diff --git a/docs/.vuepress/config.js b/docs/.vuepress/config.js index f2eb1e56f..2577fcf9f 100644 --- a/docs/.vuepress/config.js +++ b/docs/.vuepress/config.js @@ -35,7 +35,7 @@ module.exports = { '/sigs/LiveMedia', '/sigs/Marketing', '/sigs/Migration', - '/sigs/ProcessForCreatingNewSIG' + '/sigs/ProcessForCreatingNewSIG' ] }, ] @@ -63,7 +63,32 @@ module.exports = { title: 'Howto Series', path: '/series/', children: [ - ] + { + title: "Nginx Series", + path: '/series/nginx/', + children: [ + '/series/nginx/NginxSeriesA01', + '/series/nginx/NginxSeriesA02R8', + '/series/nginx/NginxSeriesA02R91', + '/series/nginx/NginxSeriesA02R92', + '/series/nginx/NginxSeriesA03', + '/series/nginx/NginxSeriesA04P1', + ] + }, + { + title: "System Series", + path: '/series/system/', + children: [ + '/series/system/SystemSeriesA01', + '/series/system/SystemSeriesA02', + '/series/system/SystemSeriesA03', + '/series/system/SystemSeriesA03R8', + '/series/system/SystemSeriesA03R9', + '/series/system/SystemSeriesA04', + '/series/system/SystemSeriesA05', + ] + } + ] }, { title: 'Release Notes', diff --git a/docs/series/README.md b/docs/series/README.md index b6a50a4ba..56e9b25bd 100644 --- a/docs/series/README.md +++ b/docs/series/README.md @@ -1,6 +1,52 @@ ---- -title: "Howto Series" ---- +# Howto Series: AlmaLinux Tutorials 🚀 -# Series Page +Welcome to our Howto series on AlmaLinux! In this series, we provide comprehensive guides and tutorials to help you learn and master various aspects of AlmaLinux. Whether you are interested in Nginx or system-related topics, we've got you covered. +## Nginx Series + +The Nginx series focuses on all things related to Nginx web server. From installation to configuration, security, and optimization, you will find step-by-step guides to help you deploy and manage a powerful web server on AlmaLinux. + +Browse the articles in the Nginx series: + +- [A01](nginx/NginxSeriesA01.md) ❯ Beginner's Guide +- [A02 R8](nginx/NginxSeriesA02R8.md) ❯ AlmaLinux 8.x Installation Examples +- [A02 R9.1](nginx/NginxSeriesA02R91.md) ❯ AlmaLinux 9.1 Installation Examples +- [A02 R9.2](nginx/NginxSeriesA02R92.md) ❯ AlmaLinux 9.2 Installation Examples +- [A03](nginx/NginxSeriesA03.md) ❯ Default Configuration Guide +- [A04](nginx/NginxSeriesA04P1.md) ❯ Secure Nginx Deployment + +## System Series + +**The vision:** (In near future) The System series covers a wide range of system-related topics on AlmaLinux. This guides will help you enhance your system administration skills and ensure the stability and security of your AlmaLinux environment. + +Explore the articles in the System series: + +- [A01](system/SystemSeriesA01.md) ❯ Application Streams +- [A02](system/SystemSeriesA02.md) ❯ Firewalld: A Beginner's Guide +- [A03](system/SystemSeriesA03.md) ❯ NVIDIA Driver Installation Guide +- [A03 R8](system/SystemSeriesA03R8.md) ❯ NVIDIA Driver: Installation on 8.x +- [A03 R9](system/SystemSeriesA03R9.md) ❯ NVIDIA Driver: Installation on 9.x +- [A04](system/SystemSeriesA04.md) ❯ Snapd Installation Guide +- [A05](system/SystemSeriesA05.md) ❯ Multimedia Codecs Installation Guide + +Dive into our Howto series and unlock the full potential of AlmaLinux. Happy hacking! 🐧💻🚀 + +---- + +##### Trademark Notices +:::warning + +**AlmaLinux** is a registered trademark of AlmaLinux OS Foundation. + +**Linux®** is a registered trademark of Linus Torvalds in the U.S. and other countries. + +**macOS** are trademarks of Apple Inc., registered in the U.S. and other countries. + +**NVIDIA** is a registered trademark of NVIDIA Corporation in the U.S. and other countries. + +**Red Hat** is a registered trademark of Red Hat, Inc. or its subsidiaries in the United States and other countries. + +**Windows** is a registered trademark of Microsoft Corporation in the United States and other countries. + +All other trademarks are the property of their respective owners. +::: diff --git a/docs/series/nginx/NginxSeriesA01.md b/docs/series/nginx/NginxSeriesA01.md new file mode 100644 index 000000000..7a508d6cc --- /dev/null +++ b/docs/series/nginx/NginxSeriesA01.md @@ -0,0 +1,170 @@ +# A01 ❯ A Beginner's Guide +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-10 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ +## 🌟 Introduction + +In this guide, we offer a detailed walk-through of Nginx installation, exploring three potential installation methods with examples for AlmaLinux OS 8.x and 9.x. You'll gain insights into essential Nginx interactions, and we'll present a tailored-learning path crafted to assist you in mastering Nginx and achieving proficiency in its utilization. + + +### About Nginx + +Nginx is a popular open-source, powerful web server and reverse proxy that is known for its high performance and stability. It can be used to serve static and dynamic content, load balance traffic, and optimize performance and scalability. + + +### Architecture +Nginx is based on an event-driven architecture, which differs from traditional thread-based web servers by handling multiple connections simultaneously without creating a separate thread for each one. This approach enables Nginx to efficiently manage a large number of connections with minimal overhead, resulting in improved performance, especially under high load conditions. + + +### Primary components +The primary components of Nginx include the master process, worker processes, and configuration files. The master process is responsible for reading and validating the configuration file, managing worker processes, and handling signals. Worker processes handle incoming client requests, process them, and send responses back to the clients. Configuration files define the behavior of Nginx, specifying how it should handle different types of requests, route traffic, and manage other settings. + +### Best practices + +In this series, we will delve into best practices and uncover new aspects of Nginx to accelerate your learning and develop practical skills. Here is a basic set of best practices: + + +- **Strengthen Server Security**: Adopt security best practices, including firewalls, intrusion detection systems, and regular software updates, to safeguard your server from potential attacks. +- **Implement HTTPS**: Ensure SSL/TLS certificates are in place to encrypt traffic between your server and users. +- **Enhance Performance**: Employ caching and load balancing techniques to optimize your server's performance and scalability. + +## 🧠 Fundamental Concepts + +### Nginx Installation Variants + +There are three ways of installing Nginx on AlmaLinux 8.x and 9.x: + + - **AppStream non-module** + -- Installs the default, non-module version from the AppStream repository + - **AppStream module** + -- Installs the module version from the AppStream repository + -- Allows installation of a specific version for compatibility reasons + - **F5 Networks repository** + -- Involves defining a new repository data for your system + -- Installs the latest RPM package from external main-line repository + -- Allows always running the latest version of Nginx + + +## 📝 Key Takeaways + +### ➡️ Installing +- **Update System Packages**: Ensure your system packages are up-to-date before installing Nginx by running: +``` +sudo dnf update +``` +- **Configure Firewall**: Allow incoming traffic on TCP ports for HTTP & HTTPS services (80 & 443, respectively): + +:::warning +On AlmaLinux OS, the `Firewalld` packet filtering service is enabled by default +::: + +``` +sudo firewall-cmd --permanent --add-service={http,https} +sudo firewall-cmd --reload +``` + + +- **Install Nginx**: Install Nginx using one of the three variants: default package repository, Appstream module, or Nginx repository. + + Compatibility Matrix + | Install Variant | 8.7 | 9.1| 9.2 | + |--------------------|-----|----|-----| + | I. AppStream non-module | ❗¹ | ✅ | ❗² | + | II. AppStream module | ✅ | ❌ | ✅ | + | III. Mainline repo | ✅ | ✅ | ✅ | + + ¹ On 8.7, this will actually install the AppStream module. +
+ ² Default version is outdated; AppStream module is recommended. + + + +### ➡️ Testing +- **Start Nginx Service**: After installation, start the Nginx service with: +``` +sudo systemctl start nginx +``` + +- **Check Nginx Status**: Verify if Nginx is running properly by running: + ``` + sudo systemctl status nginx + ``` + +- **Check Firewall Status**: make sure `http` & `https` services are enabled (open ports): + +``` +sudo firewall-cmd --list-services +``` + +- **Test Nginx Installation**: Navigate a web browser of your choice to your server's hostname or IP address to check for the default page. + +**Example:** we use `lynx` to be able to perform the check from command-line-interface: + ``` + lynx http://localhost/ + ``` + + ::: details + `lynx` is a text-based web browser for use on cursor-addressable character (cell) terminals. + + Install it with `dnf install lynx`. + ::: + + ::: tip + To exit `lynx` press `q` and then `y` to confirm. + ::: + + +### ➡️ Configuring +- **Configure Nginx**: To serve your own content, edit the Nginx configuration file at: + ``` + /etc/nginx/nginx.conf + ``` + +- **Test Nginx Configuration**: Before reloading Nginx, test the configuration file for syntax errors using: + ``` + sudo nginx -t + ``` + + +### ➡️ Management +- **Reload Nginx**: Reload Nginx to apply configuration changes with: + ``` + sudo systemctl reload nginx + ``` + +- **Stop Nginx Service**: To stop the Nginx service, execute the command: + ``` + sudo systemctl stop nginx + ``` + +- **Enable Nginx at Boot**: To start Nginx automatically at system boot, run: + ``` + sudo systemctl enable nginx + ``` + +## 📖 Release-Specific Installation + +AlmaLinux version-specific examples: + + - AlmaLinux Nginx Series ❯ [AlmaLinux OS 8.x Installation Examples](NginxSeriesA02R8.md) + - AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.1 Installation Examples](NginxSeriesA02R91.md) + - AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.2 Installation Examples](NginxSeriesA02R92.md) + + +## 📚 Further reading and Next Steps + +In-depth Resources: + +- AlmaLinux Nginx Series ❯ [Default Configuration Guide](NginxSeriesA03.md) +- AlmaLinux Nginx Series ❯ [Secure Nginx Deployment](NginxSeriesA04P1.md) + + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) + diff --git a/docs/series/nginx/NginxSeriesA02R8.md b/docs/series/nginx/NginxSeriesA02R8.md new file mode 100644 index 000000000..0c9f48915 --- /dev/null +++ b/docs/series/nginx/NginxSeriesA02R8.md @@ -0,0 +1,604 @@ +# A02 R8 ❯ AlmaLinux 8.x Installation +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-16 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ +## 🌟 Introduction +This is a dedicated example for the **AlmaLinux 8.x series**, demonstrating how to install Nginx using one of the three variants: + +- Variant I: AppStream non-module +- Variant II: AppStream module +- Variant III: Nginx mainline repository + +## 📝 Installation instructions + +### System Updates First! + +::: warning +Please make sure to run **`sudo dnf update`** before proceeding with any other installation or configuration steps to ensure that your system is up-to-date and any known security vulnerabilities or bugs are patched. +::: + + +### 📖 Available Nginx Versions (AlmaLinux OS 8.7) + +Different Nginx server versions are available to install depending on the installation variant. + +| |Installation Variant | Nginx Versions available | Notes | +|-|------------------------|--------------------------|---------------| +|🟥| AppStream non-module | 1.14 | Default version is outdated and does not get updates! Inadvisable. | +|🟩| AppStream module | 1.14 -- 1.20 | Module version are getting the security updates. **The recommended method**. | +|🟨| Nginx mainline repo | 1.15.2 -- 1.23.3¹ | You always get latest version of Nginx avaiable. Second good (small chance of incompatibilty). | + +¹ current version at the time of testing (1.23.4 already available at Nginx.org) + + + +Architecture Compatibility +| Architecture | Supported | +|-----|----| +| Aarch64 | ✅ | +| PowerPC | ❌ | +| S390X | ✅ | +| X86_64 | ✅ | + + +### 🔖 Variant I - AppStream Non-module Install + +There is no Nginx AppStream non-module package on AlmaLinux 8.x series, but there is an Appstream module one. For that reason, `dnf` will offer you to install Nginx as module (version **1:1.14**) and accompanying elements of its Application Stream, by default. + +### ➡️ Install + +``` +sudo dnf install nginx +``` + +Example output: +``` +Last metadata expiration check: 8:40:11 ago on Thu 13 Apr 2023 09:34:17 PM EDT. +Dependencies resolved. +================================================================================================================================ + Package Architecture Version Repository Size +================================================================================================================================ +Installing: + nginx x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 568 k +Installing dependencies: + gd x86_64 2.2.5-7.el8 appstream 143 k + jbigkit-libs x86_64 2.1-14.el8 appstream 54 k + libXpm x86_64 3.5.12-9.el8_7 appstream 57 k + libjpeg-turbo x86_64 1.5.3-12.el8 appstream 156 k + libtiff x86_64 4.0.9-26.el8_7 appstream 188 k + libwebp x86_64 1.0.0-5.el8 appstream 271 k + nginx-all-modules noarch 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 23 k + nginx-filesystem noarch 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 23 k + nginx-mod-http-image-filter x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 34 k + nginx-mod-http-perl x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 44 k + nginx-mod-http-xslt-filter x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 32 k + nginx-mod-mail x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 63 k + nginx-mod-stream x86_64 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma appstream 84 k + perl-Carp noarch 1.42-396.el8 baseos 30 k + perl-Data-Dumper x86_64 2.167-399.el8 baseos 58 k + perl-Digest noarch 1.17-395.el8 appstream 27 k + perl-Digest-MD5 x86_64 2.55-396.el8 appstream 37 k + perl-Encode x86_64 4:2.97-3.el8 baseos 1.5 M + perl-Errno x86_64 1.28-421.el8 baseos 75 k + perl-Exporter noarch 5.72-396.el8 baseos 34 k + perl-File-Path noarch 2.15-2.el8 baseos 38 k + perl-File-Temp noarch 0.230.600-1.el8 baseos 62 k + perl-Getopt-Long noarch 1:2.50-4.el8 baseos 63 k + perl-HTTP-Tiny noarch 0.074-1.el8 baseos 58 k + perl-IO x86_64 1.38-421.el8 baseos 141 k + perl-MIME-Base64 x86_64 3.15-396.el8 baseos 30 k + perl-Net-SSLeay x86_64 1.88-2.module_el8.6.0+2811+fe6c84b0 appstream 378 k + perl-PathTools x86_64 3.74-1.el8 baseos 90 k + perl-Pod-Escapes noarch 1:1.07-395.el8 baseos 20 k + perl-Pod-Perldoc noarch 3.28-396.el8 baseos 86 k + perl-Pod-Simple noarch 1:3.35-395.el8 baseos 213 k + perl-Pod-Usage noarch 4:1.69-395.el8 baseos 34 k + perl-Scalar-List-Utils x86_64 3:1.49-2.el8 baseos 68 k + perl-Socket x86_64 4:2.027-3.el8 baseos 59 k + perl-Storable x86_64 1:3.11-3.el8 baseos 98 k + perl-Term-ANSIColor noarch 4.06-396.el8 baseos 46 k + perl-Term-Cap noarch 1.17-395.el8 baseos 23 k + perl-Text-ParseWords noarch 3.30-395.el8 baseos 18 k + perl-Text-Tabs+Wrap noarch 2013.0523-395.el8 baseos 24 k + perl-Time-Local noarch 1:1.280-1.el8 baseos 33 k + perl-URI noarch 1.73-3.el8 appstream 116 k + perl-Unicode-Normalize x86_64 1.25-396.el8 baseos 82 k + perl-constant noarch 1.33-396.el8 baseos 25 k + perl-interpreter x86_64 4:5.26.3-421.el8 baseos 6.3 M + perl-libnet noarch 3.11-3.el8 appstream 121 k + perl-libs x86_64 4:5.26.3-421.el8 baseos 1.6 M + perl-macros x86_64 4:5.26.3-421.el8 baseos 71 k + perl-parent noarch 1:0.237-1.el8 baseos 20 k + perl-podlators noarch 4.11-1.el8 baseos 118 k + perl-threads x86_64 1:2.21-2.el8 baseos 61 k + perl-threads-shared x86_64 1.58-2.el8 baseos 47 k +Installing weak dependencies: + perl-IO-Socket-IP noarch 0.39-5.el8 appstream 47 k + perl-IO-Socket-SSL noarch 2.066-4.module_el8.6.0+2811+fe6c84b0 appstream 297 k + perl-Mozilla-CA noarch 20160104-7.module_el8.5.0+2812+ed912d05 appstream 14 k +Enabling module streams: + nginx 1.14 + perl 5.26 + perl-IO-Socket-SSL 2.066 + perl-libwww-perl 6.34 + +Transaction Summary +================================================================================================================================ +Install 55 Packages + +Total download size: 14 M +Installed size: 40 M +Is this ok [y/N]: y +Downloading Packages: +(1/55): perl-Carp-1.42-396.el8.noarch.rpm 304 kB/s | 30 kB 00:00 +(2/55): perl-Data-Dumper-2.167-399.el8.x86_64.rpm 489 kB/s | 58 kB 00:00 +(3/55): perl-Exporter-5.72-396.el8.noarch.rpm 992 kB/s | 34 kB 00:00 +(4/55): perl-Errno-1.28-421.el8.x86_64.rpm 1.1 MB/s | 75 kB 00:00 +(5/55): perl-File-Path-2.15-2.el8.noarch.rpm 1.2 MB/s | 38 kB 00:00 +(6/55): perl-File-Temp-0.230.600-1.el8.noarch.rpm 1.2 MB/s | 62 kB 00:00 +(7/55): perl-Getopt-Long-2.50-4.el8.noarch.rpm 1.5 MB/s | 63 kB 00:00 +(8/55): perl-HTTP-Tiny-0.074-1.el8.noarch.rpm 1.5 MB/s | 58 kB 00:00 +(9/55): perl-IO-1.38-421.el8.x86_64.rpm 3.0 MB/s | 141 kB 00:00 +(10/55): perl-Encode-2.97-3.el8.x86_64.rpm 5.0 MB/s | 1.5 MB 00:00 +(11/55): perl-MIME-Base64-3.15-396.el8.x86_64.rpm 714 kB/s | 30 kB 00:00 +(12/55): perl-PathTools-3.74-1.el8.x86_64.rpm 2.1 MB/s | 90 kB 00:00 +(13/55): perl-Pod-Escapes-1.07-395.el8.noarch.rpm 791 kB/s | 20 kB 00:00 +(14/55): perl-Pod-Perldoc-3.28-396.el8.noarch.rpm 2.3 MB/s | 86 kB 00:00 +(15/55): perl-Pod-Simple-3.35-395.el8.noarch.rpm 5.8 MB/s | 213 kB 00:00 +(16/55): perl-Pod-Usage-1.69-395.el8.noarch.rpm 935 kB/s | 34 kB 00:00 +(17/55): perl-Scalar-List-Utils-1.49-2.el8.x86_64.rpm 2.2 MB/s | 68 kB 00:00 +(18/55): perl-Socket-2.027-3.el8.x86_64.rpm 1.9 MB/s | 59 kB 00:00 +(19/55): perl-Storable-3.11-3.el8.x86_64.rpm 2.8 MB/s | 98 kB 00:00 +(20/55): perl-Term-ANSIColor-4.06-396.el8.noarch.rpm 1.5 MB/s | 46 kB 00:00 +(21/55): perl-Term-Cap-1.17-395.el8.noarch.rpm 740 kB/s | 23 kB 00:00 +(22/55): perl-Text-ParseWords-3.30-395.el8.noarch.rpm 665 kB/s | 18 kB 00:00 +(23/55): perl-Text-Tabs+Wrap-2013.0523-395.el8.noarch.rpm 882 kB/s | 24 kB 00:00 +(24/55): perl-Time-Local-1.280-1.el8.noarch.rpm 907 kB/s | 33 kB 00:00 +(25/55): perl-Unicode-Normalize-1.25-396.el8.x86_64.rpm 2.0 MB/s | 82 kB 00:00 +(26/55): perl-constant-1.33-396.el8.noarch.rpm 642 kB/s | 25 kB 00:00 +(27/55): perl-macros-5.26.3-421.el8.x86_64.rpm 1.2 MB/s | 71 kB 00:00 +(28/55): perl-parent-0.237-1.el8.noarch.rpm 389 kB/s | 20 kB 00:00 +(29/55): perl-podlators-4.11-1.el8.noarch.rpm 2.3 MB/s | 118 kB 00:00 +(30/55): perl-threads-2.21-2.el8.x86_64.rpm 1.5 MB/s | 61 kB 00:00 +(31/55): perl-threads-shared-1.58-2.el8.x86_64.rpm 956 kB/s | 47 kB 00:00 +(32/55): perl-libs-5.26.3-421.el8.x86_64.rpm 5.4 MB/s | 1.6 MB 00:00 +(33/55): gd-2.2.5-7.el8.x86_64.rpm 2.3 MB/s | 143 kB 00:00 +(34/55): jbigkit-libs-2.1-14.el8.x86_64.rpm 1.1 MB/s | 54 kB 00:00 +(35/55): libXpm-3.5.12-9.el8_7.x86_64.rpm 1.8 MB/s | 57 kB 00:00 +(36/55): libjpeg-turbo-1.5.3-12.el8.x86_64.rpm 2.1 MB/s | 156 kB 00:00 +(37/55): libtiff-4.0.9-26.el8_7.x86_64.rpm 2.4 MB/s | 188 kB 00:00 +(38/55): libwebp-1.0.0-5.el8.x86_64.rpm 2.4 MB/s | 271 kB 00:00 +(39/55): nginx-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 3.9 MB/s | 568 kB 00:00 +(40/55): nginx-all-modules-1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch.rpm 371 kB/s | 23 kB 00:00 +(41/55): nginx-filesystem-1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch.rpm 456 kB/s | 23 kB 00:00 +(42/55): nginx-mod-http-image-filter-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 605 kB/s | 34 kB 00:00 +(43/55): nginx-mod-http-perl-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 766 kB/s | 44 kB 00:00 +(44/55): nginx-mod-http-xslt-filter-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 616 kB/s | 32 kB 00:00 +(45/55): nginx-mod-mail-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 1.1 MB/s | 63 kB 00:00 +(46/55): nginx-mod-stream-1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64.rpm 1.4 MB/s | 84 kB 00:00 +(47/55): perl-interpreter-5.26.3-421.el8.x86_64.rpm 7.8 MB/s | 6.3 MB 00:00 +(48/55): perl-Digest-1.17-395.el8.noarch.rpm 375 kB/s | 27 kB 00:00 +(49/55): perl-Digest-MD5-2.55-396.el8.x86_64.rpm 599 kB/s | 37 kB 00:00 +(50/55): perl-IO-Socket-IP-0.39-5.el8.noarch.rpm 1.7 MB/s | 47 kB 00:00 +(51/55): perl-Mozilla-CA-20160104-7.module_el8.5.0+2812+ed912d05.noarch.rpm 399 kB/s | 14 kB 00:00 +(52/55): perl-IO-Socket-SSL-2.066-4.module_el8.6.0+2811+fe6c84b0.noarch.rpm 5.8 MB/s | 297 kB 00:00 +(53/55): perl-URI-1.73-3.el8.noarch.rpm 2.8 MB/s | 116 kB 00:00 +(54/55): perl-Net-SSLeay-1.88-2.module_el8.6.0+2811+fe6c84b0.x86_64.rpm 5.2 MB/s | 378 kB 00:00 +(55/55): perl-libnet-3.11-3.el8.noarch.rpm 2.5 MB/s | 121 kB 00:00 +-------------------------------------------------------------------------------------------------------------------------------- +Total 4.5 MB/s | 14 MB 00:03 +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Installing : perl-Digest-1.17-395.el8.noarch 1/55 + Installing : perl-Digest-MD5-2.55-396.el8.x86_64 2/55 + Installing : perl-Data-Dumper-2.167-399.el8.x86_64 3/55 + Installing : perl-libnet-3.11-3.el8.noarch 4/55 + Installing : perl-Net-SSLeay-1.88-2.module_el8.6.0+2811+fe6c84b0.x86_64 5/55 + Installing : perl-URI-1.73-3.el8.noarch 6/55 + Installing : perl-Pod-Escapes-1:1.07-395.el8.noarch 7/55 + Installing : perl-Time-Local-1:1.280-1.el8.noarch 8/55 + Installing : perl-IO-Socket-IP-0.39-5.el8.noarch 9/55 + Installing : perl-Mozilla-CA-20160104-7.module_el8.5.0+2812+ed912d05.noarch 10/55 + Installing : perl-IO-Socket-SSL-2.066-4.module_el8.6.0+2811+fe6c84b0.noarch 11/55 + Installing : perl-Term-ANSIColor-4.06-396.el8.noarch 12/55 + Installing : perl-Term-Cap-1.17-395.el8.noarch 13/55 + Installing : perl-File-Temp-0.230.600-1.el8.noarch 14/55 + Installing : perl-Pod-Simple-1:3.35-395.el8.noarch 15/55 + Installing : perl-HTTP-Tiny-0.074-1.el8.noarch 16/55 + Installing : perl-podlators-4.11-1.el8.noarch 17/55 + Installing : perl-Pod-Perldoc-3.28-396.el8.noarch 18/55 + Installing : perl-Text-ParseWords-3.30-395.el8.noarch 19/55 + Installing : perl-Pod-Usage-4:1.69-395.el8.noarch 20/55 + Installing : perl-MIME-Base64-3.15-396.el8.x86_64 21/55 + Installing : perl-Storable-1:3.11-3.el8.x86_64 22/55 + Installing : perl-Getopt-Long-1:2.50-4.el8.noarch 23/55 + Installing : perl-Errno-1.28-421.el8.x86_64 24/55 + Installing : perl-Socket-4:2.027-3.el8.x86_64 25/55 + Installing : perl-Encode-4:2.97-3.el8.x86_64 26/55 + Installing : perl-Exporter-5.72-396.el8.noarch 27/55 + Installing : perl-Scalar-List-Utils-3:1.49-2.el8.x86_64 28/55 + Installing : perl-macros-4:5.26.3-421.el8.x86_64 29/55 + Installing : perl-parent-1:0.237-1.el8.noarch 30/55 + Installing : perl-Text-Tabs+Wrap-2013.0523-395.el8.noarch 31/55 + Installing : perl-Unicode-Normalize-1.25-396.el8.x86_64 32/55 + Installing : perl-File-Path-2.15-2.el8.noarch 33/55 + Installing : perl-IO-1.38-421.el8.x86_64 34/55 + Installing : perl-PathTools-3.74-1.el8.x86_64 35/55 + Installing : perl-constant-1.33-396.el8.noarch 36/55 + Installing : perl-threads-1:2.21-2.el8.x86_64 37/55 + Installing : perl-threads-shared-1.58-2.el8.x86_64 38/55 + Installing : perl-libs-4:5.26.3-421.el8.x86_64 39/55 + Installing : perl-Carp-1.42-396.el8.noarch 40/55 + Installing : perl-interpreter-4:5.26.3-421.el8.x86_64 41/55 + Installing : libjpeg-turbo-1.5.3-12.el8.x86_64 42/55 + Running scriptlet: nginx-filesystem-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 43/55 + Installing : nginx-filesystem-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 43/55 + Installing : libwebp-1.0.0-5.el8.x86_64 44/55 + Installing : libXpm-3.5.12-9.el8_7.x86_64 45/55 + Installing : jbigkit-libs-2.1-14.el8.x86_64 46/55 + Running scriptlet: jbigkit-libs-2.1-14.el8.x86_64 46/55 + Installing : libtiff-4.0.9-26.el8_7.x86_64 47/55 + Installing : gd-2.2.5-7.el8.x86_64 48/55 + Running scriptlet: gd-2.2.5-7.el8.x86_64 48/55 + Installing : nginx-mod-http-image-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 49/55 + Running scriptlet: nginx-mod-http-image-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 49/55 + Installing : nginx-mod-http-xslt-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 50/55 + Running scriptlet: nginx-mod-http-xslt-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 50/55 + Installing : nginx-mod-mail-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 51/55 + Running scriptlet: nginx-mod-mail-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 51/55 + Installing : nginx-mod-stream-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 52/55 + Running scriptlet: nginx-mod-stream-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 52/55 + Installing : nginx-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 53/55 + Running scriptlet: nginx-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 53/55 + Installing : nginx-mod-http-perl-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 54/55 + Running scriptlet: nginx-mod-http-perl-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 54/55 + Installing : nginx-all-modules-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 55/55 + Running scriptlet: nginx-all-modules-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 55/55 + Verifying : perl-Carp-1.42-396.el8.noarch 1/55 + Verifying : perl-Data-Dumper-2.167-399.el8.x86_64 2/55 + Verifying : perl-Encode-4:2.97-3.el8.x86_64 3/55 + Verifying : perl-Errno-1.28-421.el8.x86_64 4/55 + Verifying : perl-Exporter-5.72-396.el8.noarch 5/55 + Verifying : perl-File-Path-2.15-2.el8.noarch 6/55 + Verifying : perl-File-Temp-0.230.600-1.el8.noarch 7/55 + Verifying : perl-Getopt-Long-1:2.50-4.el8.noarch 8/55 + Verifying : perl-HTTP-Tiny-0.074-1.el8.noarch 9/55 + Verifying : perl-IO-1.38-421.el8.x86_64 10/55 + Verifying : perl-MIME-Base64-3.15-396.el8.x86_64 11/55 + Verifying : perl-PathTools-3.74-1.el8.x86_64 12/55 + Verifying : perl-Pod-Escapes-1:1.07-395.el8.noarch 13/55 + Verifying : perl-Pod-Perldoc-3.28-396.el8.noarch 14/55 + Verifying : perl-Pod-Simple-1:3.35-395.el8.noarch 15/55 + Verifying : perl-Pod-Usage-4:1.69-395.el8.noarch 16/55 + Verifying : perl-Scalar-List-Utils-3:1.49-2.el8.x86_64 17/55 + Verifying : perl-Socket-4:2.027-3.el8.x86_64 18/55 + Verifying : perl-Storable-1:3.11-3.el8.x86_64 19/55 + Verifying : perl-Term-ANSIColor-4.06-396.el8.noarch 20/55 + Verifying : perl-Term-Cap-1.17-395.el8.noarch 21/55 + Verifying : perl-Text-ParseWords-3.30-395.el8.noarch 22/55 + Verifying : perl-Text-Tabs+Wrap-2013.0523-395.el8.noarch 23/55 + Verifying : perl-Time-Local-1:1.280-1.el8.noarch 24/55 + Verifying : perl-Unicode-Normalize-1.25-396.el8.x86_64 25/55 + Verifying : perl-constant-1.33-396.el8.noarch 26/55 + Verifying : perl-interpreter-4:5.26.3-421.el8.x86_64 27/55 + Verifying : perl-libs-4:5.26.3-421.el8.x86_64 28/55 + Verifying : perl-macros-4:5.26.3-421.el8.x86_64 29/55 + Verifying : perl-parent-1:0.237-1.el8.noarch 30/55 + Verifying : perl-podlators-4.11-1.el8.noarch 31/55 + Verifying : perl-threads-1:2.21-2.el8.x86_64 32/55 + Verifying : perl-threads-shared-1.58-2.el8.x86_64 33/55 + Verifying : gd-2.2.5-7.el8.x86_64 34/55 + Verifying : jbigkit-libs-2.1-14.el8.x86_64 35/55 + Verifying : libXpm-3.5.12-9.el8_7.x86_64 36/55 + Verifying : libjpeg-turbo-1.5.3-12.el8.x86_64 37/55 + Verifying : libtiff-4.0.9-26.el8_7.x86_64 38/55 + Verifying : libwebp-1.0.0-5.el8.x86_64 39/55 + Verifying : nginx-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 40/55 + Verifying : nginx-all-modules-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 41/55 + Verifying : nginx-filesystem-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch 42/55 + Verifying : nginx-mod-http-image-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 43/55 + Verifying : nginx-mod-http-perl-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 44/55 + Verifying : nginx-mod-http-xslt-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 45/55 + Verifying : nginx-mod-mail-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 46/55 + Verifying : nginx-mod-stream-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 47/55 + Verifying : perl-Digest-1.17-395.el8.noarch 48/55 + Verifying : perl-Digest-MD5-2.55-396.el8.x86_64 49/55 + Verifying : perl-IO-Socket-IP-0.39-5.el8.noarch 50/55 + Verifying : perl-IO-Socket-SSL-2.066-4.module_el8.6.0+2811+fe6c84b0.noarch 51/55 + Verifying : perl-Mozilla-CA-20160104-7.module_el8.5.0+2812+ed912d05.noarch 52/55 + Verifying : perl-Net-SSLeay-1.88-2.module_el8.6.0+2811+fe6c84b0.x86_64 53/55 + Verifying : perl-URI-1.73-3.el8.noarch 54/55 + Verifying : perl-libnet-3.11-3.el8.noarch 55/55 + +Installed: + gd-2.2.5-7.el8.x86_64 + jbigkit-libs-2.1-14.el8.x86_64 + libXpm-3.5.12-9.el8_7.x86_64 + libjpeg-turbo-1.5.3-12.el8.x86_64 + libtiff-4.0.9-26.el8_7.x86_64 + libwebp-1.0.0-5.el8.x86_64 + nginx-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + nginx-all-modules-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch + nginx-filesystem-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.noarch + nginx-mod-http-image-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + nginx-mod-http-perl-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + nginx-mod-http-xslt-filter-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + nginx-mod-mail-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + nginx-mod-stream-1:1.14.1-9.module_el8.3.0+2165+af250afe.alma.x86_64 + perl-Carp-1.42-396.el8.noarch + perl-Data-Dumper-2.167-399.el8.x86_64 + perl-Digest-1.17-395.el8.noarch + perl-Digest-MD5-2.55-396.el8.x86_64 + perl-Encode-4:2.97-3.el8.x86_64 + perl-Errno-1.28-421.el8.x86_64 + perl-Exporter-5.72-396.el8.noarch + perl-File-Path-2.15-2.el8.noarch + perl-File-Temp-0.230.600-1.el8.noarch + perl-Getopt-Long-1:2.50-4.el8.noarch + perl-HTTP-Tiny-0.074-1.el8.noarch + perl-IO-1.38-421.el8.x86_64 + perl-IO-Socket-IP-0.39-5.el8.noarch + perl-IO-Socket-SSL-2.066-4.module_el8.6.0+2811+fe6c84b0.noarch + perl-MIME-Base64-3.15-396.el8.x86_64 + perl-Mozilla-CA-20160104-7.module_el8.5.0+2812+ed912d05.noarch + perl-Net-SSLeay-1.88-2.module_el8.6.0+2811+fe6c84b0.x86_64 + perl-PathTools-3.74-1.el8.x86_64 + perl-Pod-Escapes-1:1.07-395.el8.noarch + perl-Pod-Perldoc-3.28-396.el8.noarch + perl-Pod-Simple-1:3.35-395.el8.noarch + perl-Pod-Usage-4:1.69-395.el8.noarch + perl-Scalar-List-Utils-3:1.49-2.el8.x86_64 + perl-Socket-4:2.027-3.el8.x86_64 + perl-Storable-1:3.11-3.el8.x86_64 + perl-Term-ANSIColor-4.06-396.el8.noarch + perl-Term-Cap-1.17-395.el8.noarch + perl-Text-ParseWords-3.30-395.el8.noarch + perl-Text-Tabs+Wrap-2013.0523-395.el8.noarch + perl-Time-Local-1:1.280-1.el8.noarch + perl-URI-1.73-3.el8.noarch + perl-Unicode-Normalize-1.25-396.el8.x86_64 + perl-constant-1.33-396.el8.noarch + perl-interpreter-4:5.26.3-421.el8.x86_64 + perl-libnet-3.11-3.el8.noarch + perl-libs-4:5.26.3-421.el8.x86_64 + perl-macros-4:5.26.3-421.el8.x86_64 + perl-parent-1:0.237-1.el8.noarch + perl-podlators-4.11-1.el8.noarch + perl-threads-1:2.21-2.el8.x86_64 + perl-threads-shared-1.58-2.el8.x86_64 + +Complete! +``` + +### ➡️ Test installation +``` +nginx -v +``` + +Expected output: +``` +nginx version: nginx/1.14.1 +``` + +### 🔖 Variant II: AppStream Module Install + +To install the latest module version of Nginx on AlmaLinux (8.7 in the example below) you can list available module versions (streams) and then install ("enable" for modules) selected version. + + +### ➡️ Pre-Install: list versions + +``` +sudo dnf module list nginx +``` + +Example output (pre-install): +``` +AlmaLinux 8 - AppStream 5.0 kB/s | 4.1 kB 00:00 +AlmaLinux 8 - AppStream 6.3 MB/s | 12 MB 00:01 +AlmaLinux 8 - Extras 4.2 kB/s | 3.8 kB 00:00 +AlmaLinux 8 - Extras 21 kB/s | 19 kB 00:00 +Extra Packages for Enterprise Linux 8 - x86_64 11 kB/s | 28 kB 00:02 +Extra Packages for Enterprise Linux 8 - x86_64 6.5 MB/s | 14 MB 00:02 +Symas OpenLDAP for Linux RPM repository 4.2 kB/s | 2.9 kB 00:00 +AlmaLinux 8 - AppStream +Name Stream Profiles Summary +nginx 1.14 [d][x] common [d] nginx webserver +nginx 1.16 [x] common [d] nginx webserver +nginx 1.18 [x] common [d] nginx webserver +nginx 1.20 [x] common [d] nginx webserver + +Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled +``` + +### ➡️ Install: enable the selected module version + +``` +sudo dnf module enable nginx:1.20 +``` + +Example output (module enable)): +``` +Last metadata expiration check: 0:00:44 ago on Thu 13 Apr 2023 09:06:58 PM EDT. +Dependencies resolved. +================================================================================================================================ + Package Architecture Version Repository Size +================================================================================================================================ +Enabling module streams: + nginx 1.20 + +Transaction Summary +================================================================================================================================ + +Is this ok [y/N]: y +Complete! +``` + +### ➡️ Install: actual package installation + +``` +sudo dnf install nginx +``` + +Expected output (install): +:::warning +TODO: EXAMPLE IS MISSING! +:::s + +### ➡️ Test installation + +``` +nginx -v +``` + +Expected output (test) +``` +nginx version: nginx/1.20.1 +``` + +:::warning +Note: If you switch between different versions of a module, you may need to reset its state using the command `dnf module reset ` to enable installing another version. + +In Nginx case `` is `nginx`. +::: + + +### 🔖 Variant III: Main-line Repository Install + +To install the latest RPM package of Nginx on AlmaLinux (8.7 in example below) from the official Nginx repository (https://nginx.org), you can follow these steps: + + +### ➡️ Add the repository + +**Import the Nginx signing key** +``` +sudo rpm --import https://nginx.org/keys/nginx_signing.key +``` +**Create a new Nginx repository file in the /etc/yum.repos.d/ directory with editor of choice** +``` +sudo tee /etc/yum.repos.d/nginx.repo +``` +** Populate the new repo file with below text (copy-paste & press `Ctrl+D`)** +``` +[nginx-mainline] +name=nginx mainline repo +baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ +gpgcheck=1 +enabled=0 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true +``` + +::: tip +When editing the file, you can change `enabled=0` setting it to `1`. With that change you can skip next two steps (installing `dnf-utils` and running `dnf config-manager`). +::: + +### ➡️ Install `dnf-uils` + +``` +sudo dnf install dnf-utils +``` + +**Enable the newly add external repo from nginx.org:** +``` +sudo dnf config-manager --enable nginx-mainline +``` + +**Finally, install Nginx:** +``` +sudo dnf install nginx +``` + +Example output: + +With the official Nginx mainline repo enabled `dnf` allows to install the latest available: `1.23.3`. + +``` +nginx stable repo 24 kB/s | 2.9 kB 00:00 +nginx mainline repo 39 kB/s | 2.9 kB 00:00 +Dependencies resolved. +================================================================================================================================ + Package Architecture Version Repository Size +================================================================================================================================ +Installing: + nginx x86_64 1:1.23.3-1.el8.ngx nginx-mainline 834 k + +Transaction Summary +================================================================================================================================ +Install 1 Package + +Total download size: 834 k +Installed size: 2.8 M +Is this ok [y/N]: y +Downloading Packages: +nginx-1.23.3-1.el8.ngx.x86_64.rpm 2.9 MB/s | 834 kB 00:00 +-------------------------------------------------------------------------------------------------------------------------------- +Total 2.9 MB/s | 834 kB 00:00 +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Running scriptlet: nginx-1:1.23.3-1.el8.ngx.x86_64 1/1 + Installing : nginx-1:1.23.3-1.el8.ngx.x86_64 1/1 + Running scriptlet: nginx-1:1.23.3-1.el8.ngx.x86_64 1/1 +---------------------------------------------------------------------- + +Thanks for using nginx! + +Please find the official documentation for nginx here: +* https://nginx.org/en/docs/ + +Please subscribe to nginx-announce mailing list to get +the most important news about nginx: +* https://nginx.org/en/support.html + +Commercial subscriptions for nginx are available on: +* https://nginx.com/products/ + +---------------------------------------------------------------------- + + Verifying : nginx-1:1.23.3-1.el8.ngx.x86_64 1/1 + +Installed: + nginx-1:1.23.3-1.el8.ngx.x86_64 + +Complete! +``` + +### ➡️ Test +``` +nginx -v +``` + +Expected output (test): +``` +nginx version: nginx/1.23.3 +``` + +## 📚 Further reading and Next Steps + +Get Back: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](NginxSeriesA01.md) + +In-depth Resources: +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.1 Installation](NginxSeriesA02R91.