Windows Updateしたらsamba ADへの接続がおかしくなった


sambaで作ったsamba AD環境がある。

最近、新しい仮想マシン作ってドメイン参加したあと、PowerShellで「Test-ComputerSecureChannel」を実行したら「False」と出た。

repairしても状況が変わらない

(ADサーバと該当マシン間の通信がセキュアチャネルを使って行われていないという状態)

いまつかっているsambaバージョンを確認すると4.18.2

# /usr/local/samba/sbin/smbd --version
Version 4.18.2
#

sambaのリリース履歴を見るとNetAppでも問題になったセキュリティ修正関連での修正が出ている。

CVE-2023-34967CVE-2022-2127CVE-2023-34968CVE-2023-34966 and CVE-2023-3347.

直接のバグとしては「Bug 15418 – secure channel faulty since Windows 10/11 update 07/2023」が該当している模様

バグであるならアップデートするしかないな、というわけで、samba 4.18.5へアップデート

展開して、make;make install; systemctl restart samba-ad-dc っと

# /usr/local/samba/sbin/smbd --version
Version 4.18.5
#

で、repairすると、今度は成功しました

Oracle Linux 9でWordPressサーバを立てる


Oracle Linux 9でwordpressサーバをたてる、という記事を2022年9月に書き始めたのですが、Oracle Linux 9用のEPELレポジトリにfail2banが含まれていなかっため、sshへの簡単な対策が行えないため書くのを中断していました。

2023年7月25日の更新でfail2banが収録されたようなので、改めて手順を作成してみます

準備1: Oracle Cloud用手順

準備1-1: IPv6アドレス割り当て:Oracle Cloudコンソール側

Oracle Cloudのコンソールを開いて、インスタンスにIPv6アドレスを割り当てます。

また、割り当てられたIPv6アドレスを確認します。

準備1-2: インスタンス側操作

Oracle Linux 9のイメージではIPv6が有効化されていたので、特に設定する必要はありませんでした。

準備2: 一般的な前準備

準備2-1: 日本時間にする

日本に住んでいる場合、日本時間表記の方が使いやすいので、OSも日本時間表示に設定する。

$ sudo timedatectl set-timezone Japan
$ 

準備2-2: パッケージを最新にアップデートする

現時点でインストール済みパッケージを最新にします。

Oracle Linux 9ではyum updateではなくdnf updateとなります。アップデート後は再起動します。(yumコマンドでも動きます)

$ sudo dnf update -y
<略>
$ sudo reboot

手順2-3:日本語Locale対応

ja_JP.UTF-8など日本語Localeで設定した際、「Failed to set locale, defaulting to C.UTF-8」というメッセージが出力される場合があります。

その場合は日本語Localeを追加インストールします。

$ sudo dnf install langpacks-ja glibc-langpack-ja
<略>
$

手順3: EPELレポジトリの追加

EPELレポジトリを使うので、使用できるようにします。

Oracle Linux 8と異なり、Oracle-Linux-9.2-2023.08.31-0 ではOracle CloudのOS管理下にレポジトリ管理が委託されていませんでした。

手順3-1:レポジトリの状態を確認

現状のレポジトリ設定状況を「sudo dnf repolist –all」を実行して確認します。

出力内に「This system is receiving updates from OSMS server.」という文字がなければこの手順で実行できます。

$ sudo dnf repolist --all
repo id                      repo name                                  status
ol9_MODRHCK                  Latest RHCK with fixes from Oracle for Ora disabled
ol9_RDMA                     Oracle Linux 9 (x86_64) RDMA               disabled
ol9_UEKR7                    Oracle Linux 9 UEK Release 7 (x86_64)      enabled
ol9_addons                   Oracle Linux 9 Addons (x86_64)             enabled
ol9_appstream                Oracle Linux 9 Application Stream Packages enabled
ol9_baseos_latest            Oracle Linux 9 BaseOS Latest (x86_64)      enabled
ol9_codeready_builder        Oracle Linux 9 CodeReady Builder (x86_64)  disabled
ol9_developer                Oracle Linux 9 Development Packages (x86_6 disabled
ol9_developer_EPEL           Oracle Linux 9 EPEL Packages for Developme disabled
ol9_developer_UEKR7          Developer Preview of UEK Release 7 (x86_64 disabled
ol9_developer_kvm_utils      Oracle Linux 9 KVM Utilities for Developme disabled
ol9_distro_builder           Oracle Linux 9 Distro Builder (x86_64) - ( disabled
ol9_ksplice                  Ksplice for Oracle Linux 9 (x86_64)        enabled
ol9_kvm_utils                Oracle Linux 9 KVM Utilities (x86_64)      disabled
ol9_oci_included             Oracle Linux 9 OCI Included Packages (x86_ enabled
ol9_u0_baseos_base           Oracle Linux 9 BaseOS GA (x86_64)          disabled
ol9_u1_baseos_base           Oracle Linux 9.1 BaseOS (x86_64)           disabled
ol9_u2_baseos_base           Oracle Linux 9.2 BaseOS (x86_64)           disabled
ol9_x86_64_userspace_ksplice Ksplice aware userspace packages for Oracl disabled
$

有効化するために「sudo dnf config-manager –set-enabled ol9_developer_EPEL」を実行します。

$ sudo dnf config-manager --set-enabled ol9_developer_EPEL
$ sudo dnf repolist --all
repo id                      repo name                                  status
ol9_MODRHCK                  Latest RHCK with fixes from Oracle for Ora disabled
ol9_RDMA                     Oracle Linux 9 (x86_64) RDMA               disabled
ol9_UEKR7                    Oracle Linux 9 UEK Release 7 (x86_64)      enabled
ol9_addons                   Oracle Linux 9 Addons (x86_64)             enabled
ol9_appstream                Oracle Linux 9 Application Stream Packages enabled
ol9_baseos_latest            Oracle Linux 9 BaseOS Latest (x86_64)      enabled
ol9_codeready_builder        Oracle Linux 9 CodeReady Builder (x86_64)  disabled
ol9_developer                Oracle Linux 9 Development Packages (x86_6 disabled
ol9_developer_EPEL           Oracle Linux 9 EPEL Packages for Developme enabled
ol9_developer_UEKR7          Developer Preview of UEK Release 7 (x86_64 disabled
ol9_developer_kvm_utils      Oracle Linux 9 KVM Utilities for Developme disabled
ol9_distro_builder           Oracle Linux 9 Distro Builder (x86_64) - ( disabled
ol9_ksplice                  Ksplice for Oracle Linux 9 (x86_64)        enabled
ol9_kvm_utils                Oracle Linux 9 KVM Utilities (x86_64)      disabled
ol9_oci_included             Oracle Linux 9 OCI Included Packages (x86_ enabled
ol9_u0_baseos_base           Oracle Linux 9 BaseOS GA (x86_64)          disabled
ol9_u1_baseos_base           Oracle Linux 9.1 BaseOS (x86_64)           disabled
ol9_u2_baseos_base           Oracle Linux 9.2 BaseOS (x86_64)           disabled
ol9_x86_64_userspace_ksplice Ksplice aware userspace packages for Oracl disabled
$

手順4: インターネット公開用設定

手順4-1: fail2ban導入

公開サーバは各種のアタックにさらされます。管理用sshポートにもやってきます。

多少なりとも軽減するためにEPELレポジトリ収録のfail2banを使用します。

$ sudo dnf install fail2ban -y
<略>
$

カスタム設定は/etc/fail2ban/jail.local に対して行います。

$ sudo vi /etc/fail2ban/jail.local
$ cat /etc/fail2ban/jail.local
[DEFAULT]
# 86400秒=24時間以内に5回不審なアクセスがあったら24時間BAN
bantime  = 86400
findtime  = 86400
maxretry = 5
# 259200秒=3日以内に5回不審なアクセスがあったら3日間BAN
#bantime  = 259200
#findtime  = 259200
#maxretry = 5
# 除外IP
ignoreip = 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
[sshd]
enabled = true
banaction = firewallcmd-ipset
$

上記設定では24時間BANにしていますが、まぁ、3日BANでもかまわないとは思います。(本当に間違えた場合に困るのでほどほどにしておくとよい)

fail2banをOS起動時に実行する設定と、今すぐfail2banを起動するコマンドを実行します。

$ sudo systemctl enable fail2ban
$ sudo systemctl start fail2ban
$

以降、アタックがあると /var/log/fail2ban.log にログが出ます。

手順4-2: Webサーバ用ポート公開設定

この段階では、dhcpv6-clientとsshのみが許可されています。

Webサーバ公開用にhttp(ポート80)とhttps(ポート443)を追加します。

$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens3
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
$
$ sudo firewall-cmd --permanent --add-service=http
success
$ sudo firewall-cmd --permanent --add-service=https
success
$ sudo firewall-cmd --reload
success
$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens3
  sources:
  services: dhcpv6-client http https ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
$

手順5: php 7.4追加

Oracle Linux 9環境では、moduleという形で複数バージョンのソフトウェアが提供されている場合があります。

phpに関してどのようなものがあるのかを「dnf module list | grep php」を実行して確認します。

$ dnf module list | grep php
php        8.1    common [d], devel, minimal            PHP scripting language  
$

Oracle Linux 9.2では php 8.1だけが提供されているようなので、phpとだけ指定してインストールします。

$ sudo dnf install php -y
Last metadata expiration check: 0:18:54 ago on Tue 12 Sep 2023 11:13:37 AM JST.
Dependencies resolved.
================================================================================
 Package             Arch    Version                   Repository          Size
================================================================================
Installing:
 php                 x86_64  8.0.27-1.el9_1            ol9_appstream       10 k
Installing dependencies:
 apr                 x86_64  1.7.0-11.el9              ol9_appstream      132 k
 apr-util            x86_64  1.6.1-20.el9_2.1          ol9_appstream       98 k
 apr-util-bdb        x86_64  1.6.1-20.el9_2.1          ol9_appstream       12 k
 httpd-core          x86_64  2.4.53-11.0.1.el9_2.5     ol9_appstream      1.8 M
 httpd-filesystem    noarch  2.4.53-11.0.1.el9_2.5     ol9_appstream       14 k
 httpd-tools         x86_64  2.4.53-11.0.1.el9_2.5     ol9_appstream       96 k
 nginx-filesystem    noarch  1:1.20.1-14.0.1.el9       ol9_appstream       11 k
 oracle-logos-httpd  noarch  90.2-1.0.2.el9            ol9_baseos_latest   37 k
 php-common          x86_64  8.0.27-1.el9_1            ol9_appstream      716 k
Installing weak dependencies:
 apr-util-openssl    x86_64  1.6.1-20.el9_2.1          ol9_appstream       14 k
 httpd               x86_64  2.4.53-11.0.1.el9_2.5     ol9_appstream       67 k
 mod_http2           x86_64  1.15.19-4.el9_2.4         ol9_appstream      157 k
 mod_lua             x86_64  2.4.53-11.0.1.el9_2.5     ol9_appstream       61 k
 php-cli             x86_64  8.0.27-1.el9_1            ol9_appstream      3.1 M
 php-fpm             x86_64  8.0.27-1.el9_1            ol9_appstream      1.6 M
 php-mbstring        x86_64  8.0.27-1.el9_1            ol9_appstream      470 k
 php-opcache         x86_64  8.0.27-1.el9_1            ol9_appstream      512 k
 php-pdo             x86_64  8.0.27-1.el9_1            ol9_appstream       90 k
 php-xml             x86_64  8.0.27-1.el9_1            ol9_appstream      144 k
Transaction Summary
================================================================================
Install  20 Packages
<略>
  php-pdo-8.0.27-1.el9_1.x86_64
  php-xml-8.0.27-1.el9_1.x86_64
Complete!
$

手順6: MySQL設定編

Oralce Linux 9.2ではMySQL 8.0.32 か mariadb 10.5.16が提供されています。

とりあえず、Oracle直営なのでMySQLを使っておきます。

$ sudo dnf install mysql-server -y
Last metadata expiration check: 0:23:36 ago on Tue 12 Sep 2023 11:13:37 AM JST.
Dependencies resolved.
================================================================================
 Package                      Arch     Version            Repository       Size
================================================================================
Installing:
 mysql-server                 x86_64   8.0.32-1.el9_2     ol9_appstream    17 M
Installing dependencies:
 mariadb-connector-c-config   noarch   3.2.6-1.el9_0      ol9_appstream   9.7 k
 mecab                        x86_64   0.996-3.el9.3      ol9_appstream   384 k
 mysql                        x86_64   8.0.32-1.el9_2     ol9_appstream   2.8 M
 mysql-common                 x86_64   8.0.32-1.el9_2     ol9_appstream   103 k
 mysql-errmsg                 x86_64   8.0.32-1.el9_2     ol9_appstream   513 k
 mysql-selinux                noarch   1.0.5-1.el9_0      ol9_appstream    35 k
 protobuf-lite                x86_64   3.14.0-13.el9      ol9_appstream   233 k
Transaction Summary
================================================================================
Install  8 Packages
<略>
Installed:
  mariadb-connector-c-config-3.2.6-1.el9_0.noarch
  mecab-0.996-3.el9.3.x86_64
  mysql-8.0.32-1.el9_2.x86_64
  mysql-common-8.0.32-1.el9_2.x86_64
  mysql-errmsg-8.0.32-1.el9_2.x86_64
  mysql-selinux-1.0.5-1.el9_0.noarch
  mysql-server-8.0.32-1.el9_2.x86_64
  protobuf-lite-3.14.0-13.el9.x86_64
Complete!
$

mysqldを自動起動する設定とします。

$ sudo systemctl enable mysqld
Created symlink /etc/systemd/system/multi-user.target.wants/mysqld.service → /usr/lib/systemd/system/mysqld.service.
$

mysqldを起動します。

$ sudo systemctl start mysqld
$

WordPress用データベースを作成します。

MySQL 8におけるデータベースユーザ作成と権限の割り当てが従来の「grant all on DB名.* to wordpress@localhost identified by ‘パスワード’;」という一文から、「create user ~」と「grant ~」の2つに分かれている点に注意が必要です。

$ sudo mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.32 Source distribution
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create database DB名 character set utf8;
Query OK, 1 row affected, 1 warning (0.01 sec)
mysql> create user wordpress@localhost  identified by 'パスワード';
Query OK, 0 rows affected (0.01 sec)
mysql> grant all privileges on DB名.* to wordpress@localhost;
Query OK, 0 rows affected (0.00 sec)
mysql> quit
Bye
$

手順7: Webサーバ設定

手順7-1: httpdインストール

httpdをインストールします。

Oracle Linux 9.2ではWebサーバとして Apache(httpd) 2.4.53 、nginx 1.20.1、nginx 1.22.1が使えるが、apacheを使う。

$ sudo dnf install httpd -y
Last metadata expiration check: 0:05:50 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Package httpd-2.4.53-11.0.1.el9_2.5.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
$

って・・・よくみたらphpインストール時にインストール済みでした。

次で設定変更をするので、この段階ではhttpdを起動しません。

OS起動時に自動起動する設定だけを行います。

$ sudo systemctl enable httpd
$

手順7-2: dehydratedによるLet’s Encrypt導入

Let’s EncryptによるSSL証明書導入はcertbotを使うのが一般的ではあるのだが、python環境とあわせてパッケージサイズが大きいので、コンパクトでEPELにも収録されているdehydratedを使用する。

$ sudo dnf install dehydrated -y
Last metadata expiration check: 0:07:19 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package         Arch        Version              Repository               Size
================================================================================
Installing:
 dehydrated      noarch      0.7.1-1.el9          ol9_developer_EPEL      154 k
Installing dependencies:
 s-nail          x86_64      14.9.22-6.el9        ol9_appstream           626 k
Transaction Summary
================================================================================
Install  2 Packages
<略>
Installed:
  dehydrated-0.7.1-1.el9.noarch           s-nail-14.9.22-6.el9.x86_64
Complete!
$

dehydratedによるSSL証明書取得処理には /var/www/dehydrated が使用されるためディレクトリを作成します。

$ sudo mkdir  /var/www/dehydrated
$

http://~/.well-known/acme-challenge でアクセスした時に上記ディレクトリが開くようApacheの設定を /etc/httpd/conf.d/dehydrated.conf として作成します。(sudo vi /etc/httpd/conf.d/dehydrated.conf )

$ sudo vi /etc/httpd/conf.d/dehydrated.conf
$ cat /etc/httpd/conf.d/dehydrated.conf
Alias /.well-known/acme-challenge /var/www/dehydrated
<Directory /var/www/dehydrated/>
</Directory>
$

httpdを起動します

$ sudo systemctl start httpd
$

SSL証明書を発行するホスト名を /etc/dehydrated/domains.txt に記載する。(sudo vi /etc/dehydrated/domains.txt)

1行に複数のホスト名を記載するとaliasになります。

$ sudo vi /etc/dehydrated/domains.txt
$ sudo cat /etc/dehydrated/domains.txt
ホスト1名.ドメイン名 ホスト2名.ドメイン名
$

登録操作を開始します。

$ sudo dehydrated --register
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
To use dehydrated with this certificate authority you have to agree to their terms of service which you can find here: https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf
To accept these terms of service run "/bin/dehydrated --register --accept-terms".
$ sudo /bin/dehydrated --register --accept-terms
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
+ Generating account key...
+ Registering account key with ACME server...
+ Fetching account URL...
+ Done!
$

初回のSSL証明書発行処理を実行します。

$ sudo dehydrated --cron
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
 + Creating chain cache directory /etc/dehydrated/chains
Processing ホスト1名.ドメイン名 with alternative names: ホスト2名.ドメイン名
 + Creating new directory /etc/dehydrated/certs/ホスト1名.ドメイン名 ...
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 2 authorizations URLs from the CA
 + Handling authorization for ホスト1名.ドメイン名
 + Handling authorization for ホスト2名.ドメイン名
 + 2 pending challenge(s)
 + Deploying challenge tokens...
 + Responding to challenge for ホスト1名.ドメイン名 authorization...
 + Challenge is valid!
 + Responding to challenge for ホスト2名.ドメイン名 authorization...
 + Challenge is valid!
 + Cleaning challenge tokens...
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Done!
 + Running automatic cleanup
$

手順7-3: WebサーバへのSSL証明書設定

まず、httpdにmod_sslを追加します。

$ sudo dnf install mod_ssl -y
Last metadata expiration check: 0:13:55 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package      Arch        Version                      Repository          Size
================================================================================
Installing:
 mod_ssl      x86_64      1:2.4.53-11.0.1.el9_2.5      ol9_appstream      119 k
Transaction Summary
================================================================================
Install  1 Package
<略>
$

標準の /etc/httpd/conf.d/ssl.conf は使わず、Mozilla SSL Configuration Generatorベースの設定を /etc/httpd/conf.d/ssl-mozilla.conf として作成します。(なお、ssl.conf には”Listen 443 https”設定もあるので、そのままにしています)

$ sudo vi /etc/httpd/conf.d/ssl-mozilla.conf
$ cat /etc/httpd/conf.d/ssl-mozilla.conf
# generated 2023-09-12, Mozilla Guideline v5.7, Apache 2.4.53, OpenSSL 3.0.7, intermediate configuration
# https://ssl-config.mozilla.org/#server=apache&version=2.4.53&config=intermediate&openssl=3.0.7&guideline=5.7
# this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers
<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
    SSLEngine on
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt >> /path/to/signed_cert_and_intermediate_certs_and_dhparams
    SSLCertificateFile      /etc/dehydrated/certs/<ホスト名>/cert.pem
    SSLCertificateKeyFile   /etc/dehydrated/certs/<ホスト名>/privkey.pem
    # enable HTTP/2, if available
    Protocols h2 http/1.1
    # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
    Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>
# intermediate configuration
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder     off
SSLSessionTickets       off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
$

httpdを再起動します。

$ sudo systemctl restart httpd
$

手順8: WordPress導入

手順8-1: WordPressの基本インストール

WordPressのWebから最新版をダウンロードして、/var/www/html以下に展開します。
(日本語環境向けのlatest-ja.tar.gzファイルを使っていないのはWordpressプラグインが正常にインストールできるかを確認するためにWP Multibyte Patchを手動インストールする手順を入れているためです)

$ cd /var/www/html
$ ls
$ sudo curl -O https://wordpress.org/latest.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 22.3M  100 22.3M    0     0  17.6M      0  0:00:01  0:00:01 --:--:-- 17.6M
$ ls
latest.tar.gz
$ sudo tar xfz latest.tar.gz
$ ls -l
total 22904
-rw-r--r--. 1 root   root   23447259 Sep 12 11:57 latest.tar.gz
drwxr-xr-x. 5 nobody nobody     4096 Aug 29 23:14 wordpress
$ sudo rm latest.tar.gz
$

WordPressディレクトリの所有者をWebサービスのユーザである「apache」に変更します。

$ ps -ef|grep http
root       44914       1  0 11:56 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache     44915   44914  0 11:56 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache     44916   44914  0 11:56 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache     44917   44914  0 11:56 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache     44918   44914  0 11:56 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
opc        45353    7003  0 11:59 pts/0    00:00:00 grep --color=auto http
$ sudo chown -R apache:apache wordpress/
$ ls -l
total 4
drwxr-xr-x. 5 apache apache 4096 Aug 29 23:14 wordpress
$

/var/www/html/wordpress をDocumentRootとするように ssl-mozilla.conf に追加して、httpdを再起動します。

$ sudo vi /etc/httpd/conf.d/ssl-mozilla.conf
$ cat /etc/httpd/conf.d/ssl-mozilla.conf
# generated 2023-09-12, Mozilla Guideline v5.7, Apache 2.4.53, OpenSSL 3.0.7, intermediate configuration
# https://ssl-config.mozilla.org/#server=apache&version=2.4.53&config=intermediate&openssl=3.0.7&guideline=5.7
# this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers
<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
    DocumentRoot /var/www/html/wordpress
    SSLEngine on
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt >> /path/to/signed_cert_and_intermediate_certs_and_dhparams
    SSLCertificateFile      /etc/dehydrated/certs/<ホスト名>/cert.pem
    SSLCertificateKeyFile   /etc/dehydrated/certs/<ホスト名>/privkey.pem
    # enable HTTP/2, if available
    Protocols h2 http/1.1
    # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
    Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>
# intermediate configuration
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder     off
SSLSessionTickets       off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
$
$ sudo systemctl restart httpd
$

手順8-2: 「missing the MySQL extension」がでる場合の手順

いまの状態でブラウザからアクセスすると、下記の表示になります。

これはphpからMySQLにアクセスするためのパッケージがインストールされていないためなので、php-mysqlndを追加して、httpdを再起動します。

$ sudo dnf install php-mysqlnd -y
Last metadata expiration check: 0:25:26 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package           Architecture Version               Repository           Size
================================================================================
Installing:
 php-mysqlnd       x86_64       8.0.27-1.el9_1        ol9_appstream       157 k
Transaction Summary
================================================================================
Install  1 Package
<略>
$ sudo systemctl restart httpd
$

WordPressの設定手順を進めると wp-config.php に書き込めない、と出ますので、「sudo vi /var/www/html/wordpress/wp-config.php」を実行し、指定された内容を記載します。

手順9: SELinux設定

手順9-1: httpdのネットワーク接続問題

一見するとここまででうまく動いているように見えます。

しかし、プラグインをインストールしようとするとエラーになります。

/var/log/audit/audit.logを確認すると下記のようなログが出ています。

type=AVC msg=audit(1622095859.957:2064): avc:  denied  { name_connect } for  pid=8908 comm="php-fpm" dest=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0
type=AVC msg=audit(1622095868.397:2065): avc:  denied  { name_connect } for  pid=8313 comm="php-fpm" dest=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0
type=AVC msg=audit(1622095868.401:2066): avc:  denied  { name_connect } for  pid=8313 comm="php-fpm" dest=80 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0

これはhttpd_can_network_connect という値で制御されている

現在の設定値を「sudo getsebool -a |grep httpd_can_network」で確認し、「sudo setsebool -P httpd_can_network_connect on」で有効にする

$ sudo getsebool -a |grep httpd_can_network
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
$ sudo setsebool -P httpd_can_network_connect on
$ sudo getsebool -a |grep httpd_can_network
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
$

この変更ではhttpdの再起動は不要。

手順9-2: php-fpmの書き込み権限問題

プラグインやテーマのインストールについては問題なくても、WordPressのアップデートが出来ない。

このときの/var/log/audit/audit.logは下記

type=AVC msg=audit(1694506911.363:1538): avc:  denied  { write } for  pid=51364 comm="php-fpm" name="wordpress" dev="dm-0" ino=34891933 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir permissive=0

こちらは/var/www/html/wordpress に対して httpdから書き込みが行えるような SELinuxのコンテキストをつけることで解決する。

「sudo chcon -R -t httpd_sys_script_rw_t /var/www/html/wordpress」

$ ls -lZ /var/www/html/
total 4
drwxr-xr-x. 5 apache apache unconfined_u:object_r:httpd_sys_content_t:s0 4096 Sep 12 13:14 wordpress
$ sudo chcon -R -t httpd_sys_script_rw_t /var/www/html/wordpress
$ ls -lZ /var/www/html/
total 4
drwxr-xr-x. 5 apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 4096 Sep 12 13:14 wordpress
$

手順9-3:Wordpressプラグイン追加の動作確認

WordPressプラグインがインストールできる状態になっているかを確認するために「WP Multibyte Patch」をインストールします。

これをインストールするとWordpressの設定画面([Settings]-[General])に「Site language(サイトの言語)」が追加され、「日本語」表示に切り替えることができるようになります。

手順10: WordPressで取り扱えるファイルサイズの拡大

WordPressで取り扱えるファイルは標準状態だと2MBになっている。

WordPressのドキュメントのFile Upload Sizes を見ると、これはphpの設定ファイル /etc/php.ini による制限となっている。

Oracle Linux 9の標準設定では下記の値となっている。

<略>
post_max_size = 8M
<略>
upload_max_filesize = 2M
<略>

で・・・よくある手順だと軽率に /etc/php.ini を書き換えていますが、 /etc/php.d/ 以下にファイルを追加することで、そちらの設定項目を優先させることができる機能があるため、 /etc/php.d/90-wordpress.ini に変更したい2行だけを記載したファイルを作成します。

$ sudo vi /etc/php.d/90-wordpress.ini
$ cat /etc/php.d/90-wordpress.ini
post_max_size = 100M
upload_max_filesize = 100M
$

phpの設定変更を反映させるために「sudo systemctl restart php-fpm」を実行します。

$ sudo systemctl restart php-fpm
$

手順11: WordPressのSite Health Status対応

WordPressのサイトステータスを見てみると、いくつかパッケージを要求されている。

上から順に調査

Oracle Linux 8ではimagemagickのphpモジュールはなかったが、Oracle Linux 9だとあったので「sudo dnf install php-pecl-imagick」でインストール

$ sudo dnf install php-pecl-imagick
Last metadata expiration check: 1:22:23 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package                        Arch   Version         Repository          Size
================================================================================
Installing:
 php-pecl-imagick               x86_64 3.7.0-1.el9     ol9_developer_EPEL 149 k
Installing dependencies:
 ImageMagick-libs               x86_64 6.9.12.93-1.el9 ol9_developer_EPEL 2.6 M
 LibRaw                         x86_64 0.20.2-5.el9    ol9_appstream      382 k
 ModemManager-glib              x86_64 1.20.2-1.el9    ol9_baseos_latest  334 k
 adobe-mappings-cmap            noarch 20171205-12.el9 ol9_appstream      2.0 M
 adobe-mappings-cmap-deprecated noarch 20171205-12.el9 ol9_appstream      129 k
 adobe-mappings-pdf             noarch 20180407-10.el9 ol9_appstream      686 k
 adwaita-cursor-theme           noarch 40.1.1-3.el9    ol9_appstream      686 k
 adwaita-icon-theme             noarch 40.1.1-3.el9    ol9_appstream       16 M
 alsa-lib                       x86_64 1.2.8-3.el9     ol9_appstream      586 k
 at-spi2-atk                    x86_64 2.38.0-4.el9    ol9_appstream       92 k
 at-spi2-core                   x86_64 2.40.3-1.el9    ol9_appstream      262 k
 atk                            x86_64 2.36.0-5.el9    ol9_appstream      378 k
 avahi-glib                     x86_64 0.8-12.el9_2.1  ol9_appstream       13 k
 bluez-libs                     x86_64 5.64-2.el9      ol9_baseos_latest   83 k
 bubblewrap                     x86_64 0.4.1-6.el9     ol9_baseos_latest   50 k
 colord-libs                    x86_64 1.4.5-4.el9     ol9_appstream      235 k
 cups-libs                      x86_64 1:2.3.3op2-16.el9_2.1
                                                       ol9_baseos_latest  264 k
 exempi                         x86_64 2.6.0-0.2.20211007gite23c213.el9
                                                       ol9_appstream      531 k
 exiv2-libs                     x86_64 0.27.5-2.el9    ol9_appstream      780 k
 fdk-aac-free                   x86_64 2.0.0-8.el9     ol9_appstream      325 k
 flac-libs                      x86_64 1.3.3-10.el9    ol9_appstream      226 k
 flatpak-selinux                noarch 1.12.7-2.el9    ol9_appstream       22 k
 flatpak-session-helper         x86_64 1.12.7-2.el9    ol9_appstream       80 k
 fuse                           x86_64 2.9.9-15.el9    ol9_baseos_latest   91 k
 gd                             x86_64 2.3.2-3.el9     ol9_appstream      132 k
 gdk-pixbuf2-modules            x86_64 2.42.6-3.el9    ol9_appstream       96 k
 geoclue2                       x86_64 2.6.0-7.el9     ol9_appstream      136 k
 giflib                         x86_64 5.2.1-9.el9     ol9_appstream       53 k
 google-droid-sans-fonts        noarch 20200215-11.el9.2
                                                       ol9_appstream      2.7 M
 graphene                       x86_64 1.10.6-2.el9    ol9_appstream       64 k
 graphviz                       x86_64 2.44.0-25.el9   ol9_appstream      3.4 M
 gsm                            x86_64 1.0.19-6.el9    ol9_appstream       39 k
 gstreamer1                     x86_64 1.18.4-4.el9    ol9_appstream      1.5 M
 gstreamer1-plugins-base        x86_64 1.18.4-5.el9    ol9_appstream      2.1 M
 gtk-update-icon-cache          x86_64 3.24.31-2.el9   ol9_appstream       34 k
 gtk2                           x86_64 2.24.33-8.el9   ol9_appstream      3.6 M
 gtk3                           x86_64 3.24.31-2.el9   ol9_appstream      5.0 M
 hicolor-icon-theme             noarch 0.17-13.el9     ol9_appstream       70 k
 imath                          x86_64 3.1.2-1.el9     ol9_appstream      102 k
 iso-codes                      noarch 4.6.0-3.el9     ol9_appstream      4.0 M
 jasper-libs                    x86_64 2.0.28-3.el9    ol9_appstream      151 k
 jbig2dec-libs                  x86_64 0.19-7.el9      ol9_appstream       77 k
 jbigkit-libs                   x86_64 2.1-23.el9      ol9_appstream       58 k
 lcms2                          x86_64 2.12-3.el9      ol9_appstream      167 k
 libICE                         x86_64 1.0.10-8.el9    ol9_appstream       71 k
 libSM                          x86_64 1.2.3-10.el9    ol9_appstream       42 k
 libX11-xcb                     x86_64 1.7.0-7.el9     ol9_appstream       12 k
 libXaw                         x86_64 1.0.13-19.el9   ol9_appstream      198 k
 libXcomposite                  x86_64 0.4.5-7.el9     ol9_appstream       29 k
 libXcursor                     x86_64 1.2.0-7.el9     ol9_appstream       35 k
 libXdamage                     x86_64 1.1.5-7.el9     ol9_appstream       27 k
 libXfixes                      x86_64 5.0.3-16.el9    ol9_appstream       20 k
 libXi                          x86_64 1.7.10-8.el9    ol9_appstream       40 k
 libXinerama                    x86_64 1.1.4-10.el9    ol9_appstream       15 k
 libXmu                         x86_64 1.1.3-8.el9     ol9_appstream       79 k
 libXpm                         x86_64 3.5.13-8.el9_1  ol9_appstream       62 k
 libXrandr                      x86_64 1.5.2-8.el9     ol9_appstream       28 k
 libXt                          x86_64 1.2.0-6.el9     ol9_appstream      180 k
 libXtst                        x86_64 1.2.3-16.el9    ol9_appstream       21 k
 libXv                          x86_64 1.0.11-16.el9   ol9_appstream       19 k
 libXxf86vm                     x86_64 1.1.4-18.el9    ol9_appstream       19 k
 libasyncns                     x86_64 0.8-22.el9      ol9_appstream       30 k
 libcanberra                    x86_64 0.30-26.el9     ol9_appstream      100 k
 libcanberra-gtk3               x86_64 0.30-26.el9     ol9_appstream       39 k
 libdrm                         x86_64 2.4.114-1.el9   ol9_appstream      165 k
 libepoxy                       x86_64 1.5.5-4.el9     ol9_appstream      246 k
 libexif                        x86_64 0.6.22-6.el9    ol9_appstream      462 k
 libfontenc                     x86_64 1.1.3-17.el9    ol9_appstream       31 k
 libgexiv2                      x86_64 0.12.3-1.el9    ol9_appstream       88 k
 libglvnd                       x86_64 1:1.3.4-1.el9   ol9_appstream      134 k
 libglvnd-egl                   x86_64 1:1.3.4-1.el9   ol9_appstream       35 k
 libglvnd-glx                   x86_64 1:1.3.4-1.el9   ol9_appstream      141 k
 libgs                          x86_64 9.54.0-9.el9    ol9_appstream      3.4 M
 libgsf                         x86_64 1.14.47-5.el9   ol9_appstream      302 k
 libgxps                        x86_64 0.3.2-3.el9     ol9_appstream       86 k
 libijs                         x86_64 0.35-15.el9     ol9_appstream       30 k
 libiptcdata                    x86_64 1.0.5-9.el9     ol9_appstream       73 k
 libldac                        x86_64 2.0.2.3-10.el9  ol9_appstream       41 k
 liblqr-1                       x86_64 0.4.2-19.el9    ol9_developer_EPEL  53 k
 libnotify                      x86_64 0.7.9-8.el9     ol9_appstream       50 k
 libogg                         x86_64 2:1.3.4-6.el9   ol9_appstream       38 k
 libosinfo                      x86_64 1.10.0-1.el9    ol9_appstream      345 k
 libpaper                       x86_64 1.1.28-4.el9    ol9_appstream       67 k
 libpciaccess                   x86_64 0.16-6.el9      ol9_baseos_latest   28 k
 libraqm                        x86_64 0.8.0-1.el9     ol9_developer_EPEL  19 k
 libsbc                         x86_64 1.4-9.el9       ol9_appstream       45 k
 libsndfile                     x86_64 1.0.31-7.el9    ol9_appstream      212 k
 libtheora                      x86_64 1:1.1.1-31.el9  ol9_appstream      168 k
 libtiff                        x86_64 4.4.0-8.el9_2   ol9_appstream      202 k
 libtool-ltdl                   x86_64 2.4.6-45.el9    ol9_appstream       36 k
 libtracker-sparql              x86_64 3.1.2-3.el9_1   ol9_appstream      354 k
 libvisual                      x86_64 1:0.4.0-34.el9  ol9_appstream      152 k
 libvorbis                      x86_64 1:1.3.7-5.el9   ol9_appstream      198 k
 libwayland-client              x86_64 1.21.0-1.el9    ol9_appstream       32 k
 libwayland-cursor              x86_64 1.21.0-1.el9    ol9_appstream       18 k
 libwayland-egl                 x86_64 1.21.0-1.el9    ol9_appstream       12 k
 libwayland-server              x86_64 1.21.0-1.el9    ol9_appstream       41 k
 libwebp                        x86_64 1.2.0-6.el9_1   ol9_appstream      284 k
 libwmf-lite                    x86_64 0.2.12-10.el9   ol9_appstream       77 k
 libxkbcommon                   x86_64 1.0.3-4.el9     ol9_appstream      133 k
 libxshmfence                   x86_64 1.3-10.el9      ol9_appstream       13 k
 low-memory-monitor             x86_64 2.1-4.el9       ol9_appstream       42 k
 mesa-libEGL                    x86_64 22.3.0-2.el9    ol9_appstream      123 k
 mesa-libGL                     x86_64 22.3.0-2.el9    ol9_appstream      168 k
 mesa-libgbm                    x86_64 22.3.0-2.el9    ol9_appstream       37 k
 mesa-libglapi                  x86_64 22.3.0-2.el9    ol9_appstream       49 k
 mesa-vulkan-drivers            x86_64 22.3.0-2.el9    ol9_appstream      7.4 M
 mkfontscale                    x86_64 1.2.1-3.el9     ol9_appstream       37 k
 openexr-libs                   x86_64 3.1.1-2.el9     ol9_appstream      1.1 M
 openjpeg2                      x86_64 2.4.0-7.el9     ol9_appstream      170 k
 opus                           x86_64 1.3.1-10.el9    ol9_appstream      200 k
 orc                            x86_64 0.4.31-6.el9    ol9_appstream      188 k
 osinfo-db                      noarch 20221130-1.0.2.el9
                                                       ol9_appstream      1.2 M
 osinfo-db-tools                x86_64 1.10.0-1.el9    ol9_appstream       96 k
 ostree-libs                    x86_64 2023.1-6.el9_2  ol9_appstream      441 k
 pipewire-libs                  x86_64 0.3.47-3.el9_2  ol9_appstream      1.7 M
 poppler                        x86_64 21.01.0-14.el9  ol9_appstream      1.1 M
 poppler-data                   noarch 0.4.9-9.el9     ol9_appstream      2.1 M
 poppler-glib                   x86_64 21.01.0-14.el9  ol9_appstream      152 k
 pulseaudio-libs                x86_64 15.0-2.el9      ol9_appstream      726 k
 pulseaudio-utils               x86_64 15.0-2.el9      ol9_appstream       82 k
 rtkit                          x86_64 0.11-28.el9     ol9_appstream       69 k
 sound-theme-freedesktop        noarch 0.8-17.el9      ol9_appstream      407 k
 totem-pl-parser                x86_64 3.26.6-2.el9    ol9_appstream      238 k
 tracker                        x86_64 3.1.2-3.el9_1   ol9_appstream      616 k
 upower                         x86_64 0.99.13-2.el9   ol9_appstream      188 k
 urw-base35-bookman-fonts       noarch 20200910-6.el9  ol9_appstream      861 k
 urw-base35-c059-fonts          noarch 20200910-6.el9  ol9_appstream      888 k
 urw-base35-d050000l-fonts      noarch 20200910-6.el9  ol9_appstream       81 k
 urw-base35-fonts               noarch 20200910-6.el9  ol9_appstream       11 k
 urw-base35-fonts-common        noarch 20200910-6.el9  ol9_appstream       22 k
 urw-base35-gothic-fonts        noarch 20200910-6.el9  ol9_appstream      657 k
 urw-base35-nimbus-mono-ps-fonts
                                noarch 20200910-6.el9  ol9_appstream      810 k
 urw-base35-nimbus-roman-fonts  noarch 20200910-6.el9  ol9_appstream      870 k
 urw-base35-nimbus-sans-fonts   noarch 20200910-6.el9  ol9_appstream      1.3 M
 urw-base35-p052-fonts          noarch 20200910-6.el9  ol9_appstream      987 k
 urw-base35-standard-symbols-ps-fonts
                                noarch 20200910-6.el9  ol9_appstream       42 k
 urw-base35-z003-fonts          noarch 20200910-6.el9  ol9_appstream      281 k
 vulkan-loader                  x86_64 1.3.239.0-1.el9 ol9_appstream      143 k
 webrtc-audio-processing        x86_64 0.3.1-8.el9     ol9_appstream      310 k
 wireplumber                    x86_64 0.4.8-1.0.1.el9 ol9_appstream      123 k
 wireplumber-libs               x86_64 0.4.8-1.0.1.el9 ol9_appstream      335 k
 xdg-dbus-proxy                 x86_64 0.1.3-1.el9     ol9_appstream       41 k
 xdg-desktop-portal             x86_64 1.12.4-1.el9    ol9_appstream      453 k
 xkeyboard-config               noarch 2.33-2.el9      ol9_appstream      1.1 M
 xorg-x11-fonts-ISO8859-1-100dpi
                                noarch 7.5-33.el9      ol9_appstream      1.2 M
Installing weak dependencies:
 dconf                          x86_64 0.40.0-6.el9    ol9_appstream      121 k
 exiv2                          x86_64 0.27.5-2.el9    ol9_appstream      1.0 M
 flatpak                        x86_64 1.12.7-2.el9    ol9_appstream      1.8 M
 libcanberra-gtk2               x86_64 0.30-26.el9     ol9_appstream       26 k
 p11-kit-server                 x86_64 0.24.1-2.el9    ol9_appstream      202 k
 pipewire                       x86_64 0.3.47-3.el9_2  ol9_appstream       49 k
 pipewire-alsa                  x86_64 0.3.47-3.el9_2  ol9_appstream       59 k
 pipewire-jack-audio-connection-kit
                                x86_64 0.3.47-3.el9_2  ol9_appstream      133 k
 pipewire-pulseaudio            x86_64 0.3.47-3.el9_2  ol9_appstream       24 k
 tracker-miners                 x86_64 3.1.2-3.el9     ol9_appstream      1.0 M
 xdg-desktop-portal-gtk         x86_64 1.12.0-3.el9    ol9_appstream      162 k
Transaction Summary
================================================================================
Install  158 Packages
<略>
$

インストール後にサイトヘルスステータスを確認するとgdも消えている

続いて「sudo dnf install php-pecl-zip php-intl」をインストール

$ sudo dnf install php-pecl-zip php-intl
Last metadata expiration check: 1:28:15 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package            Architecture Version              Repository           Size
================================================================================
Installing:
 php-intl           x86_64       8.0.27-1.el9_1       ol9_appstream       150 k
 php-pecl-zip       x86_64       1.19.2-6.el9         ol9_appstream        78 k
Installing dependencies:
 libzip             x86_64       1.7.3-7.el9          ol9_appstream        63 k
Transaction Summary
================================================================================
Install  3 Packages
<略>
$

これで、サイトヘルスステータスのパッケージ関連のメッセージは消えた。

手順12: WordPressの.htaccess有効化

/var/www/html/wordpress/.htaccess が作成されているが、Oracle Linux 8のhttpd標準設定ではこれを読み込むようにはなっていない。

これが有効になっていないと、パーマリンク設定を「基本」から変えた場合に個別記事にアクセスできなくなる。

/etc/httpd/conf.d/wordpress.conf にファイルを作って設定する。

$ sudo vi /etc/httpd/conf.d/wordpress.conf
$ cat /etc/httpd/conf.d/wordpress.conf
<Directory /var/www/html/wordpress/>
 Allowoverride All
</Directory>
$ sudo systemctl restart httpd
$

手順13: OS自動更新の設定

メンテナンスがめんどくさくなって忘れる可能性があるので、Oracle Linux 8の自動更新設定を実施。

以前はyum-cronでしたが、現在は dnf-automatic に変わったので、パッケージをインストールします。

$ sudo dnf install dnf-automatic -y
Last metadata expiration check: 1:30:59 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
 Package          Arch      Version                  Repository            Size
================================================================================
Installing:
 dnf-automatic    noarch    4.14.0-5.0.1.el9_2       ol9_baseos_latest     53 k
Transaction Summary
================================================================================
Install  1 Package
<略>
$

/etc/dnf/automatic.conf 内の「apply_updates = no」を「apply_updates = yes」に変更

$ sudo vi /etc/dnf/automatic.conf
$ cat /etc/dnf/automatic.conf
[commands]
#  What kind of upgrade to perform:
# default                            = all available upgrades
# security                           = only the security upgrades
upgrade_type = default
random_sleep = 0
# Maximum time in seconds to wait until the system is on-line and able to
# connect to remote repositories.
network_online_timeout = 60
# To just receive updates use dnf-automatic-notifyonly.timer
# Whether updates should be downloaded when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
download_updates = yes
# Whether updates should be applied when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
apply_updates = yes
[emitters]
# Name to use for this system in messages that are emitted.  Default is the
# hostname.
# system_name = my-host
# How to send messages.  Valid options are stdio, email and motd.  If
# emit_via includes stdio, messages will be sent to stdout; this is useful
# to have cron send the messages.  If emit_via includes email, this
# program will send email itself according to the configured options.
# If emit_via includes motd, /etc/motd file will have the messages. if
# emit_via includes command_email, then messages will be send via a shell
# command compatible with sendmail.
# Default is email,stdio.
# If emit_via is None or left blank, no messages will be sent.
emit_via = stdio
[email]
# The address to send email messages from.
email_from = root@example.com
# List of addresses to send messages to.
email_to = root
# Name of the host to connect to to send email messages.
email_host = localhost
[command]
# The shell command to execute. This is a Python format string, as used in
# str.format(). The format function will pass a shell-quoted argument called
# `body`.
# command_format = "cat"
# The contents of stdin to pass to the command. It is a format string with the
# same arguments as `command_format`.
# stdin_format = "{body}"
[command_email]
# The shell command to use to send email. This is a Python format string,
# as used in str.format(). The format function will pass shell-quoted arguments
# called body, subject, email_from, email_to.
# command_format = "mail -Ssendwait -s {subject} -r {email_from} {email_to}"
# The contents of stdin to pass to the command. It is a format string with the
# same arguments as `command_format`.
# stdin_format = "{body}"
# The address to send email messages from.
email_from = root@example.com
# List of addresses to send messages to.
email_to = root
[base]
# This section overrides dnf.conf
# Use this to filter DNF core messages
debuglevel = 1
$

そしてdnf-automatic.timerを有効化し、開始します。

$ sudo systemctl enable dnf-automatic.timer
Created symlink /etc/systemd/system/timers.target.wants/dnf-automatic.timer → /usr/lib/systemd/system/dnf-automatic.timer.
$ sudo systemctl status dnf-automatic
○ dnf-automatic.service - dnf automatic
     Loaded: loaded (/usr/lib/systemd/system/dnf-automatic.service; static)
     Active: inactive (dead)
TriggeredBy: ○ dnf-automatic.timer
$ sudo systemctl start dnf-automatic.timer
$ sudo systemctl status dnf-automatic.timer
● dnf-automatic.timer - dnf-automatic timer
     Loaded: loaded (/usr/lib/systemd/system/dnf-automatic.timer; enabled; pres>
     Active: active (waiting) since Tue 2023-09-12 13:11:00 JST; 5s ago
      Until: Tue 2023-09-12 13:11:00 JST; 5s ago
    Trigger: Wed 2023-09-13 06:44:33 JST; 17h left
   Triggers: ● dnf-automatic.service
Sep 12 13:11:00 ホスト名 systemd[1]: Started dnf-automatic timer.
$

netdataをアップデートしようとしたらエラーになった


netdata でサーバの状態観察をしているのだが、アップデート要求が出ていた

OracleLinux8環境でセットアップしており、下記のパッケージでインストールされていた。

$ rpm -qa|grep netdata
netdata-conf-1.37.1-1.el8.noarch
netdata-repo-edge-1-2.noarch
netdata-data-1.37.1-1.el8.noarch
netdata-1.37.1-1.el8.aarch64
$ netdata -W buildinfo
Version: netdata v1.37.1
Configure options:  '--build=aarch64-redhat-linux-gnu' '--host=aarch64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-plugin-freeipmi' '--enable-plugin-cups' '--with-bundled-libJudy' '--with-zlib' '--with-math' '--with-user=netdata' 'build_alias=aarch64-redhat-linux-gnu' 'host_alias=aarch64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protection' 'LDFLAGS=-Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CXXFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protection' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Install type: custom
Features:
    dbengine:                   YES
    Native HTTPS:               YES
    Netdata Cloud:              YES
    ACLK:                       YES
    TLS Host Verification:      YES
    Machine Learning:           YES
    Stream Compression:         NO
Libraries:
    protobuf:                YES (system)
    jemalloc:                NO
    JSON-C:                  YES
    libcap:                  YES
    libcrypto:               YES
    libm:                    YES
    tcalloc:                 NO
    zlib:                    YES
Plugins:
    apps:                    YES
    cgroup Network Tracking: YES
    CUPS:                    YES
    EBPF:                    NO
    IPMI:                    YES
    NFACCT:                  NO
    perf:                    YES
    slabinfo:                YES
    Xen:                     NO
    Xen VBD Error Tracking:  NO
Exporters:
    AWS Kinesis:             NO
    GCP PubSub:              NO
    MongoDB:                 NO
    Prometheus Remote Write: YES
Debug/Developer Features:
    Trace Allocations:       NO
$

とりあえずお知らせ記載の「wget -O /tmp/netdata-kickstart.sh https://my-netdata.io/kickstart.sh && sh /tmp/netdata-kickstart.sh 」を実行したところエラーとなった

# wget -O /tmp/netdata-kickstart.sh https://my-netdata.io/kickstart.sh && sh /tmp/netdata-kickstart.sh
--2023-06-26 11:17:16--  https://my-netdata.io/kickstart.sh
Resolving my-netdata.io (my-netdata.io)... 2606:4700:3031::6815:d9f, 2606:4700:3036::ac43:9cc0, 172.67.156.192, ...
Connecting to my-netdata.io (my-netdata.io)|2606:4700:3031::6815:d9f|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘/tmp/netdata-kickstart.sh’

/tmp/netdata-kickst     [ <=>                ]  81.38K  --.-KB/s    in 0.01s

2023-06-26 11:17:17 (6.31 MB/s) - ‘/tmp/netdata-kickstart.sh’ saved [83335]


 --- Using /tmp/netdata-kickstart-UrT2UNzClU as a temporary directory. ---
 --- Checking for existing installations of Netdata... ---
[/tmp/netdata-kickstart-UrT2UNzClU]# sh -c cat "//etc/netdata/.install-type" > "/tmp/netdata-kickstart-UrT2UNzClU/install-type"
 OK

 ABORTED  Found an existing netdata install at /, but the install type is 'custom', which is not supported by this script, refusing to proceed.

For community support, you can connect with us on:
  - GitHub: https://github.com/netdata/netdata/discussions
  - Discord: https://discord.gg/5ygS846fR6
  - Our community forums: https://community.netdata.cloud/
[/root]# rm -rf /tmp/netdata-kickstart-UrT2UNzClU
 OK

#

この場合、Reinstall Netdata にある–reinstallオプションつきを試せ、とのことだったので実行

# wget -O /tmp/netdata-kickstart.sh https://my-netdata.io/kickstart.sh && sh /tmp/netdata-kickstart.sh --reinstall
--2023-06-26 11:17:34--  https://my-netdata.io/kickstart.sh
Resolving my-netdata.io (my-netdata.io)... 2606:4700:3036::ac43:9cc0, 2606:4700:3031::6815:d9f, 104.21.13.159, ...
Connecting to my-netdata.io (my-netdata.io)|2606:4700:3036::ac43:9cc0|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘/tmp/netdata-kickstart.sh’

/tmp/netdata-kickst     [ <=>                ]  81.38K  --.-KB/s    in 0.01s

2023-06-26 11:17:34 (6.37 MB/s) - ‘/tmp/netdata-kickstart.sh’ saved [83335]


 --- Using /tmp/netdata-kickstart-J62Yweer7w as a temporary directory. ---
 --- Attempting to install using native packages... ---
 --- Repository configuration is already present, attempting to install netdata. ---
There was an error communicating with OSMS server.
OSMS based repositories will be disabled.
<ProtocolError for http://127.0.0.1:9003/XMLRPC: 500 500 Server Error: Internal Server Error for url: http://127.0.0.1:9003/XMLRPC>
 WARNING  Could not find a usable native package for ol on aarch64.

 --- Attempting to uninstall repository configuration package. ---
[/tmp/netdata-kickstart-J62Yweer7w]# env dnf remove netdata-repo-edge
There was an error communicating with OSMS server.
OSMS based repositories will be disabled.
<ProtocolError for http://127.0.0.1:9003/XMLRPC: 500 500 Server Error: Internal Server Error for url: http://127.0.0.1:9003/XMLRPC>
Dependencies resolved.
================================================================================
 Package                  Architecture  Version      Repository            Size
================================================================================
Removing:
 netdata-repo-edge        noarch        1-2          @@commandline        580

Transaction Summary
================================================================================
Remove  1 Package

Freed space: 580
Is this ok [y/N]: y
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1
  Erasing          : netdata-repo-edge-1-2.noarch                           1/1
warning: file /etc/yum.repos.d/netdata-edge.repo: remove failed: No such file or directory

  Verifying        : netdata-repo-edge-1-2.noarch                           1/1

Removed:
  netdata-repo-edge-1-2.noarch

Complete!
 OK

 WARNING  Could not install native binary packages, falling back to alternative installation method.

[/tmp/netdata-kickstart-J62Yweer7w]# sh -c /bin/curl https://github.com/netdata/netdata-nightlies/releases/latest -s -L -I -o /dev/null -w '%{url_effective}' | grep -o '[^/]*$'
 OK

 --- Attempting to install using static build... ---
[/tmp/netdata-kickstart-J62Yweer7w]# /bin/curl --fail -q -sSL --connect-timeout 10 --retry 3 --output /tmp/netdata-kickstart-J62Yweer7w/netdata-aarch64-latest.gz.run https://github.com/netdata/netdata-nightlies/releases/download/v1.40.0-38-nightly/netdata-aarch64-latest.gz.run
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# /bin/curl --fail -q -sSL --connect-timeout 10 --retry 3 --output /tmp/netdata-kickstart-J62Yweer7w/sha256sum.txt https://github.com/netdata/netdata-nightlies/releases/download/v1.40.0-38-nightly/sha256sums.txt
 OK

 --- Installing netdata ---
[/tmp/netdata-kickstart-J62Yweer7w]# sh /tmp/netdata-kickstart-J62Yweer7w/netdata-aarch64-latest.gz.run --

  ^
  |.-.   .-.   .-.   .-.   .  netdata
  |   '-'   '-'   '-'   '-'   real-time performance monitoring, done right!
  +----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+--->

  (C) Copyright 2017-2023, Costa Tsaousis
  All rights reserved
  Released under GPL v3+

  You are about to install netdata to this system.
  netdata will be installed at:

                    /opt/netdata

  The following changes will be made to your system:

  # USERS / GROUPS
  User 'netdata' and group 'netdata' will be added, if not present.

  # LOGROTATE
  This file will be installed if logrotate is present.

   - /etc/logrotate.d/netdata

  # SYSTEM INIT
  If a supported init system is detected, appropriate configuration will be
  installed to allow Netdata to run as a system service. We currently support
  systemd, OpenRC, LSB init scripts, and traditional init.d setups, as well as
  having experimental support for runit.


  This package can also update a netdata installation that has been
  created with another version of it.

  Your netdata configuration will be retained.
  After installation, netdata will be (re-)started.

  netdata re-distributes a lot of open source software components.
  Check its full license at:
  https://github.com/netdata/netdata/blob/master/LICENSE
Please type y to accept, n otherwise: y
Creating directory /opt/netdata
Verifying archive integrity...  100%   MD5 checksums are OK. All good.
Uncompressing netdata, the real-time performance and health monitoring system    100%
 --- Attempt to create user/group netdata/netadata ---
Group 'netdata' already exists.
User 'netdata' already exists.
 --- Add user netdata to required user groups ---
Group 'docker' does not exist.
User 'netdata' is already in group 'nginx'.
Group 'varnish' does not exist.
Group 'haproxy' does not exist.
User 'netdata' is already in group 'adm'.
Group 'nsd' does not exist.
Group 'proxy' does not exist.
Group 'squid' does not exist.
Group 'ceph' does not exist.
User 'netdata' is already in group 'nobody'.
Group 'I2C' does not exist.
 --- Install logrotate configuration for netdata ---
[/opt/netdata]# chmod 644 /etc/logrotate.d/netdata
 OK  ''

 --- Telemetry configuration ---
You can opt out from anonymous statistics via the --disable-telemetry option, or by creating an empty file /opt/netdata/etc/netdata/.opt-out-from-anonymous-statistics

 --- Install netdata at system init ---
Installing systemd service...
 --- Install (but not enable) netdata updater tool ---
cat: /system/systemd/netdata-updater.timer: No such file or directory
cat: /system/systemd/netdata-updater.service: No such file or directory
Update script is located at /opt/netdata/usr/libexec/netdata/netdata-updater.sh

 --- creating quick links ---
[/opt/netdata]# ln -s bin sbin
 OK  ''

[/opt/netdata/usr]# ln -s ../bin bin
 OK  ''

[/opt/netdata/usr]# ln -s ../bin sbin
 OK  ''

[/opt/netdata/usr]# ln -s . local
 OK  ''

[/opt/netdata]# ln -s etc/netdata netdata-configs
 OK  ''

[/opt/netdata]# ln -s usr/share/netdata/web netdata-web-files
 OK  ''

[/opt/netdata]# ln -s usr/libexec/netdata netdata-plugins
 OK  ''

[/opt/netdata]# ln -s var/lib/netdata netdata-dbs
 OK  ''

[/opt/netdata]# ln -s var/cache/netdata netdata-metrics
 OK  ''

[/opt/netdata]# ln -s var/log/netdata netdata-logs
 OK  ''

[/opt/netdata/etc/netdata]# rm orig
 OK  ''

[/opt/netdata/etc/netdata]# ln -s ../../usr/lib/netdata/conf.d orig
 OK  ''

 --- fix permissions ---
[/opt/netdata]# chmod g+rx,o+rx /opt
 OK  ''

[/opt/netdata]# find /opt/netdata -type d -exec chmod go+rx {} +
 OK  ''

[/opt/netdata]# chown -R netdata:netdata /opt/netdata/var
 OK  ''

 --- changing plugins ownership and permissions ---
[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/apps.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/perf.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/slabinfo.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/debugfs.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/ioping
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/cgroup-network
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/nfacct.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/python.d.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/charts.d.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/go.d.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/ioping.plugin
 OK  ''

[/opt/netdata]# chown root:netdata usr/libexec/netdata/plugins.d/cgroup-network-helper.sh
 OK  ''

[/opt/netdata]# setcap cap_dac_read_search,cap_sys_ptrace=ep usr/libexec/netdata/plugins.d/apps.plugin
 OK  ''

[/opt/netdata]# setcap cap_dac_read_search=ep usr/libexec/netdata/plugins.d/slabinfo.plugin
 OK  ''

[/opt/netdata]# setcap cap_dac_read_search=ep usr/libexec/netdata/plugins.d/debugfs.plugin
 OK  ''

[/opt/netdata]# setcap cap_sys_admin=ep usr/libexec/netdata/plugins.d/perf.plugin
 OK  ''

[/opt/netdata]# setcap cap_net_admin,cap_net_raw=eip usr/libexec/netdata/plugins.d/go.d.plugin
 OK  ''

[/opt/netdata]# chmod 4750 usr/libexec/netdata/plugins.d/ioping
 OK  ''

[/opt/netdata]# chmod 4750 usr/libexec/netdata/plugins.d/cgroup-network
 OK  ''

[/opt/netdata]# chmod 4750 usr/libexec/netdata/plugins.d/nfacct.plugin
 OK  ''

Configure TLS certificate paths
Using /etc/pki/tls for TLS configuration and certificates
Save install options
 --- starting netdata ---
 --- Restarting netdata instance ---

Stopping all netdata threads
[/opt/netdata]# stop_all_netdata
 OK  ''

Starting netdata using command 'systemctl start netdata'
[/opt/netdata]# systemctl start netdata
 OK  ''

Downloading default configuration from netdata...
[/opt/netdata]# /bin/curl -sSL --connect-timeout 10 --retry 3 http://localhost:19999/netdata.conf
 OK  ''

[/opt/netdata]# mv /opt/netdata/etc/netdata/netdata.conf.new /opt/netdata/etc/netdata/netdata.conf
 OK  ''

 OK  New configuration saved for you to edit at /opt/netdata/etc/netdata/netdata.conf


  ^
  |.-.   .-.   .-.   .-.   .-.   .  netdata  .-.   .-.   .-.   .-.   .-.   .-
  |   '-'   '-'   '-'   '-'   '-'               '-'   '-'   '-'   '-'   '-'
  +----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+--->

[/opt/netdata]# chmod 0644 /opt/netdata/etc/netdata/netdata.conf
 OK  ''

 OK

[/tmp/netdata-kickstart-J62Yweer7w]# sh -c cat "/opt/netdata/etc/netdata/.install-type" > "/tmp/netdata-kickstart-J62Yweer7w/install-type"
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# chown 0:0 /tmp/netdata-kickstart-J62Yweer7w/install-type
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# chown netdata:netdata /tmp/netdata-kickstart-J62Yweer7w/install-type
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# cp /tmp/netdata-kickstart-J62Yweer7w/install-type /opt/netdata/etc/netdata/.install-type
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# test -x /opt/netdata/usr/libexec/netdata/netdata-updater.sh
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# grep -q \-\-enable-auto-updates /opt/netdata/usr/libexec/netdata/netdata-updater.sh
 OK

[/tmp/netdata-kickstart-J62Yweer7w]# /opt/netdata/usr/libexec/netdata/netdata-updater.sh --enable-auto-updates
Mon Jun 26 11:18:13 JST 2023 : INFO: netdata-updater.sh:  Auto-updating has been ENABLED through cron, updater script linked to /etc/cron.daily/netdata-updater\n
Mon Jun 26 11:18:13 JST 2023 : INFO: netdata-updater.sh:  If the update process fails and you have email notifications set up correctly for cron on this system, you should receive an email notification of the failure.
Mon Jun 26 11:18:13 JST 2023 : INFO: netdata-updater.sh:  Successful updates will not send an email.
 OK

Successfully installed the Netdata Agent.

The following non-fatal warnings or errors were encountered:

  - Could not find a usable native package for ol on aarch64.
  - Could not install native binary packages, falling back to alternative installation method.

Official documentation can be found online at https://learn.netdata.cloud/docs/.

Looking to monitor all of your infrastructure with Netdata? Check out Netdata Cloud at https://app.netdata.cloud.

Join our community and connect with us on:
  - GitHub: https://github.com/netdata/netdata/discussions
  - Discord: https://discord.gg/5ygS846fR6
  - Our community forums: https://community.netdata.cloud/
[/root]# rm -rf /tmp/netdata-kickstart-J62Yweer7w
 OK

#

が・・・インストールされているパッケージを確認してみると、元々入ってきたnetdata v1.37.1の他に/opt/netdata以下にv1.40.0-38-gd548db0f1もある、という状態に…

# rpm -qa|grep netdata
netdata-conf-1.37.1-1.el8.noarch
netdata-data-1.37.1-1.el8.noarch
netdata-1.37.1-1.el8.aarch64
# netdata -W buildinfo
Version: netdata v1.37.1
Configure options:  '--build=aarch64-redhat-linux-gnu' '--host=aarch64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-plugin-freeipmi' '--enable-plugin-cups' '--with-bundled-libJudy' '--with-zlib' '--with-math' '--with-user=netdata' 'build_alias=aarch64-redhat-linux-gnu' 'host_alias=aarch64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protection' 'LDFLAGS=-Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CXXFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protection' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Install type: custom
Features:
    dbengine:                   YES
    Native HTTPS:               YES
    Netdata Cloud:              YES
    ACLK:                       YES
    TLS Host Verification:      YES
    Machine Learning:           YES
    Stream Compression:         NO
Libraries:
    protobuf:                YES (system)
    jemalloc:                NO
    JSON-C:                  YES
    libcap:                  YES
    libcrypto:               YES
    libm:                    YES
    tcalloc:                 NO
    zlib:                    YES
Plugins:
    apps:                    YES
    cgroup Network Tracking: YES
    CUPS:                    YES
    EBPF:                    NO
    IPMI:                    YES
    NFACCT:                  NO
    perf:                    YES
    slabinfo:                YES
    Xen:                     NO
    Xen VBD Error Tracking:  NO
Exporters:
    AWS Kinesis:             NO
    GCP PubSub:              NO
    MongoDB:                 NO
    Prometheus Remote Write: YES
Debug/Developer Features:
    Trace Allocations:       NO
# /opt/netdata/bin/netdata -W buildinfo
Version: netdata v1.40.0-38-gd548db0f1
Configure options:  '--prefix=/opt/netdata/usr' '--sysconfdir=/opt/netdata/etc' '--localstatedir=/opt/netdata/var' '--libexecdir=/opt/netdata/usr/libexec' '--libdir=/opt/netdata/usr/lib' '--with-zlib' '--with-math' '--with-user=netdata' '--enable-cloud' '--without-bundled-protobuf' '--disable-dependency-tracking' 'CFLAGS=-static -O2 -I/openssl-static/include -I/libnetfilter-acct-static/include/libnetfilter_acct -I/usr/include/libmnl -pipe' 'LDFLAGS=-static -L/openssl-static/lib -L/libnetfilter-acct-static/lib -lnetfilter_acct -L/usr/lib -lmnl' 'PKG_CONFIG=pkg-config --static' 'PKG_CONFIG_PATH=/openssl-static/lib/pkgconfig:/libnetfilter-acct-static/lib/pkgconfig:/usr/lib/pkgconfig'
Install type: kickstart-static
    Binary architecture: aarch64
Features:
    dbengine:                   YES
    Native HTTPS:               YES
    Netdata Cloud:              YES
    ACLK:                       YES
    TLS Host Verification:      YES
    Machine Learning:           YES
    Stream Compression:         YES
    HTTPD (h2o):                YES
Libraries:
    protobuf:                YES (system)
    jemalloc:                NO
    JSON-C:                  YES
    libcap:                  NO
    libcrypto:               YES
    libm:                    YES
    tcalloc:                 NO
    zlib:                    YES
Plugins:
    apps:                    YES
    cgroup Network Tracking: YES
    CUPS:                    NO
    debugfs:                 YES
    EBPF:                    NO
    IPMI:                    NO
    NFACCT:                  YES
    perf:                    YES
    slabinfo:                YES
    Xen:                     NO
    Xen VBD Error Tracking:  NO
Exporters:
    AWS Kinesis:             NO
    GCP PubSub:              NO
    MongoDB:                 NO
    Prometheus Remote Write: YES
Debug/Developer Features:
    Trace Allocations:       NO
#

起動しているプロセスは /opt/netdata以下のもののようなので

# ps -ef|grep netdata
netdata  1805060       1  0 11:17 ?        00:00:04 /opt/netdata/bin/srv/netdat  -P /run/netdata/netdata.pid -D
netdata  1805064 1805060  0 11:17 ?        00:00:00 /opt/netdata/bin/srv/netdat  --special-spawn-server
netdata  1805243 1805060  0 11:17 ?        00:00:00 bash /opt/netdata/usr/libexec/netdata/plugins.d/tc-qos-helper.sh 1
netdata  1805250 1805060  0 11:17 ?        00:00:04 /opt/netdata/usr/libexec/netdata/plugins.d/apps.plugin 1
netdata  1805253 1805060  0 11:17 ?        00:00:00 /opt/netdata/usr/libexec/netdata/plugins.d/debugfs.plugin 1
netdata  1805256 1805060  0 11:17 ?        00:00:01 /opt/netdata/usr/libexec/netdata/plugins.d/go.d.plugin 1
root     1805265 1805060  0 11:17 ?        00:00:00 /opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin 1
root     1807528 1804248  0 11:26 pts/0    00:00:00 grep --color=auto netdata
#
# systemctl status netdata -l|cat
● netdata.service - Real time performance monitoring
   Loaded: loaded (/usr/lib/systemd/system/netdata.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2023-06-26 11:17:58 JST; 9min ago
  Process: 1805058 ExecStartPre=/bin/chown -R netdata /run/netdata (code=exited, status=0/SUCCESS)
  Process: 1805056 ExecStartPre=/bin/mkdir -p /run/netdata (code=exited, status=0/SUCCESS)
  Process: 1805054 ExecStartPre=/bin/chown -R netdata /opt/netdata/var/cache/netdata (code=exited, status=0/SUCCESS)
  Process: 1805053 ExecStartPre=/bin/mkdir -p /opt/netdata/var/cache/netdata (code=exited, status=0/SUCCESS)
 Main PID: 1805060 (netdata)
    Tasks: 69 (limit: 9094)
   Memory: 94.3M
   CGroup: /system.slice/netdata.service
           tq1805060 /opt/netdata/bin/srv/netdata -P /run/netdata/netdata.pid -D
           tq1805064 /opt/netdata/bin/srv/netdata --special-spawn-server
           tq1805243 bash /opt/netdata/usr/libexec/netdata/plugins.d/tc-qos-helper.sh 1
           tq1805250 /opt/netdata/usr/libexec/netdata/plugins.d/apps.plugin 1
           tq1805253 /opt/netdata/usr/libexec/netdata/plugins.d/debugfs.plugin 1
           tq1805256 /opt/netdata/usr/libexec/netdata/plugins.d/go.d.plugin 1
           mq1805265 /opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin 1

Jun 26 11:17:58 oraclelinux7 netdata[1805060]: 2023-06-26 11:17:58: netdata INFO  : MAIN : Created file '/opt/netdata/var/lib/netdata/dbengine_multihost_size' to store the computed value
Jun 26 11:17:58 oraclelinux7 [1805250]: PROCFILE: Cannot open file '/opt/netdata/etc/netdata/apps_groups.conf'
Jun 26 11:17:58 oraclelinux7 [1805250]: Cannot read process groups configuration file '/opt/netdata/etc/netdata/apps_groups.conf'. Will try '/opt/netdata/usr/lib/netdata/conf.d/apps_groups.conf'
Jun 26 11:17:58 oraclelinux7 [1805250]: Loaded config file '/opt/netdata/usr/lib/netdata/conf.d/apps_groups.conf'
Jun 26 11:17:58 oraclelinux7 [1805250]: started on pid 1805250
Jun 26 11:17:58 oraclelinux7 [1805250]: set name of thread 1805268 to APPS_READER
Jun 26 11:17:58 oraclelinux7 [1805271]: no charts enabled - nothing to do.
Jun 26 11:17:59 oraclelinux7 [1805253]: Zswap is disabled
Jun 26 11:17:59 oraclelinux7 [1805250]: Using now_boottime_usec() for uptime (dt is 8 ms)
Jun 26 11:18:01 oraclelinux7 sudo[1805539]:  netdata : command not allowed ; TTY=unknown ; PWD=/opt/netdata/etc/netdata ; USER=root ; COMMAND=validate
#

ちなみに・・・CentOS 7環境でセットアップしていたやつも同様にエラー(wgetパッケージをインストールしていない環境なのでcurlで代用)

 # curl -O https://my-netdata.io/kickstart.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 83335    0 83335    0     0   129k      0 --:--:-- --:--:-- --:--:--  128k
# bash kickstart.sh
kickstart.sh: line 34: cd: kickstart.sh: Not a directory

 --- Using /tmp/netdata-kickstart-gOQowVR9j7 as a temporary directory. ---
 --- Checking for existing installations of Netdata... ---
[/tmp/netdata-kickstart-gOQowVR9j7]# sh -c cat "//etc/netdata/.install-type" > "/tmp/netdata-kickstart-gOQowVR9j7/install-type"
 OK

 ABORTED  Found an existing netdata install at /, but the install type is 'custom', which is not supported by this script, refusing to proceed.

For community support, you can connect with us on:
  - GitHub: https://github.com/netdata/netdata/discussions
  - Discord: https://discord.gg/5ygS846fR6
  - Our community forums: https://community.netdata.cloud/
[/root]# rm -rf /tmp/netdata-kickstart-gOQowVR9j7
 OK

#

この環境は以下の設定だった

#  netdata -W buildinfo
Version: netdata v1.39.1
Configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-plugin-freeipmi' '--with-bundled-protobuf' '--with-zlib' '--with-math' '--with-user=netdata' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1  -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1  -m64 -mtune=generic' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Install type: custom
Features:
    dbengine:                   YES
    Native HTTPS:               YES
    Netdata Cloud:              YES
    ACLK:                       YES
    TLS Host Verification:      YES
    Machine Learning:           YES
    Stream Compression:         NO
Libraries:
    protobuf:                YES (bundled)
    jemalloc:                NO
    JSON-C:                  YES
    libcap:                  YES
    libcrypto:               YES
    libm:                    YES
    tcalloc:                 NO
    zlib:                    YES
Plugins:
    apps:                    YES
    cgroup Network Tracking: YES
    CUPS:                    NO
    EBPF:                    NO
    IPMI:                    YES
    NFACCT:                  NO
    perf:                    YES
    slabinfo:                YES
    Xen:                     NO
    Xen VBD Error Tracking:  NO
Exporters:
    AWS Kinesis:             NO
    GCP PubSub:              NO
    MongoDB:                 NO
    Prometheus Remote Write: YES
Debug/Developer Features:
    Trace Allocations:       NO
# rpm -qa|grep netd
netdata-conf-1.39.1-1.el7.noarch
netdata-1.39.1-1.el7.x86_64
netdata-repo-edge-2-1.noarch
netdata-data-1.39.1-1.el7.noarch
#

で、こちらも–reinstallしてみた

# bash kickstart.sh --reinstall
kickstart.sh: line 34: cd: kickstart.sh: Not a directory

 --- Using /tmp/netdata-kickstart-jpMNGq7kbC as a temporary directory. ---
 --- Attempting to install using native packages... ---
 --- Repository configuration is already present, attempting to install netdata. ---
 --- Checking for libuv availability. ---
[/tmp/netdata-kickstart-jpMNGq7kbC]# env yum install netdata
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
epel/x86_64/metalink                                     | 7.0 kB     00:00
 * base: ftp.iij.ad.jp
 * epel: ftp.riken.jp
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
base                                                     | 3.6 kB     00:00
epel                                                     | 4.7 kB     00:00
extras                                                   | 2.9 kB     00:00
netdata-edge/7/x86_64/signature                          |  687 B     00:00
netdata-edge/7/x86_64/signature                          | 3.0 kB     00:00 !!!
netdata-repoconfig/7/x86_64/signature                    |  687 B     00:00
netdata-repoconfig/7/x86_64/signature                    | 3.0 kB     00:00 !!!
updates                                                  | 2.9 kB     00:00
epel/x86_64/updateinfo         FAILED
https://ftp.riken.jp/Linux/fedora/epel/7/x86_64/repodata/8b4087cf1ec2a440644c52e203dac340e00f77c29e2c7aafec13fc82a187b882-updateinfo.xml.bz2: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
To address this issue please refer to the below wiki article

https://wiki.centos.org/yum-errors

If above article doesn't help to resolve this issue please use https://bugs.centos.org/.

epel/x86_64/primary_db         FAILED
https://ftp.riken.jp/Linux/fedora/epel/7/x86_64/repodata/ca38eb0f8ec9e2bd9401a853f021d0a10d110bbe72869ffbb8ae391881572ecb-primary.sqlite.bz2: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
epel/x86_64/primary_db         FAILED
http://ftp.iij.ad.jp/pub/linux/Fedora/epel/7/x86_64/repodata/ca38eb0f8ec9e2bd9401a853f021d0a10d110bbe72869ffbb8ae391881572ecb-primary.sqlite.bz2: [Errno 14] HTTP Error 404 - Not Found
Trying other mirror.
(1/5): netdata-repoconfig/7/x86_64/primary_db              | 2.5 kB   00:00
(2/5): netdata-edge/7/x86_64/primary_db                    | 122 kB   00:00
epel/x86_64/primary_db         FAILED
https://mirror-hnd.yuki.net.uk/fedora-epel/7/x86_64/repodata/ca38eb0f8ec9e2bd9401a853f021d0a10d110bbe72869ffbb8ae391881572ecb-primary.sqlite.bz2: [Errno 14] curl#52 - "Empty reply from server"
Trying other mirror.
(3/5): updates/7/x86_64/primary_db                         |  21 MB   00:02
(4/5): epel/x86_64/primary_db                              | 7.0 MB   00:02
epel/x86_64/updateinfo         FAILED
https://epel.excellmedia.net/7/x86_64/repodata/8b4087cf1ec2a440644c52e203dac340e00f77c29e2c7aafec13fc82a187b882-updateinfo.xml.bz2: [Errno 14] curl#60 - "Peer's Certificate has expired."
Trying other mirror.
It was impossible to connect to the CentOS servers.
This could mean a connectivity issue in your environment, such as the requirement to configure a proxy,
or a transparent proxy that tampers with TLS security, or an incorrect system clock.
You can try to solve this issue by using the instructions on https://wiki.centos.org/yum-errors
If above article doesn't help to resolve this issue please use https://bugs.centos.org/.

(5/5): epel/x86_64/updateinfo                              | 1.0 MB   00:00
Resolving Dependencies
--> Running transaction check
---> Package netdata.x86_64 0:1.39.1-1.el7 will be updated
---> Package netdata.x86_64 0:1.40.0.38.nightly-1.el7 will be obsoleting
--> Processing Dependency: netdata-plugin-apps for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-chartsd for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-debugfs for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-ebpf for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-go for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-perf for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-pythond for package: netdata-1.40.0.38.nightly-1.el7.x86_64
--> Processing Dependency: netdata-plugin-slabinfo for package: netdata-1.40.0.38.nightly-1.el7.x86_64
---> Package netdata-conf.noarch 0:1.39.1-1.el7 will be obsoleted
---> Package netdata-data.noarch 0:1.39.1-1.el7 will be obsoleted
--> Running transaction check
---> Package netdata-plugin-apps.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-chartsd.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-debugfs.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-ebpf.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
--> Processing Dependency: netdata-ebpf-legacy-code >= 1.40.0.38.nightly for package: netdata-plugin-ebpf-1.40.0.38.nightly-1.el7.x86_64
---> Package netdata-plugin-go.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-perf.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-pythond.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
---> Package netdata-plugin-slabinfo.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
--> Running transaction check
---> Package netdata-ebpf-legacy-code.x86_64 0:1.40.0.38.nightly-1.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                   Arch    Version                  Repository     Size
================================================================================
Installing:
 netdata                   x86_64  1.40.0.38.nightly-1.el7  netdata-edge   25 M
     replacing  netdata-conf.noarch 1.39.1-1.el7
     replacing  netdata-data.noarch 1.39.1-1.el7
Installing for dependencies:
 netdata-ebpf-legacy-code  x86_64  1.40.0.38.nightly-1.el7  netdata-edge  3.5 M
 netdata-plugin-apps       x86_64  1.40.0.38.nightly-1.el7  netdata-edge  835 k
 netdata-plugin-chartsd    x86_64  1.40.0.38.nightly-1.el7  netdata-edge   26 k
 netdata-plugin-debugfs    x86_64  1.40.0.38.nightly-1.el7  netdata-edge  745 k
 netdata-plugin-ebpf       x86_64  1.40.0.38.nightly-1.el7  netdata-edge  1.0 M
 netdata-plugin-go         x86_64  1.40.0.38.nightly-1.el7  netdata-edge   13 M
 netdata-plugin-perf       x86_64  1.40.0.38.nightly-1.el7  netdata-edge  727 k
 netdata-plugin-pythond    x86_64  1.40.0.38.nightly-1.el7  netdata-edge  260 k
 netdata-plugin-slabinfo   x86_64  1.40.0.38.nightly-1.el7  netdata-edge  727 k

Transaction Summary
================================================================================
Install  1 Package (+9 Dependent packages)

Total download size: 46 M
Is this ok [y/d/N]: y
Downloading packages:
(1/10): netdata-ebpf-legacy-code-1.40.0.38.nightly-1.el7.x | 3.5 MB   00:03
(2/10): netdata-plugin-apps-1.40.0.38.nightly-1.el7.x86_64 | 835 kB   00:00
(3/10): netdata-plugin-chartsd-1.40.0.38.nightly-1.el7.x86 |  26 kB   00:00
(4/10): netdata-plugin-debugfs-1.40.0.38.nightly-1.el7.x86 | 745 kB   00:00
(5/10): netdata-plugin-ebpf-1.40.0.38.nightly-1.el7.x86_64 | 1.0 MB   00:00
(6/10): netdata-1.40.0.38.nightly-1.el7.x86_64.rpm         |  25 MB   00:07
(7/10): netdata-plugin-perf-1.40.0.38.nightly-1.el7.x86_64 | 727 kB   00:00
(8/10): netdata-plugin-pythond-1.40.0.38.nightly-1.el7.x86 | 260 kB   00:00
(9/10): netdata-plugin-slabinfo-1.40.0.38.nightly-1.el7.x8 | 727 kB   00:00
(10/10): netdata-plugin-go-1.40.0.38.nightly-1.el7.x86_64. |  13 MB   00:02
--------------------------------------------------------------------------------
Total                                              5.5 MB/s |  46 MB  00:08
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : netdata-plugin-go-1.40.0.38.nightly-1.el7.x86_64            1/13
  Installing : netdata-plugin-perf-1.40.0.38.nightly-1.el7.x86_64          2/13
  Installing : netdata-plugin-pythond-1.40.0.38.nightly-1.el7.x86_64       3/13
  Installing : netdata-plugin-debugfs-1.40.0.38.nightly-1.el7.x86_64       4/13
  Installing : netdata-plugin-chartsd-1.40.0.38.nightly-1.el7.x86_64       5/13
  Installing : netdata-plugin-slabinfo-1.40.0.38.nightly-1.el7.x86_64      6/13
  Installing : netdata-1.40.0.38.nightly-1.el7.x86_64                      7/13
  Installing : netdata-plugin-apps-1.40.0.38.nightly-1.el7.x86_64          8/13
  Installing : netdata-ebpf-legacy-code-1.40.0.38.nightly-1.el7.x86_64     9/13
  Installing : netdata-plugin-ebpf-1.40.0.38.nightly-1.el7.x86_64         10/13
  Cleanup    : netdata-1.39.1-1.el7.x86_64                                11/13
  Erasing    : netdata-conf-1.39.1-1.el7.noarch                           12/13
  Erasing    : netdata-data-1.39.1-1.el7.noarch                           13/13
  Verifying  : netdata-plugin-apps-1.40.0.38.nightly-1.el7.x86_64          1/13
  Verifying  : netdata-plugin-go-1.40.0.38.nightly-1.el7.x86_64            2/13
  Verifying  : netdata-plugin-perf-1.40.0.38.nightly-1.el7.x86_64          3/13
  Verifying  : netdata-1.40.0.38.nightly-1.el7.x86_64                      4/13
  Verifying  : netdata-plugin-pythond-1.40.0.38.nightly-1.el7.x86_64       5/13
  Verifying  : netdata-plugin-debugfs-1.40.0.38.nightly-1.el7.x86_64       6/13
  Verifying  : netdata-plugin-ebpf-1.40.0.38.nightly-1.el7.x86_64          7/13
  Verifying  : netdata-plugin-chartsd-1.40.0.38.nightly-1.el7.x86_64       8/13
  Verifying  : netdata-ebpf-legacy-code-1.40.0.38.nightly-1.el7.x86_64     9/13
  Verifying  : netdata-plugin-slabinfo-1.40.0.38.nightly-1.el7.x86_64     10/13
  Verifying  : netdata-1.39.1-1.el7.x86_64                                11/13
  Verifying  : netdata-data-1.39.1-1.el7.noarch                           12/13
  Verifying  : netdata-conf-1.39.1-1.el7.noarch                           13/13

Installed:
  netdata.x86_64 0:1.40.0.38.nightly-1.el7

Dependency Installed:
  netdata-ebpf-legacy-code.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-apps.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-chartsd.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-debugfs.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-ebpf.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-go.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-perf.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-pythond.x86_64 0:1.40.0.38.nightly-1.el7
  netdata-plugin-slabinfo.x86_64 0:1.40.0.38.nightly-1.el7

Replaced:
  netdata-conf.noarch 0:1.39.1-1.el7     netdata-data.noarch 0:1.39.1-1.el7

Complete!
 OK

[/tmp/netdata-kickstart-jpMNGq7kbC]# test -x //usr/libexec/netdata/netdata-updater.sh
 OK

[/tmp/netdata-kickstart-jpMNGq7kbC]# grep -q \-\-enable-auto-updates //usr/libexec/netdata/netdata-updater.sh
 OK

[/tmp/netdata-kickstart-jpMNGq7kbC]# //usr/libexec/netdata/netdata-updater.sh --enable-auto-updates
Mon Jun 26 11:15:58 JST 2023 : INFO: netdata-updater.sh:  Auto-updating has been ENABLED through cron, updater script linked to /etc/cron.daily/netdata-updater\n
Mon Jun 26 11:15:58 JST 2023 : INFO: netdata-updater.sh:  If the update process fails and you have email notifications set up correctly for cron on this system, you should receive an email notification of the failure.
Mon Jun 26 11:15:58 JST 2023 : INFO: netdata-updater.sh:  Successful updates will not send an email.
 OK

Successfully installed the Netdata Agent.

Official documentation can be found online at https://learn.netdata.cloud/docs/.

Looking to monitor all of your infrastructure with Netdata? Check out Netdata Cloud at https://app.netdata.cloud.

Join our community and connect with us on:
  - GitHub: https://github.com/netdata/netdata/discussions
  - Discord: https://discord.gg/5ygS846fR6
  - Our community forums: https://community.netdata.cloud/
[/root]# rm -rf /tmp/netdata-kickstart-jpMNGq7kbC
 OK
#

インストール情報を確認すると、こちらはnetdataが用意したRPMレポジトリを利用するものとして設定されていた。

#  netdata -W buildinfo
Version: netdata v1.40.0-38-nightly
Configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--datadir=/usr/share' '--includedir=/usr/include' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--with-bundled-protobuf' '--prefix=/usr' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=/usr/libexec' '--libdir=/usr/lib' '--with-zlib' '--with-math' '--with-user=netdata' '--disable-dependency-tracking' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro ' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic' 'PKG_CONFIG_PATH=:/usr/lib/pkgconfig:/usr/share/pkgconfig'
Install type: binpkg-rpm
    Binary architecture: x86_64
    Packaging distro:
Features:
    dbengine:                   YES
    Native HTTPS:               YES
    Netdata Cloud:              YES
    ACLK:                       YES
    TLS Host Verification:      YES
    Machine Learning:           YES
    Stream Compression:         NO
    HTTPD (h2o):                YES
Libraries:
    protobuf:                YES (bundled)
    jemalloc:                NO
    JSON-C:                  YES
    libcap:                  NO
    libcrypto:               YES
    libm:                    YES
    tcalloc:                 NO
    zlib:                    YES
Plugins:
    apps:                    YES
    cgroup Network Tracking: YES
    CUPS:                    NO
    debugfs:                 YES
    EBPF:                    YES
    IPMI:                    YES
    NFACCT:                  NO
    perf:                    YES
    slabinfo:                YES
    Xen:                     NO
    Xen VBD Error Tracking:  NO
Exporters:
    AWS Kinesis:             NO
    GCP PubSub:              NO
    MongoDB:                 NO
    Prometheus Remote Write: YES
Debug/Developer Features:
    Trace Allocations:       NO
# rpm -qa|grep netd
netdata-plugin-go-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-chartsd-1.40.0.38.nightly-1.el7.x86_64
netdata-ebpf-legacy-code-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-perf-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-debugfs-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-slabinfo-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-apps-1.40.0.38.nightly-1.el7.x86_64
netdata-plugin-ebpf-1.40.0.38.nightly-1.el7.x86_64
netdata-repo-edge-2-1.noarch
netdata-plugin-pythond-1.40.0.38.nightly-1.el7.x86_64
netdata-1.40.0.38.nightly-1.el7.x86_64
#

Rstudio Serverの設定で分からなかったことのメモ


Rstudio ServerをRHEL9環境にインストールした際に悩んだことのメモ

その1: 新規作成プロジェクトでのpythonパスを指定したい

ユーザのホームディレクトリに「.Renviron」というファイルを作って 環境変数 RETICULATE_PYTHON を定義する。

RETICULATE_PYTHON="/usr/local/python3/bin/python"

なお、今回は~/.Renviron ファイルを使ったが、「Managing R with .Rprofile, .Renviron, Rprofile.site, Renviron.site, rsession.conf, and repos.conf」の記述を見ると、いろいろある。

システム全体の設定としては $R_HOME/etc/Renviron がある。

検証環境の場合 /opt/R/4.1.3/lib/R/etc/Renviron にあった

### etc/Renviron.  Generated from Renviron.in by configure.
###
### ${R_HOME}/etc/Renviron
###
### Record R system environment variables.

## As from R 4.0.0 the C code reading this follows the POSIX rules
## for parameter substitution in shells, section 2.6.2 of
## https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18
## In earlier versions ${FOO-bar} was interpreted the same as ${FOO:-bar}

R_PLATFORM=${R_PLATFORM-'x86_64-pc-linux-gnu'}
## Default printer paper size: first record if user set R_PAPERSIZE
R_PAPERSIZE_USER=${R_PAPERSIZE}
R_PAPERSIZE=${R_PAPERSIZE-'letter'}
## Default print command
R_PRINTCMD=${R_PRINTCMD-'/usr/bin/lpr'}
# for Rd2pdf, reference manual
R_RD4PDF=${R_RD4PDF-'times,hyper'}
## used for options("texi2dvi")
R_TEXI2DVICMD=${R_TEXI2DVICMD-${TEXI2DVI-'/usr/bin/texi2dvi'}}
## used by untar(support_old_tars = TRUE) and installing grDevices
R_GZIPCMD=${R_GZIPCMD-'/usr/bin/gzip'}
## Default zip/unzip commands
R_UNZIPCMD=${R_UNZIPCMD-'/usr/bin/unzip'}
R_ZIPCMD=${R_ZIPCMD-'/usr/bin/zip'}
R_BZIPCMD=${R_BZIPCMD-'/usr/bin/bzip2'}
## Default browser
R_BROWSER=${R_BROWSER-'xdg-open'}
## Default editor
EDITOR=${EDITOR-${VISUAL-vi}}
## Default pager
PAGER=${PAGER-'/usr/bin/less'}
## Default PDF viewer
R_PDFVIEWER=${R_PDFVIEWER-''}
## Used by libtool
LN_S='ln -s'
MAKE=${MAKE-'make'}
## Prefer a POSIX-compliant sed on e.g. Solaris
SED=${SED-'/usr/bin/sed'}
## Prefer a tar that can automagically read compressed archives
TAR=${TAR-'/usr/bin/gtar'}

## System and compiler types.
R_SYSTEM_ABI='linux,gcc,gxx,gfortran,gfortran'

## Strip shared objects and static libraries.
R_STRIP_SHARED_LIB=${R_STRIP_SHARED_LIB-'strip --strip-unneeded'}
R_STRIP_STATIC_LIB=${R_STRIP_STATIC_LIB-'strip --strip-debug'}

R_LIBS_USER=${R_LIBS_USER-'~/R/x86_64-pc-linux-gnu-library/4.1'}
#R_LIBS_USER=${R_LIBS_USER-'~/Library/R//4.1/library'}

### Local Variables: ***
### mode: sh ***
### sh-indentation: 2 ***
### End: ***

しかし、これを直接編集はしてはいけない。

/opt/R/4.1.3/lib/R/etc/Renviron.site というファイルを新規で作成し、 「RETICULATE_PYTHON=”/usr/local/python3/bin/python”」とか書くことで全体適用となる。

これは、/opt/R/4.1.3/lib/R/etc/Renviron の方は、Rのバージョンアップで設定値が変わる可能性があるので、特有の設定はファイルを分離しておく、というものになっている。

その2: アクセスログ

Rstudio ServerのWeb UIから誰がログインしたのか、というログがどこに出るのか?

どうやら、Pro版のみの機能の模様で、 /etc/rstudio/rserver.conf に「server-access-log=1」と設定するようだが、ライセンスがないと、この設定が入っているとRstudio serverが起動しない。

わざとパスワードを間違えたりすると /var/log/secure にログがでるので、/etc/pam.d/rstudio の内容を/etc/pam.d/sshd と同じにすれば、rstudioでログインに成功した場合でも同じようにログイン成功時もログ出力があるかと思ったのですが、出力されず。

・・・ただ、pamtesterコマンドで動作検証してみたところ、rstudioでもsshdでもログイン成功時に出力していない・・・もしかしてsshでログイン成功した時に/var/log/secureに出力しているのはpamd経由ではない??

rstudioでパスワード間違え

[root@rhel9 rstudio]# pamtester -v rstudio testuser authenticate
pamtester: invoking pam_start(rstudio, testuser, ...)
pamtester: performing operation - authenticate
Password:
pamtester: Authentication failure
[root@rhel9 rstudio]#

/var/log/secureの出力内容

Apr  5 17:50:51 rhel9 unix_chkpwd[41719]: password check failed for user (testuser)
Apr  5 17:50:51 rhel9 pamtester[41717]: pam_unix(rstudio:auth): authentication failure; logname=root uid=0 euid=0 tty= ruser= rhost=  user=testuser

rstudioでパスワード正しく

[root@rhel9 rstudio]# pamtester -v rstudio testuser authenticate
pamtester: invoking pam_start(rstudio, testuser, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated
[root@rhel9 rstudio]#

/var/log/secureへの出力は無い

sshdでパスワード誤り

[root@rhel9 rstudio]# pamtester -v sshd testuser authenticate
pamtester: invoking pam_start(sshd, testuser, ...)
pamtester: performing operation - authenticate
Password:
pamtester: Authentication failure
[root@rhel9 rstudio]#

/var/log/secureへ出力あり

Apr  5 17:51:09 rhel9 unix_chkpwd[41726]: password check failed for user (testuser)
Apr  5 17:51:09 rhel9 pamtester[41724]: pam_unix(sshd:auth): authentication failure; logname=root uid=0 euid=0 tty= ruser= rhost=  user=testuser

sshdでパスワード正しく

[root@rhel9 rstudio]# pamtester -v sshd testuser authenticate
pamtester: invoking pam_start(sshd, testuser, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated
[root@rhel9 rstudio]#

/var/log/secureに出力無し

Rstudio server上でRを使う時に追加しておいた方がいいRHELパッケージのメモ


Rstudio serverをRHEL9上で動かす際にR側でいろいろパッケージを追加する際に必要となるパッケージがあったので、そのメモ

まずは基本

「dnf groupinstall “開発ツール”」で開発ツールをインストール

tidyverseに必要だったもの

install.packages(“tidyverse”) でtidyverseを追加しようとしたら前提となるraggのインストールがfontconfigコマンドが無いことで失敗

→ fontconfig-devel

次のエラーがfribidi was not found in the pkg-config search path

→ fribidi-devel
→ libtiff-devel
→ libjpeg-turbo-devel

Rstudioからpythonを使う際に必要だったもの

Rstudio serverでpythonスクリプトを使う際に、追加パッケージを要求されるが、それが必要としているもの

→ libxml2-devel
→ libcurl-devel
→ libpng-devel