Skip to content

Commit 5b27c53

Browse files
OctomergerOctomerger
authored
Merge pull request #25771 from github/repo-sync
repo sync
2 parents 2c2e0e7 + 4e4c41f commit 5b27c53

File tree

76 files changed

+1533
-1531
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+1533
-1531
lines changed

‎content/admin/configuration/administering-your-instance-from-the-management-console/accessing-the-management-console.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ The first time that you access the {% data variables.enterprise.management_conso
2424
## Accessing the {% data variables.enterprise.management_console %} as an unauthenticated user
2525

2626
1. Visit this URL in your browser, replacing `hostname` with your actual {% data variables.product.prodname_ghe_server %} hostname or IP address:
27-
```shell
28-
http(s)://HOSTNAME/setup
29-
```
27+
```shell
28+
http(s)://HOSTNAME/setup
29+
```
3030
{% data reusables.enterprise_management_console.type-management-console-password %}
3131
{% data reusables.enterprise_management_console.click-continue-authentication %}

‎content/admin/configuration/configuring-network-settings/configuring-built-in-firewall-rules.md‎

Lines changed: 64 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -30,32 +30,32 @@ We do not recommend customizing UFW as it can complicate some troubleshooting is
3030

3131
{% data reusables.enterprise_installation.ssh-into-instance %}
3232
2. To view the default firewall rules, use the `sudo ufw status` command. You should see output similar to this:
33-
```shell
34-
$ sudo ufw status
35-
> Status: active
36-
> To Action From
37-
> -- ------ ----
38-
> ghe-1194 ALLOW Anywhere
39-
> ghe-122 ALLOW Anywhere
40-
> ghe-161 ALLOW Anywhere
41-
> ghe-22 ALLOW Anywhere
42-
> ghe-25 ALLOW Anywhere
43-
> ghe-443 ALLOW Anywhere
44-
> ghe-80 ALLOW Anywhere
45-
> ghe-8080 ALLOW Anywhere
46-
> ghe-8443 ALLOW Anywhere
47-
> ghe-9418 ALLOW Anywhere
48-
> ghe-1194 (v6) ALLOW Anywhere (v6)
49-
> ghe-122 (v6) ALLOW Anywhere (v6)
50-
> ghe-161 (v6) ALLOW Anywhere (v6)
51-
> ghe-22 (v6) ALLOW Anywhere (v6)
52-
> ghe-25 (v6) ALLOW Anywhere (v6)
53-
> ghe-443 (v6) ALLOW Anywhere (v6)
54-
> ghe-80 (v6) ALLOW Anywhere (v6)
55-
> ghe-8080 (v6) ALLOW Anywhere (v6)
56-
> ghe-8443 (v6) ALLOW Anywhere (v6)
57-
> ghe-9418 (v6) ALLOW Anywhere (v6)
58-
```
33+
```shell
34+
$ sudo ufw status
35+
> Status: active
36+
> To Action From
37+
> -- ------ ----
38+
> ghe-1194 ALLOW Anywhere
39+
> ghe-122 ALLOW Anywhere
40+
> ghe-161 ALLOW Anywhere
41+
> ghe-22 ALLOW Anywhere
42+
> ghe-25 ALLOW Anywhere
43+
> ghe-443 ALLOW Anywhere
44+
> ghe-80 ALLOW Anywhere
45+
> ghe-8080 ALLOW Anywhere
46+
> ghe-8443 ALLOW Anywhere
47+
> ghe-9418 ALLOW Anywhere
48+
> ghe-1194 (v6) ALLOW Anywhere (v6)
49+
> ghe-122 (v6) ALLOW Anywhere (v6)
50+
> ghe-161 (v6) ALLOW Anywhere (v6)
51+
> ghe-22 (v6) ALLOW Anywhere (v6)
52+
> ghe-25 (v6) ALLOW Anywhere (v6)
53+
> ghe-443 (v6) ALLOW Anywhere (v6)
54+
> ghe-80 (v6) ALLOW Anywhere (v6)
55+
> ghe-8080 (v6) ALLOW Anywhere (v6)
56+
> ghe-8443 (v6) ALLOW Anywhere (v6)
57+
> ghe-9418 (v6) ALLOW Anywhere (v6)
58+
```
5959

6060
## Adding custom firewall rules
6161

@@ -67,13 +67,13 @@ We do not recommend customizing UFW as it can complicate some troubleshooting is
6767

6868
1. Configure a custom firewall rule.
6969
2. Check the status of each new rule with the `status numbered` command.
70-
```shell
71-
$ sudo ufw status numbered
72-
```
70+
```shell
71+
$ sudo ufw status numbered
72+
```
7373
3. To back up your custom firewall rules, use the `cp`command to move the rules to a new file.
74-
```shell
75-
$ sudo cp -r /etc/ufw ~/ufw.backup
76-
```
74+
```shell
75+
$ sudo cp -r /etc/ufw ~/ufw.backup
76+
```
7777

7878
After you upgrade {% data variables.location.product_location %}, you must reapply your custom firewall rules. We recommend that you create a script to reapply your firewall custom rules.
7979

@@ -89,37 +89,37 @@ If something goes wrong after you change the firewall rules, you can reset the r
8989

9090
{% data reusables.enterprise_installation.ssh-into-instance %}
9191
2. To restore the previous backup rules, copy them back to the firewall with the `cp` command.
92-
```shell
93-
$ sudo cp -f ~/ufw.backup/*rules /etc/ufw
94-
```
92+
```shell
93+
$ sudo cp -f ~/ufw.backup/*rules /etc/ufw
94+
```
9595
3. Restart the firewall with the `systemctl` command.
96-
```shell
97-
$ sudo systemctl restart ufw
98-
```
96+
```shell
97+
$ sudo systemctl restart ufw
98+
```
9999
4. Confirm that the rules are back to their defaults with the `ufw status` command.
100-
```shell
101-
$ sudo ufw status
102-
> Status: active
103-
> To Action From
104-
> -- ------ ----
105-
> ghe-1194 ALLOW Anywhere
106-
> ghe-122 ALLOW Anywhere
107-
> ghe-161 ALLOW Anywhere
108-
> ghe-22 ALLOW Anywhere
109-
> ghe-25 ALLOW Anywhere
110-
> ghe-443 ALLOW Anywhere
111-
> ghe-80 ALLOW Anywhere
112-
> ghe-8080 ALLOW Anywhere
113-
> ghe-8443 ALLOW Anywhere
114-
> ghe-9418 ALLOW Anywhere
115-
> ghe-1194 (v6) ALLOW Anywhere (v6)
116-
> ghe-122 (v6) ALLOW Anywhere (v6)
117-
> ghe-161 (v6) ALLOW Anywhere (v6)
118-
> ghe-22 (v6) ALLOW Anywhere (v6)
119-
> ghe-25 (v6) ALLOW Anywhere (v6)
120-
> ghe-443 (v6) ALLOW Anywhere (v6)
121-
> ghe-80 (v6) ALLOW Anywhere (v6)
122-
> ghe-8080 (v6) ALLOW Anywhere (v6)
123-
> ghe-8443 (v6) ALLOW Anywhere (v6)
124-
> ghe-9418 (v6) ALLOW Anywhere (v6)
125-
```
100+
```shell
101+
$ sudo ufw status
102+
> Status: active
103+
> To Action From
104+
> -- ------ ----
105+
> ghe-1194 ALLOW Anywhere
106+
> ghe-122 ALLOW Anywhere
107+
> ghe-161 ALLOW Anywhere
108+
> ghe-22 ALLOW Anywhere
109+
> ghe-25 ALLOW Anywhere
110+
> ghe-443 ALLOW Anywhere
111+
> ghe-80 ALLOW Anywhere
112+
> ghe-8080 ALLOW Anywhere
113+
> ghe-8443 ALLOW Anywhere
114+
> ghe-9418 ALLOW Anywhere
115+
> ghe-1194 (v6) ALLOW Anywhere (v6)
116+
> ghe-122 (v6) ALLOW Anywhere (v6)
117+
> ghe-161 (v6) ALLOW Anywhere (v6)
118+
> ghe-22 (v6) ALLOW Anywhere (v6)
119+
> ghe-25 (v6) ALLOW Anywhere (v6)
120+
> ghe-443 (v6) ALLOW Anywhere (v6)
121+
> ghe-80 (v6) ALLOW Anywhere (v6)
122+
> ghe-8080 (v6) ALLOW Anywhere (v6)
123+
> ghe-8443 (v6) ALLOW Anywhere (v6)
124+
> ghe-9418 (v6) ALLOW Anywhere (v6)
125+
```

