Lab 27.2: Practice exam B

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Doel

The second practice exam, with other topics in front: NFS and autofs, resizing, SSH, boot settings and a script. Same rules: 2.5 hours, reboot, then check.

Voordat je begint

Fresh VMs or the state after exam A. server1 needs a free 5 GiB disk (here /dev/vdc).
server2 is the NFS server in this exam.

Taken

server2: Export /exports/users (rw) to 192.168.122.0/24. Create the users nfs1 and nfs2 with UIDs 4001 and 4002 and home folders /exports/users/nfs1 and /exports/users/nfs2.
server1: Create the same users with the same UIDs, without local home folders. Their homes /netusers/nfs1 and /netusers/nfs2 must be mounted automatically from server2 when used.
server1: Create a VG vgdata on /dev/vdc with an LV lvdata of 1 GiB, ext4, mounted on /data. Then grow it to 2 GiB while mounted, and shrink it to 1.5 GiB without losing data.
server1: sshd must also listen on port 2222 (next to 22), with SELinux and firewall changes. root may not log in with a password.
server1: Allow SSH (both ports) only from 192.168.122.0/24 with firewall rules; remove the general ssh service.
server1: Remove rhgb quiet from the kernel line of all kernels and set the GRUB timeout to 8 seconds.
server1: Turn on IP forwarding permanently.
server1: The journal must be persistent, max 200 MB.
server1: The service chronyd must always be restarted 10 seconds after it stops (drop-in, not the package file).
server1: Apache must be able to connect to network databases (SELinux, permanent).
server1: Write /usr/local/bin/mkfiles.sh: it takes a number N and a folder, creates the folder if needed and creates the files file1 … fileN in it. Without two arguments it prints a usage line and exits with code 2.
server1: Set the default target to multi-user and disable the cockpit socket.
both: Reboot and check.

Controleer je werk

#su - nfs1 -c 'pwd; touch test'; findmnt /netusers/nfs1
#lvs vgdata; df -h /data
#sshd -T | grep -E '^(port|permitrootlogin)'; semanage port -l | grep ssh_port_t
#firewall-cmd --list-all
$cat /proc/cmdline; grep GRUB_TIMEOUT /etc/default/grub
#sysctl net.ipv4.ip_forward
#journalctl --list-boots
#systemctl cat chronyd | tail -3
#getsebool httpd_can_network_connect_db
#mkfiles.sh 3 /tmp/x; ls /tmp/x; mkfiles.sh; echo $?
#systemctl get-default; systemctl is-enabled cockpit.socket

Hints

Toon de hints

Task 2: useradd -u 4001 -M -d /netusers/nfs1 nfs1 + autofs wildcard.
Task 3: lvextend -r -L 2G, lvreduce -r -L 1.5G (ext4).
Task 4: Port 22 and Port 2222 in a drop-in; PermitRootLogin prohibit-password.
Task 5: rich rules with service name="ssh" and port port="2222".
Task 6: grubby + /etc/default/grub + grub2-mkconfig.
Task 11: [ $# -ne 2 ] && { echo "usage: $0 N DIR" >&2; exit 2; }, for i in $(seq 1 "$1").

Oplossing

Toon de oplossing

NFS server (server2).

#dnf install -y nfs-utils; mkdir -p /exports/users
#useradd -u 4001 -d /exports/users/nfs1 nfs1; useradd -u 4002 -d /exports/users/nfs2 nfs2
#echo "/exports/users 192.168.122.0/24(rw,sync)" > /etc/exports.d/users.exports
#systemctl enable --now nfs-server; exportfs -ra
#firewall-cmd --add-service={nfs,mountd,rpc-bind} --permanent; firewall-cmd --reload

autofs (server1).

#dnf install -y autofs nfs-utils
#useradd -u 4001 -M -d /netusers/nfs1 nfs1; useradd -u 4002 -M -d /netusers/nfs2 nfs2
#echo "/netusers /etc/auto.netusers" > /etc/auto.master.d/netusers.autofs
#echo "* -rw server2:/exports/users/&" > /etc/auto.netusers
#systemctl enable --now autofs

LVM resize.

#pvcreate /dev/vdc; vgcreate vgdata /dev/vdc; lvcreate -n lvdata -L 1G vgdata
#mkfs.ext4 /dev/vgdata/lvdata; mkdir /data
#echo "/dev/vgdata/lvdata /data ext4 defaults 0 0" >> /etc/fstab; systemctl daemon-reload; mount -a
#lvextend -r -L 2G /dev/vgdata/lvdata
#lvreduce -r -L 1.5G /dev/vgdata/lvdata

sshd with two ports.

#printf 'Port 22\nPort 2222\nPermitRootLogin prohibit-password\n' > /etc/ssh/sshd_config.d/10-exam.conf
#semanage port -a -t ssh_port_t -p tcp 2222
#sshd -t && systemctl restart sshd

Firewall.

#firewall-cmd --permanent --remove-service=ssh
#firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.122.0/24" service name="ssh" accept'
#firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.122.0/24" port port="2222" protocol="tcp" accept'
#firewall-cmd --reload

Boot settings.

#grubby --update-kernel=ALL --remove-args="rhgb quiet"
#sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=8/' /etc/default/grub; grub2-mkconfig -o /boot/grub2/grub.cfg

and 8. sysctl and journal.

#echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/90-forward.conf; sysctl --system
#mkdir -p /etc/systemd/journald.conf.d
#printf '[Journal]\nStorage=persistent\nSystemMaxUse=200M\n' > /etc/systemd/journald.conf.d/exam.conf
#systemctl restart systemd-journald

and 10. Drop-in and boolean.

#mkdir -p /etc/systemd/system/chronyd.service.d
#printf '[Service]\nRestart=always\nRestartSec=10\n' > /etc/systemd/system/chronyd.service.d/override.conf
#systemctl daemon-reload; systemctl restart chronyd
#setsebool -P httpd_can_network_connect_db on

The script.

/usr/local/bin/mkfiles.sh

#!/bin/bash
if [ $# -ne 2 ]; then
    echo "usage: $0 N DIR" >&2
    exit 2
fi
mkdir -p "$2"
for i in $(seq 1 "$1"); do
    touch "$2/file$i"
done

#chmod +x /usr/local/bin/mkfiles.sh

Target and cockpit.

#systemctl set-default multi-user.target; systemctl disable --now cockpit.socket

Reboot both and run the checks.
```
#systemctl reboot
```

Mijn notities

Nog geen notities.

Practice exam B