2.2.1.1. Rocky Linux Deployment Requirements
This section features de requirements steps for deploying OpenNAC from an empty Rocky Linux:
1. IP Address Assignment
2. Operating System Language
3. Disk Partitions
4. Network Connectivity
5. Repository Credentials
2.2.1.1.1. IP Address Assignment
The very first step to begin a deployment is IP assignment.
Note
The name of the interfaces may change depending on the OS version, i.e.: ens18.
Access your deployed OVAs by CLI and provide IPs for all nodes by executing the graphical network manager:
nmtui
On the initial window, select Edit a connection:
Select the interface and press Edit:
You will see the following default configuration:
The IPv4 Configuration is set to “Automatic” by default. Change it to “Manual” and manually configure the following parameters:
Addresses: Add node IP address with netmask (<IP>/<MASK>)
Gateway: Add a default gateway
DNS Servers: Add a DNS server. We recommend using the Corporate DNS server.
Set option Require IPv4 addressing for this connection.
The IPv6 Configuration is set to “Automatic” by default. Change it to “Ignore”:
Finalize by selecting <OK> at the bottom of the view and go back to the initial menu.
Afterward, apply the changes by activating and deactivating the interface. Navigate to the Network Manager menu and choose the Activate a connection option.
Deactivate and activate interface and go back to the initial menu.
Interface is now configured and can be verified by typing the following command in CLI “ifconfig” o “ip a”:
ifconfig
2.2.1.1.2. Operating System Language
Warning
In order to proceed with the configuration, ensure that the operating system language is set to English:
Open the /etc/locale.conf file and ensure that the following line reflects the English language configuration:
LANG="en_US.UTF-8"
Save and exit the file, then reboot the system to apply the changes.
For more information about the Rocky Linux 9 installation you can visit the official Rocky Linux official site.
2.2.1.1.3. Disk Partitions
Before deploying the nodes, it is necessary to have the proper disk partitions made. Each role requires different partitions. These partitions are made from minimum 200GB disk size. If you want to add more disk space, you should distribute it according to your needs.
Note
The recommended file system is the xfs.
Partition Role |
Permissions |
Principal |
Proxy |
Worker |
Analytics |
Analy+agg |
Aggregator |
Sensor |
Captive |
VPNGW |
|---|---|---|---|---|---|---|---|---|---|---|
/ (xfs) |
default |
40GB |
40GB |
40GB |
20GB |
20GB |
20GB |
20GB |
40GB |
40GB |
/backup (xfs) |
nosuid,nodev,noexec |
24GB |
24GB |
|||||||
/boot (xfs) |
default |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
1.5GB |
/boot/efi (vfat) |
default |
1024MB |
1024MB |
1024MB |
1024MB |
1024MB |
1024MB |
1024MB |
1024MB |
1024MB |
/home (xfs) |
nosuid,nodev |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
/opt (xfs) |
nosuid,nodev |
10GB |
10GB |
10GB |
10GB |
10GB |
10GB |
127GB |
10GB |
10GB |
/tmp (tmpfs) |
nosuid,nodev,noexec |
* |
* |
* |
* (remove noexec permission) |
* (remove noexec permission) |
* |
* |
* |
* |
/var (xfs) |
nosuid,nodev |
40GB |
52GB |
40GB |
127GB |
127GB |
127GB |
10GB |
52GB |
52GB |
/var/log (xfs) |
nosuid,nodev,noexec |
58GB |
70GB |
58GB |
15GB |
15GB |
15GB |
15GB |
70GB |
70GB |
/var/log/audit (xfs) |
nosuid,nodev,noexec |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
5GB |
/var/tmp (tmpfs) |
nosuid,nodev,noexec |
* |
* |
* |
* |
* |
* |
* |
* |
* |
Swap |
default |
8GB |
8GB |
8GB |
8GB |
8GB |
8GB |
8GB |
8GB |
8GB |
* The system will define the partition size, because tmpfs uses volatile memory.
2.2.1.1.4. Network Connectivity
Ensure that you have an accessible IP address and internet connection:
[root@CORE ~]# ping google.com
PING google.com (142.250.200.142) 56(84) bytes of data.
64 bytes from mad41s14-in-f14.1e100.net (142.250.200.142): icmp_seq=1 ttl=117 time=13.10 ms
64 bytes from mad41s14-in-f14.1e100.net (142.250.200.142): icmp_seq=2 ttl=117 time=13.10 ms
64 bytes from mad41s14-in-f14.1e100.net (142.250.200.142): icmp_seq=3 ttl=117 time=13.6 ms
--- google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 13.550/13.833/13.986/0.200 ms
Check you have access to the repository by trying to download the following file:
[root@onprincipal ~]# wget --user "repo_user" --ask-password https://repo-opennac.opencloudfactory.com/1.2.4/opennac-v1.2.4.repo
Password for user ‘repo_user’:
--2024-03-05 13:56:26-- https://repo-opennac.opencloudfactory.com/1.2.4/opennac-v1.2.4.repo
Resolving repo-opennac.opencloudfactory.com (repo-opennac.opencloudfactory.com)... 10.21.160.10
Connecting to repo-opennac.opencloudfactory.com (repo-opennac.opencloudfactory.com)|10.21.160.10|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 388 [application/x-troff-man]
Saving to: ‘opennac-v1.2.4.repo’
opennac-v1.2.4.repo 100%[===========================================================================================================================================>] 388 --.-KB/s in 0s
2024-03-05 13:56:26 (9.39 MB/s) - ‘opennac-v1.2.4.repo’ saved [388/388]
Once you verify you can access the repository, you can delete this file:
[root@onprincipal ~]# rm opennac-v1.2.4.repo
rm: remove regular file 'opennac-v1.2.4.repo'? y