‎content/admin/configuration/configuring-your-enterprise/troubleshooting-tls-errors.md‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@ shortTitle: Troubleshoot TLS errors
2525
If you have a Linux machine with OpenSSL installed, you can remove your passphrase.
2626

2727
1. Rename your original key file.
28-
```shell
29-
$ mv yourdomain.key yourdomain.key.orig
30-
```
28+
```shell
29+
$ mv yourdomain.key yourdomain.key.orig
30+
```
3131
2. Generate a new key without a passphrase.
32-
```shell
33-
$ openssl rsa -in yourdomain.key.orig -out yourdomain.key
34-
```
32+
```shell
33+
$ openssl rsa -in yourdomain.key.orig -out yourdomain.key
34+
```
3535

3636
You'll be prompted for the key's passphrase when you run this command.
3737

@@ -69,17 +69,17 @@ If your {% data variables.product.prodname_ghe_server %} appliance interacts wit
6969

7070
1. Obtain the CA's root certificate from your local certificate authority and ensure it is in PEM format.
7171
2. Copy the file to your {% data variables.product.prodname_ghe_server %} appliance over SSH as the "admin" user on port 122.
72-
```shell
73-
$ scp -P 122 rootCA.crt admin@HOSTNAME:/home/admin
74-
```
72+
```shell
73+
$ scp -P 122 rootCA.crt admin@HOSTNAME:/home/admin
74+
```
7575
3. Connect to the {% data variables.product.prodname_ghe_server %} administrative shell over SSH as the "admin" user on port 122.
76-
```shell
77-
$ ssh -p 122 admin@HOSTNAME
78-
```
76+
```shell
77+
$ ssh -p 122 admin@HOSTNAME
78+
```
7979
4. Import the certificate into the system-wide certificate store.
80-
```shell
81-
$ ghe-ssl-ca-certificate-install -c rootCA.crt
82-
```
80+
```shell
81+
$ ghe-ssl-ca-certificate-install -c rootCA.crt
82+
```
8383

8484
## Updating a TLS certificate
8585

‎content/admin/enterprise-management/configuring-clustering/monitoring-cluster-nodes.md‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -48,33 +48,33 @@ You can configure [Nagios](https://www.nagios.org/) to monitor {% data variables
4848

4949
### Configuring the Nagios host
5050
1. Generate an SSH key with a blank passphrase. Nagios uses this to authenticate to the {% data variables.product.prodname_ghe_server %} cluster.
51-
```shell
52-
nagiosuser@nagios:~$ ssh-keygen -t ed25519
53-
> Generating public/private ed25519 key pair.
54-
> Enter file in which to save the key (/home/nagiosuser/.ssh/id_ed25519):
55-
> Enter passphrase (empty for no passphrase): LEAVE BLANK BY PRESSING ENTER
56-
> Enter same passphrase again: PRESS ENTER AGAIN
57-
> Your identification has been saved in /home/nagiosuser/.ssh/id_ed25519.
58-
> Your public key has been saved in /home/nagiosuser/.ssh/id_ed25519.pub.
59-
```
60-
{% danger %}
61-
62-
**Security Warning:** An SSH key without a passphrase can pose a security risk if authorized for full access to a host. Limit this key's authorization to a single read-only command.
63-
64-
{% enddanger %}
65-
{% note %}
66-
67-
**Note:** If you're using a distribution of Linux that doesn't support the Ed25519 algorithm, use the command:
68-
```shell
69-
nagiosuser@nagios:~$ ssh-keygen -t rsa -b 4096
70-
```
71-
72-
{% endnote %}
51+
```shell
52+
nagiosuser@nagios:~$ ssh-keygen -t ed25519
53+
> Generating public/private ed25519 key pair.
54+
> Enter file in which to save the key (/home/nagiosuser/.ssh/id_ed25519):
55+
> Enter passphrase (empty for no passphrase): LEAVE BLANK BY PRESSING ENTER
56+
> Enter same passphrase again: PRESS ENTER AGAIN
57+
> Your identification has been saved in /home/nagiosuser/.ssh/id_ed25519.
58+
> Your public key has been saved in /home/nagiosuser/.ssh/id_ed25519.pub.
59+
```
60+
{% danger %}
61+
62+
**Security Warning:** An SSH key without a passphrase can pose a security risk if authorized for full access to a host. Limit this key's authorization to a single read-only command.
63+
64+
{% enddanger %}
65+
{% note %}
66+
67+
**Note:** If you're using a distribution of Linux that doesn't support the Ed25519 algorithm, use the command:
68+
```shell
69+
nagiosuser@nagios:~$ ssh-keygen -t rsa -b 4096
70+
```
71+
72+
{% endnote %}
7373
2. Copy the private key (`id_ed25519`) to the `nagios` home folder and set the appropriate ownership.
74-
```shell
75-
nagiosuser@nagios:~$ sudo cp .ssh/id_ed25519 /var/lib/nagios/.ssh/
76-
nagiosuser@nagios:~$ sudo chown nagios:nagios /var/lib/nagios/.ssh/id_ed25519
77-
```
74+
```shell
75+
nagiosuser@nagios:~$ sudo cp .ssh/id_ed25519 /var/lib/nagios/.ssh/
76+
nagiosuser@nagios:~$ sudo chown nagios:nagios /var/lib/nagios/.ssh/id_ed25519
77+
```
7878

7979
3. To authorize the public key to run *only* the `ghe-cluster-status -n` command, use a `command=` prefix in the `/data/user/common/authorized_keys` file. From the administrative shell on any node, modify this file to add the public key generated in step 1. For example: `command="/usr/local/bin/ghe-cluster-status -n" ssh-ed25519 AAAA....`
8080

@@ -88,39 +88,39 @@ You can configure [Nagios](https://www.nagios.org/) to monitor {% data variables
8888
```
8989

9090
5. To test that the Nagios plugin can successfully execute the command, run it interactively from Nagios host.
91-
```shell
92-
nagiosuser@nagios:~$ /usr/lib/nagios/plugins/check_by_ssh -l admin -p 122 -H HOSTNAME -C "ghe-cluster-status -n" -t 30
93-
> OK - No errors detected
94-
```
91+
```shell
92+
nagiosuser@nagios:~$ /usr/lib/nagios/plugins/check_by_ssh -l admin -p 122 -H HOSTNAME -C "ghe-cluster-status -n" -t 30
93+
> OK - No errors detected
94+
```
9595

9696
6. Create a command definition in your Nagios configuration.
9797

98-
**Example definition**
98+
**Example definition**
9999

100-
```
101-
define command {
100+
```
101+
define command {
102102
command_name check_ssh_ghe_cluster
103103
command_line $USER1$/check_by_ssh -H $HOSTADDRESS$ -C "ghe-cluster-status -n" -l admin -p 122 -t 30
104-
}
105-
```
104+
}
105+
```
106106
7. Add this command to a service definition for a node in the {% data variables.product.prodname_ghe_server %} cluster.
107107

108-
**Example definition**
108+
**Example definition**
109109

110-
```
111-
define host{
110+
```
111+
define host{
112112
use generic-host
113113
host_name ghe-data-node-0
114114
alias ghe-data-node-0
115115
address 10.11.17.180
116116
}
117117
118-
define service{
118+
define service{
119119
use generic-service
120120
host_name ghe-data-node-0
121121
service_description GitHub Cluster Status
122122
check_command check_ssh_ghe_cluster
123123
}
124-
```
124+
```
125125

126126
After you add the definition to Nagios, the service check executes according to your configuration. You should be able to see the newly configured service in the Nagios web interface.

0 commit comments

Comments
 (0)