Showing posts with label rhel. Show all posts
Showing posts with label rhel. Show all posts

Wednesday, April 18, 2018

RHEL SELinux and docker search behind a company firewall

It seems you should add registry.access.redhat.com to the company open firewall rules / iptables...

docker search hello-world

Error response from daemon: invalid registry endpoint https://registry.access.redhat.com/v1/: Get https://registry.access.redhat.com/v1/_ping: dial tcp: lookup registry.access.redhat.com on 127.0.0.1:53: no such host. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry registry.access.redhat.com` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/registry.access.redhat.com/ca.crt

https://rhelblog.redhat.com/2015/04/15/understanding-the-changes-to-docker-search-and-docker-pull-in-red-hat-enterprise-linux-7-1/


"The Red Hat default config in ‘/etc/sysconfig/docker’ adds ‘registry.access.redhat.com’, which is the authoritative source for official Red Hat content. The default docker.io search path is hardcoded and remains enabled."


eg:

cat /etc/sysconfig/docker
# /etc/sysconfig/docker

# Modify these options if you want to change the way the docker daemon runs
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'
if [ -z "${DOCKER_CERT_PATH}" ]; then
    DOCKER_CERT_PATH=/etc/docker
fi

# Do not add registries in this file anymore. Use /etc/containers/registries.conf
# from the atomic-registries package.
#

# On an SELinux system, if you remove the --selinux-enabled option, you
# also need to turn on the docker_transition_unconfined boolean.
# setsebool -P docker_transition_unconfined 1

# Location used for temporary files, such as those created by
# docker load and build operations. Default is /var/lib/docker/tmp
# Can be overriden by setting the following environment variable.
# DOCKER_TMPDIR=/var/tmp

# Controls the /etc/cron.daily/docker-logrotate cron job status.
# To disable, uncomment the line below.
# LOGROTATE=false

# docker-latest daemon can be used by starting the docker-latest unitfile.
# To use docker-latest client, uncomment below lines
#DOCKERBINARY=/usr/bin/docker-latest
#DOCKERDBINARY=/usr/bin/dockerd-latest
#DOCKER_CONTAINERD_BINARY=/usr/bin/docker-containerd-latest
#DOCKER_CONTAINERD_SHIM_BINARY=/usr/bin/docker-containerd-shim-latest


and

cat /etc/containers/registries.conf
# This is a system-wide configuration file used to
# keep track of registries for various container backends.
# It adheres to TOML format and does not support recursive
# lists of registries.

# The default location for this configuration file is /etc/containers/registries.conf.

# The only valid categories are: 'registries.search', 'registries.insecure', 
# and 'registries.block'.

[registries.search]
registries = ['registry.access.redhat.com']

# If you need to access insecure registries, add the registry's fully-qualified name.
# An insecure registry is one that does not have a valid SSL certificate or only does HTTP.
[registries.insecure]
registries = []


# If you need to block pull access from a registry, uncomment the section below
# and add the registries fully-qualified name.
#
# Docker only
[registries.block]
registries = []




Thursday, March 19, 2015

Red Hat: cannot register with any organizations

on RHEL 7.0 I keep getting the same error when I try to update a little my packages:

[root@wltemplate ~]# yum install telnet
Failed to set locale, defaulting to C
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. 
You can use subscription-manager to register.
   
No package telnet available.
Error: Nothing to do


[root@wltemplate ~]# subscription-manager register --username pirla.vernetto 
--password blablabla --auto-attach

pirla.vernetto cannot register with any organizations.



I have desperately tried to add some Organization (like "the Sons of the Desert") in the RHEL portal profile page, but I could not find any ...



I keep fighting on it....

Ok it turned out (thanks to the timely response from RHAT Support) that the username (pirla.vernetto) I was using was INCORRECT (how about a "unkown username" error message??? ).

So this time around it DOES work:

The system has been registered with ID: blablabla123456 
Installed Product Current Status:
Product Name: Red Hat Enterprise Linux Server
Status:       Subscribed





PPS it seems I (idiot me) had 2 accounts, with different username but the same email (!!!).... and only one of the 2 was enabled to register the RHEL 7.0 product!!! I have to admit that RHEL support was BRILLIANT and they replied immediately to my questions...



Saturday, November 2, 2013

yum fails installing git on RHEL: There was an error communicating with RHN

yum install git-core
Loaded plugins: product-id, rhnplugin, security
There was an error communicating with RHN.
RHN Satellite or RHN Classic support will be disabled.
Error communicating with server. The message was:
Name or service not known
Setting up Install Process
No package git-core available.
Error: Nothing to do
First I check in cat /etc/yum.conf
[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=0
debuglevel=2
logfile=/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=3

#  This is the default, if you make this bigger yum won't see if the metadata
# is newer on the remote and so you'll "gain" the bandwidth of not having to
# download the new metadata and "pay" for it by yum not having correct
# information.
#  It is esp. important, to have correct metadata, for distributions like
# Fedora which don't keep old packages around. If you don't like this checking
# interupting your command line usage, it's much better to have something
# manually check the metadata once an hour (yum-updatesd will do this).
# metadata_expire=90m

# PUT YOUR REPOS HERE OR IN separate files named file.repo
# in /etc/yum.repos.d


and nothing seems wrong.
Then I check in
cat /etc/sysconfig/rhn/up2date

# Automatically generated Red Hat Update Agent config file, do not edit.
# Format: 1.0
tmpDir[comment]=Use this Directory to place the temporary transport files
tmpDir=/tmp

disallowConfChanges[comment]=Config options that can not be overwritten by a config update action
disallowConfChanges=noReboot;sslCACert;useNoSSLForPackages;noSSLServerURL;serverURL;disallowConfChanges

skipNetwork[comment]=Skips network information in hardware profile sync during registration.
skipNetwork=0

stagingContent[comment]=Retrieve content of future actions in advance
stagingContent=1

networkRetries[comment]=Number of attempts to make at network connections before giving up
networkRetries=1

hostedWhitelist[comment]=RHN Hosted URL's
hostedWhitelist=

enableProxy[comment]=Use a HTTP Proxy
enableProxy=0

writeChangesToLog[comment]=Log to /var/log/up2date which packages has been added and removed
writeChangesToLog=0

serverURL[comment]=Remote server URL (use FQDN)
serverURL=http://pluto.pippo.com/XMLRPC

proxyPassword[comment]=The password to use for an authenticated proxy
proxyPassword=

stagingContentWindow[comment]=How much forward we should look for future actions. In hours.
stagingContentWindow=24

proxyUser[comment]=The username for an authenticated proxy
proxyUser=

versionOverride[comment]=Override the automatically determined system version
versionOverride=

sslCACert[comment]=The CA cert used to verify the ssl server
sslCACert=/usr/share/rhn/RHNS-CA-CERT

retrieveOnly[comment]=Retrieve packages only
retrieveOnly=0

debug[comment]=Whether or not debugging is enabled
debug=0

httpProxy[comment]=HTTP proxy in host:port format, e.g. squid.redhat.com:3128
httpProxy=

useNoSSLForPackages[comment]=Use the noSSLServerURL for package, package list, and header fetching (disable Akamai)
useNoSSLForPackages=0

systemIdPath[comment]=Location of system id
systemIdPath=/etc/sysconfig/rhn/systemid

enableProxyAuth[comment]=To use an authenticated proxy or not
enableProxyAuth=0

noReboot[comment]=Disable the reboot actions
noReboot=0

The "serverURL=http://pluto.pippo.com/XMLRPC" looks suspicious, since I am not in the pippo.com network...there must be some proxy issue here... but enableProxy is 0!!!

I find some light here. But they don't say what the "default Red Hat Network URL" is... bloody hell...

If I comment out the serverURL I get:

yum install git-core
Loaded plugins: product-id, rhnplugin, security
There was an error communicating with RHN.
RHN Satellite or RHN Classic support will be disabled.

Error Message:
        Please run rhn_register as root on this client
Error Class Code: 9
Error Class Info: Invalid System Credentials.
Explanation:
     An error has occurred while processing your request. If this problem
     persists please enter a bug report at bugzilla.redhat.com.
     If you choose to submit the bug report, please be sure to include
     details of what you were trying to do when this error occurred and
     details on how to reproduce this problem.



Ok it looks like I need some good RH training...



Thursday, October 3, 2013

Configuring NIC network interface on RHEL

Note: ipconfig is deprecated in favour of ip, however a lot of legacy code still uses it.
Very interesting tutorial here and here
This is a UI to edit all configuration without requiring root privileges, bur probably if you are not root you won'et even be able to see any configuration values - forget about changing them:

/usr/sbin/system-config-network-tui

This is what you get:



ââââââââââ⤠Network Configuration âââââââââââ
â                                           â
â                                           â
â Name                 eth0________________ â
â Device               eth0________________ â
â Use DHCP             [*]                  â
â Static IP            ____________________ â
â Netmask              ____________________ â
â Default gateway IP   ____________________ â
â Primary DNS Server   ____________________ â
â Secondary DNS Server ____________________ â
â                                           â
â       ââââââ            ââââââââââ        â
â       â Ok â            â Cancel â        â
â       ââââââ            ââââââââââ        â
â                                           â
â                                           â
âââââââââââââââââââââââââââââââââââââââââââââ



this is equivalent, but requires root privileges:

/usr/bin/system-config-network

They don't require a X-terminal session, they support a text-ui mode.

To manually hack the configuration:
cd /etc/sysconfig/network-scripts/
less ifcfg-eth0
DEVICE="eth0"
BOOTPROTO="dhcp"
HWADDR="08:00:27:29:06:6F"
IPV6INIT="yes"
NM_CONTROLLED="yes"
ONBOOT="yes"
TYPE="Ethernet"
UUID="ca6ef823-ed13-46ad-8a83-9d688f6cf239"


Some other "global" info is here:
vi /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=osb-vagrant.acme.com

"/sbin/ip -o addr" displays all IPs
to add an extra IP, you must specify an interface eth0:N where N > 0:
/sbin/ifconfig eth0:1 10.0.2.16 netmask 255.255.255.0

(there is an implicit "up" at the end)
Entering "/sbin/ifconfig eth0 10.0.2.16 netmask 255.255.255.0" will crash the NIC, removing the current primary address to replace with the new one.