Advanced Linux System Administration

Strengthen Linux system security by understanding physical security and preventing unauthorized access to servers, storage media, boot processes, and data center access.

Show how physical access enables resetting the root password via single user mode and remounting the filesystem, then outline securing grub with a password.

secure the grub menu and single-user mode by requiring root passwords, setting a grub password, protecting boot options, and updating grub configuration across CentOS 7 and 8.

Demonstrate resetting the root password from rescue mode by booting from a cd, adjusting boot priority, and mounting the root filesystem, while outlining protections for single-user mode and grub.

Protect the bios by setting a supervisor password and a user password, and require a password at boot to prevent unauthorized changes to boot priority.

secure linux by removing unnecessary services, disable unused ones at boot, and use encrypted protocols like openssh and sftp; minimize software with rpm management to reduce vulnerabilities.

Keep your system updated with the latest patches, security fixes, and kernel releases; use satellite servers to push updates and lock down cron via cron.allow and cron.deny on critical machines.

Disable IP version six on Linux servers when unused to harden the system, by editing the /etc/sysconfig/network file to disable IP version six, reducing attack surface.

Implement Linux security by disabling USB storage through a /etc/modprobe.d/no-usb configuration that prevents USB detection, restricting user access and protecting data from theft.

Configure pam_unix in the system-auth file to remember the last five passwords. This prevents reuse and shows an error when a previous password is reused.

Demonstrates checking and configuring user password aging with chage, including last change, max days, warning periods, password inactive, and account expiration, plus applying global defaults in /etc/login.defs.

Verify manually created Linux accounts do not have empty passwords by checking the shadow file. Lock any found accounts with passwd -l to secure the system.

Learn to verify that only the root account uses user ID zero by inspecting /etc/passwd and removing non-root accounts with user ID zero.

Review Linux log locations and file types to secure systems, covering messages, authentication, kernel, cron, boot, yum, MySQL, and package manager logs, plus login records.

Keep /boot as read-only to protect kernel and grub files. Configure icmp echo ignore to prevent ping floods, using zfs properties and sysctl settings.

Learn how a load balancer cluster uses public and private IPs, a virtual IP for external access, and heartbeat-driven failover between master and slave.

Configure a two-node lvs cluster with a master and a slave, using heartbeat to detect failures, and virtual ips on public and private nics for automatic failover.

Configure the Piranha load-balancing cluster with the Parana tool, learning to set up virtual IPs, real servers, and heartbeat-driven master–slave failover, using open-source Linux components.

Understand how network address translation (NAT) translates source and destination IPs to hide private networks behind a public IP, and how a master router applies NAT rules.

Configure a master-slave linux cluster with virtual IP failover, map public and private IPs, and install Piranha (or Pacemaker) to run a test web service in this practice lab.

Configure routing and virtual service settings, start web services, and verify real servers are active using IP addresses, then test site access and review log messages.

Demonstrates accessing a website on real servers from the internet using a public IP, while a master load balancer distributes requests across web servers in a practice lab.

Learn to configure a master-slave linux cluster, copy the cluster configuration file to the slave, enable routing, install required packages, and verify virtual IP failover to keep services available.

Understand type 1 and type 2 virtualization, including full virtualization and paravirtualization, and how hypervisors manage hardware resources to run Linux and Windows virtual machines.

Understand the architecture of KVM, QEMU, and Libvirt on Linux, and why a hypervisor is needed to coordinate host and guest communication and resource management.

Configure a Linux lab by installing required packages with rpm or yum, creating file systems, provisioning virtual machines, and establishing a bridged network with br0 for virtual machine communication.

Practice lab session 2 explores virtualization, showing how to view and manage virtual machines, create a new guest vm, allocate memory and storage, and start installation from an iso image.

Learn to manage virtual machines with virsh: list hosts and VMs, view details, start, reboot, gracefully shut down, or force shutdown, and configure auto stop.

Explore how a proxy server shares internet access among multiple clients, enforces access control, and caches web content to speed up browsing and reduce bandwidth.

Explore how a proxy server shares internet access, caches webpages to boost performance, and acts as a firewall with IP/MAC-based access control, domain restrictions, authentication, and blacklists.

Explore how a Linux-based proxy server routes client requests, performs DNS resolution, enforces access rules, and caches web pages to speed up internet access in a lab environment.

Practice lab session 2 demonstrates configuring a proxy, creating a deny-by-default rule, and allowing a specific client IP (from the 192.168.0.0 range) to access the Internet, with testing via a browser.

Practice lab session demonstrates configuring access controls on a Linux system using IP-based and MAC-based firewall rules, including proxy considerations to prevent or allow internet access.

Configure a proxy to block a specific site and redirect requests to another site, using deny rules, access control, and log verification.

