We employ two CentOS-7 platforms: one for development and one for production (comment: two platforms may not be enough when using Linux; see the IBM-Managed warning after this section). The recommended approach is to first install (or update) software on the development box. If testing for the next few days (to weeks) proves that everything is working properly, then we would repeat the procedure on the production box. This also keeps both platforms more-or-less in sync.
I wanted to install the tree utility so I logged onto our DVLP platform where I entered this command:
sudo yum install tree
... which worked properly.
Then I repeated this command on our PROD platform which failed with numerous errors associated with file /usr/libexec/urlgrabber-ext-down which is a python script. What was worse was this: you could not execute firewall-cmd or most yum commands including yum check-update. Investigating further, I noticed that someone had installed python3 then updated the symbolic link so that typing a python command pulls up python3 rather than python2 (most Linux administrator utilities in 2018 require Python 2.7)
There are only two ways out of this problem (remember that this is an active business system).
Tip: if this is an emergency, just make minimal changes. For now, just modify the scripts for whatever is broken (eg. yum or firewall-cmd). But you will eventually need to put everything back to a pristine state. If your stuff needs python3 then you need to rely upon shebang. I have no idea why the Linux maintainers didn't do this for their scripts requiring Python2. They broke their own golden rule
# 1) partial example of a system with two versions of python # 2) notice that "python" is pointing to "python2" # 3) notice that "python2" is pointing to "python2.7" # 4) utilities requiring python2 (like yum and firewall-cmd) # should say so on the shebang line of those scripts # $ cd /usr/bin $ ls pytho* -la lrwxrwxrwx. 1 root root 7 Jan 12 15:25 python -> python2 lrwxrwxrwx. 1 root root 9 Dec 20 2016 python2 -> python2.7 -rwxr-xr-x. 1 root root 7136 Nov 5 2016 python2.7 lrwxrwxrwx. 1 root root 9 Apr 12 2017 python3 -> python3.4 -rwxr-xr-x. 2 root root 11312 Jan 17 2017 python3.4
...snip...
I have experienced several instances where updating software though the graphical interface fails for some reason, then breaks the graphical interface (or the whole system). It should not surprise anyone that updating the gnome-session, or any of its dependencies, might disturb the very session that is running yum or rpm
For this reason I recommend doing updates from the command line over the network
However, if you must work from the console device, and want to move to non-graphical session console before running yum or rpm, then try one of the following keystrokes:
key press | description | notes |
---|---|---|
CTRL ALT F1 | switch to terminal 1 (graphical interface) | only graphical when runlevel >= 5 |
CTRL ALT F2 | switch to terminal 2 (/dev/tty2) | text only |
CTRL ALT F3 | switch to terminal 3 (/dev/tty3) | text only |
CTRL ALT F4 | switch to terminal 4 (/dev/tty4) | text only |
CTRL ALT F5 | switch to terminal 5 (/dev/tty5) | text only |
CTRL ALT F6 | switch to terminal 6 (/dev/tty6) | text only |
The only other way to safely disable graphics is to lower the runlevel of your system to 3. (but only do this if you are certain that you won't kill some process currently needed by your customers).
update: Even though CentOS-7 does not use "/etc/inittab", and the text notes contained within say to do everything with systemctl, the following commands worked for me from the console as well as a network connection:
$ runlevel # display current run level runlevel N 5 $ init 3 # console #1 switches over to text mode $ runlevel runlevel 5 3 $ init 5 # console #1 switches back to graphics mode $ runlevel runlevel 3 5Caveat: never init to a number below 3 over the network because that will kill networking which means you WILL NOT be able to restore runlevel remotely
The self-help blogs really fall down on this one because the only secure way to do this is to tunnel x-sessions over SSH. But whenever anyone on a self-help blog asks how to do this only using SSH, some idiot will chime in with a procedure on how to do it using VNC, RealVNC, TigerVNC or Vino which are all insecure.
To make matters worse, setting up a remote graphical session is almost impossible (at least under certain circumstances like
Windows -> Red-Hat/CentOS) because GNOME3 contains 3-d extensions not found in Windows clients. The
best way out of this is to setup Red-Hat/CentOS on a machine at the client end then use it to connect to the desired Linux
platform.
comment: some conspiracy-minded people think this change was deliberately done to stop support
professionals from from using Windows as their default platform to support all others. The might be correct.
