معمل 20.1: RH124 review lab — set up a new server from start to end

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

الهدف

A new colleague needs a ready server. Do all tasks on server1 without looking at the summaries. Use only man, --help and /usr/share/doc. Then reboot and check that everything still works.

قبل أن تبدأ

server1 and server2 with RHEL 10 (or CentOS Stream 10 / AlmaLinux 10) on the network 192.168.122.0/24, gateway and DNS 192.168.122.1; server2 has 192.168.122.20.
Work as student (member of wheel) on the console of server1. Use sudo for root tasks.
A repository for software must work (registered system, or the DVD as a local repository).

المهام

Network: give the active profile of server1 the fixed address 192.168.122.10/24, gateway and DNS 192.168.122.1. Set the host name server1.example.com. Make server2 and server2.example.com work by name without DNS.
Users: create the group devops with GID 4000. Create the users mia and leo with devops as extra group, and the user guest with no login shell. All three get the password RedHat-2026.
Passwords: mia and leo must change their password every 60 days and get a warning 5 days before. guest must expire on 2026-12-31.
sudo: members of devops may run systemctl and journalctl as root — nothing else.
Shared folder: make /srv/devops. Members of devops may create and change files there, new files get the group devops, users can not delete files of others, other users have no access at all.
Software and service: install the web server httpd. Put the text server1 works into /var/www/html/index.html. The service must run now and after every reboot. Open the firewall for http permanently.
Process: as leo, start sleep 3000 in the background. As student, find the PID and stop it with SIGTERM.
SSH: as student on server1, make an ed25519 key and log in to student@server2 without a password. On server1, root must not log in over SSH any more.
Report: write the output of ip -br a, ss -tln and systemctl is-enabled httpd into /root/report.txt; errors must go into /root/report.err.
Reboot server1 and check all tasks again.

تحقّق من عملك

$hostnamectl --static
$ip -br -4 a
$getent hosts server2
$id mia ; id leo ; getent passwd guest
$sudo chage -l mia | grep -E 'Maximum|warning'
$sudo chage -l guest | grep 'Account expires'
$sudo -l -U mia
$ls -ld /srv/devops
$curl -s http://localhost/
$systemctl is-active httpd ; systemctl is-enabled httpd
$sudo firewall-cmd --list-services
$ssh student@server2 hostname
$sudo sshd -T | grep -i permitrootlogin
$sudo cat /root/report.txt

ls -ld /srv/devops shows drwxrws--T and the group devops.
curl prints server1 works, httpd is active and enabled, the firewall lists http.
ssh student@server2 hostname prints the name without asking for a password.
sshd -T shows permitrootlogin no.

تلميحات

اعرض التلميحات

nmcli con show shows the profile name; the new address works after nmcli con up.
useradd -s /sbin/nologin makes a user that can not log in. echo 'USER:PASSWORD' | chpasswd sets a password in one line.
For sudo, use full paths: which systemctl journalctl.
3770 = SGID + sticky + rwx for owner and group.
Put your sshd setting into a drop-in file; sshd -t checks the syntax.
{ cmd1; cmd2; } > file 2> file.err sends the output of several commands at once.

الحل

اعرض الحل

Network.

$nmcli con show
$sudo nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 192.168.122.10/24 ipv4.gateway 192.168.122.1 ipv4.dns 192.168.122.1
$sudo nmcli con up enp1s0
$sudo hostnamectl hostname server1.example.com
$echo "192.168.122.20  server2.example.com server2" | sudo tee -a /etc/hosts

Users and group.

$sudo groupadd -g 4000 devops
$sudo useradd -G devops mia
$sudo useradd -G devops leo
$sudo useradd -s /sbin/nologin guest
$for u in mia leo guest; do echo "$u:RedHat-2026" | sudo chpasswd; done

Password rules.

$sudo chage -M 60 -W 5 mia
$sudo chage -M 60 -W 5 leo
$sudo chage -E 2026-12-31 guest

sudo rule (check the syntax before you leave visudo).

$sudo visudo -f /etc/sudoers.d/devops
$sudo cat /etc/sudoers.d/devops
%devops ALL=(root) /usr/bin/systemctl, /usr/bin/journalctl
$sudo visudo -c

Shared folder.

$sudo mkdir /srv/devops
$sudo chgrp devops /srv/devops
$sudo chmod 3770 /srv/devops

Web server.

$sudo dnf install -y httpd
$echo "server1 works" | sudo tee /var/www/html/index.html
$sudo systemctl enable --now httpd
$sudo firewall-cmd --add-service=http --permanent
$sudo firewall-cmd --reload

Find and stop the process (start it as leo in a second terminal: su - leo, then sleep 3000 &).
```
$pgrep -u leo -a sleep
$sudo kill -TERM $(pgrep -u leo sleep)
```

SSH key and root login.

$ssh-keygen -t ed25519
$ssh-copy-id student@server2
$ssh student@server2 hostname
$echo "PermitRootLogin no" | sudo tee /etc/ssh/sshd_config.d/50-noroot.conf
$sudo sshd -t
$sudo systemctl reload sshd

The report.

$sudo bash -c '{ ip -br a; ss -tln; systemctl is-enabled httpd; } > /root/report.txt 2> /root/report.err'

RH124 review lab — set up a new server from start to end

الهدف

قبل أن تبدأ

المهام

تحقّق من عملك

تلميحات

الحل

ملاحظاتي

دروس هذا المعمل

الأوامر في هذا المعمل