mtpti5iD/redhat-docs_dataset huggingface dataset:
Chapter 1. Overview This guide explains how to make your Docker workflow more secure. There is no one-size-fits-all solution to the problem of securing a workflow. Because there is no single solution for securing your container workflow, you need to understand the tools and strategies that you can use to improve your Docker workflow's security. The general strategy for doing this is to reduce the number of potential attack vectors in your Docker infrastructure available to malicious agents. This guide will provide you with the fundamentals you need to understand the interaction between security practices and the Docker ecosystem. This guide will furnish you with the tools and strategies you need to find the security solution that works best with your Docker workflow. This is the general strategy for securing containers: avoid untrusted content, keep containers up-to-date, leverage SELinux, minimize attack surface, and use virtualization. The containerization ecosystem is developing, and it changes fast. This guide is intended to make the containerization ecosystem legible to you in order to help you make the best choices for your own implementation of containerization.

Commands:
8.3.4. Availability of Backups When a disaster is declared, it is necessary to notify your off-site storage facility for two reasons: To have the last backups brought to the backup site To arrange regular backup pickup and dropoff to the backup site (in support of normal backups at the backup site) Note In the event of a disaster, the last backups you have from your old data center are vitally important. Consider having copies made before anything else is done, with the originals going back off-site as soon as possible.

Commands:
12.7. Glance Image Storage Domains 12.7.1. Glance Image Storage Domains Storage domains with type set to Image represent instances of an OpenStack image service that has been added to the Red Hat Virtualization environment as an external provider. These Glance image storage domains contain an images sub-collection with virtual machine images that have been exported to or can be imported from that Glance image storage domain. Example 12.12. Listing the images sub-collection of a Glance image storage domain The import action imports a virtual machine image from a Glance image storage domain. The destination storage domain is specified with a storage_domain reference, and the destination cluster with a cluster reference. Include an optional name element to give the virtual machine or template a specific name. Example 12.13. Action to import a virtual machine from a Glance image storage domain You can also import images as templates by specifying the import_as_template reference: Example 12.14. Action to import a virtual machine from a Glance image storage domain as a template

Commands:
GET /ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000/images Accept: application/xml HTTP/1.1 200 OK Content-Type: application/xml <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <images> <image href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000/images/ 00000000-0000-0000-0000-000000000000" id="00000000-0000-0000-0000-000000000000"> <actions> <link href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000/images/ 00000000-0000-0000-0000-000000000000/import" rel="import"/> </actions> <name>RHEL_65_Disk_001</name> <storage_domain href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000" id="00000000-0000-0000-0000-000000000000"/> </image> <image href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000/images/ 00000000-0000-0000-0000-000000000000" id="00000000-0000-0000-0000-000000000000"> <actions> <link href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000/images/ 00000000-0000-0000-0000-000000000000/import" rel="import"/> </actions> <name>RHEL_65_Disk_002</name> <storage_domain href="/ovirt-engine/api/storagedomains/00000000-0000-0000-0000-000000000000" id="00000000-0000-0000-0000-000000000000"/> </image> </images>
POST /ovirt-engine/api/storagedomains/00000000-0000-0000-000000000000/images/ 00000000-0000-0000-000000000000/import HTTP/1.1 Accept: application/xml Content-type: application/xml <action> <storage_domain> <name>images0</name> </storage_domain> <cluster> <name>images0</name> </cluster> </action>
POST /ovirt-engine/api/storagedomains/00000000-0000-0000-000000000000/images/ 00000000-0000-0000-000000000000/import HTTP/1.1 Accept: application/xml Content-type: application/xml <action> <storage_domain> <name>images0</name> </storage_domain> <cluster> <name>images0</name> </cluster> </import_as_template>true</import_as_template> </action>
7.9. Configuring PAM for Auditing 7.9.1. Configuring pam_tty_audit The audit system in Red Hat Enterprise Linux uses the pam_tty_audit PAM module to enable or disable auditing of TTY input for specified users. When the audited user logs in, pam_tty_audit records the exact keystrokes the user makes into the /var/log/audit/audit.log file. The module works with the auditd daemon, so make sure it is enabled before configuring pam_tty_audit . See Section 7.4, "Starting the audit Service" for more information. When you want to specify user names for TTY auditing, modify the /etc/pam.d/system-auth and /etc/pam.d/password-auth files using the disable and enable options in the following format: session required pam_tty_audit.so disable= username , username2 enable= username You can specify one or more user names separated by commas in the options. Any disable or enable option overrides the opposite option which matches the same user name. When TTY auditing is enabled, it is inherited by all processes started by that user. In particular, daemons restarted by a user will still have TTY auditing enabled, and will audit TTY input even by other users, unless auditing for these users is explicitly disabled. Therefore, it is recommended to use disable=* as the first option for most daemons using PAM. Important By default, pam_tty_audit does NOT log keystrokes when the TTY is in password entry mode. Logging can be re-enabled by adding the log_passwd option along with the other options in the following way: session required pam_tty_audit.so disable= username , username2 enable= username log_passwd When you enable the module, the input is logged in the /var/log/audit/audit.log file, written by the auditd daemon. Note that the input is not logged immediately, because TTY auditing first stores the keystrokes in a buffer and writes the record periodically, or once the audited user logs out. The audit.log file contains all keystrokes entered by the specified user, including backspaces, delete and return keys, the control key and others. Although the contents of audit.log are human-readable it might be easier to use the aureport utility, which provides a TTY report in a format which is easy to read. You can use the following command as root: The following is an example of how to configure pam_tty_audit to track the actions of the root user across all terminals and then review the input. Example 7.8. Configuring pam_tty_audit to log root actions Enter the following line in the session section of the /etc/pam.d/system-auth and /etc/pam.d/password-auth files: Use the aureport --tty command to view the log. If the root user has logged in a TTY console at around 11:00 o'clock and tried to issue the pwd command, but then deleted it and issued ls instead, the report will look like this: For more information, see the pam_tty_audit(8) manual page.

Commands:
~]# aureport --tty
session required pam_tty_audit.so disable=* enable=root
~]# aureport --tty -ts today | tail 40. 08/28/2014 11:00:27 901 0 ? 76 bash "pwd",<backspace>,<backspace><backspace>,"ls",<ret> 41. 08/28/2014 11:00:29 903 0 ? 76 bash <^D>
5.253. psacct 5.253.1. RHBA-2012:1082 - psacct bug fix update Updated psacct packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6. The psacct packages contain utilities for monitoring process activities, including ac, lastcomm, accton, dump-acct, dump-utmp and sa. The "ac" command displays statistics about how long users have been logged on. The "lastcomm" command displays information about previously executed commands. The "accton" command turns process accounting on or off. The "dump-acct" command transforms the output file from the accton format to a human-readable format. The "dump-utmp" command prints utmp files in human-readable format. The "sa" command summarizes information about previously executed commands. Bug Fixes BZ# 828728 Previously, improper data type detection could have caused an arithmetic overflow. As a consequence, the dump-acct tool reported incorrect elapsed time values. A patch has been applied so that correct values are reported with this update. BZ# 834217 Previously, improper data type conversion caused the dump-utmp tool to report invalid timestamps. Consequently, mainly on the 64-bit PowerPC architecture, dump-utmp could have terminated unexpectedly with a segmentation fault. A patch has been applied so that correct values are reported and no crashes occur with this update. BZ# 838998 Previously, accessing an incorrect and uninitialized memory structure used for acquiring the user IDs caused the sa tool to report incorrect usernames. Consequently, the sa tool could have terminated unexpectedly with a segmentation fault. A patch has been applied so that correct values are reported and no crashes occur with this update. All users of psacct are advised to upgrade to these updated packages, which fix these bugs.

