# EX-200 - Red Hat Certified System Administrator # Setup home vms 192.168.50.164 192.168.50.105 work vms 192.168.17.185 192.168.17.208 Hyper V Disable secureboot Proxmox (host) (wget command from red hat site) > download > f12 > network > copy cURL > trim it curl -L \\ -H "Cookie: rh\_user\_id=59291558; rh\_sso\_session=1" \\ -o /var/lib/vz/template/iso/rhel-9.8-x86\_64-dvd.iso \\ "[https://access.cdn.redhat.com/content/origin/files/sha256/c0/c0dd53b73406b85b40d6168d1748e605d71361b2992d282c408b7d7d2e1d2c80/rhel-9.8-x86\_64-dvd.iso?\_auth\_=1782441220\_ea8eb57265125e48f98b84775988df3d](https://access.cdn.redhat.com/content/origin/files/sha256/c0/c0dd53b73406b85b40d6168d1748e605d71361b2992d282c408b7d7d2e1d2c80/rhel-9.8-x86_64-dvd.iso?_auth_=1782441220_ea8eb57265125e48f98b84775988df3d)"
- 64gb disk - 2048mb memory - 1 socket 2 cores cpu - Disable screen timeout
RHC Connect (needed package commands) rhc connect username: nicksotelo95 password: RHELsolomon5!! Set Hostname
hostnamectl set-hostname <hostname> set hostname
Set Time Zone
timedatectl show timedate info
timedatectl list-timezones list all timezones
timedatectl set-timezone Australia/Sydney set timezone to Sydney
timedatectl set-ntp true
chronyd service used for time synchronisation
/etc/chronyd.conf config file
/var/log/chrony log file
systemctl start/restart chronyd start/restart chronyd service
chronyc program command
rpm -qa | grep chrony verify it is installed
ps -ef | grep chrony verify it is running
yum install chrony if it is not installed
Subscription Manager Repositories
sudo dnf repolist check which repositories are installed
subscription-manager repos --enable codeready-builder-for-rhel-10-x86\_64-rpms enable codeready linux builder repository
dnf install [https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm](https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm) [install EPEL](https://www.redhat.com/en/blog/install-epel-linux)
sudo dnf install --nogpgcheck [https://mirrors.rpmfusion.org/free/el/rpmfusion-free-release-$(rpm](https://mirrors.rpmfusion.org/free/el/rpmfusion-free-release-%24(rpm) -E %rhel).noarch.rpm [https://mirrors.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-$(rpm](https://mirrors.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-%24(rpm) -E %rhel).noarch.rpm [install rpmfusion](https://rpmfusion.org/Configuration)
Remote access without password (SSH keys)
- Needed for repetitive logins or automation via scripts - Keys are generated at the user level (nsotelo, root) - Install Git Bash for ssh-copy-id to work - Powershell will then connect without password
ssh-keygen generate the key
ssh-copy-id root@192.168.1.X copy the key to the host
ssh root @192.168.1.X login to remote host
ssh -1 root 192.168.1.X
# File Management
Linux Filesystems: ext3 ext4 xfs Windows Filesystems: NTFS FAT
Basic Commands
pwd print working directory
cd home directory (/home/username) or /root
~
/ root directory (absolute)
~ user directory (/home/username)
. current directory (relative)
.. parent directory (relative)
ls show directory contents
ls -l show directory contents (list view)
ls -ltriah show directory contents (list view) -l long -t time sorted (-S for size sorted) -r reverse -i inode -a show hidden files -h human readable file sizes
Type \# of Links User Owner Group Owner Size Month Day Time Namedrwxr-xr-x
drwxr-xr-x 21 root root 4096 Feb 27 13:33 var
lrwxrwxrwx 1 root root 7 Feb 27 13:15 bin
-rw-r--r-- 1 root root 0 Mar 2 11:15 testfile
d directory
l link
- - file
Creating Files and Directories
touch filename create file
rm filename remove file
cp filename newfilename copy file and name it
cp filename /tmp copy file to /tmp
mv filename newfilename renames the file
mv filename /tmp move file to /tmp
mkdir dirname create directory
rmdir dirname remove directory
rm -r dirname remove directory
chgrp groupowner filename change the group owner of a file
chown userowner filename change the user owner of a file
chown userowner:groupowner filename change the user and group owner of a file
echo "text" > filename insert the text into the file
cat filename display the text inside a file
rm -rf remove directory (recursive) (force)
Searching Files and Directories
nsotelo@rhel-pc:~$ find / -name "\*ksh\*.rpm" 2> /dev/null search file or directory names for items containing name ksh and ending with .rpm stderr to /dev/null
grep -ri error /var/log/ 2> /dev/null | wc -l search file contents for key words -c count -r recursive -i ignore case sensitive -n display matched lines and their line numbers -v all except specified wc -l word count lines only
egrep -i "keyword|keyword2" /var/log search file contents for two key words
find /etc -name "\*.conf\*" | xargs grep "localhost" combination of above commands (output of find translated and input to grep
Soft and Hard Links
- inode - pointer of number of a file on the disk - soft link - link will be removed if the file is removed or renamed - hard link - deleting, renaming or moving the original file will not affect the hard link
ln /location/file creates a hard link to a file
ln -s /location/file creates a soft link to a file
Soft Link Example (Hard link may return an error has both directories must be on the same partition) touch hulk cd /tmp /tmp $ ln -s /home/nsotelo/hulk Input and Output Redirects (3 Redirects)