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.2 Installation](NginxSeriesA02R92.md) +- AlmaLinux Nginx Series ❯ [Default Configuration Guide](NginxSeriesA03.md) +- AlmaLinux Nginx Series ❯ [Secure Nginx Deployment](NginxSeriesA04P1.md) + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) + + + diff --git a/docs/series/nginx/NginxSeriesA02R91.md b/docs/series/nginx/NginxSeriesA02R91.md new file mode 100644 index 000000000..b8289897b --- /dev/null +++ b/docs/series/nginx/NginxSeriesA02R91.md @@ -0,0 +1,240 @@ +# A02 R91 ❯ AlmaLinux 9.1 Installation +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-15 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ +## 🌟 Introduction +This is a dedicated example for the **AlmaLinux 9.x series**, demonstrating how to install Nginx using one of the two variants: + +- Variant I: AppStream non-module +- Variant III¹: Nginx mainline repository + +¹ - Variant II omitted by purpose. + +## 📝 Installation instructions + +### System Updates First! + +::: warning +Please make sure to run **`sudo dnf update`** before proceeding with any other installation or configuration steps to ensure that your system is up-to-date and any known security vulnerabilities or bugs are patched. +::: + + +### 📖 Available Nginx Versions (AlmaLinux OS 9.1) +Different Nginx server versions are available to install depending on the installation variant. + +| |Installation Variant | Nginx Versions available | Notes | +|-|------------------------|--------------------------|---------------| +|🟩| AppStream non-module | 1.20.1 | Default version is good bu | +|❌| AppStream module | Not Available | AppStream module method is not available on 9.1. | +|🟨| Nginx mainline repo | 1.21.6 -- 1.23.4¹ | You always get latest version of Nginx avaiable. Second good (small chance of incompatibilty). | + +¹ current version at the time of testing. + +Architecture Compatibility +| Architecture | Supported | +|-----|----| +| Aarch64 | ✅ | +| PowerPC | ❌ | +| S390X | ✅ | +| X86_64 | ✅ | + + +### 🔖 Variant I: AppStream Non-module Install + +#### Example + +### ➡️ Install +``` +sudo dnf install nginx +``` +➡️ Example output +``` +Last metadata expiration check: 0:01:47 ago on Fri 14 Apr 2023 02:57:10 AM CEST. +Dependencies resolved. +================================================================================================================ + Package Architecture Version Repository Size +================================================================================================================ +Installing: + nginx x86_64 1:1.20.1-13.el9.alma appstream 38 k +Installing dependencies: + almalinux-logos-httpd noarch 90.5.1-1.1.el9 appstream 18 k + nginx-core x86_64 1:1.20.1-13.el9.alma appstream 567 k + nginx-filesystem noarch 1:1.20.1-13.el9.alma appstream 11 k + +Transaction Summary +================================================================================================================ +Install 4 Packages + +Total download size: 634 k +Installed size: 1.8 M +Is this ok [y/N]: y +Downloading Packages: +(1/4): almalinux-logos-httpd-90.5.1-1.1.el9.noarch.rpm 9.9 kB/s | 18 kB 00:01 +(2/4): nginx-1.20.1-13.el9.alma.x86_64.rpm 21 kB/s | 38 kB 00:01 +(3/4): nginx-filesystem-1.20.1-13.el9.alma.noarch.rpm 243 kB/s | 11 kB 00:00 +(4/4): nginx-core-1.20.1-13.el9.alma.x86_64.rpm 294 kB/s | 567 kB 00:01 +---------------------------------------------------------------------------------------------------------------- +Total 216 kB/s | 634 kB 00:02 +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Running scriptlet: nginx-filesystem-1:1.20.1-13.el9.alma.noarch 1/4 + Installing : nginx-filesystem-1:1.20.1-13.el9.alma.noarch 1/4 + Installing : nginx-core-1:1.20.1-13.el9.alma.x86_64 2/4 + Installing : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 3/4 + Installing : nginx-1:1.20.1-13.el9.alma.x86_64 4/4 + Running scriptlet: nginx-1:1.20.1-13.el9.alma.x86_64 4/4 + Verifying : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 1/4 + Verifying : nginx-1:1.20.1-13.el9.alma.x86_64 2/4 + Verifying : nginx-core-1:1.20.1-13.el9.alma.x86_64 3/4 + Verifying : nginx-filesystem-1:1.20.1-13.el9.alma.noarch 4/4 + +Installed: + almalinux-logos-httpd-90.5.1-1.1.el9.noarch nginx-1:1.20.1-13.el9.alma.x86_64 + nginx-core-1:1.20.1-13.el9.alma.x86_64 nginx-filesystem-1:1.20.1-13.el9.alma.noarch + +Complete! +``` + + +### 🔖 Variant II: AppStream Module Install + +This method is not available on AlmaLinux 9.1 (Lime Lynx) -- there is no AppStream module version of Nginx in RHEL repos. + +### 🔖 Variant III: Main-line Repository Install + +#### Example + +### ➡️ Import the Nginx signing key +``` +sudo rpm --import https://nginx.org/keys/nginx_signing.key +``` + +### ➡️ Create a repo definition file for Nginx +``` +sudo tee /etc/yum.repos.d/nginx.repo +``` +### ➡️ Populate the new repo file with below text (copy-paste & `Ctrl+D`) +``` +[nginx-mainline] +name=nginx mainline repo +baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ +gpgcheck=1 +enabled=0 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true +``` + +### ➡️ Install `dnf-uils` + +:::warning +ℹ️ `dnf-utils` are repo managment tools (classic YUM utilities implemented as CLI shims on top of DNF) +::: + +``` +sudo dnf install dnf-utils +``` + +### ➡️ Enable the repository +``` +dnf config-manager --enable nginx-mainline +``` + +### ➡️ Enable/install the module +``` +sudo dnf install nginx +``` + +➡️ Example output (install) +``` +nginx mainline repo 30 kB/s | 22 kB 00:00 +Dependencies resolved. +======================================================================================================================================================================================== + Package Architecture Version Repository Size +======================================================================================================================================================================================== +Installing: + nginx x86_64 1:1.23.4-1.el9.ngx nginx-mainline 868 k + +Transaction Summary +======================================================================================================================================================================================== +Install 1 Package + +Total download size: 868 k +Installed size: 3.0 M +Is this ok [y/N]: y +Downloading Packages: +nginx-1.23.4-1.el9.ngx.x86_64.rpm 67 kB/s | 868 kB 00:12 +---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- +Total 67 kB/s | 868 kB 00:12 +nginx mainline repo 5.9 kB/s | 1.5 kB 00:00 +Importing GPG key 0x7BD9BF62: + Userid : "nginx signing key " + Fingerprint: 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62 + From : https://nginx.org/keys/nginx_signing.key +Is this ok [y/N]: y +Key imported successfully +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Running scriptlet: nginx-1:1.23.4-1.el9.ngx.x86_64 1/1 + Installing : nginx-1:1.23.4-1.el9.ngx.x86_64 1/1 + Running scriptlet: nginx-1:1.23.4-1.el9.ngx.x86_64 1/1 +---------------------------------------------------------------------- + +Thanks for using nginx! + +Please find the official documentation for nginx here: +* https://nginx.org/en/docs/ + +Please subscribe to nginx-announce mailing list to get +the most important news about nginx: +* https://nginx.org/en/support.html + +Commercial subscriptions for nginx are available on: +* https://nginx.com/products/ + +---------------------------------------------------------------------- + + Verifying : nginx-1:1.23.4-1.el9.ngx.x86_64 1/1 + +Installed: + nginx-1:1.23.4-1.el9.ngx.x86_64 + +Complete! +``` + +### ➡️ Test +``` +nginx -v +``` + +Expected output (test): +``` +nginx version: nginx/1.23.4 +``` + +## 📚 Further reading and Next Steps + +Get Back: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](NginxSeriesA01.md) + +In-depth Resources: +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 8.x Installation](NginxSeriesA02R8.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.2 Installation](NginxSeriesA02R92.md) +- AlmaLinux Nginx Series ❯ [Default Configuration Guide](NginxSeriesA03.md) +- AlmaLinux Nginx Series ❯ [Secure Nginx Deployment](NginxSeriesA04P1.md) + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) diff --git a/docs/series/nginx/NginxSeriesA02R92.md b/docs/series/nginx/NginxSeriesA02R92.md new file mode 100644 index 000000000..726da38ac --- /dev/null +++ b/docs/series/nginx/NginxSeriesA02R92.md @@ -0,0 +1,738 @@ +# A02 R92 ❯ AlmaLinux 9.2 Installation +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-06-03 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.2 \| x86_64 \| 2023-06-03 | +
+ +## 🌟 Introduction +This is a dedicated example for the **AlmaLinux 9.x series**, demonstrating how to install Nginx using one of the two variants: + +- Variant I: AppStream non-module +- Variant II: AppStream module +- Variant III: Nginx mainline repository + +## 📝 Installation instructions + +### System Updates First! + +::: warning +Please make sure to run **`sudo dnf update`** before proceeding with any other installation or configuration steps to ensure that your system is up-to-date and any known security vulnerabilities or bugs are patched. +::: + + +### 📖 Available Nginx Versions (AlmaLinux OS 9.2) +Different Nginx server versions are available to install depending on the installation variant. + +| |Installation Variant | Nginx Versions available | Notes | +|-|------------------------|--------------------------|---------------| +|🟨| AppStream non-module | 1.20.1 | Default version is outdated and does not get updates! Inadvisable. | +|🟩| AppStream module | 1.22 | Module version are getting the security updates. **The recommended method**. | +|🟩| Nginx mainline repo | 1.22.2 -- 1.25.0¹ | You always get latest version of Nginx avaiable. Second good (small chance of incompatibilty). | + +¹ current version at the time of testing. + +Architecture Compatibility +| Architecture | Supported | +|-----|----| +| Aarch64 | ✅ | +| PowerPC | ❌ | +| S390X | ✅ | +| X86_64 | ✅ | + + +### 🔖 Variant I: AppStream Non-module Install + +#### Example + +### ➡️ Install + +``` +sudo dnf install nginx +``` + +Expected output (install): +``` +Last metadata expiration check: 0:26:09 ago on Fri Jun 2 20:17:44 2023. +Dependencies resolved. +================================================================================================================================================================== + Package Architecture Version Repository Size +================================================================================================================================================================== +Installing: + nginx x86_64 1:1.20.1-14.el9.alma appstream 38 k +Installing dependencies: + almalinux-logos-httpd noarch 90.5.1-1.1.el9 appstream 18 k + nginx-core x86_64 1:1.20.1-14.el9.alma appstream 567 k + nginx-filesystem noarch 1:1.20.1-14.el9.alma appstream 11 k + +Transaction Summary +================================================================================================================================================================== +Install 4 Packages + +Total download size: 634 k +Installed size: 1.8 M +Is this ok [y/N]: y +Downloading Packages: +(1/4): almalinux-logos-httpd-90.5.1-1.1.el9.noarch.rpm 85 kB/s | 18 kB 00:00 +(2/4): nginx-1.20.1-14.el9.alma.x86_64.rpm 169 kB/s | 38 kB 00:00 +(3/4): nginx-filesystem-1.20.1-14.el9.alma.noarch.rpm 396 kB/s | 11 kB 00:00 +(4/4): nginx-core-1.20.1-14.el9.alma.x86_64.rpm 2.0 MB/s | 567 kB 00:00 +------------------------------------------------------------------------------------------------------------------------------------------------------------------ +Total 738 kB/s | 634 kB 00:00 +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Running scriptlet: nginx-filesystem-1:1.20.1-14.el9.alma.noarch 1/4 + Installing : nginx-filesystem-1:1.20.1-14.el9.alma.noarch 1/4 + Installing : nginx-core-1:1.20.1-14.el9.alma.x86_64 2/4 + Installing : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 3/4 + Installing : nginx-1:1.20.1-14.el9.alma.x86_64 4/4 + Running scriptlet: nginx-1:1.20.1-14.el9.alma.x86_64 4/4 + Verifying : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 1/4 + Verifying : nginx-1:1.20.1-14.el9.alma.x86_64 2/4 + Verifying : nginx-core-1:1.20.1-14.el9.alma.x86_64 3/4 + Verifying : nginx-filesystem-1:1.20.1-14.el9.alma.noarch 4/4 + +Installed: + almalinux-logos-httpd-90.5.1-1.1.el9.noarch nginx-1:1.20.1-14.el9.alma.x86_64 nginx-core-1:1.20.1-14.el9.alma.x86_64 + nginx-filesystem-1:1.20.1-14.el9.alma.noarch + +Complete! +``` + +### ➡️ Test installation + +``` +nginx -v +``` + +Expected output (test): +``` +nginx version: nginx/1.20.1 +``` + + +### 🔖Variant II: AppStream Module Install + +``` +sudo dnf module list nginx +``` + +Expected output (module list): +``` +Last metadata expiration check: 0:30:09 ago on Fri Jun 2 20:17:44 2023. +AlmaLinux 9 - AppStream +Name Stream Profiles Summary +nginx 1.22 [x] common [d] nginx webserver + +Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled +``` + + +### ➡️ Install: enable the selected module version + +``` +sudo dnf module enable nginx:1.22 +``` + +Example output (module enable): +``` +Last metadata expiration check: 0:33:47 ago on Fri Jun 2 20:17:44 2023. +Dependencies resolved. +================================================================================================================================================================== + Package Architecture Version Repository Size +================================================================================================================================================================== +Enabling module streams: + nginx 1.22 + +Transaction Summary +================================================================================================================================================================== + +Is this ok [y/N]: y +Complete! +``` + +### ➡️ Install: actual package installation + +``` +sudo dnf install nginx +``` + +Example output (install): +``` +Last metadata expiration check: 0:34:39 ago on Fri Jun 2 20:17:44 2023. +Dependencies resolved. +================================================================================================================================================================== + Package Architecture Version Repository Size +================================================================================================================================================================== +Installing group/module packages: + nginx x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 39 k + nginx-all-modules noarch 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 10 k + nginx-filesystem noarch 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 11 k + nginx-mod-http-image-filter x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 22 k + nginx-mod-http-perl x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 33 k + nginx-mod-http-xslt-filter x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 20 k + nginx-mod-mail x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 55 k + nginx-mod-stream x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 81 k +Installing dependencies: + almalinux-logos-httpd noarch 90.5.1-1.1.el9 appstream 18 k + dejavu-sans-fonts noarch 2.37-18.el9 baseos 1.3 M + fontconfig x86_64 2.14.0-2.el9_1 appstream 274 k + gd x86_64 2.3.2-3.el9 appstream 131 k + jbigkit-libs x86_64 2.1-23.el9 appstream 52 k + langpacks-core-font-en noarch 3.0-16.el9 appstream 9.4 k + libX11 x86_64 1.7.0-7.el9 appstream 646 k + libX11-common noarch 1.7.0-7.el9 appstream 152 k + libXau x86_64 1.0.9-8.el9 appstream 30 k + libXpm x86_64 3.5.13-8.el9_1 appstream 57 k + libtiff x86_64 4.4.0-7.el9 appstream 195 k + libwebp x86_64 1.2.0-6.el9_1 appstream 275 k + libxcb x86_64 1.13.1-9.el9 appstream 225 k + libxslt x86_64 1.1.34-9.el9 appstream 240 k + nginx-core x86_64 1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma appstream 573 k + perl-AutoLoader noarch 5.74-480.el9 appstream 21 k + perl-B x86_64 1.80-480.el9 appstream 179 k + perl-Carp noarch 1.50-460.el9 appstream 29 k + perl-Class-Struct noarch 0.66-480.el9 appstream 22 k + perl-Data-Dumper x86_64 2.174-462.el9 appstream 55 k + perl-Digest noarch 1.19-4.el9 appstream 25 k + perl-Digest-MD5 x86_64 2.58-4.el9 appstream 36 k + perl-Encode x86_64 4:3.08-462.el9 appstream 1.7 M + perl-Errno x86_64 1.30-480.el9 appstream 15 k + perl-Exporter noarch 5.74-461.el9 appstream 31 k + perl-Fcntl x86_64 1.13-480.el9 appstream 20 k + perl-File-Basename noarch 2.85-480.el9 appstream 17 k + perl-File-Path noarch 2.18-4.el9 appstream 35 k + perl-File-Temp noarch 1:0.231.100-4.el9 appstream 59 k + perl-File-stat noarch 1.09-480.el9 appstream 17 k + perl-FileHandle noarch 2.03-480.el9 appstream 16 k + perl-Getopt-Long noarch 1:2.52-4.el9 appstream 59 k + perl-Getopt-Std noarch 1.12-480.el9 appstream 16 k + perl-HTTP-Tiny noarch 0.076-460.el9 appstream 54 k + perl-IO x86_64 1.43-480.el9 appstream 86 k + perl-IO-Socket-IP noarch 0.41-5.el9 appstream 42 k + perl-IPC-Open3 noarch 1.21-480.el9 appstream 23 k + perl-MIME-Base64 x86_64 3.16-4.el9 appstream 30 k + perl-Net-SSLeay x86_64 1.92-2.el9 appstream 364 k + perl-POSIX x86_64 1.94-480.el9 appstream 96 k + perl-PathTools x86_64 3.78-461.el9 appstream 85 k + perl-Pod-Escapes noarch 1:1.07-460.el9 appstream 20 k + perl-Pod-Perldoc noarch 3.28.01-461.el9 appstream 83 k + perl-Pod-Simple noarch 1:3.42-4.el9 appstream 215 k + perl-Pod-Usage noarch 4:2.01-4.el9 appstream 40 k + perl-Scalar-List-Utils x86_64 4:1.56-461.el9 appstream 71 k + perl-SelectSaver noarch 1.02-480.el9 appstream 12 k + perl-Socket x86_64 4:2.031-4.el9 appstream 54 k + perl-Storable x86_64 1:3.21-460.el9 appstream 95 k + perl-Symbol noarch 1.08-480.el9 appstream 14 k + perl-Term-ANSIColor noarch 5.01-461.el9 appstream 48 k + perl-Term-Cap noarch 1.17-460.el9 appstream 22 k + perl-Text-ParseWords noarch 3.30-460.el9 appstream 16 k + perl-Text-Tabs+Wrap noarch 2013.0523-460.el9 appstream 22 k + perl-Time-Local noarch 2:1.300-7.el9 appstream 33 k + perl-URI noarch 5.09-3.el9 appstream 108 k + perl-base noarch 2.27-480.el9 appstream 16 k + perl-constant noarch 1.33-461.el9 appstream 23 k + perl-if noarch 0.60.800-480.el9 appstream 14 k + perl-interpreter x86_64 4:5.32.1-480.el9 appstream 71 k + perl-libnet noarch 3.13-4.el9 appstream 125 k + perl-libs x86_64 4:5.32.1-480.el9 appstream 2.0 M + perl-mro x86_64 1.23-480.el9 appstream 28 k + perl-overload noarch 1.31-480.el9 appstream 46 k + perl-overloading noarch 0.02-480.el9 appstream 13 k + perl-parent noarch 1:0.238-460.el9 appstream 14 k + perl-podlators noarch 1:4.14-460.el9 appstream 111 k + perl-subs noarch 1.03-480.el9 appstream 12 k + perl-vars noarch 1.05-480.el9 appstream 13 k + xml-common noarch 0.6.3-58.el9 appstream 31 k +Installing weak dependencies: + perl-IO-Socket-SSL noarch 2.073-1.el9 appstream 216 k + perl-Mozilla-CA noarch 20200520-6.el9 appstream 12 k + perl-NDBM_File x86_64 1.15-480.el9 appstream 22 k +Installing module profiles: + nginx/common + +Transaction Summary +================================================================================================================================================================== +Install 81 Packages + +Total download size: 11 M +Installed size: 40 M +Is this ok [y/N]: y +Downloading Packages: +(1/81): almalinux-logos-httpd-90.5.1-1.1.el9.noarch.rpm 91 kB/s | 18 kB 00:00 +(2/81): jbigkit-libs-2.1-23.el9.x86_64.rpm 759 kB/s | 52 kB 00:00 +(3/81): fontconfig-2.14.0-2.el9_1.x86_64.rpm 1.0 MB/s | 274 kB 00:00 +(4/81): gd-2.3.2-3.el9.x86_64.rpm 482 kB/s | 131 kB 00:00 +(5/81): langpacks-core-font-en-3.0-16.el9.noarch.rpm 114 kB/s | 9.4 kB 00:00 +(6/81): libX11-1.7.0-7.el9.x86_64.rpm 4.5 MB/s | 646 kB 00:00 +(7/81): libX11-common-1.7.0-7.el9.noarch.rpm 1.0 MB/s | 152 kB 00:00 +(8/81): libXau-1.0.9-8.el9.x86_64.rpm 455 kB/s | 30 kB 00:00 +(9/81): libXpm-3.5.13-8.el9_1.x86_64.rpm 2.0 MB/s | 57 kB 00:00 +(10/81): libtiff-4.4.0-7.el9.x86_64.rpm 3.3 MB/s | 195 kB 00:00 +(11/81): libwebp-1.2.0-6.el9_1.x86_64.rpm 3.3 MB/s | 275 kB 00:00 +(12/81): libxcb-1.13.1-9.el9.x86_64.rpm 2.7 MB/s | 225 kB 00:00 +(13/81): libxslt-1.1.34-9.el9.x86_64.rpm 3.6 MB/s | 240 kB 00:00 +(14/81): nginx-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 794 kB/s | 39 kB 00:00 +(15/81): nginx-all-modules-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch.rpm 315 kB/s | 10 kB 00:00 +(16/81): nginx-core-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 8.0 MB/s | 573 kB 00:00 +(17/81): nginx-filesystem-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch.rpm 163 kB/s | 11 kB 00:00 +(18/81): nginx-mod-http-image-filter-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 365 kB/s | 22 kB 00:00 +(19/81): nginx-mod-http-perl-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 1.4 MB/s | 33 kB 00:00 +(20/81): nginx-mod-http-xslt-filter-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 896 kB/s | 20 kB 00:00 +(21/81): nginx-mod-mail-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 2.0 MB/s | 55 kB 00:00 +(22/81): nginx-mod-stream-1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64.rpm 2.4 MB/s | 81 kB 00:00 +(23/81): perl-AutoLoader-5.74-480.el9.noarch.rpm 651 kB/s | 21 kB 00:00 +(24/81): perl-B-1.80-480.el9.x86_64.rpm 3.8 MB/s | 179 kB 00:00 +(25/81): perl-Carp-1.50-460.el9.noarch.rpm 1.4 MB/s | 29 kB 00:00 +(26/81): perl-Class-Struct-0.66-480.el9.noarch.rpm 760 kB/s | 22 kB 00:00 +(27/81): perl-Data-Dumper-2.174-462.el9.x86_64.rpm 1.4 MB/s | 55 kB 00:00 +(28/81): perl-Digest-1.19-4.el9.noarch.rpm 621 kB/s | 25 kB 00:00 +(29/81): perl-Digest-MD5-2.58-4.el9.x86_64.rpm 1.0 MB/s | 36 kB 00:00 +(30/81): perl-Errno-1.30-480.el9.x86_64.rpm 103 kB/s | 15 kB 00:00 +(31/81): perl-Exporter-5.74-461.el9.noarch.rpm 209 kB/s | 31 kB 00:00 +(32/81): perl-Fcntl-1.13-480.el9.x86_64.rpm 245 kB/s | 20 kB 00:00 +(33/81): perl-File-Basename-2.85-480.el9.noarch.rpm 200 kB/s | 17 kB 00:00 +(34/81): perl-Encode-3.08-462.el9.x86_64.rpm 6.6 MB/s | 1.7 MB 00:00 +(35/81): perl-File-Path-2.18-4.el9.noarch.rpm 1.1 MB/s | 35 kB 00:00 +(36/81): perl-File-Temp-0.231.100-4.el9.noarch.rpm 1.8 MB/s | 59 kB 00:00 +(37/81): perl-File-stat-1.09-480.el9.noarch.rpm 750 kB/s | 17 kB 00:00 +(38/81): perl-FileHandle-2.03-480.el9.noarch.rpm 700 kB/s | 16 kB 00:00 +(39/81): perl-Getopt-Long-2.52-4.el9.noarch.rpm 2.8 MB/s | 59 kB 00:00 +(40/81): perl-Getopt-Std-1.12-480.el9.noarch.rpm 770 kB/s | 16 kB 00:00 +(41/81): perl-HTTP-Tiny-0.076-460.el9.noarch.rpm 2.3 MB/s | 54 kB 00:00 +(42/81): perl-IO-1.43-480.el9.x86_64.rpm 1.6 MB/s | 86 kB 00:00 +(43/81): perl-IO-Socket-IP-0.41-5.el9.noarch.rpm 749 kB/s | 42 kB 00:00 +(44/81): perl-IO-Socket-SSL-2.073-1.el9.noarch.rpm 2.5 MB/s | 216 kB 00:00 +(45/81): perl-IPC-Open3-1.21-480.el9.noarch.rpm 471 kB/s | 23 kB 00:00 +(46/81): perl-MIME-Base64-3.16-4.el9.x86_64.rpm 675 kB/s | 30 kB 00:00 +(47/81): perl-Mozilla-CA-20200520-6.el9.noarch.rpm 591 kB/s | 12 kB 00:00 +(48/81): perl-NDBM_File-1.15-480.el9.x86_64.rpm 938 kB/s | 22 kB 00:00 +(49/81): perl-Net-SSLeay-1.92-2.el9.x86_64.rpm 6.6 MB/s | 364 kB 00:00 +(50/81): perl-POSIX-1.94-480.el9.x86_64.rpm 2.2 MB/s | 96 kB 00:00 +(51/81): perl-PathTools-3.78-461.el9.x86_64.rpm 1.8 MB/s | 85 kB 00:00 +(52/81): perl-Pod-Escapes-1.07-460.el9.noarch.rpm 976 kB/s | 20 kB 00:00 +(53/81): perl-Pod-Perldoc-3.28.01-461.el9.noarch.rpm 3.5 MB/s | 83 kB 00:00 +(54/81): perl-Pod-Simple-3.42-4.el9.noarch.rpm 4.3 MB/s | 215 kB 00:00 +(55/81): perl-Pod-Usage-2.01-4.el9.noarch.rpm 876 kB/s | 40 kB 00:00 +(56/81): perl-Scalar-List-Utils-1.56-461.el9.x86_64.rpm 1.7 MB/s | 71 kB 00:00 +(57/81): perl-SelectSaver-1.02-480.el9.noarch.rpm 501 kB/s | 12 kB 00:00 +(58/81): perl-Socket-2.031-4.el9.x86_64.rpm 2.0 MB/s | 54 kB 00:00 +(59/81): perl-Storable-3.21-460.el9.x86_64.rpm 3.1 MB/s | 95 kB 00:00 +(60/81): perl-Symbol-1.08-480.el9.noarch.rpm 621 kB/s | 14 kB 00:00 +(61/81): perl-Term-ANSIColor-5.01-461.el9.noarch.rpm 2.0 MB/s | 48 kB 00:00 +(62/81): perl-Term-Cap-1.17-460.el9.noarch.rpm 1.0 MB/s | 22 kB 00:00 +(63/81): perl-Text-ParseWords-3.30-460.el9.noarch.rpm 683 kB/s | 16 kB 00:00 +(64/81): perl-Text-Tabs+Wrap-2013.0523-460.el9.noarch.rpm 1.0 MB/s | 22 kB 00:00 +(65/81): perl-Time-Local-1.300-7.el9.noarch.rpm 1.4 MB/s | 33 kB 00:00 +(66/81): perl-URI-5.09-3.el9.noarch.rpm 3.5 MB/s | 108 kB 00:00 +(67/81): perl-base-2.27-480.el9.noarch.rpm 513 kB/s | 16 kB 00:00 +(68/81): perl-constant-1.33-461.el9.noarch.rpm 928 kB/s | 23 kB 00:00 +(69/81): perl-if-0.60.800-480.el9.noarch.rpm 689 kB/s | 14 kB 00:00 +(70/81): perl-interpreter-5.32.1-480.el9.x86_64.rpm 3.1 MB/s | 71 kB 00:00 +(71/81): perl-libnet-3.13-4.el9.noarch.rpm 3.8 MB/s | 125 kB 00:00 +(72/81): perl-mro-1.23-480.el9.x86_64.rpm 311 kB/s | 28 kB 00:00 +(73/81): perl-overload-1.31-480.el9.noarch.rpm 547 kB/s | 46 kB 00:00 +(74/81): perl-overloading-0.02-480.el9.noarch.rpm 161 kB/s | 13 kB 00:00 +(75/81): perl-parent-0.238-460.el9.noarch.rpm 176 kB/s | 14 kB 00:00 +(76/81): perl-libs-5.32.1-480.el9.x86_64.rpm 9.5 MB/s | 2.0 MB 00:00 +(77/81): perl-podlators-4.14-460.el9.noarch.rpm 2.8 MB/s | 111 kB 00:00 +(78/81): perl-subs-1.03-480.el9.noarch.rpm 249 kB/s | 12 kB 00:00 +(79/81): perl-vars-1.05-480.el9.noarch.rpm 253 kB/s | 13 kB 00:00 +(80/81): xml-common-0.6.3-58.el9.noarch.rpm 510 kB/s | 31 kB 00:00 +(81/81): dejavu-sans-fonts-2.37-18.el9.noarch.rpm 7.6 MB/s | 1.3 MB 00:00 +------------------------------------------------------------------------------------------------------------------------------------------------------------------ +Total 4.0 MB/s | 11 MB 00:02 +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Installing : dejavu-sans-fonts-2.37-18.el9.noarch 1/81 + Running scriptlet: nginx-filesystem-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 2/81 + Installing : nginx-filesystem-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 2/81 + Installing : libwebp-1.2.0-6.el9_1.x86_64 3/81 + Installing : nginx-core-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 4/81 + Installing : langpacks-core-font-en-3.0-16.el9.noarch 5/81 + Installing : perl-Digest-1.19-4.el9.noarch 6/81 + Installing : perl-Digest-MD5-2.58-4.el9.x86_64 7/81 + Installing : perl-B-1.80-480.el9.x86_64 8/81 + Installing : perl-FileHandle-2.03-480.el9.noarch 9/81 + Installing : perl-Data-Dumper-2.174-462.el9.x86_64 10/81 + Installing : perl-libnet-3.13-4.el9.noarch 11/81 + Installing : perl-AutoLoader-5.74-480.el9.noarch 12/81 + Installing : perl-base-2.27-480.el9.noarch 13/81 + Installing : perl-URI-5.09-3.el9.noarch 14/81 + Installing : perl-Net-SSLeay-1.92-2.el9.x86_64 15/81 + Installing : perl-Mozilla-CA-20200520-6.el9.noarch 16/81 + Installing : perl-if-0.60.800-480.el9.noarch 17/81 + Installing : perl-IO-Socket-IP-0.41-5.el9.noarch 18/81 + Installing : perl-Time-Local-2:1.300-7.el9.noarch 19/81 + Installing : perl-File-Path-2.18-4.el9.noarch 20/81 + Installing : perl-Pod-Escapes-1:1.07-460.el9.noarch 21/81 + Installing : perl-Text-Tabs+Wrap-2013.0523-460.el9.noarch 22/81 + Installing : perl-IO-Socket-SSL-2.073-1.el9.noarch 23/81 + Installing : perl-Class-Struct-0.66-480.el9.noarch 24/81 + Installing : perl-POSIX-1.94-480.el9.x86_64 25/81 + Installing : perl-Term-ANSIColor-5.01-461.el9.noarch 26/81 + Installing : perl-IPC-Open3-1.21-480.el9.noarch 27/81 + Installing : perl-subs-1.03-480.el9.noarch 28/81 + Installing : perl-File-Temp-1:0.231.100-4.el9.noarch 29/81 + Installing : perl-Term-Cap-1.17-460.el9.noarch 30/81 + Installing : perl-Pod-Simple-1:3.42-4.el9.noarch 31/81 + Installing : perl-HTTP-Tiny-0.076-460.el9.noarch 32/81 + Installing : perl-Socket-4:2.031-4.el9.x86_64 33/81 + Installing : perl-SelectSaver-1.02-480.el9.noarch 34/81 + Installing : perl-Symbol-1.08-480.el9.noarch 35/81 + Installing : perl-File-stat-1.09-480.el9.noarch 36/81 + Installing : perl-podlators-1:4.14-460.el9.noarch 37/81 + Installing : perl-Pod-Perldoc-3.28.01-461.el9.noarch 38/81 + Installing : perl-Fcntl-1.13-480.el9.x86_64 39/81 + Installing : perl-Text-ParseWords-3.30-460.el9.noarch 40/81 + Installing : perl-mro-1.23-480.el9.x86_64 41/81 + Installing : perl-IO-1.43-480.el9.x86_64 42/81 + Installing : perl-overloading-0.02-480.el9.noarch 43/81 + Installing : perl-Pod-Usage-4:2.01-4.el9.noarch 44/81 + Installing : perl-Errno-1.30-480.el9.x86_64 45/81 + Installing : perl-File-Basename-2.85-480.el9.noarch 46/81 + Installing : perl-Getopt-Std-1.12-480.el9.noarch 47/81 + Installing : perl-MIME-Base64-3.16-4.el9.x86_64 48/81 + Installing : perl-Scalar-List-Utils-4:1.56-461.el9.x86_64 49/81 + Installing : perl-constant-1.33-461.el9.noarch 50/81 + Installing : perl-Storable-1:3.21-460.el9.x86_64 51/81 + Installing : perl-overload-1.31-480.el9.noarch 52/81 + Installing : perl-parent-1:0.238-460.el9.noarch 53/81 + Installing : perl-vars-1.05-480.el9.noarch 54/81 + Installing : perl-Getopt-Long-1:2.52-4.el9.noarch 55/81 + Installing : perl-Carp-1.50-460.el9.noarch 56/81 + Installing : perl-Exporter-5.74-461.el9.noarch 57/81 + Installing : perl-NDBM_File-1.15-480.el9.x86_64 58/81 + Installing : perl-PathTools-3.78-461.el9.x86_64 59/81 + Installing : perl-Encode-4:3.08-462.el9.x86_64 60/81 + Installing : perl-libs-4:5.32.1-480.el9.x86_64 61/81 + Installing : perl-interpreter-4:5.32.1-480.el9.x86_64 62/81 + Running scriptlet: xml-common-0.6.3-58.el9.noarch 63/81 + Installing : xml-common-0.6.3-58.el9.noarch 63/81 + Installing : fontconfig-2.14.0-2.el9_1.x86_64 64/81 + Running scriptlet: fontconfig-2.14.0-2.el9_1.x86_64 64/81 + Installing : libxslt-1.1.34-9.el9.x86_64 65/81 + Installing : libXau-1.0.9-8.el9.x86_64 66/81 + Installing : libxcb-1.13.1-9.el9.x86_64 67/81 + Installing : libX11-common-1.7.0-7.el9.noarch 68/81 + Installing : libX11-1.7.0-7.el9.x86_64 69/81 + Installing : libXpm-3.5.13-8.el9_1.x86_64 70/81 + Installing : jbigkit-libs-2.1-23.el9.x86_64 71/81 + Installing : libtiff-4.4.0-7.el9.x86_64 72/81 + Installing : gd-2.3.2-3.el9.x86_64 73/81 + Installing : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 74/81 + Installing : nginx-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 75/81 + Running scriptlet: nginx-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 75/81 + Installing : nginx-mod-http-image-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 76/81 + Running scriptlet: nginx-mod-http-image-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 76/81 + Installing : nginx-mod-http-perl-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 77/81 + Running scriptlet: nginx-mod-http-perl-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 77/81 + Installing : nginx-mod-http-xslt-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 78/81 + Running scriptlet: nginx-mod-http-xslt-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 78/81 + Installing : nginx-mod-mail-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 79/81 + Running scriptlet: nginx-mod-mail-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 79/81 + Installing : nginx-mod-stream-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 80/81 + Running scriptlet: nginx-mod-stream-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 80/81 + Installing : nginx-all-modules-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 81/81 + Running scriptlet: fontconfig-2.14.0-2.el9_1.x86_64 81/81 + Running scriptlet: nginx-all-modules-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 81/81 + Verifying : almalinux-logos-httpd-90.5.1-1.1.el9.noarch 1/81 + Verifying : fontconfig-2.14.0-2.el9_1.x86_64 2/81 + Verifying : gd-2.3.2-3.el9.x86_64 3/81 + Verifying : jbigkit-libs-2.1-23.el9.x86_64 4/81 + Verifying : langpacks-core-font-en-3.0-16.el9.noarch 5/81 + Verifying : libX11-1.7.0-7.el9.x86_64 6/81 + Verifying : libX11-common-1.7.0-7.el9.noarch 7/81 + Verifying : libXau-1.0.9-8.el9.x86_64 8/81 + Verifying : libXpm-3.5.13-8.el9_1.x86_64 9/81 + Verifying : libtiff-4.4.0-7.el9.x86_64 10/81 + Verifying : libwebp-1.2.0-6.el9_1.x86_64 11/81 + Verifying : libxcb-1.13.1-9.el9.x86_64 12/81 + Verifying : libxslt-1.1.34-9.el9.x86_64 13/81 + Verifying : nginx-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 14/81 + Verifying : nginx-all-modules-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 15/81 + Verifying : nginx-core-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 16/81 + Verifying : nginx-filesystem-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch 17/81 + Verifying : nginx-mod-http-image-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 18/81 + Verifying : nginx-mod-http-perl-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 19/81 + Verifying : nginx-mod-http-xslt-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 20/81 + Verifying : nginx-mod-mail-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 21/81 + Verifying : nginx-mod-stream-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 22/81 + Verifying : perl-AutoLoader-5.74-480.el9.noarch 23/81 + Verifying : perl-B-1.80-480.el9.x86_64 24/81 + Verifying : perl-Carp-1.50-460.el9.noarch 25/81 + Verifying : perl-Class-Struct-0.66-480.el9.noarch 26/81 + Verifying : perl-Data-Dumper-2.174-462.el9.x86_64 27/81 + Verifying : perl-Digest-1.19-4.el9.noarch 28/81 + Verifying : perl-Digest-MD5-2.58-4.el9.x86_64 29/81 + Verifying : perl-Encode-4:3.08-462.el9.x86_64 30/81 + Verifying : perl-Errno-1.30-480.el9.x86_64 31/81 + Verifying : perl-Exporter-5.74-461.el9.noarch 32/81 + Verifying : perl-Fcntl-1.13-480.el9.x86_64 33/81 + Verifying : perl-File-Basename-2.85-480.el9.noarch 34/81 + Verifying : perl-File-Path-2.18-4.el9.noarch 35/81 + Verifying : perl-File-Temp-1:0.231.100-4.el9.noarch 36/81 + Verifying : perl-File-stat-1.09-480.el9.noarch 37/81 + Verifying : perl-FileHandle-2.03-480.el9.noarch 38/81 + Verifying : perl-Getopt-Long-1:2.52-4.el9.noarch 39/81 + Verifying : perl-Getopt-Std-1.12-480.el9.noarch 40/81 + Verifying : perl-HTTP-Tiny-0.076-460.el9.noarch 41/81 + Verifying : perl-IO-1.43-480.el9.x86_64 42/81 + Verifying : perl-IO-Socket-IP-0.41-5.el9.noarch 43/81 + Verifying : perl-IO-Socket-SSL-2.073-1.el9.noarch 44/81 + Verifying : perl-IPC-Open3-1.21-480.el9.noarch 45/81 + Verifying : perl-MIME-Base64-3.16-4.el9.x86_64 46/81 + Verifying : perl-Mozilla-CA-20200520-6.el9.noarch 47/81 + Verifying : perl-NDBM_File-1.15-480.el9.x86_64 48/81 + Verifying : perl-Net-SSLeay-1.92-2.el9.x86_64 49/81 + Verifying : perl-POSIX-1.94-480.el9.x86_64 50/81 + Verifying : perl-PathTools-3.78-461.el9.x86_64 51/81 + Verifying : perl-Pod-Escapes-1:1.07-460.el9.noarch 52/81 + Verifying : perl-Pod-Perldoc-3.28.01-461.el9.noarch 53/81 + Verifying : perl-Pod-Simple-1:3.42-4.el9.noarch 54/81 + Verifying : perl-Pod-Usage-4:2.01-4.el9.noarch 55/81 + Verifying : perl-Scalar-List-Utils-4:1.56-461.el9.x86_64 56/81 + Verifying : perl-SelectSaver-1.02-480.el9.noarch 57/81 + Verifying : perl-Socket-4:2.031-4.el9.x86_64 58/81 + Verifying : perl-Storable-1:3.21-460.el9.x86_64 59/81 + Verifying : perl-Symbol-1.08-480.el9.noarch 60/81 + Verifying : perl-Term-ANSIColor-5.01-461.el9.noarch 61/81 + Verifying : perl-Term-Cap-1.17-460.el9.noarch 62/81 + Verifying : perl-Text-ParseWords-3.30-460.el9.noarch 63/81 + Verifying : perl-Text-Tabs+Wrap-2013.0523-460.el9.noarch 64/81 + Verifying : perl-Time-Local-2:1.300-7.el9.noarch 65/81 + Verifying : perl-URI-5.09-3.el9.noarch 66/81 + Verifying : perl-base-2.27-480.el9.noarch 67/81 + Verifying : perl-constant-1.33-461.el9.noarch 68/81 + Verifying : perl-if-0.60.800-480.el9.noarch 69/81 + Verifying : perl-interpreter-4:5.32.1-480.el9.x86_64 70/81 + Verifying : perl-libnet-3.13-4.el9.noarch 71/81 + Verifying : perl-libs-4:5.32.1-480.el9.x86_64 72/81 + Verifying : perl-mro-1.23-480.el9.x86_64 73/81 + Verifying : perl-overload-1.31-480.el9.noarch 74/81 + Verifying : perl-overloading-0.02-480.el9.noarch 75/81 + Verifying : perl-parent-1:0.238-460.el9.noarch 76/81 + Verifying : perl-podlators-1:4.14-460.el9.noarch 77/81 + Verifying : perl-subs-1.03-480.el9.noarch 78/81 + Verifying : perl-vars-1.05-480.el9.noarch 79/81 + Verifying : xml-common-0.6.3-58.el9.noarch 80/81 + Verifying : dejavu-sans-fonts-2.37-18.el9.noarch 81/81 + +Installed: + almalinux-logos-httpd-90.5.1-1.1.el9.noarch dejavu-sans-fonts-2.37-18.el9.noarch + fontconfig-2.14.0-2.el9_1.x86_64 gd-2.3.2-3.el9.x86_64 + jbigkit-libs-2.1-23.el9.x86_64 langpacks-core-font-en-3.0-16.el9.noarch + libX11-1.7.0-7.el9.x86_64 libX11-common-1.7.0-7.el9.noarch + libXau-1.0.9-8.el9.x86_64 libXpm-3.5.13-8.el9_1.x86_64 + libtiff-4.4.0-7.el9.x86_64 libwebp-1.2.0-6.el9_1.x86_64 + libxcb-1.13.1-9.el9.x86_64 libxslt-1.1.34-9.el9.x86_64 + nginx-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 nginx-all-modules-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch + nginx-core-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 nginx-filesystem-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.noarch + nginx-mod-http-image-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 nginx-mod-http-perl-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 + nginx-mod-http-xslt-filter-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 nginx-mod-mail-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 + nginx-mod-stream-1:1.22.1-3.module_el9.2.0+20+2a475c1b.alma.x86_64 perl-AutoLoader-5.74-480.el9.noarch + perl-B-1.80-480.el9.x86_64 perl-Carp-1.50-460.el9.noarch + perl-Class-Struct-0.66-480.el9.noarch perl-Data-Dumper-2.174-462.el9.x86_64 + perl-Digest-1.19-4.el9.noarch perl-Digest-MD5-2.58-4.el9.x86_64 + perl-Encode-4:3.08-462.el9.x86_64 perl-Errno-1.30-480.el9.x86_64 + perl-Exporter-5.74-461.el9.noarch perl-Fcntl-1.13-480.el9.x86_64 + perl-File-Basename-2.85-480.el9.noarch perl-File-Path-2.18-4.el9.noarch + perl-File-Temp-1:0.231.100-4.el9.noarch perl-File-stat-1.09-480.el9.noarch + perl-FileHandle-2.03-480.el9.noarch perl-Getopt-Long-1:2.52-4.el9.noarch + perl-Getopt-Std-1.12-480.el9.noarch perl-HTTP-Tiny-0.076-460.el9.noarch + perl-IO-1.43-480.el9.x86_64 perl-IO-Socket-IP-0.41-5.el9.noarch + perl-IO-Socket-SSL-2.073-1.el9.noarch perl-IPC-Open3-1.21-480.el9.noarch + perl-MIME-Base64-3.16-4.el9.x86_64 perl-Mozilla-CA-20200520-6.el9.noarch + perl-NDBM_File-1.15-480.el9.x86_64 perl-Net-SSLeay-1.92-2.el9.x86_64 + perl-POSIX-1.94-480.el9.x86_64 perl-PathTools-3.78-461.el9.x86_64 + perl-Pod-Escapes-1:1.07-460.el9.noarch perl-Pod-Perldoc-3.28.01-461.el9.noarch + perl-Pod-Simple-1:3.42-4.el9.noarch perl-Pod-Usage-4:2.01-4.el9.noarch + perl-Scalar-List-Utils-4:1.56-461.el9.x86_64 perl-SelectSaver-1.02-480.el9.noarch + perl-Socket-4:2.031-4.el9.x86_64 perl-Storable-1:3.21-460.el9.x86_64 + perl-Symbol-1.08-480.el9.noarch perl-Term-ANSIColor-5.01-461.el9.noarch + perl-Term-Cap-1.17-460.el9.noarch perl-Text-ParseWords-3.30-460.el9.noarch + perl-Text-Tabs+Wrap-2013.0523-460.el9.noarch perl-Time-Local-2:1.300-7.el9.noarch + perl-URI-5.09-3.el9.noarch perl-base-2.27-480.el9.noarch + perl-constant-1.33-461.el9.noarch perl-if-0.60.800-480.el9.noarch + perl-interpreter-4:5.32.1-480.el9.x86_64 perl-libnet-3.13-4.el9.noarch + perl-libs-4:5.32.1-480.el9.x86_64 perl-mro-1.23-480.el9.x86_64 + perl-overload-1.31-480.el9.noarch perl-overloading-0.02-480.el9.noarch + perl-parent-1:0.238-460.el9.noarch perl-podlators-1:4.14-460.el9.noarch + perl-subs-1.03-480.el9.noarch perl-vars-1.05-480.el9.noarch + xml-common-0.6.3-58.el9.noarch + +Complete! +``` + +### ➡️ Test installation + +``` +nginx -v +``` + +Expected output (test): +``` +nginx version: nginx/1.22.1 +``` + + +### 🔖 Variant III: Main-line Repository Install + +#### Example + +### ➡️ Import the Nginx signing key + +``` +sudo rpm --import https://nginx.org/keys/nginx_signing.key +``` + +### ➡️ Create a repo definition file for Nginx + +``` +sudo tee /etc/yum.repos.d/nginx.repo +``` + +### ➡️ Populate the new repo file with below text (copy-paste & `Ctrl+D`) + +``` +[nginx-mainline] +name=nginx mainline repo +baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ +gpgcheck=1 +enabled=0 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true +``` + +### ➡️ Install `dnf-uils` + +::: tip +In AlmaLinux 9.2 `dnf-utils` can installed by default (depending on install type). +::: + +::: warning +`dnf-utils` are repo managment tools (classic YUM utilities implemented as CLI shims on top of DNF) +::: + + +``` +sudo dnf install dnf-utils +``` + +Expected output (install): +``` +Last metadata expiration check: 0:46:06 ago on Fri Jun 2 20:17:44 2023. +Package yum-utils-4.3.0-5.el9_2.noarch is already installed. +Dependencies resolved. +Nothing to do. +Complete! +``` + +### ➡️ Enable the repository + +``` +dnf config-manager --enable nginx-mainline +``` + +### ➡️ Install the package + +``` +sudo dnf install nginx +``` + +Example output (install): +``` + sudo dnf install nginx +Last metadata expiration check: 0:00:10 ago on Fri Jun 2 21:06:02 2023. +Dependencies resolved. +================================================================================================================================================================== + Package Architecture Version Repository Size +================================================================================================================================================================== +Installing: + nginx x86_64 1:1.25.0-1.el9.ngx nginx-mainline 992 k + +Transaction Summary +================================================================================================================================================================== +Install 1 Package + +Total download size: 992 k +Installed size: 3.3 M +Is this ok [y/N]: y +Downloading Packages: +nginx-1.25.0-1.el9.ngx.x86_64.rpm 11 MB/s | 992 kB 00:00 +------------------------------------------------------------------------------------------------------------------------------------------------------------------ +Total 11 MB/s | 992 kB 00:00 +nginx mainline repo 21 kB/s | 1.5 kB 00:00 +Importing GPG key 0x7BD9BF62: + Userid : "nginx signing key " + Fingerprint: 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62 + From : https://nginx.org/keys/nginx_signing.key +Is this ok [y/N]: y +Key imported successfully +Running transaction check +Transaction check succeeded. +Running transaction test +Transaction test succeeded. +Running transaction + Preparing : 1/1 + Running scriptlet: nginx-1:1.25.0-1.el9.ngx.x86_64 1/1 + Installing : nginx-1:1.25.0-1.el9.ngx.x86_64 1/1 + Running scriptlet: nginx-1:1.25.0-1.el9.ngx.x86_64 1/1 +---------------------------------------------------------------------- + +Thanks for using nginx! + +Please find the official documentation for nginx here: +* https://nginx.org/en/docs/ + +Please subscribe to nginx-announce mailing list to get +the most important news about nginx: +* https://nginx.org/en/support.html + +Commercial subscriptions for nginx are available on: +* https://nginx.com/products/ + +---------------------------------------------------------------------- + + Verifying : nginx-1:1.25.0-1.el9.ngx.x86_64 1/1 + +Installed: + nginx-1:1.25.0-1.el9.ngx.x86_64 + +Complete! +``` + +### ➡️ Test +``` +nginx -v +``` + +Expected output (test): +``` +nginx version: nginx/1.25.0 +``` + +## 📚 Further reading and Next Steps + +Get Back: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](NginxSeriesA01.md) + +In-depth Resources: +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 8.x Installation](NginxSeriesA02R8.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.1 Installation](NginxSeriesA02R91.md) +- AlmaLinux Nginx Series ❯ [Default Configuration Guide](NginxSeriesA03.md) +- AlmaLinux Nginx Series ❯ [Secure Nginx Deployment](NginxSeriesA04P1.md) + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) diff --git a/docs/series/nginx/NginxSeriesA03.md b/docs/series/nginx/NginxSeriesA03.md new file mode 100644 index 000000000..5810f158e --- /dev/null +++ b/docs/series/nginx/NginxSeriesA03.md @@ -0,0 +1,276 @@ +# A03 ❯ Default Configuration Guide +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐⭐☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-15 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ +## 🌟 Intoduction +By understanding each line in the default configuration, you can modify the settings to better suit your needs. Be sure to carefully review any changes you make to the configuration and test them before deploying in a production environment. This will help ensure that your Nginx server on AlmaLinux is properly configured and running optimally. +## 🧠 Fundamental Concepts + +### Nginx Configuration File Structure + +The main Nginx configuration file, typically named `nginx.conf`, is organized into a hierarchy of configuration blocks. The top-level block is the main block, which can contain `http`, `events`, and `stream` blocks. The `http` block can contain one or more `server` blocks, which in turn can contain multiple `location`, if, and other directive blocks. + +### Directives + +Directives are the building blocks of the Nginx configuration file. They define the behavior of the web server and can be set at various levels within the configuration hierarchy. Directives have a name and one or more parameters, and they end with a semicolon. + +### Contexts + +Contexts are configuration blocks that group directives based on their functionality. Common contexts include `http`, `server`, `location`, and `events`. Directives can only be used within the appropriate context, and some directives can be used in multiple contexts. + +### Inheritance and Directive Precedence + +Directives set in a parent context are inherited by child contexts unless overridden by a more specific directive within the child context. When multiple directives with the same name are defined, the one in the most specific context takes precedence. + +### Variables + +Nginx provides a variety of built-in variables that can be used within the configuration file to store and reference values. These variables can be used to customize logging, rewrite URLs, or manipulate request and response headers. + +### Rewrite and Redirect Rules + +Nginx provides directives for creating rewrite and redirect rules, such as `rewrite`, `return`, and `error_page`. These rules can be used to manipulate incoming URLs and redirect clients to different resources based on specific conditions. + +## 📝 Key take aways + +### ➡️ Basic Configuration + +- System user account Nginx runs as: +``` +user nginx; +``` +- Number of worker processes for handling requests (auto-detects CPU cores): +``` +worker_processes auto; +``` +- Error log file path: +``` +error_log /var/log/nginx/error.log; +``` +- Process ID (PID) file path: +``` +pid /run/nginx.pid; +``` +- Included dynamically loaded modules: +``` +include /usr/share/nginx/modules/*.conf; +``` + +### ➡️ Performance and Connection Settings + +- Maximum connections per worker process: +``` +worker_connections 1024; +``` + +- Enables efficient file sending to clients: +``` +sendfile on; +``` + +- Improves performance by sending small data packets without delay¹: +``` +tcp_nopush on; +``` + +- Improves performance by sending larger data packets without delay²: +``` +tcp_nodelay on; +``` + +- Time before an idle connection is closed: +``` +keepalive_timeout 65; +``` + +¹ [Details of tcp_nopush option (nginx.org)](http://nginx.org/en/docs/http/ngx_http_core_module.html#tcp_nopush)
+² [Details of tcp_nodelay option (nginx.org)](http://nginx.org/en/docs/http/ngx_http_core_module.html#tcp_nodelay)
+ [About Neagle's algorithm (wikipedia.org)](https://en.wikipedia.org/wiki/Nagle%27s_algorithm) + +### 📖 Deep dive on `worker_connections` + +`worker_connections` directive is used to set the maximum number of simultaneous connections that a single worker process can handle. A worker process is a separate operating system process that handles the processing of client requests. The worker_connections directive is set within the events block of the Nginx configuration file. + +Each connection requires a file descriptor, and the operating system has a limit on the number of file descriptors that can be opened simultaneously. The `worker_connections` value should be set according to the available system resources, the expected number of concurrent connections, and the system’s file descriptor limit. + +Keep in mind that the total number of connections the server can handle is determined by the number of worker processes (`worker_processes` directive) multiplied by the number of `worker_connections`. For example, if you have 4 worker processes and 1024 worker connections, your server can handle up to 4096 simultaneous connections. + +It’s important to find the right balance between the number of worker processes and worker connections to optimize the performance of your Nginx server based on your specific use case and hardware resources. + + +### ➡️ MIME Types and Logging + +- Maximum size of the MIME types hash table: +``` +types_hash_max_size 4096; +``` + +::: tip +The hash table allows for faster lookups of MIME types when processing requests for different files. A larger `types_hash_max_size` value will increase memory consumption but can improve performance for lookups in cases where there are a large number of MIME type. +::: + +- Included MIME types file: +``` +include /etc/nginx/mime.types; +``` + +- Default MIME type when undetermined. +``` +default_type application/octet-stream; +``` + +- Access log file path and format. +``` +access_log /var/log/nginx/access.log main; +``` +- Log format used by Nginx +``` +log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; +``` +### 📖 Break down the the default `log_format` + +- The IP address of the client making the request: +``` +$remote_addr +``` +- The authenticated user (if any) making the request. This value will be available only if authentication is enabled: +``` +$remote_user +``` +- The local time when the request was received, enclosed in square brackets. The format is typically `"day/month/year:hour:minute:second timezone"`: +``` +[$time_local] +``` +- The full HTTP request line, enclosed in double quotes. It includes the HTTP method, the requested URI, and the HTTP version used by the client (e.g., ``"GET /index.html HTTP/1.1"``): +``` +"$request" +``` +- The HTTP status code returned by the server for the request: +``` +$status +``` +- The number of bytes sent in the response body (excluding headers) to the client: +``` +$body_bytes_sent +``` +- The HTTP referer header, enclosed in double quotes. This is the URL of the page that linked to the requested resource (if available): +``` +"$http_referer" +``` +- The HTTP user agent header, enclosed in double quotes. This contains information about the client's browser and operating system: +``` +"$http_user_agent" +``` +- The HTTP X-Forwarded-For header, enclosed in double quotes. This header is used to identify the originating IP address of a client when the request is made through a proxy or load balancer: +``` +"$http_x_forwarded_for" +``` + +### ➡️ HTTP Server Block + +- Included configuration files for additional server blocks: +``` +include /etc/nginx/conf.d/*.conf; +``` +- HTTP requests listened on port 80: +``` +listen 80; +``` +- IPv6 requests listened on port 80: +``` +listen [::]:80; +``` +- Default server name when unspecified: +``` +server_name _; +``` +- Server's file root directory: +``` +root /usr/share/nginx/html; +``` +- Included default server block configuration files: +``` +include /etc/nginx/default.d/*.conf; +``` +- URL redirect for 404 errors: +``` +error_page 404 /404.html; +``` +- Empty location block for 404 error page: +``` +location = /40x.html { } +``` +- URL redirect for 500, 502, 503, or 504 errors: +``` +error_page 500 502 503 504 /50x.html; +``` +- Empty location block for 500 error page: +``` +location = /50x.html { } +``` + +### ➡️ HTTPS Server Block Specific + +- HTTPS requests listened on port 443 (SSL and HTTP/2 protocols): +``` +listen 443 ssl http2; +``` +- IPv6 HTTPS requests listened on port 443 (SSL and HTTP/2 protocols): +``` +listen [::]:443 ssl http2; +``` +- SSL certificate file path: +``` +ssl_certificate "/etc/pki/nginx/server.crt"; +``` +- SSL certificate key file path: +``` +ssl_certificate_key "/etc/pki/nginx/private/server.key"; +``` +- Shared SSL session cache: +``` +ssl_session_cache shared:SSL:1m; +``` +- SSL session timeout value: +``` +ssl_session_timeout 10m; +``` +- Prefers server's cipher suite over client's. +``` +ssl_prefer_server_ciphers on; +``` +- Cipher suites for SSL connections. +``` +ssl_ciphers PROFILE=SYSTEM; +``` + +### 📖 More about `ssl_ciphers` setting +The `ssl_ciphers` directive in Nginx is used to specify the list of available ciphers that can be used for SSL/TLS connections. The order of ciphers in the list affects their priority during the SSL/TLS handshake between the server and the client. + +`ssl_ciphers PROFILE=SYSTEM;` tells Nginx to use the system's default cipher list for SSL/TLS connections. The system default cipher list is determined by the OpenSSL library installed on your system. + +Using `PROFILE=SYSTEM` can be useful when you want to rely on the system-wide cipher configuration rather than specifying a custom list of ciphers in your Nginx configuration. This approach can simplify your Nginx configuration and ensure that your server uses the recommended ciphers for your system. + + +## 📚 Further reading and Next Steps + +Get Back: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](NginxSeriesA01.