https://www.asuswrt-merlin.net/ https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC56U/Release/RT-AC56U_384.6_0.zip/download

Prepare USB Drive

1. Login to router via SSH (ssh admin@router_ip)
2. fdisk /dev/sda
3. mkfs.ext3 /dev/sda[1,2]

Enable JFFS Custom Scripts and Configs

Administration -> System -> Persistent JFFS2 partition -> Enable JFFS custom scripts and configs (‘yes’)

Execute Entware-Setup to Enable /opt Mount on USB Drive

The newly flashed firmware (v384.6) has entware-setup.sh included already. FYI: https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/others/entware-setup.sh

Update Post-Mount Script

/opt/etc/init.d/rc.unslung start is the line added; not sure if it’s necessary. :)

When putting files into an NFS shared directory, I get an “Access failed: 553 Could not create file.” error.

Solution

1. setsebool -P ftpd_full_access 1
2. Make sure the mounted directory has the correct ownership.

1. Docker proxy settings:

   cat /etc/systemd/system/docker.service.d/http-proxy.conf 
   [Service]
   Environment="HTTP_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "HTTPS_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "NO_PROXY=orbw-artifactory.ca.alcatel-lucent.com"

2. Insecure (private) registry:

   cat /etc/docker/daemon.json 
   {
       "insecure-registries" : [ "orbw-artifactory.ca.alcatel-lucent.com:8081" ]
   }

Install GitLab Runner

docker run -d --name gitlab-runner --restart always -v /home/cloud-user/config:/etc/gitlab-runner -v /var/run/docker.sock:/var/run/docker.sock orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest

GitLab Runner Register

docker run --rm -it -v /home/cloud-user/config:/etc/gitlab-runner orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest register

Example config:

Docker Default Security Option

https://docs.docker.com/engine/security/seccomp/

# docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.6.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)

Server:
 Containers: 17
  Running: 15
  Paused: 0
  Stopped: 2
 Images: 16
 Server Version: 20.10.8
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: e25210fe30a0a703442421b0f60afac609f950a3
 runc version: v1.0.1-0-g4144b63
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.42.2.el7.x86_64
 Operating System: Red Hat Enterprise Linux Server 7.9 (Maipo)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 23.39GiB
 Name: gene-k8s-k8sc-node1
 ID: VGBN:P5LX:RTQG:OX67:INYM:ZUHD:W6NQ:FWWL:KUV5:NZ6N:2DKH:ZIYL
 Docker Root Dir: /opt/nsp/docker
 Debug Mode: false
  Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
   127.0.0.0/8
 Live Restore Enabled: false

WARNING: API is accessible on http://0.0.0.0:2375 without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: https://docs.docker.com/go/attack-surface/
[root@gene-k8s-k8sc-node1 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
[root@gene-k8s-k8sc-node1 ~]# ps -eZ | grep docker
system_u:system_r:unconfined_service_t:s0 1254 ? 00:00:00 docker
system_u:system_r:container_runtime_t:s0 30862 ? 00:02:10 dockerd
system_u:system_r:container_runtime_t:s0 30976 ? 00:00:00 docker
[root@gene-k8s-k8sc-node1 ~]# docker context ls
NAME        DESCRIPTION                               DOCKER ENDPOINT               KUBERNETES ENDPOINT                ORCHESTRATOR
default *   Current DOCKER_HOST based configuration   unix:///var/run/docker.sock   https://127.0.0.1:6443 (default)   swarm

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

An example of the list data type:

Without a filter

I have to use both strip and split functions, which is error-prone.

glusterfs_node_hostname_base: |
  {% for item in glusterfs_node|unique %}
  {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster requires unique hostname or nodename while probing peers, here glusterfs_node_hostname 
## stores all glusterfs node's hostname for a validation purpose
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base.strip().split('\n') | default([]) }}"

With from_yaml filter

glusterfs_node_hostname_base: |
  ---
  {% for item in glusterfs_node|unique %}
  - {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster requires unique hostname or nodename while probing peers, here glusterfs_node_hostname 
## stores all glusterfs node's hostname for a validation purpose
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base | from_yaml }}"

Add the Rancher Desktop repository and install Rancher Desktop with:

curl https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/Release.key | sudo apt-key add -
sudo add-apt-repository 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt update
sudo apt install rancher-desktop

Uninstalling .deb Package

You can remove the package, repository, and key with:

sudo apt remove --autoremove rancher-desktop
sudo add-apt-repository -r 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt-key del <keyid>

Where keyid is the line above the one containing isv:Rancher:stable when you run apt-key list. So if I have the following block for the Rancher Desktop Key:

1. Ceph implements strong consistency between OSDs according to the replication factor, and reliability/availability according to the placement group (CRUSH MAP).

2. Clusters utilizing cross-site (a)sync will be performance-compromised and require fat, low-latency pipes, which strongly affects the Ceph RADOS protocol (both on RBD and object storage).

3. There is no recommendation/solution statement from Ceph upstream (or Red Hat) yet - https://tracker.ceph.com/projects/ceph/wiki/Can_Ceph_Support_Multiple_Data_Centers

4. It sounds like the team is developing/enhancing a ‘real’ stretch Ceph cluster. (Attachment 2)

   ]]> https://geneliu.itaghome.win/2020-02-13-reset-root-pwd/ Thu, 13 Feb 2020 06:02:00 +0000 gene.liu@live.com (Gene Liu) https://geneliu.itaghome.win/2020-02-13-reset-root-pwd/

   A system administrator can easily reset passwords for users who have forgotten theirs. But what happens if the system administrator forgets the root password? This guide will show you how to reset a lost or forgotten root password on a Red Hat-compatible system.

   
   

   Overview

   Please note, if the entire system hard disk has been encrypted with LUKS, you will need to provide the LUKS password when prompted. Also, this procedure is applicable to systems running systemd, which has been the default init system since Fedora 15, CentOS 7, and RHEL 7.

   ]]>