centos7虚拟机环境，光驱连接centos安装镜像。
一、创建目录挂载镜像
mkdir -p /mnt/cdrom
mount /dev/sr0 /mnt/cdrom/
二、创建本地yum源
在/etc/yum.repos.d目录下创建local.repo文件，写入内容：
[local]
name=local repo
baseurl=file:///mnt/cdrom
enable=1
gpgckeck=1
gpgkey=file:///mnt/cdrom/RPM-GPG-KEY-CentOS-7
三、将/etc/yum.repos.d目录下其余文件删除，或者移动到别的目录，使得/etc/yum.repos.d目录下只有local.repo
四、更新yum源
yum clean all
yum makecache
yum repolist all
步骤完成，可以使用yum命令安装了。
On an HPE Gen8-series or HPE ProLiant Gen9-series servers with HPE Integrated Lights-Out 4 (iLO 4), the NAND flash device may not initialize or mount properly, which may cause a variety of symptoms, which are listed below:
AHS Errors
Embedded Media Errors
Intelligent Provisioning Errors
OneView Errors
Any HPE ProLiant Gen8-series or HPE ProLiant Gen9-series server running iLO 4.
The resolution for this issue may take several steps that need to be completed in the order specified below.
OVERVIEW
Step 1) Upgrade the iLO 4 firmware to version 2.61
Step 2) Perform a NAND format
Step 3) Check the iLO status If the iLO status is normal, then skip to Step 6 If the iLO status is still degraded, continue to Step 4
Step 4) Schedule downtime; AC power-cycle and repeat the NAND format
Step 5) Check the iLO status If the iLO status is normal, continue to
Step 6 If the iLO status is still degraded, then skip to Step 7
Step 6) Perform these final steps if the system board does not need to be replaced: Reboot the server; reinstall IP; and refresh the server in OneView (if server is managed by OneView)
Step 7) If steps 1-4 did not resolve the degraded iLO, replace the system board.
Note: The 2.61 iLO 4 firmware is a critical update. As such, HPE requires users to update to this version immediately. Install this update to take advantage of significant improvements to the write algorithm for the embedded 4 GB non-volatile flash memory (also known as the NAND). These improvements increase the NAND lifespan.
Additional considerations before performing a NAND format
A NAND format can be performed while the server is online in most cases.
Exception: For ESXi hosts booting from the Embedded SD Card – it isstrongly recommended to perform the NAND format with the ESXi OSshutdown.This recommendation also applies when updating the iLO 4firmware or resetting the iLO for ESXi hosts booting from the Embedded SDCard
A server AC power removal may be required (prior to the NAND format) in order for the NAND format to be successful. This can be accomplished for ML or DL servers by shutting down the server and disconnecting the power cables for a few seconds. For blade servers, an E-fuse can be accomplished by logging into the OA CLI and typing “reset server #” where “#” is the bay number of the blade.
An AuxPwrCycle feature was added in iLO 4 firmware version 2.55 so that the equivalent of an AC power removal can be performed remotely on a server.
Refer to Customer Notice “HPE Integrated Lights Out (iLO) 4 – RESTful Command to Allow an Auxiliary Power-Cycle Is Available in Firmware Version 2.55 (and Later)” located at the following URL:
Required steps to perform after a successful NAND format
Detailed steps
Step 1. Upgrade the iLO 4 firmware to version 2.61. To download the firmware. The latest version of the iLO 4 firmware is available as follows:
Note: For ESXi hosts booting from the Embedded SD Card (Gen8/Gen9)- it is strongly recommended to perform this step with the ESXi OS shutdown.
Step 2. Perform NAND format using one of the methods detailed in the customer advisory: using one of the methods detailed in the customer advisory: HPE Integrated Lights-Out 4 (iLO 4) – How to Format the NAND Used to Store AHS logs, OneView Profiles, and Intelligent Provisioning
Find the document at:
Note: iLO 4 firmware version 2.44 (or later) is required to format the NAND using the following steps.
Step 3. Check the iLO status using the options available in the customer advisory: HPE Integrated Lights-Out 4 (iLO 4) – How to Format the NAND Used to Store AHS logs, OneView Profiles, and Intelligent Provisioning (find the document at the link in Step 2).
