Red Hat Training
A Red Hat training course is available for RHEL 8
Deploying different types of servers
A guide to deploying different types of servers in Red Hat Enterprise Linux 8
Abstract
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Providing feedback on Red Hat documentation
We appreciate your feedback on our documentation. Let us know how we can improve it.
Submitting comments on specific passages
- View the documentation in the Multi-page HTML format and ensure that you see the Feedback button in the upper right corner after the page fully loads.
- Use your cursor to highlight the part of the text that you want to comment on.
- Click the Add Feedback button that appears near the highlighted text.
- Add your feedback and click Submit.
Submitting feedback through Bugzilla (account required)
- Log in to the Bugzilla website.
- Select the correct version from the Version menu.
- Enter a descriptive title in the Summary field.
- Enter your suggestion for improvement in the Description field. Include links to the relevant parts of the documentation.
- Click Submit Bug.
Chapter 1. Setting up the Apache HTTP web server
1.1. Introduction to the Apache HTTP web server
A web server is a network service that serves content to a client over the web. This typically means web pages, but any other documents can be served as well. Web servers are also known as HTTP servers, as they use the hypertext transport protocol (HTTP).
The Apache HTTP Server, httpd
, is an open source web server developed by the Apache Software Foundation.
If you are upgrading from a previous release of Red Hat Enterprise Linux, you have to update the httpd
service configuration accordingly. This section reviews some of the newly added features, and guides you through the update of prior configuration files.
1.2. Notable changes in the Apache HTTP Server
The Apache HTTP Server has been updated from version 2.4.6 in RHEL 7 to version 2.4.37 in RHEL 8. This updated version includes several new features, but maintains backwards compatibility with the RHEL 7 version at the level of configuration and Application Binary Interface (ABI) of external modules.
New features include:
-
HTTP/2
support is now provided by themod_http2
package, which is a part of thehttpd
module. -
systemd socket activation is supported. See
httpd.socket(8)
man page for more details.
Multiple new modules have been added:
-
mod_proxy_hcheck
- a proxy health-check module -
mod_proxy_uwsgi
- a Web Server Gateway Interface (WSGI) proxy -
mod_proxy_fdpass
- provides support for the passing the socket of the client to another process -
mod_cache_socache
- an HTTP cache using, for example, memcache backend -
mod_md
- an ACME protocol SSL/TLS certificate service
-
The following modules now load by default:
-
mod_request
-
mod_macro
-
mod_watchdog
-
-
A new subpackage,
httpd-filesystem
, has been added, which contains the basic directory layout for the Apache HTTP Server including the correct permissions for the directories. -
Instantiated service support,
httpd@.service
has been introduced. See thehttpd.service
man page for more information.
-
A new
httpd-init.service
replaces the%post script
to create a self-signedmod_ssl
key pair.
-
Automated TLS certificate provisioning and renewal using the Automatic Certificate Management Environment (ACME) protocol is now supported with the
mod_md
package (for use with certificate providers such asLet’s Encrypt
). -
The Apache HTTP Server now supports loading TLS certificates and private keys from hardware security tokens directly from
PKCS#11
modules. As a result, amod_ssl
configuration can now usePKCS#11
URLs to identify the TLS private key, and, optionally, the TLS certificate in theSSLCertificateKeyFile
andSSLCertificateFile
directives. A new
ListenFree
directive in the/etc/httpd/conf/httpd.conf
file is now supported.Similarly to the
Listen
directive,ListenFree
provides information about IP addresses, ports, or IP address-and-port combinations that the server listens to. However, withListenFree
, theIP_FREEBIND
socket option is enabled by default. Hence,httpd
is allowed to bind to a nonlocal IP address or to an IP address that does not exist yet. This allowshttpd
to listen on a socket without requiring the underlying network interface or the specified dynamic IP address to be up at the time whenhttpd
is trying to bind to it.Note that the
ListenFree
directive is currently available only in RHEL 8.For more details on
ListenFree
, see the following table:Table 1.1. ListenFree directive’s syntax, status, and modules
Syntax Status Modules ListenFree [IP-address:]portnumber [protocol]
MPM
event, worker, prefork, mpm_winnt, mpm_netware, mpmt_os2
Other notable changes include:
The following modules have been removed:
-
mod_file_cache
mod_nss
Use
mod_ssl
as a replacement. For details about migrating frommod_nss
, see Section 1.14, “Exporting a private key and certificates from an NSS database to use them in an Apache web server configuration”.-
mod_perl
-
-
The default type of the DBM authentication database used by the Apache HTTP Server in RHEL 8 has been changed from
SDBM
todb5
. -
The
mod_wsgi
module for the Apache HTTP Server has been updated to Python 3. WSGI applications are now supported only with Python 3, and must be migrated from Python 2. The multi-processing module (MPM) configured by default with the Apache HTTP Server has changed from a multi-process, forked model (known as
prefork
) to a high-performance multi-threaded model,event
.Any third-party modules that are not thread-safe need to be replaced or removed. To change the configured MPM, edit the
/etc/httpd/conf.modules.d/00-mpm.conf
file. See thehttpd.service(8)
man page for more information.- The minimum UID and GID allowed for users by suEXEC are now 1000 and 500, respectively (previously 100 and 100).
-
The
/etc/sysconfig/httpd
file is no longer a supported interface for setting environment variables for thehttpd
service. Thehttpd.service(8)
man page has been added for the systemd service. -
Stopping the
httpd
service now uses a “graceful stop” by default. -
The
mod_auth_kerb
module has been replaced by themod_auth_gssapi
module.
1.3. Updating the configuration
To update the configuration files from the Apache HTTP Server version used in Red Hat Enterprise Linux 7, choose one of the following options:
-
If
/etc/sysconfig/httpd
is used to set environment variables, create a systemd drop-in file instead. - If any third-party modules are used, ensure they are compatible with a threaded MPM.
- If suexec is used, ensure user and group IDs meet the new minimums.
You can check the configuration for possible errors by using the following command:
# apachectl configtest Syntax OK
1.4. The Apache configuration files
The httpd
, by default, reads the configuration files after start. You can see the list of the locations of configuration files in the table below.
Table 1.2. The httpd service configuration files
Path | Description |
---|---|
| The main configuration file. |
| An auxiliary directory for configuration files that are included in the main configuration file. |
| An auxiliary directory for configuration files which load installed dynamic modules packaged in Red Hat Enterprise Linux. In the default configuration, these configuration files are processed first. |
Although the default configuration is suitable for most situations, you can use also other configuration options. For any changes to take effect, restart the web server first.
To check the configuration for possible errors, type the following at a shell prompt:
# apachectl configtest
Syntax OK
To make the recovery from mistakes easier, make a copy of the original file before editing it.
1.5. Managing the httpd service
This section describes how to start, stop, and restart the httpd
service.
Prerequisites
- The Apache HTTP Server is installed.
Procedure
To start the
httpd
service, enter:# systemctl start httpd
To stop the
httpd
service, enter:# systemctl stop httpd
To restart the
httpd
service, enter:# systemctl restart httpd
1.6. Setting up a single-instance Apache HTTP Server
This section describes how to set up a single-instance Apache HTTP Server to serve static HTML content.
Follow the procedure in this section if the web server should provide the same content for all domains associated with the server. If you want to provide different content for different domains, set up name-based virtual hosts. For details, see Configuring Apache name-based virtual hosts.
Procedure
Install the
httpd
package:# yum install httpd
If you use
firewalld
, open the TCP port80
in the local firewall:# firewall-cmd --permanent --add-port=80/tcp # firewall-cmd --reload
Enable and start the
httpd
service:# systemctl enable --now httpd
Optional: Add HTML files to the
/var/www/html/
directory.NoteWhen adding content to
/var/www/html/
, files and directories must be readable by the user under whichhttpd
runs by default. The content owner can be the either theroot
user androot
user group, or another user or group of the administrator’s choice. If the content owner is theroot
user androot
user group, the files must be readable by other users. The SELinux context for all the files and directories must behttpd_sys_content_t
, which is applied by default to all content within the/var/www
directory.
Verification steps
Connect with a web browser to
http://server_IP_or_host_name/
.If the
/var/www/html/
directory is empty or does not contain anindex.html
orindex.htm
file, Apache displays theRed Hat Enterprise Linux Test Page
. If/var/www/html/
contains HTML files with a different name, you can load them by entering the URL to that file, such ashttp://server_IP_or_host_name/example.html
.
Additional resources
- Apache manual: Installing the Apache HTTP server manual.
-
See the
httpd.service(8)
man page.
1.7. Configuring Apache name-based virtual hosts
Name-based virtual hosts enable Apache to serve different content for different domains that resolve to the IP address of the server.
The procedure in this section describes setting up a virtual host for both the example.com
and example.net
domain with separate document root directories. Both virtual hosts serve static HTML content.
Prerequisites
Clients and the web server resolve the
example.com
andexample.net
domain to the IP address of the web server.Note that you must manually add these entries to your DNS server.
Procedure
Install the
httpd
package:# yum install httpd
Edit the
/etc/httpd/conf/httpd.conf
file:Append the following virtual host configuration for the
example.com
domain:<VirtualHost *:80> DocumentRoot "/var/www/example.com/" ServerName example.com CustomLog /var/log/httpd/example.com_access.log combined ErrorLog /var/log/httpd/example.com_error.log </VirtualHost>
These settings configure the following:
-
All settings in the
<VirtualHost *:80>
directive are specific for this virtual host. -
DocumentRoot
sets the path to the web content of the virtual host. ServerName
sets the domains for which this virtual host serves content.To set multiple domains, add the
ServerAlias
parameter to the configuration and specify the additional domains separated with a space in this parameter.-
CustomLog
sets the path to the access log of the virtual host. ErrorLog
sets the path to the error log of the virtual host.NoteApache uses the first virtual host found in the configuration also for requests that do not match any domain set in the
ServerName
andServerAlias
parameters. This also includes requests sent to the IP address of the server.
-
All settings in the
Append a similar virtual host configuration for the
example.net
domain:<VirtualHost *:80> DocumentRoot "/var/www/example.net/" ServerName example.net CustomLog /var/log/httpd/example.net_access.log combined ErrorLog /var/log/httpd/example.net_error.log </VirtualHost>
Create the document roots for both virtual hosts:
# mkdir /var/www/example.com/ # mkdir /var/www/example.net/
If you set paths in the
DocumentRoot
parameters that are not within/var/www/
, set thehttpd_sys_content_t
context on both document roots:# semanage fcontext -a -t httpd_sys_content_t "/srv/example.com(/.*)?" # restorecon -Rv /srv/example.com/ # semanage fcontext -a -t httpd_sys_content_t "/srv/example.net(/.\*)?" # restorecon -Rv /srv/example.net/
These commands set the
httpd_sys_content_t
context on the/srv/example.com/
and/srv/example.net/
directory.Note that you must install the
policycoreutils-python-utils
package to run therestorecon
command.If you use
firewalld
, open port80
in the local firewall:# firewall-cmd --permanent --add-port=80/tcp # firewall-cmd --reload
Enable and start the
httpd
service:# systemctl enable --now httpd
Verification steps
Create a different example file in each virtual host’s document root:
# echo "vHost example.com" > /var/www/example.com/index.html # echo "vHost example.net" > /var/www/example.net/index.html
-
Use a browser and connect to
http://example.com
. The web server shows the example file from theexample.com
virtual host. -
Use a browser and connect to
http://example.net
. The web server shows the example file from theexample.net
virtual host.
Additional resources
1.8. Configuring Kerberos authentication for the Apache HTTP web server
To perform Kerberos authentication in the Apache HTTP web server, RHEL 8 uses the mod_auth_gssapi
Apache module. The Generic Security Services API (GSSAPI
) is an interface for applications that make requests to use security libraries, such as Kerberos. The gssproxy
service allows to implement privilege separation for the httpd
server, which optimizes this process from the security point of view.
The mod_auth_gssapi
module replaces the removed mod_auth_kerb
module.
Prerequisites
-
The
httpd
andgssproxy
packages are installed. -
The Apache web server is set up and the
httpd
service is running.
1.8.1. Setting up GSS-Proxy in an IdM environment
This procedure describes how to set up GSS-Proxy
to perform Kerberos authentication in the Apache HTTP web server.
Procedure
Enable access to the
keytab
file of HTTP/<SERVER_NAME>@realm principal by creating the service principal:# ipa service-add HTTP/<SERVER_NAME>
Retrieve the
keytab
for the principal stored in the/etc/gssproxy/http.keytab
file:# ipa-getkeytab -s $(awk '/^server =/ {print $3}' /etc/ipa/default.conf) -k /etc/gssproxy/http.keytab -p HTTP/$(hostname -f)
This step sets permissions to 400, thus only the
root
user has access to thekeytab
file. Theapache
user does not.Create the
/etc/gssproxy/80-httpd.conf
file with the following content:[service/HTTP] mechs = krb5 cred_store = keytab:/etc/gssproxy/http.keytab cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U euid = apache
Restart and enable the
gssproxy
service:# systemctl restart gssproxy.service # systemctl enable gssproxy.service
Additional resources
-
gssproxy(8)
man pages -
gssproxy-mech(8)
man pages -
gssproxy.conf(5)
man pages
1.8.2. Configuring Kerberos authentication for a directory shared by the Apache HTTP web server
This procedure describes how to configure Kerberos authentication for the /var/www/html/private/
directory.
Prerequisites
-
The
gssproxy
service is configured and running.
Procedure
Configure the
mod_auth_gssapi
module to protect the/var/www/html/private/
directory:<Location /var/www/html/private> AuthType GSSAPI AuthName "GSSAPI Login" Require valid-user </Location>
Create the
/etc/systemd/system/httpd.service
file with the following content:.include /lib/systemd/system/httpd.service [Service] Environment=GSS_USE_PROXY=1
Reload the
systemd
configuration:# systemctl daemon-reload
Restart the
httpd
service:# systemctl restart httpd.service
Verification steps
Obtain a Kerberos ticket:
# kinit
- Open the URL to the protected directory in a browser.
1.9. Configuring TLS encryption on an Apache HTTP Server
By default, Apache provides content to clients using an unencrypted HTTP connection. This section describes how to enable TLS encryption and configure frequently used encryption-related settings on an Apache HTTP Server.
Prerequisites
- The Apache HTTP Server is installed and running.
1.9.1. Adding TLS encryption to an Apache HTTP Server
This section describes how to enable TLS encryption on an Apache HTTP Server for the example.com
domain.
Prerequisites
- The Apache HTTP Server is installed and running.
The private key is stored in the
/etc/pki/tls/private/example.com.key
file.For details about creating a private key and certificate signing request (CSR), as well as how to request a certificate from a certificate authority (CA), see your CA’s documentation. Alternatively, if your CA supports the ACME protocol, you can use the
mod_md
module to automate retrieving and provisioning TLS certificates.-
The TLS certificate is stored in the
/etc/pki/tls/certs/example.com.crt
file. If you use a different path, adapt the corresponding steps of the procedure. -
The CA certificate is stored in the
/etc/pki/tls/certs/ca.crt
file. If you use a different path, adapt the corresponding steps of the procedure. - Clients and the web server resolve the host name of the server to the IP address of the web server.
Procedure
Install the
mod_ssl
package:# yum install mod_ssl
Edit the
/etc/httpd/conf.d/ssl.conf
file and add the following settings to the<VirtualHost _default_:443>
directive:Set the server name:
ServerName example.com
ImportantThe server name must match the entry set in the
Common Name
field of the certificate.Optional: If the certificate contains additional host names in the
Subject Alt Names
(SAN) field, you can configuremod_ssl
to provide TLS encryption also for these host names. To configure this, add theServerAliases
parameter with corresponding names:ServerAlias www.example.com server.example.com
Set the paths to the private key, the server certificate, and the CA certificate:
SSLCertificateKeyFile "/etc/pki/tls/private/example.com.key" SSLCertificateFile "/etc/pki/tls/certs/example.com.crt" SSLCACertificateFile "/etc/pki/tls/certs/ca.crt"
For security reasons, configure that only the
root
user can access the private key file:# chown root:root /etc/pki/tls/private/example.com.key # chmod 600 /etc/pki/tls/private/example.com.key
WarningIf the private key was accessed by unauthorized users, revoke the certificate, create a new private key, and request a new certificate. Otherwise, the TLS connection is no longer secure.
If you use
firewalld
, open port443
in the local firewall:# firewall-cmd --permanent --add-port=443/tcp # firewall-cmd --reload
Restart the
httpd
service:# systemctl restart httpd
NoteIf you protected the private key file with a password, you must enter this password each time when the
httpd
service starts.
Verification steps
-
Use a browser and connect to
https://example.com
.
Additional resources
1.9.2. Setting the supported TLS protocol versions on an Apache HTTP Server
By default, the Apache HTTP Server on RHEL uses the system-wide crypto policy that defines safe default values, which are also compatible with recent browsers. For example, the DEFAULT
policy defines that only the TLSv1.2
and TLSv1.3
protocol versions are enabled in apache.
This section describes how to manually configure which TLS protocol versions your Apache HTTP Server supports. Follow the procedure if your environment requires to enable only specific TLS protocol versions, for example:
-
If your environment requires that clients can also use the weak
TLS1
(TLSv1.0) orTLS1.1
protocol. -
If you want to configure that Apache only supports the
TLSv1.2
orTLSv1.3
protocol.
Prerequisites
- TLS encryption is enabled on the server as described in Adding TLS encryption to an Apache HTTP server.
Procedure
Edit the
/etc/httpd/conf/httpd.conf
file, and add the following setting to the<VirtualHost>
directive for which you want to set the TLS protocol version. For example, to enable only theTLSv1.3
protocol:SSLProtocol -All TLSv1.3
Restart the
httpd
service:# systemctl restart httpd
Verification steps
Use the following command to verify that the server supports
TLSv1.3
:# openssl s_client -connect example.com:443 -tls1_3
Use the following command to verify that the server does not support
TLSv1.2
:# openssl s_client -connect example.com:443 -tls1_2
If the server does not support the protocol, the command returns an error:
140111600609088:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1543:SSL alert number 70
- Optional: Repeat the command for other TLS protocol versions.
Additional resources
-
update-crypto-policies(8)
man page - Using system-wide cryptographic policies.
-
For further details about the
SSLProtocol
parameter, refer to themod_ssl
documentation in the Apache manual: Installing the Apache HTTP server manual.
1.9.3. Setting the supported ciphers on an Apache HTTP Server
By default, the Apache HTTP Server uses the system-wide crypto policy that defines safe default values, which are also compatible with recent browsers. For the list of ciphers the system-wide crypto allows, see the /etc/crypto-policies/back-ends/openssl.config
file.
This section describes how to manually configure which ciphers your Apache HTTP Server supports. Follow the procedure if your environment requires specific ciphers.
Prerequisites
- TLS encryption is enabled on the server as described in Adding TLS encryption to an Apache HTTP server.
Procedure
Edit the
/etc/httpd/conf/httpd.conf
file, and add theSSLCipherSuite
parameter to the<VirtualHost>
directive for which you want to set the TLS ciphers:SSLCipherSuite "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!SHA1:!SHA256"
This example enables only the
EECDH+AESGCM
,EDH+AESGCM
,AES256+EECDH
, andAES256+EDH
ciphers and disables all ciphers which use theSHA1
andSHA256
message authentication code (MAC).Restart the
httpd
service:# systemctl restart httpd
Verification steps
To display the list of ciphers the Apache HTTP Server supports:
Install the
nmap
package:# yum install nmap
Use the
nmap
utility to display the supported ciphers:# nmap --script ssl-enum-ciphers -p 443 example.com ... PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A ...
Additional resources
-
update-crypto-policies(8)
man page - Using system-wide cryptographic policies.
- SSLCipherSuite
1.10. Configuring TLS client certificate authentication
Client certificate authentication enables administrators to allow only users who authenticate using a certificate to access resources on the web server. This section describes how to configure client certificate authentication for the /var/www/html/Example/
directory.
If the Apache HTTP Server uses the TLS 1.3 protocol, certain clients require additional configuration. For example, in Firefox, set the security.tls.enable_post_handshake_auth
parameter in the about:config
menu to true
. For further details, see Transport Layer Security version 1.3 in Red Hat Enterprise Linux 8.
Prerequisites
- TLS encryption is enabled on the server as described in Adding TLS encryption to an Apache HTTP server.
Procedure
Edit the
/etc/httpd/conf/httpd.conf
file and add the following settings to the<VirtualHost>
directive for which you want to configure client authentication:<Directory "/var/www/html/Example/"> SSLVerifyClient require </Directory>
The
SSLVerifyClient require
setting defines that the server must successfully validate the client certificate before the client can access the content in the/var/www/html/Example/
directory.Restart the
httpd
service:# systemctl restart httpd
Verification steps
Use the
curl
utility to access thehttps://example.com/Example/
URL without client authentication:$ curl https://example.com/Example/ curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 **alert certificate required**, errno 0
The error indicates that the web server requires a client certificate authentication.
Pass the client private key and certificate, as well as the CA certificate to
curl
to access the same URL with client authentication:$ curl --cacert ca.crt --key client.key --cert client.crt https://example.com/Example/
If the request succeeds,
curl
displays theindex.html
file stored in the/var/www/html/Example/
directory.
Additional resources
1.11. Securing web applications on a web server using ModSecurity
ModSecurity is an open source web application firewall (WAF) supported by various web servers such as Apache, Nginx, and IIS, which reduces security risks in web applications. ModSecurity provides customizable rule sets for configuring your server.
The mod_security-crs
package contains the core rule set (CRS) with rules against cross-website scripting, bad user agents, SQL injection, Trojans, session hijacking, and other exploits.
1.11.1. Deploying the ModSecurity web-based application firewall for Apache
To reduce risks related to running web-based applications on your web server by deploying ModSecurity, install the mod_security
and mod_security_crs
packages for the Apache HTTP server. The mod_security_crs
package provides the core rule set (CRS) for the ModSecurity web-based application firewall (WAF) module.
Procedure
Install the
mod_security
,mod_security_crs
, andhttpd
packages:# yum install -y mod_security mod_security_crs httpd
Start the
httpd
server:# systemctl restart httpd
Verification
Verify that the ModSecurity web-based application firewall is enabled on your Apache HTTP server:
# httpd -M | grep security security2_module (shared)
Check that the
/etc/httpd/modsecurity.d/activated_rules/
directory contains rules provided bymod_security_crs
:# ls /etc/httpd/modsecurity.d/activated_rules/ ... REQUEST-921-PROTOCOL-ATTACK.conf REQUEST-930-APPLICATION-ATTACK-LFI.conf ...
1.11.2. Adding a custom rule to ModSecurity
If the rules contained in the ModSecurity core rule set (CRS) do not fit your scenario and if you want to prevent additional possible attacks, you can add your custom rules to the rule set used by the ModSecurity web-based application firewall. The following example demonstrates the addition of a simple rule. For creating more complex rules, see the reference manual on the ModSecurity Wiki website.
Prerequisites
- ModSecurity for Apache is installed and enabled.
Procedure
Open the
/etc/httpd/conf.d/mod_security.conf
file in a text editor of your choice, for example:# vi /etc/httpd/conf.d/mod_security.conf
Add the following example rule after the line starting with
SecRuleEngine On
:SecRule ARGS:data "@contains evil" "deny,status:403,msg:'param data contains evil data',id:1"
The previous rule forbids the use of resources to the user if the
data
parameter contains theevil
string.- Save the changes, and quit the editor.
Restart the
httpd
server:# systemctl restart httpd
Verification
Create a
test.html
page:# echo "mod_security test" > /var/www/html/test.html
Restart the
httpd
server:# systemctl restart httpd
Request
test.html
without malicious data in theGET
variable of the HTTP request:$ curl http://localhost/test.html?data=good mod_security test
Request
test.html
with malicious data in theGET
variable of the HTTP request:$ curl localhost/test.html?data=xxxevilxxx <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> </body></html>
Check the
/var/log/httpd/error_log
file, and locate the log entry about denying access with theparam data containing an evil data
message:[Wed May 25 08:01:31.036297 2022] [:error] [pid 5839:tid 139874434791168] [client ::1:45658] [client ::1] ModSecurity: Access denied with code 403 (phase 2). String match "evil" at ARGS:data. [file "/etc/httpd/conf.d/mod_security.conf"] [line "4"] [id "1"] [msg "param data contains evil data"] [hostname "localhost"] [uri "/test.html"] [unique_id "Yo4amwIdsBG3yZqSzh2GuwAAAIY"]
Additional resources
1.12. Installing the Apache HTTP Server manual
This section describes how to install the Apache HTTP Server manual. This manual provides a detailed documentation of, for example:
- Configuration parameters and directives
- Performance tuning
- Authentication settings
- Modules
- Content caching
- Security tips
- Configuring TLS encryption
After installing the manual, you can display it using a web browser.
Prerequisites
- The Apache HTTP Server is installed and running.
Procedure
Install the
httpd-manual
package:# yum install httpd-manual
Optional: By default, all clients connecting to the Apache HTTP Server can display the manual. To restrict access to a specific IP range, such as the
192.0.2.0/24
subnet, edit the/etc/httpd/conf.d/manual.conf
file and add theRequire ip 192.0.2.0/24
setting to the<Directory "/usr/share/httpd/manual">
directive:<Directory "/usr/share/httpd/manual"> ... **Require ip 192.0.2.0/24** ... </Directory>
Restart the
httpd
service:# systemctl restart httpd
Verification steps
-
To display the Apache HTTP Server manual, connect with a web browser to
http://host_name_or_IP_address/manual/
1.13. Working with Apache modules
The httpd
service is a modular application, and you can extend it with a number of Dynamic Shared Objects (DSOs). Dynamic Shared Objects are modules that you can dynamically load or unload at runtime as necessary. You can find these modules in the /usr/lib64/httpd/modules/
directory.
1.13.1. Loading a DSO module
As an administrator, you can choose the functionality to include in the server by configuring which modules the server should load. To load a particular DSO module, use the LoadModule
directive. Note that modules provided by a separate package often have their own configuration file in the /etc/httpd/conf.modules.d/
directory.
Prerequisites
-
You have installed the
httpd
package.
Procedure
Search for the module name in the configuration files in the
/etc/httpd/conf.modules.d/
directory:# grep mod_ssl.so /etc/httpd/conf.modules.d/*
Edit the configuration file in which the module name was found, and uncomment the
LoadModule
directive of the module:LoadModule ssl_module modules/mod_ssl.so
If the module was not found, for example, because a RHEL package does not provide the module, create a configuration file, such as
/etc/httpd/conf.modules.d/30-example.conf
with the following directive:LoadModule ssl_module modules/<custom_module>.so
Restart the
httpd
service:# systemctl restart httpd
1.13.2. Compiling a custom Apache module
You can create your own module and build it with the help of the httpd-devel
package, which contains the include files, the header files, and the APache eXtenSion
(apxs
) utility required to compile a module.
Prerequisites
-
You have the
httpd-devel
package installed.
Procedure
Build a custom module with the following command:
# apxs -i -a -c module_name.c
Verification steps
- Load the module the same way as described in Loading a DSO module.
1.14. Exporting a private key and certificates from an NSS database to use them in an Apache web server configuration
RHEL 8 no longer provides the mod_nss
module for the Apache web server, and Red Hat recommends using the mod_ssl
module. If you store your private key and certificates in a Network Security Services (NSS) database, for example, because you migrated the web server from RHEL 7 to RHEL 8, follow this procedure to extract the key and certificates in Privacy Enhanced Mail (PEM) format. You can then use the files in the mod_ssl
configuration as described in Configuring TLS encryption on an Apache HTTP server.
This procedure assumes that the NSS database is stored in /etc/httpd/alias/
and that you store the exported private key and certificates in the /etc/pki/tls/
directory.
Prerequisites
- The private key, the certificate, and the certificate authority (CA) certificate are stored in an NSS database.
Procedure
List the certificates in the NSS database:
# certutil -d /etc/httpd/alias/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Example CA C,, Example Server Certificate u,u,u
You need the nicknames of the certificates in the next steps.
To extract the private key, you must temporarily export the key to a PKCS #12 file:
Use the nickname of the certificate associated with the private key, to export the key to a PKCS #12 file:
# pk12util -o /etc/pki/tls/private/export.p12 -d /etc/httpd/alias/ -n "Example Server Certificate" Enter password for PKCS12 file: password Re-enter password: password pk12util: PKCS12 EXPORT SUCCESSFUL
Note that you must set a password on the PKCS #12 file. You need this password in the next step.
Export the private key from the PKCS #12 file:
# openssl pkcs12 -in /etc/pki/tls/private/export.p12 -out /etc/pki/tls/private/server.key -nocerts -nodes Enter Import Password: password MAC verified OK
Delete the temporary PKCS #12 file:
# rm /etc/pki/tls/private/export.p12
Set the permissions on
/etc/pki/tls/private/server.key
to ensure that only theroot
user can access this file:# chown root:root /etc/pki/tls/private/server.key # chmod 0600 /etc/pki/tls/private/server.key
Use the nickname of the server certificate in the NSS database to export the CA certificate:
# certutil -d /etc/httpd/alias/ -L -n "Example Server Certificate" -a -o /etc/pki/tls/certs/server.crt
Set the permissions on
/etc/pki/tls/certs/server.crt
to ensure that only theroot
user can access this file:# chown root:root /etc/pki/tls/certs/server.crt # chmod 0600 /etc/pki/tls/certs/server.crt
Use the nickname of the CA certificate in the NSS database to export the CA certificate:
#
certutil -d /etc/httpd/alias/ -L -n "Example CA" -a -o /etc/pki/tls/certs/ca.crt
Follow Configuring TLS encryption on an Apache HTTP server to configure the Apache web server, and:
-
Set the
SSLCertificateKeyFile
parameter to/etc/pki/tls/private/server.key
. -
Set the
SSLCertificateFile
parameter to/etc/pki/tls/certs/server.crt
. -
Set the
SSLCACertificateFile
parameter to/etc/pki/tls/certs/ca.crt
.
-
Set the
Additional resources
-
certutil(1)
man page -
pk12util(1)
man page -
pkcs12(1ssl)
man page
1.15. Additional resources
-
httpd(8)
-
httpd.service(8)
-
httpd.conf(5)
-
apachectl(8)
- Using GSS-Proxy for Apache httpd operation.
- Configuring applications to use cryptographic hardware through PKCS #11.
Chapter 2. Setting up and configuring NGINX
NGINX is a high performance and modular server that you can use, for example, as a:
- Web server
- Reverse proxy
- Load balancer
This section describes how to NGINX in these scenarios.
2.1. Installing and preparing NGINX
Red Hat uses Application Streams to provide different versions of NGINX. This section describes how to:
- Select a stream and install NGINX
- Open the required ports in the firewall
-
Enable and start the
nginx
service
Using the default configuration, NGINX runs as a web server on port 80
and provides content from the /usr/share/nginx/html/
directory.
Prerequisites
- RHEL 8 is installed.
- The host is subscribed to the Red Hat Customer Portal.
-
The
firewalld
service is enabled and started.
Procedure
Display the available NGINX module streams:
#
yum module list nginx
Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs) Name Stream Profiles Summary nginx 1.14 [d] common [d] nginx webserver nginx 1.16 common [d] nginx webserver ... Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalledIf you want to install a different stream than the default, select the stream:
#
yum module enable nginx:stream_version
Install the
nginx
package:#
yum install nginx
Open the ports on which NGINX should provide its service in the firewall. For example, to open the default ports for HTTP (port 80) and HTTPS (port 443) in
firewalld
, enter:#
firewall-cmd --permanent --add-port={80/tcp,443/tcp}
#firewall-cmd --reload
Enable the
nginx
service to start automatically when the system boots:#
systemctl enable nginx
Optionally, start the
nginx
service:#
systemctl start nginx
If you do not want to use the default configuration, skip this step, and configure NGINX accordingly before you start the service.
Verification steps
Use the
yum
utility to verify that thenginx
package is installed:#
yum list installed nginx
Installed Packages nginx.x86_64 1:1.14.1-9.module+el8.0.0+4108+af250afe @rhel-8-for-x86_64-appstream-rpmsEnsure that the ports on which NGINX should provide its service are opened in the firewalld:
#
firewall-cmd --list-ports
80/tcp 443/tcpVerify that the
nginx
service is enabled:#
systemctl is-enabled nginx
enabled
Additional resources
- For details about Subscription Manager, see the Using and Configuring Subscription Manager guide.
- For further details about Application Streams, modules, and installing packages, see the Installing, managing, and removing user-space components guide.
- For details about configuring firewalls, see the Securing networks guide.
2.2. Configuring NGINX as a web server that provides different content for different domains
By default, NGINX acts as a web server that provides the same content to clients for all domain names associated with the IP addresses of the server. This procedure explains how to configure NGINX:
-
To serve requests to the
example.com
domain with content from the/var/www/example.com/
directory -
To serve requests to the
example.net
domain with content from the/var/www/example.net/
directory -
To serve all other requests, for example, to the IP address of the server or to other domains associated with the IP address of the server, with content from the
/usr/share/nginx/html/
directory
Prerequisites
- NGINX is installed
Clients and the web server resolve the
example.com
andexample.net
domain to the IP address of the web server.Note that you must manually add these entries to your DNS server.
Procedure
Edit the
/etc/nginx/nginx.conf
file:By default, the
/etc/nginx/nginx.conf
file already contains a catch-all configuration. If you have deleted this part from the configuration, re-add the followingserver
block to thehttp
block in the/etc/nginx/nginx.conf
file:server { listen 80 default_server; listen [::]:80 default_server; server_name _; root /usr/share/nginx/html; }
These settings configure the following:
-
The
listen
directive define which IP address and ports the service listens. In this case, NGINX listens on port80
on both all IPv4 and IPv6 addresses. Thedefault_server
parameter indicates that NGINX uses thisserver
block as the default for requests matching the IP addresses and ports. -
The
server_name
parameter defines the host names for which thisserver
block is responsible. Settingserver_name
to_
configures NGINX to accept any host name for thisserver
block. -
The
root
directive sets the path to the web content for thisserver
block.
-
The
Append a similar
server
block for theexample.com
domain to thehttp
block:server { server_name example.com; root /var/www/example.com/; access_log /var/log/nginx/example.com/access.log; error_log /var/log/nginx/example.com/error.log; }
-
The
access_log
directive defines a separate access log file for this domain. -
The
error_log
directive defines a separate error log file for this domain.
-
The
Append a similar
server
block for theexample.net
domain to thehttp
block:server { server_name example.net; root /var/www/example.net/; access_log /var/log/nginx/example.net/access.log; error_log /var/log/nginx/example.net/error.log; }
Create the root directories for both domains:
# mkdir -p /var/www/example.com/ # mkdir -p /var/www/example.net/
Set the
httpd_sys_content_t
context on both root directories:# semanage fcontext -a -t httpd_sys_content_t "/var/www/example.com(/.*)?" # restorecon -Rv /var/www/example.com/ # semanage fcontext -a -t httpd_sys_content_t "/var/www/example.net(/.\*)?" # restorecon -Rv /var/www/example.net/
These commands set the
httpd_sys_content_t
context on the/var/www/example.com/
and/var/www/example.net/
directories.Note that you must install the
policycoreutils-python-utils
package to run therestorecon
commands.Create the log directories for both domains:
# mkdir /var/log/nginx/example.com/ # mkdir /var/log/nginx/example.net/
Restart the
nginx
service:# systemctl restart nginx
Verification steps
Create a different example file in each virtual host’s document root:
# echo "Content for example.com" > /var/www/example.com/index.html # echo "Content for example.net" > /var/www/example.net/index.html # echo "Catch All content" > /usr/share/nginx/html/index.html
-
Use a browser and connect to
http://example.com
. The web server shows the example content from the/var/www/example.com/index.html
file. -
Use a browser and connect to
http://example.net
. The web server shows the example content from the/var/www/example.net/index.html
file. -
Use a browser and connect to
http://IP_address_of_the_server
. The web server shows the example content from the/usr/share/nginx/html/index.html
file.
2.3. Adding TLS encryption to an NGINX web server
This section describes how to enable TLS encryption on an NGINX web server for the example.com
domain.
Prerequisites
- NGINX is installed.
The private key is stored in the
/etc/pki/tls/private/example.com.key
file.For details about creating a private key and certificate signing request (CSR), as well as how to request a certificate from a certificate authority (CA), see your CA’s documentation.
-
The TLS certificate is stored in the
/etc/pki/tls/certs/example.com.crt
file. If you use a different path, adapt the corresponding steps of the procedure. - The CA certificate has been appended to the TLS certificate file of the server.
- Clients and the web server resolve the host name of the server to the IP address of the web server.
-
Port
443
is open in the local firewall.
Procedure
Edit the
/etc/nginx/nginx.conf
file, and add the followingserver
block to thehttp
block in the configuration:server { listen 443 ssl; server_name example.com; root /usr/share/nginx/html; ssl_certificate /etc/pki/tls/certs/example.com.crt; ssl_certificate_key /etc/pki/tls/private/example.com.key; }
For security reasons, configure that only the
root
user can access the private key file:# chown root:root /etc/pki/tls/private/example.com.key # chmod 600 /etc/pki/tls/private/example.com.key
WarningIf the private key was accessed by unauthorized users, revoke the certificate, create a new private key, and request a new certificate. Otherwise, the TLS connection is no longer secure.
Restart the
nginx
service:# systemctl restart nginx
Verification steps
-
Use a browser and connect to
https://example.com
Additional resources
2.4. Configuring NGINX as a reverse proxy for the HTTP traffic
You can configure the NGINX web server to act as a reverse proxy for HTTP traffic. For example, you can use this functionality to forward requests to a specific subdirectory on a remote server. From the client perspective, the client loads the content from the host it accesses. However, NGINX loads the actual content from the remote server and forwards it to the client.
This procedure explains how to forward traffic to the /example
directory on the web server to the URL https://example.com
.
Prerequisites
- NGINX is installed as described in Installing and preparing NGINX.
- Optional: TLS encryption is enabled on the reverse proxy.
Procedure
Edit the
/etc/nginx/nginx.conf
file and add the following settings to theserver
block that should provide the reverse proxy:location /example { proxy_pass https://example.com; }
The
location
block defines that NGINX passes all requests in the/example
directory tohttps://example.com
.Set the
httpd_can_network_connect
SELinux boolean parameter to1
to configure that SELinux allows NGINX to forward traffic:# setsebool -P httpd_can_network_connect 1
Restart the
nginx
service:# systemctl restart nginx
Verification steps
-
Use a browser and connect to
http://host_name/example
and the content ofhttps://example.com
is shown.
2.5. Configuring NGINX as an HTTP load balancer
You can use the NGINX reverse proxy feature to load-balance traffic. This procedure describes how to configure NGINX as an HTTP load balancer that sends requests to different servers, based on which of them has the least number of active connections. If both servers are not available, the procedure also defines a third host for fallback reasons.
Prerequisites
- NGINX is installed as described in Installing and preparing NGINX.
Procedure
Edit the
/etc/nginx/nginx.conf
file and add the following settings:http { upstream backend { least_conn; server server1.example.com; server server2.example.com; server server3.example.com backup; } server { location / { proxy_pass http://backend; } } }
The
least_conn
directive in the host group namedbackend
defines that NGINX sends requests toserver1.example.com
orserver2.example.com
, depending on which host has the least number of active connections. NGINX usesserver3.example.com
only as a backup in case that the other two hosts are not available.With the
proxy_pass
directive set tohttp://backend
, NGINX acts as a reverse proxy and uses thebackend
host group to distribute requests based on the settings of this group.Instead of the
least_conn
load balancing method, you can specify:- No method to use round robin and distribute requests evenly across servers.
-
ip_hash
to send requests from one client address to the same server based on a hash calculated from the first three octets of the IPv4 address or the whole IPv6 address of the client. -
hash
to determine the server based on a user-defined key, which can be a string, a variable, or a combination of both. Theconsistent
parameter configures that NGINX distributes requests across all servers based on the user-defined hashed key value. -
random
to send requests to a randomly selected server.
Restart the
nginx
service:# systemctl restart nginx
2.6. Additional resources
- For the official NGINX documentation see https://nginx.org/en/docs/. Note that Red Hat does not maintain this documentation and that it might not work with the NGINX version you have installed.
- Configuring applications to use cryptographic hardware through PKCS #11.
Chapter 3. Using Samba as a server
Samba implements the Server Message Block (SMB) protocol in Red Hat Enterprise Linux. The SMB protocol is used to access resources on a server, such as file shares and shared printers. Additionally, Samba implements the Distributed Computing Environment Remote Procedure Call (DCE RPC) protocol used by Microsoft Windows.
You can run Samba as:
- An Active Directory (AD) or NT4 domain member
- A standalone server
An NT4 Primary Domain Controller (PDC) or Backup Domain Controller (BDC)
NoteRed Hat supports the PDC and BDC modes only in existing installations with Windows versions which support NT4 domains. Red Hat recommends not setting up a new Samba NT4 domain, because Microsoft operating systems later than Windows 7 and Windows Server 2008 R2 do not support NT4 domains.
Red Hat does not support running Samba as an AD domain controller (DC).
Independently of the installation mode, you can optionally share directories and printers. This enables Samba to act as a file and print server.
3.1. Understanding the different Samba services and modes
This section describes the different services included in Samba and the different modes you can configure.
3.1.1. The Samba services
Samba provides the following services:
smbd
This service provides file sharing and printing services using the SMB protocol. Additionally, the service is responsible for resource locking and for authenticating connecting users. For authenticating domain members,
smbd
requireswinbindd
. Thesmb
systemd
service starts and stops thesmbd
daemon.To use the
smbd
service, install thesamba
package.nmbd
This service provides host name and IP resolution using the NetBIOS over IPv4 protocol. Additionally to the name resolution, the
nmbd
service enables browsing the SMB network to locate domains, work groups, hosts, file shares, and printers. For this, the service either reports this information directly to the broadcasting client or forwards it to a local or master browser. Thenmb
systemd
service starts and stops thenmbd
daemon.Note that modern SMB networks use DNS to resolve clients and IP addresses. For Kerberos a working DNS setup is required.
To use the
nmbd
service, install thesamba
package.winbindd
This service provides an interface for the Name Service Switch (NSS) to use AD or NT4 domain users and groups on the local system. This enables, for example, domain users to authenticate to services hosted on a Samba server or to other local services. The
winbind
systemd
service starts and stops thewinbindd
daemon.If you set up Samba as a domain member,
winbindd
must be started before thesmbd
service. Otherwise, domain users and groups are not available to the local system..To use the
winbindd
service, install thesamba-winbind
package.ImportantRed Hat only supports running Samba as a server with the
winbindd
service to provide domain users and groups to the local system. Due to certain limitations, such as missing Windows access control list (ACL) support and NT LAN Manager (NTLM) fallback, SSSD is not supported.
3.1.2. The Samba security services
The security
parameter in the [global]
section in the /etc/samba/smb.conf
file manages how Samba authenticates users that are connecting to the service. Depending on the mode you install Samba in, the parameter must be set to different values:
- On an AD domain member, set
security = ads
In this mode, Samba uses Kerberos to authenticate AD users.
For details about setting up Samba as a domain member, see Setting up Samba as an AD domain member server.
- On a standalone server, set
security = user
In this mode, Samba uses a local database to authenticate connecting users.
For details about setting up Samba as a standalone server, see Setting up Samba as a standalone server.
- On an NT4 PDC or BDC, set
security = user
- In this mode, Samba authenticates users to a local or LDAP database.
- On an NT4 domain member, set
security = domain
In this mode, Samba authenticates connecting users to an NT4 PDC or BDC. You cannot use this mode on AD domain members.
For details about setting up Samba as a domain member, see Setting up Samba as an AD domain member server.
Additional resources
-
security
parameter in thesmb.conf(5)
man page
3.1.3. Scenarios when Samba services and Samba client utilities load and reload their configuration
The following describes when Samba services and utilities load and reload their configuration:
Samba services reload their configuration:
- Automatically every 3 minutes
-
On manual request, for example, when you run the
smbcontrol all reload-config
command.
- Samba client utilities read their configuration only when you start them.
Note that certain parameters, such as security
require a restart of the smb
service to take effect and a reload is not sufficient.
Additional resources
-
The
How configuration changes are applied
section in thesmb.conf(5)
man page -
The
smbd(8)
,nmbd(8)
, andwinbindd(8)
man pages
3.1.4. Editing the Samba configuration in a safe way
Samba services automatically reload their configuration every 3 minutes. This procedure describes how to edit the Samba configuration in a way that prevents the services reload the changes before you have verified the configuration using the testparm
utility.
Prerequisites
- Samba is installed.
Procedure
Create a copy of the
/etc/samba/smb.conf
file:# cp /etc/samba/smb.conf /etc/samba/samba.conf.copy
- Edit the copied file and make the desired changes.
Verify the configuration in the
/etc/samba/samba.conf.copy
file:# testparm -s /etc/samba/samba.conf.copy
If
testparm
reports errors, fix them and run the command again.Override the
/etc/samba/smb.conf
file with the new configuration:# mv /etc/samba/samba.conf.copy /etc/samba/smb.conf
Wait until the Samba services automatically reload their configuration or manually reload the configuration:
# smbcontrol all reload-config
3.2. Verifying the smb.conf file by using the testparm utility
The testparm
utility verifies that the Samba configuration in the /etc/samba/smb.conf
file is correct. The utility detects invalid parameters and values, but also incorrect settings, such as for ID mapping. If testparm
reports no problem, the Samba services will successfully load the /etc/samba/smb.conf
file. Note that testparm
cannot verify that the configured services will be available or work as expected.
Red Hat recommends that you verify the /etc/samba/smb.conf
file by using testparm
after each modification of this file.
Prerequisites
- You installed Samba.
-
The
/etc/samba/smb.conf
file exits.
Procedure
Run the
testparm
utility as theroot
user:#
testparm
Load smb config files from /etc/samba/smb.conf rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Unknown parameter encountered: "log levell" Processing section "[example_share]" Loaded services file OK. ERROR: The idmap range for the domain * (tdb) overlaps with the range of DOMAIN (ad)! Server role: ROLE_DOMAIN_MEMBER Press enter to see a dump of your service definitions # Global parameters [global] ... [example_share] ...The previous example output reports a non-existent parameter and an incorrect ID mapping configuration.
-
If
testparm
reports incorrect parameters, values, or other errors in the configuration, fix the problem and run the utility again.
3.3. Setting up Samba as a standalone server
You can set up Samba as a server that is not a member of a domain. In this installation mode, Samba authenticates users to a local database instead of to a central DC. Additionally, you can enable guest access to allow users to connect to one or multiple services without authentication.
3.3.1. Setting up the server configuration for the standalone server
This section describes how to set up the server configuration for a Samba standalone server.
Procedure
Install the
samba
package:# yum install samba
Edit the
/etc/samba/smb.conf
file and set the following parameters:[global] workgroup = Example-WG netbios name = Server security = user log file = /var/log/samba/%m.log log level = 1
This configuration defines a standalone server named
Server
within theExample-WG
work group. Additionally, this configuration enables logging on a minimal level (1
) and log files will be stored in the/var/log/samba/
directory. Samba will expand the%m
macro in thelog file
parameter to the NetBIOS name of connecting clients. This enables individual log files for each client.Optionally, configure file or printer sharing. See:
Verify the
/etc/samba/smb.conf
file:# testparm
If you set up shares that require authentication, create the user accounts.
For details, see Creating and enabling local user accounts.
Open the required ports and reload the firewall configuration by using the
firewall-cmd
utility:# firewall-cmd --permanent --add-service=samba # firewall-cmd --reload
Enable and start the
smb
service:# systemctl enable --now smb
Additional resources
-
smb.conf(5)
man page
3.3.2. Creating and enabling local user accounts
To enable users to authenticate when they connect to a share, you must create the accounts on the Samba host both in the operating system and in the Samba database. Samba requires the operating system account to validate the Access Control Lists (ACL) on file system objects and the Samba account to authenticate connecting users.
If you use the passdb backend = tdbsam
default setting, Samba stores user accounts in the /var/lib/samba/private/passdb.tdb
database.
The procedure in this section describes how to create a local Samba user named example
.
Prerequisites
- Samba is installed and configured as a standalone server.
Procedure
Create the operating system account:
# useradd -M -s /sbin/nologin example
This command adds the
example
account without creating a home directory. If the account is only used to authenticate to Samba, assign the/sbin/nologin
command as shell to prevent the account from logging in locally.Set a password to the operating system account to enable it:
# passwd example Enter new UNIX password:
password
Retype new UNIX password:password
passwd: password updated successfullySamba does not use the password set on the operating system account to authenticate. However, you need to set a password to enable the account. If an account is disabled, Samba denies access if this user connects.
Add the user to the Samba database and set a password to the account:
# smbpasswd -a example New SMB password:
password
Retype new SMB password:password
Added user example.Use this password to authenticate when using this account to connect to a Samba share.
Enable the Samba account:
# smbpasswd -e example Enabled user example.
3.4. Understanding and configuring Samba ID mapping
Windows domains distinguish users and groups by unique Security Identifiers (SID). However, Linux requires unique UIDs and GIDs for each user and group. If you run Samba as a domain member, the winbindd
service is responsible for providing information about domain users and groups to the operating system.
To enable the winbindd
service to provide unique IDs for users and groups to Linux, you must configure ID mapping in the /etc/samba/smb.conf
file for:
- The local database (default domain)
- The AD or NT4 domain the Samba server is a member of
- Each trusted domain from which users must be able to access resources on this Samba server
Samba provides different ID mapping back ends for specific configurations. The most frequently used back ends are:
Back end | Use case |
---|---|
|
The |
| AD domains only |
| AD and NT4 domains |
|
AD, NT4, and the |
3.4.1. Planning Samba ID ranges
Regardless of whether you store the Linux UIDs and GIDs in AD or if you configure Samba to generate them, each domain configuration requires a unique ID range that must not overlap with any of the other domains.
If you set overlapping ID ranges, Samba fails to work correctly.
Example 3.1. Unique ID Ranges
The following shows non-overlapping ID mapping ranges for the default (*
), AD-DOM
, and the TRUST-DOM
domains.
[global] ... idmap config * : backend = tdb idmap config * : range = 10000-999999 idmap config AD-DOM:backend = rid idmap config AD-DOM:range = 2000000-2999999 idmap config TRUST-DOM:backend = rid idmap config TRUST-DOM:range = 4000000-4999999
You can only assign one range per domain. Therefore, leave enough space between the domains ranges. This enables you to extend the range later if your domain grows.
If you later assign a different range to a domain, the ownership of files and directories previously created by these users and groups will be lost.
3.4.2. The * default domain
In a domain environment, you add one ID mapping configuration for each of the following:
- The domain the Samba server is a member of
- Each trusted domain that should be able to access the Samba server
However, for all other objects, Samba assigns IDs from the default domain. This includes:
- Local Samba users and groups
-
Samba built-in accounts and groups, such as
BUILTIN\Administrators
You must configure the default domain as described in this section to enable Samba to operate correctly.
The default domain back end must be writable to permanently store the assigned IDs.
For the default domain, you can use one of the following back ends:
tdb
When you configure the default domain to use the
tdb
back end, set an ID range that is big enough to include objects that will be created in the future and that are not part of a defined domain ID mapping configuration.For example, set the following in the
[global]
section in the/etc/samba/smb.conf
file:idmap config * : backend = tdb idmap config * : range = 10000-999999
For further details, see Using the TDB ID mapping back end.
autorid
When you configure the default domain to use the
autorid
back end, adding additional ID mapping configurations for domains is optional.For example, set the following in the
[global]
section in the/etc/samba/smb.conf
file:idmap config * : backend = autorid idmap config * : range = 10000-999999
For further details, see Using the autorid ID mapping back end.
3.4.3. Using the tdb ID mapping back end
The winbindd
service uses the writable tdb
ID mapping back end by default to store Security Identifier (SID), UID, and GID mapping tables. This includes local users, groups, and built-in principals.
Use this back end only for the *
default domain. For example:
idmap config * : backend = tdb idmap config * : range = 10000-999999
Additional resources
3.4.4. Using the ad ID mapping back end
This section describes how to configure a Samba AD member to use the ad
ID mapping back end.
The ad
ID mapping back end implements a read-only API to read account and group information from AD. This provides the following benefits:
- All user and group settings are stored centrally in AD.
- User and group IDs are consistent on all Samba servers that use this back end.
- The IDs are not stored in a local database which can corrupt, and therefore file ownerships cannot be lost.
The ad
ID mapping back end does not support Active Directory domains with one-way trusts. If you configure a domain member in an Active Directory with one-way trusts, use instead one of the following ID mapping back ends: tdb
, rid
, or autorid
.
The ad back end reads the following attributes from AD:
AD attribute name | Object type | Mapped to |
---|---|---|
| User and group | User or group name, depending on the object |
| User | User ID (UID) |
| Group | Group ID (GID) |
| User | Path to the shell of the user |
| User | Path to the home directory of the user |
| User | Primary group ID |
[a]
Samba only reads this attribute if you set idmap config DOMAIN:unix_nss_info = yes .
[b]
Samba only reads this attribute if you set idmap config DOMAIN:unix_primary_group = yes .
|
Prerequisites
-
Both users and groups must have unique IDs set in AD, and the IDs must be within the range configured in the
/etc/samba/smb.conf
file. Objects whose IDs are outside of the range will not be available on the Samba server. - Users and groups must have all required attributes set in AD. If required attributes are missing, the user or group will not be available on the Samba server. The required attributes depend on your configuration. .Prerequisites
- You installed Samba.
-
The Samba configuration, except ID mapping, exists in the
/etc/samba/smb.conf
file.
Procedure
Edit the
[global]
section in the/etc/samba/smb.conf
file:Add an ID mapping configuration for the default domain (
*
) if it does not exist. For example:idmap config * : backend = tdb idmap config * : range = 10000-999999
Enable the
ad
ID mapping back end for the AD domain:idmap config DOMAIN : backend = ad
Set the range of IDs that is assigned to users and groups in the AD domain. For example:
idmap config DOMAIN : range = 2000000-2999999
ImportantThe range must not overlap with any other domain configuration on this server. Additionally, the range must be set big enough to include all IDs assigned in the future. For further details, see Planning Samba ID ranges.
Set that Samba uses the RFC 2307 schema when reading attributes from AD:
idmap config DOMAIN : schema_mode = rfc2307
To enable Samba to read the login shell and the path to the users home directory from the corresponding AD attribute, set:
idmap config DOMAIN : unix_nss_info = yes
Alternatively, you can set a uniform domain-wide home directory path and login shell that is applied to all users. For example:
template shell = /bin/bash template homedir = /home/%U
By default, Samba uses the
primaryGroupID
attribute of a user object as the user’s primary group on Linux. Alternatively, you can configure Samba to use the value set in thegidNumber
attribute instead:idmap config DOMAIN : unix_primary_group = yes
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
- The * default domain
-
smb.conf(5)
andidmap_ad(8)
man pages -
VARIABLE SUBSTITUTIONS
section in thesmb.conf(5)
man page
3.4.5. Using the rid ID mapping back end
This section describes how to configure a Samba domain member to use the rid
ID mapping back end.
Samba can use the relative identifier (RID) of a Windows SID to generate an ID on Red Hat Enterprise Linux.
The RID is the last part of a SID. For example, if the SID of a user is S-1-5-21-5421822485-1151247151-421485315-30014
, then 30014
is the corresponding RID.
The rid
ID mapping back end implements a read-only API to calculate account and group information based on an algorithmic mapping scheme for AD and NT4 domains. When you configure the back end, you must set the lowest and highest RID in the idmap config DOMAIN : range
parameter. Samba will not map users or groups with a lower or higher RID than set in this parameter.
As a read-only back end, rid
cannot assign new IDs, such as for BUILTIN
groups. Therefore, do not use this back end for the *
default domain.
Benefits of using the rid back end
- All domain users and groups that have an RID within the configured range are automatically available on the domain member.
- You do not need to manually assign IDs, home directories, and login shells.
Drawbacks of using the rid back end
- All domain users get the same login shell and home directory assigned. However, you can use variables.
-
User and group IDs are only the same across Samba domain members if all use the
rid
back end with the same ID range settings. - You cannot exclude individual users or groups from being available on the domain member. Only users and groups outside of the configured range are excluded.
-
Based on the formulas the
winbindd
service uses to calculate the IDs, duplicate IDs can occur in multi-domain environments if objects in different domains have the same RID.
Prerequisites
- You installed Samba.
-
The Samba configuration, except ID mapping, exists in the
/etc/samba/smb.conf
file.
Procedure
Edit the
[global]
section in the/etc/samba/smb.conf
file:Add an ID mapping configuration for the default domain (
*
) if it does not exist. For example:idmap config * : backend = tdb idmap config * : range = 10000-999999
Enable the
rid
ID mapping back end for the domain:idmap config DOMAIN : backend = rid
Set a range that is big enough to include all RIDs that will be assigned in the future. For example:
idmap config DOMAIN : range = 2000000-2999999
Samba ignores users and groups whose RIDs in this domain are not within the range.
ImportantThe range must not overlap with any other domain configuration on this server. Additionally, the range must be set big enough to include all IDs assigned in the future. For further details, see Planning Samba ID ranges.
Set a shell and home directory path that will be assigned to all mapped users. For example:
template shell = /bin/bash template homedir = /home/%U
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
- The * default domain
-
VARIABLE SUBSTITUTIONS
section in thesmb.conf(5)
man page -
Calculation of the local ID from a RID, see the
idmap_rid(8)
man page
3.4.6. Using the autorid ID mapping back end
This section describes how to configure a Samba domain member to use the autorid
ID mapping back end.
The autorid
back end works similar to the rid
ID mapping back end, but can automatically assign IDs for different domains. This enables you to use the autorid
back end in the following situations:
-
Only for the
*
default domain -
For the
*
default domain and additional domains, without the need to create ID mapping configurations for each of the additional domains - Only for specific domains
If you use autorid
for the default domain, adding additional ID mapping configuration for domains is optional.
Parts of this section were adopted from the idmap config autorid documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
Benefits of using the autorid back end
- All domain users and groups whose calculated UID and GID is within the configured range are automatically available on the domain member.
- You do not need to manually assign IDs, home directories, and login shells.
- No duplicate IDs, even if multiple objects in a multi-domain environment have the same RID.
Drawbacks
- User and group IDs are not the same across Samba domain members.
- All domain users get the same login shell and home directory assigned. However, you can use variables.
- You cannot exclude individual users or groups from being available on the domain member. Only users and groups whose calculated UID or GID is outside of the configured range are excluded.
Prerequisites
- You installed Samba.
-
The Samba configuration, except ID mapping, exists in the
/etc/samba/smb.conf
file.
Procedure
Edit the
[global]
section in the/etc/samba/smb.conf
file:Enable the
autorid
ID mapping back end for the*
default domain:idmap config * : backend = autorid
Set a range that is big enough to assign IDs for all existing and future objects. For example:
idmap config * : range = 10000-999999
Samba ignores users and groups whose calculated IDs in this domain are not within the range.
WarningAfter you set the range and Samba starts using it, you can only increase the upper limit of the range. Any other change to the range can result in new ID assignments, and thus in losing file ownerships.
Optionally, set a range size. For example:
idmap config * : rangesize = 200000
Samba assigns this number of continuous IDs for each domain’s object until all IDs from the range set in the
idmap config * : range
parameter are taken.NoteIf you set a rangesize, you need to adapt the range accordingly. The range needs to be a multiple of the rangesize.
Set a shell and home directory path that will be assigned to all mapped users. For example:
template shell = /bin/bash template homedir = /home/%U
Optionally, add additional ID mapping configuration for domains. If no configuration for an individual domain is available, Samba calculates the ID using the
autorid
back end settings in the previously configured*
default domain.ImportantThe range must not overlap with any other domain configuration on this server. Additionally, the range must be set big enough to include all IDs assigned in the future. For further details, see Planning Samba ID ranges.
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
-
THE MAPPING FORMULAS
section in theidmap_autorid(8)
man page -
rangesize
parameter description in theidmap_autorid(8)
man page -
VARIABLE SUBSTITUTIONS
section in thesmb.conf(5)
man page
3.5. Setting up Samba as an AD domain member server
If you are running an AD or NT4 domain, use Samba to add your Red Hat Enterprise Linux server as a member to the domain to gain the following:
- Access domain resources on other domain members
-
Authenticate domain users to local services, such as
sshd
- Share directories and printers hosted on the server to act as a file and print server
3.5.1. Joining a RHEL system to an AD domain
Samba Winbind is an alternative to the System Security Services Daemon (SSSD) for connecting a Red Hat Enterprise Linux (RHEL) system with Active Directory (AD). This section describes how to join a RHEL system to an AD domain by using realmd
to configure Samba Winbind.
Procedure
If your AD requires the deprecated RC4 encryption type for Kerberos authentication, enable support for these ciphers in RHEL:
# update-crypto-policies --set DEFAULT:AD-SUPPORT
Install the following packages:
# yum install realmd oddjob-mkhomedir oddjob samba-winbind-clients \ samba-winbind samba-common-tools samba-winbind-krb5-locator
To share directories or printers on the domain member, install the
samba
package:# yum install samba
Backup the existing
/etc/samba/smb.conf
Samba configuration file:# mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
Join the domain. For example, to join a domain named
ad.example.com
:# realm join --membership-software=samba --client-software=winbind ad.example.com
Using the previous command, the
realm
utility automatically:-
Creates a
/etc/samba/smb.conf
file for a membership in thead.example.com
domain -
Adds the
winbind
module for user and group lookups to the/etc/nsswitch.conf
file -
Updates the Pluggable Authentication Module (PAM) configuration files in the
/etc/pam.d/
directory -
Starts the
winbind
service and enables the service to start when the system boots
-
Creates a
-
Optionally, set an alternative ID mapping back end or customized ID mapping settings in the
/etc/samba/smb.conf
file. For details, see Understanding and configuring Samba ID mapping. Verify that the
winbind
service is running:# systemctl status winbind ... Active: active (running) since Tue 2018-11-06 19:10:40 CET; 15s ago
ImportantTo enable Samba to query domain user and group information, the
winbind
service must be running before you startsmb
.If you installed the
samba
package to share directories and printers, enable and start thesmb
service:# systemctl enable --now smb
-
Optionally, if you are authenticating local logins to Active Directory, enable the
winbind_krb5_localauth
plug-in. See Using the local authorization plug-in for MIT Kerberos.
Verification steps
Display an AD user’s details, such as the AD administrator account in the AD domain:
# getent passwd "AD\administrator" AD\administrator:*:10000:10000::/home/administrator@AD:/bin/bash
Query the members of the domain users group in the AD domain:
# getent group "AD\Domain Users" AD\domain users:x:10000:user1,user2
Optionally, verify that you can use domain users and groups when you set permissions on files and directories. For example, to set the owner of the
/srv/samba/example.txt
file toAD\administrator
and the group toAD\Domain Users
:# chown "AD\administrator":"AD\Domain Users" /srv/samba/example.txt
Verify that Kerberos authentication works as expected:
On the AD domain member, obtain a ticket for the
administrator@AD.EXAMPLE.COM
principal:# kinit administrator@AD.EXAMPLE.COM
Display the cached Kerberos ticket:
# klist Ticket cache: KCM:0 Default principal: administrator@AD.EXAMPLE.COM Valid starting Expires Service principal 01.11.2018 10:00:00 01.11.2018 20:00:00 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM renew until 08.11.2018 05:00:00
Display the available domains:
# wbinfo --all-domains BUILTIN SAMBA-SERVER AD
Additional resources
- If you do not want to use the deprecated RC4 ciphers, you can enable the AES encryption type in AD. See
- Enabling the AES encryption type in Active Directory using a GPO. Note that this can have an impact on other services in your AD.
-
realm(8)
man page
3.5.2. Using the local authorization plug-in for MIT Kerberos
The winbind
service provides Active Directory users to the domain member. In certain situations, administrators want to enable domain users to authenticate to local services, such as an SSH server, which are running on the domain member. When using Kerberos to authenticate the domain users, enable the winbind_krb5_localauth
plug-in to correctly map Kerberos principals to Active Directory accounts through the winbind
service.
For example, if the sAMAccountName
attribute of an Active Directory user is set to EXAMPLE
and the user tries to log with the user name lowercase, Kerberos returns the user name in upper case. As a consequence, the entries do not match and authentication fails.
Using the winbind_krb5_localauth
plug-in, the account names are mapped correctly. Note that this only applies to GSSAPI authentication and not for getting the initial ticket granting ticket (TGT).
Prerequisites
- Samba is configured as a member of an Active Directory.
- Red Hat Enterprise Linux authenticates log in attempts against Active Directory.
-
The
winbind
service is running.
Procedure
Edit the /etc/krb5.conf
file and add the following section:
[plugins] localauth = { module = winbind:/usr/lib64/samba/krb5/winbind_krb5_localauth.so enable_only = winbind }
Additional resources
-
winbind_krb5_localauth(8)
man page.
3.6. Setting up Samba on an IdM domain member
This section describes how to set up Samba on a host that is joined to a Red Hat Identity Management (IdM) domain. Users from IdM and also, if available, from trusted Active Directory (AD) domains, can access shares and printer services provided by Samba.
Using Samba on an IdM domain member is an unsupported Technology Preview feature and contains certain limitations. For example, IdM trust controllers do not support the Active Directory Global Catalog service, and they do not support resolving IdM groups using the Distributed Computing Environment / Remote Procedure Calls (DCE/RPC) protocols. As a consequence, AD users can only access Samba shares and printers hosted on IdM clients when logged in to other IdM clients; AD users logged into a Windows machine can not access Samba shares hosted on an IdM domain member.
Customers deploying Samba on IdM domain members are encouraged to provide feedback to Red Hat.
Prerequisites
- The host is joined as a client to the IdM domain.
- Both the IdM servers and the client must run on RHEL 8.1 or later.
3.6.1. Preparing the IdM domain for installing Samba on domain members
Before you can set up Samba on an IdM client, you must prepare the IdM domain using the ipa-adtrust-install
utility on an IdM server.
Any system where you run the ipa-adtrust-install
command automatically becomes an AD trust controller. However, you must run ipa-adtrust-install
only once on an IdM server.
Prerequisites
- IdM server is installed.
- You need root privileges to install packages and restart IdM services.
Procedure
Install the required packages:
[root@ipaserver ~]# yum install ipa-server-trust-ad samba-client
Authenticate as the IdM administrative user:
[root@ipaserver ~]# kinit admin
Run the
ipa-adtrust-install
utility:[root@ipaserver ~]# ipa-adtrust-install
The DNS service records are created automatically if IdM was installed with an integrated DNS server.
If you installed IdM without an integrated DNS server,
ipa-adtrust-install
prints a list of service records that you must manually add to DNS before you can continue.The script prompts you that the
/etc/samba/smb.conf
already exists and will be rewritten:WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing Samba configuration. Do you wish to continue? [no]:
yes
The script prompts you to configure the
slapi-nis
plug-in, a compatibility plug-in that allows older Linux clients to work with trusted users:Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. Enable trusted domains support in slapi-nis? [no]:
yes
When prompted, enter the NetBIOS name for the IdM domain or press Enter to accept the name suggested:
Trust is configured but no NetBIOS domain name found, setting it now. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. NetBIOS domain name [IDM]:
You are prompted to run the SID generation task to create a SID for any existing users:
Do you want to run the ipa-sidgen task? [no]:
yes
This is a resource-intensive task, so if you have a high number of users, you can run this at another time.
(Optional) By default, the Dynamic RPC port range is defined as
49152-65535
for Windows Server 2008 and later. If you need to define a different Dynamic RPC port range for your environment, configure Samba to use different ports and open those ports in your firewall settings. The following example sets the port range to55000-65000
.[root@ipaserver ~]# net conf setparm global 'rpc server dynamic port range' 55000-65000 [root@ipaserver ~]# firewall-cmd --add-port=55000-65000/tcp [root@ipaserver ~]# firewall-cmd --runtime-to-permanent
Restart the
ipa
service:[root@ipaserver ~]# ipactl restart
Use the
smbclient
utility to verify that Samba responds to Kerberos authentication from the IdM side:[root@ipaserver ~]#
smbclient -L server.idm.example.com -U user_name --use-kerberos=required
lp_load_ex: changing to config backend registry Sharename Type Comment --------- ---- ------- IPC$ IPC IPC Service (Samba 4.15.2) ...
3.6.2. Enabling the AES encryption type in Active Directory using a GPO
This section describes how to enable the AES encryption type in Active Directory (AD) using a group policy object (GPO). Certain features on RHEL, such as running a Samba server on an IdM client, require this encryption type.
Note that RHEL no longer supports the weak DES and RC4 encryption types.
Prerequisites
- You are logged into AD as a user who can edit group policies.
-
The
Group Policy Management Console
is installed on the computer.
Procedure
-
Open the
Group Policy Management Console
. -
Right-click
Default Domain Policy
, and selectEdit
. TheGroup Policy Management Editor
opens. -
Navigate to
Computer Configuration
→Policies
→Windows Settings
→Security Settings
→Local Policies
→Security Options
. -
Double-click the
Network security: Configure encryption types allowed for Kerberos
policy. -
Select
AES256_HMAC_SHA1
and, optionally,Future encryption types
. - Click OK.
-
Close the
Group Policy Management Editor
. -
Repeat the steps for the
Default Domain Controller Policy
. Wait until the Windows domain controllers (DC) applied the group policy automatically. Alternatively, to apply the GPO manually on a DC, enter the following command using an account that has administrator permissions:
C:\> gpupdate /force /target:computer
3.6.3. Installing and configuring a Samba server on an IdM client
This section describes how to install and configure Samba on a client enrolled in an IdM domain.
Prerequisites
- Both the IdM servers and the client must run on RHEL 8.1 or later.
- The IdM domain is prepared as described in Preparing the IdM domain for installing Samba on domain members.
- If IdM has a trust configured with AD, enable the AES encryption type for Kerberos. For example, use a group policy object (GPO) to enable the AES encryption type. For details, see Enabling AES encryption in Active Directory using a GPO.
Procedure
Install the
ipa-client-samba
package:[root@idm_client]# yum install ipa-client-samba
Use the
ipa-client-samba
utility to prepare the client and create an initial Samba configuration:[root@idm_client]# ipa-client-samba Searching for IPA server... IPA server: DNS discovery Chosen IPA master: idm_server.idm.example.com SMB principal to be created: cifs/idm_client.idm.example.com@IDM.EXAMPLE.COM NetBIOS name to be used: IDM_CLIENT Discovered domains to use: Domain name: idm.example.com NetBIOS name: IDM SID: S-1-5-21-525930803-952335037-206501584 ID range: 212000000 - 212199999 Domain name: ad.example.com NetBIOS name: AD SID: None ID range: 1918400000 - 1918599999 Continue to configure the system with these values? [no]: yes Samba domain member is configured. Please check configuration at /etc/samba/smb.conf and start smb and winbind services
By default,
ipa-client-samba
automatically adds the[homes]
section to the/etc/samba/smb.conf
file that dynamically shares a user’s home directory when the user connects. If users do not have home directories on this server, or if you do not want to share them, remove the following lines from/etc/samba/smb.conf
:[homes] read only = no
Share directories and printers. For details, see:
Open the ports required for a Samba client in the local firewall:
[root@idm_client]# firewall-cmd --permanent --add-service=samba-client [root@idm_client]# firewall-cmd --reload
Enable and start the
smb
andwinbind
services:[root@idm_client]# systemctl enable --now smb winbind
Verification steps
Run the following verification step on a different IdM domain member that has the samba-client
package installed:
List the shares on the Samba server using Kerberos authentication:
$
smbclient -L idm_client.idm.example.com -U user_name --use-kerberos=required
lp_load_ex: changing to config backend registry Sharename Type Comment --------- ---- ------- example Disk IPC$ IPC IPC Service (Samba 4.15.2) ...
Additional resources
-
ipa-client-samba(1)
man page
3.6.4. Manually adding an ID mapping configuration if IdM trusts a new domain
Samba requires an ID mapping configuration for each domain from which users access resources. On an existing Samba server running on an IdM client, you must manually add an ID mapping configuration after the administrator added a new trust to an Active Directory (AD) domain.
