Activities Tasks logs by Linux Malaysia, Hafnie Harisfazillah Jamel For Linux Open Source Software

The Void - Location Kuala Lumpur Malaysia With My Blog Post

2025-10-01T03:54:00.000+08:00

Click the location tag of this post for Kuala Lumpur, Malaysia. You will get to this place. And whats its is in that void space in between buildings?

GPS Coordinate

3°07'54.9"N 101°41'02.6"E

3.131920, 101.684059

https://maps.app.goo.gl/kJvqaTf6fhoReq6M6

Mini UbuCon Malaysia 2025 - An Event Dedicated To Advancing The Open Source Software Ecosystem

2025-09-13T08:33:00.010+08:00

Mini UbuCon Malaysia 2025

We are thrilled to announce the Mini UbuCon Malaysia 2025, an event dedicated to advancing the open-source software ecosystem in our region. This year, the Ubuntu Malaysia LoCo Team is proud to partner with Cyber Digital Services, Defence and Security Asia (CyberDSA), a leading regional event serving key stakeholders in the cyber defence and security industry.

Please save the date and venue for this event:

Event: Mini UbuCon Malaysia 2025

Dates: 30 September 2025

Venue: Kompleks MITEC KL Metropolis, 8, Jalan Dutamas 2, Segambut, 50480 Kuala Lumpur

For more information and registration, please visit:

Mini UbuCon Malaysia 2025: https://2025.ubuntu.my/

CyberDSA: https://www.cyberdsa.com/

Through this collaboration, CyberDSA is the Official Place Sponsor for Mini UbuCon Malaysia 2025. This sponsorship has made it possible for us to select Kompleks MITEC KL Metropolis as our official venue, a premier convention center that will provide an exceptional setting for our community to connect, learn, and network.

Why Attend Mini UbuCon Malaysia 2025?

Stay Ahead with Cutting-Edge Technology

As one of the world's most popular Linux distributions, Ubuntu is a cornerstone of the open-source movement. Dive deep into the latest advancements that Ubuntu and the broader Linux ecosystem have to offer. Whether you are a seasoned professional or a beginner, this conference provides invaluable insights into the evolving landscape of Linux and its powerful applications in cybersecurity.

Network with Experts and Enthusiasts

Meet and connect with like-minded individuals, industry experts, and key contributors to the Ubuntu community. This is a unique opportunity to expand your network and collaborate with others who share your passion for open-source technology.

Support the Ubuntu Malaysia Community

The local Ubuntu Malaysia Community plays a crucial role in the ongoing development and support of this versatile operating system. Your participation helps bolster this community and ensures the continuous growth and innovation of Ubuntu, which in turn strengthens the global Linux community as a whole.

About CyberDSA

CyberDSA aspires to be a catalyst for change, connecting decision-makers in government and private sectors to accelerate the cyber defence and security agenda. This event aims to impart the latest knowledge and intriguing insights about cybersecurity while showcasing cutting-edge technologies that would safeguard digital economies and foster global competitiveness.

We are confident that this conference will be a significant step forward for the Malaysian open-source community. We look forward to seeing you there.

Sincerely,

Harisfazillah Jamel (LinuxMalaysia)

Ubuntu Malaysia LoCo Team

Mini UbuCon Malaysia 2025: Share Your Voice, Shape the Future

2025-07-28T06:57:00.003+08:00

🚀 Mini UbuCon Malaysia 2025: Share Your Voice, Shape the Future! 🐧

We’re thrilled to announce that planning for Mini UbuCon Malaysia 2025 is officially in motion! As Ubuntu and open source communities continue to grow, this event aims to bring together passionate developers, technologists, and enthusiasts from across Malaysia.

🔗 Fill in our Community Survey
Have a say in shaping the agenda, format, and topics for Mini UbuCon 2025:
👉 https://form.ubuntu.my/2025/ubucon/

💡 Why Your Input Matters
Mini UbuCon is built by the community, for the community. Whether you’re excited to attend, want to propose a talk, or simply have ideas on what we should cover — we want to hear from you:

🎤 Suggest exciting talk topics
🧠 Let us know what you want to learn or discuss
📍 Help us create an event that reflects YOUR interests

🗓 Tentative Date: Mini UbuCon October 2025 / Malaysia For UbuCon 2026

📣 Join Our Conversation on Telegram
Stay updated and chat with fellow Ubuntu MY members:
🔗 https://t.me/ubuntumalaysia

🐧 What is Mini UbuCon?

Mini UbuCon is a community-powered event celebrating Ubuntu and the broader open source movement. Expect insightful talks, hands-on workshops, technical demos, and open forums. It’s a space to network, collaborate, and grow together — whether you’re a Linux beginner or a seasoned sysadmin.

💻 Why Ubuntu Matters

Ubuntu Linux, developed by Canonical, is one of the world’s most popular open source operating systems. It powers desktops, servers, and cloud infrastructures globally — thanks to its stability, security, and passionate community. Ubuntu makes technology accessible, empowering innovation from classrooms to enterprises.

🤖 Ubuntu & AI

Ubuntu is at the forefront of AI and machine learning. With native support for leading frameworks like TensorFlow and PyTorch, along with robust GPU compatibility, it’s the go-to platform for AI development — from cloud clusters to edge devices. Mini UbuCon 2025 will spotlight these innovations, including practical AI use cases and community-driven projects.

📄 Additional Resources & Event References

💬 Let’s Build It Together!
The future of open source in Malaysia depends on your voice, your curiosity, and your participation. Help shape Mini UbuCon 2025 by joining the conversation and completing our quick survey:

👉 https://form.ubuntu.my/2025/ubucon/

#MiniUbuCon2025 #UbuntuMY #OpenSourceMY #LinuxMalaysia #UbuCon

Percona PostgreSQL Cluster Operations: A Public Guide to Management, Minor Upgrades, Performance Tuning, and Troubleshooting

2025-07-28T06:16:00.002+08:00

Percona PostgreSQL Cluster Operations: A Public Guide to Management, Minor Upgrades, Performance Tuning, and Troubleshooting

Percona PostgreSQL Cluster Operations: A Public Guide to Management, Minor Upgrades, Performance Tuning, and Troubleshooting 1

1. Cluster Node Information 2

2. ETCD Cluster Node Information 2

3. Pre-Upgrade Steps 3

4. Upgrade Process Steps (Rolling Upgrade Node by Node) 3

4.1. Remove Previous Version of Percona pg_tde (If Applicable) 3

4.2. Update Percona Release Package 4

4.3. Install Required Dependencies and Enable Repositories 4

4.4. Configure Percona Distribution for PostgreSQL 17 Repository 5

4.5. Stop Patroni Service on the Current Node 6

4.6. Install/Upgrade Percona Distribution for PostgreSQL 17 Packages 6

4.7. Start Patroni Service on the Current Node 7

4.8. Verify Node Health 7

4.9. Repeat Steps for Other Replicas 7

4.10. Perform Patroni Switchover (Before upgrading the original primary) 8

4.11. Upgrade the Original Primary Node (Now a Replica) 8

4.12. Configure pg_tde in PostgreSQL Configuration (If not already done) 9

4.13. Perform Patroni Cluster-Wide Restart to Apply Configuration Changes 9

4.14. Optional: Perform a Patroni Switchover for Verification 10

5. Performance Tuning Considerations 11

6. Post-Upgrade Verification 14

7. Handling Potential Issues 14

8. Understanding patronictl list Output 15

Conclusion 17

This comprehensive guide details the procedures for managing and performing a minor version upgrade of a Percona Distribution for PostgreSQL cluster, which is orchestrated by Patroni and relies on etcd for distributed consensus. This document also includes an explanation of key diagnostic outputs for cluster monitoring. All sensitive information, such as specific IP addresses, hostnames, usernames, and cluster names, has been anonymised to protect privacy for public reference.

Important Note: This document outlines steps specifically for a minor version upgrade within the PostgreSQL 17 series (e.g., from 17.2 to 17.4). Major version upgrades (e.g., from PostgreSQL 16 to 17) typically involve different procedures, often utilising pg_upgrade or logical replication, which are not covered here.

1. Cluster Node Information

The following nodes comprise the Percona Distribution for PostgreSQL cluster managed by Patroni:

Node Name	IP Address	Role
pg-node-1	192.168.1.101	Leader
pg-node-2	192.168.1.102	Replica
pg-node-3	192.168.1.103	Replica

Note: The roles (Leader/Replica) are dynamic and managed by Patroni based on cluster state and health.

2. ETCD Cluster Node Information

The Patroni instances in this PostgreSQL cluster rely on a 5-node etcd cluster for distributed consensus, leader election, and state storage. The etcd cluster nodes are:

IP Address	Hostname	Short Name
192.168.1.201	etcd-node-1	etcd-node-1
192.168.1.101	pg-node-1	pg-node-1
192.168.1.102	pg-node-2	pg-node-2
192.168.1.103	pg-node-3	pg-node-3
192.168.1.202	etcd-node-2	etcd-node-2

Note: Some nodes may serve multiple roles (e.g., hosting both PostgreSQL and etcd members) for resource efficiency or specific architectural designs.

3. Pre-Upgrade Steps

Before commencing any upgrade or significant maintenance, ensure the following critical prerequisites are met:

Validated Backup: A recent, successful, and validated backup of the entire database cluster is paramount. Verify that the backup can be restored accurately to a test environment. This provides an essential rollback point in case of unforeseen issues during the upgrade process.
Cluster Health: Confirm the Patroni cluster is operating optimally. All nodes (primary and replicas) should be running, healthy, and replicating correctly. Use patronictl list to check the PostgreSQL cluster state and verify the health of the etcd cluster separately.
System Resources: Ensure adequate disk space is available on all nodes for the package upgrade, any temporary files, and future operational growth.
Network Connectivity: Verify robust network connectivity between all cluster nodes (PostgreSQL and etcd members) and any external systems (e.g., application servers, monitoring systems, backup targets) that interact with the cluster. Pay close attention to all required ports.

4. Upgrade Process Steps (Rolling Upgrade Node by Node)

Perform the following steps on each node in the cluster, adhering to a rolling upgrade approach. It is crucial to start with replica nodes and only upgrade the primary after a controlled switchover, to minimise service disruption.

4.1. Remove Previous Version of Percona pg_tde (If Applicable)

dnf remove percona-pg_tde_16

Explanation: If the Percona Transparent Data Encryption (TDE) plugin was installed for a previous major PostgreSQL version (e.g., PostgreSQL 16), its version-specific package (percona-pg_tde_16) must be removed prior to upgrading the core PostgreSQL server binaries to version 17. This action prevents potential compatibility conflicts and ensures a clean installation for the new PostgreSQL 17 libraries. A compatible version of pg_tde for PostgreSQL 17 will be installed as part of the subsequent package upgrade. Refer to the Percona TDE installation documentation for further details. https://docs.percona.com/pg-tde/yum.html#install-percona-release

4.2. Update Percona Release Package

dnf update percona-release

Explanation: The percona-release package manages the configuration of Percona's software repositories on your system. Updating this package ensures that your system's package manager (dnf) has access to the latest repository definitions and GPG keys required to fetch packages for Percona Distribution for PostgreSQL 17. This is a necessary prerequisite to make the new version's packages available for installation or upgrade. This step aligns with the minor upgrade procedure outlined by Percona.

4.3. Install Required Dependencies and Enable Repositories

dnf install dnf-plugins-core -y
dnf config-manager --set-enabled crb
dnf install perl-IPC-Run -y

Explanation:

dnf install dnf-plugins-core -y: Installs essential plugins for DNF, including the config-manager plugin used in the subsequent step. The -y flag confirms the installation automatically.
dnf config-manager --set-enabled crb: Enables the CodeReady Linux Builder (CRB) repository. This repository provides supplementary packages, including developer tools and libraries, which may be dependencies for Percona software components like Patroni or certain PostgreSQL extensions not found in the standard distribution repositories.
dnf install perl-IPC-Run -y: Installs the perl-IPC-Run Perl module. This module is often a dependency for various system administration utilities or scripts, potentially including those used by Patroni or other components of the Percona stack for managing inter-process communication.

dnf install epel-release -y

Explanation: Installs the repository configuration for Extra Packages for Enterprise Linux (EPEL). EPEL is a widely-used repository providing additional software packages for Enterprise Linux distributions. Patroni and some of its dependencies are frequently sourced from or rely on libraries found in EPEL. The -y flag confirms the installation automatically.

dnf install dnf-plugins-core -y
dnf config-manager --set-enabled crb

Explanation: These commands re-confirm the installation of DNF plugins and the enablement of the CRB repository. While potentially redundant if the previous steps were successful, they ensure these prerequisites are firmly in place before configuring the specific Percona repository.

dnf -y install curl

Explanation: Installs the curl utility. curl is a versatile command-line tool used for transferring data via URLs. It is commonly used for downloading files, interacting with REST APIs (such as those provided by Patroni or etcd), and verifying network connectivity, making it a valuable tool for system administration and troubleshooting in a distributed environment. These dependency installations are standard steps often required before installing Percona Distribution for PostgreSQL 17. https://docs.percona.com/postgresql/17/installing.html

4.4. Configure Percona Distribution for PostgreSQL 17 Repository

percona-release setup ppg17

Explanation: This command, provided by the percona-release package, configures your system's package manager to use the official Percona repositories specifically for Percona Distribution for PostgreSQL 17. It automatically disables any older Percona PostgreSQL repository configurations to ensure that package operations target the desired version. This is a key step in the Percona PostgreSQL 17 installation process. https://docs.percona.com/postgresql/17/installing.html
Output:
[root@pg-node-3 ~]# percona-release setup ppg17
* Disabling all Percona Repositories
* Enabling the Percona Distribution for PostgreSQL 17 repository
<*> All done!

This output confirms that the repository setup was successful. All previous Percona repositories were disabled, and the repository for Percona Distribution for PostgreSQL 17 (ppg17) was enabled.

4.5. Stop Patroni Service on the Current Node

systemctl stop patroni

Explanation: Patroni is the high-availability agent responsible for managing the PostgreSQL instances. To safely perform package upgrades on a node, the Patroni service must be stopped on that specific node before modifying the PostgreSQL binaries or related software. This action prevents Patroni from attempting to manage or restart the database instance while it is in an inconsistent state during the upgrade process.

4.6. Install/Upgrade Percona Distribution for PostgreSQL 17 Packages

dnf install percona-ppg-server17
dnf upgrade

Explanation:

dnf install percona-ppg-server17: This command ensures the meta-package for Percona Distribution for PostgreSQL 17 is installed or updated, resolving dependencies against the new repository.
dnf upgrade: This command performs the actual upgrade of all installed packages on the system with newer versions available, including the core PostgreSQL 17 server binaries, client libraries, contrib modules, Patroni, etcd, pgBackRest, and Percona-specific extensions. This updates the software on the current node to version 17.4.

Output (Combined Example):

[root@pg-node-3 ~]# dnf install percona-ppg-server17
... (output showing upgrade of percona-ppg-server17 17.2 -> 17.4) ...
Complete!
[root@pg-node-3 ~]# dnf upgrade
... (output showing upgrade of various packages including postgresql17-server, patroni, etcd etc. to their 17.4 compatible versions) ...
Upgraded:
elrepo-release-9.5-2.el9.elrepo.noarch etcd-3.5.18-1.el9.x86_64 percona-patroni-1:4.0.5-1.el9.x86_64
percona-pg-telemetry17-1:1.1.0-1.el9.x86_64 percona-pg_repack17-1:1.5.2-1.el9.x86_64 percona-pg_stat_monitor17-1:2.1.1-1.el9.x86_64
percona-pgaudit17-1:17.1-1.el9.x86_64 percona-pgbackrest-1:2.54.2-1.el9.x86_64 percona-postgresql-client-common-1:267-1.el9.noarch
percona-postgresql-common-1:267-1.el9.noarch percona-postgresql17-1:17.4-1.el9.x86_64 percona-postgresql17-contrib-1:17.4-1.el9.x86_64
percona-postgresql17-libs-1:17.4-1.el9.x86_64 percona-postgresql17-server-1:17.4-1.el9.x86_64
Complete!

This output confirms that the core PostgreSQL 17 components and related software like Patroni and etcd were successfully upgraded to their respective latest versions compatible with Percona Distribution for PostgreSQL 17.4.

4.7. Start Patroni Service on the Current Node

systemctl start patroni

Explanation: After successfully upgrading the packages on the current node, restart the Patroni service. Patroni will initiate the start of the PostgreSQL instance on this node, and it should automatically attempt to rejoin the cluster, typically as a streaming replica. Starting Patroni immediately after the package upgrade on a node is crucial for maintaining the cluster's high availability during the rolling upgrade process.

4.8. Verify Node Health

patronictl -c /etc/patroni/postgresql.yml list

Explanation: Use patronictl list to verify that the node you just upgraded and restarted Patroni on has successfully rejoined the cluster and is in a healthy state (e.g., streaming for a replica). Ensure replication lag is minimal before proceeding to the next node.

4.9. Repeat Steps for Other Replicas

Repeat steps 4.5 through 4.8 on each remaining replica node in the cluster, one node at a time.

Explanation: Continue the process of stopping Patroni, upgrading packages, starting Patroni, and verifying health for all other replica nodes in the cluster. Always ensure a node is healthy and streaming before moving to the next replica.

4.10. Perform Patroni Switchover (Before upgrading the original primary)

### Perform a switchover to make an upgraded replica the new primary

patronictl -c /etc/patroni/postgresql.yml switchover --candidate <name_of_an_upgraded_replica> my-pg-cluster

Explanation: Once all replica nodes have been successfully upgraded and are healthy, perform a controlled switchover using patronictl. Choose one of the already upgraded replicas to become the new primary. This step is vital because it allows you to upgrade the original primary node with minimal downtime for write operations, as the cluster will continue serving traffic via the new primary during the original primary's upgrade window. Replace <name_of_an_upgraded_replica> with the actual name of one of the upgraded replica nodes (e.g., pg-node-2 or pg-node-3).

4.11. Upgrade the Original Primary Node (Now a Replica)

# Identify the original primary node (which is now a replica after switchover)
systemctl stop patroni # Stop Patroni on the original primary node
# Repeat steps 4.6 (dnf install/upgrade) on this node
# Repeat step 4.7 (systemctl start patroni) on this node
# Repeat step 4.8 (patronictl list) to verify it rejoins as a healthy replica

Explanation: Now that the original primary node is serving as a replica, repeat the package upgrade process (steps 4.6 and 4.7) on it. Stop Patroni, perform the dnf install/upgrade, and then start Patroni. Verify using patronictl list that this node successfully rejoins the cluster as a healthy replica.

4.12. Configure pg_tde in PostgreSQL Configuration (If not already done)

# Connect to the CURRENT primary node (the one promoted in step 4.10)
sudo -u postgres /bin/bash # Switch to postgres user
psql # Connect to postgres
```sql
ALTER SYSTEM SET shared_preload_libraries = 'pg_tde';
```bash
exit # Exit psql
exit # Exit postgres user shell

Explanation: This step ensures the shared_preload_libraries setting to load pg_tde is applied using ALTER SYSTEM. This command modifies the postgresql.conf file. It must be executed while connected to the current primary node of the cluster (the one promoted in step 4.10). This change requires a full PostgreSQL server restart to take effect, which will be done in the next step.

4.13. Perform Patroni Cluster-Wide Restart to Apply Configuration Changes

patronictl -c /etc/patroni/postgresql.yml restart my-pg-cluster

Explanation: This command uses patronictl to initiate a controlled, rolling restart of the entire cluster named my-pg-cluster. This restart is necessary specifically to apply any configuration changes (like shared_preload_libraries) that only take effect when the PostgreSQL server process starts. Patroni will handle the restart sequence, typically restarting replicas first and then the primary, ensuring minimal impact on availability.
Output:
[root@pg-node-1 ~]# patronictl -c /etc/patroni/postgresql.yml list
+ Cluster: my-pg-cluster (7465686895147752418) -------+-----------+-----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+------------------+---------------+---------+-----------+-----+-----------+
| pg-node-1 | 192.168.1.101 | Leader | running | 236 | |
| pg-node-2 | 192.168.1.102 | Replica | streaming | 236 | 0 |
| pg-node-3 | 192.168.1.103 | Replica | streaming | 236 | 0 |
+------------------+---------------+---------+-----------+-----+-----------+
When should the restart take place (e.g. 2025-04-21T05:34) [now]:
Are you sure you want to restart members pg-node-1, pg-node-2, pg-node-3? [y/N]: y

Restart if the PostgreSQL version is less than provided (e.g. 9.5.2) []:
Success: restart on member pg-node-1
Success: restart on member pg-node-2
Success: restart on member pg-node-3

The output shows the cluster state before the restart request, prompts for confirmation, and reports successful initiation of the rolling restart on each member.

[root@pg-node-1 ~]# patronictl -c /etc/patroni/postgresql.yml list
+ Cluster: my-pg-cluster (7465686895147752418) -------+-----------+-----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+------------------+---------------+---------+-----------+-----+-----------+
| pg-node-1 | 192.168.1.101 | Leader | running | 236 | |
| pg-node-2 | 192.168.1.102 | Replica | streaming | 236 | 0 |
| pg-node-3 | 192.168.1.103 | Replica | streaming | 236 | 0 |
+------------------+---------------+---------+-----------+-----+-----------+

Explanation: Checking the cluster status again with patronictl list after the rolling restart confirms that all cluster members have successfully come back online and are in a healthy state (running for the primary, streaming for replicas) with minimal lag.

4.14. Optional: Perform a Patroni Switchover for Verification

### just incase primary/leader change to other node

patronictl -c /etc/patroni/postgresql.yml switchover --leader pg-node-3 --candidate pg-node-1 my-pg-cluster

Explanation: This command demonstrates initiating a manual switchover to test the failover mechanism post-upgrade or to return the primary role to a preferred node. It requests Patroni to transfer leadership from the current primary (pg-node-3 in this example, assuming a previous switchover or failover made it primary) to pg-node-1.

patronictl -c /etc/patroni/postgresql.yml list

Explanation: Running patronictl list after the switchover verifies that the primary role has successfully transitioned to the target node.

5. Performance Tuning Considerations

PostgreSQL performance tuning is a critical aspect of database administration, ensuring the system efficiently handles its workload. Many parameters, especially those that allocate memory or manage background processes, require a PostgreSQL instance restart to take effect. The "Pending restart reason" in patronictl list often highlights changes to such parameters.

Here's an explanation of common performance-related parameters and their tuning considerations:

autovacuum_max_workers:

Purpose: Controls the maximum number of autovacuum launcher processes that can run simultaneously. Autovacuum is essential for reclaiming space from updated or deleted rows and updating statistics for the query planner.
Tuning: Increasing this value (e.g., from 3 to 6) allows more autovacuum processes to run concurrently, which can improve the speed at which dead tuples are cleaned up and statistics are updated, especially on busy systems with high write activity. This helps prevent table bloat and ensures the query planner has up-to-date information, leading to better query performance.
Implications: More workers consume more CPU and I/O resources. Careful monitoring is needed to avoid resource contention.

huge_pages:

Purpose: Determines whether PostgreSQL attempts to use Linux "huge pages" for shared memory segments. Huge pages are larger memory pages (typically 2MB or 1GB) than standard 4KB pages.
Tuning: Setting this to on or try (as seen in try->off suggesting it was turned off) can improve performance by reducing Translation Lookaside Buffer (TLB) misses, which are CPU cache misses related to memory address translation. This can lead to lower CPU overhead for memory management, especially with large shared_buffers settings.
Implications: Requires proper operating system configuration (e.g., vm.nr_hugepages kernel parameter). If not configured correctly, PostgreSQL might fail to start or fall back to standard pages. Turning it off (as per the example) might be a troubleshooting step if huge pages were causing issues, or a decision to simplify memory management if the performance benefit wasn't realised or outweighed by complexity.

max_connections:

Purpose: Sets the maximum number of concurrent client connections that the PostgreSQL server will accept.
Tuning: Increasing this value (e.g., from 100 to 250) allows more applications or users to connect simultaneously. This is often necessary as application load grows.
Implications: Each connection consumes a certain amount of memory and CPU resources. Setting max_connections too high without sufficient RAM can lead to out-of-memory errors or severe performance degradation due to excessive swapping. It's crucial to balance this with available system resources and application connection pooling strategies.

max_replication_slots:

Purpose: Defines the maximum number of replication slots that can be defined on the primary server. Replication slots prevent the primary from removing WAL (Write-Ahead Log) segments until they have been consumed by all configured replicas or logical decoding clients.
Tuning: Increasing this value (e.g., from 10 to 15) allows for more replicas or logical decoding consumers to be configured. This is essential for scaling out read replicas or integrating with external systems that rely on logical decoding.
Implications: Each active replication slot retains WAL segments. If a replica or consumer associated with a slot falls behind or disconnects for an extended period, WAL files will accumulate on the primary, potentially filling up disk space. Careful monitoring of replication slot usage and lag is critical.

max_worker_processes:

Purpose: Sets the maximum number of background worker processes that PostgreSQL can launch. These are generic processes that can be used by various features, including parallel query execution, logical replication, and custom background tasks.
Tuning: Increasing this value (e.g., from 8 to 24) allows PostgreSQL to utilise more parallel processing capabilities for queries that can benefit from it, or to run more background tasks concurrently.
Implications: Each worker process consumes resources. Setting this too high can lead to resource contention. The actual number of parallel workers used by a query is also limited by max_parallel_workers_per_gather and other parameters.

shared_buffers:

Purpose: Determines the amount of memory PostgreSQL dedicates to shared memory buffers. This is where data pages are cached when read from disk.
Tuning: Increasing this value (e.g., from 128MB to 6GB) is often the most impactful performance tuning parameter. A larger shared_buffers allows more data to be held in memory, reducing the need to read from slower disk storage, especially for frequently accessed data.
Implications: This memory is shared by all PostgreSQL processes. Setting it too high can lead to memory exhaustion or excessive swapping if the system doesn't have enough physical RAM. A common recommendation is to set it to 25% of total system RAM, but this can vary based on workload and other applications running on the server.

superuser_reserved_connections:

Purpose: Specifies the number of connection slots reserved for PostgreSQL superusers. These slots are reserved even when max_connections has been reached, ensuring that administrators can always connect to troubleshoot or perform maintenance.
Tuning: Increasing this value (e.g., from 3 to 10) provides more reserved slots for superusers. This is primarily a safety and manageability setting rather than a direct performance tuning parameter.
Implications: These connections are part of max_connections. Increasing this too much reduces the number of available slots for regular application users.

wal_buffers:

Purpose: The amount of shared memory used for the Write-Ahead Log (WAL) buffers. WAL records are written to these buffers before being flushed to disk.
Tuning: Increasing this value (e.g., from 4MB to 16MB) can reduce the number of WAL buffer flushes to disk, potentially improving write performance, especially for workloads with many small transactions.
Implications: A larger wal_buffers consumes more shared memory. While generally beneficial for write-heavy workloads, excessively large values may not provide further benefits and can waste memory.

shared_preload_libraries:

Purpose: Specifies one or more shared libraries to be preloaded into the PostgreSQL server at startup. This is typically used for extensions that need to integrate deeply with PostgreSQL's internal workings, such as pg_tde, pg_stat_statements, or performance monitoring tools.
Tuning: Preloading libraries avoids the overhead of loading them on demand and allows them to hook into PostgreSQL's startup process. For performance, extensions like pg_stat_statements (for query analysis) or custom optimisers are often preloaded.
Implications: If a preloaded library has a bug or is incompatible, it can prevent PostgreSQL from starting. Each preloaded library consumes some memory.

General Tuning Principles:

Workload-Specific: Optimal tuning values are highly dependent on your specific workload (read-heavy, write-heavy, OLTP, OLAP), hardware resources (CPU, RAM, storage I/O), and application requirements.
Iterative Process: Performance tuning is an iterative process. Change one parameter at a time, monitor the impact, and then adjust further.
Monitoring is Key: Always monitor key metrics (CPU utilisation, memory usage, disk I/O, query response times, replication lag, autovacuum activity) before and after making changes to assess their effectiveness. Tools like pg_stat_statements, pg_activity, and external monitoring solutions are invaluable.
Documentation: Document all changes made, including the rationale and observed impact.

