RHCSA RH300 Command Reference: Users, ACLs, SELinux, iSCSI, NFS, Samba, Networking and MySQL
RH300 Command Reference
for NEWUSER in stannis joffrey renly robb; do useradd -G kings ${NEWUSER}; done
chage -E $(date +%Y-%m-%d -d +90days) sspade #determine password change date
getent passwd ldapuser20
sudo ipa-client-install --domain=server1.example.com --no-ntp --mkhomedir #join IPA server
setfacl -Rm g:sodor:rwX /shares/steamies #add group ACL
setfacl -Rm u:james:r-x /shares/steamies #add user ACL
setfacl -m d:g:sodor:rwx /shares/steamies #add default ACL
setfacl -m d:u:james:r-x /shares/steamies #add default ACL
setfacl -Rb /shares/steamies #delete all ACL recursive
setfacl -x d:g:sodor:rwx /shares/steamies #delete this one ACL
semanage fcontext -l | grep httpd #list SE httpd contents
ls -Z /var/www/ #list extended attributes on existing folder
semanage fcontext -a -t httpd_sys_content_t '/srv/(/.*)?' #set new content on new folder
semanage port -a -p tcp -t 'http_port_t' 9876 #add non default http port
restorecon -vvFR /srv # restore SE content on folder
getsebool -a | grep home #search for homedir SE boolean
setsebool -P httpd_enable_homedirs on #enable homedir SE boolean
setenforce 0 #disable SELinux
Grub2 Reset Root Password
-pause grub & edit default entry, begin "linux16" & append to end: rd.break
-Ctrl+x
mount -o remount,rw /sysroot
chroot /sysroot
echo redhat | passwd --stdin root
touch /.autorelabel #reboot & password reset done
Firewall Configuration
firewall-config #GUI firewall config
firewall-cmd --permanent --add-port=3260/tcp #add port for iSCSI access
firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=172.25.1.10/32 forward-port port=443 protocol=tcp to-port=22'
firewall-cmd --reload
iSCSI Server (targetcli)
targetcli #iSCSI server
>> /backstores/block create disk1 /dev/vdb1
>> /iscsi create iqn.2014-10.com.example:server1
>> /iscsi/iqn.2014-10.com.example:server1/tpg1/acls create iqn.2014-10.com.example:desktop1
>> /iscsi/iqn.2014-10.com.example:server1/tpg1/luns create /backstores/block/disk1
>> /iscsi/iqn.2014-10.com.example:server1/tpg1/portals create 172.25.0.11 3260
>> ls
>> cd /
>> saveconfig
>> exit
iSCSI Client
man iscsiadm //EXAMPLE #iSCSI client
iscsiadm --mode discoverydb --type sendtargets --portal 172.25.0.11 --discover
iscsiadm --mode node --targetname iqn.2001-05.com.doe:test --portal 172.25.0.11:3260 --login
/etc/fstab Entries
#/etc/fstab
UUID=48469c75-fba6-499c-a408-b90d7ea3d501 /iscsidisk xfs _netdev 0 2 #iSCSI
server1:securenfs /mnt/secureshare nfs defaults,v4.2,sec=krb5p 0 0 #NFS
//server1/smbspace/ /mnt/salesshare cifs credentials=/root/smb-multiuser.txt,multiuser,sec=ntlmssp 0 0 #Samba
NFS Export with Kerberos
#wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/server1.keytab
echo "/exports/hypnotoad 172.25.1.0/24(sec=krb5p,rw)" >> /etc/exports
exportfs -r
Autofs with CIFS Shares
#yum -y install cifs-utils.x86_64 autofs
vim /etc/auto.master.d/shares.autofs: /shares /etc/auto.shares
vim /etc/auto.shares:
work -fstype=cifs,credentials=/etc/me.cred ://server1/student
docs -fstype=cifs,guest ://server1/public
vim /etc/me.cred:
username=student
password=student
domain=MYGROUP
cd /shares/work
Vim Tips
#vim select column: Ctrl+v & x
vim select lines: Shift+v & x
NetworkManager Team Interface
#nmcli con add type team con-name team1 ifname team1 config '{"runner": {"name": "activebackup"}}'
nmcli con modify team1 ipv4.addresses '192.168.0.100/24'
nmcli con modify team1 ipv4.method static
nmcli con modify team1 ipv6.addresses 'fd00:ba5e:ba11:1::1/64'
nmcli con modify team1 ipv6.method static
nmcli con add type team-slave con-name team-slave1 ifname slave1 master team1
nmcli con add type team-slave con-name team-slave2 ifname slave2 master team1
Volatile Directories with tmpfiles
#/etc/tmpfiles.d/veryveryvolatile.conf:
d /run/veryveryvolatile 1777 root root 5s
systemd-tmpfiles --create
MySQL User and Data Management
#mysql -u root
create user john@localhost identified by 'john_password';
create user steve@'%' identified by 'steve_password';
grant insert, update, delete, select on inventory.* to john@localhost;
grant select on inventory.* to steve@'%';
flush privileges; exit;
use inventory;
select * from category;
insert into category(name) values('Memory');
update category set name='Solid State Drive' where id = 3;
delete from category where name like 'Memory';
Apache SSL Virtual Host
#
ServerName www1.example.com
DocumentRoot /srv/www1/www
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLHonorCipherOrder On
SSLCertificateFile /etc/pki/tls/certs/www1.crt
SSLCertificateKeyFile /etc/pki/tls/private/www1.key
SSLCertificateChainFile /etc/pki/tls/certs/example-ca.crt
Require all granted