Prerequisites
- You configured Samba on an IdM client. Afterward, a new trust was added to IdM.
- The DES and RC4 encryption types for Kerberos must be disabled in the trusted AD domain. For security reasons, RHEL 8 does not support these weak encryption types.
Procedure
Authenticate using the host’s keytab:
[root@idm_client]# kinit -k
Use the
ipa idrange-find
command to display both the base ID and the ID range size of the new domain. For example, the following command displays the values for thead.example.com
domain:[root@idm_client]# ipa idrange-find --name="AD.EXAMPLE.COM_id_range" --raw --------------- 1 range matched --------------- cn: AD.EXAMPLE.COM_id_range ipabaseid: 1918400000 ipaidrangesize: 200000 ipabaserid: 0 ipanttrusteddomainsid: S-1-5-21-968346183-862388825-1738313271 iparangetype: ipa-ad-trust ---------------------------- Number of entries returned 1 ----------------------------
You need the values from the
ipabaseid
andipaidrangesize
attributes in the next steps.To calculate the highest usable ID, use the following formula:
maximum_range = ipabaseid + ipaidrangesize - 1
With the values from the previous step, the highest usable ID for the
ad.example.com
domain is1918599999
(1918400000 + 200000 - 1).Edit the
/etc/samba/smb.conf
file, and add the ID mapping configuration for the domain to the[global]
section:idmap config AD : range = 1918400000 - 1918599999 idmap config AD : backend = sss
Specify the value from
ipabaseid
attribute as the lowest and the computed value from the previous step as the highest value of the range.Restart the
smb
andwinbind
services:[root@idm_client]# systemctl restart smb winbind
Verification steps
List the shares on the Samba server using Kerberos authentication:
$
smbclient -L idm_client.idm.example.com -U user_name --use-kerberos=required
lp_load_ex: changing to config backend registry Sharename Type Comment --------- ---- ------- example Disk IPC$ IPC IPC Service (Samba 4.15.2) ...
3.6.5. Additional resources
3.7. Setting up a Samba file share that uses POSIX ACLs
As a Linux service, Samba supports shares with POSIX ACLs. They enable you to manage permissions locally on the Samba server using utilities, such as chmod
. If the share is stored on a file system that supports extended attributes, you can define ACLs with multiple users and groups.
If you need to use fine-granular Windows ACLs instead, see Setting up a share that uses Windows ACLs.
Parts of this section were adopted from the Setting up a Share Using POSIX ACLs documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
3.7.1. Adding a share that uses POSIX ACLs
This section describes how to create a share named example
that provides the content of the /srv/samba/example/
directory, and uses POSIX ACLs.
Prerequisites
Samba has been set up in one of the following modes:
Procedure
Create the folder if it does not exist. For example:
# mkdir -p /srv/samba/example/
If you run SELinux in
enforcing
mode, set thesamba_share_t
context on the directory:# semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?" # restorecon -Rv /srv/samba/example/
Set file system ACLs on the directory. For details, see:
Add the example share to the
/etc/samba/smb.conf
file. For example, to add the share write-enabled:[example] path = /srv/samba/example/ read only = no
NoteRegardless of the file system ACLs; if you do not set
read only = no
, Samba shares the directory in read-only mode.Verify the
/etc/samba/smb.conf
file:# testparm
Open the required ports and reload the firewall configuration using the
firewall-cmd
utility:# firewall-cmd --permanent --add-service=samba # firewall-cmd --reload
Restart the
smb
service:# systemctl restart smb
3.7.2. Setting standard Linux ACLs on a Samba share that uses POSIX ACLs
The standard ACLs on Linux support setting permissions for one owner, one group, and for all other undefined users. You can use the chown
, chgrp
, and chmod
utility to update the ACLs. If you require precise control, then you use the more complex POSIX ACLs, see
Setting extended ACLs on a Samba share that uses POSIX ACLs.
The following procedure sets the owner of the /srv/samba/example/
directory to the root
user, grants read and write permissions to the Domain Users
group, and denies access to all other users.
Prerequisites
- The Samba share on which you want to set the ACLs exists.
Procedure
# chown root:"Domain Users" /srv/samba/example/ # chmod 2770 /srv/samba/example/
Enabling the set-group-ID (SGID) bit on a directory automatically sets the default group for all new files and subdirectories to that of the directory group, instead of the usual behavior of setting it to the primary group of the user who created the new directory entry.
Additional resources
-
chown(1)
andchmod(1)
man pages
3.7.3. Setting extended ACLs on a Samba share that uses POSIX ACLs
If the file system the shared directory is stored on supports extended ACLs, you can use them to set complex permissions. Extended ACLs can contain permissions for multiple users and groups.
Extended POSIX ACLs enable you to configure complex ACLs with multiple users and groups. However, you can only set the following permissions:
- No access
- Read access
- Write access
- Full control
If you require the fine-granular Windows permissions, such as Create folder / append data
, configure the share to use Windows ACLs. See Setting up a share that uses Windows ACLs.
The following procedure shows how to enable extended ACLs on a share. Additionally, it contains an example about setting extended ACLs.
Prerequisites
- The Samba share on which you want to set the ACLs exists.
Procedure
Enable the following parameter in the share’s section in the
/etc/samba/smb.conf
file to enable ACL inheritance of extended ACLs:inherit acls = yes
For details, see the parameter description in the
smb.conf(5
) man page.Restart the
smb
service:# systemctl restart smb
Set the ACLs on the directory. For example:
Example 3.2. Setting Extended ACLs
The following procedure sets read, write, and execute permissions for the
Domain Admins
group, read, and execute permissions for theDomain Users
group, and deny access to everyone else on the/srv/samba/example/
directory:Disable auto-granting permissions to the primary group of user accounts:
# setfacl -m group::--- /srv/samba/example/ # setfacl -m default:group::--- /srv/samba/example/
The primary group of the directory is additionally mapped to the dynamic
CREATOR GROUP
principal. When you use extended POSIX ACLs on a Samba share, this principal is automatically added and you cannot remove it.Set the permissions on the directory:
Grant read, write, and execute permissions to the
Domain Admins
group:# setfacl -m group:"DOMAIN\Domain Admins":rwx /srv/samba/example/
Grant read and execute permissions to the
Domain Users
group:# setfacl -m group:"DOMAIN\Domain Users":r-x /srv/samba/example/
Set permissions for the
other
ACL entry to deny access to users that do not match the other ACL entries:# setfacl -R -m other::--- /srv/samba/example/
These settings apply only to this directory. In Windows, these ACLs are mapped to the
This folder only
mode.To enable the permissions set in the previous step to be inherited by new file system objects created in this directory:
# setfacl -m default:group:"DOMAIN\Domain Admins":rwx /srv/samba/example/ # setfacl -m default:group:"DOMAIN\Domain Users":r-x /srv/samba/example/ # setfacl -m default:other::--- /srv/samba/example/
With these settings, the
This folder only
mode for the principals is now set toThis folder, subfolders, and files
.
Samba maps the permissions set in the procedure to the following Windows ACLs:
Principal Access Applies to Domain\Domain Admins
Full control
This folder, subfolders, and files
Domain\Domain Users
Read & execute
This folder, subfolders, and files
Everyone
[a]None
This folder, subfolders, and files
owner (Unix User\owner) [b]
Full control
This folder only
primary_group (Unix User\primary_group) [c]
None
This folder only
Full control
Subfolders and files only
None
Subfolders and files only
[a] Samba maps the permissions for this principal from theother
ACL entry.[b] Samba maps the owner of the directory to this entry.[c] Samba maps the primary group of the directory to this entry.[d] On new file system objects, the creator inherits automatically the permissions of this principal.[e] Configuring or removing these principals from the ACLs not supported on shares that use POSIX ACLs.[f] On new file system objects, the creator’s primary group inherits automatically the permissions of this principal.
3.8. Setting permissions on a share that uses POSIX ACLs
Optionally, to limit or grant access to a Samba share, you can set certain parameters in the share’s section in the /etc/samba/smb.conf
file.
Share-based permissions manage if a user, group, or host is able to access a share. These settings do not affect file system ACLs.
Use share-based settings to restrict access to shares, for example, to deny access from specific hosts.
Prerequisites
- A share with POSIX ACLs has been set up.
3.8.1. Configuring user and group-based share access
User and group-based access control enables you to grant or deny access to a share for certain users and groups.
Prerequisites
- The Samba share on which you want to set user or group-based access exists.
Procedure
For example, to enable all members of the
Domain Users
group to access a share while access is denied for theuser
account, add the following parameters to the share’s configuration:valid users = +DOMAIN\"Domain Users" invalid users = DOMAIN\user
The
invalid users
parameter has a higher priority than thevalid users
parameter. For example, if theuser
account is a member of theDomain Users
group, access is denied to this account when you use the previous example.Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
-
smb.conf(5)
man page
3.8.2. Configuring host-based share access
Host-based access control enables you to grant or deny access to a share based on client’s host names, IP addresses, or IP range.
The following procedure explains how to enable the 127.0.0.1
IP address, the 192.0.2.0/24
IP range, and the client1.example.com
host to access a share, and additionally deny access for the client2.example.com
host:
Prerequisites
- The Samba share on which you want to set host-based access exists.
Procedure
Add the following parameters to the configuration of the share in the
/etc/samba/smb.conf
file:hosts allow = 127.0.0.1 192.0.2.0/24 client1.example.com hosts deny = client2.example.com
The
hosts deny
parameter has a higher priority thanhosts allow
. For example, ifclient1.example.com
resolves to an IP address that is listed in thehosts allow
parameter, access for this host is denied.Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
-
smb.conf(5)
man page
3.9. Setting up a share that uses Windows ACLs
Samba supports setting Windows ACLs on shares and file system object. This enables you to:
- Use the fine-granular Windows ACLs
- Manage share permissions and file system ACLs using Windows
Alternatively, you can configure a share to use POSIX ACLs. For details, see Setting up a Samba file share that uses POSIX ACLs.
Parts of this section were adopted from the Setting up a Share Using Windows ACLs documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
3.9.1. Granting the SeDiskOperatorPrivilege privilege
Only users and groups having the SeDiskOperatorPrivilege
privilege granted can configure permissions on shares that use Windows ACLs.
Procedure
For example, to grant the
SeDiskOperatorPrivilege
privilege to theDOMAIN\Domain Admins
group:#
net rpc rights grant "DOMAIN\Domain Admins" SeDiskOperatorPrivilege -U "DOMAIN\administrator"
Enter DOMAIN\administrator's password: Successfully granted rights.NoteIn a domain environment, grant
SeDiskOperatorPrivilege
to a domain group. This enables you to centrally manage the privilege by updating a user’s group membership.To list all users and groups having
SeDiskOperatorPrivilege
granted:#
net rpc rights list privileges SeDiskOperatorPrivilege -U "DOMAIN\administrator"
Enter administrator's password: SeDiskOperatorPrivilege: BUILTIN\Administrators DOMAIN\Domain Admins
3.9.2. Enabling Windows ACL support
To configure shares that support Windows ACLs, you must enable this feature in Samba.
Prerequisites
- A user share is configured on the Samba server.
Procedure
To enable it globally for all shares, add the following settings to the
[global]
section of the/etc/samba/smb.conf
file:vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes
Alternatively, you can enable Windows ACL support for individual shares, by adding the same parameters to a share’s section instead.
Restart the
smb
service:#
systemctl restart smb
3.9.3. Adding a share that uses Windows ACLs
This section describes how to create a share named example
, that shares the content of the /srv/samba/example/
directory, and uses Windows ACLs.
Procedure
Create the folder if it does not exists. For example:
#
mkdir -p /srv/samba/example/
If you run SELinux in
enforcing
mode, set thesamba_share_t
context on the directory:#
semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
#restorecon -Rv /srv/samba/example/
Add the example share to the
/etc/samba/smb.conf
file. For example, to add the share write-enabled:[example] path = /srv/samba/example/ read only = no
NoteRegardless of the file system ACLs; if you do not set
read only = no
, Samba shares the directory in read-only mode.If you have not enabled Windows ACL support in the
[global]
section for all shares, add the following parameters to the[example]
section to enable this feature for this share:vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes
Verify the
/etc/samba/smb.conf
file:#
testparm
Open the required ports and reload the firewall configuration using the
firewall-cmd
utility:#
firewall-cmd --permanent --add-service=samba
#firewall-cmd --reload
Restart the
smb
service:#
systemctl restart smb
3.9.4. Managing share permissions and file system ACLs of a share that uses Windows ACLs
To manage share permissions and file system ACLs on a Samba share that uses Windows ACLs, use a Windows applications, such as Computer Management
. For details, see the Windows documentation. Alternatively, use the smbcacls
utility to manage ACLs.
To modify the file system permissions from Windows, you must use an account that has the SeDiskOperatorPrivilege
privilege granted.
3.10. Managing ACLs on an SMB share using smbcacls
The smbcacls
utility can list, set, and delete ACLs of files and directories stored on an SMB share. You can use smbcacls
to manage file system ACLs:
- On a local or remote Samba server that uses advanced Windows ACLs or POSIX ACLs
- On Red Hat Enterprise Linux to remotely manage ACLs on a share hosted on Windows
3.10.1. Access control entries
Each ACL entry of a file system object contains Access Control Entries (ACE) in the following format:
security_principal:access_right/inheritance_information/permissions
Example 3.3. Access control entries
If the AD\Domain Users
group has Modify
permissions that apply to This folder, subfolders, and files
on Windows, the ACL contains the following ACE:
AD\Domain Users:ALLOWED/OI|CI/CHANGE
An ACE contains the following parts:
- Security principal
- The security principal is the user, group, or SID the permissions in the ACL are applied to.
- Access right
-
Defines if access to an object is granted or denied. The value can be
ALLOWED
orDENIED
. - Inheritance information
The following values exist:
Table 3.1. Inheritance settings
Value Description Maps to OI
Object Inherit
This folder and files
CI
Container Inherit
This folder and subfolders
IO
Inherit Only
The ACE does not apply to the current file or directory
ID
Inherited
The ACE was inherited from the parent directory
Additionally, the values can be combined as follows:
Table 3.2. Inheritance settings combinations
Value combinations Maps to the Windows Applies to
settingOI|CI
This folder, subfolders, and files
OI|CI|IO
Subfolders and files only
CI|IO
Subfolders only
OI|IO
Files only
- Permissions
This value can be either a hex value that represents one or more Windows permissions or an
smbcacls
alias:A hex value that represents one or more Windows permissions.
The following table displays the advanced Windows permissions and their corresponding value in hex format:
Table 3.3. Windows permissions and their corresponding smbcacls value in hex format
Windows permissions Hex values Full control
0x001F01FF
Traverse folder / execute file
0x00100020
List folder / read data
0x00100001
Read attributes
0x00100080
Read extended attributes
0x00100008
Create files / write data
0x00100002
Create folders / append data
0x00100004
Write attributes
0x00100100
Write extended attributes
0x00100010
Delete subfolders and files
0x00100040
Delete
0x00110000
Read permissions
0x00120000
Change permissions
0x00140000
Take ownership
0x00180000
Multiple permissions can be combined as a single hex value using the bit-wise
OR
operation. For details, see ACE mask calculation.An
smbcacls
alias. The following table displays the available aliases:Table 3.4. Existing smbcacls aliases and their corresponding Windows permission
smbcacls
aliasMaps to Windows permission R
Read
READ
Read & execute
W
Special:
- Create files / write data
- Create folders / append data
- Write attributes
- Write extended attributes
- Read permissions
D
Delete
P
Change permissions
O
Take ownership
X
Traverse / execute
CHANGE
Modify
FULL
Full control
NoteYou can combine single-letter aliases when you set permissions. For example, you can set
RD
to apply the Windows permissionRead
andDelete
. However, you can neither combine multiple non-single-letter aliases nor combine aliases and hex values.
3.10.2. Displaying ACLs using smbcacls
To display ACLs on an SMB share, use the smbcacls
utility. If you run smbcacls
without any operation parameter, such as --add
, the utility displays the ACLs of a file system object.
Procedure
For example, to list the ACLs of the root directory of the //server/example
share:
# smbcacls //server/example / -U "DOMAIN\administrator"
Enter DOMAIN\administrator's password:
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:AD\Administrators
GROUP:AD\Domain Users
ACL:AD\Administrator:ALLOWED/OI|CI/FULL
ACL:AD\Domain Users:ALLOWED/OI|CI/CHANGE
ACL:AD\Domain Guests:ALLOWED/OI|CI/0x00100021
The output of the command displays:
-
REVISION
: The internal Windows NT ACL revision of the security descriptor -
CONTROL
: Security descriptor control -
OWNER
: Name or SID of the security descriptor’s owner -
GROUP
: Name or SID of the security descriptor’s group -
ACL
entries. For details, see Access control entries.
3.10.3. ACE mask calculation
In most situations, when you add or update an ACE, you use the smbcacls
aliases listed in Existing smbcacls aliases and their corresponding Windows permission.
However, if you want to set advanced Windows permissions as listed in Windows permissions and their corresponding smbcacls value in hex format, you must use the bit-wise OR
operation to calculate the correct value. You can use the following shell command to calculate the value:
# echo $(printf '0x%X' $(( hex_value_1 | hex_value_2 | ... )))
Example 3.4. Calculating an ACE Mask
You want to set the following permissions:
- Traverse folder / execute file (0x00100020)
- List folder / read data (0x00100001)
- Read attributes (0x00100080)
To calculate the hex value for the previous permissions, enter:
# echo $(printf '0x%X' $(( 0x00100020 | 0x00100001 | 0x00100080 )))
0x1000A1
Use the returned value when you set or update an ACE.
3.10.4. Adding, updating, and removing an ACL using smbcacls
Depending on the parameter you pass to the smbcacls
utility, you can add, update, and remove ACLs from a file or directory.
Adding an ACL
To add an ACL to the root of the //server/example
share that grants CHANGE
permissions for This folder, subfolders, and files
to the AD\Domain Users
group:
# smbcacls //server/example / -U "DOMAIN\administrator --add ACL:"AD\Domain Users":ALLOWED/OI|CI/CHANGE
Updating an ACL
Updating an ACL is similar to adding a new ACL. You update an ACL by overriding the ACL using the --modify
parameter with an existing security principal. If smbcacls
finds the security principal in the ACL list, the utility updates the permissions. Otherwise the command fails with an error:
ACL for SID principal_name not found
For example, to update the permissions of the AD\Domain Users
group and set them to READ
for This folder, subfolders, and files
:
# smbcacls //server/example / -U "DOMAIN\administrator --modify ACL:"AD\Domain Users":ALLOWED/OI|CI/READ
Deleting an ACL
To delete an ACL, pass the --delete
parameter with the exact ACL to the smbcacls
utility. For example:
# smbcacls //server/example / -U "DOMAIN\administrator --delete ACL:"AD\Domain Users":ALLOWED/OI|CI/READ
3.11. Enabling users to share directories on a Samba server
On a Samba server, you can configure that users can share directories without root permissions.
3.11.1. Enabling the user shares feature
Before users can share directories, the administrator must enable user shares in Samba.
For example, to enable only members of the local example
group to create user shares.
Procedure
Create the local
example
group, if it does not exist:# groupadd example
Prepare the directory for Samba to store the user share definitions and set its permissions properly. For example:
Create the directory:
# mkdir -p /var/lib/samba/usershares/
Set write permissions for the
example
group:# chgrp example /var/lib/samba/usershares/ # chmod 1770 /var/lib/samba/usershares/
- Set the sticky bit to prevent users to rename or delete files stored by other users in this directory.
Edit the
/etc/samba/smb.conf
file and add the following to the[global]
section:Set the path to the directory you configured to store the user share definitions. For example:
usershare path = /var/lib/samba/usershares/
Set how many user shares Samba allows to be created on this server. For example:
usershare max shares = 100
If you use the default of
0
for theusershare max shares
parameter, user shares are disabled.Optionally, set a list of absolute directory paths. For example, to configure that Samba only allows to share subdirectories of the
/data
and/srv
directory to be shared, set:usershare prefix allow list = /data /srv
For a list of further user share-related parameters you can set, see the
USERSHARES
section in thesmb.conf(5)
man page.Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
Users are now able to create user shares.
3.11.2. Adding a user share
After you enabled the user share feature in Samba, users can share directories on the Samba server without root
permissions by running the net usershare add
command.
Synopsis of the net usershare add
command:
net usershare add
share_name path [[ comment ] | [ ACLs ]] [ guest_ok=y|n ]
If you set ACLs when you create a user share, you must specify the comment parameter prior to the ACLs. To set an empty comment, use an empty string in double quotes.
Note that users can only enable guest access on a user share, if the administrator set usershare allow guests = yes
in the [global]
section in the /etc/samba/smb.conf
file.
Example 3.5. Adding a user share
A user wants to share the /srv/samba/
directory on a Samba server. The share should be named example
, have no comment set, and should be accessible by guest users. Additionally, the share permissions should be set to full access for the AD\Domain Users
group and read permissions for other users. To add this share, run as the user:
$ net usershare add example /srv/samba/ "" "AD\Domain Users":F,Everyone:R guest_ok=yes
3.11.3. Updating settings of a user share
To update settings of a user share, override the share by using the net usershare add
command with the same share name and the new settings. See Adding a user share.
3.11.4. Displaying information about existing user shares
Users can enter the net usershare info
command on a Samba server to display user shares and their settings.
Prerequisites
- A user share is configured on the Samba server.
Procedure
To display all user shares created by any user:
$ net usershare info -l [share_1] path=/srv/samba/ comment= usershare_acl=Everyone:R,host_name\user:F, guest_ok=y ...
To list only shares created by the user who runs the command, omit the
-l
parameter.To display only the information about specific shares, pass the share name or wild cards to the command. For example, to display the information about shares whose name starts with
share_
:$ net usershare info -l share_*
3.11.5. Listing user shares
If you want to list only the available user shares without their settings on a Samba server, use the net usershare list
command.
Prerequisites
- A user share is configured on the Samba server.
Procedure
To list the shares created by any user:
$ net usershare list -l share_1 share_2 ...
To list only shares created by the user who runs the command, omit the
-l
parameter.To list only specific shares, pass the share name or wild cards to the command. For example, to list only shares whose name starts with
share_
:$ net usershare list -l share_*
3.11.6. Deleting a user share
To delete a user share, use the command net usershare delete
command as the user who created the share or as the root
user.
Prerequisites
- A user share is configured on the Samba server.
Procedure
$ net usershare delete share_name
3.12. Configuring a share to allow access without authentication
In certain situations, you want to share a directory to which users can connect without authentication. To configure this, enable guest access on a share.
Shares that do not require authentication can be a security risk.
3.12.1. Enabling guest access to a share
If guest access is enabled on a share, Samba maps guest connections to the operating system account set in the guest account
parameter. Guest users can access files on this share if at least one of the following conditions is satisfied:
- The account is listed in file system ACLs
-
The POSIX permissions for
other
users allow it
Example 3.6. Guest share permissions
If you configured Samba to map the guest account to nobody
, which is the default, the ACLs in the following example:
-
Allow guest users to read
file1.txt
-
Allow guest users to read and modify
file2.txt
-
Prevent guest users to read or modify
file3.txt
-rw-r--r--. 1 root root 1024 1. Sep 10:00 file1.txt -rw-r-----. 1 nobody root 1024 1. Sep 10:00 file2.txt -rw-r-----. 1 root root 1024 1. Sep 10:00 file3.txt
Procedure
Edit the
/etc/samba/smb.conf
file:If this is the first guest share you set up on this server:
Set
map to guest = Bad User
in the[global]
section:[global] ... map to guest = Bad User
With this setting, Samba rejects login attempts that use an incorrect password unless the user name does not exist. If the specified user name does not exist and guest access is enabled on a share, Samba treats the connection as a guest log in.
By default, Samba maps the guest account to the
nobody
account on Red Hat Enterprise Linux. Alternatively, you can set a different account. For example:[global] ... guest account = user_name
The account set in this parameter must exist locally on the Samba server. For security reasons, Red Hat recommends using an account that does not have a valid shell assigned.
Add the
guest ok = yes
setting to the[example]
share section:[example] ... guest ok = yes
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
3.13. Configuring Samba for macOS clients
The fruit
virtual file system (VFS) Samba module provides enhanced compatibility with Apple server message block (SMB) clients.
3.13.1. Optimizing the Samba configuration for providing file shares for macOS clients
This section describes how to configure the fruit
module for all Samba shares hosted on the server to optimize Samba file shares for macOS clients.
Red Hat recommends enabling the fruit
module globally. Clients using macOS negotiate the server server message block version 2 (SMB2) Apple (AAPL) protocol extensions when the client establishes the first connection to the server. If the client first connects to a share without AAPL extensions enabled, the client does not use the extensions for any share of the server.
Prerequisites
- Samba is configured as a file server.
Procedure
Edit the
/etc/samba/smb.conf
file, and enable thefruit
andstreams_xattr
VFS modules in the[global]
section:vfs objects = fruit streams_xattr
ImportantYou must enable the
fruit
module before enablingstreams_xattr
. Thefruit
module uses alternate data streams (ADS). For this reason, you must also enable thestreams_xattr
module.Optionally, to provide macOS Time Machine support on a share, add the following setting to the share configuration in the
/etc/samba/smb.conf
file:fruit:time machine = yes
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
Additional resources
-
vfs_fruit(8)
man page. Configuring file shares:
3.14. Using the smbclient utility to access an SMB share
The smbclient utility enables you to access file shares on an SMB server, similarly to a command-line FTP client. You can use it, for example, to upload and download files to and from a share.
Prerequisites
-
The
samba-client
package is installed.
3.14.1. How the smbclient interactive mode works
For example, to authenticate to the example
share hosted on server
using the DOMAIN\user
account:
# smbclient -U "DOMAIN\user" //server/example Enter domain\user's password: Try "help" to get a list of possible commands. smb: \>
After smbclient
connected successfully to the share, the utility enters the interactive mode and shows the following prompt:
smb: \>
To display all available commands in the interactive shell, enter:
smb: \> help
To display the help for a specific command, enter:
smb: \> help command_name
Additional resources
-
smbclient(1)
man page
3.14.2. Using smbclient in interactive mode
If you use smbclient
without the -c
parameter, the utility enters the interactive mode. The following procedure shows how to connect to an SMB share and download a file from a subdirectory.
Procedure
Connect to the share:
# smbclient -U "DOMAIN\user_name" //server_name/share_name
Change into the
/example/
directory:smb: \>
d /example/
List the files in the directory:
smb: \example\>
ls
. D 0 Thu Nov 1 10:00:00 2018 .. D 0 Thu Nov 1 10:00:00 2018 example.txt N 1048576 Thu Nov 1 10:00:00 2018 9950208 blocks of size 1024. 8247144 blocks availableDownload the
example.txt
file:smb: \example\>
get example.txt
getting file \directory\subdirectory\example.txt of size 1048576 as example.txt (511975,0 KiloBytes/sec) (average 170666,7 KiloBytes/sec)Disconnect from the share:
smb: \example\>
exit
3.14.3. Using smbclient in scripting mode
If you pass the -c
parameter to smbclient
, you can automatically execute the commands on the remote SMB share. This enables you to use smbclient
in scripts.
The following procedure shows how to connect to an SMB share and download a file from a subdirectory.
Procedure
-
Use the following command to connect to the share, change into the
example
directory, download theexample.txt
file:
# smbclient -U DOMAIN\user_name //server_name/share_name -c "cd /example/ ; get example.txt ; exit"
3.15. Setting up Samba as a print server
If you set up Samba as a print server, clients in your network can use Samba to print. Additionally, Windows clients can, if configured, download the driver from the Samba server.
Parts of this section were adopted from the Setting up Samba as a Print Server documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
Prerequisites
Samba has been set up in one of the following modes:
3.15.1. Enabling print server support in Samba
By default, print server support is not enabled in Samba. To use Samba as a print server, you must configure Samba accordingly.
Print jobs and printer operations require remote procedure calls (RPCs). By default, Samba starts the rpcd_spoolss
service on demand to manage RPCs. During the first RPC call, or when you update the printer list in CUPS, Samba retrieves the printer information from CUPS. This can require approximately 1 second per printer. Therefore, if you have more than 50 printers, tune the rpcd_spoolss
settings.
Prerequisites
The printers are configured in a CUPS server.
For details about configuring printers in CUPS, see the documentation provided in the CUPS web console (https://printserver:631/help) on the print server.
Procedure
Edit the
/etc/samba/smb.conf
file:Add the
[printers]
section to enable the printing backend in Samba:[printers] comment = All Printers path = /var/tmp/ printable = yes create mask = 0600
ImportantThe
[printers]
share name is hard-coded and cannot be changed.If the CUPS server runs on a different host or port, specify the setting in the
[printers]
section:cups server = printserver.example.com:631
If you have many printers, set the number of idle seconds to a higher value than the numbers of printers connected to CUPS. For example, if you have 100 printers, set in the
[global]
section:rpcd_spoolss:idle_seconds = 200
If this setting does not scale in your environment, also increase the number of
rpcd_spoolss
workers in the[global]
section:rpcd_spoolss:num_workers = 10
By default,
rpcd_spoolss
starts 5 workers.
Verify the
/etc/samba/smb.conf
file:# testparm
Open the required ports and reload the firewall configuration using the
firewall-cmd
utility:# firewall-cmd --permanent --add-service=samba # firewall-cmd --reload
Restart the
smb
service:# systemctl restart smb
After restarting the service, Samba automatically shares all printers that are configured in the CUPS back end. If you want to manually share only specific printers, see Manually sharing specific printers.
Verification
Submit a print job. For example, to print a PDF file, enter:
# smbclient -Uuser //sambaserver.example.com/printer_name -c "print example.pdf"
3.15.2. Manually sharing specific printers
If you configured Samba as a print server, by default, Samba shares all printers that are configured in the CUPS back end. The following procedure explains how to share only specific printers.
Prerequisites
- Samba is set up as a print server
Procedure
Edit the
/etc/samba/smb.conf
file:In the
[global]
section, disable automatic printer sharing by setting:load printers = no
Add a section for each printer you want to share. For example, to share the printer named
example
in the CUPS back end asExample-Printer
in Samba, add the following section:[Example-Printer] path = /var/tmp/ printable = yes printer name = example
You do not need individual spool directories for each printer. You can set the same spool directory in the
path
parameter for the printer as you set in the[printers]
section.
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
3.16. Setting up automatic printer driver downloads for Windows clients on Samba print servers
If you are running a Samba print server for Windows clients, you can upload drivers and preconfigure printers. If a user connects to a printer, Windows automatically downloads and installs the driver locally on the client. The user does not require local administrator permissions for the installation. Additionally, Windows applies preconfigured driver settings, such as the number of trays.
Parts of this section were adopted from the Setting up Automatic Printer Driver Downloads for Windows Clients documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
Prerequisites
- Samba is set up as a print server
3.16.1. Basic information about printer drivers
This section provides general information about printer drivers.
Supported driver model version
Samba only supports the printer driver model version 3 which is supported in Windows 2000 and later, and Windows Server 2000 and later. Samba does not support the driver model version 4, introduced in Windows 8 and Windows Server 2012. However, these and later Windows versions also support version 3 drivers.
Package-aware drivers
Samba does not support package-aware drivers.
Preparing a printer driver for being uploaded
Before you can upload a driver to a Samba print server:
- Unpack the driver if it is provided in a compressed format.
Some drivers require to start a setup application that installs the driver locally on a Windows host. In certain situations, the installer extracts the individual files into the operating system’s temporary folder during the setup runs. To use the driver files for uploading:
- Start the installer.
- Copy the files from the temporary folder to a new location.
- Cancel the installation.
Ask your printer manufacturer for drivers that support uploading to a print server.
Providing 32-bit and 64-bit drivers for a printer to a client
To provide the driver for a printer for both 32-bit and 64-bit Windows clients, you must upload a driver with exactly the same name for both architectures. For example, if you are uploading the 32-bit driver named Example PostScript
and the 64-bit driver named Example PostScript (v1.0)
, the names do not match. Consequently, you can only assign one of the drivers to a printer and the driver will not be available for both architectures.
3.16.2. Enabling users to upload and preconfigure drivers
To be able to upload and preconfigure printer drivers, a user or a group needs to have the SePrintOperatorPrivilege
privilege granted. A user must be added into the printadmin
group. Red Hat Enterprise Linux automatically creates this group when you install the samba
package. The printadmin
group gets assigned the lowest available dynamic system GID that is lower than 1000.
Procedure
For example, to grant the
SePrintOperatorPrivilege
privilege to theprintadmin
group:# net rpc rights grant "printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: Successfully granted rights.
NoteIn a domain environment, grant
SePrintOperatorPrivilege
to a domain group. This enables you to centrally manage the privilege by updating a user’s group membership.To list all users and groups having
SePrintOperatorPrivilege
granted:# net rpc rights list privileges SePrintOperatorPrivilege -U "DOMAIN\administrator" Enter administrator's password: SePrintOperatorPrivilege: BUILTIN\Administrators DOMAIN\printadmin
3.16.3. Setting up the print$ share
Windows operating systems download printer drivers from a share named print$
from a print server. This share name is hard-coded in Windows and cannot be changed.
The following procedure explains how to share the /var/lib/samba/drivers/
directory as print$
, and enable members of the local printadmin
group to upload printer drivers.
Procedure
Add the
[print$]
section to the/etc/samba/smb.conf
file:[print$] path = /var/lib/samba/drivers/ read only = no write list = @printadmin force group = @printadmin create mask = 0664 directory mask = 2775
Using these settings:
-
Only members of the
printadmin
group can upload printer drivers to the share. -
The group of new created files and directories will be set to
printadmin
. -
The permissions of new files will be set to
664
. -
The permissions of new directories will be set to
2775
.
-
Only members of the
To upload only 64-bit drivers for all printers, include this setting in the
[global]
section in the/etc/samba/smb.conf
file:spoolss: architecture = Windows x64
Without this setting, Windows only displays drivers for which you have uploaded at least the 32-bit version.
Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration
# smbcontrol all reload-config
Create the
printadmin
group if it does not exists:# groupadd printadmin
Grant the
SePrintOperatorPrivilege
privilege to theprintadmin
group.# net rpc rights grant "printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: Successfully granted rights.
If you run SELinux in
enforcing
mode, set thesamba_share_t
context on the directory:# semanage fcontext -a -t samba_share_t "/var/lib/samba/drivers(/.)?" # *restorecon -Rv /var/lib/samba/drivers/
Set the permissions on the
/var/lib/samba/drivers/
directory:If you use POSIX ACLs, set:
# chgrp -R "printadmin" /var/lib/samba/drivers/ # chmod -R 2775 /var/lib/samba/drivers/
If you use Windows ACLs, set:
Principal Access Apply to CREATOR OWNER
Full control
Subfolders and files only
Authenticated Users
Read & execute, List folder contents, Read
This folder, subfolders, and files
printadmin
Full control
This folder, subfolders, and files
For details about setting ACLs on Windows, see the Windows documentation.
Additional resources
3.16.4. Creating a GPO to enable clients to trust the Samba print server
For security reasons, recent Windows operating systems prevent clients from downloading non-package-aware printer drivers from an untrusted server. If your print server is a member in an AD, you can create a Group Policy Object (GPO) in your domain to trust the Samba server.
Prerequisites
- The Samba print server is a member of an AD domain.
- The Windows computer you are using to create the GPO must have the Windows Remote Server Administration Tools (RSAT) installed. For details, see the Windows documentation.
Procedure
-
Log into a Windows computer using an account that is allowed to edit group policies, such as the AD domain
Administrator
user. -
Open the
Group Policy Management Console
. Right-click to your AD domain and select
Create a GPO in this domain, and Link it here
.-
Enter a name for the GPO, such as
Legacy Printer Driver Policy
and clickOK
. The new GPO will be displayed under the domain entry. -
Right-click to the newly-created GPO and select
Edit
to open theGroup Policy Management Editor
. Navigate to Computer Configuration → Policies → Administrative Templates → Printers.
On the right side of the window, double-click
Point and Print Restriction
to edit the policy:Enable the policy and set the following options:
-
Select
Users can only point and print to these servers
and enter the fully-qualified domain name (FQDN) of the Samba print server to the field next to this option. In both check boxes under
Security Prompts
, selectDo not show warning or elevation prompt
.
-
Select
- Click OK.
Double-click
Package Point and Print - Approved servers
to edit the policy:-
Enable the policy and click the
Show
button. Enter the FQDN of the Samba print server.
-
Close both the
Show Contents
and the policy’s properties window by clickingOK
.
-
Enable the policy and click the
-
Close the
Group Policy Management Editor
. -
Close the
Group Policy Management Console
.
After the Windows domain members applied the group policy, printer drivers are automatically downloaded from the Samba server when a user connects to a printer.
Additional resources
- For using group policies, see the Windows documentation.
3.16.5. Uploading drivers and preconfiguring printers
Use the Print Management
application on a Windows client to upload drivers and preconfigure printers hosted on the Samba print server. For further details, see the Windows documentation.
3.17. Running Samba on a server with FIPS mode enabled
This section provides an overview of the limitations of running Samba with FIPS mode enabled. It also provides the procedure for enabling FIPS mode on a Red Hat Enterprise Linux host running Samba.
3.17.1. Limitations of using Samba in FIPS mode
The following Samba modes and features work in FIPS mode under the indicated conditions:
- Samba as a domain member only in Active Directory (AD) or Red Hat Identity Management (IdM) environments with Kerberos authentication that uses AES ciphers.
- Samba as a file server on an Active Directory domain member. However, this requires that clients use Kerberos to authenticate to the server.
Due to the increased security of FIPS, the following Samba features and modes do not work if FIPS mode is enabled:
- NT LAN Manager (NTLM) authentication because RC4 ciphers are blocked
- The server message block version 1 (SMB1) protocol
- The stand-alone file server mode because it uses NTLM authentication
- NT4-style domain controllers
- NT4-style domain members. Note that Red Hat continues supporting the primary domain controller (PDC) functionality IdM uses in the background.
- Password changes against the Samba server. You can only perform password changes using Kerberos against an Active Directory domain controller.
The following feature is not tested in FIPS mode and, therefore, is not supported by Red Hat:
- Running Samba as a print server
3.17.2. Using Samba in FIPS mode
This section describes how to enable the FIPS mode on a RHEL host that runs Samba.
Prerequisites
- Samba is configured on the Red Hat Enterprise Linux host.
- Samba runs in a mode that is supported in FIPS mode.
Procedure
Enable the FIPS mode on RHEL:
# fips-mode-setup --enable
Reboot the server:
# reboot
Use the
testparm
utility to verify the configuration:# testparm -s
If the command displays any errors or incompatibilities, fix them to ensure that Samba works correctly.
Additional resources
3.18. Tuning the performance of a Samba server
Learn what settings can improve the performance of Samba in certain situations, and which settings can have a negative performance impact.
Parts of this section were adopted from the Performance Tuning documentation published in the Samba Wiki. License: CC BY 4.0. Authors and contributors: See the history tab on the Wiki page.
Prerequisites
- Samba is set up as a file or print server
3.18.1. Setting the SMB protocol version
Each new SMB version adds features and improves the performance of the protocol. The recent Windows and Windows Server operating systems always supports the latest protocol version. If Samba also uses the latest protocol version, Windows clients connecting to Samba benefit from the performance improvements. In Samba, the default value of the server max protocol is set to the latest supported stable SMB protocol version.
To always have the latest stable SMB protocol version enabled, do not set the server max protocol
parameter. If you set the parameter manually, you will need to modify the setting with each new version of the SMB protocol, to have the latest protocol version enabled.
The following procedure explains how to use the default value in the server max protocol
parameter.
Procedure
-
Remove the
server max protocol
parameter from the[global]
section in the/etc/samba/smb.conf
file. Reload the Samba configuration
# smbcontrol all reload-config
3.18.2. Tuning shares with directories that contain a large number of files
Linux supports case-sensitive file names. For this reason, Samba needs to scan directories for uppercase and lowercase file names when searching or accessing a file. You can configure a share to create new files only in lowercase or uppercase, which improves the performance.
Prerequisites
- Samba is configured as a file server
Procedure
Rename all files on the share to lowercase.
NoteUsing the settings in this procedure, files with names other than in lowercase will no longer be displayed.
Set the following parameters in the share’s section:
case sensitive = true default case = lower preserve case = no short preserve case = no
For details about the parameters, see their descriptions in the
smb.conf(5)
man page.Verify the
/etc/samba/smb.conf
file:# testparm
Reload the Samba configuration:
# smbcontrol all reload-config
After you applied these settings, the names of all newly created files on this share use lowercase. Because of these settings, Samba no longer needs to scan the directory for uppercase and lowercase, which improves the performance.
3.18.3. Settings that can have a negative performance impact
By default, the kernel in Red Hat Enterprise Linux is tuned for high network performance. For example, the kernel uses an auto-tuning mechanism for buffer sizes. Setting the socket options
parameter in the /etc/samba/smb.conf
file overrides these kernel settings. As a result, setting this parameter decreases the Samba network performance in most cases.
To use the optimized settings from the Kernel, remove the socket options
parameter from the [global]
section in the /etc/samba/smb.conf
.
3.19. Configuring Samba to be compatible with clients that require an SMB version lower than the default
Samba uses a reasonable and secure default value for the minimum server message block (SMB) version it supports. However, if you have clients that require an older SMB version, you can configure Samba to support it.
3.19.1. Setting the minimum SMB protocol version supported by a Samba server
In Samba, the server min protocol
parameter in the /etc/samba/smb.conf
file defines the minimum server message block (SMB) protocol version the Samba server supports. This section describes how to change the minimum SMB protocol version.
By default, Samba on RHEL 8.2 and later supports only SMB2 and newer protocol versions. Red Hat recommends to not use the deprecated SMB1 protocol. However, if your environment requires SMB1, you can manually set the server min protocol
parameter to NT1
to re-enable SMB1.
Prerequisites
- Samba is installed and configured.
Procedure
Edit the
/etc/samba/smb.conf
file, add theserver min protocol
parameter, and set the parameter to the minimum SMB protocol version the server should support. For example, to set the minimum SMB protocol version toSMB3
, add:server min protocol = SMB3
Restart the
smb
service:# systemctl restart smb
Additional resources
-
smb.conf(5)
man page
3.20. Frequently used Samba command-line utilities
This chapter describes frequently used commands when working with a Samba server.
3.20.1. Using the net ads join and net rpc join commands
Using the join
subcommand of the net
utility, you can join Samba to an AD or NT4 domain. To join the domain, you must create the /etc/samba/smb.conf
file manually, and optionally update additional configurations, such as PAM.
Red Hat recommends using the realm
utility to join a domain. The realm
utility automatically updates all involved configuration files.
Procedure
Manually create the
/etc/samba/smb.conf
file with the following settings:For an AD domain member:
[global] workgroup = domain_name security = ads passdb backend = tdbsam realm = AD_REALM
For an NT4 domain member:
[global] workgroup = domain_name security = user passdb backend = tdbsam
-
Add an ID mapping configuration for the
*
default domain and for the domain you want to join to the[global
] section in the/etc/samba/smb.conf
file. Verify the
/etc/samba/smb.conf
file:# testparm
Join the domain as the domain administrator:
To join an AD domain:
# net ads join -U "DOMAIN\administrator"
To join an NT4 domain:
# net rpc join -U "DOMAIN\administrator"
Append the
winbind
source to thepasswd
andgroup
database entry in the/etc/nsswitch.conf
file:passwd: files
winbind
group: fileswinbind
Enable and start the
winbind
service:# systemctl enable --now winbind
Optionally, configure PAM using the
authselect
utility.For details, see the
authselect(8)
man page.Optionally for AD environments, configure the Kerberos client.
For details, see the documentation of your Kerberos client.
Additional resources
3.20.2. Using the net rpc rights command
In Windows, you can assign privileges to accounts and groups to perform special operations, such as setting ACLs on a share or upload printer drivers. On a Samba server, you can use the net rpc rights
command to manage privileges.
Listing privileges you can set
To list all available privileges and their owners, use the net rpc rights list
command. For example:
# net rpc rights list -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: SeMachineAccountPrivilege Add machines to domain SeTakeOwnershipPrivilege Take ownership of files or other objects SeBackupPrivilege Back up files and directories SeRestorePrivilege Restore files and directories SeRemoteShutdownPrivilege Force shutdown from a remote system SePrintOperatorPrivilege Manage printers SeAddUsersPrivilege Add users and groups to the domain SeDiskOperatorPrivilege Manage disk shares SeSecurityPrivilege System security
Granting privileges
To grant a privilege to an account or group, use the net rpc rights grant
command.
For example, grant the SePrintOperatorPrivilege
privilege to the DOMAIN\printadmin
group:
# net rpc rights grant "DOMAIN\printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: Successfully granted rights.
Revoking privileges
To revoke a privilege from an account or group, use the net rpc rights revoke
command.
For example, to revoke the SePrintOperatorPrivilege
privilege from the DOMAIN\printadmin
group:
# net rpc rights remoke "DOMAIN\printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: Successfully revoked rights.
3.20.3. Using the net rpc share command
The net rpc share
command provides the capability to list, add, and remove shares on a local or remote Samba or Windows server.
Listing shares
To list the shares on an SMB server, use the net rpc share list
command. Optionally, pass the -S server_name
parameter to the command to list the shares of a remote server. For example:
# net rpc share list -U "DOMAIN\administrator" -S server_name Enter DOMAIN\administrator's password: IPC$ share_1 share_2 ...
Shares hosted on a Samba server that have browseable = no
set in their section in the /etc/samba/smb.conf
file are not displayed in the output.
Adding a share
The net rpc share add
command enables you to add a share to an SMB server.
For example, to add a share named example
on a remote Windows server that shares the C:\example\
directory:
# net rpc share add example="C:\example" -U "DOMAIN\administrator" -S server_name
You must omit the trailing backslash in the path when specifying a Windows directory name.
To use the command to add a share to a Samba server:
-
The user specified in the
-U
parameter must have theSeDiskOperatorPrivilege
privilege granted on the destination server. -
You must write a script that adds a share section to the
/etc/samba/smb.conf
file and reloads Samba. The script must be set in theadd share command
parameter in the[global]
section in/etc/samba/smb.conf
. For further details, see theadd share command
description in thesmb.conf(5)
man page.
Removing a share
The net rpc share delete
command enables you to remove a share from an SMB server.
For example, to remove the share named example from a remote Windows server:
# net rpc share delete example -U "DOMAIN\administrator" -S server_name
To use the command to remove a share from a Samba server:
-
The user specified in the
-U
parameter must have theSeDiskOperatorPrivilege
privilege granted. -
You must write a script that removes the share’s section from the
/etc/samba/smb.conf
file and reloads Samba. The script must be set in thedelete share command
parameter in the[global]
section in/etc/samba/smb.conf
. For further details, see thedelete share command
description in thesmb.conf(5)
man page.
3.20.4. Using the net user command
The net user
command enables you to perform the following actions on an AD DC or NT4 PDC:
- List all user accounts
- Add users
- Remove Users
Specifying a connection method, such as ads
for AD domains or rpc
for NT4 domains, is only required when you list domain user accounts. Other user-related subcommands can auto-detect the connection method.
Pass the -U user_name
parameter to the command to specify a user that is allowed to perform the requested action.
Listing domain user accounts
To list all users in an AD domain:
# net ads user -U "DOMAIN\administrator"
To list all users in an NT4 domain:
# net rpc user -U "DOMAIN\administrator"
Adding a user account to the domain
On a Samba domain member, you can use the net user add
command to add a user account to the domain.
For example, add the user
account to the domain:
Add the account:
# net user add user password -U "DOMAIN\administrator" User user added
Optionally, use the remote procedure call (RPC) shell to enable the account on the AD DC or NT4 PDC. For example:
# net rpc shell -U DOMAIN\administrator -S DC_or_PDC_name Talking to domain DOMAIN (S-1-5-21-1424831554-512457234-5642315751) net rpc>
user edit disabled user: no
Set user's disabled flag from [yes] to [no] net rpc>exit
Deleting a user account from the domain
On a Samba domain member, you can use the net user delete
command to remove a user account from the domain.
For example, to remove the user
account from the domain:
# net user delete user -U "DOMAIN\administrator" User user deleted
3.20.5. Using the rpcclient utility
The rpcclient
utility enables you to manually execute client-side Microsoft Remote Procedure Call (MS-RPC) functions on a local or remote SMB server. However, most of the features are integrated into separate utilities provided by Samba. Use rpcclient
only for testing MS-PRC functions.
Prerequisites
-
The
samba-client
package is installed.
Examples
For example, you can use the rpcclient
utility to:
Manage the printer Spool Subsystem (SPOOLSS).
Example 3.7. Assigning a Driver to a Printer
# rpcclient server_name -U "DOMAIN\administrator" -c 'setdriver "printer_name" "driver_name"' Enter DOMAIN\administrators password: Successfully set printer_name to driver driver_name.
Retrieve information about an SMB server.
Example 3.8. Listing all File Shares and Shared Printers
# rpcclient server_name -U "DOMAIN\administrator" -c 'netshareenum' Enter DOMAIN\administrators password: netname: Example_Share remark: path: C:\srv\samba\example_share\ password: netname: Example_Printer remark: path: C:\var\spool\samba\ password:
Perform actions using the Security Account Manager Remote (SAMR) protocol.
Example 3.9. Listing Users on an SMB Server
# rpcclient server_name -U "DOMAIN\administrator" -c 'enumdomusers' Enter DOMAIN\administrators password: user:[user1] rid:[0x3e8] user:[user2] rid:[0x3e9]
If you run the command against a standalone server or a domain member, it lists the users in the local database. Running the command against an AD DC or NT4 PDC lists the domain users.
Additional resources
-
rpcclient(1)
man page
3.20.6. Using the samba-regedit application
Certain settings, such as printer configurations, are stored in the registry on the Samba server. You can use the ncurses-based samba-regedit
application to edit the registry of a Samba server.
Prerequisites
-
The
samba-client
package is installed.
Procedure
To start the application, enter:
# samba-regedit
Use the following keys:
- Cursor up and cursor down: Navigate through the registry tree and the values.
- Enter: Opens a key or edits a value.
-
Tab: Switches between the
Key
andValue
pane. - Ctrl+C: Closes the application.
3.20.7. Using the smbcontrol utility
The smbcontrol
utility enables you to send command messages to the smbd
, nmbd
, winbindd
, or all of these services. These control messages instruct the service, for example, to reload its configuration.
The procedure in this section shows how to to reload the configuration of the smbd
, nmbd
, winbindd
services by sending the reload-config
message type to the all
destination.
Prerequisites
-
The
samba-common-tools
package is installed.
Procedure
# smbcontrol all reload-config
Additional resources
-
smbcontrol(1)
man page
3.20.8. Using the smbpasswd utility
The smbpasswd
utility manages user accounts and passwords in the local Samba database.
Prerequisites
-
The
samba-common-tools
package is installed.
Procedure
If you run the command as a user,
smbpasswd
changes the Samba password of the user who run the command. For example:[user@server ~]$ smbpasswd New SMB password: password Retype new SMB password: password
If you run
smbpasswd
as theroot
user, you can use the utility, for example, to:Create a new user:
[root@server ~]# smbpasswd -a user_name New SMB password:
password
Retype new SMB password:password
Added user user_name.NoteBefore you can add a user to the Samba database, you must create the account in the local operating system. See the Adding a new user from the command line section in the Configuring basic system settings guide.
Enable a Samba user:
[root@server ~]# smbpasswd -e user_name Enabled user user_name.
Disable a Samba user:
[root@server ~]# smbpasswd -x user_name Disabled user user_name
Delete a user:
[root@server ~]# smbpasswd -x user_name Deleted user user_name.
Additional resources
-
smbpasswd(8)
man page
3.20.9. Using the smbstatus utility
The smbstatus
utility reports on:
-
Connections per PID of each
smbd
daemon to the Samba server. This report includes the user name, primary group, SMB protocol version, encryption, and signing information. -
Connections per Samba share. This report includes the PID of the
smbd
daemon, the IP of the connecting machine, the time stamp when the connection was established, encryption, and signing information. - A list of locked files. The report entries include further details, such as opportunistic lock (oplock) types
Prerequisites
-
The
samba
package is installed. -
The
smbd
service is running.
Procedure
# smbstatus Samba version 4.15.2 PID Username Group Machine Protocol Version Encryption Signing ....------------------------------------------------------------------------------------------------------------------------- 963 DOMAIN\administrator DOMAIN\domain users client-pc (ipv4:192.0.2.1:57786) SMB3_02 - AES-128-CMAC Service pid Machine Connected at Encryption Signing: ....--------------------------------------------------------------------------- example 969 192.0.2.1 Thu Nov 1 10:00:00 2018 CEST - AES-128-CMAC Locked files: Pid Uid DenyMode Access R/W Oplock SharePath Name Time ....-------------------------------------------------------------------------------------------------------- 969 10000 DENY_WRITE 0x120089 RDONLY LEASE(RWH) /srv/samba/example file.txt Thu Nov 1 10:00:00 2018
Additional resources
-
smbstatus(1)
man page
3.20.10. Using the smbtar utility
The smbtar
utility backs up the content of an SMB share or a subdirectory of it and stores the content in a tar
archive. Alternatively, you can write the content to a tape device.
Prerequisites
-
The
samba-client
package is installed.
Procedure
Use the following command to back up the content of the
demo
directory on the//server/example/
share and store the content in the/root/example.tar
archive:# smbtar -s server -x example -u user_name -p password -t /root/example.tar
Additional resources
-
smbtar(1)
man page
3.20.11. Using the wbinfo utility
The wbinfo
utility queries and returns information created and used by the winbindd
service.
Prerequisites
-
The
samba-winbind-clients
package is installed.
Procedure
You can use wbinfo
, for example, to:
List domain users:
# wbinfo -u AD\administrator AD\guest ...
List domain groups:
# wbinfo -g AD\domain computers AD\domain admins AD\domain users ...
Display the SID of a user:
# wbinfo --name-to-sid="AD\administrator" S-1-5-21-1762709870-351891212-3141221786-500 SID_USER (1)
Display information about domains and trusts:
# wbinfo --trusted-domains --verbose Domain Name DNS Domain Trust Type Transitive In Out BUILTIN None Yes Yes Yes server None Yes Yes Yes DOMAIN1 domain1.example.com None Yes Yes Yes DOMAIN2 domain2.example.com External No Yes Yes
Additional resources
-
wbinfo(1)
man page
3.21. Additional resources
-
smb.conf(5)
man page -
/usr/share/docs/samba-version/
directory contains general documentation, example scripts, and LDAP schema files, provided by the Samba project - Setting up Samba and the Clustered Trivial Database (CDTB) to share directories stored on an GlusterFS volume
- Mounting an SMB Share on Red Hat Enterprise Linux
Chapter 4. Setting up and configuring a BIND DNS server
BIND is a feature-rich DNS server that is fully compliant with the Internet Engineering Task Force (IETF) DNS standards and draft standards. For example, administrators frequently use BIND as:
- Caching DNS server in the local network
- Authoritative DNS server for zones
- Secondary server to provide high availability for zones
4.1. Considerations about protecting BIND with SELinux or running it in a change-root environment
To secure a BIND installation, you can:
Run the
named
service without a change-root environment. In this case, SELinux inenforcing
mode prevents exploitation of known BIND security vulnerabilities. By default, Red Hat Enterprise Linux uses SELinux inenforcing
mode.ImportantRunning BIND on RHEL with SELinux in
enforcing
mode is more secure than running BIND in a change-root environment.Run the
named-chroot
service in a change-root environment.Using the change-root feature, administrators can define that the root directory of a process and its sub-processes is different to the
/
directory. When you start thenamed-chroot
service, BIND switches its root directory to/var/named/chroot/
. As a consequence, the service usesmount --bind
commands to make the files and directories listed in/etc/named-chroot.files
available in/var/named/chroot/
, and the process has no access to files outside of/var/named/chroot/
.
If you decide to use BIND:
-
In normal mode, use the
named
service. -
In a change-root environment, use the
named-chroot
service. This requires that you install, additionally, thenamed-chroot
package.
Additional resources
-
The
Red Hat SELinux BIND security profile
section in thenamed(8)
man page
4.2. The BIND Administrator Reference Manual
The comprehensive BIND Administrator Reference Manual
, that is included in the bind
package, provides:
- Configuration examples
- Documentation on advanced features
- A configuration reference
- Security considerations
To display the BIND Administrator Reference Manual
on a host that has the bind
package installed, open the /usr/share/doc/bind/Bv9ARM.html
file in a browser.
4.3. Configuring BIND as a caching DNS server
By default, the BIND DNS server resolves and caches successful and failed lookups. The service then answers requests to the same records from its cache. This significantly improves the speed of DNS lookups.
Prerequisites
- The IP address of the server is static.
Procedure
Install the
bind
andbind-utils
packages:# yum install bind bind-utils
These packages provide BIND 9.11. If you require BIND 9.16, install the
bind9.16
andbind9.16-utils
packages.If you want to run BIND in a change-root environment install the
bind-chroot
package:# yum install bind-chroot
Note that running BIND on a host with SELinux in
enforcing
mode, which is default, is more secure.Edit the
/etc/named.conf
file, and make the following changes in theoptions
statement:Update the
listen-on
andlisten-on-v6
statements to specify on which IPv4 and IPv6 interfaces BIND should listen:listen-on port 53 { 127.0.0.1; 192.0.2.1; }; listen-on-v6 port 53 { ::1; 2001:db8:1::1; };
Update the
allow-query
statement to configure from which IP addresses and ranges clients can query this DNS server:allow-query { localhost; 192.0.2.0/24; 2001:db8:1::/64; };
Add an
allow-recursion
statement to define from which IP addresses and ranges BIND accepts recursive queries:allow-recursion { localhost; 192.0.2.0/24; 2001:db8:1::/64; };
WarningDo not allow recursion on public IP addresses of the server. Otherwise, the server can become part of large-scale DNS amplification attacks.
By default, BIND resolves queries by recursively querying from the root servers to an authoritative DNS server. Alternatively, you can configure BIND to forward queries to other DNS servers, such as the ones of your provider. In this case, add a
forwarders
statement with the list of IP addresses of the DNS servers that BIND should forward queries to:forwarders { 198.51.100.1; 203.0.113.5; };
As a fall-back behavior, BIND resolves queries recursively if the forwarder servers do not respond. To disable this behavior, add a
forward only;
statement.
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Update the
firewalld
rules to allow incoming DNS traffic:# firewall-cmd --permanent --add-service=dns # firewall-cmd --reload
Start and enable BIND:
# systemctl enable --now named
If you want to run BIND in a change-root environment, use the
systemctl enable --now named-chroot
command to enable and start the service.
Verification
Use the newly set up DNS server to resolve a domain:
# dig @localhost www.example.org ... www.example.org. 86400 IN A 198.51.100.34 ;; Query time: 917 msec ...
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.After querying a record for the first time, BIND adds the entry to its cache.
Repeat the previous query:
# dig @localhost www.example.org ... www.example.org. 85332 IN A 198.51.100.34 ;; Query time: 1 msec ...
Because of the cached entry, further requests for the same record are significantly faster until the entry expires.
Next steps
- Configure the clients in your network to use this DNS server. If a DHCP server provides the DNS server setting to the clients, update the DHCP server’s configuration accordingly.
Additional resources
- Considerations about protecting BIND with SELinux or running it in a change-root environment
-
named.conf(5)
man page -
/usr/share/doc/bind/sample/etc/named.conf
- The BIND Administrator Reference Manual
4.4. Configuring logging on a BIND DNS server
The configuration in the default /etc/named.conf
file, as provided by the bind
package, uses the default_debug
channel and logs messages to the /var/named/data/named.run
file. The default_debug
channel only logs entries when the server’s debug level is non-zero.
Using different channels and categories, you can configure BIND to write different events with a defined severity to separate files.
Prerequisites
- BIND is already configured, for example, as a caching name server.
-
The
named
ornamed-chroot
service is running.
Procedure
Edit the
/etc/named.conf
file, and addcategory
andchannel
phrases to thelogging
statement, for example:logging { ... category notify { zone_transfer_log; }; category xfer-in { zone_transfer_log; }; category xfer-out { zone_transfer_log; }; channel zone_transfer_log { file "/var/named/log/transfer.log" versions 10 size 50m; print-time yes; print-category yes; print-severity yes; severity info; }; ... };
With this example configuration, BIND logs messages related to zone transfers to
/var/named/log/transfer.log
. BIND creates up to10
versions of the log file and rotates them if they reach a maximum size of50
MB.The
category
phrase defines to which channels BIND sends messages of a category.The
channel
phrase defines the destination of log messages including the number of versions, the maximum file size, and the severity level BIND should log to a channel. Additional settings, such as enabling logging the time stamp, category, and severity of an event are optional, but useful for debugging purposes.Create the log directory if it does not exist, and grant write permissions to the
named
user on this directory:# mkdir /var/named/log/ # chown named:named /var/named/log/ # chmod 700 /var/named/log/
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Restart BIND:
# systemctl restart named
If you run BIND in a change-root environment, use the
systemctl restart named-chroot
command to restart the service.
Verification
Display the content of the log file:
# cat /var/named/log/transfer.log ... 06-Jul-2022 15:08:51.261 xfer-out: info: client @0x7fecbc0b0700 192.0.2.2#36121/key example-transfer-key (example.com): transfer of 'example.com/IN': AXFR started: TSIG example-transfer-key (serial 2022070603) 06-Jul-2022 15:08:51.261 xfer-out: info: client @0x7fecbc0b0700 192.0.2.2#36121/key example-transfer-key (example.com): transfer of 'example.com/IN': AXFR ended
Additional resources
-
named.conf(5)
man page - The BIND Administrator Reference Manual
4.5. Writing BIND ACLs
Controlling access to certain features of BIND can prevent unauthorized access and attacks, such as denial of service (DoS). BIND access control list (acl
) statements are lists of IP addresses and ranges. Each ACL has a nickname that you can use in several statements, such as allow-query
, to refer to the specified IP addresses and ranges.
BIND uses only the first matching entry in an ACL. For example, if you define an ACL { 192.0.2/24; !192.0.2.1; }
and the host with IP address 192.0.2.1
connects, access is granted even if the second entry excludes this address.
BIND has the following built-in ACLs:
-
none
: Matches no hosts. -
any
: Matches all hosts. -
localhost
: Matches the loopback addresses127.0.0.1
and::1
, as well as the IP addresses of all interfaces on the server that runs BIND. -
localnets
: Matches the loopback addresses127.0.0.1
and::1
, as well as all subnets the server that runs BIND is directly connected to.
Prerequisites
- BIND is already configured, for example, as a caching name server.
-
The
named
ornamed-chroot
service is running.
Procedure
Edit the
/etc/named.conf
file and make the following changes:Add
acl
statements to the file. For example, to create an ACL namedinternal-networks
for127.0.0.1
,192.0.2.0/24
, and2001:db8:1::/64
, enter:acl internal-networks { 127.0.0.1; 192.0.2.0/24; 2001:db8:1::/64; }; acl dmz-networks { 198.51.100.0/24; 2001:db8:2::/64; };
Use the ACL’s nickname in statements that support them, for example:
allow-query { internal-networks; dmz-networks; }; allow-recursion { internal-networks; };
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
Verification
Execute an action that triggers a feature which uses the configured ACL. For example, the ACL in this procedure allows only recursive queries from the defined IP addresses. In this case, enter the following command on a host that is not within the ACL’s definition to attempt resolving an external domain:
# dig +short @192.0.2.1 www.example.com
If the command returns no output, BIND denied access, and the ACL works. For a verbose output on the client, use the command without
+short
option:# dig @192.0.2.1 www.example.com ... ;; WARNING: recursion requested but not available ...
Additional resources
-
The
Access control lists
section in the The BIND Administrator Reference Manual.
4.6. Configuring zones on a BIND DNS server
A DNS zone is a database with resource records for a specific sub-tree in the domain space. For example, if you are responsible for the example.com
domain, you can set up a zone for it in BIND. As a result, clients can, resolve www.example.com
to the IP address configured in this zone.
4.6.1. The SOA record in zone files
The start of authority (SOA) record is a required record in a DNS zone. This record is important, for example, if multiple DNS servers are authoritative for a zone but also to DNS resolvers.
A SOA record in BIND has the following syntax:
name class type mname rname serial refresh retry expire minimum
For better readability, administrators typically split the record in zone files into multiple lines with comments that start with a semicolon (;
). Note that, if you split a SOA record, parentheses keep the record together:
@ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL
Note the trailing dot at the end of the fully-qualified domain names (FQDNs). FQDNs consist of multiple domain labels, separated by dots. Because the DNS root has an empty label, FQDNs end with a dot. Therefore, BIND appends the zone name to names without a trailing dot. A hostname without a trailing dot, for example, ns1.example.com
would be expanded to ns1.example.com.example.com.
, which is not the correct address of the primary name server.
These are the fields in a SOA record:
-
name
: The name of the zone, the so-calledorigin
. If you set this field to@
, BIND expands it to the zone name defined in/etc/named.conf
. -
class
: In SOA records, you must set this field always to Internet (IN
). -
type
: In SOA records, you must set this field always toSOA
. -
mname
(master name): The hostname of the primary name server of this zone. -
rname
(responsible name): The email address of who is responsible for this zone. Note that the format is different. You must replace the at sign (@
) with a dot (.
). serial
: The version number of this zone file. Secondary name servers only update their copies of the zone if the serial number on the primary server is higher.The format can be any numeric value. A commonly-used format is
<year><month><day><two-digit-number>
. With this format, you can, theoretically, change the zone file up to a hundred times per day.-
refresh
: The amount of time secondary servers should wait before checking the primary server if the zone was updated. -
retry
: The amount of time after that a secondary server retries to query the primary server after a failed attempt. -
expire
: The amount of time after that a secondary server stops querying the primary server, if all previous attempts failed. -
minimum
: RFC 2308 changed the meaning of this field to the negative caching time. Compliant resolvers use it to determine how long to cacheNXDOMAIN
name errors.
A numeric value in the refresh
, retry
, expire
, and minimum
fields define a time in seconds. However, for better readability, use time suffixes, such as m
for minute, h
for hours, and d
for days. For example, 3h
stands for 3 hours.
4.6.2. Setting up a forward zone on a BIND primary server
Forward zones map names to IP addresses and other information. For example, if you are responsible for the domain example.com
, you can set up a forward zone in BIND to resolve names, such as www.example.com
.
Prerequisites
- BIND is already configured, for example, as a caching name server.
-
The
named
ornamed-chroot
service is running.
Procedure
Add a zone definition to the
/etc/named.conf
file:zone "example.com" { type master; file "example.com.zone"; allow-query { any; }; allow-transfer { none; }; };
These settings define:
-
This server as the primary server (
type master
) for theexample.com
zone. -
The
/var/named/example.com.zone
file is the zone file. If you set a relative path, as in this example, this path is relative to the directory you set indirectory
in theoptions
statement. - Any host can query this zone. Alternatively, specify IP ranges or BIND access control list (ACL) nicknames to limit the access.
- No host can transfer the zone. Allow zone transfers only when you set up secondary servers and only for the IP addresses of the secondary servers.
-
This server as the primary server (
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Create the
/var/named/example.com.zone
file, for example, with the following content:$TTL 8h @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL IN NS ns1.example.com. IN MX 10 mail.example.com. www IN A 192.0.2.30 www IN AAAA 2001:db8:1::30 ns1 IN A 192.0.2.1 ns1 IN AAAA 2001:db8:1::1 mail IN A 192.0.2.20 mail IN AAAA 2001:db8:1::20
This zone file:
-
Sets the default time-to-live (TTL) value for resource records to 8 hours. Without a time suffix, such as
h
for hour, BIND interprets the value as seconds. - Contains the required SOA resource record with details about the zone.
-
Sets
ns1.example.com
as an authoritative DNS server for this zone. To be functional, a zone requires at least one name server (NS
) record. However, to be compliant with RFC 1912, you require at least two name servers. -
Sets
mail.example.com
as the mail exchanger (MX
) of theexample.com
domain. The numeric value in front of the host name is the priority of the record. Entries with a lower value have a higher priority. -
Sets the IPv4 and IPv6 addresses of
www.example.com
,mail.example.com
, andns1.example.com
.
-
Sets the default time-to-live (TTL) value for resource records to 8 hours. Without a time suffix, such as
Set secure permissions on the zone file that allow only the
named
group to read it:# chown root:named /var/named/example.com.zone # chmod 640 /var/named/example.com.zone
Verify the syntax of the
/var/named/example.com.zone
file:# named-checkzone example.com /var/named/example.com.zone zone example.com/IN: loaded serial 2022070601 OK
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
Verification
Query different records from the
example.com
zone, and verify that the output matches the records you have configured in the zone file:# dig +short @localhost AAAA www.example.com 2001:db8:1::30 # dig +short @localhost NS example.com ns1.example.com. # dig +short @localhost A ns1.example.com 192.0.2.1
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.
4.6.3. Setting up a reverse zone on a BIND primary server
Reverse zones map IP addresses to names. For example, if you are responsible for IP range 192.0.2.0/24
, you can set up a reverse zone in BIND to resolve IP addresses from this range to hostnames.
If you create a reverse zone for whole classful networks, name the zone accordingly. For example, for the class C network 192.0.2.0/24
, the name of the zone is 2.0.192.in-addr.arpa
. If you want to create a reverse zone for a different network size, for example 190.0.2.0/28
, the name of the zone is 28-2.0.192.in-addr.arpa
.
Prerequisites
- BIND is already configured, for example, as a caching name server.
-
The
named
ornamed-chroot
service is running.
Procedure
Add a zone definition to the
/etc/named.conf
file:zone "2.0.192.in-addr.arpa" { type master; file "2.0.192.in-addr.arpa.zone"; allow-query { any; }; allow-transfer { none; }; };
These settings define:
-
This server as the primary server (
type master
) for the2.0.192.in-addr.arpa
reverse zone. -
The
/var/named/2.0.192.in-addr.arpa.zone
file is the zone file. If you set a relative path, as in this example, this path is relative to the directory you set indirectory
in theoptions
statement. - Any host can query this zone. Alternatively, specify IP ranges or BIND access control list (ACL) nicknames to limit the access.
- No host can transfer the zone. Allow zone transfers only when you set up secondary servers and only for the IP addresses of the secondary servers.
-
This server as the primary server (
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Create the
/var/named/2.0.192.in-addr.arpa.zone
file, for example, with the following content:$TTL 8h @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL IN NS ns1.example.com. 1 IN PTR ns1.example.com. 30 IN PTR www.example.com.
This zone file:
-
Sets the default time-to-live (TTL) value for resource records to 8 hours. Without a time suffix, such as
h
for hour, BIND interprets the value as seconds. - Contains the required SOA resource record with details about the zone.
-
Sets
ns1.example.com
as an authoritative DNS server for this reverse zone. To be functional, a zone requires at least one name server (NS
) record. However, to be compliant with RFC 1912, you require at least two name servers. -
Sets the pointer (
PTR
) record for the192.0.2.1
and192.0.2.30
addresses.
-
Sets the default time-to-live (TTL) value for resource records to 8 hours. Without a time suffix, such as
Set secure permissions on the zone file that only allow the
named
group to read it:# chown root:named /var/named/2.0.192.in-addr.arpa.zone # chmod 640 /var/named/2.0.192.in-addr.arpa.zone
Verify the syntax of the
/var/named/2.0.192.in-addr.arpa.zone
file:# named-checkzone 2.0.192.in-addr.arpa /var/named/2.0.192.in-addr.arpa.zone zone 2.0.192.in-addr.arpa/IN: loaded serial 2022070601 OK
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
Verification
Query different records from the reverse zone, and verify that the output matches the records you have configured in the zone file:
# dig +short @localhost -x 192.0.2.1 ns1.example.com. # dig +short @localhost -x 192.0.2.30 www.example.com.
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.
4.6.4. Updating a BIND zone file
In certain situations, for example if an IP address of a server changes, you must update a zone file. If multiple DNS servers are responsible for a zone, perform this procedure only on the primary server. Other DNS servers that store a copy of the zone will receive the update through a zone transfer.
Prerequisites
- The zone is configured.
-
The
named
ornamed-chroot
service is running.