6. Post-Upgrade Verification

After completing the package upgrades and cluster restart on all nodes, perform the following comprehensive verification steps:

Cluster Status: Re-run patronictl list to confirm all nodes are healthy (running/streaming) and replication lag is minimal.
PostgreSQL Version: Connect to the database using psql on each node and verify the version using SELECT version(); to ensure it shows Percona Distribution for PostgreSQL 17.4.
Extension Loading: Connect to the database and verify that pg_tde and other expected extensions are loaded using SHOW shared_preload_libraries; and querying pg_available_extensions.
Log Files: Review PostgreSQL and Patroni logs on all nodes for any errors or warnings that occurred during or after the upgrade and restarts.
Application Connectivity: Test connectivity from your applications to the database cluster and verify basic read/write operations are successful.
Replication Health: Perform more detailed checks on replication status using SELECT * FROM pg_stat_replication; on the primary node.
Monitoring: Verify that your monitoring system is correctly collecting metrics from the upgraded cluster and that all nodes are reporting as healthy.

7. Handling Potential Issues

Package Upgrade Failure: If dnf upgrade fails on a node, review the error messages carefully. Attempt to resolve dependency issues or conflicts. If necessary, roll back the package changes on that node using dnf history rollback <transaction_id>. Do not start Patroni on a node with a failed package upgrade.
Patroni Restart Failure: If Patroni fails to start or the PostgreSQL instance doesn't become healthy after a restart (Step 4.7 or during the cluster restart in Step 4.13), check the Patroni logs (journalctl -u patroni) and PostgreSQL logs for error details. Common issues include configuration errors, port conflicts, or data directory problems.
Replication Issues: If replication breaks after a node restart or the cluster restart, check firewall rules, PostgreSQL configuration (e.g., wal_level, max_wal_senders), and logs. Patroni may attempt to rebuild replicas automatically, but manual intervention might be required in some cases (e.g., using patronictl remove --force and allowing Patroni to recreate the replica from the primary).
Rollback Plan: In case of severe issues that cannot be resolved, the primary rollback strategy is to restore the cluster from the validated backup taken before the upgrade.

8. Understanding patronictl list Output

Here's an explanation of the patronictl list command output, which provides a summary of your Patroni-managed PostgreSQL cluster:

Explanation of the Output:

+ Cluster: my-pg-cluster (7445859937569462303): This line identifies the name of your Patroni cluster (my-pg-cluster) and its unique internal ID.
| Member | Host | Role | State | TL | Lag in MB |: These are the standard columns providing essential information about each node in the cluster:

Member: The name Patroni uses for the specific PostgreSQL instance (e.g., pg-node-a).
Host: The IP address of the node.
Role: The current role of the PostgreSQL instance within the cluster.

Leader: This node is currently the primary PostgreSQL instance, handling all write operations and serving as the source for replication.
Replica: These nodes are standby PostgreSQL instances, receiving changes from the primary via streaming replication.

State: The current operational status of the PostgreSQL instance.

running: The PostgreSQL instance is active and operational.
streaming: The replica is actively receiving and applying changes from the primary.

TL (Timeline): Represents the PostgreSQL timeline ID. This increments on certain events, such as a failover or switchover, and helps ensure consistency in replication history. A consistent timeline across all nodes indicates healthy replication.
Lag in MB: The amount of replication lag, measured in megabytes, between the replica and the primary. A value of 0 indicates the replica is fully caught up.

| Pending restart | Pending restart reason |: This is the crucial part that indicates necessary actions.

Pending restart: The asterisk (*) in this column for all three nodes signifies that there are configuration changes that have been applied to the PostgreSQL configuration (either directly in postgresql.conf or via ALTER SYSTEM SET commands) but have not yet taken effect. For these changes to become active, the PostgreSQL instance on that specific node needs to be restarted. Patroni actively monitors for such pending changes and flags them here.
Pending restart reason: This column provides specific details about which PostgreSQL parameters have been modified and are awaiting a restart. In your output, it lists several parameters and their old and new values (e.g., autovacuum_max_workers: 3->6, shared_buffers: 128MB->6GB, wal_buffers: 4MB->16MB, etc.). The entry shared_preload_libraries: [hidden - too long] indicates that this parameter was also changed, but its full value isn't displayed due to length constraints in this output format.

In summary, this output indicates that your PostgreSQL cluster has several pending configuration changes across all its nodes that require a restart of each PostgreSQL instance for them to be fully applied and become active. Patroni is aware of these pending restarts and is ready to manage them.

To apply these changes and ensure your cluster is running with the updated configuration, you would typically perform a controlled rolling restart of the cluster using Patroni's command-line interface, for example:

patronictl -c /etc/patroni/postgresql.yml restart my-pg-cluster

This command would instruct Patroni to orchestrate the restarts of your PostgreSQL instances in a safe manner, typically restarting replicas first and then the primary, to minimise service disruption.

Conclusion

This comprehensive guide serves as a reference for performing minor version upgrades and understanding key diagnostic outputs for a Percona Distribution for PostgreSQL cluster managed by Patroni and etcd. By following these detailed steps and best practices, administrators can ensure a smooth upgrade process and maintain the high availability and performance of their PostgreSQL environment. Regular verification and adherence to security best practices are essential for a robust and secure database infrastructure.

Prepared By : Harisfazillah Jamel and Google Gemini, LinuxMalaysia. 26 Jul 2025.

How-To: Deploy Java 21 OpenJDK in an Air-Gapped Environment using yumdownloader

2025-07-26T05:39:00.002+08:00

How-To: Deploy Java 21 OpenJDK in an Air-Gapped Environment using yumdownloader

This guide outlines a robust process for deploying Java 21 OpenJDK in environments with no internet connectivity (air-gapped systems). It leverages the yumdownloader utility to efficiently gather all necessary RPM packages and their dependencies from an internet-connected host, enabling a secure and controlled installation on the isolated target system.

Prerequisites

To successfully follow this guide, ensure you have the following:

Internet-Connected Host:

A Linux machine with active internet access.
Crucially, this host should be running the same major and minor version of AlmaLinux, Red Hat Enterprise Linux (RHEL), or a compatible distribution as your air-gapped target. This ensures package compatibility and avoids unforeseen dependency issues.
An active RHEL subscription (if using RHEL) to access official repositories.
Alternative: RHEL 9 on Windows 11 WSL2
For users who prefer a Windows environment, you can set up a Red Hat Enterprise Linux 9 instance within Windows Subsystem for Linux 2 (WSL2) to serve as your internet-connected host. This provides a convenient way to access RHEL repositories and download packages. Remember to obtain the RHEL 9 image from the official Red Hat Developer program.

Air-Gapped Host:

The target Linux machine where Java 21 OpenJDK will be installed. This host must have absolutely no direct internet access.

Secure Transfer Mechanism:

A reliable and secure method to transfer files from the internet-connected host to the air-gapped host. Common methods include:

USB drive (ensure it's clean and secure)
Portable hard drive
Intermediate jump host with strict access controls
Secure local network share (if applicable and isolated)

Step-by-Step Guide

Step 1: Prepare the Internet-Connected Host

On your internet-connected AlmaLinux 9 (or equivalent RHEL/CentOS) host, we will use yumdownloader to collect all required RPMs.

Install yum-utils Package:
The yumdownloader utility is part of the yum-utils package. If it's not already installed, proceed with the installation.

sudo dnf install yum-utils

You will be prompted to confirm the installation. Type y and press Enter.

Verify OpenJDK 21 Package Name:
Before downloading, it's a good practice to confirm the exact package name for Java 21 OpenJDK available in your repositories.

dnf search openjdk

Look for the java-21-openjdk.x86_64 entry, which represents the primary runtime environment package.

Create a Dedicated Download Directory:

Establish a clean, dedicated directory to store all the downloaded RPM packages. This organization is vital for managing the numerous dependency files.

mkdir ~/openjdk-rpm-download

Download Java 21 OpenJDK and its Dependencies:

This is the core step. Use yumdownloader with the --resolve option to automatically identify and download all recursive dependencies of java-21-openjdk. The --downloaddir option directs where these RPMs will be saved.

yumdownloader java-21-openjdk --downloaddir ~/openjdk-rpm-download --resolve

java-21-openjdk: Specifies the primary package for which dependencies are to be resolved.
--downloaddir ~/openjdk-rpm-download: Sets the target directory for all downloaded RPM files.
--resolve: Crucial for air-gapped environments, this option ensures that yumdownloader fetches not only the specified package but also all its direct and indirect dependencies. This guarantees a self-contained set of RPMs for offline installation.

The download process may take some time, as OpenJDK has a significant number of dependencies (as observed in your previous output, around 130 packages).

Verify Downloaded Files:

Once the download operation completes, list the contents of your designated download directory to confirm that all expected RPM files are present.
ls ~/openjdk-rpm-download

You should see a comprehensive list of .rpm files, including java-21-openjdk-*.rpm and java-21-openjdk-headless-*.rpm, alongside all their required libraries and components.

Step 2: Transfer Files to the Air-Gapped Host

Securely move the entire ~/openjdk-rpm-download directory (containing all the collected RPM files) from your internet-connected host to a suitable location on the air-gapped target host.

Example using a USB Drive:

Copy to USB Drive (on Internet Host):

cp -r ~/openjdk-rpm-download /mnt/usb_drive/ # Adjust /mnt/usb_drive/ as per your system

Safely Unmount USB Drive (on Internet Host).
Connect USB Drive (to Air-Gapped Host).

Copy from USB Drive (on Air-Gapped Host):

cp -r /mnt/usb_drive/openjdk-rpm-download /opt/rpms/ # Adjust paths as needed

Step 3: Install Java 21 OpenJDK on the Air-Gapped Host

Manual Dependency Installation (For Learning/Debugging)

For those who wish to understand the dependency chain explicitly or debug specific issues, you can attempt to install packages one by one. This method is generally not recommended for production environments due to its tedious nature and potential for errors, but it is highly valuable for learning and precise dependency mapping.

Navigate to the RPM Directory:

cd /path/to/openjdk-rpm-download # Replace with the actual path where you transferred the RPMs

Attempt to Install the Main Package First:
Start by trying to install the primary java-21-openjdk package. This will reveal its immediate missing dependencies.

sudo rpm -Uvh java-21-openjdk-21.0.8.0.9-1.el9.alma.1.x86_64.rpm

You will likely see an error: Failed dependencies: output, similar to your original notes, listing all the immediate prerequisites. For example:
error: Failed dependencies:

fontconfig(x86-64) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64

java-21-openjdk-headless(x86-64) = 1:21.0.8.0.9-1.el9.alma.1 is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64

libX11.so.6()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64

... (many more dependencies)

Install Listed Dependencies Iteratively:
Go through the list of failed dependencies and install them one by one. After installing a set of dependencies, try installing the main package again. Repeat this process until all dependencies are satisfied.

Example Iteration:

# Install fontconfig

sudo rpm -Uvh fontconfig-*.rpm

# Install java-21-openjdk-headless (often a major dependency)

sudo rpm -Uvh java-21-openjdk-headless-*.rpm

# Install X11 libraries

sudo rpm -Uvh libX11-*.rpm libXcomposite-*.rpm libXext-*.rpm libXi-*.rpm libXrender-*.rpm libXtst-*.rpm xorg-x11-fonts-Type1-*.rpm

Note: You'll need to identify the exact RPM filenames from your ls ~/openjdk-rpm-download output. Using wildcards (*.rpm) can simplify this if only one version of each dependency is present.

Continue until Main Package Installs:
Keep repeating step 2, installing the newly reported missing dependencies, until sudo rpm -Uvh java-21-openjdk-*.rpm executes successfully without dependency errors.

This manual process provides deep insight into the package's dependencies but is significantly more time-consuming than the recommended sudo rpm -Uvh *.rpm approach, which leverages rpm's internal dependency resolver to handle the order automatically when all files are present.

To install all at once (you are confidence the dependencies don't break others packages), run the rpm -Uvh *.rpm command on the target systems. Prefer to install rpm one by one.

On your air-gapped host, navigate to the directory where you've placed the RPMs and proceed with the installation.

Install All Downloaded RPMs:

Since yumdownloader with --resolve has ensured that all dependencies are available locally, you can perform a single, comprehensive installation of all RPMs in the directory. The rpm -Uvh command will install new packages or upgrade existing ones, providing verbose output (-v) and a progress bar (-h).
sudo rpm -Uvh *.rpm

Note on Dependencies: Unlike your initial attempt to install only java-21-openjdk.rpm which failed due to missing dependencies, installing *.rpm in the directory ensures that rpm can find and satisfy all dependencies from the local set of files. This is the correct and most efficient method for air-gapped installations.

Verify Installation:

After the installation process completes, confirm that Java 21 OpenJDK has been successfully installed and is accessible on your air-gapped system.
java -version

You should observe output similar to the following, confirming the installed Java version:
openjdk version "21.0.8" 2025-07-16

OpenJDK Runtime Environment (build 21.0.8+9-LTS)

OpenJDK 64-Bit Server VM (build 21.0.8+9-LTS, mixed mode, sharing)

Advanced Considerations and Best Practices

Version Consistency: Reiterate the critical importance of ensuring the exact same major and minor Linux distribution version (e.g., AlmaLinux 9.x, RHEL 9.x) on both the internet-connected and air-gapped hosts. Even slight version mismatches can lead to library conflicts or unexpected behavior.
Automation with Ansible: For managing multiple air-gapped systems or automating routine updates, leveraging Ansible is highly recommended. Playbooks can be crafted to:

Execute yumdownloader on a designated "bastion" host with internet access.
Securely transfer the collected RPMs to a local repository or directly to target air-gapped servers (adhering to strict security protocols for data transfer).
Run the rpm -Uvh *.rpm command on the target systems.

