April 28, 2025 by kittycool only

Best Practise Auditd Configuration

Do take a look at https://github.com/Neo23x0/auditd. The idea of the configuration by Neo23x0 is to provide

works out-of-the-box on all major Linux distributions
fits most use cases
produces a reasonable amount of log data
covers security relevant activity
is easy to read (different sections, many comments)

The Recommended Video by IPPSec

December 6, 2024 by kittycool only

Using grubby to configure bootloader menu for Rocky Linux 8

grubby is a command line tool to configure bootloader menu entries for Linux. Here are some commands which you may find useful

List Kernels

# grubby --info=ALL | grep ^kernel
kernel="/boot/vmlinuz-4.18.0-553.16.1.el8_10.x86_64"
kernel="/boot/vmlinuz-4.18.0-513.18.1.el8_9.x86_64"
kernel="/boot/vmlinuz-4.18.0-425.3.1.el8.x86_64"
kernel="/boot/vmlinuz-0-rescue-1fd272f10209466d81c89276e275d210"

Check Defaults Loading

# grubby --default-kernel
/boot/vmlinuz-4.18.0-553.16.1.el8_10.x86_64

# grubby --default-index
0

Change Default Loading

# grubby --set-default="/boot/vmlinuz-4.18.0-513.18.1.el8_9.x86_64"

Verify Default Loading

# grubby --default-kernel
/boot/vmlinuz-4.18.0-513.18.1.el8_9.x86_64

# grubby --default-index
1

December 3, 2024 by kittycool only

Installing Octopus-15.0.0 with OpenMPI on Rocky Linux 8

This is an update to the blog entry Basic Configuration of Octopus 5.0.0 with OpenMPI on CentOS 6

Prerequisites:

GNU Compilers – 12.3
OpenMPI – 4.1.5
FFTW – 3.3.10
LAPACK/BLAS – (Comes with Rocky Linux 8)
GSL – 2.7.1

To install Octopus using autoconf, you will need to dnf install the autoconf, automaker, autogen packages

dnf install autoconf automake autogen

Preparing the Configure file using Autoreconf tools

After downloading from https://octopus-code.org/documentation/15/releases/ and unzip and untar, you must prepare the environment to generate the configure file. Do take a look at INSTALL and README files.

autoreconf --install

Prepare the PATH and LD_LIBRARY_PATH Environment

If you are using Module Environment, it will be much easier, if not, you have to configure $PATH and $LD_LIBRARY_PATH

export PATH=$PATH:/usr/local/openmpi-4.1.5/bin:...........
export LD_LIBRARY_PATH: $LD_LIBRARY_PATH: /usr/local/openmpi-4.1.5/lib...................

export FC=mpif90
export CC=mpicc
export FCFLAGS="-O3"
export CFLAGS="-O3"

Prepare the Octopus Setup Environment

./configure 
--prefix=/usr/local/octopus-15.0.0  \
--with-libxc-prefix=/usr/local/libxc-6.2.2 \
--with-libxc-include=/usr/local/libxc-6.2.2/include \
--with-gsl-prefix=/usr/local/gsl-2.7.1 \
--with-blas=/usr/lib64/libblas.a \ 
--with-arpack=/usr/lib64/libarpack.so.2 \ 
--with-fft-lib="-L/usr/local/fftw-3.3.10/lib" \
--disable-zdotc-test \
--enable-single \
--enable-mpi

make -j 16
make install

October 20, 2024 by kittycool only

Disabling ipv6 on Rocky Linux 8 with Ansible

If you wish to disable ipv6 on Rocky Linux 8, there is a wonderful writeup on the script found at https://github.com/juju4/ansible-ipv6/blob/main/tasks/ipv6-disable.yml which you may find useful. If you just need to disable it temporarily without disruption (assuming you have not been using ipv6 at all)

- name: Disable IPv6 with sysctl
  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "1"
    state: "present"
    reload: "yes"
  with_items:
    - net.ipv6.conf.all.disable_ipv6
    - net.ipv6.conf.default.disable_ipv6
    - net.ipv6.conf.lo.disable_ipv6

If you can tolerate a bit of disruption, you may want to take a look at putting it at the network configuration and restarting it

- name: RedHat | disable ipv6 in sysconfig/network
  ansible.builtin.lineinfile:
    dest: /etc/sysconfig/network
    regexp: "^{{ item.regexp }}"
    line: "{{ item.line }}"
    mode: '0644'
    backup: true
    create: true
  with_items:
    - { regexp: 'NETWORKING_IPV6=.*', line: 'NETWORKING_IPV6=NO' }
    - { regexp: 'IPV6INIT=.*', line: 'IPV6INIT=no' }
  notify:
    - Restart network
    - Restart NetworkManager
  when: ansible_os_family == 'RedHat'

August 19, 2024 by kittycool only

Using Mac Terminal App to SSH X-Forward

If you are using a MacOS and you are planning to do a X-forwarding, you may notice an error like this. In the Pix, below, after SSH, I wanted to X-forward Firefox Browser from Rocky Linux 8

ssh -X user1@192.168.0.1

There are a few settings we need to do. Let’s fix the “Locale not supported by C library. Using the fallback ‘C’ locale”

Issue 1 – Locale not support by C library. Using the fallback ‘C’ locale

To fix it, go to Top-Left-Hand Corner of your Mac-Desktop to look for the Terminal App,

Click “Settings” (Pix 1)
Click the Profiles Icons (Pix 2)
Uncheck the “Set locale environment variable on startup” (Pix 2)

Close and Quit Terminal App and come in again. You should fix the first problem.