Explore the LDAP database structure, from the domain controller and domain name to organizational units and users, and learn to configure multiple files for each DC and OU.

Learn to craft ldap configuration files, including domain controller and organizational unit templates, by editing with your domain name. Explore case sensitivity and the migrate script for setup.

Engage in a hands-on lab to configure a lamp server, set the host name and packages, load main and schema configuration files, and update the database with admin credentials.

Configure LDAP directory services, search the knowledge base, and set up home directory sharing for Linux clients; enable automatic mounting of home directories and validate domain controller authentication.

Learn to generate and configure certificates to encrypt LDAP communications, using self-signed and CA-signed options, create private keys, CSRs, and X.509 certificates.

Set up a secure LDAP connection by creating and configuring SSL certificates and private keys, updating certificate files on the server and client, and validating encrypted communication.

Explore how SELinux context assigns type rules to files, directories, and ports under the target policy, and learn to view httpd_t and other contexts.

During this lab, we install httpd and show how SELinux targeted policy confines the Apache process to its web directory under enforcing and permissive modes, with audit logs capturing outcomes.

Learn how SELinux context labeling affects file inheritance and why copying a file can change its context while moving a file preserves it.

Learn to inspect audit logs and troubleshoot SELinux denials by examining lock files, server logs, and SELinux contexts, using command line and graphical tools to diagnose permission denied issues.

Discover nftables' unified netfilter interface, faster packet processing and IPv4/IPv6 handling. The firewall provides dynamic on-the-fly rule updates with network zones, without restart.

Follow how a client request travels through a private network and firewall, with DNS resolution and packet fields, ports, and firewall rules controlling allowed or dropped traffic.

Configure a linux firewall server with firewalld in a lab, checking status, default and active zones, and adding or removing ssh access in the public zone.

Change the ssh port from 22 to 2222 on the firewall, update the public zone to allow 2222/tcp with firewall-cmd, restart the ssh service, and verify access from the client.

Learn to make firewall changes in firewalld permanent by using the permanent option, so services like Telnet persist after system or firewalld restarts, while also understanding on-the-fly updates.

Configure the firewall server as a web server by installing httpd, creating a simple page, and restarting Apache; enable http service in the public zone and test access from client.

Learn to configure masquerade and port forwarding for a private web server behind a firewall, using firewall-cmd and Apache httpd, with a client test.

Master rich rules in firewall to control access, including SSH, by applying specific services or networks with rich-rule syntax. Leverage firewall-cmd for adding, querying, and listing rich rules.

practice configuring rich rules on a firewall to permit ssh only from web server with log prefixes, block ssh from other hosts, and allow telnet to a client server.

Block icmp ping to the firewall by adding a rich rule for icmp and reject, then compare reject versus drop to understand when packets are acknowledged or dropped.

Discover how samba server, an open source suite, enables file and print sharing across Linux and Windows clients using SMB/CIFS, and can act as a domain controller for cross-OS interoperability.

Explore how a Linux-based samba server shares resources like DVD room, pendrive, tape drive, and a folder with Linux, Windows, Mac, and Novell clients, using smb.conf and mount commands.

Install and start samba on CentOS 8, enabling smb and nmbd services, verify listening ports 139, 445 (tcp) and 137, 138 (udp), and add samba to the firewall.

Mount a samba share from the server to a Windows client by entering the server IP and credentials, then access the documents share and create a new file.

Configure a public samba share without authentication by mapping to the guest account and enabling guest access. Create a browsable public share with 777 permissions and restart smb.

Demonstrates mapping a Windows network drive to a Samba share by selecting a drive letter and entering the server IP and share name for auto login.

Securely configure a samba share by creating a no-login user, assigning group permissions with ACLs, and updating the samba config to require a password and restrict access.

Create a kickstart config file that contains all installation answers, including language, time, packages, file systems, and partitions. Enable automated, hands-off Linux installations across multiple hosts with reduced manual intervention.

Configure a kickstart server by mounting the installation cd, copying its contents to a local directory, and generating a kickstart file with system-config-kickstart in graphical mode for unattended installation.

Use the graphical mode to configure a kickstart file, selecting language, keyboard, and root password, then set installation source, partitioning, and bootloader options, and save the file.

Learn to configure a kickstart file for Linux system installation, including partitioning, network and authentication settings, firewall options, and pre/post installation scripts, with LVM, DNS, and package selection.

Learn to configure a kickstart server to boot clients from the network using DHCP and TFTP, transfer bootable and OS files, and prepare a kickstart file and bootloader.

Configure DHCP for network boot, define an IP range and subnet, and link kickstart to network boot with TFTP.

Configure network boot and unattended linux installation by setting IP and DHCP, preparing boot and OS files, enabling TFTP and kickstart automation, and verifying access in a lab environment.