Minimal KVM Virtual Host Server

Tutorial: Setup CentOS 7 Virtual Host Server as an everyday desktop

Minimalistic Virtual Host server

Chech if the CPU has extension for virtualization first
egrep --color '(vmx|svm)' /proc/cpuinfo

Prepare the Virtual Host Server
yum upgrade -y
yum groupinstall virtualization-hypervisor  -y
yum install virt-install virt-df virt-filesystems virt-inspector virt-resize libguestfs-bash-completion iotop bash-completion  -y

Tools breakdown:
=======================

• virt-install is a command line tool to provision new virtual machines. It supports both text-based and graphical installations, using serial console, SPICE, or VNC client/server pair graphics. Installation media can be local, or exist remotely on an NFS, HTTP, or FTP server. The tool can also be configured to run unattended and kickstart the guest when installation is complete, allowing for easy automation of installation. This tool is installed as part of the virt-install package.
• virt-df A command line tool used to show the actual physical disk usage of virtual machines, similar to the command line tool df. Note that this tool does not work across remote connections. It is installed as part of the libguestfs-tools package.
• virt-inspector examines a virtual machine and tries to determine the version of the OS, the kernel version, what drivers are installed, whether the virtual machine is fully virtualized (FV) or para-virtualized (PV), what applications are installed and more.
• virt-resize can resize existing virtual machine disk images.
• iotop - Linux has always been able to show how much I/O was going on.

Virtual Server Performance tuning
=======================

• yum install tuned
• systemctl enable tuned (to autostart everytime the machine reboots)
• (To list available profiles run) tuned-adm list
• (To check which profile is currently active run) tuned-adm active
• (If not running virtual-host profile then run) tuned-adm profile virtual-host

CentOS 7 Desktop Build

Tutorial: Setup CentOS 7 as an everyday desktop

You can use CentOS 7 as an everyday desktop not just a server. This guide is aimed at building a minimalistic bare essentials build for home office / business users.

Install OS:

• Download the latest CentOS 7 minimal ISO and burn to CD / USB Stick
• Boot up your machine and choose to Install CentOS 7
• Go through the wizard
• The only options to look at would be the partition, machine name and username password. (click on vid for some guidance)

Additional Repo breakdown

Fast track bug, ver and security updates by enabling
vi /etc/yum.repos.d/CentOS-fasttrack.repo
enabled=1

Add Google chrome
vi /etc/yum.repos.d/google-chrome.repo
[google-chrome]
name=google-chrome
baseurl=http://dl.google.com/linux/chrome/rpm/stable/$basearch
enabled=1
gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub

Add additional Driver support
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-2.el7.elrepo.noarch.rpm

Add enterprise Linux and nux repos
yum -y install centos-release-scl epel-release && rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm

(Optional) Server side packages:
Virtualisation SIG
yum install centos-release-qemu-ev.noarch

Application Install and desktop configuration
yum groupinstall "Base" -y
yum groupinstall "X Window System" -y
yum install gnome-classic-session gnome-terminal nautilus-open-terminal control-center liberation-mono-fonts cups gnome-calculator evince eog gedit firefox google-chrome-stable NetworkManager networkmanager-wifi ntfs-3g gnome-tweak-tool bash-completion bash-completion-extras -y

(Optional apps - Everyday useful apps)
yum groupinstall "Office Suite and Productivity" -y
yum install audacity gimp handbrake -y

Multimedia Support
yum install totem gstreamer1-plugins-base gstreamer1-plugins-base-devel gstreamer1-devel gstreamer1-plugins-good gstreamer-plugin-crystalhd  gstreamer1-plugins-bad-free gstreamer1-plugins-bad-free-devel gstreamer1-libav gstreamer1-vaapi gstreamer1-vaapi-devel gstreamer-plugins-base-tools gstreamer-tools.x86_64 PackageKit-gstreamer-plugin dirac flac libtheora libvorbis libvpx wavpack libv4l gavl libbluray libdv libmpcdec compat-libstdc++-33 gstreamer gstreamer-plugins-bad-free gstreamer-plugins-bad-free-devel gstreamer-plugins-base gstreamer-plugins-base-devel gstreamer-plugins-good gstreamer-python gstreamer-python-devel compat-libstdc++-33 gstreamer1-plugins-bad-free-extras gstreamer1-plugins-bad-freeworld gstreamer1-plugins-base-tools gstreamer1-plugins-good-extras gstreamer1-plugins-ugly gstreamer1 gstreamer-plugins-ugly gstreamer-ffmpeg -y

Turn off GNOME animations
yum install dconf-editor -y

(Optional) VPN Cisco Anyconnect
yum install openconnect pangox-compat -y

(Optional) Virtualisation
yum groupinstall 'Virtualization Hypervisor' -y
yum install virt-manager, qemu libguestfs-bash-completion -y

(Optional - wanting to add to your Win Domain environment)
yum install sssd realmd ntp -y

Configure and add machine to your DC, below is an example
++++++++++++++++++++++++++++++++++++++++++++++++++++
realm join group.company.eu -U adminaccount

vi /etc/sudoers
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
adminaccount@group.company.eu    ALL=(ALL)       ALL
group.dxi.eu\Domain_Admins     ALL=(ALL)       ALL

vi /etc/ntp.conf
server ntp1.int.company-ntpserver.eu
server ntp2.int.company-ntpserver.eu
server ntp3.int.compant-ntpserver.eu

++++++++++++++++++++++++++++++++++++++++++++++++++++

If you want to boot straight into Desktop GUI
unlink /etc/systemd/system/default.target
ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target

Notes: When trying to enable"Global Dark Theme" causing the following error:

"Error writing setting", to fix:

1. cd ~/.config
2. mkdir gtk-3.0
3. cd gtk-3.0/
4. touch settings.ini
5. Log out
6. Log back in

Setup a Bridged Network on Linux using Network Manager (Fedora, CentOS7, RHEL7)

Tutorial-Linux-Networking

NetworkManager has many benefits especially with WiFi compatibility, virtualisation and it's found by default on many Linux distros.

You may find when attempting to setup Bridging libvirt setups fail; suggested solution is to disable NetworkManager and use the classic network initscripts. However there is a work around for the bug.

Quick Ref Guide:

1. Remove existing wired Network
2. Add a new bridge connection
3. Ensure bridge is set to connect automatically
4. Add bridged-slave connections
5. Set bridged-slave connection to auto
6. Check bridged-slave interface MAC Address is your physical network (the one you removed)
7. Activate the connection

CLI Guide

1. Make sure bridge module is loaded

modprobe --first-time bridge
modprobe: ERROR: could not insert 'bridge': Module already in kernel

2. Grab the name of your interface(s) and delete existing network(s)

nmcli con show 

nmcli con del 'Your interface'

(can use filter options, i.e view all active connections only, use nmcli --fields ACTIVE, NAME, UUID, TYPE, DEVICE, STATE c show)

3. Create Bridged network

nmcli con add type bridge ifname br0

(leaving the name blank after 'ifname' will default to default to bridge, bridge-1, bridge-2, and so on)

4. (Optional steps) Disable SFTP, Delay directive

nmcli con modify bridge-br0 bridge.stp no
vi /etc/sysconfig/network-scripts/ifcfg-bridge-br0 add line Delay=0

5. Create bridged-slave connection under current master bridge.

nmcli con add type bridge-slave ifname 'your interface name' master bridge-br0 

(you can grab the interface name ip a, this will be your physical interface)

6. Activate the bridge connection

ifup bridge-br0 bridge-slave-en0 or restart all your existing network interface(s) systemctl restart network

Notes
The above can be accomplished using NetworkManager Text User Interface by issuing nmtui. 

You can always go back and modify your network by issuing nmcli connection edit bridge-br0 which brings you to the interactive mode.

Useful definitions

• ifname = The name of the interface to the bridge.
• Aging time = The time, in seconds, a MAC address is kept in the MAC address forwarding database.
• STP (Spanning Tree Protocol)
• Priority = The bridge priority; the bridge with the lowest priority will be elected as the root bridge.
• Forward delay = The time, in seconds, spent in both the Listening and Learning states before entering the
• Forwarding state = The default is 15 seconds.
• Hello time = The time interval, in seconds, between sending configuration information in bridge protocol
• data units (BPDU).
• Max age = The maximum time, in seconds, to store the configuration information from BPDUs. This
• value should be twice the Hello Time plus 1 but less than twice the Forwarding delay minus

For more about Linux bridge network setups click here

Enable Java/NPAPI in Google Chrome

Skip to end of metadata

Go to start of metadata

How to enable Java in Google Chrome

Background

NPAPI support by Chrome (Copied from Java's website)

The Java plug-in for web browsers relies on the cross platform plugin architecture NPAPI, which has long been, and currently is, supported by all major web browsers. Google announced in September 2013 plans to remove NPAPI support from Chrome by "the end of 2014", thus effectively dropping support for Silverlight, Java, Facebook Video and other similar NPAPI based plugins. Recently, Google has revised their plans and now state that they plan to completely remove NPAPI by late 2015. As it is unclear if these dates will be further extended or not, we strongly recommend Java users consider alternatives to Chrome as soon as possible. Instead, we recommend Firefox, Internet Explorer and Safari as longer-term options. As of April 2015, starting with Chrome Version 42, Google has added an additional step to configuring NPAPI based plugins like Java to run — see the section Enabling NPAPI in Chrome Version 42 and laterbelow.

The Fix

Enabling NPAPI in Chrome Version 42 and later

As of Chrome Version 42, an additional configuration step is required to continue using NPAPI plugins.

1. In your URL bar, enter:
   chrome://flags/#enable-npapi 
2. Click the Enable link for the Enable NPAPI configuration option.
3. Click the Relaunch button that now appears at the bottom of the configuration page.

Developers and System administrators looking for alternative ways to support users of Chrome should see this blog, in particular "Running Web Start applications outside of a browser" and "Additional Deployment Options" section.

Partitioning Linux File System (Redhat, Fedora, CentOS)

Tutorial-Partition-Linux

/boot recommended size at least 500MB
The partition mounted on /boot contains the operating system kernel along with files used for the bootstrap process.

/ recommended size of 10 GB
This is where the root directory is located. The root directory is the top-level  and by default all files are written to this partition unless a different partition is mounted in the path being written to (i.e /boot or /home). 5GB root partition allows you to install a minimal installation, it is recommended to allocate at least 10GB so that you can perform a full installation, choosing all package groups.

/home recommended size up to user but normally 50GB or over
User data storage which is separate from system data, create a dedicated partition within a volume group for the /home directory. This partition should be sized accordingly on the amount of user data that will be stored locally.

swap (varies)

• Systems with 4GB of ram or less require a minimum of 2GB of swap space 
• Systems with 4GB to 16GB of ram require a minimum of 4GB of swap space
• Systems with 16GB to 64GB of ram require a minimum of 8GB of swap space
• Systems with 64GB to 256GB of ram require a minimum of 16GB of swap space

SSD Optimization

Using the btrfs file system you can optimize SSD. There are two ways this can be done.

1) The first way is mkfs.btrfs turns off meta data duplication on a single device when /sys/block/device/queue/rotational is zero for the single specified device. This is equivalent to specifying -m single on the command line. It can be overridden and duplicate meta data forced by providing the -m dup option.

Duplication is not required due to SSD firmware potentially losing both copies. This wastes space and is a performance cost.

2) The second way is through a group of SSD mount options: ssd, nossd, and ssd_spread. The ssd option does several things:

• It allows larger metadata cluster allocation.
• It allocates data more sequentially where possible.
• It disables btree leaf rewriting to match key and block order.
• It commits log fragments without batching multiple processes.

The ssd mount option only enables the ssd option. Use the nossd option to disable it.

Partition tree example using "lsblk" command.

Plain HTML5 Cheat / Reference Sheet

Programming: HTML5 Cheat / Reference Sheet

Bolded text

<b>Text goes here</b>

Italic text

<i>Text goes here</i>

Underlined text

<u>Text goes here</u>

Changing font color

<font color=”blue”>Text goes here</font>

Changing font size

<font size=”12px”>Text goes here</font>
<font size=”large”>Text goes here</font>

Adding links

<a href=”sadiqulanalysis.blogspot.co.uk” target=”_blank”>Link goes here</a> 

(target=_blank indicates that the link will open in a new browser window or tab; you may remove it if you’d like the link to open in the same window)

Adding images

<img src=”sadiqulanalysis.blogspot.co.uk/image.jpg” border=”1px black solid” align=”right” />

border=”1px #000 solid” puts black border around the image. The "1px" value refers to the border thickness, the second value "black" refers to the border colour, the third value (solid) refers to the pattern of the line, which can be replaced with "dotted" or "dashed"
align=”right” will position the image to alignment you may replace right with left, center or justify

Adding a horizontal divider between sections on web page

 <hr> </hr>

Adding a line break

 <br > <br/>

Making nested bulletined list

<ul>
<li>Section A</li>

<ul>
<li>Section A Part 1</li>
<li>Section A Part 2</li>

<ul>
<li>Section A Part 2.1</li>
<li>Section A Part 2.2</li>
<li>Section A Part 2.3</li>
</ul>

<li>Section A Part 3</li>
<li>Section A Part 4</li>
</ul>

<li>Section B</li>
<li>Section C</li>

<ul>
<li>Section C Part 1</li>
<li>Section C Part 2</li>
</ul>

<li>Section D</li>
</ul>

Making a numbered list

Replace <ul> with <ol> and </ul> with </ol> in the code above
You can also combine numbers and bullets within the same nested list, depending on whether you choose to use <ul> </ul> or <ol> </ol> for each list level.

Making paragraphs

<p>A paragraph of text goes in here</p>

<p style=”font-size:14px;color:green;font-weight:bold;align=center;”> This whole paragraph of text will be centered, green and in 14px. </p>

Creating nested table

<table border="1" style="width:100%">
  <tr>
    <td>Column 1 Row 1 </td>
    <td>Column 1 Row 2 </td>
    <td>Column 1 Row 3 </td>
  </tr>
  <tr>
    <td>Column 2 Row 1 </td>
    <td>Column 2 Row 2 </td>
    <td>Column 2 Row 3 </td>
  </tr>
</table>

RDP into a Linux box from Windows

Tutorial:xRDP-Windows-Linux

Use Windows Remote Desktop Protocol to log into a Linux machine. This tutorial is for primarily Centos 7 / Rhel 7 / Fedora

1.  Open up the terminal either locally or remotely
2.  Enter: vi /etc/yum.repos.d/xrdp.repo
3.  Enter the following content into vi editor:
   [xrdp]
   name=xrdp
   baseurl=http://li.nux.ro/download/nux/dextop/el7/x86_64/
   enabled=1
   gpgcheck=0
   
   Hit : and type wq! to save changes
4.  Enter: yum -y install xrdp tigervnc-server
5.  Enter: systemctl start xrdp.service
6. Verify xRDP start up service by entering: netstat -antup | grep xrdp
7. Configure Firewall IPTables
   firewall-cmd --permanent --zone=public --add-port=3389/tcp
   firewall-cmd --reload

Open up remote desktop and enter the Linux machines IP address and test connectivity.

Bypass Skip TrueCrypt Recovery Disk and save it as an Image file

Tutorial:TrueCrypt-Ver7.2-Windows

Bypass Skip TrueCrypt Recovery Disk and save it as an Image file

1. Goto Start > Run / Search for 'cmd' > right click 'run as admin'
2. Type: cd c:\Programs Files\"TrueCrypt format.exe" /noisocheck (your driver letter and file location may be different)

This will skip the CD check, create an ISO file and prompt user to save the image location.

TrueCrypt Windows command line options

TrueCrypt.exe command options (Windows)	Description
truecrypt.exe /a or /auto [devices | favorites]	If no parameter is specified, automatically mount the volume. If devices is specified as the parameter, auto-mount all currently accessible device/partition-hosted TrueCrypt volumes. If favorites is specified as the parameter, auto-mount favorite volumes designated as “mount upon logon”. Note that /auto is implicit if /quit and /volume are specified. If you need to prevent the application window from appearing, use /quit.
truecrypt.exe /b or /beep	Beep after a volume has been successfully mounted or dismounted.
truecrypt.exe /c or /cache [y | n]	Enable or disable password cache, Note that turning the password cache off will not clear it (use /w to clear the password cache).
truecrypt.exe /d or /dismount [drive letter]	Dismount volume specified by drive letter. When no drive letter is specified, dismounts all currently mounted TrueCrypt volumes.
truecrypt.exe /e or /explore	Open a Windows Explorer window after a volume has been mounted.
truecrypt.exe /f or /force	Forces dismount (if the volume to be dismounted contains files being used by the system or an application) and forces mounting in shared mode (i.e., without exclusive access).
truecrypt.exe /h or /history [y | n]	Enables or disables saving the history of mounted volumes.
truecrypt.exe /help or /?	Display command line help.
truecrypt.exe /k or /keyfiles [keyfile | search path]	Specifies a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2. To specify a keyfile stored on a security token or smart card, use the following syntax: token://slot/SLOT_NUMBER/file/FILE_NAME.
truecrypt.exe /l or /letter [drive letter]	Driver letter to mount the volume as. When /l is omitted and when /a is used, the first free drive letter is used.
truecrypt.exe /m or /mount [bk|rm|recovery|ro|sm|ts]	bk or headerbak: Mount volume using embedded backup header. All volumes created by TrueCrypt 6.0 or later contain an embedded backup header (located at the end of the volume). recovery: Do not verify any checksums stored in the volume header. This option should be used only when the volume header is damaged and the volume cannot be mounted even with the mount option headerbak. rm or removable: Mount volume as removable medium. ro or readonly: Mount volume as read-only. ts or timestamp: Do not preserve container modification timestamp. sm or system: Without pre-boot authentication, mount a partition that is within the key scope of system encryption (for example, a partition located on the encrypted system drive of another operating system that is not running). Useful e.g. for backup or repair operations. Note: If you supply a password as a parameter of /p, make sure that the password has been typed using the standard US keyboard layout (in contrast, the GUI ensures this automatically). This is required due to the fact that the password needs to be typed in the pre-boot environment (before Windows starts) where non-US Windows keyboard layouts are not available.
truecrypt.exe format.exe /n or /noisocheck	Do not verify that TrueCrypt Rescue Disks are correctly burned. Warning: never attempt to use this option to facilitate the reuse of a previously created TrueCrypt Rescue Disk. Note that every time you encrypt a system partition/drive, you must create a new TrueCrypt Rescue Disk even if you use the same password. A previously created TrueCrypt Rescue Disk cannot be reused as it was created for a different master key.
truecrypt.exe /p or /password [password]	The volume password. If the password contains spaces, it must be enclosed in quotation marks (e.g., /p “My Password”). Use /p “” to specify an empty password. Warning: this method of entering a volume password may be insecure, for example, when an unencrypted command prompt history log is being saved to unencrypted disk.
truecrypt.exe /q or /quit [background|preferences]	Automatically perform requested actions and exit (main TrueCrypt window will not be displayed). If preferences is specified as the parameter (e.g.,/q preferences), then program settings are loaded/saved and they override settings specified on the command line. /q background launches the TrueCrypt Background Task (tray icon) unless it is disabled in the Preferences.
truecrypt.exe /s or /silent	If /q is specified, suppresses interaction with the user (prompts, error messages, warnings, etc.). If /q is not specified, this option has no effect.
truecrypt.exe /v or /volume [volume]	Path to a TrueCrypt volume to mount (do not use when dismounting). For a file-hosted volume, the path must include the filename. To mount a partition/device-hosted volume, use, for example, /v \Device\Harddisk1\Partition3 (to determine the path to a partition/device, run TrueCrypt and click ‘Select Device’). You can also mount a partition or dynamic volume using its volume name (for example, /v \\?\Volume{5cceb196-48bf-46ab-ad00-70965512253a}\). To determine the volume name use e.g. mountvol.exe. Also note that device paths are case-sensitive.
truecrypt.exe /w or /wipecache	Wipes any passwords cached in the driver memory.