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 8.x Installation Examples](NginxSeriesA02R8.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.1 Installation Examples](NginxSeriesA02R91.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.2 Installation Examples](NginxSeriesA02R92.md) + +In-depth Resources: + +- AlmaLinux Nginx Series ❯ [Secure Nginx Deployment](NginxSeriesA04P1.md) + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) + diff --git a/docs/series/nginx/NginxSeriesA04P1.md b/docs/series/nginx/NginxSeriesA04P1.md new file mode 100644 index 000000000..58a6b97c9 --- /dev/null +++ b/docs/series/nginx/NginxSeriesA04P1.md @@ -0,0 +1,351 @@ +# A04 ❯ Secure Nginx Deployment +ℹ️ This article is part of AlmaLinux [Nginx Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-16 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ + +## 🌟 Introduction +As Nginx is a high-performance web server commonly used in public environments it makes it a prime target for malicious attacks. To enhance the security of your Nginx server and protect your web content, it's important to secure your system. This guide presents a few simple steps you can take to secure your Nginx server and help prevent unauthorized access. + +## 🧠 Fundamental Concepts + +### General Protection + +#### Regular Updates and Patches + +Keeping your Nginx installation up-to-date is essential in ensuring that it is secure. Regularly check for software updates and patches from the official repository to stay informed of any vulnerabilities or bugs that could affect your Nginx server. + +#### File and Directory Permissions + +Make sure that the file and directory permissions are set appropriately for your Nginx server. Only allow users with the appropriate permissions to access the files and directories. + +#### Use a Dedicated User Account + +Running Nginx as a dedicated user account can help limit the damage caused by an attacker if your server is compromised. This is because a dedicated user account only has access to the files and directories required to run Nginx, reducing the potential damage an attacker can cause if they gain access to your server. + +#### Restrict Access to Sensitive Information + +To reduce the risk of exposing sensitive information, limit access to sensitive information on your server. You can do this by ensuring that only authorized users have access to sensitive files and directories. + +#### Monitor Logs + +Monitoring your Nginx server logs can help you detect and respond to security incidents quickly. Regularly reviewing your logs can help you identify any suspicious activity or unauthorized access attempts. You can also set up alerts or notifications to receive notifications when specific events occur, such as failed login attempts. + +### Security must-haves + +⚠️ Implement a firewall to block all incoming traffic (default on AlmaLinux) except for the ports you want to allow. For a web server like Nginx, you typically want to allow ports for HTTP and HTTPS services. + +⚠️ Use secure protocols for accessing your server, such as SSH, and disable password-based authentication in favor of public-key authentication. + +⚠️ Use secure coding practices when developing your web application or service, such as input validation and sanitization, to prevent common web vulnerabilities like SQL injection and cross-site scripting (XSS). + +### Configuration Specific Practices + +➡️ Enable SSL/TLS encryption to encrypt your web traffic, preventing attackers from intercepting sensitive information. Obtaining an SSL certificate from a trusted certificate authority like Let's Encrypt is recommended. + +➡️ Implement user authentication using the `htpasswd` tool to restrict access to your Nginx server and control access to specific areas of your site. + +➡️ Implement rate limiting to limit the number of requests from a particular IP address over a given period, preventing denial-of-service (DoS) attacks and other malicious traffic. + +➡️ Disable server tokens in Nginx to prevent revealing information about the software and version being used, making it harder for attackers to find potential vulnerabilities in your server. + + + + +## 📝 Key Takeaways + + +### Step 1: Check The Firewalld Configuration + +:::warning +On AlmaLinux OS, the Firewalld packet filtering service is enabled by default. + + +::: + +To allow incoming traffic on ports 80 (HTTP) and 443 (HTTPS), run: +``` +sudo firewall-cmd --permanent --zone=public --add-service={http,https} +``` +Then just reload the rules: +``` +sudo firewall-cmd --reload +``` + +### Step 2: Enable SSL/TLS Encryption + +Encrypting your web traffic using SSL/TLS is an essential step in securing your Nginx installation. To enable SSL/TLS encryption, you will need to obtain an SSL certificate and configure Nginx to use it. +One way to obtain an SSL certificate is to use Let's Encrypt, a free, automated, and open certificate authority. + +To install Let's Encrypt on AlmaLinux 9.x, run the following command: + +``` +sudo dnf install certbot python3-certbot-nginx +``` + +::: tip +The `python3-certbot-nginx` package is from EPEL repository, so if you get error to the above, just do: +``` +dnf install epel-release +``` +::: + +Then, obtain an SSL certificate for your domain by running the following command: + +``` +sudo certbot --nginx -d almalinux.example.com +``` +Replace example.com with your domain name. + +#### Example on success: +``` +... +Deploying certificate +Successfully deployed certificate for almalinux.example.com to /etc/nginx/nginx.conf +Congratulations! You have successfully enabled HTTPS on https://almalinux.example.com +``` + +::: tip +After successful configuration, '/etc/nginx/nginx.conf' will contain these new lines: + +:::details + +``` + listen [::]:443 ssl ipv6only=on; # managed by Certbot + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/almalinux.example.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/almalinux.example.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + + server { + if ($host = almalinux.example.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + listen 80; + listen [::]:80; + server_name almalinux.example.com; + return 404; # managed by Certbot + } +``` +::: + + +:::warning +If you get this weird error: +``` +... +Deploying certificate +Could not install certificate +An unexpected error occurred: +OpenSSL.crypto.Error: [('Provider routines', '', 'invalid key length')] +Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. +``` +Please check if you have FIPS mode enabled which prevents 'unauthorized' uses of OpenSSL framework (instruction in Details). + +:::details +``` +fips-mode-setup --check +``` +Should tell you: +```FIPS mode is disabled.``` + +If does not you need to disable the FIPS for the time of generation: + +* Disable it: +``` +fips-mode-setup --disable +``` +* Reboot the system! +  +* Regenerate the certificate (or just reinstall - `certbot` will offer that option when runs again) with the command that previously failed (above). +* Renable FIPS: +``` +fips-mode-setup --enable +``` +* Reboot the system! +::: + + +#### Check if that works! + +Navigate your browser to your site with `https` protocol prefix. +(Like: https://almalinux.example.com). Now the connection is encrypted(🔒). + + +### Step 3: Implement User Authentication + +If you want to restrict access to your Nginx server, you can implement user authentication using the `htpasswd` tool. + +::: tip +`htpasswd` manages user accounts and passwords for accessing restricted areas of your website, helping to add basic authentication to your Nginx server and control access to specific areas of your site. +::: + +To do this, run the following command to install `httpd-tools` package: + +``` +sudo dnf install httpd-tools +``` + +Then, create a password file for your user by running the following command: + +``` +sudo htpasswd -c /etc/nginx/.htpasswd myuser +``` +Replace `myuser` with your desired username. + +Finally, add the following configuration to your Nginx server block to require authentication for all requests (lines starting with `auth_basic`): + +``` +server { + listen 80; + server_name example.com; + root /var/www/example.com; + index index.html; + + auth_basic "Restricted Access"; + auth_basic_user_file /etc/nginx/.htpasswd; + + location / { + try_files $uri $uri/ =404; + } +} +``` + +Accessing the site will prompt user for username and password now. + + +### Step 4: Implement Rate Limiting + +Rate limiting is a technique used to limit the number of requests from a particular IP address over a given period. This can help prevent denial-of-service (DoS) attacks and other malicious traffic. + +To implement rate limiting in Nginx, add the following configuration to your server block (lines starting with `limit_req*`) + +``` +server { + listen 80; + server_name example.com; + root /var/www/example.com; + index index.html; + + limit_req zone=one burst=5 nodelay; + limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s; + + location / { + try_files $uri $uri/ =404; + } +} +``` + +This configuration will limit requests to one request per second per IP address, with a burst of 5 requests allowed before blocking further requests. The nodelay parameter ensures that requests exceeding the limit are blocked immediately. + +Note: both can be added to `http` block. + +:::details + For more info on rate limitting please read **[ a dedicated blog post Nginx.org ]( https://www.nginx.com/blog/rate-limiting-nginx/)** +::: + +### Step 5: Disable Server Tokens + +By default, Nginx includes server tokens in its response headers, which can reveal information about the software and version being used. This can be useful for attackers to find potential vulnerabilities in your server. + +To disable server tokens in Nginx, add the following configuration to your `nginx.conf` file: + +``` +server_tokens off; +``` + +As with all the changes to the configuration file you need to reload the server for this to be effective: +``` +systemctl reload nginx +``` + +## 📖 FAQ + +#### Q: How to fix `Nginx: stat() failed (13: Permission denied)` with SELinux enabled? + +Context: Nginx server is running under the user "nginx" and has access to to the files. But when I am attempting to list the contents of the /usr/share/nginx/srv/downloads/ directory on my server using a web browser. I have installed the Nginx server and set up configuration files, but when I try to access the directory, not all content is listed, and I receive a "Permission denied" error. The error message is as follows: + +``` +2023/04/27 17:08:54 [crit] 12839#0: *1 stat() "/usr/share/nginx/srv/downloads/file.txt" failed (13: Permission denied), client: 192.168.0.26, server: localhost, request: "GET /downloads/ HTTP/1.1", host: "localhost" +``` + +The Nginx server is running under the user "nginx," which is part of the "devs" group. I have verified that the user has access to the files by running the following command: + +``` +su -l nginx -s /bin/stat /usr/share/nginx/srv/downloads/file.txt +``` + +The output indicates that the user has the necessary permissions: + +``` +Last login: Thu Apr 28 09:30:19 CEST 2023 on pts/0 + File: '/usr/share/nginx/srv/downloads/file.txt' + Size: 0 Blocks: 0 IO Block: 4096 regular empty file +Device: fd00h/64768d Inode: 85524762 Links: 1 +Access: (0644/-rw-r--r--) Uid: ( 1000/ is) Gid: ( 1000/ devs) +Context: system_u:object_r:httpd_sys_content_t:s0 +Access: 2023-04-28 09:45:48.393259661 +0200 +Modify: 2023-04-28 09:45:48.393259661 +0200 +Change: 2023-04-28 09:45:48.393259661 +0200 + Birth: - +``` + +I also tried with the user www-data, but the issue persists. + +**A:** + +1. **Reproduce the problem** +This issue is likely related to SELinux blocking access to the directory. To confirm if it's an SELinux issue, temporarily disable SELinux by running + +``` +sudo setenforce 0 +``` + +then try loading the directory again. + +2. **Generate SELinux policy** + +If this resolves the issue, you will need to adjust the context of the directory to allow Nginx access or use `audit2allow` to identify a SELinux boolean that can be changed. + + :::tip + `audit2allow` - generate SELinux policy allow/dontaudit rules from logs of denied operations + ::: + +3. **Fix the SELinux issue** +``` +sudo semanage fcontext -a -t httpd_sys_content_t "/usr/share/nginx/srv(/.*)?" +``` + +``` +sudo restorecon -R -v /usr/share/nginx/srv +``` + + +The first command tells SELinux that the `/usr/share/nginx/srv` directory contains read-only content for an HTTP server. The second command relabels all the files in the `/usr/share/nginx/srv` directory with the correct context. + +4. **Re-enable SELinux** +``` +sudo setenforce 1 +``` + + +## 📚 Further reading and Next Steps + +Get Back: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](NginxSeriesA01.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 8.x Installation](NginxSeriesA01R8.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.1 Installation](NginxSeriesA02R91.md) +- AlmaLinux Nginx Series ❯ [AlmaLinux OS 9.2 Installation](NginxSeriesA02R92.md) + +In-depth Resources: + +Related Resources: +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](../system/SystemSeriesA02.md) +- AlmaLinux System Series ❯ [Application Streams](../system/SystemSeriesA01.md) + diff --git a/docs/series/nginx/README.md b/docs/series/nginx/README.md new file mode 100644 index 000000000..0455ca642 --- /dev/null +++ b/docs/series/nginx/README.md @@ -0,0 +1,15 @@ +# AlmaLinux Nginx Series + +Welcome! +---- +The articles in the series guide you through the installation, configuration, security, and management of your Nginx server. + +**Article List** +---- + +- [A01](NginxSeriesA01.md) ❯ Beginner's Guide +- [A02 R8](NginxSeriesA02R8.md) ❯ AlmaLinux 8.x Installation Examples +- [A02 R9.1](NginxSeriesA02R91.md) ❯ AlmaLinux 9.1 Installation Examples +- [A02 R9.2](NginxSeriesA02R92.md) ❯ AlmaLinux 9.2 Installation Examples +- [A03](NginxSeriesA03.md) ❯ Default Configuration Guide +- [A04](NginxSeriesA04P1.md) ❯ Secure Nginx Deployment diff --git a/docs/series/system/README.md b/docs/series/system/README.md new file mode 100644 index 000000000..937100992 --- /dev/null +++ b/docs/series/system/README.md @@ -0,0 +1,14 @@ +# AlmaLinux System Series + +Welcome! +---- +This series will guide you through the installation, configuration, security, and management of your server. + +**Article List** +---- +- [A01](SystemSeriesA01.md) ❯ Application Streams +- [A02](SystemSeriesA02.md) ❯ Firewalld: A Beginner's Guide +- [A03](SystemSeriesA03.md) ❯ NVIDIA Driver Installation Guide +- [A04](SystemSeriesA04.md) ❯ Snapd Installation Guide +- [A05](SystemSeriesA05.md) ❯ Multimedia: Install Media Codecs + diff --git a/docs/series/system/SystemSeriesA01.md b/docs/series/system/SystemSeriesA01.md new file mode 100644 index 000000000..f06c6f0cc --- /dev/null +++ b/docs/series/system/SystemSeriesA01.md @@ -0,0 +1,179 @@ +# A01 ❯ Application Streams +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-16 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ + +## 🌟 Introduction + +This guide will introduce the fundamental concepts of AppStream modules and demonstrate their usage in an AlmaLinux environment. With the introduction of Application Streams in Red Hat® Enterprise Linux 8, user-space components can be delivered and updated more frequently than the core operating system packages. This feature enables greater customization of your AlmaLinux installation without compromising the platform's underlying stability or specific deployments. + + +## 🧠 Fundamental Concepts + +### AppStream + +The AppStream repository contains both modular and non-modular packages. Non-modular packages, which serve as general-purpose utilities, libraries, or dependencies, are not tied to any specific module. They can be installed and updated independently, offering users more flexibility and control over their software stack. + +### AppStream Modularity +AppStream's modular design ensures the delivery of software packages as independent modules, each with its own release schedule and lifecycle. This approach facilitates the provision of new features and updates for applications without necessitating a complete