Issue 2 – Install XQuartz

X11 used to be included with macOS. Apple no longer includes X11 with macOS. That is why you see an error like this “Error: no DISPLAY environment variable specified.”

You have to download the XQuartz App which is an open-source effort to develop a version of the X.Org X Window System that runs on macOS. Downloading and Installing is very straight-forward and easy. I’ve captured selected screen-shots….

After installing, you may want to let is run in the background

Log-Off from Your Mac Completely to allow the settings to reinitate

Issue 3 – Fixing the libGL error: failed to load driver: swrast on Rocky Linux 8

You may find an issue similar to the one in the earlier blog. That is how you may want to fix it.

August 18, 2024 by kittycool only

Installing Chrome on Rocky Linux 8

Step 1: Download Chrome RPM Package

wget https://dl.google.com/linux/direct/google-chrome-stable_current_x86.64.rpm

Step 2: DNF install Dependency and RPM Packages

# dnf install google-chrome-stable_current_x86_64.rpm

You should be able to find Chrome when you click the “List all Applications”

Great! You can see the Chrome Icon!

July 6, 2024 by kittycool only

How to prevent NetworkManager from updating /etc/resolv.conf for Rocky Linux 8

If you are using NetworkManager, it can override your /etc/resolv.conf customised settings. To prevent Network Manager from doing that, you can do the following

# vim /etc/NetworkManager/NetworkManager.conf

At the [main] section, add the following line

dns=none
rc-manager=unmanaged

That is all.

May 22, 2024 by kittycool only

Troubleshooting Intel VMD Driver Boot Issue on Supermicro Server with Rocky Linux 8.7

I was installing Rocky Linux 8.7 on a Supermicro Server with Intel VirtualRAID. I could not boot to Rocky Linux 8.7, the Install Screen could not be presented. Instead, there are repeated errors like the one below on the screen.

“DMAR: [INTR-REMAP] Request device [bc:00.5] fault index 0x8000 [fault reason 0x25] Blocked a compatibility format interrupt request”

The Issue was explained in the Article from Intel “Unable to Boot RHEL* 8.7/9.0 if Intel® VMD Is Enabled for Intel® Virtual RAID on CPU (Intel® VROC) RAID Management”

Resolution
A problem with the inbox Intel®️ VMD driver included in RHEL 8.7 and 9.0 was identified, and it is necessary to add the boot parameter intremap=off to the kernel command line while installing the operating system. This will prevent the operating system from encountering any problems.

This particular issue has been fixed via a kernel update and has been implemented in RHEL 9.1.

it is necessary to add the boot parameter intremap=off to the kernel command line while installing the operating system

I tried Rocky Linux 8.9 and the issue was fixed.

April 26, 2024 by kittycool only

Configuring ABAQUS Linux Client for New License Server | Step-by-Step

If you have migrated to a new ABAQUS License Server and is planning to point your ABAQUS Linux Client to the new License Server. Here are the simple steps you will need to do

Step 1: Find the custom_v6.env files to edit.

Depending on how you install, for me I like to put everything in /usr/local so my abaqus will be placed there.

# cd /usr/local/abaqus-2023/SIMULIA/EstProducts/2023/linux_a64/SMA/site/
# vim custom_v6.env

Step 2: Edit the custom_v6.env file

Add the abaquslm_license_file = “27398@XXX.XXX.XXX.XXX”

# Installation of Established Products 2023
# Wed Oct 11 13:30:54 2023
plugin_central_dir="/usr/local/abaqus-2023/DassaultSystemes/SIMULIA/CAE/plugins/2023"
# retrieve licensing configuration from EstablishedProductsConfig.ini
importEnv('licensing.env')
abaquslm_license_file = "27398@XXX.XXX.XXX.XXX"

References:

Manually Configuring Licensing for ABAQUS

March 16, 2024 by kittycool only

SSH Error – Receive Packet Type 51 on Rocky Linux 8

If you are having SSH issues and if you turned on high verbosity and the following output is generated

# ssh -vvv XXX.XXX.XXX.XXX

.....
.....
debug1: Offering public key: debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
.....
.....
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
user1@192.168.0.1: Permission denied (publickey,gssapi-with-mic,password)

According to SSH protocol (RFC 4252), these are the general authentication message codes

SSH_MSG_USERAUTH_REQUEST            50
SSH_MSG_USERAUTH_FAILURE            51
SSH_MSG_USERAUTH_SUCCESS            52
SSH_MSG_USERAUTH_BANNER             53

It means that the authentiation methods mentioned in the “Permission Denied” was not accepted. What are some of the common issues.

Type 1 (Most Common Mistake): Permission Errors on the .ssh Folder and files inside .ssh

For more information, see Encountering SSH “Permission denied, please try again.”

Type 2: Incorrect Configuration Settings on the /etc/ssh/sshd_config
(Assuming you are using Password Authentication) Inside /etc/ssh/sshd_config, you should have something like

PermitRootLogin no
.....
PasswordAuthentication yes
.....
ChallengeResponseAuthentication no
.....
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
.....
UsePAM yes

Type 2: Incorrect Configuration Settings on the /etc/ssh/ssh_config
In Rocky Linux 8, everything should be commented except the last line “Include /etc/ssh/ssh_config.d/*.conf”