mtpti5iD/redhat-docs_dataset huggingface dataset:
7.42. dovecot 7.42.1. RHSA-2013:0520 - Low: dovecot security and bug fix update Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below. Dovecot is an IMAP server, written with security primarily in mind, for Linux and other UNIX-like systems. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are provided as sub-packages. Security Fixes CVE-2011-2166 , CVE-2011-2167 Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. A remote, authenticated user could use these flaws to bypass intended access restrictions or conduct a directory traversal attack by leveraging login scripts. CVE-2011-4318 A flaw was found in the way Dovecot performed remote server identity verification, when it was configured to proxy IMAP and POP3 connections to remote hosts using TLS/SSL protocols. A remote attacker could use this flaw to conduct man-in-the-middle attacks using an X.509 certificate issued by a trusted Certificate Authority (for a different name). Bug Fix BZ#697620 When a new user first accessed their IMAP inbox, Dovecot was, under some circumstances, unable to change the group ownership of the inbox directory in the user's Maildir location to match that of the user's mail spool (/var/mail/USDUSER). This correctly generated an "Internal error occurred" message. However, with a subsequent attempt to access the inbox, Dovecot saw that the directory already existed and proceeded with its operation, leaving the directory with incorrectly set permissions. This update corrects the underlying permissions setting error. When a new user now accesses their inbox for the first time, and it is not possible to set group ownership, Dovecot removes the created directory and generates an error message instead of keeping the directory with incorrect group ownership. Users of dovecot are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the dovecot service will be restarted automatically.

Commands:
Chapter 7. Integration with Red Hat Single Sign-On The Red Hat Single Sign-On (RH-SSO) option works with JAAS to provide enterprise security for certain Web client applications and services running inside Fuse and Fuse administration services (SSH, JMX, and Fuse Management Console). Adapters are provided for the following types of container in Red Hat Fuse: Section 7.1, "Adapter for Spring Boot container" Section 7.2, "Adapter for Apache Karaf container" Section 7.3, "Adapter for JBoss EAP container" 7.1. Adapter for Spring Boot container The adapter for the Spring Boot container supports the following embedded Web containers: Undertow Jetty Tomcat For details on installing and using the Red Hat Single Sign-On adapter for the Spring Boot container, see Spring Boot Adapter in the Red Hat Single Sign-On Securing Applications and Services Guide . 7.2. Adapter for Apache Karaf container The adapter for the Apache Karaf container can secure the following components: Classic WAR applications deployed on Fuse with Pax Web War Extender. Servlets deployed on Fuse as OSGI services with Pax Web Whiteboard Extender and additionally servlets registered through org.osgi.service.http.HttpService#registerServlet()` which is a standard OSGi Enterprise HTTP Service. Apache Camel Undertow endpoints running with the Camel Undertow component. Apache CXF endpoints running on their own separate Undertow engine. Apache CXF endpoints running on the default engine provided by the CXF servlet. SSH and JMX admin access. Hawtio administration console. For details on installing and using the Red Hat Single Sign-On adapter for the Apache Karaf container, see JBoss Fuse 7 Adapter in the Red Hat Single Sign-On Securing Applications and Services Guide . 7.3. Adapter for JBoss EAP container The adapter for the JBoss Enterprise Application Platform (EAP) container provides security for WARs, enabling you to define role-based security constraints on your URLs. For details on installing and using the Red Hat Single Sign-On adapter for the JBoss EAP container, see JBoss EAP Adapter in the Red Hat Single Sign-On Securing Applications and Services Guide .

Commands:
4.2. Live Migration and Red Hat Enterprise Linux Version Compatibility Live Migration is supported as shown in table Table 4.1, "Live Migration Compatibility" : Table 4.1. Live Migration Compatibility Migration Method Release Type Example Live Migration Support Notes Forward Major release 5.x 6.y Not supported Forward Minor release 5.x 5.y (y>x, x>=4) Fully supported Any issues should be reported Forward Minor release 6.x 6.y (y>x, x>=0) Fully supported Any issues should be reported Backward Major release 6.x 5.y Not supported Backward Minor release 5.x 5.y (x>y,y>=4) Supported Refer to Troubleshooting problems with migration for known issues Backward Minor release 6.x 6.y (x>y, y>=0) Supported Refer to Troubleshooting problems with migration for known issues Troubleshooting problems with migration Issues with SPICE - It has been found that SPICE has an incompatible change when migrating from Red Hat Enterprise Linux 6.0 6.1. In such cases, the client may disconnect and then reconnect, causing a temporary loss of audio and video. This is only temporary and all services will resume. Issues with USB - Red Hat Enterprise Linux 6.2 added USB functionality which included migration support, but not without certain caveats which reset USB devices and caused any application running over the device to abort. This problem was fixed in Red Hat Enterprise Linux 6.4, and should not occur in future versions. To prevent this from happening in a version prior to 6.4, abstain from migrating while USB devices are in use. Issues with the migration protocol - If backward migration ends with "unknown section error", repeating the migration process can repair the issue as it may be a transient error. If not, please report the problem. Configuring Network Storage Configure shared storage and install a guest virtual machine on the shared storage. Alternatively, use the NFS example in Section 4.3, "Shared Storage Example: NFS for a Simple Migration"