standard input (stdin) with file descriptor 0 ls >> listings appends the output of ls to listings file
standard output (stdout) with file descriptor 1 cat < listings feeds file contents to a file
standard output (stdout) with file descriptor 1 mail -s "office memo" allusers@abc.com < memoletter feeds file contents to a file
standard error (stderr) with file descriptor 2 ls -l /root 2> errorfile outputs the error message to errorfile
Pipes Connects the output of one command directly to the input of another command ls -ltr | more ll | tail -l # File Editor Text Editors
ed (1969) original, line oriented standard for Unix
ex (1976) extended, more powerful version of ed, introduced visual mode for full screen editing
vi (1976) classic, efficient, visual full-screen editor built on top of ex
emacs (1976) extensible, feature-rich ecosystem known for customisation
pico (1992) simple, menu-driven, for non-technical users
vim (1991) improved and advanced version of vi, with modern features
nano (1999) free open source clone of pico
echo 'export EDITOR=nano' >> ~/.bashrc set nano as default text editor
vi commands
mode command function
esc up down left right move around
esc shift g move to end
esc i insert
insert a move right (and insert)
insert o line break (and insert)
insert esc escape current mode
esc x remove character
esc r replace character
esc d delete line
esc u bring line back
esc :q! quit
esc :wq! save and quit
nano commands
ctrl o save current file (write out)
ctrl s save current file (newer versions)
ctrl x exit
ctrl w search for specific text
ctrl \\ find and replace
ctrl k cut line
ctrl u paste line
alt 6 copy line
alt n toggle line numbers
alt u undo
alt e re-do
# Shell Scripting Basic Commands
echo $0 display current shell
cat /etc/shells display available shells
cat /etc/passwd shows user's shell e.g. /bin/bash)
chmod a+x scriptname allow execute permission for all
./script.bash execute from current location
/home/userdir/script.bash execute from absolute location
Script Components
\#!/bin/bash Shell
\# This script does X Comment
echo/cp/grep Command
if/while/for Statement
Basic Scripts nano output-screen
\#!/bin/bash \# made by Nicolas Sotelo whoami echo pwd echo hostname echo ls -ltr echo shell comment command space
Variables nano variable-command
\#!/bin/bash a=Nicolas b=Sotelo c="Linux Class" echo "My first name is $a" echo "My surname is $b" echo "My class is $c" set variable echo variable
Input / Output
\#!/bin/bash echo Hello, my name is Nicolas Sotelo echo echo What is your name? read namevar echo echo Hello $namevar echo read sets variable to the user's input echo variable
\#!/bin/bash hnvar=`hostname` echo Hello, my hostname is $hnvar echo echo What is your name? read namevar echo echo Hello $namevar echo set variable as a `command` echo the output
If-then scripts
\#!/bin/bash count=100 if \[ $count -eq 100 \] then echo Count is 100 else echo Count is not 100 fi end if statement
\#!/bin/bash clear if \[ -e /home/nsotelo/error.txt \] then echo "File exists" else echo "File does not exist" fi
\#!/bin/bash clear echo echo "What is your name?" echo read namevar echo echo Hello $namevar sir echo echo "Do you like working in IT? (y/n)" read Like echo if \[ "$Like" == "y" \] then echo "You are cool" elif \[ "$Like" == "n" \] then echo "You should try IT, it's a good field" echo fi
For Loops
- Runs repeatedly until specified number of variables is met
\#!/bin/bash for numv in 1 2 3 4 5 do echo "Welcome $numv times" done assign 1 2 3 4 5 to numv repeatedly display for each of the specified variables
\#!/bin/bash for actionv in eat run jump play do echo "See Nick $actionv" done assign eat run jump play to actionv repeatedly display for each of the specified variables
\#!/bin/bash for filev in {1..5} do touch $filev done for loop to create 5 files named 1-5
\#!/bin/bash for filev in {1..5} do rm $filev done for loop to delete 5 files named 1-5
\#!/bin/bash i=1 for day in Mon Tue Wed Thu Fri do echo "Weekday $((i++)): $day" done specify days in for loop
\#!/bin/bash a=1 for username in `awk -F: '{print $1}' /etc/passwd` do echo "Username $((a++)) : $username" done list all users one by one from /etc/passwd file
# Scheduled Tasks Scheduled Tasks
crontab -e scheduled jobs -e edit
at. scheduled one-off jobs
\* \* \* \* \* minute (0-59), hour (0-23), day (1-31), month (1-12), week day (0-6)
0 \* \* \* \* /home/user/script run every hour (at minute 0)
0 0 \* \* \* /home/user/script run every day (at midnight)
30 4 \* \* 1 /home/user/script run every Monday at 4:30 AM
# Access Control File Permissions
- Files that are not scripts do not have x - Directories have x because users can cd into them
d r w x r w x r w x
file type user read user write user execute group read group write group execute others read others write others execute
Numerical Permissions
- 7 = rwx - 6 = rw - 5 = rx - 4 = r - 2 = w - 1 = x - 0 = -
Owner of parent directory can still delete a file or subdirectory
chmod u+rw filename user owner add rw
chomd g-w filename group owner remove w
chmod o+r filename others owner add r
chmod a-r filename all owners remove r
chmod 755 filename set to rwxr-xr-x
chmod 644 filename set to rw-r--r--
chmod 777 filename set to rwxrwxrwx
chown root filename change user owner to root
chgrp root filename change group owner to root
Access Control Lists (ACLs) ACLs are used to grant rwx to a specific user, separate from the file owners
- As you assign ACL to a file/directory it adds + to the permissions - w permission does not include delete (owner only)
getfacl get file acl
setfacl -m u:user:rwx filename add permissions for user
setfacl -m g:group:rw filename add permissions for group
setfacl -rm u:user:rwx dirname add permissions for directory -r recursive
setfacl -x u:user filename remove entry for user
setfacl -b filename remove all entries
# SELinux [![image.png](http://192.168.50.66/uploads/images/gallery/2026-07/scaled-1680-/image.png)](http://192.168.50.66/uploads/images/gallery/2026-07/image.png) # User Management
useradd username create a user
groupadd groupname create a group
userdel username delete user
groupdel groupname delete group
usermod username modify user
Important files /etc/passwd /etc/group /etc/shadow Examples useradd -g superheros -s /bin/bash -c "User Description" -m -d /home/spiderman spiderman (Creates spiderman in group superheros) usermod -G superheros spiderman (adds spiderman to superheros group) chgrp -R superheros spiderman (change the group owner of user to superheros)
cat /etc/passwd display users, passwords (x=encrypted), UserID, GroupID, etc.
defaults file located in /etc/login.defs Example: chage -m 5 -M 90 -W 10 -I 3 -E 20656 babubutt
-d (lastchanged) days since 01/01/1970 that password was last changed
-m minimum number of days between password changes
-M maximum number of days before user must change password
-W number of days before password is to expire before user is warned
-I number of days after password expires that account is disabled
-E days since 01/01/1970 that account is disabled (account end date)
grep babu /etc/shadow babubutt:!:20626:5:90:10:3:20656: Switching users and sudo access
su - switch to root
su - username switch user
sudo perform action as super user
visudo
Add user to sudoers
su - switch to root
usermod -aG wheel nsotelo adds nsotelo to wheel group
grep wheel /etc/group verify
su - nsotelo switch back to nsotelo
sudo fdisk -l run sudo command to confirm access
# Processes & Services Basic Definitions
- Application - Script - Process - Daemon - Thread - Job
Monitoring and Management
command example function
fdisk fdisk -l disk partitioner -l list disks
df df -h filesystem capacity
du du -sh /var/log size of each item in directory
uptime uptime -p shows urrent time, uptime and load usage % past 1, 5, 15 minutes
top top -h display linux processes (human readable)
free free -h display amount of free and used system memory (human readable)
lsof lsof -I :80 list open files (using port 80)
tcpdump tcpdump -i eth0 capture packets flowing through interface eth0
ps ps -ef --forest current processes snapshot (tree diagram)
kill kill 34448 terminates a process (PID)
top
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
top columns
PID id
USER owner
PR focus priority
NI the nice value
VIRT amount of virtual memory in use
RES amount of resident memory in use
SHR amount of shared memory in use
S status of the process
%CPU share of CPU time since last update
%MEM share of physical memory in use
TIME+ total cpu time used (hundredths of a second)
COMMAND name of the command or process
Services & Daemons
systemctl --version Check if systemd is installed
ps -ef | grep system check if systemd is running
systemctl --all check all running services
systemctl status/stop/start/restart application.service status/start/stop/restart application.service
systemctl reload application.service reload the config of a service
systemctl enable/disable application.service enable or disable at boot
systemctl mask/unmask application.service enable or disable completely (ignore dependencies)
Logs
/var/log log directory
Log Examples
- boot (overwrites upon boot) - chonyd / ntp - cron - maillog - secure - messages - httpd
Technical Support and Analyse Server
sos report collect logs and configuration file then transfer to Redhat support server enter case ID compressed archive saved to /var/tmp/sosreport-hostname-caseid-yyyy-mm-dd-filename.tar.xz
cockpit web based server administration tool sponsored by Red Hat can monitor system resources, add/remove accounts, shutdown system and perform other tasks also available centos redhat ubuntu fedora
ping [www.google.com](http://www.google.com) verify internet connectivity
rpm -qa | grep cockpit verify cockpit package is installed
yum/dnf install cockpit -y install cockpit (Red Hat, CentOS)
apt-get install cockpit install cockpit (Debian, Ubuntu)
systemctl start/enable cockpit.socket relies on socket activation to start enable socket listener which watches port 9090 and wakes Cockpit up when someone tries to connect
systemctl status cockpit verify
systemctl status cockpit.socket verify
[https://192.168.50.164:9090](https://192.168.50.164:9090) firewall may need to be disabled (safe for labs) or rule created access the web-interface log in with root or system user can be used to manage everything including terminal access
