🐧 RHEL Study Guide

💾 Managing Partitions & File Systems

Disk partitioning, file system creation, mounting, fstab, fsck, and more.

Partition Types & Tools

# View all disks and partitions
fdisk -l
lsblk
blkid

# Create MBR partition (RHEL 6/7)
fdisk /dev/sdb
  n → new | p → primary | e → extended | t → change type
  8e → LVM | 82 → swap | 83 → Linux | fd → RAID
  w → write and exit

# Update partition table without reboot
partprobe /dev/sdb
partx -a /dev/sdb

File System Comparison

Create, Mount, and Configure File Systems

# Create file system
mkfs.ext4 /dev/sdb1
mkfs.xfs  /dev/sdb2      # default in RHEL 7+

# Temporary mount
mkdir /mnt/data
mount /dev/sdb1 /mnt/data

# Permanent mount — edit /etc/fstab
# device   mountpoint  fstype  options  dump  fsck
/dev/sdb1   /mnt/data   ext4   defaults   0    0
UUID=xxxx   /mnt/data2  xfs    defaults   0    0
LABEL=myfs  /mnt/data3  ext4   defaults   0    0

mount -a   # mount all in fstab
df -hT     # verify

Label & UUID Operations

e2label /dev/sdb1 mydata          # assign label (ext*)
xfs_admin -L myxfs /dev/sdb2      # assign label (xfs)
blkid /dev/sdb1                   # get UUID
tune2fs -l /dev/sdb1              # show metadata

fsck — File System Check

# ALWAYS unmount before fsck
umount /dev/sdb1
fsck /dev/sdb1
e2fsck -p /dev/sdb1    # non-interactive
fsck -AR -y            # all file systems, auto-fix

# Repair superblock
dumpe2fs /dev/sdb1 | grep superblock
e2fsck -b <secondary_superblock> /dev/sdb1

Swap Management

# Rule: RAM ≤ 2GB → swap = 2×RAM; RAM > 2GB → swap = 2GB + RAM
fdisk /dev/sdb   # create partition, type 82
mkswap /dev/sdb2
swapon /dev/sdb2
free -m           # verify

# In /etc/fstab:
/dev/sdb2   swap   swap   defaults   0   0

# Create swap file (when no free partition)
dd if=/dev/zero of=/swapfile bs=1M count=2048
mkswap /swapfile
swapon /swapfile

🗂️ LVM & RAID

Logical Volume Management, extending/reducing volumes, RAID levels, and migration.

LVM Components

• PV (Physical Volume) — raw partition with type 8e
• PE (Physical Extent) — chunk of disk space, default 4MB
• VG (Volume Group) — pool combining PVs
• LV (Logical Volume) — usable volume formatted with a FS
• LE (Logical Extent) — mapped to PEs

Creating LVM (Full Workflow)

# Step 1: Create partitions with type 8e
fdisk /dev/sdb    # create partition → t → 8e → w
partprobe /dev/sdb

# Step 2: Create Physical Volumes
pvcreate /dev/sdb1 /dev/sdc1

# Step 3: Create Volume Group
vgcreate myvg /dev/sdb1 /dev/sdc1
vgcreate -s 8M myvg /dev/sdb1   # 8MB PE size

# Step 4: Create Logical Volume
lvcreate -L +10G -n mylv myvg
lvcreate -l 100 -n mylv myvg    # using PE count

# Step 5: Format and mount
mkfs.xfs /dev/myvg/mylv
mkdir /mnt/lvm
mount /dev/myvg/mylv /mnt/lvm

# Permanent — /etc/fstab
/dev/myvg/mylv   /mnt/lvm   xfs   defaults   0   0

Extending LVM

# Extend VG (add new PV)
pvcreate /dev/sdd1
vgextend myvg /dev/sdd1

# Extend LV and filesystem (online — no downtime)
lvextend -L +5G /dev/myvg/mylv
xfs_growfs /mnt/lvm            # for XFS
resize2fs /dev/myvg/mylv       # for ext4

# Shortcut: extend + resize in one command
lvresize -r -L +5G /dev/myvg/mylv   # RHEL 7+

Reducing LVM (ext4 only — requires downtime)

# DANGER: XFS cannot be reduced. ext4 only.
umount /mnt/lvm
e2fsck /dev/myvg/mylv
lvreduce -L -2G /dev/myvg/mylv
resize2fs /dev/myvg/mylv
mount -a

Migrating Data Between PVs

pvmove /dev/sdb1 /dev/sdd1     # move data from old to new PV
vgreduce myvg /dev/sdb1        # remove failed PV from VG
pvremove /dev/sdb1             # remove PV metadata

# Create thin pool
lvcreate -L 20G --thinpool mypool myvg

# Create thin volume (over-provisioned)
lvcreate -V 50G --thin -n thin_lv myvg/mypool

# Snapshot
lvcreate -s -n snap1 -L 1G /dev/myvg/mylv

RAID Levels Comparison

Software RAID with mdadm

# Create RAID 5
mdadm -Cv /dev/md0 -n 3 /dev/sdb /dev/sdc /dev/sdd -l 5

# Check status
cat /proc/mdstat
mdadm -D /dev/md0

# Simulate disk failure + replace
mdadm /dev/md0 -f /dev/sdb   # mark failed
mdadm /dev/md0 -r /dev/sdb   # remove
mdadm /dev/md0 -a /dev/sde   # add replacement

# Save RAID config
mdadm --detail --scan >> /etc/mdadm.conf

🔒 Permissions, ACL & Special Bits

Linux file permissions, ACLs, SUID/SGID/sticky bit, umask, disk quotas.

Permission Basics

ls -l filename
# -rwxr-xr-- 1 root root 1234 Jan 1 file
# r=4, w=2, x=1, -=0
# chmod [ugo][+-=][rwx] file  OR  chmod 755 file

chmod 755 /dir
chmod -R 644 /dir/       # recursive
chown root:devs file     # change owner and group
chgrp devs file          # change group only

Special Permissions

# SUID (Set UID) — run as file owner
chmod u+s /usr/bin/passwd
# rwsrwxrwx — 's' in owner execute position

# SGID (Set GID) — run as file group | dirs: inherit group
chmod g+s /shared_dir

# Sticky Bit — only owner can delete from dir
chmod o+t /tmp
# rwxrwxrwt — 't' in others execute position

# Numeric: 4=SUID, 2=SGID, 1=sticky
chmod 4755 file   # SUID + 755
chmod 1777 /tmp   # sticky + full perms

umask

# Default: root=0022, users=0002
# File perms = 666 - umask | Dir perms = 777 - umask
umask              # see current
umask 027          # set temporarily

# Make permanent for all users
echo "umask 027" >> /etc/bashrc
source /etc/bashrc

ACL (Access Control List)

# Mount partition with ACL support
# /dev/sdb1  /mnt/data  ext4  defaults,acl  0 0

# View ACL
getfacl filename

# Set ACL
setfacl -m u:alice:rw  filename      # user
setfacl -m g:devs:rx   /dir          # group
setfacl -R -m u:alice:rwx /dir       # recursive

# Remove ACL
setfacl -x u:alice  filename
setfacl -b          filename         # remove all ACL

Disk Quotas

# /etc/fstab — add usrquota and/or grpquota
/dev/sdb1  /mnt/data  ext4  defaults,usrquota,grpquota  0 0

# Remount and create quota database
mount -o remount /mnt/data
quotacheck -cug /mnt/data
quotaon /mnt/data

# Set user quota
edquota -u username      # edit in editor
edquota -t               # edit grace period
edquota -p user1 user2   # copy user1's quota to user2

# Report
repquota /mnt/data

🌐 Network Configuration & Troubleshooting

IP configuration, bonding/teaming, routing, and diagnostic commands across RHEL versions.

IP Address Classes

Static IP Configuration

# /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.10
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8

service network restart

nmcli connection add \
  con-name "eth0" ifname eth0 type ethernet
nmcli connection modify "eth0" \
  ipv4.addresses "192.168.1.10/24 192.168.1.1" \
  ipv4.dns 8.8.8.8 ipv4.method static
nmcli connection up "eth0"
systemctl restart network

# RHEL 8/9 — Traditional network.service is deprecated
# Only NetworkManager; /etc/sysconfig/network-scripts/ deprecated in RHEL 9

# Add and configure connection
nmcli con add type ethernet ifname ens160 con-name mycon
nmcli con mod mycon \
  ipv4.addresses 192.168.1.10/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns 8.8.8.8 \
  ipv4.method manual
nmcli con up mycon

# RHEL 9 — use nmtui (TUI) or cockpit web console
nmtui

# Show all connections
nmcli con show
nmcli device status

Hostname Management

# Temporary (all versions)
hostname server1.example.com

# RHEL 6 permanent: /etc/sysconfig/network → HOSTNAME=...
# RHEL 7/8/9 permanent:
hostnamectl set-hostname server1.example.com
hostnamectl status

NIC Bonding / Teaming

# /etc/sysconfig/network-scripts/ifcfg-bond0
DEVICE=bond0
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.5
BONDING_OPTS="mode=1 miimon=50"

# ifcfg-eth0
MASTER=bond0
SLAVE=yes

nmcli con add con-name team0 \
  ifname team0 type team \
  config '{"runner":{"name":"activebackup"}}'
nmcli con add con-name port1 \
  ifname eth1 type team-slave master team0
nmcli con add con-name port2 \
  ifname eth2 type team-slave master team0
nmcli con mod team0 \
  ipv4.addresses "10.0.0.5/24" ipv4.method static
nmcli con up team0
teamdctl team0 state

# NIC Teaming is deprecated in RHEL 9; use Bonding
nmcli con add type bond con-name bond0 ifname bond0 \
  bond.options "mode=active-backup,miimon=1000"
nmcli con add type ethernet ifname ens160 master bond0
nmcli con add type ethernet ifname ens161 master bond0
nmcli con mod bond0 ipv4.addresses 10.0.0.5/24 ipv4.method manual
nmcli con up bond0

Network Diagnostics

ping -c 4 8.8.8.8
traceroute 8.8.8.8    # or tracepath
nslookup google.com
dig google.com
host google.com
netstat -ntulp         # open ports (or ss -ntulp in RHEL 7+)
ss -ntulp              # preferred RHEL 7+
nmap -p 22 192.168.1.1
ethtool eth0           # check cable/link
ip addr show
ip route
route -n

🛡️ Managing SELinux

SELinux modes, contexts, Booleans, policies, and troubleshooting.

SELinux Modes

Managing SELinux Modes

# Check mode
getenforce
sestatus

# Change temporarily (no reboot)
setenforce 0    # Permissive
setenforce 1    # Enforcing

# Permanent — /etc/selinux/config (or /etc/sysconfig/selinux symlink)
SELINUX=enforcing    # or permissive or disabled

# Note: Changing to/from disabled requires reboot + relabeling

Contexts & Labels

# View contexts
ls -Z filename
ls -ldZ /var/www/html
ps -efZ | grep httpd

# Change context (temporary — lost on relabel)
chcon -t httpd_sys_content_t /mywebdir

# Set persistent context (survives relabel)
semanage fcontext -a -t httpd_sys_content_t "/mywebdir(/.*)?"
restorecon -Rv /mywebdir

# Relabel entire filesystem (on next boot)
touch /.autorelabel
reboot

Booleans

# List all booleans
getsebool -a
getsebool -a | grep ftp
getsebool -a | grep http

# Change boolean temporarily
setsebool httpd_can_network_connect on

# Change permanently (-P)
setsebool -P httpd_can_network_connect on
setsebool -P allow_ftpd_anon_write on
setsebool -P samba_export_all_rw 1

SELinux Port Management

# View ports for a type
semanage port -l | grep http

# Add custom port for httpd (e.g., 8888)
semanage port -a -t http_port_t -p tcp 8888

Troubleshooting SELinux Denials

# Audit log
cat /var/log/audit/audit.log | grep AVC

# Human-readable explanations
ausearch -m avc -ts recent
sealert -a /var/log/audit/audit.log

# Install troubleshooting tools
yum install setroubleshoot-server -y    # RHEL 6/7
dnf install setroubleshoot-server -y    # RHEL 8/9

🚀 Booting Procedure & Kernel

BIOS/UEFI, GRUB, init/systemd, run levels/targets, kernel modules.

Boot Stages

Run Levels vs Systemd Targets

# RHEL 6 — change run level
init 3
who -r                         # check run level

# RHEL 7/8/9 — change target
systemctl isolate multi-user.target
systemctl get-default
systemctl set-default graphical.target

GRUB2 Commands (RHEL 7/8/9)

# View config (never edit directly)
cat /boot/grub2/grub.cfg

# Regenerate grub config
grub2-mkconfig -o /boot/grub2/grub.cfg            # BIOS
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg  # UEFI

# Reinstall GRUB
grub2-install /dev/sda   # BIOS

Kernel Modules

lsmod                     # list loaded modules
modinfo module_name       # info about module
modprobe module_name      # load module with deps
modprobe -r module_name   # remove module
rmmod module_name         # remove without dep check
depmod                    # scan for new hardware

# Blacklist a module permanently
echo "blacklist usb_storage" > /etc/modprobe.d/blacklist.conf

Kernel Version & Info

uname -r             # kernel version
uname -a             # all info
rpm -qa kernel*      # installed kernels
cat /etc/redhat-release

# RHEL 8/9 — manage multiple kernels
dnf install kernel    # install new kernel
grubby --default-kernel
grubby --set-default /boot/vmlinuz-<version>

⏰ Job Automation (Cron & At)

Scheduling with crontab, at, anacron — for regular and one-time jobs.

Cron Format

# MIN  HOUR  DOM  MON  DOW  COMMAND
#  0-59  0-23  1-31  1-12  0-7(0&7=Sun)

# Examples
0 2 * * *  /backup.sh            # daily at 2AM
30 8 * * 1  /weekly_report.sh    # every Monday 8:30AM
*/5 * * * * /check.sh            # every 5 minutes
0 0 1 * *   /monthly.sh          # first of every month
@reboot     /startup.sh          # on every boot
@monthly    /monthly.sh          # monthly shortcut

Crontab Commands

crontab -e              # edit current user's crontab
crontab -l              # list crontabs
crontab -r              # remove all crontabs
crontab -eu username    # edit another user's crontab (root)
cat /etc/crontab        # system-wide crontab

Allow / Deny Cron

# /etc/cron.allow — only listed users can use cron
# /etc/cron.deny  — listed users cannot use cron
# If neither file exists → all users except root are denied

Service Commands

service crond start
service crond restart
chkconfig crond on
service atd start
chkconfig atd on

systemctl start crond
systemctl restart crond
systemctl enable crond
systemctl start atd
systemctl enable atd

at Jobs (One-time Execution)

at 14:30                     # schedule at 2:30 PM
at now +30min
at 9AM Jan 20 2026
at midnight + 4days

# In at editor → enter commands → Ctrl+D to save

atq                          # list queued jobs
at -l                        # same as atq
atrm 3                       # remove job #3
at -r 3                      # same as atrm

Anacron (Missed Jobs)

# /etc/anacrontab — handles jobs missed due to downtime
# PERIOD  DELAY  JOB-ID  COMMAND
1         5      daily    run-parts /etc/cron.daily
7         10     weekly   run-parts /etc/cron.weekly

# Modern alternative to cron in RHEL 8/9
# /etc/systemd/system/myjob.timer
[Unit]
Description=Run myjob every day

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

systemctl enable --now myjob.timer
systemctl list-timers --all

🔐 SSH & Remote Administration

SSH configuration, key-based auth, port forwarding, scp, rsync, and security.

SSH Basics

# Connect to remote host
ssh user@192.168.1.10
ssh 192.168.1.10 -l root
ssh root@server.example.com

# Run command on remote host without login
ssh root@192.168.1.10 "df -h"

# Run GUI over SSH (X forwarding)
ssh -X root@192.168.1.10

Key-Based Authentication

# 1. Generate keys on local machine
ssh-keygen -t rsa -b 4096
# Keys: ~/.ssh/id_rsa (private)  ~/.ssh/id_rsa.pub (public)

# 2. Copy public key to remote host
ssh-copy-id user@remote_host

# Remote stores key in ~/.ssh/authorized_keys
# Next login will not ask password

SSH Configuration (/etc/ssh/sshd_config)

# Prevent root login
PermitRootLogin no

# Disable password auth (key-only)
PasswordAuthentication no

# Allow empty passwords
PermitEmptyPasswords yes

# Enable X11 forwarding
X11Forwarding yes

# Allow/deny specific users
AllowUsers alice bob
DenyUsers hacker
AllowGroups sysadmins

# Change SSH port
Port 2222

# Max auth attempts
MaxAuthTries 3

# Restart after changes
systemctl restart sshd    # RHEL 7/8/9
service sshd restart      # RHEL 6

File Transfer

# scp — secure copy (overwrites existing)
scp file.txt user@192.168.1.10:/tmp/
scp -r /dir user@host:/dest/
scp user@host:/remote/file /local/path

# rsync — syncs only changed data (faster)
rsync -av /src/ user@host:/dest/
rsync -aAx /src/ user@host:/dest/  # with ACL+SELinux
rsync -avz --delete /src/ user@host:/dest/  # delete removed files

Allow / Deny Hosts (TCP Wrappers)

# /etc/hosts.allow — allowed hosts
sshd: 192.168.1.0/24
sshd: *.example.com

# /etc/hosts.deny — denied hosts
sshd: ALL EXCEPT 192.168.1.10
sshd: 10.0.0.0/8

🧠 Memory Management & Swap

RAM, swap configuration, virtual memory concepts, and monitoring.

Swap Size Guidelines

Swap Commands

free -m               # RAM and swap summary
swapon -s             # list swap partitions/files
vmstat 2 5            # virtual memory statistics
cat /proc/meminfo     # detailed memory info

# Activate / deactivate
swapon /dev/sdb2
swapoff /dev/sdb2
swapon -a             # all in /etc/fstab
swapoff -a

Create Swap Partition

fdisk /dev/sdb    # create partition, type 82
mkswap /dev/sdb2
swapon /dev/sdb2

# Add to /etc/fstab
/dev/sdb2   swap   swap   defaults   0   0

Create Swap File

dd if=/dev/zero of=/swapfile bs=1M count=2048
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

# /etc/fstab
/swapfile   swap   swap   defaults   0   0

Key Concepts

• Virtual memory = Physical RAM + Swap space
• Page-out (swap-in): inactive pages move from RAM → swap
• Page-in (swap-out): pages move from swap → RAM when needed
• High swap usage = insufficient RAM; add more RAM rather than more swap

📦 Software Management

RPM, YUM, DNF, repositories, and kernel patching procedures.

RPM Commands

# Install / Upgrade / Remove
rpm -ivh package.rpm
rpm -Uvh package.rpm       # upgrade (installs if not present)
rpm -e package_name
rpm -e --nodeps package    # ignore dependencies
rpm -ivh package.rpm --force  # force reinstall

# Query
rpm -qa                    # all installed
rpm -qa | grep httpd
rpm -qi package            # detailed info
rpm -ql package            # list files
rpm -qf /usr/bin/ls        # which package owns file
rpm -qR package            # list dependencies
rpm -V  package            # verify package integrity
rpm --replacepkgs package  # restore missing files

YUM Commands (RHEL 6/7)

yum install httpd -y
yum remove httpd -y
yum update httpd
yum update             # update all packages
yum search keyword
yum info package
yum list installed
yum list available
yum groupinstall "Development Tools"
yum repolist
yum history
yum history undo <id>
yum clean all

# DNF is the default; yum is a compatibility alias in RHEL 8/9
dnf install httpd -y
dnf remove httpd
dnf update
dnf search keyword
dnf info package
dnf grouplist
dnf groupinstall "Development Tools"

# Module streams (Application Streams — new in RHEL 8)
dnf module list
dnf module enable nodejs:18
dnf module install nodejs:18/common

# Enable EPEL repository
dnf install epel-release -y
dnf config-manager --enable powertools    # RHEL 8 CRB
dnf config-manager --enable crb          # RHEL 9 CRB

YUM Repository Setup

# /etc/yum.repos.d/local.repo
[localrepo]
name=Local RHEL Repo
baseurl=file:///mnt/cdrom
gpgcheck=0
enabled=1

# Network repo example
baseurl=http://server/rhel8
# or
baseurl=ftp://server/pub/rhel

yum clean all
yum repolist

💿 Backup & Restore

tar, cpio, dd, dump/restore, rsync, and backup strategies.

tar (Tape Archiving)

# Create archive
tar -cvf /backup/etc.tar /etc/

# With gzip compression
tar -czvf /backup/etc.tar.gz /etc/

# With bzip2 (smaller, slower)
tar -cjvf /backup/etc.tar.bz2 /etc/

# With xz (RHEL 7+, best compression)
tar -cJvf /backup/etc.tar.xz /etc/

# List contents
tar -tvf archive.tar

# Extract to specific path
tar -xvf archive.tar -C /restore/

# Include ACL and SELinux contexts
tar --xattrs -cvf /backup/full.tar /data/

# Add files to existing archive
tar -uvf archive.tar newfile

Backup Types

dd — Disk-to-Disk Backup

dd if=/dev/sda of=/dev/sdb           # clone disk
dd if=/dev/sda of=/backup/mbr.bak bs=512 count=1  # backup MBR
dd if=/dev/cdrom of=/isos/rhel9.iso  # create ISO from DVD
dd if=/dev/zero of=/bigfile bs=1M count=1024  # create empty file

rsync

rsync -av /source/ /dest/
rsync -av /source/ user@host:/dest/
rsync -aAx /source/ /dest/      # preserve ACL + SELinux
rsync -avz --delete /src/ /dst/ # delete removed files

⚙️ Managing Services & Daemons

service/chkconfig (RHEL 6) vs systemctl (RHEL 7/8/9), unit files, and targets.

Service Commands Comparison

systemctl Advanced

# Mask (prevent any start, including manual)
systemctl mask httpd
systemctl unmask httpd

# Check dependencies
systemctl list-dependencies httpd

# Failed services
systemctl --failed --type=service

# Journal logs for a service
journalctl -u httpd
journalctl -u httpd -f         # follow live
journalctl -u httpd --since "1 hour ago"

initd vs systemd

📊 Process Management

ps, top, kill, nice/renice, signals, process states, vmstat, SAR.

Key Commands

ps -ef                 # all processes with PPID
ps -aux                # all including background
ps -u username         # user's processes
ps -o pid,comm,%mem,%cpu  # custom fields
pgrep -u alice         # PIDs for user alice
pidof httpd            # PIDs of named process
pstree                 # parent-child tree

Process Signals

kill -9 1234           # kill by PID (force)
kill -15 1234          # kill gracefully
kill -1 1234           # reload
pkill -9 firefox       # kill by name
pkill -u alice         # kill all of user
killall httpd          # kill all with name

Priority (nice / renice)

# Nice scale: -20 (highest priority) to 19 (lowest)
# Default niceness = 0

nice -n 10 command       # start with low priority
nice -n -5 command       # higher priority (root only)
renice 5 -p 1234         # change running process
renice -n 10 1560        # RHEL 7+ syntax

top Interactive Keys

# While top is running:
k → kill process    M → sort by memory   P → sort by CPU
r → renice          u → filter by user   z → color mode
q → quit            1 → show all CPUs    d → change refresh rate

Monitoring Commands

vmstat 2 10        # virtual memory stats every 2s, 10 times
iostat 5 2         # I/O stats
sar -r 2 5         # memory utilization
sar -p ALL 2 5     # CPU utilization
sar -b 2 5         # disk I/O
uptime             # load average (1m, 5m, 15m)
lscpu              # CPU info
nproc              # number of CPUs
cat /proc/cpuinfo

Process States

• R — Running
• S — Sleeping (interruptible)
• D — Uninterruptible sleep (I/O wait)
• T — Stopped (Ctrl+Z)
• Z — Zombie (finished but parent hasn't reaped)
• O — Orphan (running without parent)

📁 FTP Server (vsftpd)

Configure FTP server, secure FTP, anonymous and authenticated access.

FTP Profile

Basic FTP Server Setup

# Install
yum install vsftpd* -y          # RHEL 6/7
dnf install vsftpd -y           # RHEL 8/9

# Create files in FTP root
mkdir -p /var/ftp/pub
touch /var/ftp/pub/test{1..5}

# Start and enable
systemctl start vsftpd
systemctl enable vsftpd

# Firewall
firewall-cmd --permanent --add-service=ftp
firewall-cmd --reload

Key vsftpd.conf Settings

# /etc/vsftpd/vsftpd.conf
anonymous_enable=YES       # allow anon login
local_enable=YES           # allow local users
write_enable=YES           # allow uploads
anon_upload_enable=YES     # anon uploads
chroot_local_user=YES      # jail users to home dir
ftp_banner="Welcome!"
max_clients=20

LFTP Client

lftp 192.168.1.10
lftp> ls
lftp> get filename
lftp> put localfile
lftp> mget f1 f2 f3
lftp> quit

🗄️ NFS & Autofs

NFS server/client, secure NFS with Kerberos, Autofs, and LDAP client.

NFS Server Setup

# Install and configure
yum install nfs-utils -y
mkdir /shared
chmod 777 /shared

# /etc/exports
/shared   *.example.com(rw,sync)
/shared   192.168.1.0/24(ro,sync)
/shared   client1.example.com(rw,sync,no_root_squash)

# Export and start
exportfs -rv
systemctl restart nfs-server   # RHEL 7/8/9
systemctl enable nfs-server
service nfs restart             # RHEL 6

# Firewall
firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --reload

NFS Client

# Check available exports
showmount -e server.example.com

# Mount temporarily
mkdir /mnt/nfs
mount server.example.com:/shared /mnt/nfs

# Permanent — /etc/fstab
server.example.com:/shared  /mnt/nfs  nfs  defaults  0  0

Autofs Configuration

# Install
yum install autofs -y

# /etc/auto.master
/mnt   /etc/auto.misc   --timeout=60

# /etc/auto.misc
nfs   -rw   server.example.com:/shared

# Restart autofs
systemctl restart autofs
systemctl enable autofs

# Access triggers auto-mount
cd /mnt/nfs   # → auto-mounted!

🪟 Samba Server

File sharing between Linux and Windows using SMB/CIFS protocol.

Samba Profile

Samba Server Configuration

# Install
dnf install samba samba-client -y

# Create share directory
mkdir /samba
chmod 777 /samba
chcon -t samba_share_t /samba    # SELinux context

# Create samba user
useradd sambauser
smbpasswd -a sambauser

# /etc/samba/smb.conf — add at end
[myshare]
  comment = My Samba Share
  path = /samba
  public = no
  writable = yes
  valid users = sambauser
  write list = sambauser

# Test config
testparm

# Start
systemctl start smb nmb
systemctl enable smb nmb

# Firewall
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload

Samba Client (Linux)

# List shares
smbclient -L //server -U username

# Mount Samba share
mount -t cifs //server/myshare /mnt/samba \
  -o username=sambauser,password=pass

# Permanent mount in /etc/fstab
//server/myshare  /mnt/samba  cifs  credentials=/etc/samba/creds  0  0

🕐 NTP & Chrony Time Synchronization

Configure time synchronization using ntpd (RHEL 6) or chrony (RHEL 7+).

NTP vs Chrony

Chrony Configuration (RHEL 7/8/9)

# /etc/chrony.conf
server time1.google.com iburst
server time2.google.com iburst
server 0.rhel.pool.ntp.org iburst

# Restrict to local NTP server
allow 192.168.1.0/24

systemctl restart chronyd
systemctl enable chronyd

# Verify sync
chronyc tracking
chronyc sources -v
timedatectl

timedatectl (RHEL 7+)

timedatectl                          # show status
timedatectl set-time "2025-01-01 12:00:00"
timedatectl set-timezone Asia/Kolkata
timedatectl list-timezones | grep Asia
timedatectl set-ntp true             # enable NTP sync

NTP RHEL 6

yum install ntp -y
# /etc/ntp.conf → add: server pool.ntp.org iburst
service ntpd start
chkconfig ntpd on
ntpq -p             # check peers
ntpstat             # sync status

🌍 DNS Server (BIND)

Configure primary and secondary DNS, forward/reverse zones, unbound caching.

DNS Profile

Primary DNS Server Setup

# Install
yum install bind* caching-nameserver* -y    # RHEL 6/7
dnf install bind bind-utils -y             # RHEL 8/9

# /etc/named.conf — key changes
listen-on port 53 { 127.0.0.1; 192.168.1.11; };
allow-query { localhost; 192.168.1.0/24; };

# /etc/named.rfc1912.zones — add zones
zone "example.com" IN {
    type master;
    file "named.forward";
};
zone "1.168.192.in-addr.arpa" IN {
    type master;
    file "named.reverse";
};

# Forward zone — /var/named/named.forward
$TTL 1D
@  IN SOA  ns1.example.com. admin.example.com. (2024010101 1D 1H 1W 3H)
   IN NS   ns1.example.com.
ns1        IN A   192.168.1.11
server     IN A   192.168.1.11
client     IN A   192.168.1.10
www        IN CNAME  server.example.com.

# Reverse zone — /var/named/named.reverse
$TTL 1D
@ IN SOA ns1.example.com. admin.example.com. (2024010101 1D 1H 1W 3H)
  IN NS  ns1.example.com.
11 IN PTR server.example.com.
10 IN PTR client.example.com.

# Verify config
named-checkconf
named-checkzone example.com /var/named/named.forward

# Start
systemctl restart named
systemctl enable named

# Firewall
firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

# Test
dig server.example.com
dig -x 192.168.1.11
nslookup server.example.com

# RHEL 8/9 — unbound for caching resolver (replaces dnsmasq for many cases)
dnf install unbound -y
systemctl enable --now unbound

# /etc/unbound/unbound.conf
interface: 0.0.0.0
access-control: 192.168.1.0/24 allow

# RHEL 9 — split DNS with systemd-resolved
systemctl enable --now systemd-resolved
resolvectl status

📡 DHCP Server

Dynamic IP assignment with DHCP — DORA process, server and client config.

DHCP DORA Process

1. Discover — Client broadcasts looking for DHCP server
2. Offer — Server offers an IP address
3. Request — Client requests the offered IP
4. Acknowledge — Server confirms the lease

DHCP Profile

DHCP Server Configuration

# Install
yum install dhcp -y         # RHEL 6/7
dnf install dhcp-server -y  # RHEL 8/9

# /etc/dhcp/dhcpd.conf
default-lease-time 3600;
max-lease-time 86400;
authoritative;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.50 192.168.1.150;
    option domain-name "example.com";
    option domain-name-servers 192.168.1.11;
    option routers 192.168.1.1;
    option broadcast-address 192.168.1.255;
}

# Fixed IP for specific host (reservation)
host printer {
    hardware ethernet 00:11:22:33:44:55;
    fixed-address 192.168.1.200;
}

# Start
systemctl start dhcpd
systemctl enable dhcpd

# Firewall
firewall-cmd --permanent --add-service=dhcp
firewall-cmd --reload

🌐 Web Server (Apache httpd)

Apache configuration, virtual hosts, SSL/TLS, CGI, and access control.

Apache Profile

Basic Apache Setup

yum install httpd -y          # RHEL 6/7
dnf install httpd -y          # RHEL 8/9

echo "<h1>Hello</h1>" > /var/www/html/index.html

systemctl start httpd
systemctl enable httpd

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Virtual Host Configuration

# /etc/httpd/conf.d/site1.conf
<VirtualHost 192.168.1.11:80>
    ServerAdmin admin@site1.com
    ServerName site1.example.com
    DocumentRoot /var/www/site1
    ErrorLog /var/log/httpd/site1_error.log
    CustomLog /var/log/httpd/site1_access.log combined
</VirtualHost>

<Directory "/var/www/site1">
    AllowOverride None
    Require all granted
</Directory>

HTTPS / SSL Configuration

yum install mod_ssl -y

# /etc/httpd/conf.d/ssl.conf — key lines
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile    /etc/pki/tls/certs/server.crt
    SSLCertificateKeyFile /etc/pki/tls/private/server.key
    ServerName server.example.com
    DocumentRoot /var/www/html
</VirtualHost>

Password-Protected Directory

htpasswd -c /etc/httpd/conf.d/.htpasswd admin
# (remove -c for additional users)

# In VirtualHost config
<Directory "/var/www/html/private">
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/httpd/conf.d/.htpasswd
    Require valid-user
</Directory>

📧 Mail Server (Postfix)

Configure Postfix MTA, relay, and basic mail routing.

Mail Profile

Basic Postfix Setup

yum install postfix -y    # usually pre-installed

# /etc/postfix/main.cf — key settings
inet_interfaces = all           # listen on all interfaces
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost, $mydomain
mynetworks = 192.168.1.0/24
relayhost =                     # leave empty for local delivery

systemctl start postfix
systemctl enable postfix

firewall-cmd --permanent --add-service=smtp
firewall-cmd --reload

# Test
echo "Test" | mail -s "Subject" user@example.com
mailq              # view mail queue

💿 iSCSI (Remote Storage)

Configure iSCSI target (server) and initiator (client) for block-level SAN storage.

iSCSI Terminology

• Target — the iSCSI server exposing storage (LUN)
• Initiator — the client connecting to the target
• IQN — iSCSI Qualified Name (unique identifier)
• LUN — Logical Unit Number (virtual disk)
• Port: 3260 TCP

iSCSI Target (Server)

# RHEL 6/7
yum install scsi-target-utils -y
# RHEL 8/9
dnf install targetcli -y

targetcli
/backstores/block create name=disk1 dev=/dev/sdb
/iscsi create iqn.2024-01.com.example:storage
/iscsi/iqn.2024-01.com.example:storage/tpg1/luns create /backstores/block/disk1
/iscsi/iqn.2024-01.com.example:storage/tpg1/acls create iqn.2024-01.com.example:client1
saveconfig
exit

systemctl start target
systemctl enable target

firewall-cmd --permanent --add-port=3260/tcp
firewall-cmd --reload

iSCSI Initiator (Client)

yum install iscsi-initiator-utils -y

# /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.2024-01.com.example:client1

# Discover targets
iscsiadm -m discovery -t st -p 192.168.1.10

# Login
iscsiadm -m node -T iqn.2024-01.com.example:storage -p 192.168.1.10 -l

# Verify new disk
fdisk -l
lsblk

🗃️ MySQL / MariaDB

Install, configure, and manage MySQL/MariaDB database server.

MySQL Profile

MariaDB Setup (RHEL 8/9)

dnf install mariadb-server -y
systemctl start mariadb
systemctl enable mariadb

# Secure installation
mysql_secure_installation

# Connect
mysql -u root -p

# Basic SQL
SHOW DATABASES;
CREATE DATABASE mydb;
USE mydb;
CREATE TABLE users (id INT, name VARCHAR(50));
GRANT ALL ON mydb.* TO 'app'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;

# Firewall
firewall-cmd --permanent --add-service=mysql
firewall-cmd --reload

RHEL 8/9 Module Streams

# Available MySQL versions
dnf module list mysql

# Install specific version
dnf module enable mysql:8.0 -y
dnf install mysql-server -y

📋 Log Management

rsyslog, journald, logrotate, and centralized logging.

Key Log Files

rsyslog Configuration

# /etc/rsyslog.conf
# Facility.Severity   Action
*.info;mail.none;authpriv.none  /var/log/messages
authpriv.*                      /var/log/secure
cron.*                          /var/log/cron

# Send logs to remote log server
*.* @@192.168.1.20:514    # TCP (@@)
*.* @192.168.1.20:514     # UDP (@)

journald (RHEL 7/8/9)

journalctl                          # all logs
journalctl -n 50                    # last 50 lines
journalctl -f                       # follow live
journalctl -p err                   # errors only
journalctl -u httpd                 # specific service
journalctl --since "2024-01-01"
journalctl --since yesterday --until now
journalctl -b                       # current boot
journalctl -b -1                    # previous boot

# Make journal persistent
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal

logrotate

# /etc/logrotate.conf  /etc/logrotate.d/
/var/log/messages {
    weekly
    rotate 4
    compress
    missingok
    notifempty
    postrotate
        /bin/kill -HUP $(cat /var/run/syslogd.pid 2>/dev/null) 2>/dev/null || true
    endscript
}

logrotate -f /etc/logrotate.conf   # force rotate now

🔥 Firewall & IPtables

iptables (RHEL 6), firewalld (RHEL 7/8/9), and nftables (RHEL 9).

iptables (RHEL 6)

# Allow service
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

# Block IP
iptables -A INPUT -s 10.0.0.5 -j DROP

# Save and restore
service iptables save
service iptables restart
iptables -L -n -v    # list rules

firewalld (RHEL 7/8/9)

# Status
systemctl start firewalld
systemctl enable firewalld
firewall-cmd --state

# Add service (permanent)
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

# Add port directly
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

# Remove service
firewall-cmd --permanent --remove-service=http
firewall-cmd --reload

# List rules
firewall-cmd --list-all
firewall-cmd --list-services

# Zones
firewall-cmd --get-active-zones
firewall-cmd --zone=public --add-service=https --permanent

Rich Rules (advanced)

# Allow specific IP for SSH
firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="192.168.1.5" service name="ssh" accept'

# Block an IP
firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="10.0.0.5" reject'

firewall-cmd --reload

# RHEL 8+: firewalld uses nftables backend (not iptables)
# nftables is also available directly
nft list ruleset

# iptables-legacy still available for compatibility
iptables-legacy -L

# RHEL 9: prefer firewalld; nftables scripting for advanced use
nft add rule inet filter input tcp dport 80 accept

🔌 Port Numbers Reference

Common service port numbers for quick exam and interview reference.

Quick Reference Table