WereDoku

• https://github.com/raamsri/automount-usb

doveadm pw -s SHA512 -p mojeheslo

$ID$SALT$HASH
$ID = typ hash fce; $1 = MD5, $2 = Blowfish, $5 = SHA-256, $6 = SHA-512
$SALT = salt, plaintext
$HASH = vysledny hash

openssl passwd -1 -salt nejakejSalt
- zadani hesla
- vystup:
$1$nejakejSalt$hash

certbot certonly \
 --webroot \
 -w /var/www/example.com/web \
 -d example.com \
 -d www.example.com \
 -m hostmaster@example.com \
 [--dry-run]

• Upravit /etc/systemd/logind.conf:

HandleLidSwitch=ignore

• systemctl restart systemd-logind

doveadm expunge -u pepa@example.com mailbox Junk savedbefore 30d

* Dokumentace

• VirtualBox (headless)

apt install --no-install-recommends \
 bridge-utils \
 libosinfo-bin \
 libvirt-bin \
 qemu-kvm \
 qemu-utils \
 virtinst

systemctl enable libvirtd
systemctl start libvirtd

Vytvořit image

qemu-img create -f qcow2 -o preallocation=metadata /var/vms/my-little-vm/my-little-vm-disk.qcow2 350G

Vytvořit bridge br0

network:
  version: 2
  renderer: networkd
  ethernets:
    eno1:
      dhcp4: no
      dhcp6: no
  bridges:
    br0:
      interfaces: [eno1]
      dhcp4: no
      dhcp6: yes
      addresses: [192.168.104.3/24]
      gateway4: 192.168.104.1
      nameservers:
        addresses: [1.1.1.1,9.9.9.9]

Seznam typů OS

osinfo-query os

Vytvořit virtuálku

virt-install \
 --name=win10 \
 --hvm \
 --vcpus=4 \
 --memory=8192\
 --disk path=/var/vms/my-little-vm/my-little-vm-disk.qcow2,format=qcow2,bus=virtio \
 --disk device=cdrom,path=/path/to/Windows10_1909_CZ_x86+x64.iso \
 --disk device=cdrom,path=/path/to/virtio-win-0.1.171.iso \
 --network=bridge:virbr0,model=virtio \
 --os-type=windows --os-variant=win10 \
 --virt-type kvm \
 --graphics vnc

virsh edit jmenovirtualky

<os>
  <boot dev='hd'/>
  <boot dev='cdrom'/>
  <bootmenu enable='yes'>
</os>

• Disk

<disk ...>
  <target dev='vda' bus='virtio'>
</disk>

(+ smazat <address … />)

• Síťovka

<interface type='bridge'>
  <model type='virtio'/>
</interface>

• Zkopírovat blok <cdrom>, změnit pozici (na IDE řadič se vejdou dvě zařízení).
• Pro instalaci Windows je potřeba ručně přidat ovladače (k instalátoru navíc mountnout .iso s ovladači - ke stažení např. ze stránek RedHatu)
• V instalátoru odškrtnout “Skrýt nekompatibilní ovladače”
• E:\viostor\<os>\amd64

Zdroj: https://wiki.archlinux.org/index.php/QEMU#Preparing_a_Windows_guest

lsusb

ID AAAA:BBBB ⇒ AAAA = Vendor ID, BBBB = Product ID

<devices>
  <hostdev mode='subsystem' type='usb' managed='yes'>
    <source>
      <vendor id='0xAAAA'/>
      <product id='0xBBBB'/>
    </source>
  </hostdev>
</devices>

• Pokud není specifikováno jinak, běží na automaticky vybraném portu na localhostu, typicky na prvním volném od 5900 (včetně). Přístup třeba přes SSH tunel.

<graphics type='vnc' port='-1' autoport='yes'>

 virsh list --all

virsh start jmenovirtualky
 
virsh reboot jmenovirtualky
 
# ustřelení
virsh destroy jmenovirtualky 
 
virsh suspend/resume jmenovirtualky

virsh autostart jmenovirtualky

virsh list --all --autostart

virsh undefine jmenovirtualky

Pozor: nesmaže data, jen odregistruje.

virsh domrename puvodnijmeno novejmeno

virsh attach-disk jmenovirtualky \
--source /cesta/k/image/souboru \
--target vdX \
[--persistent]

X = volné písmeno

virsh -c qemu:///system list

Doplnit do /etc/environment, nebo .bashrc, nebo /etc/profile):

LIBVIRT_DEFAULT_URI='qemu:///system'

qemu-img convert -O qcow2 puvodni-image.ova novy-image.qcow2

1. apt install libsasl2-modules postfix.
2. Nastavit postfix jako “Internet site”, zvolit FQDN hostname (třeba debian.int.nazevfirmy.cz).
3. Vytvořit soubor etc/postfix/sasl_passwd a do něj napsat:
   1. [mail.isp.example]:587 username:password.
4. Spustit postmap /etc/postfix/sasl_passwd - vytvoří se /etc/postfix/sasl_passwd.db.
5. Nastavit práva pro sasl_passwd.db:
   1. chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
   2. chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
6. Upravit /etc/postfix/main.cf:
   1. Přidat/upravit: relayhost = [mail.isp.example]:587
   2. Do mynetworks= přidat IP adresu/rozsah, ze kterých bude postfix přijímat poštu jako submission (IP adresu přidat s prefixem /32, tj. třeba 10.0.0.5/32).
   3. Na konec konfiguráku připsat:

      # enable SASL authentication
      smtp_sasl_auth_enable = yes
      # disallow methods that allow anonymous authentication.
      smtp_sasl_security_options = noanonymous
      # where to find sasl_passwd
      smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
      # Enable STARTTLS encryption
      smtp_use_tls = yes
      # where to find CA certificates
      smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

7. Restart postfix
8. ???
9. Profit

Důležité:

1. U Office 365 je při posílání mailu potřeba mít “From:” nastaveno na odesílatele z dané domény.

Otestování konfigurace

• echo “body of your email” | mail -s “This is a Subject” -a “From: sender@example.com” recipient@elsewhere.com

Variantně přes balík s-nail, který umí specifikovat jiný SMTP server než výchozí pro systém:

1. cat ~/.mailrc
   set mta=smtp://ip-adresa-smtp-serveru

2. echo “body of your email” | s-nail -r “sender@example.com” -s “This is a Subject” recipient@elsewhere.com

Zdroj: https://www.linode.com/docs/email/postfix/postfix-smtp-debian7/

#!/bin/sh
 
# Setting this, so the repo does not need to be given on the commandline:
export BORG_REPO=ssh://<hostname>:50022/<remote_location>/borg
 
export BORG_PASSPHRASE="<passphrase>"
 
# some helpers and error handling:
info() { printf "\n%s %s\n\n" "$( date )" "$*" >&2; }
trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
 
info "Starting backup"
 
# Backup the most important directories into an archive named after
# the machine this script is currently running on:
 
borg create                         \
    --verbose                       \
    --filter AME                    \
    --list                          \
    --show-rc                       \
    --stats                         \
    --compression lz4               \
    --exclude-caches                \
    --exclude '/home/*/.cache/*'    \
    --exclude '/home/*/.local/lib/python*' \
    --exclude '/var/cache/*'        \
    --exclude '/var/lib/docker/*'   \
    --exclude '/var/tmp/*'          \
    --exclude '*.git'               \
                                    \
    ::'{hostname}-{now}'            \
    /etc                            \
    /home                           \
    /root                           \
    /var                            \
 
backup_exit=$?
 
info "Pruning repository"
 
# Use the `prune` subcommand to maintain 7 daily, 4 weekly and 6 monthly
# archives of THIS machine. The '{hostname}-' prefix is very important to
# limit prune's operation to this machine's archives and not apply to
# other machines' archives also:
 
borg prune                          \
    --list                          \
    --prefix '{hostname}-'          \
    --show-rc                       \
    --keep-daily    7               \
    --keep-weekly   4               \
    --keep-monthly  12              \
 
prune_exit=$?
 
# use highest exit code as global exit code
global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
 
if [ ${global_exit} -eq 1 ];
then
    info "Backup and/or Prune finished with a warning"
fi
 
if [ ${global_exit} -gt 1 ];
then
    info "Backup and/or Prune finished with an error"
fi
 
exit ${global_exit}

fstab

# <file system>                            <mount point>        <type> <options> <dump> <pass>
proc                                       /proc                proc   defaults  0      0

UUID=27d259c9-f4a8-4749-b8a7-b9a0f019a3c4  /mnt/ext-usb-4tb     ext4   defaults  0      0

# Adding an ASCII Armored key (.asc key)
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/docker-ce-archive-keyring.gpg > \
/dev/null

# Or if you prefer a one-liner
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/docker-ce-archive-keyring.gpg > /dev/null

# Breakdown of each part
#
# curl             downloads the key 
# gpg --dearmor    creates a binary .gpg because /usr/share/keyrings cannot take .asc keys
# sudo tee         because we get permission denied if we try redirect the output of a sudo command
# /dev/null        we don't need to see the dearmored keyring on the console

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \ 
sudo tee /etc/apt/sources.list.d/docker-ce.list > \
/dev/null


# Of if you prefer a one-liner
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker-ce.list > /dev/null

docker run -it --rm -v /home/user/temp/docker:/qemu-temp debian /bin/bash

(-v cesta_venku:cesta_uvnitr)

# lshw -C network -short

H/W path                  Device          Class          Description
====================================================================
/0/100/1.2/0/4/0          enp38s0         network        I210 Gigabit Network Connection
/0/100/1.2/0/5/0          enp39s0         network        I210 Gigabit Network Connection
/0/100/3.1/0              enp45s0         network        AQC107 NBase-T/IEEE 802.3bz Ethernet Controller [AQtion]
/0/100/3.2/0              enp46s0         network        MT27500 Family [ConnectX-3]
/4                        enp46s0d1       network        MT27500 Family [ConnectX-3]

mail -s 'Some Subject' -r 'First Last <you@example.com>' recipient@example.net

time rsync -avP --exclude '.recycle' /zdrojovy/adresar/ /cilovy/adresar/