Procedure
Optional: Identify the path to the zone file in the
/etc/named.conf
file:options { ... directory "/var/named"; } zone "example.com" { ... file "example.com.zone"; };
You find the path to the zone file in the
file
statement in the zone’s definition. A relative path is relative to the directory set indirectory
in theoptions
statement.Edit the zone file:
- Make the required changes.
Increment the serial number in the start of authority (SOA) record.
ImportantIf the serial number is equal to or lower than the previous value, secondary servers will not update their copy of the zone.
Verify the syntax of the zone file:
# named-checkzone example.com /var/named/example.com.zone zone example.com/IN: loaded serial 2022062802 OK
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
Verification
Query the record you have added, modified, or removed, for example:
# dig +short @localhost A ns2.example.com 192.0.2.2
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.
4.6.5. DNSSEC zone signing using the automated key generation and zone maintenance features
You can sign zones with domain name system security extensions (DNSSEC) to ensure authentication and data integrity. Such zones contain additional resource records. Clients can use them to verify the authenticity of the zone information.
If you enable the DNSSEC policy feature for a zone, BIND performs the following actions automatically:
- Creates the keys
- Signs the zone
- Maintains the zone, including re-signing and periodically replacing the keys.
To enable external DNS servers to verify the authenticity of a zone, you must add the public key of the zone to the parent zone. Contact your domain provider or registry for further details on how to accomplish this.
This procedure uses the built-in default
DNSSEC policy in BIND. This policy uses single ECDSAP256SHA
key signatures. Alternatively, create your own policy to use custom keys, algorithms, and timings.
Prerequisites
-
BIND 9.16 or later is installed. To meet this requirement, install the
bind9.16
package instead ofbind
. - The zone for which you want to enable DNSSEC is configured.
-
The
named
ornamed-chroot
service is running. - The server synchronizes the time with a time server. An accurate system time is important for DNSSEC validation.
Procedure
Edit the
/etc/named.conf
file, and adddnssec-policy default;
to the zone for which you want to enable DNSSEC:zone "example.com" { ... dnssec-policy default; };
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.BIND stores the public key in the
/var/named/K<zone_name>.+<algorithm>+<key_ID>.key
file. Use this file to display the public key of the zone in the format that the parent zone requires:DS record format:
# dnssec-dsfromkey /var/named/Kexample.com.+013+61141.key example.com. IN DS 61141 13 2 3E184188CF6D2521EDFDC3F07CFEE8D0195AACBD85E68BAE0620F638B4B1B027
DNSKEY format:
# grep DNSKEY /var/named/Kexample.com.+013+61141.key example.com. 3600 IN DNSKEY 257 3 13 sjzT3jNEp120aSO4mPEHHSkReHUf7AABNnT8hNRTzD5cKMQSjDJin2I3 5CaKVcWO1pm+HltxUEt+X9dfp8OZkg==
- Request to add the public key of the zone to the parent zone. Contact your domain provider or registry for further details on how to accomplish this.
Verification
Query your own DNS server for a record from the zone for which you enabled DNSSEC signing:
# dig +dnssec +short @localhost A www.example.com 192.0.2.30 A 13 3 28800 20220718081258 20220705120353 61141 example.com. e7Cfh6GuOBMAWsgsHSVTPh+JJSOI/Y6zctzIuqIU1JqEgOOAfL/Qz474 M0sgi54m1Kmnr2ANBKJN9uvOs5eXYw==
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.After the public key has been added to the parent zone and propagated to other servers, verify that the server sets the authenticated data (
ad
) flag on queries to the signed zone:# dig @localhost example.com +dnssec ... ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ...
4.7. Configuring zone transfers among BIND DNS servers
Zone transfers ensure that all DNS servers that have a copy of the zone use up-to-date data.
Prerequisites
- On the future primary server, the zone for which you want to set up zone transfers is already configured.
- On the future secondary server, BIND is already configured, for example, as a caching name server.
-
On both servers, the
named
ornamed-chroot
service is running.
Procedure
On the existing primary server:
Create a shared key, and append it to the
/etc/named.conf
file:# tsig-keygen example-transfer-key | tee -a /etc/named.conf key "example-transfer-key" { algorithm hmac-sha256; secret "q7ANbnyliDMuvWgnKOxMLi313JGcTZB5ydMW5CyUGXQ="; };
This command displays the output of the
tsig-keygen
command and automatically appends it to/etc/named.conf
.You will require the output of the command later on the secondary server as well.
Edit the zone definition in the
/etc/named.conf
file:In the
allow-transfer
statement, define that servers must provide the key specified in theexample-transfer-key
statement to transfer a zone:zone "example.com" { ... allow-transfer { key example-transfer-key; }; };
Alternatively, use BIND access control list (ACL) nicknames in the
allow-transfer
statement.By default, after a zone has been updated, BIND notifies all name servers which have a name server (
NS
) record in this zone. If you do not plan to add anNS
record for the secondary server to the zone, you can, configure that BIND notifies this server anyway. For that, add thealso-notify
statement with the IP addresses of this secondary server to the zone:zone "example.com" { ... also-notify { 192.0.2.2; 2001:db8:1::2; }; };
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
On the future secondary server:
Edit the
/etc/named.conf
file as follows:Add the same key definition as on the primary server:
key "example-transfer-key" { algorithm hmac-sha256; secret "q7ANbnyliDMuvWgnKOxMLi313JGcTZB5ydMW5CyUGXQ="; };
Add the zone definition to the
/etc/named.conf
file:zone "example.com" { type slave; file "slaves/example.com.zone"; allow-query { any; }; allow-transfer { none; }; masters { 192.0.2.1 key example-transfer-key; 2001:db8:1::1 key example-transfer-key; }; };
These settings state:
-
This server is a secondary server (
type slave
) for theexample.com
zone. -
The
/var/named/slaves/example.com.zone
file is the zone file. If you set a relative path, as in this example, this path is relative to the directory you set indirectory
in theoptions
statement. To separate zone files for which this server is secondary from primary ones, you can store them, for example, in the/var/named/slaves/
directory. - Any host can query this zone. Alternatively, specify IP ranges or ACL nicknames to limit the access.
- No host can transfer the zone from this server.
-
The IP addresses of the primary server of this zone are
192.0.2.1
and2001:db8:1::2
. Alternatively, you can specify ACL nicknames. This secondary server will use the key namedexample-transfer-key
to authenticate to the primary server.
-
This server is a secondary server (
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
-
Optional: Modify the zone file on the primary server and add an
NS
record for the new secondary server.
Verification
On the secondary server:
Display the
systemd
journal entries of thenamed
service:# journalctl -u named ... Jul 06 15:08:51 ns2.example.com named[2024]: zone example.com/IN: Transfer started. Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: connected using 192.0.2.2#45803 Jul 06 15:08:51 ns2.example.com named[2024]: zone example.com/IN: transferred serial 2022070101 Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: Transfer status: success Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: Transfer completed: 1 messages, 29 records, 2002 bytes, 0.003 secs (667333 bytes/sec)
If you run BIND in a change-root environment, use the
journalctl -u named-chroot
command to display the journal entries.Verify that BIND created the zone file:
# ls -l /var/named/slaves/ total 4 -rw-r--r--. 1 named named 2736 Jul 6 15:08 example.com.zone
Note that, by default, secondary servers store zone files in a binary raw format.
Query a record of the transferred zone from the secondary server:
# dig +short @192.0.2.2 AAAA www.example.com 2001:db8:1::30
This example assumes that the secondary server you set up in this procedure listens on IP address
192.0.2.2
.
4.8. Configuring response policy zones in BIND to override DNS records
Using DNS blocking and filtering, administrators can rewrite a DNS response to block access to certain domains or hosts. In BIND, response policy zones (RPZs) provide this feature. You can configure different actions for blocked entries, such as returning an NXDOMAIN
error or not responding to the query.
If you have multiple DNS servers in your environment, use this procedure to configure the RPZ on the primary server, and later configure zone transfers to make the RPZ available on your secondary servers.
Prerequisites
- BIND is already configured, for example, as a caching name server.
-
The
named
ornamed-chroot
service is running.
Procedure
Edit the
/etc/named.conf
file, and make the following changes:Add a
response-policy
definition to theoptions
statement:options { ... response-policy { zone "rpz.local"; }; ... }
You can set a custom name for the RPZ in the
zone
statement inresponse-policy
. However, you must use the same name in the zone definition in the next step.Add a
zone
definition for the RPZ you set in the previous step:zone "rpz.local" { type master; file "rpz.local"; allow-query { localhost; 192.0.2.0/24; 2001:db8:1::/64; }; allow-transfer { none; }; };
These settings state:
-
This server is the primary server (
type master
) for the RPZ namedrpz.local
. -
The
/var/named/rpz.local
file is the zone file. If you set a relative path, as in this example, this path is relative to the directory you set indirectory
in theoptions
statement. -
Any hosts defined in
allow-query
can query this RPZ. Alternatively, specify IP ranges or BIND access control list (ACL) nicknames to limit the access. - No host can transfer the zone. Allow zone transfers only when you set up secondary servers and only for the IP addresses of the secondary servers.
-
This server is the primary server (
Verify the syntax of the
/etc/named.conf
file:# named-checkconf
If the command displays no output, the syntax is correct.
Create the
/var/named/rpz.local
file, for example, with the following content:$TTL 10m @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1h ; refresh period 1m ; retry period 3d ; expire time 1m ) ; minimum TTL IN NS ns1.example.com. example.org IN CNAME . *.example.org IN CNAME . example.net IN CNAME rpz-drop. *.example.net IN CNAME rpz-drop.
This zone file:
-
Sets the default time-to-live (TTL) value for resource records to 10 minutes. Without a time suffix, such as
h
for hour, BIND interprets the value as seconds. - Contains the required start of authority (SOA) resource record with details about the zone.
-
Sets
ns1.example.com
as an authoritative DNS server for this zone. To be functional, a zone requires at least one name server (NS
) record. However, to be compliant with RFC 1912, you require at least two name servers. -
Return an
NXDOMAIN
error for queries toexample.org
and hosts in this domain. -
Drop queries to
example.net
and hosts in this domain.
For a full list of actions and examples, see IETF draft: DNS Response Policy Zones (RPZ).
-
Sets the default time-to-live (TTL) value for resource records to 10 minutes. Without a time suffix, such as
Verify the syntax of the
/var/named/rpz.local
file:# named-checkzone rpz.local /var/named/rpz.local zone rpz.local/IN: loaded serial 2022070601 OK
Reload BIND:
# systemctl reload named
If you run BIND in a change-root environment, use the
systemctl reload named-chroot
command to reload the service.
Verification
Attempt to resolve a host in
example.org
, that is configured in the RPZ to return anNXDOMAIN
error:# dig @localhost www.example.org ... ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30286 ...
This example assumes that BIND runs on the same host and responds to queries on the
localhost
interface.Attempt to resolve a host in the
example.net
domain, that is configured in the RPZ to drop queries:# dig @localhost www.example.net ... ;; connection timed out; no servers could be reached ...
Additional resources
Chapter 5. Exporting NFS shares
As a system administrator, you can use the NFS server to share a directory on your system over network.
5.1. Introduction to NFS
This section explains the basic concepts of the NFS service.
A Network File System (NFS) allows remote hosts to mount file systems over a network and interact with those file systems as though they are mounted locally. This enables you to consolidate resources onto centralized servers on the network.
The NFS server refers to the /etc/exports
configuration file to determine whether the client is allowed to access any exported file systems. Once verified, all file and directory operations are available to the user.
5.2. Supported NFS versions
This section lists versions of NFS supported in Red Hat Enterprise Linux and their features.
Currently, Red Hat Enterprise Linux 8 supports the following major versions of NFS:
- NFS version 3 (NFSv3) supports safe asynchronous writes and is more robust at error handling than the previous NFSv2; it also supports 64-bit file sizes and offsets, allowing clients to access more than 2 GB of file data.
-
NFS version 4 (NFSv4) works through firewalls and on the Internet, no longer requires an
rpcbind
service, supports Access Control Lists (ACLs), and utilizes stateful operations.
NFS version 2 (NFSv2) is no longer supported by Red Hat.
Default NFS version
The default NFS version in Red Hat Enterprise Linux 8 is 4.2. NFS clients attempt to mount using NFSv4.2 by default, and fall back to NFSv4.1 when the server does not support NFSv4.2. The mount later falls back to NFSv4.0 and then to NFSv3.
Features of minor NFS versions
Following are the features of NFSv4.2 in Red Hat Enterprise Linux 8:
- Server-side copy
-
Enables the NFS client to efficiently copy data without wasting network resources using the
copy_file_range()
system call. - Sparse files
-
Enables files to have one or more holes, which are unallocated or uninitialized data blocks consisting only of zeroes. The
lseek()
operation in NFSv4.2 supportsseek_hole()
andseek_data()
, which enables applications to map out the location of holes in the sparse file. - Space reservation
-
Permits storage servers to reserve free space, which prohibits servers to run out of space. NFSv4.2 supports the
allocate()
operation to reserve space, thedeallocate()
operation to unreserve space, and thefallocate()
operation to preallocate or deallocate space in a file. - Labeled NFS
- Enforces data access rights and enables SELinux labels between a client and a server for individual files on an NFS file system.
- Layout enhancements
-
Provides the
layoutstats()
operation, which enables some Parallel NFS (pNFS) servers to collect better performance statistics.
Following are the features of NFSv4.1:
- Enhances performance and security of network, and also includes client-side support for pNFS.
- No longer requires a separate TCP connection for callbacks, which allows an NFS server to grant delegations even when it cannot contact the client: for example, when NAT or a firewall interferes.
- Provides exactly once semantics (except for reboot operations), preventing a previous issue whereby certain operations sometimes returned an inaccurate result if a reply was lost and the operation was sent twice.
5.3. The TCP and UDP protocols in NFSv3 and NFSv4
NFSv4 requires the Transmission Control Protocol (TCP) running over an IP network.
NFSv3 could also use the User Datagram Protocol (UDP) in earlier Red Hat Enterprise Linux versions. In Red Hat Enterprise Linux 8, NFS over UDP is no longer supported. By default, UDP is disabled in the NFS server.
5.4. Services required by NFS
This section lists system services that are required for running an NFS server or mounting NFS shares. Red Hat Enterprise Linux starts these services automatically.
Red Hat Enterprise Linux uses a combination of kernel-level support and service processes to provide NFS file sharing. All NFS versions rely on Remote Procedure Calls (RPC) between clients and servers. To share or mount NFS file systems, the following services work together depending on which version of NFS is implemented:
nfsd
- The NFS server kernel module that services requests for shared NFS file systems.
rpcbind
-
Accepts port reservations from local RPC services. These ports are then made available (or advertised) so the corresponding remote RPC services can access them. The
rpcbind
service responds to requests for RPC services and sets up connections to the requested RPC service. This is not used with NFSv4. rpc.mountd
-
This process is used by an NFS server to process
MOUNT
requests from NFSv3 clients. It checks that the requested NFS share is currently exported by the NFS server, and that the client is allowed to access it. If the mount request is allowed, thenfs-mountd
service replies with a Success status and provides the File-Handle for this NFS share back to the NFS client. rpc.nfsd
-
This process enables explicit NFS versions and protocols the server advertises to be defined. It works with the Linux kernel to meet the dynamic demands of NFS clients, such as providing server threads each time an NFS client connects. This process corresponds to the
nfs-server
service. lockd
- This is a kernel thread that runs on both clients and servers. It implements the Network Lock Manager (NLM) protocol, which enables NFSv3 clients to lock files on the server. It is started automatically whenever the NFS server is run and whenever an NFS file system is mounted.
rpc.statd
-
This process implements the Network Status Monitor (NSM) RPC protocol, which notifies NFS clients when an NFS server is restarted without being gracefully brought down. The
rpc-statd
service is started automatically by thenfs-server
service, and does not require user configuration. This is not used with NFSv4. rpc.rquotad
-
This process provides user quota information for remote users. The
rpc-rquotad
service, which is provided by thequota-rpc
package, has to be started by user when thenfs-server
is started. rpc.idmapd
This process provides NFSv4 client and server upcalls, which map between on-the-wire NFSv4 names (strings in the form of
user@domain
) and local UIDs and GIDs. Foridmapd
to function with NFSv4, the/etc/idmapd.conf
file must be configured. At a minimum, theDomain
parameter should be specified, which defines the NFSv4 mapping domain. If the NFSv4 mapping domain is the same as the DNS domain name, this parameter can be skipped. The client and server must agree on the NFSv4 mapping domain for ID mapping to function properly.Only the NFSv4 server uses
rpc.idmapd
, which is started by thenfs-idmapd
service. The NFSv4 client uses the keyring-basednfsidmap
utility, which is called by the kernel on-demand to perform ID mapping. If there is a problem withnfsidmap
, the client falls back to usingrpc.idmapd
.
The RPC services with NFSv4
The mounting and locking protocols have been incorporated into the NFSv4 protocol. The server also listens on the well-known TCP port 2049. As such, NFSv4 does not need to interact with rpcbind
, lockd
, and rpc-statd
services. The nfs-mountd
service is still required on the NFS server to set up the exports, but is not involved in any over-the-wire operations.
Additional resources
5.5. NFS host name formats
This section describes different formats that you can use to specify a host when mounting or exporting an NFS share.
You can specify the host in the following formats:
- Single machine
Either of the following:
- A fully-qualified domain name (that can be resolved by the server)
- Host name (that can be resolved by the server)
- An IP address.
- IP networks
Either of the following formats is valid:
-
a.b.c.d/z
, wherea.b.c.d
is the network andz
is the number of bits in the netmask; for example192.168.0.0/24
. -
a.b.c.d/netmask
, wherea.b.c.d
is the network andnetmask
is the netmask; for example,192.168.100.8/255.255.255.0
.
-
- Netgroups
-
The
@group-name
format , wheregroup-name
is the NIS netgroup name.
5.6. NFS server configuration
This section describes the syntax and options of two ways to configure exports on an NFS server:
-
Manually editing the
/etc/exports
configuration file -
Using the
exportfs
utility on the command line
5.6.1. The /etc/exports configuration file
The /etc/exports
file controls which file systems are exported to remote hosts and specifies options. It follows the following syntax rules:
- Blank lines are ignored.
-
To add a comment, start a line with the hash mark (
#
). -
You can wrap long lines with a backslash (
\
). - Each exported file system should be on its own individual line.
- Any lists of authorized hosts placed after an exported file system must be separated by space characters.
- Options for each of the hosts must be placed in parentheses directly after the host identifier, without any spaces separating the host and the first parenthesis.
Export entry
Each entry for an exported file system has the following structure:
export host(options)
It is also possible to specify multiple hosts, along with specific options for each host. To do so, list them on the same line as a space-delimited list, with each host name followed by its respective options (in parentheses), as in:
export host1(options1) host2(options2) host3(options3)
In this structure:
- export
- The directory being exported
- host
- The host or network to which the export is being shared
- options
- The options to be used for host
Example 5.1. A simple /etc/exports file
In its simplest form, the /etc/exports
file only specifies the exported directory and the hosts permitted to access it:
/exported/directory bob.example.com
Here, bob.example.com
can mount /exported/directory/
from the NFS server. Because no options are specified in this example, NFS uses default options.
The format of the /etc/exports
file is very precise, particularly in regards to use of the space character. Remember to always separate exported file systems from hosts and hosts from one another with a space character. However, there should be no other space characters in the file except on comment lines.
For example, the following two lines do not mean the same thing:
/home bob.example.com(rw) /home bob.example.com (rw)
The first line allows only users from bob.example.com
read and write access to the /home
directory. The second line allows users from bob.example.com
to mount the directory as read-only (the default), while the rest of the world can mount it read/write.
Default options
The default options for an export entry are:
ro
- The exported file system is read-only. Remote hosts cannot change the data shared on the file system. To allow hosts to make changes to the file system (that is, read and write), specify the rw option.
sync
-
The NFS server will not reply to requests before changes made by previous requests are written to disk. To enable asynchronous writes instead, specify the option
async
. wdelay
-
The NFS server will delay writing to the disk if it suspects another write request is imminent. This can improve performance as it reduces the number of times the disk must be accessed by separate write commands, thereby reducing write overhead. To disable this, specify the
no_wdelay
option, which is available only if the default sync option is also specified. root_squash
This prevents root users connected remotely (as opposed to locally) from having root privileges; instead, the NFS server assigns them the user ID
nobody
. This effectively "squashes" the power of the remote root user to the lowest local user, preventing possible unauthorized writes on the remote server. To disable root squashing, specify theno_root_squash
option.To squash every remote user (including root), use the
all_squash
option. To specify the user and group IDs that the NFS server should assign to remote users from a particular host, use theanonuid
andanongid
options, respectively, as in:export host(anonuid=uid,anongid=gid)
Here, uid and gid are user ID number and group ID number, respectively. The
anonuid
andanongid
options enable you to create a special user and group account for remote NFS users to share.
By default, access control lists (ACLs) are supported by NFS under Red Hat Enterprise Linux. To disable this feature, specify the no_acl
option when exporting the file system.
Default and overridden options
Each default for every exported file system must be explicitly overridden. For example, if the rw
option is not specified, then the exported file system is shared as read-only. The following is a sample line from /etc/exports
which overrides two default options:
/another/exported/directory 192.168.0.3(rw,async)
In this example, 192.168.0.3
can mount /another/exported/directory/
read and write, and all writes to disk are asynchronous.
5.6.2. The exportfs utility
The exportfs
utility enables the root user to selectively export or unexport directories without restarting the NFS service. When given the proper options, the exportfs
utility writes the exported file systems to /var/lib/nfs/xtab
. Because the nfs-mountd
service refers to the xtab
file when deciding access privileges to a file system, changes to the list of exported file systems take effect immediately.
Common exportfs options
The following is a list of commonly-used options available for exportfs
:
-r
-
Causes all directories listed in
/etc/exports
to be exported by constructing a new export list in/var/lib/nfs/etab
. This option effectively refreshes the export list with any changes made to/etc/exports
. -a
-
Causes all directories to be exported or unexported, depending on what other options are passed to
exportfs
. If no other options are specified,exportfs
exports all file systems specified in/etc/exports
. -o file-systems
-
Specifies directories to be exported that are not listed in
/etc/exports
. Replace file-systems with additional file systems to be exported. These file systems must be formatted in the same way they are specified in/etc/exports
. This option is often used to test an exported file system before adding it permanently to the list of exported file systems. -i
-
Ignores
/etc/exports
; only options given from the command line are used to define exported file systems. -u
-
Unexports all shared directories. The command
exportfs -ua
suspends NFS file sharing while keeping all NFS services up. To re-enable NFS sharing, useexportfs -r
. -v
-
Verbose operation, where the file systems being exported or unexported are displayed in greater detail when the
exportfs
command is executed.
If no options are passed to the exportfs
utility, it displays a list of currently exported file systems.
Additional resources
5.7. NFS and rpcbind
The rpcbind
service maps Remote Procedure Call (RPC) services to the ports on which they listen. RPC processes notify rpcbind
when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts rpcbind
on the server with a particular RPC program number. The rpcbind
service redirects the client to the proper port number so it can communicate with the requested service.
The Network File System Version 3 (NFSv3) requires the rpcbind
service.
Because RPC-based services rely on rpcbind
to make all connections with incoming client requests, rpcbind
must be available before any of these services start.
Access control rules for rpcbind
affect all RPC-based services. Alternatively, it is possible to specify access control rules for each of the NFS RPC daemons.
Additional resources
-
rpc.mountd(8)
man page -
rpc.statd(8)
man page
5.8. Installing NFS
This procedure installs all packages necessary to mount or export NFS shares.
Procedure
Install the
nfs-utils
package:# yum install nfs-utils
5.9. Starting the NFS server
This procedure describes how to start the NFS server, which is required to export NFS shares.
Prerequisites
For servers that support NFSv3 connections, the
rpcbind
service must be running. To verify thatrpcbind
is active, use the following command:$ systemctl status rpcbind
If the service is stopped, start and enable it:
$ systemctl enable --now rpcbind
Procedure
To start the NFS server and enable it to start automatically at boot, use the following command:
# systemctl enable --now nfs-server
Additional resources
5.10. Troubleshooting NFS and rpcbind
Because the rpcbind
service provides coordination between RPC services and the port numbers used to communicate with them, it is useful to view the status of current RPC services using rpcbind
when troubleshooting. The rpcinfo
utility shows each RPC-based service with port numbers, an RPC program number, a version number, and an IP protocol type (TCP or UDP).
Procedure
To make sure the proper NFS RPC-based services are enabled for
rpcbind
, use the following command:# rpcinfo -p
Example 5.2. rpcinfo -p command output
The following is sample output from this command:
program vers proto port service 100000 4 tcp 111 portmapper 100000 3 tcp 111 portmapper 100000 2 tcp 111 portmapper 100000 4 udp 111 portmapper 100000 3 udp 111 portmapper 100000 2 udp 111 portmapper 100005 1 udp 20048 mountd 100005 1 tcp 20048 mountd 100005 2 udp 20048 mountd 100005 2 tcp 20048 mountd 100005 3 udp 20048 mountd 100005 3 tcp 20048 mountd 100024 1 udp 37769 status 100024 1 tcp 49349 status 100003 3 tcp 2049 nfs 100003 4 tcp 2049 nfs 100227 3 tcp 2049 nfs_acl 100021 1 udp 56691 nlockmgr 100021 3 udp 56691 nlockmgr 100021 4 udp 56691 nlockmgr 100021 1 tcp 46193 nlockmgr 100021 3 tcp 46193 nlockmgr 100021 4 tcp 46193 nlockmgr
If one of the NFS services does not start up correctly,
rpcbind
will be unable to map RPC requests from clients for that service to the correct port.In many cases, if NFS is not present in
rpcinfo
output, restarting NFS causes the service to correctly register withrpcbind
and begin working:# systemctl restart nfs-server
Additional resources
5.11. Configuring the NFS server to run behind a firewall
NFS requires the rpcbind
service, which dynamically assigns ports for RPC services and can cause issues for configuring firewall rules. The following sections describe how to configure NFS versions to work behind a firewall if you want to support:
NFSv3
This includes any servers that support NFSv3:
- NFSv3-only servers
- Servers that support both NFSv3 and NFSv4
- NFSv4-only
5.11.1. Configuring the NFSv3-enabled server to run behind a firewall
The following procedure describes how to configure servers that support NFSv3 to run behind a firewall. This includes NFSv3-only servers and servers that support both NFSv3 and NFSv4.
Procedure
To allow clients to access NFS shares behind a firewall, configure the firewall by running the following commands on the NFS server:
firewall-cmd --permanent --add-service mountd firewall-cmd --permanent --add-service rpc-bind firewall-cmd --permanent --add-service nfs
Specify the ports to be used by the RPC service
nlockmgr
in the/etc/nfs.conf
file as follows:[lockd] port=tcp-port-number udp-port=udp-port-number
Alternatively, you can specify
nlm_tcpport
andnlm_udpport
in the/etc/modprobe.d/lockd.conf
file.Open the specified ports in the firewall by running the following commands on the NFS server:
firewall-cmd --permanent --add-port=<lockd-tcp-port>/tcp firewall-cmd --permanent --add-port=<lockd-udp-port>/udp
Add static ports for
rpc.statd
by editing the[statd]
section of the/etc/nfs.conf
file as follows:[statd] port=port-number
Open the added ports in the firewall by running the following commands on the NFS server:
firewall-cmd --permanent --add-port=<statd-tcp-port>/tcp firewall-cmd --permanent --add-port=<statd-udp-port>/udp
Reload the firewall configuration:
firewall-cmd --reload
Restart the
rpc-statd
service first, and then restart thenfs-server
service:# systemctl restart rpc-statd.service # systemctl restart nfs-server.service
Alternatively, if you specified the
lockd
ports in the/etc/modprobe.d/lockd.conf
file:Update the current values of
/proc/sys/fs/nfs/nlm_tcpport
and/proc/sys/fs/nfs/nlm_udpport
:# sysctl -w fs.nfs.nlm_tcpport=<tcp-port> # sysctl -w fs.nfs.nlm_udpport=<udp-port>
Restart the
rpc-statd
andnfs-server
services:# systemctl restart rpc-statd.service # systemctl restart nfs-server.service
5.11.2. Configuring the NFSv4-only server to run behind a firewall
The following procedure describes how to configure the NFSv4-only server to run behind a firewall.
Procedure
To allow clients to access NFS shares behind a firewall, configure the firewall by running the following command on the NFS server:
firewall-cmd --permanent --add-service nfs
Reload the firewall configuration:
firewall-cmd --reload
Restart the nfs-server:
# systemctl restart nfs-server
5.11.3. Configuring an NFSv3 client to run behind a firewall
The procedure to configure an NFSv3 client to run behind a firewall is similar to the procedure to configure an NFSv3 server to run behind a firewall.
If the machine you are configuring is both an NFS client and an NFS server, follow the procedure described in Configuring the NFSv3-enabled server to run behind a firewall.
The following procedure describes how to configure a machine that is an NFS client only to run behind a firewall.
Procedure
To allow the NFS server to perform callbacks to the NFS client when the client is behind a firewall, add the
rpc-bind
service to the firewall by running the following command on the NFS client:firewall-cmd --permanent --add-service rpc-bind
Specify the ports to be used by the RPC service
nlockmgr
in the/etc/nfs.conf
file as follows:[lockd] port=port-number udp-port=upd-port-number
Alternatively, you can specify
nlm_tcpport
andnlm_udpport
in the/etc/modprobe.d/lockd.conf
file.Open the specified ports in the firewall by running the following commands on the NFS client:
firewall-cmd --permanent --add-port=<lockd-tcp-port>/tcp firewall-cmd --permanent --add-port=<lockd-udp-port>/udp
Add static ports for
rpc.statd
by editing the[statd]
section of the/etc/nfs.conf
file as follows:[statd] port=port-number
Open the added ports in the firewall by running the following commands on the NFS client:
firewall-cmd --permanent --add-port=<statd-tcp-port>/tcp firewall-cmd --permanent --add-port=<statd-udp-port>/udp
Reload the firewall configuration:
firewall-cmd --reload
Restart the
rpc-statd
service:# systemctl restart rpc-statd.service
Alternatively, if you specified the
lockd
ports in the/etc/modprobe.d/lockd.conf
file:Update the current values of
/proc/sys/fs/nfs/nlm_tcpport
and/proc/sys/fs/nfs/nlm_udpport
:# sysctl -w fs.nfs.nlm_tcpport=<tcp-port> # sysctl -w fs.nfs.nlm_udpport=<udp-port>
Restart the
rpc-statd
service:# systemctl restart rpc-statd.service
5.11.4. Configuring an NFSv4 client to run behind a firewall
Perform this procedure only if the client is using NFSv4.0. In that case, it is necessary to open a port for NFSv4.0 callbacks.
This procedure is not needed for NFSv4.1 or higher because in the later protocol versions the server performs callbacks on the same connection that was initiated by the client.
Procedure
To allow NFSv4.0 callbacks to pass through firewalls, set
/proc/sys/fs/nfs/nfs_callback_tcpport
and allow the server to connect to that port on the client as follows:# echo "fs.nfs.nfs_callback_tcpport = <callback-port>" >/etc/sysctl.d/90-nfs-callback-port.conf # sysctl -p /etc/sysctl.d/90-nfs-callback-port.conf
Open the specified port in the firewall by running the following command on the NFS client:
firewall-cmd --permanent --add-port=<callback-port>/tcp
Reload the firewall configuration:
firewall-cmd --reload
5.12. Exporting RPC quota through a firewall
If you export a file system that uses disk quotas, you can use the quota Remote Procedure Call (RPC) service to provide disk quota data to NFS clients.
Procedure
Enable and start the
rpc-rquotad
service:# systemctl enable --now rpc-rquotad
NoteThe
rpc-rquotad
service is, if enabled, started automatically after starting the nfs-server service.To make the quota RPC service accessible behind a firewall, the TCP (or UDP, if UDP is enabled) port 875 need to be open. The default port number is defined in the
/etc/services
file.You can override the default port number by appending
-p port-number
to theRPCRQUOTADOPTS
variable in the/etc/sysconfig/rpc-rquotad
file.-
By default, remote hosts can only read quotas. If you want to allow clients to set quotas, append the
-S
option to theRPCRQUOTADOPTS
variable in the/etc/sysconfig/rpc-rquotad
file. Restart
rpc-rquotad
for the changes in the/etc/sysconfig/rpc-rquotad
file to take effect:# systemctl restart rpc-rquotad
5.13. Enabling NFS over RDMA (NFSoRDMA)
In Red Hat Enterprise Linux 8, Remote direct memory access (RDMA) service on RDMA-capable hardware provides Network File System (NFS) protocol support for high-speed file transfer over the network.
Procedure
Install the
rdma-core
package:# yum install rdma-core
Verify the lines with
xprtrdma
andsvcrdma
are commented out in the/etc/rdma/modules/rdma.conf
file:# NFS over RDMA client support xprtrdma # NFS over RDMA server support svcrdma
On the NFS server, create directory
/mnt/nfsordma
and export it to/etc/exports
:# mkdir /mnt/nfsordma # echo "/mnt/nfsordma *(fsid=0,rw,async,insecure,no_root_squash)" >> /etc/exports
On the NFS client, mount the nfs-share with server IP address, for example,
172.31.0.186
:# mount -o rdma,port=20049 172.31.0.186:/mnt/nfs-share /mnt/nfs
Restart the
nfs-server
service:# systemctl restart nfs-server
Additional resources
5.14. Additional resources
Chapter 6. Securing NFS
To minimize NFS security risks and protect data on the server, consider the following sections when exporting NFS file systems on a server or mounting them on a client.
6.1. NFS security with AUTH_SYS and export controls
NFS provides the following traditional options in order to control access to exported files:
- The server restricts which hosts are allowed to mount which file systems either by IP address or by host name.
-
The server enforces file system permissions for users on NFS clients in the same way it does for local users. Traditionally, NFS does this using the
AUTH_SYS
call message (also calledAUTH_UNIX
), which relies on the client to state the UID and GIDs of the user. Be aware that this means that a malicious or misconfigured client might easily get this wrong and allow a user access to files that it should not.
To limit the potential risks, administrators often limits the access to read-only or squash user permissions to a common user and group ID. Unfortunately, these solutions prevent the NFS share from being used in the way it was originally intended.
Additionally, if an attacker gains control of the DNS server used by the system exporting the NFS file system, they can point the system associated with a particular hostname or fully qualified domain name to an unauthorized machine. At this point, the unauthorized machine is the system permitted to mount the NFS share, because no username or password information is exchanged to provide additional security for the NFS mount.
Wildcards should be used sparingly when exporting directories through NFS, as it is possible for the scope of the wildcard to encompass more systems than intended.
Additional resources
-
To secure NFS and
rpcbind
, use, for example,nftables
andfirewalld
. -
nft(8)
man page -
firewalld-cmd(1)
man page
6.2. NFS security with AUTH_GSS
All version of NFS support RPCSEC_GSS and the Kerberos mechanism.
Unlike AUTH_SYS, with the RPCSEC_GSS Kerberos mechanism, the server does not depend on the client to correctly represent which user is accessing the file. Instead, cryptography is used to authenticate users to the server, which prevents a malicious client from impersonating a user without having that user’s Kerberos credentials. Using the RPCSEC_GSS Kerberos mechanism is the most straightforward way to secure mounts because after configuring Kerberos, no additional setup is needed.
6.3. Configuring an NFS server and client to use Kerberos
Kerberos is a network authentication system that allows clients and servers to authenticate to each other by using symmetric encryption and a trusted third party, the KDC. Red Hat recommends using Identity Management (IdM) for setting up Kerberos.
Prerequisites
-
The Kerberos Key Distribution Centre (
KDC
) is installed and configured.
Procedure
-
Create the
nfs/hostname.domain@REALM
principal on the NFS server side. -
Create the
host/hostname.domain@REALM
principal on both the server and the client side. - Add the corresponding keys to keytabs for the client and server.
-
Create the
On the server side, use the
sec=
option to enable the wanted security flavors. To enable all security flavors as well as non-cryptographic mounts:/export *(sec=sys:krb5:krb5i:krb5p)
Valid security flavors to use with the
sec=
option are:-
sys
: no cryptographic protection, the default -
krb5
: authentication only krb5i
: integrity protection- uses Kerberos V5 for user authentication and performs integrity checking of NFS operations using secure checksums to prevent data tampering.
krb5p
: privacy protection- uses Kerberos V5 for user authentication, integrity checking, and encrypts NFS traffic to prevent traffic sniffing. This is the most secure setting, but it also involves the most performance overhead.
-
On the client side, add
sec=krb5
(orsec=krb5i
, orsec=krb5p
, depending on the setup) to the mount options:# mount -o sec=krb5 server:/export /mnt
Additional resources
- Creating files as root on krb5-secured NFS. Not recommended.
-
exports(5)
man page -
nfs(5)
man page
6.4. NFSv4 security options
NFSv4 includes ACL support based on the Microsoft Windows NT model, not the POSIX model, because of the Microsoft Windows NT model’s features and wide deployment.
Another important security feature of NFSv4 is the removal of the use of the MOUNT
protocol for mounting file systems. The MOUNT
protocol presented a security risk because of the way the protocol processed file handles.
6.5. File permissions on mounted NFS exports
Once the NFS file system is mounted as either read or read and write by a remote host, the only protection each shared file has is its permissions. If two users that share the same user ID value mount the same NFS file system on different client systems, they can modify each others' files. Additionally, anyone logged in as root on the client system can use the su -
command to access any files with the NFS share.
By default, access control lists (ACLs) are supported by NFS under Red Hat Enterprise Linux. Red Hat recommends to keep this feature enabled.
By default, NFS uses root squashing when exporting a file system. This sets the user ID of anyone accessing the NFS share as the root user on their local machine to nobody
. Root squashing is controlled by the default option root_squash
; for more information about this option, see NFS server configuration.
When exporting an NFS share as read-only, consider using the all_squash
option. This option makes every user accessing the exported file system take the user ID of the nobody
user.
Chapter 7. Enabling pNFS SCSI layouts in NFS
You can configure the NFS server and client to use the pNFS SCSI layout for accessing data. pNFS SCSI is beneficial in use cases that involve longer-duration single-client access to a file.
Prerequisites
- Both the client and the server must be able to send SCSI commands to the same block device. That is, the block device must be on a shared SCSI bus.
- The block device must contain an XFS file system.
- The SCSI device must support SCSI Persistent Reservations as described in the SCSI-3 Primary Commands specification.
7.1. The pNFS technology
The pNFS architecture improves the scalability of NFS. When a server implements pNFS, the client is able to access data through multiple servers concurrently. This can lead to performance improvements.
pNFS supports the following storage protocols or layouts on RHEL:
- Files
- Flexfiles
- SCSI
7.2. pNFS SCSI layouts
The SCSI layout builds on the work of pNFS block layouts. The layout is defined across SCSI devices. It contains a sequential series of fixed-size blocks as logical units (LUs) that must be capable of supporting SCSI persistent reservations. The LU devices are identified by their SCSI device identification.
pNFS SCSI performs well in use cases that involve longer-duration single-client access to a file. An example might be a mail server or a virtual machine housing a cluster.
Operations between the client and the server
When an NFS client reads from a file or writes to it, the client performs a LAYOUTGET
operation. The server responds with the location of the file on the SCSI device. The client might need to perform an additional operation of GETDEVICEINFO
to determine which SCSI device to use. If these operations work correctly, the client can issue I/O requests directly to the SCSI device instead of sending READ
and WRITE
operations to the server.
Errors or contention between clients might cause the server to recall layouts or not issue them to the clients. In those cases, the clients fall back to issuing READ
and WRITE
operations to the server instead of sending I/O requests directly to the SCSI device.
To monitor the operations, see Monitoring pNFS SCSI layouts functionality.
Device reservations
pNFS SCSI handles fencing through the assignment of reservations. Before the server issues layouts to clients, it reserves the SCSI device to ensure that only registered clients may access the device. If a client can issue commands to that SCSI device but is not registered with the device, many operations from the client on that device fail. For example, the blkid
command on the client fails to show the UUID of the XFS file system if the server has not given a layout for that device to the client.
The server does not remove its own persistent reservation. This protects the data within the file system on the device across restarts of clients and servers. In order to repurpose the SCSI device, you might need to manually remove the persistent reservation on the NFS server.
7.3. Checking for a SCSI device compatible with pNFS
This procedure checks if a SCSI device supports the pNFS SCSI layout.
Prerequisites
Install the
sg3_utils
package:# yum install sg3_utils
Procedure
On both the server and client, check for the proper SCSI device support:
# sg_persist --in --report-capabilities --verbose path-to-scsi-device
Ensure that the Persist Through Power Loss Active (
PTPL_A
) bit is set.Example 7.1. A SCSI device that supports pNFS SCSI
The following is an example of
sg_persist
output for a SCSI device that supports pNFS SCSI. ThePTPL_A
bit reports1
.inquiry cdb: 12 00 00 00 24 00 Persistent Reservation In cmd: 5e 02 00 00 00 00 00 20 00 00 LIO-ORG block11 4.0 Peripheral device type: disk Report capabilities response: Compatible Reservation Handling(CRH): 1 Specify Initiator Ports Capable(SIP_C): 1 All Target Ports Capable(ATP_C): 1 Persist Through Power Loss Capable(PTPL_C): 1 Type Mask Valid(TMV): 1 Allow Commands: 1 Persist Through Power Loss Active(PTPL_A): 1 Support indicated in Type mask: Write Exclusive, all registrants: 1 Exclusive Access, registrants only: 1 Write Exclusive, registrants only: 1 Exclusive Access: 1 Write Exclusive: 1 Exclusive Access, all registrants: 1
Additional resources
-
sg_persist(8)
man page
7.4. Setting up pNFS SCSI on the server
This procedure configures an NFS server to export a pNFS SCSI layout.
Procedure
- On the server, mount the XFS file system created on the SCSI device.
Configure the NFS server to export NFS version 4.1 or higher. Set the following option in the
[nfsd]
section of the/etc/nfs.conf
file:[nfsd] vers4.1=y
Configure the NFS server to export the XFS file system over NFS with the
pnfs
option:Example 7.2. An entry in /etc/exports to export pNFS SCSI
The following entry in the
/etc/exports
configuration file exports the file system mounted at/exported/directory/
to theallowed.example.com
client as a pNFS SCSI layout:/exported/directory allowed.example.com(pnfs)
NoteThe exported file system must be created on the whole block device, not only on a partition.
Additional resources
7.5. Setting up pNFS SCSI on the client
This procedure configures an NFS client to mount a pNFS SCSI layout.
Prerequisites
- The NFS server is configured to export an XFS file system over pNFS SCSI. See Setting up pNFS SCSI on the server.
Procedure
On the client, mount the exported XFS file system using NFS version 4.1 or higher:
# mount -t nfs -o nfsvers=4.1 host:/remote/export /local/directory
Do not mount the XFS file system directly without NFS.
Additional resources
7.6. Releasing the pNFS SCSI reservation on the server
This procedure releases the persistent reservation that an NFS server holds on a SCSI device. This enables you to repurpose the SCSI device when you no longer need to export pNFS SCSI.
You must remove the reservation from the server. It cannot be removed from a different IT Nexus.
Prerequisites
Install the
sg3_utils
package:# yum install sg3_utils
Procedure
Query an existing reservation on the server:
# sg_persist --read-reservation path-to-scsi-device
Example 7.3. Querying a reservation on /dev/sda
# *sg_persist --read-reservation /dev/sda* LIO-ORG block_1 4.0 Peripheral device type: disk PR generation=0x8, Reservation follows: Key=0x100000000000000 scope: LU_SCOPE, type: Exclusive Access, registrants only
Remove the existing registration on the server:
# sg_persist --out \ --release \ --param-rk=reservation-key \ --prout-type=6 \ path-to-scsi-device
Example 7.4. Removing a reservation on /dev/sda
# sg_persist --out \ --release \ --param-rk=0x100000000000000 \ --prout-type=6 \ /dev/sda LIO-ORG block_1 4.0 Peripheral device type: disk
Additional resources
-
sg_persist(8)
man page
Chapter 8. Configuring the Squid caching proxy server
Squid is a proxy server that caches content to reduce bandwidth and load web pages more quickly. This chapter describes how to set up Squid as a proxy for the HTTP, HTTPS, and FTP protocol, as well as authentication and restricting access.
8.1. Setting up Squid as a caching proxy without authentication
This section describes a basic configuration of Squid as a caching proxy without authentication. The procedure limits access to the proxy based on IP ranges.
Prerequisites
-
The procedure assumes that the
/etc/squid/squid.conf
file is as provided by thesquid
package. If you edited this file before, remove the file and reinstall the package.
Procedure
Install the
squid
package:# yum install squid
Edit the
/etc/squid/squid.conf
file:Adapt the
localnet
access control lists (ACL) to match the IP ranges that should be allowed to use the proxy:acl localnet src 192.0.2.0/24 acl localnet 2001:db8:1::/64
By default, the
/etc/squid/squid.conf
file contains thehttp_access allow localnet
rule that allows using the proxy from all IP ranges specified inlocalnet
ACLs. Note that you must specify alllocalnet
ACLs before thehttp_access allow localnet
rule.ImportantRemove all existing
acl localnet
entries that do not match your environment.The following ACL exists in the default configuration and defines
443
as a port that uses the HTTPS protocol:acl SSL_ports port 443
If users should be able to use the HTTPS protocol also on other ports, add an ACL for each of these port:
acl SSL_ports port port_number
Update the list of
acl Safe_ports
rules to configure to which ports Squid can establish a connection. For example, to configure that clients using the proxy can only access resources on port 21 (FTP), 80 (HTTP), and 443 (HTTPS), keep only the followingacl Safe_ports
statements in the configuration:acl Safe_ports port 21 acl Safe_ports port 80 acl Safe_ports port 443
By default, the configuration contains the
http_access deny !Safe_ports
rule that defines access denial to ports that are not defined inSafe_ports
ACLs.Configure the cache type, the path to the cache directory, the cache size, and further cache type-specific settings in the
cache_dir
parameter:cache_dir ufs /var/spool/squid 10000 16 256
With these settings:
-
Squid uses the
ufs
cache type. -
Squid stores its cache in the
/var/spool/squid/
directory. -
The cache grows up to
10000
MB. -
Squid creates
16
level-1 sub-directories in the/var/spool/squid/
directory. Squid creates
256
sub-directories in each level-1 directory.If you do not set a
cache_dir
directive, Squid stores the cache in memory.
-
Squid uses the
If you set a different cache directory than
/var/spool/squid/
in thecache_dir
parameter:Create the cache directory:
# mkdir -p path_to_cache_directory
Configure the permissions for the cache directory:
# chown squid:squid path_to_cache_directory
If you run SELinux in
enforcing
mode, set thesquid_cache_t
context for the cache directory:# semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?" # restorecon -Rv path_to_cache_directory
If the
semanage
utility is not available on your system, install thepolicycoreutils-python-utils
package.
Open the
3128
port in the firewall:# firewall-cmd --permanent --add-port=3128/tcp # firewall-cmd --reload
Enable and start the
squid
service:# systemctl enable --now squid
Verification steps
To verify that the proxy works correctly, download a web page using the curl
utility:
# curl -O -L "https://www.redhat.com/index.html" -x "proxy.example.com:3128"
If curl
does not display any error and the index.html
file was downloaded to the current directory, the proxy works.
8.2. Setting up Squid as a caching proxy with LDAP authentication
This section describes a basic configuration of Squid as a caching proxy that uses LDAP to authenticate users. The procedure configures that only authenticated users can use the proxy.
Prerequisites
-
The procedure assumes that the
/etc/squid/squid.conf
file is as provided by thesquid
package. If you edited this file before, remove the file and reinstall the package. -
An service user, such as
uid=proxy_user,cn=users,cn=accounts,dc=example,dc=com
exists in the LDAP directory. Squid uses this account only to search for the authenticating user. If the authenticating user exists, Squid binds as this user to the directory to verify the authentication.
Procedure
Install the
squid
package:# yum install squid
Edit the
/etc/squid/squid.conf
file:To configure the
basic_ldap_auth
helper utility, add the following configuration entry to the top of/etc/squid/squid.conf
:auth_param basic program /usr/lib64/squid/basic_ldap_auth -b "cn=users,cn=accounts,dc=example,dc=com" -D "uid=proxy_user,cn=users,cn=accounts,dc=example,dc=com" -W /etc/squid/ldap_password -f "(&(objectClass=person)(uid=%s))" -ZZ -H ldap://ldap_server.example.com:389
The following describes the parameters passed to the
basic_ldap_auth
helper utility in the example above:-
-b base_DN
sets the LDAP search base. -
-D proxy_service_user_DN
sets the distinguished name (DN) of the account Squid uses to search for the authenticating user in the directory. -
-W path_to_password_file
sets the path to the file that contains the password of the proxy service user. Using a password file prevents that the password is visible in the operating system’s process list. -f LDAP_filter
specifies the LDAP search filter. Squid replaces the%s
variable with the user name provided by the authenticating user.The
(&(objectClass=person)(uid=%s))
filter in the example defines that the user name must match the value set in theuid
attribute and that the directory entry contains theperson
object class.-ZZ
enforces a TLS-encrypted connection over the LDAP protocol using theSTARTTLS
command. Omit the-ZZ
in the following situations:- The LDAP server does not support encrypted connections.
- The port specified in the URL uses the LDAPS protocol.
- The -H LDAP_URL parameter specifies the protocol, the host name or IP address, and the port of the LDAP server in URL format.
-
Add the following ACL and rule to configure that Squid allows only authenticated users to use the proxy:
acl ldap-auth proxy_auth REQUIRED http_access allow ldap-auth
ImportantSpecify these settings before the
http_access deny
all rule.Remove the following rule to disable bypassing the proxy authentication from IP ranges specified in
localnet
ACLs:http_access allow localnet
The following ACL exists in the default configuration and defines
443
as a port that uses the HTTPS protocol:acl SSL_ports port 443
If users should be able to use the HTTPS protocol also on other ports, add an ACL for each of these port:
acl SSL_ports port port_number
Update the list of
acl Safe_ports
rules to configure to which ports Squid can establish a connection. For example, to configure that clients using the proxy can only access resources on port 21 (FTP), 80 (HTTP), and 443 (HTTPS), keep only the followingacl Safe_ports
statements in the configuration:acl Safe_ports port 21 acl Safe_ports port 80 acl Safe_ports port 443
By default, the configuration contains the
http_access deny !Safe_ports
rule that defines access denial to ports that are not defined inSafe_ports ACLs
.Configure the cache type, the path to the cache directory, the cache size, and further cache type-specific settings in the
cache_dir
parameter:cache_dir ufs /var/spool/squid 10000 16 256
With these settings:
-
Squid uses the
ufs
cache type. -
Squid stores its cache in the
/var/spool/squid/
directory. -
The cache grows up to
10000
MB. -
Squid creates
16
level-1 sub-directories in the/var/spool/squid/
directory. Squid creates
256
sub-directories in each level-1 directory.If you do not set a
cache_dir
directive, Squid stores the cache in memory.
-
Squid uses the
If you set a different cache directory than
/var/spool/squid/
in thecache_dir
parameter:Create the cache directory:
# mkdir -p path_to_cache_directory
Configure the permissions for the cache directory:
# chown squid:squid path_to_cache_directory
If you run SELinux in
enforcing
mode, set thesquid_cache_t
context for the cache directory:# semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?" # restorecon -Rv path_to_cache_directory
If the
semanage
utility is not available on your system, install thepolicycoreutils-python-utils
package.
Store the password of the LDAP service user in the
/etc/squid/ldap_password
file, and set appropriate permissions for the file:# echo "password" > /etc/squid/ldap_password # chown root:squid /etc/squid/ldap_password # chmod 640 /etc/squid/ldap_password
Open the
3128
port in the firewall:# firewall-cmd --permanent --add-port=3128/tcp # firewall-cmd --reload
Enable and start the
squid
service:# systemctl enable --now squid
Verification steps
To verify that the proxy works correctly, download a web page using the curl
utility:
# curl -O -L "https://www.redhat.com/index.html" -x "user_name:password@proxy.example.com:3128"
If curl does not display any error and the index.html
file was downloaded to the current directory, the proxy works.
Troubleshooting steps
To verify that the helper utility works correctly:
Manually start the helper utility with the same settings you used in the
auth_param
parameter:# /usr/lib64/squid/basic_ldap_auth -b "cn=users,cn=accounts,dc=example,dc=com" -D "uid=proxy_user,cn=users,cn=accounts,dc=example,dc=com" -W /etc/squid/ldap_password -f "(&(objectClass=person)(uid=%s))" -ZZ -H ldap://ldap_server.example.com:389
Enter a valid user name and password, and press Enter:
user_name password
If the helper utility returns
OK
, authentication succeeded.
8.3. Setting up Squid as a caching proxy with kerberos authentication
This section describes a basic configuration of Squid as a caching proxy that authenticates users to an Active Directory (AD) using Kerberos. The procedure configures that only authenticated users can use the proxy.
Prerequisites
-
The procedure assumes that the
/etc/squid/squid.conf
file is as provided by thesquid
package. If you edited this file before, remove the file and reinstall the package.
Procedure
Install the following packages:
# yum install squid krb5-workstation
Authenticate as the AD domain administrator:
# kinit administrator@AD.EXAMPLE.COM
Create a keytab for Squid and store it in the
/etc/squid/HTTP.keytab
file:# export KRB5_KTNAME=FILE:/etc/squid/HTTP.keytab # net ads keytab CREATE -U administrator
Add the
HTTP
service principal to the keytab:# net ads keytab ADD HTTP -U administrator
Set the owner of the keytab file to the
squid
user:# chown squid /etc/squid/HTTP.keytab
Optionally, verify that the keytab file contains the
HTTP
service principal for the fully-qualified domain name (FQDN) of the proxy server:klist -k /etc/squid/HTTP.keytab Keytab name: FILE:/etc/squid/HTTP.keytab KVNO Principal ---- --------------------------------------------------- ... 2 HTTP/proxy.ad.example.com@AD.EXAMPLE.COM ...
Edit the
/etc/squid/squid.conf
file:To configure the
negotiate_kerberos_auth
helper utility, add the following configuration entry to the top of/etc/squid/squid.conf
:auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s HTTP/proxy.ad.example.com@AD.EXAMPLE.COM
The following describes the parameters passed to the
negotiate_kerberos_auth
helper utility in the example above:-
-k file
sets the path to the key tab file. Note that the squid user must have read permissions on this file. -s HTTP/host_name@kerberos_realm
sets the Kerberos principal that Squid uses.Optionally, you can enable logging by passing one or both of the following parameters to the helper utility:
-
-i
logs informational messages, such as the authenticating user. -d
enables debug logging.Squid logs the debugging information from the helper utility to the
/var/log/squid/cache.log
file.
-
Add the following ACL and rule to configure that Squid allows only authenticated users to use the proxy:
acl kerb-auth proxy_auth REQUIRED http_access allow kerb-auth
ImportantSpecify these settings before the
http_access deny all
rule.Remove the following rule to disable bypassing the proxy authentication from IP ranges specified in
localnet
ACLs:http_access allow localnet
The following ACL exists in the default configuration and defines
443
as a port that uses the HTTPS protocol:acl SSL_ports port 443
If users should be able to use the HTTPS protocol also on other ports, add an ACL for each of these port:
acl SSL_ports port port_number
Update the list of
acl Safe_ports
rules to configure to which ports Squid can establish a connection. For example, to configure that clients using the proxy can only access resources on port 21 (FTP), 80 (HTTP), and 443 (HTTPS), keep only the followingacl Safe_ports
statements in the configuration:acl Safe_ports port 21 acl Safe_ports port 80 acl Safe_ports port 443
By default, the configuration contains the
http_access deny !Safe_ports
rule that defines access denial to ports that are not defined inSafe_ports
ACLs.Configure the cache type, the path to the cache directory, the cache size, and further cache type-specific settings in the
cache_dir
parameter:cache_dir ufs /var/spool/squid 10000 16 256
With these settings:
-
Squid uses the
ufs
cache type. -
Squid stores its cache in the
/var/spool/squid/
directory. -
The cache grows up to
10000
MB. -
Squid creates
16
level-1 sub-directories in the/var/spool/squid/
directory. Squid creates
256
sub-directories in each level-1 directory.If you do not set a
cache_dir
directive, Squid stores the cache in memory.
-
Squid uses the
If you set a different cache directory than
/var/spool/squid/
in thecache_dir
parameter:Create the cache directory:
# mkdir -p path_to_cache_directory
Configure the permissions for the cache directory:
# chown squid:squid path_to_cache_directory
If you run SELinux in
enforcing
mode, set thesquid_cache_t
context for the cache directory:# semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?" # restorecon -Rv path_to_cache_directory
If the
semanage
utility is not available on your system, install thepolicycoreutils-python-utils
package.
Open the
3128
port in the firewall:# firewall-cmd --permanent --add-port=3128/tcp # firewall-cmd --reload
Enable and start the
squid
service:# systemctl enable --now squid
Verification steps
To verify that the proxy works correctly, download a web page using the curl
utility:
# curl -O -L "https://www.redhat.com/index.html" --proxy-negotiate -u : -x "proxy.ad.example.com:3128"
If curl
does not display any error and the index.html
file exists in the current directory, the proxy works.
Troubleshooting steps
To manually test Kerberos authentication:
Obtain a Kerberos ticket for the AD account:
# kinit user@AD.EXAMPLE.COM
Optionally, display the ticket:
# klist
Use the
negotiate_kerberos_auth_test
utility to test the authentication:# /usr/lib64/squid/negotiate_kerberos_auth_test proxy.ad.example.com
If the helper utility returns a token, the authentication succeeded:
Token: YIIFtAYGKwYBBQUCoIIFqDC...
8.4. Configuring a domain deny list in Squid
Frequently, administrators want to block access to specific domains. This section describes how to configure a domain deny list in Squid.
Prerequisites
- Squid is configured, and users can use the proxy.
Procedure
Edit the
/etc/squid/squid.conf
file and add the following settings:acl domain_deny_list dstdomain "/etc/squid/domain_deny_list.txt" http_access deny all domain_deny_list
ImportantAdd these entries before the first
http_access allow
statement that allows access to users or clients.Create the
/etc/squid/domain_deny_list.txt
file and add the domains you want to block. For example, to block access toexample.com
including subdomains and to blockexample.net
, add:.example.com example.net
ImportantIf you referred to the
/etc/squid/domain_deny_list.txt
file in the squid configuration, this file must not be empty. If the file is empty, Squid fails to start.Restart the
squid
service:# systemctl restart squid
8.5. Configuring the Squid service to listen on a specific port or IP address
By default, the Squid proxy service listens on the 3128
port on all network interfaces. This section describes how to change the port and configuring Squid to listen on a specific IP address.
Prerequisites
-
The
squid
package is installed.
Procedure
Edit the
/etc/squid/squid.conf
file:To set the port on which the Squid service listens, set the port number in the
http_port
parameter. For example, to set the port to8080
, set:http_port 8080
To configure on which IP address the Squid service listens, set the IP address and port number in the
http_port
parameter. For example, to configure that Squid listens only on the192.0.2.1
IP address on port3128
, set:http_port 192.0.2.1:3128
Add multiple
http_port
parameters to the configuration file to configure that Squid listens on multiple ports and IP addresses:http_port 192.0.2.1:3128 http_port 192.0.2.1:8080
If you configured that Squid uses a different port as the default (
3128
):Open the port in the firewall:
# firewall-cmd --permanent --add-port=port_number/tcp # firewall-cmd --reload
If you run SELinux in enforcing mode, assign the port to the
squid_port_t
port type definition:# semanage port -a -t squid_port_t -p tcp port_number
If the
semanage
utility is not available on your system, install thepolicycoreutils-python-utils
package.
Restart the
squid
service:# systemctl restart squid
8.6. Additional resources
-
Configuration parameters
usr/share/doc/squid-<version>/squid.conf.documented
Chapter 9. Database servers
9.1. Introduction to database servers
A database server is a service that provides features of a database management system (DBMS). DBMS provides utilities for database administration and interacts with end users, applications, and databases.
Red Hat Enterprise Linux 8 provides the following database management systems:
- MariaDB 10.3
- MariaDB 10.5 - available since RHEL 8.4
- MySQL 8.0
- PostgreSQL 10
- PostgreSQL 9.6
- PostgreSQL 12 - available since RHEL 8.1.1
- PostgreSQL 13 - available since RHEL 8.4
9.2. Using MariaDB
The MariaDB server is an open source fast and robust database server that is based on the MySQL technology. This part describes how to install and configure MariaDB on a RHEL system, how to back up MariaDB data, how to migrate from an earlier MariaDB version, and how to replicate a database using the MariaDB Galera Cluster.
9.2.1. Getting started with MariaDB
MariaDB is a relational database that converts data into structured information and provides an SQL interface for accessing data. It includes multiple storage engines and plug-ins, as well as geographic information system (GIS) and JavaScript Object Notation (JSON) features.
For Red Hat Enterprise Linux 8 this part describes:
- How to install the MariaDB server in Installing MariaDB.
- How to adjust MariaDB configuration in Configuring MariaDB.
- How to back up MariaDB data in Backing up MariaDB data.
- How to migrate from the RHEL 7 default version, MariaDB 5.5, to the RHEL 8 default version, MariaDB 10.3, in Migrating to MariaDB 10.3.
- How to upgrade from MariaDB 10.3 to MariaDB 10.5 within RHEL 8 in Upgrading from MariaDB 10.3 to MariaDB 10.5.
- How to replicate a database using the MariaDB Galera Cluster in Replicating MariaDB with Galera.
9.2.2. Installing MariaDB
In RHEL 8, the MariaDB server is available in the following versions, each provided by a separate stream:
- MariaDB 10.3
- MariaDB 10.5 - available since RHEL 8.4
To install MariaDB, use the following procedure.
Procedure
Install MariaDB server packages by selecting a stream (version) from the
mariadb
module and specifying theserver
profile. For example:# yum module install mariadb:10.3/server
Start the
mariadb
service:# systemctl start mariadb.service
Enable the
mariadb
service to start at boot:# systemctl enable mariadb.service
Recommended for MariaDB 10.3: To improve security when installing MariaDB, run the following command:
$ mysql_secure_installation
The command launches a fully interactive script, which prompts for each step in the process. The script enables you to improve security in the following ways:
- Setting a password for root accounts
- Removing anonymous users
Disallowing remote root logins (outside the local host)
NoteThe mysql_secure_installation script is no longer valuable in MariaDB 10.5 or later. The security enhancements are part of the default behavior since MariaDB 10.5.
The MariaDB and MySQL database servers cannot be installed in parallel in RHEL 8 due to conflicting RPM packages. Parallel installation of components is possible in Red Hat Software Collections for RHEL 7. In RHEL 8, different versions of database servers can be used in containers.
9.2.3. Configuring MariaDB
To configure the MariaDB server for networking, use the following procedure.
Procedure
Edit the
[mysqld]
section of the/etc/my.cnf.d/mariadb-server.cnf
file. You can set the following configuration directives:bind-address
- is the address on which the server listens. Possible options are:- a host name
- an IPv4 address
- an IPv6 address
skip-networking
- controls whether the server listens for TCP/IP connections. Possible values are:- 0 - to listen for all clients
- 1 - to listen for local clients only
-
port
- the port on which MariaDB listens for TCP/IP connections.
Restart the
mariadb
service:# systemctl restart mariadb.service
9.2.4. Setting up TLS encryption on a MariaDB server
By default, MariaDB uses unencrypted connections. For secure connections, enable TLS support on the MariaDB server and configure your clients to establish encrypted connections.
9.2.4.1. Placing the CA certificate, server certificate, and private key on the MariaDB server
Before you can enable TLS encryption in the MariaDB server, store the certificate authority (CA) certificate, the server certificate, and the private key on the MariaDB server.
Prerequisites
The following files in Privacy Enhanced Mail (PEM) format have been copied to the server:
-
The private key of the server:
server.example.com.key.pem
-
The server certificate:
server.example.com.crt.pem
-
The Certificate Authority (CA) certificate:
ca.crt.pem
For details about creating a private key and certificate signing request (CSR), as well as about requesting a certificate from a CA, see your CA’s documentation.
-
The private key of the server:
Procedure
Store the CA and server certificates in the
/etc/pki/tls/certs/
directory:# mv <path>/server.example.com.crt.pem /etc/pki/tls/certs/ # mv <path>/ca.crt.pem /etc/pki/tls/certs/
Set permissions on the CA and server certificate that enable the MariaDB server to read the files:
# chmod 644 /etc/pki/tls/certs/server.example.com.crt.pem /etc/pki/tls/certs/ca.crt.pem
Because certificates are part of the communication before a secure connection is established, any client can retrieve them without authentication. Therefore, you do not need to set strict permissions on the CA and server certificate files.
Store the server’s private key in the
/etc/pki/tls/private/
directory:# mv <path>/server.example.com.key.pem /etc/pki/tls/private/
Set secure permissions on the server’s private key:
# chmod 640 /etc/pki/tls/private/server.example.com.key.pem # chgrp mysql /etc/pki/tls/private/server.example.com.key.pem
If unauthorized users have access to the private key, connections to the MariaDB server are no longer secure.
Restore the SELinux context:
# restorecon -Rv /etc/pki/tls/
9.2.4.2. Configuring TLS on a MariaDB server
To improve security, enable TLS support on the MariaDB server. As a result, clients can transmit data with the server using TLS encryption.
Prerequisites
- You installed the MariaDB server.
-
The
mariadb
service is running. The following files in Privacy Enhanced Mail (PEM) format exist on the server and are readable by the
mysql
user:-
The private key of the server:
/etc/pki/tls/private/server.example.com.key.pem
-
The server certificate:
/etc/pki/tls/certs/server.example.com.crt.pem
-
The Certificate Authority (CA) certificate
/etc/pki/tls/certs/ca.crt.pem
-
The private key of the server:
- The subject distinguished name (DN) or the subject alternative name (SAN) field in the server certificate matches the server’s host name.
Procedure
Create the
/etc/my.cnf.d/mariadb-server-tls.cnf
file:Add the following content to configure the paths to the private key, server and CA certificate:
[mariadb] ssl_key = /etc/pki/tls/private/server.example.com.key.pem ssl_cert = /etc/pki/tls/certs/server.example.com.crt.pem ssl_ca = /etc/pki/tls/certs/ca.crt.pem
If you have a Certificate Revocation List (CRL), configure the MariaDB server to use it:
ssl_crl = /etc/pki/tls/certs/example.crl.pem
Optional: If you run MariaDB 10.5.2 or later, you can reject connection attempts without encryption. To enable this feature, append:
require_secure_transport = on
Optional: If you run MariaDB 10.4.6 or later, you can set the TLS versions the server should support. For example, to support TLS 1.2 and TLS 1.3, append:
tls_version = TLSv1.2,TLSv1.3
By default, the server supports TLS 1.1, TLS 1.2, and TLS 1.3.
Restart the
mariadb
service:# systemctl restart mariadb
Verification
To simplify troubleshooting, perform the following steps on the MariaDB server before you configure the local client to use TLS encryption:
Verify that MariaDB now has TLS encryption enabled:
# mysql -u root -p -e "SHOW GLOBAL VARIABLES LIKE 'have_ssl';" +---------------+-----------------+ | Variable_name | Value | +---------------+-----------------+ | have_ssl | YES | +---------------+-----------------+
If the
have_ssl
variable is set toyes
, TLS encryption is enabled.If you configured the MariaDB service to only support specific TLS versions, display the
tls_version
variable:# mysql -u root -p -e "SHOW GLOBAL VARIABLES LIKE 'tls_version';" +---------------+-----------------+ | Variable_name | Value | +---------------+-----------------+ | tls_version | TLSv1.2,TLSv1.3 | +---------------+-----------------+
9.2.4.3. Requiring TLS encrypted connections for specific user accounts
Users that have access to sensitive data should always use a TLS-encrypted connection to avoid sending data unencrypted over the network.
If you cannot configure on the server that a secure transport is required for all connections (require_secure_transport = on
), configure individual user accounts to require TLS encryption.
Prerequisites
- The MariaDB server has TLS support enabled.
- The user you configure to require secure transport exists.
Procedure
Connect as an administrative user to the MariaDB server:
# mysql -u root -p -h server.example.com
If your administrative user has no permissions to access the server remotely, perform the command on the MariaDB server and connect to
localhost
.Use the
REQUIRE SSL
clause to enforce that a user must connect using a TLS-encrypted connection:MariaDB [(none)]> **ALTER USER __'example__'@__'%'__ REQUIRE SSL;**
Verification
Connect to the server as the
example
user using TLS encryption:# mysql -u example -p -h server.example.com --ssl ... MariaDB [(none)]>
If no error is shown and you have access to the interactive MariaDB console, the connection with TLS succeeds.
Attempt to connect as the
example
user with TLS disabled:# mysql -u example -p -h server.example.com --skip-ssl ERROR 1045 (28000): Access denied for user 'example'@'server.example.com' (using password: YES)
The server rejected the login attempt, because TLS is required for this user, but disabled (
--skip-ssl
).
Additional resources
9.2.5. Globally enabling TLS encryption in MariaDB clients
If your MariaDB server supports TLS encryption, configure your clients to establish only secure connections and to verify the server certificate. This procedure describes how to enable TLS support for all users on the server.
9.2.5.1. Configuring the MariaDB client to use TLS encryption by default
On RHEL, you can globally configure that the MariaDB client uses TLS encryption and verifies that the Common Name (CN) in the server certificate matches the hostname the user connects to. This prevents man-in-the-middle attacks.
Prerequisites
- The MariaDB server has TLS support enabled.
- If the certificate authority (CA) that issued the server’s certificate is not trusted by RHEL, the CA certificate has been copied to the client.
Procedure
If RHEL does not trust the CA that issued the server’s certificate:
Copy the CA certificate to the
/etc/pki/ca-trust/source/anchors/
directory:# cp <path>/ca.crt.pem /etc/pki/ca-trust/source/anchors/
Set permissions that enable all users to read the CA certificate file:
# chmod 644 /etc/pki/ca-trust/source/anchors/ca.crt.pem
Rebuild the CA trust database:
# update-ca-trust
Create the
/etc/my.cnf.d/mariadb-client-tls.cnf
file with the following content:[client-mariadb] ssl ssl-verify-server-cert
These settings define that the MariaDB client uses TLS encryption (
ssl
) and that the client compares the hostname with the CN in the server certificate (ssl-verify-server-cert
).
Verification
Connect to the server using the hostname, and display the server status:
# mysql -u root -p -h server.example.com -e status ... SSL: Cipher in use is TLS_AES_256_GCM_SHA384
If the
SSL
entry containsCipher in use is…
, the connection is encrypted.Note that the user you use in this command has permissions to authenticate remotely.
If the hostname you connect to does not match the hostname in the TLS certificate of the server, the
ssl-verify-server-cert
parameter causes the connection to fail. For example, if you connect tolocalhost
:# mysql -u root -p -h localhost -e status ERROR 2026 (HY000): SSL connection error: Validation of SSL server certificate failed
Additional resources
-
The
--ssl*
parameter descriptions in themysql(1)
man page.
9.2.6. Backing up MariaDB data
There are two main ways to back up data from a MariaDB database in Red Hat Enterprise Linux 8:
- Logical backup
- Physical backup
Logical backup consists of the SQL statements necessary to restore the data. This type of backup exports information and records in plain text files.
The main advantage of logical backup over physical backup is portability and flexibility. The data can be restored on other hardware configurations, MariaDB versions or Database Management System (DBMS), which is not possible with physical backups.
Note that logical backup can be performed if the mariadb.service
is running. Logical backup does not include log and configuration files.
Physical backup consists of copies of files and directories that store the content.
Physical backup has the following advantages compared to logical backup:
- Output is more compact.
- Backup is smaller in size.
- Backup and restore are faster.
- Backup includes log and configuration files.
Note that physical backup must be performed when the mariadb.service
is not running or all tables in the database are locked to prevent changes during the backup.
