RHELベースのopenEuler 20.03環境でdnf check-update / yum check-update を実行したら「Operation too slow」と言われた
update 338 B/s | 3.5 kB 00:10
update 6.7 kB/s | 843 kB 02:06
Errors during downloading metadata for repository 'update':
- Curl error (56): Failure when receiving data from the peer for http://repo.openeuler.org/openEuler-20.03-LTS-SP1/update/x86_64/repodata/repomd.xml [Recv failure: Connection reset by peer]
- Curl error (28): Timeout was reached for http://repo.openeuler.org/openEuler-20.03-LTS-SP1/update/x86_64/repodata/416426aa7e21eba53323018f9077ad6e94fe240e320c577b6ec34ef7fc1f62be-filelists.xml.gz [Operation too slow. Less than 1 bytes/sec transferred the last 30 seconds]
- Curl error (28): Timeout was reached for http://repo.openeuler.org/openEuler-20.03-LTS-SP1/update/x86_64/repodata/c5910efa87edf2c30e8262d4061feb2d84ab441fef40232c861c31db9cd97978-primary.xml.gz [Operation too slow. Less than 1 bytes/sec transferred the last 30 seconds]
Error: Failed to download metadata for repo 'update': Yum repo downloading error: Downloading error(s): repodata/c5910efa87edf2c30e8262d4061feb2d84ab441fef40232c861c31db9cd97978-primary.xml.gz - Cannot download, all mirrors were already tried without success; repodata/416426aa7e21eba53323018f9077ad6e94fe240e320c577b6ec34ef7fc1f62be-filelists.xml.gz - Cannot download, all mirrors were already tried without success
[root@openeuler ~]#
Solaris 2.5.1時代に原型を作ったperl CGIも存在してるWebサーバは時代を経てCentOS4→CentOS7→Oracle Autonomous Linux 7(OCI上)と移転しつつ運用していた。ただ、それもいい加減置き換えるかとOracle Linux9(OCI上)へ移行した時のメモ書き
[Thu Apr 25 13:24:45.157549 2024] [core:error] [pid 6267:tid 6455] (13)Permission denied: [client 118.238.215.174:55006] AH00035: access to /index.html denied (filesystem path '/home/user/web/index.html') because search permissions are missing on a component of the path
# ausearch -m AVC|grep denied|grep cgi | audit2allow -M comchatq
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i comchatq.pp
# ls -l comchatq*
-rw-r--r--. 1 root root 1329 Apr 26 15:23 comchatq.pp
-rw-r--r--. 1 root root 586 Apr 26 15:23 comchatq.te
# cat comchatq.te
module comchatq 1.0;
require {
type user_home_dir_t;
type httpd_sys_rw_content_t;
type httpd_t;
type httpd_sys_script_t;
class file { execute execute_no_trans };
class dir search;
}
#============= httpd_sys_script_t ==============
#!!!! This avc can be allowed using one of the these booleans:
# httpd_enable_homedirs, httpd_read_user_content
allow httpd_sys_script_t user_home_dir_t:dir search;
#============= httpd_t ==============
#!!!! This avc can be allowed using the boolean 'httpd_unified'
allow httpd_t httpd_sys_rw_content_t:file { execute execute_no_trans };
#
$ ./joyful.cgi
Can't use 'defined(%hash)' (Maybe you should just omit the defined()?) at ./jcode.pl line 684.
Compilation failed in require at ./joyful.cgi line 44.
$
$ curl -O https://cpan.metacpan.org/authors/id/I/IN/INA/Jacode/Jacode-2.13.4.31.tar.gz
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 5408k 100 5408k 0 0 5803k 0 --:--:-- --:--:-- --:--:-- 5797k
$ tar xfz Jacode-2.13.4.31.tar.gz
$ cd Jacode-2.13.4.31/lib
$ ls -l
total 220
-rwxr-xr-x. 1 osakanataro osakanataro 217584 Mar 21 2023 jacode.pl
-rw-r--r--. 1 osakanataro osakanataro 2432 Mar 21 2023 Jacode.pm
$
MySQL 8におけるデータベースユーザ作成と権限の割り当てが従来の「grant all on DB名.* to wordpress@localhost identified by ‘パスワード’;」という一文から、「create user ～」と「grant ～」の２つに分かれている点に注意が必要です。
$ sudo mysql -u root
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.32 Source distribution
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create database DB名 character set utf8;
Query OK, 1 row affected, 1 warning (0.01 sec)
mysql> create user wordpress@localhost identified by 'パスワード';
Query OK, 0 rows affected (0.01 sec)
mysql> grant all privileges on DB名.* to wordpress@localhost;
Query OK, 0 rows affected (0.00 sec)
mysql> quit
Bye
$
手順7: Webサーバ設定
手順7-1: httpdインストール
httpdをインストールします。
Oracle Linux 9.2ではWebサーバとして Apache(httpd) 2.4.53 、nginx 1.20.1、nginx 1.22.1が使えるが、apacheを使う。
$ sudo dnf install httpd -y
Last metadata expiration check: 0:05:50 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Package httpd-2.4.53-11.0.1.el9_2.5.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
$
$ sudo dehydrated --register
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
To use dehydrated with this certificate authority you have to agree to their terms of service which you can find here: https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf
To accept these terms of service run "/bin/dehydrated --register --accept-terms".
$ sudo /bin/dehydrated --register --accept-terms
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
+ Generating account key...
+ Registering account key with ACME server...
+ Fetching account URL...
+ Done!
$
初回のSSL証明書発行処理を実行します。
$ sudo dehydrated --cron
# INFO: Using main config file /etc/dehydrated/config
# INFO: Using additional config file /etc/dehydrated/conf.d/local.sh
+ Creating chain cache directory /etc/dehydrated/chains
Processing ホスト1名.ドメイン名 with alternative names: ホスト2名.ドメイン名
+ Creating new directory /etc/dehydrated/certs/ホスト1名.ドメイン名 ...
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 2 authorizations URLs from the CA
+ Handling authorization for ホスト1名.ドメイン名
+ Handling authorization for ホスト2名.ドメイン名
+ 2 pending challenge(s)
+ Deploying challenge tokens...
+ Responding to challenge for ホスト1名.ドメイン名 authorization...
+ Challenge is valid!
+ Responding to challenge for ホスト2名.ドメイン名 authorization...
+ Challenge is valid!
+ Cleaning challenge tokens...
+ Requesting certificate...
+ Checking certificate...
+ Done!
+ Creating fullchain.pem...
+ Done!
+ Running automatic cleanup
$
手順7-3: WebサーバへのSSL証明書設定
まず、httpdにmod_sslを追加します。
$ sudo dnf install mod_ssl -y
Last metadata expiration check: 0:13:55 ago on Tue 12 Sep 2023 11:38:07 AM JST.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
mod_ssl x86_64 1:2.4.53-11.0.1.el9_2.5 ol9_appstream 119 k
Transaction Summary
================================================================================
Install 1 Package
＜略＞
$
$ cd /var/www/html
$ ls
$ sudo curl -O https://wordpress.org/latest.tar.gz
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 22.3M 100 22.3M 0 0 17.6M 0 0:00:01 0:00:01 --:--:-- 17.6M
$ ls
latest.tar.gz
$ sudo tar xfz latest.tar.gz
$ ls -l
total 22904
-rw-r--r--. 1 root root 23447259 Sep 12 11:57 latest.tar.gz
drwxr-xr-x. 5 nobody nobody 4096 Aug 29 23:14 wordpress
$ sudo rm latest.tar.gz
$
現在の設定値を「sudo getsebool -a |grep httpd_can_network」で確認し、「sudo setsebool -P httpd_can_network_connect on」で有効にする
$ sudo getsebool -a |grep httpd_can_network
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
$ sudo setsebool -P httpd_can_network_connect on
$ sudo getsebool -a |grep httpd_can_network
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
$
$ sudo vi /etc/dnf/automatic.conf
$ cat /etc/dnf/automatic.conf
[commands]
# What kind of upgrade to perform:
# default = all available upgrades
# security = only the security upgrades
upgrade_type = default
random_sleep = 0
# Maximum time in seconds to wait until the system is on-line and able to
# connect to remote repositories.
network_online_timeout = 60
# To just receive updates use dnf-automatic-notifyonly.timer
# Whether updates should be downloaded when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
download_updates = yes
# Whether updates should be applied when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
apply_updates = yes
[emitters]
# Name to use for this system in messages that are emitted. Default is the
# hostname.
# system_name = my-host
# How to send messages. Valid options are stdio, email and motd. If
# emit_via includes stdio, messages will be sent to stdout; this is useful
# to have cron send the messages. If emit_via includes email, this
# program will send email itself according to the configured options.
# If emit_via includes motd, /etc/motd file will have the messages. if
# emit_via includes command_email, then messages will be send via a shell
# command compatible with sendmail.
# Default is email,stdio.
# If emit_via is None or left blank, no messages will be sent.
emit_via = stdio
[email]
# The address to send email messages from.
email_from = root@example.com
# List of addresses to send messages to.
email_to = root
# Name of the host to connect to to send email messages.
email_host = localhost
[command]
# The shell command to execute. This is a Python format string, as used in
# str.format(). The format function will pass a shell-quoted argument called
# `body`.
# command_format = "cat"
# The contents of stdin to pass to the command. It is a format string with the
# same arguments as `command_format`.
# stdin_format = "{body}"
[command_email]
# The shell command to use to send email. This is a Python format string,
# as used in str.format(). The format function will pass shell-quoted arguments
# called body, subject, email_from, email_to.
# command_format = "mail -Ssendwait -s {subject} -r {email_from} {email_to}"
# The contents of stdin to pass to the command. It is a format string with the
# same arguments as `command_format`.
# stdin_format = "{body}"
# The address to send email messages from.
email_from = root@example.com
# List of addresses to send messages to.
email_to = root
[base]
# This section overrides dnf.conf
# Use this to filter DNF core messages
debuglevel = 1
$
そしてdnf-automatic.timerを有効化し、開始します。
$ sudo systemctl enable dnf-automatic.timer
Created symlink /etc/systemd/system/timers.target.wants/dnf-automatic.timer → /usr/lib/systemd/system/dnf-automatic.timer.
$ sudo systemctl status dnf-automatic
○ dnf-automatic.service - dnf automatic
Loaded: loaded (/usr/lib/systemd/system/dnf-automatic.service; static)
Active: inactive (dead)
TriggeredBy: ○ dnf-automatic.timer
$ sudo systemctl start dnf-automatic.timer
$ sudo systemctl status dnf-automatic.timer
● dnf-automatic.timer - dnf-automatic timer
Loaded: loaded (/usr/lib/systemd/system/dnf-automatic.timer; enabled; pres>
Active: active (waiting) since Tue 2023-09-12 13:11:00 JST; 5s ago
Until: Tue 2023-09-12 13:11:00 JST; 5s ago
Trigger: Wed 2023-09-13 06:44:33 JST; 17h left
Triggers: ● dnf-automatic.service
Sep 12 13:11:00 ホスト名 systemd[1]: Started dnf-automatic timer.
