mtpti5iD/redhat-docs_dataset huggingface dataset:
Chapter 5. Running .NET 8.0 applications in containers Use the ubi8/dotnet-80-runtime image to run a .NET application inside a Linux container. The following example uses podman. Procedure Create a new MVC project in a directory called mvc_runtime_example : Publish the project: Run your image: Verification steps View the application running in the container:

Commands:
dotnet new mvc --output mvc_runtime_example
dotnet publish mvc_runtime_example -f net8.0 /p:PublishProfile=DefaultContainer /p:ContainerBaseImage=registry.access.redhat.com/ubi8/dotnet-80-runtime:latest
podman run --rm -p8080:8080 mvc_runtime_example
xdg-open http://127.0.0.1:8080
Chapter 4. Workstation Security Securing a Linux environment begins with the workstation. Whether locking down a personal machine or securing an enterprise system, sound security policy begins with the individual computer. After all, a computer network is only as secure as its weakest node. 4.1. Evaluating Workstation Security When evaluating the security of a Red Hat Enterprise Linux workstation, consider the following: BIOS and Boot Loader Security - Can an unauthorized user physically access the machine and boot into single user or rescue mode without a password? Password Security - How secure are the user account passwords on the machine? Administrative Controls - Who has an account on the system and how much administrative control do they have? Available Network Services - What services are listening for requests from the network and should they be running at all? Personal Firewalls - What type of firewall, if any, is necessary? Security Enhanced Communication Tools - Which tools should be used to communicate between workstations and which should be avoided?

Commands:
Chapter 13. Managing container storage interface (CSI) component placements Each cluster consists of a number of dedicated nodes such as infra and storage nodes. However, an infra node with a custom taint will not be able to use OpenShift Data Foundation Persistent Volume Claims (PVCs) on the node. So, if you want to use such nodes, you can set tolerations to bring up csi-plugins on the nodes. Procedure Edit the configmap to add the toleration for the custom taint. Remember to save before exiting the editor. Display the configmap to check the added toleration. Example output of the added toleration for the taint, nodetype=infra:NoSchedule : Note Ensure that all non-string values in the Tolerations value field has double quotation marks. For example, the values true which is of type boolean, and 1 which is of type int must be input as "true" and "1". Restart the rook-ceph-operator if the csi-cephfsplugin- * and csi-rbdplugin- * pods fail to come up on their own on the infra nodes. Example : Verification step Verify that the csi-cephfsplugin- * and csi-rbdplugin- * pods are running on the infra nodes.

Commands:
oc edit configmap rook-ceph-operator-config -n openshift-storage
oc get configmap rook-ceph-operator-config -n openshift-storage -o yaml
apiVersion: v1 data: [...] CSI_PLUGIN_TOLERATIONS: | - key: nodetype operator: Equal value: infra effect: NoSchedule - key: node.ocs.openshift.io/storage operator: Equal value: "true" effect: NoSchedule [...] kind: ConfigMap metadata: [...]
oc delete -n openshift-storage pod <name of the rook_ceph_operator pod>
oc delete -n openshift-storage pod rook-ceph-operator-5446f9b95b-jrn2j pod "rook-ceph-operator-5446f9b95b-jrn2j" deleted
Chapter 2. Configuring System Authentication Authentication is the process in which a user is identified and verified to a system. It requires presenting some sort of identity and credentials, such as a user name and password. The system then compares the credentials against the configured authentication service. If the credentials match and the user account is active, then the user is authenticated . Once a user is authenticated, the information is passed to the access control service to determine what the user is permitted to do. Those are the resources the user is authorized to access. Note that authentication and authorization are two separate processes. The system must have a configured list of valid account databases for it to check for user authentication. The information to verify the user can be located on the local system or the local system can reference a user database on a remote system, such as LDAP or Kerberos. A local system can use a variety of different data stores for user information, including Lightweight Directory Access Protocol (LDAP), Network Information Service (NIS), and Winbind. Both LDAP and NIS data stores can use Kerberos to authenticate users. For convenience and potentially part of single sign-on, Red Hat Enterprise Linux can use the System Security Services Daemon (SSSD) as a central daemon to authenticate the user to different identity back ends or even to ask for a ticket-granting ticket (TGT) for the user. SSSD can interact with LDAP, Kerberos, and external applications to verify user credentials. This chapter explains what tools are available in Red Hat Enterprise Linux for configuring system authentication: the ipa-client-install utility and the realmd system for Identity Management systems; see Section 2.1, "Identity Management Tools for System Authentication" for more information the authconfig utility and the authconfig UI for other systems; see Section 2.2, "Using authconfig " for more information 2.1. Identity Management Tools for System Authentication You can use the ipa-client-install utility and the realmd system to automatically configure system authentication on Identity Management machines. ipa-client-install The ipa-client-install utility configures a system to join the Identity Management domain as a client machine. For more information about ipa-client-install , see the Installing a Client in the Linux Domain Identity, Authentication, and Policy Guide . Note that for Identity Management systems, ipa-client-install is preferred over realmd . realmd The realmd system joins a machine to an identity domain, such as an Identity Management or Active Directory domain. For more information about realmd , see the Using realmd to Connect to an Active Directory Domain section in the Windows Integration Guide .

Commands:
4.3. Displaying Device-Specific Fencing Options Use the following command to view the options for the specified STONITH agent. For example, the following command displays the options for the fence agent for APC over telnet/SSH.

Commands:
pcs stonith describe stonith_agent
pcs stonith describe fence_apc Stonith options for: fence_apc ipaddr (required): IP Address or Hostname login (required): Login Name passwd: Login password or passphrase passwd_script: Script to retrieve password cmd_prompt: Force command prompt secure: SSH connection port (required): Physical plug number or name of virtual machine identity_file: Identity file for ssh switch: Physical switch number on device inet4_only: Forces agent to use IPv4 addresses only inet6_only: Forces agent to use IPv6 addresses only ipport: TCP port to use for connection with device action (required): Fencing Action verbose: Verbose mode debug: Write debug information to given file version: Display version information and exit help: Display help and exit separator: Separator for CSV created by operation list power_timeout: Test X seconds for status change after ON/OFF shell_timeout: Wait X seconds for cmd prompt after issuing command login_timeout: Wait X seconds for cmd prompt after login power_wait: Wait X seconds after issuing ON/OFF delay: Wait X seconds before fencing is started retry_on: Count of attempts to retry power on
3.3. Putting the Configuration Together After determining which of the preceding routing methods to use, the hardware should be connected together and configured. Important The network adapters on the LVS routers must be configured to access the same networks. For instance if eth0 connects to the public network and eth1 connects to the private network, then these same devices on the backup LVS router must connect to the same networks. Also the gateway listed in the first interface to come up at boot time is added to the routing table and subsequent gateways listed in other interfaces are ignored. This is especially important to consider when configuring the real servers. After connecting the hardware to the network, configure the network interfaces on the primary and backup LVS routers. This should be done by editing the network configuration files manually. For more information about working with network configuration files, see the Red Hat Enterprise Linux 7 Networking Guide . 3.3.1. General Load Balancer Networking Tips Configure the real IP addresses for both the public and private networks on the LVS routers before attempting to configure Load Balancer using Keepalived. The sections on each topology give example network addresses, but the actual network addresses are needed. Below are some useful commands for bringing up network interfaces or checking their status. Bringing Up Real Network Interfaces To open a real network interface, use the following command as root , replacing N with the number corresponding to the interface ( eth0 and eth1 ). ifup eth N Warning Do not use the ifup scripts to open any floating IP addresses you may configure using Keepalived ( eth0:1 or eth1:1 ). Use the service or systemctl command to start keepalived instead. Bringing Down Real Network Interfaces To bring down a real network interface, use the following command as root , replacing N with the number corresponding to the interface ( eth0 and eth1 ). ifdown eth N Checking the Status of Network Interfaces If you need to check which network interfaces are up at any given time, enter the following command: ip link To view the routing table for a machine, issue the following command: ip route 3.3.2. Firewall Requirements If you are running a firewall (by means of firewalld or iptables ), you must allow VRRP traffic to pass between the keepalived nodes. To configure the firewall to allow the VRRP traffic with firewalld , run the following commands: If the zone is omitted the default zone will be used. If, however, you need to allow the VRRP traffic with iptables , run the following commands:

Commands:
firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent firewall-cmd --reload
iptables -I INPUT -p vrrp -j ACCEPT iptables-save > /etc/sysconfig/iptables systemctl restart iptables
7.48. environment-modules 7.48.1. RHBA-2013:0316 - environment-modules bug fix update Updated environment-modules packages that fix several bugs are now available for Red Hat Enterprise Linux 6. The environment-modules packages provide for the dynamic modification of a user's environment using modulefiles. Each modulefile contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the module command which interprets modulefiles. Note The environment-modules package has been upgraded to upstream version 3.2.9c, which provides a number of bug fixes over the version. (BZ# 765630 ) Bug Fixes BZ#818177 Due to an error in the Tcl library, some allocated pointers were invalidated inside the library. Consequently, running the "module switch" command in the tcsh shell led to a segmentation fault. The bug has been fixed and the system memory is now allocated and pointed to correctly. BZ#848865 Previously, the /usr/share/Modules/modulefiles/modules file contained an incorrect path. Consequently, an error occurred when the "module load modules" command was executed. With this update, the incorrect path has been replaced and the described error no longer occurs. All users of environment-modules are advised to upgrade to these updated packages, which fix these bugs.

Commands:
Chapter 39. Red Hat Enterprise Linux Atomic Host 7.2.5 39.1. Atomic Host OStree update : New Tree Version: 7.2.5 (hash: 9bfe1fb65094d43e420490196de0e9aea26b3923f1c18ead557460b83356f058) Changes since Tree Version 7.2.4 (hash: b060975ce3d5abbf564ca720f64a909d1a4d332aae39cb4de581611526695a0c) Updated packages : rpm-ostree-client-2016.3.1.g5bd7211-2.atomic.el7.1 rpm-ostree-2016.3.1.g5bd7211-1.atomic.el7 ostree-2016.5-3.atomic.el7 cockpit-ostree-0.108-1.el7 New packages : openscap-daemon-0.1.5-1.el7 39.2. Extras Updated packages : atomic-1.10.5-5.el7 cockpit-0.108-1.el7 docker-1.10.3-44.el7 docker-distribution-2.4.1-1.el7 * docker-latest-1.10.3-44.el7 dpdk-2.2.0-3.el7 * etcd-2.2.5-2.el7 kubernetes-1.2.0-0.12.gita4463d9.el7 runc-0.1.1-4.el7 (Technology Preview) * The asterisk (*) marks packages which are available for Red Hat Enterprise Linux only. 39.2.1. Container Images Updated : Red Hat Enterprise Linux Container Image (rhel7/rhel) Red Hat Enterprise Linux Atomic Tools Container Image (rhel7/rhel-tools) Red Hat Enterprise Linux Atomic rsyslog Container Image (rhel7/rsyslog) Red Hat Enterprise Linux Atomic sadc Container Image (rhel7/sadc) Red Hat Enterprise Linux Atomic cockpit-ws Container Image (rhel7/cockpit-ws) Red Hat Enterprise Linux Atomic etcd Container Image (rhel7/etcd) Red Hat Enterprise Linux Atomic Kubernetes-controller Container Image (rhel7/kubernetes-controller-mgr) Red Hat Enterprise Linux Atomic Kubernetes-apiserver Container Image (rhel7/kubernetes-apiserver) Red Hat Enterprise Linux Atomic Kubernetes-scheduler Container Image (rhel7/kubernetes-scheduler) Red Hat Enterprise Linux Atomic SSSD Container Image (rhel7/sssd) (Technology Preview) New : Red Hat Enterprise Linux Atomic openscap Container Image (rhel7/openscap) (Technology Preview) 39.3. New Features ostree admin unlock command now available Red Hat Enterprise Linux Atomic Host 7.2.5 introduces the new command ostree admin unlock. It allows users to unlock the current ostree deployment and install packages temporarily. This is done by mounting a writable overlayfs on /usr. When a user reboots, the overlayfs is unmounted and the packages are no longer installed. Use the ostree admin unlock --hotfix option for the changes, such as package installs to persist across reboots. This command provides the same capabilities as atomic-pkglayer, which is now deprecated. There are known issues with overlayfs and SELinux, so this functionality is not intended for long term use. Strict browser security policy for Cockpit is now enforced This defines what code can be run in a Cockpit session and mitigates a number of browser-based attacks.

Commands:
Appendix D. LVM Object Tags An LVM tag is a word that can be used to group LVM2 objects of the same type together. Tags can be attached to objects such as physical volumes, volume groups, and logical volumes. Tags can be attached to hosts in a cluster configuration. Tags can be given on the command line in place of PV, VG or LV arguments. Tags should be prefixed with @ to avoid ambiguity. Each tag is expanded by replacing it with all objects possessing that tag which are of the type expected by its position on the command line. LVM tags are strings of up to 1024 characters. LVM tags cannot start with a hyphen. A valid tag can consist of a limited range of characters only. The allowed characters are [A-Za-z0-9_+.-]. As of the Red Hat Enterprise Linux 6.1 release, the list of allowed characters was extended, and tags can contain the /, =, !, :, #, and & characters. Only objects in a volume group can be tagged. Physical volumes lose their tags if they are removed from a volume group; this is because tags are stored as part of the volume group metadata and that is deleted when a physical volume is removed. The following command lists all the logical volumes with the database tag. The following command lists the currently active host tags. D.1. Adding and Removing Object Tags To add or delete tags from physical volumes, use the --addtag or --deltag option of the pvchange command. To add or delete tags from volume groups, use the --addtag or --deltag option of the vgchange or vgcreate commands. To add or delete tags from logical volumes, use the --addtag or --deltag option of the lvchange or lvcreate commands. You can specify multiple --addtag and --deltag arguments within a single pvchange , vgchange , or lvchange command. For example, the following command deletes the tags T9 and T10 and adds the tags T13 and T14 to the volume group grant .

Commands:
lvs @database
lvm tags
vgchange --deltag T9 --deltag T10 --addtag T13 --addtag T14 grant
7.312. dbus-glib 7.312.1. RHSA-2013:0568 - Important: dbus-glib security update Updated dbus-glib packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below. dbus-glib is an add-on library to integrate the standard D-Bus library with the GLib main loop and threading model. Security Fix CVE-2013-0292 A flaw was found in the way dbus-glib filtered the message sender (message source subject) when the "NameOwnerChanged" signal was received. This could trick a system service using dbus-glib (such as fprintd) into believing a signal was sent from a privileged process, when it was not. A local attacker could use this flaw to escalate their privileges. All dbus-glib users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications linked against dbus-glib, such as fprintd and NetworkManager, must be restarted for this update to take effect.

Commands:
B.3. Identity Management Clients This section describes common client problems for IdM in Red Hat Enterprise Linux. Additional resources: To validate your /etc/sssd.conf file, see SSSD Configuration Validation in the System-Level Authentication Guide . B.3.1. The Client Is Unable to Resolve Reverse Lookups when Using an External DNS An external DNS server returns a wrong host name for the IdM server. The following errors related to the IdM server appear in the Kerberos database: What this means: The external DNS name server returns the wrong host name for the IdM server or returns no answer at all. To fix the problem: Verify your DNS configuration, and make sure the DNS domains used by IdM are properly delegated. See Section 2.1.5, "Host Name and DNS Configuration" for details. Verify your reverse (PTR) DNS records settings. See Chapter 33, Managing DNS for details. B.3.2. The Client Is Not Added to the DNS Zone When running the ipa-client-install utility, the nsupdate utility fails to add the client to the DNS zone. What this means: The DNS configuration is incorrect. To fix the problem: Verify your configuration for DNS delegation from the parent zone to IdM. See Section 2.1.5, "Host Name and DNS Configuration" for details. Make sure that dynamic updates are allowed in the IdM zone. See Section 33.5.1, "Enabling Dynamic DNS Updates" for details. For details on managing DNS in IdM, see Section 33.7, "Managing Reverse DNS Zones" . For details on managing DNS in Red Hat Enterprise Linux, see Editing Zone Files in the Networking Guide . B.3.3. Client Connection Problems Users cannot log in to a machine. Attempts to access user and group information, such as with the getent passwd admin command, fail. What this means: Client authentication problems often indicate problems with the System Security Services Daemon (SSSD) service. To fix the problem: Examine the SSSD logs in the /var/log/sssd/ directory. The directory includes a log file for the DNS domain, such as sssd_ example.com .log . If the logs do not include enough information, increase the log level: In the /etc/sssd/sssd.conf file, look up the [domain/ example.com ] section. Adjust the debug_level option to record more information in the logs. Restart the sssd service. Examine sssd_ example.com .log again. The file now includes more error messages.

Commands:
Jun 30 11:11:48 server1 krb5kdc[1279](info): AS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: NEEDED_PREAUTH: admin EXAMPLE COM for krbtgt/EXAMPLE COM EXAMPLE COM, Additional pre-authentication required Jun 30 11:11:48 server1 krb5kdc[1279](info): AS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: ISSUE: authtime 1309425108, etypes {rep=18 tkt=18 ses=18}, admin EXAMPLE COM for krbtgt/EXAMPLE COM EXAMPLE COM Jun 30 11:11:49 server1 krb5kdc[1279](info): TGS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: UNKNOWN_SERVER: authtime 0, admin EXAMPLE COM for HTTP/server1.wrong.example.com@EXAMPLE.COM, Server not found in Kerberos database
debug_level = 9
systemctl start sssd
3.2.2. CPUfreq Setup Before selecting and configuring a CPUfreq governor, you need to add the appropriate CPUfreq driver first. Procedure 3.1. How to Add a CPUfreq Driver Use the following command to view which CPUfreq drivers are available for your system: Use modprobe to add the appropriate CPUfreq driver. When using the above command, be sure to remove the .ko filename suffix. Important When choosing an appropriate CPUfreq driver, always choose acpi-cpufreq over p4-clockmod . While using the p4-clockmod driver reduces the clock frequency of a CPU, it does not reduce the voltage. acpi-cpufreq , on the other hand, reduces voltage along with CPU clock frequency, allowing less power consumption and heat output for each unit reduction in performance. You can also view which governors are available for use for a specific CPU using: Some CPUfreq governors may not be available for you to use. In this case, use modprobe to add the necessary kernel modules that enable the specific CPUfreq governor you wish to use. These kernel modules are available in /lib/modules/ [kernel version] /kernel/drivers/cpufreq/ . Procedure 3.2. Enabling a CPUfreq Governor If a specific governor is not listed as available for your CPU, use modprobe to enable the governor you wish to use: Example 3.1. Enabling a Governor If the ondemand governor is not available for your CPU, use the following command: Once a governor is listed as available for your CPU, you can enable it using:

Commands:
ls /lib/modules/ [kernel version] /kernel/arch/ [architecture] /kernel/cpu/cpufreq/
modprobe [CPUfreq driver]
cpupower frequency-info --governors
modprobe [governor]
modprobe cpufreq_ondemand
cpupower frequency-set --governor [governor]