# System Performance Tuned - dynamic system duning daemon
rpm -qa | grep tuned check if tuned package is installed
yum install tuned install tuned
systemctl status/enable/disable tuned check tuned status
tuned --version check tuned version
tuned-adm change setting for tuned daemon
tuned-adm active check which profile is active
tuned-adm list list available profiles
tuned-adm profile profile-name change profile
tuned-adm recommend recommended profile
tuned-adm off turn off tuned daemon
[https://192.168.X.X:9090](https://192.168.X.X:9090) change via web console (check firewall)
nice and renice
- Prioritise CPU tasks - Range from -20 (highest priority) to 19 (lowest priority), 0 = default - System priorities range 0-139, (0-99 real time), (100-139 users)
top check active process priority PR = System priority (-99 to 39) NI = nice value (-20 to 19)
ps axo pid,comm,nice,cls --sort=-nice show active processes nice, by nice
nice -n # process-name set process value
nice -n -12 top set top nice to -12
renice -n -15 <PID> change active PID nice to -15 (open 2nd terminal to check)
# Networking Basic Commands
ip a Display network inerfaces and details
ip addr
ifconfig
hostnamectl set-hostname <hostname> set hostname
NetworkManager
systemctl status NetworkManager NetworkManager status
ps -ef | grep NetworkManager verify the process is running
Network Configuration Methods
nmcli network manager cli (non gui) can be used in scripts
nmtui text user interface
nm-connection-editor full gui (via desktop/console)
GNOME Settings
Creating a New Connection Profile nmcli con add type ethernet ifname enp0s3 con-name myprofile1 Use nmcli to set a static ip address
nmcli connection connected interface UUIDs
nmcli device connected interface status
nmcli connection modify eth0 ipv4.addresses 192.168.50.X/24 set static ip address & subnet mask
nmcli connection modify eth0 ipp4.gateway 192.168.50.1 set gateway
nmcli connection modify eth0 ipv4.method manual configure eth0 to use static IP
nmcli connection modify eth0 ipv4.dns 8.8.8.8 set dns to google.com
nmcli connection down eth0 && nmcli connection up eth0 restart nmcli connection
ip address show eth0
Use nmcli to configure a secondary static ip address
nmcli device status
nmcli connection show --active
ifconfig
nmcli connection modify eth0 +ipv4.addresses 192.168.50.X/24 set secondary static ip address & subnet mask
nmcli connection reload
systemctl reboot
ip address show
nmtui (as root), nm-connection-editor or GNOME settings can also be used to activate a connection or change hostname Network Files and Basic Commands
/etc/sysconfig/network-scripts
/etc/hosts
/etc/hostname
/etc/resolv.conf DNS
/etc/nsswitch.conf Set to use Files or DNS first (per command/request)
ping verify network connectivity to a host
ifconfig Display network interfaces and IP addresses
ip addr
ip a
ifup brings up a specific network interface
ifdown takes down a specific network interface
traceroute track and display path (router/hops) that packets take to reach a destination host
tcpdump -i eth0 capture and monitor live network traffic flowing through eth0
nslookup queries DNS servers to find ip adddress of a domain or vice versa
dig
ethtool eth0 display and modify physical hardware settings of eth0 such as link speed & duplex
# Network Firewall Software Firewall (Runs on operating system) Hardware Firewall (Dedicated network appliance) Modern Linux uses firewalld as front-end & nftables under the hood
- organises rules by "zones" (like public, home, work) - exposes "services" (ssh, http, samba, nfs, etc.)
- temporary changes are active immediately but vanish on reload - permanent changes are written to disk and take effect after reload
- unspecified zone will be applied to the default (public) zone - services not on --list-all can be enabled by opening specific ports
Examples
- allow SSH from jump hosts - open http/https on a web server - open NFS only to specific subnets
Exam
- start/enable firewall, list zones, see active zone - add/remove a service, open/close a port, make changes permanent - reload, create, or use a custom XML service file - basic rich rules for blocking a specific source IP - temporary vs permanent
Basic Commands
dnf install firewalld install firewalld
systemctl enable --now firewalld enable now
systemctl status firewalld details & uptime
firewall-cmd --state status
firewall-cmd --get-active-zones
firewall-cmd --get-zones list predefined zone profiles - public - locked down default - home/work - more relaxed (known networks) - trusted - allow all - dmz/external - edge scenarios
firewall-cmd --list-all shows all zones, rules, services, etc. (only a few enabled by default)
firewall-cmd --get-services list of all services that can be allowed
firewall-cmd --reload write permanent and custom rules to memory
Adding and Removing Temporary and Permanent Rules
firewall-cmd --add-service=http add http (temporary)
firewall-cmd --permenent --add-service=http add http (permanent)
firewall-cmd --remove-service=http remove http (temporary)
firewall-cmd --permanent --remove-service=http remove http (permanent)
firewall-cmd --add-port=1110/tcp add TCP 1110 (temporary)
firewall-cmd --permanent --add-port=1110/tcp add TCP 1110 (permanent)
firewall-cmd --remove-port=1110/tcp remove TCP 1110 (temporary)
firewall-cmd --permanent --remove-port=1110/tcp remove TCP 1110 (permanent)
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.25" reject' block incoming packets from specific IP
firewall-cmd --remove-rich-rule='rule family="ipv4" source address="192.168.0.25" reject' remove
firewall-cmd --add-icmp-block=echo-request block icmp (ping) requests
firewall-cmd --remove-icmp-block=echo-request remove
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP block outgoing packets to IP (priority)
firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP remove
nano /etc/firewalld/services/sap.xml xml version="1.0" encoding="utf-8" <service version=1.0"> <short>SAP</short> <description>Third-party application service</description> <port protocol="tcp" port="3200"/> </service> add a custom service definition for SAP xml header for firewalld
firewall-cmd --get-services | grep -i sap verify
firewall-cmd --add-service=sap add the custom rule (temporary)
firewall-cmd --permanent --add-service=sap add the custom rule (permanent)
dnf install -y httpd install apache web service
systemctl enable --now httpd
curl -I [http://localhost](http://localhost) verify (403 Forbidden)
curl -I [http://192.168.50.164/](http://192.168.50.164/) verify (403 Forbidden)
# Archive & FTP Archive and Compress Files
tar cvf nsotelo.tar /home/nsotelo archive all folders in /home/nsotelo
mkdir new create a directory 'new'
mv nsotelo.tar new move archive to 'new'
cd new change to 'new' directory
gzip nsotelo.tar compress nsotelo.tar
gzip -d nsotelo.tar.gz uncompress nsotelo.tar.gz
tar xvf nsotelo.tar extract archive
File Transfer Protocol remote host:
rpm -qa | grep ftp check if the required package is installed
ping [www.google.com](http://www.google.com) verify internet connection
yum install vsftpd install the remote package
nano /etc/vsftpd disable anonymous login uncomment ascii\_upload\_enable=YES uncomment ascii\_download\_enable=YES ftpd\_banner=Welcome to blah FTP sevice add to the end of the file "use\_localtime=YES" save & exit
systemctl start vsftpd
systemctl enable vsftpd
systemctl stop firewalld
systemctl disable firewalld
client host:
yum install ftp install the client package
ftp 192.168.50.105 log in to the remote host via ftp enter username and password of an active remote host account
bi switch to binary mode (data integrity)
hash display progress visually
put filename transfer a file
bye exit ftp
Secure Copy Protocol (Better security and authentication)
- Uses Port 22 (same as SSH)
client host:
touch filename create a file
scp filename jsmith@192.168.50.105:/home/jsmith securely copy the file to /home/jsmith on remote host enter jsmith password
# Software & Packages RHC Connect (needed for package commands)
rhc connect -u username -p password connects to red hat subscription manager
username: nicksotelo95 password: RHELsolomon5!! Packages are Collections of Files
- RPM = Red Hat Package Manager tool - CentOS & RHEL packages are in .rpm format
dnf install CentOS & RHEL packages (formerly yum)
dnf install chrony -y install time sync manager (yes to prompts)
dnf install httpd -y install apache web server
rpm -qa | wc -l count how many packages are installed -q query -a all wc word count -l lines
dnf install bind installs Berkeley Internet Name Domain package
cat /etc/redhat-release check RHEL version
dnf update -y update all packages to latest version
dnf install ksh -y install kornshell package
dnf remove ksh -y remove kornshell package
Manual Package Installations
wget <download link address> rpmfind.net
find / -name \*ksh\*.rpm 2>/dev/null verifies downloaded package
rpm -ihv ksh\*.rpm KSH… package -i install -h progress bar -v verbose
wget <download link for chkconfig depdency>
rpm -ihv chkconfig\*.rpm install depdedency first
rpm -qa | grep ksh verify installation -q query -a all
rpm -qi ksh more info on the package
rpm -e ksh remove it manually
Offline Package Installation
- Building a local repository from an iso - [https://mirror.stream.centos.org/9-stream/BaseOS/x86\_64/iso/](https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/iso/)
wget -O ~/iso-downloads/centos-9.iso <.iso url> download the iso to ~/iso-downloads and name it centos-9.iso
mkdir -p /mnt/rhel-dvd create the mount folder -p create parent if required, suppress errors if already exists
mount -t iso9660 -o loop,ro ~/iso-downloads/centos-9.iso /mnt/rhel-dvd mount centos-9.iso as /mnt/rhel-dvd -t (optional) iso9660 type = standard format for optical disks -o loop - option to treat the iso as a physical block device ro read only
df -h verify mounted disk file system -h human readable
mkdir -p /localrepo create a directory for .rpm packages and metadata
cp -rv /mnt/rhel-dvd/BaseOS/Packages/\* /localrepo unpack iso BaseOS to localrepo -r recursive -v verbose
cp -rv /mnt/rhel-dvd/AppStream/\* /localrepo unpack iso AppStream to localrepo
dnf install createrepo\_c -y installs the createrepo\_c utility
createrepo /localrepo/ scan folder and build the necessary XML metadata in the repository so dnf/yum can index package names, versions & dependencies
cd /etc/yum.repos.d go to the location that dns reads .repo (config) files from
mkdir backup backup existing repo files for later
