Configuring basic system settings Red Hat Enterprise Linux 8 Set up the essential functions of your system and customize your system environment Red Hat Customer Content Services

Commands:
nmcli connection show NAME UUID TYPE DEVICE Wired connection 1 a5eb6490-cc20-3668-81f8-0314a27f3f75 ethernet enp1s0
nmcli connection add con-name <connection-name> ifname <device-name> type ethernet
nmcli connection modify "Wired connection 1" connection.id "Internal-LAN"
nmcli connection show Internal-LAN connection.interface-name: enp1s0 connection.autoconnect: yes ipv4.method: auto ipv6.method: auto
nmcli connection modify Internal-LAN ipv4.method auto
nmcli connection modify Internal-LAN ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200 ipv4.dns-search example.com
nmcli connection modify Internal-LAN ipv6.method auto
nmcli connection modify Internal-LAN ipv6.method manual ipv6.addresses 2001:db8:1::fffe/64 ipv6.gateway 2001:db8:1::fffe ipv6.dns 2001:db8:1::ffbb ipv6.dns-search example.com
nmcli connection modify <connection-name> <setting> <value>
nmcli connection up Internal-LAN
ip address show enp1s0 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0 valid_lft forever preferred_lft forever inet6 2001:db8:1::fffe/64 scope global noprefixroute valid_lft forever preferred_lft forever
ip route show default default via 192.0.2.254 dev enp1s0 proto static metric 102
ip -6 route show default default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium
cat /etc/resolv.conf search example.com nameserver 192.0.2.200 nameserver 2001:db8:1::ffbb
ping <host-name-or-IP-address>
nmcli device status DEVICE TYPE STATE CONNECTION enp1s0 ethernet unavailable --
nmtui
ip address show enp1s0 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0 valid_lft forever preferred_lft forever inet6 2001:db8:1::fffe/64 scope global noprefixroute valid_lft forever preferred_lft forever
ip route show default default via 192.0.2.254 dev enp1s0 proto static metric 102
ip -6 route show default default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium
cat /etc/resolv.conf search example.com nameserver 192.0.2.200 nameserver 2001:db8:1::ffbb
ping <host-name-or-IP-address>
--- - name: Configure the network hosts: managed-node-01.example.com tasks: - name: Ethernet connection profile with dynamic IP address settings ansible.builtin.include_role: name: rhel-system-roles.network vars: network_connections: - name: enp1s0 interface_name: enp1s0 type: ethernet autoconnect: yes ip: dhcp4: yes auto6: yes state: up
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m ansible.builtin.setup "ansible_default_ipv4": { "address": "192.0.2.1", "alias": "enp1s0", "broadcast": "192.0.2.255", "gateway": "192.0.2.254", "interface": "enp1s0", "macaddress": "52:54:00:17:b8:b6", "mtu": 1500, "netmask": "255.255.255.0", "network": "192.0.2.0", "prefix": "24", "type": "ether" }, "ansible_default_ipv6": { "address": "2001:db8:1::1", "gateway": "2001:db8:1::fffe", "interface": "enp1s0", "macaddress": "52:54:00:17:b8:b6", "mtu": 1500, "prefix": "64", "scope": "global", "type": "ether" }, "ansible_dns": { "nameservers": [ "192.0.2.1", "2001:db8:1::ffbb" ], "search": [ "example.com" ] },
subscription-manager register Registering to: subscription.rhsm.redhat.com:443/subscription Username: <example_username> Password: <example_password> The system has been registered with ID: 37to907c-ece6-49ea-9174-20b87ajk9ee7 The registered system name is: client1.example.com
subscription-manager list --available --all
subscription-manager attach --pool= <example_pool_id>
yum install sos
sosreport
timedatectl list-timezones Europe/Berlin
timedatectl set-timezone <time_zone>
timedatectl set-time <YYYY-mm-dd HH:MM-SS>
date Mon Mar 30 16:02:59 CEST 2020
timedatectl Local time: Mon 2020-03-30 16:04:42 CEST Universal time: Mon 2020-03-30 14:04:42 UTC RTC time: Mon 2020-03-30 14:04:41 Time zone: Europe/Prague (CEST, +0200) System clock synchronized: yes NTP service: active RTC in local TZ: no
localectl status System Locale: LANG=en_US.UTF-8 VC Keymap: de-nodeadkeys X11 Layout: de X11 Variant: nodeadkeys
localectl list-locales C.UTF-8 en_US.UTF-8 en_ZA.UTF-8 en_ZW.UTF-8
localectl set-locale LANG= en_US .UTF-8
localectl list-keymaps ANSI-dvorak al al-plisi amiga-de amiga-us
localectl status VC Keymap: us
localectl set-keymap us
cat /etc/vconsole.conf FONT="eurlatgr"
