Sei sulla pagina 1di 18


Ch1: Kickstart/Anaconda
-------1) Locations:

url --url="";
repo --baseurl="..."

2) Auth:

rootp --plaintext PASSWORD

3) Partition:

clearpart --all --initlabel;

part / --fstype=ext4 --size=4096 --maxsize=100000 --grow
part / --fstype="xfs" --ondisk=vda --size=5120

4) Network:

network --device=eth0 --bootproto=dhcp

lang en_US.UTF-8
timezone --utc
rootpw --plaintext redhat
services --disabled=network,iptables,ip6tables --enabled=Network

5) Config:

group --name=admins --gid=1001
cd /usr/share/
find . -name '*kickstart*.txt' -print
** /usr/share/doc/pykickstart-
Sample File: /root/anaconda-ks.cfg
-----------echo "RUN_FIRSTBOOT=NO" >> /etc/sysconfig/firstboot
- press 'F12' to select the boot media, and choose 'pxe' boot
- on the boot menu, select the appropriate (usually the 1st one) and
press 'tab' key to see options
- add/append to end of line: ks=
lab kickstart setup
- installed the httpd web-server
- created the /var/www/html/ks-config/ directory
cp /home/student/kickstart.cfg /var/www/html/ks-config/
Ch2: Regex / grep

Regular Expression (regex)

^ = begining of the line anchor
$ = end of line anchor
^$ = matches empty lines
[a-zA-Z] = match a range of characters, just ONE occurrence
[a-z0-9] = matches alphanumerics, letters (a-z), and num (0-9). ONE occurrence
[a-z0-9]\{32\} = matches 32 alphanumeric characters.

= match the 'empty' string at the begining of word

= match the 'empty' string at the end of word.

They are my pets
My dog and cat live peacefully
# This is a comment using '#'(hash)
; This is a comment using ';' (semicolon)
$string="My dog and cat live peacefully"
grep -w dog $string <-- match
grep '\<dog\>' $string <-- also match
c[aou]t = c, followed by 'a' or 'o' or 'u' and ends with t
= c, followed by ANY num.of characters, end with t
c.\{2\}t = c, followed by exactly 2 characters, ends with t
Using 'grep'
= case IN-sensitive
= display lines that does NOT match
= search recursively in a directory or list of files
-A <N> = display <N> of lines After regex match
-B <N> = display <N> of lines Before regex match
= matches the entire 'word' (word bounary) in the pattern
= when you need to use multiple regex with the logical OR
[0-9][0-9][0-9] = matches any 3 numbers
cat door.log |grep '1[345]:[0-9]\{2\}:[0-9]\{2\}' > door.out
cat wall.log |grep '14:[345][0-9]:[0-9]\{2\}' > wall.out
cat wall.out |grep -i -v 'no activity' > wall2.out
More examples:
Ch3: More vim
-----------------------------------cmd mode: (default, when you first start vi/vim)
insert mode: press 'i' (or 'a' or 'o' or 'O')
yy = yank (copy)
dd = delete line

Nx = del N characters, e.g. 9x = remove 9 characters from cursor position

ctrl-v = 'visual mode'
v = visual/line-by-line mode
Search & Replace:
a) go into cmd mode (press 'Esc')
b) /pattern <-- to search for pattern
c) :1,$s/pattern/replace/gc <-- search for 'pattern' and replace with 'replace'
note: "g" for global - replace all occurrences, 'c' to ask for confirmat
ion b4
:1 <-- start from 1st line
$s <-- go to end of file
d) :11,20s/pattern/replace/g <-- replace all occurences of 'pattern' with 'repla
ce' FROM line 11 to line 20 only. Do not ask for confirmation.
Ch4: Scheduling - at & cron
-----------------------------------a) "at" command <-- scheduling One-time tasks
at now +5min <CMD>
at noon +4 days <CMD>
at 5pm August 3 2015 <CMD>
atq <-- to view jobs in the queue.
to View the actual commands of the job, use: at -c <jobnumber>
atrm <jobnumber> <-- removes queued jobs
There are a total of 26 queues: a,b,c,d,e....x,y,z
at -q d teatime tomorrow <-- add a new job queue "d" to run at tea time(4pm) tom
> <cmd>
> <cmd>
OR, pipe the command to 'at', e.g.
"Run this command ..." | at now +5
echo "Hello world" >> out.txt | at now +5min
b) "crontab" / cronjob <-- scheduling regular/periodic tasks
User Cron:
5 fields, from left to right
*memorize the fields on page 70
min | hour | (1-31) | (1-12) | (dayofWeek: 0-6)| <cmd-to-run>
System Cron:

Shell scripts in the directories above will be run at those intervals
*Files in the /etc/cron.d/ has the usual 5 time-specs

c) Managing tmp files with systemd - "systemd-tmpfiles"

One of the first services that systemd starts is the
'systemd-tmpfiles-setup' - this service will run the following command:
systemd-tmpfiles --create to create tmp files
systemd-tmpfiles --remove to remove tmp files
Config files at:
/etc/tmpfiles.d/*.conf <-- admin defined.
/run/tmpfiles.d/*.conf <-- run-time configuration, usually set by the services/d
aemons themselves
/usr/lib/tmpfiles.d/*.conf <-- system defined/installed. Do not edit.
Config file format:
Mode UID GID Age Argument
d /run/systemd/xtmp 755 root root d=to create 'd'irectory if does not exist at /run/systemd/xtmp
The directory is owned by root, perm 755,
and is not automatically purged (the Age is '-')
D /home/student/tmp 0700 student student 1d
create dir /home/student/tmp if does not exist. If exist, then del
all contents. when systemd-tmpfiles --clean is run, remove all files
which has not been accessed,changed or modified in more than 1 day.
Syntax: view the man pages --> man 5 tmpfiles.d
*NOTE: after making changes to the tmpfiles config files, remember
to check/test with:
# systemd-tmpfiles --clean <tmp-conf-file.conf>
# systemd-tmpfiles --clean /etc/tmpfiles.d/tmp.conf
Ch5: Priority Processes / nice, renice
--------------------------------------ps aux --sort=nice
nice -n 15 <process-name> &
renice -n -<NICE_LEVEL> <PID>
renice -n -7 $(pgrep sha1sum) <-- change the nice levels of ALL the 'sha1sum' pr
ocesses to -7
kill $(pgrep sha1sum) <-- to kill all process IDs with the pattern 'sha1sum'

Ch6: ACL
-----------------------------------Extends the basic 'rwx' permissions of users and groups
2 commands:
a) setfacl (to set the ACL permissions of resources)
b) getfacl (to view the ACL permissions)
setfacl -m u:<name>:rwX <file|dir>
setfacl -m g:<name>:rwX <file|dir>
setfacl -m o::- <file> <-- the dash '-' means no permission
* if <name> is left blank, then it applies to the file owner, otherwise
<name> can be the username or UID.
Default ACL
setfacl -m d:u:<name>:rx <directory>
setfacl -x d:u:<name> <directory> <-- remove default ACL on dir. set previously
setfacl -b <dir>|<file> <-- removes ALL ACLs (including default ACL)
setfacl -k <directory> <-- removes default ACL on dir
ACL Mask
The ACL mask restricts existing permissions that exceed the mask but
does nothing to permissions that are less permissive than the mask, i.e.
it sets
- named
- group
- named

the MAXIMUM permissions allowed for:

user (the file/dir owner is NOT affected)
owner (but the 'group' owner is affected)

