Docker @ CentOS 7.0

Reference :

https://docs.docker.com/
https://docs.docker.com/engine/userguide/basics/
http://philipzheng.gitbooks.io/docker_practice/content/
http://www.openfoundry.org/tw/tech-column/9319-docker-101
http://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach

1. Installation

1. yum install docker

Note:

FirewallD

CentOS-7 introduced firewalld, which is a wrapper around iptables and can conflict with Docker.

When firewalld is started or restarted it will remove the DOCKER chain from iptables, preventing Docker from working properly.

When using systemd, firewalld is started before Docker, but if you start or restart firewalld after Docker, you will have to restart the Docker daemon.

2. service docker start (/bin/systemctl start  docker.service)

3. chkconfig docker on  (systemctl enable docker.service)

2. Image

1. Search image with CentOS

docker search centos

2. Download image

docker pull centos

3. List local image

docker images

3.Container

1. List all container

docker ps -a

2. Start / Stop / Restart a container

docker start|stop|restart container-id

3. List all container

docker ps -a

4. Init a container ( create and run )

docker run -dit --name myCentOS6 centos:centos6

5. Start / Stop / Restart a exist container

docker start|stop|restart container-id

6. Attach (go back) to a container

docker attach containuer-id
EX :
docker run -dit --name myCentOS6 centos:centos6
docker attach myCentOS6

 7. De-attach (leave) a container

in the container, ctrl+p then ctrl+q
EX :
docker run -dit --name myCentOS6 centos:centos6
docker attach myCentOS6
ctrl + p , ctrl + q
(if we use exit to leave the bash, the container will stop because we "close" the last container job)

 




8. Run a new job in a container

docker exec container-id job
EX:  docker run myCentOS6

9. show a container info

docker inspect container-id job
EX:  docker run myCentOS6

CentOS 7 + Apache 2.4 + WebDav (Not so secure)

1. Create webdav directory 

mkdir /var/www/webdav
chown apache:apache /var/www/webdav

2.  Add a virtual host to apache server

vim /etc/httpd/conf/httpd.conf

NameVirtualHost *:8080

        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/webdav/
       
                Options Indexes MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
       

        DavLockDB "/tmp/DavLock"
        Alias /webdav /var/www/webdav/

       
                DAV On
                AuthType Basic
                AuthName "webdav"
                AuthUserFile /var/www/webdav/passwd.dav
                Require valid-user
                RewriteEngine off
       

3. Create webdav user

htpasswd -c /var/www/webdav/passwd.dav test

Use"-c" at first time to create the passwd file
To add other users, don't use "-c" option

4. SELINUX , set the webdav folder writable by apache httpd

grep denied /var/log/audit/audit.log | grep webdav

type=AVC msg=audit(1443167688.330:3067): avc:  denied  { write } for  pid=10689 comm="httpd" name="webdav" dev="dm-0" ino=770665 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir

grep "Permission denied" /var/log/httpd/error_log

[Fri Sep 25 15:54:48.332239 2015] [dav:error] [pid 10689] (13)Permission denied: [client 192.168.1.195:45679] Could not open file for writing  [500, #0]

chcon -R -t httpd_sys_content_rw_t /var/www/webdav/

5. Test webdav

yum install cadaver
cadaver http://192.168.1.195:8080/webdav/
Authentication required for webdav on server `192.168.1.195':
Username: test
Password:
dav:/webdav/> exit

CentOS 7 + Nginx 1.8.0 + PHP 5.6 + MariaDB 10.0 (LEMP) + SSL

1. change ulimits

vim /etc/security/limits.conf

* soft nofile 65535
* hard nofile 65535

2. Install MariaDB

vim /etc/yum.repos.d/MariaDB.repo
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.0/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

yum install MariaDB-server MariaDB-client
chkconfig mysql on
mysql_secure_installation
setting firewalld for mysql

3. Install Nginx

rpm -Uvh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm

yum install nginx
systemctl start nginx
systemctl enable nginx

setting firewalld for nginx

4.  Install PHP

https://webtatic.com/packages/php56/
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
yum install php56w php56w-fpm php56w-mysql

vim /etc/php.ini
;cgi.fix_pathinfo=1
cgi.fix_pathinfo=0

Reference : https://www.digitalocean.com/community/tutorials/how-to-install-linux-nginx-mysql-php-lemp-stack-on-centos-7

What we are looking for in this file is the parameter that sets cgi.fix_pathinfo. This will be commented out with a semi-colon (;) and set to "1" by default.

This is an extremely insecure setting because it tells PHP to attempt to execute the closest file it can find if a PHP file does not match exactly. This basically would allow users to craft PHP requests in a way that would allow them to execute scripts that they shouldn't be allowed to execute.

We will change both of these conditions by uncommenting the line and setting it to "0" like this:

5. Edit /etc/php-fpm.d/www.conf

[global]
pid = /usr/local/php/var/run/php-fpm.pid
error_log = /var/log/httpd/php-fpm.log

[www]
;listen = 127.0.0.1:9000
listen = /var/run/php-fpm/php-fpm.sock

listen.owner = nobody
listen.group = nobody
listen.mode = 0666


;user = apache
user = nginx
;group = apache
group = nginx

6. Edit /etc/nginx/conf.d/default.conf

 location / {
        root   /usr/share/nginx/html;
        index  index.php index.html index.htm;
    }

location ~ \.php$ {
        root   /usr/share/nginx/html;
        try_files $uri = 404;
        fastcgi_pass  unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
}

7 Restart php-fpm and nginx

systemctl restart php-fpm
systemctl restart nginx

8. Test PHP

vim /usr/share/nginx/html/info.php

http://serverip/info.php


9. Create Self-Signed Cert
openssl req -x509 -nodes -sha512 -newkey rsa:2048 -keyout cert.key -out cert.pem.csr -days 65536

Common Name (eg, your name or your server's hostname) []: mysite.example.com

chmod 600 cert.key
chmod 600 cert.pem.csr
copy cert.key /etc/nginx
copy cert.pem.csr /etc/nginx

vim /etc/nginx/conf.d/my_host_ssl.conf

server {
    listen       443 ssl;
    server_name  mysite.example.com;

    ssl_certificate      /etc/nginx/cert.pem.csr;
    ssl_certificate_key  /etc/nginx/cert.key;

    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";






#set the ssl_ciphers to resolve chrome display "is encrypted with obsolete cryptography"
   ssl_prefer_server_ciphers   on;
    ssl_protocols      TLSv1.2;

    location / {
        root   /usr/share/nginx/html;
        index  index.php index.html index.htm;
    }
}

CentOS 7 command mapping

 Ref :
http://note.tc.edu.tw/931.html
http://note.tc.edu.tw/932.html

1. netstat
   
   ss
   ss -lt
   ss -t
   
2. route
   
   ip -route
3. ifconfig
   
   ip addr
   ip -s link
4. arp
   
   ip neigh
5. ifconfig
   
   ip link set eth1 up
   ip link set eth1 down
6. traceroute
   
   tracepath 168.95.1.1
7. service
   
   systemctl  restart firewalld
   systemctl -l status mysql
   systemctl list-unit-files | grep nginx    //check the default start option , like chkconfig
   systemctl enable nginx
   
   
   
8. iptables
   
   firewall-cmd --list-service
   firewall-cmd --list-zone
   firewall-cmd --list-all --permanent
   firewall-cmd --add-service=http
   firewall-cmd --zone=public --list-all
   firewall-cmd --zone=public --add-port=443/tcp
   firewall-cmd --zone=public --remove-port=443
   firewall-cmd --zone=public --add-source=192.168.1.0/24
   firewall-cmd --zone=public -remove-source=192.168.1.0/24
   firewall-cmd --zone=public --list-rich-rules
   firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.2.0/24" port port="8080" protocol="tcp" accept'
   
   vim /etc/firewalld/zones/public.xml

CentOS 6.5 Upgarde PHP 5.3.3 to PHP 5.4

https://webtatic.com/packages/php54/

1.

rpm -Uvh http://mirror.webtatic.com/yum/el6/latest.rpm

2.

yum install yum-plugin-replace   yum replace php-common --replace-with=php54w-common

=============================================================================================================================================================================
 Package                                      Arch                                Version                                        Repository                             Size
=============================================================================================================================================================================
Installing:
 php54w                                       x86_64                              5.4.32-1.w6                                    webtatic                              2.5 M
 php54w-bcmath                                x86_64                              5.4.32-1.w6                                    webtatic                               34 k
 php54w-cli                                   x86_64                              5.4.32-1.w6                                    webtatic                              2.4 M
 php54w-common                                x86_64                              5.4.32-1.w6                                    webtatic                              1.1 M
 php54w-devel                                 x86_64                              5.4.32-1.w6                                    webtatic                              2.4 M
 php54w-gd                                    x86_64                              5.4.32-1.w6                                    webtatic                              118 k
 php54w-mbstring                              x86_64                              5.4.32-1.w6                                    webtatic                              918 k
 php54w-mcrypt                                x86_64                              5.4.32-1.w6                                    webtatic                               25 k
 php54w-mysql                                 x86_64                              5.4.32-1.w6                                    webtatic                              110 k
 php54w-pdo                                   x86_64                              5.4.32-1.w6                                    webtatic                               94 k
 php54w-pear                                  noarch                              1:1.9.4-7.w6                                   webtatic                              389 k
 php54w-tidy                                  x86_64                              5.4.32-1.w6                                    webtatic                               29 k
 php54w-xml                                   x86_64                              5.4.32-1.w6                                    webtatic                              145 k
Removing:
 php                                          x86_64                              5.3.3-27.el6_5.1                               @updates                              3.5 M
 php-bcmath                                   x86_64                              5.3.3-27.el6_5.1                               @updates                               29 k
 php-cli                                      x86_64                              5.3.3-27.el6_5.1                               @updates                              6.2 M
 php-common                                   x86_64                              5.3.3-27.el6_5.1                               @updates                              2.9 M
 php-devel                                    x86_64                              5.3.3-27.el6_5.1                               @updates                              3.0 M
 php-gd                                       x86_64                              5.3.3-27.el6_5.1                               @updates                              324 k
 php-mbstring                                 x86_64                              5.3.3-27.el6_5.1                               @updates                              2.1 M
 php-mcrypt                                   x86_64                              5.3.3-3.el6                                    @epel                                  46 k
 php-mysql                                    x86_64                              5.3.3-27.el6_5.1                               @updates                              216 k
 php-pdo                                      x86_64                              5.3.3-27.el6_5.1                               @updates                              168 k
 php-pear                                     noarch                              1:1.9.4-4.el6                                  @base                                 2.2 M
 php-tidy                                     x86_64                              5.3.3-27.el6_5.1                               @updates                               48 k
 php-xml                                      x86_64                              5.3.3-27.el6_5.1                               @updates                              307 k
Installing for dependencies:
 pcre-devel                                   x86_64                              7.8-6.el6                                      base                                  318 k
 t1lib                                        x86_64                              5.1.2-6.el6_2.1                                base                                  160 k

Transaction Summary
=============================================================================================================================================================================