If the iLO status is normal based on the above criteria, then skip to Step 6 If the iLO status is still degraded, continue to Step 4
Step 4. If the iLO status is still degraded, perform the following steps:
a) Schedule a maintenance window
b) Shut down the server
c) Perform an E-fuse (server blade) or AC Power Pull (DL / ML series servers) d) Perform the NAND format again (refer to the instructions in Step 2 above)
Step 5. Check the iLO status (refer to the instructions in Step 3 above)
If the iLO status is normal, continue to Step 6
If the iLO status is still degraded, then skip to Step 7
Step 6. Perform these final steps after the NAND format is successful:
a) Reboot the server
b) Reinstall Intelligent Provisioning (see additional details below)
c) If the server is managed by HPE OneView, perform a server refresh to bring the server back under management.
Note: Any existing errors in OneView will need to be marked as cleared after the refresh.
Step 7. If steps 1-4 did not resolve the degraded iLO, contact HPE support to arrange a system board replacement. Follow these steps to complete the remediation:
a) Open an HPE support case to arrange for a replacement system board / arrange a maintenance window
b) During the maintenance window, shutdown the server
c) Unassign the OneView profile (if the server is under OneView management)
d) Replace the system board
e) Enter Server Model and Serial Number via RBSU
f) Update to iLO 4 firmware 2.61 (or later)
g) Check iLO status (refer to Step 3 above)
h) Reassign the OneView profile (if the server is under OneView management)
Note: Any existing errors in OneView will need to be marked as cleared after the OneView profile is applied.
If additional assistance is needed, contact HPE support and reference Advisory a00019495en_us as follows:
Click on the following URL to locate the HPE Customer Support phone number in your country:
https://h20195.www2.hpe.com/v2/Getdocument.aspx?docname=A00039121ENW .
OneView Considerations
OneView relies on the NAND to be accessible to perform many operations such as adding a new server or applying a profile. Because of this there are several things that need to be understood when dealing with this issue in an OneView environment.
Reinstalling Intelligent Provisioning Considerations
There are online and offline options for reinstalling Intelligent Provisioning
Note: Intelligent Provisioning version 3.x is for HPE ProLiant Gen10-series servers only.
Offline method considerations:
Reference:
https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_170e0ac3cb6e4439bf313f137a#tab3
Note: The DVD can be used multiple times.
Please note the Intelligent Provisioning Recovery Media DVD may be remotely mounted using HPE Integrated Lights-Out 4 (iLO 4) Virtual Media functionality, in order to reinstall Intelligent Provisioning. Additional information is available in the HPE iLO 4 User Guide at the following URL regarding how to mount an ISO image (federated or un-federated) and perform basic virtual media operations. Reference Pages 189 and 223-237:
HPE iLO 4 User Guide:
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03334051-16
In addition, it is possible to write a script that utilizes HPE Integrated Lights-Out 4 (iLO 4) to reinstall Intelligent Provisioning on multiple servers. HPE Lights-Out management processors support an advanced scripting interface for group configuration and server actions. Scripts would need to be customized for the specific environment and task. Sample scripts are available for customers to reference at the following URL: HPE Lights-Out XML Scripting Sample for Windows: https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_459b8adc29c04317ad1d6a6752
Intelligent Provisioning software download links
HPE ProLiant Gen8-series servers are only supported with Intelligent Provisioning 1.x
HPE ProLiant Gen9-series servers are only supported with Intelligent Provisioning 2.x
a.) Linux RPM located at the following URLs: For HPE Gen8-series servers: http://downloads.linux.hpe.com/SDR/repo/ip/rhel/current/x86_64/gen8/
