvd updated (version: 26417, sigs: 1970392, f-level: 90, builder: raynman) Received an older daily CVD than was advertised. We'll retry so the incremental update will ensure we're up-to-date. daily database available for update (local version: 26417, remote version: 26418) Current database is 1 version behind. Downloading database patch # 26418... Time: 0.3s, ETA: 0.0s [========================>] 17.69KiB/17.69KiB Testing database: '/var/lib/clamav/tmp.c4df3b5d92/clamav-5c5443b6e50115d93eee73791fdeef2d.tmp-daily.cld' ... Database test passed. daily.cld updated (version: 26418, sigs: 1970616, f-level: 90, builder: raynman) main database available for download (remote version: 62) Time: 1m 52s, ETA: 0.0s [========================>] 162.58MiB/162.58MiB Testing database: '/var/lib/clamav/tmp.c4df3b5d92/clamav-8386ce50419ade790b68d54384981dde.tmp-main.cvd' ... Database test passed. main.cvd updated (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) bytecode database available for download (remote version: 333) Time: 0.4s, ETA: 0.0s [========================>] 286.79KiB/286.79KiB Testing database: '/var/lib/clamav/tmp.c4df3b5d92/clamav-3f9bdf821bc8c476599361fc1534578f.tmp-bytecode.cvd' ... Database test passed. bytecode.cvd updated (version: 333, sigs: 92, f-level: 63, builder: awillia2) |
clamav-freshclamを起動時有効化し、起動する。
ただし、freshclam実行時に作成されたログファイルは削除しておかないとデーモン起動失敗する。
パーミッションは同じ640なので理由はよくわからない・・・
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# rm -rf /var/log/clamav/freshclam.log # systemctl enable clamav-freshclam # systemctl start clamav-freshclam # systemctl status clamav-freshclam ● clamav-freshclam.service - ClamAV virus database updater Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2022-01-10 23:14:05 JST; 1min 21s ago Docs: man:freshclam(1) man:freshclam.conf(5) https://docs.clamav.net/ Main PID: 9605 (freshclam) Tasks: 1 (limit: 23686) Memory: 2.0M CGroup: /system.slice/clamav-freshclam.service mq9605 /usr/bin/freshclam -d --foreground=true Jan 10 23:14:05 localhost.localdomain systemd[1]: Started ClamAV virus database updater. Jan 10 23:14:05 localhost.localdomain freshclam[9605]: ClamAV update process started at Mon Jan 10 23:14:05 2022 Jan 10 23:14:05 localhost.localdomain freshclam[9605]: daily.cld database is up-to-date (version: 26418, sigs: 1970616, f-level: 90, builder: raynman) Jan 10 23:14:05 localhost.localdomain freshclam[9605]: main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) Jan 10 23:14:05 localhost.localdomain freshclam[9605]: bytecode.cvd database is up-to-date (version: 333, sigs: 92, f-level: 63, builder: awillia2) |
clamd起動
scan.conf内のLocalSocketのコメントアウトを外す。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# cp /etc/clamd.d/scan.conf /etc/clamd.d/scan.conf.default # vim /etc/clamd.d/scan.conf # diff /etc/clamd.d/scan.conf /etc/clamd.d/scan.conf.default 96d95 < ## 2022.01.10 changed ##################### 98,99d96 < LocalSocket /run/clamd.scan/clamd.sock < ########################################### 107d103 < ## 2022.01.10 changed ##################### 109,110d104 < LocalSocketMode 660 < ########################################### |
clamdサービスを以下の内容で登録
高使用頻度パッケージインストール
bash-completion
コマンドの入力補完をしてくれるパッケージ
vim
最近の流行は知らないけど、vimに慣れてるのでインストール
設定ファイル
ユーザのトップディレクトリ配下に.vimrc作成して以下の内容を記載。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
" ----- for General ------------------- set number set laststatus=2 set wildmenu set backspace=indent,eol,start set ruler set showmatch set expandtab set shiftwidth=4 set softtabstop=4 set tabstop=2 set smartindent set autoindent augroup fileTypeIndent autocmd! autocmd BufNewFile,BufRead *.js setlocal tabstop=2 softtabstop=2 shiftwidth=2 augroup END " ------------------------------------- " ----- for Search -------------------- set hlsearch set ignorecase set smartcase set wrapscan set incsearch " ------------------------------------- |