linux:astra

Linux.Astra

Информация по astra 1.7 https://wiki.astralinux.ru/pages/viewpage.action?pageId=137563438
https://wiki.astralinux.ru/fstec/security_measures - реализация мер защиты

astra-safepolicy - управление безопасностью 

sudo astra-safepolicy 3 # 0 Базовый / 1 Усиленный/ 2 Максимальный - детали смотри выше
sudo pdpl-user -i 63 username   #- повышение уровня целостности

https://dl.astralinux.ru/astra/ astra common edition

Astra doc

Astra hint

Astra теминология

  • СН - … назначение
  • МКЦ - ман кон цел
  • МРД - ман управ дос
  • ПК СВ - прог комплекс системы виртуализации

Linux.hint

  • screen tmux killed after logout systemd-run –scope –user sreen
/etc/systemd/logind.conf:
#Можно
  KillUserProcesses=no
  KillExcludeUsers=root
 
#restart systemd-logind 
$ sudo systemctl restart systemd-logind
$loginctl enable-linger YOU_USER_NAME
 
#for start recommendation
$ systemd-run --scope --user  screen -AmdS server

Astra EMERGENCY network

# ethernet configure - networkmanager and networking 
nmcli con add type vlan con-name eth3.201 id 201 dev eth3 vlan.parent eth3  ipv4.method auto
 
cat << EOF > /etc/network/interfaces.d/eth0
auto eth0
iface eth0 inet dhcp 
EOF
 
# mount CIFS and prepare for install packages
mount.cifs //10.59.20.200/test /mnt -o username=eam
sudo cp -r /tmp/apt  /etc/
 
sudo apt update
sudo apt install openssh-server cifs-utils
 
/etc/pam.d/sshd - отключаем parsec
sudo passwd astra-live # for example astra-live
sudo systemctl start ssh
 
export http_proxy=http://proxy.gorod.ru:3128/
export https_proxy=http://proxy.gorod.ru:3128/
curl https://getmic.ro | bash && sudo mv ./micro /usr/bin 
mkdir -p ~/.config/micro/
echo '{ "clipboard": "terminal" }' > ~/.config/micro/settings.json

Astra partition

# https://internet-lab.ru/mdadm_useful - mdadm usefull
# example restore DD with pigz
sudo dd if=/dev/sda1 bs=4M | pigz -c | dd of=/path/to/image.gz bs=4M
pigz -dc sdc1_prog.gz | dd of=/dev/md0p1 bs=4M status=progress
 
# create RAID
sudo mdadm --create /dev/md0 --level=1 --raid-devices=1  /dev/sdd3 --force 
 
# create LVM
pvcreate /dev/md0
vgcreate vg0 /dev/md0
lvcreate -n root -L 50G vg0
mkfs.ext4 /dev/mapper/vg0-root
 
# RSYNC
sudo rsync -ax /mnt/1/ /mnt/2/
 
# CHROOT
mount /dev/sdb2 /mnt/
mount /dev/md0p1 /mnt/2/boot/efi
for i in /dev /dev/pts /proc /sys /sys/firmware/efi/efivars /run; do sudo mount --bind $i /mnt$i; done
chroot /mnt
 
modify fstab on UUID with  lsblk -fs / blkid
!comment /etc/initramfs-tools/conf.d/resume

Monitoring program RAID

# !!!  mismatch_cnt   https://web.archive.org/web/20201214182307/https://www.thomas-krenn.com/en/wiki/Mdadm_checkarray_function
# recovery resync  https://web.archive.org/web/20160801015011/https://www.thomas-krenn.com/en/wiki/Mdadm_recovery_and_resync
# recovery degraded https://web.archive.org/web/20150102095244/http://www.thomas-krenn.com/en/wiki/Mdadm_recover_degraded_Array
# Mdadm checkarray function
# https://github.com/glensc/nagios-plugin-check_raid

check_linux_raid_mismatch.sh

Astra grub boot

# GRUB загрузка # https://wiki.debian.org/GrubEFIReinstall https://wiki.archlinux.org/title/GRUB
# check UEFI or Bios
[ -d /sys/firmware/efi ] && echo "UEFI boot" || echo "Legacy boot"
 
sudo apt install grub-pc
sudo update-initramfs -u
sudo grub-install --recheck /dev/sda
sudo update-grub
 
# управление mdadm raid https://www.dmosk.ru/miniinstruktions.php?mini=mdadm#create-raid
sudo dd if=/dev/zero of=/dev/sdc bs=1M count=1
sudo partprobe /dev/sdc
 
# MDADM grow active raid
sudo mdadm --manage /dev/md124 --add /dev/sdc
sudo mdadm -G /dev/md124 --raid-devices=2
# информация по raid
sudo mdadm -D /dev/md124
 
# LVM snapshots https://www.tecmint.com/take-snapshot-of-logical-volume-and-restore-in-lvm/
lvcreate --size 1G --snapshot --name main_snap /dev/vg0/lv_name
# если нужно оставить активныфй раздел без изменений
lvremove /dev/vg0/main_snap
# если нужно откатить изменения merge
umount /data
lvconvert --merge /dev/vg0/main_snap
  • linux/astra.txt
  • Last modified: 2024/07/26 07:21
  • by admin