For HPE Gen9-series servers: http://downloads.linux.hpe.com/SDR/repo/ip/rhel/current/x86_64/gen9/firmware-intelligentprovisioning-ip-2.71-1.1.x86_64.rpm
b.) The Windows files are located at the following URLs:
For HPE ProLiant Gen8-series servers: Intelligent Provisioning for Microsoft Windows 64-bit Operating Systems 1.64.0.0 (2 Mar 2017) cp031302.exe https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_01b900175afc4ae68be6c87b39
For HPE ProLiant Gen9-series servers: Intelligent Provisioning for Windows x64 2.50.0.0(6 Jan 2017) cp031091.exe https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_b031497eafd94b9ea2156cdef6
c) ISO images (e.g. for VMware) on Hewlett Packard Enterprise Support Center located at the following: https://support.hpe.com/hpesc/public/home/driverHome?sp4ts.oid=1008862660
For HPE ProLiant Gen8-series servers: Intelligent Provisioning Recovery Media, version 1.70(9 Oct 2017)
For HPE ProLiant Gen9-series servers: Intelligent Provisioning for Gen9 Servers, version 2.70(b)(28 Feb 2018)
HP服务器的F10功能是一个安装在主板NAND空间上的独立的linux内核系统，主要功能是系统快速安装和服务器维护诊断。
如果开机自检时没有出现F10按钮的提示，有三种可能。
一、主板BIOS设置问题，可以通过恢复BIOS默认设置或者单独设置F10。
按F9进入主板BIOS设置，System Utilities——System Configuration——menucascade-separatorBIOS/
Platform Configuration (RBSU)（BIOS/平台配置）——menucascade-separatorServer Security（服务器安
全性）——menucascade-separatorIntelligent Provisioning (F10 Prompt)（F10 提示），选择Enabled启用，按F10保存即可。
二、F10系统崩溃，此时需要在HP官网下载F10镜像进行重新安装。
需要进入ilo integrated remote console控制台界面，挂载镜像，然后从F11从镜像启动。
选择第一个直接安装镜像，等待安装完成即可，安装完成后会自动重启，重启后即可使用F10功能。
三、NAND空间受损，如此功能受损，将会在ilo上看到有类似”Embedded Flash/SD-CARD:Failed restart”的报错，这种情况下，如果ILO版本较高，可以在ilo里直接format reset下ilo。
或者通过HP Lights-Out 配置实用程序HPQLOCFG命令行的方式来重新格式化NAND。
linux新增了一块硬盘，首先通过fdisk -l查看：
然后fdisk /dev/vdb创建分区
以此输入n p
first sector和last sector默认，直接回车，输入t L
输入8e，采用LVM分区
按w保存。
然后pvcreate /dev/vdb1，vgcreate vg_vdb /dev/vdb1
lvcreate -L 1000G -n lv_u01 vg_vdb，mkfs.xfs /dev/vg_vdb/lv_u01
新建/u01目录，挂载分区mount /dev/vg_vdb/lv_u01 /u01
在/etc/fstab中添加/dev/mapper/vg_vdb-lv_u01 /u01 xfs defaults 0 0，即可。
Linux LVM分区扩容方法，可以参见https://www.eumz.com/2018-04/1461.html
For SLES, user may have to specify the module as e1000e while configuring
the network. The module can be specified in Hardware Details of Advanced
configuration
For SLES, the configuration file is /etc/modprobe.conf or /etc/modprobe.conf.local
To verify that the e1000e driver is loaded use the following command.
# lsmodYou should find e1000e listed. You can also verify if the correct e1000e driver is
loaded through any of the following methods. Note that version of the driver loaded
should be same as that of the package version.
A. Look for driver load messages in the system log.
#dmesg | grep IntelYou should see messages of the following type,
Intel(R) PRO/1000 Network Driver - version x.x.xB. Check the /var/log/messages file for a similar message as indicated in method A.
Note: To load the driver from command line use ‘modprobe’ instead of ‘insmod’.
Refer to the man pages for lsmod, ifconfig, rmmod, insmod, modprobe, modules.conf
and modprobe.conf for more detailed information.
The following command will uninstall the RPM.
Red Hat
# rpm -e kmod-hp-e1000e-<kernel flavor>
SLES
# rpm -e hp-e1000e-kmp-<kernel flavor>Some Linux distributions may not add the default route back to a specified network
device when a network stop/start command is used. Use the route command to add the
default router back to the network device.
Some Linux distributions may not add the default assigned IP address back to a
specified network device when using the following:
ifconfig eth(x) down
rmmod <module name>
insmod <module name> <optional parameter changes>
ifconfig eth(x) upAnother step to reassign the IP address back to the device may be required:
ifconfig eth(x) <ip address>Some Linux distributions may add multiple IP addresses with the same system name in
the /etc/hosts file when configuring multiple network devices.
