mtpti5iD/redhat-docs_dataset huggingface dataset:
22.16.6. Adding a Manycast Client Address To add a manycast client address, that is to say, to configure a multicast address to be used for NTP server discovery, make use of the manycastclient command in the ntp.conf file. The manycastclient command takes the following form: manycastclient address where address is an IP multicast address from which packets are to be received. The client will send a request to the address and select the best servers from the responses and ignore other servers. NTP communication then uses unicast associations, as if the discovered NTP servers were listed in ntp.conf . This command configures a system to act as an NTP client. Systems can be both client and server at the same time.

Commands:
4.214. pam 4.214.1. RHEA-2011:1732 - pam enhancement update Updated pam packages that add one enhancement are now available for Red Hat Enterprise Linux. Pluggable Authentication Modules (PAM) provide a system for administrators to set up authentication policies without the need to recompile programs to handle authentication. Enhancement BZ# 727286 With this update, the libraries are recompiled with the partial read only relocation (RELRO) flag to enhance the security of applications that use the libraries. All pam users are advised to upgrade to these updated packages, which add this enhancement. 4.214.2. RHEA-2012:0482 - pam enhancement update Updated pam packages that add one enhancement are now available for Red Hat Enterprise Linux 6. Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Enhancement BZ# 809370 The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password. All users of pam are advised to upgrade to these updated packages, which add this enhancement.

Commands:
26.2. Authentication The Authentication tab allows for the configuration of network authentication methods. To enable an option, click the empty checkbox beside it. To disable an option, click the checkbox beside it to clear the checkbox. Figure 26.2. Authentication The following explains what each option configures: Enable Kerberos Support - Select this option to enable Kerberos authentication. Click the Configure Kerberos button to configure: Realm - Configure the realm for the Kerberos server. The realm is the network that uses Kerberos, composed of one or more KDCs and a potentially large number of clients. KDC - Define the Key Distribution Center (KDC), which is the server that issues Kerberos tickets. Admin Servers - Specify the administration server(s) running kadmind . The krb5-libs and krb5-workstation packages must be installed for this option to work. Refer to the Reference Guide for more information on Kerberos. Enable LDAP Support - Select this option to have standard PAM-enabled applications use LDAP for authentication. Click the Configure LDAP button to specify the following: Use TLS to encrypt connections - Use Transport Layer Security to encrypt passwords sent to the LDAP server. LDAP Search Base DN - Retrieve user information by its Distinguished Name (DN). LDAP Server - Specify the IP address of the LDAP server. The openldap-clients package must be installed for this option to work. Refer to the Reference Guide for more information about LDAP. Use Shadow Passwords - Select this option to store passwords in shadow password format in the /etc/shadow file instead of /etc/passwd . Shadow passwords are enabled by default during installation and are highly recommended to increase the security of the system. The shadow-utils package must be installed for this option to work. For more information about shadow passwords, refer to the Users and Groups chapter in the Reference Guide . Enable SMB Support - This option configures PAM to use an SMB server to authenticate users. Click the Configure SMB button to specify: Workgroup - Specify the SMB workgroup to use. Domain Controllers - Specify the SMB domain controllers to use. Winbind - Select this option to configure the system to connect to a Windows Active Directory or a Windows domain controller. User information can be accessed, as well as server authentication options can be configured. Use MD5 Passwords - Select this option to enable MD5 passwords, which allows passwords to be up to 256 characters instead of eight characters or less. It is selected by default during installation and is highly recommended for increased security.

Commands:
15.3. Importing an Intermediate Certificate Chain Before beginning, please change directories into the NSS DB: cd /path/to/nssdb Ensure that your web service is offline (stopped, disabled, etc.) while performing these steps and ensure no concurrent access to the NSS DB by other processes (such as a browser). Doing so may corrupt the NSS DB or result in improper usage of these certificates. If you have not imported and trusted the root certificate, see Section 15.2, "Importing a Root Certificate" . When given a series of intermediate certificates between your root and end server or client certificates, we need to import and validate the signed certificate chain in order from closest to furthest from the root CA certificate. We assume the Intermediate CAs are in files named ca_sub_<num>.crt (for example ca_sub_1.crt , ca_sub_2.crt , and so on). Substitute names and paths for your certificates as appropriate to your deployment. Note In the unlikely scenario that you are instead given a single file named fullchain.crt , fullchain.pem , or similar and it contains multiple certificates, split it into the above format by copying each block (between and including the ----BEGIN CERTIFICATE----- and an -----END CERTIFICATE----- markers) to its own file. The first ones should be named ca_sub_<num>.crt and the last will be your server cert named service.crt . Server certificates are discussed in later sections. First, we will import and validate any intermediate CAs in order of closest to furthest from the root CA certificate. If you don't have any, you can skip to the section. For more information about the certutil and PKICertImport options used below, see Section 15.1, "About certutil and PKICertImport " . For every intermediate certificate in the chain: Execute PKICertImport -d . -n "CA Sub USDnum" -t "CT,C,C" -a -i ca_sub_USDnum.crt -u L This command validates and imports the Intermediate CA certificate into your NSS DB. The validation succeeds when no error message is printed and the return code is 0. To check the return code, execute echo USD? immediately after executing the command above. In most cases, a visual error message is printed. If the validation does not succeed, contact the issuer and ensure that all intermediate and root certificates are present on your system.

