RHCSA7

[Server]
开机
<e>
linux16 ... rd.break console=tty0
<Ctrl-x>
switch_root:/# mount | grep xfs
/dev/vda1 on /sysroot type xfs (ro,relatime,attr2,inode64,noquota)
switch_root:/# mount -o remount,rw /sysroot
switch_root:/# chroot /sysroot
sh-4.2# echo fedora | passwd --stdin root
Changing password for user root.
passwd: all authentication tokens updated successfully.
sh-4.2# touch /.autorelabel
sh-4.2# sync
sh-4.2# exit
switch_root:/# reboot

:: 配置网络和主机名
按要求设置 Server0 的网络 172.25.0.11/16，网关为 172.25.0.254，DNS 指向 172.25.254.254
主机名为 server0.example.com
正常连接网络后才能做后续的试题。

================================================== 显示/隐藏答案 ==================================================

[Server]
# nmtui
# nmcli con mod 'System eth0' ipv4.addresses '172.25.0.11/16 172.25.0.254' ipv4.method static ipv4.dns 172.25.254.254 connection.autoconnect true
# service network restart
# ip add show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:00:00:0b brd ff:ff:ff:ff:ff:ff
inet 172.25.0.11/16 brd 172.25.255.255 scope global eth0
...
# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 172.25.254.254
# ip route
default via 172.25.0.254 dev eth0 proto static metric 1024
172.25.0.0/16 dev eth0 proto kernel scope link src 172.25.0.10
# hostnamectl set-hostname server0.example.com
# hostname
# cat /etc/hostname

:: SELINUX
将 Server0 的 SELinux 设为 permissive 模式。
此设置必须永久有效

================================================== 显示/隐藏答案 ==================================================

[Server]
# vim /etc/selinux/config
/per yw /= p D ZZ
# cat /etc/selinux/config
# setenforce 0
# getenforce

::软件仓库
按照要求建立 yum 软件仓库
配置文件后续如果按软件包需要，这个 yum 仓库为默认仓库,
地址为 http://classroom.example.com/content/rhel7.0/x86_64/dvd

================================================== 显示/隐藏答案 ==================================================

[Server]
# yum-config-manager --add-repo http://classroom.example.com/content/rhel7.0/x86_64/dvd
# echo gpgcheck=0 >> /etc/yum.repos.d/ classroom.example.com_rhel7.0_x86_64_dvd.repo
# yum list

:: LVM
逻辑卷的创建与扩容在系统中空闲磁盘上创建一个 200MB 的逻辑卷，
卷组名为 vg1 ，
逻辑卷名为 lv1 ，
文件系统格式为 xfs ，
挂载目录为 /mnt/data ，
该配置永久生效。
扩容逻辑卷的容量到 300MB 。

================================================== 显示/隐藏答案 ==================================================

[Server]
# fdisk -l
# fdisk /dev/vdb
    Command (m for help): <n>
    Select (default p): <Enter>
    Partition number (1-4, default 1): <Enter>
    First sector (2048-20971519, default 2048): <Enter>
    Last sector, +sectors or +size{K,M,G} (2048-20971519, default 20971519): +204M
    Command (m for help): <t>
    Hex code (type L to list all codes): 8e
    Command (m for help): <w>
# pvcreate /dev/vdb1
# vgcreate vg1 /dev/vdb1
# lvcreate -n lv1 -L 200M vg1
# mkfs.xfs /dev/vg1/lv1
# mkdir /mnt/data
# vim /etc/fstab
...
/dev/vg1/lv1 /mnt/data xfs defaults 1 2
# mount -a
# df -h /mnt/data

[Server]
# fdisk /dev/vdb
    Command (m for help): <n>
    Select (default p): <Enter>
    Partition number (2-4, default 2): <Enter>
    First sector (419840-20971519, default 419840): <Enter>
    Last sector, +sectors or +size{K,M,G} (419840-20971519, default 20971519): +104M
    Command (m for help): <t>
    Partition number (1,2, default 2): <Enter>
    Hex code (type L to list all codes): 8e
    Command (m for help): <w>
# partprobe
# pvcreate /dev/vdb2
# vgextend vg1 /dev/vdb2
# lvextend -L 300M /dev/vg1/lv1
xfs # xfs_growfs /mnt/data
ext4 # resize2fs -f /dev/vg0/data
# df -h /mnt/data

:: 创建用户帐户
添加3个用户，用户 harry、 natasha、 tom，
要求 harry、 natasha 用户的附加组为 admin 组，
tom 用户的登陆 shell 为非交互式 shell。

================================================== 显示/隐藏答案 ==================================================

[Server]
# groupadd admin
# useradd -G admin natasha
# useradd -G admin harry
# useradd -s /sbin/nologin tom

[Server]
# usermod –u 1234 harry
# echo h1234 | passwd --stdin harry

:: 权限
在 /home 下创建一个目录，名为 admins，
要求所属组为 admin 组，组成员可以读写，
其它用户没有任何权限，
同组成员在目录下创建的文件的所属组也为 admin 组

================================================== 显示/隐藏答案 ==================================================

[Server]
# mkdir /home/admins
# chgrp admin /home/admins
# chmod g=rwx /home/admins
# chmod o=--- /home/admins
# chmod g+s /home/admins
# su - harry
$ touch /home/admins/h.txt
$ ls -l /home/admins/h.txt