Commands:
Chapter 4. Overriding the cluster-wide default node selector for OpenShift Data Foundation post deployment When a cluster-wide default node selector is used for OpenShift Data Foundation, the pods generated by container storage interface (CSI) daemonsets are able to start only on the nodes that match the selector. To be able to use OpenShift Data Foundation from nodes which do not match the selector, override the cluster-wide default node selector by performing the following steps in the command line interface : Procedure Specify a blank node selector for the openshift-storage namespace. Delete the original pods generated by the DaemonSets.

Commands:
oc annotate namespace openshift-storage openshift.io/node-selector=
delete pod -l app=csi-cephfsplugin -n openshift-storage delete pod -l app=csi-rbdplugin -n openshift-storage
8.3. Session/Query Metrics Name Property Description Comment Session Count sessionCount Indicates the number of user connections currently active. To ensure number of sessions are not restricted at peak times, check max-sessions-allowed (default 5000) is set accordingly and review sessions-expiration-timelimit. Query Count queryCount Indicates the number of queries currently active. Active Query Plan Count ENGINE_STATISTIC.active-plans-count Number of query plans currently being processed. To ensure maximum throughput, see the performance tuning section on QueryEngine and threading. Waiting Query Plan Count ENGINE_STATISTIC.waiting-plans-count Number of query plans currently waiting. Max Waiting Query Plan Watermark ENGINE_STATISTIC.max-waitplan-watermark The maximum number of query plans that have been waiting at one time, since the last time the server started. Long Running Queries longRunningQueries List current executing queries that have surpassed the query threshold ( query-threshold-in-seconds. ). Setup alert to warn when one or more queries are consuming resources for an extended period of time. If running too long, an option is to cancel request or increase threshold.

Commands:
17.6. Isolated Mode When using Isolated mode , guests connected to the virtual switch can communicate with each other, and with the host physical machine, but their traffic will not pass outside of the host physical machine, and they cannot receive traffic from outside the host physical machine. Using dnsmasq in this mode is required for basic functionality such as DHCP. However, even if this network is isolated from any physical network, DNS names are still resolved. Therefore, a situation can arise when DNS names resolve but ICMP echo request (ping) commands fail. Figure 17.6. Virtual network switch in isolated mode

Commands:
A.2. Hardware Security According to a study released in 2000 by the FBI and the Computer Security Institute (CSI), over seventy percent of all attacks on sensitive data and resources reported by organizations occurred from within the organization itself. Implementing an internal security policy is just as important as an external strategy. This section explains some of the common steps administrators and users can take to safeguard their systems from internal exploitation. Employee workstations, for the most part, are not as likely to be targets for remote attacks, especially those behind a properly configured firewall. However, there are some safeguards that can be implemented to avert an internal or physical attack on individual workstation resources. Modern workstation and home PCs use a BIOS that controls system resources on the hardware level. Workstation users can set administrative passwords within the BIOS to prevent malicious users from accessing or booting the system. BIOS passwords prevent malicious users from booting the system at all, deterring the user from quickly accessing or stealing information stored on the hard drive. However, if the malicious user steals the PC (the most common case of theft among frequent travelers who carry laptops and other mobile devices) and takes it to a location where they can disassemble the PC, the BIOS password does not prevent the attacker from removing the hard drive, installing it in another PC without BIOS restriction, and accessing the hard drive to read its contents. In these cases, it is recommended that workstations have locks to restrict access to internal hardware. Specialized security devices, such as lockable steel cables, can be attached to PC and laptop chassis to prevent theft, as well as locks on the chassis itself to prevent internal access. This type of hardware is widely available from manufacturers such as Kensington and Targus. Server hardware, especially production servers, are typically mounted on racks in server rooms. Server cabinets usually have lockable doors, and individual server chassis also are available with lockable front bezels for increased security from errant (or intentional) tampering. Enterprises can also use co-location providers to house their servers, as co-location providers offer higher bandwidth, 24x7 technical support, and expertise in system and server security. This can be an effective means of outsourcing security and connectivity needs for HTTP transactions or streaming media services. However, co-location can be cost-prohibitive, especially for small- to medium-sized businesses. Co-location facilities are known for being heavily guarded by trained security staff and tightly monitored at all times.

Commands:
Chapter 7. Linux Containers with Docker Format Docker is an open source project that automates the deployment of applications inside Linux Containers, and provides the capability to package an application with its runtime dependencies into a container. It provides a Docker CLI command line tool for the lifecycle management of image-based containers. Linux containers enable rapid application deployment, simpler testing, maintenance, and troubleshooting while improving security. Using Red Hat Enterprise Linux 7 with Docker allows customers to increase staff efficiency, deploy third-party applications faster, enable a more agile development environment, and manage resources more tightly. To quickly get up-and-running with Docker Containers, refer to Get Started with Docker Containers . Linux containers with Docker format are supported running on hosts with SELinux enabled. SELinux is not supported when the /var/lib/docker directory is located on a volume using the B-tree file system (Btrfs). 7.1. Components of Docker Containers Docker works with the following fundamental components: Container - an application sandbox. Each container is based on an image that holds necessary configuration data. When you launch a container from an image, a writable layer is added on top of this image. Every time you commit a container (using the docker commit command), a new image layer is added to store your changes. Image - a static snapshot of the containers' configuration. Image is a read-only layer that is never modified, all changes are made in top-most writable layer, and can be saved only by creating a new image. Each image depends on one or more parent images. Platform Image - an image that has no parent. Platform images define the runtime environment, packages and utilities necessary for containerized application to run. The platform image is read-only, so any changes are reflected in the copied images stacked on top of it. See an example of such stacking in Figure 7.1, "Image Layering Using Docker Format" . Registry - a repository of images. Registries are public or private repositories that contain images available for download. Some registries allow users to upload images to make them available to others. Dockerfile - a configuration file with build instructions for Docker images. Dockerfiles provide a way to automate, reuse, and share build procedures. Figure 7.1. Image Layering Using Docker Format

Commands:
14.9. Shutting Down, Rebooting, and Forcing Shutdown of a Guest Virtual Machine This section provides information about shutting down, rebooting, and forcing shutdown of a guest virtual machine. 14.9.1. Shutting Down a Guest Virtual Machine Shut down a guest virtual machine using the virsh shutdown command: You can control the behavior of the rebooting guest virtual machine by modifying the on_shutdown parameter in the guest virtual machine's configuration file.

Commands:
virsh shutdown {domain-id, domain-name or domain-uuid} [--mode method ]
Chapter 8. Supported Configurations Supported configurations for the Streams for Apache Kafka 2.7 release. 8.1. Supported platforms The following platforms are tested for Streams for Apache Kafka 2.7 running with Kafka on the version of Red Hat Enterprise Linux (RHEL) stated. Operating System Architecture JVM RHEL 8 and 9 x86, amd64, ppc64le (IBM Power), s390x (IBM Z and IBM(R) LinuxONE), aarch64 (64-bit ARM) Java 11 (deprecated) and Java 17 Platforms are tested with Open JDK 11 and 17, though Java 11 is deprecated in Streams for Apache Kafka 2.7.0. The IBM JDK is supported but not regularly tested against during each release. Oracle JDK 11 is not supported. FIPS compliance Streams for Apache Kafka 2.7.0 is designed for FIPS. To check which versions of RHEL are approved by the National Institute of Standards and Technology (NIST), see the Cryptographic Module Validation Program on the NIST website. 8.2. Supported clients Only client libraries built by Red Hat are supported for Streams for Apache Kafka. Currently, Streams for Apache Kafka only provides a Java client library. Clients are tested with Open JDK 11 and 17. 8.3. Supported Apache Kafka ecosystem In Streams for Apache Kafka, only the following components released directly from the Apache Software Foundation are supported: Apache Kafka Broker Apache Kafka Connect Apache MirrorMaker Apache MirrorMaker 2 Apache Kafka Java Producer, Consumer, Management clients, and Kafka Streams Apache ZooKeeper Note Apache ZooKeeper is supported solely as an implementation detail of Apache Kafka and should not be modified for other purposes. Additionally, the cores or vCPU allocated to ZooKeeper nodes are not included in subscription compliance calculations. In other words, ZooKeeper nodes do not count towards a customer's subscription. 8.4. Additional supported features Kafka Bridge Cruise Control Distributed Tracing See also, Chapter 10, Supported integration with Red Hat products . 8.5. Storage requirements Streams for Apache Kafka has been tested with block storage and is compatible with the XFS and ext4 file systems, both of which are commonly used with Kafka. File storage options, such as NFS, are not compatible. Additional resources For information on the supported configurations for the Streams for Apache Kafka 2.5 LTS release, see the Streams for Apache Kafka 2.5 Release Notes .

Commands:
Workloads APIs OpenShift Container Platform 4.15 Reference guide for workloads APIs Red Hat OpenShift Documentation Team

Commands:
"postCommit": { "script": "rake test --verbose", }
The above is a convenient form which is equivalent to:
"postCommit": { "command": ["/bin/sh", "-ic"], "args": ["rake test --verbose"] }
"postCommit": { "commit": ["rake", "test", "--verbose"] }
Command overrides the image entrypoint in the exec form, as documented in Docker: https://docs.docker.com/engine/reference/builder/#entrypoint.
"postCommit": { "args": ["rake", "test", "--verbose"] }
This form is only useful if the image entrypoint can handle arguments.
"postCommit": { "script": "rake test USD1", "args": ["--verbose"] }
This form is useful if you need to pass arguments that would otherwise be hard to quote properly in the shell script. In the script, USD0 will be "/bin/sh" and USD1, USD2, etc, are the positional arguments from Args.
"postCommit": { "command": ["rake", "test"], "args": ["--verbose"] }
This form is equivalent to appending the arguments to the Command slice.
"postCommit": { "script": "rake test --verbose", }
The above is a convenient form which is equivalent to:
"postCommit": { "command": ["/bin/sh", "-ic"], "args": ["rake test --verbose"] }
"postCommit": { "commit": ["rake", "test", "--verbose"] }
Command overrides the image entrypoint in the exec form, as documented in Docker: https://docs.docker.com/engine/reference/builder/#entrypoint.
"postCommit": { "args": ["rake", "test", "--verbose"] }
This form is only useful if the image entrypoint can handle arguments.
"postCommit": { "script": "rake test USD1", "args": ["--verbose"] }
This form is useful if you need to pass arguments that would otherwise be hard to quote properly in the shell script. In the script, USD0 will be "/bin/sh" and USD1, USD2, etc, are the positional arguments from Args.
"postCommit": { "command": ["rake", "test"], "args": ["--verbose"] }
This form is equivalent to appending the arguments to the Command slice.
5.55. dropwatch 5.55.1. RHBA-2012:1182 - dropwatch bug fix update Updated dropwatch packages that fix one bug are now available for Red Hat Enterprise Linux 6. The dropwatch package contains a utility that provides packet monitoring services. Bug Fix BZ# 725464 Prior to this update, the dropwatch utility could become unresponsive because it was waiting for a deactivation acknowledgement to be issued by an already deactivated or stopped service. With this update, dropwatch detects an attempt to deactivate/stop an already deactivated/stopped service and no longer hangs. All users of dropwatch are advised to upgrade to these updated packages, which fix this bug. 5.55.2. RHBA-2012:0383 - dropwatch bug fix update An updated dropwatch package that fixes one bug is now available for Red Hat Enterprise Linux 6. The dropwatch package contains a utility that provides packet monitoring services. Bug Fix BZ# 684713 Previously, the dropwatch utility could terminate unexpectedly with a segmentation fault. The failure was caused by a double-free error which occurred while issuing the start and stop messages. This update removes the freeing function calls from the underlying code, which prevents the dropwatch utility from crashing. All users of dropwatch are advised to upgrade to this updated package, which fixes this bug.

Commands:
Chapter 1. Overview of hosts in Satellite A host is any Linux client that Red Hat Satellite manages. Hosts can be physical or virtual. You can deploy virtual hosts on any platform supported by Red Hat Satellite, such as Amazon EC2, Google Compute Engine, KVM, libvirt, Microsoft Azure, OpenStack, Red Hat Virtualization, Rackspace Cloud Services, or VMware vSphere. With Satellite, you can manage hosts at scale, including monitoring, provisioning, remote execution, configuration management, software management, and subscription management. 1.1. Browsing Hosts in Satellite web UI In the Satellite web UI, you can browse all hosts recognized by Satellite, grouped by type: All Hosts - a list of all hosts recognized by Satellite. Discovered Hosts - a list of bare-metal hosts detected on the provisioning network by the Discovery plugin. Content Hosts - a list of hosts that manage tasks related to content and subscriptions. Host Collections - a list of user-defined collections of hosts used for bulk actions such as errata installation. To search for a host, type in the Search field, and use an asterisk (*) to perform a partial string search. For example, if searching for a content host named server.example.com , click the Content Hosts page and type server* in the Search field. Alternatively, *ver* will also find the content host server.example.com . Warning Satellite Server is listed as a host itself even if it is not self-registered. Do not delete Satellite Server from the list of hosts.

Commands: