book

Red Hat Enterprise Linux 9 Administration - Second Edition

Name: Red Hat Enterprise Linux 9 Administration - Second Edition
ISBN: 9781803248806

by Pablo Iranzo Gómez, Pedro Ibañez Requena, Miguel Pérez Colino, Scott McCarty

November 2022

Intermediate to advanced

530 pages

11h 19m

English

Packt Publishing

Read now

Unlock full access

Red Hat Enterprise Linux 9 Administration
ContributorsAbout the authorsAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchShare your thoughtsDownload a free PDF copy of this book
Part 1 – Systems Administration – Software, User, Network, and Services Management
Chapter 1: Getting RHEL Up and Running
Technical requirements Obtaining RHEL and a subscriptionInstalling RHEL 9 Preparation for a physical server installationPreparation for a virtual server installationRunning an RHEL installation Summary
Chapter 2: RHEL 9 Advanced Installation Options
Technical requirements Automating RHEL deployments with AnacondaDeploying RHEL on the cloudInstallation best practicesSummary
Chapter 3: Basic Commands and Simple Shell Scripts
Logging in as a user and managing multi-user environmentsUsing the root accountUsing and understanding the command promptChanging users with the su commandUnderstanding users, groups, and basic permissionsUsersGroupsFile permissionsUsing the command line, environment variables, and navigating through the filesystemCommand line and environment variablesNavigating the filesystemBash auto-completeThe filesystem hierarchyUnderstanding I/O redirection on the command lineFiltering output with grep and sedListing, creating, copying, and moving files, directories, links, and hard linksDirectoriesCopying and movingSymbolic and hard linksUsing tar and gzipCreating basic shell scriptsfor loopsif conditionalsExit codesUsing system documentation resourcesman pagesinfo pagesOther documentation resourcesSummary
Chapter 4: Tools for Regular Operations
Technical requirementsManaging system services with systemdsystemd unit file structureManaging services to be started and stopped at bootManaging boot targetsScheduling tasks with cron and systemdSystem-wide crontabUser crontabsystemd timersLearning about time synchronization with chrony and NTPNTP clientNTP serverChecking for free resources – memory and disk (free and df)MemoryDisk spaceCPULoad averageOther monitoring toolsFinding logs, using journald, and reading log files, including log preservation and rotationLog rotationSummary
Chapter 5: Securing Systems with Users, Groups, and Permissions
Creating, modifying, and deleting local user accounts and groupsManaging groups and reviewing assignmentsAdjusting password policiesConfiguring sudo access for administrative tasksUnderstanding sudo configurationUsing sudo to run admin commandsConfiguring sudoersChecking, reviewing, and modifying file permissionsUsing special permissionsUnderstanding and applying SUIDUnderstanding and applying SGIDUsing the sticky bitSummary
Chapter 6: Enabling Network Connectivity
Technical requirementsExploring network configuration in RHELGetting to know the configuration files and NetworkManagerConfiguring network interfaces with IPv4 and IPv6IPv4 and IPv6 – what do they mean?Configuring interfaces with nmtuiConfiguring interfaces with nm-connection-editorConfiguring interfaces with nmcliWhere does NetworkManager store configuration?Configuring hostname and hostname resolutions (DNS)An overview of firewall configurationConfiguring the firewallTesting network connectivitySummary
Chapter 7: Adding, Patching, and Managing Software
RHEL subscription registration and managementManaging repositories and signatures with yum/dnfDoing software installations, updates, and rollbacks with YUM/DNFCreating and syncing repositories with createrepo and reposyncUnderstanding RPM internalsSummary

Part 2 – Security with SSH, SELinux, a Firewall, and System Permissions
Chapter 8: Administering Systems Remotely
Technical requirementsSSH and OpenSSH overview and base configurationOpenSSH serverOpenSSH clientEnabling root access via SSH (and when not to do it)Accessing remote systems with SSHKey-based authentication with SSHSSH agentRemote file management with SCP/rsync Transferring files with an OpenSSH secure file copyTransferring files with sftpTransferring files with rsyncAdvanced remote management – SSH tunnels and SSH redirectionsRemote terminals with tmuxIntroduction to Ansible automationInventoryPlaybookSummary
Chapter 9: Securing Network Connectivity with firewalld
Introduction to the RHEL firewall – firewalldEnabling firewalld in the system and reviewing the default zonesReviewing the different configuration items under firewalldEnabling and managing services and portsCreating and using service definitions for firewalldConfiguring firewalld with the web interfaceSummary
Chapter 10: Keeping Your System Hardened with SELinux
Technical requirementsSELinux usage in enforcing and permissive modesReviewing the SELinux context for files and processesTweaking the policy with semanageRestoring changed file contexts to the default policyUsing SELinux Boolean settings to enable servicesSELinux troubleshooting and common fixesIntegrity Measurement Architecture, digital hashes, and signatures for enhancing securityEVM and trusted keysEnabling IMA and EVM in the system kernelSummary
Chapter 11: System Security Profiles with OpenSCAP
Getting started with OpenSCAP and discovering system vulnerabilitiesUsing OpenSCAP with security profiles for OSPP and PCI DSSScanning for OSPP complianceScanning for PCI DSS complianceSummary
Part 3 – Resource Administration – Storage, Boot Process, Tuning, and Containers
Chapter 12: Managing Local Storage and Filesystems
Technical requirementsLet’s start with a definitionA bit of historyPartitioning disks (MBR and GPT disks)Formatting and mounting filesystemsSetting default mounts and options in fstabUsing network filesystems with NFSSummary
Chapter 13: Flexible Storage Management with LVM
Technical requirementsUnderstanding LVMCreating, moving, and removing physical volumesCombining physical volumes into volume groupsCreating and extending logical volumesAdding new disks to a volume group and extending an logical volumeRemoving logical volumes, volume groups, and physical volumesReviewing LVM commandsSummary
Chapter 14: Advanced Storage Management with Stratis and VDO
Technical requirementsUnderstanding StratisInstalling and enabling StratisManaging storage pools and filesystems with StratisPreparing systems to use VDOCreating and using a VDO volumeTesting a VDO volume and reviewing the statsSummary
Chapter 15: Understanding the Boot Process
Understanding the boot process – BIOS and UEFI bootingWorking with GRUB, the bootloader, and the initrd system imagesManaging the boot sequence with systemdIntervening in the boot process to gain access to a systemSummary
Chapter 16: Kernel Tuning and Managing Performance Profiles with tuned
Technical requirementsIdentifying processes, checking memory usage, and killing processesAdjusting kernel scheduling parameters to better manage processesInstalling tuned and managing tuning profilesCreating a custom tuned profileUsing the web console for observing performance metrics Summary
Chapter 17: Managing Containers with Podman, Buildah, and Skopeo
Technical requirementsIntroduction to containersInstalling container toolsRunning a container using Podman and UBIBasic container management – pull, run, stop, and removeAttaching persistent storage to a containerDeploying a container on a production system with systemdBuilding a container image using a Dockerfile or ContainerfileConfiguring Podman to search registry serversSummary of Podman optionsWhen to use Buildah and SkopeoBuilding container images with BuildahInspecting a remote container with SkopeoSummary
Part 4 – Practical Exercises
Chapter 18: Practice Exercises – 1
Technical requirementsTips for the exercisePractice exercise 1ExercisesExercise 1 solution1. Configuring the time zone to GMT2. Allowing passwordless login to the root user using SSH3. Creating a user named user that can connect to the machine without a password4. The user user should change their password every week, with 2 days’ warning and 1 day of usage once expired5. The root user must be able to SSH as user without a password so that nobody can connect remotely as the root user using a password6. The user user should be able to become root and also execute commands without a password7. When a user tries to log in over SSH, display a legal message about not allowing unauthorized access to this system8. SSH must listen on port 22222 instead of the default one9. Creating a group named devel10. Making user a member of devel11. Storing user membership in a file called userids in the home folder for user12. The user user and root user should be able to connect to the localhost via SSH without specifying the port, and default to compression for the connection13. Finding all man page names in the system, and putting the names into a file named manpages.txt14. Printing usernames for users without a login so that they can be permitted access to the system, and printing the UID and groups for each user15. Monitoring available system resources every 5 minutes without using cron, and storing them as /root/resources.log16. Adding a per-minute job to report the available percentage of free disk space and storing it in /root/freespace.log so that it shows the filesystem and free space17. Configuring the system to only leave 3 days of logs18. Configuring the log rotation for /root/freespace.log and /root/resources.log19. Configuring the time synchronization against pool.ntp.org with fast sync20. Providing NTP server services for the 172.22.0.1/24 subnet21. Configuring system stats for collection every minute22. Configuring the password length for users in the system to be 12 characters long23. Creating a bot user named privacy that keeps its files only visible to itself by default24. Creating a folder named /shared that can be accessed by all users and defaults new files and directories to still be accessible to users of the devel group25. Configuring a network connection with IPv4 and IPv6 addressing named mynic, using the following data: 2001:db8:0:1::c000:207/64 g gateway 2001:db8:0:1::1 ipv4 192.0.1.3/24 gateway 192.0.1.126. Allowing the host to use the hostname google to reach www.google.com, and the hostname redhat to reach www.redhat.com27. Reporting the files modified from those that the vendor distributed, and storing them in /root/altered.txt28. Making our system installation media packages available via HTTP under the /mirror path for other systems to use as a mirror, and configuring the repository in our system. Removing the kernel packages from that mirror so that other systems (even ours) can’t find new kernels. Ignoring the glibc packages from this repository to be installed without removing them29. As user, make a copy of the /root folder in the /home/user/root/ folder and keep it in sync every day, synchronizing additions and deletions30. Checking whether our system conforms to the PCI-DSS standard31. Adding a second hard drive of 30 GB to the system, but using only 15 GB to move the mirror to it, making it available at boot using compression and deduplication, and available under /mirror/mirror32. Creating a second copy of the mirror under /mirror/mytailormirror and removing all packages starting with k*33. Creating a new volume in the remaining space (15 GB) of the hard drive and using it to extend the root filesystem34. Creating a boot entry that allows us to boot into emergency mode in order to change the root password35. Creating a custom tuning profile that defines the readahead to be 4096 for the first drive and 1024 for the second drive – this profile should also crash the system should an OOM event occur36. Disabling and removing the installed httpd package, and setting up the httpd server using the registry.redhat.io/rhel9/httpd-24 image
Chapter 19: Practice Exercise – 2
Technical requirementsTips for the exercisePractice exercise 2ExercisesExercise 2 resolution1. Downloading the necessary file from this book’s GitHub repository at https://raw.githubusercontent.com/PacktPublishing/Red-Hat-Enterprise-Linux-RHEL-9-Administration/main/chapter-19-exercise2/users.txt2. Using the users.txt file to generate users in the system in an automated way using the values provided, in the following order: username, placeholder, uid, gid, name, home, shell3. Creating a group named myusers and adding that group as the primary group to all users, leaving their own groups, named after each user, as secondary groups4. Changing the home folders for the users so that they are group-owned5. Setting up an HTTP server and enabling a web page for each user, with a small introduction for each that is different between users6. Allowing all users in the users group to become root without a password7. Creating SSH keys for each user and adding each key to root and the other users so that each user can SSH like the other users; that is, without a password8. Disabling password access to the system with SSH9. Setting each user with a different password using /dev/random and storing the password in the users.txt file in the second field of the file10. If the number of letters in the username is a multiple of 2, adding that fact to each user description web page11. Creating a container that runs the yq Python package as the entry point12. Configuring password aging for users that are not a multiple of 2 so that they’re expiring13. Configuring a daily compressed log rotation for a month of logs using date-named files14. Saving all logs generated in the day in /root/errors.log15. Installing all available updates for system libraries16. Repairing the broken rpm binary using a previously downloaded package available in the /root folder17. Making all processes that are executed by the user doe run with a low priority and the ones from john run with a higher priority (+/- 5)18. Making the system run with the highest throughput and performance19. Changing the system network interface so that it uses an IP address that’s higher than the one it was using and adding another IPv6 address to the same interface20. Creating and adding /opt/mysystem/bin/ to the system PATH variable for all users21. Creating a firewall zone, assigning it to an interface, and making it the default zone22. Adding a repository hosted at https://myserver.com/repo/ with the GPG key from https://myserver.com/mygpg.key to the system since our server might be down and configuring it so that it can be skipped if it’s unavailable
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare your thoughtsDownload a free PDF copy of this book

Overview

The book "Red Hat Enterprise Linux 9 Administration" is your go-to resource for mastering the skills necessary to administer and secure RHEL 9 systems with confidence. Designed for both aspiring Linux administrators and certification candidates, it provides hands-on practices, practical examples, and in-depth explanations to guide you from initial deployment to advanced management tasks.

What this Book will help me do

Deploy and connect Red Hat Enterprise Linux 9 systems effectively.
Ensure the security of your Linux setups using SELinux, firewalls, and access controls.
Master volume management through LVM and VDO deduplication.
Use remote administration tools like SSH and configure public key authentication.
Automate administrative tasks with scripting and Ansible Playbooks.

Author(s)

Pablo Iranzo Gómez, Pedro Ibañez Requena, Miguel Pérez Colino, and Scott McCarty bring together decades of Linux system administration experience. Their collaboration combines expertise in enterprise system deployment, security, and performance tuning. They write from a perspective of practical teaching, aiming to empower readers with actionable knowledge.

Who is it for?

This book is ideal for aspiring Linux system administrators looking to acquire hands-on skills in managing RHEL 9. Beginners and intermediate users who want to deepen their command line and system configuration knowledge will find it full of essentials. The content caters to system administrators looking to excel in their roles and those preparing for the RHCSA certification exam.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781803248806

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills