chapter.install.xml

<section id="RockyLinux">
	<title>Rocky Linux</title>
	<para>CentOS 8 的后续版本，CentOS 替代方案</para>
	<section>
		<title>制作 U 盘</title>
		<para>查看 U 盘设备</para>
		<screen>
	<![CDATA[
Neo-iMac:~ neo$ diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *28.0 GB    disk0
   1:                        EFI ⁨EFI⁩                     314.6 MB   disk0s1
   2:                 Apple_APFS ⁨Container disk2⁩         27.7 GB    disk0s2

/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk1
   1:                        EFI ⁨EFI⁩                     209.7 MB   disk1s1
   2:                 Apple_APFS ⁨Container disk2⁩         1000.0 GB  disk1s2

/dev/disk2 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1.0 TB     disk2
                                 Physical Stores disk0s2, disk1s2
   1:                APFS Volume ⁨Macintosh HD - 数据⁩     148.6 GB   disk2s1
   2:                APFS Volume ⁨Preboot⁩                 269.0 MB   disk2s2
   3:                APFS Volume ⁨Recovery⁩                1.1 GB     disk2s3
   4:                APFS Volume ⁨VM⁩                      2.2 GB     disk2s4
   5:                APFS Volume ⁨Macintosh HD⁩            15.7 GB    disk2s5
   6:              APFS Snapshot ⁨com.apple.os.update-...⁩ 15.7 GB    disk2s5s1
   7:                APFS Volume ⁨Data⁩                    2.1 GB     disk2s7

/dev/disk3 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *30.8 GB    disk3	
	]]>
		</screen>
		<para>/dev/disk3 是 U 盘，使用下面命令将ISO镜像制作成启动盘</para>
		<screen>
		<![CDATA[
Neo-iMac:Data neo$ ls
Rocky-8.5-x86_64-minimal.iso
 
Neo-iMac:Data neo$ sudo dd if=Rocky-8.5-x86_64-minimal.iso of=/dev/rdisk3 bs=100m
Password:
		]]>
		</screen>
		<para>过程比较缓慢，请耐心等待</para>
		<screen>
		<![CDATA[
sudo dd if=Rocky-9.0-x86_64-minimal.iso of=/dev/rdisk4 bs=100m		
		]]>
		</screen>
		<para>Rocky Linux 安装过程与 CentOS 8 没有太大差异。</para>
	</section>
	<section id="Rocky.ISO">
		<title>Rocky-9.3-x86_64-minimal.iso 镜像初始化</title>
		<para></para>
		<para>首次安装后初始化系统</para>
		<screen>
		<![CDATA[ 
cp /etc/dnf/dnf.conf{,.original} 
echo "fastestmirror=true" >> /etc/dnf/dnf.conf
dnf makecache 
		]]>
		</screen>
		<para>Extra Packages for Enterprise Linux repository configuration
		</para>
		<screen>
			<![CDATA[
dnf -y upgrade
dnf -y install epel-release
			]]>
		</screen>
		<para>管理员常用工具</para>
		<screen>
			<![CDATA[
dnf install -y bzip2 tree psmisc \
telnet wget rsync vim-enhanced \
net-tools bind-utils			
			]]>
		</screen>
		<para>设置终端字符集（这样对 macOS 更友好），还可以解决 Failed to set locale, defaulting
			to
			C.UTF-8 问题
		</para>
		<screen>
			<![CDATA[
dnf install -y langpacks-en glibc-langpack-en
localectl set-locale LANG=en_US.UTF-8

cat >> /etc/environment <<EOF
LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8
LC_CTYPE=UTF-8
EOF
			]]>
		</screen>
		<!-- dnf install langpacks-en glibc-all-langpacks -y -->
		<para>设置历史记录格式，可以看到命令的执行时间</para>
		<screen>
			<![CDATA[			
cat >> /etc/profile.d/history.sh <<EOF
# Administrator specific aliases and functions for system security
export HISTSIZE=10000
export HISTFILESIZE=10000
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export TIME_STYLE=long-iso
EOF

source /etc/profile.d/history.sh
			]]>
		</screen>
		<para>sysctl 优化</para>
		<screen>
			<![CDATA[
cat >> /etc/sysctl.conf <<EOF

# add by netkiller
net.ipv4.ip_local_port_range = 10000 65500
net.core.somaxconn = 1024
vm.max_map_count = 262144

# TCP BBR
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF

sysctl -p			
			]]>
		</screen>
		<para>确认 ulimit 已经优化</para>
		<screen>
			<![CDATA[
cat > /etc/security/limits.d/20-nofile.conf <<EOF

root soft nofile 65535
root hard nofile 65535

docker soft nofile 65535
docker hard nofile 65535

EOF
	
			]]>
		</screen>
		<para>设置时区</para>
		<screen>
			<![CDATA[
timedatectl set-timezone Asia/Shanghai			
			]]>
		</screen>
		<para>安装时间同步服务 chronyd 并确认工作正常</para>
		<screen>
			<![CDATA[
dnf install -y chrony
systemctl enable chronyd
systemctl start chronyd	
			]]>
		</screen>
		<para>zmodem 用来上传和下载文件（注意 macOS 的 Terminal.app 不支持）</para>
		<screen>
			<![CDATA[
dnf install -y lrzsz			
			]]>
		</screen>
		<para>优化 SSH</para>
		<screen>
			<![CDATA[
cp /etc/ssh/sshd_config{,.original}

