Laboratorio

1. Setting up a Base Server

• Install two RHEL servers as a virtual machine, using the minimal installation pattern.
• Use the names server1.example.com and server2.example.com and use DHCP to get an IP address from the local DHCP server. Configure host name resolution for both.
• Use default partitioning.
• Do NOT register the servers with Red Hat. Do NOT set a root password.
• Create an administrative user anna with the password “password”

2. Getting Administrative Access

Use the appropriate solution to reset the root password on server2, assuming that you have lost the root password and you have no administrator access to the server anymore.

init=/bin/bash

init=/bin/bash

mount -o remount,rw /
passwd root
touch /.autorelabel
exec /usr/lib/systemd/systemd

3. Configuring Repository Access

• On server1, copy the contents of the installation disk to the directory /repo. Verify that it has the directories /repo/BaseOS and /repo/AppStream
• Provide access to the directory contents using the Apache web server, such that it can be used as a repository.
• Configure both servers as a repository client to this server.
• After successfully completing this task, you should be able to install software on both servers.

mount /dev/sr0 /mnt
mkdir /repo
cp -R /mnt/* /repo
dnf config-manager --add-repo="file:///repo/AppStream"
dnf config-manager --add-repo="file:///repo/BaseOS"
echo "gpgcheck=0" >> /etc/yum.repos.d/repo_AppStream.repo
echo "gpgcheck=0" >> /etc/yum.repos.d/repo_BaseOS.repo
dnf install httpd
vi /etc/httpd/conf/httpd.conf

DocumentRoot "/repo"

<Directory "/repo">
  ...
</Directory>

semanage fcontext -a -t httpd_sys_content_t 'repo(/.*)?'
restorecon -rv /repo/
firewall-cmd --add-service http --permanent
firewall-reload

vi /etc/yum.repo.d/repo_AppStream.repo
vi /etc/yum.repo.d/repo_BaseOS.repo

systemctl enable --now httpd
dnf repolist

4. Manage Users and Groups

Actividad 1

• On server2, create a user chisha. Ensure she has the password set to “password” and is using UID 1234. She must be a member of the secondary group sales.
• Create user caroline who also is a member of the group sales.
• On server2, create a user myapp. Ensure this user cannot open an interactive shell.

useradd -u 1234 -G sales chisha
id chisha
useradd -G sales caroline
useradd -s /usr/sbin/nologin myapp

Actividad 2

• On server 1, ceate a user linda.
• Create a sudo configuration that allows linda to perform common user management tasks.
  • Allow using useradd, usermod and userdel
  • Allow changing passwords, but not the password for user root.
• Ensure that the user only needs to enter a password for sudo operations every 60 minutes.

useradd linda
passwd linda
visudo

linda    ALL=/usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel, /usr/bin/passwd, ! /usr/bin/passwd root
Defaults  timestamp_type=global, timestamp_timeout=60

su - linda
sudo useradd test
sudo passwd test
sudo userdel -r test
sudo userdel root

Actividad 3

• On server 1, set default values for new users. A user should get a warning three days before expiration of the current password.

vi /etc/login.defs

useradd test
chage -l test

Actividad 4

• On server 1, create a group named operators.
• Ensure that all users who belong to the operators group can run sudo commands.
• The users must enter their own password when using sudo.

groupadd operators

visudo

%operators ALL=(ALL) ALL

chmod -aG operators test
su - test
sudo whoami
sudo visudo
sudo su

Actividad 5

On server2, create a shared group directory /data/sales and ensure that chisha is the owner of that directory.

• The owner and the group sales should have permissions to access this directory and read and write files in it. Other users should have no permissions at all.
• Ensure that any new file that is created in this directory is group-owned by the group sales automatically, and can only be deleted by chisha, as well as the user that created the file.

groupadd sales
usermod -aG sales chisha
mkdir -p /data/sales
chown chisha:sales /data/sales

5. Managing Partitions

• On server1, use your virtualization software to increase the size of your primary disk in such a way that at least 10GiB of unallocated disk space is available.
• In the free disk space, create a 1GiB partition and format it with the ext4 filesystem. Make sure it is mounted persistently using its UUID on the /mnt/files directory.
• Also create a 1GiB swap partition and ensure it is mounted persistently using its UUID.

lsblk
fdisk /dev/nvme0n2

lsblk
mkfs.ext4 /dev/nvme0n2p1
mkswap /dev/nvme0n2p2
blkid -s UUID -o value /dev/nvme0n2p1 /dev/nvme0n2p2 >> /etc/fstab
vi /etc/fstab

UUID=630959e6-77c3-4473-ae04-65edc153f50a       /mnt/files      ext4    defaults        0 0
UUID=44361dc1-598b-4f71-a6a2-bd34947a08c1       none            swap    defaults        0 0

mkdir /mnt/files
mount -a
systemctl daemon-reload
lsblk
free -h
swapon -a
free -h
swapon --show

6. Managing SELinux

Actividad 1

• Ensure that the Apache webserver is installed on server2 and configure it to offer access on port 82.
• Copy the file /etc/hosts to /tmp/hosts. Next, move /tmp/hosts to the directory /var/www/html/hosts and ensure this file can be accessed by the Apache webserver.

systemctl status httpd
vi /etc/httpd/conf/httpd.conf

man semanage-port
semanage port -a -t http_port_t -p tcp 82
systemctl restart httpd
systemctl status httpd
cp /etc/hosts /tmp/hosts
mv /tmp/hosts /var/www/html/hosts
ls -Zl /var/www/html/hosts
ls -Zl /var/www/
semanage fcontext -a -t httpd_sys_content_t /var/www/html/hosts
restorecon -Rv /var/www/html/
ls -Zl /var/www/html/hosts

Actividad 2

• En server2, verifica el estado actual de SELinux. Luego cambia SELinux temporalmente a modo Permissive y confirma el cambio. Finalmente, vuelve a dejar SELinux en el estado original recomendado para seguridad.

getenforce
sestatus
setenforce 0
getenforce
setenforce 1
getenforce

7. Managing SSH Access

• Set up SSH passphrase-based authentication which allows the root user to log in from server1 to server2 without having to enter anything.

sudo su
ssh-keygen
ssh-agent /bin/bash
ssh-add
ssh-copy-id anna@192.168.145.129
ssh anna@192.168.145.129

8. Managing Archives

Actividad 1

• On server 1, use tar to create a compressed archive of all files in the /etc and /opt directories. Write this archive to your home directory.
• Create a symbolic link to the archive you’ve just created in the /tmp directory.
• Remove the archive from your home directory. What happens to the symbolic link?

sudo su
tar -cf backup.tar.gz /etc  /opt
ln -s /root/backup.tar.gz /tmp/backup.tar.gz
ls -l /tmp/backup.tar.gz

Actividad 2

• On server 2, create /root/backup.tar.bz2 containing /usr/local, compressed with gzip2.

sudo su
tar -zcf backup.tar.bz2 /usr/local
file backup.tar.bz2

9. Managing Logs

• On server2, make sure the systemd journal is persistent.
• Create an entry in rsyslog that writes all messages with a severity of error or higher to /var/log/error.
• Ensure that /var/log/error is rotated on a monthly basis, and the last 12 logs are kept before they are rotated out.

mkdir /var/www/journal
systemctl restart systemd-journal-flush.service
ls /var/log/journal/

vi /etc/logrotate.conf

systemctl restart rsyslog.service
logger -p err errormessage
cat /var/log/error
cd /etc/logrotate.d/
cp sssd error
vi error

10. Gestión con tuned

En server1:

• Verifica el perfil activo de tuned
• Cambia el perfil a throughput-performance
• Asegúrate de que el servicio quede habilitado y activo
• Verifica que el cambio se aplicó correctamente

tuned-adm list
tuned-adm active
tuned-adm profile throughput-performance
systemctl enable --now tuned
tuned-adm active

11. Managing Flatpak

• On server2, add the Flatpak repository https://dl.flathub.org/repo/flathub.flatpakrepo in such a way that it is accessible for user chisha only.
• As user chisha, install the gimp application from this repository, in such a way that it is accessible for this user only.

dnf install -y flatpak
flatpak remotes
flatpak remote-add -u flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak remotes
flatpak install -u gimp
flatpak list

12. Setting Time

• Configure server1 and server2 as an NTP client for pool.ntp.org

vi /etc/chrony.conf

systemctl restart chronyd
systemctl status chronyd

13. Find Files

Actividad 1

Find all files owned by anna and copy to /root/findfiles

find / -user anna
find / -user anna -exec cp -a {} /root/findfiles/ \;

Actividad 2

• Find all files in the /usr directory that have either the SUID or the SGID permission set and a size smaller than 100KiB.
• Copy these files to /root/sugidfiles.

mkdir /root/sugidfiles
find /usr -perm /6000 -size -100k -exec cp -r {} /root/sugidfiles/ \;

Actividad 3

• Find all files in the /etc directory and its subdirectories that contain the text “alex”.
• Exclude any results that contain the text “alexander”.
• Write the names of these files, as well as the lines with the matching text, to the file /root/alexfiles.txt.