$
手順14 メモリが足らない対策
Oracle CloudのFree Tierで初期値のまま稼働させてみたのですが、頻繁に応答がなくなりました。(Oracle Linux 8だと問題なかったんだけど、Oracle Linux 9だと1日複数回発生)
# dnf repolist
repo id repo の名前
ol9_UEKR7 Oracle Linux 9 UEK Release 7 (x86_64)
ol9_addons Oracle Linux 9 Addons (x86_64)
ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)
#
しかし、”Oracle Linux 9 OCI Included Packages (x86_64)”(oci-included-ol9.repo)を戻したところ応答がなくなる現象発生
# dnf repolist
repo id repo の名前
ol9_UEKR7 Oracle Linux 9 UEK Release 7 (x86_64)
ol9_addons Oracle Linux 9 Addons (x86_64)
ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)
ol9_oci_included Oracle Linux 9 OCI Included Packages (x86_64)
# dnf check-update
Oracle Linux 9 OCI Included Packages (x86_64) 27 MB/s | 84 MB 00:03
＜ここから出力が続かない＞
強制再起動したあと、Oracle Linux 9 OCI Included Packages (x86_64)を除外して、EPELを含めてそれ以外の状態を戻してみるとdnf check-updateに成功
# dnf repolist
repo id repo の名前
ol9_UEKR7 Oracle Linux 9 UEK Release 7 (x86_64)
ol9_addons Oracle Linux 9 Addons (x86_64)
ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)
ol9_developer_EPEL Oracle Linux 9 EPEL Packages for Development (x86_64)
ol9_ksplice Ksplice for Oracle Linux 9 (x86_64)
#
が・・・dnf updateでエラーが・・・
# dnf update -y
メタデータの期限切れの最終確認: 0:01:49 前の 2024年05月07日 11時32分27秒 に実施しました。
エラー:
問題 1: package ImageMagick-libs-6.9.12.93-1.el9.x86_64 from @System requires libraw_r.so.20()(64bit), but none of the providers can be installed
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-6.el9.x86_64 from @System
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-5.el9.x86_64 from ol9_appstream
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-6.el9.x86_64 from ol9_appstream
- パッケージの最良アップデート候補をインストールできません LibRaw-0.20.2-6.el9.x86_64
- パッケージの最良アップデート候補をインストールできません ImageMagick-libs-6.9.12.93-1.el9.x86_64
問題 2: package tuned-profiles-oci-2.21.0-1.0.1.el9_3.noarch from @System requires tuned = 2.21.0-1.0.1.el9_3, but none of the providers can be installed
- cannot install both tuned-2.22.1-1.0.1.el9.noarch from ol9_baseos_latest and tuned-2.21.0-1.0.1.el9_3.noarch from @System
- cannot install both tuned-2.22.1-1.0.1.el9.noarch from ol9_baseos_latest and tuned-2.21.0-1.0.1.el9_3.noarch from ol9_baseos_latest
- パッケージの最良アップデート候補をインストールできません tuned-2.21.0-1.0.1.el9_3.noarch
- インストール済パッケージの問題 tuned-profiles-oci-2.21.0-1.0.1.el9_3.noarch
(競合するパッケージを置き換えるには、コマンドラインに '--allowerasing' を追加してみてください または、'--skip-broken' を追加して、インストール不可のパッケージをスキップしてください または、'--nobest' を追加して、最適候補のパッケージのみを使用しないでください)
#
# dnf update -y --exclude=tuned*
メタデータの期限切れの最終確認: 0:21:39 前の 2024年05月07日 11時32分27秒 に実施しました。
エラー:
問題: package ImageMagick-libs-6.9.12.93-1.el9.x86_64 from @System requires libraw_r.so.20()(64bit), but none of the providers can be installed
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-6.el9.x86_64 from @System
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-5.el9.x86_64 from ol9_appstream
- cannot install both LibRaw-0.21.1-1.el9.x86_64 from ol9_appstream and LibRaw-0.20.2-6.el9.x86_64 from ol9_appstream
- パッケージの最良アップデート候補をインストールできません LibRaw-0.20.2-6.el9.x86_64
- パッケージの最良アップデート候補をインストールできません ImageMagick-libs-6.9.12.93-1.el9.x86_64
(競合するパッケージを置き換えるには、コマンドラインに '--allowerasing' を追加してみてください または、'--skip-broken' を追加して、インストール不可のパッケージをスキップしてください または、'--nobest' を追加して、最適候補のパッケージのみを使用しないでください)
# dnf update -y --exclude=tuned*,ImageMagick-libs,LibRaw
メタデータの期限切れの最終確認: 0:22:54 前の 2024年05月07日 11時32分27秒 に実施しました。
依存関係が解決しました。
＜略＞
アップデート完了後、Oracle Linux 9 OCI Included Packages (x86_64)を戻してdnf check-updateを実行すると、これまでと同じで止まる