ls -1 /usr/lib/kbd/consolefonts/*.psfu.gz /usr/lib/kbd/consolefonts/eurlatgr.psfu.gz /usr/lib/kbd/consolefonts/LatArCyrHeb-08.psfu.gz /usr/lib/kbd/consolefonts/LatArCyrHeb-14.psfu.gz /usr/lib/kbd/consolefonts/LatArCyrHeb-16.psfu.gz /usr/lib/kbd/consolefonts/LatArCyrHeb-16+.psfu.gz /usr/lib/kbd/consolefonts/LatArCyrHeb-19.psfu.gz
setfont LatArCyrHeb-16.psfu.gz
FONT=LatArCyrHeb-16
reboot
ssh-keygen -t ecdsa Generating public/private ecdsa key pair. Enter file in which to save the key (/home/ <username> /.ssh/id_ecdsa): Enter passphrase (empty for no passphrase): <password> Enter same passphrase again: <password> Your identification has been saved in /home/ <username> /.ssh/id_ecdsa. Your public key has been saved in /home/ <username> /.ssh/id_ecdsa.pub. The key fingerprint is: SHA256:Q/x+qms4j7PCQ0qFd09iZEFHA+SqwBKRNaU72oZfaCI <username> @ <localhost.example.com> The key's randomart image is: +---[ECDSA 256]---+ |.oo..o=++ | |.. o .oo . | |. .. o. o | |....o.+... | |o.oo.o +S . | |.=.+. .o | |E.*+. . . . | |.=..+ +.. o | | . oo*+o. | +----[SHA256]-----+
ssh-copy-id <username> @ <ssh-server-example.com> /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed <username> @ <ssh-server-example.com> 's password: ... Number of key(s) added: 1 Now try logging into the machine, with: "ssh ' <username> @ <ssh-server-example.com> '" and check to make sure that only the key(s) you wanted were added.
ssh -o PreferredAuthentications=publickey <username> @ <ssh-server-example.com>
vi /etc/ssh/sshd_config
PasswordAuthentication no
setsebool -P use_nfs_home_dirs 1
systemctl reload sshd
vi ~/.bashrc
eval USD(ssh-agent)
AddKeysToAgent yes
ssh <example.user> @ <ssh-server@example.com>
ssh-keygen -D pkcs11: > keys.pub
ssh-copy-id -f -i keys.pub <username@ssh-server-example.com>
ssh -i "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i "pkcs11:id=%01" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i pkcs11: <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
cat ~/.ssh/config IdentityFile "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" ssh <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled) Active: inactive (dead)
systemctl enable --now firewalld
systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running)
yum install rsyslog-doc
firefox /usr/share/doc/rsyslog/html/index.html &
semanage port -a -t syslogd_port_t -p tcp 30514
firewall-cmd --zone= <zone-name> --permanent --add-port=30514/tcp success firewall-cmd --reload
Define templates before the rules that use them Per-Host templates for remote systems template(name="TmplAuthpriv" type="list") { constant(value="/var/log/remote/auth/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } template(name="TmplMsg" type="list") { constant(value="/var/log/remote/msg/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } Provides TCP syslog reception module(load="imtcp") Adding this ruleset to process remote messages ruleset(name="remote1"){ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv") *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg") } input(type="imtcp" port="30514" ruleset="remote1")
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
*.* action(type="omfwd" queue.type="linkedlist" queue.filename="example_fwd" action.resumeRetryCount="-1" queue.saveOnShutdown="on" target="example.com" port="30514" protocol="tcp" )
systemctl restart rsyslog
logger test
cat /var/log/remote/msg/ hostname /root.log Feb 25 03:53:17 hostname root[6064]: test
Set certificate files global( DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem" DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/server-cert.pem" DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/server-key.pem" ) TCP listener module( load="imtcp" PermittedPeer=["client1.example.com", "client2.example.com"] StreamDriver.AuthMode="x509/name" StreamDriver.Mode="1" StreamDriver.Name="ossl" ) Start up listener at port 514 input( type="imtcp" port="514" )
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run (level 1) rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
Set certificate files global( DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem" DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/client-cert.pem" DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/client-key.pem" ) Set up the action for all messages *.* action( type="omfwd" StreamDriver="ossl" StreamDriverMode="1" StreamDriverPermittedPeers="server.example.com" StreamDriverAuthMode="x509/name" target="server.example.com" port="514" protocol="tcp" )
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run (level 1) rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/ <hostname> /root.log Feb 25 03:53:17 <hostname> root[6064]: test
semanage port -a -t syslogd_port_t -p udp portno
firewall-cmd --zone= zone --permanent --add-port= portno /udp success firewall-cmd --reload
firewall-cmd --reload
Define templates before the rules that use them Per-Host templates for remote systems template(name="TmplAuthpriv" type="list") { constant(value="/var/log/remote/auth/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } template(name="TmplMsg" type="list") { constant(value="/var/log/remote/msg/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } Provides UDP syslog reception module(load="imudp") This ruleset processes remote messages ruleset(name="remote1"){ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv") *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg") } input(type="imudp" port="514" ruleset="remote1")
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run
systemctl restart rsyslog
systemctl enable rsyslog
*.* action(type="omfwd" queue.type="linkedlist" queue.filename=" example_fwd " action.resumeRetryCount="-1" queue.saveOnShutdown="on" target=" example.com " port=" portno " protocol="udp" )
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/ hostname /root.log Feb 25 03:53:17 hostname root[6064]: test
action(type="omfwd" protocol="tcp" RebindInterval="250" target=" example.com " port="514" ...) action(type="omfwd" protocol="udp" RebindInterval="250" target=" example.com " port="514" ...) action(type="omrelp" RebindInterval="250" target=" example.com " port="6514" ...)
module(load="omrelp") *.* action(type="omrelp" target="_target_IP_" port="_target_port_")
systemctl restart rsyslog
systemctl enable rsyslog
ruleset(name="relp"){ *.* action(type="omfile" file="_log_path_") } module(load="imrelp") input(type="imrelp" port="_target_port_" ruleset="relp")
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/hostname/root.log Feb 25 03:53:17 hostname root[6064]: test
ls /usr/lib64/rsyslog/{i,o}m *
yum install netconsole-service
SYSLOGADDR= 192.0.2.1
systemctl enable --now netconsole
--- - name: Deploy the logging solution hosts: managed-node-01.example.com tasks: - name: Filter logs based on a specific value they contain ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: files_input type: basics logging_outputs: - name: files_output0 type: files property: msg property_op: contains property_value: error path: /var/log/errors.log - name: files_output1 type: files property: msg property_op: "!contains" property_value: error path: /var/log/others.log logging_flows: - name: flow0 inputs: [files_input] outputs: [files_output0, files_output1]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
rsyslogd -N 1 rsyslogd: version 8.1911.0-6.el8, config validation run rsyslogd: End of config validation run. Bye.
logger error
cat /var/log/errors.log Aug 5 13:48:31 hostname root[6778]: error
--- - name: Deploy the logging solution hosts: managed-node-01.example.com tasks: - name: Configure the server to receive remote input ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: remote_udp_input type: remote udp_ports: [ 601 ] - name: remote_tcp_input type: remote tcp_ports: [ 601 ] logging_outputs: - name: remote_files_output type: remote_files logging_flows: - name: flow_0 inputs: [remote_udp_input, remote_tcp_input] outputs: [remote_files_output] - name: Deploy the logging solution hosts: managed-node-02.example.com tasks: - name: Configure the server to output the logs to local files in directories named by remote host names ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: basic_input type: basics logging_outputs: - name: forward_output0 type: forwards severity: info target: <host1.example.com> udp_port: 601 - name: forward_output1 type: forwards facility: mail target: <host1.example.com> tcp_port: 601 logging_flows: - name: flows0 inputs: [basic_input] outputs: [forward_output0, forward_output1] [basic_input] [forward_output0, forward_output1]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
rsyslogd -N 1 rsyslogd: version 8.1911.0-6.el8, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: End of config validation run. Bye.
logger test
cat /var/log/ <host2.example.com> /messages Aug 5 13:48:31 <host2.example.com> root[6778]: test
--- - name: Configure remote logging solution using TLS for secure transfer of logs hosts: managed-node-01.example.com tasks: - name: Deploying files input and forwards output with certs ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_certificates: - name: logging_cert dns: ['localhost', 'www.example.com'] ca: ipa logging_pki_files: - ca_cert: /local/path/to/ca_cert.pem cert: /local/path/to/logging_cert.pem private_key: /local/path/to/logging_cert.pem logging_inputs: - name: input_name type: files input_log_path: /var/log/containers/*.log logging_outputs: - name: output_name type: forwards target: your_target_host tcp_port: 514 tls: true pki_authmode: x509/name permitted_server: 'server.example.com' logging_flows: - name: flow_name inputs: [input_name] outputs: [output_name]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure remote logging solution using TLS for secure transfer of logs hosts: managed-node-01.example.com tasks: - name: Deploying remote input and remote_files output with certs ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_certificates: - name: logging_cert dns: ['localhost', 'www.example.com'] ca: ipa logging_pki_files: - ca_cert: /local/path/to/ca_cert.pem cert: /local/path/to/logging_cert.pem private_key: /local/path/to/logging_cert.pem logging_inputs: - name: input_name type: remote tcp_ports: 514 tls: true permitted_clients: ['clients.example.com'] logging_outputs: - name: output_name type: remote_files remote_log_path: /var/log/remote/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log async_writing: true client_count: 20 io_buffer_size: 8192 logging_flows: - name: flow_name inputs: [input_name] outputs: [output_name]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure client-side of the remote logging solution using RELP hosts: managed-node-01.example.com tasks: - name: Deploy basic input and RELP output ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: basic_input type: basics logging_outputs: - name: relp_client type: relp target: logging.server.com port: 20514 tls: true ca_cert: /etc/pki/tls/certs/ca.pem cert: /etc/pki/tls/certs/client-cert.pem private_key: /etc/pki/tls/private/client-key.pem pki_authmode: name permitted_servers: - '*.server.example.com' logging_flows: - name: example_flow inputs: [basic_input] outputs: [relp_client]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure server-side of the remote logging solution using RELP hosts: managed-node-01.example.com tasks: - name: Deploying remote input and remote_files output ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: relp_server type: relp port: 20514 tls: true ca_cert: /etc/pki/tls/certs/ca.pem cert: /etc/pki/tls/certs/server-cert.pem private_key: /etc/pki/tls/private/server-key.pem pki_authmode: name permitted_clients: - '*example.client.com' logging_outputs: - name: remote_files_output type: remote_files logging_flows: - name: example_flow inputs: relp_server outputs: remote_files_output
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
/usr/share/doc/setup/uidgid
Min/max values for automatic uid selection in useradd # UID_MIN 5000
Min/max values for automatic gid selection in groupadd # GID_MIN 5000
useradd example.user
passwd example.user
usermod -a -G example.group example.user
useradd <options> <username>
useradd -u 5000 sarah
id sarah
uid=5000(sarah) gid=5000(sarah) groups=5000(sarah)
groupadd options group-name
groupadd -g 5000 sysadmins
getent group sysadmin
sysadmins:x:5000:
usermod --append -G <group_name> <username>
groups <username>
mkdir <directory-name>
groupadd <group-name>
usermod --append -G <group_name> <username>
chgrp <group_name> <directory>
chmod g+rwxs <directory>
ls -ld <directory>
*drwx__rws__r-x.* 2 root _group-name_ 6 Nov 25 08:45 _directory-name_
loginctl terminate-user user-name
userdel user-name
userdel --remove --selinux-user user-name
rm -rf /var/lib/AccountsService/users/ user-name
groups user-name
groups sarah
sarah : sarah wheel developer
usermod -g <group-name> <user-name>
groups <username>
usermod --append -G <group_name> <username>
groups <username>
gpasswd -d <user-name> <group-name>
groups <username>
usermod -G <group-names> <username>
groups <username>
passwd
sudo passwd root
load_video set gfx_payload=keep insmod gzio linux (USDroot)/vmlinuz-4.18.0-80.e18.x86_64 root=/dev/mapper/rhel-root ro crash kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet initrd (USDroot)/initramfs-4.18.0-80.e18.x86_64.img USDtuned_initrd
mount -o remount,rw /sysroot
chroot /sysroot
passwd
touch /.autorelabel
exit
exit
whoami
## Next comes the main part: which users can run what software on ## which machines (the sudoers file can be shared between multiple ## systems).
<username> <hostname.example.com> =( <run_as_user> : <run_as_group> ) <path/to/command>
#includedir /etc/sudoers.d
visudo
## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL
usermod --append -G wheel <username>
sudo whoami root
visudo -f /etc/sudoers.d/ <filename>
<username> <hostname.example.com> = ( <run_as_user> : <run_as_group> ) <path/to/command>
user1 host1.example.com = /bin/dnf, /sbin/reboot
Defaults mail_always Defaults mailto=" <email@example.com> "
su <username> -
sudo whoami [sudo] password for <username> :
usage: dnf [options] COMMAND
<username> is not in the sudoers file. This incident will be reported.
<username> is not allowed to run sudo on <host.example.com>.
