it-knowledge/src/rhcsa.md

RHCSA Study Notes

Exam Information

• Exam Code: EX200
• Duration: 2.5 hours
• Passing Score: 210/300 (70%)

CLI Commands

Core Topics

1. Essential Tools

• Access a shell prompt and issue commands
• Use input-output redirection
• Use grep and regular expressions
• Access remote systems using SSH
• Log in and switch users in multiuser targets

2. File Management

• Create, delete, copy, and move files and directories
• Create and manage hard and soft links
• Find files and directories
• Manage file permissions and ownership

3. Service Configuration

• Configure networking and hostname resolution
• Start, stop, and check system service status
• Configure services to start automatically at boot
• Configure time service clients

4. Storage Management

• List, create, delete, and modify physical storage partitions
• Create and configure filesystem
• Configure and manage swap space
• Create and manage LVM storage
• Create and manage STRATIS storage

5. Container Management

• Find and retrieve container images
• Create and manage containers
• Configure container storage

6. System Management

• Boot, reboot, and shut down a system
• Install Red Hat Enterprise Linux
• Use systemd targets for system management
• Configure system logging
• Schedule tasks using cron and systemd timers

7. Security

• Configure firewall settings
• Configure SELinux
• Manage users and groups
• Set file permissions and ownership

Resources

• Official Red Hat Documentation
• Practice Environments
• Useful Commands Reference

Progress Tracking

• Complete practice exams
• Lab environment setup
• Hands-on practice completed

---

Note: Check boxes can be used to track progress on each topic as you study

---

---

CLI Commands

Networking

nmtui

nmtui # Network Manager Text User Interface

ip

sudo ip addr add dev eth0 192.168.2.2/24 # Add an IP address to the interface eth0 Note: Not persistent, will be lost on reboot

nmcli

nmcli connection add connection.interface-name ens160 ipv4.addresses 192.168.100.1/24 ipv4.gateway 192.168.100.254 type ethernet # Persistant IP address

sudo nmcli connection up ethernet-ens160 # Bring up the ethernet interface

sudo nmcli connection down ethernet-ens160 # Bring down the ethernet interface

sudo nmcli connection delete id "ens160" # Delete the ethernet connection

sudo nmcli connection show # Show all connections

Manage and Monitor Processes

top

top # Display running processes

top -o %MEM # Sort by memory usage

top -o %CPU # Sort by CPU usage

top -p 1234 # Display information for process 1234

pidof

pidof sleep # Display the PID of the sleep command

kill

kill -l # List all signals

kill -9 1234 # Kill the process with PID 1234

nice

nice -n 10 sleep 100 # Run the sleep command with a priority of 10

Partitions and Mounting

lsblk

lsblk -f # List all block devices with filesystem type

fdisk

sudo fdisk /dev/sda # Partition the disk /dev/sda 
# Note: n for new partition, p for primary, 1 for first partition, w for write

mkfs

sudo mkfs.xfs /dev/sda1 # Format the partition /dev/sda1 as XFS

mount

sudo mount /dev/sda1 /mnt # Mount the partition /dev/sda1 to /mnt

sudo mount -a # Mount all partitions

LVM

sudo fdisk /dev/sda # Partition the disk /dev/sda
# Note: p for print, n for new partition, t for type, 8e for LVM, w for write

### Physical Volumes ###
sudo pvdisplay # Display all physical volumes
sudo pvs # Display all physical volumes

sudo pvcreate /dev/sda1p1 # Create a physical volume on /dev/sda1p1
sudo pvcreate /dev/sdb1p1 # Create a physical volume on /dev/sdb1p1
sudo pvcreate /dev/sdc1p1 # Create a physical volume on /dev/sdc1p1

### Volume Groups ###
sudo vgcreate vg_data /dev/sda1p1 /dev/sdb1p1 /dev/sdc1p1 # Create a volume group vg_data on /dev/sda1p1, /dev/sdb1p1, /dev/sdc1p1

sudo vgdisplay # Display all volume groups
sudo vgs # Display all volume groups

### Logical Volumes ###
sudo lvdisplay # Display all logical volumes
sudo lvs # Display all logical volumes

sudo lvcreate -n lv_data -l 100%FREE vg_data # Create a logical volume lv_data on vg_data
sudo lvcreate -n lv_data -L 100M vg_data # Create a logical volume lv_data on vg_data with a size of 100M