Commands:
13.3. Removing a Partition Warning Do not attempt to remove a partition on a device that is in use. Procedure 13.3. Remove a partition Before removing a partition, boot into rescue mode (or unmount any partitions on the device and turn off any swap space on the device). Start parted , where /dev/ sda is the device on which to remove the partition: View the current partition table to determine the minor number of the partition to remove: Remove the partition with the command rm . For example, to remove the partition with minor number 3: The changes start taking place as soon as you press Enter , so review the command before committing to it. After removing the partition, use the print command to confirm that it is removed from the partition table. You should also view the output of /proc/partitions to make sure the kernel knows the partition is removed. The last step is to remove it from the /etc/fstab file. Find the line that declares the removed partition, and remove it from the file.

Commands:
parted /dev/ sda
print
rm 3
cat /proc/partitions
Chapter 16. package 16.1. package:exports 16.1.1. Description Lists exported packages and the bundles that export them 16.1.2. Syntax package:exports [options] 16.1.3. Options Name Description --help Display this help message -b Only show packages exported by given bundle id -d Only show packages that are exported by more than one bundle --show-name-only Show only package name -p Only show package starting with given name --no-format Disable table rendered output 16.2. package:imports 16.2.1. Description Lists imported packages and the bundles that import them 16.2.2. Syntax package:imports [options] 16.2.3. Options Name Description --help Display this help message -b Only show imports of the given bundle id --show-name-only Show only package name --filter Only show package instead of full filter -p Only show package starting with given name --no-format Disable table rendered output

Commands:
13.2.2. Formatting and Labeling the Partition To format and label the partition use the following procedure: Procedure 13.2. Format and label the partition The partition still does not have a file system. To create one use the following command: # /sbin/mkfs -t ext3 /dev/ sda6 Warning Formatting the partition permanently destroys any data that currently exists on the partition. , give the file system on the partition a label. For example, if the file system on the new partition is /dev/sda6 and you want to label it /work , use: By default, the installation program uses the mount point of the partition as the label to make sure the label is unique. You can use any label you want. Afterwards, create a mount point (e.g. /work ) as root.

Commands:
e2label /dev/sda6 /work
1.2. A Three-Tier Load Balancer Add-On Configuration Figure 1.2, "A Three-Tier Load Balancer Add-On Configuration" shows a typical three-tier Load Balancer Add-On topology. In this example, the active LVS router routes the requests from the Internet to the pool of real servers. Each of the real servers then accesses a shared data source over the network. Figure 1.2. A Three-Tier Load Balancer Add-On Configuration This configuration is ideal for busy FTP servers, where accessible data is stored on a central, highly available server and accessed by each real server by means of an exported NFS directory or Samba share. This topology is also recommended for websites that access a central, highly available database for transactions. Additionally, using an active-active configuration with the Load Balancer Add-on, administrators can configure one high-availability cluster to serve both of these roles simultaneously. The third tier in the above example does not have to use the Load Balancer Add-on, but failing to use a highly available solution would introduce a critical single point of failure.

Commands:
7.60. gdbm 7.60.1. RHBA-2015:0005 - gdbm bug fix update Updated gdbm packages that fix one bug are now available for Red Hat Enterprise Linux 6. Gdbm is a GNU database indexing library, which includes routines which use extensible hashing. Gdbm works in a similar way to standard UNIX dbm routines. Bug Fix BZ# 629640 Due to incorrect open file flags, the gdbm utility caused creation of a new file when opening a non-existent file for reading. To fix this bug, the wrong file open flags have been set correctly, and gdbm thus no longer creates a new file in the aforementioned scenario. Users of gdbm are advised to upgrade to these updated packages, which fix this bug. 7.60.2. RHBA-2015:0089 - gdbm bug fix update Updated gdbm packages that fix one bug are now available for Red Hat Enterprise Linux 6. The gdbm packages provide a GNU database indexing library, which includes routines that use extensible hashing. The library works in a similar way to standard UNIX dbm routines. Bug Fix BZ# 1180392 The release of gdbm introduced a regression in the way file handlers were used. Consequently, gdbm failed to write to a database opened for reading and writing. With this update, the file handlers have been fixed to use the right flags, and as a result, gdbm works with such databases as expected. Users of gdbm are advised to upgrade to these updated packages, which fix this bug.

Commands:
6.2. Configuring Host Names Using Text User Interface, nmtui The text user interface tool nmtui can be used to configure a host name in a terminal window. Issue the following command to start the tool: The text user interface appears. Any invalid command prints a usage message. Figure 6.1. The NetworkManager Text User Interface starting menu To navigate, use the arrow keys or press Tab to step forwards and press Shift + Tab to step back through the options. Press Enter to select an option. The Space bar toggles the status of a check box. See Section 3.2, "Configuring IP Networking with nmtui" for information on installing nmtui . The NetworkManager text user interface tool nmtui can be used to query and set the static host name in the /etc/hostname file. Important In Red Hat Enterprise Linux, NetworkManager uses the systemd-hostnamed service to read and write the static host name, which is stored in the /etc/hostname file. Due to this, manual modifications done to the /etc/hostname file are no longer picked up automatically by NetworkManager ; you should change the system host name through the hostnamectl utility. Also, the use of the HOSTNAME variable in the /etc/sysconfig/network file is now deprecated.

Commands:
~]USD nmtui
5.4. Moving swap File Systems from a Single Path Device to a Multipath Device By default, swap devices are set up as logical volumes. This does not require any special procedure for configuring them as multipath devices as long as you set up multipathing on the physical volumes that constitute the logical volume group. If your swap device is not an LVM volume, however, and it is mounted by device name, you may need to edit the fstab file to switch to the appropriate multipath device name. Determine the WWID number of the swap device by running the /sbin/multipath command with the -v3 option. The output from the command should show the swap device in the paths list. You should look in the command output for a line of the following format, showing the swap device: For example, if your swap file system is set up on sda or one of its partitions, you would see a line in the output such as the following: Set up an alias for the swap device in the /etc/multipath.conf file: Edit the /etc/fstab and replace the old device path to the root device with the multipath device. For example, if you had the following entry in the /etc/fstab file: You would change the entry to the following:

Commands:
WWID H:B:T:L devname MAJOR : MINOR
===== paths list ===== 1ATA WDC WD800JD-75MSA3 WD-WMAM9F 1:0:0:0 sda 8:0
multipaths { multipath { wwid WWID_of_swap_device alias swapdev } }
/dev/sda2 swap swap defaults 0 0
/dev/mapper/swapdev swap swap defaults 0 0
2.25. RHEA-2011:0723 - new package: perl-IPC-Run A new perl-IPC-Run package is now available for Red Hat Enterprise Linux 6. The IPC::Run module provides a mechanism for Perl scripts to interact with child processes. This enhancement update adds the perl-IPC-Run package to Red Hat Enterprise Linux 6. (BZ# 669403 ) All users who require the IPC::Run Perl module should install this new package.

Commands:
Red Hat Enterprise Linux System Roles for SAP Red Hat Enterprise Linux for SAP Solutions 8 Red Hat Customer Content Services

Commands:
dnf install ansible-core
subscription-manager repos --enable=rhel-USD(rpm -E %rhel)-for-USD(uname -m)-sap-solutions-rpms
dnf install rhel-system-roles-sap
[galaxy] server_list = automation_hub_install [galaxy_server.automation_hub_install] url = https://console.redhat.com/api/automation-hub/[https://console.redhat.com/api/automation-hub/] auth_url = https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token[https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token] token = 123567890abcdef...abcdef1234
ansible-galaxy collection install redhat.sap_install
ansible-galaxy collection install ./redhat-sap_install-1.2.1.tar.gz
locale
export LC_ALL=C
export LC_ALL=en_US.UTF-8
- hosts: localhost connection: local roles: - sap_general_preconfigure - sap_netweaver_preconfigure
ansible-playbook sap-netweaver.yml
- hosts: localhost connection: local vars: sap_general_preconfigure_assert: yes sap_general_preconfigure_assert_ignore_errors: yes sap_netweaver_preconfigure_assert: yes sap_netweaver_preconfigure_assert_ignore_errors: yes roles: - sap_general_preconfigure - sap_netweaver_preconfigure
ansible-playbook sap-netweaver.yml
ansible-playbook sap-netweaver-assert.yml | ./bin/beautify-assert-output.sh
echo -e "\033[37mResetting font color\n"
[sap_hana] host01 host02 host03
ssh host01 uname -a ssh host02 hostname ssh host03 echo test
- hosts: sap_hana roles: - sap_general_preconfigure - sap_hana_preconfigure
ansible-playbook sap-hana.yml
Chapter 5. Deprecated functionality This section provides an overview of functionality that has been deprecated in all minor releases up to this release of Red Hat Ceph Storage. Important Deprecated functionality continues to be supported until the end of life of Red Hat Ceph Storage 5. Deprecated functionality will likely not be supported in future major releases of this product and is not recommended for new deployments. For the most recent list of deprecated functionality within a particular major release, refer to the latest version of release documentation. NFS support for CephFS is now deprecated NFS support for CephFS is now deprecated. Red Hat Ceph Storage support for NFS in OpenStack Manila is not affected. Deprecated functionality will receive only bug fixes for the lifetime of the current release, and may be removed in future releases. Relevant documentation around this technology is identified as "Limited Availability". iSCSi support is now deprecated iSCSi support is now deprecated in favor of future NVMEoF support. Deprecated functionality will receive only bug fixes for the lifetime of the current release, and may be removed in future releases. Relevant documentation around this technology is identified as "Limited Availability".

Commands:
28.3.3. Deleting Problems If you are certain that you do not want to report a particular problem, you can delete it. To delete a problem so ABRT does not keep information about it, use the command: abrt-cli rm directory ...where directory stands for the problem data directory of the problem being deleted. For example: Note Note that ABRT performs a detection of duplicate problems by comparing new problems with all locally saved problems. For a repeating crash, ABRT requires you to act upon it only once. However, if you delete the crash dump of that problem, the time this specific problem occurs, ABRT will treat it as a new crash: ABRT will alert you about it, prompt you to fill in a description, and report it. To avoid having ABRT notifying you about a recurring problem, do not delete its problem data. The following table shows options available with the abrt-cli rm command. Table 28.5. The abrt-cli rm command options Option Description With no additional option, the abrt-cli rm command removes the specified problem data directory with all its contents. -v , --verbose abrt-cli rm provides additional information on its actions.

Commands:
~]USD abrt-cli rm /var/spool/abrt/ccpp-2011-09-12-18:37:24-4413 rm '/var/spool/abrt/ccpp-2011-09-12-18:37:24-4413'
18.3.6. Listing Options The default list command, iptables -L , provides a very basic overview of the default filter table's current chains. Additional options provide more information: -v - Displays verbose output, such as the number of packets and bytes each chain has seen, the number of packets and bytes each rule has matched, and which interfaces apply to a particular rule. -x - Expands numbers into their exact values. On a busy system, the number of packets and bytes seen by a particular chain or rule may be abbreviated using K (thousands), M (millions), and G (billions) at the end of the number. This option forces the full number to be displayed. -n - Displays IP addresses and port numbers in numeric format, rather than the default hostname and network service format. --line-numbers - Lists rules in each chain to their numeric order in the chain. This option is useful when attempting to delete the specific rule in a chain or to locate where to insert a rule within a chain. -t - Specifies a table name.

Commands:
Chapter 6. Migrating JBoss EAP 6.4 configurations to JBoss EAP 8.0 The procedure to migrate the JBoss EAP 6.4 configurations to JBoss EAP 8.0 has been updated. You must migrate first your JBoss EAP 6.4 configurations to the latest CP version of JBoss EAP 7.4 and then migrate it further to JBoss EAP 8.0. To migrate a JBoss EAP 6.4 configuration to JBoss EAP 7.4, see Use the JBoss Server Migration Tool to Migrate Server Configurations . To migrate a JBoss EAP 7.x configuration to JBoss EAP 8.0, see Migrating JBoss EAP 7.x configurations to JBoss EAP 8.0 .

Commands: