mtpti5iD/redhat-docs_dataset huggingface dataset:
Chapter 4. Gaining Privileges System administrators (and in some cases users) will need to perform certain tasks with administrative access. Accessing the system as root is potentially dangerous and can lead to widespread damage to the system and data. This chapter covers ways to gain administrative privileges using the su and sudo programs. These programs allow specific users to perform tasks which would normally be available only to the root user while maintaining a higher level of control and system security. See the Red Hat Enterprise Linux 6 Security Guide for more information on administrative controls, potential dangers and ways to prevent data loss resulting from improper use of privileged access. 4.1. The su Command When a user executes the su command, they are prompted for the root password and, after authentication, are given a root shell prompt. Once logged in via the su command, the user is the root user and has absolute administrative access to the system [1] . In addition, once a user has become root, it is possible for them to use the su command to change to any other user on the system without being prompted for a password. Because this program is so powerful, administrators within an organization may want to limit who has access to the command. One of the simplest ways to do this is to add users to the special administrative group called wheel . To do this, type the following command as root: In the command, replace username with the user name you want to add to the wheel group. You can also use the User Manager to modify group memberships, as follows. Note: you need Administrator privileges to perform this procedure. Click the System menu on the Panel, point to Administration and then click Users and Groups to display the User Manager. Alternatively, type the command system-config-users at a shell prompt. Click the Users tab, and select the required user in the list of users. Click Properties on the toolbar to display the User Properties dialog box (or choose Properties on the File menu). Click the Groups tab, select the check box for the wheel group, and then click OK . See Section 3.2, "Managing Users via the User Manager Application" for more information about the User Manager . After you add the desired users to the wheel group, it is advisable to only allow these specific users to use the su command. To do this, you will need to edit the PAM configuration file for su : /etc/pam.d/su . Open this file in a text editor and remove the comment ( # ) from the following line: This change means that only members of the administrative group wheel can switch to another user using the su command. Note The root user is part of the wheel group by default. [1] This access is still subject to the restrictions imposed by SELinux, if it is enabled.

Commands:
~]# usermod -a -G wheel username
#auth required pam_wheel.so use_uid
Chapter 9. jdbc 9.1. jdbc:ds-create 9.1.1. Description Create a JDBC datasource config for pax-jdbc-config from a DataSourceFactory 9.1.2. Syntax jdbc:ds-create [options] name 9.1.3. Arguments Name Description name The JDBC datasource name 9.1.4. Options Name Description -p, --password The database password --help Display this help message -dt, --databaseType The database type (ConnectionPoolDataSource, XADataSource or DataSource) -dbName Database name to use -dn, --driverName org.osgi.driver.name property of the DataSourceFactory -url The JDBC URL to use -dc, --driverClass org.osgi.driver.class property of the DataSourceFactory -u, --username The database username 9.2. jdbc:ds-delete 9.2.1. Description Delete a JDBC datasource 9.2.2. Syntax jdbc:ds-delete [options] name 9.2.3. Arguments Name Description name The JDBC datasource name (the one used at creation time) 9.2.4. Options Name Description --help Display this help message 9.3. jdbc:ds-factories 9.3.1. Description List the JDBC DataSourceFactories 9.3.2. Syntax jdbc:ds-factories [options] 9.3.3. Options Name Description --help Display this help message 9.4. jdbc:ds-info 9.4.1. Description Display details about a JDBC datasource 9.4.2. Syntax jdbc:ds-info [options] datasource 9.4.3. Arguments Name Description datasource The JDBC datasource name 9.4.4. Options Name Description --help Display this help message 9.5. jdbc:ds-list 9.5.1. Description List the JDBC datasources 9.5.2. Syntax jdbc:ds-list [options] 9.5.3. Options Name Description --help Display this help message 9.6. jdbc:execute 9.6.1. Description Execute a SQL command on a given JDBC datasource 9.6.2. Syntax jdbc:execute [options] datasource command 9.6.3. Arguments Name Description datasource The JDBC datasource command The SQL command to execute 9.6.4. Options Name Description --help Display this help message 9.7. jdbc:query 9.7.1. Description Execute a SQL query on a JDBC datasource 9.7.2. Syntax jdbc:query [options] datasource query 9.7.3. Arguments Name Description datasource The JDBC datasource to use query The SQL query to execute 9.7.4. Options Name Description --help Display this help message 9.8. jdbc:tables 9.8.1. Description List the tables on a given JDBC datasource 9.8.2. Syntax jdbc:tables [options] datasource 9.8.3. Arguments Name Description datasource The JDBC datasource to use 9.8.4. Options Name Description --help Display this help message

Commands:
Chapter 28. Using Metering on AMQ Streams You can use the Metering tool that is available on OpenShift to generate metering reports from different data sources. As a cluster administrator, you can use metering to analyze what is happening in your cluster. You can either write your own, or use predefined SQL queries to define how you want to process data from the different data sources you have available. Using Prometheus as a default data source, you can generate reports on pods, namespaces, and most other OpenShift resources. You can also use the OpenShift Metering operator to analyze your installed AMQ Streams components to determine whether you are in compliance with your Red Hat subscription. To use metering with AMQ Streams, you must first install and configure the Metering operator on OpenShift Container Platform. 28.1. Metering resources Metering has many resources which can be used to manage the deployment and installation of metering, as well as the reporting functionality metering provides. Metering is managed using the following CRDs: Table 28.1. Metering resources Name Description MeteringConfig Configures the metering stack for deployment. Contains customizations and configuration options to control each component that makes up the metering stack. Reports Controls what query to use, when, and how often the query should be run, and where to store the results. ReportQueries Contains the SQL queries used to perform analysis on the data contained within ReportDataSources . ReportDataSources Controls the data available to ReportQueries and Reports. Allows configuring access to different databases for use within metering. 28.2. Metering labels for AMQ Streams The following table lists the metering labels for AMQ Streams infrastructure components and integrations. Table 28.2. Metering Labels Label Possible values com.company Red_Hat rht.prod_name Red_Hat_Application_Foundations rht.prod_ver 2023.Q3 rht.comp AMQ_Streams rht.comp_ver 2.5 rht.subcomp Infrastructure cluster-operator entity-operator topic-operator user-operator zookeeper Application kafka-broker kafka-connect kafka-connect-build kafka-mirror-maker2 kafka-mirror-maker cruise-control kafka-bridge kafka-exporter drain-cleaner rht.subcomp_t infrastructure application Examples Infrastructure example (where the infrastructure component is entity-operator ) com.company=Red_Hat rht.prod_name=Red_Hat_Application_Foundations rht.prod_ver=2023.Q3 rht.comp=AMQ_Streams rht.comp_ver=2.5 rht.subcomp=entity-operator rht.subcomp_t=infrastructure Application example (where the integration deployment name is kafka-bridge ) com.company=Red_Hat rht.prod_name=Red_Hat_Application_Foundations rht.prod_ver=2023.Q3 rht.comp=AMQ_Streams rht.comp_ver=2.5 rht.subcomp=kafka-bridge rht.subcomp_t=application

Commands:
com.company=Red_Hat rht.prod_name=Red_Hat_Application_Foundations rht.prod_ver=2023.Q3 rht.comp=AMQ_Streams rht.comp_ver=2.5 rht.subcomp=entity-operator rht.subcomp_t=infrastructure
com.company=Red_Hat rht.prod_name=Red_Hat_Application_Foundations rht.prod_ver=2023.Q3 rht.comp=AMQ_Streams rht.comp_ver=2.5 rht.subcomp=kafka-bridge rht.subcomp_t=application
Chapter 8. Configuring external user groups Satellite does not associate external users with their user group automatically. You must create a user group with the same name as in the external source on Satellite. Members of the external user group then automatically become members of the Satellite user group and receive the associated permissions. The configuration of external user groups depends on the type of external authentication. To assign additional permissions to an external user, add this user to an internal user group that has no external mapping specified. Then assign the required roles to this group. Prerequisites If you use an LDAP server, configure Satellite to use LDAP authentication. For more information, see Chapter 6, Configuring an LDAP server as an external identity provider for Satellite . When using external user groups from an LDAP source, you cannot use the USDlogin variable as a substitute for the account user name. You must use either an anonymous or dedicated service user. If you use a Identity Management or AD server, configure Satellite to use Identity Management or AD authentication. For more information, see Configuring External Authentication in Installing Satellite Server in a connected network environment . Ensure that at least one external user authenticates for the first time. Retain a copy of the external group names you want to use. To find the group membership of external users, enter the following command: Procedure In the Satellite web UI, navigate to Administer > User Groups , and click Create User Group . Specify the name of the new user group. Do not select any users to avoid adding users automatically when you refresh the external user group. Click the Roles tab and select the roles you want to assign to the user group. Alternatively, select the Administrator checkbox to assign all available permissions. Click the External groups tab, then click Add external user group , and select an authentication source from the Auth source drop-down menu. Specify the exact name of the external group in the Name field. Click Submit .

Commands:
id username
Chapter 11. Remotely accessing the desktop as a single user You can remotely connect to the desktop on a RHEL server using graphical GNOME applications. Only a single user can connect to the desktop on the server at a given time. 11.1. Enabling desktop sharing on the server using GNOME This procedure configures a RHEL server to enable a remote desktop connection from a single client. Prerequisites The GNOME Remote Desktop service is installed: Procedure Configure a firewall rule to enable VNC access to the server: Reload firewall rules: Open Settings in GNOME. Navigate to the Sharing menu: Click Screen Sharing . The screen sharing configuration opens: Click the switch button in the window header to enable screen sharing: Select the Allow connections to control the screen check box. Under Access Options , select the Require a password option. Set a password in the Password field. Remote clients must enter this password when connecting to the desktop on the server. 11.2. Connecting to a shared desktop using GNOME This procedure connects to a remote desktop session using the Connections application. It connects to the graphical session of the user that is currently logged in on the server. Prerequisites A user is logged into the GNOME graphical session on the server. The desktop sharing is enabled on the server. Procedure Install the Connections application on the client: Launch the Connections application. Click the + button to open a new connection. Enter the IP address of the server. Choose the connection type based on the operating system you want to connect to. Click Connect . Verification On the client, check that you can see the shared server desktop. On the server, a screen sharing indicator appears on the right side of the top panel: You can control the screen sharing in the system menu. 11.3. Disabling encryption in GNOME VNC You can disable encryption in the GNOME remote desktop solution. This enables VNC clients that do not support the encryption to connect to the server. Procedure As the server user, set the encryption key of org.gnome.desktop.remote-desktop.vnc GSettings schema to ['none'] . Optional: Red Hat recommends that you tunnel the VNC connection over SSH to your VNC port. As a result, the SSH tunnel keeps the connection encrypted. For example: On the client, configure the port forwarding. Connect to the VNC session on the localhost:5901 address.

Commands:
dnf install gnome-remote-desktop
firewall-cmd --permanent --add-service=vnc-server success
firewall-cmd --reload success
dnf install gnome-connections
gsettings set org.gnome.desktop.remote-desktop.vnc encryption "['none']"
ssh -N -T -L 5901: server-ip-address :5901 user@server-ip-address
Chapter 7. User Access settings in the Red Hat Hybrid Cloud Console User Access is the Red Hat implementation of role-based access control (RBAC). Your Organization Administrator uses User Access to configure what users can see and do on the Red Hat Hybrid Cloud Console (the console): Control user access by organizing roles instead of assigning permissions individually to users. Create groups that include roles and their corresponding permissions. Assign users to these groups, allowing them to inherit the permissions associated with their group's roles. 7.1. Predefined User Access groups and roles To make groups and roles easier to manage, Red Hat provides two predefined groups and a set of predefined roles. 7.1.1. Predefined groups The Default access group contains all users in your organization. Many predefined roles are assigned to this group. It is automatically updated by Red Hat. Note If the Organization Administrator makes changes to the Default access group its name changes to Custom default access group and it is no longer updated by Red Hat. The Default admin access group contains only users who have Organization Administrator permissions. This group is automatically maintained and users and roles in this group cannot be changed. On the Hybrid Cloud Console navigate to Red Hat Hybrid Cloud Console > the Settings icon (⚙) > Identity & Access Management > User Access > Groups to see the current groups in your account. This view is limited to the Organization Administrator. 7.1.2. Predefined roles assigned to groups The Default access group contains many of the predefined roles. Because all users in your organization are members of the Default access group, they inherit all permissions assigned to that group. The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their name. On the Hybrid Cloud Console navigate to Red Hat Hybrid Cloud Console > the Settings icon (⚙) > Identity & Access Management > User Access > Roles to see the current roles in your account. You can see how many groups each role is assigned to. This view is limited to the Organization Administrator. 7.2. Access permissions The Prerequisites for each procedure list which predefined role provides the permissions you must have. As a user, you can navigate to Red Hat Hybrid Cloud Console > the Settings icon (⚙) > My User Access to view the roles and application permissions currently inherited by you. If you try to access Insights for Red Hat Enterprise Linux features and see a message that you do not have permission to perform this action, you must obtain additional permissions. The Organization Administrator or the User Access administrator for your organization configures those permissions. Use the Red Hat Hybrid Cloud Console Virtual Assistant to ask "Contact my Organization Administrator". The assistant sends an email to the Organization Administrator on your behalf. Additional resources For more information about user access and permissions, see User Access Configuration Guide for Role-based Access Control (RBAC) .

Commands:
1.2. How Do You Perform a Kickstart Installation? Kickstart installations can be performed using a local CD-ROM, a local hard drive, or via NFS, FTP, or HTTP. To use kickstart, you must: Create a kickstart file. Create a boot media with the kickstart file or make the kickstart file available on the network. Make the installation tree available. Start the kickstart installation. This chapter explains these steps in detail.

Commands:
Chapter 2. Automating Network Intrusion Detection and Prevention Systems (IDPS) with Ansible You can use Ansible to automate your Intrusion Detection and Prevention System (IDPS). For the purpose of this guide, we use Snort as the IDPS. Use Ansible automation hub to consume content collections, such as tasks, roles, and modules to create automated workflows. 2.1. Requirements and prerequisites Before you begin automating your IDPS with Ansible, ensure that you have the proper installations and configurations necessary to successfully manage your IDPS. You have installed Ansible-core 2.15 or later. SSH connection and keys are configured. IDPS software (Snort) is installed and configured. You have access to the IDPS server (Snort) to enforce new policies. 2.1.1. Verifying your IDPS installation To verify that Snort has been configured successfully, call it via sudo and ask for the version: USD sudo snort --version ,,_ -*> Snort! <*- o" )~ Version 2.9.13 GRE (Build 15013) "" By Martin Roesch & The Snort Team: http://www.snort.org/contact#team Copyright (C) 2014-2019 Cisco and/or its affiliates.

Commands:
sudo snort --version ,,_ -*> Snort! <*- o" )~ Version 2.9.13 GRE (Build 15013) "" By Martin Roesch & The Snort Team: http://www.snort.org/contact#team Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.5.3 Using PCRE version: 8.32 2012-11-30 Using ZLIB version: 1.2.7
sudo systemctl status snort ● snort.service - Snort service Loaded: loaded (/etc/systemd/system/snort.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2019-08-26 17:06:10 UTC; 1s ago Main PID: 17217 (snort) CGroup: /system.slice/snort.service └─17217 /usr/sbin/snort -u root -g root -c /etc/snort/snort.conf -i eth0 -p -R 1 --pid-path=/var/run/snort --no-interface-pidfile --nolock-pidfile [...]
ansible-galaxy install ansible_security.ids_rule
- name: Add Snort rule hosts: snort
- name: Add Snort rule hosts: snort become: true
- name: Add Snort rule hosts: snort become: true vars: ids_provider: snort
- name: Add Snort rule hosts: snort become: true vars: ids_provider: snort tasks: - name: Add snort password attack rule include_role: name: "ansible_security.ids_rule" vars: ids_rule: 'alert tcp any any -> any any (msg:"Attempted /etc/passwd Attack"; uricontent:"/etc/passwd"; classtype:attempted-user; sid:99000004; priority:1; rev:1;)' ids_rules_file: '/etc/snort/rules/local.rules' ids_rule_state: present
ansible-navigator run add_snort_rule.ym --mode stdout
Chapter 4. Red Hat build of OpenJDK 8.0.342 release notes The Red Hat build of OpenJDK 8.0.342 release might include new features. Additionally, this release might enhance, deprecate, or remove features that originated from Red Hat build of OpenJDK 8 releases. Note For all the other changes and security fixes, see OpenJDK 8u342 Released . 4.1. New features and enhancements Review the following release notes to understand new features and feature enhancements that have been included with the Red Hat build of OpenJDK 8.0.342 release: Customizing PKCS12 keystore generation The Red Hat build of OpenJDK 8 release includes a new system property and a new security property that allows you to customize the generation of PKCS #12 keystores. Users can customize algorithms and parameters for key protection, certificate protection, and MacData. You can find information about the properties, including a list of possible values, in the "PKCS12 KeyStore properties" section of the java.security file. Also, the Red Hat build of OpenJDK 8 release adds support for the following SHA-2 based HmacPBE algorithms to the SunJCE provider: HmacPBESHA224 HmacPBESHA256 HmacPBESHA384 HmacPBESHA512 HmacPBESHA512/224 HmacPBESHA512/256 See, JDK-8215293 (JDK Bug System) New system property to disable Windows Alternate Data Stream support in java.io.File The Windows implementation of java.io.File allows access to NTFS Alternate Data Streams (ADS) by default. These streams are structured in the format "filename:streamname". The Red Hat build of OpenJDK 8.0.342 release adds a system property that allows you to disable ADS support in java.io.File . To disable ADS support in java.io.File , set the system property jdk.io.File.enableADS to false . Important Disabling ADS support in java.io.File results in stricter path checking that prevents the use of special device files, such as NUL: . See, JDK-8285660 (JDK Bug System) Revised on 2024-05-10 09:05:34 UTC

Commands:
8.17. Begin Installation When all required sections of the Installation Summary screen have been completed, the admonition at the bottom of the menu screen disappears and the Begin Installation button becomes available. Figure 8.38. Ready to Install Warning Up to this point in the installation process, no lasting changes have been made on your computer. When you click Begin Installation , the installation program will allocate space on your hard drive and start to transfer Red Hat Enterprise Linux into this space. Depending on the partitioning option that you chose, this process might include erasing data that already exists on your computer. To revise any of the choices that you made up to this point, return to the relevant section of the Installation Summary screen. To cancel installation completely, click Quit or switch off your computer. To switch off most computers at this stage, press the power button and hold it down for a few seconds. If you have finished customizing your installation and are certain that you want to proceed, click Begin Installation . After you click Begin Installation , allow the installation process to complete. If the process is interrupted, for example, by you switching off or resetting the computer, or by a power outage, you will probably not be able to use your computer until you restart and complete the Red Hat Enterprise Linux installation process, or install a different operating system.

Commands:
27.3. Defining the Console The pam_console.so module uses the /etc/security/console.perms file to determine the permissions for users at the system console. The syntax of the file is very flexible; you can edit the file so that these instructions no longer apply. However, the default file has a line that looks like this: When users log in, they are attached to some sort of named terminal, either an X server with a name like :0 or mymachine.example.com:1.0 , or a device like /dev/ttyS0 or /dev/pts/2 . The default is to define that local virtual consoles and local X servers are considered local, but if you want to consider the serial terminal to you on port /dev/ttyS1 to also be local, you can change that line to read:

Commands:
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]\.[0-9] :[0-9]
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]\.[0-9] :[0-9] /dev/ttyS1