mtpti5iD/redhat-docs_dataset huggingface dataset:
7.83. iproute 7.83.1. RHBA-2015:1331 - iproute bug fix and enhancement update Updated iproute packages that fix several bugs and add two enhancements are now available for Red Hat Enterprise Linux 6. The iproute packages contain networking utilities such as ip and rtmon designed to use the advanced networking capabilities of the Linux kernel. Bug Fixes BZ# 997965 The default route was erroneously deleted after running the "ip route del" command without further parameters. A patch has been applied, and the default route is no longer removed in this situation. BZ# 1011817 Running the "bridge monitor file" command opened the file, but never closed it. A fix has been applied to close the opened file after loading its content. As a result, the command now closes all opened files as expected. BZ# 1034049 Previously, the "ip -6 addrlabel" command returned an incorrect error message that contained "inet" instead of "inet6". To fix this bug, the error message has been changed to include "inet" for IPv4 addresses and "inet6" for IPv6 addresses. BZ# 1040367 Prior to this update, the iproute utility handled the return values of the send() system call incorrectly when reading kernel responses. Consequently, iproute could interpret successful kernel responses as failures, which caused iproute to terminate with an error. With this update, iproute uses the return values correctly and processes kernel responses as intended. BZ# 1060195 The /sbin/ip file displayed statistics for 32-bit system even on 64-bit kernel. To fix this bug, a patch has been applied, and the statistics are now presented correctly. BZ# 1152951 Prior to this update, multipath routing did not function with IPv6 addresses and resulted in an "IP address is expected rather than "2001:470:25:94::1" error. To fix this bug, a patch that enables adding multipath routes using IPv6 addresses has been applied. Enhancements BZ# 1131650 Support for spoof checking configuration has been added to iproute. BZ# 1177982 Dynamic precision, human readable, and IEC outputs are now backported to IP statistics. Users of iproute are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Commands:
5.2. Installing the firewall-config GUI configuration tool To use the firewall-config GUI configuration tool, install the firewall-config package as root : Alternatively, in GNOME , use the Super key and type Software to launch the Software Sources application. Type firewall to the search box, which appears after selecting the search button in the top-right corner. Select the Firewall item from the search results, and click on the Install button. To run firewall-config , use either the firewall-config command or press the Super key to enter the Activities Overview , type firewall , and press Enter .

Commands:
~]# yum install firewall-config
function::user_string2_warn Name function::user_string2_warn - Retrieves string from user space with alternative warning string Synopsis Arguments addr the user space address to retrieve the string from warn_msg the warning message to return when data isn't available Description Returns the null terminated C string from a given user space memory address. Reports the given warning message on the rare cases when userspace data is not accessible and warns (but does not abort) about the failure.

Commands:
user_string2_warn:string(addr:long,warn_msg:string)
14.3.6. Signing an SSH Certificate Using a PKCS#11 Token It is possible to sign a host key using a CA key stored in a PKCS#11 token by providing the token library using the -D and identifying the CA key by providing its public half as an argument to the -s option: ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I certificate_ID host_key.pub In all cases, certificate_ID is a " key identifier " that is logged by the server when the certificate is used for authentication. Certificates may be configured to be valid only for a set of users or host names, the principals. By default, generated certificates are valid for all users or hosts. To generate a certificate for a specified set of principals, use a comma separated list with the -Z option as follows: and for hosts: Additional limitations on the validity and use of user certificates may be specified through certificate options. A certificate option may disable features of the SSH session, may be valid only when presented from particular source addresses or may force the use of a specific command. For a list of valid certificate options, see the ssh-keygen(1) manual page for the -O option. Certificates may be defined to be valid for a specific lifetime. The -V option allows specifying a certificates start and end times. For example: ssh-keygen -s ca_user_key -I certificate_ID id_rsa.pub -V "-1w:+54w5d" A certificate that is presented at a time outside this range will not be considered valid. By default, certificates are valid indefinitely starting from UNIX Epoch.

Commands:
ssh-keygen -s ca_user_key.pub -D libpkcs11.so -I certificate_ID -Z user1,user2 id_rsa.pub
ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I certificate_ID -h -Z host.domain ssh_host_rsa_key.pub
4.92. ImageMagick 4.92.1. RHSA-2012:0544 - Moderate: ImageMagick security update Updated ImageMagick packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix CVE-2012-0247 A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially-crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. CVE-2012-0248 A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially-crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. CVE-2010-4167 It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially-crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. CVE-2012-0259 An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially-crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. CVE-2012-0260 A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially-crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. CVE-2012-1798 An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially-crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. Red Hat would like to thank CERT-FI for reporting CVE-2012-0259 , CVE-2012-0260 , and CVE-2012-1798 . CERT-FI acknowledges Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of Codenomicon's CROSS project as the original reporters. Users of ImageMagick are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of ImageMagick must be restarted for this update to take effect.

Commands:
14.11. Listing, Creating, Applying, and Deleting a Snapshot Using different parameters from the qemu-img snapshot command you can list, apply, create, or delete an existing snapshot ( snapshot ) of specified image ( filename ). The accepted arguments are as follows: -l lists all snapshots associated with the specified disk image. The apply option, -a , reverts the disk image ( filename ) to the state of a previously saved snapshot . -c creates a snapshot ( snapshot ) of an image ( filename ). -d deletes the specified snapshot.

Commands:
qemu-img snapshot [ -l | -a snapshot | -c snapshot | -d snapshot ] filename
24.5.2. Using the lsusb Command The lsusb command allows you to display information about USB buses and devices that are attached to them. To list all USB devices that are in the system, type the following at a shell prompt: lsusb This displays a simple list of devices, for example: You can also use the -v command-line option to display more verbose output: lsusb -v For instance: For a complete list of available command-line options, see the lsusb (8) manual page.

Commands:
~]USD lsusb Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub [output truncated] Bus 001 Device 002: ID 0bda:0151 Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader) Bus 008 Device 002: ID 03f0:2c24 Hewlett-Packard Logitech M-UAL-96 Mouse Bus 008 Device 003: ID 04b3:3025 IBM Corp.
~]USD lsusb -v [output truncated] Bus 008 Device 002: ID 03f0:2c24 Hewlett-Packard Logitech M-UAL-96 Mouse Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x03f0 Hewlett-Packard idProduct 0x2c24 Logitech M-UAL-96 Mouse bcdDevice 31.00 iManufacturer 1 iProduct 2 iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 [output truncated]
Chapter 9. Configure Network Bridging A network bridge is a link-layer device which forwards traffic between networks based on MAC addresses. It makes forwarding decisions based on a table of MAC addresses which it builds by listening to network traffic and thereby learning what hosts are connected to each network. A software bridge can be used within a Linux host in order to emulate a hardware bridge, for example in virtualization applications for sharing a NIC with one or more virtual NICs. Note that a bridge cannot be established over Wi-Fi networks operating in Ad-Hoc or Infrastructure modes. This is due to the IEEE 802.11 standard that specifies the use of 3-address frames in Wi-Fi for the efficient use of airtime. 9.1. Configure Bridging Using the Text User Interface, nmtui The text user interface tool nmtui can be used to configure bridging in a terminal window. Issue the following command to start the tool: The text user interface appears. Any invalid command prints a usage message. To navigate, use the arrow keys or press Tab to step forwards and press Shift + Tab to step back through the options. Press Enter to select an option. The Space bar toggles the status of a check box. From the starting menu, select Edit a connection . Select Add , the New Connection screen opens. Figure 9.1. The NetworkManager Text User Interface Add a Bridge Connection menu Select Bridge , the Edit connection screen opens. To add port interfaces to the bridge select Add , the New Connection screen opens. Once the type of Connection has been chosen select the Create button to cause the bridge's Edit Connection display to appear. Figure 9.2. The NetworkManager Text User Interface Adding a new Bridge Slave Connection menu Enter the required port's device name or MAC address in the Device section. If required, enter a clone MAC address to be used as the bridge's MAC address by selecting Show to the right of the Ethernet label. Select the OK button. Note If the device is specified without a MAC address the Device section will be automatically populated once the Edit Connection window is reloaded, but only if it successfully finds the device. Figure 9.3. The NetworkManager Text User Interface Configuring a Bridge Slave Connection menu The name of the bridge port appears in the Slaves section. Repeat the above steps to add further port connections. Review and confirm the settings before selecting the OK button. Figure 9.4. The NetworkManager Text User Interface Configuring a Bridge menu See Section 9.4.1.1, "Configuring the Bridge Tab" for definitions of the bridge terms. See Section 3.2, "Configuring IP Networking with nmtui" for information on installing nmtui .