You can use one of the following MariaDB backup approaches to back up data from a MariaDB database:
-
Logical backup with
mysqldump
-
Physical online backup using the
Mariabackup
utility - File system backup
- Replication as a backup solution
9.2.6.1. Performing logical backup with mysqldump
The mysqldump client is a backup utility, which can be used to dump a database or a collection of databases for the purpose of a backup or transfer to another database server. The output of mysqldump typically consists of SQL statements to re-create the server table structure, populate it with data, or both. mysqldump can also generate files in other formats, including XML and delimited text formats, such as CSV.
To perform the mysqldump backup, you can use one of the following options:
- Back up one or more selected databases
- Back up all databases
- Back up a subset of tables from one database
Procedure
To dump a single database, run:
# mysqldump [options] --databases db_name > backup-file.sql
To dump multiple databases at once, run:
# mysqldump [options] --databases db_name1 [db_name2 …] > backup-file.sql
To dump all databases, run:
# mysqldump [options] --all-databases > backup-file.sql
To load one or more dumped full databases back into a server, run:
# mysql < backup-file.sql
To load a database to a remote MariaDB server, run:
# mysql --host=remote_host < backup-file.sql
To dump a subset of tables from one database, add a list of the chosen tables at the end of the
mysqldump
command:# mysqldump [options] db_name [tbl_name …] > backup-file.sql
To load a subset of tables dumped from one database, run:
# mysql db_name < backup-file.sql
NoteThe db_name database must exist at this point.
To see a list of the options that mysqldump supports, run:
$ mysqldump --help
Additional resources
- For more information on logical backup with mysqldump, see the MariaDB Documentation.
9.2.6.2. Performing physical online backup using the Mariabackup utility
Mariabackup is a utility based on the Percona XtraBackup technology, which enables performing physical online backups of InnoDB, Aria, and MyISAM tables. This utility is provided by the mariadb-backup
package from the AppStream repository.
Mariabackup supports full backup capability for MariaDB server, which includes encrypted and compressed data.
Prerequisites
The
mariadb-backup
package is installed on the system:# yum install mariadb-backup
- You must provide Mariabackup with credentials for the user under which the backup will be run. You can provide the credentials either on the command line or by a configuration file.
-
Users of Mariabackup must have the
RELOAD
,LOCK TABLES
, andREPLICATION CLIENT
privileges.
To create a backup of a database using Mariabackup, use the following procedure.
Procedure
To create a backup while providing credentials on the command line, run:
$ mariabackup --backup --target-dir <backup_directory> --user <backup_user> --password <backup_passwd>
The
target-dir
option defines the directory where the backup files are stored. If you want to perform a full backup, the target directory must be empty or not exist.The
user
andpassword
options allow you to configure the user name and the password.To create a backup with credentials set in a configuration file:
-
Create a configuration file in the
/etc/my.cnf.d/
directory, for example,/etc/my.cnf.d/mariabackup.cnf
. Add the following lines into the
[xtrabackup]
or[mysqld]
section of the new file:[xtrabackup] user=myuser password=mypassword
Perform the backup:
$ mariabackup --backup --target-dir <backup_directory>
-
Create a configuration file in the
Mariabackup does not read options in the [mariadb]
section of configuration files. If a non-default data directory is specified on a MariaDB server, you must specify this directory in the [xtrabackup]
or [mysqld]
sections of configuration files so that Mariabackup is able to find the data directory.
To specify a non-default data directory, include the following line in the [xtrabackup]
or [mysqld]
sections of MariaDB configuration files:
datadir=/var/mycustomdatadir
Additional resources
9.2.6.3. Restoring data using the Mariabackup utility
When the backup is complete, you can restore the data from the backup by using the mariabackup
command with one of the following options:
-
--copy-back
allows you to keep the original backup files. -
--move-back
moves the backup files to the data directory and removes the original backup files.
To restore data using the Mariabackup utility, use the following procedure.
Prerequisites
Verify that the
mariadb
service is not running:# systemctl stop mariadb.service
- Verify that the data directory is empty.
-
Users of Mariabackup must have the
RELOAD
,LOCK TABLES
, andREPLICATION CLIENT
privileges.
Procedure
Run the
mariabackup
command:To restore data and keep the original backup files, use the
--copy-back
option:$ mariabackup --copy-back --target-dir=/var/mariadb/backup/
To restore data and remove the original backup files, use the
--move-back
option:$ mariabackup --move-back --target-dir=/var/mariadb/backup/
Fix the file permissions.
When restoring a database, Mariabackup preserves the file and directory privileges of the backup. However, Mariabackup writes the files to disk as the user and group restoring the database. After restoring a backup, you may need to adjust the owner of the data directory to match the user and group for the MariaDB server, typically
mysql
for both.For example, to recursively change ownership of the files to the
mysql
user and group:# chown -R mysql:mysql /var/lib/mysql/
Start the
mariadb
service:# systemctl start mariadb.service
Additional resources
9.2.6.4. Performing file system backup
To create a file system backup of MariaDB data files, copy the content of the MariaDB data directory to your backup location.
To back up also your current configuration or the log files, use the optional steps of the following procedure.
Procedure
Stop the
mariadb
service:# systemctl stop mariadb.service
Copy the data files to the required location:
# cp -r /var/lib/mysql /backup-location
Optionally, copy the configuration files to the required location:
# cp -r /etc/my.cnf /etc/my.cnf.d /backup-location/configuration
Optionally, copy the log files to the required location:
# cp /var/log/mariadb/ /backup-location/logs*
Start the
mariadb
service:# systemctl start mariadb.service
When loading the backed up data from the backup location to the
/var/lib/mysql
directory, ensure thatmysql:mysql
is an owner of all data in/var/lib/mysql
:# chown -R mysql:mysql /var/lib/mysql
9.2.6.5. Replication as a backup solution
Replication is an alternative backup solution for source servers. If a source server replicates to a replica server, backups can be run on the replica without any impact on the source. The source can still run while you shut down the replica and back the data up from the replica.
Replication itself is not a sufficient backup solution. Replication protects source servers against hardware failures, but it does not ensure protection against data loss. It is recommended that you use any other backup solution on the replica together with this method.
Additional resources
9.2.7. Migrating to MariaDB 10.3
RHEL 7 contains MariaDB 5.5 as the default implementation of a server from the MySQL databases family. Later versions of the MariaDB database server are available as Software Collections for RHEL 7. RHEL 8 provides MariaDB 10.3, MariaDB 10.5, and MySQL 8.0.
This part describes migration to MariaDB 10.3 from a RHEL 7 or Red Hat Software Collections version of MariaDB. If you want to migrate from MariaDB 10.3 to MariaDB 10.5 within RHEL 8, see Upgrading from MariaDB 10.3 to MariaDB 10.5 instead.
9.2.7.1. Notable differences between the RHEL 7 and RHEL 8 versions of MariaDB
The most important changes between MariaDB 5.5 and MariaDB 10.3 are as follows:
- MariaDB Galera Cluster, a synchronous multi-source cluster, is a standard part of MariaDB since 10.1.
- The ARCHIVE storage engine is no longer enabled by default, and the plug-in needs to be specifically enabled.
- The BLACKHOLE storage engine is no longer enabled by default, and the plug-in needs to be specifically enabled.
InnoDB is used as the default storage engine instead of XtraDB, which was used in MariaDB 10.1 and earlier versions.
For more details, see Why does MariaDB 10.2 use InnoDB instead of XtraDB?.
-
The new
mariadb-connector-c
packages provide a common client library for MySQL and MariaDB. This library is usable with any version of the MySQL and MariaDB database servers. As a result, the user is able to connect one build of an application to any of the MySQL and MariaDB servers distributed with Red Hat Enterprise Linux 8.
To migrate from MariaDB 5.5 to MariaDB 10.3, you need to perform multiple configuration changes as described in Migrating to MariaDB.
9.2.7.2. Configuration changes
The recommended migration path from MariaDB 5.5 to MariaDB 10.3 is to upgrade to MariaDB 10.0 first, and then upgrade by one version successively.
The main advantage of upgrading one minor version at a time is better adaptation of the database, including both data and configuration, to the changes. The upgrade ends on the same major version as is available in RHEL 8 (MariaDB 10.3), which significantly reduces configuration changes or other issues.
For more information about configuration changes when migrating from MariaDB 5.5 to MariaDB 10.0, see Migrating to MariaDB 10.0 in Red Hat Software Collections documentation.
The migration to following successive versions of MariaDB and the required configuration changes is described in these documents:
- Migrating to MariaDB 10.1 in Red Hat Software Collections documentation.
- Migrating to MariaDB 10.2 in Red Hat Software Collections documentation.
- Migrating to MariaDB 10.3 in Red Hat Software Collections documentation.
Migration directly from MariaDB 5.5 to MariaDB 10.3 is also possible, but you must perform all configuration changes that are required by differences described in the migration documents above.
9.2.7.3. In-place upgrade using the mysql_upgrade utility
To migrate the database files to RHEL 8, users of MariaDB on RHEL 7 must perform the in-place upgrade using the mysql_upgrade
utility. The mysql_upgrade
utility is provided by the mariadb-server-utils
subpackage, which is installed as a dependency of the mariadb-server
package.
To perform an in-place upgrade, you must copy binary data files to the /var/lib/mysql/
data directory on the RHEL 8 system and use the mysql_upgrade
utility.
You can use this method for migrating data from:
- The Red Hat Enterprise Linux 7 version of MariaDB 5.5
The Red Hat Software Collections versions of:
- MariaDB 5.5 (no longer supported)
- MariaDB 10.0 (no longer supported)
- MariaDB 10.1 (no longer supported)
- MariaDB 10.2 (no longer supported)
MariaDB 10.3
Note that it is recommended to upgrade to MariaDB 10.3 by one version successively. See the respective Migration chapters in the Release Notes for Red Hat Software Collections.
If you are upgrading from the RHEL 7 version of MariaDB, the source data is stored in the /var/lib/mysql/
directory. In case of Red Hat Software Collections versions of MariaDB, the source data directory is /var/opt/rh/<collection_name>/lib/mysql/
(with the exception of the mariadb55
, which uses the /opt/rh/mariadb55/root/var/lib/mysql/
data directory).
To perform an upgrade using the mysql_upgrade utility, use the following procedure.
Prerequisites
- Before performing the upgrade, back up all your data stored in the MariaDB databases.
Procedure
Ensure that the
mariadb-server
package is installed on the RHEL 8 system:# yum install mariadb-server
Ensure that the
mariadb
service is not running on either of the source and target systems at the time of copying data:# systemctl stop mariadb.service
-
Copy the data from the source location to the
/var/lib/mysql/
directory on the RHEL 8 target system. Set the appropriate permissions and SELinux context for copied files on the target system:
# restorecon -vr /var/lib/mysql
Start the MariaDB server on the target system:
# systemctl start mariadb.service
Run the
mysql_upgrade
command to check and repair internal tables:$ mysql_upgrade
-
When the upgrade is complete, verify that all configuration files within the
/etc/my.cnf.d/
directory include only options valid for MariaDB 10.3.
There are certain risks and known problems related to an in-place upgrade. For example, some queries might not work or they will be run in different order than before the upgrade. For more information about these risks and problems, and for general information about an in-place upgrade, see MariaDB 10.3 Release Notes.
9.2.8. Upgrading from MariaDB 10.3 to MariaDB 10.5
This part describes migration from MariaDB 10.3 to MariaDB 10.5 within RHEL 8.
9.2.8.1. Notable differences between MariaDB 10.3 and MariaDB 10.5
Significant changes between MariaDB 10.3 and MariaDB 10.5 include:
-
MariaDB now uses the
unix_socket
authentication plug-in by default. The plug-in enables users to use operating system credentials when connecting to MariaDB through the local UNIX socket file. -
MariaDB
addsmariadb-*
named binaries andmysql*
symbolic links pointing to themariadb-*
binaires. For example, themysqladmin
,mysqlaccess
, andmysqlshow
symlinks point to themariadb-admin
,mariadb-access
, andmariadb-show
binaries, respectively. -
The
SUPER
privilege has been split into several privileges to better align with each user role. As a result, certain statements have changed required privileges. -
In parallel replication, the
slave_parallel_mode
now defaults tooptimistic
. -
In the InnoDB storage engine, defaults of the following variables have been changed:
innodb_adaptive_hash_index
toOFF
andinnodb_checksum_algorithm
tofull_crc32
. MariaDB now uses the
libedit
implementation of the underlying software managing the MariaDB command history (the.mysql_history
file) instead of the previously usedreadline
library. This change impacts users working directly with the.mysql_history
file. Note that.mysql_history
is a file managed by the MariaDB or MySQL applications, and users should not work with the file directly. The human-readable appearance is coincidental.NoteTo increase security, you can consider not maintaining a history file. To disable the command history recording:
-
Remove the
.mysql_history
file if it exists. Use either of the following approaches:
-
Set the
MYSQL_HISTFILE
variable to/dev/null
and include this setting in any of your shell’s startup files. Change the
.mysql_history
file to a symbolic link to/dev/null
:$ ln -s /dev/null $HOME/.mysql_history
-
Set the
-
Remove the
MariaDB Galera Cluster has been upgraded to version 4 with the following notable changes:
- Galera adds a new streaming replication feature, which supports replicating transactions of unlimited size. During an execution of streaming replication, a cluster replicates a transaction in small fragments.
- Galera now fully supports Global Transaction ID (GTID).
-
The default value for the
wsrep_on
option in the/etc/my.cnf.d/galera.cnf
file has changed from1
to0
to prevent end users from startingwsrep
replication without configuring required additional options.
Changes to the PAM plug-in in MariaDB 10.5 include:
-
MariaDB 10.5 adds a new version of the Pluggable Authentication Modules (PAM) plug-in. The PAM plug-in version 2.0 performs PAM authentication using a separate
setuid root
helper binary, which enables MariaDB to use additional PAM modules. -
The helper binary can be executed only by users in the
mysql
group. By default, the group contains only themysql
user. Red Hat recommends that administrators do not add more users to themysql
group to prevent password-guessing attacks without throttling or logging through this helper utility. -
In MariaDB 10.5, the Pluggable Authentication Modules (PAM) plug-in and its related files have been moved to a new package,
mariadb-pam
. As a result, no newsetuid root
binary is introduced on systems that do not use PAM authentication forMariaDB
. -
The
mariadb-pam
package contains both PAM plug-in versions: version 2.0 is the default, and version 1.0 is available as theauth_pam_v1
shared object library. -
The
mariadb-pam
package is not installed by default with the MariaDB server. To make the PAM authentication plug-in available in MariaDB 10.5, install themariadb-pam
package manually.
9.2.8.2. Upgrading from a RHEL 8 version of MariaDB 10.3 to MariaDB 10.5
This procedure describes upgrading from the mariadb:10.3
module stream to the mariadb:10.5
module stream using the yum
and mariadb-upgrade
utilities.
The mariadb-upgrade
utility is provided by the mariadb-server-utils
subpackage, which is installed as a dependency of the mariadb-server
package.
Prerequisites
- Before performing the upgrade, back up all your data stored in the MariaDB databases.
Procedure
Stop the MariaDB server:
# systemctl stop mariadb.service
Execute the following command to determine if your system is prepared for switching to a later stream:
# yum distro-sync
This command must finish with the message Nothing to do. Complete! For more information, see Switching to a later stream.
Reset the
mariadb
module on your system:# yum module reset mariadb
Enable the new
mariadb:10.5
module stream:# yum module enable mariadb:10.5
Synchronize installed packages to perform the change between streams:
# yum distro-sync
This will update all installed MariaDB packages.
-
Adjust configuration so that option files located in
/etc/my.cnf.d/
include only options valid for MariaDB 10.5. For details, see upstream documentation for MariaDB 10.4 and MariaDB 10.5. Start the MariaDB server.
When upgrading a database running standalone:
# systemctl start mariadb.service
When upgrading a Galera cluster node:
# galera_new_cluster
The
mariadb
service will be started automatically.
Execute the mariadb-upgrade utility to check and repair internal tables.
When upgrading a database running standalone:
# mariadb-upgrade
When upgrading a Galera cluster node:
# mariadb-upgrade --skip-write-binlog
There are certain risks and known problems related to an in-place upgrade. For example, some queries might not work or they will be run in different order than before the upgrade. For more information about these risks and problems, and for general information about an in-place upgrade, see MariaDB 10.5 Release Notes.
9.2.9. Replicating MariaDB with Galera
This section describes how to replicate a MariaDB database using the Galera solution on Red Hat Enterprise Linux 8.
9.2.9.1. Introduction to MariaDB Galera Cluster
Galera replication is based on the creation of a synchronous multi-source MariaDB Galera Cluster consisting of multiple MariaDB servers. Unlike the traditional primary/replica setup where replicas are usually read-only, nodes in the MariaDB Galera Cluster can be all writable.
The interface between Galera replication and a MariaDB database is defined by the write set replication API (wsrep API).
The main features of MariaDB Galera Cluster are:
- Synchronous replication
- Active-active multi-source topology
- Read and write to any cluster node
- Automatic membership control, failed nodes drop from the cluster
- Automatic node joining
- Parallel replication on row level
- Direct client connections: users can log on to the cluster nodes, and work with the nodes directly while the replication runs
Synchronous replication means that a server replicates a transaction at commit time by broadcasting the write set associated with the transaction to every node in the cluster. The client (user application) connects directly to the Database Management System (DBMS), and experiences behavior that is similar to native MariaDB.
Synchronous replication guarantees that a change that happened on one node in the cluster happens on other nodes in the cluster at the same time.
Therefore, synchronous replication has the following advantages over asynchronous replication:
- No delay in propagation of the changes between particular cluster nodes
- All cluster nodes are always consistent
- The latest changes are not lost if one of the cluster nodes crashes
- Transactions on all cluster nodes are executed in parallel
- Causality across the whole cluster
9.2.9.2. Components to build MariaDB Galera Cluster
To build MariaDB Galera Cluster, you must install the following packages on your system:
-
mariadb-server-galera
- contains support files and scripts for MariaDB Galera Cluster. -
mariadb-server
- is patched by MariaDB upstream to include the write set replication API (wsrep API). This API provides the interface between Galera replication and MariaDB. galera
- is patched by MariaDB upstream to add full support for MariaDB. Thegalera
package contains the following:- Galera Replication Library provides the whole replication functionality.
- The Galera Arbitrator utility can be used as a cluster member that participates in voting in split-brain scenarios. However, Galera Arbitrator cannot participate in the actual replication.
-
Galera Systemd service and Galera wrapper script which are used for deploying the Galera Arbitrator utility. MariaDB 10.3 and MariaDB 10.5 in RHEL 8 include a Red Hat version of the
garbd
systemd service and a wrapper script for thegalera
package in the/usr/lib/systemd/system/garbd.service
and/usr/sbin/garbd-wrapper
files, respectively. Since RHEL 8.6, MariaDB 10.3 and MariaDB 10.5 now also provide an upstream version of these files located at/usr/share/doc/galera/garb-systemd
and/usr/share/doc/galera/garbd.service
.
Additional resources
9.2.9.3. Deploying MariaDB Galera Cluster
Prerequisites
Install MariaDB Galera Cluster packages by selecting a stream (version) from the
mariadb
module and specifying thegalera
profile. For example:# {PackageManagerCommand} module install mariadb:10.3/galera
As a result, the following packages are installed:
-
mariadb-server-galera
-
mariadb-server
galera
The
mariadb-server-galera
package pulls themariadb-server
andgalera
packages as its dependency.For more information about which packages you need to install to build MariaDB Galera Cluster, see Components to build MariaDB Cluster.
-
The MariaDB server replication configuration must be updated before the system is added to a cluster for the first time.
The default configuration is distributed in the
/etc/my.cnf.d/galera.cnf
file.Before deploying MariaDB Galera Cluster, set the
wsrep_cluster_address
option in the/etc/my.cnf.d/galera.cnf
file on all nodes to start with the following string:gcomm://
For the initial node, it is possible to set
wsrep_cluster_address
as an empty list:wsrep_cluster_address="gcomm://"
For all other nodes, set
wsrep_cluster_address
to include an address to any node which is already a part of the running cluster. For example:wsrep_cluster_address="gcomm://10.0.0.10"
For more information about how to set Galera Cluster address, see Galera Cluster Address.
Procedure
Bootstrap a first node of a new cluster by running the following wrapper on that node:
# *galera_new_cluster*
This wrapper ensures that the MariaDB server daemon (
mysqld
) runs with the--wsrep-new-cluster
option. This option provides the information that there is no existing cluster to connect to. Therefore, the node creates a new UUID to identify the new cluster.NoteThe
mariadb
service supports a systemd method for interacting with multiple MariaDB server processes. Therefore, in cases with multiple running MariaDB servers, you can bootstrap a specific instance by specifying the instance name as a suffix:# galera_new_cluster mariadb@node1
Connect other nodes to the cluster by running the following command on each of the nodes:
# systemctl start mariadb
As a result, the node connects to the cluster, and synchronizes itself with the state of the cluster.
Additional resources
9.2.9.4. Adding a new node to MariaDB Galera Cluster
To add a new node to MariaDB Galera Cluster, use the following procedure.
Note that you can also use this procedure to reconnect an already existing node.
Procedure
On the particular node, provide an address to one or more existing cluster members in the
wsrep_cluster_address
option within the[mariadb]
section of the/etc/my.cnf.d/galera.cnf
configuration file :[mariadb] wsrep_cluster_address="gcomm://192.168.0.1"
When a new node connects to one of the existing cluster nodes, it is able to see all nodes in the cluster.
However, preferably list all nodes of the cluster in
wsrep_cluster_address
.As a result, any node can join a cluster by connecting to any other cluster node, even if one or more cluster nodes are down. When all members agree on the membership, the cluster’s state is changed. If the new node’s state is different from the state of the cluster, the new node requests either an Incremental State Transfer (IST) or a State Snapshot Transfer (SST) to ensure consistency with the other nodes.
Additional resources
9.2.9.5. Restarting MariaDB Galera Cluster
If you shut down all nodes at the same time, you stop the cluster, and the running cluster no longer exists. However, the cluster’s data still exist.
To restart the cluster, bootstrap a first node as described in Configuring MariaDB Galera Cluster.
If the cluster is not bootstrapped, and mysqld
on the first node is started with only the systemctl start mariadb
command, the node tries to connect to at least one of the nodes listed in the wsrep_cluster_address
option in the /etc/my.cnf.d/galera.cnf
file. If no nodes are currently running, the restart fails.
Additional resources
9.3. Using MySQL
The MySQL server is an open source fast and robust database server. This part describes how to install and configure MySQL on a RHEL system, how to back up MySQL data, how to migrate from an earlier MySQL version, and how to replicate a MySQL.
9.3.1. Getting started with MySQL
MySQL is a relational database that converts data into structured information and provides an SQL interface for accessing data. It includes multiple storage engines and plug-ins, as well as geographic information system (GIS) and JavaScript Object Notation (JSON) features.
This part describes:
- How to install the MySQL server in Installing MySQL.
- How to adjust MySQL configuration in Configuring MySQL.
- How to back up MySQL data in Backing up MySQL data.
- How to migrate MySQL data in Migrating to a RHEL 8 version of MySQL 8.0.
- How to replicate a MySQL database in Replicating MySQL.
9.3.2. Installing MySQL
In RHEL 8, the MySQL 8.0 server is available as the mysql:8.0
module stream.
To install MySQL, use the following procedure.
Procedure
Install MySQL server packages by selecting the
8.0
stream (version) from themysql
module and specifying theserver
profile:# yum module install mysql:8.0/server
Start the
mysqld
service:# systemctl start mysqld.service
Enable the
mysqld
service to start at boot:# systemctl enable mysqld.service
Recommended: To improve security when installing MySQL, run the following command:
$ mysql_secure_installation
The command launches a fully interactive script, which prompts for each step in the process. The script enables you to improve security in the following ways:
- Setting a password for root accounts
- Removing anonymous users
- Disallowing remote root logins (outside the local host)
The MySQL and MariaDB database servers cannot be installed in parallel in RHEL 8 due to conflicting RPM packages. Parallel installation of components is possible in Red Hat Software Collections for RHEL 7. In RHEL 8, different versions of database servers can be used in containers.
9.3.3. Configuring MySQL
To configure the MySQL server for networking, use the following procedure.
Procedure
Edit the
[mysqld]
section of the/etc/my.cnf.d/mysql-server.cnf
file. You can set the following configuration directives:bind-address
- is the address on which the server listens. Possible options are:- a host name
- an IPv4 address
- an IPv6 address
skip-networking
- controls whether the server listens for TCP/IP connections. Possible values are:- 0 - to listen for all clients
- 1 - to listen for local clients only
-
port
- the port on which MySQL listens for TCP/IP connections.
Restart the
mysqld
service:# systemctl restart mysqld.service
9.3.4. Backing up MySQL data
There are two main ways to back up data from a MySQL database in Red Hat Enterprise Linux 8:
- Logical backup
- Physical backup
Logical backup consists of the SQL statements necessary to restore the data. This type of backup exports information and records in plain text files.
The main advantage of logical backup over physical backup is portability and flexibility. The data can be restored on other hardware configurations, MySQL versions or Database Management System (DBMS), which is not possible with physical backups.
Note that logical backup can be performed if the mysqld.service
is running. Logical backup does not include log and configuration files.
Physical backup consists of copies of files and directories that store the content.
Physical backup has the following advantages compared to logical backup:
- Output is more compact.
- Backup is smaller in size.
- Backup and restore are faster.
- Backup includes log and configuration files.
Note that physical backup must be performed when the mysqld.service
is not running or all tables in the database are locked to prevent changes during the backup.
You can use one of the following MySQL backup approaches to back up data from a MySQL database:
-
Logical backup with
mysqldump
- File system backup
- Replication as a backup solution
9.3.4.1. Performing logical backup with mysqldump
The mysqldump client is a backup utility, which can be used to dump a database or a collection of databases for the purpose of a backup or transfer to another database server. The output of mysqldump typically consists of SQL statements to re-create the server table structure, populate it with data, or both. mysqldump can also generate files in other formats, including XML and delimited text formats, such as CSV.
To perform the mysqldump backup, you can use one of the following options:
- Back up one or more selected databases
- Back up all databases
- Back up a subset of tables from one database
Procedure
To dump a single database, run:
# mysqldump [options] --databases db_name > backup-file.sql
To dump multiple databases at once, run:
# mysqldump [options] --databases db_name1 [db_name2 ...] > backup-file.sql
To dump all databases, run:
# mysqldump [options] --all-databases > backup-file.sql
To load one or more dumped full databases back into a server, run:
# mysql < backup-file.sql
To load a database to a remote MySQL server, run:
# mysql --host=remote_host < backup-file.sql
To dump a subset of tables from one database, add a list of the chosen tables at the end of the
mysqldump
command:# mysqldump [options] db_name [tbl_name ...] > backup-file.sql
To load a subset of tables dumped from one database, run:
# mysql db_name < backup-file.sql
NoteThe db_name database must exist at this point.
To see a list of the options that mysqldump supports, run:
$ mysqldump --help
Additional resources
9.3.4.2. Performing file system backup
To create a file system backup of MySQL data files, copy the content of the MySQL data directory to your backup location.
To back up also your current configuration or the log files, use the optional steps of the following procedure.
Procedure
Stop the
mysqld
service:# systemctl stop mysqld.service
Copy the data files to the required location:
# cp -r /var/lib/mysql /backup-location
Optionally, copy the configuration files to the required location:
# cp -r /etc/my.cnf /etc/my.cnf.d /backup-location/configuration
Optionally, copy the log files to the required location:
# cp /var/log/mysql/* /backup-location/logs
Start the
mysqld
service:# systemctl start mysqld.service
When loading the backed up data from the backup location to the
/var/lib/mysql
directory, ensure thatmysql:mysql
is an owner of all data in/var/lib/mysql
:# chown -R mysql:mysql /var/lib/mysql
9.3.4.3. Replication as a backup solution
Replication is an alternative backup solution for source servers. If a source server replicates to a replica server, backups can be run on the replica without any impact on the source. The source can still run while you shut down the replica and back the data up from the replica.
For instructions on how to replicate a MySQL database, see Replicating MySQL.
Replication itself is not a sufficient backup solution. Replication protects source servers against hardware failures, but it does not ensure protection against data loss. It is recommended that you use any other backup solution on the replica together with this method.
Additional resources
9.3.5. Migrating to a RHEL 8 version of MySQL 8.0
RHEL 7 contains MariaDB 5.5 as the default implementation of a server from the MySQL databases family. The Red Hat Software Collections offering for RHEL 7 provides MySQL 8.0 and several versions of MariaDB. RHEL 8 provides MySQL 8.0, MariaDB 10.3, and MariaDB 10.5.
This procedure describes migration from a Red Hat Software Collections version of MySQL 8.0 to a RHEL 8 version of MySQL 8.0 using the mysql_upgrade
utility. The mysql_upgrade
utility is provided by the mysql-server
package.
In the Red Hat Software Collections version of MySQL, the source data directory is /var/opt/rh/rh-mysql80/lib/mysql/
. In RHEL 8, MySQL data is stored in the /var/lib/mysql/
directory.
Prerequisites
- Before performing the upgrade, back up all your data stored in the MySQL databases.
Procedure
Ensure that the
mysql-server
package is installed on the RHEL 8 system:# yum install mysql-server
Ensure that the
mysqld
service is not running on either of the source and target systems at the time of copying data:# systemctl stop mysqld.service
-
Copy the data from the
/var/opt/rh/rh-mysql80/lib/mysql/
directory on the RHEL 7 source system to the/var/lib/mysql/
directory on the RHEL 8 target system. Set the appropriate permissions and SELinux context for copied files on the target system:
# restorecon -vr /var/lib/mysql
Ensure that
mysql:mysql
is an owner of all data in the/var/lib/mysql
directory:# chown -R mysql:mysql /var/lib/mysql
Start the MySQL server on the target system:
# systemctl start mysqld.service
Note: In earlier versions of MySQL, the
mysql_upgrade
command was needed to check and repair internal tables. This is now done automatically when you start the server.
9.3.6. Replicating MySQL
MySQL provides various configuration options for replication, ranging from basic to advanced. This section describes a transaction-based way to replicate in MySQL on freshly installed MySQL servers using global transaction identifiers (GTIDs). Using GTIDs simplifies transaction identification and consistency verification.
To set up replication in MySQL, you must:
If you want to use existing MySQL servers for replication, you must first synchronize data. See the upstream documentation for more information.
9.3.6.1. Configuring a MySQL source server
This section describes configuration options required for a MySQL source server to properly run and replicate all changes made on the database server.
Prerequisites
- The source server is installed.
Procedure
Include the following options in the
/etc/my.cnf.d/mysql-server.cnf
file under the[mysqld]
section:bind-address=source_ip_adress
This option is required for connections made from replicas to the source.
server-id=id
The id must be unique.
log_bin=path_to_source_server_log
This option defines a path to the binary log file of the MySQL source server. For example:
log_bin=/var/log/mysql/mysql-bin.log
.gtid_mode=ON
This option enables global transaction identifiers (GTIDs) on the server.
enforce-gtid-consistency=ON
The server enforces GTID consistency by allowing execution of only statements that can be safely logged using a GTID.
Optional:
binlog_do_db=db_name
Use this option if you want to replicate only selected databases. To replicate more than one selected database, specify each of the databases separately:
binlog_do_db=db_name1 binlog_do_db=db_name2 binlog_do_db=db_name3
Optional:
binlog_ignore_db=db_name
Use this option to exclude a specific database from replication.
Restart the
mysqld
service:# systemctl restart mysqld.service
9.3.6.2. Configuring a MySQL replica server
This section describes configuration options required for a MySQL replica server to ensure a successful replication.
Prerequisites
- The replica server is installed.
Procedure
Include the following options in the
/etc/my.cnf.d/mysql-server.cnf
file under the[mysqld]
section:server-id=id
The id must be unique.
relay-log=path_to_replica_server_log
The relay log is a set of log files created by the MySQL replica server during replication.
log_bin=path_to_replica_sever_log
This option defines a path to the binary log file of the MySQL replica server. For example:
log_bin=/var/log/mysql/mysql-bin.log
.This option is not required in a replica but strongly recommended.
gtid_mode=ON
This option enables global transaction identifiers (GTIDs) on the server.
enforce-gtid-consistency=ON
The server enforces GTID consistency by allowing execution of only statements that can be safely logged using a GTID.
log-replica-updates=ON
This option ensures that updates received from the source server are logged in the replica’s binary log.
skip-replica-start=ON
This option ensures that the replica server does not start the replication threads when the replica server starts.
Optional:
binlog_do_db=db_name
Use this option if you want to replicate only certain databases. To replicate more than one database, specify each of the databases separately:
binlog_do_db=db_name1 binlog_do_db=db_name2 binlog_do_db=db_name3
Optional:
binlog_ignore_db=db_name
Use this option to exclude a specific database from replication.
Restart the
mysqld
service:# systemctl restart mysqld.service
9.3.6.3. Creating a replication user on the MySQL source server
You must create a replication user and grant this user permissions required for replication traffic. This procedure shows how to create a replication user with appropriate permissions. Execute these steps only on the source server.
Prerequisites
- The source server is installed and configured as described in Configuring a MySQL source server.
Procedure
Create a replication user:
mysql> CREATE USER 'replication_user'@'replica_server_ip' IDENTIFIED WITH mysql_native_password BY 'password';
Grant the user replication permissions:
mysql> GRANT REPLICATION SLAVE ON *.* TO 'replication_user'@'replica_server_ip';
Reload the grant tables in the MySQL database:
mysql> FLUSH PRIVILEGES;
Set the source server to read-only state:
mysql> SET @@GLOBAL.read_only = ON;
9.3.6.4. Connecting the replica server to the source server
On the MySQL replica server, you must configure credentials and the address of the source server. Use the following procedure to implement the replica server.
Prerequisites
- The source server is installed and configured as described in Configuring a MySQL source server.
- The replica server is installed and configured as described in Configuring a MySQL replica server.
- You have created a replication user. See Creating a replication user on the MySQL source server.
Procedure
Set the replica server to read-only state:
mysql> SET @@GLOBAL.read_only = ON;
Configure the replication source:
mysql> CHANGE REPLICATION SOURCE TO -> SOURCE_HOST='source_ip_address', -> SOURCE_USER='replication_user', -> SOURCE_PASSWORD='password', -> SOURCE_AUTO_POSITION=1;
Start the replica thread in the MySQL replica server:
mysql> START REPLICA;
Unset the read-only state on both the source and replica servers:
mysql> SET @@GLOBAL.read_only = OFF;
Optional: Inspect the status of the replica server for debugging purposes:
mysql> SHOW REPLICA STATUS\G;
NoteIf the replica server fails to start or connect, you can skip a certain number of events following the binary log file position displayed in the output of the
SHOW MASTER STATUS
command. For example, skip the first event from the defined position:mysql> SET GLOBAL SQL_SLAVE_SKIP_COUNTER=1;
and try to start the replica server again.
Optional: Stop the replica thread in the replica server:
mysql> STOP REPLICA;
9.3.6.5. Verification steps
Create an example database on the source server:
mysql> CREATE DATABASE test_db_name;
-
Verify that the
test_db_name
database replicates on the replica server. Display status information about the binary log files of the MySQL server by executing the following command on either of the source or replica servers:
mysql> SHOW MASTER STATUS;
The
Executed_Gtid_Set
column, which shows a set of GTIDs for transactions executed on the source, must not be empty.NoteThe same set of GTIDs is displayed in the
Executed_Gtid_Set
row when you use theSHOW SLAVE STATUS
on the replica server.
9.3.6.6. Additional resources
9.4. Using PostgreSQL
The PostgreSQL server is an open source robust and highly-extensible database server based on the SQL language. This part describes how to install and configure PostgreSQL on a RHEL system, how to back up PostgreSQL data, and how to migrate from an earlier PostgreSQL version
9.4.1. Getting started with PostgreSQL
The PostgreSQL server provides an object-relational database system, which allows you to manage extensive datasets and a high number of concurrent users. For these reasons, the PostgreSQL servers can be used in clusters to manage high amounts of data.
The PostgreSQL server includes features for ensuring data integrity, building fault-tolerant environments, and building applications. It allows users to extend a database with users' own data types, custom functions, or code from different programming languages without the need to recompile the database.
This part describes:
- How to install PostgreSQL in Installing PostgreSQL.
- Users, roles, and privileges in Creating PostgreSQL users.
- How to adjust PostgreSQL configuration in Configuring PostgreSQL.
- How to enable Transport Layer Security (TLS) support on the PostgreSQL server in Configuring TLS encryption on a PostgreSQL server.
- How to back up your databases in Backing up PostgreSQL data.
- How to migrate to a later version of PostgreSQL in Migrating to a RHEL 8 version of PostgreSQL. One of the prerequisites of migration is performing a data backup.
9.4.2. Installing PostgreSQL
In RHEL 8, the PostgreSQL server is available in several versions, each provided by a separate stream:
- PostgreSQL 10 - the default stream
- PostgreSQL 9.6
- PostgreSQL 12 - available since RHEL 8.1.1
- PostgreSQL 13 - available since RHEL 8.4
By design, it is impossible to install more than one version (stream) of the same module in parallel. Thus you must choose only one of the available streams from the postgresql
module. Parallel installation of components is possible in Red Hat Software Collections for RHEL 7. In RHEL 8, different versions of database servers can be used in containers.
To install PostgreSQL, use the following procedure.
Procedure
Install the PostgreSQL server packages by selecting a stream (version) from the
postgresql
module and specifying the server profile. For example:# yum module install postgresql:13/server
The
postgres
superuser is created automatically.Initialize the database cluster:
# postgresql-setup --initdb
Red Hat recommends storing the data in the default
/var/lib/pgsql/data
directory.Start the
postgresql
service:# systemctl start postgresql.service
Enable the
postgresql
service to start at boot:# systemctl enable postgresql.service
For information about using module streams, see Installing, managing, and removing user-space components.
If you want to upgrade from an earlier postgresql
stream within RHEL 8, follow both procedures described in Switching to a later stream and in Section 9.4.7, “Migrating to a RHEL 8 version of PostgreSQL”.
9.4.3. Creating PostgreSQL users
PostgreSQL users are of the following types:
-
The
postgres
UNIX system user - should be used only to run the PostgreSQL server and client applications, such aspg_dump
. Do not use thepostgres
system user for any interactive work on PostgreSQL administration, such as database creation and user management. -
A database superuser - the default
postgres
PostgreSQL superuser is not related to thepostgres
system user. You can limit access of thepostgres
superuser in thepg_hba.conf
file, otherwise no other permission limitations exist. You can also create other database superusers. A role with specific database access permissions:
- A database user - has a permission to log in by default
- A group of users - enables managing permissions for the group as a whole
Roles can own database objects (for example, tables and functions) and can assign object privileges to other roles using SQL commands.
Standard database management privileges include SELECT
, INSERT
, UPDATE
, DELETE
, TRUNCATE
, REFERENCES
, TRIGGER
, CREATE
, CONNECT
, TEMPORARY
, EXECUTE
, and USAGE
.
Role attributes are special privileges, such as LOGIN
, SUPERUSER
, CREATEDB
, and CREATEROLE
.
Red Hat recommends performing most tasks as a role that is not a superuser. A common practice is to create a role that has the CREATEDB
and CREATEROLE
privileges and use this role for all routine management of databases and roles.
Prerequisites
- The PostgreSQL server is installed.
- The database cluster is initialized.
Procedure
To create a user, set a password for the user, and assign the user the
CREATEROLE
andCREATEDB
permissions:postgres=# CREATE USER mydbuser WITH PASSWORD 'mypasswd' CREATEROLE CREATEDB;
Replace mydbuser with the username and mypasswd with the user’s password.
Additional resources
Example 9.1. Initializing, creating, and connecting to a PostgreSQL database
This example demonstrates how to initialize a PostgreSQL database, create a database user with routine database management privileges, and how to create a database that is accessible from any system account through the database user with management privileges.
Install the PosgreSQL server:
# yum module install postgresql:13/server
Initialize the database cluster:
# postgresql-setup --initdb * Initializing database in '/var/lib/pgsql/data' * Initialized, logs are in /var/lib/pgsql/initdb_postgresql.log
Set the password hashing algorithm to
scram-sha-256
.In the
/var/lib/pgsql/data/postgresql.conf
file, change the following line:#password_encryption = md5 # md5 or scram-sha-256
to:
password_encryption = scram-sha-256
In the
/var/lib/pgsql/data/pg_hba.conf
file, change the following line for the IPv4 local connections:host all all 127.0.0.1/32 ident
to:
host all all 127.0.0.1/32 scram-sha-256
Start the postgresql service:
# systemctl start postgresql.service
Log in as the system user named
postgres
:# su - postgres
Start the PostgreSQL interactive terminal:
$ psql psql (13.7) Type "help" for help. postgres=#
Optional: Obtain information about the current database connection:
postgres=# \conninfo You are connected to database "postgres" as user "postgres" via socket in "/var/run/postgresql" at port "5432".
Create a user named
mydbuser
, set a password formydbuser
, and assignmydbuser
theCREATEROLE
andCREATEDB
permissions:postgres=# CREATE USER mydbuser WITH PASSWORD 'mypasswd' CREATEROLE CREATEDB; CREATE ROLE
The
mydbuser
user now can perform routine database management operations: create databases and manage user indexes.Log out of the interactive terminal by using the
\q
meta command:postgres=# \q
Log out of the
postgres
user session:$ logout
Log in to the PostgreSQL terminal as
mydbuser
, specify the hostname, and connect to the defaultpostgres
database, which was created during initialization:# psql -U mydbuser -h 127.0.0.1 -d postgres Password for user mydbuser: Type the password. psql (13.7) Type "help" for help. postgres=>
Create a database named
mydatabase
:postgres=> CREATE DATABASE mydatabase; CREATE DATABASE postgres=>
Log out of the session:
postgres=# \q
Connect to mydatabase as
mydbuser
:# psql -U mydbuser -h 127.0.0.1 -d mydatabase Password for user mydbuser: psql (13.7) Type "help" for help. mydatabase=>
Optional: Obtain information about the current database connection:
mydatabase=> \conninfo You are connected to database "mydatabase" as user "mydbuser" on host "127.0.0.1" at port "5432".
9.4.4. Configuring PostgreSQL
In a PostgreSQL database, all data and configuration files are stored in a single directory called a database cluster. Red Hat recommends storing all data, including configuration files, in the default /var/lib/pgsql/data/
directory.
PostgreSQL configuration consists of the following files:
-
postgresql.conf
- is used for setting the database cluster parameters. -
postgresql.auto.conf
- holds basic PostgreSQL settings similarly topostgresql.conf
. However, this file is under the server control. It is edited by theALTER SYSTEM
queries, and cannot be edited manually. -
pg_ident.conf
- is used for mapping user identities from external authentication mechanisms into the PostgreSQL user identities. -
pg_hba.conf
- is used for configuring client authentication for PostgreSQL databases.
To change the PostgreSQL configuration, use the following procedure.
Procedure
-
Edit the respective configuration file, for example,
/var/lib/pgsql/data/postgresql.conf
. Restart the
postgresql
service so that the changes become effective:# systemctl restart postgresql.service
Example 9.2. Configuring PostgreSQL database cluster parameters
This example shows basic settings of the database cluster parameters in the /var/lib/pgsql/data/postgresql.conf
file.
# This is a comment log_connections = yes log_destination = 'syslog' search_path = '"$user", public' shared_buffers = 128MB password_encryption = scram-sha-256
Example 9.3. Setting client authentication in PostgreSQL
This example demonstrates how to set client authentication in the /var/lib/pgsql/data/pg_hba.conf
file.
# TYPE DATABASE USER ADDRESS METHOD local all all trust host postgres all 192.168.93.0/24 ident host all all .example.com scram-sha-256
9.4.5. Configuring TLS encryption on a PostgreSQL server
By default, PostgreSQL uses unencrypted connections. For more secure connections, you can enable Transport Layer Security (TLS) support on the PostgreSQL server and configure your clients to establish encrypted connections.
Prerequisites
- The PostgreSQL server is installed.
- The database cluster is initialized.
Procedure
Install the OpenSSL library:
# yum install openssl
Generate a TLS certificate and a key:
# openssl req -new -x509 -days 365 -nodes -text -out server.crt \ -keyout server.key -subj "/CN=dbhost.yourdomain.com"
Replace dbhost.yourdomain.com with your database host and domain name.
Copy your signed certificate and your private key to the required locations on the database server:
# cp server.{key,crt} /var/lib/pgsql/data/.
Change the owner and group ownership of the signed certificate and your private key to the
postgres
user:# chown postgres:postgres /var/lib/pgsql/data/server.{key,crt}
Restrict the permissions for your private key so that it is readable only by the owner:
# chmod 0400 /var/lib/pgsql/data/server.key
Set the password hashing algorithm to
scram-sha-256
by changing the following line in the/var/lib/pgsql/data/postgresql.conf
file:#password_encryption = md5 # md5 or scram-sha-256
to:
password_encryption = scram-sha-256
Configure PostgreSQL to use SSL/TLS by changing the following line in the
/var/lib/pgsql/data/postgresql.conf
file:#ssl = off
to:
ssl=on
Restrict access to all databases to accept only connections from clients using TLS by changing the following line for the IPv4 local connections in the
/var/lib/pgsql/data/pg_hba.conf
file:host all all 127.0.0.1/32 ident
to:
hostssl all all 127.0.0.1/32 scram-sha-256
Alternatively, you can restrict access for a single database and a user by adding the following new line:
hostssl mydatabase mydbuser 127.0.0.1/32 scram-sha-256
Replace mydatabase with the database name and mydbuser with the username.
Make the changes effective by restarting the
postgresql
service:# systemctl restart postgresql.service
Verification
To manually verify that the connection is encrypted:
Connect to the PostgreSQL database as the mydbuser user, specify the host name and the database name:
$ psql -U mydbuser -h 127.0.0.1 -d mydatabase Password for user mydbuser:
Replace mydatabase with the database name and mydbuser with the username.
Obtain information about the current database connection:
mydbuser=> \conninfo You are connected to database "mydatabase" as user "mydbuser" on host "127.0.0.1" at port "5432". SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
You can write a simple application that verifies whether a connection to PostgreSQL is encrypted. This example demonstrates such an application written in C that uses the
libpq
client library, which is provided by thelibpq-devel
package:#include <stdio.h> #include <stdlib.h> #include <libpq-fe.h> int main(int argc, char* argv[]) { //Create connection PGconn* connection = PQconnectdb("hostaddr=127.0.0.1 password=mypassword port=5432 dbname=mydatabase user=mydbuser"); if (PQstatus(connection) ==CONNECTION_BAD) { printf("Connection error\n"); PQfinish(connection); return -1; //Execution of the program will stop here } printf("Connection ok\n"); //Verify TLS if (PQsslInUse(connection)){ printf("TLS in use\n"); printf("%s\n", PQsslAttribute(connection,"protocol")); } //End connection PQfinish(connection); printf("Disconnected\n"); return 0; }
Replace mypassword with the password, mydatabase with the database name, and mydbuser with the username.
NoteYou must load the
pq
libraries for compilation by using the-lpq
option. For example, to compile the application by using the GCC compiler:$ gcc source_file.c -lpq -o myapplication
where the source_file.c contains the example code above, and myapplication is the name of your application for verifying secured PostgreSQL connection.
Example 9.4. Initializing, creating, and connecting to a PostgreSQL database using TLS encryption
This example demonstrates how to initialize a PostgreSQL database, create a database user and a database, and how to connect to the database using a secured connection.
Install the PosgreSQL server:
# yum module install postgresql:13/server
Initialize the database cluster:
# postgresql-setup --initdb * Initializing database in '/var/lib/pgsql/data' * Initialized, logs are in /var/lib/pgsql/initdb_postgresql.log
Install the OpenSSL library:
# yum install openssl
Generate a TLS certificate and a key:
# openssl req -new -x509 -days 365 -nodes -text -out server.crt \ -keyout server.key -subj "/CN=dbhost.yourdomain.com"
Replace dbhost.yourdomain.com with your database host and domain name.
Copy your signed certificate and your private key to the required locations on the database server:
# cp server.{key,crt} /var/lib/pgsql/data/.
Change the owner and group ownership of the signed certificate and your private key to the
postgres
user:# chown postgres:postgres /var/lib/pgsql/data/server.{key,crt}
Restrict the permissions for your private key so that it is readable only by the owner:
# chmod 0400 /var/lib/pgsql/data/server.key
Set the password hashing algorithm to
scram-sha-256
. In the/var/lib/pgsql/data/postgresql.conf
file, change the following line:#password_encryption = md5 # md5 or scram-sha-256
to:
password_encryption = scram-sha-256
Configure PostgreSQL to use SSL/TLS. In the
/var/lib/pgsql/data/postgresql.conf
file, change the following line:#ssl = off
to:
ssl=on
Start the
postgresql
service:# systemctl start postgresql.service
Log in as the system user named
postgres
:# su - postgres
Start the PostgreSQL interactive terminal as the
postgres
user:$ psql -U postgres psql (13.7) Type "help" for help. postgres=#
Create a user named
mydbuser
and set a password formydbuser
:postgres=# CREATE USER mydbuser WITH PASSWORD 'mypasswd'; CREATE ROLE postgres=#
Create a database named
mydatabase
:postgres=# CREATE DATABASE mydatabase; CREATE DATABASE postgres=#
Grant all permissions to the
mydbuser
user:postgres=# GRANT ALL PRIVILEGES ON DATABASE mydatabase TO mydbuser; GRANT postgres=#
Log out of the interactive terminal:
postgres=# \q
Log out of the
postgres
user session:$ logout
Restrict access to all databases to accept only connections from clients using TLS by changing the following line for the IPv4 local connections in the
/var/lib/pgsql/data/pg_hba.conf
file:host all all 127.0.0.1/32 ident
to:
hostssl all all 127.0.0.1/32 scram-sha-256
Make the changes effective by restarting the
postgresql
service:# systemctl restart postgresql.service
Connect to the PostgreSQL database as the
mydbuser
user, specify the host name and the database name:$ psql -U mydbuser -h 127.0.0.1 -d mydatabase Password for user mydbuser: psql (13.7) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off) Type "help" for help. mydatabase=>
9.4.6. Backing up PostgreSQL data
To back up PostgreSQL data, use one of the following approaches:
- SQL dump
- See Backing up with SQL dump.
- File system level backup
- See File system level backup.
- Continuous archiving
- See Continuous archiving.
9.4.6.1. Backing up PostgreSQL data with an SQL dump
The SQL dump method is based on generating a dump file with SQL commands. When a dump is uploaded back to the database server, it recreates the database in the same state as it was at the time of the dump.
The SQL dump is ensured by the following PostgreSQL client applications:
- pg_dump dumps a single database without cluster-wide information about roles or tablespaces
- pg_dumpall dumps each database in a given cluster and preserves cluster-wide data, such as role and tablespace definitions.
By default, the pg_dump
and pg_dumpall
commands write their results into the standard output. To store the dump in a file, redirect the output to an SQL file. The resulting SQL file can be either in a text format or in other formats that allow for parallelism and for more detailed control of object restoration.
You can perform the SQL dump from any remote host that has access to the database.
9.4.6.1.1. Advantages and disadvantages of an SQL dump
An SQL dump has the following advantages compared to other PostgreSQL backup methods:
- An SQL dump is the only PostgreSQL backup method that is not server version-specific. The output of the pg_dump utility can be reloaded into later versions of PostgreSQL, which is not possible for file system level backups or continuous archiving.
- An SQL dump is the only method that works when transferring a database to a different machine architecture, such as going from a 32-bit to a 64-bit server.
- An SQL dump provides internally consistent dumps. A dump represents a snapshot of the database at the time pg_dump began running.
- The pg_dump utility does not block other operations on the database when it is running.
A disadvantage of an SQL dump is that it takes more time compared to file system level backup.
9.4.6.1.2. Performing an SQL dump using pg_dump
To dump a single database without cluster-wide information, use the pg_dump utility.
Prerequisites
-
You must have read access to all tables that you want to dump. To dump the entire database, you must run the commands as the
postgres
superuser or a user with database administrator privileges.
Procedure
Dump a database without cluster-wide information:
$ pg_dump dbname > dumpfile
To specify which database server pg_dump will contact, use the following command-line options:
The
-h
option to define the host.The default host is either the local host or what is specified by the
PGHOST
environment variable.The
-p
option to define the port.The default port is indicated by the
PGPORT
environment variable or the compiled-in default.
9.4.6.1.3. Performing an SQL dump using pg_dumpall
To dump each database in a given database cluster and to preserve cluster-wide data, use the pg_dumpall utility.
Prerequisites
-
You must run the commands as the
postgres
superuser or a user with database administrator privileges.
Procedure
Dump all databases in the database cluster and preserve cluster-wide data:
$ pg_dumpall > dumpfile
To specify which database server pg_dumpall will contact, use the following command-line options:
The
-h
option to define the host.The default host is either the local host or what is specified by the
PGHOST
environment variable.The
-p
option to define the port.The default port is indicated by the
PGPORT
environment variable or the compiled-in default.The
-l
option to define the default database.This option enables you to choose a default database different from the
postgres
database created automatically during initialization.
9.4.6.1.4. Restoring a database dumped using pg_dump
To restore a database from an SQL dump that you dumped using the pg_dump utility, follow the steps below.
Prerequisites
-
You must run the commands as the
postgres
superuser or a user with database administrator privileges.
Procedure
Create a new database:
$ createdb dbname
- Verify that all users who own objects or were granted permissions on objects in the dumped database already exist. If such users do not exist, the restore fails to recreate the objects with the original ownership and permissions.
Run the psql utility to restore a text file dump created by the pg_dump utility:
$ psql dbname < dumpfile
where
dumpfile
is the output of thepg_dump
command. To restore a non-text file dump, use thepg_restore
utility instead:$ pg_restore non-plain-text-file
9.4.6.1.5. Restoring databases dumped using pg_dumpall
To restore data from a database cluster that you dumped using the pg_dumpall utility, follow the steps below.
Prerequisites
-
You must run the commands as the
postgres
superuser or a user with database administrator privileges.
Procedure
- Ensure that all users who own objects or were granted permissions on objects in the dumped databases already exist. If such users do not exist, the restore fails to recreate the objects with the original ownership and permissions.
Run the psql utility to restore a text file dump created by the pg_dumpall utility:
$ psql < dumpfile
where
dumpfile
is the output of thepg_dumpall
command.
9.4.6.1.6. Performing an SQL dump of a database on another server
Dumping a database directly from one server to another is possible because pg_dump and psql can write to and read from pipes.
Procedure
To dump a database from one server to another, run:
$ pg_dump -h host1 dbname | psql -h host2 dbname
9.4.6.1.7. Handling SQL errors during restore
By default, psql continues to execute if an SQL error occurs, causing the database to restore only partially.
To change the default behavior, use one of the following approaches when restoring a dump.
Prerequisites
-
You must run the commands as the
postgres
superuser or a user with database administrator privileges.
Procedure
Make psql exit with an exit status of 3 if an SQL error occurs by setting the
ON_ERROR_STOP
variable:$ psql --set ON_ERROR_STOP=on dbname < dumpfile
Specify that the whole dump is restored as a single transaction so that the restore is either fully completed or canceled.
When restoring a text file dump using the
psql
utility:$ psql -1
When restoring a non-text file dump using the
pg_restore
utility:$ pg_restore -e
Note that when using this approach, even a minor error can cancel a restore operation that has already run for many hours.
9.4.6.1.8. Additional resources
9.4.6.2. Backing up PostgreSQL data with a file system level backup
To create a file system level backup, copy PostgreSQL database files to another location. For example, you can use any of the following approaches:
- Create an archive file using the tar utility.
- Copy the files to a different location using the rsync utility.
- Create a consistent snapshot of the data directory.
9.4.6.2.1. Advantages and limitations of file system backing up
File system level backing up has the following advantage compared to other PostgreSQL backup methods:
- File system level backing up is usually faster than an SQL dump.
File system level backing up has the following limitations compared to other PostgreSQL backup methods:
- This backing up method is not suitable when you want to upgrade from RHEL 7 to RHEL 8 and migrate your data to the upgraded system. File system level backup is specific to an architecture and a RHEL major version. You can restore your data on your RHEL 7 system if the upgrade is not successful but you cannot restore the data on a RHEL 8 system.
- The database server must be shut down before backing up and restoring data.
- Backing up and restoring certain individual files or tables is impossible. Backing up a file system works only for complete backing up and restoring of an entire database cluster.
9.4.6.2.2. Performing file system level backing up
To perform file system level backing up, use the following procedure.
Procedure
Choose the location of a database cluster and initialize this cluster:
# postgresql-setup --initdb
Stop the postgresql service:
# systemctl stop postgresql.service
Use any method to create a file system backup, for example a
tar
archive:$ tar -cf backup.tar /var/lib/pgsql/data
Start the postgresql service:
# systemctl start postgresql.service
Additional resources
9.4.6.3. Backing up PostgreSQL data by continuous archiving
9.4.6.3.1. Introduction to continuous archiving
PostgreSQL records every change made to the database’s data files into a write ahead log (WAL) file that is available in the pg_wal/
subdirectory of the cluster’s data directory. This log is intended primarily for a crash recovery. After a crash, the log entries made since the last checkpoint can be used for restoring the database to a consistency.
The continuous archiving method, also known as an online backup, combines the WAL files with a copy of the database cluster in the form of a base backup performed on a running server or a file system level backup.
If a database recovery is needed, you can restore the database from the copy of the database cluster and then replay log from the backed up WAL files to bring the system to the current state.
With the continuous archiving method, you must keep a continuous sequence of all archived WAL files that extends at minimum back to the start time of your last base backup. Therefore the ideal frequency of base backups depends on:
- The storage volume available for archived WAL files.
- The maximum possible duration of data recovery in situations when recovery is necessary. In cases with a long period since the last backup, the system replays more WAL segments, and the recovery therefore takes more time.
You cannot use pg_dump and pg_dumpall SQL dumps as a part of a continuous archiving backup solution. SQL dumps produce logical backups and do not contain enough information to be used by a WAL replay.
To perform a database backup and restore using the continuous archiving method, follow these instructions:
- Set up and test your procedure for archiving WAL files - see WAL archiving.
- Perform a base backup - see base backup.
To restore your data, follow instructions in Restoring database with continuous archiving.
9.4.6.3.2. Advantages and disadvantages of continuous archiving
Continuous archiving has the following advantages compared to other PostgreSQL backup methods:
- With the continuous backup method, it is possible to use a base backup that is not entirely consistent because any internal inconsistency in the backup is corrected by the log replay. Therefore you can perform a base backup on a running PostgreSQL server.
-
A file system snapshot is not needed;
tar
or a similar archiving utility is sufficient. - Continuous backup can be achieved by continuing to archive the WAL files because the sequence of WAL files for the log replay can be indefinitely long. This is particularly valuable for large databases.
- Continuous backup supports point-in-time recovery. It is not necessary to replay the WAL entries to the end. The replay can be stopped at any point and the database can be restored to its state at any time since the base backup was taken.
- If the series of WAL files are continuously available to another machine that has been loaded with the same base backup file, it is possible to restore the other machine with a nearly-current copy of the database at any point.
Continuous archiving has the following disadvantages compared to other PostgreSQL backup methods:
- Continuous backup method supports only restoration of an entire database cluster, not a subset.
- Continuous backup requires extensive archival storage.
9.4.6.3.3. Setting up WAL archiving
A running PostgreSQL server produces a sequence of write ahead log (WAL) records. The server physically divides this sequence into WAL segment files, which are given numeric names that reflect their position in the WAL sequence. Without WAL archiving, the segment files are reused and renamed to higher segment numbers.
When archiving WAL data, the contents of each segment file are captured and saved at a new location before the segment file is reused. You have multiple options where to save the content, such as an NFS-mounted directory on another machine, a tape drive, or a CD.
Note that WAL records do not include changes to configuration files.
To enable WAL archiving, use the following procedure.
Procedure
In the
/var/lib/pgsql/data/postgresql.conf
file:-
Set the
wal_level
configuration parameter toreplica
or higher. -
Set the
archive_mode
parameter toon
. -
Specify the shell command in the
archive_command
configuration parameter. You can use thecp
command, another command, or a shell script.
-
Set the
Restart the
postgresql
service to enable the changes:# systemctl restart postgresql.service
- Test your archive command and ensure it does not overwrite an existing file and that it returns a non-zero exit status if it fails.
- To protect your data, ensure that the segment files are archived into a directory that does not have group or world read access.
The archive command is executed only on completed WAL segments. A server that generates little WAL traffic can have a substantial delay between the completion of a transaction and its safe recording in archive storage. To limit how old unarchived data can be, you can:
-
Set the
archive_timeout
parameter to force the server to switch to a new WAL segment file with a given frequency. -
Use the
pg_switch_wal
parameter to force a segment switch to ensure that a transaction is archived immediately after it finishes.
Example 9.5. Shell command for archiving WAL segments
This example shows a simple shell command you can set in the archive_command
configuration parameter.
The following command copies a completed segment file to the required location:
archive_command = 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
where the %p
parameter is replaced by the relative path to the file to archive and the %f
parameter is replaced by the file name.
This command copies archivable WAL segments to the /mnt/server/archivedir/
directory. After replacing the %p
and %f
parameters, the executed command looks as follows:
test ! -f /mnt/server/archivedir/00000001000000A900000065 && cp pg_wal/00000001000000A900000065 /mnt/server/archivedir/00000001000000A900000065
A similar command is generated for each new file that is archived.
Additional resources
9.4.6.3.4. Making a base backup
You can create a base backup in several ways. This section describes the simplest way of performing a base backup using the pg_basebackup utility on a running PostgreSQL server.
The base backup process creates a backup history file that is stored into the WAL archive area and is named after the first WAL segment file that you need for the base backup.
The backup history file is a small text file containing the starting and ending times, and WAL segments of the backup. If you used the label string to identify the associated dump file, you can use the backup history file to determine which dump file to restore.
Consider keeping several backup sets to be certain that you can recover your data.
To perform a base backup, use the following procedure.
Prerequisites
-
You must run the commands as the
postgres
superuser, a user with database administrator privileges, or another user with at leastREPLICATION
permissions. - You must keep all the WAL segment files generated during and after the base backup.
Procedure
Use the
pg_basebackup
utility to perform the base backup.To create a base backup as individual files (plain format):
$ pg_basebackup -D backup_directory -Fp
Replace backup_directory with your desired backup location.
If you use tablespaces and perform the base backup on the same host as the server, you must also use the
--tablespace-mapping
option, otherwise the backup will fail upon an attempt to write the backup to the same location.To create a base backup as a
tar
archive (tar
and compressed format):$ pg_basebackup -D backup_directory -Ft -z
Replace backup_directory with your desired backup location.
To restore such data, you must manually extract the files in the correct locations.
- After the base backup process is complete, safely archive the copy of the database cluster and the WAL segment files used during the backup, which are specified in the backup history file.
- Delete WAL segments numerically lower than the WAL segment files used in the base backup because these are older than the base backup and no longer needed for a restore.
To specify which database server pg_basebackup will contact, use the following command-line options:
The
-h
option to define the host.The default host is either the local host or a host specified by the
PGHOST
environment variable.The
-p
option to define the port.The default port is indicated by the
PGPORT
environment variable or the compiled-in default.
Additional resources
9.4.6.3.5. Restoring the database using a continuous archive backup
To restore a database using a continuous backup, use the following procedure.
Procedure
Stop the server:
# systemctl stop postgresql.service
Copy the necessary data to a temporary location.
Preferably, copy the whole cluster data directory and any tablespaces. Note that this requires enough free space on your system to hold two copies of your existing database.
If you do not have enough space, save the contents of the cluster’s
pg_wal
directory, which can contain logs that were not archived before the system went down.- Remove all existing files and subdirectories under the cluster data directory and under the root directories of any tablespaces you are using.
Restore the database files from your base backup.
Ensure that:
-
The files are restored with the correct ownership (the database system user, not
root
). - The files are restored with the correct permissions.
-
The symbolic links in the
pg_tblspc/
subdirectory are restored correctly.
-
The files are restored with the correct ownership (the database system user, not
Remove any files present in the
pg_wal/
subdirectory.These files resulted from the base backup and are therefore obsolete. If you did not archive
pg_wal/
, recreate it with proper permissions.-
Copy any unarchived WAL segment files that you saved in step 2 into
pg_wal/
. Create the
recovery.conf
recovery command file in the cluster data directory and specify the shell command in therestore_command
configuration parameter. You can use thecp
command, another command, or a shell script. For example:restore_command = 'cp /mnt/server/archivedir/%f "%p"'
Start the server:
# systemctl start postgresql.service
The server will enter the recovery mode and proceed to read through the archived WAL files that it needs.
If the recovery is terminated due to an external error, the server can be restarted and it will continue the recovery. When the recovery process is completed, the server renames
recovery.conf
torecovery.done
. This prevents the server from accidental re-entering the recovery mode after it starts normal database operations.Check the contents of the database to verify that the database has recovered into the required state.
If the database has not recovered into the required state, return to step 1. If the database has recovered into the required state, allow the users to connect by restoring the client authentication configuration in the
pg_hba.conf
file.
For more information about restoring using the continuous backup, see PostgreSQL Documentation.
9.4.6.3.6. Additional resources
9.4.7. Migrating to a RHEL 8 version of PostgreSQL
Red Hat Enterprise Linux 7 contains PostgreSQL 9.2 as the default version of the PostgreSQL server. In addition, several versions of PostgreSQL are provided as Software Collections for RHEL 7.
Red Hat Enterprise Linux 8 provides PostgreSQL 10 (the default postgresql
stream), PostgreSQL 9.6, PostgreSQL 12, and PostgreSQL 13.
Users of PostgreSQL on Red Hat Enterprise Linux can use two migration paths for the database files:
The fast upgrade method is quicker than the dump and restore process. However, in certain cases, the fast upgrade does not work, and you can only use the dump and restore process. Such cases include:
- Cross-architecture upgrades
-
Systems using the
plpython
orplpython2
extensions. Note that RHEL 8 AppStream repository includes only thepostgresql-plpython3
package, not thepostgresql-plpython2
package. - Fast upgrade is not supported for migration from Red Hat Software Collections versions of PostgreSQL.
As a prerequisite for migration to a later version of PostgreSQL, back up all your PostgreSQL databases.
Dumping the databases and performing backup of the SQL files is required for the dump and restore process and recommended for the fast upgrade method.
Before migrating to a later version of PostgreSQL, see the upstream compatibility notes for the version of PostgreSQL to which you want to migrate, as well as for all skipped PostgreSQL versions between the one you are migrating from and the target version.
9.4.7.1. Fast upgrade using the pg_upgrade utility
During a fast upgrade, you must copy binary data files to the /var/lib/pgsql/data/
directory and use the pg_upgrade
utility.
You can use this method for migrating data:
- From the RHEL 7 system version of PostgreSQL 9.2 to the RHEL 8 version of PostgreSQL 10
- From the RHEL 8 version of PostgreSQL 10 to the RHEL 8 version of PostgreSQL 12 or PostgreSQL 13
If you want to upgrade from an earlier postgresql
stream within RHEL 8, follow the procedure described in Switching to a later stream and then migrate your PostgreSQL data.
For migrating between other combinations of PostgreSQL versions within RHEL, and for migration from the Red Hat Software Collections versions of PostgreSQL to RHEL, use Dump and restore upgrade.
The following procedure describes migration from the RHEL 7 system version of Postgreql 9.2 to a RHEL 8 version of PostgreSQL using the fast upgrade method.
Prerequisites
-
Before performing the upgrade, back up all your data stored in the PostgreSQL databases. By default, all data is stored in the
/var/lib/pgsql/data/
directory on both the RHEL 7 and RHEL 8 systems.
Procedure
On the RHEL 8 system, enable the stream (version) to which you wish to migrate:
# yum module enable postgresql:stream
Replace stream with the selected version of the PostgreSQL server.
You can omit this step if you want to use the default stream, which provides PostgreSQL 10.
On the RHEL 8 system, install the
postgresql-server
andpostgresql-upgrade
packages:# yum install postgresql-server postgresql-upgrade
Optionally, if you used any PostgreSQL server modules on RHEL 7, install them also on the RHEL 8 system in two versions, compiled both against PostgreSQL 9.2 (installed as the
postgresql-upgrade
package) and the target version of PostgreSQL (installed as thepostgresql-server
package). If you need to compile a third-party PostgreSQL server module, build it both against thepostgresql-devel
andpostgresql-upgrade-devel
packages.Check the following items:
-
Basic configuration: On the RHEL 8 system, check whether your server uses the default
/var/lib/pgsql/data
directory and the database is correctly initialized and enabled. In addition, the data files must be stored in the same path as mentioned in the/usr/lib/systemd/system/postgresql.service
file. - PostgreSQL servers: Your system can run multiple PostgreSQL servers. Ensure that the data directories for all these servers are handled independently.
-
PostgreSQL server modules: Ensure that the PostgreSQL server modules that you used on RHEL 7 are installed on your RHEL 8 system as well. Note that plug-ins are installed in the
/usr/lib64/pgsql/
directory (or in the/usr/lib/pgsql/
directory on 32-bit systems).
-
Basic configuration: On the RHEL 8 system, check whether your server uses the default
Ensure that the
postgresql
service is not running on either of the source and target systems at the time of copying data.# systemctl stop postgresql.service
-
Copy the database files from the source location to the
/var/lib/pgsql/data/
directory on the RHEL 8 system. Perform the upgrade process by running the following command as the PostgreSQL user:
# postgresql-setup --upgrade
This launches the
pg_upgrade
process in the background.In case of failure,
postgresql-setup
provides an informative error message.Copy the prior configuration from
/var/lib/pgsql/data-old
to the new cluster.Note that the fast upgrade does not reuse the prior configuration in the newer data stack and the configuration is generated from scratch. If you want to combine the old and new configurations manually, use the *.conf files in the data directories.
Start the new PostgreSQL server:
# systemctl start postgresql.service
Run the
analyze_new_cluster.sh
script located in the PostgreSQL home directory:su postgres -c '~/analyze_new_cluster.sh'
If you want the new PostgreSQL server to be automatically started on boot, run:
# systemctl enable postgresql.service
9.4.7.2. Dump and restore upgrade
When using the dump and restore upgrade, you must dump all databases contents into an SQL file dump file.
Note that the dump and restore upgrade is slower than the fast upgrade method and it may require some manual fixing in the generated SQL file.
You can use this method for migrating data from:
- The Red Hat Enterprise Linux 7 system version of PostgreSQL 9.2
- Any earlier Red Hat Enterprise Linux 8 version of PostgreSQL
An earlier or equal version of PostgreSQL from Red Hat Software Collections:
- PostgreSQL 9.2 (no longer supported)
- PostgreSQL 9.4 (no longer supported)
- PostgreSQL 9.6 (no longer supported)
- PostgreSQL 10
- PostgreSQL 12
On RHEL 7 and RHEL 8 systems, PostgreSQL data is stored in the /var/lib/pgsql/data/
directory by default. In case of Red Hat Software Collections versions of PostgreSQL, the default data directory is /var/opt/rh/collection_name/lib/pgsql/data/
(with the exception of postgresql92
, which uses the /opt/rh/postgresql92/root/var/lib/pgsql/data/
directory).
If you want to upgrade from an earlier postgresql
stream within RHEL 8, follow the procedure described in Switching to a later stream and then migrate your PostgreSQL data.
To perform the dump and restore upgrade, change the user to root
.
The following procedure describes migration from the RHEL 7 system version of Postgreql 9.2 to a RHEL 8 version of PostgreSQL.
Procedure
On your RHEL 7 system, start the PostgreSQL 9.2 server:
# systemctl start postgresql.service
On the RHEL 7 system, dump all databases contents into the
pgdump_file.sql
file:su - postgres -c "pg_dumpall > ~/pgdump_file.sql"
Verify that the databases were dumped correctly:
su - postgres -c 'less "$HOME/pgdump_file.sql"'
As a result, the path to the dumped sql file is displayed:
/var/lib/pgsql/pgdump_file.sql
.On the RHEL 8 system, enable the stream (version) to which you wish to migrate:
# yum module enable postgresql:stream
Replace stream with the selected version of the PostgreSQL server.