Fedora 31 : Can be better? part 005.

Today we have once again dealt with this topic on the possibilities of improving the Fedora distro.
This time the adventure turned to the Selinux system switching to SELinux MLS.
Let's test the SELinux Fedora 31 from default targeted to mls.
First let's see the users:

[root@desk mythcat]# semanage user -l

                Labeling   MLS/       MLS/                          
SELinux User    Prefix     MCS Level  MCS Range                      SELinux Roles

guest_u         user       s0         s0                             guest_r
root            user       s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r unconfined_r
staff_u         user       s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r unconfined_r
sysadm_u        user       s0         s0-s0:c0.c1023                 sysadm_r
system_u        user       s0         s0-s0:c0.c1023                 system_r unconfined_r
unconfined_u    user       s0         s0-s0:c0.c1023                 system_r unconfined_r
user_u          user       s0         s0                             user_r
xguest_u        user       s0         s0                             xguest_r

To use the MLS you need to change this file:

[root@desk mythcat]# vim /etc/selinux/config


# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

The changes are:

#SELINUX=enforcing
SELINUX=permissive
...
#SELINUXTYPE=targeted
SELINUXTYPE=mls

Is need to install these packages:

[root@desk mythcat]# dnf search mls | grep selinux
Last metadata expiration check: 2:45:09 ago on Sun 02 Feb 2020 01:28:54 PM EET.
selinux-policy-mls.noarch : SELinux mls base policy
[root@desk mythcat]# dnf install selinux-policy-mls.noarch
...
Installed:
  mcstrans-2.9-2.fc31.x86_64                                                    
  policycoreutils-newrole-2.9-5.fc31.x86_64                                     
  selinux-policy-mls-3.14.4-45.fc31.noarch                                      

Complete!

These commands will relabel and start the MLS.

[mythcat@desk ~]$ setenforce 0
[mythcat@desk ~]$ getenforce
Permissive
...
[root@desk mythcat]# touch /.autorelabel
[root@desk mythcat]# reboot

If you have problems on boot the add selinux=0 on boot kernel.
After I boot and relabel all files I got errors about Gtk-Messages.
I remove my old Cinnamon with this command:

[root@desk mythcat]# dnf groupremove -y "Cinnnamon"

I list all my group with dnf tool:

[root@desk mythcat]# dnf grouplist -v 

I install the MATE environment:

dnf groupinstall -y "MATE Desktop" --allowerasing

After that the only way to start the environement is this command:

[mythcat@desk ~]$ sudo systemctl restart lightdm.service

Another issue comes from SELinux Alert Browser, where I get multiple alerts and these need to fix manually.
First, these alerts are more than 250.
After I fix some of these now I see only 50.
I think this problem with changing the SELinux type can be improved.

Fedora 31 : Using the dmesg command on Linux operating system.

The dmesg command is used to display the kernel-related messages on Unix like systems. Today I will show you how to use this command on the Linux operating system. Simply use the command:

[mythcat@desk ~]$ dmesg 
[    0.000000] microcode: microcode updated early to revision 0x21, date = 2019-02-13
...

Show the latest message that fits on screen:

[mythcat@desk ~]$ dmesg | less
... 

Use it to see infoermation about motherboard:

[mythcat@desk ~]$ dmesg | grep -i memory
...
[mythcat@desk ~]$ dmesg | grep -i dma
...
[mythcat@desk ~]$ dmesg | grep -i usb
...
[mythcat@desk ~]$ dmesg | grep -i tty
...

Same reult with a single command using multiple grep option:

[mythcat@desk ~]$ dmesg | grep -E "memory|dma|usb|tty"

This display logs related to error and warning:

[root@desk mythcat]# dmesg --level=err,warn

The dmesg comes with supported log facilities:

• kern - kernel messages;
• user - random user-level messages;
• mail - mail system;
• daemon - system daemons;
• auth - security/authorization messages;
• syslog - messages generated internally by syslogd;
• lpr - line printer subsystem;
• news - network news subsystem;

See output facility only for one:

[mythcat@desk ~]$ dmesg --facility=daemon

Use root user to clear dmesg logs after the reading them:

[root@desk mythcat]# dmesg -C

If you want then you can show the outpout into the colored messages:

# dmesg -L

Fedora 31 : Can be better? part 004.

Another issue on Fedora can be linked to the management of transactions to avoid transaction lock. Let's see how can be fixed:

[root@desk mythcat]# rpm --rebuilddb
warning: waiting for transaction lock on /var/lib/rpm/.rpm.lock
^C
[root@desk mythcat]# rm /var/lib/rpm/.rpm.lock
rm: remove regular empty file '/var/lib/rpm/.rpm.lock'? y
[root@desk mythcat]# rpm --rebuilddb
...
[root@desk mythcat]# dnf clean all
...
Waiting for process with pid 2128 to finish.
^CKeyboardInterrupt: Terminated.
[root@desk mythcat]# kill  -9 2128
[root@desk mythcat]# dnf clean all
95 files removed

Fedora 31 : The twa web auditor tool.

This tool comes with a good intro: A tiny web auditor with strong opinions.
The tool named twa takes one domain at a time and use these dependencies: bash 4, curl, dig, jq, and nc, along with the POSIX system.
The project can be found at GitHub repository but I can be install easy on Fedora 31 distro:

[root@desk mythcat]# dnf install twa.noarch 
Last metadata expiration check: 0:06:08 ago on Fri 24 Jan 2020 01:57:53 PM EET.
Dependencies resolved.
================================================================================
 Package       Architecture     Version                  Repository        Size
================================================================================
Installing:
 twa           noarch           1.8.0-3.fc31             fedora            18 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 18 k
Installed size: 30 k
Is this ok [y/N]: y
Downloading Packages:
twa-1.8.0-3.fc31.noarch.rpm                      10 kB/s |  18 kB     00:01    
--------------------------------------------------------------------------------
Total                                           6.7 kB/s |  18 kB     00:02     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : twa-1.8.0-3.fc31.noarch                                1/1 
  Running scriptlet: twa-1.8.0-3.fc31.noarch                                1/1 
  Verifying        : twa-1.8.0-3.fc31.noarch                                1/1 

Installed:
  twa-1.8.0-3.fc31.noarch                                                       

Complete!

Let's see some examples with google website responses and this tool:

[mythcat@desk ~]$ twa google.com
FAIL(google.com): TWA-0102: HTTP redirects to HTTP (not secure)
FAIL(google.com): TWA-0205: Strict-Transport-Security missing
MEH(google.com): TWA-0206: X-Frame-Options is 'sameorigin', consider 'deny'
FAIL(google.com): TWA-0209: X-Content-Type-Options missing
FAIL(google.com): TWA-0210: X-XSS-Protection is '0'; XSS filtering disabled
FAIL(google.com): TWA-0214: Referrer-Policy missing
FAIL(google.com): TWA-0219: Content-Security-Policy missing
FAIL(google.com): TWA-0220: Feature-Policy missing
PASS(google.com): Site sends 'Server', but probably only a vendor ID: gws
PASS(google.com): Site doesn't send 'X-Powered-By'
PASS(google.com): Site doesn't send 'Via'
PASS(google.com): Site doesn't send 'X-AspNet-Version'
PASS(google.com): Site doesn't send 'X-AspNetMvc-Version'
PASS(google.com): No SCM repository at: http://google.com/.git/HEAD
PASS(google.com): No SCM repository at: http://google.com/.hg/store/00manifest.i
PASS(google.com): No SCM repository at: http://google.com/.svn/entries
PASS(google.com): No environment file at: http://google.com/.env
PASS(google.com): No environment file at: http://google.com/.dockerenv
PASS(google.com): No config file at: http://google.com/config.xml
PASS(google.com): No config file at: http://google.com/config.json
PASS(google.com): No config file at: http://google.com/config.yaml
PASS(google.com): No config file at: http://google.com/config.yml
PASS(google.com): No config file at: http://google.com/config.ini
^C

The output result line looks like this:
TYPE(domain): explanation where TYPE is one of PASS, MEH, FAIL, UNK, SKIP, and FATAL., see the output example:
PASS: The test passed with flying color.
MEH: The test passed, but with one or more things that could be improved.
FAIL: The test failed and should be fixed.
UNK: The server gave us something we didn't understand.
SKIP: The server gave us something we understood, but that we don't handle yet.
FATAL: A really important test failed, and should be fixed immediately.
Another feature is scoring.
The score format is this: npasses nmehs nfailures nunknowns nskips totally_screwed.
Let's see one example:

[mythcat@desk ~]$ twa google.com | tscore
20 37 2 7 0 0 0

The tool can be used with Alpine Docker container.

Fedora 31 : Install Yii framework.

Today I will show you how to install the Yii framework:
Yii is a fast, secure, and efficient PHP framework. Flexible yet pragmatic. Works right out of the box. Has reasonable defaults.
First, let's install the PHP , see the official webpage.
Fedora for PHP development.

[mythcat@desk ~]$ sudo dnf install php-cli
...
Is this ok [y/N]: y
Downloading Packages:
(1/2): php-common-7.3.13-1.fc31.x86_64.rpm      794 kB/s | 760 kB     00:00    
(2/2): php-cli-7.3.13-1.fc31.x86_64.rpm         2.2 MB/s | 2.8 MB     00:01    
--------------------------------------------------------------------------------
Total                                           1.6 MB/s | 3.5 MB     00:02     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : php-common-7.3.13-1.fc31.x86_64                        1/2 
  Installing       : php-cli-7.3.13-1.fc31.x86_64                           2/2 
  Running scriptlet: php-cli-7.3.13-1.fc31.x86_64                           2/2 
  Verifying        : php-cli-7.3.13-1.fc31.x86_64                           1/2 
  Verifying        : php-common-7.3.13-1.fc31.x86_64                        2/2 

Installed:
  php-cli-7.3.13-1.fc31.x86_64          php-common-7.3.13-1.fc31.x86_64         

Complete!

Install these packages: PHPUnit for unit tests or Composer.

[mythcat@desk ~]$ sudo dnf install phpunit composer
...
Complete!

Install mysqli extension:

[mythcat@desk ~]$ sudo dnf install php-mysqli
...
Installed:
  php-mysqlnd-7.3.13-1.fc31.x86_64                                              

Complete!

You can start the server:

[mythcat@desk ~]$ sudo php --server localhost:8080 --docroot  .
PHP 7.3.13 Development Server started at Tue Jan 14 21:58:19 2020
Listening on http://localhost:8080
Document root is /home/mythcat
Press Ctrl-C to quit.
[Tue Jan 14 21:58:40 2020] [::1]:32988 [404]: / - No such file or directory
[Tue Jan 14 21:58:40 2020] [::1]:32990 [404]: / - No such file or directory
[Tue Jan 14 21:58:42 2020] [::1]:33014 [404]: /favicon.ico - No such file or directory
[Tue Jan 14 21:59:48 2020] [::1]:33080 [404]: / - No such file or directory
...

The composer command has these arguments:

[mythcat@desk ~]$ composer
   ______
  / ____/___  ____ ___  ____  ____  ________  _____
 / /   / __ \/ __ `__ \/ __ \/ __ \/ ___/ _ \/ ___/
/ /___/ /_/ / / / / / / /_/ / /_/ (__  )  __/ /
\____/\____/_/ /_/ /_/ .___/\____/____/\___/_/
                    /_/
Composer version 1.9.1 2019-11-01 17:20:17

Usage:
  command [options] [arguments]

Options:
  -h, --help                     Display this help message
  -q, --quiet                    Do not output any message
  -V, --version                  Display this application version
      --ansi                     Force ANSI output
      --no-ansi                  Disable ANSI output
  -n, --no-interaction           Do not ask any interactive question
      --profile                  Display timing and memory usage information
      --no-plugins               Whether to disable plugins.
  -d, --working-dir=WORKING-DIR  If specified, use the given directory as working directory.
      --no-cache                 Prevent use of the cache
  -v|vv|vvv, --verbose           Increase the verbosity of messages: 1 for normal output,

 2 for more verbose output and 3 for debug

Available commands:
  about                Shows the short information about Composer.
  archive              Creates an archive of this composer package.
  browse               Opens the package's repository URL or homepage in your browser.
  check-platform-reqs  Check that platform requirements are satisfied.
  clear-cache          Clears composer's internal package cache.
  clearcache           Clears composer's internal package cache.
  config               Sets config options.
  create-project       Creates new project from a package into given directory.
  depends              Shows which packages cause the given package to be installed.
  diagnose             Diagnoses the system to identify common errors.
  dump-autoload        Dumps the autoloader.
  dumpautoload         Dumps the autoloader.
  exec                 Executes a vendored binary/script.
  global               Allows running commands in the global composer dir ($COMPOSER_HOME).
  help                 Displays help for a command
  home                 Opens the package's repository URL or homepage in your browser.
  i                    Installs the project dependencies from the composer.lock file if present,
 or falls back on the composer.json.
  info                 Shows information about packages.
  init                 Creates a basic composer.json file in current directory.
  install              Installs the project dependencies from the composer.lock file if present,
 or falls back on the composer.json.
  licenses             Shows information about licenses of dependencies.
  list                 Lists commands
  outdated             Shows a list of installed packages that have updates available, including
 their latest version.
  prohibits            Shows which packages prevent the given package from being installed.
  remove               Removes a package from the require or require-dev.
  require              Adds required packages to your composer.json and installs them.
  run                  Runs the scripts defined in composer.json.
  run-script           Runs the scripts defined in composer.json.
  search               Searches for packages.
  show                 Shows information about packages.
  status               Shows a list of locally modified packages, for packages installed from source.
  suggests             Shows package suggestions.
  u                    Upgrades your dependencies to the latest version according to composer.json,
 and updates the composer.lock file.
  update               Upgrades your dependencies to the latest version according to composer.json,
 and updates the composer.lock file.
  upgrade              Upgrades your dependencies to the latest version according to composer.json,
 and updates the composer.lock file.
  validate             Validates a composer.json and composer.lock.
  why                  Shows which packages cause the given package to be installed.
  why-not              Shows which packages prevent the given package from being installed.

Let's install the Yii framework:

[mythcat@desk ~]$ composer create-project --prefer-dist yiisoft/yii2-app-basic basic

Installing yiisoft/yii2-app-basic (2.0.31)
  - Installing yiisoft/yii2-app-basic (2.0.31): Downloading (100%)         
Created project in basic
Loading composer repositories with package information
Updating dependencies (including require-dev)
...
Writing lock file
Generating autoload files
> yii\composer\Installer::postCreateProject
chmod('runtime', 0777)...done.
chmod('web/assets', 0777)...done.
chmod('yii', 0755)...done.
> yii\composer\Installer::postInstall 

Let's run it:

[mythcat@desk ~]$ cd basic/
[mythcat@desk basic]$ ./yii serve
Server started on http://localhost:8080/
Document root is "/home/mythcat/basic/web"
Quit the server with CTRL-C or COMMAND-C.
[Tue Jan 14 22:20:22 2020] [::1]:34072 [200]: /
[Tue Jan 14 22:20:22 2020] [::1]:34074 [200]: /assets/dd70c73/css/bootstrap.css
[Tue Jan 14 22:20:22 2020] [::1]:34076 [200]: /css/site.css
[Tue Jan 14 22:20:22 2020] [::1]:34078 [200]: /assets/afa8d426/jquery.js
[Tue Jan 14 22:20:22 2020] [::1]:34080 [200]: /assets/3235fb02/yii.js
[Tue Jan 14 22:20:22 2020] [::1]:34082 [200]: /assets/dd70c73/js/bootstrap.js
[Tue Jan 14 22:20:23 2020] [::1]:34084 [200]: /index.php?r=debug%2Fdefault%2Ftoolbar&tag=5e1e228626c18 

Fedora 31 : Can be better? part 004.

