tried to repartition on 6.7 for the DISA STIG, hangs at boot
I am building a system that must be stigged. I let the install do what it felt like, but that resulted in a gigantic /home partition and most of the security interesting bits all being in the same volume as /. I created a smaller /home to recoup room, created new partitions to put /var, /var/log, /var/log/audit and /opt in (STIG says "do it")
lvremove vg/lv_home
lvcreate -L {sane}M -n lv_home
similar lines for the others, and formatted them from the disk manager.
I created temporary mount points for these, mounted them and ran these commands:
cd $old (where old is one of the directories mentioned)
tar -cf ../$old.tar *
cd ../$new ($new is a temporary mount point)
tar -xf ../$old.tar
I then edited fstab to include lines to mount the new partitions.
The system comes up to the splash screen and stays there, although having let it go over last night maybe it has done something. I can't check for a while.
So, boot to single user and correct fstab? Reinstall? How do people install when they know they want to STIG the system? I am mostly a BSD guy on the Linux side, so LVM is a real novelty for me.
Responses
'tar' may not be the best command for copying /var, as /var is likely to contain sockets, named pipes, and other weird file types that aren't handled well (or at all) by 'tar' (certainly not with default options).
I have moved /var in the past, but I don't think I've done it on RHEL 6+, and I generally do it from single-user mode or better yet rescue mode.
(also, I would avoid saving a duplicate copy of the data in a file, by piping the output of the first 'tar' directly to the second:
cd $OLDDIR; tar cf - . | (cd $NEWDIR; tar xf - )
note the spaces!)
Why not just 'cp' the data from old to new? James brings up a good point about sockets, etc. Bring the system up in rescue mode to prevent any dynamic things from living in /var during the copy.
selinux contexts buggered another person recently posted in this discussion forum who had to migrate data from a /var to a new partition. may have to relabel a new partition. Anyone reading this with a similar issue, may need to remember to validate selinux contexts, perhaps (only) temporarily turn off selinux in the /etc/selinux/config file (and reenable after the test of a reboot).
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