touch /root/alexfiles.txt
grep -r "alex" /etc | grep -v "alexander" > /root/alexfiles.txt

Actividad 4

• Find all files in the /etc directory and its subdirectories that contain the text “Administrator” or “administrator”.
• Write the names of these files, as well as the lines with the matching text to the file /root/administratorfiles.txt.

grep -rE "Administrator|administrator" /etc > /root/administratorfiles.txt

Actividad 5

Find all lines containing “ng” in /usr/share/xml/iso-codes/iso_639_3.xml.
Copy these lines to /root/list.txt in original order. No empty lines; exact copies required.

grep "ng" /usr/share/xml/iso-codes/iso_639_3.xml | grep -v '^$' > /root/list
cat /root/list

Actividad 6

Use head and tail to display the fifth line of the file /etc/passwd.
Use sed to display the fifth line of the file /etc/passwd.
Use awk in a pipe to filter the last column out of the results of the command ps aux.
Use grep to show the names of all files in /etc that have lines that contain the text ‘root’ as a word.
Use grep to show all lines from all files in /etc that contain exactly 3 characters.
Use grep to find all files that contain the string “alex”, but make sure that “alexander” is not included in the result.

head -n 5 /etc/passwd | tail -n 1
sed -n '5p' /etc/passwd
ps aux | awk {' print $NF '}
grep -rlw 'root' /etc 2>/dev/null
grep -rhx '...' /etc/* 2>/dev/null
grep -rlw 'alex' / 2>/dev/null

Actividad 7

Find all files that have the SUID permission set, and write the result to the file /root/suidfiles.

mkdir /root/suidfiles
find / -perm /4000  2>/dev/null -exec cp -r {} /root/suidfiles/ \;
ls /root/suidfiles/

14. Managing Processes

• On server1, use the user linda and open a shell as this user.
• As linda, run two background processes sleep 600; one of them with the highest possible priority, the other one with the lowest possible priority.
• Use the most efficient way to terminate all current sessions for user linda.

sleep 600 &
nice -n 19 sleep 600 &
jobs

ps aux | grep linda
killall -u linda
ps aux | grep linda

15. Configure Cron Job

Actividad 1

• On server1, Ensure the systemd timer that cleans up tmp files is enabled.
• Run a cron job that will issue the command touch /tmp/cronfile 5 minutes from now as user linda.

sudo su
systemctl status systemd-tmpfiles-clean.service
crontab -e -u linda

42 * * * * touch /tmp/cronfile

ls -l /tmp/cronfile

Actividad 2

On server 2, configure cron job
Configure cron job for user harry to execute /usr/bin/echo hello daily at 14:23

useradd harry
crontab -u harry -e

23 14 * * * /usr/bin/echo hello

sudo crontab -u harry -l

16. Managing Scripts

• On server1, write a script that makes a copy of each file that has the *.txt extension. The copy should be named filename.txt.bak. After making the copy, the script should move it to the /tmp directory.
• While running the script, the directory where it should look for the files should be provided as an argument.
• If no argument was provided, the script should stop with exit code 9.

mkdir files
touch files/file{1..9}.txt
vi my-script.sh

#!/bin/bash
 
var=$1
 
[ -z $var ] && exit 9
 
cd $var
 
for i in *.txt;
do cp $i /tmp/$i.bak;
done;

./my-script.sh files/
ls /tmp/

17. Managing Systemd Services

• Make sure the httpd service is automatically started.
• Edit its configuration such that on failure, it will continue after 1 minute.

systemctl cat sshd

Restart=on-failure
RestartSec=42s

systemctl edit httpd

[Service]
Restart=on-failure
RestartSec=60s

systemctl restart httpd
systemctl status httpd
killall -SIGKILL httpd
systemctl status httpd
date
systemctl status httpd

18. Scheduling Jobs

Actividad 1

On server 2, schedule a systemd timer job that writes “hello folks” to syslog every Monday through Friday at 2 AM. Make sure this job is executed as the user chisha.

loginctl enable-linger chisha
ssh chisha@localhost
mkdir -p .config/systemd/user/
cd .config/systemd/user/
vi hello.service

[Unit]
Description=Write hello folkjs for syslog
 
[Service]
Type=oneshot
ExecStart=/usr/bin/logger "hello folks"

vi hello.timer

[Unit]
Description=Run hello.service Mon-Fri 2AM
 
[Timer]
OnCalendar=Mon..Fri *-*-* 02:00:00
Persistent=true
Unit=hello.service
 
[Install]
WantedBy=default.target

systemctl --user daemon-reload
systemctl --user enable --now hello.timer
systemctl status hello.timer

Actividad 2

• On server2, install the package that provides the nslookup command.
• Create a script that runs nslookup against example.com and writes the result to /var/log/dns-check.log.
• Configure the system so the script runs every 5 minutes.
• Do not use crontab.
• Use a systemd service and timer.

vi /usr/local/bin/dns-check.sh

#!/bin/bash
 
nslookup example.com >> /var/log/dns-check.log
echo "-------" >> /var/log/dns-check.log

chmod +x /usr/local/bin/dns-check.sh
vi /etc/systemd/system/dns-check.service

[Unit]
Description=Run DNS check with nslookup
 
[Service]
Type=oneshot
ExecStart=/usr/local/bin/dns-check.sh

vi /etc/systemd/system/dns-check.timer

[Unit]
Description=Run DNS check every 5 minutes
 
[Timer]
OnBootSec=1min
OnUnitActiveSec=5min
Unit=dns-check.service
 
[Install]
WantedBy=timers.target

systemctl daemon-reload
systemctl enable --now dns-check.timer
systemctl list-timers | grep dns-check
systemctl status dns-check.timer
cat /var/log/dns-check.log

19. Managing Autofs

Actividad 1

• On server2, create the directories /homes/user1 and /homes/user2. Use NFS to share these directories and ensure the firewall does not block access to these directories.
• On server1, create a solution that automatically, on-demand mounts server2:/homes/user1 on /homes/user1, and also that automatically, on-demand mounts server2:/homes/user2 on /homes/user2 when these directories are accessed.

mkdir -p /homes/user{1..2}
ls /homes/
dnf install -y nfs-utils
echo "/homes *(rw,no_root_squash)" >> /etc/exports
systemctl enable --now nfs-server
for i in rpc-bind mountd nfs; do firewall-cmd --add-service=$i --permanente; done
firewall-cmd --reload

dnf install -y nfs-utils
showmount -e server02

dnf install -y autofs
vi /etc/auto.master

/homes  /etc/auto.homes

vi /etc/auto.homes

*       -rw     server02:/homes/&

systemctl restart autofs.service
cd /homes/
cd user1

Actividad 2

On server2, create a user named user2 with password roxica.
Create the directory /homes/user2.
The directory /homes/user2 must be owned by user2.
On server1, export /homes/user2 by using NFS.

useradd user2
passwd user2
mkdir -p /data/user2
chown user2:user2 /data/user2/
chmod 770 /data/user2/
echo "/data *(rw,no_root_squash)" >> /etc/exports
systemctl restart nfs-server.service

vi /etc/auto.master

/data   /etc/auto.data

vi /etc/auto.data

*       -rw     server02:/data/&

systemctl restart autofs.service
cd /data/
cd user2

20. Managing LVM Logical Volumes

Actividad 1

• On server1, create a volume group named vgdata using a new disk or available free space.
• Ensure the physical volume uses a 4MiB extent size.
• Create a logical volume named lvbackup using 50 extents from the volume group.
• Format the logical volume with the xfs filesystem and mount it persistently on /backup.
• Extend the logical volume by +100MiB and grow the filesystem accordingly.
• Create another logical volume named lvlogs using 200MiB and format it with ext4, mounting it persistently on /logs.
• Verify that both logical volumes are correctly mounted and available after reboot.

# Crear PV (ajusta /dev/sdb según tu entorno)
pvcreate /dev/sdb
# Crear VG con extent de 4MiB
vgcreate -s 4M vgdata /dev/sdb
# Crear LV lvbackup con 50 extents
lvcreate -l 50 -n lvbackup vgdata
# Formatear y montar en /backup
mkfs.xfs /dev/vgdata/lvbackup
mkdir -p /backup
echo "/dev/vgdata/lvbackup /backup xfs defaults 0 0" >> /etc/fstab
mount -a
# Extender LV +100MiB y crecer filesystem (xfs)
lvextend -L +100M /dev/vgdata/lvbackup
xfs_growfs /backup
# Crear LV lvlogs de 200MiB
lvcreate -L 200M -n lvlogs vgdata
# Formatear y montar en /logs
mkfs.ext4 /dev/vgdata/lvlogs
mkdir -p /logs
echo "/dev/vgdata/lvlogs /logs ext4 defaults 0 0" >> /etc/fstab
mount -a
# Verificación
lsblk
df -h

Actividad 2

Managing LVM Logical Volumes

• On server1, create a logical volume with the name myfiles. Ensure it uses 8MiB extents.
• Configure the volume to use 75 extents.
• Format it with the xfs filesystem and ensure it mounts persistently on /mnt/data
• Increase the size of the / logical volume by 5GiB
• If volume groups need to be created, create them as needed