vim /etc/ssh/sshd_config <<EOF > /dev/null 2>&1
:43,43s/PermitRootLogin yes/PermitRootLogin no/
:84,84s/GSSAPIAuthentication yes/GSSAPIAuthentication no/
:99,99s/#AllowTcpForwarding yes/AllowTcpForwarding no/
:106,106/X11Forwarding yes/X11Forwarding no/
:116,116s/#TCPKeepAlive yes/TCPKeepAlive yes/
:121,121s/#UseDNS no/UseDNS no/
:wq
EOF
			]]>
		</screen>
		<para>禁止 root 登陆，开启 sudo</para>
		<para>禁用普通用户，我们需要一个普通用户登陆，然后使用 sudo 暂时获得 root 权限，我不打算新建一个用户，发现系统里面内置了
			operator 这个操作员用户符合我的需求。
		</para>
		<screen>
			<![CDATA[
usermod -s /bin/bash -aG wheel operator

PASSWORD=$(cat /dev/urandom | tr -dc [:alnum:] | head -c 32)

echo operator:${PASSWORD} | chpasswd
echo "operator password: ${PASSWORD}"			
			]]>
		</screen>
		<para>将 /usr/local/sbin:/usr/local/bin 路径加入到 Defaults secure_path =
			/sbin:/bin:/usr/sbin:/usr/bin，否则sudo找不到
			/usr/local/sbin:/usr/local/bin 中的可执行文件。
		</para>
		<screen>
			<![CDATA[
sed -i "s/#PermitRootLogin yes/PermitRootLogin no/" /etc/ssh/sshd_config
systemctl restart sshd
			
cp /etc/sudoers{,.original}

sed -i '88s#$#:/usr/local/sbin:/usr/local/bin#' /etc/sudoers

visudo -c
			]]>
		</screen>
	</section>
	<section id="rockylinux.net">
		<title>.Net 环境</title>
		<screen>
		<![CDATA[
[root@netkiller ~]# dnf search dotnet
Last metadata expiration check: 0:30:16 ago on Mon 06 Jan 2025 11:11:05 AM CST.
=============================================================== Name Matched: dotnet ================================================================
dotnet-apphost-pack-6.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 6.0
dotnet-apphost-pack-7.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 7.0
dotnet-apphost-pack-8.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 8.0
dotnet-apphost-pack-9.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 9.0
dotnet-host.x86_64 : .NET command line launcher
dotnet-hostfxr-6.0.x86_64 : .NET command line host resolver
dotnet-hostfxr-7.0.x86_64 : .NET command line host resolver
dotnet-hostfxr-8.0.x86_64 : .NET command line host resolver
dotnet-hostfxr-9.0.x86_64 : .NET command line host resolver
dotnet-runtime-6.0.x86_64 : NET 6.0 runtime
dotnet-runtime-7.0.x86_64 : NET 7.0 runtime
dotnet-runtime-8.0.x86_64 : NET 8.0 runtime
dotnet-runtime-9.0.x86_64 : NET 9.0 runtime
dotnet-runtime-dbg-8.0.x86_64 : Managed debug symbols NET 8.0 runtime
dotnet-runtime-dbg-9.0.x86_64 : Managed debug symbols NET 9.0 runtime
dotnet-sdk-6.0.x86_64 : .NET 6.0 Software Development Kit
dotnet-sdk-7.0.x86_64 : .NET 7.0 Software Development Kit
dotnet-sdk-8.0.x86_64 : .NET 8.0 Software Development Kit
dotnet-sdk-9.0.x86_64 : .NET 9.0 Software Development Kit
dotnet-sdk-aot-9.0.x86_64 : Ahead-of-Time (AOT) support for the .NET 9.0 Software Development Kit
dotnet-sdk-dbg-8.0.x86_64 : Managed debug symbols for the .NET 8.0 Software Development Kit
dotnet-sdk-dbg-9.0.x86_64 : Managed debug symbols for the .NET 9.0 Software Development Kit
dotnet-targeting-pack-6.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 6.0
dotnet-targeting-pack-7.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 7.0
dotnet-targeting-pack-8.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 8.0
dotnet-targeting-pack-9.0.x86_64 : Targeting Pack for Microsoft.NETCore.App 9.0
dotnet-templates-6.0.x86_64 : .NET 6.0 templates
dotnet-templates-7.0.x86_64 : .NET 7.0 templates
dotnet-templates-8.0.x86_64 : .NET 8.0 templates
dotnet-templates-9.0.x86_64 : .NET 9.0 templates
		]]>
		</screen>
		<section>
			<title>运行环境</title>
			<para>只安装运行境</para>
			<screen>
			<![CDATA[
[root@netkiller ~]# dnf install dotnet-runtime-7.0
			]]>		
			</screen>
		</section>
		<section>
			<title>开发包</title>
			<screen>
			<![CDATA[
[root@netkiller ~]# dnf install dotnet-sdk-7.0
			]]>
			</screen>			
		</section>
		<section id="aspnetcore">
			<title>aspnetcore</title>
			<programlisting>
			<![CDATA[
[root@netkiller ~]# dnf search aspnetcore
Last metadata expiration check: 0:31:08 ago on Mon 06 Jan 2025 11:11:05 AM CST.
======================================================== Name & Summary Matched: aspnetcore =========================================================
aspnetcore-targeting-pack-6.0.x86_64 : Targeting Pack for Microsoft.AspNetCore.App 6.0
aspnetcore-targeting-pack-7.0.x86_64 : Targeting Pack for Microsoft.AspNetCore.App 7.0
aspnetcore-targeting-pack-8.0.x86_64 : Targeting Pack for Microsoft.AspNetCore.App 8.0
aspnetcore-targeting-pack-9.0.x86_64 : Targeting Pack for Microsoft.AspNetCore.App 9.0
============================================================= Name Matched: aspnetcore ==============================================================
aspnetcore-runtime-6.0.x86_64 : ASP.NET Core 6.0 runtime
aspnetcore-runtime-7.0.x86_64 : ASP.NET Core 7.0 runtime
aspnetcore-runtime-8.0.x86_64 : ASP.NET Core 8.0 runtime
aspnetcore-runtime-9.0.x86_64 : ASP.NET Core 9.0 runtime
aspnetcore-runtime-dbg-8.0.x86_64 : Managed debug symbols for the ASP.NET Core 8.0 runtime
aspnetcore-runtime-dbg-9.0.x86_64 : Managed debug symbols for the ASP.NET Core 9.0 runtime			
			]]>
			</programlisting>
		</section>
		<section>
			<title>后台运行</title>
			<para></para>
			<programlisting>
			<![CDATA[
[Unit]
Description="Netkiller Service"
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5
 
[Service]
WorkingDirectory=/srv/RCT/WD.Net.Web.Admin
ExecStart=dotnet /srv/RCT/WD.Net.Web.Admin/bin/Release/net7.0/WD.Net.Web.Admin.dll --urls "http://*:8086"
Restart=always
RestartSec=10s
StartLimitInterval=0 

[Install]
WantedBy=default.target
			]]>
			</programlisting>
			<screen>
			<![CDATA[
[root@netkiller ~]# systemctl start api.service
[root@netkiller ~]# systemctl status api.service			
			]]>
			</screen>
			<para>配置文件中设置端口</para>
			<programlisting>
			<![CDATA[
dotnet YourApp.dll --urls "http://*:5002"			
			]]>
			</programlisting>
			<para>在 appsettings.json 或 appsettings.Production.json 中直接配置端口号：</para>
			<programlisting>
			<![CDATA[
示例：

{
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "http://localhost:5003"
      }
    }
  }
}			
			]]>
			</programlisting>
			<para></para>
			<screen>
			<![CDATA[
[root@netkiller net7.0]# ss -lnt | egrep "8085|8086"
LISTEN 0      512                *:8086            *:*          
LISTEN 0      512                *:8085            *:* 			
			]]>
			</screen>
		</section>
	</section>
</section>
<section id="AlmaLinux">
	<title>AlmaLinux</title>
	<section>
		<title>制作 U 盘启动盘</title>
		<para>桌面版 AlmaLinux-9-latest-x86_64-dvd.iso</para>
		<screen>
		<![CDATA[
neo@MacBook-Pro-M2 ~/Downloads> sudo dd if=AlmaLinux-9.3-x86_64-minimal.iso of=/dev/rdisk4 bs=100m		
		]]>
		</screen>
		<screen>
		<![CDATA[
iMac:Downloads neo$ sudo dd if=AlmaLinux-9-latest-x86_64-dvd.iso of=/dev/rdisk2 bs=100m
		]]>
		</screen>
	</section>
	<section>
		<title>AlmaLinux 镜像安装初始化</title>
		<screen>
			<![CDATA[
dnf -y upgrade
dnf -y install epel-release

dnf install -y bzip2 tree psmisc \
telnet wget rsync vim-enhanced \
net-tools bind-utils
			]]>
		</screen>
		<para>将其改为英文</para>
		<screen>
		<![CDATA[
cat >> /etc/environment <<EOF
LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8
LC_CTYPE=UTF-8
EOF
		]]>
		</screen>
		<para>设置历史记录格式，可以看到命令的执行时间</para>
		<screen>
			<![CDATA[			
cat >> /etc/profile.d/history.sh <<EOF
# Administrator specific aliases and functions for system security
export HISTSIZE=10000
export HISTFILESIZE=10000
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export TIME_STYLE=long-iso
EOF

source /etc/profile.d/history.sh
			]]>
		</screen>
		<para>sysctl 优化</para>
		<screen>
			<![CDATA[
cat >> /etc/sysctl.conf <<EOF

# add by netkiller
net.ipv4.ip_local_port_range = 1025 65500
net.core.somaxconn = 1024

# TCP BBR
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

fs.inotify.max_user_instances=65535
fs.inotify.max_user_watches=5088930
EOF

sysctl -p			
			]]>
		</screen>
		<para>ulimit 优化</para>
		<screen>
			<![CDATA[
cat > /etc/security/limits.d/20-nofile.conf <<EOF

* soft nofile 655350
* hard nofile 655350

EOF
			]]>
		</screen>
		<screen>
			<![CDATA[
cp /etc/selinux/config{,.original}
sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config

setenforce Permissive
			]]>
		</screen>
		<para>关闭防火墙</para>
		<screen>
			<![CDATA[
systemctl disable firewalld
systemctl stop firewalld
			]]>
		</screen>
		<para>时间同步</para>
		<screen>
			<![CDATA[
dnf install -y chrony
systemctl start chronyd
			]]>
		</screen>
	</section>
	<section>
		<title>Minimal 版本安装 XWindows</title>
		<para>迷你版安装桌面</para>
		<screen>
		<![CDATA[
dnf update -y

dnf grouplist
dnf groupinstall -y "Server with GUI"
		]]>
		</screen>
		<section>
			<title>KVM 虚拟机</title>
			<para>安装虚拟机</para>
			<screen>
			<![CDATA[
dnf groupinstall -y "Virtualization Host"
dnf install -y virt-manager