Commands:
Chapter 4. Upgrading Red Hat build of Keycloak adapters After you upgrade the Red Hat build of Keycloak server, you can upgrade the adapters. Earlier versions of the adapter might work with later versions of the Red Hat build of Keycloak server, but earlier versions of the Red Hat build of Keycloak server might not work with later versions of the adapter. 4.1. Compatibility with older adapters Newer versions of the Red Hat build of Keycloak server potentially work with older versions of the adapters. However, some fixes of the Red Hat build of Keycloak server may break compatibility with older versions of the adapters. For example, a new implementation of the OpenID Connect specification may not match older client adapter versions. For this situation, you can use Compatibility modes. For OpenID Connect clients, the Admin Console includes OpenID Connect Compatibility Modes on the page with client details. With this option, you can disable some new aspects of the Red Hat build of Keycloak server to preserve compatibility with older client adapters. For more details, see the tool tips of individual switches. 4.2. Upgrading the EAP adapter To upgrade the JBoss EAP adapter, complete the following steps: Procedure Download the new adapter archive. Remove the adapter modules by deleting the EAP_HOME/modules/system/add-ons/keycloak/ directory. Unzip the downloaded archive into EAP_HOME . 4.3. Upgrading the JavaScript adapter To upgrade a JavaScript adapter that has been copied to your web application, perform the following procedure. Procedure Download the new adapter archive. Overwrite the keycloak.js file in your application with the keycloak.js file from the downloaded archive. 4.4. Upgrading the Node.js adapter To upgrade a Node.js adapter that has been copied to your web application, perform the following procedure. Procedure Download the new adapter archive. Remove the existing Node.js adapter directory Unzip the updated file into its place Change the dependency for keycloak-connect in the package.json of your application

Commands:
Chapter 12. Network Time Protocol You need to ensure that systems within your Red Hat OpenStack Platform cluster have accurate and consistent timestamps between systems. Red Hat OpenStack Platform on Red Hat Enterprise Linux 9 supports Chrony for time management. For more information, see Using the Chrony suite to configure NTP . 12.1. Why consistent time is important Consistent time throughout your organization is important for both operational and security needs: Identifying a security event Consistent timekeeping helps you correlate timestamps for events on affected systems so that you can understand the sequence of events. Authentication and security systems Security systems can be sensitive to time skew, for example: A kerberos-based authentication system might refuse to authenticate clients that are affected by seconds of clock skew. Transport layer security (TLS) certificates depend on a valid source of time. A client to server TLS connection fails if the difference between client and server system times exceeds the Valid From date range. Red Hat OpenStack Platform services Some core OpenStack services are especially dependent on accurate timekeeping, including High Availability (HA) and Ceph. 12.2. NTP design Network time protocol (NTP) is organized in a hierarchical design. Each layer is called a stratum. At the top of the hierarchy are stratum 0 devices such as atomic clocks. In the NTP hierarchy, stratum 0 devices provide reference for publicly available stratum 1 and stratum 2 NTP time servers. Do not connect your data center clients directly to publicly available NTP stratum 1 or 2 servers. The number of direct connections would put unnecessary strain on the public NTP resources. Instead, allocate a dedicated time server in your data center, and connect the clients to that dedicated server. Configure instances to receive time from your dedicated time servers, not the host on which they reside. Note Service containers running within the Red Hat OpenStack Platform environment still receive time from the host on which they reside.

Commands:
3.2. Modeling Your Source Metadata When you model the Source Metadata within your enterprise information systems, you capture some detailed information, including: Identification of datatype Storage formats Constraints Source-specific locations and names The Source Metadata captures this detailed technical metadata to provide a map of the data, the location of the data, and how you access it. This collection of Source Metadata comprises a direct mapping of the information sources within your enterprise. If you use the JBoss Data Virtualization Server for information integration, this technical metadata plays an integral part in query resolution. For example, our ZIPCode column and its parent table StreetAddress map directly to fields within our hypothetical address book database. To extend our example, we might have a second source of information, a comma separated text file provided by a marketing research vendor. This text file can supply additional demographic information based upon address or ZIP code. This text file would represent another Enterprise Information System (EIS), and the meta objects in its Source Model would describe each comma separated value.

Commands:
Chapter 5. Using the Management CLI with a Managed Domain You can use the management CLI to configure and manage both standalone servers and managed domains. The JBoss EAP documentation usually shows examples of management CLI commands for a standalone server configuration. If you are running a managed domain instead, you often need to adjust the command. The following sections describe how to change standalone server management CLI commands for a managed domain configuration. Specify the Profile for Subsystem Configuration The management CLI commands for standalone server subsystem configuration begin with /subsystem= SUBSYSTEM_NAME . For managed domain subsystem configuration, you must specify which profile's subsystem to configure by starting the command with /profile= PROFILE_NAME /subsystem= SUBSYSTEM_NAME . Example: Read the Logging Subsystem Configuration (Standalone Server) This example shows how to read the configuration of the logging subsystem for a standalone server. Example: Read the Logging Subsystem Configuration (Managed Domain) This example shows how to read the configuration of the logging subsystem for a the default profile in a managed domain. Specify the Host for Core Management and Runtime Commands Some core management and runtime commands for a managed domain require you to specify the host that the command applies to by starting the command with /host= HOST_NAME . Example: Enable Audit Logging (Standalone Server) This example shows how to enable audit logging for a standalone server. Example: Enable Audit Logging (Managed Domain) This example shows how to enable audit logging for the master host in a managed domain. Note Some commands require the host as an argument, for example, reload --host= HOST_NAME . If you do not specify a host for these commands, an error message notifies you that the --host argument is required. Specify the Server for Core Management and Runtime Commands Some core management and runtime commands for a managed domain require you to specify the host and server that the command applies to by starting the command with /host= HOST_NAME /server= SERVER_NAME . Example: Display Runtime Metrics for a Deployment (Standalone Server) This example shows how to display runtime metrics for a standalone server deployment. Example: Display Runtime Metrics for a Deployment (Managed Domain) This example shows how to display runtime metrics for a managed domain deployment that is deployed to the server-one server on the master host.

Commands:
/subsystem=logging:read-resource
/profile=default/subsystem=logging:read-resource
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
/host=master/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
/deployment=test-application.war/subsystem=undertow:read-attribute(name=active-sessions)
/host=master/server=server-one/deployment=test-application.war/subsystem=undertow:read-attribute(name=active-sessions)
8.124. nfs-utils 8.124.1. RHBA-2013:1714 - nfs-utils bug fix and enhancement update Updated nfs-utils packages that fix several bugs and add various enhancements are now available. The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools such as the mount.nfs, umount.nfs, and showmount. Bug Fixes BZ# 889272 When the "Background", "Foreground" or "timeo" options were set in multiple sections of the nfsmount.conf configuration file, each of those options were incorrectly present in the resulting parsed values. This update changes this behavior so that the first instance of either option overrides any ones. In addition, configuration file options could have been incorrectly passed to the mount syscall from sections that were not relevant to the options that were being performed. The parser has been made more strict so that each option can appear at most four times: once for the system section, once for the server-specific section, once for the mount-specific section, and once for the command line mount options. BZ# 890146 Prior to this update, running "nfsstat -s -o rpc" command produced output with incorrect labels in a table header. With this update, the underlying source code has been adapted to make sure that all columns now have the correct name. BZ# 892235 Starting the nfs service resulted in the following output: Although the sequence of events of having to first stop and then start the RPC idmapd service was previously necessary, the current init scripts do not require this behavior. This has been corrected so that starting the nfs service now simply results in a single "Starting RPC idmapd" status display. BZ# 950324 When running sm-notify, specifying the "-v <ip_address>" or "-v <hostname>" option did not work correctly after the nfs-utils packages were updated to version 1.2.2, which was the first version that included support for IPv6. This update corrects the address handling logic so that specifying a hostname, IPv4 or IPv6 IP address with the '-v' option works as expected. BZ# 952560 The nfs(5) manual page contained incorrect information about the "retrans=n" option, by which specifies the number of times an NFS client will retry a request before it attempts a further recovery action. This information has been corrected and now specifies the number of attempts by protocol type. The man page correction for the "retrans=n" option is: The number of times the NFS client retries a request before it attempts further recovery action. If the retrans option is not specified, the NFS client tries each request three times with mounts using UDP and two times with mounts using TCP. Users of nfs-utils are advised to upgrade to these updated packages, which fix these bugs and add various enhancements.

Commands:
Stopping RPC idmapd: [ OK ] Starting RPC idmapd: [ OK ]
Part II. Managing Confined Services This part of the book focuses more on practical tasks and provides information how to set up and configure various services. For each service, there are listed the most common types and Booleans with the specifications. Also included are real-world examples of configuring those services and demonstrations of how SELinux complements their operation. When SELinux is in enforcing mode, the default policy used in Red Hat Enterprise Linux, is the targeted policy. Processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. See Chapter 3, Targeted Policy for more information about targeted policy and confined and unconfined processes.

Commands:
Chapter 5. OS/JVM certifications This release is supported for use with the following operating system and Java Development Kit (JDK) versions: Operating System Chipset Architecture Java Virtual Machine Red Hat Enterprise Linux 9 x86_64 Red Hat OpenJDK 11, Red Hat OpenJDK 17, Oracle JDK 11, Oracle JDK 17 Red Hat Enterprise Linux 8 x86_64 Red Hat OpenJDK 11, Red Hat OpenJDK 17, Oracle JDK 11, Oracle JDK 17 Microsoft Windows 2019 Server x86_64 Red Hat OpenJDK 11, Red Hat OpenJDK 17, Oracle JDK 11, Oracle JDK 17 Note Red Hat Enterprise Linux 7 and Microsoft Windows 2016 Server are not supported.

Commands:
3.3. Additional Resources For more information about security updates, ways of applying them, the Red Hat Customer Portal, and related topics, see the resources listed below. Installed Documentation yum (8) - The manual page for the Yum package manager provides information about the way Yum can be used to install, update, and remove packages on your systems. rpmkeys (8) - The manual page for the rpmkeys utility describes the way this program can be used to verify the authenticity of downloaded packages. Online Documentation Red Hat Enterprise Linux 7 System Administrator's Guide - The System Administrator's Guide for Red Hat Enterprise Linux 7 documents the use of the Yum and rpm commands that are used to install, update, and remove packages on Red Hat Enterprise Linux 7 systems. Red Hat Enterprise Linux 7 SELinux User's and Administrator's Guide - The SELinux User's and Administrator's Guide for Red Hat Enterprise Linux 7 documents the configuration of the SELinux mandatory access control mechanism. Red Hat Customer Portal Red Hat Customer Portal, Security - The Security section of the Customer Portal contains links to the most important resources, including the Red Hat CVE database, and contacts for Red Hat Product Security. Red Hat Security Blog - Articles about latest security-related issues from Red Hat security professionals. See Also Chapter 2, Security Tips for Installation describes how to configure your system securely from the beginning to make it easier to implement additional security settings later. Section 4.9.2, "Creating GPG Keys" describes how to create a set of personal GPG keys to authenticate your communications.

Commands:
Chapter 43. Installation and Booting Multi-threaded xz compression in rpm-build Compression can take long time for highly parallel builds as it currently uses only one core. This is problematic especially for continuous integration of large projects that are built on hardware with many cores. This feature, which is provided as a Technology Preview, enables multi-threaded xz compression for source and binary packages when setting the %_source_payload or %_binary_payload macros to the wLTX.xzdio pattern . In it, L represents the compression level, which is 6 by default, and X is the number of threads to be used (may be multiple digits), for example w6T12.xzdio . This can be done by editing the /usr/lib/rpm/macros file or by declaring the macro within the spec file or at the command line. (BZ#1278924)

Commands:
10.4. Payment Card Industry Data Security Standard (PCI DSS) From https://www.pcisecuritystandards.org/about/index.shtml : The PCI Security Standards Council is an open global forum, launched in 2006, that is responsible for the development, management, education, and awareness of the PCI Security Standards, including the Data Security Standard (DSS). You can download the PCI DSS standard from https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml .

Commands: