mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-01-13 22:30:37 +08:00
struggling
commit
b5a2c08a20
@ -1,7 +1,7 @@
|
||||
如何在 Docker 容器中运行支持 OData 的 JBoss 数据虚拟化 GA
|
||||
Howto Run JBoss Data Virtualization GA with OData in Docker Container
|
||||
================================================================================
|
||||
大家好，我们今天来学习如何在一个 Docker 容器中运行支持 OData（译者注：Open Data Protocol，开放数据协议） 的 JBoss 数据虚拟化 6.0.0 GA（译者注：GA，General Availability，具体定义可以查看[WIKI][4]）。JBoss 数据虚拟化是数据提供和集成解决方案平台，有多种分散的数据源时，转换为一种数据源统一对待，在正确的时间将所需数据传递给任意的应用或者用户。JBoss 数据虚拟化可以帮助我们将数据快速组合和转换为可重用的商业友好的数据模型，通过开放标准接口简单可用。它提供全面的数据抽取、联合、集成、转换，以及传输功能，将来自一个或多个源的数据组合为可重复使用和共享的灵活数据。要了解更多关于 JBoss 数据虚拟化的信息，可以查看它的[官方文档][1]。Docker 是一个提供开放平台用于打包，装载和以轻量级容器运行任何应用的开源平台。使用 Docker 容器我们可以轻松处理和启用支持 OData 的 JBoss 数据虚拟化。
|
||||
|
||||
大家好，我们今天来学习如何在一个 Docker 容器中运行支持 OData（译者注：Open Data Protocol，开放数据协议） 的 JBoss 数据虚拟化 6.0.0 GA（译者注：GA，General Availability，具体定义可以查看[WIKI][4]）。JBoss 数据虚拟化是数据提供和集成解决方案平台，将多种分散的数据源转换为一种数据源统一对待，在正确的时间将所需数据传递给任意的应用或者用户。JBoss 数据虚拟化可以帮助我们将数据快速组合和转换为可重用的商业友好的数据模型，通过开放标准接口简单可用。它提供全面的数据抽取、联合、集成、转换，以及传输功能，将来自一个或多个源的数据组合为可重复使用和共享的灵活数据。要了解更多关于 JBoss 数据虚拟化的信息，可以查看它的[官方文档][1]。Docker 是一个提供开放平台用于打包，装载和以轻量级容器运行任何应用的开源平台。使用 Docker 容器我们可以轻松处理和启用支持 OData 的 JBoss 数据虚拟化。
|
||||
|
||||
下面是该指南中在 Docker 容器中运行支持 OData 的 JBoss 数据虚拟化的简单步骤。
|
||||
|
||||
@ -78,7 +78,6 @@ Howto Run JBoss Data Virtualization GA with OData in Docker Container
|
||||
"LinkLocalIPv6PrefixLen": 0,
|
||||
|
||||
### 6. Web 界面 ###
|
||||
### 6. Web Interface ###
|
||||
|
||||
现在，如果一切如期望的那样进行，当我们用浏览器打开 http://container-ip:8080/ 和 http://container-ip:9990 时会看到支持 oData 的 JBoss 数据虚拟化登录界面和 JBoss 管理界面。管理验证的用户名和密码分别是 admin 和 redhat1！数据虚拟化验证的用户名和密码都是 user。之后，我们可以通过 web 界面在内容间导航。
|
||||
|
||||
@ -94,7 +93,7 @@ via: http://linoxide.com/linux-how-to/run-jboss-data-virtualization-ga-odata-doc
|
||||
|
||||
作者：[Arun Pyasi][a]
|
||||
译者：[ictlyh](http://www.mutouxiaogui.cn/blog)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
@ -1,17 +1,19 @@
|
||||
为Antergos与Arch Linux添加印度语和梵文支持
|
||||
也许你需要在 Antergos 与 Arch Linux 中查看印度语和梵文？
|
||||
================================================================================
|
||||
|
||||
|
||||
你们到目前或许知道，我最近一直在尝试体验[Antergos Linux][1]。在安装完[Antergos][2]后我所首先注意到的一些事情是在默认的Chromium浏览器中**没法正确显示印度语脚本**。
|
||||
你们到目前或许知道，我最近一直在尝试体验 [Antergos Linux][1]。在安装完[Antergos][2]后我所首先注意到的一些事情是在默认的 Chromium 浏览器中**没法正确显示印度语脚本**。
|
||||
|
||||
这是一件奇怪的事情，在我之前桌面Linux的体验中是从未遇到过的。起初，我认为是浏览器的问题，所以我安装了Firefox，然而问题依旧，Firefox也不能正确显示印度语。和Chromium不显示任何东西不同的是，Firefox确实显示了一些东西，但是毫无可读性。
|
||||
|
||||
|
||||
Chromium中的印度语显示
|
||||
|
||||
*Chromium中的印度语显示*
|
||||
|
||||
|
||||
|
||||
Firefox中的印度语显示
|
||||
|
||||
*Firefox中的印度语显示*
|
||||
|
||||
奇怪吧？那么，默认情况下基于Arch的Antergos Linux中没有印度语的支持吗？我没有去验证，但是我假设其它基于梵语脚本的印地语之类会产生同样的问题。
|
||||
|
||||
@ -37,7 +39,7 @@ via: http://itsfoss.com/display-hindi-arch-antergos/
|
||||
|
||||
作者：[Abhishek][a]
|
||||
译者：[GOLinux](https://github.com/GOLinux)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
66
published/20150826 Five Super Cool Open Source Games.md
Normal file
66
published/20150826 Five Super Cool Open Source Games.md
Normal file
@ -0,0 +1,66 @@
|
||||
五大超酷的开源游戏
|
||||
================================================================================
|
||||
|
||||
在2014年和2015年，Linux 涌入了一堆流行的付费游戏，例如备受欢迎的无主之地（Borderlands）、巫师（Witcher）、死亡岛（Dead Island） 和 CS 系列游戏。虽然这是令人激动的消息，但玩家有这个支出预算吗？付费游戏很好，但更好的是由了解玩家喜好的开发者开发的免费的替代品。
|
||||
|
||||
前段时间，我偶然看到了一个三年前发布的 YouTube 视频，标题非常的有正能量 [5个不算糟糕的开源游戏][1]。虽然视频表扬了一些开源游戏，我还是更喜欢用一个更加热情的方式来切入这个话题，至少如标题所说。所以，下面是我的一份五大超酷开源游戏的清单。
|
||||
|
||||
### Tux Racer ###
|
||||
|
||||
|
||||
|
||||
*Tux Racer*
|
||||
|
||||
[《Tux Racer》][2]是这份清单上的第一个游戏，因为我对这个游戏很熟悉。最近，我的兄弟和我为了参加[玩电脑的孩子们][4]项目，在[去墨西哥的路途中][3]，Tux Racer 是孩子和教师都喜欢玩的游戏之一。在这个游戏中，玩家使用 Linux 吉祥物——企鹅 Tux——在下山雪道上以计时赛的方式进行比赛。玩家们不断挑战他们自己的最佳纪录。目前还没有多玩家版本，但这是有可能改变的。它适用于 Linux、OS X、Windows 和 Android。
|
||||
|
||||
### Warsow ###
|
||||
|
||||
|
||||
|
||||
*Warsow*
|
||||
|
||||
[《Warsow》][5]网站介绍道：“设定是有未来感的卡通世界，Warsow 是个完全开放的适用于 Windows、Linux 和 Mac OS X平台的快节奏第一人称射击游戏（FPS）。Warsow 是跨网络的尊重和体育精神的的艺术。（Warsow is the Art of Respect and Sportsmanship Over the Web. 大写回文字母组成 Warsow。）” 我很不情愿的把 FPS 类放到了这个列表中，因为很多人玩过这类的游戏，但是我的确被 Warsow 打动了。它对很多动作进行了优先级排序，游戏节奏很快，一开始就有八个武器。卡通化的风格让玩的过程变得没有那么严肃，更加的休闲，非常适合和亲友一同玩。然而，它却以充满竞争的游戏自居，并且当我体验这个游戏时，我发现周围确实有一些专家级的玩家。它适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### M.A.R.S——一个荒诞的射击游戏 ###
|
||||
|
||||
|
||||
|
||||
*M.A.R.S.——一个荒诞的射击游戏*
|
||||
|
||||
[《M.A.R.S——一个荒诞的射击游戏》][6]之所以吸引人是因为它充满活力的色彩和画风。支持两个玩家使用同一个键盘，而一个在线多玩家版本目前正在开发中——这意味着想要和朋友们一起玩暂时还要等等。不论如何，它是个可以使用几个不同飞船和武器的有趣的太空射击游戏。飞船的形状不同，从普通的枪、激光、散射枪到更有趣的武器（随机出来的飞船中有一个会对敌人发射泡泡，这为这款混乱的游戏增添了很多乐趣）。游戏有几种模式，比如标准模式和对方进行殊死搏斗以获得高分或先达到某个分数线，还有其他的模式，空间球（Spaceball）、坟坑（Grave-itation Pit）和保加农炮（Cannon Keep）。它适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### Valyria Tear ###
|
||||
|
||||
|
||||
|
||||
*Valyria Tear*
|
||||
|
||||
[Valyria Tear][7] 类似近年来拥有众多粉丝的角色扮演游戏（RPG）。故事设定在奇幻游戏的通用年代，充满了骑士、王国和魔法，以及主要角色 Bronann。设计团队在这个世界的设计上做的非常棒，实现了玩家对这类游戏所有的期望：隐藏的宝藏、偶遇的怪物、非玩家操纵角色（NPC）的互动以及所有 RPG 不可或缺的——在低级别的怪物上刷经验直到可以面对大 BOSS。我在试玩的时候，时间不允许我太过深入到这个游戏故事中，但是感兴趣的人可以看 YouTube 上由 Yohann Ferriera 用户发的‘[Let’s Play][8]’系列视频。它适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### SuperTuxKart ###
|
||||
|
||||
|
||||
|
||||
*SuperTuxKart*
|
||||
|
||||
最后一个同样好玩的游戏是 [SuperTuxKart][9]，一个效仿 Mario Kart（马里奥卡丁车）但丝毫不逊色的好游戏。它在2000年-2004年间开始以 Tux Kart 开发，但是在成品中有错误，结果开发就停止了几年。从2006年开始重新开发时起，它就一直在改进，直到四个月前0.9版首次发布。在游戏里，我们的老朋友 Tux 与马里奥和其他一些开源吉祥物一同开始。其中一个熟悉的面孔是 Suzanne，这是 Blender 的那只吉祥物猴子。画面很给力，游戏很流畅。虽然在线游戏还在计划阶段，但是分屏多玩家游戏是可以的。一个电脑最多可以供四个玩家同时玩。它适用于 Linux、Windows、OS X、AmigaOS 4、AROS 和 MorphOS。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://fossforce.com/2015/08/five-super-cool-open-source-games/
|
||||
|
||||
作者：Hunter Banks
|
||||
译者：[H-mudcup](https://github.com/H-mudcup)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:https://www.youtube.com/watch?v=BEKVl-XtOP8
|
||||
[2]:http://tuxracer.sourceforge.net/download.html
|
||||
[3]:http://fossforce.com/2015/07/banks-family-values-texas-linux-fest/
|
||||
[4]:http://www.kidsoncomputers.org/an-amazing-week-in-oaxaca
|
||||
[5]:https://www.warsow.net/download
|
||||
[6]:http://mars-game.sourceforge.net/
|
||||
[7]:http://valyriatear.blogspot.com/
|
||||
[8]:https://www.youtube.com/channel/UCQ5KrSk9EqcT_JixWY2RyMA
|
||||
[9]:http://supertuxkart.sourceforge.net/
|
||||
@ -0,0 +1,110 @@
|
||||
mosh：一个基于 SSH 用于连接远程 Unix/Linux 系统的工具
|
||||
================================================================================
|
||||
Mosh 表示移动 Shell（Mobile Shell），是一个用于从客户端跨互联网连接远程服务器的命令行工具。它能用于 SSH 连接，但是比 Secure Shell 功能更多。它是一个类似于 SSH 而带有更多功能的应用。程序最初由 Keith Winstein 编写，用于类 Unix 的操作系统中，发布于GNU GPL v3协议下。
|
||||
|
||||
|
||||
|
||||
*Mosh Shell SSH 客户端*
|
||||
|
||||
#### Mosh的功能 ####
|
||||
|
||||
- 它是一个支持漫游的远程终端程序。
|
||||
- 在所有主流的类 Unix 版本中可用，如 Linux、FreeBSD、Solaris、Mac OS X 和 Android。
|
||||
- 支持不稳定连接
|
||||
- 支持智能的本地回显
|
||||
- 支持用户输入的行编辑
|
||||
- 响应式设计及在 wifi、3G、长距离连接下的鲁棒性
|
||||
- 在 IP 改变后保持连接。它使用 UDP 代替 TCP（在 SSH 中使用），当连接被重置或者获得新的 IP 后 TCP 会超时，但是 UDP 仍然保持连接。
|
||||
- 在很长的时候之后恢复会话时仍然保持连接。
|
||||
- 没有网络延迟。立即显示用户输入和删除而没有延迟
|
||||
- 像 SSH 那样支持一些旧的方式登录。
|
||||
- 包丢失处理机制
|
||||
|
||||
### Linux 中 mosh 的安装 ###
|
||||
|
||||
在 Debian、Ubuntu 和 Mint 类似的系统中，你可以很容易地用 [apt-get 包管理器][1]安装。
|
||||
|
||||
# apt-get update
|
||||
# apt-get install mosh
|
||||
|
||||
在基于 RHEL/CentOS/Fedora 的系统中，要使用 [yum 包管理器][3]安装 mosh，你需要打开第三方的 [EPEL][2]。
|
||||
|
||||
# yum update
|
||||
# yum install mosh
|
||||
|
||||
在 Fedora 22+的版本中，你需要使用 [dnf 包管理器][4]来安装 mosh。
|
||||
|
||||
# dnf install mosh
|
||||
|
||||
### 我该如何使用 mosh？ ###
|
||||
|
||||
1、 让我们尝试使用 mosh 登录远程 Linux 服务器。
|
||||
|
||||
$ mosh root@192.168.0.150
|
||||
|
||||
|
||||
|
||||
*mosh远程连接*
|
||||
|
||||
**注意**：你有没有看到一个连接错误，因为我在 CentOS 7中还有打开这个端口。一个快速但是我并不建议的解决方法是：
|
||||
|
||||
# systemctl stop firewalld [在远程服务器上]
|
||||
|
||||
更好的方法是打开一个端口并更新防火墙规则。接着用 mosh 连接到预定义的端口中。至于更深入的细节，也许你会对下面的文章感兴趣。
|
||||
|
||||
- [如何配置 Firewalld][5]
|
||||
|
||||
2、 让我们假设把默认的 22 端口改到 70，这时使用 -p 选项来使用自定义端口。
|
||||
|
||||
$ mosh -p 70 root@192.168.0.150
|
||||
|
||||
3、 检查 mosh 的版本
|
||||
|
||||
$ mosh --version
|
||||
|
||||
|
||||
|
||||
*检查mosh版本*
|
||||
|
||||
4、 你可以输入`exit`来退出 mosh 会话。
|
||||
|
||||
$ exit
|
||||
|
||||
5、 mosh 支持很多选项，你可以用下面的方法看到：
|
||||
|
||||
$ mosh --help
|
||||
|
||||
|
||||
|
||||
*Mosh 选项*
|
||||
|
||||
#### mosh 的优缺点 ####
|
||||
|
||||
- mosh 有额外的需求，比如需要允许 UDP 直接连接，这在 SSH 不需要。
|
||||
- 动态分配的端口范围是 60000-61000。第一个打开的端口是分配好的。每个连接都需要一个端口。
|
||||
- 默认的端口分配是一个严重的安全问题，尤其是在生产环境中。
|
||||
- 支持 IPv6 连接，但是不支持 IPv6 漫游。
|
||||
- 不支持回滚
|
||||
- 不支持 X11 转发
|
||||
- 不支持 ssh-agent 转发
|
||||
|
||||
### 总结 ###
|
||||
|
||||
mosh是一款在大多数linux发行版的仓库中可以下载的一款小工具。虽然它有一些差异尤其是安全问题和额外的需求，它的功能，比如漫游后保持连接是一个加分点。我的建议是任何一个使用ssh的linux用户都应该试试这个程序，mosh值得一试。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/install-mosh-shell-ssh-client-in-linux/
|
||||
|
||||
作者：[Avishek Kumar][a]
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/avishek/
|
||||
[1]:http://www.tecmint.com/useful-basic-commands-of-apt-get-and-apt-cache-for-package-management/
|
||||
[2]:https://linux.cn/article-2324-1.html
|
||||
[3]:http://www.tecmint.com/20-linux-yum-yellowdog-updater-modified-commands-for-package-mangement/
|
||||
[4]:http://www.tecmint.com/dnf-commands-for-fedora-rpm-package-management/
|
||||
[5]:http://www.tecmint.com/configure-firewalld-in-centos-7/
|
||||
63
published/20150901 Is Linux Right For You.md
Normal file
63
published/20150901 Is Linux Right For You.md
Normal file
@ -0,0 +1,63 @@
|
||||
Linux 系统是否适合于您？
|
||||
================================================================================
|
||||
> 并非人人都适合使用 Linux --对许多用户来说，Windows 或 OSX 会是更好的选择。
|
||||
|
||||
我喜欢使用 Linux 桌面系统，并不是因为软件的政治性质，也不是不喜欢其它操作系统。我喜欢 Linux 系统因为它能满足我的需求并且确实适合使用。
|
||||
|
||||
我的经验是，并非人人都适合切换至“Linux 的生活方式”。本文将帮助您通过分析使用 Linux 系统的利弊来供您自行判断使用 Linux 是否真正适合您。
|
||||
|
||||
### 什么时候更换系统？ ###
|
||||
|
||||
当有充分的理由时，将系统切换到 Linux 系统是很有意义的。这对 Windows 用户将系统更换到 OSX 或类似的情况都同样适用。为让您的系统转变成功，您必须首先确定为什么要做这种转换。
|
||||
|
||||
对某些人来说，更换系统通常意味着他们不满于当前的系统操作平台。也许是最新的升级给了他们糟糕的用户体验，而他们也已准备好更换到别的系统，也许仅仅是因为对某个系统好奇。不管动机是什么，必须要有充分的理由支撑您做出更换操作系统的决定。如果没有一个充足的原因让您这样做，往往不会成功。
|
||||
|
||||
然而事事都有例外。如果您确实对 Linux 桌面非常感兴趣，或许可以选择一种折衷的方式。
|
||||
|
||||
### 放慢起步的脚步 ###
|
||||
|
||||
第一次尝试运行 Linux 系统后，我看到就有人开始批判 Windows 安装过程的费时，完全是因为他们20分钟就用闪存安装好 Ubuntu 的良好体验。但是伙伴们，这并不只是一次测验。相反，我有如下建议：
|
||||
|
||||
- 用一周的时间尝试在[虚拟机上运行 Linux 系统][1]。这意味着您将在该系统上执行所有的浏览器工作、邮箱操作和其它想要完成的任务。
|
||||
- 如果运行虚拟机资源消耗太大，您可以尝试用提供了[一些持久存储][2]的 USB 驱动器来运行 Linux，您的主操作系统将不受任何影响。与此同时，您仍可以运行 Linux 系统。
|
||||
- 运行 Linux 系统一周后，如果一切进展顺利，下一步您可以计算一下这周内登入 Windows 的次数。如果只是偶尔登录 Windows 系统，下一步就可以尝试运行 Windows 和 Linux 的[双系统][3]。对那些只运行了 Linux 系统的用户，可以考虑尝试将系统真正更换为 Linux 系统。
|
||||
- 在你完全删除 Windows 分区前，更应该购买一个新硬盘来安装 Linux 系统。这样有了充足的硬盘空间，您就可以使用双系统。如果必须要启动 Windows 系统做些事情的话，Windows 系统也是可以运行的。
|
||||
|
||||
### 使用 Linux 系统的好处是什么？ ###
|
||||
|
||||
将系统更换到 Linux 有什么好处呢？一般而言，这种好处对大多数人来说可以归结到释放个性自由。在使用 Linux 系统的时候，如果您不喜欢某些设置，可以自行更改它们。同时使用 Linux 可以为用户节省大量的硬件升级开支和不必要的软件开支。另外，您不需再费力找寻已丢失的软件许可证密钥，而且如果您不喜欢即将发布的系统版本，大可轻松地更换到别的版本。
|
||||
|
||||
在 Linux 桌面方面可以选择的桌面种类是惊人的多，看起来对新手来说做这种选择非常困难。但是如果您发现了喜欢的一款 Linux 版本（Debian、Fedora、Arch等），最困难的工作其实已经完成了，您需要做的就是找到各版本的区别并选择出您最喜欢的系统版本环境。
|
||||
|
||||
如今我听到的最常见的抱怨之一是用户发现没有太多的软件能适用于 Linux 系统。然而，这并不是事实。尽管别的操作系统可能会提供更多软件，但是如今的 Linux 也已经提供了足够多应用程序满足您的各种需求，包括视频剪辑（家用和专业级）、摄影、办公管理软件、远程访问、音乐软件、等等等等。
|
||||
|
||||
### 使用 Linux 系统您会失去些什么？ ###
|
||||
|
||||
虽然我喜欢使用 Linux，但我妻子的家庭办公依然依赖于 OS X。对于用 Linux 系统完成一些特定的任务她心满意足，但是她需要 OS X 来运行一些不支持 Linux 的软件。这是许多想要更换系统的用户会遇到的一个常见的问题。如果要更换系统，您需要考虑是否愿意失去一些关键的软件工具。
|
||||
|
||||
有时这个问题是因为软件的数据只能用该软件打开。别的情况下，是传统应用程序的工作流和功能并不适用于在 Linux 系统上可运行的软件。我自己并没有遇到过这类问题，但是我知道确实存在这些问题。许多 Linux 上的软件在其它操作系统上也都可以用。所以如果担心这类软件兼容问题，建议您先尝试在已有的系统上操作一下几款类似的应用程序。
|
||||
|
||||
更换成 Linux 系统后，另一件您可能会失去的是本地系统支持服务。人们通常会嘲笑这种愚蠢行径，但我知道，无数的新手在使用 Linux 时会发现解决 Linux 上各种问题的唯一资源就是来自网络另一端的陌生人提供的帮助。如果只是他们的 PC 遇到了一些问题，这将会比较麻烦。Windows 和 OS X 的用户已经习惯各城市遍布了支持他们操作系统的各项技术服务。
|
||||
|
||||
### 如何开启新旅程？ ###
|
||||
|
||||
这里建议大家要记住最重要的就是总要有个回退方案。如果您将 Windows 10 从硬盘中擦除，您会发现重新安装它又会花费金钱。对那些从其它 Windows 发布版本升级的用户来说尤其会遇到这种情况。请接受这个建议，对新手来说使用闪存安装 Linux 或使用 Windows 和 Linux 双系统都是更值得提倡的做法。您也许会如鱼得水般使用 Linux系统，但是有了一份回退方案，您将高枕无忧。
|
||||
|
||||
相反，如果数周以来您一直依赖于使用双操作系统，但是已经准备好冒险去尝试一下单操作系统，那么就去做吧。格式化您的驱动器，重新安装您喜爱的 Linux 发行版。数年来我一直都是“全职” Linux 使用爱好者，这里可以确定地告诉您，使用 Linux 系统感觉棒极了。这种感觉会持续多久？我第一次的 Linux 系统使用经验还是来自早期的 Red Hat 系统，最终在2003年，我在自己的笔记本上整个安装了 Linux 系统。
|
||||
|
||||
Linux 爱好者们，你们什么时候开始使用 Linux 的？您在最初更换成 Linux 系统时是兴奋还是焦虑呢？欢迎点击评论分享你们的经验。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.datamation.com/open-source/is-linux-right-for-you.html
|
||||
|
||||
作者：[Matt Hartley][a]
|
||||
译者：[icybreaker](https://github.com/icybreaker)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.datamation.com/author/Matt-Hartley-3080.html
|
||||
[1]:http://www.psychocats.net/ubuntu/virtualbox
|
||||
[2]:http://www.howtogeek.com/howto/14912/create-a-persistent-bootable-ubuntu-usb-flash-drive/
|
||||
[3]:http://www.linuxandubuntu.com/home/dual-boot-ubuntu-15-04-14-10-and-windows-10-8-1-8-step-by-step-tutorial-with-screenshots
|
||||
@ -1,4 +1,4 @@
|
||||
在 Ubuntu 里，如何下载，安装和配置 Plank Dock
|
||||
在 Ubuntu 里如何下载、安装和配置 Plank Dock
|
||||
=============================================================================
|
||||
一个众所周知的事实就是，Linux 是一个用户可以高度自定义的系统，有很多选项可以选择 —— 作为操作系统，有各种各样的发行版，而对于单个发行版来说，又有很多桌面环境可以选择。与其他操作系统的用户一样，Linux 用户也有不同的口味和喜好，特别是对于桌面来说。
|
||||
|
||||
@ -8,7 +8,7 @@
|
||||
|
||||
### Plank ###
|
||||
|
||||
官方的文档描述 Plank 是“这个星球上最简洁的 dock”。该项目的目的就是提供一个 dock 仅需要的功能，尽管这是很基础的一个库，却可以被扩展，创造其他的含更多高级功能的 dock 程序。
|
||||
官方的文档描述 Plank 是“这个星球上最简洁的 dock”。该项目的目的就是仅提供一个 dock 需要的功能，尽管这是很基础的一个库，却可以被扩展，创造其他的含更多高级功能的 dock 程序。
|
||||
|
||||
这里值得一提的就是，在 elementary OS 里，Plank 是预装的。并且 Plank 是 Docky 的基础，Docky 也是一个非常流行的 dock 应用，在功能上与 Mac OS X 的 Dock 非常相似。
|
||||
|
||||
@ -30,11 +30,11 @@
|
||||
|
||||
|
||||
|
||||
正如上面图片显示的那样，dock 包含许多带橙色的应用图标，这表明这些应用正处于运行状态。无需说，你可以点击一个图标来打开那个应用。同时，右击一个应用图标会给出更多的选项，你可能会感兴趣。举个例子，该下面的屏幕快照：
|
||||
正如上面图片显示的那样，dock 包含许多带橙色标示的应用图标，这表明这些应用正处于运行状态。无需说，你可以点击一个图标来打开那个应用。同时，右击一个应用图标会给出更多的选项，你可能会感兴趣。举个例子，看下面的屏幕快照：
|
||||
|
||||
|
||||
|
||||
为了获得配置的选项，你不得不右击一下 Plank 的图标（左数第一个），然后点击 Preferences 选项。这就会产生接下来的窗口。
|
||||
为了获得配置的选项，你需要右击一下 Plank 的图标（左数第一个），然后点击 Preferences 选项。这就会出现如下的窗口。
|
||||
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ via: https://www.maketecheasier.com/download-install-configure-plank-dock-ubuntu
|
||||
|
||||
作者：[Himanshu Arora][a]
|
||||
译者：[wi-cuckoo](https://github.com/wi-cuckoo)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
10条真心有趣的Linux命令
|
||||
10 条真心有趣的 Linux 命令
|
||||
================================================================================
|
||||
|
||||
**在终端工作是一件很有趣的事情。今天，我们将会列举一些有趣得为你带来欢笑的Linux命令。**
|
||||
@ -29,7 +29,7 @@
|
||||
|
||||
### 3. yes ###
|
||||
|
||||
#yes <string>
|
||||
# yes <string>
|
||||
|
||||
这个命令会不停打印字符串，直到用户把这进程给结束掉。
|
||||
|
||||
@ -38,6 +38,7 @@
|
||||
|
||||
|
||||
### 4. figlet ###
|
||||
|
||||
这个命令可以用apt-get安装，安装之后，在**/usr/share/figlet**可以看到一些ascii字体文件。
|
||||
|
||||
cd /usr/share/figlet
|
||||
@ -45,26 +46,25 @@
|
||||
----------
|
||||
|
||||
#figlet -f <font> <string>
|
||||
|
||||
e.g.
|
||||
|
||||
#figlet -f big.flf unixmen
|
||||
|
||||
|
||||
|
||||
#figlet -f block.flf unixmen
|
||||
#figlet -f block.flf unixmen
|
||||
|
||||
|
||||
|
||||
当然，你也可以尝试使用其他的选项。
|
||||
|
||||
### 5. asciiquarium ###
|
||||
|
||||
这个命令会将你的终端变成一个海洋馆。
|
||||
下载term animator
|
||||
|
||||
下载term animator：
|
||||
|
||||
# wget http://search.cpan.org/CPAN/authors/id/K/KB/KBAUCOM/Term-Animation-2.4.tar.gz
|
||||
|
||||
安装并且配置这个包
|
||||
安装并且配置这个包：
|
||||
|
||||
# tar -zxvf Term-Animation-2.4.tar.gz
|
||||
# cd Term-Animation-2.4/
|
||||
@ -75,14 +75,14 @@ e.g.
|
||||
|
||||
# apt-get install libcurses-perl
|
||||
|
||||
下载并且安装asciiquarium
|
||||
下载并且安装asciiquarium：
|
||||
|
||||
# wget http://www.robobunny.com/projects/asciiquarium/asciiquarium.tar.gz
|
||||
# tar -zxvf asciiquarium.tar.gz
|
||||
# cd asciiquarium_1.0/
|
||||
# cp asciiquarium /usr/local/bin/
|
||||
|
||||
执行如下命令
|
||||
执行如下命令：
|
||||
|
||||
# /usr/local/bin/asciiquarium
|
||||
|
||||
@ -176,8 +176,8 @@ aafire能让你的终端燃起来。
|
||||
via: http://www.unixmen.com/list-10-funny-linux-commands/
|
||||
|
||||
作者：[Rajneesh Upadhyay][a]
|
||||
译者：[tnuoccalanosrep](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
译者：[tnuoccalanosrep](https://github.com/tnuoccalanosrep)
|
||||
校对：[wxy](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
@ -0,0 +1,152 @@
|
||||
RHCSA 系列（五）: RHEL7 中的进程管理：开机，关机
|
||||
================================================================================
|
||||
我们将概括和简要地复习从你按开机按钮来打开你的 RHEL 7 服务器到呈现出命令行界面的登录屏幕之间所发生的所有事情，以此来作为这篇文章的开始。
|
||||
|
||||
|
||||
|
||||
*Linux 开机过程*
|
||||
|
||||
**请注意：**
|
||||
|
||||
1. 相同的基本原则也可以应用到其他的 Linux 发行版本中，但可能需要较小的更改，并且
|
||||
2. 下面的描述并不是旨在给出开机过程的一个详尽的解释，而只是介绍一些基础的东西
|
||||
|
||||
### Linux 开机过程 ###
|
||||
|
||||
1. 初始化 POST（加电自检）并执行硬件检查；
|
||||
|
||||
2. 当 POST 完成后，系统的控制权将移交给启动管理器的第一阶段（first stage），它存储在一个硬盘的引导扇区（对于使用 BIOS 和 MBR 的旧式的系统而言）或存储在一个专门的 (U)EFI 分区上。
|
||||
|
||||
3. 启动管理器的第一阶段完成后，接着进入启动管理器的第二阶段（second stage），通常大多数使用的是 GRUB（GRand Unified Boot Loader 的简称），它驻留在 `/boot` 中，然后开始加载内核和驻留在 RAM 中的初始化文件系统（被称为 initramfs，它包含执行必要操作所需要的程序和二进制文件，以此来最终挂载真实的根文件系统）。
|
||||
|
||||
4. 接着展示了闪屏（splash）过后，呈现在我们眼前的是类似下图的画面，它允许我们选择一个操作系统和内核来启动：
|
||||
|
||||
|
||||
|
||||
*启动菜单屏幕*
|
||||
|
||||
5. 内核会对接入到系统的硬件进行设置，当根文件系统被挂载后，接着便启动 PID 为 1 的进程，这个进程将开始初始化其他的进程并最终呈现给我们一个登录提示符界面。
|
||||
|
||||
注意：假如我们想在启动后查看这些信息，我们可以使用 [dmesg 命令][1]，并使用这个系列里的上一篇文章中介绍过的工具（注：即 grep）来过滤它的输出。
|
||||
|
||||
|
||||
|
||||
*登录屏幕和进程的 PID*
|
||||
|
||||
在上面的例子中，我们使用了大家熟知的 `ps` 命令来显示在系统启动过程中的一系列当前进程的信息，它们的父进程（或者换句话说，就是那个开启这些进程的进程）为 systemd（大多数现代的 Linux 发行版本已经切换到的系统和服务管理器）：
|
||||
|
||||
# ps -o ppid,pid,uname,comm --ppid=1
|
||||
|
||||
记住 `-o`（为 -format 的简写）选项允许你以一个自定义的格式来显示 ps 的输出，以此来满足你的需求；这个自定义格式使用 `man ps` 里 STANDARD FORMAT SPECIFIERS 一节中的特定关键词。
|
||||
|
||||
另一个你想自定义 ps 的输出而不是使用其默认输出的情形是：当你需要找到引起 CPU 或内存消耗过多的那些进程，并按照下列方式来对它们进行排序时：
|
||||
|
||||
# ps aux --sort=+pcpu # 以 %CPU 来排序(增序)
|
||||
# ps aux --sort=-pcpu # 以 %CPU 来排序(降序)
|
||||
# ps aux --sort=+pmem # 以 %MEM 来排序(增序)
|
||||
# ps aux --sort=-pmem # 以 %MEM 来排序(降序)
|
||||
# ps aux --sort=+pcpu,-pmem # 结合 %CPU (增序) 和 %MEM (降序)来排列
|
||||
|
||||
|
||||
|
||||
*自定义 ps 命令的输出*
|
||||
|
||||
### systemd 的一个介绍 ###
|
||||
|
||||
在 Linux 世界中，很少有能比在主流的 Linux 发行版本中采用 systemd 引起更多的争论的决定。systemd 的倡导者根据以下事实来表明其主要的优势：
|
||||
|
||||
1. 在系统启动期间，systemd 允许并发地启动更多的进程（相比于先前的 SysVinit，SysVinit 似乎总是表现得更慢，因为它一个接一个地启动进程，检查一个进程是否依赖于另一个进程，然后等待守护进程启动才可以启动的更多的服务)，并且
|
||||
2. 在一个运行着的系统中，它用作一个动态的资源管理器。这样在启动期间，当一个服务被需要时，才启动它（以此来避免消耗系统资源）而不是在没有一个合理的原因的情况下启动额外的服务。
|
||||
3. 向后兼容 sysvinit 的脚本。
|
||||
|
||||
另外请阅读: ['init' 和 'systemd' 背后的故事][2]
|
||||
|
||||
systemd 由 systemctl 工具控制，假如你了解 SysVinit，你将会对以下的内容感到熟悉：
|
||||
|
||||
- service 工具，在旧一点的系统中，它被用来管理 SysVinit 脚本，以及
|
||||
- chkconfig 工具，为系统服务升级和查询运行级别信息
|
||||
- shutdown 你一定使用过几次来重启或关闭一个运行的系统。
|
||||
|
||||
下面的表格展示了使用传统的工具和 systemctl 之间的相似之处：
|
||||
|
||||
|
||||
| 旧式工具 | Systemctl 等价命令 | 描述 |
|
||||
|-------------|----------------------|-------------|
|
||||
| service name start | systemctl start name | 启动 name （这里 name 是一个服务） |
|
||||
| service name stop | systemctl stop name | 停止 name |
|
||||
| service name condrestart | systemctl try-restart name | 重启 name （如果它已经运行了） |
|
||||
| service name restart | systemctl restart name | 重启 name |
|
||||
| service name reload | systemctl reload name | 重载 name 的配置 |
|
||||
| service name status | systemctl status name | 显示 name 的当前状态 |
|
||||
| service - status-all | systemctl | 显示当前所有服务的状态 |
|
||||
| chkconfig name on | systemctl enable name | 通过一个特定的单元文件，让 name 可以在系统启动时运行（这个文件是一个符号链接）。启用或禁用一个启动时的进程，实际上是增加或移除一个到 /etc/systemd/system 目录中的符号链接。 |
|
||||
| chkconfig name off | systemctl disable name | 通过一个特定的单元文件，让 name 可以在系统启动时禁止运行（这个文件是一个符号链接）。 |
|
||||
| chkconfig -list name | systemctl is-enabled name | 确定 name （一个特定的服务）当前是否启用。|
|
||||
| chkconfig - list | systemctl - type=service | 显示所有的服务及其是否启用或禁用。 |
|
||||
| shutdown -h now | systemctl poweroff | 关机 |
|
||||
| shutdown -r now | systemctl reboot | 重启系统 |
|
||||
|
||||
systemd 也引进了单元（unit）（它可能是一个服务，一个挂载点，一个设备或者一个网络套接字）和目标（target）（它们定义了 systemd 如何去管理和同时开启几个相关的进程，可以认为它们与在基于 SysVinit 的系统中的运行级别等价，尽管事实上它们并不等价）的概念。
|
||||
|
||||
### 总结归纳 ###
|
||||
|
||||
其他与进程管理相关，但并不仅限于下面所列的功能的任务有：
|
||||
|
||||
**1. 在考虑到系统资源的使用上，调整一个进程的执行优先级：**
|
||||
|
||||
这是通过 `renice` 工具来完成的，它可以改变一个或多个正在运行着的进程的调度优先级。简单来说，调度优先级是一个允许内核（当前只支持 >= 2.6 的版本）根据某个给定进程被分配的执行优先级（即友善度（niceness），从 -20 到 19）来为其分配系统资源的功能。
|
||||
|
||||
`renice` 的基本语法如下：
|
||||
|
||||
# renice [-n] priority [-gpu] identifier
|
||||
|
||||
在上面的通用命令中，第一个参数是将要使用的优先级数值，而另一个参数可以是进程 ID（这是默认的设定），进程组 ID，用户 ID 或者用户名。一个常规的用户（即除 root 以外的用户）只可以更改他或她所拥有的进程的调度优先级，并且只能增加友善度的层次（这意味着占用更少的系统资源）。
|
||||
|
||||
|
||||
|
||||
*进程调度优先级*
|
||||
|
||||
**2. 按照需要杀死一个进程（或终止其正常执行）：**
|
||||
|
||||
更精确地说，杀死一个进程指的是通过 [kill 或 pkill][3] 命令给该进程发送一个信号，让它优雅地（SIGTERM=15）或立即（SIGKILL=9）结束它的执行。
|
||||
|
||||
这两个工具的不同之处在于前一个被用来终止一个特定的进程或一个进程组，而后一个则允许你通过进程的名称和其他属性，执行相同的动作。
|
||||
|
||||
另外， pkill 与 pgrep 相捆绑，pgrep 提供将受符合的进程的 PID 给 pkill 来使用。例如，在运行下面的命令之前：
|
||||
|
||||
# pkill -u gacanepa
|
||||
|
||||
查看一眼由 gacanepa 所拥有的 PID 或许会带来点帮助：
|
||||
|
||||
# pgrep -l -u gacanepa
|
||||
|
||||
|
||||
|
||||
*找到用户拥有的 PID*
|
||||
|
||||
默认情况下，kill 和 pkiill 都发送 SIGTERM 信号给进程，如我们上面提到的那样，这个信号可以被忽略（即该进程可能会终止其自身的执行，也可能不终止），所以当你因一个合理的理由要真正地停止一个运行着的进程，则你将需要在命令行中带上特定的 SIGKILL 信号：
|
||||
|
||||
# kill -9 identifier # 杀死一个进程或一个进程组
|
||||
# kill -s SIGNAL identifier # 同上
|
||||
# pkill -s SIGNAL identifier # 通过名称或其他属性来杀死一个进程
|
||||
|
||||
### 结论 ###
|
||||
|
||||
在这篇文章中，我们解释了在 RHEL 7 系统中，有关开机启动过程的基本知识，并分析了一些可用的工具来帮助你通过使用一般的程序和 systemd 特有的命令来管理进程。
|
||||
|
||||
请注意，这个列表并不旨在涵盖有关这个话题的所有花哨的工具，请随意使用下面的评论栏来添加你自已钟爱的工具和命令。同时欢迎你的提问和其他的评论。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/rhcsa-exam-boot-process-and-process-management/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:https://linux.cn/article-3587-1.html
|
||||
[2]:http://www.tecmint.com/systemd-replaces-init-in-linux/
|
||||
[3]:https://linux.cn/article-2116-1.html
|
||||
@ -1,28 +1,28 @@
|
||||
RHCSA 系列：使用 'Parted' 和 'SSM' 来配置和加密系统存储 – Part 6
|
||||
RHCSA 系列（六）: 使用 Parted 和 SSM 来配置和加密系统存储
|
||||
================================================================================
|
||||
在本篇文章中，我们将讨论在 RHEL 7 中如何使用传统的工具来设置和配置本地系统存储，并介绍系统存储管理器(也称为 SSM)，它将极大地简化上面的任务。
|
||||
在本篇文章中，我们将讨论在 RHEL 7 中如何使用传统的工具来设置和配置本地系统存储，并介绍系统存储管理器（也称为 SSM），它将极大地简化上面的任务。
|
||||
|
||||
|
||||
|
||||
RHCSA: 配置和加密系统存储 – Part 6
|
||||
*RHCSA: 配置和加密系统存储 – Part 6*
|
||||
|
||||
请注意，我们将在这篇文章中展开这个话题，但由于该话题的宽泛性，我们将在下一期(Part 7)中继续介绍有关它的描述和使用。
|
||||
请注意，我们将在这篇文章中展开这个话题，但由于该话题的宽泛性，我们将在下一期中继续介绍有关它的描述和使用。
|
||||
|
||||
### 在 RHEL 7 中创建和修改分区 ###
|
||||
|
||||
在 RHEL 7 中， parted 是默认的用来处理分区的程序，且它允许你：
|
||||
|
||||
- 展示当前的分区表
|
||||
- 操纵(增加或减少分区的大小)现有的分区
|
||||
- 操纵（扩大或缩小分区的大小）现有的分区
|
||||
- 利用空余的磁盘空间或额外的物理存储设备来创建分区
|
||||
|
||||
强烈建议你在试图增加一个新的分区或对一个现有分区进行更改前，你应当确保设备上没有任何一个分区正在使用(`umount /dev/partition`)，且假如你正使用设备的一部分来作为 swap 分区，在进行上面的操作期间，你需要将它禁用(`swapoff -v /dev/partition`) 。
|
||||
强烈建议你在试图增加一个新的分区或对一个现有分区进行更改前，你应当确保该设备上没有任何一个分区正在使用（`umount /dev/分区`），且假如你正使用设备的一部分来作为 swap 分区，在进行上面的操作期间，你需要将它禁用（`swapoff -v /dev/分区`） 。
|
||||
|
||||
实施上面的操作的最简单的方法是使用一个安装介质例如一个 RHEL 7 安装 DVD 或 USB 以急救模式启动 RHEL(Troubleshooting → Rescue a Red Hat Enterprise Linux system)，然后当让你选择一个选项来挂载现有的 Linux 安装时，选择'跳过'这个选项，接着你将看到一个命令行提示符，在其中你可以像下图显示的那样开始键入与在一个未被使用的物理设备上创建一个正常的分区时所用的相同的命令。
|
||||
实施上面的操作的最简单的方法是使用一个安装介质例如一个 RHEL 7 的 DVD 或 USB 安装盘以急救模式启动 RHEL（`Troubleshooting` → `Rescue a Red Hat Enterprise Linux system`），然后当让你选择一个选项来挂载现有的 Linux 安装时，选择“跳过”这个选项，接着你将看到一个命令行提示符，在其中你可以像下图显示的那样开始键入与在一个未被使用的物理设备上创建一个正常的分区时所用的相同的命令。
|
||||
|
||||
|
||||
|
||||
RHEL 7 急救模式
|
||||
*RHEL 7 急救模式*
|
||||
|
||||
要启动 parted，只需键入：
|
||||
|
||||
@ -32,17 +32,17 @@ RHEL 7 急救模式
|
||||
|
||||
|
||||
|
||||
创建新的分区
|
||||
*创建新的分区*
|
||||
|
||||
正如你所看到的那样，在这个例子中，我们正在使用一个 5 GB 的虚拟光驱。现在我们将要创建一个 4 GB 的主分区，然后将它格式化为 xfs 文件系统，它是 RHEL 7 中默认的文件系统。
|
||||
正如你所看到的那样，在这个例子中，我们正在使用一个 5 GB 的虚拟驱动器。现在我们将要创建一个 4 GB 的主分区，然后将它格式化为 xfs 文件系统，它是 RHEL 7 中默认的文件系统。
|
||||
|
||||
你可以从一系列的文件系统中进行选择。你将需要使用 mkpart 来手动地创建分区，接着和平常一样，用 mkfs.fstype 来对分区进行格式化，因为 mkpart 并不支持许多现代的文件系统以达到即开即用。
|
||||
你可以从一系列的文件系统中进行选择。你将需要使用 `mkpart` 来手动地创建分区，接着和平常一样，用 `mkfs.类型` 来对分区进行格式化，因为 `mkpart` 并不支持许多现代的文件系统的到即开即用。
|
||||
|
||||
在下面的例子中，我们将为设备设定一个标记，然后在 `/dev/sdb` 上创建一个主分区 `(p)`，它从设备的 0% 开始，并在 4000MB(4 GB) 处结束。
|
||||
|
||||
|
||||
|
||||
标记分区的名称
|
||||
*标记分区的名称*
|
||||
|
||||
接下来，我们将把分区格式化为 xfs 文件系统，然后再次打印出分区表，以此来确保更改已被应用。
|
||||
|
||||
@ -51,11 +51,11 @@ RHEL 7 急救模式
|
||||
|
||||
|
||||
|
||||
格式化分区为 XFS 文件系统
|
||||
*格式化分区为 XFS 文件系统*
|
||||
|
||||
对于旧一点的文件系统，在 parted 中你应该使用 `resize` 命令来改变分区的大小。不幸的是，这只适用于 ext2, fat16, fat32, hfs, linux-swap, 和 reiserfs (若 libreiserfs 已被安装)。
|
||||
对于旧一点的文件系统，在 parted 中你可以使用 `resize` 命令来改变分区的大小。不幸的是，这只适用于 ext2, fat16, fat32, hfs, linux-swap, 和 reiserfs （若 libreiserfs 已被安装）。
|
||||
|
||||
因此，改变分区大小的唯一方式是删除它然后再创建它(所以确保你对你的数据做了完整的备份！)。毫无疑问，在 RHEL 7 中默认的分区方案是基于 LVM 的。
|
||||
因此，改变分区大小的唯一方式是删除它然后再创建它（所以，确保你对你的数据做了完整的备份！）。毫无疑问，在 RHEL 7 中默认的分区方案是基于 LVM 的。
|
||||
|
||||
使用 parted 来移除一个分区，可以用：
|
||||
|
||||
@ -64,23 +64,23 @@ RHEL 7 急救模式
|
||||
|
||||
|
||||
|
||||
移除或删除分区
|
||||
*移除或删除分区*
|
||||
|
||||
### 逻辑卷管理(LVM) ###
|
||||
|
||||
一旦一个磁盘被分好了分区，再去更改分区的大小就是一件困难或冒险的事了。基于这个原因，假如我们计划在我们的系统上对分区的大小进行更改，我们应当考虑使用 LVM 的可能性，而不是使用传统的分区系统。这样多个物理设备可以组成一个逻辑组，以此来寄宿可自定义数目的逻辑卷，而逻辑卷的增大或减少不会带来任何麻烦。
|
||||
一旦一个磁盘被分好了分区，再去更改分区的大小就是一件困难或冒险的事了。基于这个原因，假如我们计划在我们的系统上对分区的大小进行更改，我们应当考虑使用 LVM 的可能性，而不是使用传统的分区系统。这样多个物理设备可以组成一个逻辑组，以此来存放任意数目的逻辑卷，而逻辑卷的增大或减少不会带来任何麻烦。
|
||||
|
||||
简单来说，你会发现下面的示意图对记住 LVM 的基础架构或许有用。
|
||||
|
||||
|
||||
|
||||
LVM 的基本架构
|
||||
*LVM 的基本架构*
|
||||
|
||||
#### 创建物理卷，卷组和逻辑卷 ####
|
||||
|
||||
遵循下面的步骤是为了使用传统的卷管理工具来设置 LVM。由于你可以通过阅读这个网站上的 LVM 系列来扩展这个话题，我将只是概要的介绍设置 LVM 的基本步骤，然后与使用 SSM 来实现相同功能做个比较。
|
||||
|
||||
**注**: 我们将使用整个磁盘 `/dev/sdb` 和 `/dev/sdc` 来作为 PVs (物理卷)，但是否执行相同的操作完全取决于你。
|
||||
**注**: 我们将使用整个磁盘 `/dev/sdb` 和 `/dev/sdc` 来作为物理卷（PV），但是否执行相同的操作完全取决于你。
|
||||
|
||||
**1. 使用 /dev/sdb 和 /dev/sdc 中 100% 的可用磁盘空间来创建分区 `/dev/sdb1` 和 `/dev/sdc1`：**
|
||||
|
||||
@ -89,7 +89,7 @@ LVM 的基本架构
|
||||
|
||||
|
||||
|
||||
创建新分区
|
||||
*创建新分区*
|
||||
|
||||
**2. 分别在 /dev/sdb1 和 /dev/sdc1 上共创建 2 个物理卷。**
|
||||
|
||||
@ -98,21 +98,21 @@ LVM 的基本架构
|
||||
|
||||
|
||||
|
||||
创建两个物理卷
|
||||
*创建两个物理卷*
|
||||
|
||||
记住，你可以使用 pvdisplay /dev/sd{b,c}1 来显示有关新建的 PV 的信息。
|
||||
记住，你可以使用 pvdisplay /dev/sd{b,c}1 来显示有关新建的物理卷的信息。
|
||||
|
||||
**3. 在上一步中创建的 PV 之上创建一个 VG：**
|
||||
**3. 在上一步中创建的物理卷之上创建一个卷组（VG）：**
|
||||
|
||||
# vgcreate tecmint_vg /dev/sd{b,c}1
|
||||
|
||||
|
||||
|
||||
创建卷组
|
||||
*创建卷组*
|
||||
|
||||
记住，你可使用 vgdisplay tecmint_vg 来显示有关新建的 VG 的信息。
|
||||
记住，你可使用 vgdisplay tecmint_vg 来显示有关新建的卷组的信息。
|
||||
|
||||
**4. 像下面那样，在 VG tecmint_vg 之上创建 3 个逻辑卷：**
|
||||
**4. 像下面那样，在卷组 tecmint_vg 之上创建 3 个逻辑卷（LV）：**
|
||||
|
||||
# lvcreate -L 3G -n vol01_docs tecmint_vg [vol01_docs → 3 GB]
|
||||
# lvcreate -L 1G -n vol02_logs tecmint_vg [vol02_logs → 1 GB]
|
||||
@ -120,11 +120,11 @@ LVM 的基本架构
|
||||
|
||||
|
||||
|
||||
创建逻辑卷
|
||||
*创建逻辑卷*
|
||||
|
||||
记住，你可以使用 lvdisplay tecmint_vg 来显示有关在 VG tecmint_vg 之上新建的 LV 的信息。
|
||||
记住，你可以使用 lvdisplay tecmint_vg 来显示有关在 tecmint_vg 之上新建的逻辑卷的信息。
|
||||
|
||||
**5. 格式化每个逻辑卷为 xfs 文件系统格式(假如你计划在以后将要缩小卷的大小，请别使用 xfs 文件系统格式！)：**
|
||||
**5. 格式化每个逻辑卷为 xfs 文件系统格式（假如你计划在以后将要缩小卷的大小，请别使用 xfs 文件系统格式！）：**
|
||||
|
||||
# mkfs.xfs /dev/tecmint_vg/vol01_docs
|
||||
# mkfs.xfs /dev/tecmint_vg/vol02_logs
|
||||
@ -138,7 +138,7 @@ LVM 的基本架构
|
||||
|
||||
#### 移除逻辑卷，卷组和物理卷 ####
|
||||
|
||||
**7.现在我们将进行与刚才相反的操作并移除 LV，VG 和 PV：**
|
||||
**7.现在我们将进行与刚才相反的操作并移除逻辑卷、卷组和物理卷：**
|
||||
|
||||
# lvremove /dev/tecmint_vg/vol01_docs
|
||||
# lvremove /dev/tecmint_vg/vol02_logs
|
||||
@ -161,20 +161,20 @@ LVM 的基本架构
|
||||
- 初始化块设备来作为物理卷
|
||||
- 创建一个卷组
|
||||
- 创建逻辑卷
|
||||
- 格式化 LV 和
|
||||
- 格式化逻辑卷，以及
|
||||
- 只使用一个命令来挂载它们
|
||||
|
||||
**9. 现在，我们可以使用下面的命令来展示有关 PV，VG 或 LV 的信息：**
|
||||
**9. 现在，我们可以使用下面的命令来展示有关物理卷、卷组或逻辑卷的信息：**
|
||||
|
||||
# ssm list dev
|
||||
# ssm list pool
|
||||
# ssm list vol
|
||||
|
||||
|
||||
|
||||
|
||||
检查有关 PV, VG,或 LV 的信息
|
||||
*检查有关物理卷、卷组或逻辑卷的信息*
|
||||
|
||||
**10. 正如我们知道的那样， LVM 的一个显著的特点是可以在不停机的情况下更改(增大或缩小) 逻辑卷的大小：**
|
||||
**10. 正如我们知道的那样， LVM 的一个显著的特点是可以在不停机的情况下更改（增大或缩小）逻辑卷的大小：**
|
||||
|
||||
假定在 vol02_logs 上我们用尽了空间，而 vol03_homes 还留有足够的空间。我们将把 vol03_homes 的大小调整为 4 GB，并使用剩余的空间来扩展 vol02_logs：
|
||||
|
||||
@ -184,7 +184,7 @@ LVM 的基本架构
|
||||
|
||||
|
||||
|
||||
查看卷的大小
|
||||
*查看卷的大小*
|
||||
|
||||
然后执行：
|
||||
|
||||
@ -196,11 +196,11 @@ LVM 的基本架构
|
||||
|
||||
# ssm remove tecmint_vg
|
||||
|
||||
这个命令将返回一个提示，询问你是否确认删除 VG 和它所包含的 LV：
|
||||
这个命令将返回一个提示，询问你是否确认删除卷组和它所包含的逻辑卷：
|
||||
|
||||
|
||||
|
||||
移除逻辑卷和卷组
|
||||
*移除逻辑卷和卷组*
|
||||
|
||||
### 管理加密的卷 ###
|
||||
|
||||
@ -216,7 +216,7 @@ SSM 也给系统管理员提供了为新的或现存的卷加密的能力。首
|
||||
|
||||
我们的下一个任务是往 /etc/fstab 中添加条目来让这些逻辑卷在启动时可用，而不是使用设备识别编号(/dev/something)。
|
||||
|
||||
我们将使用每个 LV 的 UUID (使得当我们添加其他的逻辑卷或设备后，我们的设备仍然可以被唯一的标记)，而我们可以使用 blkid 应用来找到它们的 UUID：
|
||||
我们将使用每个逻辑卷的 UUID （使得当我们添加其他的逻辑卷或设备后，我们的设备仍然可以被唯一的标记），而我们可以使用 blkid 应用来找到它们的 UUID：
|
||||
|
||||
# blkid -o value UUID /dev/tecmint_vg/vol01_docs
|
||||
# blkid -o value UUID /dev/tecmint_vg/vol02_logs
|
||||
@ -226,7 +226,7 @@ SSM 也给系统管理员提供了为新的或现存的卷加密的能力。首
|
||||
|
||||
|
||||
|
||||
找到逻辑卷的 UUID
|
||||
*找到逻辑卷的 UUID*
|
||||
|
||||
接着，使用下面的内容来创建 /etc/crypttab 文件(请更改 UUID 来适用于你的设置)：
|
||||
|
||||
@ -243,11 +243,11 @@ SSM 也给系统管理员提供了为新的或现存的卷加密的能力。首
|
||||
# Logical volume vol03_homes
|
||||
/dev/mapper/homes /mnt/homes ext4 defaults 0 2
|
||||
|
||||
现在重启(systemctl reboot)，则你将被要求为每个 LV 输入密码。随后，你可以通过检查相应的挂载点来确保挂载操作是否成功：
|
||||
现在重启（`systemctl reboot`），则你将被要求为每个逻辑卷输入密码。随后，你可以通过检查相应的挂载点来确保挂载操作是否成功：
|
||||
|
||||
|
||||
|
||||
确保逻辑卷挂载点
|
||||
*确保逻辑卷挂载点*
|
||||
|
||||
### 总结 ###
|
||||
|
||||
@ -261,7 +261,7 @@ via: http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-p
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
@ -1,42 +1,40 @@
|
||||
RHCSA 系列：使用 ACL(访问控制列表) 和挂载 Samba/NFS 共享 – Part 7
|
||||
RHCSA 系列（六）: 使用 ACL（访问控制列表) 和挂载 Samba/NFS 共享
|
||||
================================================================================
|
||||
在上一篇文章([RHCSA 系列 Part 6][1])中，我们解释了如何使用 parted 和 ssm 来设置和配置本地系统存储。
|
||||
在上一篇文章([RHCSA 系列（六）][1])中，我们解释了如何使用 parted 和 ssm 来设置和配置本地系统存储。
|
||||
|
||||
|
||||
|
||||
RHCSA Series: 配置 ACL 及挂载 NFS/Samba 共享 – Part 7
|
||||
*RHCSA 系列: 配置 ACL 及挂载 NFS/Samba 共享 – Part 7*
|
||||
|
||||
我们也讨论了如何创建和在系统启动时使用一个密码来挂载加密的卷。另外，我们告诫过你要避免在挂载的文件系统上执行苛刻的存储管理操作。记住了这点后，现在，我们将回顾在 RHEL 7 中最常使用的文件系统格式，然后将涵盖有关手动或自动挂载、使用和卸载网络文件系统(CIFS 和 NFS)的话题以及在你的操作系统上实现访问控制列表的使用。
|
||||
我们也讨论了如何创建和在系统启动时使用一个密码来挂载加密的卷。另外，我们告诫过你要避免在挂载的文件系统上执行危险的存储管理操作。记住了这点后，现在，我们将回顾在 RHEL 7 中最常使用的文件系统格式，然后将涵盖有关手动或自动挂载、使用和卸载网络文件系统（CIFS 和 NFS）的话题以及在你的操作系统上实现访问控制列表（Access Control List）的使用。
|
||||
|
||||
#### 前提条件 ####
|
||||
|
||||
在进一步深入之前，请确保你可使用 Samba 服务和 NFS 服务(注意在 RHEL 7 中 NFSv2 已不再被支持)。
|
||||
在进一步深入之前，请确保你可使用 Samba 服务和 NFS 服务（注意在 RHEL 7 中 NFSv2 已不再被支持）。
|
||||
|
||||
在本次指导中，我们将使用一个IP 地址为 192.168.0.10 且同时运行着 Samba 服务和 NFS 服务的机子来作为服务器，使用一个 IP 地址为 192.168.0.18 的 RHEL 7 机子来作为客户端。在这篇文章的后面部分，我们将告诉你在客户端上你需要安装哪些软件包。
|
||||
在本次指导中，我们将使用一个IP 地址为 192.168.0.10 且同时运行着 Samba 服务和 NFS 服务的机器来作为服务器，使用一个 IP 地址为 192.168.0.18 的 RHEL 7 机器来作为客户端。在这篇文章的后面部分，我们将告诉你在客户端上你需要安装哪些软件包。
|
||||
|
||||
### RHEL 7 中的文件系统格式 ###
|
||||
|
||||
从 RHEL 7 开始，由于 XFS 的高性能和可扩展性，它已经被引入所有的架构中来作为默认的文件系统。
|
||||
根据 Red Hat 及其合作伙伴在主流硬件上执行的最新测试，当前 XFS 已支持最大为 500 TB 大小的文件系统。
|
||||
从 RHEL 7 开始，由于 XFS 的高性能和可扩展性，它已经被作为所有的架构中的默认文件系统。根据 Red Hat 及其合作伙伴在主流硬件上执行的最新测试，当前 XFS 已支持最大为 500 TB 大小的文件系统。
|
||||
|
||||
另外， XFS 启用了 user_xattr(扩展用户属性) 和 acl(
|
||||
POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext4(对于 RHEL 7 来说， ext2 已过时)，这意味着当挂载一个 XFS 文件系统时，你不必显式地在命令行或 /etc/fstab 中指定这些选项(假如你想在后一种情况下禁用这些选项，你必须显式地使用 no_acl 和 no_user_xattr)。
|
||||
另外，XFS 启用了 `user_xattr`（扩展用户属性） 和 `acl`（POSIX 访问控制列表）来作为默认的挂载选项，而不像 ext3 或 ext4（对于 RHEL 7 来说，ext2 已过时），这意味着当挂载一个 XFS 文件系统时，你不必显式地在命令行或 /etc/fstab 中指定这些选项（假如你想在后一种情况下禁用这些选项，你必须显式地使用 `no_acl` 和 `no_user_xattr`）。
|
||||
|
||||
请记住扩展用户属性可以被指定到文件和目录中来存储任意的额外信息如 mime 类型，字符集或文件的编码，而用户属性中的访问权限由一般的文件权限位来定义。
|
||||
请记住扩展用户属性可以给文件和目录指定，用来存储任意的额外信息如 mime 类型，字符集或文件的编码，而用户属性中的访问权限由一般的文件权限位来定义。
|
||||
|
||||
#### 访问控制列表 ####
|
||||
|
||||
作为一名系统管理员，无论你是新手还是专家，你一定非常熟悉与文件和目录有关的常规访问权限，这些权限为所有者，所有组和"世界"(所有的其他人)指定了特定的权限(可读，可写及可执行)。但如若你需要稍微更新你的记忆，请随意参考 [RHCSA 系列的 Part 3][3].
|
||||
作为一名系统管理员，无论你是新手还是专家，你一定非常熟悉与文件和目录有关的常规访问权限，这些权限为所有者，所有组和“世界”（所有的其他人）指定了特定的权限（可读，可写及可执行）。但如若你需要稍微更新下你的记忆，请参考 [RHCSA 系列（三）][3].
|
||||
|
||||
但是，由于标准的 `ugo/rwx` 集合并不允许为不同的用户配置不同的权限，所以 ACL 便被引入了进来，为的是为文件和目录定义更加详细的访问权限，而不仅仅是这些特别指定的特定权限。
|
||||
|
||||
事实上， ACL 定义的权限是由文件权限位所特别指定的权限的一个超集。下面就让我们看看这个转换是如何在真实世界中被应用的吧。
|
||||
|
||||
1. 存在两种类型的 ACL：访问 ACL，可被应用到一个特定的文件或目录上，以及默认 ACL，只可被应用到一个目录上。假如目录中的文件没有 ACL，则它们将继承它们的父目录的默认 ACL 。
|
||||
1. 存在两种类型的 ACL：访问 ACL，可被应用到一个特定的文件或目录上；以及默认 ACL，只可被应用到一个目录上。假如目录中的文件没有 ACL，则它们将继承它们的父目录的默认 ACL 。
|
||||
|
||||
2. 从一开始， ACL 就可以为每个用户，每个组或不在文件所属组中的用户配置相应的权限。
|
||||
|
||||
3. ACL 可使用 `setfacl` 来设置(和移除)，可相应地使用 -m 或 -x 选项。
|
||||
3. ACL 可使用 `setfacl` 来设置（和移除），可相应地使用 -m 或 -x 选项。
|
||||
|
||||
例如，让我们创建一个名为 tecmint 的组，并将用户 johndoe 和 davenull 加入该组：
|
||||
|
||||
@ -53,36 +51,32 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
|
||||
|
||||
检验用户
|
||||
*检验用户*
|
||||
|
||||
现在，我们在 /mnt 下创建一个名为 playground 的目录，并在该目录下创建一个名为 testfile.txt 的文件。我们将设定该文件的属组为 tecmint，并更改它的默认 ugo/rwx 权限为 770(即赋予该文件的属主和属组可读，可写和可执行权限)：
|
||||
现在，我们在 /mnt 下创建一个名为 playground 的目录，并在该目录下创建一个名为 testfile.txt 的文件。我们将设定该文件的属组为 tecmint，并更改它的默认 `ugo/rwx` 权限为 770（即赋予该文件的属主和属组可读、可写和可执行权限）：
|
||||
|
||||
# mkdir /mnt/playground
|
||||
# touch /mnt/playground/testfile.txt
|
||||
# chown :tecmint /mnt/playground/testfile.txt
|
||||
# chmod 770 /mnt/playground/testfile.txt
|
||||
|
||||
接着，依次切换为 johndoe 和 davenull 用户，并在文件中写入一些信息：
|
||||
|
||||
echo "My name is John Doe" > /mnt/playground/testfile.txt
|
||||
echo "My name is Dave Null" >> /mnt/playground/testfile.txt
|
||||
|
||||
到目前为止，一切正常。现在我们让用户 gacanepa 来向该文件执行写操作 – 则写操作将会失败，这是可以预料的。
|
||||
|
||||
但实际上我们需要用户 gacanepa(TA 不是组 tecmint 的成员)在文件 /mnt/playground/testfile.txt 上有写权限，那又该怎么办呢？首先映入你脑海里的可能是将该用户添加到组 tecmint 中。但那将使得他在所有该组具有写权限位的文件上均拥有写权限，但我们并不想这样，我们只想他能够在文件 /mnt/playground/testfile.txt 上有写权限。
|
||||
|
||||
# touch /mnt/playground/testfile.txt
|
||||
# chown :tecmint /mnt/playground/testfile.txt
|
||||
# chmod 777 /mnt/playground/testfile.txt
|
||||
# su johndoe
|
||||
$ echo "My name is John Doe" > /mnt/playground/testfile.txt
|
||||
$ su davenull
|
||||
$ echo "My name is Dave Null" >> /mnt/playground/testfile.txt
|
||||
|
||||
到目前为止，一切正常。现在我们让用户 gacanepa 来向该文件执行写操作 – 则写操作将会失败，这是可以预料的。
|
||||
|
||||
$ su gacanepa
|
||||
$ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt
|
||||
|
||||
|
||||
|
||||
管理用户的权限
|
||||
*管理用户的权限*
|
||||
|
||||
但实际上我们需要用户 gacanepa（他不是组 tecmint 的成员）在文件 /mnt/playground/testfile.txt 上有写权限，那又该怎么办呢？首先映入你脑海里的可能是将该用户添加到组 tecmint 中。但那将使得他在所有该组具有写权限位的文件上均拥有写权限，但我们并不想这样，我们只想他能够在文件 /mnt/playground/testfile.txt 上有写权限。
|
||||
|
||||
现在，让我们给用户 gacanepa 在 /mnt/playground/testfile.txt 文件上有读和写权限。
|
||||
|
||||
@ -90,7 +84,7 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
# setfacl -R -m u:gacanepa:rwx /mnt/playground
|
||||
|
||||
则你将成功地添加一条 ACL，运行 gacanepa 对那个测试文件可写。然后切换为 gacanepa 用户，并再次尝试向该文件写入一些信息：
|
||||
则你将成功地添加一条 ACL，允许 gacanepa 对那个测试文件可写。然后切换为 gacanepa 用户，并再次尝试向该文件写入一些信息：
|
||||
|
||||
$ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt
|
||||
|
||||
@ -100,9 +94,9 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
|
||||
|
||||
检查文件的 ACL
|
||||
*检查文件的 ACL*
|
||||
|
||||
要为目录设定默认 ACL(它的内容将被该目录下的文件继承，除非另外被覆写)，在规则前添加 `d:`并特别指定一个目录名，而不是文件名：
|
||||
要为目录设定默认 ACL（它的内容将被该目录下的文件继承，除非另外被覆写），在规则前添加 `d:`并特别指定一个目录名，而不是文件名：
|
||||
|
||||
# setfacl -m d:o:r /mnt/playground
|
||||
|
||||
@ -111,7 +105,7 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
|
||||
|
||||
在 Linux 中设定默认 ACL
|
||||
*在 Linux 中设定默认 ACL*
|
||||
|
||||
[在官方的 RHEL 7 存储管理指导手册的第 20 章][3] 中提供了更多有关 ACL 的例子，我极力推荐你看一看它并将它放在身边作为参考。
|
||||
|
||||
@ -129,7 +123,7 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
|
||||
|
||||
检查可用的 NFS 共享
|
||||
*检查可用的 NFS 共享*
|
||||
|
||||
要按照需求在本地客户端上使用命令行来挂载 NFS 网络共享，可使用下面的语法：
|
||||
|
||||
@ -139,7 +133,7 @@ POSIX 访问控制列表)来作为默认的挂载选项，而不像 ext3 或 ext
|
||||
|
||||
# mount -t nfs 192.168.0.10:/NFS-SHARE /mnt/nfs
|
||||
|
||||
若你得到如下的错误信息：“Job for rpc-statd.service failed. See “systemctl status rpc-statd.service”及“journalctl -xn” for details.”，请确保 `rpcbind` 服务被启用且已在你的系统中启动了。
|
||||
若你得到如下的错误信息：`Job for rpc-statd.service failed. See "systemctl status rpc-statd.service" and "journalctl -xn" for details.`，请确保 `rpcbind` 服务被启用且已在你的系统中启动了。
|
||||
|
||||
# systemctl enable rpcbind.socket
|
||||
# systemctl restart rpcbind.service
|
||||
@ -162,7 +156,7 @@ Samba 代表一个特别的工具，使得在由 *nix 和 Windows 机器组成
|
||||
|
||||
|
||||
|
||||
检查 Samba 共享
|
||||
*检查 Samba 共享*
|
||||
|
||||
要在本地客户端上挂载 Samba 网络共享，你需要已安装好 cifs-utils 软件包：
|
||||
|
||||
@ -176,14 +170,14 @@ Samba 代表一个特别的工具，使得在由 *nix 和 Windows 机器组成
|
||||
|
||||
# mount -t cifs -o credentials=~/.smbcredentials //192.168.0.10/gacanepa /mnt/samba
|
||||
|
||||
其中 `smbcredentials`
|
||||
其中 `.smbcredentials` 的内容是：
|
||||
|
||||
username=gacanepa
|
||||
password=XXXXXX
|
||||
|
||||
是一个位于 root 用户的家目录(/root/) 中的隐藏文件，其权限被设置为 600，所以除了该文件的属主外，其他人对该文件既不可读也不可写。
|
||||
它是一个位于 root 用户的家目录(/root/) 中的隐藏文件，其权限被设置为 600，所以除了该文件的属主外，其他人对该文件既不可读也不可写。
|
||||
|
||||
请注意 samba_share 是 Samba 分享的名称，由上面展示的 `smbclient -L remote_host` 所返回。
|
||||
请注意 samba_share 是 Samba 共享的名称，由上面展示的 `smbclient -L remote_host` 所返回。
|
||||
|
||||
现在，若你需要在系统启动时自动地使得 Samba 分享可用，可以向 /etc/fstab 文件添加一个像下面这样的有效条目：
|
||||
|
||||
@ -197,7 +191,7 @@ Samba 代表一个特别的工具，使得在由 *nix 和 Windows 机器组成
|
||||
|
||||
在这篇文章中，我们已经解释了如何在 Linux 中设置 ACL，并讨论了如何在一个 RHEL 7 客户端上挂载 CIFS 和 NFS 网络共享。
|
||||
|
||||
我建议你去练习这些概念，甚至混合使用它们(试着在一个挂载的网络共享上设置 ACL)，直至你感觉舒适。假如你有问题或评论，请随时随意地使用下面的评论框来联系我们。另外，请随意通过你的社交网络分享这篇文章。
|
||||
我建议你去练习这些概念，甚至混合使用它们（试着在一个挂载的网络共享上设置 ACL），直至你感觉掌握了。假如你有问题或评论，请随时随意地使用下面的评论框来联系我们。另外，请随意通过你的社交网络分享这篇文章。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
@ -205,11 +199,11 @@ via: http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-partitions-in-linux/
|
||||
[2]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/
|
||||
[1]:https://linux.cn/article-6257-1.html
|
||||
[2]:https://linux.cn/article-6187-1.html
|
||||
[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html
|
||||
@ -1,26 +1,27 @@
|
||||
RHCSA 系列：安全 SSH，设定主机名及开启网络服务 – Part 8
|
||||
RHCSA 系列（八）: 加固 SSH，设定主机名及启用网络服务
|
||||
================================================================================
|
||||
作为一名系统管理员，你将经常使用一个终端模拟器来登陆到一个远程的系统中，执行一系列的管理任务。你将很少有机会坐在一个真实的(物理)终端前，所以你需要设定好一种方法来使得你可以登陆到你被要求去管理的那台远程主机上。
|
||||
|
||||
事实上，当你必须坐在一台物理终端前的时候，就可能是你登陆到该主机的最后一种方法。基于安全原因，使用 Telnet 来达到以上目的并不是一个好主意，因为穿行在线缆上的流量并没有被加密，它们以文本方式在传送。
|
||||
作为一名系统管理员，你将经常使用一个终端模拟器来登录到一个远程的系统中，执行一系列的管理任务。你将很少有机会坐在一个真实的（物理）终端前，所以你需要设定好一种方法来使得你可以登录到你需要去管理的那台远程主机上。
|
||||
|
||||
事实上，当你必须坐在一台物理终端前的时候，就可能是你登录到该主机的最后一种方法了。基于安全原因，使用 Telnet 来达到以上目的并不是一个好主意，因为穿行在线缆上的流量并没有被加密，它们以明文方式在传送。
|
||||
|
||||
另外，在这篇文章中，我们也将复习如何配置网络服务来使得它在开机时被自动开启，并学习如何设置网络和静态或动态地解析主机名。
|
||||
|
||||
|
||||
|
||||
RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
*RHCSA: 安全 SSH 和开启网络服务 – Part 8*
|
||||
|
||||
### 安装并确保 SSH 通信安全 ###
|
||||
|
||||
对于你来说，要能够使用 SSH 远程登陆到一个 RHEL 7 机子，你必须安装 `openssh`，`openssh-clients` 和 `openssh-servers` 软件包。下面的命令不仅将安装远程登陆程序，也会安装安全的文件传输工具以及远程文件复制程序：
|
||||
对于你来说，要能够使用 SSH 远程登录到一个 RHEL 7 机子，你必须安装 `openssh`，`openssh-clients` 和 `openssh-servers` 软件包。下面的命令不仅将安装远程登录程序，也会安装安全的文件传输工具以及远程文件复制程序：
|
||||
|
||||
# yum update && yum install openssh openssh-clients openssh-servers
|
||||
|
||||
注意，安装上服务器所需的相应软件包是一个不错的主意，因为或许在某个时刻，你想使用同一个机子来作为客户端和服务器。
|
||||
注意，也安装上服务器所需的相应软件包是一个不错的主意，因为或许在某个时刻，你想使用同一个机子来作为客户端和服务器。
|
||||
|
||||
在安装完成后，如若你想安全地访问你的 SSH 服务器，你还需要考虑一些基本的事情。下面的设定应该在文件 `/etc/ssh/sshd_config` 中得以呈现。
|
||||
在安装完成后，如若你想安全地访问你的 SSH 服务器，你还需要考虑一些基本的事情。下面的设定应该出现在文件 `/etc/ssh/sshd_config` 中。
|
||||
|
||||
1. 更改 sshd 守护进程的监听端口，从 22(默认的端口值)改为一个更高的端口值(2000 或更大)，但首先要确保所选的端口没有被占用。
|
||||
1、 更改 sshd 守护进程的监听端口，从 22（默认的端口值）改为一个更高的端口值（2000 或更大），但首先要确保所选的端口没有被占用。
|
||||
|
||||
例如，让我们假设你选择了端口 2500 。使用 [netstat][1] 来检查所选的端口是否被占用：
|
||||
|
||||
@ -30,17 +31,17 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
Port 2500
|
||||
|
||||
2. 只允许协议 2:
|
||||
2、 只允许协议 2（LCTT 译注：SSHv1 已经被证明不安全，默认情况下 SSHv1 和 SSHv2 都支持，所以应该显示去掉如下配置行的注释，并只支持 SSHv2。）：
|
||||
|
||||
Protocol 2
|
||||
|
||||
3. 配置验证超时的时间为 2 分钟，不允许以 root 身份登陆，并将允许通过 ssh 登陆的人数限制到最小：
|
||||
3、 配置验证超时的时间为 2 分钟，不允许以 root 身份登录，并将允许通过 ssh 登录的人数限制到最小：
|
||||
|
||||
LoginGraceTime 2m
|
||||
PermitRootLogin no
|
||||
AllowUsers gacanepa
|
||||
|
||||
4. 假如可能，使用基于公钥的验证方式而不是使用密码：
|
||||
4、 假如可能，使用基于公钥的验证方式而不是使用密码：
|
||||
|
||||
PasswordAuthentication no
|
||||
RSAAuthentication yes
|
||||
@ -48,13 +49,13 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
这假设了你已经在你的客户端机子上创建了带有你的用户名的一个密钥对，并将公钥复制到了你的服务器上。
|
||||
|
||||
- [开启 SSH 无密码登陆][2]
|
||||
- [开启 SSH 无密码登录][2]
|
||||
|
||||
### 配置网络和名称的解析 ###
|
||||
|
||||
1. 每个系统管理员应该对下面这个系统配置文件非常熟悉：
|
||||
1、 每个系统管理员都应该对下面这个系统配置文件非常熟悉：
|
||||
|
||||
- /etc/hosts 被用来在小型网络中解析名称 <---> IP 地址。
|
||||
- /etc/hosts 被用来在小型网络中解析“名称” <---> “IP 地址”。
|
||||
|
||||
文件 `/etc/hosts` 中的每一行拥有如下的结构：
|
||||
|
||||
@ -64,7 +65,7 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
192.168.0.10 laptop laptop.gabrielcanepa.com.ar
|
||||
|
||||
2. `/etc/resolv.conf` 特别指定 DNS 服务器的 IP 地址和搜索域，它被用来在没有提供域名后缀时，将一个给定的查询名称对应为一个全称域名。
|
||||
2、 `/etc/resolv.conf` 特别指定 DNS 服务器的 IP 地址和搜索域，它被用来在没有提供域名后缀时，将一个给定的查询名称对应为一个全称域名。
|
||||
|
||||
在正常情况下，你不必编辑这个文件，因为它是由系统管理的。然而，若你非要改变 DNS 服务器的 IP 地址，建议你在该文件的每一行中，都应该遵循下面的结构：
|
||||
|
||||
@ -74,7 +75,7 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
nameserver 8.8.8.8
|
||||
|
||||
3. `/etc/host.conf` 特别指定在一个网络中主机名被解析的方法和顺序。换句话说，告诉名称解析器使用哪个服务，并以什么顺序来使用。
|
||||
3、 `/etc/host.conf` 特别指定在一个网络中主机名被解析的方法和顺序。换句话说，告诉名称解析器使用哪个服务，并以什么顺序来使用。
|
||||
|
||||
尽管这个文件由几个选项，但最为常见和基本的设置包含如下的一行：
|
||||
|
||||
@ -82,12 +83,12 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
它意味着解析器应该首先查看 `resolv.conf` 中特别指定的域名服务器，然后到 `/etc/hosts` 文件中查找解析的名称。
|
||||
|
||||
4. `/etc/sysconfig/network` 包含了所有网络接口的路由和全局主机信息。下面的值可能会被使用：
|
||||
4、 `/etc/sysconfig/network` 包含了所有网络接口的路由和全局主机信息。下面的值可能会被使用：
|
||||
|
||||
NETWORKING=yes|no
|
||||
HOSTNAME=value
|
||||
|
||||
其中的 value 应该是全称域名(FQDN)。
|
||||
其中的 value 应该是全称域名（FQDN）。
|
||||
|
||||
GATEWAY=XXX.XXX.XXX.XXX
|
||||
|
||||
@ -97,7 +98,7 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
在一个带有多个网卡的机器中， value 为网关设备名，例如 enp0s3。
|
||||
|
||||
5. 位于 `/etc/sysconfig/network-scripts` 中的文件(网络适配器配置文件)。
|
||||
5、 位于 `/etc/sysconfig/network-scripts` 中的文件（网络适配器配置文件）。
|
||||
|
||||
在上面提到的目录中，你将找到几个被命名为如下格式的文本文件。
|
||||
|
||||
@ -107,26 +108,27 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
|
||||
|
||||
检查网络连接状态
|
||||
*检查网络连接状态*
|
||||
|
||||
例如：
|
||||
|
||||
|
||||
|
||||
网络文件
|
||||
*网络文件*
|
||||
|
||||
除了环回接口,你还可以为你的网卡进行一个相似的配置。注意，假如设定了某些变量，它们将为这个特别的接口，覆盖掉 `/etc/sysconfig/network` 中定义的值。在这篇文章中，为了能够解释清楚，每行都被加上了注释，但在实际的文件中，你应该避免加上注释：
|
||||
除了环回接口（loopback），你还可以为你的网卡指定相似的配置。注意，假如设定了某些变量，它们将为这个指定的接口覆盖掉 `/etc/sysconfig/network` 中定义的默认值。在这篇文章中，为了能够解释清楚，每行都被加上了注释，但在实际的文件中，你应该避免加上注释：
|
||||
|
||||
HWADDR=08:00:27:4E:59:37 # The MAC address of the NIC
|
||||
TYPE=Ethernet # Type of connection
|
||||
BOOTPROTO=static # This indicates that this NIC has been assigned a static IP. If this variable was set to dhcp, the NIC will be assigned an IP address by a DHCP server and thus the next two lines should not be present in that case.
|
||||
HWADDR=08:00:27:4E:59:37 ### 网卡的 MAC 地址
|
||||
TYPE=Ethernet ### 连接类型
|
||||
BOOTPROTO=static ### 这代表着该网卡指定了一个静态地址。
|
||||
### 如果这个值指定为 dhcp，这个网卡会从 DHCP 服务器获取 IP 地址，并且就不应该出现以下两行。
|
||||
IPADDR=192.168.0.18
|
||||
NETMASK=255.255.255.0
|
||||
GATEWAY=192.168.0.1
|
||||
NM_CONTROLLED=no # Should be added to the Ethernet interface to prevent NetworkManager from changing the file.
|
||||
NM_CONTROLLED=no ### 应该给以太网卡设置，以便可以让 NetworkManager 可以修改这个文件。
|
||||
NAME=enp0s3
|
||||
UUID=14033805-98ef-4049-bc7b-d4bea76ed2eb
|
||||
ONBOOT=yes # The operating system should bring up this NIC during boot
|
||||
ONBOOT=yes ### 操作系统会在启动时打开这个网卡。
|
||||
|
||||
### 设定主机名 ###
|
||||
|
||||
@ -138,7 +140,7 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
|
||||
|
||||
检查系统的主机名
|
||||
*检查系统的主机名*
|
||||
|
||||
要更改主机名，使用
|
||||
|
||||
@ -148,13 +150,13 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
# hostnamectl set-hostname cinderella
|
||||
|
||||
要想使得更改生效，你需要重启 hostnamed 守护进程(这样你就不必因为要应用更改而登出系统并再登陆系统)：
|
||||
要想使得更改生效，你需要重启 hostnamed 守护进程（这样你就不必因为要应用更改而登出并再登录系统）：
|
||||
|
||||
# systemctl restart systemd-hostnamed
|
||||
|
||||
|
||||
|
||||
设定系统主机名
|
||||
*设定系统主机名*
|
||||
|
||||
另外， RHEL 7 还包含 `nmcli` 工具，它可被用来达到相同的目的。要展示主机名，运行：
|
||||
|
||||
@ -170,13 +172,13 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
|
||||
|
||||
使用 nmcli 命令来设定主机名
|
||||
*使用 nmcli 命令来设定主机名*
|
||||
|
||||
### 在开机时开启网络服务 ###
|
||||
|
||||
作为本文的最后部分，就让我们看看如何确保网络服务在开机时被自动开启。简单来说，这个可通过创建符号链接到某些由服务的配置文件中的 [Install] 小节中指定的文件来实现。
|
||||
作为本文的最后部分，就让我们看看如何确保网络服务在开机时被自动开启。简单来说，这个可通过创建符号链接到某些由服务的配置文件中的 `[Install]` 小节中指定的文件来实现。
|
||||
|
||||
以 firewalld(/usr/lib/systemd/system/firewalld.service) 为例：
|
||||
以 firewalld（/usr/lib/systemd/system/firewalld.service） 为例：
|
||||
|
||||
[Install]
|
||||
WantedBy=basic.target
|
||||
@ -192,11 +194,11 @@ RHCSA: 安全 SSH 和开启网络服务 – Part 8
|
||||
|
||||
|
||||
|
||||
在开机时开启服务
|
||||
*在开机时开启服务*
|
||||
|
||||
### 总结 ###
|
||||
|
||||
在这篇文章中，我们总结了如何安装 SSH 及使用它安全地连接到一个 RHEL 服务器，如何改变主机名，并在最后如何确保在系统启动时开启服务。假如你注意到某个服务启动失败，你可以使用 `systemctl status -l [service]` 和 `journalctl -xn` 来进行排错。
|
||||
在这篇文章中，我们总结了如何安装 SSH 及使用它安全地连接到一个 RHEL 服务器；如何改变主机名，并在最后如何确保在系统启动时开启服务。假如你注意到某个服务启动失败，你可以使用 `systemctl status -l [service]` 和 `journalctl -xn` 来进行排错。
|
||||
|
||||
请随意使用下面的评论框来让我们知晓你对本文的看法。提问也同样欢迎。我们期待着你的反馈！
|
||||
|
||||
@ -206,10 +208,10 @@ via: http://www.tecmint.com/rhcsa-series-secure-ssh-set-hostname-enable-network-
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/20-netstat-commands-for-linux-network-management/
|
||||
[2]:http://www.tecmint.com/ssh-passwordless-login-using-ssh-keygen-in-5-easy-steps/
|
||||
[2]:https://linux.cn/article-5444-1.html
|
||||
@ -0,0 +1,44 @@
|
||||
Meet The New Ubuntu 15.10 Default Wallpaper
|
||||
================================================================================
|
||||
**The brand new default wallpaper for Ubuntu 15.10 Wily Werewolf has been unveiled. **
|
||||
|
||||
At first glance you may find little has changed from the origami-inspired ‘Suru’ design shipped with April’s release of Ubuntu 15.04. But look closer and you’ll see that the new default background does feature some subtle differences.
|
||||
|
||||
For one it looks much lighter, helped by an orange glow emanating from the upper-left of the image. The angular folds and sections remain, but with the addition of blocky, rectangular sections.
|
||||
|
||||
The new background has been designed by Canonical Design Team member Alex Milazzo.
|
||||
|
||||
|
||||
|
||||
The Ubuntu 15.10 default desktop wallpaper
|
||||
|
||||
And just to show that there is a change, here is the Ubuntu 15.04 default wallpaper for comparison:
|
||||
|
||||
|
||||
|
||||
The Ubuntu 15.04 default desktop wallpaper
|
||||
|
||||
### Download Ubuntu 15.10 Wallpaper ###
|
||||
|
||||
If you’re running daily builds of Ubuntu 15.10 Wily Werewolf and don’t yet see this as your default wallpaper you’ve no broken anything: the design has been unveiled but is, as of writing, yet to be packaged and uploaded to Wily itself.
|
||||
|
||||
You don’t have to wait until October to use the new design as your desktop background. You can download the wallpaper in a huge HiDPI display friendly 4096×2304 resolution by hitting the button below.
|
||||
|
||||
- [Download Ubuntu the new 15.10 Default Wallpaper][1]
|
||||
|
||||
Finally, as we say this every time there’s a new wallpaper, you don’t have to care about the minutiae of distribution branding and design. If the new wallpaper is not to your tastes or you never keep it you can, as ever, easily change it — this isn’t the Ubuntu Phone after all!
|
||||
|
||||
**Are you a fan of the refreshed look? Let us know in the comments below. **
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.omgubuntu.co.uk/2015/09/ubuntu-15-10-wily-werewolf-default-wallpaper
|
||||
|
||||
作者：[Joey-Elijah Sneddon][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://plus.google.com/117485690627814051450/?rel=author
|
||||
[1]:https://launchpadlibrarian.net/218258177/Wolf_Wallpaper_Desktop_4096x2304_Purple_PNG-24.png
|
||||
@ -1,63 +0,0 @@
|
||||
Is Linux Right For You?
|
||||
================================================================================
|
||||
> Not everyone should opt for Linux -- for many users, remaining with Windows or OSX is the better choice.
|
||||
|
||||
I enjoy using Linux on the desktop. Not because of software politics or because I despise other operating systems. I simply like Linux because it just works.
|
||||
|
||||
It's been my experience that not everyone is cut out for the Linux lifestyle. In this article, I'll help you run through the pros and cons of making the switch to Linux so you can determine if switching is right for you.
|
||||
|
||||
### When to make the switch ###
|
||||
|
||||
Switching to Linux makes sense when there is a decisive reason to do so. The same can be said about moving from Windows to OS X or vice versa. In order to have success with switching, you must be able to identify your reason for jumping ship in the first place.
|
||||
|
||||
For some people, the reason for switching is frustration with their current platform. Maybe the latest upgrade left them with a lousy experience and they're ready to chart new horizons. In other instances, perhaps it's simply a matter of curiosity. Whatever the motivation, you must have a good reason for switching operating systems. If you're pushing yourself in this direction without a good reason, then no one wins.
|
||||
|
||||
However, there are exceptions to every rule. And if you're really interested in trying Linux on the desktop, then maybe coming to terms with a workable compromise is the way to go.
|
||||
|
||||
### Starting off slow ###
|
||||
|
||||
After trying Linux for the first time, I've seen people blast their Windows installation to bits because they had a good experience with Ubuntu on a flash drive for 20 minutes. Folks, this isn't a test. Instead I'd suggest the following:
|
||||
|
||||
- Run the [Linux distro in a virtual machine][1] for a week. This means you are committing to running that distro for all browser work, email and other tasks you might otherwise do on that machine.
|
||||
- If running a VM for a week is too resource intensive, try doing the same with a USB drive running Linux that offers [some persistent storage][2]. This will allow you to leave your main OS alone and intact. At the same time, you'll still be able to "live inside" of your Linux distribution for a week.
|
||||
- If you find that everything is successful after a week of running Linux, the next step is to examine how many times you booted into Windows that week. If only occasionally, then the next step is to look into [dual-booting Windows][3] and Linux. For those of you that only found themselves using their Linux distro, it might be worth considering making the switch full time.
|
||||
- Before you hose your Windows partition completely, it might make more sense to purchase a second hard drive to install Linux onto instead. This allows you to dual-boot, but to do so with ample hard drive space. It also makes Windows available to you if something should come up.
|
||||
|
||||
### What do you gain adopting Linux? ###
|
||||
|
||||
So what does one gain by switching to Linux? Generally it comes down to personal freedom for most people. With Linux, if something isn't to your liking, you're free to change it. Using Linux also saves users oodles of money in avoiding hardware upgrades and unnecessary software expenses. Additionally, you're not burdened with tracking down lost license keys for software. And if you dislike the direction a particular distribution is headed, you can switch to another distribution with minimal hassle.
|
||||
|
||||
The sheer volume of desktop choice on the Linux desktop is staggering. This level of choice might even seem overwhelming to the newcomer. But if you find a distro base (Debian, Fedora, Arch, etc) that you like, the hard work is already done. All you need to do now is find a variation of the distro and the desktop environment you prefer.
|
||||
|
||||
Now one of the most common complaints I hear is that there isn't much in the way of software for Linux. However, this isn't accurate at all. While other operating systems may have more of it, today's Linux desktop has applications to do just about anything you can think of. Video editing (home and pro-level), photography, office management, remote access, music (listening and creation), plus much, much more.
|
||||
|
||||
### What you lose adopting Linux? ###
|
||||
|
||||
As much as I enjoy using Linux, my wife's home office relies on OS X. She's perfectly content using Linux for some tasks, however she relies on OS X for specific software not available for Linux. This is a common problem that many people face when first looking at making the switch. You must decide whether or not you're going to be losing out on critical software if you make the switch.
|
||||
|
||||
Sometimes the issue is because the software has content locked down with it. In other cases, it's a workflow and functionality that was found with the legacy applications and not with the software available for Linux. I myself have never experienced this type of challenge, but I know those who have. Many of the software titles available for Linux are also available for other operating systems. So if there is a concern about such things, I encourage you to try out comparable apps on your native OS first.
|
||||
|
||||
Another thing you might lose by switching to Linux is the luxury of local support when you need it. People scoff at this, but I know of countless instances where a newcomer to Linux was dismayed to find their only recourse for solving Linux challenges was from strangers on the Web. This is especially problematic if their only PC is the one having issues. Windows and OS X users are spoiled in that there are endless support techs in cities all over the world that support their platform(s).
|
||||
|
||||
### How to proceed from here ###
|
||||
|
||||
Perhaps the single biggest piece of advice to remember is always have a fallback plan. Remember, once you wipe that copy of Windows 10 from your hard drive, you may find yourself spending money to get it reinstalled. This is especially true for those of you who upgrade from other Windows releases. Accepting this, persistent flash drives with Linux or dual-booting Windows and Linux is always a preferable way forward for newcomers. Odds are that you may be just fine and take to Linux like a fish to water. But having that fallback plan in place just means you'll sleep better at night.
|
||||
|
||||
If instead you've been relying on a dual-boot installation for weeks and feel ready to take the plunge, then by all means do it. Wipe your drive and start off with a clean installation of your favorite Linux distribution. I've been a full time Linux enthusiast for years and I can tell you for certain, it's a great feeling. How long? Let's just say my first Linux experience was with early Red Hat. I finally installed a dedicated installation on my laptop by 2003.
|
||||
|
||||
Existing Linux enthusiasts, where did you first get started? Was your switch an exciting one or was it filled with angst? Hit the Comments and share your experiences.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.datamation.com/open-source/is-linux-right-for-you.html
|
||||
|
||||
作者：[Matt Hartley][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.datamation.com/author/Matt-Hartley-3080.html
|
||||
[1]:http://www.psychocats.net/ubuntu/virtualbox
|
||||
[2]:http://www.howtogeek.com/howto/14912/create-a-persistent-bootable-ubuntu-usb-flash-drive/
|
||||
[3]:http://www.linuxandubuntu.com/home/dual-boot-ubuntu-15-04-14-10-and-windows-10-8-1-8-step-by-step-tutorial-with-screenshots
|
||||
@ -0,0 +1,30 @@
|
||||
Italy's Ministry of Defense to Drop Microsoft Office in Favor of LibreOffice
|
||||
================================================================================
|
||||
>**LibreItalia's Italo Vignoli [reports][1] that the Italian Ministry of Defense is about to migrate to the LibreOffice open-source software for productivity and adopt the Open Document Format (ODF), while moving away from proprietary software products.**
|
||||
|
||||
The movement comes in the form of a [collaboration][1] between Italy's Ministry of Defense and the LibreItalia Association. Sonia Montegiove, President of the LibreItalia Association, and Ruggiero Di Biase, Rear Admiral and General Executive Manager of Automated Information Systems of the Ministry of Defense in Italy signed an agreement for a collaboration to adopt the LibreOffice office suite in all of the Ministry's offices.
|
||||
|
||||
While the LibreItalia non-profit organization promises to help the Italian Ministry of Defense with trainers for their offices across the country, the Ministry will start the implementation of the LibreOffice software on October 2015 with online training courses for their staff. The entire transition process is expected to be completed by the end of year 2016\. An Italian law lets officials find open source software alternatives to well-known commercial software.
|
||||
|
||||
"Under the agreement, the Italian Ministry of Defense will develop educational content for a series of online training courses on LibreOffice, which will be released to the community under Creative Commons, while the partners, LibreItalia, will manage voluntarily the communication and training of trainers in the Ministry," says Italo Vignoli, Honorary President of LibreItalia.
|
||||
|
||||
### The Ministry of Defense will adopt the Open Document Format (ODF)
|
||||
|
||||
The initiative will allow the Italian Ministry of Defense to be independent from proprietary software applications, which are aimed at individual productivity, and adopt open source document format standards like Open Document Format (ODF), which is used by default in the LibreOffice office suite. The project follows similar movements already made by governments of other European countries, including United Kingdom, France, Spain, Germany, and Holland.
|
||||
|
||||
It would appear that numerous other public institutions all over Italy are using open source alternatives, including the Italian Region Emilia Romagna, Galliera Hospital in Genoa, Macerata, Cremona, Trento and Bolzano, Perugia, the municipalities of Bologna, ASL 5 of Veneto, Piacenza and Reggio Emilia, and many others. AGID (Agency for Digital Italy) welcomes this project and hopes that other public institutions will do the same.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://news.softpedia.com/news/italy-s-ministry-of-defense-to-drop-microsoft-office-in-favor-of-libreoffice-491850.shtml
|
||||
|
||||
作者：[Marius Nestor][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://news.softpedia.com/editors/browse/marius-nestor
|
||||
[1]:http://www.libreitalia.it/accordo-di-collaborazione-tra-associazione-libreitalia-onlus-e-difesa-per-ladozione-del-prodotto-libreoffice-quale-pacchetto-di-produttivita-open-source-per-loffice-automation/
|
||||
[2]:http://www.libreitalia.it/chi-siamo/
|
||||
@ -0,0 +1,72 @@
|
||||
14 tips for teaching open source development
|
||||
================================================================================
|
||||
Academia is an excellent platform for training and preparing the open source developers of tomorrow. In research, we occasionally open source software we write. We do this for two reasons. One, to promote the use of the tools we produce. And two, to learn more about the impact and issues other people face when using them. With this background of writing research software, I was tasked with redesigning the undergraduate software engineering course for second-year students at the University of Bradford.
|
||||
|
||||
It was a challenge, as I was faced with 80 students coming for different degrees, including IT, business computing, and software engineering, all in the same course. The hardest part was working with students with a wide range of programming experience levels. Traditionally, the course had involved allowing students to choose their own teams, tasking them with building a garage database system and then submitting a report in the end as part of the assessment.
|
||||
|
||||
I decided to redesign the course to give students insight into the process of working on real-world software teams. I divided the students into teams of five or six, based on their degrees and programming skills. The aim was to have an equal distribution of skills across the teams to prevent any unfair advantage of one team over another.
|
||||
|
||||
### The core lessons ###
|
||||
|
||||
The course format was updated to have both lectures and lab sessions. However, the lab session functioned as mentoring sessions, where instructors visited each team to ask for updates and see how the teams were progressing with the clients and the products. There were traditional lectures on project management, software testing, requirements engineering, and similar topics, supplemented by lab sessions and mentor meetings. These meetings allowed us to check up on students' progress and monitor whether they were following the software engineering methodologies taught in the lecture portion. Topics we taught this year included:
|
||||
|
||||
- Requirements engineering
|
||||
- How to interact with clients and other team members
|
||||
- Software methodologies, such as agile and extreme programming approaches
|
||||
- How to use different software engineering approaches and work through sprints
|
||||
- Team meetings and documentations
|
||||
- Project management and Gantt charts
|
||||
- UML diagrams and system descriptions
|
||||
- Code revisioning using Git
|
||||
- Software testing and bug tracking
|
||||
- Using open source libraries for their tools
|
||||
- Open source licenses and which one to use
|
||||
- Software delivery
|
||||
|
||||
Along with these lectures, we had a few guest speakers from the corporate world talk about their practices in software product deliveries. We also managed to get the university’s intellectual property lawyer to come and talk about IP issues surrounding software in the UK, and how to handle any intellectual properties issues in software.
|
||||
|
||||
### Collaboration tools ###
|
||||
|
||||
To make all of the above possible, a number of tools were introduced. Students were trained on how to use them for their projects. These included:
|
||||
|
||||
- Google Drive folders shared within the team and the tutor, to maintain documents and spreadsheets for project descriptions, requirements gathering, meeting minutes, and time tracking of the project. This was an extremely efficient way to monitor and also provide feedback straight into the folders for each team.
|
||||
- [Basecamp][1] for document sharing as well, and later in the course we considered this as a possible replacement for Google Drive.
|
||||
- Bug reporting tools such as [Mantis][2] again have a limited users for free reporting. Later Git itself was being used for bug reports n any tools by the testers in the teams
|
||||
- Remote videoconferencing tools were used as a number of clients were off-campus, and sometimes not even in the same city. The students were regularly using Skype to communicate with them, documenting their meetings and sometimes even recording them for later use.
|
||||
- A number of open source tool kits were also used for students' projects. The students were allowed to choose their own tool kits and languages based on the requirements of the projects. The only condition was that these have to be open source and could be installed in the university labs, which the technical staff was extremely supportive of.
|
||||
- In the end all teams had to deliver their projects to the client, including complete working version of the software, documentation, and open source licenses of their own choosing. Most of the teams chose the GPL version 3 license.
|
||||
|
||||
### Tips and lessons learned ###
|
||||
|
||||
In the end, it was a fun year and nearly all students did very well. Here are some of the lessons I learned which may help improve the course next year:
|
||||
|
||||
1. Give the students a wide variety of choice in projects that are interesting, such as game development or mobile application development, and projects with goals. Working with mundane database systems is not going to keep most students interested. Working with interesting projects, most students became self-learners, and were also helping others in their teams and outside to solve some common issues. The course also had a message list, where students were posting any issues they were encountering, in hopes of receiving advice from others. However, there was a drawback to this approach. The external examiners have advised us to go back to a style of one type of project, and one type of language to help narrow the assessment criteria for the students.
|
||||
1. Give students regular feedback on their performance at every stage. This could be done during the mentoring meetings with the teams, or at other stages, to help them improve the work for next time.
|
||||
1. Students are more than willing to work with clients from outside university! They look forward to working with external company representatives or people outside the university, just because of the new experience. They were all able to display professional behavior when interacting with their mentors, which put the instructors at ease.
|
||||
1. A lot of teams left developing unit testing until the end of the project, which from an extreme programming methodology standpoint was a serious no-no. Maybe testing should be included at the assessments of the various stages to help remind students that they need to be developing unit tests in parallel with the software.
|
||||
1. In the class of 80, there were only four girls, each working in different teams. I observed that boys were very ready to take on roles as team leads, assigning the most interesting code pieces to themselves and the girls were mostly following instructions or doing documentation. For some reason, the girls choose not to show authority or preferred not to code even when they were encouraged by a female instructor. This is still a major issue that needs to be addressed.
|
||||
1. There are different styles of documentation such as using UML, state diagrams, and others. Allow students to learn them all and merge with other courses during the year to improve their learning experience.
|
||||
1. Some students were very good developers, but some doing business computing had very little coding experience. The teams were encouraged to work together to prevent the idea that developer would get better marks than other team members if they were only doing meeting minutes or documentations. Roles were also encouraged to be rotated during mentoring sessions to see that everyone was getting a chance to learn how to program.
|
||||
1. Allowing the team to meet with the mentor every week was helpful in monitoring team activities. It also showed who was doing the most work. Usually students who were not participating in their groups would not come to meetings, and could be identified by the work being presented by other members every week.
|
||||
1. We encouraged students to attach licenses to their work and identify intellectual property issues when working with external libraries and clients. This allowed students to think out of the box and learn about real-world software delivery problems.
|
||||
1. Give students room to choose their own technologies.
|
||||
1. Having teaching assistants is key. Managing 80 students was very difficult, especially on the weeks when they were being assessed. Next year I would definitely have teaching assistants helping me with the teams.
|
||||
1. A supportive tech support for the lab is very important. The university tech support was extremely supportive of the course. Next year, they are talking about having virtual machines assigned to teams, so the teams can install any software on their own virtual machine as needed.
|
||||
1. Teamwork helps. Most teams exhibited a supportive nature to other team members, and mentoring also helped.
|
||||
1. Additional support from other staff members is a plus. As a new academic, I needed to learn from experience and also seek advice at multiple points on how to handle certain students and teams if I was confused on how to engage them with the course. Support from senior staff members was very encouraging to me.
|
||||
|
||||
In the end, it was a fun course—not only for the me as an instructor, but for the students as well. There were some issues with learning objectives and traditional grading schemes that still need to be ironed out to reduce the workload it produced on the instructors. For next year, I plan to keep this same format, but hope to come up with a better grading scheme and introduce more software tools that can help monitor project activities and code revisions.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://opensource.com/education/15/9/teaching-open-source-development-undergraduates
|
||||
|
||||
作者：[Mariam Kiran][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://opensource.com/users/mariamkiran
|
||||
[1]:https://basecamp.com/
|
||||
[2]:https://www.mantisbt.org/
|
||||
@ -1,85 +0,0 @@
|
||||
alim0x translating
|
||||
|
||||
The history of Android
|
||||
================================================================================
|
||||
|
||||
Yet another Android Market redesign dips its toe into the "cards" interface that would become a Google staple.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
The Android Market released its fourth new design in Android's two-and-a-half years on the market. This new design was hugely important as it came really close to Google's "cards" interface. By displaying Apps or other content in little blocks, Google could seamlessly transition its app design between screens of various sizes with minimal effort. Content could be displayed just like photos in a gallery app—feed the layout renderer a big list of content blocks, enable screen wrapping, and you were done. Bigger screens saw more blocks of content, and smaller screens only saw a few at a time. With the content display out of the way, Google added a "Categories" fragment to the right side and a big featured app carousel at the top.
|
||||
|
||||
While the design was ready for an easily configurable interface, the functionality was not. The original shipping version of the market was locked to a landscape orientation and was Honeycomb-exclusive.
|
||||
|
||||
|
||||
The app page and "My Apps" interface.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
This new market sold not only apps, but brought Books and Movies rentals into the fold as well. Google was selling books since 2010; it was only ever through a Website. The new market unified all of Google's content sales in a single location and brought it one step closer to taking on Apple's iTunes juggernaut, though selling all of these items under the "Android Market" was a bit of a branding snafu, as much of the content didn't require Android to use.
|
||||
|
||||
|
||||
The browser did its best to look like Chrome, and Contacts used a two-pane interface.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
The new Browser added an honest-to-goodness tabs strip at the top of the interface. While this browser wasn't Chrome, it aped a lot of Chrome's design and features. Besides the pioneering tabs-on-top interface, it added Incognito tabs, which kept no history or autocomplete records. There was also an option to have a Chrome-style new tab page consisting of thumbnails of your most-viewed webpages.
|
||||
|
||||
The new Browser even synced with Chrome. After signing in to the browser, it would download your Chrome bookmarks and automatically sign in to Google Web pages with your account. Bookmarking a page was as easy as tapping on the star icon in the address bar. Just like Google Maps, the browser dumped the zoom buttons and went with all gesture controls.
|
||||
|
||||
The contacts app was finally removed from the phone app and broken out into a standalone app. The previous contacts/dialer hybrid was far too phone-centric for how people use a modern smartphone. Contacts housed information for e-mails, IM, texting, addresses, birthdays, and social networks, so tying it to the phone app makes just as much sense as trying it to Google Maps. With the telephony requirements out of the way, contacts could be simplified to a tab-less list of people. Honeycomb went with a dual pane view showing the full contact list on the left and contacts on the right. This again made use of a Fragments API; a hypothetical phone version of this app could show each panel as a single screen.
|
||||
|
||||
The Honeycomb version of Contacts was the first version to have a quick scroll feature. When grabbing the left scroll bar, you could quickly scroll up and down, and a letter preview showed your current spot in the list.
|
||||
|
||||
|
||||
The new YouTube app looked like something out of the Matrix.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
YouTube thankfully dumped the "unique" design Google came up with for 2.3 and gave the video service a cohesive design that looked like it belonged in Android. The main screen was a horizontally scrolling curved wall of video thumbnails that showed a most popular or (when signed in) personalized selection of videos. While Google never brought this design to phones, it could be considered an easily reconfigurable card interface. The action bar shined here as a reconfigurable toolbar. When not signed it, the action bar was filled with a search bar. When you were signed in, search shrank down to a button, and tabs for "Home," "Browse," and "Your Channel" were shown.
|
||||
|
||||
|
||||
Honeycomb really liked to drive home that it was a computer interface with blue scaffolding. Movie Studio completes the Tron look with an orange theme.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
The lone new app in Honeycomb was "Movie Studio," which was not a self-explanatory app and arrived with no explanations or instructions. As far as we could tell, you could import video clips, cut them up, and add text and scene transitions. Editing video—one of the most time consuming, difficult, and processor-intensive things you can do on a computer—on a tablet felt just a little too ambitious, and Google would completely remove this app in later versions. Our favorite part of Movie Studio was that it really completed the Tron theme. While the rest of the OS used blue highlights, this was all orange. (Movie Studio is an evil program!)
|
||||
|
||||
|
||||
Widgets!
|
||||
Photo by Ron Amadeo
|
||||
|
||||
Honeycomb brought a new widget framework that allowed for scrolling widgets, and the Gmail, Email, and Calendar widgets were upgraded to support it. YouTube and Books used a new widget that auto-scrolled through cards of content. By flicking up or down on the widget, you could scroll through the cards. We're not sure what the point of being constantly reminded of your book collection was, but it's there if you want it. While all of these widgets worked great on a 10-inch screen, Google never redesigned them for phones, making them practically useless on Android's most popular form factor. All the widgets had massive identifying headers and usually took up half the screen to show only a few items.
|
||||
|
||||
|
||||
The scrollable Recent Apps and resizable widgets in Android 3.1.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
Later versions of Honeycomb would fix many of the early problems 3.0 had. Android 3.1 was released three months after the first version of Honeycomb, and it brought several improvements. Resizable widgets were one of the biggest features added. After long pressing on a widget, a blue outline with grabbable handles would pop up around it, and dragging the handles around would resize the widget. The Recent Apps panel could now scroll vertically and held many more apps. The only feature missing from it at this point was the ability to swipe away apps.
|
||||
|
||||
Today, an 0.1 upgrade is a major release, but in Honeycomb, point releases were considerably smaller. Besides the few UI tweaks, 3.1 added support for gamepads, keyboards, mice, and other input devices over USB and Bluetooth. It also offered a few more developer APIs.
|
||||
|
||||
|
||||
Android 3.2's compatibility zoom and a typical stretched-out app on an Android tablet.
|
||||
Photo by Ron Amadeo
|
||||
|
||||
Android 3.2 launched two months after 3.1, adding support for smaller sized tablets in the seven- to eight-inch range. It finally enabled SD card support, which the Xoom carried like a vestigial limb for the first five months of its life.
|
||||
|
||||
Honeycomb was rushed out the door in order to be an ecosystem builder. No one will want an Android tablet if the tablet-specific apps aren't there, and Google knew it needed to get something in the hands of developers ASAP. At this early stage of Android's tablet ecosystem, the apps just weren't there. It was the biggest problem people had with the Xoom.
|
||||
|
||||
3.2 added "Compatibility Zoom," which gave users a new option of stretching apps to the screen (as shown in the right picture) or zooming the normal app layout to fit the screen. Neither option was ideal, and without the app ecosystem to support it, Honeycomb devices sold pretty poorly. Google's tablet moves would eventually pay off though. Today, Android tablets have [taken the market share crown from iOS][1].
|
||||
|
||||
----------
|
||||
|
||||
|
||||
|
||||
[Ron Amadeo][a] / Ron is the Reviews Editor at Ars Technica, where he specializes in Android OS and Google products. He is always on the hunt for a new gadget and loves to rip things apart to see how they work.
|
||||
|
||||
[@RonAmadeo][t]
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://arstechnica.com/gadgets/2014/06/building-android-a-40000-word-history-of-googles-mobile-os/18/
|
||||
|
||||
译者：[译者ID](https://github.com/译者ID) 校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:http://techcrunch.com/2014/03/03/gartner-195m-tablets-sold-in-2013-android-grabs-top-spot-from-ipad-with-62-share/
|
||||
[a]:http://arstechnica.com/author/ronamadeo
|
||||
[t]:https://twitter.com/RonAmadeo
|
||||
@ -1,3 +1,4 @@
|
||||
ictlyh Translating
|
||||
5 Useful Commands to Manage File Types and System Time in Linux – Part 3
|
||||
================================================================================
|
||||
Adapting to using the command line or terminal can be very hard for beginners who want to learn Linux. Because the terminal gives more control over a Linux system than GUIs programs, one has to get a used to running commands on the terminal. Therefore to memorize different commands in Linux, you should use the terminal on a daily basis to understand how commands are used with different options and arguments.
|
||||
|
||||
250
sources/tech/20150921 Configure PXE Server In Ubuntu 14.04.md
Normal file
250
sources/tech/20150921 Configure PXE Server In Ubuntu 14.04.md
Normal file
@ -0,0 +1,250 @@
|
||||
translation by strugglingyouth
|
||||
Configure PXE Server In Ubuntu 14.04
|
||||
================================================================================
|
||||
|
||||
|
||||
PXE (Preboot Execution Environment) Server allows the user to boot a Linux distribution from a network and install it on hundreds of PCs at a time without any Linux iso images. If your client’s computers don’t have CD/DVD or USB drives, or if you want to set up multiple computers at the same time in a large enterprise, then PXE server can be used to save money and time.
|
||||
|
||||
In this article we will show you how you can configure a PXE server in Ubuntu 14.04.
|
||||
|
||||
### Configure Networking ###
|
||||
|
||||
To get started, you need to first set up your PXE server to use a static IP. To set up a static IP address in your system, you need to edit the “/etc/network/interfaces” file.
|
||||
|
||||
1. Open the “/etc/network/interfaces” file.
|
||||
|
||||
sudo nano /etc/network/interfaces
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
# The loopback network interface
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
# The primary network interface
|
||||
auto eth0
|
||||
iface eth0 inet static
|
||||
address 192.168.1.20
|
||||
netmask 255.255.255.0
|
||||
gateway 192.168.1.1
|
||||
dns-nameservers 8.8.8.8
|
||||
|
||||
Save the file and exit. This will set its IP address to “192.168.1.20”. Restart the network service.
|
||||
|
||||
sudo /etc/init.d/networking restart
|
||||
|
||||
### Install DHCP, TFTP and NFS: ###
|
||||
|
||||
DHCP, TFTP and NFS are essential components for configuring a PXE server. First you need to update your system and install all necessary packages.
|
||||
|
||||
For this, run the following commands:
|
||||
|
||||
sudo apt-get update
|
||||
sudo apt-get install isc-dhcp-Server inetutils-inetd tftpd-hpa syslinux nfs-kernel-Server
|
||||
|
||||
### Configure DHCP Server: ###
|
||||
|
||||
DHCP stands for Dynamic Host Configuration Protocol, and it is used mainly for dynamically distributing network configuration parameters such as IP addresses for interfaces and services. A DHCP server in PXE environment allow clients to request and receive an IP address automatically to gain access to the network servers.
|
||||
|
||||
1. Edit the “/etc/default/dhcp3-server” file.
|
||||
|
||||
sudo nano /etc/default/dhcp3-server
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
INTERFACES="eth0"
|
||||
|
||||
Save (Ctrl + o) and exit (Ctrl + x) the file.
|
||||
|
||||
2. Edit the “/etc/dhcp3/dhcpd.conf” file:
|
||||
|
||||
sudo nano /etc/dhcp/dhcpd.conf
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
default-lease-time 600;
|
||||
max-lease-time 7200;
|
||||
subnet 192.168.1.0 netmask 255.255.255.0 {
|
||||
range 192.168.1.21 192.168.1.240;
|
||||
option subnet-mask 255.255.255.0;
|
||||
option routers 192.168.1.20;
|
||||
option broadcast-address 192.168.1.255;
|
||||
filename "pxelinux.0";
|
||||
next-Server 192.168.1.20;
|
||||
}
|
||||
|
||||
Save the file and exit.
|
||||
|
||||
3. Start the DHCP service.
|
||||
|
||||
sudo /etc/init.d/isc-dhcp-server start
|
||||
|
||||
### Configure TFTP Server: ###
|
||||
|
||||
TFTP is a file-transfer protocol which is similar to FTP. It is used where user authentication and directory visibility are not required. The TFTP server is always listening for PXE clients on the network. When it detects any network PXE client asking for PXE services, then it provides a network package that contains the boot menu.
|
||||
|
||||
1. To configure TFTP, edit the “/etc/inetd.conf” file.
|
||||
|
||||
sudo nano /etc/inetd.conf
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
tftp dgram udp wait root /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/tftpboot
|
||||
|
||||
Save and exit the file.
|
||||
|
||||
2. Edit the “/etc/default/tftpd-hpa” file.
|
||||
|
||||
sudo nano /etc/default/tftpd-hpa
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
TFTP_USERNAME="tftp"
|
||||
TFTP_DIRECTORY="/var/lib/tftpboot"
|
||||
TFTP_ADDRESS="[:0.0.0.0:]:69"
|
||||
TFTP_OPTIONS="--secure"
|
||||
RUN_DAEMON="yes"
|
||||
OPTIONS="-l -s /var/lib/tftpboot"
|
||||
|
||||
Save and exit the file.
|
||||
|
||||
3. Enable boot service for `inetd` to automatically start after every system reboot and start tftpd service.
|
||||
|
||||
sudo update-inetd --enable BOOT
|
||||
sudo service tftpd-hpa start
|
||||
|
||||
4. Check status.
|
||||
|
||||
sudo netstat -lu
|
||||
|
||||
It will show the following output:
|
||||
|
||||
Proto Recv-Q Send-Q Local Address Foreign Address State
|
||||
udp 0 0 *:tftp *:*
|
||||
|
||||
### Configure PXE boot files ###
|
||||
|
||||
Now you need the PXE boot file “pxelinux.0” to be present in the TFTP root directory. Make a directory structure for TFTP, and copy all the bootloader files provided by syslinux from the “/usr/lib/syslinux/” to the “/var/lib/tftpboot/” path by issuing the following commands:
|
||||
|
||||
sudo mkdir /var/lib/tftpboot
|
||||
sudo mkdir /var/lib/tftpboot/pxelinux.cfg
|
||||
sudo mkdir -p /var/lib/tftpboot/Ubuntu/14.04/amd64/
|
||||
sudo cp /usr/lib/syslinux/vesamenu.c32 /var/lib/tftpboot/
|
||||
sudo cp /usr/lib/syslinux/pxelinux.0 /var/lib/tftpboot/
|
||||
|
||||
#### Set up PXELINUX configuration file ####
|
||||
|
||||
The PXE configuration file defines the boot menu displayed to the PXE client when it boots up and contacts the TFTP server. By default, when a PXE client boots up, it will use its own MAC address to specify which configuration file to read, so we need to create that default file that contains the list of kernels which are available to boot.
|
||||
|
||||
Edit the PXE Server configuration file with valid installation options.
|
||||
|
||||
To edit “/var/lib/tftpboot/pxelinux.cfg/default,”
|
||||
|
||||
sudo nano /var/lib/tftpboot/pxelinux.cfg/default
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
DEFAULT vesamenu.c32
|
||||
TIMEOUT 100
|
||||
PROMPT 0
|
||||
MENU INCLUDE pxelinux.cfg/PXE.conf
|
||||
NOESCAPE 1
|
||||
LABEL Try Ubuntu 14.04 Desktop
|
||||
MENU LABEL Try Ubuntu 14.04 Desktop
|
||||
kernel Ubuntu/vmlinuz
|
||||
append boot=casper netboot=nfs nfsroot=192.168.1.20:/var/lib/tftpboot/Ubuntu/14.04/amd64
|
||||
initrd=Ubuntu/initrd.lz quiet splash
|
||||
ENDTEXT
|
||||
LABEL Install Ubuntu 14.04 Desktop
|
||||
MENU LABEL Install Ubuntu 14.04 Desktop
|
||||
kernel Ubuntu/vmlinuz
|
||||
append boot=casper automatic-ubiquity netboot=nfs nfsroot=192.168.1.20:/var/lib/tftpboot/Ubuntu/14.04/amd64
|
||||
initrd=Ubuntu/initrd.lz quiet splash
|
||||
ENDTEXT
|
||||
|
||||
Save and exit the file.
|
||||
|
||||
Edit the “/var/lib/tftpboot/pxelinux.cfg/pxe.conf” file.
|
||||
|
||||
sudo nano /var/lib/tftpboot/pxelinux.cfg/pxe.conf
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
MENU TITLE PXE Server
|
||||
NOESCAPE 1
|
||||
ALLOWOPTIONS 1
|
||||
PROMPT 0
|
||||
MENU WIDTH 80
|
||||
MENU ROWS 14
|
||||
MENU TABMSGROW 24
|
||||
MENU MARGIN 10
|
||||
MENU COLOR border 30;44 #ffffffff #00000000 std
|
||||
|
||||
Save and exit the file.
|
||||
|
||||
### Add Ubuntu 14.04 Desktop Boot Images to PXE Server ###
|
||||
|
||||
For this, Ubuntu kernel and initrd files are required. To get those files, you need the Ubuntu 14.04 Desktop ISO Image. You can download the Ubuntu 14.04 ISO image in the /mnt folder by issuing the following command:
|
||||
|
||||
sudo cd /mnt
|
||||
sudo wget http://releases.ubuntu.com/14.04/ubuntu-14.04.3-desktop-amd64.iso
|
||||
|
||||
**Note**: the download URL might change as the ISO image is updated. Check out this website for the latest download link if the above URL is not working.
|
||||
|
||||
Mount the ISO file, and copy all the files to the TFTP folder by issuing the following commands:
|
||||
|
||||
sudo mount -o loop /mnt/ubuntu-14.04.3-desktop-amd64.iso /media/
|
||||
sudo cp -r /media/* /var/lib/tftpboot/Ubuntu/14.04/amd64/
|
||||
sudo cp -r /media/.disk /var/lib/tftpboot/Ubuntu/14.04/amd64/
|
||||
sudo cp /media/casper/initrd.lz /media/casper/vmlinuz /var/lib/tftpboot/Ubuntu/
|
||||
|
||||
### Configure NFS Server to Export ISO Contents ###
|
||||
|
||||
Now you need to setup Installation Source Mirrors via NFS protocol. You can also use http and ftp for Installation Source Mirrors. Here I have used NFS to export ISO contents.
|
||||
|
||||
To configure the NFS server, you need to edit the “/etc/exports” file.
|
||||
|
||||
sudo nano /etc/exports
|
||||
|
||||
Add/edit as described below:
|
||||
|
||||
/var/lib/tftpboot/Ubuntu/14.04/amd64 *(ro,async,no_root_squash,no_subtree_check)
|
||||
|
||||
Save and exit the file. For the changes to take effect, export and start NFS service.
|
||||
|
||||
sudo exportfs -a
|
||||
sudo /etc/init.d/nfs-kernel-server start
|
||||
|
||||
Now your PXE Server is ready.
|
||||
|
||||
### Configure Network Boot PXE Client ###
|
||||
|
||||
A PXE client can be any computer system with a PXE network boot enable option. Now your clients can boot and install Ubuntu 14.04 Desktop by enabling “Boot From Network” options from their systems BIOS.
|
||||
|
||||
You’re now ready to go – start your PXE Client Machine with the network boot enable option, and you should now see a sub-menu showing for your Ubuntu 14.04 Desktop that we created.
|
||||
|
||||
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
Configuring network boot installation using PXE server is efficient and a time-saving method. You can install hundreds of client at a time in your local network. All you need is a PXE server and PXE enabled clients. Try it out, and let us know if this works for you.
|
||||
|
||||
Reference:
|
||||
- [PXE Server wiki][1]
|
||||
- [PXE Server Ubuntu][2]
|
||||
|
||||
Image credit: [fupsol_unl_20][3]
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.maketecheasier.com/configure-pxe-server-ubuntu/
|
||||
|
||||
作者：[Hitesh Jethva][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://www.maketecheasier.com/author/hiteshjethva/
|
||||
[1]:https://en.wikipedia.org/wiki/Preboot_Execution_Environment
|
||||
[2]:https://help.ubuntu.com/community/PXEInstallServer
|
||||
[3]:https://www.flickr.com/photos/jhcalderon/3681926417/
|
||||
@ -0,0 +1,89 @@
|
||||
How to Setup IonCube Loaders on Ubuntu 14.04 / 15.04
|
||||
================================================================================
|
||||
IonCube Loaders is an encryption/decryption utility for PHP applications which assists in speeding up the pages that are served. It also protects your website's PHP code from being viewed and ran on unlicensed computers. Using ionCube encoded and secured PHP files requires a file called ionCube Loader to be installed on the web server and made available to PHP which is often required for a lot of PHP based applications. It handles the reading and execution of encoded files at run time. PHP can use the loader with one line added to a PHP configuration file that ‘php.ini’.
|
||||
|
||||
### Prerequisites ###
|
||||
|
||||
In this article we will setup the installation of Ioncube Loader on Ubuntu 14.04/15.04, so that it can be used in all PHP Modes. The only requirement for this tutorial is to have "php.ini" file exists in your system with LEMP stack installed on the server.
|
||||
|
||||
### Download IonCube Loader ###
|
||||
|
||||
Login to your ubuntu server to download the latest IonCube loader package according to your operating system architecture whether your are using a 32 Bit or 64 Bit OS. You can get its package by issuing the following command with super user privileges or root user.
|
||||
|
||||
# wget http://downloads3.ioncube.com/loader_downloads/ioncube_loaders_lin_x86-64.tar.gz
|
||||
|
||||
|
||||
|
||||
After Downloading unpack the archive into the "/usr/local/src/" folder by issuing the following command.
|
||||
|
||||
# tar -zxvf ioncube_loaders_lin_x86-64.tar.gz -C /usr/local/src/
|
||||
|
||||
|
||||
|
||||
After extracting the archive, we can see the list of all modules present in it. But we needs only the relevant with the version of PHP installed on our system.
|
||||
|
||||
To check your PHP version, you can run the below command to find the relevant modules.
|
||||
|
||||
# php -v
|
||||
|
||||
|
||||
|
||||
With reference to the output of above command we came to know that the PHP version installed on the system is 5.6.4, so we need to copy the appropriate module to the PHP modules folder.
|
||||
|
||||
To do so we will create a new folder with name "ioncube" within the "/usr/local/" directory and copy the required ioncube loader modules into it.
|
||||
|
||||
root@ubuntu-15:/usr/local/src/ioncube# mkdir /usr/local/ioncube
|
||||
root@ubuntu-15:/usr/local/src/ioncube# cp ioncube_loader_lin_5.6.so ioncube_loader_lin_5.6_ts.so /usr/local/ioncube/
|
||||
|
||||
### PHP Configuration ###
|
||||
|
||||
Now we need to put the following line into the configuration file of PHP file "php.ini" which is located in "/etc/php5/cli/" folder then restart your web server’s services and php module.
|
||||
|
||||
# vim /etc/php5/cli/php.ini
|
||||
|
||||
|
||||
|
||||
In our scenario we have Nginx web server installed, so we will run the following commands to start its services.
|
||||
|
||||
# service php5-fpm restart
|
||||
# service nginx restart
|
||||
|
||||
|
||||
|
||||
### Testing IonCube Loader ###
|
||||
|
||||
To test the ioncube loader in the PHP configuration for your website, create a test file called "info.php" with the following content and place it into the web directory of your web server.
|
||||
|
||||
# vim /usr/share/nginx/html/info.php
|
||||
|
||||
Then save the changes after placing phpinfo script and access "info.php" in your browser with your domain name or server’s IP address after reloading the web server services.
|
||||
|
||||
You will be able to see the below section at the bottom of your php modules information.
|
||||
|
||||
|
||||
|
||||
From the terminal issue the following command to verify the php version that shows the ionCube PHP Loader is Enabled.
|
||||
|
||||
# php -v
|
||||
|
||||
|
||||
|
||||
The output shown in the PHP version's command clearly indicated that IonCube loader has been successfully integrated with PHP.
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
At the end of this tutorial you learnt about the installation and configuration of ionCube Loader on Ubuntu with Nginx web server there will be no such difference if you are using any other web server. So, installing Loaders is simple when its done correctly, and on most servers its installation will work without a problem. However there is no such thing as a "standard PHP installation", and servers can be setup in many different ways, and with different features enabled or disabled.
|
||||
|
||||
If you are on a shared server, then make sure that you have run the ioncube-loader-helper.php script, and click the link to test run time installation. If you still face as such issue while doing your setup, feel free to contact us and leave us a comment.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://linoxide.com/ubuntu-how-to/setup-ioncube-loaders-ubuntu-14-04-15-04/
|
||||
|
||||
作者：[Kashif Siddique][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://linoxide.com/author/kashifs/
|
||||
@ -0,0 +1,102 @@
|
||||
How to Setup Node JS v4.0.0 on Ubuntu 14.04 / 15.04
|
||||
================================================================================
|
||||
Hi everyone, Node.JS Version 4.0.0 has been out, the popular server-side JavaScript platform has combines the Node.js and io.js code bases. This release represents the combined efforts encapsulated in both the Node.js project and the io.js project that are now combined in a single codebase. The most important change is this Node.js is ships with version 4.5 of Google's V8 JavaScript engine, which is the same version that ships with the current Chrome browser. So, being able to more closely track V8’s releases means Node.js runs JavaScript faster, more securely, and with the ability to use many desirable ES6 language features.
|
||||
|
||||
|
||||
|
||||
Node.js 4.0.0 aims to provide an easy update path for current users of io.js and node as there are no major API changes. Let’s see how you can easily get it installed and setup on Ubuntu server by following this simple article.
|
||||
|
||||
### Basic System Setup ###
|
||||
|
||||
Node works perfectly on Linux, Macintosh, and Solaris operating systems and among the Linux operating systems it has the best results using Ubuntu OS. That's why we are to setup it Ubuntu 15.04 while the same steps can be followed using Ubuntu 14.04.
|
||||
|
||||
**1) System Resources**
|
||||
|
||||
The basic system resources for Node depend upon the size of your infrastructure requirements. So, here in this tutorial we will setup Node with 1 GB RAM, 1 GHz Processor and 10 GB of available disk space with minimal installation packages installed on the server that is no web or database server packages are installed.
|
||||
|
||||
**2) System Update**
|
||||
|
||||
It always been recommended to keep your system upto date with latest patches and updates, so before we move to the installation on Node, let's login to your server with super user privileges and run update command.
|
||||
|
||||
# apt-get update
|
||||
|
||||
**3) Installing Dependencies**
|
||||
|
||||
Node JS only requires some basic system and software utilities to be present on your server, for its successful installation like 'make' 'gcc' and 'wget'. Let's run the below command to get them installed if they are not already present.
|
||||
|
||||
# apt-get install python gcc make g++ wget
|
||||
|
||||
### Download Latest Node JS v4.0.0 ###
|
||||
|
||||
Let's download the latest Node JS version 4.0.0 by following this link of [Node JS Download Page][1].
|
||||
|
||||
|
||||
|
||||
We will copy the link location of its latest package and download it using 'wget' command as shown.
|
||||
|
||||
# wget https://nodejs.org/download/rc/v4.0.0-rc.1/node-v4.0.0-rc.1.tar.gz
|
||||
|
||||
Once download completes, unpack using 'tar' command as shown.
|
||||
|
||||
# tar -zxvf node-v4.0.0-rc.1.tar.gz
|
||||
|
||||
|
||||
|
||||
### Installing Node JS v4.0.0 ###
|
||||
|
||||
Now we have to start the installation of Node JS from its downloaded source code. So, change your directory and configure the source code by running its configuration script before compiling it on your ubuntu server.
|
||||
|
||||
root@ubuntu-15:~/node-v4.0.0-rc.1# ./configure
|
||||
|
||||
|
||||
|
||||
Now run the 'make install' command to compile the Node JS installation package as shown.
|
||||
|
||||
root@ubuntu-15:~/node-v4.0.0-rc.1# make install
|
||||
|
||||
The make command will take a couple of minutes while compiling its binaries so after executinf above command, wait for a while and keep calm.
|
||||
|
||||
### Testing Node JS Installation ###
|
||||
|
||||
Once the compilation process is complete, we will test it if every thing went fine. Let's run the following command to confirm the installed version of Node JS.
|
||||
|
||||
root@ubuntu-15:~# node -v
|
||||
v4.0.0-pre
|
||||
|
||||
By executing 'node' without any arguments from the command-line you will be dropped into the REPL (Read-Eval-Print-Loop) that has simplistic emacs line-editing where you can interactively run JavaScript and see the results.
|
||||
|
||||
|
||||
|
||||
### Writing Test Program ###
|
||||
|
||||
We can also try out a very simple console program to test the successful installation and proper working of Node JS. To do so we will create a file named "test.js" and write the following code into it and save the changes made in the file as shown.
|
||||
|
||||
root@ubuntu-15:~# vim test.js
|
||||
var util = require("util");
|
||||
console.log("Hello! This is a Node Test Program");
|
||||
:wq!
|
||||
|
||||
Now in order to run the above program, from the command prompt run the below command.
|
||||
|
||||
root@ubuntu-15:~# node test.js
|
||||
|
||||
|
||||
|
||||
So, upon successful installation we will get the output as shown in the screen, where as in the above program it loads the "util" class into a variable "util" and then uses the "util" object to perform the console tasks. While the console.log is a command similar to the cout in C++.
|
||||
|
||||
### Conclusion ###
|
||||
|
||||
That’s it. Hope this gives you a good idea of Node.js going with Node.js on Ubuntu. If you are new to developing applications with Node.js. After all we can say that we can expect significant performance gains with Node JS Version 4.0.0.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://linoxide.com/ubuntu-how-to/setup-node-js-4-0-ubuntu-14-04-15-04/
|
||||
|
||||
作者：[Kashif Siddique][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://linoxide.com/author/kashifs/
|
||||
[1]:https://nodejs.org/download/rc/v4.0.0-rc.1/
|
||||
@ -1,211 +0,0 @@
|
||||
RHCE Series: Implementing HTTPS through TLS using Network Security Service (NSS) for Apache
|
||||
================================================================================
|
||||
If you are a system administrator who is in charge of maintaining and securing a web server, you can’t afford to not devote your very best efforts to ensure that data served by or going through your server is protected at all times.
|
||||
|
||||
|
||||
|
||||
RHCE Series: Implementing HTTPS through TLS using Network Security Service (NSS) for Apache – Part 8
|
||||
|
||||
In order to provide more secure communications between web clients and servers, the HTTPS protocol was born as a combination of HTTP and SSL (Secure Sockets Layer) or more recently, TLS (Transport Layer Security).
|
||||
|
||||
Due to some serious security breaches, SSL has been deprecated in favor of the more robust TLS. For that reason, in this article we will explain how to secure connections between your web server and clients using TLS.
|
||||
|
||||
This tutorial assumes that you have already installed and configured your Apache web server. If not, please refer to following article in this site before proceeding further.
|
||||
|
||||
- [Install LAMP (Linux, MySQL/MariaDB, Apache and PHP) on RHEL/CentOS 7][1]
|
||||
|
||||
### Installation of OpenSSL and Utilities ###
|
||||
|
||||
First off, make sure that Apache is running and that both http and https are allowed through the firewall:
|
||||
|
||||
# systemctl start http
|
||||
# systemctl enable http
|
||||
# firewall-cmd --permanent –-add-service=http
|
||||
# firewall-cmd --permanent –-add-service=https
|
||||
|
||||
Then install the necessary packages:
|
||||
|
||||
# yum update && yum install openssl mod_nss crypto-utils
|
||||
|
||||
**Important**: Please note that you can replace mod_nss with mod_ssl in the command above if you want to use OpenSSL libraries instead of NSS (Network Security Service) to implement TLS (which one to use is left entirely up to you, but we will use NSS in this article as it is more robust; for example, it supports recent cryptography standards such as PKCS #11).
|
||||
|
||||
Finally, uninstall mod_ssl if you chose to use mod_nss, or viceversa.
|
||||
|
||||
# yum remove mod_ssl
|
||||
|
||||
### Configuring NSS (Network Security Service) ###
|
||||
|
||||
After mod_nss is installed, its default configuration file is created as /etc/httpd/conf.d/nss.conf. You should then make sure that all of the Listen and VirtualHost directives point to port 443 (default port for HTTPS):
|
||||
|
||||
nss.conf – Configuration File
|
||||
|
||||
----------
|
||||
|
||||
Listen 443
|
||||
VirtualHost _default_:443
|
||||
|
||||
Then restart Apache and check whether the mod_nss module has been loaded:
|
||||
|
||||
# apachectl restart
|
||||
# httpd -M | grep nss
|
||||
|
||||
|
||||
|
||||
Check Mod_NSS Module Loaded in Apache
|
||||
|
||||
Next, the following edits should be made in `/etc/httpd/conf.d/nss.conf` configuration file:
|
||||
|
||||
1. Indicate NSS database directory. You can use the default directory or create a new one. In this tutorial we will use the default:
|
||||
|
||||
NSSCertificateDatabase /etc/httpd/alias
|
||||
|
||||
2. Avoid manual passphrase entry on each system start by saving the password to the database directory in /etc/httpd/nss-db-password.conf:
|
||||
|
||||
NSSPassPhraseDialog file:/etc/httpd/nss-db-password.conf
|
||||
|
||||
Where /etc/httpd/nss-db-password.conf contains ONLY the following line and mypassword is the password that you will set later for the NSS database:
|
||||
|
||||
internal:mypassword
|
||||
|
||||
In addition, its permissions and ownership should be set to 0640 and root:apache, respectively:
|
||||
|
||||
# chmod 640 /etc/httpd/nss-db-password.conf
|
||||
# chgrp apache /etc/httpd/nss-db-password.conf
|
||||
|
||||
3. Red Hat recommends disabling SSL and all versions of TLS previous to TLSv1.0 due to the POODLE SSLv3 vulnerability (more information [here][2]).
|
||||
|
||||
Make sure that every instance of the NSSProtocol directive reads as follows (you are likely to find only one if you are not hosting other virtual hosts):
|
||||
|
||||
NSSProtocol TLSv1.0,TLSv1.1
|
||||
|
||||
4. Apache will refuse to restart as this is a self-signed certificate and will not recognize the issuer as valid. For this reason, in this particular case you will have to add:
|
||||
|
||||
NSSEnforceValidCerts off
|
||||
|
||||
5. Though not strictly required, it is important to set a password for the NSS database:
|
||||
|
||||
# certutil -W -d /etc/httpd/alias
|
||||
|
||||
|
||||
|
||||
Set Password for NSS Database
|
||||
|
||||
### Creating a Apache SSL Self-Signed Certificate ###
|
||||
|
||||
Next, we will create a self-signed certificate that will identify the server to our clients (please note that this method is not the best option for production environments; for such use you may want to consider buying a certificate verified by a 3rd trusted certificate authority, such as DigiCert).
|
||||
|
||||
To create a new NSS-compliant certificate for box1 which will be valid for 365 days, we will use the genkey command. When this process completes:
|
||||
|
||||
# genkey --nss --days 365 box1
|
||||
|
||||
Choose Next:
|
||||
|
||||
|
||||
|
||||
Create Apache SSL Key
|
||||
|
||||
You can leave the default choice for the key size (2048), then choose Next again:
|
||||
|
||||
|
||||
|
||||
Select Apache SSL Key Size
|
||||
|
||||
Wait while the system generates random bits:
|
||||
|
||||
|
||||
|
||||
Generating Random Key Bits
|
||||
|
||||
To speed up the process, you will be prompted to enter random text in your console, as shown in the following screencast. Please note how the progress bar stops when no input from the keyboard is received. Then, you will be asked to:
|
||||
|
||||
1. Whether to send the Certificate Sign Request (CSR) to a Certificate Authority (CA): Choose No, as this is a self-signed certificate.
|
||||
|
||||
2. to enter the information for the certificate.
|
||||
|
||||
注：youtube 视频
|
||||
<iframe width="720" height="405" frameborder="0" src="//www.youtube.com/embed/mgsfeNfuurA" allowfullscreen="allowfullscreen"></iframe>
|
||||
|
||||
Finally, you will be prompted to enter the password to the NSS certificate that you set earlier:
|
||||
|
||||
# genkey --nss --days 365 box1
|
||||
|
||||
|
||||
|
||||
Apache NSS Certificate Password
|
||||
|
||||
At anytime, you can list the existing certificates with:
|
||||
|
||||
# certutil –L –d /etc/httpd/alias
|
||||
|
||||
|
||||
|
||||
List Apache NSS Certificates
|
||||
|
||||
And delete them by name (only if strictly required, replacing box1 by your own certificate name) with:
|
||||
|
||||
# certutil -d /etc/httpd/alias -D -n "box1"
|
||||
|
||||
if you need to.c
|
||||
|
||||
### Testing Apache SSL HTTPS Connections ###
|
||||
|
||||
Finally, it’s time to test the secure connection to our web server. When you point your browser to https://<web server IP or hostname>, you will get the well-known message “This connection is untrusted“:
|
||||
|
||||
|
||||
|
||||
Check Apache SSL Connection
|
||||
|
||||
In the above situation, you can click on Add Exception and then Confirm Security Exception – but don’t do it yet. Let’s first examine the certificate to see if its details match the information that we entered earlier (as shown in the screencast).
|
||||
|
||||
To do so, click on View… –> Details tab above and you should see this when you select Issuer from the list:
|
||||
|
||||
|
||||
|
||||
Confirm Apache SSL Certificate Details
|
||||
|
||||
Now you can go ahead, confirm the exception (either for this time or permanently) and you will be taken to your web server’s DocumentRoot directory via https, where you can inspect the connection details using your browser’s builtin developer tools:
|
||||
|
||||
In Firefox you can launch it by right clicking on the screen, and choosing Inspect Element from the context menu, specifically through the Network tab:
|
||||
|
||||
|
||||
|
||||
Inspect Apache HTTPS Connection
|
||||
|
||||
Please note that this is the same information as displayed before, which was entered during the certificate previously. There’s also a way to test the connection using command line tools:
|
||||
|
||||
On the left (testing SSLv3):
|
||||
|
||||
# openssl s_client -connect localhost:443 -ssl3
|
||||
|
||||
On the right (testing TLS):
|
||||
|
||||
# openssl s_client -connect localhost:443 -tls1
|
||||
|
||||
|
||||
|
||||
Testing Apache SSL and TLS Connections
|
||||
|
||||
Refer to the screenshot above for more details.
|
||||
|
||||
### Summary ###
|
||||
|
||||
As I’m sure you already know, the presence of HTTPS inspires trust in visitors who may have to enter personal information in your site (from user names and passwords all the way to financial / bank account information).
|
||||
|
||||
In that case, you will want to get a certificate signed by a trusted Certificate Authority as we explained earlier (the steps to set it up are identical with the exception that you will need to send the CSR to a CA, and you will get the signed certificate back); otherwise, a self-signed certificate as the one used in this tutorial will do.
|
||||
|
||||
For more details on the use of NSS, please refer to the online help about [mod-nss][3]. And don’t hesitate to let us know if you have any questions or comments.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/create-apache-https-self-signed-certificate-using-nss/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/install-lamp-in-centos-7/
|
||||
[1]:http://www.tecmint.com/author/gacanepa/
|
||||
[2]:https://access.redhat.com/articles/1232123
|
||||
[3]:https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html
|
||||
@ -1,178 +0,0 @@
|
||||
FSSlc translating
|
||||
|
||||
RHCSA Series: Mandatory Access Control Essentials with SELinux in RHEL 7 – Part 13
|
||||
================================================================================
|
||||
During this series we have explored in detail at least two access control methods: standard ugo/rwx permissions ([Manage Users and Groups – Part 3][1]) and access control lists ([Configure ACL’s on File Systems – Part 7][2]).
|
||||
|
||||
|
||||
|
||||
RHCSA Exam: SELinux Essentials and Control FileSystem Access
|
||||
|
||||
Although necessary as first level permissions and access control mechanisms, they have some limitations that are addressed by Security Enhanced Linux (aka SELinux for short).
|
||||
|
||||
One of such limitations is that a user can expose a file or directory to a security breach through a poorly elaborated chmod command and thus cause an unexpected propagation of access rights. As a result, any process started by that user can do as it pleases with the files owned by the user, where finally a malicious or otherwise compromised software can achieve root-level access to the entire system.
|
||||
|
||||
With those limitations in mind, the United States National Security Agency (NSA) first devised SELinux, a flexible mandatory access control method, to restrict the ability of processes to access or perform other operations on system objects (such as files, directories, network ports, etc) to the least permission model, which can be modified later as needed. In few words, each element of the system is given only the access required to function.
|
||||
|
||||
In RHEL 7, SELinux is incorporated into the kernel itself and is enabled in Enforcing mode by default. In this article we will explain briefly the basic concepts associated with SELinux and its operation.
|
||||
|
||||
### SELinux Modes ###
|
||||
|
||||
SELinux can operate in three different ways:
|
||||
|
||||
- Enforcing: SELinux denies access based on SELinux policy rules, a set of guidelines that control the security engine.
|
||||
- Permissive: SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode.
|
||||
- Disabled (self-explanatory).
|
||||
|
||||
The `getenforce` command displays the current mode of SELinux, whereas `setenforce` (followed by a 1 or a 0) is used to change the mode to Enforcing or Permissive, respectively, during the current session only.
|
||||
|
||||
In order to achieve persistence across logouts and reboots, you will need to edit the `/etc/selinux/config` file and set the SELINUX variable to either enforcing, permissive, or disabled:
|
||||
|
||||
# getenforce
|
||||
# setenforce 0
|
||||
# getenforce
|
||||
# setenforce 1
|
||||
# getenforce
|
||||
# cat /etc/selinux/config
|
||||
|
||||
|
||||
|
||||
Set SELinux Mode
|
||||
|
||||
Typically you will use setenforce to toggle between SELinux modes (enforcing to permissive and back) as a first troubleshooting step. If SELinux is currently set to enforcing while you’re experiencing a certain problem, and the same goes away when you set it to permissive, you can be confident you’re looking at a SELinux permissions issue.
|
||||
|
||||
### SELinux Contexts ###
|
||||
|
||||
A SELinux context consists of an access control environment where decisions are made based on SELinux user, role, and type (and optionally a level):
|
||||
|
||||
- A SELinux user complements a regular Linux user account by mapping it to a SELinux user account, which in turn is used in the SELinux context for processes in that session, in order to explicitly define their allowed roles and levels.
|
||||
- The concept of role acts as an intermediary between domains and SELinux users in that it defines which process domains and file types can be accessed. This will shield your system against vulnerability to privilege escalation attacks.
|
||||
- A type defines an SELinux file type or an SELinux process domain. Under normal circumstances, processes are prevented from accessing files that other processes use, and and from accessing other processes, thus access is only allowed if a specific SELinux policy rule exists that allows it.
|
||||
|
||||
Let’s see how all of that works through the following examples.
|
||||
|
||||
**EXAMPLE 1: Changing the default port for the sshd daemon**
|
||||
|
||||
In [Securing SSH – Part 8][3] we explained that changing the default port where sshd listens on is one of the first security measures to secure your server against external attacks. Let’s edit the `/etc/ssh/sshd_config` file and set the port to 9999:
|
||||
|
||||
Port 9999
|
||||
|
||||
Save the changes, and restart sshd:
|
||||
|
||||
# systemctl restart sshd
|
||||
# systemctl status sshd
|
||||
|
||||
|
||||
|
||||
Restart SSH Service
|
||||
|
||||
As you can see, sshd has failed to start. But what happened?
|
||||
|
||||
A quick inspection of `/var/log/audit/audit.log` indicates that sshd has been denied permissions to start on port 9999 (SELinux log messages include the word “AVC” so that they might be easily identified from other messages) because that is a reserved port for the JBoss Management service:
|
||||
|
||||
# cat /var/log/audit/audit.log | grep AVC | tail -1
|
||||
|
||||
|
||||
|
||||
Inspect SSH Logs
|
||||
|
||||
At this point you could disable SELinux (but don’t!) as explained earlier and try to start sshd again, and it should work. However, the semanage utility can tell us what we need to change in order for us to be able to start sshd in whatever port we choose without issues.
|
||||
|
||||
Run,
|
||||
|
||||
# semanage port -l | grep ssh
|
||||
|
||||
to get a list of the ports where SELinux allows sshd to listen on.
|
||||
|
||||
|
||||
|
||||
Semanage Tool
|
||||
|
||||
So let’s change the port in /etc/ssh/sshd_config to Port 9998, add the port to the ssh_port_t context, and then restart the service:
|
||||
|
||||
# semanage port -a -t ssh_port_t -p tcp 9998
|
||||
# systemctl restart sshd
|
||||
# systemctl is-active sshd
|
||||
|
||||
|
||||
|
||||
Semanage Add Port
|
||||
|
||||
As you can see, the service was started successfully this time. This example illustrates the fact that SELinux controls the TCP port number to its own port type internal definitions.
|
||||
|
||||
**EXAMPLE 2: Allowing httpd to send access sendmail**
|
||||
|
||||
This is an example of SELinux managing a process accessing another process. If you were to implement mod_security and mod_evasive along with Apache in your RHEL 7 server, you need to allow httpd to access sendmail in order to send a mail notification in the wake of a (D)DoS attack. In the following command, omit the -P flag if you do not want the change to be persistent across reboots.
|
||||
|
||||
# semanage boolean -1 | grep httpd_can_sendmail
|
||||
# setsebool -P httpd_can_sendmail 1
|
||||
# semanage boolean -1 | grep httpd_can_sendmail
|
||||
|
||||
|
||||
|
||||
Allow Apache to Send Mails
|
||||
|
||||
As you can tell from the above example, SELinux boolean settings (or just booleans) are true / false rules embedded into SELinux policies. You can list all the booleans with `semanage boolean -l`, and alternatively pipe it to grep in order to filter the output.
|
||||
|
||||
**EXAMPLE 3: Serving a static site from a directory other than the default one**
|
||||
|
||||
Suppose you are serving a static website using a different directory than the default one (`/var/www/html`), say /websites (this could be the case if you’re storing your web files in a shared network drive, for example, and need to mount it at /websites).
|
||||
|
||||
a). Create an index.html file inside /websites with the following contents:
|
||||
|
||||
<html>
|
||||
<h2>SELinux test</h2>
|
||||
</html>
|
||||
|
||||
If you do,
|
||||
|
||||
# ls -lZ /websites/index.html
|
||||
|
||||
you will see that the index.html file has been labeled with the default_t SELinux type, which Apache can’t access:
|
||||
|
||||
|
||||
|
||||
Check SELinux File Permission
|
||||
|
||||
b). Change the DocumentRoot directive in `/etc/httpd/conf/httpd.conf` to /websites and don’t forget to update the corresponding Directory block. Then, restart Apache.
|
||||
|
||||
c). Browse to `http://<web server IP address>`, and you should get a 503 Forbidden HTTP response.
|
||||
|
||||
d). Next, change the label of /websites, recursively, to the httpd_sys_content_t type in order to grant Apache read-only access to that directory and its contents:
|
||||
|
||||
# semanage fcontext -a -t httpd_sys_content_t "/websites(/.*)?"
|
||||
|
||||
e). Finally, apply the SELinux policy created in d):
|
||||
|
||||
# restorecon -R -v /websites
|
||||
|
||||
Now restart Apache and browse to `http://<web server IP address>` again and you will see the html file displayed correctly:
|
||||
|
||||
|
||||
|
||||
Verify Apache Page
|
||||
|
||||
### Summary ###
|
||||
|
||||
In this article we have gone through the basics of SELinux. Note that due to the vastness of the subject, a full detailed explanation is not possible in a single article, but we believe that the principles outlined in this guide will help you to move on to more advanced topics should you wish to do so.
|
||||
|
||||
If I may, let me recommend two essential resources to start with: the [NSA SELinux page][4] and the [RHEL 7 SELinux User’s and Administrator’s][5] guide.
|
||||
|
||||
Don’t hesitate to let us know if you have any questions or comments.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/selinux-essentials-and-control-filesystem-access/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups
|
||||
[2]:http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares/
|
||||
[3]:http://www.tecmint.com/rhcsa-series-secure-ssh-set-hostname-enable-network-services-in-rhel-7/
|
||||
[4]:https://www.nsa.gov/research/selinux/index.shtml
|
||||
[5]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/part_I-SELinux.html
|
||||
@ -1,66 +0,0 @@
|
||||
Translated by H-mudcup
|
||||
五大超酷的开源游戏
|
||||
================================================================================
|
||||
在2014年和2015年，Linux 成了一堆流行商业品牌的家，例如备受欢迎的 Borderlands、Witcher、Dead Island 和 CS系列游戏。虽然这是令人激动的消息，但这跟玩家的预算有什么关系？商业品牌很好，但更好的是由了解玩家喜好的开发者开发的免费的替代品。
|
||||
|
||||
前段时间，我偶然看到了一个三年前发布的 YouTube 视频，标题非常的有正能量[5个不算糟糕的开源游戏][1]。虽然视频表扬了一些开源游戏，我还是更喜欢用一个更加热情的方式来切入这个话题，至少如标题所说。所以，下面是我的一份五大超酷开源游戏的清单。
|
||||
|
||||
### Tux Racer ###
|
||||
|
||||
|
||||
|
||||
Tux Racer
|
||||
|
||||
[《Tux Racer》][2]是这份清单上的第一个游戏，因为我对这个游戏很熟悉。我和兄弟与[电脑上的孩子们][4]项目在[最近一次去墨西哥的路途中][3] Tux Racer 是孩子和教师都喜欢玩的游戏之一。在这个游戏中，玩家使用 Linux 吉祥物，企鹅 Tux，在下山雪道上以计时赛的方式进行比赛。玩家们不断挑战他们自己的最佳纪录。目前还没有多玩家版本，但这是有可能改变的。适用于 Linux、OS X、Windows 和 Android。
|
||||
|
||||
### Warsow ###
|
||||
|
||||
|
||||
|
||||
Warsow
|
||||
|
||||
[《Warsow》][5]网站解释道：“设定是有未来感的卡通世界，Warsow 是个完全开放的适用于 Windows、Linux 和 Mac OS X平台的快节奏第一人称射击游戏（FPS）。Warsow 是尊重的艺术和网络中的体育精神。（Warsow is the Art of Respect and Sportsmanship Over the Web.大写字母组成Warsow。）” 我很不情愿的把 FPS 类放到了这个列表中，因为很多人玩过这类的游戏，但是我的确被 Warsow 打动了。它对很多动作进行了优先级排序，游戏节奏很快，一开始就有八个武器。卡通化的风格让玩的过程变得没有那么严肃，更加的休闲，非常适合可以和亲友一同玩。然而，他却以充满竞争的游戏自居，并且当我体验这个游戏时，我发现周围确实有一些专家级的玩家。适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### M.A.R.S——一个荒诞的射击游戏 ###
|
||||
|
||||
|
||||
|
||||
M.A.R.S.——一个荒诞的射击游戏
|
||||
|
||||
[《M.A.R.S——一个荒诞的射击游戏》][6]之所以吸引人是因为他充满活力的色彩和画风。支持两个玩家使用同一个键盘，而一个在线多玩家版本目前正在开发中——这意味着想要和朋友们一起玩暂时还要等等。不论如何，它是个可以使用几个不同飞船和武器的有趣的太空射击游戏。飞船的形状不同，从普通的枪、激光、散射枪到更有趣的武器（随机出来的飞船中有一个会对敌人发射泡泡，这为这款混乱的游戏增添了很多乐趣）。游戏几种模式，比如标准模式和对方进行殊死搏斗以获得高分或先达到某个分数线，还有其他的模式，空间球（Spaceball）、坟坑（Grave-itation Pit）和保加农炮（Cannon Keep）。适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### Valyria Tear ###
|
||||
|
||||
|
||||
|
||||
Valyria Tear
|
||||
|
||||
[Valyria Tear][7] 类似几年来拥有众多粉丝的角色扮演游戏（RPG）。故事设定在梦幻游戏的通用年代，充满了骑士、王国和魔法，以及主要角色 Bronann。设计团队做的非常棒，在设计这个世界和实现玩家对这类游戏所有的期望：隐藏的宝藏、偶遇的怪物、非玩家操纵角色（NPC）的互动以及所有 RPG 不可或缺的：在低级别的怪物上刷经验直到可以面对大 BOSS。我在试玩的时候，时间不允许我太过深入到这个游戏故事中，但是感兴趣的人可以看 YouTube 上由 Yohann Ferriera 用户发的‘[Let’s Play][8]’系列视频。适用于 Linux、Windows 和 OS X。
|
||||
|
||||
### SuperTuxKart ###
|
||||
|
||||
|
||||
|
||||
SuperTuxKart
|
||||
|
||||
最后一个同样好玩的游戏是 [SuperTuxKart][9]，一个效仿 Mario Kart（马里奥卡丁车）但丝毫不必原作差的好游戏。它在2000年-2004年间开始以 Tux Kart 开发，但是在成品中有错误，结果开发就停止了几年。从2006年开始重新开发时起，它就一直在改进，直到四个月前0.9版首次发布。在游戏里，我们的老朋友 Tux 与马里奥和其他一些开源吉祥物一同开始。其中一个熟悉的面孔是 Suzanne，Blender 的那只吉祥物猴子。画面很给力，游戏很流畅。虽然在线游戏还在计划阶段，但是分屏多玩家游戏是可以的。一个电脑最多可以四个玩家同时玩。适用于 Linux、Windows、OS X、AmigaOS 4、AROS 和 MorphOS。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://fossforce.com/2015/08/five-super-cool-open-source-games/
|
||||
|
||||
作者：Hunter Banks
|
||||
译者：[H-mudcup](https://github.com/H-mudcup)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:https://www.youtube.com/watch?v=BEKVl-XtOP8
|
||||
[2]:http://tuxracer.sourceforge.net/download.html
|
||||
[3]:http://fossforce.com/2015/07/banks-family-values-texas-linux-fest/
|
||||
[4]:http://www.kidsoncomputers.org/an-amazing-week-in-oaxaca
|
||||
[5]:https://www.warsow.net/download
|
||||
[6]:http://mars-game.sourceforge.net/
|
||||
[7]:http://valyriatear.blogspot.com/
|
||||
[8]:https://www.youtube.com/channel/UCQ5KrSk9EqcT_JixWY2RyMA
|
||||
[9]:http://supertuxkart.sourceforge.net/
|
||||
@ -1,111 +0,0 @@
|
||||
mosh - 一个基于SSH用于连接远程Unix/Linux系统的工具
|
||||
================================================================================
|
||||
Mosh表示移动Shell（Mobile Shell）是一个用于从客户端连接远程服务器的命令行工具。它可以像ssh那样使用并包含了更多的功能。它是一个类似ssh的程序，但是提供更多的功能。程序最初由Keith Winstein编写用于类Unix的操作系统中，发布于GNU GPL v3协议下。
|
||||
|
||||
|
||||
|
||||
Mosh客户端
|
||||
|
||||
#### Mosh的功能 ####
|
||||
|
||||
- 它是一个支持漫游的远程终端程序。
|
||||
- 在所有主流类Unix版本中可用如Linux、FreeBSD、Solaris、Mac OS X和Android。
|
||||
- 中断连接支持
|
||||
- 支持智能本地echo
|
||||
- 用户按键行编辑支持
|
||||
- 响应式设计及在wifi、3G、长距离连接下的鲁棒性
|
||||
- 在IP改变后保持连接。它使用UDP代替TCP（在SSH中使用）当连接被重置或者获得新的IP后TCP会超时但是UDP仍然保持连接。
|
||||
- 在你很长之间之后恢复会话时仍然保持连接。
|
||||
- 没有网络延迟。立即显示用户输入和删除而没有延迟
|
||||
- 像SSH那样支持一些旧的方式登录。
|
||||
- 包丢失处理机制
|
||||
|
||||
### Linux中mosh的安装 ###
|
||||
|
||||
在Debian、Ubuntu和Mint类似的系统中，你可以很容易地用[apt-get包管理器][1]安装。
|
||||
|
||||
# apt-get update
|
||||
# apt-get install mosh
|
||||
|
||||
在基于RHEL/CentOS/Fedora的系统中，要使用[yum 包管理器][3]安装mosh，你需要打开第三方的[EPEL][2]。
|
||||
|
||||
# yum update
|
||||
# yum install mosh
|
||||
|
||||
在Fedora 22+的版本中，你需要使用[dnf包管理器][4]来安装mosh。
|
||||
|
||||
# dnf install mosh
|
||||
|
||||
### 我该如何使用mosh？ ###
|
||||
|
||||
1. 让我们尝试使用mosh登录远程Linux服务器。
|
||||
|
||||
$ mosh root@192.168.0.150
|
||||
|
||||
|
||||
|
||||
mosh远程连接
|
||||
|
||||
**注意**：你有没有看到一个连接错误，因为我在CentOS 7中还有打开这个端口。一个快速但是我并不建议的解决方法是：
|
||||
|
||||
# systemctl stop firewalld [on Remote Server]
|
||||
|
||||
更好的方法是打开一个端口并更新防火墙规则。接着用mosh连接到预定义的端口中。至于更深入的细节，也许你会对下面的文章感兴趣。
|
||||
|
||||
- [如何配置Firewalld][5]
|
||||
|
||||
2. 让我们假设把默认的22端口改到70，这时使用-p选项来使用自定义端口。
|
||||
|
||||
$ mosh -p 70 root@192.168.0.150
|
||||
|
||||
3. 检查mosh的版本
|
||||
|
||||
$ mosh --version
|
||||
|
||||
|
||||
|
||||
检查mosh版本
|
||||
|
||||
4. 你可以输入‘exit’来退出mosh会话。
|
||||
|
||||
$ exit
|
||||
|
||||
5. mosh支持很多选项，你可以用下面的方法看到：
|
||||
|
||||
$ mosh --help
|
||||
|
||||
|
||||
|
||||
Mosh选项
|
||||
|
||||
#### mosh的利弊 ####
|
||||
|
||||
- mosh有额外的需求，比如需要允许UDP直接连接，这在SSH不需要。
|
||||
- 动态分配的端口范围是60000-61000。第一个打开的端口是分配的。每个连接都需要一个端口。
|
||||
- 默认端口分配是一个严重的安全问题，尤其是在生产环境中。
|
||||
- 支持IPv6连接，但是不支持IPv6漫游。
|
||||
- 不支持回溯
|
||||
- 不支持X11转发
|
||||
- 不支持ssh-agent转发
|
||||
|
||||
### 总结 ###
|
||||
|
||||
Mosh is a nice small utility which is available for download in the repository of most of the Linux Distributions. Though it has a few discrepancies specially security concern and additional requirement it’s features like remaining connected even while roaming is its plus point. My recommendation is Every Linux-er who deals with SSH should try this application and mind it, Mosh is worth a try.
|
||||
mosh是一款在大多数linux发行版的仓库中可以下载的一款小工具。虽然它有一些差异尤其是安全问题和额外的需求，它的功能像漫游后保持连接是一个加分点。我的建议是任何一个使用ssh的linux用户都应该试试这个程序，mosh值得一试
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/install-mosh-shell-ssh-client-in-linux/
|
||||
|
||||
作者：[Avishek Kumar][a]
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/avishek/
|
||||
[1]:http://www.tecmint.com/useful-basic-commands-of-apt-get-and-apt-cache-for-package-management/
|
||||
[2]:http://www.tecmint.com/how-to-enable-epel-repository-for-rhel-centos-6-5/
|
||||
[3]:http://www.tecmint.com/20-linux-yum-yellowdog-updater-modified-commands-for-package-mangement/
|
||||
[4]:http://www.tecmint.com/dnf-commands-for-fedora-rpm-package-management/
|
||||
[5]:http://www.tecmint.com/configure-firewalld-in-centos-7/
|
||||
@ -0,0 +1,83 @@
|
||||
安卓编年史
|
||||
================================================================================
|
||||
|
||||
安卓市场的新设计试水“卡片式”界面，这将成为谷歌的主要风格。
|
||||
Ron Amadeo 供图
|
||||
|
||||
安卓推向市场已经有两年半时间了，安卓市场放出了它的第四版设计。这个新设计十分重要，因为它已经很接近谷歌的“卡片式”界面了。通过在小方块中显示应用或其他内容，谷歌可以使其设计在不同尺寸屏幕下无缝过渡而不受影响。内容可以像一个相册应用里的照片一样显示——给布局渲染填充一个内容块列表，加上屏幕包装，就完成了。更大的屏幕一次可以看到更多的内容块，小点的屏幕一次看到的内容就少。内容用了不一样的方式显示，谷歌还在右边新增了一个“分类”板块，顶部还有个巨大的热门应用滚动显示。
|
||||
|
||||
虽然设计上为更容易配置界面准备好准备好了，但功能上还没有。最初发布的市场版本锁定为横屏模式，而且还是蜂巢独占的。
|
||||
|
||||
|
||||
应用详情页和“我的应用”界面。
|
||||
Ron Amadeo 供图
|
||||
|
||||
新的市场不仅出售应用，还加入了书籍和电影租借。谷歌从2010年开始出售图书；之前只通过网站出售。新的市场将谷歌所有的内容销售聚合到了一处，进一步向苹果 iTunes 的主宰展开较量。虽然在“安卓市场”出售这些东西有点品牌混乱，因为大部分内容都不依赖于安卓才能使用。
|
||||
|
||||
|
||||
浏览器看起来非常像 Chrome，联系人使用了双面板界面。
|
||||
Ron Amadeo 供图
|
||||
|
||||
新浏览器界面顶部添加了标签页栏。尽管这个浏览器并不是 Chrome ，它模仿了许多 Chrome 的设计和特性。除了这个探索性的顶部标签页界面，浏览器还加入了隐身标签，在浏览网页时不保存历史记录和自动补全记录。它还有个选项可以让你拥有一个 Chrome 风格的新标签页，页面上包含你最经常访问的网页略缩图。
|
||||
|
||||
新浏览器甚至还能和 Chrome 同步。在浏览器登录后，它会下载你的 Chrome 书签并且自动登录你的谷歌账户。收藏一个页面只需点击地址栏的星形标志即可，和谷歌地图一样，浏览器抛弃了缩放按钮，完全改用手势控制。
|
||||
|
||||
联系人应用最终从电话应用中移除，并且独立为一个应用。之前的联系人/拨号混合式设计相对于人们使用现代智能手机的方式来说，过于以电话为中心了。联系人中存有电子邮件，IM，短信，地址，生日，以及社交网络等信息，所以将它们捆绑在电话应用里的意义和将它们放进谷歌地图里差不多。抛开了电话通讯功能，联系人能够简化成没有标签页的联系人列表。蜂巢采用了双面板视图，在左侧显示完整的联系人列表，右侧是联系人详情。应用利用了 Fragments API，通过它应用可以在同一屏显示多个面板界面。
|
||||
|
||||
蜂巢版本的联系人应用是第一个拥有快速滚动功能的版本。当按住左侧滚动条的时候，你可以快速上下拖动，应用会显示列表当前位置的首字母预览。
|
||||
|
||||
|
||||
新 Youtube 应用看起来像是来自黑客帝国。
|
||||
Ron Amadeo 供图
|
||||
|
||||
谢天谢地 Youtube 终于抛弃了自安卓 2.3 以来的谷歌给予这个视频服务的“独特”设计，新界面设计与系统更加一体化。主界面是一个水平滚动的曲面墙，上面显示着最热门或者（登录之后）个人关注的视频。虽然谷歌从来没有将这个设计带到手机上，但它可以被认为是一个易于重新配置的卡片界面。操作栏在这里是个可配置的工具栏。没有登录时，操作栏由一个搜索栏填满。当你登录后，搜索缩小为一个按钮，“首页”，“浏览”和“你的频道”标签将会显示出来。
|
||||
|
||||
|
||||
蜂巢用一个蓝色框架的电脑界面来驱动主屏。电影工作室完全采用橙色电子风格主题。
|
||||
Ron Amadeo 供图
|
||||
|
||||
蜂巢新增的应用“电影工作室”，这不是一个不言自明的应用，而且没有任何的解释或说明。就我们所知，你可以导入视频，剪切它们，添加文本和场景过渡。编辑视频——电脑上你可以做的最耗时，困难，以及处理器密集型任务之一——在平板上完成感觉有点野心过大了，谷歌在之后的版本里将其完全移除了。电影工作室里我们最喜欢的部分是它完全的电子风格主题。虽然系统的其它部分使用蓝色高亮，在这里是橙色的。（电影工作室是个邪恶的程序！）
|
||||
|
||||
|
||||
小部件！
|
||||
Ron Amadeo 供图
|
||||
|
||||
蜂巢带来了新的部件框架，允许部件滚动，Gmail，Email 以及日历部件都升级了以支持改功能。Youtube 和书籍使用了新的部件，内容卡片可以自动滚动切换。在小部件上轻轻向上或向下滑动可以切换卡片。我们不确定你的书籍中哪些书会被显示出来，但如果你想要的话它就在那儿。尽管所有的这些小部件在10英寸屏幕上运行良好，谷歌从未将它们重新设计给手机，这让它们在安卓最流行的规格上几乎毫无用处。所有的小部件有个大块的标识标题栏，而且通常占据大半屏幕只显示很少的内容。
|
||||
|
||||
|
||||
安卓3.1中可滚动的最近应用以及可自定义大小的小部件。
|
||||
Ron Amadeo 供图
|
||||
|
||||
蜂巢后续的版本修复了3.0早期的一些问题。安卓3.1在蜂巢的第一个版本之后三个月放出，并带来了一些改进。小部件自定义大小是添加的最大特性之一。长按小部件之后，一个带有拖拽按钮的蓝色外框会显示出来，拖动按钮可以改变小部件尺寸。最近应用界面现在可以垂直滚动并且承载更多应用。这个版本唯一缺失的功能是滑动关闭应用。
|
||||
|
||||
在今天，一个0.1版本的升级是个主要更新，但是在蜂巢，那只是个小更新。除了一些界面调整，3.1添加了对游戏手柄，键盘，鼠标以及其它USB和蓝牙输入设备的支持。它还提供了更多的开发者API。
|
||||
|
||||
|
||||
安卓3.2的兼容性缩放和一个安卓平板上典型的展开视图应用。
|
||||
Ron Amadeo 供图
|
||||
|
||||
安卓3.2在3.1发布后两个月放出，添加了七到八英寸的小尺寸平板支持。3.2终于启用了SD卡支持，Xoom 在生命最初的五个月像是抱着个不完整的肢体一样。
|
||||
|
||||
蜂巢匆匆问世是为了成为一个生态系统建设者。如果应用没有平板版本，没人会想要一个安卓平板的，所以谷歌知道需要尽快将东西送到开发者手中。在这个安卓平板生态的早期阶段，应用还没有到齐。这是拥有 Xoom 的人们所面临的最大的问题。
|
||||
|
||||
3.2添加了“兼容缩放”，给了用户一个新选项，可以将应用拉伸适应屏幕（如右侧图片显示的那样）或缩放成正常的应用布局来适应屏幕。这些选项都不是很理想，没有应用生态来支持平板，蜂巢设备销售状况惨淡。但谷歌的平板决策最终还是会得到回报。今天，安卓平板已经[取代 iOS 占据了最大的市场份额][1]。
|
||||
|
||||
----------
|
||||
|
||||
|
||||
|
||||
[Ron Amadeo][a] / Ron是Ars Technica的评论编缉，专注于安卓系统和谷歌产品。他总是在追寻新鲜事物，还喜欢拆解事物看看它们到底是怎么运作的。
|
||||
|
||||
[@RonAmadeo][t]
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://arstechnica.com/gadgets/2014/06/building-android-a-40000-word-history-of-googles-mobile-os/18/
|
||||
|
||||
译者：[alim0x](https://github.com/alim0x) 校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:http://techcrunch.com/2014/03/03/gartner-195m-tablets-sold-in-2013-android-grabs-top-spot-from-ipad-with-62-share/
|
||||
[a]:http://arstechnica.com/author/ronamadeo
|
||||
[t]:https://twitter.com/RonAmadeo
|
||||
@ -0,0 +1,60 @@
|
||||
在 Ubuntu 和 Linux Mint 上安装 Terminator 0.98
|
||||
================================================================================
|
||||
[Terminator][1]，在一个窗口中有多个终端。该项目的目标之一是为管理终端提供一个有用的工具。它的灵感来自于类似 gnome-multi-term，quankonsole 等程序，这些程序关注于在窗格中管理终端。 Terminator 0.98 带来了更完美的标签功能，更好的布局保存/恢复，改进了偏好用户界面和多出 bug 修复。
|
||||
|
||||
|
||||
|
||||
###TERMINATOR 0.98 的更改和新特性
|
||||
- 添加了一个布局启动器，允许在不用布局之间简单切换（用 Alt + L 打开一个新的布局切换器）；
|
||||
- 添加了一个新的手册（使用 F1 打开）；
|
||||
- 保存的时候，布局现在会记住：
|
||||
- * 最大化和全屏状态
|
||||
- * 窗口标题
|
||||
- * 激活的标签
|
||||
- * 激活的终端
|
||||
- * 每个终端的工作目录
|
||||
- 添加选项用于启用/停用非同质标签和滚动箭头；
|
||||
- 添加快捷键用于按行/半页/一页向上/下滚动;
|
||||
- 添加使用 Ctrl+鼠标滚轮放大/缩小，Shift+鼠标滚轮向上/下滚动页面；
|
||||
- 为下一个/上一个 profile 添加快捷键
|
||||
- 改进自定义命令菜单的一致性
|
||||
- 新增快捷方式/代码来切换所有/标签分组;
|
||||
- 改进监视插件
|
||||
- 增加搜索栏切换；
|
||||
- 清理和重新组织窗口偏好，包括一个完整的全局便签更新
|
||||
- 添加选项用于设置 ActivityWatcher 插件静默时间
|
||||
- 其它一些改进和 bug 修复
|
||||
- [点击此处查看完整更新日志][2]
|
||||
|
||||
### 安装 Terminator 0.98：
|
||||
|
||||
Terminator 0.98 有可用的 PPA，首先我们需要在 Ubuntu/Linux Mint 上添加库。在终端里运行下面的命令来安装 Terminator 0.98。
|
||||
|
||||
$ sudo add-apt-repository ppa:gnome-terminator/nightly
|
||||
$ sudo apt-get update
|
||||
$ sudo apt-get install terminator
|
||||
|
||||
如果你想要移除 Terminator，只需要在终端中运行下面的命令（可选）
|
||||
|
||||
$ sudo apt-get remove terminator
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.ewikitech.com/articles/linux/terminator-install-ubuntu-linux-mint/
|
||||
|
||||
作者：[admin][a]
|
||||
译者：[ictlyh](http://mutouxiaogui.cn/blog)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.ewikitech.com/author/admin/
|
||||
[1]:https://launchpad.net/terminator
|
||||
[2]:http://bazaar.launchpad.net/~gnome-terminator/terminator/trunk/view/head:/ChangeLog
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,48 @@
|
||||
如何在Ubuntu中添加和删除书签[新手技巧]
|
||||
================================================================================
|
||||
|
||||
|
||||
这是一篇对完全是新手的一篇技巧，我将向你展示如何在Ubuntu文件管理器中添加书签。
|
||||
|
||||
现在如果你想知道为什么要这么做，答案很简单。它可以让你可以快速地在左边栏中访问。比如。我[在Ubuntu中安装了Copy][1]。现在它创建了/Home/Copy。先进入Home目录再进入Copy目录并不是一件大事，但是我想要更快地访问它。因此我添加了一个书签这样我就可以直接从侧边栏访问了。
|
||||
|
||||
### 在Ubuntu中添加书签 ###
|
||||
|
||||
打开Files。进入你想要保存快速访问的目录。你需要在标记书签的目录里面。
|
||||
|
||||
现在，你有两种方法。
|
||||
|
||||
#### 方法1: ####
|
||||
|
||||
当你在Files中时（Ubuntu中的文件管理器），查看顶部菜单。你会看到书签按钮。点击它你会看到将当前路径保存为书签的选项。
|
||||
|
||||
|
||||
|
||||
#### 方法 2: ####
|
||||
|
||||
你可以直接按下Ctrl+D就可以将当前位置保存位书签。
|
||||
|
||||
如你所见，这里左边栏就有一个新添加的Copy目录：
|
||||
|
||||
|
||||
|
||||
### 管理书签 ###
|
||||
|
||||
如果你不想要太多的书签或者你错误地添加了一个书签，你可以很简单地删除它。按下Ctrl+B查看所有的书签。现在选择想要删除的书签并点击删除。
|
||||
|
||||
|
||||
|
||||
这就是在Ubuntu中管理书签需要做的。我知道这对于大多数用户而言很贱，但是这也许多Ubuntu的新手而言或许还有用。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://itsfoss.com/add-remove-bookmarks-ubuntu/
|
||||
|
||||
作者：[Abhishek][a]
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://itsfoss.com/author/abhishek/
|
||||
[1]:http://itsfoss.com/install-copy-in-ubuntu-14-04/
|
||||
151
translated/tech/20150918 Install Justniffer In Ubuntu 15.04.md
Normal file
151
translated/tech/20150918 Install Justniffer In Ubuntu 15.04.md
Normal file
@ -0,0 +1,151 @@
|
||||
在 Ubuntu 15.04 上安装 Justniffer
|
||||
================================================================================
|
||||
### 简介 ###
|
||||
|
||||
[Justniffer][1] 是一个可用于替换 Snort 的网络协议分析器。它非常流行，可交互式地跟踪/探测一个网络连接。它能从实时环境中抓取流量，支持 “lipcap” 和 “tcpdump” 文件格式。它可以帮助用户分析一个用 wireshark 难以抓包的复杂网络。尤其是它可以有效的帮助分析应用层流量，能提取类似图像、脚本、HTML 等 http 内容。Justniffer 有助于理解不同组件之间是如何通信的。
|
||||
|
||||
### 功能 ###
|
||||
|
||||
Justniffer 收集一个复杂网络的所有流量而不影响系统性能，这是 Justniffer 的一个优势，它还可以保存日志用于之后的分析，Justniffer 其它一些重要功能包括：
|
||||
|
||||
#### 1. 可靠的 TCP 流重建 ####
|
||||
|
||||
它可以使用主机 Linux 内核的一部分用于记录并重现 TCP 片段和 IP 片段。
|
||||
|
||||
#### 2. 日志 ####
|
||||
|
||||
保存日志用于之后的分析，并能自定义保存内容和时间。
|
||||
|
||||
#### 3. 可扩展 ####
|
||||
|
||||
可以通过外部 python、 perl 和 bash 脚本扩展来从分析报告中获取一些额外的结果。
|
||||
|
||||
#### 4. 性能管理 ####
|
||||
|
||||
基于连接时间、关闭时间、响应时间或请求时间等提取信息。
|
||||
|
||||
### 安装 ###
|
||||
|
||||
Justniffer 可以通过 PPA 安装：
|
||||
|
||||
运行下面命令添加库：
|
||||
|
||||
$ sudo add-apt-repository ppa:oreste-notelli/ppa
|
||||
|
||||
更新系统：
|
||||
|
||||
$ sudo apt-get update
|
||||
|
||||
安装 Justniffer 工具：
|
||||
|
||||
$ sudo apt-get install justniffer
|
||||
|
||||
make 的时候失败了，然后我运行下面的命令并尝试重新安装服务
|
||||
|
||||
$ sudo apt-get -f install
|
||||
|
||||
### 事例 ###
|
||||
|
||||
首先用 -v 选项验证安装的 Justniffer 版本，你需要用超级用户权限来使用这个工具。
|
||||
|
||||
$ sudo justniffer -V
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**1. 为 eth1 接口导出 apache 中的流量到终端**
|
||||
|
||||
$ sudo justniffer -i eth1
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**2. 可以永恒下面的选项跟踪正在运行的 tcp 流**
|
||||
|
||||
$ sudo justniffer -i eth1 -r
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**3. 获取 web 服务器的响应时间**
|
||||
|
||||
$ sudo justniffer -i eth1 -a " %response.time"
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**4. 使用 Justniffer 读取一个 tcpdump 抓取的文件**
|
||||
|
||||
首先，用 tcpdump 抓取流量。
|
||||
|
||||
$ sudo tcpdump -w /tmp/file.cap -s0 -i eth0
|
||||
|
||||
然后用 Justniffer 访问数据
|
||||
|
||||
$ justniffer -f file.cap
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**5. 只抓取 http 数据**
|
||||
|
||||
$ sudo justniffer -i eth1 -r -p "port 80 or port 8080"
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**6. 从一个指定主机获取 http 数据**
|
||||
|
||||
$ justniffer -i eth1 -r -p "host 192.168.1.250 and tcp port 80"
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
**7. 以更精确的格式抓取数据**
|
||||
|
||||
当你输入 **justniffer -h** 的时候你可以看到很多用于以更精确的方式获取数据的格式关键字
|
||||
|
||||
$ justniffer -h
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
让我们用 Justniffer 根据预先定义的参数提取数据
|
||||
|
||||
$ justniffer -i eth1 -l "%request.timestamp %request.header.host %request.url %response.time"
|
||||
|
||||
事例输出：
|
||||
|
||||
|
||||
|
||||
其中还有很多你可以探索的选项
|
||||
|
||||
### 总结 ###
|
||||
|
||||
Justniffer 是用于网络测试一个很好的工具。在我看来对于那些用 Snort 来进行网络探测的用户来说，Justniffer 是一个更简单的工具。它提供了很多 **格式关键字** 用于按照你的需要精确地提取数据。你可以用 .cap 文件格式记录网络信息，之后用于分析监视网络服务性能。
|
||||
|
||||
**参考资料：**
|
||||
|
||||
- [Justniffer 官网][2]
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.unixmen.com/install-justniffer-ubuntu-15-04/
|
||||
|
||||
作者：[Rajneesh Upadhyay][a]
|
||||
译者：[ictlyh](http://mutouxiaogui.cn/blog)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.unixmen.com/author/rajneesh/
|
||||
[1]:http://sourceforge.net/projects/justniffer/?source=directory
|
||||
[2]:http://justniffer.sourceforge.net/
|
||||
@ -0,0 +1,210 @@
|
||||
RHCE 系列： 使用网络安全服务（NSS）为 Apache 通过 TLS 实现 HTTPS
|
||||
================================================================================
|
||||
如果你是一个负责维护和确保 web 服务器安全的系统管理员，你不能不花费最大的精力确保服务器中处理和通过的数据任何时候都受到保护。
|
||||
|
||||
|
||||
RHCE 系列：第八部分 - 使用网络安全服务（NSS）为 Apache 通过 TLS 实现 HTTPS
|
||||
|
||||
为了在客户端和服务器之间提供更安全的连接，作为 HTTP 和 SSL（安全套接层）或者最近称为 TLS（传输层安全）的组合，产生了 HTTPS 协议。
|
||||
|
||||
由于一些严重的安全漏洞，SSL 已经被更健壮的 TLS 替代。由于这个原因，在这篇文章中我们会解析如何通过 TLS 实现你 web 服务器和客户端之间的安全连接。
|
||||
|
||||
这里假设你已经安装并配置好了 Apache web 服务器。如果还没有，在进入下一步之前请阅读下面站点中的文章。
|
||||
|
||||
- [在 RHEL/CentOS 7 上安装 LAMP（Linux，MySQL/MariaDB，Apache 和 PHP）][1]
|
||||
|
||||
### 安装 OpenSSL 和一些工具包 ###
|
||||
|
||||
首先，确保正在运行 Apache 并且允许 http 和 https 通过防火墙：
|
||||
|
||||
# systemctl start http
|
||||
# systemctl enable http
|
||||
# firewall-cmd --permanent –-add-service=http
|
||||
# firewall-cmd --permanent –-add-service=https
|
||||
|
||||
然后安装一些必须软件包：
|
||||
|
||||
# yum update && yum install openssl mod_nss crypto-utils
|
||||
|
||||
**重要**：请注意如果你想使用 OpenSSL 库而不是 NSS（网络安全服务）实现 TLS，你可以在上面的命令中用 mod\_ssl 替换 mod\_nss（使用哪一个取决于你，但在这篇文章中由于更加健壮我们会使用 NSS；例如，它支持最新的加密标准，比如 PKCS #11）。
|
||||
|
||||
如果你使用 mod\_nss，首先要卸载 mod\_ssl，反之如此。
|
||||
|
||||
# yum remove mod_ssl
|
||||
|
||||
### 配置 NSS（网络安全服务）###
|
||||
|
||||
安装完 mod\_nss 之后，会创建默认的配置文件 /etc/httpd/conf.d/nss.conf。你应该确保所有 Listen 和 VirualHost 指令都指向 443 号端口（HTTPS 默认端口）：
|
||||
|
||||
nss.conf – 配置文件
|
||||
|
||||
----------
|
||||
|
||||
Listen 443
|
||||
VirtualHost _default_:443
|
||||
|
||||
然后重启 Apache 并检查是否加载了 mod\_nss 模块：
|
||||
|
||||
# apachectl restart
|
||||
# httpd -M | grep nss
|
||||
|
||||
|
||||
|
||||
检查 Apache 是否加载 mod\_nss 模块
|
||||
|
||||
下一步，在 `/etc/httpd/conf.d/nss.conf` 配置文件中做以下更改：
|
||||
|
||||
1. 指定 NSS 数据库目录。你可以使用默认的目录或者新建一个。本文中我们使用默认的：
|
||||
|
||||
NSSCertificateDatabase /etc/httpd/alias
|
||||
|
||||
2. 通过保存密码到数据库目录中的 /etc/httpd/nss-db-password.conf 文件避免每次系统启动时要手动输入密码：
|
||||
|
||||
NSSPassPhraseDialog file:/etc/httpd/nss-db-password.conf
|
||||
|
||||
其中 /etc/httpd/nss-db-password.conf 只包含以下一行，其中 mypassword 是后面你为 NSS 数据库设置的密码：
|
||||
|
||||
internal:mypassword
|
||||
|
||||
另外，要设置该文件的权限和属主为 0640 和 root:apache：
|
||||
|
||||
# chmod 640 /etc/httpd/nss-db-password.conf
|
||||
# chgrp apache /etc/httpd/nss-db-password.conf
|
||||
|
||||
3. 由于 POODLE SSLv3 漏洞，红帽建议停用 SSL 和 TLSv1.0 之前所有版本的 TLS（更多信息可以查看[这里][2]）。
|
||||
|
||||
确保 NSSProtocol 指令的每个实例都类似下面一样（如果你没有托管其它虚拟主机，很可能只有一条）：
|
||||
|
||||
NSSProtocol TLSv1.0,TLSv1.1
|
||||
|
||||
4. 由于这是一个自签名证书，Apache 会拒绝重启，并不会识别为有效发行人。由于这个原因，对于这种特殊情况我们还需要添加：
|
||||
|
||||
NSSEnforceValidCerts off
|
||||
|
||||
5. 虽然并不是严格要求，为 NSS 数据库设置一个密码同样很重要：
|
||||
|
||||
# certutil -W -d /etc/httpd/alias
|
||||
|
||||
|
||||
|
||||
为 NSS 数据库设置密码
|
||||
|
||||
### 创建一个 Apache SSL 自签名证书 ###
|
||||
|
||||
下一步，我们会创建一个自签名证书为我们的客户机识别服务器（请注意这个方法对于生产环境并不是最好的选择；对于生产环境你应该考虑购买第三方可信证书机构验证的证书，例如 DigiCert）。
|
||||
|
||||
我们用 genkey 命令为 box1 创建有效期为 365 天的 NSS 兼容证书。完成这一步后：
|
||||
|
||||
# genkey --nss --days 365 box1
|
||||
|
||||
选择 Next：
|
||||
|
||||
|
||||
|
||||
创建 Apache SSL 密钥
|
||||
|
||||
你可以使用默认的密钥大小（2048），然后再次选择 Next：
|
||||
|
||||
|
||||
|
||||
选择 Apache SSL 密钥大小
|
||||
|
||||
等待系统生成随机比特：
|
||||
|
||||
|
||||
|
||||
生成随机密钥比特
|
||||
|
||||
为了加快速度，会提示你在控制台输入随机字符，正如下面的截图所示。请注意当没有从键盘接收到输入时进度条是如何停止的。然后，会让你选择：
|
||||
|
||||
1. 是否发送验证签名请求（CSR）到一个验证机构（CA）：选择 No，因为这是一个自签名证书。
|
||||
|
||||
2. 为证书输入信息。
|
||||
|
||||
注：youtube 视频
|
||||
<iframe width="720" height="405" frameborder="0" src="//www.youtube.com/embed/mgsfeNfuurA" allowfullscreen="allowfullscreen"></iframe>
|
||||
|
||||
最后，会提示你输入之前设置的密码到 NSS 证书：
|
||||
|
||||
# genkey --nss --days 365 box1
|
||||
|
||||
|
||||
|
||||
Apache NSS 证书密码
|
||||
|
||||
在任何时候你都可以用以下命令列出现有的证书：
|
||||
|
||||
# certutil –L –d /etc/httpd/alias
|
||||
|
||||
|
||||
|
||||
列出 Apache NSS 证书
|
||||
|
||||
然后通过名字删除（除非严格要求，用你自己的证书名称替换 box1）：
|
||||
|
||||
# certutil -d /etc/httpd/alias -D -n "box1"
|
||||
|
||||
如果你需要继续的话：
|
||||
|
||||
### 测试 Apache SSL HTTPS 连接 ###
|
||||
|
||||
最后，是时候测试到我们服务器的安全连接了。当你用浏览器打开 https://<web 服务器 IP 或主机名\>，你会看到著名的信息 “This connection is untrusted”：
|
||||
|
||||
|
||||
|
||||
检查 Apache SSL 连接
|
||||
|
||||
在上面的情况中，你可以点击添加例外（Add Exception） 然后确认安全例外（Confirm Security Exception） - 但先不要这么做。让我们首先来看看证书看它的信息是否和我们之前输入的相符（如截图所示）。
|
||||
|
||||
要做到这点，点击上面的视图（View...）-> 详情（Details）选项卡，当你从列表中选择发行人你应该看到这个：
|
||||
|
||||
|
||||
|
||||
确认 Apache SSL 证书详情
|
||||
|
||||
现在你继续，确认例外（限于此次或永久），然后会通过 https 把你带到你 web 服务器的 DocumentRoot 目录，在这里你可以使用你浏览器自带的开发者工具检查连接详情：
|
||||
|
||||
在火狐浏览器中，你可以通过在屏幕中右击然后从上下文菜单中选择检查元素（Inspect Element）启动，尤其是通过网络选项卡：
|
||||
|
||||
|
||||
|
||||
检查 Apache HTTPS 连接
|
||||
|
||||
请注意这和之前显示的在验证过程中输入的信息一致。还有一种方式通过使用命令行工具测试连接：
|
||||
|
||||
左边（测试 SSLv3）：
|
||||
|
||||
# openssl s_client -connect localhost:443 -ssl3
|
||||
|
||||
右边（测试 TLS）：
|
||||
|
||||
# openssl s_client -connect localhost:443 -tls1
|
||||
|
||||
|
||||
|
||||
测试 Apache SSL 和 TLS 连接
|
||||
|
||||
参考上面的截图了解更相信信息。
|
||||
|
||||
### 总结 ###
|
||||
|
||||
我确信你已经知道，使用 HTTPS 会增加会在你站点中输入个人信息的访客的信任（从用户名和密码到任何商业/银行账户信息）。
|
||||
|
||||
在那种情况下，你会希望获得由可信验证机构签名的证书，正如我们之前解释的（启用的步骤和发送 CSR 到 CA 然后获得签名证书的例子相同）；另外的情况，就是像我们的例子中一样使用自签名证书。
|
||||
|
||||
要获取更多关于使用 NSS 的详情，可以参考关于 [mod-nss][3] 的在线帮助。如果你有任何疑问或评论，请告诉我们。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/create-apache-https-self-signed-certificate-using-nss/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[ictlyh](http://www.mutouxiaogui.cn/blog/)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/install-lamp-in-centos-7/
|
||||
[1]:http://www.tecmint.com/author/gacanepa/
|
||||
[2]:https://access.redhat.com/articles/1232123
|
||||
[3]:https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html
|
||||
@ -1,214 +0,0 @@
|
||||
RHECSA 系列：RHEL7 中的进程管理：开机，关机，以及两者之间的所有其他事项 – Part 5
|
||||
================================================================================
|
||||
我们将概括和简要地复习从你按开机按钮来打开你的 RHEL 7 服务器到呈现出命令行界面的登录屏幕之间所发生的所有事情，以此来作为这篇文章的开始。
|
||||
|
||||
|
||||
|
||||
Linux 开机过程
|
||||
|
||||
**请注意：**
|
||||
|
||||
1. 相同的基本原则也可以应用到其他的 Linux 发行版本中，但可能需要较小的更改，并且
|
||||
2. 下面的描述并不是旨在给出开机过程的一个详尽的解释，而只是介绍一些基础的东西
|
||||
|
||||
### Linux 开机过程 ###
|
||||
|
||||
1.初始化 POST(加电自检)并执行硬件检查；
|
||||
|
||||
2.当 POST 完成后，系统的控制权将移交给启动管理器的第一阶段，它存储在一个硬盘的引导扇区(对于使用 BIOS 和 MBR 的旧式的系统)或存储在一个专门的 (U)EFI 分区上。
|
||||
|
||||
3.启动管理器的第一阶段完成后，接着进入启动管理器的第二阶段，通常大多数使用的是 GRUB(GRand Unified Boot Loader 的简称)，它驻留在 `/boot` 中，反过来加载内核和驻留在 RAM 中的初始化文件系统(被称为 initramfs，它包含执行必要操作所需要的程序和二进制文件，以此来最终挂载真实的根文件系统)。
|
||||
|
||||
4.接着经历了闪屏过后，呈现在我们眼前的是类似下图的画面，它允许我们选择一个操作系统和内核来启动：
|
||||
|
||||
|
||||
|
||||
启动菜单屏幕
|
||||
|
||||
5.然后内核对挂载到系统的硬件进行设置，一旦根文件系统被挂载，接着便启动 PID 为 1 的进程，反过来这个进程将初始化其他的进程并最终呈现给我们一个登录提示符界面。
|
||||
|
||||
注意：假如我们想在后面这样做(注：这句话我总感觉不通顺，不明白它的意思，希望改一下)，我们可以使用 [dmesg 命令][1](注:这篇文章已经翻译并发表了，链接是 https://linux.cn/article-3587-1.html )并使用这个系列里的上一篇文章中解释过的工具(注:即 grep)来过滤它的输出。
|
||||
|
||||
|
||||
|
||||
登录屏幕和进程的 PID
|
||||
|
||||
在上面的例子中，我们使用了众所周知的 `ps` 命令来显示在系统启动过程中的一系列当前进程的信息，它们的父进程(或者换句话说，就是那个开启这些进程的进程) 为 systemd(大多数现代的 Linux 发行版本已经切换到的系统和服务管理器)：
|
||||
|
||||
# ps -o ppid,pid,uname,comm --ppid=1
|
||||
|
||||
记住 `-o`(为 -format 的简写)选项允许你以一个自定义的格式来显示 ps 的输出，以此来满足你的需求；这个自定义格式使用 man ps 里 STANDARD FORMAT SPECIFIERS 一节中的特定关键词。
|
||||
|
||||
另一个你想自定义 ps 的输出而不是使用其默认输出的情形是：当你需要找到引起 CPU 或内存消耗过多的那些进程，并按照下列方式来对它们进行排序时：
|
||||
|
||||
# ps aux --sort=+pcpu # 以 %CPU 来排序(增序)
|
||||
# ps aux --sort=-pcpu # 以 %CPU 来排序(降序)
|
||||
# ps aux --sort=+pmem # 以 %MEM 来排序(增序)
|
||||
# ps aux --sort=-pmem # 以 %MEM 来排序(降序)
|
||||
# ps aux --sort=+pcpu,-pmem # 结合 %CPU (增序) 和 %MEM (降序)来排列
|
||||
|
||||
|
||||
|
||||
自定义 ps 命令的输出
|
||||
|
||||
### systemd 的一个介绍 ###
|
||||
|
||||
在 Linux 世界中，很少有决定能够比在主流的 Linux 发行版本中采用 systemd 引起更多的争论。systemd 的倡导者根据以下事实命名其主要的优势：
|
||||
|
||||
另外请阅读: ['init' 和 'systemd' 背后的故事][2]
|
||||
|
||||
1. 在系统启动期间，systemd 允许并发地启动更多的进程(相比于先前的 SysVinit，SysVinit 似乎总是表现得更慢，因为它一个接一个地启动进程，检查一个进程是否依赖于另一个进程，然后等待守护进程去开启可以开始的更多的服务)，并且
|
||||
2. 在一个运行着的系统中，它作为一个动态的资源管理器来工作。这样在开机期间，当一个服务被需要时，才启动它(以此来避免消耗系统资源)而不是在没有一个合理的原因的情况下启动额外的服务。
|
||||
3. 向后兼容 sysvinit 的脚本。
|
||||
|
||||
systemd 由 systemctl 工具控制，假如你带有 SysVinit 背景，你将会对以下的内容感到熟悉：
|
||||
|
||||
- service 工具, 在旧一点的系统中，它被用来管理 SysVinit 脚本，以及
|
||||
- chkconfig 工具, 为系统服务升级和查询运行级别信息
|
||||
- shutdown, 你一定使用过几次来重启或关闭一个运行的系统。
|
||||
|
||||
下面的表格展示了使用传统的工具和 systemctl 之间的相似之处：
|
||||
|
||||
注：表格
|
||||
<table cellspacing="0" border="0">
|
||||
<colgroup width="237"></colgroup>
|
||||
<colgroup width="256"></colgroup>
|
||||
<colgroup width="1945"></colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td align="left" height="25" bgcolor="#B7B7B7" style="border: 1px solid #000000;"><b><span style="color: black; font-family: Arial; font-size: small;">Legacy tool</span></b></td>
|
||||
<td align="left" bgcolor="#B7B7B7" style="border: 1px solid #000000;"><b><span style="color: black; font-family: Arial; font-size: small;">Systemctl equivalent</span></b></td>
|
||||
<td align="left" bgcolor="#B7B7B7" style="border: 1px solid #000000;"><b><span style="color: black; font-family: Arial; font-size: small;">Description</span></b></td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name start</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl start name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Start name (where name is a service)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name stop</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl stop name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Stop name</td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name condrestart</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl try-restart name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Restarts name (if it’s already running)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name restart</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl restart name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Restarts name</td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name reload</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl reload name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Reloads the configuration for name</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service name status</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl status name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Displays the current status of name</td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="23" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">service –status-all</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Arial;">Displays the status of all current services</span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">chkconfig name on</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl enable name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Enable name to run on startup as specified in the unit file (the file to which the symlink points). The process of enabling or disabling a service to start automatically on boot consists in adding or removing symbolic links inside the /etc/systemd/system directory.</td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">chkconfig name off</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl disable name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Disables name to run on startup as specified in the unit file (the file to which the symlink points)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="21" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">chkconfig –list name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl is-enabled name</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;">Verify whether name (a specific service) is currently enabled</td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="23" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">chkconfig –list</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl –type=service</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Arial;">Displays all services and tells whether they are enabled or disabled</span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left" height="23" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">shutdown -h now</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl poweroff</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Arial;">Power-off the machine (halt)</span></td>
|
||||
</tr>
|
||||
<tr class="alt">
|
||||
<td align="left" height="23" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">shutdown -r now</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Courier New;">systemctl reboot</span></td>
|
||||
<td align="left" style="border: 1px solid #000000;"><span style="color: black; font-family: Arial;">Reboot the system</span></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
systemd 也引进了单元(它可能是一个服务，一个挂载点，一个设备或者一个网络套接字)和目标(它们定义了 systemd 如何去管理和同时开启几个相关的进程，并可认为它们与在基于 SysVinit 的系统中的运行级别等价,尽管事实上它们并不等价)。
|
||||
|
||||
### 总结归纳 ###
|
||||
|
||||
其他与进程管理相关，但并不仅限于下面所列的功能的任务有：
|
||||
|
||||
**1. 在考虑到系统资源的使用上，调整一个进程的执行优先级：**
|
||||
|
||||
这是通过 `renice` 工具来完成的，它可以改变一个或多个正在运行着的进程的调度优先级。简单来说，调度优先级是一个允许内核(当前只支持 >= 2.6 的版本)根据某个给定进程被分配的执行优先级(即优先级，从 -20 到 19)来为其分配系统资源的功能。
|
||||
|
||||
`renice` 的基本语法如下：
|
||||
|
||||
# renice [-n] priority [-gpu] identifier
|
||||
|
||||
在上面的通用命令中，第一个参数是将要使用的优先级数值，而另一个参数可以解释为进程 ID(这是默认的设定)，进程组 ID，用户 ID 或者用户名。一个常规的用户(即除 root 以外的用户)只可以更改他或她所拥有的进程的调度优先级，并且只能增加优先级的层次(这意味着占用更少的系统资源)。
|
||||
|
||||
|
||||
|
||||
进程调度优先级
|
||||
|
||||
**2. 按照需要杀死一个进程(或终止其正常执行)：**
|
||||
|
||||
更精确地说，杀死一个进程指的是通过 [kill 或 pkill][3]命令给该进程发送一个信号，让它优雅地(SIGTERM=15)或立即(SIGKILL=9)结束它的执行。
|
||||
|
||||
这两个工具的不同之处在于前一个被用来终止一个特定的进程或一个进程组，而后一个则允许你在进程的名称和其他属性的基础上，执行相同的动作。
|
||||
|
||||
另外， pkill 与 pgrep 相捆绑，pgrep 提供将受影响的进程的 PID 给 pkill 来使用。例如，在运行下面的命令之前：
|
||||
|
||||
# pkill -u gacanepa
|
||||
|
||||
查看一眼由 gacanepa 所拥有的 PID 或许会带来点帮助：
|
||||
|
||||
# pgrep -l -u gacanepa
|
||||
|
||||
|
||||
|
||||
找到用户拥有的 PID
|
||||
|
||||
默认情况下，kill 和 pkiill 都发送 SIGTERM 信号给进程，如我们上面提到的那样，这个信号可以被忽略(即该进程可能会终止其自身的执行或者不终止)，所以当你因一个合理的理由要真正地停止一个运行着的进程，则你将需要在命令行中带上特定的 SIGKILL 信号：
|
||||
|
||||
# kill -9 identifier # 杀死一个进程或一个进程组
|
||||
# kill -s SIGNAL identifier # 同上
|
||||
# pkill -s SIGNAL identifier # 通过名称或其他属性来杀死一个进程
|
||||
|
||||
### 结论 ###
|
||||
|
||||
在这篇文章中，我们解释了在 RHEL 7 系统中，有关开机启动过程的基本知识，并分析了一些可用的工具来帮助你通过使用一般的程序和 systemd 特有的命令来管理进程。
|
||||
|
||||
请注意，这个列表并不旨在涵盖有关这个话题的所有花哨的工具，请随意使用下面的评论栏来添加你自已钟爱的工具和命令。同时欢迎你的提问和其他的评论。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/rhcsa-exam-boot-process-and-process-management/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/dmesg-commands/
|
||||
[2]:http://www.tecmint.com/systemd-replaces-init-in-linux/
|
||||
[3]:http://www.tecmint.com/how-to-kill-a-process-in-linux/
|
||||
@ -0,0 +1,177 @@
|
||||
RHCSA 系列： 在 RHEL 7 中使用 SELinux 进行强制访问控制 – Part 13
|
||||
================================================================================
|
||||
在本系列的前面几篇文章中，我们已经详细地探索了至少两种访问控制方法：标准的 ugo/rwx 权限([管理用户和组 – Part 3][1]) 和访问控制列表([在文件系统中配置 ACL – Part 7][2])。
|
||||
|
||||
|
||||
|
||||
RHCSA 认证：SELinux 精要和控制文件系统的访问
|
||||
|
||||
尽管作为第一级别的权限和访问控制机制是必要的，但它们同样有一些局限，而这些局限则可以由安全增强 Linux(Security Enhanced Linux,简称为 SELinux) 来处理。
|
||||
|
||||
这些局限的一种情形是：某个用户可能通过一个未加详细阐述的 chmod 命令将一个文件或目录暴露在安全漏洞面前(注：这句我的翻译有点问题)，从而引起访问权限的意外传播。结果，由该用户开启的任意进程可以对属于该用户的文件进行任意的操作，最终一个恶意的或受损的软件对整个系统可能会实现 root 级别的访问权限。
|
||||
|
||||
考虑到这些局限性，美国国家安全局(NSA) 率先设计出了 SELinux，一种强制的访问控制方法，它根据最小权限模型去限制进程在系统对象(如文件，目录，网络接口等)上的访问或执行其他的操作的能力，而这些限制可以在后面根据需要进行修改。简单来说，系统的每一个元素只给某个功能所需要的那些权限。
|
||||
|
||||
在 RHEL 7 中，SELinux 被并入了内核中，且默认情况下以强制模式开启。在这篇文章中，我们将简要地介绍有关 SELinux 及其相关操作的基本概念。
|
||||
|
||||
### SELinux 的模式 ###
|
||||
|
||||
SELinux 可以以三种不同的模式运行：
|
||||
|
||||
- 强制模式：SELinux 根据 SELinux 策略规则拒绝访问，这些规则是用以控制安全引擎的一系列准则；
|
||||
- 宽容模式：SELinux 不拒绝访问，但对于那些运行在强制模式下会被拒绝访问的行为，它会进行记录；
|
||||
- 关闭 (不言自明，即 SELinux 没有实际运行).
|
||||
|
||||
使用 `getenforce` 命令可以展示 SELinux 当前所处的模式，而 `setenforce` 命令(后面跟上一个 1 或 0) 则被用来将当前模式切换到强制模式或宽容模式，但只对当前的会话有效。
|
||||
|
||||
为了使得在登出和重启后上面的设置还能保持作用，你需要编辑 `/etc/selinux/config` 文件并将 SELINUX 变量的值设为 enforcing，permissive，disabled 中之一：
|
||||
|
||||
# getenforce
|
||||
# setenforce 0
|
||||
# getenforce
|
||||
# setenforce 1
|
||||
# getenforce
|
||||
# cat /etc/selinux/config
|
||||
|
||||
|
||||
|
||||
设置 SELinux 模式
|
||||
|
||||
通常情况下，你将使用 `setenforce` 来在 SELinux 模式间进行切换(从强制模式到宽容模式，或反之)，以此来作为你排错的第一步。假如 SELinux 当前被设置为强制模式，而你遇到了某些问题，但当你把 SELinux 切换为宽容模式后问题不再出现了，则你可以确信你遇到了一个 SELinux 权限方面的问题。
|
||||
|
||||
### SELinux 上下文 ###
|
||||
|
||||
一个 SELinux 上下文由一个权限控制环境所组成，在这个环境中，决定的做出将基于 SELinux 的用户，角色和类型(和可选的级别)：
|
||||
|
||||
- 一个 SELinux 用户是通过将一个常规的 Linux 用户账户映射到一个 SELinux 用户账户来实现的，反过来，在一个会话中，这个 SELinux 用户账户在 SELinux 上下文中被进程所使用，为的是能够显示地定义它们所允许的角色和级别。
|
||||
- 角色的概念是作为域和处于该域中的 SELinux 用户之间的媒介，它定义了 SELinux 可以访问到哪个进程域和哪些文件类型。这将保护您的系统免受提权漏洞的攻击。
|
||||
- 类型则定义了一个 SELinux 文件类型或一个 SELinux 进程域。在正常情况下，进程将会被禁止访问其他进程正使用的文件，并禁止对其他进程进行访问。这样只有当一个特定的 SELinux 策略规则允许它访问时，才能够进行访问。
|
||||
|
||||
下面就让我们看看这些概念是如何在下面的例子中起作用的。
|
||||
|
||||
**例 1：改变 sshd 守护进程的默认端口**
|
||||
|
||||
在[加固 SSH – Part 8][3] 中，我们解释了更改 sshd 所监听的默认端口是加固你的服务器免收外部攻击的首个安全措施。下面，就让我们编辑 `/etc/ssh/sshd_config` 文件并将端口设置为 9999：
|
||||
|
||||
Port 9999
|
||||
|
||||
保存更改并重启 sshd：
|
||||
|
||||
# systemctl restart sshd
|
||||
# systemctl status sshd
|
||||
|
||||
|
||||
|
||||
重启 SSH 服务
|
||||
|
||||
正如你看到的那样， sshd 启动失败，但为什么会这样呢？
|
||||
|
||||
快速检查 `/var/log/audit/audit.log` 文件会发现 sshd 已经被拒绝在端口 9999 上开启(SELinux 日志信息包含单词 "AVC",所以这类信息可以被轻易地与其他信息相区分)，因为这个端口是 JBoss 管理服务的保留端口：
|
||||
|
||||
# cat /var/log/audit/audit.log | grep AVC | tail -1
|
||||
|
||||
|
||||
|
||||
查看 SSH 日志
|
||||
|
||||
在这种情况下，你可以像先前解释的那样禁用 SELinux(但请不要这样做！)，并尝试重启 sshd，且这种方法能够起效。但是， `semanage` 应用可以告诉我们在哪些端口上可以开启 sshd 而不会出现任何问题。
|
||||
|
||||
运行：
|
||||
|
||||
# semanage port -l | grep ssh
|
||||
|
||||
便可以得到一个 SELinux 允许 sshd 在哪些端口上监听的列表：
|
||||
|
||||
|
||||
|
||||
Semanage 工具
|
||||
|
||||
所以让我们在 `/etc/ssh/sshd_config` 中将端口更改为 9998 端口，增加这个端口到 ssh_port_t 的上下文，然后重启 sshd 服务：
|
||||
|
||||
# semanage port -a -t ssh_port_t -p tcp 9998
|
||||
# systemctl restart sshd
|
||||
# systemctl is-active sshd
|
||||
|
||||
|
||||
|
||||
Semanage 添加端口
|
||||
|
||||
如你所见，这次 sshd 服务被成功地开启了。这个例子告诉我们这个事实：SELinux 控制 TCP 端口数为它自己端口类型中间定义。
|
||||
|
||||
**例 2：允许 httpd 访问 sendmail**
|
||||
|
||||
这是一个 SELinux 管理一个进程来访问另一个进程的例子。假如在你的 RHEL 7 服务器上，你要实现 Apache 的 mod_security 和 mod_evasive(注：这里少添加了一个链接，链接的地址是 http://www.tecmint.com/protect-apache-using-mod_security-and-mod_evasive-on-rhel-centos-fedora/)，你需要允许 httpd 访问 sendmail，以便在遭受到 (D)DoS 攻击时能够用邮件来提醒你。在下面的命令中，如果你不想使得更改在重启后任然生效，请去掉 `-P` 选项。
|
||||
|
||||
# semanage boolean -1 | grep httpd_can_sendmail
|
||||
# setsebool -P httpd_can_sendmail 1
|
||||
# semanage boolean -1 | grep httpd_can_sendmail
|
||||
|
||||
|
||||
|
||||
允许 Apache 发送邮件
|
||||
|
||||
从上面的例子中，你可以知道 SELinux 布尔设定(或者只是布尔值)分别对应于 true 或 false,被嵌入到了 SELinux 策略中。你可以使用 `semanage boolean -l` 来列出所有的布尔值，也可以管道至 grep 命令以便筛选输出的结果。
|
||||
|
||||
**例 3：在一个特定目录而非默认目录下服务一个静态站点**
|
||||
|
||||
假设你正使用一个不同于默认目录(`/var/www/html`)的目录来服务一个静态站点，例如 `/websites` 目录(这种情形会出现在当你把你的网络文件存储在一个共享网络设备上，并需要将它挂载在 /websites 目录时)。
|
||||
|
||||
a). 在 /websites 下创建一个 index.html 文件并包含如下的内容：
|
||||
|
||||
<html>
|
||||
<h2>SELinux test</h2>
|
||||
</html>
|
||||
|
||||
假如你执行
|
||||
|
||||
# ls -lZ /websites/index.html
|
||||
|
||||
你将会看到这个 index.html 已经被标记上了 default_t SELinux 类型，而 Apache 不能访问这类文件：
|
||||
|
||||
|
||||
|
||||
检查 SELinux 文件的权限
|
||||
|
||||
b). 将 `/etc/httpd/conf/httpd.conf` 中的 DocumentRoot 改为 /websites，并不要忘了
|
||||
更新相应的 Directory 代码块。然后重启 Apache。
|
||||
|
||||
c). 浏览到 `http://<web server IP address>`，则你应该会得到一个 503 Forbidden 的 HTTP 响应。
|
||||
|
||||
d). 接下来，递归地改变 /websites 的标志,将它的标志变为 httpd_sys_content_t 类型，以便赋予 Apache 对这些目录和其内容的只读访问权限：
|
||||
|
||||
# semanage fcontext -a -t httpd_sys_content_t "/websites(/.*)?"
|
||||
|
||||
e). 最后，应用在 d) 中创建的 SELinux 策略：
|
||||
|
||||
# restorecon -R -v /websites
|
||||
|
||||
现在重启 Apache 并再次浏览到 `http://<web server IP address>`，则你可以看到被正确展现出来的 html 文件：
|
||||
|
||||
|
||||
|
||||
确认 Apache 页面
|
||||
|
||||
### 总结 ###
|
||||
|
||||
在本文中，我们详细地介绍了 SELinux 的基础知识。请注意，由于这个主题的广泛性，在单篇文章中做出一个完全详尽的解释是不可能的，但我们相信，在这个指南中列出的基本原则将会对你进一步了解更高级的话题有所帮助，假如你想了解的话。
|
||||
|
||||
假如可以，请让我推荐两个必要的资源来入门 SELinux：[NSA SELinux 页面][4] 和 [针对用户和系统管理员的 RHEL 7 SELinux 指南][5]。
|
||||
|
||||
假如你有任何的问题或评论，请不要犹豫，让我们知晓吧。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/selinux-essentials-and-control-filesystem-access/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[FSSlc](https://github.com/FSSlc)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups
|
||||
[2]:http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares/
|
||||
[3]:http://www.tecmint.com/rhcsa-series-secure-ssh-set-hostname-enable-network-services-in-rhel-7/
|
||||
[4]:https://www.nsa.gov/research/selinux/index.shtml
|
||||
[5]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/part_I-SELinux.html
|
||||
Loading…
Reference in New Issue
Block a user