Local Repository Management: For larger-scale air-gapped deployments, consider setting up a local YUM/DNF repository. This involves using tools like reposync to mirror external repositories and createrepo to generate metadata, providing a more robust and scalable solution for managing packages offline. While yumdownloader is excellent for individual package sets, a local repository offers greater flexibility for ongoing maintenance.

References and Further Reading

This section compiles all the external resources and documentation referenced in our discussion, providing avenues for deeper understanding and official guidance.

Red Hat Access: How to download an installed package, "yumdownloader" is useful.

URL: https://access.redhat.com/solutions/10154
Description: An official Red Hat solution article detailing the basic usage of yumdownloader for downloading RPM packages. This also covers using yumdownloader for installed packages.

Red Hat Access: How to use yum to download a package without installing it

URL: https://access.redhat.com/solutions/9934
Description: Another official Red Hat solution covering two methods for downloading packages without installation: the downloadonly plugin and yumdownloader. This was a key reference for understanding the --downloadonly option and --downloaddir option.

AlmaLinux Git: rpms/java-21-openjdk

URL: https://git.almalinux.org/rpms/java-21-openjdk
Description: The Git repository for the java-21-openjdk RPM in AlmaLinux. It provides insights into how OpenJDK packages are built and maintained, noting the shift to a single portable build for different RHEL major versions. This is useful for inspecting package specifics, build information, and dependencies at a deeper level.

Red Hat Developer Program: Download RHEL

URL: https://developers.redhat.com/products/rhel/download
Description: The official portal for developers to download Red Hat Enterprise Linux, crucial for obtaining compatible RHEL versions for your internet-connected host.

Red Hat Developer Program: Getting Started with RHEL on Windows Subsystem for Linux (WSL2)

URL: https://developers.redhat.com/articles/2025/05/20/getting-started-rhel-windows-subsystem-linux
Description: A comprehensive guide for setting up Red Hat Enterprise Linux (RHEL) within Windows Subsystem for Linux 2 (WSL2) on Windows 11. This enables developers and system administrators to run RHEL locally on Windows, facilitating the preparation of RPMs in a familiar environment.

Red Hat Customer Portal: Red Hat Enterprise Linux 9 Downloads (for WSL2)

URL: https://access.redhat.com/downloads/content/479/ver=/rhel---9/9.6/x86_64/product-software
Description: Direct download links for RHEL 9.x releases, specifically relevant for obtaining the necessary image to set up RHEL 9 within WSL2. This is essential for ensuring version parity between your source and target systems.

Prepared by Harisfazillah Jamel with the help of Google Gemini, LinuxMalaysia 26 Jul 2025.

Notes

Yumdownloader - RPM download

How to download java-21-openjdk using Yumdownloader from a host, to another host that in inside a airgap enviroments. to download an installed package, "yumdownloader" is useful. The download RPM can be transferred to the server without Internet connection.

Install the yum-utils package:

yum install yum-utils

Run the command followed by the desired package:

yumdownloader <package>

https://access.redhat.com/solutions/10154

Add --resolve to download dependencies with the rpm.

###########

Need to read

https://git.almalinux.org/rpms/java-21-openjdk

#########

For redhat better to install another redhat such as redhat for developer. We need to use same RHEL version major and minor.

https://developers.redhat.com/products/rhel/download

or for Windows11 WSL2

https://developers.redhat.com/articles/2025/05/20/getting-started-rhel-windows-subsystem-linux

For RHEL9

https://access.redhat.com/downloads/content/479/ver=/rhel---9/9.6/x86_64/product-software

##########

How to use yum to download a package without installing it
https://access.redhat.com/solutions/10154

OpenJDK21 Almalinux9 repository

https://git.almalinux.org/rpms/java-21-openjdk

The OpenJDK packages are now created from a single build which is then packaged for different major versions of Red Hat Enterprise Linux (RHEL). This allows the OpenJDK team to focus their efforts on the development and testing of this single build, rather than having multiple builds which only differ by the platform they were built on.

This does make rebuilding the package slightly more complicated than a normal package. Modifications should be made to the java-21-openjdk-portable.specfile file, which can be found with this README file in the source RPM or installed in the documentation tree by the java-21-openjdk-headless RPM.

Getting started with RHEL on WSL Windows

https://developers.redhat.com/articles/2025/05/20/getting-started-rhel-windows-subsystem-linux

Red Hat Enterprise Linux (RHEL) can now be used on Microsoft Windows Subsystem for Linux (WSL). This enables developers, system administrators, and other users to run RHEL, the leading enterprise Linux environment, locally on Windows.

In this article, we'll explore the steps to get started with RHEL on WSL and create customized RHEL images, enabling you to work seamlessly with Windows and Linux environments.

For RHEL9 WSL2 Download

https://access.redhat.com/downloads/content/479/ver=/rhel---9/9.6/x86_64/product-software

############

How to use yum to download a package without installing it
Solution Vérifié - Mis à jour 7 Août 2024 à 07h22 - English
Environnement

Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5

Question

How do I use yum to download a package without installing it?

Résolution

There are two ways to download a package without installing it.

One is using the "downloadonly" plugin for yum, the other is using "yumdownloader" utility.
Downloadonly plugin for yum

Install the package including "downloadonly" plugin:

Raw

(RHEL5)
# yum install yum-downloadonly

(RHEL6)
# yum install yum-plugin-downloadonly

Run yum command with "--downloadonly" option as follows:
Raw

# yum install --downloadonly --downloaddir=<directory> <package>

Confirm the RPM files are available in the specified download directory.

Note:

Before using the plugin, check /etc/yum/pluginconf.d/downloadonly.conf to confirm that this plugin is "enabled=1"
This is applicable for "yum install/yum update" and not for "yum groupinstall". Use "yum groupinfo" to identify packages within a specific group.
If only the package name is specified, the latest available package is downloaded (such as sshd). Otherwise, you can specify the full package name and version (such as httpd-2.2.3-22.el5).
If you do not use the --downloaddir option, files are saved by default in /var/cache/yum/ in rhel-{arch}-channel/packages
If desired, you can download multiple packages on the same command.
You still need to re-download the repodata if the repodata expires before you re-use the cache. By default it takes two hours to expire.

Yumdownloader

If downloading a installed package, "yumdownloader" is useful.

Install the yum-utils package:
Raw

# yum install yum-utils

Run the command followed by the desired package:
Raw

# yumdownloader <package>

Note:

The package is saved in the current working directly by default; use the --destdir option to specify an alternate location.
Be sure to add --resolve if you need to download dependencies

########## this example is using Almalinux9

package name java-21-openjdk and other dependencies.

1) On the node thats has Internet.

Install yumdownloader

dnf install yum-utils

[root@LinuxMalaysia-MIFOMBP ~]# dnf install yum-utils
Last metadata expiration check: 0:02:13 ago on Sat 26 Jul 2025 04:22:10 AM +08.
Dependencies resolved.
==========================================================================================================================================================================
Package Architecture Version Repository Size
==========================================================================================================================================================================
Installing:
yum-utils noarch 4.3.0-20.el9 baseos 35 k
Upgrading:
dnf-plugins-core noarch 4.3.0-20.el9 baseos 36 k
python3-dnf-plugins-core noarch 4.3.0-20.el9 baseos 246 k

Transaction Summary
==========================================================================================================================================================================
Install 1 Package
Upgrade 2 Packages

Total download size: 316 k

Is this ok [y/N]: y
Downloading Packages:
(1/3): dnf-plugins-core-4.3.0-20.el9.noarch.rpm 175 kB/s | 36 kB 00:00
(2/3): yum-utils-4.3.0-20.el9.noarch.rpm 158 kB/s | 35 kB 00:00
(3/3): python3-dnf-plugins-core-4.3.0-20.el9.noarch.rpm 822 kB/s | 246 kB 00:00
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 175 kB/s | 316 kB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Upgrading : python3-dnf-plugins-core-4.3.0-20.el9.noarch 1/5
warning: Unable to get systemd shutdown inhibition lock: Could not activate remote peer.

Upgrading : dnf-plugins-core-4.3.0-20.el9.noarch 2/5
Installing : yum-utils-4.3.0-20.el9.noarch 3/5
Cleanup : dnf-plugins-core-4.3.0-16.el9.noarch 4/5
Cleanup : python3-dnf-plugins-core-4.3.0-16.el9.noarch 5/5
Running scriptlet: python3-dnf-plugins-core-4.3.0-16.el9.noarch 5/5
Verifying : yum-utils-4.3.0-20.el9.noarch 1/5
Verifying : dnf-plugins-core-4.3.0-20.el9.noarch 2/5
Verifying : dnf-plugins-core-4.3.0-16.el9.noarch 3/5
Verifying : python3-dnf-plugins-core-4.3.0-20.el9.noarch 4/5
Verifying : python3-dnf-plugins-core-4.3.0-16.el9.noarch 5/5

Upgraded:
dnf-plugins-core-4.3.0-20.el9.noarch python3-dnf-plugins-core-4.3.0-20.el9.noarch
Installed:
yum-utils-4.3.0-20.el9.noarch

Complete!

####

[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]# dnf search openjdk
AlmaLinux 9 - AppStream 2.2 MB/s | 14 MB 00:06
AlmaLinux 9 - BaseOS 2.3 MB/s | 15 MB 00:06
AlmaLinux 9 - Extras 13 kB/s | 20 kB 00:01
==================================================================== Name & Summary Matched: openjdk =====================================================================
ant-openjdk11.noarch : OpenJDK 11 binding for Ant
ant-openjdk17.noarch : OpenJDK 17 binding for Ant
ant-openjdk21.noarch : OpenJDK 21 binding for Ant
ant-openjdk8.noarch : OpenJDK 8 binding for Ant
java-1.8.0-openjdk.x86_64 : OpenJDK 8 Runtime Environment
java-1.8.0-openjdk-demo.x86_64 : OpenJDK 8 Demos
java-1.8.0-openjdk-devel.x86_64 : OpenJDK 8 Development Environment
java-1.8.0-openjdk-headless.x86_64 : OpenJDK 8 Headless Runtime Environment
java-1.8.0-openjdk-javadoc.noarch : OpenJDK 8 API documentation
java-1.8.0-openjdk-javadoc-zip.noarch : OpenJDK 8 API documentation compressed in a single archive
java-1.8.0-openjdk-src.x86_64 : OpenJDK 8 Source Bundle
java-11-openjdk.x86_64 : OpenJDK 11 Runtime Environment
java-11-openjdk-demo.x86_64 : OpenJDK 11 Demos
java-11-openjdk-devel.x86_64 : OpenJDK 11 Development Environment
java-11-openjdk-headless.x86_64 : OpenJDK 11 Headless Runtime Environment
java-11-openjdk-javadoc.x86_64 : OpenJDK 11 API documentation
java-11-openjdk-javadoc-zip.x86_64 : OpenJDK 11 API documentation compressed in a single archive
java-11-openjdk-jmods.x86_64 : JMods for OpenJDK 11
java-11-openjdk-src.x86_64 : OpenJDK 11 Source Bundle
java-11-openjdk-static-libs.x86_64 : OpenJDK 11 libraries for static linking
java-17-openjdk.x86_64 : OpenJDK 17 Runtime Environment
java-17-openjdk-demo.x86_64 : OpenJDK 17 Demos
java-17-openjdk-devel.x86_64 : OpenJDK 17 Development Environment
java-17-openjdk-headless.x86_64 : OpenJDK 17 Headless Runtime Environment
java-17-openjdk-javadoc.x86_64 : OpenJDK 17 API documentation
java-17-openjdk-javadoc-zip.x86_64 : OpenJDK 17 API documentation compressed in a single archive
java-17-openjdk-jmods.x86_64 : JMods for OpenJDK 17
java-17-openjdk-src.x86_64 : OpenJDK 17 Source Bundle
java-17-openjdk-static-libs.x86_64 : OpenJDK 17 libraries for static linking
java-21-openjdk.x86_64 : OpenJDK 21 Runtime Environment
java-21-openjdk-demo.x86_64 : OpenJDK 21 Demos
java-21-openjdk-devel.x86_64 : OpenJDK 21 Development Environment
java-21-openjdk-headless.x86_64 : OpenJDK 21 Headless Runtime Environment
java-21-openjdk-javadoc.x86_64 : OpenJDK 21 API documentation
java-21-openjdk-javadoc-zip.x86_64 : OpenJDK 21 API documentation compressed in a single archive
java-21-openjdk-jmods.x86_64 : JMods for OpenJDK 21
java-21-openjdk-src.x86_64 : OpenJDK 21 Source Bundle
java-21-openjdk-static-libs.x86_64 : OpenJDK 21 libraries for static linking
maven-openjdk11.noarch : OpenJDK 11 binding for Maven
maven-openjdk17.noarch : OpenJDK 17 binding for Maven
maven-openjdk21.noarch : OpenJDK 21 binding for Maven
maven-openjdk8.noarch : OpenJDK 8 binding for Maven

####

2) create the needed directory

mkdir ~/openjdk-rpm-download

3) Download the package

yumdownloader java-21-openjdk --downloaddir ~/openjdk-rpm-download --resolve

####

[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]# rm -f *
[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]# yumdownloader java-21-openjdk --downloaddir ~/openjdk-rpm-download --resolve
Last metadata expiration check: 0:04:58 ago on Sat 26 Jul 2025 04:22:10 AM +08.
(1/130): graphite2-1.3.14-9.el9.x86_64.rpm 366 kB/s | 94 kB 00:00
(2/130): geoclue2-2.6.0-8.el9_6.1.x86_64.rpm 453 kB/s | 122 kB 00:00
(3/130): fdk-aac-free-2.0.0-8.el9.x86_64.rpm 1.0 MB/s | 324 kB 00:00
(4/130): libproxy-0.4.15-35.el9.x86_64.rpm 940 kB/s | 73 kB 00:00
(5/130): libpng-1.6.37-12.el9.x86_64.rpm 1.1 MB/s | 116 kB 00:00
(6/130): pango-1.48.7-3.el9.x86_64.rpm 1.3 MB/s | 297 kB 00:00
(7/130): harfbuzz-2.7.4-10.el9.x86_64.rpm 1.4 MB/s | 623 kB 00:00
(8/130): gsettings-desktop-schemas-40.0-6.el9.x86_64.rpm 1.0 MB/s | 666 kB 00:00
(8/130): gsettings-desktop-schemas-40.0-6.el9.x86_64.rpm 2% [=- ] 1.4 MB/s | 3.0 MB 01:19 ETA

.........