[Server]
# vim /etc/crontab
# crontab -e
23 14 * * * echo hello
# crontab -l
23 14 * * * echo hello

:: 安装内核的升级
按指定要求安装升级内核
保证grub2 启动时为默认项目，
安装包位置 http://172.25.0.254/content/rhel7.0/x86_64/errata/Packages/kernel-3.10.0-123.1.2.el7.x86_64.rpm

================================================== 显示/隐藏答案 ==================================================

[Server]
# rpm -ivh http://172.25.0.254/content/rhel7.0/x86_64/errata/Packages/kernel-3.10.0-123.1.2.el7.x86_64.rpm
# shutdown -r 0
# uname –r

:: UID & GID
创建组 sales，设置组 ID 为 1111
添加用户 user1，设置用户 ID 为 1111，同时设置原始组为 sales

================================================== 显示/隐藏答案 ==================================================

[Server]
# groupadd -g 1111 sales
# useradd -u 1111 -g sales user1
# id user1
uid=1111(user1) gid=1111(sales) groups=1111(sales)

:: LDAP
使用LDAP 作为本地用户认证方式，
Base DN： dc=example,dc=com
LDAP Server： classroom.example.com
使用 TLS 加密，证书位置： http://classroom.example.com/pub/example-ca.crt
使用 Kerberos 密码
Realm： EXAMPLE.COM
kdcS： classroom.example.com
Admin Servers： classroom.example.com

================================================== 显示/隐藏答案 ==================================================

[Server]
# yum -y install authconfig-gtk
# authconfig-gtk
  "Identity & Authentication"
    User Account Database: "LDAP"
        [Install] / [Install] / [Force install]
        [Install] / [Install] / [Force install]
        [Cancel]
# authconfig-gtk
  "Identity & Authentication"
    User Account Database: "LDAP"
        LDAP Search Base DN: "dc=example,dc=com"
        LDAP Server: "classroom.example.com""
        复选 "Use TLS encrypt connections"
        "[Download CA Certificate...]"
            Certificate URL: "http://classroom.example.com/pub/example-ca.crt" / [OK]
    Authentication Method: "Kerberos password"
        Realm: "EXAMPLE.COM"
        KDCs: "classroom.example.com"
        Admin Servers: "classroom.example.com"
        取消复选 "Use DNS to resolve hosts to realms"
# getent passwd ldapuser0
ldapuser0:*:1700:1700:LDAP Test User 0:/home/guests/ldapuser0:/bin/bash

[Server]
# rpm -q autofs
# yum -y install autofs
# vim /etc/auto.master
...
/home /etc/auto.ldap
# vim /etc/auto.ldap
* -rw,soft,intr classroom:/home/&
# systemctl restart autofs
# systemctl enable autofs
# ssh ldapuser0@localhost

:: SWAP
创建新的指定大小为 2GB 的swap 分区
需要写入 fstab 自动开机挂接

================================================== 显示/隐藏答案 ==================================================

[Server]
# fdisk /dev/vdb
    Command (m for help): <n>
    Select (default p): <Enter>
    Partition number (3,4, default 3): <Enter>
    First sector (632832-20971519, default 632832): <Enter>
    Last sector, +sectors or +size{K,M,G} (632832-20971519, default 20971519): +2G
    Command (m for help): <t>
    Partition number (1-3, default 3): <Enter>
    Hex code (type L to list all codes): 82
    Command (m for help): <w>
# partprobe
# mkswap /dev/vdb3
# vim /etc/fstab
...
/dev/vdb3 swap swap defaults 0 0
# swapon –a
# free

[Server]
# mkdir /opt/dir
# find / -type f -user harry -exec cp -a {} /opt/dir \;

:: GREP
从文件 /var/log/messages 中找出非空行
和不包含 httpd 的行，
写入到文件/tmp/testfile 中，
要求顺序与 /var/log/messages 中一致。

================================================== 显示/隐藏答案 ==================================================

[Server]
# grep -v ^$ /var/log/messages | grep -v httpd > /tmp/testfile

:: TAR
创建一个压缩包
将 /root 文件夹下的所有文件打包压缩
压缩格式为 bzip
压缩包保存到 /tmp/f.tar.gz

================================================== 显示/隐藏答案 ==================================================

[Server]
# man tar
/-j /-J /-z
# tar -cjf /tmp/f.tar.gz /root/*
# tar -tjf /tmp/f.tar.gz
# file /tmp/f.tar.gz

[Server]
# vim /etc/chrony.conf
...
#server 0.rhel.pool.ntp.org iburst
#server 1.rhel.pool.ntp.org iburst
#server 2.rhel.pool.ntp.org iburst
#server 3.rhel.pool.ntp.org iburst
server classroom.example.com iburst
...
# service chronyd restart
# timedatectl set-ntp true
# timedatectl
...
Timezone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: yes

:: FACL
用户 natasha 对文件 /var/log/maillog 可读和可写，
用户 harry 对文件 /var/log/maillog 不可读和不可写，
所有其它用户对文件 /var/log/maillog 只能读。

================================================== 显示/隐藏答案 ==================================================

[Server]
# setfacl -m u:natasha:rw /var/log/maillog
# setfacl -m u:harry:--- /var/log/maillog
# chmod o=r /var/log/maillog
# getfacl /var/log/maillog