Nilson Lopes noslin005

FreeIPA/IDM Setup

RHEL8 IPA Server

Use the procedure below to create a rhel8 IPA and to test migrating IPA from rhel8 to rhel9.

ipa1 (rhel8)

HOSTNAME=ipa1.example.com

https://access.redhat.com/labs/idmupgradehelper/

https://www.freeipa.org/page/V4/FreeIPA-on-FIPS

https://floblanc.wordpress.com/2023/08/23/interoperability-of-rhel-7-8-9-idm-server-and-rhel-7-8-9-idm-client/

https://oneuptime.com/blog/post/2026-03-04-migrate-identity-management-rhel-8-to-rhel-9/view

https://sambaxp.org/fileadmin/user_upload/sambaxp2023-Slides/Bokovoy_sXP23_FIPS_140_3.pdf

Create a Bootable Raw Disk

Attach Virtual Disk

sudo kpartx -avs test.img

Create Partition

sudo parted /dev/loop0 mktable msdos
sudo parted /dev/loop0 mkpart primary ext4 1 100%

sudo parted /dev/loop0 set 1 boot on

Remove LUKS Encryption from a Encrypted Rocky Linux 9

DISCLAIMER: USE AT YOUR OWN RISK

This procedure converts a LUKS2 container to LUKS1 and then decrypts it in place using cryptsetup reencrypt --decrypt.

Warning

Socat

Receiver

socat -d -d UDP-RECV:9000,ip-add-membership=239.0.0.1:0.0.0.0,interface=eth0,reuseaddr FILE:/dev/ttyS1,raw,echo=0
socat -d -d UDP-RECV:9000,ip-add-membership=239.0.0.1:0.0.0.0,interface=eth0,reuseaddr PTY,raw,echo=0,link=/tmp/virtual-tty
socat -d -d UDP-RECV:9000,ip-add-membership=239.0.0.1:0.0.0.0,reuseaddr SYSTEM:'tee /dev/ttyS1 > /tmp/mirror'

" Show line numbers
set number

" Allow normal pasting
set paste

" Set NPC analogues for set list
set listchars=eol:¬,tab:>-,trail:█,extends:>,precedes:<

VXLAN+VLAN+BRIDGE+LINUX

Both Host A and Host B are running Linux with identical VXLAN and VLAN aware bridge configurations.
They communicate through a VXLAN overlay (ID 100) carried over multicast (239.1.1.1) on UDP port 4789.
VLANs are extended across the VXLAN tunnel.
Subinterfaces br0.10 and br0.20 provide access to specific VLAN networks (10 and 20).
Devices on the same VLAN across hosts can directly communicate as if they are on the same Layer 2 segment.

Use iproute2 tools (testing)

Firewall

# INTERNAL ZONE
firewall-cmd --set-default-zone=internal
firewall-cmd --zone=internal --add-interface=bond0 --permanent
firewall-cmd --zone=internal --add-service={dhcp,tftp,http,https,dns,nfs,mountd,rpc-bind} --permanent

	#!/bin/bash
	set -euo pipefail

	# --- Settings ---
	IMG="rocky_installer.img"
	VMDK="rocky_installer.vmdk"
	SIZE="20G"
	LABEL="ROCKY_INSTALLER"
	ISO="/VMs/isos/Rocky-9.5-x86_64-dvd.iso"
	MNT_ISO="/mnt/iso"

	unbind C-b
	set-option -g prefix C-a
	bind-key C-a send-prefix

	bind \| split-window -h
	bind - split-window -v
	unbind '"'
	unbind %

	bind -n F5 setw synchronize-panes