(114/130): at-spi2-core-2.40.3-1.el9.x86_64.rpm 679 kB/s | 176 kB 00:00
(115/130): libXtst-1.2.3-16.el9.x86_64.rpm 108 kB/s | 20 kB 00:00
(116/130): atk-2.36.0-5.el9.x86_64.rpm 621 kB/s | 270 kB 00:00
(117/130): libproxy-webkitgtk4-0.4.15-35.el9.x86_64.rpm 148 kB/s | 20 kB 00:00
(118/130): low-memory-monitor-2.1-4.el9.x86_64.rpm 234 kB/s | 35 kB 00:00
(119/130): hicolor-icon-theme-0.17-13.el9.noarch.rpm 400 kB/s | 65 kB 00:00
(120/130): lua-5.4.4-4.el9.x86_64.rpm 723 kB/s | 187 kB 00:00
(121/130): gtk3-3.24.31-5.el9.x86_64.rpm 940 kB/s | 4.8 MB 00:05
(122/130): lua-posix-35.0-8.el9.x86_64.rpm 727 kB/s | 131 kB 00:00
(123/130): libgusb-0.3.8-2.el9.x86_64.rpm 434 kB/s | 50 kB 00:00
(124/130): libasyncns-0.8-22.el9.x86_64.rpm 426 kB/s | 29 kB 00:00
(125/130): rtkit-0.11-29.el9.x86_64.rpm 548 kB/s | 55 kB 00:00
(126/130): gdk-pixbuf2-2.42.6-4.el9_4.x86_64.rpm 879 kB/s | 466 kB 00:00
(127/130): gdk-pixbuf2-modules-2.42.6-4.el9_4.x86_64.rpm 586 kB/s | 85 kB 00:00
(128/130): avahi-glib-0.8-22.el9_6.1.x86_64.rpm 261 kB/s | 13 kB 00:00
(129/130): libicu-67.1-9.el9.x86_64.rpm 1.5 MB/s | 9.6 MB 00:06
(130/130): java-21-openjdk-headless-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 2.7 MB/s | 48 MB 00:18
[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]#

[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]# ls
abattis-cantarell-fonts-0.301-4.el9.noarch.rpm libatomic-11.5.0-5.el9_5.alma.1.x86_64.rpm libXrender-0.9.10-16.el9.x86_64.rpm
adobe-source-code-pro-fonts-2.030.1.050-12.el9.1.noarch.rpm libcanberra-0.30-27.el9.x86_64.rpm libXtst-1.2.3-16.el9.x86_64.rpm
adwaita-cursor-theme-40.1.1-3.el9.noarch.rpm libcanberra-gtk3-0.30-27.el9.x86_64.rpm lksctp-tools-1.0.19-3.el9_4.x86_64.rpm
adwaita-icon-theme-40.1.1-3.el9.noarch.rpm libdatrie-0.2.13-4.el9.x86_64.rpm low-memory-monitor-2.1-4.el9.x86_64.rpm
alsa-lib-1.2.13-2.el9.x86_64.rpm libepoxy-1.5.5-4.el9.x86_64.rpm lua-5.4.4-4.el9.x86_64.rpm
atk-2.36.0-5.el9.x86_64.rpm libfontenc-1.1.3-17.el9.x86_64.rpm lua-posix-35.0-8.el9.x86_64.rpm
at-spi2-atk-2.38.0-4.el9.x86_64.rpm libgusb-0.3.8-2.el9.x86_64.rpm mkfontscale-1.2.1-3.el9.x86_64.rpm
at-spi2-core-2.40.3-1.el9.x86_64.rpm libicu-67.1-9.el9.x86_64.rpm ModemManager-glib-1.20.2-1.el9.x86_64.rpm
avahi-glib-0.8-22.el9_6.1.x86_64.rpm libjpeg-turbo-2.0.90-7.el9.x86_64.rpm nspr-4.35.0-17.el9_2.x86_64.rpm
avahi-libs-0.8-22.el9_6.1.x86_64.rpm libldac-2.0.2.3-10.el9.x86_64.rpm nss-3.101.0-10.el9_2.x86_64.rpm
bluez-libs-5.72-4.el9.x86_64.rpm libnotify-0.7.9-8.el9.x86_64.rpm nss-softokn-3.101.0-10.el9_2.x86_64.rpm
cairo-1.17.4-7.el9.x86_64.rpm libogg-1.3.4-6.el9.x86_64.rpm nss-softokn-freebl-3.101.0-10.el9_2.x86_64.rpm
cairo-gobject-1.17.4-7.el9.x86_64.rpm libpng-1.6.37-12.el9.x86_64.rpm nss-sysinit-3.101.0-10.el9_2.x86_64.rpm
colord-libs-1.4.5-6.el9_6.x86_64.rpm libproxy-0.4.15-35.el9.x86_64.rpm nss-util-3.101.0-10.el9_2.x86_64.rpm
copy-jdk-configs-4.0-3.el9.noarch.rpm libproxy-webkitgtk4-0.4.15-35.el9.x86_64.rpm opus-1.3.1-10.el9.x86_64.rpm
cups-libs-2.3.3op2-33.el9.x86_64.rpm libsbc-1.4-9.el9.x86_64.rpm pango-1.48.7-3.el9.x86_64.rpm
dconf-0.40.0-6.el9.x86_64.rpm libsndfile-1.0.31-9.el9.x86_64.rpm pipewire-1.0.1-1.el9.x86_64.rpm
fdk-aac-free-2.0.0-8.el9.x86_64.rpm libsoup-2.72.0-10.el9_6.2.x86_64.rpm pipewire-alsa-1.0.1-1.el9.x86_64.rpm
flac-libs-1.3.3-10.el9_2.1.x86_64.rpm libstemmer-0-18.585svn.el9.x86_64.rpm pipewire-jack-audio-connection-kit-1.0.1-1.el9.x86_64.rpm
fontconfig-2.14.0-2.el9_1.x86_64.rpm libtdb-1.4.12-1.el9.x86_64.rpm pipewire-jack-audio-connection-kit-libs-1.0.1-1.el9.x86_64.rpm
freetype-2.10.4-10.el9_5.x86_64.rpm libthai-0.1.28-8.el9.x86_64.rpm pipewire-libs-1.0.1-1.el9.x86_64.rpm
fribidi-1.0.10-6.el9.2.x86_64.rpm libtiff-4.4.0-13.el9.x86_64.rpm pipewire-pulseaudio-1.0.1-1.el9.x86_64.rpm
fuse-2.9.9-17.el9.x86_64.rpm libtool-ltdl-2.4.6-46.el9.x86_64.rpm pixman-0.40.0-6.el9_3.x86_64.rpm
fuse-common-3.10.2-9.el9.x86_64.rpm libtracker-sparql-3.1.2-3.el9_1.x86_64.rpm polkit-0.117-13.el9.x86_64.rpm
fuse-libs-2.9.9-17.el9.x86_64.rpm libusbx-1.0.26-1.el9.x86_64.rpm polkit-libs-0.117-13.el9.x86_64.rpm
gdk-pixbuf2-2.42.6-4.el9_4.x86_64.rpm libvorbis-1.3.7-5.el9.x86_64.rpm polkit-pkla-compat-0.1-21.el9.x86_64.rpm
gdk-pixbuf2-modules-2.42.6-4.el9_4.x86_64.rpm libwayland-client-1.21.0-1.el9.x86_64.rpm pulseaudio-libs-15.0-3.el9.x86_64.rpm
geoclue2-2.6.0-8.el9_6.1.x86_64.rpm libwayland-cursor-1.21.0-1.el9.x86_64.rpm rtkit-0.11-29.el9.x86_64.rpm
glib-networking-2.68.3-3.el9.x86_64.rpm libwayland-egl-1.21.0-1.el9.x86_64.rpm shared-mime-info-2.1-5.el9.x86_64.rpm
graphite2-1.3.14-9.el9.x86_64.rpm libwebp-1.2.0-8.el9_3.x86_64.rpm sound-theme-freedesktop-0.8-17.el9.noarch.rpm
gsettings-desktop-schemas-40.0-6.el9.x86_64.rpm libX11-1.7.0-11.el9.x86_64.rpm tracker-3.1.2-3.el9_1.x86_64.rpm
gsm-1.0.19-6.el9.x86_64.rpm libX11-common-1.7.0-11.el9.noarch.rpm ttmkfdir-3.0.9-65.el9.x86_64.rpm
gstreamer1-1.22.12-3.el9.x86_64.rpm libXau-1.0.9-8.el9.x86_64.rpm tzdata-java-2025b-1.el9.noarch.rpm
gtk3-3.24.31-5.el9.x86_64.rpm libxcb-1.13.1-9.el9.x86_64.rpm webkit2gtk3-jsc-2.48.3-1.el9_6.x86_64.rpm
gtk-update-icon-cache-3.24.31-5.el9.x86_64.rpm libXcomposite-0.4.5-7.el9.x86_64.rpm webrtc-audio-processing-0.3.1-8.el9.x86_64.rpm
harfbuzz-2.7.4-10.el9.x86_64.rpm libXcursor-1.2.0-7.el9.x86_64.rpm wireplumber-0.4.14-1.el9.x86_64.rpm
hicolor-icon-theme-0.17-13.el9.noarch.rpm libXdamage-1.1.5-7.el9.x86_64.rpm wireplumber-libs-0.4.14-1.el9.x86_64.rpm
java-21-openjdk-21.0.8.0.9-1.el9.alma.1.x86_64.rpm libXext-1.3.4-8.el9.x86_64.rpm xdg-desktop-portal-1.12.6-1.el9.x86_64.rpm
java-21-openjdk-headless-21.0.8.0.9-1.el9.alma.1.x86_64.rpm libXfixes-5.0.3-16.el9.x86_64.rpm xdg-desktop-portal-gtk-1.12.0-3.el9.x86_64.rpm
javapackages-filesystem-6.4.0-1.el9.noarch.rpm libXft-2.3.3-8.el9.x86_64.rpm xkeyboard-config-2.33-2.el9.noarch.rpm
jbigkit-libs-2.1-23.el9.x86_64.rpm libXi-1.7.10-8.el9.x86_64.rpm xml-common-0.6.3-58.el9.noarch.rpm
json-glib-1.6.6-1.el9.x86_64.rpm libXinerama-1.1.4-10.el9.x86_64.rpm xorg-x11-fonts-Type1-7.5-33.el9.noarch.rpm
lcms2-2.12-3.el9.x86_64.rpm libxkbcommon-1.0.3-4.el9.x86_64.rpm
libasyncns-0.8-22.el9.x86_64.rpm libXrandr-1.5.2-8.el9.x86_64.rpm
[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]#

#############

Transfer all this files to airgap host.

#########

Installation need to run one by one, start with the main RPM that we realy want to install. Such as java-21-openjdk. Tried to minimum what we want to install.

[root@LinuxMalaysia-MIFOMBP openjdk-rpm-download]# rpm -Uvh java-21-openjdk-21.0.8.0.9-1.el9.alma.1.x86_64.rpm
error: Failed dependencies:
fontconfig(x86-64) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
java-21-openjdk-headless(x86-64) = 1:21.0.8.0.9-1.el9.alma.1 is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libX11.so.6()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libXcomposite(x86-64) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libXext.so.6()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libXi.so.6()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libXrender.so.1()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
libXtst.so.6()(64bit) is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64
xorg-x11-fonts-Type1 is needed by java-21-openjdk-1:21.0.8.0.9-1.el9.alma.1.x86_64

Download And Use latest Version Of Nginx Stable

2024-06-19T06:13:00.004+08:00

Download And Use latest Version Of Nginx Stable

To ensure you receive the latest security updates and bug fixes for Nginx, configure your system's repository specifically for it. Detailed instructions on how to achieve this can be found on the Nginx website. Setting up the repository allows your system to automatically download and install future Nginx updates, keeping your web server running optimally and securely.

Visit this websites for information on how to configure your repository for Nginx.

https://nginx.org/en/linux_packages.html

https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/

Installing Nginx on different Linux distributions

Example from https://docs.bunkerweb.io/latest/integrations/#linux

Ubuntu

sudo apt install -y curl gnupg2 ca-certificates lsb-release debian-archive-keyring && \
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
| sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/debian `lsb_release -cs` nginx" \
| sudo tee /etc/apt/sources.list.d/nginx.list

# Latest Stable (pick either latest stable or by version)

sudo apt update && \
sudo apt install -y nginx

# By version (pick one only, latest stable or by version)

sudo apt update && \
sudo apt install -y nginx=1.24.0-1~$(lsb_release -cs)

# Latest

sudo apt update && \
sudo apt install -y nginx

AlmaLinux / Rocky Linux (Redhat)

Create the following file at /etc/yum.repos.d/nginx.repo

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

# Latest Stable (pick either latest stable or by version)

sudo dnf install nginx

# Latest Stable (pick either latest stable or by version)

sudo dnf install nginx-1.24.0

Harisfazillah Jamel - LinuxMalaysia - 20240619

Online Security Tools for Website Owners

2024-06-15T14:36:00.006+08:00

Online Security Tools for Website Owners

Introduction

In today's digital landscape, website security is paramount. From protecting user data to maintaining trust, strong security measures are essential. This blog post explores five valuable online tools that can empower website owners to take charge of their online security.

The Risks of Poor Website Security

Inadequate website security can lead to a host of issues, including data breaches, loss of customer trust, and significant financial losses. Hackers can exploit vulnerabilities to steal sensitive information, inject malicious code, or take down your site altogether. The consequences of a security breach can be devastating, both in terms of reputation and legal repercussions.

Benefits of Robust Security Measures

On the flip side, strong security measures can protect your website from these threats, ensuring the safety of user data and maintaining the trust of your visitors. By proactively addressing security issues, you can create a safer online environment, which can lead to higher user engagement and loyalty.

1. OpenDNS CacheCheck ( https://cachecheck.opendns.com/ )

OpenDNS is a popular Domain Name System (DNS) service provider. Large caches contribute to OpenDNS's speed, but sometimes outdated information might linger. CacheCheck allows you to see what OpenDNS customers see when they request your domain. If discrepancies arise, you can refresh OpenDNS's cache for that domain, ensuring visitors receive the latest version of your website.

Using CacheCheck can help you maintain the accuracy and timeliness of your website's data as seen by users. This ensures that any changes you make are quickly reflected, minimizing the risk of users encountering outdated content.

2. SSLMate CT Policy Analyzer ( https://sslmate.com/labs/ct_policy_analyzer/ )

Secure Sockets Layer (SSL) certificates encrypt communication between your website and visitors. Apple and Chrome have implemented Certificate Transparency (CT) policies to ensure SSL certificate validity. To combat SSL certificate misuse, Apple and Chrome have implemented Certificate Transparency (CT) policies. These policies require SSL certificates to be logged in public CT logs, which helps identify and prevent fraudulent certificates. The SSLMate CT Policy Analyzer checks if your website's SSL certificate adheres to these CT policies. If not, it's crucial to contact your certificate authority and obtain a compliant certificate to avoid browser warnings for your visitors.

3. SSL Certificate Checkers

ImmuniWeb ( https://www.immuniweb.com/ssl )

SSL/TLS certificates play a vital role in website security. Regular SSL certificate checks are essential. ImmuniWeb goes beyond basic checks, ensuring your website's SSL configuration complies with industry standards and regulations like PCI DSS, GDPR, and NIST. This ensures strong encryption and protects your visitors from data breaches.

Qualys, Inc. SSL Labs ( https://www.ssllabs.com/ssltest )

Qualys, Inc SSL Labs identifies potential vulnerabilities and suggests improvements. Use this tool to maintain strong SSL security and foster trust with your visitors. Using SSL Labs can help you pinpoint weak spots in your SSL setup and make the necessary improvements to enhance your website's security and build user trust.

4. Netcraft Site Report ( https://sitereport.netcraft.com/ )

Understanding the technologies powering a website can reveal potential security implications. Netcraft Site Report leverages internet data mining to reveal the infrastructure and technologies used by any website. This tool can reveal valuable insights, such as the web server software, hosting provider, and security features in use. This information can help you understand potential security implications and make informed decisions about your website's architecture.

5. Security Headers Check ( https://securityheaders.com/ )

Security headers are special directives sent by a web server to a browser. These headers play a crucial role in website security by offering protection against various threats. Security Headers offers a free service that analyzes your website's HTTP response headers and assigns a security rating. The tool also provides guidance on implementing missing headers, helping you improve your website's security posture.

By incorporating these online tools into your website security routine, you can gain valuable insights, identify and address vulnerabilities, and ultimately create a more secure online environment for your website and its visitors. Remember, online security is an ongoing process. Regular use of these tools and staying informed about evolving threats will empower you to safeguard your website and maintain user trust.

Improve by ChatGPT and Google Gemini

Harisfazillah Jamel

15 June 2024

Check Your Email Sender Authentication Schemes

2020-11-17T19:54:00.000+08:00

Check Your Email Sender Authentication schemes

You can email to ping@tools.mxtoolbox.com to check your email server sender authentication schemes setup. This will help you to determine the reasons your email mark as SPAM when you send email to your friends. Your email server must a least have one of them. Example Email Sender Authentication schemes are DKIM, Domain Keys, Sender ID and SPF.

More information about your email send to ping@tools.mxtoolbox.com

https://mxtoolbox.com/deliverability

New effort to combat SPAM and spoofed email.

Domain-based Message Authentication, Reporting & Conformance

http://dmarc.org/

Archive message from old post publish
31/01/2012 10:59

Email auto respond from sa-test@sendmail.net

sendmail.net Sender Authentication Auto-Responder $Revision: 1.19 $

This service runs at and allows remote users

to perform a simple, automated test to see if different Sender

Authentication schemes are working. Mail sent to this service

is checked by our Sender Authentication filters for any valid

credentials or signatures. A script receives the message, checks

for a special header with the results of the tests, and composes

this response message based on what it finds. This response is also

signed with DomainKeys and DomainKeys Identified Mail (DKIM).

Please note that the DKIM filter signing this reply message conforms

to the latest IETF draft version, and thus may not be successfully

verified by older implementations. If you are using dkim-filter from

Sendmail, Inc., upgrade to at least version 1.0.0 to be compatible

with the most recent version of DKIM.

We hope this service has been helpful to you.

Authentication System: DomainKeys Identified Mail

Result: DKIM signature confirmed GOOD

Description: Signature verified, message arrived intact

Reporting host: sendmail.net

More information: http://mipassoc.org/dkim/

Sendmail milter: https://sourceforge.net/projects/dkim-milter/

Authentication System: Domain Keys

Result: (no result present)

Reporting host:

More information: http://antispam.yahoo.com/domainkeys

Sendmail milter: https://sourceforge.net/projects/domainkeys-milter/

Authentication System: Sender ID

Result: SID data confirmed GOOD

Description: Sending host is authorized for sending domain

Reporting host: sendmail.net

More information: http://www.microsoft.com/senderid

Sendmail milter: https://sourceforge.net/projects/sid-milter/

Authentication System: Sender Permitted From (SPF)

Result: SPF data confirmed GOOD

Description: Sending host is authorized for sending domain

Reporting host: sendmail.net

More information: http://spf.pobox.com/

Usaha Menubuhkan Jabatan IT Negara dan melantik Ketua Perkhidmatan daripada Profesional ICT

2018-11-25T12:37:00.002+08:00

Saya menyokong gesaan ini kerana ia bertujuan untuk mewujudkan jabatan IT Negara dalam Pentadbiran Kerajaan Malaysia. Dan Ketua utamanya adalah daripada pegawai IT Kerajaan yang layak dan seterusnya memusatkan sumber manusia IT kerajaan, diantaranya.

https://goo.gl/UcfzSu

Dengan pemusatan sumber manusia, kemahiran dan pengalaman pegawai-pegawai IT dapat disumbangkan dengan lebih meluas kepada semua agensi-agensi dan jabatan-jabatan dalam pentadbiran Kerajaan Malaysia. Tanpa ianya terhad kepada agensi dimana pegawai itu berada. Ia turut memperkasakan pengetahuan pegawai-pegawai IT Kerajaan kerana sumber ilmu dapat dikongsikan secara berpusat.

===

Saya panjangkan, daripada rakan-rakan ICT kepada yang lain. Atau baca di laman gesaan ini https://goo.gl/UcfzSu

https://www.change.org/p/government-of-malaysia-kerajaan-perlu-menubuhkan-jabatan-it-dan-melantik-ketua-perkhidmatan-drpd-profesional-it

Ringkasan, gesaan ini adalah bertujuan untuk mewujudkan jabatan IT Negara dalam Pentadbiran Kerajaan Malaysia. Dan Ketua utamanya adalah daripada pegawai IT Kerajaan yang layak dan seterusnya memusatkan sumber manusia IT kerajaan.

Dipanjangkan oleh Harisfazillah Jamel. 25 Nov 2018.

=========

Usaha Menubuhkan Jabatan IT Negara dan melantik Ketua Perkhidmatan daripada Profesional ICT.

Assalamualaikum dan salam sejahtera, Mohon kawan-kawan sebarkan dan viralkan petition berkenaan skim perkhidmatan skim teknologi maklumat ini. Terima kasih.

PENGENALAN.

Keputusan kabinet berkenaan perpindahan MAMPU ke Kementerian Komunikasi dan Multimedia Malaysia (KKMM) melalui surat bertajuk Cadangan Rasionalisasi Struktur Jabatan Perdana Menteri bertarikh 28 Jun 2018 dilihat sebagai reformasi baharu ke arah meningkatkan daya saing Teknologi Maklumat (IT) Sektor Awam. Ia seiring dengan fungsi agensi berteraskan IT lain yang diletakkan di bawah KKMM seperti Suruhanjaya Komunikai dan Multimedia Malaysia (SKMM) dan Malaysia Digital Economy Corporation (MDEC). Namun begitu, arahan bertarikh 12 Oktober 2018 untuk mengekalkan MAMPU kembali di bawah Jabatan Perdana Menteri (JPM) melalui surat bertajuk Perakuan Pindaan Waran Perjawatan Berikutan Perubahan Semula Senarai Agensi di bawah Program Kementerian Komunikasi dan Multimedia Malaysia Tahun 2018, telah menimbulkan tanda tanya kepada banyak pihak.

Keputusan mengembalikan fungsi teras IT di bawah MAMPU dilihat tidak seiring dengan amalan terbaik negara maju seperti di United Kingdom melalui Government Digital Service, Australia melalui Digital Tranformation Office, Singapura melalui Govtech dan Korea Selatan melalui National Computing and Information Service. Prestasi perkhidmatan dalam talian negara tersebut dilihat lebih signifikan dan berdaya saing dengan meletakkan ICT sebagai satu entiti yang berautoriti bagi menjalankan aktiviti khusus berkaitan penyelidikan dan pembangunan khusus berkaitan ICT. Model ini seharusnya diadaptasi di Malaysia bagi memastikan prestasi perkhidmatan IT kerajaan yang lebih baik ke arah pembangunan yang mapan.

RESOLUSI.

Sehubungan dengan itu, kami mendesak agar pihak kerajaan mengkaji semula keputusan ini dengan mempertimbangkan dua (2) resolusi utama yang didatangkan bersama petisyen ini iaitu:

#1 MENUBUHKAN JABATAN IT.

Jabatan IT sebagai entiti yang berautoriti secara khusus dengan memberi fokus kepada reformasi pendigitalan penyampaian kerajaan meliputi aktiviti berkaitan penggubalan akta/dasar/polisi, penyelidikan, pembangunan, pelaksanaan dan penguatkuasaan program di bawah Pelan Pendigitalan Penyampaian Perkhidmatan Kerajaan yang diluluskan oleh Jemaah Menteri pada 11 Oktober 2017 serta aktiviti berkaitan IT Sektor Awam. Jabatan IT juga berperanan penting bagi menyelaras aktiviti tersebut merentasi kementerian dan agensi. Menerui Jabatan IT, perkhidmatan dapat dikoordinasi dengan lebih baik serta mengatasi pertindanan dan birokrasi di antara agensi bagi mengembalikan semula tahap penerimaan dan kepercayaan rakyat terhadap perkhidmatan dalam talian kerajaan.

#2 MELANTIK KETUA PERKHIDMATAN DARIPADA PROFESIONAL IT.

Sektor IT kerajaan hendaklah diterajui oleh Ketua Perkhidmatan dari kalangan Pegawai Skim Teknologi Maklumat (F) dan dianggotai oleh pegawai profesional yang berpengetahuan di dalam bidang IT. Ia penting bagi memastikan keputusan dasar yang lebih tepat dan realistik seiring dengan tuntutan semasa rakyat dan perubahan pantas ekosistem perkhidmatan kerajaan serta memacu profesionalisma Skim Perkhidmatan Sistem Maklumat. Pada ketika ini, bilangan pegawai Skim Perkhidmatan Sistem Maklumat yang dipusatkan di MAMPU telah melebihi 10,000 orang.

PENUTUP.

Kami menyokong penuh dasar dan kemimpinan baharu kerajaan yang dilihat lebih proaktif memperkasa fungsi perkhidmatan awam ke arah pembangunan negara yang mapan. Kami yakin Malaysia Baharu memerlukan reformasi perkhidmatan awam yang holistik dengan memperkukuh fungsi IT Sektor Awam. Dengan usaha bersepadu kami yakin Wawasan 2025 untuk kembali meletakkan Malaysia di landasan negara maju bakal tercapai.

https://goo.gl/UcfzSu

SongketMail Sdn Bhd (1243508-A), An ICT Service Delivery and Operation (ISDO) Company

2018-02-18T11:43:00.000+08:00

SongketMail Sdn Bhd (1243508-A), An ICT Service Delivery and Operation (ISDO) Company

SongketMail Sdn Bhd (1243508-A) is an Information Technology systems Integrator and Open Source Software consulting. SongketMail is focusing on ICT Service Delivery and Operation (ISDO), ICT Security related to ISDO, Data Center Agility and Cloud Computing base on Open Source Software and solution. We enable our customers based in the Government, Education and Private sectors to deliver agility, secure and success in their cloud computing, DevOps automation, and Open Source Software related projects.

http://www.songketmail.org

SongketMail

019-6085482 (Harisfazillah Jamel / LinuxMalaysia)

linuxmalaysia@songketmail.org

Malaysia Linux and Open Source Support by Harisfazillah Jamel (LinuxMalaysia)

2017-01-03T01:26:00.000+08:00

This page is created as reference to Linux and Open Source Support in Malaysia.

It is created by Harisfazillah Jamel, after configuration and support is done on this server. If you are the owner of this server, this page will help you to get further support from us.

Harisfazillah Jamel 019-6085482

or linuxmalaysia @ gmail.com or

http://linuxmalaysia.harisfazillah.info

Self Support for Linux and Open Source can be found through numbers of Mailing list, forums and telegram channel, Sumber Terbuka Malaysia.

https://telegram.me/sumberterbukamy

For more Open Source Software visit http://linuxwanita.blogspot.com/

For professional support with reasonable fee please contact us. We will provided support around Malaysia including Sabah and Sarawak.

Harisfazillah Jamel

019-6085482

linuxmalaysia @ gmail.com

http://blog.harisfazillah.info/

SongketMail Team Support

http://www.songketmail.org/

First publish : Dec 14, 2007 5:54 PM

Big Data - Harisfazillah Jamel - Startup and Developer 4th Meetup 5th November 2016

2016-11-06T02:42:00.002+08:00

Big Data - Harisfazillah Jamel - Startup and Developer 4th Meetup 5th November 2016

1. Big Data Harisfazillah Jamel Startup and Developer 4th Meetup 5th November 2016
2. Why Big Data? Big Data is not only for big player Big Data is also for Us. Startup and developers Data is raw gold. Information about us is the end product. Data define us. Web Server log, web page analytic and comments about or products.
3. What Is Big Data? Big data is a term for data sets that are so large or complex that traditional data processing applications are inadequate to deal with them. Challenges include analysis, capture, data curation, search, sharing, storage, transfer, visualization, querying, updating and information privacy. (Wikipedia) Lets redefine big data for us.
4. What Is Big Data? Volume . Variety . Velocity . Veracity ● Very big data ● Multiple sources ● Stream in data ● Accuracy of the data
5. Redefine Big Data For Startup 4 important terms :- ● Data Sets ● Data Processing ● Analytic ● Visualization Big Data is big. We need to focus
6. What Should We Call Our Big Data? ● Small Data ● Startup Data ● No Data We need to visualize our data since day 0 It’s a must
7. Why Big Data? Big data analytics examines large amounts of data to uncover hidden patterns, correlations and other insights. (SAS) We need to know our own insight. Visualize our future.
8. Data Sets We don’t have any data (No data) or lack of data - Hendak cari data kita cari data Our own data or We have a place to start. www.data.gov.my
9. Data Set : Our Own Data? ● Web server log ○ IP address of the visitors. IP2Country ● Web access analysis ○ Most visited pages ● Comments from our users. ○ Good, bad, Like, Dislike.
10. Issues With The Data? Lack of useable information. We need to collect data on our own. Ini peluang business untuk startup.
11. What Need To Be Collected?
12. Good Bad Like Dislike What we want to know from big data and any data that we analysis is this :- GOOD BAD LIKE DISLIKE Sentiment analysis
13. When Who Where What Why How When - @timestamp is important for data analysis. Who - Anonymous is important but we need to know male or female and his or her age. Where - Anonymous is important, but we still need the IP address to know from which country or state or county. What - The operating system, the browser's version Why - Keywords thats lead them How - How they know about us
14. How To Visualize Our Data I’m a fan of ELK Elasticsearch Logstash & Kibana ELK is one of Big Data tools
15. Index The Data With ES Used Elasticsearch to Index our data. One misconception. ES is not for storage. Don’t used ES to store our data. Data need to be archived elsewhere.
16. ES Search API The result in JSON. Developer love JSON. (May be) https://www.elastic.co/guide/en/elasticsearch/reference/5. 0/_exploring_your_data.html
17. Kibana We can use Kibana to view our data in ES.
18. DKAN We can store data with DKAN. DKAN follow CKAN. The open source open data platform with a full suite of cataloging, publishing and visualization features that allows organizations to easily share data with the public. http://www.nucivic.com/dkan/ Take advantage DKAN Datastore API
19. GeoSpatial Is Important Our data need to have spatial information (GPS Coordinate) We can used GeoServer to have our own Map Server. http://geoserver.org/
20. The End Q & A linuxmalaysia@gmail.com 019-6085482 http://linuxmalaysia.harisfazillah.info/

Call For Speakers Malaysia Open Source Conference 2016 MOSC MY

2016-03-20T14:12:00.003+08:00

Call For Speakers Malaysia Open Source Conference 2016 MOSC MY

Call for speakers is open to all individual, organization, universities, companies and government agencies who is to present on the case study, development, implementation or applications. The presentation paper or slide must be in knowledge sharing concept. The presentation paper or slide must not contain marketing materials to promote certain product or company.

MOSC MY 2016 : http://www.mosc.my

Call For Speakers form : http://goo.gl/forms/BiWQIn2bD8

Over the years, Malaysia Open Source Conference or MOSC MY have brought together thousands participants, of CEOs and leaders, vendors, consultants, associations and regulators from around Malaysia and the world to address mutual challenges and share information on Open Source Software.

With "A New Begining" as the theme for year 2016, we are addressing the main technology focus and trends for most consumers.

MOSCMY 2016 is set to explore the Open Source software and technology at the Enterprise level, and to promote the development of local Open Source solution for Enterprise environment to be use worldwide.

Date : 25-27 May 2016 (Wednesday Till Friday)

Time : 9am till 5pm

Venue : Faculty of Information Science & Technology, Universiti Kebangsaan Malaysia, Bangi, Selangor.

http://lanyrd.com/venues/22722938/vgdky/

http://www.ftsm.ukm.my/location.php

MOSC MY

Install Oinkmaster For Suricata IDS / IPS / Network Security Monitoring Software

2016-02-09T15:08:00.000+08:00

I'm using Suricata IDS / IPS / Network security monitoring software and log alert into syslog. By logging into syslog its can be process later by Logstash and store into Elasticsearch and can be view by Kibana. I'm using Ubuntu Linux Server 14.04 LTS for this setup.

Simple guide :-

1) Install suricata and oinkmaster

apt-get update
apt-get install suricata oinkmaster

* suricata disabled, please adjust the configuration to your needs
* and then set RUN to 'yes' in /etc/default/suricata to enable it.

2) Download rules

2.1) Create directory

mkdir /etc/suricata/rules

edit /etc/oinkmaster.conf using vi or pico and add this line.

url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz

Save and run test

oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

check directory /etc/suricata/rules should all rules download

3) Create a cron file into /etc/cron.d named oinkmaster

pico /etc/cron.d/oinkmaster

Add this content

0 2 * * * /usr/sbin/oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

4) edit /etc/suricata/suricata-debian.yaml

# Configure the type of alert (and other) logging you would like.

# a line based alerts log similar to fast.log into syslog
- syslog:
enabled: yes
# reported identity to syslog. If ommited the program name (usually
# suricata) will be used.
#identity: "suricata"
facility: local5
#level: Info ## possible levels: Emergency, Alert, Critical,
## Error, Warning, Notice, Info, Debug

logging:

- syslog:
enabled: yes
facility: local5
format: "[%i] <%d> -- "

# Set the default rule path here to search for the files.
# if not set, it will look at the current working dir
default-rule-path: /etc/suricata/rules
rule-files:

classification-file: /etc/suricata/rules/classification.config

reference-config-file: /etc/suricata/rules/reference.config

Further reading :-

https://web.nsrc.org/workshops/2015/pacnog17-ws/raw-attachment/wiki/Track2Agenda/ex-suricata-rules.htm

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

Tips Pemasangan Docker Bagi Linux Ubuntu Server

2015-12-20T20:10:00.004+08:00

Tips Pemasangan Docker Bagi Linux Ubuntu Server

1) Pemasangan Linux Ubuntu Server. Bagi nota ini adalah versi Linux Ubuntu Server 14.04 LTS

Pastikan sewaktu pemasangan anda, pada langkah kedua selepas pemilihan bahasa, tekan butang F4. Ini akan memberikan anda pilihan Mode pemasangan.

Buat pilihan minimal system jika anda memasang pada perkakasan dan minimal virtual machine jika anda memasang dalam Virtual Machine (VM) seperti Vmware, VirtualBox atau Proxmox.

2) Pemasangan yang asas untuk keselamatan. Saya memasang Fail2ban dan UFW untuk perlindungan awal.

apt-get install fail2ban ufw

Bagi konfigurasi ufw

ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status
ufw default deny

Pada arahan ufw status pastikan periksa dahulu port SSH (22/tcp) telah open. Fail2ban akan lindungi bruteforce. Adalah penting untuk lindungi dengan password yang keras dan username yang susah teka.

Jangan lupa dalam pemasangan nanti untuk allow ports yang berkaitan dengan Docker dan Fowardered. Baca manual secara keseluruhan.

3) Pemasangan Docker

Permasangan yang sesuai adalah dengan mengikut nota yang disediakan oleh pihak docker sendiri di

https://docs.docker.com/engine/installation/ubuntulinux/

Perkara penting sebelum memasang Docker. Kemaskini Kernel dengan apt-get dist-upgrade dan reboot server.

4) Saya menggunakan unbound bagi tujuan cache DNS pada host server. Pastikan DNS konfigurasinya telah dibuat. Rujuk kepada /etc/resolv.conf

apt-get install unbound

Seterusnya Docker Rancher.

Harisfazillah Jamel / LinuxMalaysia

Lean & Mean

20 Dis 2015

ps -ef | grep docker

Tunnel To a Server With A LAN only IP From a Server with Public Internet IP

2014-02-20T17:17:00.001+08:00

Tunnel To a Server With A LAN only IP From a Server with Public Internet IP

I'm assuming you know OpenSSH and terminal commands.

We have a server called Server A thats can be remote SSH from public Internet. We have a Server B, with LAN only IP with same segment as Server A. Server B can only can be access from Server A. With Only port SSH open for both servers. SSH port monitored by using fail2ban.

We want to access a Postgresql Database in Server B by using of PgAdmin and I'm using Ubuntu desktop. From command line terminal by using this command, I'm accessing Server A.

Step 1 :-

ssh -L 35432:localhost:35432 hafnie@serverA.harisfazillah.info

Step 2 :-

Successfully access server A, I will SSH to Server B with this command.

ssh -L 35432:localhost:5432 hafnie@serverB.harisfazillah.info

Step 3 :-

And then using Pgadmin to access localhost port 35432 to access the Postgresql Server B.

For more info

http://ubuntuguide.org/wiki/Using_SSH_to_Port_Forward

Using Windows Desktop? You may use putty to tunnel to server A for step 1.

https://code.google.com/p/putty-tunnel-manager/

Perl Locale Failed Warning Messages For Ubuntu

2014-02-20T11:23:00.007+08:00

New installation for Ubuntu 10.04 and 12.04 most of the time, I will get this warning messages. Its only a warning will not impact the command executed using the perl.

perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
    LANGUAGE = (unset),
    LC_ALL = (unset),
    LC_PAPER = "ms_MY",
    LC_ADDRESS = "ms_MY",
    LC_MONETARY = "ms_MY",
    LC_NUMERIC = "ms_MY",
    LC_TELEPHONE = "ms_MY",
    LC_IDENTIFICATION = "ms_MY",
    LC_MEASUREMENT = "ms_MY",
    LC_TIME = "ms_MY",
    LC_NAME = "ms_MY",
    LANG = "en_US.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").

To fix this issue. Used this command. Im from Malaysia using locale ms_MY, please change your setting locale to yours. Your command messages may different from mine. I'm generating for ms_MY and en_US.UTF8.

$ sudo locale-gen ms_MY
Generating locales...
ms_MY.ISO-8859-1... done
Generation complete.

$ sudo locale-gen en_US.UTF-8
Generating locales...
en_US.UTF-8... done
Generation complete.

$ sudo dpkg-reconfigure locales
Generating locales...
en_US.UTF-8... up-to-date
ms_MY.ISO-8859-1... done
Generation complete.

Ubuntu Locale
https://help.ubuntu.com/community/Locale

Package for Ubuntu is language-pack-ms

Cerita Tentang Kesan Buruk Email Spam dan Trojan

2014-02-20T00:51:00.001+08:00

Saya ingin sampaikan cerita ini untuk dijadikan panduan kepada rakan-rakan tentang bahaya email spam, phishing dan trojan dalam komputer.

Satu masa dahulu tidak berapa lama tahunnya, di sebuah syarikat yang saya bekerja sebelum ini. Sedang kami sibuk bekerja, empat individu datang ke pejabat dan memperkenalkan kepada penyambut tetamu, bahawa mereka adalah Polis, pasukan siasatan jenayah, IPD Polis sebuah negeri. Mereka mahu berjumpa dengan seorang rakan kerja saya, yang kebetulan pada masa itu keluar mesyuarat.

Saya berjumpa dengan mereka dan berbual untuk pengesahan iaitu melalui kad kuasa yang ditunjukkan kepada saya. Berpuas hati, Saya telepon rakan saya tersebut, untuk meminta berliau pulang ke pejabat. Saya turut ditemubual seketika, mereka tidak banyak bercerita hanya tunjukan gambar rakan untuk pengesahan. Mereka juga memberitahu akan membawa rakan kerja saya ke balai polis berdekatan untuk diambil keterangan.

Apabila rakan saya pulang ke pejabat, saya beritahu dia untuk berikan kerja sama dan ikut sahaja arahan pegawai-pegawai polis dan beliau pun dibawa ke balai. Lewat petang, beliau kembali ke pejabat bersama polis untuk mengambil beberapa dokumen peribadi.

Untuk dua hari, beliau ditahan untuk diambil keterangan. Atas sebab kerja sama yang ditunjukan dan beliau juga adalah mangsa, beliau dilepaskan dengan jaminan polis.

Kes beliau adalah melibatkan kecurian wang atas talian sebuah bank. Beliau telah ditipu melalui satu skim kerja mudah di Internet. Dan skim ini beliau ketahui melalui email SPAM.

Beliau diminta untuk Telegraphic transfer (TT) sejumlah wang yang akan dimasukkan ke akaun beliau ke akaun seorang individu di sebuah negara di Eropah. Beliau boleh ambil beberapa percent, sebagai bayaran kepadanya.

Perhubungan adalah melalui email dan memang benar sejumlah wang telah dimasukkan ke akaun beliau. Beliau pun telah TT duit tersebut ke akaun bank luar negara itu.

Selang dua bulan lebih, pasukan Polis itu datang dan sebenarnya, satu laporan telah dibuat oleh seorang individu bahawa sejumlah wang telah dipindahkan daripada akaunnya ke akaun orang lain. Disyaki ia adalah melalui capaian tanpa izin, kemudahan Internet Banking individu tersebut. Malah maklumat banknya mungkin turut didapatkan melalui phishing atau trojan yang memantau komputer.

Beliau bernasib baik kerana masih menyimpan resit TT dan email-email hubungan beliau dengan individu penipu tersebut. Dalam kes ini, terdapat dua mangsa, rakan kerja saya dan pemilik akaun. Kes dapat diselesaikan tanpa bicara selepas pengadu menerima penyelesaikan bayaran ganti rugi oleh rakan kerja saya tersebut.

Ini adalah isu keselamatan yang jelas. Usaha perlu dilakukan untuk benteras SPAM dan phishing email. Malah komputer peribadi perlu dipastikan tiada menjadi sarang trojan komputer.

Moral : Laporkan kepada Cyber999 MyCERT Cybersecurity Malaysia, email SPAM yang meragukan.

Emoji For A Technical Person (Text Codes)

2014-01-31T03:29:00.002+08:00

SSH TCP 22 PC Reboot OS ACK HTTPS LISTEN 443 SHA1 RSA AJAX SMTP #linuxmy

I named my post emoji because my Malaysian Facebook friends are playing an Emoji Games called "Guess The Emoji". Not related to any emoji smiley. Just for fun. Guess what all the words mean?

Hint "Zimbra".

Original Facebook post

Post by LinuxMalaysia Malaysia.

The answer :-

Remote ssh port 22/tcp into the server (PC) and reboot the operating system (OS). After reboot, check HTTPS port TCP/443 working with digital certificate using SHA1 RSA. AJAX web interface is related to Zimbra Email Collaboration Server.

Cloud Presentation by Harisfazillah Jamel For FOSSDAY@IIUM 2012

2012-09-28T19:20:00.002+08:00

Cloud Presentation by Harisfazillah Jamel For FOSSDAY@IIUM 2012

FOSSDAY@IIUM 2012 Cloud Presentation By LinuxMalaysia

FOSSDAY@IIUM 2012 Cloud Presentation By LinuxMalaysia from Harisfazillah Jamel

FOSSDAY@IIUM 2012 Cloud Presentation By LinuxMalaysia — Presentation Transcript

Your Own Cloud With GlusterFS and OpenStack

FOSSDAY@IIUM 2012

WHOAMI

I'm a technical guy by heart, an ICT security
by hobby and a Project Manager by
profession.

Real Name : Harisfazillah Jamel
Not So Real Name : LinuxMalaysia

Job : PM @ Tuxuri
FOSSDAY@IIUM2012
2

PMO
FOSSDAY@IIUM2012
3

Cloud Project

Cloud Project is not easy (Done properly)
You have to know what you are doing (On
time)
Need hardware big one (On budget)
FOSSDAY@IIUM2012
4

ITS STILL FUN
Learn a lot of things from a single cloud
project
● Virtualization
● Clustering
● Network segmentation
● Firewall and security
● Network files sharing
● Database
FOSSDAY@IIUM2012
5

ITS STILL FUN

Caught playing game in the lab (My BOSS camera)
FOSSDAY@IIUM2012
6

Cloud
FOSSDAY@IIUM2012
7

Cloud?
FOSSDAY@IIUM2012
8

Basic Model
● IaaS (Infrastructure As Service)
● PaaS (Platform As Service)
● SaaS (Software As Service)
FOSSDAY@IIUM2012
9

IaaS

Provide all the Infra to install OS
Service are only CPU Core, Memory, Disk Space
and Network bandwidth
Self service
– – Other services needed by your users
–

OS installation and configuration
Yes we need personal with LPI certificate
Example : Amazon EC2 and Google Compute
Engine
FOSSDAY@IIUM2012
10

PaaS

Provide all the need for your software (Computing
platform)
Service include operating system (PaaS),
programming language execution environment,
database, and web server.
Self service
–

Programming (PHP, Python and C)
Example : Google Apps Engine (Python & Java)
and Microsoft Azure (PHP & ASP)
FOSSDAY@IIUM2012
11

SaaS

Provide all the needed application services
(Email, Website, API, Security and Documents
sharing)
● We are only the users and the data is still ours
● Example : Google Apps and Cloudflare
FOSSDAY@IIUM2012
12

Example : SaaS

Cloudflare http://www.cloudflare.com/
Service : Contents Distribution Network
(CDN), website security and performance and
DNS
FOSSDAY@IIUM2012
13

Example : SaaS

Google Map API
Service : Provide API to developers to access
Google MAP and satellite image
http://selesa.kkr.gov.my/
&
http://goo.gl/maps/1gfyf
FOSSDAY@IIUM2012
14

Example : SaaS

Google Map API (Our developers explain)
FOSSDAY@IIUM2012
15

Own Vs Cloud

Own
– – Layers (GeoServer & MapNik)
– Database (PostGIS + PostgreSQL)
– Web Map Server (WMS) (Apache + Jboss + Nginx
+ Varnish)
–

Basemap (GeoServer & MapNik)
Client & Web browser (Qgis & Mozilla Firefox)
Cloud
– Basemap, Layers, Database, WMS (Google Map
API)
– FOSSDAY@IIUM2012
Web browser (Mozilla Firefox)
16

Open Source drive the Cloud
Amazon EC2, Google, Cloudflare & OpenDNS
are using Open Source
FOSSDAY@IIUM2012
17

Example : SaaS
● OpenDNS http://www.opendns.com/
● Service : DNS filtering

Protect yourself and children from botnet and
phishing websites.
FOSSDAY@IIUM2012

18
Take 5 (Questions)
FOSSDAY@IIUM2012
19

Make Your Own Cloud
FOSSDAY@IIUM2012
20

Distributed File System

SaaS with GlusterFS
FOSSDAY@IIUM2012
21

Why GlusterFS?

Make use of unused disk spaces in Data
Center (capable of scaling to several petabytes
(actually, 72 brontobytes!)
● Easy setup and use of commodity hardware
● Scalability and Elasticity
● Simplicity
● Open Source and support by Red Hat

Gluster Connector for OpenStack – Underlying
file system.
FOSSDAY@IIUM2012
22

Why GlusterFS?
● No metadata server
● Build In Replication
● No single point of failure (4 peers 2 x 2)
● POSIX Compliance file system
● Hardware solution is costly (will cost millions)

Share with NFS, CIFS (Windows sharing) and
Glusters native
FOSSDAY@IIUM2012
23

IaaS
● You own cloud Infrastructure – OpenStack
● http://www.openstack.org/
FOSSDAY@IIUM2012
24

Why OpenStack?

Make use of new under utilize hardware and old
hardware.
Simple to setup (sakit juga kepala) and use of
commodity hardware
Scalability and Elasticity
Open Source and support by major IT companies
(Rackspace)
Management for your Virtualization and Data center
resources (CPU core, Memory, Hard disk space and
Network)
FOSSDAY@IIUM2012
25

Why OpenStack?
● Code using Python
● Can run on ARM

FOSSDAY@IIUM2012
26

End
Email : haris@tuxuri.com
Website : http://www.tuxuri.com/
FOSSDAY@IIUM2012
27

Software Freedom Day Kuala Lumpur 2011 (SFDKL2011) - In Youtube

2011-09-24T09:42:00.002+08:00

OSDC.my Discussion Group In Facebook

2011-09-24T09:39:00.006+08:00

Join us to discuss Open Source Software and OSS community events and projects here

https://www.facebook.com/groups/osdcmalaysia/

About OSDC.my

Malaysia Open Source Developer's Club or in short known as OSDC.my is a community based club open for all enthusiastic Open Source developers and users across Malaysia.

Thanks

Harisfazillah Jamel

http://linuxmalaysia.harisfazillah.info/

A Response Letter to the Word Attachments

2011-01-28T08:32:00.000+08:00

A Response Letter to the Word Attachments

The document you have sent is not an Internet mail format. It is a proprietary format that is unreadable on several types of computers, including those used by visually-impaired readers and older computers used in foreign countries.

In most cases, the size of the file is substantially larger than a plain-text file containing the same information. (Even if it LOOKS like plain-text to you, chances are it is not, and contains a considerable amount of unnecessary formatting codes, printer information, etc.)

In addition, Word documents are often infected with viruses. Excel, Access, and Power Point files are also vulnerable to infection.

Please “Save As” DOS Text, HTML or Portable Document Format (PDF) and send the resulting file as an attachment. Another option is to simply type your message directly into mail then you won't need to use an attachment at all.

In the highly unlikely event that your document cannot be converted to an open, non-proprietary format, consider posting it on a web page, and sending e-mail with the URL which points to the file.

Thank you.

ps. Please forward to your friends.

Please avoid sending me Word or PowerPoint attachments.

See http://www.gnu.org/philosophy/no-word-attachments.html

LibreOffice

http://www.libreoffice.org/

LibreOffice is the free power-packed Open Source personal productivity suite for Windows, Macintosh and Linux, that gives you six feature-rich applications for all your document production and data processing needs: Writer, Calc, Impress, Draw, Math and Base.

Working With KVM QEMU Host Upgrade

2010-12-30T03:36:00.000+08:00

I have to update one of client KVM QEMU host server for new kernel and libvirt. I need to do the backup and I'm using virt-clone as per command below. Its take around half and hour for my 62GB of VM to be clone. Example of virt-clone that Im using

virt-clone -o Ubuntu-Zimbra-Email -n Ubuntu-Zimbra-Email301210 -f /data/backup/Ubuntu-Zimbra-Email301210.qcow2

Ubuntu-Zimbra-Email = Name of the VM to be clone (need to shutdown the VM)

Ubuntu-Zimbra-Email301210 = Name of the new VM machine.

/data/backup/Ubuntu-Zimbra-Email301210.qcow2 = Directory where you want to put the VM file.

Replace the above thats suitable with your setup.

XML file for the clone machine is created under /etc/libvirt/qemu

You can read more about virt-clone here

http://blog.friocorte.com/2008/01/using-virtclone.html

virt-clone take sometimes. Im using screen so I can detach my terminal without worrying the connection will be lost. Command issues in Screen can be monitor.

https://help.ubuntu.com/community/Screen

Detach " Ctrl and A D

To return to session : screen -r

Using OpenDNS To Check DNS Entry

2010-12-23T03:44:00.001+08:00

Updating your Domain DNS and you want to find out the entry is updated all over Internet, you should try CacheCheck by OpenDNS to find out what happening.

in reference to: OpenDNS > Support > CacheCheck (view on Google Sidewiki)

Activities Tasks logs by Linux Malaysia, Hafnie Harisfazillah Jamel For Linux Open Source Software

The Void - Location Kuala Lumpur Malaysia With My Blog Post

3°07'54.9"N 101°41'02.6"E

3.131920, 101.684059

Mini UbuCon Malaysia 2025 - An Event Dedicated To Advancing The Open Source Software Ecosystem

Mini UbuCon Malaysia 2025

Why Attend Mini UbuCon Malaysia 2025?

Stay Ahead with Cutting-Edge Technology

Network with Experts and Enthusiasts

Support the Ubuntu Malaysia Community

About CyberDSA

Mini UbuCon Malaysia 2025: Share Your Voice, Shape the Future

🐧 What is Mini UbuCon?

💻 Why Ubuntu Matters

🤖 Ubuntu & AI

Percona PostgreSQL Cluster Operations: A Public Guide to Management, Minor Upgrades, Performance Tuning, and Troubleshooting

Percona PostgreSQL Cluster Operations: A Public Guide to Management, Minor Upgrades, Performance Tuning, and Troubleshooting

1. Cluster Node Information

2. ETCD Cluster Node Information

3. Pre-Upgrade Steps

4. Upgrade Process Steps (Rolling Upgrade Node by Node)

4.1. Remove Previous Version of Percona pg_tde (If Applicable)

4.2. Update Percona Release Package

4.3. Install Required Dependencies and Enable Repositories

4.4. Configure Percona Distribution for PostgreSQL 17 Repository

4.5. Stop Patroni Service on the Current Node

4.6. Install/Upgrade Percona Distribution for PostgreSQL 17 Packages

4.7. Start Patroni Service on the Current Node

4.8. Verify Node Health

4.9. Repeat Steps for Other Replicas

4.10. Perform Patroni Switchover (Before upgrading the original primary)

4.11. Upgrade the Original Primary Node (Now a Replica)

4.12. Configure pg_tde in PostgreSQL Configuration (If not already done)

4.13. Perform Patroni Cluster-Wide Restart to Apply Configuration Changes

4.14. Optional: Perform a Patroni Switchover for Verification

5. Performance Tuning Considerations

6. Post-Upgrade Verification

7. Handling Potential Issues

8. Understanding patronictl list Output

Conclusion

How-To: Deploy Java 21 OpenJDK in an Air-Gapped Environment using yumdownloader

How-To: Deploy Java 21 OpenJDK in an Air-Gapped Environment using yumdownloader

Prerequisites

Step-by-Step Guide

Step 1: Prepare the Internet-Connected Host

Step 2: Transfer Files to the Air-Gapped Host

Step 3: Install Java 21 OpenJDK on the Air-Gapped Host

Manual Dependency Installation (For Learning/Debugging)

Advanced Considerations and Best Practices

References and Further Reading

Notes

Download And Use latest Version Of Nginx Stable

Download And Use latest Version Of Nginx Stable

Installing Nginx on different Linux distributions

Ubuntu

AlmaLinux / Rocky Linux (Redhat)

Nginx Fork (This for reference only - year 2024)

Use this Web tool to configure nginx.

Example

Online Security Tools for Website Owners

Online Security Tools for Website Owners

Introduction

The Risks of Poor Website Security

Benefits of Robust Security Measures

Check Your Email Sender Authentication Schemes

Usaha Menubuhkan Jabatan IT Negara dan melantik Ketua Perkhidmatan daripada Profesional ICT

SongketMail Sdn Bhd (1243508-A), An ICT Service Delivery and Operation (ISDO) Company

SongketMail Sdn Bhd (1243508-A), An ICT Service Delivery and Operation (ISDO) Company

Malaysia Linux and Open Source Support by Harisfazillah Jamel (LinuxMalaysia)

Big Data - Harisfazillah Jamel - Startup and Developer 4th Meetup 5th November 2016

Big Data - Harisfazillah Jamel - Startup and Developer 4th Meetup 5th November 2016

Call For Speakers Malaysia Open Source Conference 2016 MOSC MY

Install Oinkmaster For Suricata IDS / IPS / Network Security Monitoring Software

Tips Pemasangan Docker Bagi Linux Ubuntu Server

Tunnel To a Server With A LAN only IP From a Server with Public Internet IP

Perl Locale Failed Warning Messages For Ubuntu

Cerita Tentang Kesan Buruk Email Spam dan Trojan

Emoji For A Technical Person (Text Codes)

Cloud Presentation by Harisfazillah Jamel For FOSSDAY@IIUM 2012

Software Freedom Day Kuala Lumpur 2011 (SFDKL2011) - In Youtube