** IMPORTANT: Always do 'chmod' first before setting the ACL via setfacl.
cd /shares;chown -R root:bakerstreet cases; chmod g+s cases;chmod 660 cases/*;se
tfacl -Rm g:scotlandyard:rwX cases;setfacl -Rm u:jones:r-X cases;setfacl -Rm d:g
:scotlandyard:rwX cases;setfacl -Rm d:u:jones:r-X cases;setfacl -m g::rwX cases
cd /shares;chown -R root:bakerstreet cases; chmod g+s cases;setfacl -Rm g:scotla
ndyard:rwX cases;chmod 660 cases/*;setfacl -Rm u:jones:r-X cases;setfacl -Rm d:g
:scotlandyard:rwX cases;setfacl -Rm d:u:jones:r-X cases;setfacl -m g::rwX cases
Ch7: SELinux
-----------------------------------Standard Linux Security (DAC - Discretionary Access Control)
- only 2 privilege levels: "user" and "root"
- main problem: any process/programs launched as the 'user' (bob)
has the user bob's permission. Eg. Bob launches Firefox - can firefox
read Bob's private-keys in ~/.ssh/id_rsa ? YES. So a compromised Firefox
wreak havoc. (Another example, Apache privilege escalation)
SELinux - MAC (Mandatory Access Control)
- default rule is everything is denied.
- every process ('subjects') has to be explicitly allowed to access
the resources ('objects') - such as files, sockets, devices, etc.

3 Types of Access Control

a) Type/Targeted Enforcement (TE) - this is the main mechanism
b) Role-Based Access Ctrl (RBAC)
c) Multi-Level Security (MLS) - usually in high security/Military
SELinux POLICY => (is made up of hundreds of rules) <=> applied to 'context'
Security Context
---------------In SELinux, all subjects (processes) and objects (system resources) are associat
ed with a 'type' which taken together controls the access permissions for specif
ic users. This combo of:
user:role:type is called the "Security Context" (SC)
SELinux Access Rules are constructed based on these SC.
TE (Type Enforcement)
This is based on a single security property - 'type'
- is applied to processes (subjects) and resources (objects), eg
* Apache processes --> type is: httpd_t
* /var/www/html/index.php --> type is: httpd_sys_content_t
- Access is allowed solely by types, eg:
* many processes (subj) and resources (obj) have same type
* processes with same type have same access to resources of the same type. Fo
r example:
* httpd_t can read/access httpd_sys_content_t
* Process types called "domains"
(sometimes applied to resources such as sockets)
* Different resources can have same type
Targeted Policy uses the 'TE' (Type enforcement)
- System where processes by default are 'un-confined'
- Only targeted processes are confined
- Unconfined Domains
* default user processes runs in unconfined_t
* system processes run in initrc_t
* 'unconfined' processes have the same access/privileges like
a normal Linux system without SELinux
* Daemons (services) with defined policy transition to confined domains, e.g.
- httpd started from 'unconfined_t' transitions to 'httpd_t' which has limit
ed access.
"Z" is your friend.
ls -Z
id -Z
ps auxZ
lsof -Z
netstat -natZ
find / -context=
cp - uses the security context of the destination directory
mv - maintains the original source security context.
installation (via yum or rpm) - sets default security context based on system de

faults/system policy.
Essential Software Packages to install
yum install policycoreutils policycoreutils-python policycoreutils-gui
yum install setroubleshoot setroubleshoot-server
Essential CMDs:
setenforce 1 (enforcing)
setenforce 0 (permissive)
semanage boolean -l
semanage boolean -l -C <-- shows variation from the default
semanage fcontext -l <-- to list all
semanage fcontext -l | grep 'httpd_.*content*'
semanage fcontext -a -t <TYPE> '/directory(/.*)?'
restorecon -Rv /directory
chcon -Rv --reference <good_dir_context> <destination_dir>
chcon -Rv --reference /var/www/html /custom <-- '-R' for recursive, 'v' verbose
chcon -Rv --reference /var/www/html '/custom(/.*)?' <-- Cap.Hook doesn't work wi
th chcon
semanage fcontext -a -t httpd_sys_content_t '/virtual(/.*)?'
restorecon -RFv /virtual
ls -ldZ /var/www/html
semanage fcontext -a -t httpd_sys_content_t <-- "-a -t" (add type)
semanage fcontext -d -t httpd_sys_content_t <-- "-d -t" (delete type)
getsebool -l
setsebool -P httpd_enable_homedirs on <-- "-P" for permanent
semanage boolean -l (to view all the booleans)
semanage boolean -l <-- show all default boolean values and their description
semanage boolean -l -C <-- shows the variation of the boolean that differs from
(this happens when we use the 'P' (permanent flag) to set a boolean value, e.g
# setsebool -P httpd_enable_homedirs on (<-- "P" for permanent)
# semanage boolean -l -C
getsebool -a | less <-- to list the current boolean settings
Viewing SELinux Alerts
----------------------tail -f /var/log/messages
journalctl -f -l -p err

Apache 101
---------1) Config file: vi /etc/httpd/conf/httpd.conf
- search for "DocumentRoot" <-- this specify the location of the web (html) fil
default is /var/www/html
to change to another location, need to edit 2 lines, e.g.
a) DocumentRoot /var/www/html => to: DocumentRoot /custom
b) <Directory /var/www/html> => to: <Directory /custom>
- After editing the Apache config file, remember to restart Apache,i.e. "system
ctl restart httpd"
2) Publish web content from User's home directory:
- vi /etc/httpd/conf.d/userdir.conf
search for "UserDir disabled" <-- change this to:
UserDir enabled
search for "#UserDir public_html" <-- default is commented,ieit has a '#' at t
he begining,then uncomment it. It should read:
UserDir public_html

Example: Enabling User's (student) public_html directory

$ mkdir /home/student/public_html
$ su # semanage boolean -l|grep 'httpd.*home*'
(off , off) Allow httpd to enable homedirs
# setsebool -P httpd_enable_homedirs on
# semanage boolean -l -C (<-- to view the change from the default settings)
# vi /etc/httpd/conf.d/userdir.conf
Change "UserDir disabled" ---> TO: "UserDir enabled"
Uncomment: #UserDir public_html ---> TO: UserDir public_html
(note: change the <Directory "/home/*/..."> entry accordingly)
# systemctl restart httpd <-- remember to restart httpd after making changes to
the config file
The following 2 cmds are the 'manual' method to make non-standard httpd folders
accessible on the web.
# semanage fcontext -a -t httpd_sys_content_t "/home/student/public_html(/.*)?"
# restorecon -Rv /home/student/public_html
Ch8: Ldap,Kerberos/IPA (Identity,Policy & Audit server)
---------------------------------------------------- Centralized authentication/user login is vital in an enterprise environment
- 2 methods: a) LDAP+Kerberos+sssd (b) IPA (Identity,Policy,Audit) Server
- IPA is basically LDAP+Kerberos+web UI+extras (LDAP+Kerberos on steroids)
Note: the server side is assumed already configured

a) on the client (e.g. desktopX)

# yum install sssd authconfig-gtk krb5-workstation
# authconfig-gtk &
*** IMPORTANT: the 'REALM' must be in UPPERCASE
b) on the client
# yum install ipa-client
# ipa-client-install --no-ntp --mkhomedir
Ch9: FileSystems, Mounts, Swaps
-----------------------------------MBR (Master Boot Record) - use fdisk
- stores only 1 copy of the partition data at the begining of the hdd.
- if lost or corrupted, then data is lost
- Max: 4 partitions, if need more, then one of the partitions must be
'extended' partition, which can contain multiple logical partition
GPT (GUID Partition Table) - use gdisk
GPT partitions are used in systems running the UEFI.
- stores partition data at begining of disk as well as
backup partition table at the end of the disk with
CRC32 checksums
fdisk /dev/vda <-- note: there is no number,
i.e. fdisk /dev/vda1 <-- wrong.
gdisk /dev/vdb
Options in 'fdisk'
p = print/display the partition table on screen
n = create a new partition
t = to change the partition type (82=swap, 83=Linux, 8e=Linux LVM)
d = to delete a partition
w = to save the changes
**NOTE: only 4 primary partitions, if need more, use 'extended' ("e") partition

----------mkfs -t xfs /dev/vda1 <-- specify partition '1', i.e. /dev/vda1
mkfs -t ext4 /dev/vdb2 <-- partition 2 on second hdd. "-t" is type
mount /dev/vdb2 /mnt
Persistent: Mount points specified at /etc/fstab
TO find "UUID":
--------------blkid /dev/vdb1
blkid /dev/vdb2
Swap Space
------------mkswap /dev/vdb2
swapon /dev/vdb2 <-- turn on the swap space

swapoff /dev/vdb2 <-- turn off swap

example /etc/fstab entry:
UUID=fadkasuyr...dfsc swap
UUID=fadkasuyr...dfsc swap

0 0
0 0
(specify swap priority)

The last 2 digits represents: "dump flag" (an old backup utility called 'dump')
and "fsck" (fileSystem check).
Since swap space does not need these 2 options, they are set to 0 0
For the root file system, it's typically 1 1.
For the LOCALLY mounted file system (eg /dev/vdb1), they are
usually 1 2 (but it can also be: 0 0)
(the 'fsck' order is '2' which has less priority over the root filesystem)
Note: on most modern systems today, it's 0 0
For network mounted (NFS or CIFS), use 0 0 because the
remote disk is NOT under the local machine's control
To recap:
fdisk /dev/vdb <-- to create partitions. Do NOT specify partition num.
n = create new partition. Then specify partition num.
accept the default first/starting sector
specify the disk size, e.g +512M or +1G, etc
p = print - display the changes you've made
t = change the partition type
w = write the changes to disk
Types, 't'
83 <-- default Linux partition
8e <-- LVM partition
82 <-- swap space
(for 'gdisk' - add 2 zeroes at the end, eg. 8e00 for LVM, 8300 for Linux part)
Then run 'partprobe' to tell the kernel of the new partition
create filesystem:
----------------mkfs -t xfs /dev/vdb1
mkfs -t ext /dev/vdb3
Making Swap space
- create the partition using fdisk or gdisk. Change type to 82
- mkswap /dev/vdb2
- swapon /dev/vdb2
IF adding the swap entry into the /etc/fstab, then enable it by
swapon -a <-- "-a" for all
To disable swap
swapoff -a
To set a priority for the swap-space in /etc/fstab, use:
0 0
0 0

- do NOT create different partitions using both fdisk and gdisk. It will confuse
the system. If you had created the 1st partition using gdisk, then use gdisk fo
r ALL other other partition on that disk. If you had created the 1st partition u
sing fdisk, then use fdisk for all the other partitions on that disk.
Ch10: LVM
-----------------------------------5 steps in creating a usable LV
a) prepare the physical device - use fdisk/gdisk to create partitions.
# fdisk /dev/vdb
# fdisk /dev/vdc
b) create the PV (initialize the partitions)
# pvcreate /dev/vdb1 /dev/vdb2 /dev/vdc1
c) create the VG (called 'avengers')
# vgcreate avengers /dev/vdb1 /dev/vdb2 /dev/vdc1
d) create the LV (called 'hulk', 10G in size in the 'avengers' volume group)
# lvcreate -n hulk -L 10G avengers
e) create the filesystem, e.g.
# mkfs -t xfs /dev/avengers/hulk
then, create a mount point to mount this new filesystem, eg.
# mkdir /mnt/hulk
# mount /dev/avengers/hulk /mnt/hulk
# mount -a
OR add entry in /etc/fstab (to make the mount permanent/survive a reboot)

/mnt/hulk xfs defaults

1 2

PV cmds
pvcreate /dev/vdb1 /dev/vdb2
pvremove /dev/vdb1 /dev/vdb2
pvdisplay /dev/vdb2
pvmove /dev/vdb1 <-- this will move all the data (in the phy.extents to other PV
s in the same VG)
VG cmds
vgcreate <vgname> /dev/vdb1 /dev/vdb2
vgremove <vgname>
vgdisplay <vgname>
vgextend <vgname> /dev/vdc1
LV cmds
lvcreate -n <lvname> -L <SIZE> <vgname>
lvremove /dev/vgname/lvname
lvdisplay /dev/vgname/lvname
lvextend -L +300M /dev/vgname/lvname
-> after running lvextend, remember to run 'xfs_growfs' to expand the file syste
m to occupy the extended LV, e.g.

# xfs_growfs /mnt/storage
** alternatively, can use resize2fs, but instead of the mount point, it takes th
e LV name,e.g
# resize2fs /dev/vgname/lvname <-- may not always work. use "xfs_growfs" first
Ch11: NFS
-----------------------------------RHEL7 uses NFSv4 (uses TCP) by default and falls back to nfs3 or nfs2 if nfs4 is
not available. (NFS 3 or 2 can use either tcp or udp)
* Manually mount a NFS share (via cmd line OR via /etc/fstab)
* Automatic mount of NFS share via 'autofs' service
NFS shares are secured by various methods: 'none', 'sys', 'krb5', 'krb5i' and 'k
The nfs client must connect to the exported share using one of the methods above
as specified by the share (via the mount option, sec=<method>)
the Kerberos option will require at least /etc/krb5.keytab which will be provide
d. It is outside the scope of this course. Just remember it's required!
The "nfs-secure" (part of the 'nfs-utils' package) service is used to manage com
munication with the server when connecting to kerberos secured shares.
Steps in SEQUENCE:
--------------------1. check if nfs-utils package is installed (yum list nfs-utils)
If not installed, then 'yum install nfs-utils'
2. download the 'krb5.keytab' from the server/classroom and rename it to /etc/kr
# wget -O /etc/krb5.
3. # systemctl enable nfs-secure
# systemctl start nfs-secure
4. Create the mountpoints on the DesktopX
# mkdir -p /mnt/public
For Manual Mounts:
a). Edit /etc/fstab and add the following line:
# /dev/vda1
# /dev/shazam/storage






b) Test it out:
# mount -a (to mount all the filesystem/shares in the /etc/fstab)
# df -h
For AutoMounts: (autofs)
yum -y install autofs

a) create the master-map (*.autofs) files in the /etc/auto.master.d/

b) create the corresponding map file /etc/ (eg. /etc/auto.shares, /etc/auto.dire
ct, /etc/
c) Enable and start autofs service:
# systemctl enable autofs
# systemctl start autofs
Automounter Benefits:
- users do not need root privileges to run mount/umount cmds
- nfs shares are not permanently connected via /etc/fstab
- "autofs" is the service that handles all these
yum install autofs: will create the following files & dir:
/etc/auto.master.d/ <-- directory
1. create a 'master map' file (*.autofs) - which identifies the base directory u
sed for mount points as well as identifies the mapping files (/etc/auto.*) used
for creating the automounts
# vi /etc/auto.master.d/master.autofs
(add the following entry)
/etc/ <-- /shares is the 'base directory'
# vi /etc/
work -rw,sync,sec=krb5p
docs -rw,sync,sec=sys

'work' & 'docs' are the mount point that will be automatically created/remove
d by the 'autofs' service. The full path is /shares/work & /shares/docs (remem
ber that /shares is the base dir for the mount point)
OR, use wildcard:
# vi /etc/


The master-map file content: /etc/auto.master.d/direct.autofs
The content for the mapping-file: /etc/
/mnt/public -rw,sync,sec=krb5p
note: you need to create the /mnt/public directory manually.
In the case of auto-map, you only have to create base dir (/shares)
and the autofs service will automatically create the 'works' and 'docs' director
y when needed.
1) Use Fully Qualified Name, i.e. and NOT serverX:/s

2) Double check the 'security' type,ie. sec=krb5p <-- don't for the 'p' if aske
d to use encryption for security. (krb5i = for integrity check and 'sys' for loc
alsystem security).
Ch12: SMB
------------------------------------ Mount SMB file systems manually (cli and /etc/fstab)
- Mount SMB file systems (CIFS) automatically - via autofs
Required software packages: cifs-utils
Optional (but useful): samba-client package - has the 'sambaclient-*' cmd line u
3 Steps:
-------a) identify the remote share to access
b) determine the mount point where the share should be mounted (create it locall
y if needed)
c) mount the SMB share via cli or appropriate config change
- SMB shares can be flagged as non-browseable, and can be restricted to specific
users, groups
- there are many authentication scheme supported by SMB, the most common is the
username/pass combo.
(these can be stored in /etc/fstab itself or in a secret 'credentials' file, e
g /etc/smbcred.smb)
Manual Mount
# mount -t cifs -o guest

//serverX/share /mnt/share

(in comparison to other filesystem/nfs)

mount -t nfs -o rw,sec=krb5p serverX:/shares /mnt/nfshare
mount (-t xfs -o defaults)
mount (-t ext4 -o defaults) /dev/VG/lvname /mnt/lv1
# mount -t cifs -o username=watson //serverX/share /mnt/share <-- you'll be prom
pted for passwd
# mount -t cifs -o cred=/etc/smbcred.smb //serverX/shre /mnt/share
(username & passwd is stored in the /etc/smbcred file)
format for the credentials file:
** NOTE: the client needs to have the same UID/GID as the user/group on the SMB
AutoMount (autofs)
- create a 'master map' file (*.autofs) in /etc/auto.master.d/ (eg. /etc/
/shares /etc/auto.smb
- create the associated map file (auto.*) in the /etc/ directory, e.g. /etc/auto

(For CIFS/samba - take note of the colon ":")
cases -fstype=cifs,credential=/etc/smbcred.smb ://serverX/cases
(For NFS:)
cases -rw,sync,sec=krb5p


- # systemctl enable autofs

# systemctl start autofs
NOTE: the file /etc/smbcred.smb:
Ch13: Boot Process
------------------------------------BIOS & UEFI are both 'firmware interfaces' that acts as an interperter between t
he computer hardware/firmware with the Operating System. Both BIOS/UEFI are used
at the startup to initialize the hardware components and load the OS "bootloade
r" (grub, grub2,etc) stored on the hardisk.
BIOS: reads 1st sector of HDD. .
UEFI: modern hardware - all initialization code are kept in *.efi files on the H
Detailed info:
(nice to know, but not essential)
What could go wrong with the boot process?
1) corrupted /etc/fstab => boot into
ie. same line as 'linux16...' - append:
the give root passwd and edit the /etc/fstab and remove the offending entry
2) corrupted /boot/grub2/grub.cfg (boot loader)
upon startup, select the boot entry and press 'e' to edit
then look for the offending grub2 entry and correct it, e.g. "os16" --> "linu
after system had booted up, login and run:
# grub2-mkconfig > grub-new.cfg
# diff grub-new.cfg /boot/grub2/grub.cfg <-- see the offending entries.
# grub2-mkconfig > /boot/grub2/grub.cfg <-- install the new/corrected
3) Lost Root Passwd
- on the boot menu, select the appropriate entry and press 'e'
- on the 'linux16' line, append "rd.break" (without quotes). This will boot t
he system
and mount the root filesystem as 'read only' on /sysroot
# mount -o remount,rw /sysroot <-- remount for read-write
# chroot /sysroot <-- make this the 'tmp' root filesystem
# passwd root <-- change the root passwd
# touch /.autorelabel <-- tells SELinux to relabel (fixes permissions, etc)
# exit; (exit from chroot)
# exit; (exit from the rescue shell) and continue booting

systemctl get-default
systemctl set-default
systemctl isolate ( <-- reboot)
important targets : sulogin prompt, basic system initialization completed, system
in read/write mode sulogin prompt, initramfs pivot compete and system root mounte
d on / (read only)
** To select a different target at boot time, a special option can be appended t
o the kernel
command line from the boot loader: eg:
Fix incorrect /etc/fstab entry
-----------------------------1. Reboot
2. Interrupt the boot loader menu countdown by pressing any key
3. Move the cursor to the entry to be started. Press "e" to edit that entry
4. Move cursor to the line that starts with "linux16". This is the kernel cmd li
5. Append: systemd.unit=<>
6. Press 'ctrl-X' to reboot
Recover root passwd
-------------------1. Select the Boot-Entry (default or the rescue), and press 'e' to edit
2. Goto the the 'linux16' (the line that has /boot/vmlinuz-3.x.x <-- this is the
press the 'end' key to go to end of the line, and append: "rd.break" (without
=> this will break just before ctrl is handed from the initramfs t othe actua
l system
3. Ctrl-X to continue booting - a root shell is presented where the actual syste
m is mounted
as 'read-only' on /sysroot
4. RE-mount /sysroot as read-write:
# mount -o remount,rw /sysroot
# chroot /sysroot <-- switch into chroot jail,
where /sysroot is treated as the root of the file-system
# passwd root <-- reset root pass
# touch /.autorelabel <-- needed for SELinux relabelling for correct per
m settings
6. # exit (to exit from chroot)
# exit (exit the initramfs debug shell)
Repairig Grub2
---------------grub2-mkconfig > /boot/grub2/grub.cfg
* in grub menu entries, "linux16" is valid. Anything else
such as "os16" is wrong.
-----to remount a 'read-only' filesystem:
# mount -o remount,rw /

Ch14: FirewallD
------------------------------------ old ways: iptables, ip6tables, ebtables <-- find out what's ebtables
- firewalld - manages both ipv4 and ipv6
- All network traffic is classified into "zones".
- based on criteria such as source IP of packet, or the incoming NIC, traffic is
diverted to the appropriate zones and the rules in that zone is then applied
* every packet that comes into the system is first checked for the source IP add
if it matches a specific zone, then the rules in that zone is applied. If the so
IP is not tied to a zone, then the zone for the incoming network interface is us
If the network interface is not associated with any zone for some reason, then t
default zone will be used. The 'public' zone is used by default
Pre-defined zones:
------------------ trusted
- internal: similar to home
- home: reject all unless related to outgoing or ssh,ipp-client,dhcpv6-client
- work: reject all unless related to outgoing or ssh,ipp-client,dhcpv6-client
- public: reject all unless related to outoing or ssh, dhcpv6-client
- external: reject all unless related to outgoing or ssh. Outgoing ipv4 traffic
thru this zone is
- dmz: reject all unless related to outgoing or ssh
- block: reject all unless related to outgoing
- drop: drop all unless related to outgoing (do not respond with icmp err messag
Predefined Services: firewall-cmd --get-services (to view all)
-------------------ssh: local ssh server. Port 22
dhcpv6-client: local DHCPv6 client. Port 546/udp
ipp-client: local IPP priting. Port 631/udp
samba-client: local Windows file & print sharing client. Port 137/udp & 138/udp
mdns: Multicast DNS (mDNS) local-link name resolution. Port 5353/udp to 224.0.0.
To configure firewalld
------------------------firewall-config & (GUI) [yum -y install firewall-config]
firewall-cmd (cli)
firewall-cmd --get-default-zone
firewall-cmd --set-default-zone=<ZONE>
firewall-cmd --add-source=<CIDR> --zone=<ZONE> (default zone is assumed if zone
is not specified)
firewall-cmd --remove-source=<CIDR> --zone=<ZONE>
firewall-cmd --add-interface=<IFACE> --zone=<ZONE>
firewall-cmd --change-interface=<IFACE> --zone=<ZONE>


--add-service=<SERVICE> --zone=<ZONE>
--add-port=PORT/PROTO --zone=<ZONE>
--remove-service=<SERVICE> --zone=<ZONE>
--remove-port=PORT/PROTO --zone=<ZONE>

To view the available services in a particular zone:

firewall-cmd --list-services --zone=<ZONE>
Useful commands:
(e.g. whereis tmpfiles.d; whereis sealert; whereis httpd)
(e.g. find /usr/lib -iname "tmp*" -print)
Software packages to install
yum -y install sssd
yum -y install authconfig-gtk
yum -y install krb5-workstation
yum -y install ipa-client
yum -y install nfs-utils
yum -y install cifs-utils
yum -y install autofs
yum -y install httpd
yum -y install mod_ssl
yum -y install system-config-kickstart
yum -y install setroubleshoot
yum -y install setroubleshoot-server
Useful Site: