RHCE exam summary (continuously updated)

Keywords: Operation & Maintenance firewall vim yum SELinux

Environmental preparation

1. Configure YUM software warehouse

server and desktop machine do the same operation!!!!
# // server:
$ vim /etc/yum.repos.d/base.repo
name = EX300
gpgcheck = 0
baseurl = http://classroom.example.com/content/rhel7.0/x86_64/dvd/

### Clear the previous software warehouse cache
$ yum clean all
### Refresh software warehouse
$ yum repolist

### Copy to desktop
$ scp /etc/yum.repos.d/base.repo root@

Start answering questions

1. Configure SELinux

SELinux for virtual machine server and desktop must be running in Enforcing mode.
$ vim /etc/selinux/config 
$ grep -v ^# /etc/selinux/config 
### Modify the current mode to enforce  
$ setenforcing 1
$ sestatus
Current mode:                   enforcing
Mode from config file:          enforcing

2. Configure ssh access

Configure SSH access as follows
Users can remotely access your two virtual machine systems through SSH from clients within domain example.com
Clients in the domain my133t.org cannot access your two virtual machines
### Check if the firewall is on
$ systemctl status firewalld.service
Active : active (running)
$ firewall-cmd --permanent --add-service=ssh
$ firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address= service name=ssh reject'
$ firewall-cmd --reload
### inspect
$ firewall-cmd --list-all

#//desktop does the same thing

3. Custom user environment

Create custom command on system server0 and desktop0 for qstat this definition command will execute the following command:
/bin/ps -Ao pid,tt,user,fname,rsz
This command is valid for all users in the system.
$ echo "alias qstat='/bin/ps -Ao pid,tt,user,fname,rsz'" >> /etc/bashrc
$ source /etc/bashrc 
### Check it out.
$ qstat

#//desktop does the same thing

4. Configure port forwarding

Configure port forwarding on system server0 as follows:
In the network, the local port 5423 accessing server0 will be forwarded to 80
This setting must be permanent.
$ firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address= forward-port port=5423 protocol=tcp to-prot=80'
$ firewall-cmd --reload
### inspect
firewall-cmd --list-all
Or execute
$ firewall-cmd --permanent --add-forward-port=port=5423:proto=tcp:toport=80
$ firewall-cmd --reload
### inspect
$ firewall-cmd --list-forward-ports 

5, Configure link aggregation

Configure a link between server0.example.com and desktop0.example.com as follows:
This link uses interfaces eth1 and eth2
This link still works when an interface fails
This link server0 uses the following address /
This link desktop0 uses the following address /
This link remains normal after the system restarts.
If you are not familiar with commands, you can use the help file. Skip help if familiar.
-----help --- split line--------
$man nmcli examples
$man team. Conf -- > here are two core help
"Runner": {"name": "activebackup"} -- > use this help
$cat / usr / share / Doc / team-1.9/example \ ifcfgs / ifcfgs-team \ Test0 -- > see here, too
-----help --- split line--------
$ nmcli connection add type team con-name Team0 ifname team0 config '{"runner":  {"name":"activebackup"}}'
--->Note single and double quotes
### inspect
$ ip a s
$ nmcli connection add type team-slave con-name Team0-port1 ifname eth1 master team0 
$ nmcli connection add type team-slave con-name Team0-port2 ifname eth2 master team0 
$ nmcli connection modify Team0 ipv4.addresses '' ipv4.method manual 
$ nmcli connection reload 
$ nmcli connection up Team0 
### Verification
$ teamdctl team0 state
#//desktop -- do the same
Note ip address: nmcli connection modify team0 ipv4.addresses' 'ipv4.method manual

6. Configure IPv6 address

Configure the interface eth0 on your test system to use the following IPv6 address:
The address on server0 should be 2014:ac18::a/64
The address on desktop0 should be 2014:ac18::b/64
The two systems must be able to communicate with the system in network 2014:ac18/64
Address must be valid after restart
Both systems must maintain the current IPv4 address and be able to communicate.
$ nmcli connection modify 'System eth0' ipv6.addresses '2014:ac18::a/64' ipv6.method manual 
$ nmcli connection reload 
### activation
$ nmcli connection up 'System eth0'

### Verification 
$ ping
$ nmcli connection modify 'System eth0' ipv6.addresses '2014:ac18::b/64' ipv6.method manual 
$ nmcli connection reload 
### activation
$ nmcli connection up 'System eth0'

### Verification 
$ ping6 2014:ac18::a

7. Configure local mail service

Configure mail service on system server0 and desktop0 to meet the following requirements:
These systems do not receive messages sent from outside
Any messages sent on these systems are automatically routed to classroom.example.com
Messages sent from these systems appear to be from example.com
You can test your configuration by sending an email to the local user hal. The system classroom.example.com has configured to send this user's email to the following URL:
### To view the question requirements, one is to do email forwarding, the other is to do email alias
$ cd /etc/postfix/
$ cp -a main.cf{,.bak} 

//Modify the configuration file / etc/postfix/main.cf to modify the following lines:
$ vim /etc/postfix/main.cf
83 mydomain = example.com                      --->field
99 myorigin = $mydomain                        --->Configure mail source domain
164 mydestination = ""                         --->Configure mail destinations
316 relayhost = [classroom.example.com]       --->Configure mail routing host

$ systemctl restart postfix.service 

### test
$ echo "$HOSTNAME" |mail -s "nullclient" hal@classroom.example.com 
$ mailq 
Mail queue is empty --->No, it's a success
$ scp /etc/postfix/main.cf root@desktop0:/etc/postfix/
--->yes,Then input root Password

### test
$ echo "$HOSTNAME" |mail -s "nullclient" hal@classroom.example.com 
$ mailq 

8. Share directory through SMB

Configure SMB service on server0
Your SMB server must be a member of the STAFF Workgroup
Share / groupdir directory share name must be common
Only clients in the example.com domain can access the common share
common must be browsable
User barney must be able to read the content in the share, and if necessary, the password to be verified is flectrag
$ yum -y install samba samba-client 
$ systemctl enable smb nmb        --->Boot up

$ mkdir /groupdir 
$ setfacl -m u:barney:rx   /groupdir     --->Notice this is rx ,If written rw implement ls No permission will be prompted

$ chcon -t samba_share_t /groupdir        --->This and the next line can be found at/etc/samba/smb.conf Found in file SELINUX Location view of
$ setsebool -P samba_export_all_ro 1

$ cp -a /etc/samba/smb.conf{,.bak}        --->Backup is very important, add -a Copy the permission bit
$ vim /etc/samba/smb.conf
89    workgroup = STAFF 
95    hosts allow = 127.   172.25.0.     --->Domains allowed, 172.25.0. yes example.com All clients in the domain
321   [common]                           --->Shared name
322   path = /groupdir                   --->Shared directory
323   browseable = yes                   --->Browable

$ systemctl start smb nmb     --->start-up

$ smbpasswd -a barney 
New SMB password: [flectrag]
Retype new SMB password: [flectrag]
$ pdbedit -L
barney : 1001 :
$ smbclient //server0.example.com/common -U barney
Enter barney's password: [flectrag]
Domain=[STAFF] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls 
40913 blocks of size 262144. 28449 blocks available
smb: \> exit

9. Configure multi-user SMB mount

Share on server0 through SMB directory / data to meet the following requirements:
Share name is data
Shared directory data can only be used by clients in the example.com domain
Shared directory data must be browsable
The user manager must be able to access the share in a read mode, and the access password is flectrag
The user wolfery ne must be able to access this share in a read-write way, and the access password is flectrag
This share is permanently mounted in the / mnt/multi directory on desktop0.example.com, and uses the user manager as the authentication. Any user can obtain the write permission temporarily through the user wolfery ne.
$ mkdir /data 
$ setfacl -m u:manager:rx /data 
$ setfacl -m u:wolferyne:rwx /data   --->Notice this is rwx ,Be sure to add. x Executive authority

$ chcon -t samba_share_t /data          --->This and the next line can be found at/etc/samba/smb.conf Found in file SELINUX Location view of
$ setsebool -P samba_export_all_rw 1 

$ cp -a /etc/samba/smb.conf{,.bak2}
$ vim /etc/samba/smb.conf 
324      [data]
325      path = /data 
326     public = yes 
327     writable = yes
328     write list = wolferyne 

$ smbpasswd -a manager              --->Set up smb User password
New SMB password: [flectrag]
Retype new SMB password: [flectrag]
$ smbpasswd -a wolferyne            --->Set up smb User password
New SMB password: [flectrag]
Retype new SMB password: [flectrag]

$ systemctl restart smb nmb 

//Add firewall policy
$ firewall-cmd --permanent --add-service=samba
$ firewall-cmd --reload
Client configuration
$ yum -y install samba-client cifs-utils
$ mkdir /mnt/multi

--->Check the help of mount, execute man -k mount, and find mount.cifs to check the details
$VIM / root / mysmb -- > create credentials authentication file for smb

$VIM / etc / fstab -- > set boot auto mount
//server0.example.com/data    /mnt/multi     cifs     defaults,credentials=/root/mysmb,multiuser   0     0

$mount - a -- > reload everything in / etc/fstab
//Be sure to add the samba firewall policy on server0 first, or you will be prompted Unable to find suitable address
//Or prompt: connection to server0.example.com failed (error NT? Status? Host? Unreachable)
$ su - wolferyne 
$ cifscreds add server0 
Password: [flectrag]
$ cd /mnt/multi/
$ touch a 
$ exit 

10. Configure services for NFS

To configure the NFS service on server0, the requirements are as follows:
Share directory as read-only / public can be accessed by the system in the example.com domain
Shared directory in read-write mode / protected can be accessed by the system in the example.com domain
Access to / protected requires Kerberos security encryption, and you can use the key provided by the following URL:
Directory / protected should contain a subdirectory named restricted with owner ldapuser0
User ldapuser0 can access / protected/restricted in read-write mode
$ wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/server0.keytab  
 --->Download to/etc/krb5.keytab Corresponding/etc/exports In configuration sec=krb5p
 ---> kerberos Time synchronization required $ system-config-date -—->$ chronyc sources -v 
 ---> Otherwise mount -a Will prompt for access denied.
$ mkdir /public 
$ chown nfsnobody /public 

$ vim /etc/exports 
/public  *.example.com(ro)   --->Share directories read-only /public Can be example.com System access in domain

$ mkdir -p /protected/restricted
$ chown nfsnobody /protected
$ chown ldapuser0 /protected/restricted  --->Catalog /protected/restricted Owner ldapuser0

$ vim /etc/exports 
/protected  *.example.com(rw,sync,sec=krb5p)  --->Share directories read and write /protected Can be example.com System access in domain
/public  *.example.com(ro)

$ exportfs -avr      --->Boot sharing

$ systemctl enable nfs-server nfs-secure-server 
$ systemctl start nfs-server nfs-secure-server 
--->If rpcbind This service does not start, nfs Service will fail to start, nfs-secure-server rely on /etc/krb5.keytab   

$ showmount -e       --->View sharing

#Add firewall
$ firewall-cmd --permanent --add-service=nfs 
$ firewall-cmd --permanent --add-service=mountd    --->adopt mountd Service (cannot be remote if it is not turned on showmount)
$ firewall-cmd --permanent --add-service=rpc-bind  --->adopt rpc Service (if not turned on, rpcinfo Can't scan)
$ firewall-cmd --reload

11. Mount an NFS share

Mount an NFS share from server0.example.com on desktop0, and meet the following requirements:
/public is mounted on the following directory / mnt/nfsmount
/protected is mounted on the following directory / mnt/nfssecure and used in a safe way. The key Download URL is as follows:
User ldapuser0 can create files on / mnt/nfssecure/restricted
These file systems mount automatically when the system starts.
$ wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/desktop0.keytab
  --->Download to/etc/krb5.keytab Corresponding /etc/fstab In configuration sec=krb5p, nfs-secure rely on /etc/krb5.keytab 

$ systemctl enable nfs-secure
$ systemctl start nfs-secure

$ mkdir /mnt/nfsmount 
$ mkdir /mnt/nfssecure 

$ vim /etc/fstab 
server0.example.com:/public   /mnt/nfsmount  nfs   defaults    0  0
server0.example.com:/protected   /mnt/nfssecure  nfs   defaults,sec=krb5p    0  0
$ mount -a  --->take/etc/fstab All content reloads for

$ df -Th 
Filesystem                       Type  Size  Used  Avail    Use%  Mounted on 
server0.example.com:/public      nfs4  11G   3.4G  7.5G     31%   /mnt/nfsmount
server0.example.com:/protected   nfs4  11G   3.4G  7.5G     31%   /mnt/nfssecure

$ su - ldapuser0 
-bash-4.2$ kinit ldapuser0 
Password for ldapuser0@EXAMPLE.COM: [kerberos]
-bash-4.2$ klist 
-bash-4.2$ cd /mnt/nfssecure/restricted 
-bash-4.2$ touch a

12. Implement a Web server

Configure a site http://server0.example.com on server0 and perform the following steps:
Download the file from http://classroom.example.com/materials/station.html and rename the file to index.html do not modify the contents of this file
Copy the file index.html to the DocumentRoot directory of your web server
Clients from the example.com domain can access this web service
Client from my133t.org domain denied access to this web service
$ yum -y install httpd 
$ systemctl enable httpd
$ systemctl start httpd

$ wget -O /var/www/html/index.html http://classroom.example.com/materials/station.html
$ rpm -qd httpd          --->Find help
$ vim /etc/httpd/conf.d/site1.conf 
<VirtualHost _default_:80>
   ServerName server0.example.com    --->Set site name
   <Directory "/var/www/html">       --->/var/www/html Is the default. DocumentRoot Catalog
         Require all granted 
         Require not ip

$ systemctl restart httpd
//Add firewalld policy
$ firewall-cmd --permanent --add-service=http 
$ firewall-cmd --reload
###Test to desktop
Test mode 1
$ firefox http://server0.example.com& 
Test mode 2
$ yum -y install links 
$ links http://server0.example.com

13. Configure secure web services

Configure TLS encryption for the site http://server0.example.com
Get the signed certificate from http://classroom.example.com/pub/tls/certs/server0.crt
Get the key of this certificate from http://classroom.example.com/pub/tls/private/server0.key
Get the signature authorization information for this certificate from http://classroom.example.com/pub/example-ca.crt
$ yum -y install mod_ssl    --->After installation, it will generate /etc/httpd/conf.d/ssl.conf

$ wget -P /etc/pki/tls/certs/ http://classroom.example.com/pub/tls/certs/server0.crt
$ wget -P /etc/pki/tls/private/ http://classroom.example.com/pub/tls/private/server0.key 
$ wget -P /etc/pki/tls/certs/ http://classroom.example.com/pub/example-ca.crt 

$ vim /etc/httpd/conf.d/ssl.conf ---> :%s/localhost/server0/g ---use server0 replace localhost
100   SSLCertificateFile      /etc/pki/tls/certs/server0.crt 
107   SSLCertificateKeyFile   /etc/pki/tls/private/server0.key 

$ systemctl restart httpd 
//If firewalld is used, add a policy 
$ firewall-cmd --permanent --add-service=https
$ firewall-cmd --reload
$ firefox https://server0.example.com & 
--->Click the verification button to confirm

14. Configure virtual host

Expand your web server on server0, create a virtual host for the site http://www0.example.com, and then perform the following steps:
Set DocumentRoot to / var/www/virtual
Download the file from http://classroom.example.com/materials/www.html and rename it to index.html. Do not make any changes to the contents of index.html
Put the file index.html in the DocumentRoot directory of the virtual host
Make sure barney users can create files in / var/www/virtual directory
Note: the original site http://server0.example.com must still be accessible. The name server example.com provides domain name resolution for the host name www0.example.com.
$ mkdir /var/www/virtual 
$ setfacl -m u:barney:rwx  /var/www/virtual     --->ensure barney Users can /var/www/virtual Create file in directory

$ wget -O /var/www/virtual/index.html http://classroom.example.com/materials/www.html 

$ rpm -qd httpd --->Find help

$ vim /etc/httpd/conf.d/vhost-www0.conf 
<VirtualHost *:80>
   ServerName   www0.example.com 
   DocumentRoot /var/www/virtual 

$ systemctl restart httpd
$ firefox http://www0.example.com &

15. Configure access to web content

Create a directory named confidential under the DocumentRoot directory of the web server on your server0. The requirements are as follows:
Download a copy of the file from http://classroom.example.com/materials/private.html to this directory and rename it index.html
Do not make any changes to the contents of this file
From server0, anyone can browse the contents of confidential, but the contents of this directory cannot be accessed from other systems
$ mkdir /var/www/html/confidential 
$ cd /var/www/html/confidential 
$ wget -O index.html http://classroom.example.com/materials/private.html

//Edit the configuration file / etc/httpd/conf.d/site1.conf and add the following lines
<Directory "/var/www/html/confidential">
   Require local 

$ vim /etc/httpd/conf.d/site1.conf 
<VirtualHost _default_:80>
   ServerName server0.example.com    --->Set site name
   <Directory "/var/www/html">       --->/var/www/html Is the default. DocumentRoot Catalog
         Require all granted 
         Require not ip
   <Directory "/var/www/html/confidential">
       Require local 

$ systemctl restart httpd.service
$ firefox http://server0.example.com/confidential & 


16. Implementing dynamic web content

Dynamic web content is provided on server0. The requirements are as follows:
Dynamic content is provided by a virtual machine called transitional.example.com
Virtual machine listening on port 8989
Download a script from http://classroom.example.com/materials/script.wsgi and put it in the right place, never modify the contents of this file
Clients should receive dynamically generated web pages when visiting http://transitional.example.com: 8989 /
This http://transitional.example.com:8989/ must be accessible by all systems in the example.com domain
$ yum -y install mod_wsgi 

$ rpm -qd mod_wsgi  --->Query help

//Edit the configuration file / etc/httpd/conf.d/site2.conf 
$ vim /etc/httpd/conf.d/site2.conf 
Listen 8989
<VirtualHost *:8989>
   ServerName   transitive.example.com:8989
   WSGIScriptAlias  /     /var/www/cgi-bin/script.wsgi 

$ wget -P /var/www/cgi-bin/ http://classroom.example.com/materials/script.wsgi 

$ semanage port -l |grep 80
http_port_t       tcp 80,81,443,488,8008,8009,8443,9000
$ semanage port -a -t http_port_t -p tcp 8989
$ systemctl restart httpd.service

### Add firewall policy
$ firewall-cmd --permanent --add-port=8989/tcp
$ firewall-cmd --reload 

### inspect
$ firefox http://transitive.example.com:8989/ & 

17. Create a script

Create a script named / root/script.sh on server0 to provide the following features:
When running / root/script.sh all, the output is none
When running / root/script.sh none, the output is all
When no parameter or parameter is all or none, its error output produces the following information:
/root/script.sh all|none
$ touch /root/script.sh 
$ chmod u+x /root/script.sh 
$ vim /root/script.sh 
case "$1" in 
      echo "none"
      echo "all"
      echo "/root/script.sh all|none"
### Verification
$ /root/script.sh all
$ /root/script.sh none

18. Create a script to add users

Create a script named / root/makeusers on server0, which can create local users for system server0, and the user names of these users come from a file containing the user name list.
Meanwhile, the following requirements shall be met:
This script requires a parameter, which is the file containing the user list
If no parameters are provided, the script should give the following prompt: Usage: / root / makeusers < userfile > and exit with the corresponding value
If you provide a file name that does not exist, the script should give the following prompt, Iuput file not found, and then exit with the corresponding value
The user login shell created is / bin/false
This script does not need to set a password for the user
You can get the user list from the following URL for testing http://classroom.example.com/materials/ulist
$ touch /root/makeusers
$ chmod u+x /root/makeusers
//Method 1:
$ vim /root/makeusers
if [ $# -ne 1 ];then 
   echo 'Usage:/root/makeusers <userfile>'
   exit 1
elif [ ! -f "$1" ];then 
   echo 'Iuput file not found'
   exit 2
   for USER in $(cat "$1");do 
      useradd -s /bin/false $USER 
### Verification
$ wget http://classroom.example.com/materials/ulist
$ ./makeusers
$ ./makeusers ulist
$ tail -n 10 /etc/passwd |grep /bin/false
Method two:
$ vim /root/makeusers
if [ $# -eq 1 ];then 
   if [ -f "$1" ];then 
      while read username;do 
         useradd -s /bin/false $username &>/dev/null 
      echo 'Iuput file not found'
   echo 'Usage:/root/makeusers <userfile>'

Posted by iamyespee on Sun, 09 Feb 2020 03:55:34 -0800