The common question of any Fedora Linux user: Can be better?.
Yes, we can fix some common errors...
This is a common error generated by the GTK on Fedora distro applications:

[mythcat@desk bin]$ ./studio.sh 

(java:12631): Gtk-WARNING **: 11:45:47.061: Unable to locate theme engine in module_path: "murrine",

(java:12631): Gtk-WARNING **: 11:45:47.061: Unable to locate theme engine in module_path: "murrine",

(java:12631): Gtk-WARNING **: 11:45:47.106: Unable to locate theme engine in module_path: "murrine",
...

First, find the running GUI environment from the terminal:

[mythcat@desk ~]$ echo $XDG_CURRENT_DESKTOP
X-Cinnamon

This allows us to know that the issue may be a GTK theme package.

[root@desk bin]# dnf install gtk-murrine-engine.x86_64
Last metadata expiration check: 0:45:00 ago on Mon 06 Jan 2020 11:14:27 AM EET.
Dependencies resolved.
...
Installed:
  gtk-murrine-engine-0.98.2-17.fc31.x86_64                                      

Complete!

Now the Android Studio works well without warning errors:

[mythcat@desk bin]$ ./studio.sh 
Jan 06, 2020 12:00:51 PM java.util.prefs.FileSystemPreferences$1 run
INFO: Created user preferences directory.
...

Fedora 31 : Install MongoDB on Fedora 31 distro.

Today I will show you how to install the MongoDB on Fedora 31 distro. MongoDB is a general-purpose, document-based, distributed database built for modern application developers and for the cloud.
You can see the source code for MongoDb at the GitHub website.
First, you need to create a repository file.

[mythcat@desk ~]$ su
Password: 
[root@desk mythcat]# vi /etc/yum.repos.d/mongodb.repo

Add the code for this repository file.

[mongodb-org-4.2]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/8Server/mongodb-org/testing/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.2.asc

Let's search this Fedora apckage with dnf tool

[root@desk mythcat]# dnf search mongodb-org
MongoDB Repository                                        5.8 kB/s | 6.5 kB     00:01    
=========================== Name Exactly Matched: mongodb-org ============================
mongodb-org.x86_64 : MongoDB open source document-oriented database system (metapackage)
=============================== Name Matched: mongodb-org ================================
mongodb-org-shell.x86_64 : MongoDB shell client
mongodb-org-tools.x86_64 : MongoDB tools
mongodb-org-mongos.x86_64 : MongoDB sharded cluster query router
mongodb-org-server.x86_64 : MongoDB database server

[root@desk mythcat]# dnf install mongodb-org.x86_64 
Last metadata expiration check: 0:01:46 ago on Fri 03 Jan 2020 05:27:49 PM EET.
Dependencies resolved.
==========================================================================================
 Package                 Arch        Version                   Repository            Size
==========================================================================================
Installing:
 mongodb-org             x86_64      4.2.2-0.1.rc1.el8         mongodb-org-4.2       10 k
Installing dependencies:
 mongodb-org-mongos      x86_64      4.2.2-0.1.rc1.el8         mongodb-org-4.2       14 M
 mongodb-org-server      x86_64      4.2.2-0.1.rc1.el8         mongodb-org-4.2       25 M
 mongodb-org-shell       x86_64      4.2.2-0.1.rc1.el8         mongodb-org-4.2       17 M
 mongodb-org-tools       x86_64      4.2.2-0.1.rc1.el8         mongodb-org-4.2       47 M

Transaction Summary
==========================================================================================
Install  5 Packages

Total download size: 103 M
Installed size: 260 M
Is this ok [y/N]: y
...
 From       : https://www.mongodb.org/static/pgp/server-4.2.asc
Is this ok [y/N]: y
Key imported successfully
...
Installed:
  mongodb-org-4.2.2-0.1.rc1.el8.x86_64        mongodb-org-mongos-4.2.2-0.1.rc1.el8.x86_64
  mongodb-org-server-4.2.2-0.1.rc1.el8.x86_64 mongodb-org-shell-4.2.2-0.1.rc1.el8.x86_64 
  mongodb-org-tools-4.2.2-0.1.rc1.el8.x86_64 

Complete!