[root@localhost ~]# systemctl enable libvirtd
[root@localhost ~]# systemctl start libvirtd

[root@localhost ~]# dnf install -y bridge-utils
[root@localhost ~]# brctl addbr br0
[root@localhost ~]# brctl addif br0 enp3s0
[root@localhost ~]# brctl stp br0 on
[root@localhost ~]# brctl show
			]]>
			</screen>
			<para>使用 nmtui 给 br0 设置 IP 地址、子网掩码和DNS</para>
			<screen>
			<![CDATA[
[root@localhost ~]# nmtui
			]]>
			</screen>
		</section>
	</section>
</section>


<section id="install.ubuntu">
	<title>Debian / Ubuntu</title>
	<para>
		Ubuntu Server Edition
		<ulink url="http://www.ubuntu.com/">http://www.ubuntu.com/</ulink>
	</para>
	<para>
		Debian
		<ulink url="https://www.debian.org/index.zh-cn.html">https://www.debian.org/index.zh-cn.html</ulink>
	</para>
	<section id="linux.debian">
		<title>Debian 12</title>
		<para>下载并制作启动盘，如果你的网络环境比较好，可以网络安装，下载 debian-12.0.0-amd64-netinst.iso
		</para>
		<screen>
	<![CDATA[
neo@MacBook-Pro-M2 ~/Downloads> ls debian-12.0.0-amd64-netinst.iso
debian-12.0.0-amd64-netinst.iso

neo@MacBook-Pro-M2 ~/Downloads> sudo dd if=debian-12.0.0-amd64-netinst.iso of=/dev/rdisk4 bs=16M status=progress oflag=sync
Password:
  771751936 bytes (772 MB, 736 MiB) transferred 93.628s, 8243 kB/s
46+1 records in
46+1 records out
773849088 bytes transferred in 93.869599 secs (8243873 bytes/sec)
	]]>
		</screen>
		<para>debian-12.0.0-amd64-DVD-1.iso 是离线安装 DVD 版本</para>
		<screen>
	<![CDATA[
neo@MacBook-Pro-M2 ~/Downloads> ls debian-12.0.0-amd64-DVD-1.iso
debian-12.0.0-amd64-DVD-1.iso
	
neo@MacBook-Pro-M2 ~/Downloads> sudo dd if=debian-12.0.0-amd64-DVD-1.iso of=/dev/rdisk4 bs=16M status=progress oflag=sync
Password:
  3925868544 bytes (3926 MB, 3744 MiB) transferred 353.296s, 11 MB/s
234+1 records in
234+1 records out
3931095040 bytes transferred in 353.732449 secs (11113188 bytes/sec)
	]]>
		</screen>
		<section id="debian.init">
			<title>通用初始化设置</title>
			<screen>
		<![CDATA[
apt install -y curl vim		
		]]>
			</screen>
		</section>
	</section>
	<section>
		<title>历史记录优化</title>
		<screen>
			<![CDATA[
cat >> /etc/profile.d/history.sh <<EOF
# Administrator specific aliases and functions for system security
# Add by netkiller
export HISTSIZE=10000
export HISTFILESIZE=10000
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export TIME_STYLE=long-iso
EOF

source /etc/profile.d/history.sh				
			]]>
		</screen>
	</section>
	<section>
		<title>关闭 SELinux</title>
		<screen>
			<![CDATA[
cat >> /etc/selinux/config <<EOF
# Add by netkiller
SELINUX=disabled
EOF

setenforce Permissive		
			]]>
		</screen>
		<tip>
			<para>很多云主机的linux系统selinux被裁剪掉了，所以不用关闭 selinux</para>
		</tip>
	</section>
	<section>
		<title>sysctl / ulimit</title>
		<para>sysctl 优化</para>
		<screen>
			<![CDATA[
cat >> /etc/sysctl.conf <<EOF

# Netkiller
net.ipv4.ip_local_port_range = 1025 65500
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_keepalive_time = 1800
net.core.netdev_max_backlog=3000
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_max_tw_buckets = 4096
net.core.somaxconn = 1024

# TCP BBR
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
#net.ipv4.tcp_syncookies = 1
#net.ipv4.tcp_fin_timeout = 60

sysctl -p			
			]]>
		</screen>
		<tip>
			<para>如果是阿里云会自动帮你配置</para>
			<programlisting>
				<![CDATA[
# see details in https://help.aliyun.com/knowledge_detail/39428.html
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_announce = 2

# see details in https://help.aliyun.com/knowledge_detail/41334.html
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_slow_start_after_idle = 0				
				]]>
			</programlisting>
		</tip>
		<para>ulimit 优化</para>
		<screen>
			<![CDATA[
cat > /etc/security/limits.d/20-nofile.conf <<EOF

www soft nofile 65535
www hard nofile 65535

nginx soft nofile 65535
nginx hard nofile 65535

mysql soft nofile 65535
mysql hard nofile 65535

redis soft nofile 65535
redis hard nofile 65535

rabbitmq soft nofile 40960
rabbitmq hard nofile 40960

hadoop soft nofile 65535
hadoop hard nofile 65535

EOF			
			]]>
		</screen>
		<tip>
			<para>如果是阿里云，不需要配置</para>
			<screen>
			<![CDATA[
root@netkiller:~# cat /etc/security/limits.conf | tail -n 6

# End of file
root soft nofile 65535
root hard nofile 65535
* soft nofile 65535
* hard nofile 65535			
			]]>
			</screen>
		</tip>
		<para>Redis 配置</para>
		<screen>
			<![CDATA[
cat >> /etc/sysctl.conf <<EOF

# Redis
net.core.somaxconn = 1024
vm.overcommit_memory=1
EOF				
			]]>
		</screen>
		<para>MongoDB 配置</para>
		<screen>
			<![CDATA[
cat <<'EOF'>> /etc/rc.local 
		
if test -f /sys/kernel/mm/transparent_hugepage/enabled; then
	echo never > /sys/kernel/mm/transparent_hugepage/enabled
fi

if test -f /sys/kernel/mm/transparent_hugepage/defrag; then
	echo never > /sys/kernel/mm/transparent_hugepage/defrag
fi
EOF
			]]>
		</screen>
	</section>
	<section>
		<title>时间同步</title>
		<para>查看时区</para>
		<screen>
			<![CDATA[
cat /etc/timezone			
			]]>
		</screen>
		<para></para>
		<screen>
			<![CDATA[
root@netkiller:~# timedatectl set-local-rtc 0
root@netkiller:~# timedatectl
      Local time: Tue 2021-08-17 10:32:27 CST
  Universal time: Tue 2021-08-17 02:32:27 UTC
        RTC time: Tue 2021-08-17 02:32:27
       Time zone: Asia/Shanghai (CST, +0800)
 Network time on: yes
NTP synchronized: yes
 RTC in local TZ: no			
			]]>
		</screen>
		<para>确认 Network time on: yes 和 NTP synchronized: yes 开启，然后启动时间同步
			systemd-timesyncd.service。
		</para>
		<screen>
			<![CDATA[
root@netkiller:~# systemctl start systemd-timesyncd.service

root@netkiller:~# systemctl status systemd-timesyncd.service
● systemd-timesyncd.service - Network Time Synchronization
   Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/systemd-timesyncd.service.d
           └─disable-with-time-daemon.conf
   Active: inactive (dead)
Condition: start condition failed at Tue 2021-08-17 10:29:36 CST; 14min ago
     Docs: man:systemd-timesyncd.service(8)

Aug 17 10:29:36 netkiller systemd[1]: Stopped Network Time Synchronization.			
			]]>
		</screen>
		<para>如果 systemd-timesyncd.service 启动失败，可能是系统已经有其他时间同步服务在运行。查看方法
		</para>
		<screen>
			<![CDATA[
root@netkiller:~# cat /lib/systemd/system/systemd-timesyncd.service.d/disable-with-time-daemon.conf 
[Unit]
# don't run timesyncd if we have another NTP daemon installed
ConditionFileIsExecutable=!/usr/sbin/ntpd
ConditionFileIsExecutable=!/usr/sbin/openntpd
ConditionFileIsExecutable=!/usr/sbin/chronyd
ConditionFileIsExecutable=!/usr/sbin/VBoxService			
			]]>
		</screen>
		<para>然后逐一检查 ConditionFileIsExecutable 后面的程序，最终我们找到了 chronyd</para>
		<screen>
			<![CDATA[
root@netkiller:~# whereis chronyd
chronyd: /usr/sbin/chronyd /usr/share/man/man8/chronyd.8.gz

root@netkiller:~# systemctl status chrony
● chrony.service - LSB: Controls chronyd NTP time daemon
   Loaded: loaded (/etc/init.d/chrony; bad; vendor preset: enabled)
   Active: active (running) since Mon 2021-08-16 19:05:31 CST; 15h ago
     Docs: man:systemd-sysv-generator(8)
   CGroup: /system.slice/chrony.service
           └─1222 /usr/sbin/chronyd

Aug 16 19:05:29 netkiller systemd[1]: Starting LSB: Controls chronyd NTP time daemon...
Aug 16 19:05:29 netkiller chronyd[1222]: chronyd version 2.1.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -DEBUG +ASYNCDNS +IPV6 +SECHASH)
Aug 16 19:05:29 netkiller chronyd[1222]: Frequency -14.398 +/- 0.452 ppm read from /var/lib/chrony/drift
Aug 16 19:05:31 netkiller chrony[1201]: Password: chronyd is running and online.
Aug 16 19:05:31 netkiller systemd[1]: Started LSB: Controls chronyd NTP time daemon.
Aug 16 19:05:39 netkiller chronyd[1222]: Selected source 100.100.61.88			
			]]>
		</screen>
		<para>确保 chronyd 处于工作状态，systemd-timesyncd.service 与 chronyd
			选择其中一个即可。所以我们不用在关心 systemd-timesyncd.service
		</para>
	</section>
	<section>
		<title>启动 rc.local</title>
		<para>/etc/rc.local 是一个开机启动脚本</para>
		<tip>
			<para>很多系统已经弃用了该运行方案</para>
		</tip>
		<screen>
			<![CDATA[
root@netkiller:~# cat /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

exit 0	
			]]>
		</screen>
		<para>注意：一定要删除 exit 0，之所以加入这行就是linux系统不鼓励你使用 rc.local </para>
		<screen>
			<![CDATA[
root@netkiller:~# sed -i '$d' /etc/rc.local			
			]]>
		</screen>
		<para>删除后效果</para>
		<screen>
			<![CDATA[
root@netkiller:~# cat /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

			]]>
		</screen>
		<para>rc-local.service 需要做如下配置</para>
		<!-- /lib/systemd/system/rc-local.service.d/debian.conf -->
		<screen>
			<![CDATA[
cat >> /lib/systemd/system/rc-local.service <<EOF

[Install]
WantedBy=multi-user.target
EOF		
			]]>
		</screen>
		<para></para>
		<screen>
			<![CDATA[
[root@netkiller ~]# chmod +x /etc/rc.local

[root@netkiller ~]# systemctl enable rc-local
Created symlink /etc/systemd/system/multi-user.target.wants/rc-local.service → /usr/lib/systemd/system/rc-local.service.

[root@netkiller ~]# systemctl start rc-local	

[root@netkiller ~]# systemctl status rc-local
● rc-local.service - /etc/rc.d/rc.local Compatibility
   Loaded: loaded (/usr/lib/systemd/system/rc-local.service; enabled; vendor preset: disabled)
   Active: active (exited) since Mon 2021-08-16 12:57:16 CST; 2s ago
     Docs: man:systemd-rc-local-generator(8)
  Process: 532000 ExecStart=/etc/rc.d/rc.local start (code=exited, status=0/SUCCESS)

Aug 16 12:57:16 testing systemd[1]: Starting /etc/rc.d/rc.local Compatibility...
Aug 16 12:57:16 testing systemd[1]: Started /etc/rc.d/rc.local Compatibility.	
			]]>
		</screen>
	</section>
	<section>
		<title>禁用防火墙</title>
		<para>禁用防火墙</para>
		<screen>
			<![CDATA[
root@production:~# ufw disable
Firewall stopped and disabled on system startup			
			]]>
		</screen>
	</section>
	<section>
		<title>更换包镜像</title>
		<screen>
		<![CDATA[
sudo sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list		
		]]>
		</screen>
	</section>
	<section>
		<title>The following signatures couldn't be verified because the public key is not available: NO_PUBKEY</title>
		<screen>
		<![CDATA[
W: GPG error: https://mirrors.cloud.tencent.com/debian-security buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 112695A0E562B32A NO_PUBKEY 54404762BBB6E853
E: The repository 'https://mirrors.cloud.tencent.com/debian-security buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository 'https://mirrors.cloud.tencent.com/debian buster-backports Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository 'https://mirrors.aliyun.com/dotnet/apt stable Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository 'https://mirrors.cloud.tencent.com/dotnet/apt stable Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
		]]>
		</screen>
		<para>解决方案</para>
		<screen>
		<![CDATA[
ubuntu@VM-0-13-ubuntu:/etc/apt$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 54404762BBB6E853
Executing: /tmp/apt-key-gpghome.IEJiYBE5PB/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 54404762BBB6E853
gpg: key A48449044AAD5C5D: public key "Debian Security Archive Automatic Signing Key (11/bullseye) <ftpmaster@debian.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1		
		]]>
		</screen>
	</section>		

</section>
<section id="install.centos8">
	<title>CentOS 8 Stream</title>
	<para>Centos 8 较之前的版本改动比较大</para>
	<itemizedlist>
		<title>CentOS 有两个发行版</title>
		<listitem>CentOS stream：滚动发布的 Linux 发行版，适用于需要频繁更新的开发者</listitem>
		<listitem>CentOS：类似 RHEL 8 的稳定操作系统，系统管理员可以用其部署或配置服务和应用</listitem>
	</itemizedlist>
	<section>
		<title>U 盘安装 CentOS Stream</title>
		<para>下载 ISO 文件你会发现只有boot和dvd1，boot 是网络安装，而DVD1差不多8G，估计你的手上没有
			DVD9光盘，普通DVD光盘是D5只有4.7G，那么怎么安装呢，使用U盘。
		</para>
		<para>将ISO文件烧录到U盘中，方法如下。</para>
		<screen>
		<![CDATA[
neo@MacBook-Pro-Neo ~/Downloads % sudo dd if=CentOS-Stream-x86_64-dvd1.iso of=/dev/disk2 bs=1m
Password:
dd: /dev/disk2: end of device
7581+0 records in
7580+1 records out
7948210176 bytes transferred in 1500.898226 secs (5295636 bytes/sec)
		]]>
		</screen>
		<para>我手上并没有大容量U盘，我是用USB读卡器+8GB TF卡。</para>
		<para>使用 dd 命令将 ISO 写入U盘后，使用U盘启动电脑就可以安装了。</para>
		<para>如果下载速度慢，可以从国内镜像下载 ISO 文件</para>
		<screen>
		<![CDATA[
neo@MacBook-Pro-Neo ~ % wget -c http://mirrors.163.com/centos/8-stream/isos/x86_64/CentOS-Stream-8-x86_64-20210706-dvd1.iso	
		]]>
		</screen>
	</section>
	<section>
		<title>macOS 制作 U 盘启动盘速度慢</title>
		<para>制作启动盘慢怎么解决</para>
		<para>查看 U 盘设备文件，这里是 /dev/disk2</para>
		<screen>
		<![CDATA[
neo@MacBook-Pro-Neo ~ % diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *251.0 GB   disk0
   1:                        EFI ⁨EFI⁩                     209.7 MB   disk0s1
   2:                 Apple_APFS ⁨Container disk1⁩         250.8 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +250.8 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume ⁨Macintosh HD - Data⁩     209.8 GB   disk1s1
   2:                APFS Volume ⁨Preboot⁩                 685.0 MB   disk1s2
   3:                APFS Volume ⁨Recovery⁩                620.1 MB   disk1s3
   4:                APFS Volume ⁨VM⁩                      6.4 GB     disk1s4
   5:                APFS Volume ⁨Macintosh HD⁩            15.4 GB    disk1s5
   6:              APFS Snapshot ⁨com.apple.os.update-...⁩ 15.4 GB    disk1s5s1

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *30.8 GB    disk2		
		]]>
		</screen>
		<para>制作U盘启动盘，注意！将 /dev/disk2 改成 /dev/rdisk2 写入速度会提速，rdisk 是 rawdisk。
		</para>
		<screen>
		<![CDATA[
neo@MacBook-Pro-Neo ~ % sudo dd if=CentOS-Stream-8-x86_64-20210706-dvd1.iso of=/dev/rdisk2 bs=100m
Password:			
		]]>
		</screen>

		<table>
			<title>服务器怎样分区才合理</title>
			<tgroup cols="2">
				<thead>
					<row>
						<entry>卷（volume）</entry>
						<entry>尺寸（size）</entry>
					</row>
				</thead>
				<tbody>
					<row>
						<entry>/boot/efi</entry>
						<entry>500M</entry>
					</row>
					<row>
						<entry>/boot</entry>
						<entry>1G</entry>
					</row>
					<row>
						<entry>/</entry>
						<entry>50G</entry>
					</row>
					<row>
						<entry>/opt</entry>
						<entry>剩余所有</entry>
					</row>
					<row>
						<entry>交换分区（swap）</entry>
						<entry>如何开发测试环境不需要分，生产服务器是情况而定，因为现在的服务器内存越来越大，极少出现不够用的情况，16G
							内存交换分区可以给 memory * 2，32G 分 32G空间，超过32G 基本不需要分交换分区了。
						</entry>
					</row>
				</tbody>
			</tgroup>
		</table>

		<table>
			<title>Linux desktop partition</title>
			<tgroup cols="2">
				<thead>
					<row>
						<entry>volume</entry>
						<entry>size</entry>
					</row>
				</thead>
				<tbody>
					<row>
						<entry>/boot</entry>
						<entry>300M</entry>
					</row>
					<row>
						<entry>/</entry>
						<entry>30G</entry>
					</row>
					<row>
						<entry>/var</entry>
						<entry>50G</entry>
					</row>
					<row>
						<entry>/home</entry>
						<entry>remainder</entry>
					</row>
					<row>
						<entry>swap</entry>
						<entry>memory * 2</entry>
					</row>
				</tbody>
			</tgroup>
		</table>

	</section>
	<section>
		<title>首次安装后初始化系统</title>
		<para></para>
		<screen>
		<![CDATA[
cp /etc/dnf/dnf.conf{,.original}		
echo "fastestmirror=True" >> /etc/dnf/dnf.conf
dnf makecache
		]]>
		</screen>
		<para>Extra Packages for Enterprise Linux repository configuration
		</para>
		<screen>
			<![CDATA[
dnf -y upgrade
dnf -y install epel-release
			]]>
		</screen>
		<para>管理员常用工具</para>
		<screen>
			<![CDATA[
dnf install -y bzip2 tree psmisc \
telnet wget rsync vim-enhanced \
net-tools bind-utils			
			]]>
		</screen>
		<para>设置终端字符集（这样对 macOS 更友好），还可以解决 Failed to set locale, defaulting to
			C.UTF-8 问题
		</para>
		<screen>
			<![CDATA[
dnf install -y langpacks-en glibc-langpack-en
localectl set-locale LANG=en_US.UTF-8

cat >> /etc/environment <<EOF
LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8
LC_CTYPE=UTF-8
EOF
			]]>
		</screen>
		<!-- dnf install langpacks-en glibc-all-langpacks -y -->
		<para>设置历史记录格式，可以看到命令的执行时间</para>
		<screen>
			<![CDATA[			
cat >> /etc/profile.d/history.sh <<EOF
# Administrator specific aliases and functions for system security
export HISTSIZE=10000
export HISTFILESIZE=10000
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export TIME_STYLE=long-iso
EOF

source /etc/profile.d/history.sh
			]]>
		</screen>
		<para>关闭 SELINUX</para>
		<screen>
			<![CDATA[
cp /etc/selinux/config{,.original}
sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config

setenforce Permissive
			]]>
		</screen>
		<para>sysctl 优化</para>
		<screen>
			<![CDATA[
cat >> /etc/sysctl.conf <<EOF

# Netkiller
net.ipv4.ip_local_port_range = 1025 65500
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_keepalive_time = 1800
net.core.netdev_max_backlog=3000
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_max_tw_buckets = 4096
net.core.somaxconn = 1024

# TCP BBR
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
#net.ipv4.tcp_syncookies = 1
#net.ipv4.tcp_fin_timeout = 60

sysctl -p			
			]]>
		</screen>
		<para>ulimit 优化</para>
		<screen>
			<![CDATA[
cat > /etc/security/limits.d/20-nofile.conf <<EOF

root soft nofile 65535
root hard nofile 65535

www soft nofile 65535
www hard nofile 65535

nginx soft nofile 65535
nginx hard nofile 65535

mysql soft nofile 65535
mysql hard nofile 65535

redis soft nofile 65535
redis hard nofile 65535

rabbitmq soft nofile 40960
rabbitmq hard nofile 40960

hadoop soft nofile 65535
hadoop hard nofile 65535

EOF			
			]]>
		</screen>
		<para>设置时区</para>
		<screen>
			<![CDATA[
timedatectl set-timezone Asia/Shanghai			
			]]>
		</screen>
		<para>安装时间同步服务器，确保每台服务器的时间同步</para>
		<screen>
			<![CDATA[
dnf install -y chrony
systemctl enable chronyd
systemctl start chronyd			
			]]>
		</screen>
		<para>zmodem 用来上传和下载文件（注意 macOS 的 Terminal.app 不支持）</para>
		<screen>
			<![CDATA[
dnf install -y lrzsz			
			]]>
		</screen>
		<para>优化 SSH</para>
		<screen>
			<![CDATA[
cp /etc/ssh/sshd_config{,.original}

vim /etc/ssh/sshd_config <<EOF > /dev/null 2>&1
:43,43s/PermitRootLogin yes/PermitRootLogin no/
:84,84s/GSSAPIAuthentication yes/GSSAPIAuthentication no/
:99,99s/#AllowTcpForwarding yes/AllowTcpForwarding no/
:106,106/X11Forwarding yes/X11Forwarding no/
:116,116s/#TCPKeepAlive yes/TCPKeepAlive yes/
:121,121s/#UseDNS no/UseDNS no/
:wq
EOF
			]]>
		</screen>
		<para>禁止 root 登陆，开启 sudo</para>
		<para>禁用普通用户，我们需要一个普通用户登陆，然后使用 sudo 暂时获得 root 权限，我不打算新建一个用户，发现系统里面内置了
			operator 这个操作员用户符合我的需求。
		</para>
		<screen>
			<![CDATA[
usermod -s /bin/bash -aG wheel operator

PASSWORD=$(cat /dev/urandom | tr -dc [:alnum:] | head -c 32)

echo operator:${PASSWORD} | chpasswd
echo "operator password: ${PASSWORD}"			
			]]>
		</screen>
		<para>将 /usr/local/sbin:/usr/local/bin 路径加入到 Defaults secure_path =
			/sbin:/bin:/usr/sbin:/usr/bin，否则sudo找不到
			/usr/local/sbin:/usr/local/bin 中的可执行文件。
		</para>
		<screen>
			<![CDATA[
sed -i "s/#PermitRootLogin yes/PermitRootLogin no/" /etc/ssh/sshd_config
systemctl restart sshd
			
cp /etc/sudoers{,.original}

sed -i '88s#$#:/usr/local/sbin:/usr/local/bin#' /etc/sudoers

visudo -c
			]]>
		</screen>
	</section>
	<section>
		<title>启用 rc.local</title>
		<para>/etc/rc.local 是一个开机启动脚本</para>
		<screen>
		<![CDATA[
[root@netkiller ~]# cat /etc/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.

touch /var/lock/subsys/local		
		]]>
		</screen>
		<tip>
			<para>很多系统已经弃用了该运行方案，因为很多更好的替代方案，例如 node 实现的 pm2 和 Python 实现的
				supervisor，以及 Linux 系统自带的 Systemd。
			</para>
		</tip>
		<para>CentOS 8 Stream 如果你想使用 rc.local 需要做如下配置</para>
		<screen>
		<![CDATA[
cat >> /usr/lib/systemd/system/rc-local.service <<EOF

[Install]
WantedBy=multi-user.target
EOF		
		]]>
		</screen>
		<para></para>
		<screen>
			<![CDATA[
[root@netkiller ~]# chmod +x /etc/rc.d/rc.local		

[root@netkiller ~]# systemctl enable rc-local
Created symlink /etc/systemd/system/multi-user.target.wants/rc-local.service → /usr/lib/systemd/system/rc-local.service.

[root@netkiller ~]# systemctl start rc-local	

[root@netkiller ~]# systemctl status rc-local
● rc-local.service - /etc/rc.d/rc.local Compatibility
   Loaded: loaded (/usr/lib/systemd/system/rc-local.service; enabled; vendor preset: disabled)
   Active: active (exited) since Mon 2021-08-16 12:57:16 CST; 2s ago
     Docs: man:systemd-rc-local-generator(8)
  Process: 532000 ExecStart=/etc/rc.d/rc.local start (code=exited, status=0/SUCCESS)

Aug 16 12:57:16 testing systemd[1]: Starting /etc/rc.d/rc.local Compatibility...
Aug 16 12:57:16 testing systemd[1]: Started /etc/rc.d/rc.local Compatibility.	
			]]>
		</screen>
	</section>
	<section>
		<title>卸载防火墙</title>
		<para>firewalld 不是适合 IDC 使用，IDC 通常只需要 INPUT 规则，其次是 OUTPUT 规则，所以我们换回
			iptables 或者 nftable
		</para>
		<screen>
			<![CDATA[
systemctl stop firewalld

dnf remove -y firewalld
dnf install iptables-services -y

systemctl start iptables
systemctl enable iptables

systemctl stop ip6tables
systemctl disable ip6tables
			]]>
		</screen>
	</section>
</section>

<section id="linux.alpine">
	<title>Alpine Linux</title>
	<para>
		Small. Simple. Secure.
		<ulink url="https://www.alpinelinux.org">https://www.alpinelinux.org</ulink>
	</para>
	<para>Alpine Linux is a security-oriented, lightweight Linux
		distribution based on musl libc and busybox.
	</para>
	<!-- <section> <title>HDD Partition</title> <para>partition</para> <table> 
		<title>Linux partition</title> <tgroup cols="2"> <thead> <row> <entry>volume</entry> 
		<entry>size</entry> </row> </thead> <tbody> <row> <entry>/boot</entry> <entry>500M</entry> 
		</row> <row> <entry>/</entry> <entry>50G</entry> </row> <row> <entry>/opt</entry> 
		<entry>remainder</entry> </row> <row> <entry>swap</entry> <entry>memory * 
		2</entry> </row> </tbody> </tgroup> </table> </section> -->
</section>