linux:astra

This is an old revision of the document!

Linux.Astra

https://habr.com/ru/companies/jetinfosystems/articles/730106/ - экзамен alcsa 1.7 https://tour.astralinux.ru/

Информация по astra 1.7 https://wiki.astralinux.ru/pages/viewpage.action?pageId=137563438
https://wiki.astralinux.ru/fstec/security_measures - реализация мер защиты

astra-safepolicy - управление безопасностью 

sudo astra-safepolicy 3 # 0 Базовый / 1 Усиленный/ 2 Максимальный - детали смотри выше
sudo pdpl-user -i 63 username   #- повышение уровня целостности

https://dl.astralinux.ru/astra/ astra common edition

Astra doc

Astra Images

https://registry.astralinux.ru/latest/download/

Astra links

  1. virt KVM - https://wiki.astralinux.ru/pages/viewpage.action?pageId=3277425
  2. mandat attr - https://wiki.astralinux.ru/pages/viewpage.action?pageId=41191598
  1. https://github.com/bioinformatics-ptp/kvmBackup/wiki/Create-a-snapshot

Astra migration dd / boot recovery

  • Astra recovery

Astra hint

Astra теминология

  • СН - … назначение
  • МКЦ - ман кон цел
  • МРД - ман управ дос
  • ПК СВ - прог комплекс системы виртуализации

Linux.hint

  • screen tmux killed after logout systemd-run –scope –user sreen
/etc/systemd/logind.conf:
#Можно
  KillUserProcesses=no
  KillExcludeUsers=root
 
#restart systemd-logind 
$ sudo systemctl restart systemd-logind
$loginctl enable-linger YOU_USER_NAME
 
#for start recommendation
$ systemd-run --scope --user  screen -AmdS server

Astra EMERGENCY network

# ethernet configure - networkmanager and networking 
nmcli con add type vlan con-name eth3.201 id 201 dev eth3 vlan.parent eth3  ipv4.method auto
 
cat << EOF > /etc/network/interfaces.d/eth0
auto eth0
iface eth0 inet dhcp 
EOF
 
# mount CIFS and prepare for install packages
mount.cifs //10.59.20.200/test /mnt -o username=eam
sudo cp -r /tmp/apt  /etc/
 
sudo apt update
sudo apt install openssh-server cifs-utils
 
/etc/pam.d/sshd - отключаем parsec
sudo passwd astra-live # for example astra-live
sudo systemctl start ssh
 
export http_proxy=http://proxy.gorod.ru:3128/
export https_proxy=http://proxy.gorod.ru:3128/
curl https://getmic.ro | bash && sudo mv ./micro /usr/bin 
mkdir -p ~/.config/micro/
echo '{ "clipboard": "terminal" }' > ~/.config/micro/settings.json

Astra partition

# https://internet-lab.ru/mdadm_useful - mdadm usefull
# example restore DD with pigz
sudo dd if=/dev/sda1 bs=4M | pigz -c | dd of=/path/to/image.gz bs=4M
pigz -dc sdc1_prog.gz | dd of=/dev/md0p1 bs=4M status=progress
 
# create RAID
sudo mdadm --create /dev/md0 --level=1 --raid-devices=1  /dev/sdd3 --force 
 
# create LVM
pvcreate /dev/md0
vgcreate vg0 /dev/md0
lvcreate -n root -L 50G vg0
mkfs.ext4 /dev/mapper/vg0-root
 
# RSYNC
sudo rsync -ax /mnt/1/ /mnt/2/
 
# CHROOT
mount /dev/sdb2 /mnt/
mount /dev/md0p1 /mnt/2/boot/efi
for i in /dev /dev/pts /proc /sys /sys/firmware/efi/efivars /run; do sudo mount --bind $i /mnt$i; done
chroot /mnt
 
modify fstab on UUID with  lsblk -fs / blkid
!comment /etc/initramfs-tools/conf.d/resume

Monitoring program RAID

# !!!  mismatch_cnt   https://web.archive.org/web/20201214182307/https://www.thomas-krenn.com/en/wiki/Mdadm_checkarray_function
# recovery resync  https://web.archive.org/web/20160801015011/https://www.thomas-krenn.com/en/wiki/Mdadm_recovery_and_resync
# recovery degraded https://web.archive.org/web/20150102095244/http://www.thomas-krenn.com/en/wiki/Mdadm_recover_degraded_Array
# Mdadm checkarray function
# https://github.com/glensc/nagios-plugin-check_raid

check_linux_raid_mismatch.sh

Astra grub boot

# GRUB загрузка # https://wiki.debian.org/GrubEFIReinstall https://wiki.archlinux.org/title/GRUB
# check UEFI or Bios
[ -d /sys/firmware/efi ] && echo "UEFI boot" || echo "Legacy boot"
 
sudo apt install grub-pc
sudo update-initramfs -u
sudo grub-install --recheck /dev/sda
sudo update-grub
 
# управление mdadm raid https://www.dmosk.ru/miniinstruktions.php?mini=mdadm#create-raid
sudo dd if=/dev/zero of=/dev/sdc bs=1M count=1
sudo partprobe /dev/sdc
 
# MDADM grow active raid
sudo mdadm --manage /dev/md124 --add /dev/sdc
sudo mdadm -G /dev/md124 --raid-devices=2
# информация по raid
sudo mdadm -D /dev/md124
 
# LVM snapshots https://www.tecmint.com/take-snapshot-of-logical-volume-and-restore-in-lvm/
lvcreate --size 1G --snapshot --name main_snap /dev/vg0/lv_name
# если нужно оставить активныфй раздел без изменений
lvremove /dev/vg0/main_snap
# если нужно откатить изменения merge
umount /data
lvconvert --merge /dev/vg0/main_snap

Astra migration

#-- Rvirt04
# Partition the disk using parted
parted /dev/sda mklabel gpt
parted /dev/sda mkpart primary 1MiB 1025MiB    # sda1 - /boot/efi
parted /dev/sda mkpart primary 1025MiB 2049MiB # sda2 - swap
parted /dev/sda mkpart primary 2049MiB 300GB   # sda3 - LVM
 
# Format partitions
mkfs.fat -F32 /dev/sda1                        # Format sda1 as FAT32 for EFI
mkswap /dev/sda2                               # Format sda2 as swap
pvcreate /dev/sda3                             # Initialize sda3 as LVM physical volume
 
# Create LVM structure
vgcreate vg_system /dev/sda3                   # Create volume group
lvcreate -L 60G -n lv_root vg_system           # Create root logical volume (60GB)
lvcreate -L 100G -n lv_data vg_system          # Create data logical volume (100GB)
 
# Format LVM partitions
mkfs.ext4 /dev/vg_system/lv_root               # Format root as ext4
mkfs.ext4 /dev/vg_system/lv_data               # Format data as ext4
 
mount /dev/vg_system/lv_data /mnt/    # Mount data to /mnt/root/data
 
 
# Restore the image to the LVM logical volume with progress
sudo pv /mnt/boot.img | sudo dd of=/dev/sda1 bs=4M status=progress
 
 
-- get data
# Mount root, boot/efi, and data partitions
mount /dev/vg_system/lv_root /mnt/root         # Mount root to /mnt/root
mkdir -p /mnt/root/boot/efi                    # Create boot/efi directory
mount /dev/sda1 /mnt/root/boot/efi             # Mount sda1 to /mnt/root/boot/efi
mkdir -p /mnt/root/data                        # Create data directory
mount /dev/vg_system/lv_data /mnt/root/data    # Mount data to /mnt/root/data
 
sudo sfdisk /dev/sdX < partition_table_backup.txt
part:
label: gpt
label-id: 7F6B3CF0-40F7-504A-A0D1-9E21442B0E57
device: /dev/sdd
unit: sectors
first-lba: 2048
last-lba: 468862094
 
/dev/sdd1 : start=        2048, size=     1048576, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, uuid=125CDFD1-11A6-C444-BD0A-A7161E0C6947
/dev/sdd2 : start=     1050624, size=    19531776, type=0657FD6D-A4AB-43C4-84E5-0933C84B4F4F, uuid=A690A365-B3FB-A24F-9ED1-585BFCC774F8
/dev/sdd3 : start=    20582400, size=   419430400, type=A19D880F-05FC-4D3B-A006-743F0F84911E, uuid=251F310F-56EE-694D-941A-44057D9BCFD1

Astra audit ufix

ufix.zip

Src code

  • linux/astra.1747646801.txt.gz
  • Last modified: 2025/05/19 09:26
  • by admin