Xming
CygWin and CygWin/X
action: start your local x-server (on the start menu) : task will appear on your horizontal task bar action: start xterm : associated with the x-server icon on the task bar type : ssh -X name@fully-qualified-domain-name (replacing "-X" with "-Y" is even better) action: wait for the password prompt then enter it type : xterm & action: a new window should open type : /gnome-weather & action: a graphical weather app will pop up type : /gnome-session --disable-acceleration-check & action: a new window manager should open (but does not) : 1) green switch was added to gnome startin with version 3.16 : 2) without it you may see something like this: "Oh no! Something has gone wrong. A problem has occurred and the system can't recover. Please log out and try again." : 3) gnome3 requires advanced graphics so may never work this way; try a desktop other than gnome
# notes: # 1) well-known port 1433 is reserved for Microsoft SQL Server # 2) SQL Server 2005 appears to support ssl2 but nothing higher # 3) contrary to popular belief, as soon as you specify a
# username and password in your ODBC connect string (via
# sqlcmd) then the initial handshake will be encrypted # # this passes # openssl s_client -debug -state -connect ip-address:1433 -ssl2 # # this fails # openssl s_client -debug -state -connect ip-address:1433 -ssl3
Platform | CentOS Notes | OpenSSL version | OpenSSL Notes |
---|---|---|---|
Production | CentOS 7.3 (built 14-months ago) | OpenSSL-1.0.1e | ssl2 is supported |
Development | CentOS 7.4 (yum updated 2018-01-29) | OpenSSL-1.0.2k | ssl2 has been disabled prior to build |
wget https://openssl.org/source/openssl-1.0.2k.tar.gz tar -xvf openssl-1.0.2k.tar.gz cd openssl-1.0.2k/ # --prefix will make sure that make install copies the files locally instead of system-wide # --openssldir will make sure that the binary will look in the regular system location for openssl.cnf # no-shared builds a mostly static binary ./config --prefix=`pwd`/local --openssldir=/usr/lib/ssl enable-ssl2 enable-ssl3 no-shared make depend make # # these next two steps are not required if openssl-1.0.2k already exists on your system. # make -i install sudo cp local/bin/openssl /usr/local/bin/ # # test the newly created binary like so: ./apps/openssl s_client -debug -state -connect ip-address:1433 -ssl2 # ...remembering that many other destinations will no longer accept ssl2 # then rename the old binary (paranoid): mv /usr/bin/openssl /usr/bin/openssl-old # then copy the new binary: cp ./apps/openssl /usr/bin/openssl #
One of our developers was experiencing problems developing a new LDAP-based application. So he invoked YUM to update LDAP on our production box. The big problem here is that the update was done in a careless way (without reading all the release notes). So the LDAP update also updated OpenSSL for the whole system so now we can no longer connect to that older Microsoft platform in Montreal. (see: this previous note)
It now appears that we will need to install a third (older) CentOS platform whose only purpose would be to reach through to the older Microsoft platform. This platform would need to be modified so that it could never been updated.
This problem is so weird that I'll stick to bullet points
# NOT Generated by NetworkManager # /etc/resolv.conf options timeout:1 options attempts:1 options rotate options no-check-names search on.bell.ca nameserver 142.182.48.71 nameserver 142.182.48.105 #nameserver 142.113.87.152
cd /etc cp resolv.conf resolv.conf-copy
We are running CentOS-7.2 on two HP-ML370-g5 servers (one PROD, one DVLP) and both have been running for 30 and 24 months respectively without a reboot. These are older hardware platforms so I have been preparing to cut the whole thing over to to two newer servers (HP-DL385p-gen8) next month. I just noticed I can't access the console on PROD.
command | result | |
---|---|---|
CTRL ALT F1 | screen turns solid blue | should be GUI mode |
CTRL ALT F2 | screen turns solid green | should be text mode |
CTRL ALT F3 | screen turns sold green | should be text mode |
I should mention that we can do anything else we want via a remote ssh terminal session over the network. In fact, the customers are unaware of fact that anything is wrong.
I've tried everything (short of rebooting) including replacing the monitor and restarting various services (eg. "systemctl restart gdm.service") but it seems that the VGA port is locked up somehow.
SUGGESTION: every system admin must ensure that every system has at least one external network port configured -AND- that the firewall has been configured to permit ssh2 connections so you be able to manage your platform if your VGA console is FUBARed.
This is a continuation of item-8 after a 1 month delay. Okay so the good news is this: we have acquired a replacement server and copied all necessary files to it. Since everything appeared to be running properly on the new server, I finished the day by rebooting the old server to see if my VGA port was still broken. The VGA port was not defective but now the system only boots part way then drops into emergency text mode offering a few useless before presenting a root password prompt. Sometime later I got a call saying "we missed some files on the old server". Oops! So I tried rebooting again:
---------- method 1 ----------
cd /dev ls -ls sd*
---------- method 2 ----------
lsblk # list block structured devices
sda | name of disk #1 |
sda1 sda2 sda3 |
name of partition #1 (if one exists) name of partition #2 (if one exists) name of partition #3 (if one exists) |
sdb | name of disk #2 |
sdb1 sdb2 |
name of partition #1 (if one exists) name of partition #2 (if one exists) |
mkdir -p /media/usb # my mount point (use any name you wish) mount -t vfat /dev/sdb1 /media/usb ls -la /media/usb ----------------------------------- cd /home/neil cp -p * /media/usb # copy with preserve attributes ----------------------------------- umount /media/usb
# ---------- step 1a ----------
# format whole device (deletes any partitions) mkfs.ext4 /dev/sdb # formats whole device mount /dev/sdb /media/usb # ---------- step 1b ---------- # format partition #1 mkfs.ext4 /dev/sdb1 # only format partition #1 mount /dev/sdb /media/usb # ---------- step 2 ----------- # common set -ve # set verify, stop on error ls -la /media/usb rsync -aX /etc /media/usb/etc # a = all; X = extended attributes
This is a continuation of items-8-9. I messed around with the old server (~ 30 minutes each day) following the on-screen suggestions after the GUI drops back to text mode during boot. Here is one of the messages presented to me:
Error initializing authority: Could not connect: No such file or directory (g-io-error-quark, 1)
I began Googling various pieces of the above phrase including "(g-io-error-quark, 1)" which took me to this
link at askubuntu.com (even though this is a CentOS problem). That article implicates erroneous entries in "/etc/fstab".
Apparently any mount failure during boot is considered fatal even though the basic root directory ( "/" ) is in good shape. So I
used a text editor to disable my last line of "/etc/fstab" then rebooted. The system came right up.
p.s. that one line I disabled in fstab was pointing at a disk which had been unmounted and deslotted shortly after the first boot
30 months ago.
Caveat: I have seen one situation where log files written to files under "/var/log" had filled the associated partition (some files like wtmp and others under "/var/log/gdm" can grow forever if your system hasn't been rebooted for a while). Type "df -h" to inspect disk free space. If near full, and if an emergency, you might consider deleting some of the larger log files before you reboot. Use this command to display files larger than 2MB
find /var/log -size +2M -exec ls -la {} \;
PROD (Linux) DVLP (Linux) OpenVMS OpenVMS +-------------+ +-------------+ +-------+ +------+ | primary | | primary | | PROD | | DVLP | Level-1 +-------------+ +-------------+ +-------+ +------+ +-------------+ +-------------+ | local copy | | local copy | Level-2 +-------------+ +-------------+ +-------------+ +-------------+ | remote copy | | remote copy | Level-3 +-------------+ +-------------+
caveat: this problem covers web applications using Python3 directly (i.e. when not using Django or WSGI)
update: on 2020-05-13 this patch was available from the CentOS repositories: libselinux-python3.x86_64
(ver2.5-15.el7)
wget https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm
sudo yum install ./google-chrome-stable_current_*.rpm
google-chrome &
cd Download
ls -lad # view the files
sudo yum install ./desired-file #
df -Th # disk free (human units; fs Type) mount | grep mapper # display mount points (1) mount | grep centos # display mount points (2)
Step-1 a) log on as root # do not first log on under /home then su b) ensure no interactive users # command: w c) stop-disable cron jobs needing "/home" # d) stop the SAMBA service # command: sudo systemctl stop smb nmb Step-2 mkdir /hack # create tmp folder (if sufficient space here) rsync -aX /home /hack # copy everything (-X = includes SELinux stuff)
--------------- du -a /home # check the src file count du -a /hack/home # verify the dst file count (do they match?) Step-3 umount /dev/mapper/centos-home # un-mount this volume Step-4 lvremove /dev/mapper/centos-home # DANGER (now past the point of no return) Step-5 lvcreate -L 400GB -n home centos # create a smaller replacement LVM # (keep 100 GB free just in case) Step-6 mkfs.xfs -f /dev/centos/home # format the volume with xfs (or xfs4)
# note1: here the "-f" switch means "force" # note2: "-t xfs" assumed (but not allowed with -f) Step-7 mount -a # mount everything in "/etc/fstab" # -OR TYPE- # mount /dev/mapper/centos/home /home Step-8 lvextend -r -L500GB /dev/mapper/centos-root # extend this volume to 500 GB; use "-r" to resize # without "-r" you will only see the new size in "lvs" # with "-r" you will also see the new size in "df -h" Step-9 rsync -aX /hack/home # restore everything including SELinux stuff du -a /hack/home # check the src file count du -a /home # verify the dst file count (do they match?) Step-10 sudo systemctl start smb nmb # start Samba sudo systemctl status smb nmb # check Samba
Next Steps
[root@kawc0f /]# yum makecache fast Loaded plugins: fastestmirror, langpacks Determining fastest mirrors epel/x86_64/metalink | 16 kB 00:00:00 Could not retrieve mirrorlist ... ... https://mirrors.iuscommunity.org/mirrorlist?repo=ius-centos7&arch=x86_64&protocol=http error was 14: HTTPS Error 404 - Not Found One of the configured repositories failed (Unknown), and yum doesn't have enough cached
data to continue. At this point the only safe thing yum can do is fail. There are a few
ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working upstream. This is
most often useful if you are using a newer distribution release than is supported by the
repository (and the packages for the previous distribution release still work). 3. Run the command with the repository temporarily disabled yum --disablerepo=<repoid> ... 4. Disable the repository permanently, so yum won't use it by default. Yum will then just
ignore the repository until you permanently enable it again or use --enablerepo for
temporary usage: yum-config-manager --disable <repoid> or subscription-manager repos --disable=<repoid> 5. Configure the failing repository to be skipped, if it is unavailable. Note that yum will
try to contact the repo. when it runs most commands, so will have to try and fail each
time (and thus. yum will be be much slower). If it is a very temporary problem though,
this is often a nice compromise: yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true Cannot find a valid baseurl for repo: ius/x86_64 [root@kawc0f /]#
https://github.com/iusrepo/announce/issues/18where we learn that many of the repositories have moved from the ".org" domain to the ".io" domain. Apparently support for ".org" ended in April-2020.
yum install -y https://centos7.iuscommunity.org/ius-release.rpmbut this fixed my problem:
yum install -y https://repo.ius.io/ius-release-el7.rpmCaveat: the ius-release repo was installed by a newbie in order to install python36 on CentOS7. Here is a better way to solve this problem:
sudo yum erase ius-releasebecause the epel-release repo is much more up-to-date
sudo yum install epel-release
sudo yum clean all
sudo yum makecache
caveat: all work here was done from a non-GUI session (usually a network connection)
yum groups list # display available groups
# pick any available package yum group install "Server with GU*I" # consider doing this
systemctl isolate multi-user.target | this temporary command makes immediate changes |
systemctl set-default multi-user.target | this permanent command will affect the next reboot |
humans here |
no humans here | no humans here |
---|---|---|
PROD | local-copy | remote-copy |
DVLP | local-copy | remote-copy |
Jun 4 16:46:00 bfdc0e rtkit-daemon[1021]: The canary thread is apparently starving.Taking action.
caveat: this problem is on going (so the follow proposed solution is untested)
yum upgrade
yum upgrade --skip-broken
su -
cd /etc/yum.repos.d
cp CentOS-Base.repo CentOS-Base.repo-old
vi CentOS-Base.repo
# just comment the mirror list AND uncomment the baseurl in four places [base] #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os baseurl=http://vault.centos.org/$releasever/os/$basearch/ [updates] #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates baseurl=http://vault.centos.org/$releasever/updates/$basearch/ [extras] #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras baseurl=http://vault.centos.org/$releasever/extras/$basearch/ [centosplus] #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus baseurl=http://vault.centos.org/$releasever/centosplus/$basearch/
yum upgrade --releasever=7.4.1708
================================================================================ title : mpack_notes.txt author : Neil Rieck created: 2021-11-17 edit : 2021-11-18 notes : the 'munpack' utility is also found here platfom: CentOS-7 stanzas: 1) play with file mpack-1.6.tar.gz 2) play with file mpack-1.6-2.el6.rf.x86_64.rpm ================================================================================
1) mpack-1.6.tar.gz (mpack + munpack for UNIX + Windows)
------------------------------------------------------------ tar -tvf mpack-1.6.tar.gz # list verbosely (f=mpack-1.6.tar.gz) tar -xvf mpack-1.6.tar.gz # extract verbosely (f=mpack-1.6.tar.gz) # note: creates folder 'mpack-1.6' tar -xvf mpack-1.6.tar.gz -C yada # place output in folder 'yada' ================================================================================
2) mpack-1.6-2.el6.rf.x86_64.rpm (mpack + munpack for CentOS-6)
------------------------------------------------------------------- mkdir mpack_rpm_hack # create directory cp mpack-1.6-2.el6.rf.x86_64.rpm mpack_rpm_hack # copy file to folder cd mpack_rpm_hack # move into folder rpm2cpio mpack-1.6-2.el6.rf.x86_64.rpm | cpio -idmv # extract contents tree --charset="ascii" # see the mess . |-- mpack-1.6-2.el6.rf.x86_64.rpm `-- usr |-- bin | |-- mpack | `-- munpack `-- share |-- doc | `-- mpack-1.6 | |-- Changes | |-- INSTALL | |-- README.mac | `-- README.unix `-- man `-- man1 |-- mpack.1.gz `-- munpack.1.gz 7 directories, 9 files [neil@kawc4n mpack_rpm_hack]$
./usr/bin/munpack -? # test the binary as-is
munpack version 1.6 # yay!
usage: munpack [-f] [-q] [-C directory] [files...]
<sr> [my-root-prompt]
<ur> ifconfig
<sr> ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 74.208.23.87 netmask 255.255.255.255 broadcast 74.208.23.87 inet6 fe80::250:56ff:fe0a:4fab prefixlen 64 scopeid 0x20<link> ether 00:50:56:0a:4f:ab txqueuelen 1000 (Ethernet) RX packets 1822 bytes 254353 (248.3 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1214 bytes 2218180 (2.1 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[my-root-prompt]
<ur> ip addr
<sr> ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group
default qlen 1000 link/ether 00:50:56:0a:4f:ab brd ff:ff:ff:ff:ff:ff inet 74.208.23.87/32 brd 74.208.23.87 scope global dynamic ens192 valid_lft 41794sec preferred_lft 41794sec inet6 fe80::250:56ff:fe0a:4fab/64 scope link valid_lft forever preferred_lft forever
[my-root-prompt]
<ur> cd /etc/sysconfig/network-scripts/
<sr> [my-root-prompt]
<ur> ls -l *ens192*
<sr> -rw-r--r-- 1 root root 148 Mar 5 08:00 ifcfg-ens192
[my-root-prompt]
<ur> cat ifcfg-ens192
<sr> BOOTPROTO=dhcp (note: since DHCP we need DNS info from the provider) DEVICE=ens192 DHCPV6C=yes DHCPV6C_OPTIONS="-nw" IPV6_AUTOCONF=yes IPV6INIT=yes NM_CONTROLLED=no ONBOOT=yes TYPE=Ethernet
[my-root-prompt]
<ur> vim ifcfg-ens192 (edit desired file with vim or nano) PEERDNS=yes (add on this line)
<sr> [my-root-prompt]
<ur> systemctl restart network.service
<sr> [my-root-prompt]
<ur> nslookup ibm.com
<sr> Server: 212.227.123.16 Address: 212.227.123.16#53 Non-authoritative answer: (success) Name: ibm.com Address: 23.35.139.245 Name: ibm.com Address: 2600:1407:21:282::3831 Name: ibm.com Address: 2600:1407:21:28f::3831
[my-root-prompt]
----------------------------------------- optional
<ur> cd /etc
<sr> [my-root-prompt]
<ur> cp resolv.conf resolv.conf-copy
[my-root-prompt]
I have four identical platforms all running CentOS-7 (last updated 4 month ago. This is what I see when I execute 'yum update'
Note that 'yum clean' fails the same way
[root@kawc3v ~]# yum clean error: rpmdb: BDB0113 Thread/process 23380/139868776736832 failed: BDB1507 Thread died in Berkeley DB library error: db5 error(-30973) from dbenv->failchk: BDB0087 DB_RUNRECOVERY: Fatal error, run database recovery error: cannot open Packages index using db5 - (-30973) error: cannot open Packages database in /var/lib/rpm CRITICAL:yum.main:
And here's the fix:
mv /var/lib/rpm/__db* /tmp/ rpm --rebuilddb yum clean all
comment: 'rpm --rebuilddb' is undocumented under 'man rpm' so look for it under 'man rpmdb' and use it sparingly
Okay so this is a weird problem which might not affect too many others.
<sr> $
<ur> sudo yum install epel-release
<sr> ...verbage...
$
<ur> sudo yum list wine.*
<sr> Installed Packages
Available Packages
wine.x86_64
<ur> sudo yum install wine.x86_64
<sr> ...verbage...
$
<sr> $
<ur> wineconsole compress.exe <sr> wine: Bad EXE format for Z:\home\neil\wine\compress.exe. $
<sr> $I see wine64 but where are the 32-bit programs?
<ur> which wine <sr> /usr/bin/wine $
<ur> ls -la /usr/bin/wine*
<sr> lrwxrwxrwx. 1 root root 22 Aug 8 11:30 /usr/bin/wine ->
/etc/alternatives/wine -rwxr-xr-x. 1 root root 11408 Apr 21 2020 /usr/bin/wine64 -rwxr-xr-x. 1 root root 2106864 Apr 21 2020 /usr/bin/wine64-preloader -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/wineboot -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/winecfg -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/wineconsole -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/winedbg -rwxr-xr-x. 1 root root 190200 Apr 21 2020 /usr/bin/winedump -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/winefile -rwxr-xr-x. 1 root root 95099 Apr 21 2020 /usr/bin/winemaker -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/winemine -rwxr-xr-x. 1 root root 1949 Apr 21 2020 /usr/bin/winepath lrwxrwxrwx. 1 root root 32 Aug 8 11:30 /usr/bin/wine-preloader ->
/etc/alternatives/wine-preloader lrwxrwxrwx. 1 root root 28 Aug 8 11:30 /usr/bin/wineserver ->
/etc/alternatives/wineserver -rwxr-xr-x. 1 root root 490768 Apr 21 2020 /usr/bin/wineserver64 $
<sr> $which worked.
<ur> sudo yum install wine32-release.noarch # adds a new repository
<sr> ...verbage...
$
<ur> sudo yum install wine.i686
<sr> ...verbage...
$
<ur> wineconsole compress one two
<sr> $
Aug 26 14:55:32 kawc3v systemd: Stopping The Apache HTTP Server...
Aug 26 14:55:33 kawc3v systemd: Stopped The Apache HTTP Server.
Aug 26 14:55:33 kawc3v systemd: Starting The Apache HTTP Server...
Aug 26 14:55:33 kawc3v httpd: AH00526: Syntax error on line 114 of /etc/httpd/conf.d/ssl.conf:
Aug 26 14:55:33 kawc3v httpd: SSLCertificateKeyFile: file '/etc/pki/tls/private/kawc96_20220822.key' does not exist or is empty
Aug 26 14:55:33 kawc3v systemd: httpd.service: main process exited, code=exited, status=1/FAILURE
Aug 26 14:55:33 kawc3v systemd: Failed to start The Apache HTTP Server.
Aug 26 14:55:33 kawc3v systemd: Unit httpd.service entered failed state.
Aug 26 14:55:33 kawc3v systemd: httpd.service failed.
restorecon -F -R -v /etc/pki/tls/certs restorecon -F -R -v /etc/pki/tls/private
#!/usr/bin/bash # title : pip36_install_p1.sh # author : Neil Rieck # created: 2022-09-08 python3.6 -m pip install ${1} \ --index https://pypi.org/simple \ --trusted-host pypi.org \ --trusted-host files.pythonhosted.org \ --proxy http://neilrieck.net:8083
#!/usr/bin/bash # title : pip39_install_p1.sh # author : Neil Rieck # created: 2022-09-08 python3.9 -m pip install ${1} \ --trusted-host pypi.org \ --trusted-host files.pythonhosted.org \ --proxy https://neilrieck.net:8083
Today I need to write a Python SFTP program based upon pysftp which is based upon paramiko but I cannot install paramiko on python-3.6.8 (I am seeing deprecated library alerts indicating that 3.6.8 is too old).
CentOS-7.9 doesn't offer a better python via rpm so I tried an easy install of python-3.8.13 as seen here
1) sudo yum install centos-release-scl 2) sudo yum list rh-python3\* 3) sudo yum install rh-python38 4) scl enable rh-python38 bash 5) python3 --version Python 3.8.13
Notes:
This works -AND- I can now install paramiko
======================================================================================== title : python3.x_build_on_centos7.txt author : Neil Rieck created: 2022-08-31 edit : 2022-09-08 links : 1) https://www.python.org/downloads/source 2) https://docs.python.org/3/using/unix.html (<<< how to build) 3) https://docs.python.org/3/using/configure.html (<<< how to build) notes : 1) this is an experimental build of python-3.9.13 on CentOS-7 2) Hopefully pip for python-3.9.13 works better with our corporate proxy server 3) python-3.9.13 allows me to install paramiko while python-3.6.8 does not ======================================================================================== file linkage BEFORE the install: [neil@kawc4n ~]$ ls -lad /usr/bin/python* lrwxrwxrwx. 1 root root 7 Jun 5 08:56 /usr/bin/python -> python2 lrwxrwxrwx. 1 root root 9 Jun 5 08:56 /usr/bin/python2 -> python2.7 -rwxr-xr-x. 1 root root 7144 Nov 16 2020 /usr/bin/python2.7 -rwxr-xr-x. 1 root root 1835 Nov 16 2020 /usr/bin/python2.7-config lrwxrwxrwx. 1 root root 16 Jun 5 08:56 /usr/bin/python2-config -> python2.7-config lrwxrwxrwx. 1 root root 9 Jun 7 07:13 /usr/bin/python3 -> python3.6 -rwxr-xr-x. 2 root root 11328 Nov 16 2020 /usr/bin/python3.6 -rwxr-xr-x. 2 root root 11328 Nov 16 2020 /usr/bin/python3.6m lrwxrwxrwx. 1 root root 14 Jun 5 08:56 /usr/bin/python-config -> python2-config [neil@kawc4n ~]$ file linkage AFTER the install: [neil@kawc4n ~]$ ls -lad /usr/bin/python* lrwxrwxrwx. 1 root root 7 Jun 5 08:56 /usr/bin/python -> python2 lrwxrwxrwx. 1 root root 9 Jun 5 08:56 /usr/bin/python2 -> python2.7 -rwxr-xr-x. 1 root root 7144 Nov 16 2020 /usr/bin/python2.7 -rwxr-xr-x. 1 root root 1835 Nov 16 2020 /usr/bin/python2.7-config lrwxrwxrwx. 1 root root 16 Jun 5 08:56 /usr/bin/python2-config -> python2.7-config lrwxrwxrwx. 1 root root 9 Jun 7 07:13 /usr/bin/python3 -> python3.6 -rwxr-xr-x. 2 root root 11328 Nov 16 2020 /usr/bin/python3.6 -rwxr-xr-x. 2 root root 11328 Nov 16 2020 /usr/bin/python3.6m -rwxr-xr-x. 1 root root 16328 Sep 7 16:09 /usr/bin/python3.9 -rwxr-xr-x. 1 root root 3073 Sep 7 16:12 /usr/bin/python3.9-config lrwxrwxrwx. 1 root root 14 Jun 5 08:56 /usr/bin/python-config -> python2-config [neil@kawc4n ~]$ ======================================================================================== steps: 1 ) sudo yum install epel-release 2 ) sudo yum update 3 ) sudo yum -y groupinstall "Development Tools" 4a) sudo yum -y install openssl-devel bzip2-devel libffi-devel xz-devel # required
4b) sudo yum -y install openssl11-devel # required >= python3.10 5 ) gcc --version 6a) # get source file via pc <-----------------------------------------------+- pick one
visit: https://www.python.org/downloads/ | then download file Python-3.9.13.tgz to your pc | then ftp it to the server | 6b) # get source file via wget <---------------------------------------------+
https_proxy=https://neilrieck.net:8083 \
wget https://www.python.org/ftp/python/3.9.13/Python-3.9.13.tgz 7 ) tar xvf Python-3.9.13.tgz 8 ) cd Python-3.9*/ 9a) # recipe-a (generates a large binary) <----------------------------------+- pick one # caveat: the default destination is: '/usr/local/bin/python3.9' | # but the next line will put it in: '/usr/bin/python3.9' | ./configure --prefix=/usr --enable-optimizations | tee nsr_39_step1.txt | 9b) # recipe-b (generates a small binary) <----------------------------------+
# caveat: the default destination is: '/usr/local/bin/python3.9' # but the next line will put it in: '/usr/bin/python3.9' sudo ./configure --prefix=/usr --enable-optimizations --enable-shared \
| tee nsr_39_step1.txt # sudo ldconfig (do this step after the make step) 10) # caveat: altinstall allows multiple versions of python to coexist # install does not allow multiple versions of python to coexist # so type carefully sudo make altinstall | tee nsr_39_step2.txt 11) # optional (required if you enabled shared libraries) sudo ldconfig ========================================================================= 20) # test executable python3.9 exit() 21) # display our packages python3.9 -m pip list --trusted-host pypi.org Package Version ---------- ------- pip 22.0.4 setuptools 58.1.0 22) # upgrade pip sudo python3.9 -m pip install --upgrade pip \ --trusted-host pypi.org \ --trusted-host files.pythonhosted.org \ --proxy https://neilrieck.net:8083 23) # display our packages (again) python3.9 -m pip list --trusted-host pypi.org Package Version ---------- ------- pip 22.2.2 <<< setuptools 58.1.0
proxy=http://neilrieck.net:8083For Rocky-8 systems sitting behind a corporate proxy server, you need to add two lines to file /etc/dnf/dnf.conf
proxy=http://neilrieck.net:8083 sslverify=false
caveats:
"You can use the source code free of charge but are only required to pay for support"BTW, many customer-facing commercial servers in the North America and Europe (governments, banks, insurance companies, etc.) are "mandated by law" to only use supported software covered by an active support contract.
Caveat: this problem is not specific to AlmaLinux. On the day of this problem, it would also have affected Debian, Fedora, Kali, Ubuntu and possibly anyone using epel-release. BTW, I am sitting behind a corporate firewall and am working through a proxy server. The proxy server is security enhanced via bluecoat and other stuff.
Problem:legend:Solution 1:
<ur> = user response
<sr> = system response
=======================================
<ur> sudo dnf clean all
<sr> ...stuff was deleted...
<ur> sudo dnf makecache
<sr> AlmaLinux 8 - BaseOS 48 kB/s | 14 kB 00:00 Error: Failed to download metadata for repo 'baseos': repomd.xml parser error: Parse error at line: 235 (Opening and ending tag mismatch: meta line 0 and head)
<ur> sudo tail -100 /var/log/dnf.librepo.log
<sr> ...100 lines are displayed...
2024-03-12T10:09:37-0400 INFO Downloading: https://mirrors.almalinux.org/mirrorlist/8/baseos 2024-03-12T10:09:37-0400 INFO Downloading: http://mirror.accuris.ca/almalinux/8.9/BaseOS/x86_64/os/repodata/repomd.xml 2024-03-12T10:09:37-0400 WARNING WARNING: Repomd xml parser: Unknown element "html"
<ur> [[[ interpret the results ]]]
<ur> attempt to fetch the file via "wget" or "curl"
<sr> received an html page from my employer's proxy server indicating blocked access to the destination
<ur> attempt to fetch the file via a browser
<sr> Destination site has been black-listed due to malware (was an error from Symantec)
<ur> find /etc -iname almalinux\*repo # where are the dnf repos? (could be dnf or yum)
<sr> ...
/etc/yum.repos.d/almalinux.repo # is one entry of many
...
<ur> cd /etc/yum.repos.d/ # change default directory
<sr> [root@123456 yum.repos.d]#
<ur> [[[ make backup copies of everything you intend to modify ]]]
vim almalinux.repo # edit the desired file(s)
[[[ comment out all lines beginning with "mirrorlist" ]]]
[[[ uncomment all associated lines beginning with "# baseurl" ]]]
[[[ consider changing each baseurl to a nearby mirror:
I used this nearby-to-me site:
https://mirror.csclub.uwaterloo.ca/almalinux/ ]]]
Moved to my Enterprise Linux page
Corporate security tells me that one of my systems needs to install an update of fontforge but my copy of yum/dnf does not see it. Poking around https://www.rpmfind.net/ indicates that this package is associated with powertools so how do I enable this on EL8 (AlmaLinux-8, CentOS-8, etc)?
[neil@neilrieck ~]$ cat /etc/os* | grep PRETTY PRETTY_NAME="AlmaLinux 8.10 (Cerulean Leopard)" [neil@neilrieck ~]$ ----------------------------------------------------------------------------- failsNote: The command above will not work on EL9 (AlmaLinux-9, CentOS-9). For that you need to type this:
[neil@neilrieck ~]$ sudo yum list fontforge\* Last metadata expiration check: 2:02:25 ago on Sat 12 Oct 2024 07:57:55 AM EDT. Error: No matching Packages to list
[neil@neilrieck ~]$
----------------------------------------------------------------------------- enable [neil@neilrieck ~]$ sudo dnf config-manager --set-enabled powertools
[neil@neilrieck ~]$
----------------------------------------------------------------------------- works [neil@neilrieck ~]$ sudo yum list fontforge\* AlmaLinux 8 - PowerTools 3.7 MB/s | 3.7 MB 00:01 Last metadata expiration check: 0:00:01 ago on Sat 12 Oct 2024 10:00:58 AM EDT. Available Packages fontforge.i686 20200314-6.el8_10 powertools fontforge.x86_64 20200314-6.el8_10 powertools [neil@neilrieck ~]$
$ sudo dnf config-manager --set-enabled crb