mtpti5iD/redhat-docs_dataset huggingface dataset:
Chapter 6. Configuring basic system security Computer security is the protection of computer systems and their hardware, software, information, and services from theft, damage, disruption, and misdirection. Ensuring computer security is an essential task, in particular in enterprises that process sensitive data and handle business transactions. This section covers only the basic security features that you can configure after installation of the operating system. 6.1. Enabling the firewalld service A firewall is a network security system that monitors and controls incoming and outgoing network traffic according to configured security rules. A firewall typically establishes a barrier between a trusted secure internal network and another outside network. The firewalld service, which provides a firewall in Red Hat Enterprise Linux, is automatically enabled during installation. To enable the firewalld service, follow this procedure. Procedure Display the current status of firewalld : If firewalld is not enabled and running, switch to the root user, and start the firewalld service and enable to start it automatically after the system restarts: Verification Check that firewalld is running and enabled: Additional resources Using and configuring firewalld man firewalld(1) 6.2. Managing basic SELinux settings Security-Enhanced Linux (SELinux) is an additional layer of system security that determines which processes can access which files, directories, and ports. These permissions are defined in SELinux policies. A policy is a set of rules that guide the SELinux security engine. SELinux has two possible states: Disabled Enabled When SELinux is enabled, it runs in one of the following modes: Enabled Enforcing Permissive In enforcing mode , SELinux enforces the loaded policies. SELinux denies access based on SELinux policy rules and enables only the interactions that are explicitly allowed. Enforcing mode is the safest SELinux mode and is the default mode after installation. In permissive mode , SELinux does not enforce the loaded policies. SELinux does not deny access, but reports actions that break the rules to the /var/log/audit/audit.log log. Permissive mode is the default mode during installation. Permissive mode is also useful in some specific cases, for example when troubleshooting problems. Additional resources Using SELinux 6.3. Additional resources Generating SSH key pairs Setting an OpenSSH server for key-based authentication Security hardening Using SELinux Securing networks

Commands:
systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled) Active: inactive (dead)
systemctl enable --now firewalld
systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running)
Chapter 3. Network 3.1. Network Architecture Red Hat Virtualization networking can be discussed in terms of basic networking, networking within a cluster, and host networking configurations. Basic networking terms cover the basic hardware and software elements that facilitate networking. Networking within a cluster includes network interactions among cluster level objects such as hosts, logical networks and virtual machines. Host networking configurations covers supported configurations for networking within a host. A well designed and built network ensures, for example, that high bandwidth tasks receive adequate bandwidth, that user interactions are not crippled by latency, and virtual machines can be successfully migrated within a migration domain. A poorly built network can cause, for example, unacceptable latency, and migration and cloning failures resulting from network flooding. An alternative method of managing your network is by integrating with Cisco Application Centric Infrastructure (ACI), by configuring Red Hat Virtualization on Cisco's Application Policy Infrastructure Controller (APIC) version 3.1(1) and later according to the Cisco's documentation . On the Red Hat Virtualization side, all that is required is connecting the hosts' NICs to the network and the virtual machines' vNICs to the required network. The remaining configuration tasks are managed by Cisco ACI.

Commands:
11.2.7. Setting Up 802.1Q VLAN Tagging If required, start the VLAN 8021q module by issuing the following command as root : No visual output indicates the module was not running and has now been loaded. Note that given a correct configuration file, the VLAN 8021q module will be loaded as required and therefore does not need to be loaded separately. Configure your physical interface in /etc/sysconfig/network-scripts/ifcfg-eth X , where X is a unique number corresponding to a specific interface, as follows: Configure the VLAN interface configuration in /etc/sysconfig/network-scripts . The configuration filename should be the physical interface plus a . character plus the VLAN ID number. For example, if the VLAN ID is 192, and the physical interface is eth0 , then the configuration filename should be ifcfg-eth0.192 : If there is a need to configure a second VLAN, with for example, VLAN ID 193, on the same interface, eth0 , add a new file with the name eth0.193 with the VLAN configuration details. Restart the networking service, in order for the changes to take effect. Issue the following command as root :

Commands:
~]# modprobe --first-time 8021q
DEVICE=ethX TYPE=Ethernet BOOTPROTO=none ONBOOT=yes
DEVICE=ethX.192 BOOTPROTO=none ONBOOT=yes IPADDR=192.168.1.1 NETMASK=255.255.255.0 USERCTL=no NETWORK=192.168.1.0 VLAN=yes
~]# service network restart
1.8.4. Persistence and Firewall Marks In certain situations, it may be desirable for a client to reconnect repeatedly to the same real server, rather than have an LVS load-balancing algorithm send that request to the best available server. Examples of such situations include multi-screen web forms, cookies, SSL, and FTP connections. In those cases, a client may not work properly unless the transactions are being handled by the same server to retain context. LVS provides two different features to handle this: persistence and firewall marks . 1.8.4.1. Persistence When enabled, persistence acts like a timer. When a client connects to a service, LVS remembers the last connection for a specified period of time. If that same client IP address connects again within that period, it is sent to the same server it connected to previously - bypassing the load-balancing mechanisms. When a connection occurs outside the time window, it is handled according to the scheduling rules in place. Persistence also allows you to specify a subnet mask to apply to the client IP address test as a tool for controlling what addresses have a higher level of persistence, thereby grouping connections to that subnet. Grouping connections destined for different ports can be important for protocols that use more than one port to communicate, such as FTP. However, persistence is not the most efficient way to deal with the problem of grouping together connections destined for different ports. For these situations, it is best to use firewall marks .

Commands:
Chapter 5. Using Tempest Run the commands in this section to perform various test operations. You can also combine multiple options in a single tempest run command. 5.1. Listing Available Tests Run the tempest-run command with either the --list-tests or -l options to get a list of available tempest tests: 5.2. Running Smoke Tests Smoke testing is a type of preliminary testing which only covers the most important functionality. While they are not comprehensive, running smoke tests can save time if they do identify a problem. 5.3. Passing Tests Using Whitelist Files A whitelist file is a file that contains regular expressions to select tests that you want to include. Regular expressions are separated by a newline. Run the tempest run command with either the --whitelist-file or -w options to use a whitelist file: 5.4. Skipping Tests Using Blacklist Files A blacklist file is a file that contains regular expressions to select tests that you want to exclude. Regular expressions are separated by a newline. Run the tempest run command with either the --blacklist-file or -b options to use a blacklist file: 5.5. Running Tests in Parallel Concurrently, or Serially Run the tests serially: Run the tests in parallel. Parallel testing is the default: Use the --concurrency or -c option to specify the number of workers to use when running tests in parallel: By default, the Integration Test Suite uses one worker for each CPU available. 5.6. Running Specific Tests Run specific tests with the --regex regular expression option. The regular expression must be Python regular expression: For example, use the following example command to run all tests that have names beginning with tempest.scenario :

Commands:
tempest run -l
tempest run --smoke
tempest run -w <whitelist_file>
tempest run -b <blacklist_file>
tempest run --serial
tempest run --parallel
tempest run --concurrency <workers>
tempest run --regex <regex>
tempest run --regex ^tempest.scenario
Appendix B. Delete existing PVCs from AAP installations Open a terminal window and login to your Red Hat OpenShift cluster, e.g. exporting your KUBECONFIG file Verify the list of PVCs in the specified Ansible Automation Platform namespace, e.g. aap Note This shows a list of all the PVCs within the aap namespace including their name, status, capacity, access modes and storage class. Identify the PVC you wish to remove from the list Remove the PVC using the oc delete command Verify the list of PVCs available within the aap namespace and ensure the PVC is no longer displayed.

Commands:
export KUBECONFIG=/path/to/kubeconfig
oc get pvc -n aap
delete pvc <pvc-name-to-remove> -n aap
oc get pvc -n aap
17.9. Managing Hosts The Hosts tab allows you to add, edit, or remove hosts from the /etc/hosts file. This file contains IP addresses and their corresponding hostnames. When your system tries to resolve a hostname to an IP address or tries to determine the hostname for an IP address, it refers to the /etc/hosts file before using the name servers (if you are using the default Red Hat Enterprise Linux configuration). If the IP address is listed in the /etc/hosts file, the name servers are not used. If your network contains computers whose IP addresses are not listed in DNS, it is recommended that you add them to the /etc/hosts file. To add an entry to the /etc/hosts file, go to the Hosts tab, click the New button on the toolbar, provide the requested information, and click OK . Select File => Save or press Ctrl + S to save the changes to the /etc/hosts file. The network or network services do not need to be restarted since the current version of the file is referred to each time an address is resolved. Warning Do not remove the localhost entry. Even if the system does not have a network connection or have a network connection running constantly, some programs need to connect to the system via the localhost loopback interface. Figure 17.15. Hosts Configuration Note To change lookup order, edit the /etc/host.conf file. The line order hosts, bind specifies that /etc/hosts takes precedence over the name servers. Changing the line to order bind, hosts configures the system to resolve hostnames and IP addresses using the name servers first. If the IP address cannot be resolved through the name servers, the system then looks for the IP address in the /etc/hosts file.

Commands:
Appendix A. Using your subscription Streams for Apache Kafka is provided through a software subscription. To manage your subscriptions, access your account at the Red Hat Customer Portal. Accessing Your Account Go to access.redhat.com . If you do not already have an account, create one. Log in to your account. Activating a Subscription Go to access.redhat.com . Navigate to My Subscriptions . Navigate to Activate a subscription and enter your 16-digit activation number. Downloading Zip and Tar Files To access zip or tar files, use the customer portal to find the relevant files for download. If you are using RPM packages, this step is not required. Open a browser and log in to the Red Hat Customer Portal Product Downloads page at access.redhat.com/downloads . Locate the Streams for Apache Kafka for Apache Kafka entries in the INTEGRATION AND AUTOMATION category. Select the desired Streams for Apache Kafka product. The Software Downloads page opens. Click the Download link for your component. Installing packages with DNF To install a package and all the package dependencies, use: dnf install <package_name> To install a previously-downloaded package from a local directory, use: dnf install <path_to_download_package> Revised on 2024-10-25 16:50:38 UTC

Commands:
dnf install <package_name>
dnf install <path_to_download_package>
7.5.2. Runlevel 5 When the system boots into runlevel 5, a special X client application, called a display manager, is launched. A user must authenticate using the display manager before any desktop environment or window managers are launched. Depending on the desktop environments installed on the system, three different display managers are available to handle user authentication. GNOME - The default display manager for Red Hat Enterprise Linux, GNOME allows the user to configure language settings, shutdown, restart or log in to the system. KDE - KDE's display manager which allows the user to shutdown, restart or log in to the system. xdm - A very basic display manager which only lets the user log in to the system. When booting into runlevel 5, the prefdm script determines the preferred display manager by referencing the /etc/sysconfig/desktop file. A list of options for this file is available within the file (where <version-number> is the version number of the initscripts package). Each of the display managers reference the /etc/X11/xdm/Xsetup_0 file to set up the login screen. Once the user logs into the system, the /etc/X11/xdm/GiveConsole script runs to assign ownership of the console to the user. Then, the /etc/X11/xdm/Xsession script runs to accomplish many of the tasks normally performed by the xinitrc script when starting X from runlevel 3, including setting system and user resources, as well as running the scripts in the /etc/X11/xinit/xinitrc.d/ directory. Users can specify which desktop environment they want to utilize when they authenticate using the GNOME or KDE display managers by selecting it from the Sessions menu item (accessed by selecting Main Menu Button [on the Panel] => Preferences => More Preferences => Sessions ). If the desktop environment is not specified in the display manager, the /etc/X11/xdm/Xsession script checks the .xsession and .Xclients files in the user's home directory to decide which desktop environment to load. As a last resort, the /etc/X11/xinit/Xclients file is used to select a desktop environment or window manager to use in the same way as runlevel 3. When the user finishes an X session on the default display ( :0 ) and logs out, the /etc/X11/xdm/TakeConsole script runs and reassigns ownership of the console to the root user. The original display manager, which continued running after the user logged in, takes control by spawning a new display manager. This restarts the X server, displays a new login window, and starts the entire process over again. The user is returned to the display manager after logging out of X from runlevel 5. For more information on how display managers control user authentication, refer to the /usr/share/doc/gdm- <version-number> /README (where <version-number> is the version number for the gdm package installed) and the xdm man page.

Commands:
/usr/share/doc/initscripts- <version-number> / sysconfig.txt
18.6. How Directory Server Handles ACIs in a Replication Topology ACIs are stored in aci attributes of entries. Therefore, if an entry containing ACIs is part of a replicated database, the ACIs are replicated. ACIs are always evaluated on the server that resolves the incoming LDAP requests. When a consumer server receives an update request, it returns a referral to the supplier server before evaluating whether the request can be serviced on the supplier.

Commands:
Chapter 4. Sorting in the API To give you examples that are easy to follow, we use the following URL throughout this guide: https://<server name>/api/v2/groups/ Procedure To specify that {{ model_verbose_name_plural }} are returned in a particular order, use the order_by query string parameter on the GET request: https://<server name>/api/v2/model_verbose_name_plural?order_by={{ order_field }} Prefix the field name with a dash ( - ) to sort in reverse: https://<server name>/api/v2/model_verbose_name_plural?order_by=-{{ order_field }} You can specify the sorting fields by separating the field names with a comma ( , ): https://<server name>/api/v2/model_verbose_name_plural?order_by={{ order_field }},some_other_field

Commands:
https://<server name>/api/v2/groups/
https://<server name>/api/v2/model_verbose_name_plural?order_by={{ order_field }}
https://<server name>/api/v2/model_verbose_name_plural?order_by=-{{ order_field }}
https://<server name>/api/v2/model_verbose_name_plural?order_by={{ order_field }},some_other_field
Chapter 15. Disabling Multicloud Object Gateway external service after deploying OpenShift Data Foundation When you deploy OpenShift Data Foundation, public IPs are created even when OpenShift is installed as a private cluster. However, you can disable the Multicloud Object Gateway (MCG) load balancer usage by using the disableLoadBalancerService variable in the storagecluster CRD. This restricts MCG from creating any public resources for private clusters and helps to disable the NooBaa service EXTERNAL-IP . Procedure Run the following command and add the disableLoadBalancerService variable in the storagecluster YAML to set the service to ClusterIP: Note To undo the changes and set the service to LoadBalancer, set the disableLoadBalancerService variable to false or remove that line completely.

Commands:
oc edit storagecluster -n openshift-storage <storagecluster_name> [...] spec: arbiter: {} encryption: kms: {} externalStorage: {} managedResources: cephBlockPools: {} cephCluster: {} cephConfig: {} cephDashboard: {} cephFilesystems: {} cephNonResilientPools: {} cephObjectStoreUsers: {} cephObjectStores: {} cephRBDMirror: {} cephToolbox: {} mirroring: {} multiCloudGateway: disableLoadBalancerService: true <--------------- Add this endpoints: [...]
6.3. Modifying the Cluster Configuration To modify the cluster configuration (the cluster configuration file ( /etc/cluster/cluster.conf ), use the Cluster Configuration Tool . For more information about using the Cluster Configuration Tool , refer to Chapter 5, Configuring Red Hat Cluster With system-config-cluster . Warning Do not manually edit the contents of the /etc/cluster/cluster.conf file without guidance from an authorized Red Hat representative or unless you fully understand the consequences of editing the /etc/cluster/cluster.conf file manually. Important Although the Cluster Configuration Tool provides a Quorum Votes parameter in the Properties dialog box of each cluster member, that parameter is intended only for use during initial cluster configuration. Furthermore, it is recommended that you retain the default Quorum Votes value of 1 . For more information about using the Cluster Configuration Tool , refer to Chapter 5, Configuring Red Hat Cluster With system-config-cluster . Important If you are changing the number of cluster members, refer to Section 5.5, "Adding and Deleting Members" . You must take into account certain circumstances for both DLM and GULM clusters when adding or deleting members. To edit the cluster configuration file, click the Cluster Configuration tab in the cluster configuration GUI. Clicking the Cluster Configuration tab displays a graphical representation of the cluster configuration. Change the configuration file according the the following steps: Make changes to cluster elements (for example, create a service). Propagate the updated configuration file throughout the cluster by clicking Send to Cluster . Note The Cluster Configuration Tool does not display the Send to Cluster button if the cluster is new and has not been started yet, or if the node from which you are running the Cluster Configuration Tool is not a member of the cluster. If the Send to Cluster button is not displayed, you can still use the Cluster Configuration Tool ; however, you cannot propagate the configuration. You can still save the configuration file. For information about using the Cluster Configuration Tool for a new cluster configuration, refer to Chapter 5, Configuring Red Hat Cluster With system-config-cluster . Clicking Send to Cluster causes a Warning dialog box to be displayed. Click Yes to save and propagate the configuration. Clicking Yes causes an Information dialog box to be displayed, confirming that the current configuration has been propagated to the cluster. Click OK . Click the Cluster Management tab and verify that the changes have been propagated to the cluster members.

Commands:
Deployment Guide Red Hat Enterprise Linux 6 Deployment, Configuration and Administration of Red Hat Enterprise Linux 6 Marie Dolezelova Red Hat Customer Content Services mdolezel@redhat.com Mirek Jahoda Red Hat Customer Content Services mjahoda@redhat.com Maxim Svistunov Red Hat Customer Content Services Stephen Wadeley Red Hat Customer Content Services Tomas Capek Red Hat Customer Content Services Robert Kratky Red Hat Customer Content Services Jana Heves Red Hat Customer Content Services Jaromir Hradilek Red Hat Customer Content Services Douglas Silas Red Hat Customer Content Services Barbora Ancincova Red Hat Customer Content Services Petr Kovar Red Hat Customer Content Services Jiri Herrmann Red Hat Customer Content Services Peter Ondrejka Red Hat Customer Content Services Petr Bokoc Red Hat Customer Content Services Martin Prpic Red Hat Product Security Eva Majorsinova Red Hat Customer Content Services Eva Kopalova Red Hat Customer Content Services Miroslav Svoboda Red Hat Customer Content Services Milan Navratil Red Hat Customer Content Services Ella Deon Lackey Red Hat Customer Content Services Florian Nadge Red Hat Customer Content Services John Ha Red Hat Customer Content Services David O'Brien Red Hat Customer Content Services Michael Hideo Red Hat Customer Content Services Don Domingo Red Hat Customer Content Services

Commands: