[RHCE] 01 – Be able to perform all tasks expected of a Red Hat Certified System Administrator

ssh username@hostname          # Basic SSH connection
ssh -p 2222 username@hostname  # Connect to specific port
ssh-keygen                    # Generate SSH key pair
ssh-copy-id username@hostname  # Copy SSH key to remote host

ls -la                        # List all files with details
pwd                          # Print working directory
cd /path/to/directory        # Change directory
find / -name filename        # Search for files
locate filename             # Quick file search (requires updatedb)

chmod 755 filename          # Change permissions
chown user:group filename   # Change ownership

grep pattern filename       # Search for pattern
grep -r pattern directory  # Recursive search
sed 's/old/new/g' file    # Replace text
awk '{print $1}' file     # Process text by columns

tar -czf archive.tar.gz files/   # Create gzip archive
tar -xzf archive.tar.gz          # Extract gzip archive
tar -cjf archive.tar.bz2 files/  # Create bzip2 archive
tar -xjf archive.tar.bz2         # Extract bzip2 archive

ps aux                     # List all processes
top                       # Dynamic process viewer
kill PID                  # Kill process by ID
killall processname       # Kill process by name

ip addr                   # Show IP addresses
ip route                  # Show routing table
ping hostname            # Test connectivity
traceroute hostname      # Trace packet route

uname -a                  # System information
free -h                  # Memory usage
df -h                    # Disk usage
du -sh directory         # Directory size

dnf install package      # Install package
dnf remove package      # Remove package
dnf update             # Update system
dnf search keyword     # Search for package

journalctl             # View systemd logs
tail -f /var/log/messages  # Follow system logs
grep ERROR /var/log/*     # Search errors in logs

systemctl reboot         # Reboot system
systemctl poweroff      # Shutdown system
systemctl rescue        # Enter rescue mode
grub2-mkconfig         # Update GRUB configuration

systemctl get-default                  # View default target
systemctl set-default graphical.target # Set graphical target
systemctl isolate multi-user.target   # Switch to multi-user
systemctl list-units --type=target    # List all targets

systemctl start service_name    # Start service
systemctl stop service_name     # Stop service
systemctl restart service_name  # Restart service
systemctl status service_name   # Check service status
systemctl enable service_name   # Enable at boot
systemctl disable service_name  # Disable at boot

lsblk                          # List block devices
mount /dev/sdb1 /mnt          # Mount filesystem
umount /mnt                   # Unmount filesystem
blkid                         # Show block device info
df -h                         # Show disk usage

swapon --show                 # Show swap spaces
mkswap /dev/sdb2             # Create swap
swapon /dev/sdb2             # Enable swap
swapoff /dev/sdb2            # Disable swap

top                           # Process viewer
free -h                       # Memory usage
vmstat                        # Virtual memory stats
iostat                        # I/O statistics

journalctl                    # View system logs
journalctl -u service_name   # Service specific logs
journalctl -f                # Follow new entries

nmcli device show            # Show all devices
nmcli con show              # Show connections
nmcli con add               # Add connection
nmcli con mod              # Modify connection
nmcli con up/down          # Enable/disable connection

lsblk                     # List all block devices
fdisk -l                  # Show disk information
parted -l                 # Display partition layout

fdisk /dev/sdb           # Start fdisk utility
# Common fdisk commands:
# n - new partition
# p - print partition table
# w - write changes
# d - delete partition
# t - change partition type

parted /dev/sdb          # Start parted utility
mklabel gpt             # Create GPT label
mkpart primary 1MiB 1GiB # Create partition

pvcreate /dev/sdb1      # Create PV
pvdisplay               # Show PV info
pvs                     # Brief PV info

vgcreate vg_name /dev/sdb1   # Create VG
vgextend vg_name /dev/sdc1   # Extend VG
vgdisplay                    # Show VG info
vgs                          # Brief VG info

lvcreate -L 10G -n lv_name vg_name  # Create LV
lvextend -L +5G /dev/vg_name/lv_name # Extend LV
lvdisplay                           # Show LV info
lvs                                # Brief LV info

mkfs.xfs /dev/vg_name/lv_name     # Create XFS
mkfs.ext4 /dev/vg_name/lv_name    # Create ext4

mount /dev/vg_name/lv_name /mnt   # Mount filesystem
echo "/dev/vg_name/lv_name /mnt xfs defaults 0 0" >> /etc/fstab  # Persistent mount

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1  # Create RAID1
mdadm --detail /dev/md0           # Show RAID info
cat /proc/mdstat                  # RAID status

df -h                            # Disk usage
du -sh /path                     # Directory size
iostat                          # I/O statistics

parted /dev/sdb mklabel gpt
parted /dev/sdb mkpart primary 1MiB 1GiB
mkfs.xfs /dev/sdb1
mkdir /mnt/data
mount /dev/sdb1 /mnt/data

pvcreate /dev/sdb /dev/sdc
vgcreate vg_data /dev/sdb
vgextend vg_data /dev/sdc
lvcreate -L 2G -n lv_apps vg_data
mkfs.xfs /dev/vg_data/lv_apps

mkfs.xfs /dev/vda1                    # Create XFS
xfs_admin -L "DataDisk" /dev/vda1     # Label XFS
xfs_repair /dev/vda1                  # Check/repair XFS

mkfs.ext4 /dev/vda2                   # Create Ext4
e2label /dev/vda2 "BackupDisk"        # Label Ext4
fsck.ext4 /dev/vda2                   # Check Ext4

mount /dev/vda1 /mnt/data             # Mount filesystem
umount /mnt/data                      # Unmount
mount -a                              # Mount all in fstab

# Device                  MountPoint  FStype  Options  Dump  Pass
/dev/vda1                /mnt/data   xfs     defaults  0     0
UUID=1234-5678           /mnt/backup ext4    defaults  0     2

chmod 755 /mnt/data                   # Set permissions
chown user:group /mnt/data            # Change ownership

setfacl -m u:user:rwx /mnt/data      # Set ACL
getfacl /mnt/data                     # View ACLs
setfacl -b /mnt/data                  # Remove all ACLs

# Add usrquota,grpquota to fstab options
/dev/vda1  /mnt/data  xfs  defaults,usrquota,grpquota  0  0

xfs_quota -x -c 'limit bsoft=100m bhard=120m user1' /mnt/data
xfs_quota -x -c 'report' /mnt/data    # View quotas

ls -Z /mnt/data                       # View context
semanage fcontext -a -t public_content_t "/mnt/data(/.*)?"
restorecon -Rv /mnt/data              # Restore context

# Create partition
fdisk /dev/vdb
# Create filesystem
mkfs.xfs /dev/vdb1
# Create mount point
mkdir /data
# Add to fstab
echo "/dev/vdb1 /data xfs defaults 0 0" >> /etc/fstab
# Mount
mount -a

# Enable ACLs
mount -o acl /dev/vdb1 /data
# Set ACL
setfacl -m u:john:rwx /data
# Enable quota
xfs_quota -x -c 'limit bsoft=500m bhard=600m john' /data

# Boot options
linux inst.ks=http://server/kickstart.cfg  # Kickstart installation
linux inst.vlm=http://server/vol1          # Install from network

dnf repolist                  # List repositories
dnf install package_name      # Install package
dnf group install "group"     # Install package group
dnf remove package_name       # Remove package
dnf update                    # Update system
dnf history                   # View DNF history

# /etc/yum.repos.d/example.repo
[example]
name=Example Repository
baseurl=http://mirror.example.com/repo
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY

dnf check-update             # Check available updates
dnf update-minimal          # Security updates only
dnf download package_name   # Download without installing
dnf clean all              # Clean cache

# /root/anaconda-ks.cfg
install
cdrom
lang en_US.UTF-8
keyboard us
network --bootproto=dhcp
rootpw --iscrypted $1$xyz$ABC123
firewall --enabled
selinux --enforcing
timezone America/New_York
bootloader --location=mbr
text
skipx
zerombr
clearpart --all --initlabel
autopart
reboot
%packages
@core
%end

# Crontab configuration
0 2 * * * /usr/sbin/dnf -y update > /var/log/dnf-update.log

# /etc/logrotate.d/custom
/var/log/custom.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
}

tar -czf /backup/system-$(date +%F).tar.gz /etc /home
rsync -av /source/ /destination/

cat << EOF > /etc/yum.repos.d/local.repo
[local]
name=Local Repo
baseurl=file:///mnt/repo
enabled=1
gpgcheck=0
EOF

dnf clean all
dnf repolist

#!/bin/bash
# /usr/local/sbin/system-update.sh
dnf -y check-update
if [ $? -eq 100 ]; then
    dnf -y update
    needs-restarting -r
fi

useradd username              # Create user
usermod -c "Comment" username # Modify user
userdel -r username          # Delete user & home
passwd username              # Set password
chage -l username           # View password info

# /etc/passwd format
username:x:UID:GID:comment:home_dir:shell

# /etc/shadow format
username:encrypted_password:lastchange:min:max:warn:inactive:expire:reserved

groupadd groupname           # Create group
groupmod -n newname oldname  # Rename group
groupdel groupname          # Delete group
gpasswd -a user group      # Add user to group
gpasswd -d user group      # Remove from group

# /etc/group format
groupname:x:GID:user_list

# /etc/login.defs
PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_MIN_LEN    8
PASS_WARN_AGE   7

chage -M 90 username        # Max password age
chage -m 7 username         # Min password age
chage -W 7 username        # Warning days
chage -E 2024-12-31 user   # Account expiry

# /etc/sudoers
username ALL=(ALL) ALL      # Full sudo access
%wheel   ALL=(ALL) ALL      # Group sudo access

chmod u+s /path/file        # Set SUID
chmod g+s /path/file        # Set SGID
chmod +t /path/dir         # Set sticky bit

# Create user with custom settings
useradd -m -d /home/john -s /bin/bash -c "John Doe" -G wheel john
passwd john
chage -M 90 -m 7 -W 7 john

# Create project group and add users
groupadd project
usermod -aG project user1
usermod -aG project user2
chmod 2770 /proj            # SGID for group sharing
chown :project /proj

usermod -L username         # Lock account
usermod -U username         # Unlock account

useradd -D                 # View defaults
useradd -D -s /bin/bash    # Change default shell

# users.txt format: username:password
while IFS=: read user pass; do
    useradd -m "$user"
    echo "$pass" | passwd --stdin "$user"
done < users.txt

getenforce                      # Check SELinux mode
setenforce 1                    # Set enforcing mode
semanage fcontext -l           # List contexts
semanage port -l               # List port labels
restorecon -Rv /path           # Restore contexts

# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

firewall-cmd --state                  # Check status
firewall-cmd --get-default-zone       # Show default zone
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload                 # Apply changes
firewall-cmd --list-all              # Show all rules

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
Protocol 2
X11Forwarding no
MaxAuthTries 3

# /etc/security/pwquality.conf
minlen = 12
minclass = 4
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/sudoers -p wa -k sudo_changes

# Setup web server firewall
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# Configure Apache context
semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
restorecon -Rv /web
setsebool -P httpd_can_network_connect on

sestatus
ls -Z /web
getsebool -a | grep httpd

firewall-cmd --list-all
ss -tulpn

sshd -t              # Test configuration
systemctl restart sshd

dnf update --security
needs-restarting -r

systemctl mask telnet
systemctl disable rpcbind
lsof -i                # Check open ports

tail -f /var/log/secure
aureport --auth        # Authentication reports
ausearch -k sudo_changes  # Audit log search