Advanced Linux System Administration

secure the grub menu and single-user mode by requiring root passwords, setting a grub password, protecting boot options, and updating grub configuration across CentOS 7 and 8.

Demonstrate resetting the root password from rescue mode by booting from a cd, adjusting boot priority, and mounting the root filesystem, while outlining protections for single-user mode and grub.

Protect the bios by setting a supervisor password and a user password, and require a password at boot to prevent unauthorized changes to boot priority.

Keep your system updated with the latest patches, security fixes, and kernel releases; use satellite servers to push updates and lock down cron via cron.allow and cron.deny on critical machines.

Implement Linux security by disabling USB storage through a /etc/modprobe.d/no-usb configuration that prevents USB detection, restricting user access and protecting data from theft.

Demonstrates checking and configuring user password aging with chage, including last change, max days, warning periods, password inactive, and account expiration, plus applying global defaults in /etc/login.defs.

Verify manually created Linux accounts do not have empty passwords by checking the shadow file. Lock any found accounts with passwd -l to secure the system.

Review Linux log locations and file types to secure systems, covering messages, authentication, kernel, cron, boot, yum, MySQL, and package manager logs, plus login records.

Learn how a load balancer cluster uses public and private IPs, a virtual IP for external access, and heartbeat-driven failover between master and slave.

Configure a two-node lvs cluster with a master and a slave, using heartbeat to detect failures, and virtual ips on public and private nics for automatic failover.

Configure the Piranha load-balancing cluster with the Parana tool, learning to set up virtual IPs, real servers, and heartbeat-driven master–slave failover, using open-source Linux components.

Configure routing and virtual service settings, start web services, and verify real servers are active using IP addresses, then test site access and review log messages.

Demonstrates accessing a website on real servers from the internet using a public IP, while a master load balancer distributes requests across web servers in a practice lab.

Learn to configure a master-slave linux cluster, copy the cluster configuration file to the slave, enable routing, install required packages, and verify virtual IP failover to keep services available.

Configure a Linux lab by installing required packages with rpm or yum, creating file systems, provisioning virtual machines, and establishing a bridged network with br0 for virtual machine communication.

Learn to manage virtual machines with virsh: list hosts and VMs, view details, start, reboot, gracefully shut down, or force shutdown, and configure auto stop.

Explore how a Linux-based proxy server routes client requests, performs DNS resolution, enforces access rules, and caches web pages to speed up internet access in a lab environment.

Practice lab session 2 demonstrates configuring a proxy, creating a deny-by-default rule, and allowing a specific client IP (from the 192.168.0.0 range) to access the Internet, with testing via a browser.

Explore the LDAP database structure, from the domain controller and domain name to organizational units and users, and learn to configure multiple files for each DC and OU.

Learn to craft ldap configuration files, including domain controller and organizational unit templates, by editing with your domain name. Explore case sensitivity and the migrate script for setup.

Learn to generate and configure certificates to encrypt LDAP communications, using self-signed and CA-signed options, create private keys, CSRs, and X.509 certificates.

Explore how SELinux context assigns type rules to files, directories, and ports under the target policy, and learn to view httpd_t and other contexts.

During this lab, we install httpd and show how SELinux targeted policy confines the Apache process to its web directory under enforcing and permissive modes, with audit logs capturing outcomes.

Discover nftables' unified netfilter interface, faster packet processing and IPv4/IPv6 handling. The firewall provides dynamic on-the-fly rule updates with network zones, without restart.

Configure a linux firewall server with firewalld in a lab, checking status, default and active zones, and adding or removing ssh access in the public zone.

Learn to make firewall changes in firewalld permanent by using the permanent option, so services like Telnet persist after system or firewalld restarts, while also understanding on-the-fly updates.

Learn to configure masquerade and port forwarding for a private web server behind a firewall, using firewall-cmd and Apache httpd, with a client test.

Master rich rules in firewall to control access, including SSH, by applying specific services or networks with rich-rule syntax. Leverage firewall-cmd for adding, querying, and listing rich rules.

practice configuring rich rules on a firewall to permit ssh only from web server with log prefixes, block ssh from other hosts, and allow telnet to a client server.

Block icmp ping to the firewall by adding a rich rule for icmp and reject, then compare reject versus drop to understand when packets are acknowledged or dropped.

Discover how samba server, an open source suite, enables file and print sharing across Linux and Windows clients using SMB/CIFS, and can act as a domain controller for cross-OS interoperability.

Install and start samba on CentOS 8, enabling smb and nmbd services, verify listening ports 139, 445 (tcp) and 137, 138 (udp), and add samba to the firewall.

Mount a samba share from the server to a Windows client by entering the server IP and credentials, then access the documents share and create a new file.

Configure a public samba share without authentication by mapping to the guest account and enabling guest access. Create a browsable public share with 777 permissions and restart smb.

Demonstrates mapping a Windows network drive to a Samba share by selecting a drive letter and entering the server IP and share name for auto login.

Securely configure a samba share by creating a no-login user, assigning group permissions with ACLs, and updating the samba config to require a password and restrict access.

Create a kickstart config file that contains all installation answers, including language, time, packages, file systems, and partitions. Enable automated, hands-off Linux installations across multiple hosts with reduced manual intervention.

Configure a kickstart server by mounting the installation cd, copying its contents to a local directory, and generating a kickstart file with system-config-kickstart in graphical mode for unattended installation.

Use the graphical mode to configure a kickstart file, selecting language, keyboard, and root password, then set installation source, partitioning, and bootloader options, and save the file.

Learn to configure a kickstart server to boot clients from the network using DHCP and TFTP, transfer bootable and OS files, and prepare a kickstart file and bootloader.