Debian 8

virt-install \
--accelerate \
--name debian8 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/debian8.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant generic \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://ftp.nl.debian.org/debian/dists/jessie/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

Debian 7

virt-install \
--accelerate \
--name debian7 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/debian7.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant debian7 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://ftp.nl.debian.org/debian/dists/jessie/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

Debian 6

virt-install \
--accelerate \
--name debian6 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/debian6.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant debian6 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://ftp.nl.debian.org/debian/dists/squeeze/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

CentOS 7

virt-install \
--accelerate \
--name centos7 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/centos7.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant centos7 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://mirror.i3d.net/pub/centos/7/os/x86_64/' \
--extra-args 'console=ttyS0,115200n8 serial'

CentOS 6

virt-install \
--accelerate \
--name centos6 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/centos6.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant centos6 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://mirror.i3d.net/pub/centos/6/os/x86_64/' \
--extra-args 'console=ttyS0,115200n8 serial'

CentOS 5

virt-install \
--accelerate \
--name centos5 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/centos5.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant centos5 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://mirror.i3d.net/pub/centos/5/os/x86_64/' \
--extra-args 'console=ttyS0,115200n8 serial'

Ubuntu 14.04

virt-install \
--accelerate \
--name ubuntu1404 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/ubuntu1404.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant generic \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

Ubuntu 12.04

virt-install \
--accelerate \
--name ubuntu1204 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/ubuntu1204.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant ubuntu12.04 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://archive.ubuntu.com/ubuntu/dists/precise/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

Ubuntu 10.04

virt-install \
--accelerate \
--name ubuntu1004 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/ubuntu1004.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant ubuntu10.04 \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://archive.ubuntu.com/ubuntu/dists/lucid/main/installer-amd64/' \
--extra-args 'console=ttyS0,115200n8 serial'

OpenSUSE 13

virt-install \
--accelerate \
--name opensuse13 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/opensuse13.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant generic \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://download.opensuse.org/distribution/13.2/repo/oss/' \
--extra-args 'console=ttyS0,115200n8 serial'

OpenSUSE 12

virt-install \
--accelerate \
--name opensuse12 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/opensuse12.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant generic \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://download.opensuse.org/distribution/12.3/repo/oss/' \
--extra-args 'console=ttyS0,115200n8 serial'

OpenSUSE 11

virt-install \
--accelerate \
--name opensuse11 \
--ram 1024 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/opensuse11.qcow2,size=10,sparse=true,cache=none,bus=scsi \
--vcpus 1 \
--os-type linux \
--os-variant generic \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--location 'http://download.opensuse.org/distribution/11.4/repo/oss/' \
--extra-args 'console=ttyS0,115200n8 serial'

windows 7

virt-install \
--accelerate \
--name windows7 \
--ram 2048 \
--vcpus=2 \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/date/windows7.qcow2,size=50,sparse=true,cache=none,bus=virtio \
--cdrom=/home/iso/windows7.iso \
--graphics vnc,listen=0.0.0.0,port=5900,password=123456 \
--network bridge=br0 \
--os-type=windows \
--os-variant=win7

The post KVM virt-install 安装各个系统配置 appeared first on 猫言猫语.

无人值守安装centos 7前提是要安装KVM，并且能手动创建虚拟机。
首先创建centos7.ks.cfg文件 vi /root/centos7.ks.cfg

install
#禁用第一次启动时设置系统的向导
firstboot --disabled
eula --agreed
reboot

# 系统语言
lang en_US.UTF-8
keyboard us
# 设置时区
timezone --isUtc Asia/Shanghai
# 关闭selinux和防火墙
selinux --disabled
firewall --disabled
# 开启的服务
services --enabled=sshd,ntpd,ntpdate,network

# 网络设置比较复杂，建议安装后再设置
# network --hostname pandora

# 启动方式、自动分区
clearpart --all --initlabel
bootloader --location=mbr
autopart --type=lvm
zerombr

# root 密码为123@abc#
auth --useshadow --enablemd5
rootpw --iscrypted $6$nLlYENVDvCsM/2SX$ZD6JgRkeuN1nW239DA53b33Yyl7j0MuAKCY/CKQ/YSdA3/6sBOqInIO67JJmssHb3HTCQLj4OlVfzwt7m8Bin0

#repo --name=base --baseurl=http://centos.mirrors.ovh.net/ftp.centos.org/7/os/x86_64
#url --url="http://centos.mirrors.ovh.net/ftp.centos.org/7/os/x86_64"

# 最小化安装
%packages --nobase --ignoremissing
@core

#安装一些组件
acpid
net-tools
ntp
ntpdate
wget
%end

%post
echo "ttyS0" >> /etc/securetty
sed  -i 's/1:2345:respawn:\/sbin\/mingetty tty1/co:2345:respawn:\/sbin\/agetty ttyS0 115200 vt100-nav/' /etc/inittab

sed -i 's/^HISTSIZE=.*$/HISTSIZE=100/' /etc/profile

# /etc/security/limits.conf
[ -z "`cat /etc/security/limits.conf | grep 'nproc 65535'`" ] && cat >> /etc/security/limits.conf < > /etc/rc.local

[ -z "`cat ~/.bashrc | grep ^PS1`" ] && echo 'PS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h \[\e[35;40m\]\W\[\e[0m\]]\\$ "' >> /root/.bashrc 

# /etc/sysctl.conf
sed -i 's/net.ipv4.tcp_syncookies.*$/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf
[ -z "`cat /etc/sysctl.conf | grep 'fs.file-max'`" ] && cat >> /etc/sysctl.conf < < EOF
fs.file-max=65535
net.ipv4.tcp_fin_timeout = 30 
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 65535 
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_max_orphans = 262144
EOF
%end

关于配置里面的root的密码，首先看看python 的版本

[root@pandora qemu]# python -V
Python 2.7.5

python的版本大于2.7的，运行设置密码

python -c 'import crypt,getpass; print(crypt.crypt(getpass.getpass(), crypt.mksalt(crypt.METHOD_SHA512)))'

python的版本小于于2.7的，运行

python -c 'import crypt; print crypt.crypt("CLEARTEXTPASSWORD", "$6$saltsalt$")'

当然，直接用脚本配置里面的123@abc#的密码也可以，安装完后更改root密码

接着用virt-install安装虚拟机，就会自动按照centos7.ks.cfg的配置完成安装

virt-install \
--accelerate \
--name=centos7\
--hvm \
--virt-type kvm \
--boot hd \
--controller type=scsi,model=virtio-scsi \
--disk path=/home/data/centos7.qcow2,format=qcow2,size=300,sparse=true,cache=none,bus=scsi \
--network bridge:br0 \
--vcpus=8 --ram=16384 \
--os-type=linux \
--os-variant=rhel7 \
--graphics none \
--serial pty \
--console pty \
--location /home/iso/CentOS-7-x86_64-Minimal-1503-01.iso \
--initrd-inject /root/centos7.ks.cfg \
--extra-args "inst.ks=file:/centos7.ks.cfg console=ttyS0"

The post kvm无人值守安装centos 7虚拟机 appeared first on 猫言猫语.

新安装的centos 7怎么初始化就不说，但是要禁止selinux。

sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

yum安装KVM

yum install kvm virt-manager libvirt virt-install qemu-kvm

接着就是桥接网卡，将/etc/sysconfig/network-scripts/ifcfg-eth0 改为

DEVICE=eth0  
TYPE=Ethernet  
ONBOOT=yes  
BOOTPROTO=none  
BRIDGE=br0  
IPV6INIT=yes

新建/etc/sysconfig/network-scripts/ifcfg-br0文件，内容如下

DEVICE=br0  
TYPE=Bridge  
ONBOOT=yes  
BOOTPROTO=static  
IPADDR=服务器外网IP  
GATEWAY=服务器网关  
NETMASK=255.255.255.0  
DNS1=8.8.8.8  
IPV6INIT=yes
IPV6_AUTOCONF=no
IPV6ADDR=服务器IP6地址  
DELAY=0

最后重启网络服务 service network restart，看到br0网卡启动，桥接就成功了。

[root@pandora qemu]# ifconfig
br0: flags=4163  mtu 1500
        inet xxx.xx.xx.xx  netmask 255.255.255.0  broadcast xxx.xx.xx.xx
        inet6 fe80::21e:67ff:fee3:c0cc  prefixlen 64  scopeid 0x20
        inet6 xxx.xx.xx.xx  prefixlen 64  scopeid 0x0
        ether 00:1e:67:e3:c0:cc  txqueuelen 0  (Ethernet)
        RX packets 4548273  bytes 2978437532 (2.7 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 281319  bytes 26960851 (25.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163  mtu 1500
        inet6 fe80::21e:67ff:fee3:c0cc  prefixlen 64  scopeid 0x20
        ether 00:1e:67:e3:c0:cc  txqueuelen 1000  (Ethernet)
        RX packets 6321262  bytes 3169347733 (2.9 GiB)
        RX errors 0  dropped 999  overruns 0  frame 0
        TX packets 286078  bytes 27317934 (26.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0xc1200000-c127ffff  

lo: flags=73  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10
        loop  txqueuelen 0  (Local Loopback)
        RX packets 6  bytes 276 (276.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0 

最后就是安装虚拟机了。

virt-install \
--accelerate \
--name=centos7 \ 
--controller type=scsi,model=virtio-scsi \
--disk path=/home/data/centos7.qcow2,format=qcow2,size=300,sparse=true,cache=none,bus=scsi \
--cdrom=/home/iso/CentOS-7-x86_64-Minimal-1503-01.iso \
--graphics vnc,listen=0.0.0.0,port=5900,password=123456\
--network bridge=br0,mac=02:00:00:fd:5f:0f \
--vcpus=8 --ram=16384 \
--os-type=linux \
--os-variant=rhel7

–name 虚拟机名称
–disk 磁盘位置，格式为qcow2，size为300G
–cdrom 安装ISO的位置
–graphics vnc连接地址端口密码
–vcpus=8 –ram=16384 设置cpu 8个核心，内存16G

另外centos 7创建虚拟机的时候，可能会出现Failed to create chardev错误，解决办法在上一篇说了。
centos7创建KVM虚拟机提示错误Failed to create chardev

The post centos 7安装KVM appeared first on 猫言猫语.

systemctl status libvirtd
libvirtd.service - Virtualization daemon
   Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled)
   Active: active (running) since Thu 2015-09-17 20:07:25 CST; 6h ago
     Docs: man:libvirtd(8)
           http://libvirt.org
 Main PID: 807 (libvirtd)
   CGroup: /system.slice/libvirtd.service
           ├─807 /usr/sbin/libvirtd
           ├─887 /sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --dhcp-script=/usr/libexec/libvirt_leaseshelper
           └─888 /sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --dhcp-script=/usr/libexec/libvirt_leaseshelper

Sep 18 02:11:59 pandora libvirtd[807]: libvirt version: 1.2.8, package: 16.el7_1.4 (CentOS BuildSystem <http://bugs.centos.org>, 2015-09-15-14:00:05, worker1.bsys.centos.org)
Sep 18 02:11:59 pandora libvirtd[807]: failed to connect to monitor socket: No such process
Sep 18 02:11:59 pandora libvirtd[807]: internal error: process exited while connecting to monitor: 2015-09-17T18:11:59.609939Z qemu-kvm: -chardev pty,id=charserial0: Failed to create chardev
Sep 18 02:14:39 pandora libvirtd[807]: failed to connect to monitor socket: No such process
Sep 18 02:14:39 pandora libvirtd[807]: internal error: process exited while connecting to monitor: 2015-09-17T18:14:39.583154Z qemu-kvm: -chardev pty,id=charserial0: Failed to create chardev
Sep 18 02:17:24 pandora libvirtd[807]: failed to connect to monitor socket: No such process
Sep 18 02:17:24 pandora libvirtd[807]: internal error: process exited while connecting to monitor: 2015-09-17T18:17:23.881779Z qemu-kvm: -chardev pty,id=charserial0: Failed to create chardev

修改/etc/fstab文件，找到类似

devpts		/dev/pts	devpts	defaults	0	0

更改为

devpts /dev/pts devpts gid=5,mode=620 0 0

然后运行

mount -o remount /dev/pts

The post centos7创建KVM虚拟机提示错误Failed to create chardev appeared first on 猫言猫语.

attr_rewrite sanereplymessage {
	attribute = Reply-Message
	searchin = reply
	searchfor = "\n|\r"
	replacewith = ""
	ignore_case = no
	new_attribute = no
	max_matches = 10
	append = no
}

然后修改default，在sql前面增加sanereplymessage

Post-Auth-Type REJECT {
		..
		sanereplymessage
		sql
		..
	}

最后按照FreeRADIUS 2.x 记录认证者信息 修改usr/local/etc/raddb/sql/mysql/dialup.conf

postauth_query = "INSERT INTO ${postauth_table} \
                          (username, pass, reply, authdate, calledstationid, nasipaddress, replymessage) \
                          VALUES ( \
                          '%{User-Name}', \
                          '%{%{User-Password}:-%{Chap-Password}}', \
                          '%{reply:Packet-Type}', '%S', '%{Calling-Station-Id}', '%{NAS-IP-Address}', '%{Module-Failure-Message}-%{reply:Reply-Message}')"

Freeradius 3.x 下修改raddb/mods-config/sql/main/mysql/queries.conf

post-auth {
	# Write SQL queries to a logfile. This is potentially useful for bulk inserts
	# when used with the rlm_sql_null driver.
#	logfile = ${logdir}/post-auth.sql

	query =	"\
		INSERT INTO ${..postauth_table} \
			(username, pass, reply, authdate, calledstationid, nasipaddress, replymessage, nasidentifier) \
		VALUES ( \
			'%{SQL-User-Name}', \
			'%{%{User-Password}:-%{Chap-Password}}', \
			'%{reply:Packet-Type}', \
			'%S', '%{Calling-Station-Id}', '%{NAS-IP-Address}', '%{reply:Reply-Message}', '%{NAS-Identifier}')"
}

The post FreeRadius记录登陆的错误信息到数据库 appeared first on 猫言猫语.

首先给FreeRADIUS数据库的radpostauth表添加2个字段 calledstationid和nasipaddress。
然后修改 /usr/local/etc/raddb/sql/mysql/dialup.conf ，将最后的认证信息修改为：

postauth_query = "INSERT INTO ${postauth_table} \
                          (username, pass, reply, authdate, calledstationid, nasipaddress) \
                          VALUES ( \
                          '%{User-Name}', \
                          '%{%{User-Password}:-%{Chap-Password}}', \
                          '%{reply:Packet-Type}', '%S', '%{Calling-Station-Id}', '%{NAS-IP-Address}')"

重启FreeRADIUS就OK

The post FreeRADIUS 2.x 记录认证者信息 appeared first on 猫言猫语.

The post Linux下查看开放的端口 appeared first on 猫言猫语.

“Security advisory CVE-2014-0160 (Heartbleed)”. FreeRadius 3.0.3 would not allow to start radius server if  you have openssl version in range 1.0.1 – 1.0.1f installed.

原因是openssl漏洞，需要升级openssl。首先检查openssl的版本

[root@Pandora ~]# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Aug 13 19:13:02 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic

下载openssl，开始编译安装

wget http://www.openssl.org/source/openssl-1.0.1j.tar.gz
tar xzvf openssl-1.0.1j.tar.gz
cd openssl-1.0.1j
./config
make
make install
mv /usr/bin/openssl /usr/bin/openssl.bak
ln -s /usr/local/ssl/bin/openssl /usr/bin/

如果已经编译了freeradius，你可能还要需要修改radiusd.conf里面的security项，
freeradius 2.x

allow_vulnerable_openssl = yes

freeradius 3.x

allow_vulnerable_openssl = 'CVE-2014-0160'

The post 升级openssl到最新版本 appeared first on 猫言猫语.

freeradius 2.x 提示的错误

radclient:: Failed to find IP address for Excalibur
radclient: Nothing to send.

freeradius 3.x 提示的错误

(0) Error parsing "-": ip_hton: Name or service not known

解决方法很简单给/etc/hosts添加主机名解析就可以

vi /etc/hosts
添加：127.0.0.1 servername
或者运行以下语句

cat >>/etc/hosts<<EOF
127.0.0.1 `hostname`
EOF

The post 测试freeradius 2.x和freeradius 3.x连接出现错误 appeared first on 猫言猫语.

给镜像增加40G

dd if=/dev/zero of=imcat.centos.img bs=1G conv=notrunc count=1 seek=40
1+0 records in
1+0 records out
1073741824 bytes (1.1 GB) copied, 51.9901 s, 20.7 MB/s

扫描检查镜像文件：

losetup -d /dev/loop0
losetup /dev/loop0 imcat.centos.img
e2fsck -f /dev/loop0
resize2fs /dev/loop0
e2fsck -f /dev/loop0
losetup -d /dev/loop0

The post 增加 Xen 虚拟硬盘的大小 appeared first on 猫言猫语.