mv \*.repo backup move any existing repos to backup, disables default Red Hat online repositories ensures the system only uses local repositories
nano local.repo \[localrepo\] name=localrepo baseurl=file:///localrepo/ enabled=1 gpgcheck=0 metadata\_expire=-1 create a local .repo (config) file for local repositories repository header human readable name to show up in lists exact path to the files, [file:///](file:///) tells the system to look at a local directory /localrepo/ rather than http:// enabled the repository disable verification check for security signatures (GPG keys) on the packages Disable metadata expiry
dnf clean all delete cached repository metadata and package indexes (existing .repo's)
dnf repolist list all active software sources
dnf install httpd -y verifies the local repository can support package installations
# Containers Containers allows developers to test and build applications on any computer by putting it in a container bundled with software code, libraries, and config files Docker
- software used to create and manage containers - can be installed on Linux - daemon can be controlled natively - not supported in RHEL 8
Podman
- developed by Red Hat 2018 as an alternative to docker - daemon less, open source, linux native tool to develop, manage and run containers
Red Hat provides a set of CLI tools
- podman - directly managing pods and container images (run, stop, start, ps attach, etc) - buildah - for building, pushing, and signing container images - skopeo - copying, inspecting, deleting, signing images - runc - providing container run and build features to podman and buildah - crun - optional runtime that can be configured and give greater flexibility, control & security for rootless containers
- images - containers can be created through images and containers can be converted to images - pods - groups of containers deployed together on the host
Basic Commands
dnf install podman -y install podman
alias docker=podman used when switching from docker to podman
podman -v check podman version
podman info check podman environment (see registries) if loading an image, looks locally, then to registries by order listed
Image --> Run Container --> Remove it
podman search httpd search container registries for an image
podman pull docker.io/library/httpd download image from a registry
podman images list downloaded images
podman run -d --name web1 -p 8080:80 docker.io/library/httpd create & start a container from an image
podman ps list running containers
curl localhost:8080 (or web) [http://localhost:8080](http://localhost:8080) verify application is accessible
podman stop web1 stop a container gracefully
podman rm -f web1 remove a container
Image --> Create Container --> Start Container
podman pull docker.io/library/httpd download image from a registry
podman create --name web2 -p 8081:80 docker.io/library/httpd create a container
podman ps -a verify status is created -a all containers
podman start web2 start an existing container
podman ps verify container status is running
curl localhost:8081 (or web) [http://localhost:8081](http://localhost:8081) verify application is accessible
podman logs web2 view output generated by container
Quadlet (Modern RHEL10) systemd container management
mkdir -p /etc/containers/systemd create directory for quadlet definitions
nano /etc/containers/systemd/web3.container … \[Unit\] Description=Apache Web Container \[Container\] Image=docker.io/library/httpd ContainerName=web3 PublishPort=8082:80 \[Service\] Restart=always \[Install\] WantedBy=multi-user.target create quadlet container definition file define systemd metadata description define container-specific settings specifies container image assigns name maps host port to container port defines systemd behaviour automatically restart container if it stops definte boot settings allow service to start automatically during boot
systemctl daemon-reload reload systemd configuration
systemctl enable --now web3.service enable service at boot and start now
systemctl status web3.service verify service status
podman ps verify container status is running
curl localhost:8082 (or web) [http://localhost:8082](http://localhost:8082) verify application is accessible
# Storage & LVM Types of Storage
- Local Storage - SAN (Storage Area Network) - NAS (Network Attached Storage)
Basic Commands
fdisk -l disk partition utility (displays disk system names) -l list disks
lsblk -f list block devices (displays UUID) -f forest (tree) hierarchy
df -h filesystem capacity (displays mounted disks) -h human readable
Add a New Disk
insert a new 2GB disk
fdisk /dev/sdb enter fdisk utility for the new disk
n new partition
enter (default) new standalone disk
enter (default) first sector 2048 last sector 67108863 (whole disk = 1 partition)
enter (default)
w write (apply)
mkfs.xfs /dev/sdb1 create xfs filesystem for the disk
mkdir /data create directory to mount the disk to
lsblk -f retrieve UUID
mount /dev/sdb1 /data mount the disk to the directory
nano /etc/fstab add the below line to mount during boot (spaces = tab) /dev/sdb1 /data xfs defaults 0 0 UUID=4461ddd4-6c2c-4078-ab90-d4514368dd09 /data xfs defaults 0 0
reboot verify successful boot
umount /data to unmount
mount -a mount disks again according to /etc/fstab
LVM (Logical Volume Management)
- Allows disks to be combined together via software - Volume groups can be extended by adding additional disks
Physical Volume Volume Group Logical Volume Mounted On
Disk 1 rootvg system /
home /home
swap
Disk 2 datavg data1 /data1
Disk 3 data2 /data2
Disk 4 data3 /data3
data4 /data4
Add Disk and Create LVM Partition
File system datafs
Logical Volume(s) datalv
Volume Group datavg
Physical Volume /dev/sda1 /dev/sdb1 /dev/sdc1
Partitions /dev/sda1 /dev/sdb1 /dev/sdc1
Hard Disks /dev/sda /dev/sdb /dev/sdc
Basic Commands
pvdisplay display phsyical volumes
pvs summary physical volumes
vgdisplay display volume groups
vgs summary volume groups
lvdisplay display logical volumes
lvs summary logical volumes
Creating this Structure
insert a new 1GB disk
fdisk /dev/sdc enter fdisk utility for the new disk
n new partition
enter (default) new standalone disk
enter (default) first sector 2048 last sector 67108863 (whole disk = 1 partition)
enter (default)
p show partitions
t change partition type
L show LVM hex codes
8e Linux LVM
w write (apply)
pvcreate /dev/sdc1 create physical volume
vgcreate vg\_app /dev/sdc1 create volume group
lvcreate -n lv\_app --size 1020M vg\_app create logical volume (allowing overhead)
mkfs.xfs /dev/vg\_app/lv\_app create filesystem
blkid /dec/vg\_app/lv\_app retrieve UUID
mkdir app create directory
mount /dev/vg\_app/lv\_app /app mount
nano /etc/fstab UUID=12345678-abcd-1234-efgh-123456789abc /app xfs defaults 0 0
Extending this Space (this can only be done with LVM)
insert a new 1GB disk
fdisk /dev/sdd enter fdisk utility for the new disk
n new partition
enter (default) new standalone disk
enter (default) first sector 2048 last sector 67108863 (whole disk = 1 partition)
enter (default)
p show partitions
t change partition type
8e Linux LVM
w write (apply)
pvcreate /dev/sdd1 create phsyical volume
vgextend vg\_app /dev/sdd1 extend vg\_app to new disk
lvextend -L+1020M /dev/mapper/vg\_app-lv\_app extend by 1020MB lv\_app
xfs\_growfs /dev/mapper/vg\_app-lv\_app extend filesystem for lv\_app
# Stratis Pools Stratis
- Red Hat 8 introduced Stratis volume management - Uses thin provisioning (starts with 546Mb) - Combines LVM and filesystems onto one system - Stratis automatically extends the filesystem if space is available
dnf install stratis-cli stratisd Install stratis and daemon
systemctl enable/start stratisd Enable and start the daemon
lsblk -f
stratis pool list
stratis filesystem list
Creating a Two-Disk Stratis Pool and Filesystem
insert two new 5GB disks
stratis pool create pool1 /dev/sde create stratis pool
stratis pool add-data pool1 /dev/sdf extend stratis pool to another disk
stratis filesystem create pool1 fs1 create stratis filesystem
mkdir /bigdata
mount /dev/stratis/pool1/fs1 /bigdata
stratis filesystem snapshot pool1 fs1 fs1-snap create a snapshot
nano /etc/fstab … UUID=a6dca899-feab-4663-8028-fe6ce748d268 /bigdata xfs defaults,x-systemd.requires=stratisd.service 0 0 tells fstab to not mount this filesystem unless the system starts stratisd daemon (UUID of the filesystem)
# Network File Shares Network file sharing (Linux to Linux)
- A client's mounted NFS export appears as a local directory
NFS - Exam Scenario
1. install nfs uitilities 2. enable the nfs server service 3. add a correct line to /etc/exports 4. apply it with exportfs -arv 5. allow the nfs service in the firewall 6. mount on the client 7. mount persistent in /etc/fstab with options like \_netdev & vers=4.2
NFS - Server 192.168.17.185
dnf install nfs-utils -y install nfs utilities
systemctl enable --now nfs-server start and enable nfs service
mkdir -p /srv/nfsshare create NFS share directory
chmod -R 0777 /srv/nfsshare open permissions (0777 for lab)
semanage fcontext -a -t public\_content\_rw\_t "/srv/nfsshare(/.\*)?" assign selinux context
restorecon -Rv /srv/nfsshare apply selinux context
ls -Zd /srv/nfsshare verify selinux context
nano /etc/exports … /srv/nfsshare 192.168.17.0/24(rw,sync,no\_root\_squash) export share to subnet with read-write access
exportfs -arv reload and verify exports
firewall-cmd --add-service=nfs --permanent allow nfs through firewall
firewall-cmd --add-serivce=rpc-bind --permanent NFSv4 alone works over port 2049, but showmount and legacy tools need rpc-bind and mountd ports
firewall-cmd --add-service=mountd --permanent
firewall-cmd --reload reload firewall rules
exportfs -v | grep /srv/nfsshare verify export configuration
NFS - Client 192.168.17.208
ip a confirm subnet
showmount -e 192.168.17.185 verify server is exporting
sudo dnf install nfs-utils -y install nfs utilities
sudo mkdir -p /mnt/nfsshare create nfs mount directory
sudo mount -t nfs -o vers=4.2 192.168.17.185:/srv/nfsshare /mnt/nfsshare mount nfs share
df -h | grep nfsshare verify
echo "Created from client" | sudo tee /mnt/nfsshare/client.txt >/dev/null test write access
sudo nano /etc/fstab … 192.168.17.185:/srv/nfsshare /mnt/nfsshare nfs \_netdev,vers=4.2,rw 0 0 persistent nfs mount entry
sudo systemctl daemon-reload reload systemd config
sudo mount -a test fstab config
reboot verify mount survives
Samba (Linux to Windows)