Start and enable MongoDB service to start on boot.

[root@desk mythcat]# systemctl start mongod
[root@desk mythcat]# sudo systemctl enable mongod
[root@desk mythcat]# systemctl status mongod
● mongod.service - MongoDB Database Server
   Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disabl>
   Active: active (running) since Fri 2020-01-03 17:32:36 EET; 17s ago
     Docs: https://docs.mongodb.org/manual
 Main PID: 9019 (mongod)
   Memory: 71.0M
      CPU: 890ms
   CGroup: /system.slice/mongod.service
           └─9019 /usr/bin/mongod -f /etc/mongod.conf

Jan 03 17:32:34 desk systemd[1]: Starting MongoDB Database Server...
Jan 03 17:32:34 desk mongod[9017]: about to fork child process, waiting until server is r>
Jan 03 17:32:34 desk mongod[9017]: forked process: 9019
Jan 03 17:32:36 desk mongod[9017]: child process started successfully, parent exiting
Jan 03 17:32:36 desk systemd[1]: Started MongoDB Database Server.
Jan 03 17:32:47 desk systemd[1]: /usr/lib/systemd/system/mongod.service:16: PIDFile= refe>
...

Use the netstat utility to confirm that indeed Mongod service is listening.

[root@desk mythcat]# netstat -pnltu | grep mongo
tcp        0      0 127.0.0.1:27017         0.0.0.0:*               LISTEN      9019/mongod

Create an admin user with elevated privileges to perform elevated tasks.

[root@desk mythcat]# mongo
MongoDB shell version v4.2.2-rc1
...
> use admin 
switched to db admin
> db.createUser(
...  {
...  user: "admin",
...  pwd: "123",
...  roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
...  }
...  )
Successfully added user: {
 "user" : "admin",
 "roles" : [
  {
   "role" : "userAdminAnyDatabase",
   "db" : "admin"
  }
 ]
}

Show the users:

> show users
{
 "_id" : "admin.admin",
 "userId" : UUID("5ca3a1c2-6225-4158-b2bc-e32e5e5de58f"),
 "user" : "admin",
 "db" : "admin",
 "roles" : [
  {
   "role" : "userAdminAnyDatabase",
   "db" : "admin"
  }
 ],
 "mechanisms" : [
  "SCRAM-SHA-1",
  "SCRAM-SHA-256"
 ]
}

To enable authentication edit the /lib/systemd/system/mongod.service file, under the [Service] section, locate and edit the Environment parameter as shown.

[root@desk mythcat]# vim /lib/systemd/system/mongod.service
...
[Unit]
Description=MongoDB Database Server
Documentation=https://docs.mongodb.org/manual
After=network.target

[Service]
User=mongod
Group=mongod
Environment="OPTIONS= --auth -f /etc/mongod.conf"
...

Apply the changes to the service mongo unit.

[root@desk mythcat]# systemctl daemon-reload
[root@desk mythcat]# systemctl restart mongod
[root@desk mythcat]# systemctl status mongod
● mongod.service - MongoDB Database Server
   Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disable>
   Active: active (running) since Fri 2020-01-03 17:44:09 EET; 11s ago
     Docs: https://docs.mongodb.org/manual
  Process: 9272 ExecStartPre=/usr/bin/mkdir -p /var/run/mongodb (code=exited, status=0/SUC>
  Process: 9273 ExecStartPre=/usr/bin/chown mongod:mongod /var/run/mongodb (code=exited, s>
  Process: 9274 ExecStartPre=/usr/bin/chmod 0755 /var/run/mongodb (code=exited, status=0/S>
  Process: 9275 ExecStart=/usr/bin/mongod $OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 9277 (mongod)
   Memory: 168.3M
      CPU: 1.423s
   CGroup: /system.slice/mongod.service
           └─9277 /usr/bin/mongod --auth -f /etc/mongod.conf
...