[LINUX] A story about a beginner trying hard to set up CentOS 8 (procedure memo)

I want to use CentOS 8 for desktop / development (blender-python3.7, unity for linux (game engine)). Do not publish outside the LAN (WAN-> LAN port mapping is not performed on the router side) Almost the first time (I used it a little in a university circle about 5-10 years ago) To-do list

1. Update to the latest BIOS before installation (because RDRAND is dead Ryzen 3 ASRock X570 Pro4 (BIOS v1.0))

2. Partition (only one NVME m2 512GB) --MBR default -/ boot 1GB (If you have it, can you afford it? Now the kernel is about 100MB?

   • /(root)) 128GB -/ home rest (about 400GB?) -/ swap 4GB (with 32GB of RAM ...

3. selinux

   • /etc/selinux/config -~~ SELINUX = permissive (only warning) ~~ --setebool -P antivirus_can_scan_system 1 (Allow selinux to scan for viruses (clamAV))

4. Administrator account --sudo adduser adminhoge #You will be asked for your password on the way

   • sudo adduser adminhoge wheel

5. Everyday account --adduser userhoge #You will be asked for your password on the way

6. nvidiaDriver install (https://qiita.com/kkk627/items/9ab959421804341f215e) dnf update (without kernel source (kernbel-devel) and kernel)

   1. dnf groupinstall "Development Tools"
   2. dnf install libglvnd-devel elfutils-libelf-devel
   3. /etc/modprobe.d/blacklist-nouveau.conf
      • blacklist nouveau
      • options nouveau modeset=0
      • blacklist lbm-nouveau
   4. mv /boot/initramfs-(uname -r).img /boot/initramfs-(uname -r)-nouveau.img #backup with nouveau.img
   5. dracut --omit-drivers nouveau /boot/initramfs-$(uname -r).img $(uname -r) #make no nouveau.img
   6. reboot os In select mode a-> e quiet Behind (space) 3-> ctrl x
   7. sudo init 3 #CUI mode
   8. bash NVIDIA-Linux-x86_64****.run : y->n

7. Add to nvidia-drm.modeset = 1 GRUB and grub2-update (https://wiki.archlinux.jp/index.php/NVIDIA) -> If you don't do this, you will not have enough privileges to log in? The driver crashes and the screen goes black, causing a recovery load. 8. reboot

8. Edit> vm.swappiness = 10> /etc/sysctl.conf #swap suppression

9. yum install epel-release

10. dnf install dnf-automatic zsh dnf install java-11-openjdk.x86_64

11. clamAV settings

• dnf install clamav clamav-{update,scanner-systemd}

• sed -i '/^Example/s/^/#/' /etc/freshclam.conf

• add above default : DatabaseMirror db.jp.clamav.net > /etc/freshclam.conf

• sed -i '/^NotifyClamd/s/^/#/' /etc/clamd.d/scan.conf

• add # -> User clamscan　 /etc/clamd.d/scan.conf #to root execute

• freshclam --ln -s /etc/clamd.d/scan.conf /etc/clamd.conf # Link

• sed -i '/^Example/s/^/#/' /etc/clamd.conf

• sed -i '/TCPSocket/s/^#//' /etc/clamd.conf

• sed -i '/TCPAddr/s/^#//' /etc/clamd.conf

• sed -i '/clamd.sock/s/^#//' /etc/clamd.conf --Edit> [Service] TimeoutSec = 5min> /lib/systemd/system/[email protected] # Extend the timeout as it dies when the startup is shit slow --Add clamdscan.sh to cron's daily execution script directory

  • nano /etc/cron.daily/clamdscan.sh

  #!/bin/bash
  #setting file
  CONFIG=/etc/clamd.d/scan.conf
  

Scan execution clamdscan -c ${CONFIG} ```
chmod +x /etc/cron.daily/clamdscan.sh systemctl enable clamd@scan systemctl start clamd@scan systemctl status clamd@scan (https://inaba-serverdesign.jp/blog/20170913/clamav_scan_virus_install.html) (https://qiita.com/bezeklik/items/4696e15c889ffff6bc41)

7. Install from web: Google-chrome vscode (& minecraft client)
8. Are you there? ./ zshrc https://news.mynavi.jp/article/zsh-10/

Work with sudo vs code from here --install the following in vscode - ms-ceintl.vscode-language-pack-ja - coenraads.bracket-pair-colorizer - ms-python.python --Ctrl + Shift + P-> configure display language-> Change the part written as "en" to "ja"

7. dnf-automatic, but I want to update the kernel manually, update is security only --Edit excludepkgs = kernel *> /etc/dnf/automatic.conf --Edit apply_updates = yes> /etc/dnf/automatic.conf --Edit upgrade_type = security> /etc/dnf/automatic.conf

   • systemctl enable dnf-automatic.timer
   • systemctl start dne-automatic.timer

8. (http://tooljp.com/linux/Redhat7/faqRedhat7/html/what-is-virbr.html) Somehow the virtual LAN is springing up without permission, so crush it.

   • dnf install libvirt-client.x86_64
   • virsh net-list --all
   • virsh net-autostart default --disable

9. sshd

• /etc/ssh/sshd_config --Edit PrtmitRootLogin no --Edit Port 55000 (49152 or later)
• firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.1.0/24" port protocol="tcp" port="55000" accept" --firewall-cmd --remove-service = ssh --zone = public --permanent # (close number 22)
• service sshd restart
• firewall-cmd --reload
• /etc/hosts.allow --sshd: 192.168.1. Only # 192.168.1.0-255 is allowed
• /etc/hosts.deny
  • ALL:ALL --with client
  • ssh-keygen -t rsa -b 4096 -C "example_icyp" (https://qiita.com/suthio/items/2760e4cff0e185fe2db9)
  • ssh-copy-id -i id_rsa.pub -p 55000 [email protected] --ssh config host: 192.168.1.?, key location, port
• cat /.ssh/id_rsa.pub >> ~/.ssh/authorized_keys --chmod 600 authorized_keys #owner rw possible
• /etc/ssh/sshd_config
  • PubkeyAuthentication yes
  • PasswordAuthentication no
  • PermitEmptyPasswords no
  • ChallengeResponseAuthentication no
  • IgnoreRhosts　yes
• systemctl restart sshd

10. py -3.7 -m venv py37env
11. dnf install mesa-libGLU-devel.x86_64 --Without, unity did not start
    • ln -s /etc/ca-certificates/extracted/ca-
    • bundle.trust.crt /etc/ssl/certs/ca-certificates.crt -Certificate name? Seems to have changed and unity was throwing a compile error (v2018.4), so I linked it.
12. chmod u+x ~/Downloads/UnityHubSetup.AppImage ./UnityHubSetup.AppImage
13. Date gsettings set org.gnome.desktop.interface clock-show-date true
14. Window button gsettings set org.gnome.desktop.wm.preferences button-layout appmenu: minimize, maximize, close

In / etc / sudoers %wheel ALL=(ALL) ALL But Make sure there is groups -> username wheel

Make sure that it is

sudo passwd -l root #root login seal (I was able to sudo if I was messed up with rescue from the USB that died here and I thought I was going to die. But clamdscan doesn't work without sudo, what should I do?

ps. dnf install pv ps.

https://qiita.com/takanemu/items/90ea4b938a979b0990b3

I wrote it in .xprofile but it didn't work, so I wrote it in .bashrc. Make the cache a RAMDisk. It seems that it will support if it complies with freedesktop.org (chrome etc.

ps. dual boot with windows

/etc/adjtime

UTC -> LOCAL

Specifying the cache directory

~/.bashrc

export XDG_CACHE_HOME=/dev/shm/.cache-$(whoami)
mkdir -p ${XDG_CACHE_HOME}
chmod 700 ${XDG_CACHE_HOME}