- Implements SMB/CIFS (windows file sharing) - Allows Linux to share a folder that Windows clients can map - Linux clients can connect using CIFS - Define a share in /etc/samba/smb.conf - With SELinux, you need to label the path you are sharing - Set proper file permissions and ACLs - Ensure SELinux is enforcing with right context on shared directories
Samba - Exam Scenario
1. install Samba 2. add a share block in smb.conf and verify wih testparm 3. label the directory using semanage fcontext and restorecon 4. allow the samba service through the firewall 5. start and enable the smb daemon 6. test with smbclient 7. mount using CIFS 8. make persistent in /etc/fstab
Samba - Server 192.168.17.185
dnf install -y samba policycoreutils-python-utils install samba server and selinux tools
mkdir -p /srv/sambashare create samba share directory
echo "This is a samba file" > /srv/sambashare/readme.txt create test file
chmod -R 0777 /srv/sambashare open permissions (0777 for lab)
nano /etc/samba/smb.conf … \[sambashare\] path = /srv/sambashare browsable = yes writable = yes guest ok = yes read only = no define samba share configuration
testparm -s validate samba config
semanage fcontext -a -t samba\_share\_t "/srv/sambashare(/.\*)?" assign selinux context
restorecon -Rv /srv/sambashare apply selinux context
ls -Zd /srv/sambashare verify selinux context
firewall-cmd --add-service=samba --permanent allow samba through firewall
firewall-cmd --reload reload firewall rules
systemctl enable --now smb start and enable samba service
systemctl status smb --no-pager verify status
Samba - Client 192.168.17.208
sudo dnf install -y samba-client cifs-utils install samba client tools
smbclient -L //192.168.17.185 -N list available samba shares
smbclient //192.168.17.185/sambashare -N connect to samba share
ls list files in share
get readme.txt download file from share
quit exit smbclient session
sudo mkdir -p /mnt/sambashare create mount directory
sudo mount -t cifs //192.168.17.185/sambashare /mnt/sambashare -o guest mount samba share
ls -l /mnt/sambashare verify share contents
echo "Client wrote this via Samba" | sudo tee /mnt/sambashare/client.txt >/dev/null create file on share
sudo nano /etc/fstab … //192.168.17.185/sambashare /mnt/sambashare cifs \_netdev,guest 0 0 configure persistent mount
sudo mount -a test fstab config
reboot verify mount survives
# Boot Modes & Recovery New Boot Process (CentOS/RHEL 7 and above):
- systemd manages boot sequence - backward compatible with SysV init scripts from previous versions
BIOS - Basic Input/Output System (firmware interface) POST - Power-On-Self-Test started
- MBR - Master Boot Record - information saved in first sector of hard disk that indicates where the GRUB2 is located so it can be loaded in RAM - GRUB2 - Grant Unified Boot Loader v2 - loads linux kernel
/boot/grub2/grub.cfg
- Kernel - Core of the operating system - loads required drivers from initrd.img starts first OS process
systemd
- Systemd = System Daemon (PID #1) then starts all required processes
read /etc/systemd/system/default.target to bring system to run level (7 run levels 0-6) How to Reboot / Shutdown
systemctl poweroff stops all services, unmounts file systems, powers off system
poweroff
systemctl reboot all of the above plus reboot
reboot
Select systemd target
- 0-6 run levels now referred to as targets - important targets: - graphical.target - system supports multiple users, graphical and text based logins - multi-user.target - system supports multiple users, text based logins only - rescue.target - sulogin prompt, basic system initialisation completed - emergency.target - sulogin prompt, initramfs pivot complete and system root mounted on / read only - a target can be part of another target (graphical.target includes mult-user.target)
systemctl get-default check current target
who -r run level
systemctl list-dependencies graphical.target | grep target list target dependencies
ls -l /lib/systemd/system/runlevel\* list run levels
systemctl set-default graphical.target set default target
Recover Root Password (RHEL 9)
Reboot
Press esc to get to grub
Find line beginning with Linux, add " rd.break" to the end RHEL 9 boot into emergency recovery mode
Find line beginning with Linux, add "init=/bin/bash" to the end RHEL 10 boot into emergency recovery mode
Press Ctrl X start boot using the modified settings
mount -o remount,rw /sysroot RHEL 9 remount the root filesystem as read-write to allow changes
mount -o remount,rw / RHEL 10 remount the root filesystem as read-write to allow changes
chroot /sysroot change root to /sysroot (RHEL OS)
passwd
Enter your new password
touch /.autorelabel Force SELinux to relabel files on next boot
exit RHEL 9 exit back to emergency shell
mount -o remount,ro / RHEL 10 reboot cleanly
exit exit to boot
Repair Filesystem Corruption Common errors
Corrupt file system systemd attempts to repair file system if it cannot be repaired, go to emergency shell
nonexistent device/UUID in /etc/fstab if device remains unavailable, go to emergency shell
nonexistent mount point in /etc/fstab go to emergency shell
incorrect mount option in /etc/fstab go to emergency shell
Emergency target can diagnose and fix the issue, because no file systems are mounted before emergency shell is displayed
systemctl daemon-reload when using emergency shell, remember to run this after editing /etc/fstab