Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
Notes LVM
Voir :
lv_attrs
man 8 lvs
Extents are the smallest units of space that you can allocate in LVM. Physical extents (PE) and logical extents (LE) has the default size of 4 MiB that you can configure. All extents have the same size. When you create a logical volume (LV) within a VG, LVM allocates physical extents on the PVs
Création LVs
lvcreate -l 100%FREE -n newlv vg_data
Script - get size lv_size & vgfree space
lvs --readonly --noheadings --nosuffix --units=m /dev/mapper/applivg-lv_plop -o lv_size vgs --readonly --noheadings --nosuffix --units=m applivg -o vgfree
Pb
# pvcreate /dev/sda3 Device /dev/sda3 not found (or ignored by filtering).
# pvcreate -vvv /dev/sda3 2>&1 | grep '/dev/sda3'
/dev/sda3: Skipping: Too small to hold a PV
Tags
vgchange --deltag T9 --deltag T10 --addtag T13 --addtag T14 grant pvs -o pv_tags /dev/sda2 vgs -o vg_tags /dev/VolGroup00 lvs -o lv_tags /dev/VolGroup00/LogVol00
Use the following command to list all the logical volumes with the database tag
lvs @database
Use the following command to list the currently active host tags
lvm tags
Autres
Resize the PV when some data was allocated at the end of the LVM.
pvs -v --segments /dev/sda5 pvmove --alloc anywhere /dev/sda5:yyyy-end pvs -v --segments /dev/sda5
Notes luks cryptsetup
Voir aussi :
- homectl
- Clevis / Tang Server
Add a new passphrase
cryptsetup luksAddKey /dev/nvme0n1p3
cryptsetup luksDump /dev/sda2
Upgrade your LUKS key derivation function
Source :
lsblk sudo cryptsetup luksHeaderBackup /dev/whatever --header-backup-file /tmp/luksheader
Copy that to a USB stick or something. If something goes wrong here you'll be able to boot a live image and run
sudo cryptsetup luksHeaderRestore /dev/whatever --header-backup-file luksheader
to restore it.
(Edit to add: Once everything is working, delete this backup! It contains the old weak key, and someone with it can potentially use that to brute force your disk encryption key using the old KDF even if you've updated the on-disk KDF.)
Next, run
sudo cryptsetup luksDump /dev/whatever
and look for the Version: line. If it's version 1, you need to update the header to LUKS2. Run
sudo cryptsetup convert /dev/whatever --type luks2
and follow the prompts. Make sure your system still boots, and if not go back and restore the backup of your header. Assuming everything is ok at this point, run
sudo cryptsetup luksDump /dev/whatever
again and look for the PBKDF: line in each keyslot (pay attention only to the keyslots, ignore any references to pbkdf2 that come after the Digests: line). If the PBKDF is either pbkdf2 or argon2i you should convert to argon2id. Run the following:
sudo cryptsetup luksConvertKey /dev/whatever --pbkdf argon2id
and follow the prompts. If you have multiple passwords associated with your drive you'll have multiple keyslots, and you'll need to repeat this for each password.
Distributions! You should really be handling this sort of thing on upgrade. People who installed their systems with your encryption defaults several years ago are now much less secure than people who perform a fresh install today. Please please please do something about this.
Notes logrotate
Voir :
Voir aussi :
/etc/cron.daily/logrotate
#!/bin/sh /usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1 EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]" fi exit 0
Exemple de conf
/opt/atom/apache-tomcat-*/logs/catalina.out
{
copytruncate
weekly
rotate 52
compress
missingok
size 5M
}
/var/log/cups/*_log {
missingok
notifempty
sharedscripts
}
/var/log/dracut.log {
missingok
notifempty
size 30k
yearly
create 0600 root root
}
/var/log/clamav/freshclam.log {
missingok
notifempty
create 644 clam clam
}
/var/log/httpd/*log {
missingok
notifempty
sharedscripts
delaycompress
postrotate
/sbin/service httpd reload > /dev/null 2>/dev/null || true
endscript
}
/var/log/numad.log {
compress
copytruncate
maxage 60
missingok
rotate 5
size 1M
}
# Rotate OCS Inventory NG agent logs daily, only if not empty
# Save 7 days old logs under compressed mode
/var/log/ocsinventory-agent/*.log {
daily
rotate 7
compress
notifempty
missingok
}
/var/account/pacct {
#prerotate loses accounting records, let's no
# prerotate
# /usr/sbin/accton
# endscript
compress
delaycompress
notifempty
daily
rotate 31
create 0600 root root
postrotate
/usr/sbin/accton /var/account/pacct
endscript
}
/var/log/sssd/*.log {
weekly
missingok
notifempty
sharedscripts
rotate 2
compress
postrotate
/bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null || true
endscript
}
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
/var/log/yum.log {
missingok
notifempty
size 30k
yearly
create 0600 root root
}
Test
logrotate -df /etc/logrotate.d/plop
