RHEL7 - Configuring Firewall using a firewalld

Check whether firewalld services are running

# systemctl status firewalld

Incase it is not running, start with below command:

# systemctl start firewalld

Enable it by, so that it would start by default while booting:

# systemctl enable firewalld

To add roles to firewall, there are couple of command, they are :

[root@server1 /]# firewall firewall-cmd          firewalld   firewall-config       firewall-offline-cmd

# firewall-cmd           is an command line interface

# firewall-conf           is an graphical interface

The basic concept in firewall is zones & services.

If you want to know which are zones are availabe, type:

[root@server1 /]# firewall-cmd --get-zones block dmz drop external home internal public trusted work

If you want to know which are services are availabe, type:

[root@server1 /]# firewall-cmd --get-services amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

To know which is the default zone:

[root@server1 /]# firewall-cmd --get-default-zone home

To set the default zone:

[root@server1 /]# firewall-cmd --set-default-zone=public success

Now to add serivces to zone:

Basically service is name associated to protocol & ports.

Here /etc/firewalld/services is an directory where user defined its own services.

[root@server1 services]# pwd /etc/firewalld/services [root@server1 services]# ls -l total 4 -rw-r--r--. 1 root root 449 Dec 11 15:53 amanda-client.xml

Default system defined services are stored at /usr/lib/firewalld/services/

[root@server1 services]# pwd /usr/lib/firewalld/services [root@server1 services]# ls amanda-client.xml  dhcpv6.xml  high-availability.xml  ipp-client.xml  kpasswd.xml      libvirt.xml  mysql.xml    pmcd.xml       pop3s.xml       rpc-bind.xml      ssh.xml          transmission-client.xml bacula-client.xml  dhcp.xml    https.xml              ipp.xml         ldaps.xml        mdns.xml     nfs.xml      pmproxy.xml    postgresql.xml  samba-client.xml  telnet.xml       vnc-server.xml bacula.xml         dns.xml     http.xml               ipsec.xml       ldap.xml         mountd.xml   ntp.xml      pmwebapis.xml  proxy-dhcp.xml  samba.xml         tftp-client.xml  wbem-https.xml dhcpv6-client.xml  ftp.xml     imaps.xml              kerberos.xml    libvirt-tls.xml  ms-wbt.xml   openvpn.xml  pmwebapi.xml   radius.xml      smtp.xml          tftp.xml

[root@server1 services]# cat high-availability.xml <?xml version="1.0" encoding="utf-8"?> <service>   <short>Red Hat High Availability</short>   <description>This allows you to use the Red Hat High Availability (previously named Red Hat Cluster Suite). Ports are opened for corosync, pcsd, pacemaker_remote and dlm.</description>   <port protocol="tcp" port="2224"/>   <port protocol="tcp" port="3121"/>   <port protocol="udp" port="5404"/>   <port protocol="udp" port="5405"/>   <port protocol="tcp" port="21064"/> </service>

[root@server1 services]# cat samba-client.xml <?xml version="1.0" encoding="utf-8"?> <service>   <short>Samba Client</short>   <description>This option allows you to access Windows file and printer sharing networks. You need the samba-client package installed for this option to be useful.</description>   <port protocol="udp" port="137"/>   <port protocol="udp" port="138"/>   <module name="nf_conntrack_netbios_ns"/> </service>

If you want to add a services, you could do by:

[root@server1 services]# firewall-cmd --zone=public --add-service=high-availability success

Let’s type # firewall-cmd --list-all to get the configuration for the current zone.

[root@server1 services]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

Everything you add, will persist until reboot only. If you want to make it permanent setting, type:

[root@server1 services]# firewall-cmd --permanent --zone=public --add-service=high-availability success

Exercise:

1. Open a root shell. Type firewall-cmd --get-default-zone . This shows the current default zone. You’ll see the current default zone, which is by default set to public.

[root@server1 /]# firewall-cmd --get-default-zone public

2. To see which zones are available, type firewall-cmd --get-zones .

[root@server1 /]# firewall-cmd --get-zones block dmz drop external home internal public trusted work

3. Now show the services that are available on your server by using firewall-cmd--get-services . Notice that the firewall-cmd --get options show what is available on your server.

[root@server1 /]# firewall-cmd --get-services amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

4. To see which services are available in the current zone, type firewall-cmd--list-services . You’ll see a short list containing a Dynamic Host Configuration Protocol (DHCP) client as well as Secure Shell (SSH).

[root@server1 /]# firewall-cmd --list-services dhcpv6-client high-availability https samba-client ssh

5. Now type firewall-cmd --list-all . Look at the output and compare the output to the result of firewall-cmd --list-all --zone=public . Both commands show a complete overview of the current firewall configuration. Notice that you see much more than just the zone and services that are configured in that zone; you also see information about the interfaces and more advanced items.

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

[root@server1 /]# firewall-cmd --list-all --zone=public public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

6. Type firewall-cmd --add-service=vnc-server to add the VNC server to the configuration of the firewall. Verify using firewall-cmd --list-all .

[root@server1 /]# firewall-cmd --add-service=vnc-server success

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh vnc-server   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

7. Type systemctl restart firewalld and repeat firewall-cmd --list-all . Notice that the vnc-server service is no longer listed.

[root@server1 /]# systemctl restart firewalld

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

8. Add the vnc-server service again, but make it permanent this time, using firewall-cmd --add-service vnc-server --permanent .

[root@server1 /]# firewall-cmd --add-service=vnc-server --permanent success

9. Type firewall-cmd --list-all again to verify. You’ll see that VNC server is not listed. Services that have been added to the on-disk configuration are not added automatically to the runtime configuration. Type firewall-cmd --reload to reload the on-disk configuration into runtime configuration.

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

[root@server1 /]# firewall-cmd --reload success

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh vnc-server   ports: 8080/tcp 2020/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

10. Type firewall-cmd --addport=2022/tcp --permanent , followed by firewallcmd --reload . Verify using firewall-cmd --list-all . You’ll see that a port has now been added to the firewalld configuration.

[root@server1 /]# firewall-cmd --add-port=2022/tcp --permanent success

[root@server1 /]# firewall-cmd --reload success

[root@server1 /]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client high-availability https samba-client ssh vnc-server   ports: 2020/tcp 8080/tcp 2022/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules: Common firewall-cmd Options Firewall-cmd Options Explanation --get-zones Lists all available zones --get-default-zone Shows the zone currently set as default zone --set-default-zone=<ZONE> Changes the default zone --get-services Shows all available services --list-services Shows services currently in use --add-service=<service-name>              [--zone=<ZONE>] Adds a service to the current default zone or the zone that is specified --remove-service=<service-name> Removes a service from the configuration --list-all [--zone=<ZONE>] Lists all configurations in a zone --add-port=<port/protocol> [--zone=<ZONE>] Adds a port and protocol --remove-port=<port/protocol> [--zone=<ZONE>] Removes a port from the configuration --add-interface=<INTERFACE> [--zone=<ZONE>] Adds an interface to the default zone or a specific zone that is specified --remove-interface=<INTERFACE> [--zone=<ZONE>] Removes an interface from a specific zone --add-source=<ipaddress/netmask> [--zone=<ZONE>] Adds a specific IP address --remove-source=<ipaddress/netmask> [-zone=<ZONE>] Removes an IP address from the configuration --permanent Writes configuration to disk and not to run-time --reload Reloads the on-disk configuration Thank you for reading. For Reading other article, visit to “https://sites.google.com/site/unixwikis/”

RHEL 7 - Extending a Logical Volume

Outcomes:

A Resized logical volume, 700Mib, called storage in the volume group shazam, mounted at /storage. Resizing done while the file system is still mounted and is use. The volume group extended to include an additional physical volume of 512MiB, giving a total VG size of 1GiB.

1. Check for space in Volume Group

                  Use vgdisplay to check if the VG has sufficient free space to extend the LV to a total size of 700MiB.

[root@server1 /]# vgdisplay shazam   --- Volume group ---   VG Name               shazam   System ID               Format                lvm2   Metadata Areas        2   Metadata Sequence No  2   VG Access             read/write   VG Status             resizable   MAX LV                0   Cur LV                1   Open LV               1   Max PV                0   Cur PV                2   Act PV                2   VG Size               504.00 MiB   PE Size               4.00 MiB   Total PE              126   Alloc PE / Size       100 / 400.00 MiB   Free  PE / Size       26 / 104.00 MiB   VG UUID               wWqgm1-BjlR-yByw-3XVN-11RD-25ay-Hfzj3Y

There is only 104MiB available (25 PEs X 4MiB extents) and we need at least 300Mib to have 700Mib in total. We need to extend the VG.

For later comparison, use df to check current disk space:

[root@server1 /]# df -h /storage Filesystem                  Size  Used Avail Use% Mounted on /dev/mapper/shazam-storage  397M   21M  377M   6% /storage

2. Create the Physical Resources

                  2. 1 Use fdisk to create an additional partitions of 512Mib and set to to type LVM.

[root@server1 /]# fdisk /dev/sdb Welcome to fdisk (util-linux 2.23.2).

                  2.2 Add a new Primary partition of 512Mib.

Command (m for help): n Partition type:    p   primary (2 primary, 0 extended, 2 free)    e   extended Select (default p): Using default response p Partition number (3,4, default 3): First sector (1050624-10485759, default 1050624): Using default value 1050624 Last sector, +sectors or +size{K,M,G} (1050624-10485759, default 10485759): +512M Partition 3 of type Linux and of size 512 MiB is set

                  2.3 Change the partition type to Linux Lvm - 0X8e

Command (m for help): t Partition number (1-3, default 3): Hex code (type L to list all codes): 8e Changed type of partition 'Linux' to 'Linux LVM'

                  2.4 Write the changes to the partition table and quit

Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. WARNING: Re-reading the partition table failed with error 16: Device or resource busy. The kernel still uses the old table. The new table will be used at the next reboot or after you run partprobe(8) or kpartx(8) Syncing disks.

                  2.5 Use partprobe to register the new partions with the kernel.

[root@server1 /]# partprobe Warning: Unable to open /dev/sr0 read-write (Read-only file system).  /dev/sr0 has been opened read-only. Warning: Unable to open /dev/sr0 read-write (Read-only file system).  /dev/sr0 has been opened read-only. Warning: Unable to open /dev/sr0 read-write (Read-only file system).  /dev/sr0 has been opened read-only. [root@server1 /]# cat /proc/partitions major minor  #blocks  name  11        0    3655680 sr0    8        0   20971520 sda    8        1    1048576 sda1    8        2   10485760 sda2    8       16    5242880 sdb    8       17     262144 sdb1    8       18     262144 sdb2    8       19     524288 sdb3  253        0     409600 dm-0

3. Extend the Volume Group

                  3.1 Use vgextend to extend the VG named shazam, using the new /dev/sdb3 PV.

[root@server1 /]# vgextend shazam /dev/sdb3   Physical volume "/dev/sdb3" successfully created   Volume group "shazam" successfully extended

                  3.2 Use vgdisplay to check the shazam VG free space again. There should be plenty of free space now.

[root@server1 /]# vgdisplay shazam   --- Volume group ---   VG Name               shazam   System ID               Format                lvm2   Metadata Areas        3   Metadata Sequence No  3   VG Access             read/write   VG Status             resizable   MAX LV                0   Cur LV                1   Open LV               1   Max PV                0   Cur PV                3   Act PV                3   VG Size               1012.00 MiB   PE Size               4.00 MiB   Total PE              253   Alloc PE / Size       100 / 400.00 MiB   Free  PE / Size       153 / 612.00 MiB   VG UUID               wWqgm1-BjlR-yByw-3XVN-11RD-25ay-Hfzj3Y

There is now 612MiB Available (153 PEs X 4MiB extents); perfect

4.Extend the logical Volume

Use lvextend to extend the exisitng LV to 700Mib

[root@server1 /]# lvextend -L 700M /dev/shazam//storage   Extending logical volume storage to 700.00 MiB   Logical volume storage successfully resized

Note: If our example, we specified the exact size to make the final LV, but we could also have used:

·        -L              +300M to add the new space using size in MiB.

·        -l               175 to specifiy the total number of extents (175PEs X 4MiB)

·        -l               +75 to add the additional extents needed

Some Example:

·        lvextend -l 128                                   Resize the logical volume to exactly 128 extents in size

·        lvextend -l +128                                 Add 128 extents to the current size of the logical volume.

·        lvextend -L 128M                               Resize the logical volume to exactly 128Mib

·        lvextend -L +128M                            Add 128MiB to the current size of the logical volume.

·        lvextend -l +50%FREE                      Add 50 percent of the current free space in the VG to the LV

5. Resize the File System

Use xfs_growfs to extend the XFS file system to the remainder of the free space on the LV.

[root@server1 /]# xfs_growfs /storage meta-data=/dev/mapper/shazam-storage isize=256    agcount=4, agsize=25600 blks          =                       sectsz=512   attr=2, projid32bit=1          =                       crc=0 data     =                       bsize=4096   blocks=102400, imaxpct=25          =                       sunit=0      swidth=0 blks naming   =version 2              bsize=4096   ascii-ci=0 ftype=0 log      =internal               bsize=4096   blocks=853, version=2          =                       sectsz=512   sunit=0 blks, lazy-count=1 realtime =none                   extsz=4096   blocks=0, rtextents=0 data blocks changed from 102400 to 179200

Note: To grow the logical volume size, use lvresize, followed by the -r option to resize the file system used on it.

Example:

·        lvresize -r -l 75%VG /dev/shazam/storage           This resizes the logical volume so that it will take 75% of the total disk spae in the volume group.

·        lvresize -r -l +75%VG /dev/shazam/storage         This tries to add 75% of the total size of the volume group to the logical volume. (Notice the difference with the previous command)

·        lvresize -r -l +75%FREE /dev/shazam/storage     This add 75% of all free disk space to the logical volume.

·        lvresize -r -l 75%FREE /dev/shazam/storage        This resizes the logical volume ta a total size that equals 75% of the amount of free disk space. (Notice the difference with the previous command)

6. Verify Content Availability and New File System Size

Use df and ls|wc  to review the new file system size and verify the existing files are still prestent.

[root@server1 /]# df -h /storage Filesystem                  Size  Used Avail Use% Mounted on /dev/mapper/shazam-storage  697M   21M  677M   3% /storage [root@server1 /]# ls /storage|wc -l 49

The files are still there and the file system is about the size we expect.

Extend a logical volume and ext4 file system

Adding space to a logical Volume:

# pvcreate /dev/sdb3 [[root@localhost ~]# pvcreate /dev/sdb3   Physical volume "/dev/sdb3" successfully created [root@localhost ~]# pvs   PV         VG    Fmt  Attr PSize   PFree    /dev/sdb1  volg1 lvm2 a-   484.00M      0   /dev/sdb2  volg1 lvm2 a-   484.00M 468.00M   /dev/sdb3        lvm2 --   486.34M 486.34M

# vgextend volg1 /dev/sdb3 vgs to confirm available space [root@localhost ~]# vgextend /dev/volg1 /dev/sdb3   Volume group "volg1" successfully extended [root@localhost ~]# vgs   VG    #PV #LV #SN Attr   VSize VFree    volg1   3   1   0 wz--n- 1.42G 952.00M

#lvextend -L +200M /dev/volg1/logvol1 resize2fs /dev/volg1/logvol1 [root@localhost ~]# lvextend -L 900 /dev/volg1/logvol1   Extending logical volume logvol1 to 900.00 MB   Logical volume logvol1 successfully resized [root@localhost ~]# resize2fs /dev/volg1/logvol1 resize2fs 1.39 (29-May-2006) Filesystem at /dev/volg1/logvol1 is mounted on /mnt; on-line resizing required Performing an on-line resize of /dev/volg1/logvol1 to 921600 (1k) blocks. The filesystem on /dev/volg1/logvol1 is now 921600 blocks long.

Note: The primary difference between xfs_growfs and resize2fs is the argument passed to identify the file system. xfs_growfs takes the mount point and resize2fs take the logical volume.