现有一台电脑接了双网卡，连接外网网卡配置IP地址网关，连接内网的网卡通过DHCP获取地址，由于此时系统上有两个网关，会导致部分网段无法正常访问，需要将内网的网关去掉，到内网网段写路由。关于双网卡的配置，参见windows下双网卡双网关的设置https://www.eumz.com/2012-05/251.html。
该内网网卡DHCP获取到的地址是192.168.1.113/24，网关192.168.1.1，此时关闭DHCP，配置静态地址192.168.1.113和24位掩码，不配置网关，此时发现ping网关192.168.1.1不通。在电脑接入的交换机上查看DHCP地址池配置，发现DHCP地址池是192.168.1.2-192.168.1.200，为电脑配置地址池之外的IP192.168.1.201，这时到192.168.1.1是通的，然后配置到内网网段的路由即可。
对于这种情况，静态地址配置成DHCP获取到的地址无法使用，就需要配置成DHCP地址池外的地址。
启动linux，在这个界面时，按e，
按向下的箭头键，在linux16这一行的末尾LANG=en_US.UTF-8后面输入init=/bin/sh
然后按ctrl+x，进入单用户模式
此时在单用户模式下还不能修改密码，需要输入命令mount -o remount,rw /
然后通过passwd修改root密码，修改完成后，一定要输入touch /.autorelabel，不然启动不了
输入 touch /.autorelabel后输入exec /sbin/init即可使用刚才修改的root密码进入系统
centos6进入单用户模式方法如下：
启动到这个步骤时，按e
在kernel这一行按e
在quiet后面输入single，或者输入1按回车
回到这个界面
再按b启动，即可进入单用户模式，在单用户模式可以修改root密码等。
供应链攻击是一种以软件开发人员和供应商为目标的新出现的威胁。 目标是通过感染合法应用来分发恶意软件来访问源代码、构建过程或更新机制。
攻击者搜寻不安全的网络协议、未受保护的服务器基础结构和不安全的编码实践。 它们在生成和更新过程中会中断、更改源代码并隐藏恶意软件。
由于软件由受信任的供应商生成和发布，因此这些应用和更新已经过签名和认证。 在软件供应链攻击中，供应商可能不知道他们的应用或更新在公开发布时受到恶意代码的感染。 然后，恶意代码以与应用相同的信任和权限运行。
鉴于某些应用的热门程度，潜在隐患的数量很大。 发生了一种情况，其中免费文件压缩应用被病毒化，并部署到作为顶级实用工具应用的国家/地区的客户。
一般软件供应链分三个环节，每个环节都可能被攻击。
1、生产节点被攻击（开发软件）
软件开发涉及到的软硬件开发环境、开发工具、第三方库、软件开发实施等等，并且软件开发实施的具体过程还包括需求分析、设计、实现和测试等，软件产品在这一环节中形成最终用户可用的形态。
2、交付节点被攻击（软件上线的平台、硬件）
用户通过软件官网、公共仓库、在线商店、免费网络下载、购买软件安装光盘等存储介质、资源共享等方式获取到所需软件产品的过程。受攻击对象比如著名的软件下载站、Python官方镜像源、Github等。
3、使用节点被攻击（软硬件使用者） 使用软硬件产品的整个生命周期，包括产品更新升级、维护等过程。
根据赛门铁克2019 年《互联网安全威胁报告》，供应链攻击和离地攻击现已成为网络犯罪的主流：2018年供应链攻击增加了78%。特别在很多发布平台的安全能力较弱甚至没有的情况下，软件供应链攻击仅需要作者的一个上传、发布即可轻松完成钓鱼。
附录：
[1] xCodeGhost：https://security.tencent.com/index.php/blog/msg/96
[2] xshell攻击：https://security.tencent.com/index.php/blog/msg/120
[3] 中文版Putty后门事件：https://www.cnbeta.com/articles/tech/171116.htm
[4] 思科后门事件: https://www.guancha.cn/TMT/2014_03_31_218296.shtml
[5] powercdn软件升级劫持攻击:https://www.freebuf.com/news/140079.html