OpenNebula: Allowing Private Network accessing outside via host

This one is really a pickle. Spend hours of my time to figuring out what went wrong. My private network (interface virbr0 from libvirt daemon, 192.168.122.0/24) can't connect to outside world.

Actually it was a simple solution (have the same problem years ago, but i don't document it well - so i forget to remember).


Solution:
Use firewall or iptables to do NATting between virbr0 with current DMZ/host bridge at HOST. I hate iptables, hence:


firewall-cmd --zone=external --add-interface=virbr0
firewall-cmd --zone=external --add-interface=virbr0 --permanent


And yes. You didn't have to explicitly specify masquerade because external IS the forwarding zone duh! (ref manual: https://fedoraproject.org/wiki/Firewalld?rd=FirewallD#external)


And walla, you got yourself a deal - and a external connection.

PS: Just don't forgot to add DNS to your virbr0 settings (using nmtui should done it, UI-ly).


Why:
Since libvirt by default is configured as Host-Only, all connection via virbr0 can only see their peer, and not outside host. (Here i thought it might have something to do with my network config, libvirt.conf hance DNS not forwarded and not visible! dammit). And by attaching virbr0 to external zone, it will automatically enable NATting and forwarding + post/pre routing.

Guys, if you don't have any complex rule, just use firewall-cmd. Just forget about iptables. It's already 2017 dammit, not the 1997.

Working CentOS with SeLinux and hugetlbfs

Recently i got this:

type=AVC msg=audit(1490657751.072:24243): avc:  denied  { write } for  pid=26274 comm="httpd" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=8360015 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file

One way to correct it, is like this:

setsebool -P httpd_execmem 1

grep hugetlbfs /var/log/audit/audit.log | audit2allow -M hugetlbfs
semodule -i hugetlbfs.pp

Postgresql generate series

SELECT to_char(d.serie, 'Mon-YYYY'), count(r.report_kes_id) FROM 
(SELECT serie, extract(year FROM serie) as tahun , extract(Month FROM serie) as bulan FROM generate_series(date '2013-01-01', date '2015-12-31' , interval '1 month') serie) d
LEFT JOIN  rekod.dadah_klien r ON r.tarikhperintah = d.tahun AND r.bulan_ks = d.bulan 
   GROUP BY d.serie ORDER BY d.serie

SELinux for HTTPD outside /var/www/,..

Check with:

sudo ls -Z /opt/lampp/

Install semanage

sudo yum install policycoreutils-python

Set label and reset directories/files label

sudo semanage fcontext -a -t httpd_sys_script_exec_t "/opt/lampp/htdocs(/.*)?"
sudo restorecon -rv "/opt/lampp/htdocs"

How to set SSH private key location

Create .ssh folder in your user profile and then, don't forget to set environment HOME to %USERPROFILE%

Elasticsearch 5.2 on CentOS 7: ERROR: bootstrap checks failed

Previously, got this error:

ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
max number of threads [1024] for user [username] is too low, increase to at least [2048]
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

So what I do is:

vi /etc/security/limits.conf

# Add or edit
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
#EOF /etc/security/limits.conf
 
vi /etc/security/limits.d/90-nproc.conf

# changed original soft nproc 1024 to 2048
#*          soft    nproc     1024
*          soft    nproc     2048
#EOF /etc/security/limits.d/90-nproc.conf

 
vim /etc/sysctl.conf

# Added here
vm.max_map_count = 262144
#EOF /etc/sysctl.conf
 
sysctl -p

Install GCC 5.3 on CentOS 7.3 with SCL

Another way to enable GCC 5 just for current bash environment,

sudo yum install centos-release-scl
sudo yum install devtoolset-4-gcc*
scl enable devtoolset-4 bash
which gcc
gcc --version

and then, add this to enablegcc5.sh at /etc/profile.d

#!/bin/bash
source scl_source enable devtoolset-4

There you go

sudo cat > /etc/profile.d/gcc5-scl.sh << EOF
#!/bin/bash 
source scl_source enable devtoolset-4
EOF