Commands:
~]USD nmtui
Chapter 8. Configuring FIPS for Red Hat JBoss Web Server When JBoss Web Server is installed on a Red Hat Enterprise Linux 8 host, you can configure JBoss Web Server to be compliant with Federal Information Processing Standards (FIPS). When you enable FIPS on the Red Hat Enterprise Linux host, this allows JBoss Web Server to operate in FIPS mode automatically. Note FIPS does not support the password-based encryption functionality that is provided by the tomcat-vault component of JBoss Web Server. If you want to use password-based encryption on the JBoss Web Server host, you must ensure that FIPS is disabled. For more information about password-based encryption and tomcat-vault , see Vault for Red Hat JBoss Web Server . 8.1. Introduction to FIPS The Federal Information Processing Standards (FIPS) provide guidelines and requirements for improving security and interoperability across computer systems and networks. The FIPS 140-2 and 140-3 series apply to cryptographic modules at both the hardware and software levels. The National Institute of Standards and Technology in the United States implements a cryptographic module validation program with searchable lists of both in-process and approved cryptographic modules. Red Hat Enterprise Linux provides an integrated framework to enable FIPS 140-2 compliance on a system-wide basis. When operating under FIPS mode, software packages using cryptographic libraries are self-configured according to the global policy. Additional resources Government Standards (Red Hat Customer Portal) Security Requirements for Cryptographic Modules (National Institute of Standards and Technology (NIST) website) 8.2. Configuring FIPS for JBoss Web Server on RHEL 8 You can enable FIPS compliance on the Red Hat Enterprise Linux 8 host during system installation. Alternatively, you can switch your system to FIPS mode after you have completed the system installation. Procedure To enable FIPS mode, complete either of the following steps: If you want to enable FIPS during system installation, follow the instructions in Security Hardening: Installing the system with FIPS mode enabled . If you want to switch to FIPS mode after system installation, follow the instructions in Security Hardening: Switching the system to FIPS mode . Verification Enter the following command: If FIPS is enabled, this prints the following output:

Commands:
fips-mode-setup --check
FIPS mode is enabled.
6.7. Viewing Red Hat Satellite Errata for a Virtual Machine Errata for each virtual machine can be viewed after the Red Hat Virtualization virtual machine has been configured to receive errata information from the Red Hat Satellite server. For more information on configuring a virtual machine to display available errata see Section 4.8, "Configuring Red Hat Satellite Errata Management for a Virtual Machine" Viewing Red Hat Satellite Errata Click Compute Virtual Machines . Click the virtual machine's name to go to the details view. Click Errata .

Commands:
Chapter 26. Clustering PCS is able to find a token and connect to a node with upper case characters in its node name Previously, PCS was unable to find a token for any node name with upper case characters, and it would report an error that the node is not authenticated. This occurred because the pcs cluster auth command would lowercase all node names before storing them to the PCS token file. With this fix, PCS does not lowercase node names before storing them to the PCS token file. (BZ# 1590533 ) pcs now shows correct value for failcount Starting with the Red Hat Enterprise Linux 7.5 release, the pcs resource failcount show command always showed a failcount of zero, even when this was not the correct value. This occurred because the format of resource failcounts was changed in Pacemaker. With this fix, the pcs utility is able to parse the new failcount format and it displays the correct value. (BZ#1588667) At cluster startup, corosync starts on each node with a small delay to reduce the risk of JOIN flood Starting corosync on all nodes at the same time may cause a JOIN flood, which may result in some nodes not joining the cluster. With this update, each node starts corosync with a small delay to reduce the risk of this happening. (BZ# 1572886 ) New /etc/sysconfig/pcsd option to reject client-initiated SSL/TLS renegotiation When TLS renegotiation is enabled on the server, a client is allowed to send a renegotiation request, which initiates a new handshake. Computational requirements of a handshake are higher on a server than on a client. This makes the server vulnerable to DoS attacks. With this fix, a new option has been added to the /etc/sysconfig/pcsd configuration file to reject renegotiations. Note that the client can still open multiple connections to a server with a handshake performed for all of the connections. (BZ#1566382)

Commands:
Chapter 1. About OpenShift Virtualization Learn about OpenShift Virtualization's capabilities and support scope. 1.1. What you can do with OpenShift Virtualization OpenShift Virtualization is an add-on to OpenShift Container Platform that allows you to run and manage virtual machine workloads alongside container workloads. OpenShift Virtualization adds new objects into your OpenShift Container Platform cluster via Kubernetes custom resources to enable virtualization tasks. These tasks include: Creating and managing Linux and Windows virtual machines Connecting to virtual machines through a variety of consoles and CLI tools Importing and cloning existing virtual machines Managing network interface controllers and storage disks attached to virtual machines Live migrating virtual machines between nodes An enhanced web console provides a graphical portal to manage these virtualized resources alongside the OpenShift Container Platform cluster containers and infrastructure. OpenShift Virtualization is tested with OpenShift Container Storage (OCS) and designed to use with OCS features for the best experience. You can use OpenShift Virtualization with either the OVN-Kubernetes or the OpenShiftSDN default Container Network Interface (CNI) network provider. 1.1.1. OpenShift Virtualization supported cluster version OpenShift Virtualization 2.6 is supported for use on OpenShift Container Platform 4.7 clusters. To use the latest z-stream release of OpenShift Virtualization, you must first upgrade to the latest version of OpenShift Container Platform.

Commands:
Chapter 2. Compatibility Matrix for Red Hat Ceph Storage 5.1 The following tables list products and their versions compatible with Red Hat Ceph Storage 5.1. Host Operating System Version Notes Red Hat Enterprise Linux 8.6, 8.5, 8.4, and EUS 8.4 Standard lifecycle 8.6 is included in the product (recommended). Red Hat Enterprise Linux EUS is optional. Important All nodes in the cluster and their clients must use the supported OS version(s) to ensure that the version of the ceph package is the same on all nodes. Using different versions of the ceph package is not supported. Important Red Hat no longer supports using Ubuntu as a host operating system to deploy Red Hat Ceph Storage. Product Version Notes Ansible Supported in a limited capacity. Supported for upgrade and conversion to Cephadm and for other minimal playbooks. Red Hat OpenShift 3.x RBD,Cinder and CephFS drivers are supported. Red Hat OpenShift Data Foundation See the Red Hat OpenShift Data Foundation Supportability and Interoperability Checker for detailed external mode version compatibility. Red Hat OpenStack Platform 16.1 and 16.2 Red Hat OpenStack Platform 16.1z8 and 16.2z1 is supported only with external Red Hat Ceph Storage 5.1. Red Hat Satellite 6.x Only registering with the Content Delivery Network (CDN) is supported. Registering with Red Hat Network (RHN) is deprecated and not supported. Client Connector Version Notes S3A 2.8.x, 3.2.x, and trunk Red Hat Enterprise Linux iSCSI Initiator The latest versions of the iscsi-initiator-utils and device-mapper-multipath packages VMware vSphere versions 6.7 and 7 are supported Red Hat Ceph Storage as a backup target Version Notes CommVault Cloud Data Management v11 IBM Spectrum Protect Plus 10.1.5 IBM Spectrum Protect server 8.1.8 NetApp AltaVault 4.3.2 and 4.4 Rubrik Cloud Data Management (CDM) 3.2 onwards Trilio, TrilioVault 3.0 S3 target Veeam (object storage) Veeam Availability Suite 9.5 Update 4 Supported on Red Hat Ceph Storage object storage with the S3 protocol Veritas NetBackup for Symantec OpenStorage (OST) cloud backup 7.7 and 8.0 Independent Software vendors Version Notes IBM Spectrum Discover 2.0.3 WekaIO 3.12.2

Commands:
Preface The Kernel Administration Guide describes working with the kernel and shows several practical tasks. Beginning with information on using kernel modules, the guide then covers interaction with the sysfs facility, manual upgrade of the kernel and using kpatch. The guide also introduces the crash dump mechanism, which steps through the process of setting up and testing vmcore collection in the event of a kernel failure. The Kernel Administration Guide also covers selected use cases of managing the kernel and includes reference material about command line options, kernel tunables (also known as switches), and a brief discussion of kernel features.

Commands:
12.3. Cockpit Enablement Red Hat Enterprise Linux Atomic Host 7.1.5 and Red Hat Enterprise Linux 7.1 include the following updates: The Cockpit Web Service is now available as a privileged container. This allows you to run Cockpit on systems like Red Hat Enterprise Linux Atomic Host where the cockpit-ws package cannot be installed, but other prerequisites of Cockpit are included. To use this privileged container, use the following command: Cockpit now includes the ability to access other hosts using a single instance of the Cockpit Web Service. This is useful when only one machine is reachable by the user, or to manage other hosts that do not have the Cockpit Web Service installed. The other hosts should have the cockpit-bridge and cockpit-shell packages installed. The authorized SSH keys for a particular user and system can now be configured using the "Administrator Accounts" section. Cockpit now uses the new storaged system API to configure and monitor disks and file systems. Red Hat Enterprise Linux Atomic Host 7.1.2 and Red Hat Enterprise Linux 7.1 include the following updates: libssh - a multiplatform C library which implements the SSHv1 and SSHv2 protocol on client and server side. It can be used to remotely execute programs, transfer files, use a secure and transparent tunnel for remote programs. The Secure FTP implementation makes it easier to manager remote files. cockpit-ws - The cockpit-ws package contains the web server component used for communication between the browser application and various configuration tools and services like cockpitd . cockpit-ws is automatically started on system boot. The cockpit-ws package has been included in Red Hat Enterprise Linux 7.1 only.

Commands:
sudo atomic run rhel7/cockpit-ws