`Sorry, user _<username>_ is not allowed to execute '_<path/to/command>_' as root on _<host.example.com>_.`
ls -l -rwxrw----. 1 sysadmins sysadmins 2 Mar 2 08:43 file
ls -dl directory drwxr-----. 1 sysadmins sysadmins 2 Mar 2 08:43 directory
chmod <level><operation><permission> file-name
ls -l file-name
ls -dl directory-name
ls -l directory-name
ls -l my-file.txt -rw-rw-r--. 1 username username 0 Feb 24 17:56 my-file.txt
chmod go= my-file.txt
ls -l my-file.txt -rw-------. 1 username username 0 Feb 24 17:56 my-file.txt
ls -dl my-directory drwxrwx---. 2 username username 4096 Feb 24 18:12 my-directory
chmod o+rx my-directory
ls -dl my-directory drwxrwxr-x. 2 username username 4096 Feb 24 18:12 my-directory
chmod octal_value file-name
getfacl file-name
setfacl -m u: username : symbolic_value file-name
setfacl -m u:andrew:rw- group-project setfacl -m u:susan:--- group-project
getfacl group-project
file: group-project owner: root group: root user:andrew:rw- user:susan:--- group::r-- mask::rw- other::r--
umask -S
umask
umask -S <level><operation><permission>
umask octal_value
if [ USDUID -gt 199 ] && [ "id -gn" = "id -un" ]; then umask 002 else umask 022 fi
if [ USDUID -gt 199 ] && [ "/usr/bin/id -gn" = "/usr/bin/id -un" ]; then umask 002 else umask 022 fi
echo 'umask octal_value ' >> /home/ username /.bashrc
HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new home directories. If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700
Default initial "umask" value used by login(1) on non-PAM enabled systems. Default "umask" value for pam_umask(8) on PAM enabled systems. UMASK is also used by useradd(8) and newusers(8) to set the mode for new home directories if HOME_MODE is not set. 022 is the default value, but 027, or even 077, could be considered for increased privacy. There is no One True Answer here: each sysadmin must make up their mind. UMASK 022
DefaultTimeoutStartSec= required value
systemctl list-units --type service UNIT LOAD ACTIVE SUB DESCRIPTION abrt-ccpp.service loaded active exited Install ABRT coredump hook abrt-oops.service loaded active running ABRT kernel log watcher abrtd.service loaded active running ABRT Automated Bug Reporting Tool systemd-vconsole-setup.service loaded active exited Setup Virtual Console tog-pegasus.service loaded active running OpenPegasus CIM Server LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, or a generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 46 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'
systemctl list-units --type service --all
systemctl list-unit-files --type service UNIT FILE STATE abrt-ccpp.service enabled abrt-oops.service enabled abrtd.service enabled wpa_supplicant.service disabled ypbind.service disabled 208 unit files listed.
systemctl status <name> .service
systemctl is-active <name> .service
systemctl is-enabled <name> .service
systemctl list-dependencies --after <name> .service
systemctl list-dependencies --after gdm.service gdm.service ├─dbus.socket ├─getty@tty1.service ├─livesys.service ├─plymouth-quit.service ├─system.slice ├─systemd-journald.socket ├─systemd-user-sessions.service └─basic.target [output truncated]
systemctl list-dependencies --before <name> .service
systemctl list-dependencies --before gdm.service gdm.service ├─dracut-shutdown.service ├─graphical.target │ ├─systemd-readahead-done.service │ ├─systemd-readahead-done.timer │ └─systemd-update-utmp-runlevel.service └─shutdown.target ├─systemd-reboot.service └─final.target └─systemd-reboot.service
*systemctl start <systemd_unit> *
systemctl stop <name> .service
systemctl restart <name> .service
systemctl try-restart <name> .service
systemctl reload <name> .service
systemctl status <systemd_unit>
systemctl unmask <systemd_unit>
systemctl enable <systemd_unit>
systemctl disable <name> .service
systemctl mask <name> .service
systemctl get-default graphical.target
systemctl list-units --type target
systemctl set-default <name> .target
Example: systemctl set-default multi-user.target Removed /etc/systemd/system/default.target Created symlink /etc/systemd/system/default.target -> /usr/lib/systemd/system/multi-user.target
systemctl get-default multi-user.target
systemctl isolate default.target
systemctl list-units --type target
systemctl isolate <name> .target
Example: systemctl isolate multi-user.target
systemctl rescue Broadcast message from root@localhost on pts/0 (Fri 2023-03-24 18:23:15 CEST): The system is going down to rescue mode NOW!
systemctl --no-wall rescue
linux (USDroot)/vmlinuz-5.14.0-70.22.1.e19_0.x86_64 root=/dev/mapper/rhel-root ro crash kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet
linux (USDroot)/vmlinuz-5.14.0-70.22.1.e19_0.x86_64 root=/dev/mapper/rhel-root ro crash kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet systemd.unit= <name> .target
shutdown --poweroff hh:mm
shutdown --halt +m
shutdown -c
systemctl poweroff
systemctl halt
systemctl reboot
systemctl suspend
systemctl hibernate
systemctl hybrid-sleep
systemctl suspend-then-hibernate
HandlePowerKey=reboot
[org/gnome/settings-daemon/plugins/power] power-button-action=<value>
/org/gnome/settings-daemon/plugins/power/power-button-action
dconf update
chronyc
chronyc>
chronyc command
chronyd -q 'server ntp.example.com iburst' 2018-05-18T12:37:43Z chronyd version 3.3 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 +DEBUG) 2018-05-18T12:37:43Z Initial frequency -2.630 ppm 2018-05-18T12:37:48Z System clock wrong by 0.003159 seconds (step) 2018-05-18T12:37:48Z chronyd exiting
python3 /usr/share/doc/chrony/ntp2chrony.py -b -v Reading /etc/ntp.conf Reading /etc/ntp/crypto/pw Reading /etc/ntp/keys Writing /etc/chrony.conf Writing /etc/chrony.keys
yum install chrony
systemctl status chronyd chronyd.service - NTP client/server Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled) Active: active (running) since Wed 2013-06-12 22:23:16 CEST; 11h ago
systemctl start chronyd
systemctl enable chronyd
systemctl stop chronyd
systemctl disable chronyd
chronyc tracking Reference ID : CB00710F (ntp-server.example.net) Stratum : 3 Ref time (UTC) : Fri Jan 27 09:49:17 2017 System time : 0.000006523 seconds slow of NTP time Last offset : -0.000006747 seconds RMS offset : 0.000035822 seconds Frequency : 3.225 ppm slow Residual freq : 0.000 ppm Skew : 0.129 ppm Root delay : 0.013639022 seconds Root dispersion : 0.001100737 seconds Update interval : 64.2 seconds Leap status : Normal
chronyc sources 210 Number of sources = 3 MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* GPS0 0 4 377 11 -479ns[ -621ns] /- 134ns ^? a.b.c 2 6 377 23 -923us[ -924us] +/- 43ms ^ d.e.f 1 6 377 21 -2629us[-2619us] +/- 86ms
chronyc sourcestats 210 Number of sources = 1 Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev =============================================================================== abc.def.ghi 11 5 46m -0.001 0.045 1us 25us
chronyc makestep
#!/bin/sh exit 0
driftfile /var/lib/chrony/drift commandkey 1 keyfile /etc/chrony.keys initstepslew 10 client1 client3 client6 local stratum 8 manual allow <subnet>
server <server_fqdn> driftfile /var/lib/chrony/drift logdir /var/log/chrony log measurements statistics tracking keyfile /etc/chrony.keys commandkey 24 local stratum 10 initstepslew 20 ntp1.example.net allow <server_ip_address>
bindcmdaddress 0.0.0.0
bindcmdaddress ::
cmdallow 192.168.1.0/24
cmdallow 2001:db8::/64
firewall-cmd --permanent --add-port=323/udp
firewall-cmd --reload
--- - hosts: timesync-test vars: timesync_ntp_servers: - hostname: 2.rhel.pool.ntp.org pool: yes iburst: yes roles: - rhel-system-roles.timesync
ethtool -T enp1s0
hwtimestamp enp1s0 hwtimestamp eno*
server ntp.example.comlocal minpoll 0 maxpoll 0
server ntp.example.comlocal minpoll 0 maxpoll 0 xleave
clientloglimit 100000000
systemctrl restart chronyd
chronyd[4081]: Enabled HW timestamping on enp1s0 chronyd[4081]: Enabled HW timestamping on eno1
chronyc ntpdata Output: [literal,subs="+quotes,verbatim,normal"] Remote address : 203.0.113.15 (CB00710F) Remote port : 123 Local address : 203.0.113.74 (CB00714A) Leap status : Normal Version : 4 Mode : Server Stratum : 1 Poll interval : 0 (1 seconds) Precision : -24 (0.000000060 seconds) Root delay : 0.000015 seconds Root dispersion : 0.000015 seconds Reference ID : 47505300 (GPS) Reference time : Wed May 03 13:47:45 2017 Offset : -0.000000134 seconds Peer delay : 0.000005396 seconds Peer dispersion : 0.000002329 seconds Response time : 0.000152073 seconds Jitter asymmetry: +0.00 NTP tests : 111 111 1111 Interleaved : Yes Authenticated : No TX timestamping : Hardware RX timestamping : Hardware Total TX : 27 Total RX : 27 Total valid RX : 27
chronyc sourcestats Output: [literal,subs="+quotes,verbatim,normal"] . 210 Number of sources = 1 Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ntp.local 12 7 11 +0.000 0.019 +0ns 49ns .
bindaddress 203.0.113.74 hwtimestamp enp1s0 local stratum 1
systemctrl restart chronyd
chronyc -n tracking Reference ID : 0A051B0A (10.5.27.10) Stratum : 2 Ref time (UTC) : Thu Mar 08 15:46:20 2018 System time : 0.000000338 seconds slow of NTP time Last offset : +0.000339408 seconds RMS offset : 0.000339408 seconds Frequency : 2.968 ppm slow Residual freq : +0.001 ppm Skew : 3.336 ppm Root delay : 0.157559142 seconds Root dispersion : 0.001339232 seconds Update interval : 64.5 seconds Leap status : Normal
ntpstat synchronised to NTP server (10.5.27.10) at stratum 2 time correct to within 80 ms polling server every 64 s
For example: server time.example.com iburst nts server nts.netnod.se iburst nts server ptbtime1.ptb.de iburst nts
ntsdumpdir /var/lib/chrony
PEERNTP=no
systemctl restart chronyd
chronyc -N authdata Name/IP address Mode KeyID Type KLen Last Atmp NAK Cook CLen ================================================================ time.example.com NTS 1 15 256 33m 0 0 8 100 nts.netnod.se NTS 1 15 256 33m 0 0 8 100 ptbtime1.ptb.de NTS 1 15 256 33m 0 0 8 100
chronyc -N sources MS Name/IP address Stratum Poll Reach LastRx Last sample ========================================================= time.example.com 3 6 377 45 +355us[ +375us] +/- 11ms nts.netnod.se 1 6 377 44 +237us[ +237us] +/- 23ms ptbtime1.ptb.de 1 6 377 44 -170us[ -170us] +/- 22ms
ntsserverkey /etc/pki/tls/private/ <ntp-server.example.net> .key ntsservercert /etc/pki/tls/certs/ <ntp-server.example.net> .crt
chown root:chrony /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt chmod 644 /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt
firewall-cmd -permannent --add-port={323/udp,4460/tcp} firewall-cmd --reload
systemctl restart chronyd
chronyd -Q -t 3 'server ntp-server.example.net iburst nts maxsamples 1' 2021-09-15T13:45:26Z chronyd version 4.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG) 2021-09-15T13:45:26Z Disabled control of system clock 2021-09-15T13:45:28Z System clock wrong by 0.002205 seconds (ignored) 2021-09-15T13:45:28Z chronyd exiting
chronyc serverstats NTP packets received : 7 NTP packets dropped : 0 Command packets received : 22 Command packets dropped : 0 Client log records dropped : 0 NTS-KE connections accepted: 1 NTS-KE connections dropped : 0 Authenticated NTP packets: 7
yum list langpacks- *
yum list installed langpacks *
yum list available langpacks *
yum repoquery --whatsupplements langpacks-<locale_code>
yum install langpacks-<locale_code>
yum remove langpacks-<locale_code>
yum install glibc-langpack-<locale_code>
sudo grubby --update-kernel ALL --args crashkernel=512M
--- - hosts: kdump-test vars: kdump_path: /var/crash roles: - rhel-system-roles.kdump
yum install rear
vi /etc/rear/local.conf
BACKUP=NETFS BACKUP_URL= backup.location
NETFS_KEEP_OLD_BACKUP_COPY=y
BACKUP_TYPE=incremental
rear mkrescue
rear mkbackuponly
rear mkbackup
BACKUP=NETFS BACKUP_URL=nfs:// <nfsserver name> / <share path>
rear mkbackup
virtualenv -p python3.11 venv3.11 Running virtualenv with interpreter /usr/bin/python3.11 ERROR: Virtual environments created by virtualenv < 20 are not compatible with Python 3.11. ERROR: Use python3.11 -m venv instead.
yum install python3
yum install python38
yum install python39
yum install python3.11
yum install python3.12
python3 --version
python3.8 --version
python3.9 --version
python3.11 --version
python3.12 --version
yum install python3-requests
yum install python38-Cython
yum install python39-pip
yum install python3.11-pip
yum install python3.12-pip
subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms
yum module enable python39-devel
yum install python3-pytest
yum install python38-pytest
yum install python39-pytest
yum install python3.11-pytest
yum install python3.12-pytest
yum install python2
yum install python2-requests
yum install python2-Cython
python2 --version
python3 python3 -m venv --help python3 -m pip install package pip3 install package
python3.8 python3.8 -m venv --help python3.8 -m pip install package pip3.8 install package
python3.9 python3.9 -m venv --help python3.9 -m pip install package pip3.9 install package
python3.11 python3.11 -m venv --help python3.11 -m pip install package pip3.11 install package
python3.12 python3.12 -m venv --help python3.12 -m pip install package pip3.12 install package
python2 python2 -m pip install package pip2 install package
alternatives --set python /usr/bin/python3
alternatives --set python /usr/bin/python3.8
alternatives --set python /usr/bin/python3.9
alternatives --set python /usr/bin/python3.11
alternatives --set python /usr/bin/python3.12
alternatives --set python /usr/bin/python2
alternatives --config python
alternatives --auto python
%global modname detox 1 Name: python3-detox 2 Version: 0.12 Release: 4%{?dist} Summary: Distributing activities of the tox tool License: MIT URL: https://pypi.io/project/detox Source0: https://pypi.io/packages/source/d/%{modname}/%{modname}-%{version}.tar.gz BuildArch: noarch BuildRequires: python36-devel 3 BuildRequires: python3-setuptools BuildRequires: python36-rpm-macros BuildRequires: python3-six BuildRequires: python3-tox BuildRequires: python3-py BuildRequires: python3-eventlet %?python_enable_dependency_generator 4 %description Detox is the distributed version of the tox python testing tool. It makes efficient use of multiple CPUs by running all possible activities in parallel. Detox has the same options and configuration that tox has, so after installation you can run it in the same way and with the same options that you use for tox. USD detox %prep %autosetup -n %{modname}-%{version} %build %py3_build 5 %install %py3_install %check %{__python3} setup.py test 6 %files -n python3-%{modname} %doc CHANGELOG %license LICENSE %{_bindir}/detox %{python3_sitelib}/%{modname}/ %{python3_sitelib}/%{modname}-%{version}* %changelog
#!/usr/bin/python3 #!/usr/bin/python3.6 #!/usr/bin/python3.8 #!/usr/bin/python3.9 #!/usr/bin/python3.11 #!/usr/bin/python3.12 #!/usr/bin/python2
#!/usr/bin/python
#!/usr/bin/env python
pathfix.py -pn -i %{__python3} PATH ...
BuildRequires: python36-rpm-macros
%undefine __brp_mangle_shebangs
yum module install php: stream
yum module install php:8.0
yum module install php: stream/profile
yum module install php:8.0/minimal
yum module install httpd:2.4
systemctl start httpd
systemctl restart httpd
systemctl start php-fpm
systemctl enable php-fpm httpd
echo '<?php phpinfo(); ?>' > /var/www/html/index.php
http://<hostname>/
mkdir hello
<!DOCTYPE html> <html> <head> <title>Hello, World! Page</title> </head> <body> <?php echo 'Hello, World!'; ?> </body> </html>
systemctl start httpd
http://<hostname>/hello/hello.php
yum module install nginx: stream
yum module install nginx:1.18
systemctl start nginx
systemctl restart nginx
systemctl start php-fpm
systemctl enable php-fpm nginx
echo '<?php phpinfo(); ?>' > /usr/share/nginx/html/index.php
http://<hostname>/
mkdir hello
<!DOCTYPE html> <html> <head> <title>Hello, World! Page</title> </head> <body> <?php echo 'Hello, World!'; ?> </body> </html>
systemctl start nginx
http://<hostname>/hello/hello.php
php filename .php
<?php echo 'Hello, World!'; ?>
php hello.php
Tcl_GetErrorLine(interp)
include <tcl.h> if !defined(Tcl_GetErrorLine) define Tcl_GetErrorLine(interp) (interp->errorLine) endif
tkIconList_Arrange tkIconList_AutoScan tkIconList_Btn1 tkIconList_Config tkIconList_Create tkIconList_CtrlBtn1 tkIconList_Curselection tkIconList_DeleteAll tkIconList_Double1 tkIconList_DrawSelection tkIconList_FocusIn tkIconList_FocusOut tkIconList_Get tkIconList_Goto tkIconList_Index tkIconList_Invoke tkIconList_KeyPress tkIconList_Leave1 tkIconList_LeftRight tkIconList_Motion1 tkIconList_Reset tkIconList_ReturnKey tkIconList_See tkIconList_Select tkIconList_Selection tkIconList_ShiftBtn1 tkIconList_UpDown