Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (STEP 13)
This config is on the VMware host. In my case, that’s a MacOS Mojave MacBook Pro running VMware Fusion. Any recent VMware hypervisors (Fusion, Workstation ESXi) are capable of providing this. VirtualBox and Parallels can to. This scope of this guide is staying with VMware Fusion on MacOS.
* for simplicity, this VMNET config uses an entire class c range (private/non-routable of course), and then allocates the bottom half for static IP and lets the DHCP process serve the top half.
Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (STEP 12)
- this is how/where those are provided to the PXE/Kickstart clients.
- Each targeted Distro/Release/Arch requires a matching “LiveOS” be provided.
- When the client node boots into this image, this is what runs the Anaconda installer (and processes the kickstart script).
- cp /mnt/cdrom/LiveOS/* /var/www/html/repos/c7x64/base/LiveOS/
- # OR: cp /run/media/{username}/CentOS\ 7\ x86_64/LiveOS/* /var/www/html/repos/c7x64/base/LiveOS/
- # cp /run/media/elmer/CentOS\ 7\ x86_64/LiveOS/* /var/www/html/repos/c7x64/base/LiveOS/
Now, switch to the the 32 bit ISO and cp those files as well:
- umount /dev/cdrom
- mount /dev/cdrom/ /mnt/cdrom/
- cp /mnt/cdrom/isolinux/{vmlinuz,initrd.img,splash.png} /var/lib/tftpboot/CentOS7x32/
- cp /mnt/cdrom/LiveOS/* /var/www/html/repos/c7x32/base/LiveOS/
Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (STEP 11)
Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (STEP 9)
- enable firewall port for tftp
- enable the service.
- systemctl start tftp.socket
- systemctl enable tftp.socket
- put some important files into the tftp server location:
- cd /var/lib/tftpboot # // it starts out empty.
- cp /usr/share/syslinux/{pxelinux.0,vesamenu.c32} . # // now it has those two files in it.
- Create a menu for the PXE Service… (the options a client machine gets):
- mkdir /var/lib/tftpboot/pxelinux.cfg
- cd /var/lib/tftpboot/pxelinux.cfg/
- nano default
Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (introduction)
- CentOS 7.x Linux 64-bit, NO GUI desktop, HTTPD, PXE, Kickstart, RepoSync+RepoTrack, NFS.
- Begin with by making a full clone from existing VM c7baseline.
- two vDisks:
- 20GB for RepoSync at “/var/www/html/repos/” hdd=”c7pxe-repos.vmdk”
- 6GB for /boot and “/” hdd=”c7baseline-d1.vmdk”
- entry for “/etc/hosts”: 10.0.0.11 c7pxe.lab.domain.net c7pxe.local c7pxe
- VM is configured with a static IP using VMware Fusion VMNET2
- Only user is “elmer”. Elmer has administrative (sudo) privileges.
- SELinux=permissive
- firewalld is enabled and configured, with only SSH and nss-mdns in from local subnet.
- repo EPEL is enabled.
- KDUMP and SWAP were disabled during install.
- has these packages: ip address, nmtui, gzip, tar, top, curl, epel-release, yum-utils, deltarpm, nano, nss-mdns, htop, rng-tools, rsync.
- Avahi is running, so I can use *.local name resolution and skip more complicated DNS and/or host file configurations.
- open-vm-tools is running. I have a couple folders shared into the VM for getting scripts and outputting config backups.
- SSHD is running. I do most of my activity via a host MacOS terminal ssh connection.
- I use nano as editor on CentOS VMs. If you prefer vi, emacs, or something else… thats ok with me.
- The VM gets TIME from the host, via hypervisor/open-vm-tools, so it doesn’t need NTP or Chrony.
- Virtual hardware items Printer, Sound, USB, Camera, and Bluetooth have been removed from the VM config.
- The VM using NVMe for hard disks and SATA for cdrom. No IDE or SCSI.
- The reduced hardware profile enables removing a lot of firmware packages from these VMs.
It’s easy/fast to make a ZIP backup copy of an entire VM, so I’m moderately aggressive with removing things like dracut emergency/rescue packages, old kernels, yum caches, etc. If I break a VM, I just revert to a previous backup.
With VMs under 20GB in size, making ZIP backups via the host OS filesystem is often faster than managing VMware snapshots. Also, I like knowing that I have fully contained/atomic backups set to the side and quickly available if needed.
I have some custom scripts that clean up the VM contents and shrink the vdisk (to reduce disk usage on host system).
There are many options to further minimize and harden these VMs, but this current baseline maintains normal CentOS/Fedora/RHEL/Oracle functionality and compatibility.
Build a CentOS7 server for: pxe boot, kickstart, reposync, repotrack, nfs, https (summary of steps)
- INTRODUCTION: Overview of the starting point for this install, and reasons why to do it.
- STEP 1 – clone an existing “minimal” VM (or build one).
- STEP 2 – prepare to install/config PXE/RepoSync/RepoTrack (load software packages).
- STEP 3 – add/config a 2nd virtual hard disk for the repo files.
- STEP 4 – CONFIG RepoSync/RepoTrack to support multiple OS Distros, Releases, and Architectures.
- STEP 5 – configure an EXCLUDE LINE for YUM CONFIG files
- STEP 6 – build REPOSYNC commands for SCRIPT “rs-c7x64-update.sh”
- STEP 7 – CREATE /etc/yum.repos.d/c7x64.repo for the CentOS 7 64-bit REPOSYNC CLIENTS
- STEP 8 – CREATE /etc/yum.repos.d/c7x32.repo for the CentOS 7 32-bit REPOSYNC CLIENTS
- STEP 9 – ENABLE and CONFIGURE PXE (uses vmware dhcp; does not require CentOS NTP/DHCP/DNS/vsftd/xinetd)
- STEP 10 – Create a PXE BOOT MENU
- STEP 11 – create the kickstart files referenced by the PXE Boot menu:
- STEP 12 – Put the required PXE client boot files in place.
- STEP 13 – Provide PXE boot server info to DHCP clients, via VMware Fusion vnet config (not a CentOS DHCP server).
- STEP 14 – Test PXE Boot and Kickstart installation.
- SIDEBAR 1 – Alternate ways to provide PXE BOOT IMAGES to clients (a brief summary)
- SIDEBAR 2 – Optional NFS SHARE: convenient for exploring repo contents from a gui desktop VM.
- SIDEBAR 3 – PXE client note re memory: the boot image uses a ramdisk.
OS X, Fusion, command line, VMs as daemons…
somewhat random string of notes created while exploring options to run VMware Fusion VMs on system boot (prior to user login). ie., looking at ways to start the VMs from a system level daemon… launchd, continuously running, independent of user logins.
* don’t want to leave this as root… need to create a service account for starting/running the VMs… and allow specific users to SU to that service if/when they need to use the Fusion app for gui interaction with the running VM(s).
… resume this later …
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
start & stop VMs with command line (or script)
- OS X 10.8.2 Mountain Lion
- VMware Fusion 5.0.2
- 2012 MacBook Pro Retina 13″, 2.5Ghz i5, 8GB Ram
some command line options for vmrun:
- start [gui|nogui]
- list
- stop [hard|soft]
- full details of vmrun command for Fusion 5
sudo su
- if vmrun is executed as root, the resulting PID will belong to root. if a user uses the desktop gui to launch “VMware Fusion.app”, they will not be able to interact with the VM… and attempting to launch it from the GUI Virtual Machine Library will display an error (the executing PID will be unaffected).
- if vmrum is executed as a user, the resulting PID will belong to that user. if the same user then used the desktop guy to launch “VMware Fusion.app”, Fusion will immediately create a GUI display for the running VM(s). Although the VM was launched from the command line as “nogui”, starting Fusion effectively converted the VM to “gui” mode. Any attempt to quit/close the Fusion GUI will result in the closure/shutdown of the running VM(s).
- if vmrun is executed as root, and then “/Applications/VMware\ Fusion.app/Contents/MacOS/VMware\ Fusion” is also executed as root… this will result in a desktop GUI instance of Fusion with a connection to the VMs… ie., converts the VM from “nogui” to “gui”. Closing the Fusion app via it’s menu options will shutdown the VM… however, using the Activity Monitor “Quit Process” function seems to leave the VM running just fine.
- follow up by testing with a “service account” instead of “sudo su”.
- and verify the VM remains functional with remote login/tests to the VM(s).
So…
- to start a VM in “headless” mode… use the command line “nogui” option.
- to make a “gui” connection to the VM, launch the Fusion app using the same user.
- to resume “headless” mode, close Fusion gui with Activity Monitor “Quit Process”.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- /Applications/VMware Fusion.app/Contents/Library/vmrun
- vmrun -T fusion <path to VM> nogui
- vmrun -T fusion list
…/vmrun -T fusion start …/[vmname].vmwarevm/[vmname].vmx nogui
/Applications/VMware\ Fusion.app/Contents/Library/vmrun -T fusion start $HOME/VMwareVMs/TestImage.vmwarevm/TestImage.vmx nogui
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
…/vmrun -T fusion list
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
…/vmrun -T fusion stop …/[vmname].vmwarevm/[vmname].vmx soft
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To see ALL the daemons currently running, you need to type:
sudo launchctl list
And then you can remove it, for example:
sudo launchctl remove com.sassafras.KeyAccess.daemon
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GUI utility to view/edit agents & daemons.
Lingon 2.1.1 by Peter Borg. Displays existing items. Edits plist files. Creates the plist file when creating a new agent.
note: Newer versions of the app are only available from the Mac App Store and (due to GateKeeper / app rules) no longer have the ability to work on system agents/daemons. The App Store version is limited to the current log’d in user only. But the older 2.1.1 (2008-12-18) still works under Mountain Lion OS X 10.8.2 and is able to create or edit new agents and daemons.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
d
d
Reduce size of guest vmdk disks with VMware Fusion 4.1.3 on OS X 10.8
When running multiple VMs, and keeping backup copies of various configs, a considerable amount of disk space can be used quickly. The following steps have been confirmed to reduce disk usage for several virtual machine guest operating systems.
- Oracle Linux R6 U3 64-bit
- centOS 6.3 64-bit
- Ubuntu 12.04 LPS 64-bit
- openSUSE 12.1 64-bit
- Mac OS X (multiple versions)
Oracle Linux R6 U3 and CentOS 6.3: *these steps utilize a desktop environment and VMtools.
- remove any unneeded apps/packages, files, etc and empty the trash.
- clean up the YUM package files with (terminal commands as root):
- yum clean packages
- yum clean metadata
- yum clean dbcache
- (or) yum clean all
- at the command line, type “vmware-toolbox” to launch the VMware Tools GUI within the guest VM. This is equivalent to the GUI available within Windows guests.
- Select the drive (partition) to Shrink. 1st the utility will prepare the drive for the shrink process and then a final dialog box will be presented to begin the shrink drive operation.
Ubuntu 12.04 LPS: same as described for centOS and Oracle Linux, except the YUM commands are replaced with:
- sudo apt-get autoclean
- (or) sudo apt-get clean
- (0r) sudo apt-get autoremove
*note: Ubuntu 12.04 utilizes the Ubuntu Software Center for GUI application management (and has the annoying characteristic of only working with one selection at a time); installing the “Synaptic” package manager provides a more traditional Linux package manager.
openSUSE 12.1: same as described for centOS and Oracle Linux, except YAST handles the package and cache cleanups (instead of yum or apt-get). Options are available within the YAST GUI.
OS X: 10.6 Snow Leopard, 10.7 Lion, and 10.8 Mountain Lion (including servers).
- remove any unneeded apps, files, etc and empty the trash.
- using Finder, navigate to the following folders and remove unneeded fonts and dictionary files for languages you’re certain you won’t need for this VM. Sort the folder contents by size and select the largest. You can verify font files by opening them in the “font book” app to preview.
- /System/Library/Fonts/
- /Library/Dictionaries/
- /Library/Fonts/
- note: sometimes the system will state a font is in use and need a restart before allowing all of the deleted fonts to be emptied from the trash.
- use the utility Monolingualto remove unneeded Architectures, Input Types, and Languages from OS X and installed application packages.
- If you know you have an app which needs to be excluded, use the Monolingual “Preference” to add the app’s location to a list of excluded directories.
- in the main app, use the “Languages” tab to select which languages to remove (be sure to scroll the entire list and de-select any you wish to keep). On a fresh install of OS X 10.8 Mountain Lion, selecting all but English, French, and Spanish removed about 1.6GB
- use the “Input Menu” tab to select what to remove.
- use the “Architectures” tab to select what to remove.
- note: Monolingual only removes the items in the visible tab; if you desire to remove items from all three tabs, you’ll need to run it three times.
- use the disk utility app (within the VM) to erase free space on the disk.
- close the VM and exit VMware Fusion
- use the vmware-vdiskmanager utility to shrink the VMDK.
- open Finder, browse to the stored VM, right click and show package contents, locate the file “your-vm-name-here.vmdk”.
- open Terminal and CD to “/Applications/VMware\ Fusion/Contents/Library/”
- type “./vmware-vdiskmanager -k “
- drag the VMDK file from Finder to Terminal (this will append the file path and name to the command.
- In terminal, enter the command to shrink the vmdk.
VPN on a stick: DoD Lightweight Portable Security
In a previous post, I mentioned the DoD’s Lightweight Portable Security bootable Linux as applicable for some situations. The current LPS Public 1.3.5 ISOs come in two configurations, the basic and deluxe.
The deluxe version is a 401MB bootable ISO. It includes clients for Citrix, VMware View, and MS Remote Desktop. Also includes OpenOffice and Firefox.
As a bootable ISO, it also works within a virtual machine. This makes for a handy way to use the bootable ISO’s included clients for Telework without giving up full use of your physical computer during the remote session.
For government organizations which need additional customizations (pre-loading target URLs, additional client apps/versions, etc), customization is available at no cost to DoD organizations. Other non-DoD Federal organizations, the customization charge is $10K with an annual $2K maintenance fee. The Air Force organization providing this is looking into means to offer customized versions for State and Local govt organizations as well. The public versions are free to everyone.
Additional documentation is available on their website.
For someone just beginning the process of creating a bootable LiveCD for their own organizational needs, this provides a nice clean example to start from.