operating system upgrade. By incorporating both modular and non-modular packages, AppStream provides users with a wide variety of software options while maintaining system stability, compatibility, and security. +AppStream modules provide a cohesive and tested set of packages that work together and ensure that all necessary packages are installed and configured correctly. + +## 📝 Key Takeaways + +To use AppStream modules in your AlmaLinux environment, you need to understand the following fundamental concepts: + +- **Modules**: A module is a set of RPM packages that represent a component and are usually installed together. A typical module includes packages with the application, application-specific dependency libraries, documentation, and helper utilities. +- **Streams**: A stream is a version of a module. A module can have multiple streams that represent different versions of the same component. +- **Profiles**: A profile is a set of streams for a module. Each profile represents a specific use case or workload. + + +## 📖 Version Specific Examples + +### ➡️ Version independent calling (here installing) syntax is: + +`sudo dnf module install nginx:/` + + ::: tip + There is a substantially greater number of AppStream modules available for the AlmaLinux 8.x series compared to the 9.x series. + ::: +:::warning +Below we show list of modules available for each (major) AlmaLinux release. +::: +### 🔖 AlmaLinux 8.7 + +### ➡️ List modules +``` +dnf module list +``` +Expected output: +``` +Last metadata expiration check: 0:08:54 ago on Sun 16 Apr 2023 07:42:28 AM EDT. +AlmaLinux 8 - AppStream +Name Stream Profiles Summary +389-ds 1.4 389 Directory Server (base) +ant 1.10 [d] common [d] Java build tool +container-tools rhel8 [d][e] common [d] Most recent (rolling) versions of podman, buildah, skopeo, runc, conmon, runc, conmon, CRIU, Udica, etc as well as dependencies such as container-selinux built and tested together, and updated as frequently as every 12 weeks. +container-tools 1.0 common [d] Stable versions of podman 1.0, buildah 1.5, skopeo 0.1, runc, conmon, CRIU, Udica, etc as well as dependencies such as container-selinux built and tested together, and supported for 24 months. +container-tools 2.0 common [d] Stable versions of podman 1.6, buildah 1.11, skopeo 0.1, runc, conmon, etc as well as dependencies such as container-selinux built and tested together, and supported as documented on the Application Stream lifecycle page. +container-tools 3.0 common [d] Stable versions of podman 3.0, buildah 1.19, skopeo 1.2, runc, conmon, CRIU, Udica, etc as well as dependencies such as container-selinux built and tested together, and supported as documented on the Application Stream lifecycle page. +container-tools 4.0 common [d] Stable versions of podman 4.0, buildah 1.24, skopeo 1.6, runc, conmon, CRIU, Udica, etc as well as dependencies such as container-selinux built and tested together, and supported as documented on the Application Stream lifecycle page. +eclipse rhel8 java [d] An open, extensible IDE and application platform +freeradius 3.0 [d] server [d] High-performance and highly configurable free RADIUS server +gimp 2.8 [d] common [d], devel gimp module +go-toolset rhel8 [d] common [d] Go +httpd 2.4 [d] common [d], devel, minimal Apache HTTP Server +idm DL1 adtrust, client, common [d], dns, server The Red Hat Enterprise Linux Identity Management system module +idm client [d] common [d] RHEL IdM long term support client module +inkscape 0.92.3 [d] common [d] Vector-based drawing program using SVG +javapackages-runtime 201801 [d] common [d] Basic runtime utilities to support Java applications +jmc rhel8 [d] common [d], core Java Mission Control is a profiling and diagnostics tool for the Hotspot JVM +libselinux-python 2.8 common Python 2 bindings for libselinux +llvm-toolset rhel8 [d] common [d] LLVM +log4j 2 [d] common [d] Java logging library +mailman 2.1 [d] common [d] Electronic mail discussion and e-newsletter lists managing software +mariadb 10.3 [d] client, galera, server [d] MariaDB Module +mariadb 10.5 client, galera, server [d] MariaDB Module +maven 3.5 [d] common [d] Java project management and project comprehension tool +maven 3.6 common [d] Java project management and project comprehension tool +maven 3.8 common [d] Java project management and project comprehension tool +mercurial 4.8 [d] common [d] Mercurial -- a distributed SCM +mercurial 6.2 common [d] Mercurial -- a distributed SCM +mod_auth_openidc 2.3 [d] default [d] Apache module suporting OpenID Connect authentication +mysql 8.0 [d] client, server [d] MySQL Module +nginx 1.14 [d] common [d] nginx webserver +nginx 1.16 common [d] nginx webserver +nginx 1.18 common [d] nginx webserver +nginx 1.20 [e] common [d] [i] nginx webserver +nodejs 10 [d] common [d], development, minimal, s2i Javascript runtime +nodejs 12 common [d], development, minimal, s2i Javascript runtime +nodejs 14 common [d], development, minimal, s2i Javascript runtime +nodejs 16 common [d], development, minimal, s2i Javascript runtime +nodejs 18 common [d], development, minimal, s2i Javascript runtime +parfait 0.5 common Parfait Module +perl 5.24 common [d], minimal Practical Extraction and Report Language +perl 5.26 [d][e] common [d], minimal Practical Extraction and Report Language +perl 5.30 common [d], minimal Practical Extraction and Report Language +perl 5.32 common [d], minimal Practical Extraction and Report Language +perl-App-cpanminus 1.7044 [d] common [d] Get, unpack, build and install CPAN modules +perl-DBD-MySQL 4.046 [d] common [d] A MySQL interface for Perl +perl-DBD-Pg 3.7 [d] common [d] A PostgreSQL interface for Perl +perl-DBD-SQLite 1.58 [d] common [d] SQLite DBI driver +perl-DBI 1.641 [d] common [d] A database access API for Perl +perl-FCGI 0.78 [d] common [d] FastCGI Perl bindings +perl-IO-Socket-SSL 2.066 [d][e] common [d] Perl library for transparent TLS +perl-YAML 1.24 [d] common [d] Perl parser for YAML +perl-libwww-perl 6.34 [d][e] common [d] A Perl interface to the World-Wide Web +php 7.2 [d] common [d], devel, minimal PHP scripting language +php 7.3 common [d], devel, minimal PHP scripting language +php 7.4 common [d], devel, minimal PHP scripting language +php 8.0 common [d], devel, minimal PHP scripting language +pki-core 10.6 PKI Core module for PKI 10.6 or later +pki-deps 10.6 PKI Dependencies module for PKI 10.6 or later +pmdk 1_fileformat_v6 Persistent Memory Development Kit (former NVML) +postgresql 9.6 client, server [d] PostgreSQL server and client module +postgresql 10 [d] client, server [d] PostgreSQL server and client module +postgresql 12 client, server [d] PostgreSQL server and client module +postgresql 13 client, server [d] PostgreSQL server and client module +python27 2.7 [d] common [d] Python programming language, version 2.7 +python36 3.6 [d] build, common [d] Python programming language, version 3.6 +python38 3.8 [d] build, common [d] Python programming language, version 3.8 +python39 3.9 [d] build, common [d] Python programming language, version 3.9 +redis 5 [d] common [d] Redis persistent key-value database +redis 6 common [d] Redis persistent key-value database +rhn-tools 1.0 [d] common [d] Red Hat Satellite 5 tools for RHEL +ruby 2.5 [d] common [d] An interpreter of object-oriented scripting language +ruby 2.6 common [d] An interpreter of object-oriented scripting language +ruby 2.7 common [d] An interpreter of object-oriented scripting language +ruby 3.0 common [d] An interpreter of object-oriented scripting language +ruby 3.1 common [d] An interpreter of object-oriented scripting language +rust-toolset rhel8 [d] common [d] Rust +satellite-5-client 1.0 [d] common [d], gui Red Hat Satellite 5 client packages +scala 2.10 [d] common [d] A hybrid functional/object-oriented language for the JVM +squid 4 [d] common [d] Squid - Optimising Web Delivery +subversion 1.10 [d] common [d], server Apache Subversion +subversion 1.14 common [d], server Apache Subversion +swig 3.0 [d] common [d], complete Connects C/C++/Objective C to some high-level programming languages +swig 4.0 common [d], complete Connects C/C++/Objective C to some high-level programming languages +varnish 6 [d] common [d] Varnish HTTP cache +virt rhel [d][e] common [d] Virtualization module + +Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled + + +``` + +### 🔖 AlmaLinux 9.1 + +### ➡️ List modules +``` +dnf module list +``` +Expected output: +``` +Last metadata expiration check: 13:03:40 ago on Sun 16 Apr 2023 12:31:58 AM CEST. +AlmaLinux 9 - AppStream +Name Stream Profiles Summary +maven 3.8 common [d] Java project management and project comprehension tool +nodejs 18 common [d], development, minimal, s2i Javascript runtime +php 8.1 common [d], devel, minimal PHP scripting language +ruby 3.1 common [d] An interpreter of object-oriented scripting language + +Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled +``` + +## 📚 Further Reading and Next Steps + +In-depth Resources: + +- [Introduction of Application Streams (RHEL 8)](https://www.redhat.com/en/blog/introduction-appstreams-and-modules-red-hat-enterprise-linux) +- [Application Streams Considerations (RHEL 9)](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/considerations_in_adopting_rhel_9/ref_application-streams_considerations-in-adopting-rhel-9) + +Related Resources: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](../nginx/NginxSeriesA01.md) +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](SystemSeriesA02.md) + diff --git a/docs/series/system/SystemSeriesA02.md b/docs/series/system/SystemSeriesA02.md new file mode 100644 index 000000000..7eb79084b --- /dev/null +++ b/docs/series/system/SystemSeriesA02.md @@ -0,0 +1,347 @@ +# A02 ❯ Firewalld: A Beginner's Guide +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-10 +| 🔧 | Tested by
↳ version \| platform \| date | [Pawel Suchanecki](mailto:psuchanecki@almalinux.org)
↳ 9.1 \| x86_64 \| 2023-04-21 | +
+ + +## 🌟 Introduction + Firewalld is a dynamic firewall management tool that is enabled by default in AlmaLinux. It provides a flexible and powerful interface for configuring network traffic filtering rules and allows system administrators to easily manage firewall settings without needing to know the specifics of iptables or nftables. Firewalld uses zones, services, ports, source and destination, and masquerading/NAT to define firewall rules and secure network traffic. With firewalld, system administrators can create custom firewall configurations, add or remove services and ports, and manage network zones to secure their systems against unauthorized access and potential security threats. + + +:::tip +On AlmaLinux OS, the Firewalld packet filtering service is enabled by default. + +:::details + +You can verify with later described command: +``` +sudo firewall-cmd --state +``` + +Example: +``` +running +``` + +::: + + + +## 🧠 Fundamental Concepts + +Firewalld implements a number of fundamental concepts to provide flexible and powerful network traffic filtering. These concepts include: + +**Zones:** Firewalld uses zones to define different levels of trust for network connections. Zones are predefined or custom-defined sets of rules that specify what traffic is allowed and what is not allowed. By default, Firewalld comes with three zones: public, internal, and trusted. Each zone is associated with a set of firewall rules that determine how incoming and outgoing traffic is handled. + +**Services:** Firewalld uses services to group ports and protocols that are used by applications. A service is defined by a set of rules that determine what ports and protocols are associated with the service. By default, Firewalld comes with a number of predefined services, such as ssh, http, https, smtp, and dns. + +**Policies:** Firewalld allows the definition of policies to control how traffic is forwarded between zones. Policies are defined rules that determine how traffic is handled when it is forwarded between different zones. Policies can be used to allow or deny traffic between zones or to modify the source or destination of traffic. + +**Ports:** Firewalld uses ports to allow or deny traffic to specific ports. A port is a communication endpoint that is identified by a number. Ports are typically associated with specific protocols, such as TCP or UDP. + +**Source and Destination:** Firewalld allows rules to be defined based on the source or destination of network traffic. Rules can be defined based on IP addresses, subnets, interfaces, and MAC addresses. + +**Masquerading and NAT:** Firewalld provides support for Network Address Translation (NAT) and masquerading. NAT is used to map private IP addresses to public IP addresses, while masquerading is used to hide the source IP address of outgoing traffic. + + + +## 📝 Key Takeaways + +### Predefined zones + +List of the predefined zones along with their respective trust levels and descriptions: + +- 🟥 `drop` - Blocks all incoming connections, allows only outgoing connections. +- 🟥 `block` - Similar to drop, but rejects incoming requests. +- 🟥 `public` - Allows selective incoming connections on a case-by-case basis. +- 🟥 `external` - Enables NAT masquerading for private network accessibility. +- 🟨 `internal` - Fairly trustworthy computers, additional services may be available. +- 🟨 `dmz` - Permits specific incoming connections. +- 🟩 `work` - Trusts most computers in the network, allows more services. +- 🟩 `home` - Trusts most other computers, allows additional services. +- 🟩 `trusted` - Trusts all machines in the network, use sparingly. + + +:::details +List all defined zones: +``` +sudo firewall-cmd --get-zones +``` +::: + +### Default config +By default, most of incoming traffic is denied, and only outgoing traffic is allowed in all three zones. You can add or remove services and ports from each zone as needed to configure the firewall rules for your system. By default you will have `cockpit`, `dhcpv6-client` and `ssh` enabled on default AlmaLinux installation. + +By default, `firewalld` on AlmaLinux uses the `public` zone as the default zone for all network interfaces that are not explicitly assigned to another zone. This means that any incoming traffic that is not explicitly allowed or denied in another zone will be subject to the rules defined in the `public` zone. + +### `firewall-cmd` +`firewall-cmd` is a command-line tool used to configure and manage firewalld, providing an easy way to configure firewall rules and zones, enable and disable services, and manage network traffic. With `firewall-cmd`, users can add, remove, and modify firewall rules in real-time, as well as make changes that persist across reboots and firewall restarts. It is recommended to use `firewall-cmd` for managing the firewall configuration, as it simplifies the process and ensures that changes are made correctly. + +### The `--permanent` flag + +The changes by `firewall-cmd` when adding or removing rules are temporary are only effective for the current runtime of the firewall. If the firewall service is restarted, those changes will be lost. + +Using the `--permanent` option makes the changes permanent, meaning they will be saved to the firewall configuration files on disk. These configuration files are read and applied by the firewall service when it starts up, so the changes will persist across reboots and firewall restarts. + + +## 📖 Interacting with Firewalld + +::: tip +Keep in mind that sudo privileges are required for firewall modification commands. +::: + +### ➡️ Adding / removing temporary rules + +Here are some basic patterns for adding and removing rules temporarily or permanently: + +- To add a service to the default zone temporarily, use the command: + +``` +sudo firewall-cmd --add-service= +``` + +- To remove a service from the default zone temporarily, use the command: + +``` +sudo firewall-cmd --remove-service= +``` + +### ➡️ Adding / removing permanent rules + +- To add a service to the default zone permanently, use the command: + +``` +sudo firewall-cmd --permanent --add-service= +``` + +- To remove a service from the default zone permanently, use the command: + +``` +sudo firewall-cmd --permanent --remove-service= +``` + + +## 🔖 Probing settings + +### ➡️ Configuration + +List the current active zone (by default it is `public` zone), along with any configured rules and services for that zone: + +``` +sudo firewall-cmd --list-all +``` + +::: details +Example: +``` +public (active) + target: default + icmp-block-inversion: no + interfaces: eth0 + sources: + services: cockpit dhcpv6-client ssh + ports: + protocols: + forward: yes + masquerade: no + forward-ports: + source-ports: + icmp-blocks: + rich rules: +``` +::: + +### ➡️ Zones + +Current configuration of the firewall zones: + +``` +sudo firewall-cmd --get-default-zone +``` + +List all available zones with: + +``` +sudo firewall-cmd --get-zones +``` + +Get detailed information about a specific zone: +``` +sudo firewall-cmd --info-zone= command +``` + + +### ➡️ Services: list active services + +List of services that are currently allowed in the public zone. +::: tip +If no services are allowed in the zone, the output will be empty. In example we have output for default AlmaLinux settings. +::: + +``` +sudo firewall-cmd --zone=public --list-services +``` +::: details +Example: + +``` +cockpit dhcpv6-client ssh +``` +::: + +::: tip +Replace `public` with the name of any other zone that you want to check. +::: + + + +## 🔖 Configuring + +::: warning + +If on remote connection (`ssh`) +**Do not to block all incoming traffic**, it will cut you out from the remote system. + +``` +DANGEROUS firewall-cmd --set-default-zone=drop <--- dissallows ssh! +``` + +::: details + +Your access is allowed in the zone `public`: + +``` +sudo firewall-cmd --zone=public --list-services +``` +#### Example output: +``` +cockpit dhcpv6-client ssh +``` + +::: + + +### ➡️ Selecting Zones for Interfaces + +By default, each network interface is assigned to the default zone when the firewall is booted. +To change the zone of an interface during a session using the `--zone=` parameter with the `--change-interface=` parameter. + +For example, to transition the eth0 interface to the `work` zone, use the following command: + +``` +sudo firewall-cmd --zone=work--change-interface=eth0 +``` + +### ➡️ Changing the Default Zone + +If you want to handle all your interfaces with a single zone, it's recommended to select the appropriate default zone for your configuration. +To change the default zone, use the `--set-default-zone=` parameter followed by the desired zone name. +This command will immediately update any interface using the default zone. + +For example, to set the default zone to "home", use the following command: + + +``` +sudo firewall-cmd --set-default-zone=home +``` +:::details +Example: +``` +success +```` +::: + +By adjusting the default zone, you can simplify and customize your firewall configuration. + + +## 📋 Table of Services + +Table below lists common services and ports that can be used with the `firewall-cmd` command to add or remove them from the default zone (or other zones when using `--zone`). + + +| Group name | Description | Service Name | Protocol | Port | +| -------------------- | ------------------------------------ | -------------- | -------- | ----------- | +| **Databases** | | | | | +| MongoDB | MongoDB database | mongodb | TCP | 27017 | +| MySQL | MySQL database | mysql | TCP/UDP | 3306 | +| PostgreSQL | PostgreSQL database | postgresql | TCP | 5432 | +| Redis | Redis database | redis | TCP | 6379 | +| **Web Services** | | | | | +| FTP | FTP service | ftp | TCP | 21 | +| HTTP | HTTP service | http | TCP | 80 | +| HTTPS | HTTPS service | https | TCP | 443 | +| IMAP | IMAP service | imap | TCP | 143 | +| POP3 | POP3 service | pop3 | TCP | 110 | +| SMTP | SMTP service | smtp | TCP | 25 | +| **Security Services**| | | | | +| Firewall | Firewall Management | firewall | TCP/UDP | 9090 | +| IPsec NAT-T | IPsec NAT Traversal | ipsec-nat-t | UDP | 4500 | +| ISAKMP/IKE | ISAKMP/IKE | isakmp | UDP | 500 | +| LDAPS | Secure LDAP | ldaps | TCP | 636 | +| RADIUS accounting | RADIUS Accounting | radacct | UDP | 1813, 1814 | +| RADIUS authentication| RADIUS Authentication | radius | UDP | 1812 | +| SNMP | Simple Network Management | snmp | UDP | 161 | +| SNMP trap | SNMP Trap | snmptrap | UDP | 162 | +| SSH | Secure Shell | ssh | TCP | 22 | +| **System Services** | | | | | +| DHCP | Dynamic Host Configuration Protocol | dhcp | UDP | 67, 68 | +| DHCPv6 client | DHCPv6 Client | dhcpv6-client | UDP | 546, 547 | +| DHCPv6 server | DHCPv6 Server | dhcpv6-server | UDP | 547 | +| DNS | Domain Name System | dns | TCP/UDP | 53 | +| LDAP | Lightweight Directory Access Protocol | ldap | TCP | 389 | +| NFS | Network File System | nfs | TCP/UDP | 2049 | +| NTP | Network Time Protocol | ntp | UDP | 123 | +| RDP | Remote Desktop Protocol | rdp | TCP | 3389 | +| SMB | Server Message Block | smb | TCP | 445 | +| VNC server | Virtual Network Computing Server | vnc-server | TCP | 5900 | +| **Other Services** | +| IMAPS | Secure IMAP | imaps | TCP | 993 | +| HTTPS Alternate | HTTPS Alternate | https-alt | TCP | 8443 | +| LPD | Line Printer Daemon | lpd | TCP | 515 | +| L2TP VPN | L2TP VPN | l2tp | UDP | 1701 | +| POP3S | Secure POP3 | pop3s | TCP | 995 | +| POP3 | POP3 service | pop3 | TCP | 110 | +| PPTP VPN | PPTP VPN | pptp | TCP/UDP | 1723 | +| RIP | Routing Information Protocol | rip | UDP | 520 | +| SIP | Session Initiation Protocol | sip | TCP/UDP | 5060 | +| SIPs | Secure SIP | sips | TCP/UDP | 5061 | +| Telnet | Telnet Protocol | telnet | TCP | 23 | +| TFTP | Trivial File Transfer Protocol | tftp | UDP | 69 | + +This is not an exhaustive list, and the service names, protocols, and ports may vary depending on your specific system configuration. + +::: tip +In GNU/Linux systems the `/etc/services` file contains the list of TCP & UDP network services. `grep` it to find interesting data. +``` +grep mysql /etc/services +``` + +::: details +``` +mysql 3306/tcp # MySQL +mysql 3306/udp # MySQL +mysql-cluster 1186/tcp # MySQL Cluster Manager +mysql-cluster 1186/udp # MySQL Cluster Manager +mysql-cm-agent 1862/tcp # MySQL Cluster Manager Agent +mysql-cm-agent 1862/udp # MySQL Cluster Manager Agent +mysql-im 2273/tcp # MySQL Instance Manager +mysql-im 2273/udp # MySQL Instance Manager +mysql-proxy 6446/tcp # MySQL Proxy +mysql-proxy 6446/udp # MySQL Proxy +``` +::: + + + +## 📚 Further Reading and Next Steps + +In-depth Resources: +- Firewalld Series ❯ [Advanced Configuration Guide](#) 🚧 -- Work In Progress (5/15) -- HELP NEEDED: psuchanecki@almalinux.org + +Related Resources: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](../nginx/NginxSeriesA01.md) +- AlmaLinux System Series ❯ [Application Streams](SystemSeriesA01.md) diff --git a/docs/series/system/SystemSeriesA03.md b/docs/series/system/SystemSeriesA03.md new file mode 100644 index 000000000..17a931127 --- /dev/null +++ b/docs/series/system/SystemSeriesA03.md @@ -0,0 +1,72 @@ +# A03 ❯ NVIDIA Driver Installation Guide +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-22 +| 🔧 | Tested by
↳ version \| platform \| date | [none](mailto:none@almalinux.org)
↳ 9.x \| x86_64 \| 2023-05-xx | +
+ + +## 🌟 Introduction + +This guide provides instructions how to install NVIDIA's graphics driver for AlmaLinux in to variants: + +- **Binary Driver** [**8.x**](SystemSeriesA03R8.md) | [**9.x**](SystemSeriesA03R9.md) 👈 USING PRECOMPILED DRIVERS IS RECOMMENDED +- **Compiling From Source** [**8.x**](SystemSeriesA03R8.md) | [**9.x**](SystemSeriesA03R9.md) ⚠️ REQURIES SWITCHING TO ELRepo KERNEL + +## 🧠 Fundamental Concepts + +### Dynamic Kernel Module Support (DKMS) + +DKMS is a system utility that allows you to automatically build kernel modules. + +### ELRepo Kernel + +ELRepo is a community repository for Enterprise Linux distributions (e.g., RHEL, CentOS, AlmaLinux). It focuses on hardware-related packages to enhance your Linux experience. This repo provides a kernel (packages) which tracks mainline kernel very closely. In result, this kernel is updated frequently and sometimes it leads to temporary incompatiblity with NVIDIA driver sources. + +### NVIDIA Drivers Source +Install the NVIDIA graphics driver using the DKMS (Dynamic Kernel Module Support). Needs switching the kernel to ELRepo kernel version. + +### NVIDIA Precompiled/Binary Drivers +NVIDIA compiles and tests this driver for each precise kernel version. Installing it locks your kernel upgrade (with driver). It is the recommended way according to NVIDIA. + + +## 📖 Release-Specific Installation + +- **NVIDIA Driver Installation Guide ❯ [Installation on 8.x](SystemSeriesA03R8)** +- **NVIDIA Driver Installation Guide ❯ [Installation on 9.x](SystemSeriesA03R9)** + + +## FAQ + +### Q: Installed the module but getting Black Screen after reboot? + +WIP + +#### If you are able to change `GRUB` kernel boot parameters, do: + +``` +module_blacklist=nvidia,nvidia_drm,nvida_modeset +``` + +#### If you are getting Black Screen right after boot (no GRUB visible), do: + +WIP + +### Q: `prime-select` + +WIP + +## 📚 Further Reading and Next Steps + + +In-depth Resources: + +- AlmaLinux System Series ❯ [NVIDIA: Installation on 8.x](SystemSeriesA03R8.md) +- AlmaLinux System Series ❯ [NVIDIA: Installation on 9.x](SystemSeriesA03R9.md) + +Related Resources: + +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](../nginx/NginxSeriesA01.md) +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](SystemSeriesA02.md) diff --git a/docs/series/system/SystemSeriesA03R8.md b/docs/series/system/SystemSeriesA03R8.md new file mode 100644 index 000000000..ed52c279f --- /dev/null +++ b/docs/series/system/SystemSeriesA03R8.md @@ -0,0 +1,138 @@ +# A03 R8 ❯ NVIDIA: Installation on 8.x +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-22 +| 🔧 | Tested by
↳ version \| platform \| date | [none](mailto:none@almalinux.org)
↳ 9.x \| x86_64 \| 2023-05-xx | +
+ + +## 🌟 Introduction + +This is a dedicated example for the AlmaLinux 8.x series, demonstrating how to install NVIDIA graphics driver using one of two variants: + +* Variant I: Precompiled/Binary Driver +* Variant II: Compile Driver Source + + +## 🔖 Variant I: Install Binary Driver + + +➡️ Enable PowerTools: + +``` +sudo dnf config-manager --set-enabled powertools +sudo dnf makecache +``` + +➡️ Add EPEL8: + +``` +sudo dnf -y install epel-release +sudo dnf upgrade +``` + +➡️ Add NVIDIA Repository: + + +``` +sudo dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/cuda-rhel8.repo +sudo dnf makecache +``` + +➡️ Install the latest NVIDIA driver: + +``` +sudo dnf module install nvidia-driver:latest +``` + +➡️ Install third-party libraries for CUDA: + +``` +sudo dnf install freeglut-devel libX11-devel libXi-devel libXmu-devel make mesa-libGLU-devel freeimage-devel libglfw3-devel +``` + + +## 🔖 Variant II: Compile Driver Source + +::: tip +Installing NVIDIA drivers on AlmaLinux 8 requires using ELRepo Mainline kernel. +::: + +### ELRepo releated steps + +➡️ Enable PowerTools & add EPEL8: + +``` +sudo dnf config-manager --set-enabled powertools +sudo dnf makecache && sudo dnf -y install epel-release +sudo dnf makecache +``` + +➡️ Add ELRepo: + +``` +rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org +sudo dnf -y install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm +sudo dnf makecache +``` + +➡️ Enable ELRepo Mainline Kernel Repo: + +``` +sudo dnf config-manager --set-enabled elrepo-kernel +sudo dnf makecache +``` + +➡️ Install ELrepo Mainline kernel: + +``` +sudo dnf -y install kernel-ml kernel-ml-modules kernel-ml-modules-extra kernel-ml-devel kernel-headers +``` + +### NVIDIA driver build related steps + +➡️ Add NVIDIA repository: + +``` +sudo dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/cuda-rhel8.repo +sudo dnf makecache +``` + +➡️ Install NVIDIA DKMS Drivers: + +``` +sudo dnf module install nvidia-driver:latest-dkms +``` + +➡️ Disable Nouveau: + +``` +printf 'blacklist nouveau\n' | sudo tee /etc/modprobe.d/nouveau-blacklist.conf +sudo dracut -f --regenerate-all +lsmod | grep -Ei '(nouv|nvidia)' +``` + +➡️ Reboot to runlevel 3: + +``` +sudo systemctl set-default multi-user.target +sudo reboot +sudo systemctl set-default graphical.target +sudo reboot +``` + +## 📚 Further Reading and Next Steps + +Get Back: + +- AlmaLinux System Series ❯ [NVIDIA Driver Installation Guide](SystemSeriesA03.md) + +In-depth Resources: + +- AlmaLinux System Series ❯ [NVIDIA: Installation on 9.x](SystemSeriesA03R9.md) + +Related Resources: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](../nginx/NginxSeriesA01.md) +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](SystemSeriesA02.md) diff --git a/docs/series/system/SystemSeriesA03R9.md b/docs/series/system/SystemSeriesA03R9.md new file mode 100644 index 000000000..ca92cff55 --- /dev/null +++ b/docs/series/system/SystemSeriesA03R9.md @@ -0,0 +1,140 @@ +# A03 R9 ❯ NVIDIA: Installation on 9.x +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-05-22 +| 🔧 | Tested by
↳ version \| platform \| date | [none](mailto:none@almalinux.org)
↳ 9.x \| x86_64 \| 2023-05-xx | +
+ + +## 🌟 Introduction + +This is a dedicated example for the AlmaLinux 9.x series, demonstrating how to install NVIDIA graphics driver using one of two variants: + +* Variant I: Precompiled/Binary Driver +* Variant II: Compile Driver Source + + +## 🔖 Variant I: Install Binary Driver + + +➡️ Enable PowerTools: + +``` +sudo dnf config-manager --set-enabled powertools +sudo dnf makecache +``` + +➡️ Add EPEL9 + +``` +sudo dnf -y install epel-release +sudo dnf upgrade +``` + +➡️ Add NVIDIA Repository: + + +``` +sudo dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/cuda-rhel9.repo +sudo dnf makecache +``` + +➡️ Install the latest NVIDIA driver: + +``` +sudo dnf module install nvidia-driver:latest +``` + +➡️ Install third-party libraries for CUDA: + +``` +sudo dnf install freeglut-devel libX11-devel libXi-devel libXmu-devel make mesa-libGLU-devel freeimage-devel libglfw3-devel +``` + + +## 🔖 Variant II: Compile Driver Source + +::: tip +Installing NVIDIA drivers on AlmaLinux 9 requires using ELRepo Mainline kernel. +::: + +### ELRepo releated steps + +➡️ Enable CodeReady Builder & add EPEL9: + +``` +sudo dnf config-manager --set-enabled crb +sudo dnf makecache && sudo dnf -y install epel-release +sudo dnf makecache +``` + +➡️ Add ELRepo: + +``` +rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org +sudo dnf -y install https://www.elrepo.org/elrepo-release-9.el9.elrepo.noarch.rpm +sudo dnf makecache +``` + +➡️ Enable ELRepo Mainline Kernel Repo: + +``` +sudo dnf config-manager --set-enabled elrepo-kernel +sudo dnf makecache +``` + +➡️ Install ELrepo Mainline kernel: + +``` +sudo dnf -y install kernel-ml kernel-ml-modules kernel-ml-modules-extra kernel-ml-devel kernel-headers +``` + +### NVIDIA driver build related steps + +➡️ Add NVIDIA repository: + +``` +sudo dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/cuda-rhel9.repo +sudo dnf makecache +``` + +➡️ Install NVIDIA DKMS Drivers: + +``` +sudo dnf module install nvidia-driver:latest-dkms +``` + +➡️ Disable Nouveau: + +``` +printf 'blacklist nouveau\n' | sudo tee /etc/modprobe.d/nouveau-blacklist.conf +sudo dracut -f --regenerate-all +lsmod | grep -Ei '(nouv|nvidia)' +``` + +➡️ Reboot to runlevel 3: + +``` +sudo systemctl set-default multi-user.target +sudo reboot +sudo systemctl set-default graphical.target +sudo reboot +``` + +## 📚 Further Reading and Next Steps + +Get Back: + +- AlmaLinux System Series ❯ [NVIDIA Driver Installation Guide](SystemSeriesA03.md) + +In-depth Resources: + +- AlmaLinux System Series ❯ [NVIDIA: Installation on 8.x](SystemSeriesA03R8.md) + +Related Resources: +- AlmaLinux Nginx Series ❯ [A Beginner's Guide](../nginx/NginxSeriesA01.md) +- AlmaLinux Firewalld Series ❯ [A Beginner's Guide](SystemSeriesA0.md) + + diff --git a/docs/series/system/SystemSeriesA04.md b/docs/series/system/SystemSeriesA04.md new file mode 100644 index 000000000..2cdacf547 --- /dev/null +++ b/docs/series/system/SystemSeriesA04.md @@ -0,0 +1,64 @@ +# A04 ❯ Snapd Installation Guide +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-06-07 +| 🔧 | Tested by
↳ version \| platform \| date | NOT TESTED YET | +
+ +## 🌟 Introduction + +The snap packages for AlmaLinux can be found in the Extra Packages for Enterprise Linux (EPEL) repository. :package: + +## Enable EPEL repo :minidisc: +If you haven’t done it yet, enable the EPEL repository for your AlmaLinux system: +``` +sudo dnf install epel-release +sudo dnf upgrade +``` + +## Install :hammer_and_wrench: + +:::tip +:information_source: +Important for cloud images users! + +Before proceeding with the installation of snapd, it’s important to install the `kernel-modules` package as these type of images come with limited number of modules. This package includes SquashFS, a compressed read-only file system for Linux, which is necessary for the snapd functionality. +:::tip + +Install the `kernel-modules`, using the following command: +``` +sudo dnf install kernel-modules +``` + +With the EPEL repository and kernel-modules added to your AlmaLinux installation, you can now install the snapd package: :inbox_tray: + +``` +sudo dnf install snapd +``` + +## Set up :gear: + +Next, instruct systemd to enable the unit providing the snapd communication socket: + +``` +sudo systemctl enable --now snapd.socket +``` + +Then, enable classic snap support, create a symbolic link it requires: + +``` +sudo ln -s /var/lib/snapd/snap /snap +``` + +### Last installation step :checkered_flag: + +To make sure the paths for snapd are updated correctly, you just need to re-login. Reboot will work too. :arrows_counterclockwise: + +Congratulations, snapd is now installed and fully operational! :tada: + +### Optional: for Desktop Users :desktop_computer: + +If you’re using a desktop environment, consider installing the Snap Store app (https://forum.snapcraft.io/t/installing-the-snap-store-app/10077) 🛍️ + diff --git a/docs/series/system/SystemSeriesA05.md b/docs/series/system/SystemSeriesA05.md new file mode 100644 index 000000000..183175e95 --- /dev/null +++ b/docs/series/system/SystemSeriesA05.md @@ -0,0 +1,50 @@ +# A05 ❯ Multimedia Codecs Installation Guide +ℹ️ This article is part of AlmaLinux [System Series](/series/). +
+| 💡 | Experience Level | ⭐☆☆☆☆ | +|--- | --------- | --------| +| 📆 | Last modified | 2023-06-22 +| 🔧 | Tested by
↳ version \| platform \| date | NOT TESTED YET | + + +# Enable CRB: +```Bash +sudo dnf config-manager --set-enabled crb +``` +# Add EPEL9: + +```Bash +sudo dnf -y install epel-release +sudo dnf makecache +``` + +# Add RPMFusion: +```Bash +sudo dnf -y install --nogpgcheck https://mirrors.rpmfusion.org/free/el/rpmfusion-free-release-$(rpm -E %rhel).noarch.rpm https://mirrors.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-$(rpm -E %rhel).noarch.rpm +sudo dnf -y install rpmfusion-free-release-tainted rpmfusion-nonfree-release-tainted +sudo dnf makecache +``` + +# Install multimedia codecs: + +```bash +sudo dnf -y group install multimedia +sudo dnf -y install ffmpeg ffmpeg-libs ffmpeg-devel mpv +``` + +# Extra Audio packages +```bash +sudo dnf -y group install sound-and-video +``` + +# Play a DVD +```Bash +sudo dnf -y install libdvdcss +``` + +# Install mediaplayers like VLC, MPV or Celluloid from RPMFusion +```bash +sudo dnf install vlc +sudo dnf install mpv +sudo dnf install celluloid # Simple GTK+ frontend for mpv +```