### Formatting and Mounting ###
sudo mkfs.xfs /dev/vg_data/lv_data # Format the logical volume lv_data as XFS
sudo mount /dev/vg_data/lv_data /mnt # Mount the logical volume lv_data to /mnt
sudo umount /mnt # Unmount the logical volume lv_data from /mnt

### Extending and Reducing ###
sudo lvextend -L +100M /dev/vg_data/lv_data # Extend the logical volume lv_data by 100M
sudo lvreduce -L -100M /dev/vg_data/lv_data # Reduce the logical volume lv_data by 100M

sudo lvremove /dev/vg_data/lv_data # Remove the logical volume lv_data
sudo vgremove vg_data # Remove the volume group vg_data
sudo pvremove /dev/sda1p1 /dev/sdb1p1 /dev/sdc1p1 # Remove the physical volumes /dev/sda1p1, /dev/sdb1p1, /dev/sdc1p1

### Interactive LVM Tool ###
sudo lvm # Interactive LVM tool

STRATIS

sudo dnf install stratisd stratis-cli # Install the STRATIS storage service and CLI

sudo stratis pool create pool1 /dev/sda1p1 # Create a pool named pool1 on /dev/sda1p1
sudo stratis pool add-data pool1 /dev/sdb1p1 # Add a data volume to the pool named pool1 on /dev/sdb1p1

sudo stratis pool delete pool1 # Delete the pool named pool1

sudo stratis pool list # List all pools
sudo stratis blockdev list # List all block devices

sudo stratis fs create pool1 fstest # Create a filesystem named fstest on the pool named pool1
sudo stratis fs list # List all filesystems # Note: UUID is the UUID of the filesystem
mkdir /mnt/fsmount # Create a mount point for the filesystem
sudo nano /etc/fstab # Add the following line to the fstab file: UUID=1234567890 /mnt/fsmount xfs x-systemd.requires=stratisd.service 0 0
sudo mount -a # Mount all filesystems

Automatic Services & Task Scheduling

cron

sudo crontab -e # Edit the cron table

sudo crontab -l # List the cron table

### crontab format ###

* * * * * command # Run the command every minute

0 12 * * * command # Run the command at 12:00 PM

0 0 * * * command # Run the command at 12:00 AM

at

at 12:00 PM # Schedule a command to run at 12:00 PM

at -l # List all scheduled jobs

atq # List all scheduled jobs

atrm 1 # Remove the scheduled job with ID 1

systemd

sudo systemctl start sshd # Start the sshd service
sudo systemctl stop sshd # Stop the sshd service
sudo systemctl restart sshd # Restart the sshd service

sudo systemctl enable sshd # Enable the sshd service to start on boot
sudo systemctl disable sshd # Disable the sshd service from starting on boot
sudo systemctl status sshd # Check the status of the sshd service

sudo systemctl daemon-reload # Reload the systemd daemon

sudo systemctl mask sshd # Mask the sshd service
sudo systemctl unmask sshd # Unmask the sshd service

systemd service and timer commands

### Creating a service ###
sudo nano /etc/systemd/system/myapp.service
# [Unit]
# Description=My App

# [Service]
# Type=simple
# ExecStart=/usr/bin/myapp
# User=myuser

### Creating a timer ###
sudo nano /etc/systemd/system/myapp.timer
# [Unit]
# Description=My App Timer

# [Timer]
# OnBootSec=10min # Run the timer 10 minutes after the system starts
# OnCalendar=*-*-* 10:00:00 # Run at 10:00 AM every day
# OnCalendar=*-*-* *:*:0 # Run at every minute

# [Install]
# WantedBy=graphical.target # Run the timer on the graphical target

### Tying the timer to the service ###
sudo systemctl link /etc/systemd/system/myapp.timer 

### Starting a service ###
sudo systemctl start myapp
sudo systemctl start myapp.timer

Bash Scripting

Basic Script

nano myscript.sh

Note: Shebang is the first line of the script that tells the system which interpreter to use.

#!/bin/bash
echo "Hello, World!"

### Variables ###
myvar="Hello, World!"
echo $myvar

### Conditionals ###
if [ -f /etc/passwd ]; then
    echo "File exists"
else
    echo "File does not exist"
fi

Script to create a directory

NOTE: When creating bash scripts you can use particular operators to check for the existence of a file (-f) or directory (-d). The following example uses the -d operator to check for the existence of a directory. Using conditional logic, if the script detects that the directory does not exist, the script will go ahead and create it.

#!/bin/bash

# Ask the user to enter a directory name
echo "Enter a directory name: "

# Read the user's input 
read user_dir

# Check if the user_dir exists
if [ -d "$user_dir" ]; then
  echo "The directory '$user_dir' already exists."
else
  # Create the user_dir directory if it doesn't exist
  mkdir "$user_dir"
  echo "The directory '$user_dir' has been created."
fi

In a similar vein, you can check for the existence of a regular file using the -f operator.

#!/bin/bash

# Ask the user to enter a filename
echo "Enter a filename: "

# Read the user's input
read user_file

# Check if the file exists
if [ -f "$user_file" ]; then
  echo "The file '$user_file' exists."
else
  echo "The file '$user_file' does not exist."
fi

for loop

#!/bin/bash

for i in 1..10; do
    echo $i
done

while loop

#!/bin/bash

i=1
while [ $i -le 10 ]; do
    echo $i
    i=$((i+1))
done

until loop

#!/bin/bash

i=1
until [ $i -gt 10 ]; do
    echo $i
    i=$((i+1))
done

Example script to check a user's age

#!/bin/bash
echo "Please provide me your age: "

read age

if [ "$age" -le 17 ]; then
	echo "You cannot enter bars or vote."
elif [ "$age" -ge 18 ] && [ "$age" -le 20 ]; then
	echo "You can vote but not enter bars."
else
	echo "You are old enough to vote and enter bars."
fi

Boot Process & Targets

Change the grub2 configuration

sudo grub2-mkconfig -o /boot/grub2/grub.cfg # Create a new grub configuration file

sudo nano /etc/default/grub # Edit the grub configuration file

# Add the following line to the grub configuration file:
GRUB_CMDLINE_LINUX="quiet splash"

dmesg

Note: The boot process is the process by which a system starts up. It is a sequence of events that occur when a system is powered on or rebooted.

sudo dmesg # Display the kernel messages
sudo dmesg | tail # Display the last 10 lines of the kernel messages
sudo dmesg | grep "kernel" # Display the kernel messages that contain the word "kernel"

### /var/log/messages ###
sudo less /var/log/messages # Display the kernel messages

systemd targets

Note: Systemd targets are a way to manage the boot process of a system. They are a way to manage the boot process of a system.

multi.target is the default target for the system. graphical.target is the target for the graphical interface. basic.target is the target for the minimal system. rescue.target is the target for the rescue mode. emergency.target is the target for the emergency mode. multi-user.target is the target for the multi-user mode. reboot.target is the target for the reboot mode. poweroff.target is the target for the poweroff mode.

systemctl list-units --type=target

### Changing the default target ###
sudo systemctl set-default multi-user.target # Set the default target to multi-user.target
sudo systemctl set-default graphical.target # Set the default target to graphical.target
sudo systemctl set-default basic.target # Set the default target to basic.target

Run Level

Note: Run level is a way to manage the boot process of a system. It is a way to manage the boot process of a system. 0 is the emergency mode. 1 is the single user mode. 2 is the multi-user mode. 3 is the multi-user mode. 4 is the multi-user mode. (unused) 5 is the graphical mode. 6 is the reboot mode.

runlevel # Display the current run level
sudo systemctl get-default # Display the default target
sudo systemctl set-default runlevel3.target # Set the default target to runlevel3.target
sudo telinit 3 # Change to runlevel 3

Manage SSH Connections

ssh

ssh user@host # Connect to the host as the user

ssh -p 2222 user@host # Connect to the host as the user on port 2222

ssh -i /path/to/private_key user@host # Connect to the host as the user using a private key

ssh-copy-id user@host # Copy the user's public key to the host

ssh-keygen -t ed25519 -C "comment" -f ~/.ssh/id_ed25519 -N "" # Generate a new ed25519 key

ssh-keygen -t rsa -b 4096 -C "comment" -f ~/.ssh/id_rsa -N "" # Generate a new rsa key

sshd_config

sudo nano /etc/ssh/sshd_config # Edit the sshd configuration file

# Add the following line to the sshd configuration file:
Port 2222

sudo systemctl restart sshd # Restart the sshd service

NFS & NTP

NFS

sudo dnf install nfs-utils # Install the NFS utilities

### Port Number ###
> Note: The port number for NFS is 2049.

### Firewall ###
sudo firewall-cmd --add-service=nfs --permanent # Add the NFS service to the firewall
sudo firewall-cmd --reload # Reload the firewall
sudo firewall-cmd --list-services # List the services in the firewall

sudo nano /etc/exports # Edit the exports file

# Add the following line to the exports file:
/mnt/nfs 192.168.1.0/24(rw,sync,no_subtree_check) # The directory to export

sudo exportfs -r # Export the NFS shares
sudo exportfs # Display the NFS shares

sudo systemctl start nfs-server # Start the NFS server

### root-squash and no_root_squash
> Note: root-squash is a feature of NFS that allows the root user to access the NFS share as a regular user. no_root_squash 
> is a feature of NFS that allows the root user to access the NFS share as the root user.

> Note: async is a feature of NFS that allows the NFS server to write to the NFS share asynchronously. 
> sync is a feature of NFS that allows the NFS server to write to the NFS share synchronously.

```bash
sudo nano /etc/exports # Edit the exports file

# Add the following line to the exports file:
/mnt/nfs 192.168.1.0/24(rw,sync,no_subtree_check,root_squash) # The directory to export

# Add the following line to the exports file:
/mnt/nfs 192.168.1.0/24(rw,async,no_subtree_check,no_root_squash) # The directory to export

Configure an NFS Client

sudo dnf install nfs-utils # Install the NFS utilities

sudo nano /etc/fstab # Edit the fstab file

# Add the following line to the fstab file:
192.168.1.1:/mnt/nfs /mnt/nfs nfs defaults 0 0

sudo mount -a # Mount the NFS shares

sudo mount 192.168.1.1:/mnt/nfs /mnt/nfs # Mount the NFS share
sudo umount /mnt/nfs # Unmount the NFS share

NTP

sudo dnf install ntp # Install the NTP utilities

sudo ntpdate time.nist.gov # Update the time
sudo ntpq -p # Display the NTP peers
sudo ntpstat # Display the NTP status

### Timezone and Time Commands ###
sudo timedatectl set-timezone America/Chicago # Set the timezone to America/Chicago
sudo timedatectl set-time "12:00:00" # Set the time to 12:00:00
sudo timedatectl set-ntp true # Enable the NTP service
sudo timedatectl set-ntp false # Disable the NTP service

### chrony
```bash
sudo dnf install chrony # Install the chrony utilities

sudo chronyc sources # Display the chrony sources
sudo chronyc tracking # Display the chrony tracking
sudo chronyc sources -v # Display the chrony sources with more detail

sudo nano /etc/chrony.conf # Edit the chrony configuration file

# Add the following line to the chrony configuration file:
server time.nist.gov iburst # Add the NIST time server
pool 2.rhel.pool.ntp.org iburst # Add the RHEL time server

sudo systemctl start chronyd # Start the chrony service
sudo systemctl enable chronyd # Enable the chrony service to start on boot

Secure Linux Systems

lsattr

lsattr # List the attributes of the files and directories

lsattr /etc/passwd # List the attributes of the /etc/passwd file

chattr

chattr +i /etc/passwd # Set the immutable attribute on the /etc/passwd file
chattr -R +i /etc/ # Set the immutable attribute on the /etc/ directory and all its contents
chattr +a /etc/passwd # Set the append only attribute on the /etc/passwd file

chattr -i /etc/passwd # Remove the immutable attribute on the /etc/passwd file
chattr -R -i /etc/ # Remove the immutable attribute on the /etc/ directory and all its contents

getfacl

getfacl /etc/passwd # Display the ACLs of the /etc/passwd file

setfacl

setfacl -m u:user:rwx /etc/passwd # Set the ACLs of the /etc/passwd file for the user user with read, write, and execute permissions
setfacl -m g:group1:r file.txt # Set the ACLs of the file.txt file for the group group1 read only

SELinux Basics

sudo sestatus # Display the SELinux status

sudo getenforce # Display the SELinux mode

sudo setenforce 0 # Set the SELinux mode to permissive
sudo setenforce 1 # Set the SELinux mode to enforcing

ls -Z # List the SELinux context of the files and directories
ps -eZ # List the SELinux context of the processes

### SELinux Port Management
# Note: SELinux will block any attempt to use a port that is not in the SELinux policy in enforcing mode.
sudo semanage port -a -t http_port_t -p tcp 8080 # Add the HTTP port to the SELinux policy
sudo semanage port -d -t http_port_t -p tcp 8080 # Remove the HTTP port from the SELinux policy

### SELinux Login Management
sudo semanage login -a -s user_t user1 # Add the user user1 to the SELinux policy
sudo semanage login -d user1 # Remove the user user1 from the SELinux policy

### getsebool
```bash
getsebool -a # List all SELinux booleans

getsebool httpd_can_network_connect # Display the SELinux boolean for the httpd_can_network_connect boolean

### setsebool
```bash
setsebool -P httpd_can_network_connect on # Set the httpd_can_network_connect boolean to on
setsebool -P httpd_can_network_connect off # Set the httpd_can_network_connect boolean to off

sudo semanage boolean -l -C # List all SELinux booleans

### sealert
```bash
sudo sealert -a /var/log/audit/audit.log # Display the SELinux alerts

journalctl | grep -i sealert # Display the SELinux alerts

Manage Packages on RHEL

rpm

rpm -q httpd # Display the installed packages
rpm -qa # Display all installed packages

rpm -qf /bin/bash # Display the package that installed the /bin/bash command
rpm -ql httpd # Display the files installed by the httpd package
rpm -ql coreutils | grep bin # Display the files installed by the coreutils package

sudo rpm -i httpd-2.4.37-1.el8.x86_64.rpm # Install the httpd package

sudo rpm -e httpd # Remove the httpd package

rpm2cpio

rpm2cpio httpd-2.4.37-1.el8.x86_64.rpm | cpio -tv # Display the contents of the httpd package

rpm2cpio httpd-2.4.37-1.el8.x86_64.rpm | cpio -idmv # Extract the contents of the httpd package

dnf

sudo dnf install httpd # Install the httpd package

sudo dnf remove httpd # Remove the httpd package

sudo dnf list # List all packages

sudo dnf search httpd # Search for the httpd package
sudo dnf info httpd # Display information about the httpd package

sudo dnf provides /bin/bash # Display the package that provides the /bin/bash command
sudo dnf deplist httpd # Display the dependencies of the httpd package

modify the .repo file to skip the GPG check

sudo nano /etc/yum.repos.d/rhel.repo

# Add the following line to the rhel.repo file:
gpgcheck=0

dnf groups

sudo dnf group list # List all groups
sudo dnf group list --hidden # List all hidden groups

sudo dnf group install "Development Tools" # Install the Development Tools group
sudo dnf group install --with-optional "Development Tools" # Install the Development Tools group with optional packages
sudo dnf group info "Development Tools" # Display information about the Development Tools group
sudo dnf group remove "Development Tools" # Remove the Development Tools group

sudo dnf history # Display the history of the packages
sudo dnf history undo 1 # Undo the last package installation
sudo less /var/log/dnf.rpm.log # Display the dnf log

dd

Note: dd is used to copy and convert files and is used to create disk images.

sudo dd if=/dev/sr0 of=/optical-rhel.iso bs=1M # Create an ISO image of the optical drive

sudo dd if=/dev/sr0 of=/optical-rhel.iso bs=1M status=progress # Create an ISO image of the optical drive with progress

### mounting an iso image using /etc/fstab
```bash
sudo nano /etc/fstab

# Add the following line to the fstab file:
/path/to/iso /mnt/iso iso9660 defaults 0 0

sudo mount -a # Mount the ISO image
sudo umount /mnt/iso # Unmount the ISO image

### dnf config-manager
sudo dnf config-manager --add-repo="file:///path/to/repo/AppStream" # Add a repository
sudo dnf config-manager --add-repo="file:///path/to/repo/BaseOS" # Add a repository

sudo dnf repolist # List all repositories

Understand and Configure Firewalls

firewall-cmd

Note: firewall-cmd is used to manage the firewall rules.

sudo firewall-cmd --get-active-zones # Display the active zones
sudo firewall-cmd --get-default-zone # Display the default zone
sudo firewall-cmd --get-zones # Display the zones

sudo firewall-cmd --list-all # Display all the rules in the firewall

sudo firewall-cmd --zone=public --add-service=http --permanent # Add the http service to the public zone
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent # Add the port 80/tcp to the public zone
sudo firewall-cmd --zone=public --add-protocol=tcp --permanent # Add the tcp protocol to the public zone

sudo firewall-cmd --reload # Reload the firewall

port reference

sudo less /etc/services # Display the services