Linux Mastery With Practical Approach & Level Up Your Career

Explore firewall concepts and netfilter basics in linux, configure with firewalld to filter packets, manage external and internal traffic, and apply rules to allow or block access.

Explore nf tables in Red Hat Enterprise Linux 8, its faster packet processing, and how firewall d uses nft for dynamic zones and on-the-fly updates.

Explore firewalld zones such as drop, block, and public, and how they govern traffic. Learn to manage these zones with cockpit and command line interface, including permanent rules for ssh.

Explore how a packet travels from client to destination through a firewall, including DNS, IPs, and ports. Learn to apply firewall rules to allow or deny traffic on private networks.

Perform practical firewall configuration on a linux server using firewalld, check status and zones, and enable or remove ssh access in the public zone to control client connectivity.

In this lab, learn to change the ssh port from 22 to a custom port and configure the firewall to allow the new port, ensuring secure access.

Learn to make firewalld changes permanent in Linux by using on-the-fly updates or the permanent option, and verify persistence after restart with telnet and sntp services.

Set up a web server on a firewall server with httpd, restart httpd, and enable the http service in firewalld to allow client access.

Learn how to implement port forwarding with a firewall to map port 80 requests to a different port like 12345, configure apache to listen on that port, and validate access.

Explore how a private web server sits behind a firewall and remains internet reachable through a public IP using port forwarding and masquerading, with packet flow and address translation explained.

Explore masquerading with port forwarding in a lab setup, forwarding public port 80 through a firewall to a private web server (192.168.209.139) running Apache.

Explore rich rules in firewalld to restrict ssh access using firewall-cmd, including --add-rich-rule and --list-rich-rules, with syntax like service, port, protocol, icmp, and actions (accept, reject, drop).

Conducts a lab on using rich rules to selectively allow ssh from a specific server while blocking others on a firewall, including commands to remove ssh and add rich rules.

Configure rich rules on a firewall to allow ssh from the web server with log prefix, block ssh from clientserver.example.com, and enable telnet or ftp access from that client.

Learn how to use a rich rule to block ICMP ping to a firewall, then compare reject and drop actions and their effects on traffic.

Master Stratis on Linux, including RHEL 8, by managing multiple storage layers with thin provisioning, pools, and the XFX file system, enabling dynamic space allocation from pools.

Install stratis-cli and stratisd via yum, enable the service, create and expand a stratis pool with disks, and provision a filesystem from the pool.

Create and manage Stratis pools and file systems, monitor storage with pool list and df, and mount xfs file systems with UUIDs for persistent fstab entries.

Learn to persistently mount a stratis filesystem by configuring its UUID in /etc/fstab with defaults and systemd requirements, then verify with mount -a and reboot readiness.

Create a Stratis filesystem snapshot to back up a filesystem and enable restoration. Specify the target filesystem and snapshot name, as shown with pool1 and fs1, and verify.

Create a thin-provisioned filesystem with Stratis, expand the pool by adding disks, and mount it to verify dynamic growth. Create a snapshot and access data from it.

Demonstrates a thin-provisioned Linux filesystem growing dynamically as a 1 GB file is created with dd, with a 20 GB pool.

Create a Stratis snapshot of a filesystem in the pool, mount it to access data, and recover files by copying them back to the main filesystem.

Explore vdo, the virtual data optimizer, performing in-line deduplication and compression to save storage on block devices, with zero block elimination and kvdo/uds modules.

Install and verify vdo on the system and enable it. Create a 10 GB vdo volume with thin provisioning and check deduplication and compression.

Format the vdo volume with xfs using mkfs.xfs on /dev/mapper/myfirstvdo, then register the device, mount it at /myfirstvdo, and configure fstab with its UUID for persistence via vdo.service.

Demonstrate deduplication in a vdo volume by duplicating a 1 GB file, revealing how duplicates share space and affect space saving from 75% to 50%.

Recap the vdo setup and management by showing how to install, enable, and start vdo, create and control volumes, and monitor statistics with status and vdostats.

Extend a vdo volume with vdo growLogical to 25 gb, though the physical disk is 15 gb; then unmount, remove with vdo remove, and verify with vdo list.

Explore container technology, explain what a container is, and compare with traditional virtual machine setups; learn how containers isolate applications, bundle runtime environments and dependencies for lightweight, scalable deployment.

Plan for containers on Red Hat Enterprise Linux by using cgroups, namespaces, SELinux, and seccomp to enforce security and isolation, and manage container images with Podman and Skopeo.

Install podman and container-tools, login to the container registry, and pull Ubuntu and Apache images to run and inspect containers.

Map host port 8080 to container port 80 with podman run, verify mappings with podman port -a, adjust firewall for 8080/tcp, then test 127.0.0.1:8080 and stop the container.

Learn to manage containers with podman by starting, restarting, stopping, and removing containers and images. Use podman ps -a to identify processes and resolve image usage.

Learn what Apache is and how to configure it. Understand its configuration files, virtual hosts, and how HTTP uses ports 80 and 443 with TLS for security.

Set up an Apache web server on Linux and verify installation with rpm -q httpd; install via rpm or yum if needed, review /usr/sbin/httpd and /etc/httpd, including conf.d and modules.

Explore the Apache main configuration file httpd.conf in /etc/httpd/conf, learn directives like serverRoot and pidfile, set server name and documentRoot, review paths /var/www/html and logs/error_log, and note backup.

Configure Apache main settings including error_log, log level, and listen port. Deploy a simple test site in var/html, restart Apache, and access it via browser with SSL on port 443.

Launch a website by installing Apache, setting the server name and document root, starting httpd, and validating access from client machines after adjusting firewall rules.

Configure Apache access control with order deny, allow to restrict site access to a Linux host and deny all others, using directory directives and httpd restart.

learn how apache uses indexes to list directory contents, configure index files like index.html, and control directory indexing with options indexes, using var/www/html and index_allow as examples.

Learn how directory indexes list browser content and how to secure important files by configuring apache with index_deny options to deny access to selected directories and restart services.

Learn how to restrict access to directories with an .htaccess file by enabling basic authentication, configuring AuthType, require valid-user, and managing a password file while noting performance costs.

Set up directory authentication in Apache by creating .htaccess and htpasswd, configuring AuthType Basic and AuthName, pointing AuthUserFile, enabling AllowOverride AuthConfig, and restarting httpd to require valid-user.

Discover how to secure a web server with ssl/tls, verify server authenticity, and encrypt authentication and sessions to protect user data on Apache.

Demonstrates how a client and secure web server negotiate the strongest SSL/TLS on port 443, exchange certificates and public keys, verify trust (CA/OCSP), and establish encrypted sessions.

Create a certificate and key with OpenSSL, then configure the web server to enable encrypted communication on port 443. Test in a browser and note the self-signed certificate warning.

Discover how the DNS translates domain names to IP addresses on port 53, enabling clients and servers to locate each other, while replacing manual etc/hosts updates.

Understand how the domain name system uses an inverted tree, from the root name server to gTLDs and ccTLDs, and how second-level domains like example.com map to IPs.

Understand how dns resolves a website request from internal dns to root servers, then to tld servers and final name servers, with caching.

configure a dns server with bind, install the bind package, edit the main configuration to listen on port 53 and allow queries, and create forward and reverse zone files.

Explore zone configuration in bind, including forward and reverse lookup zones, TTL, and DNS records like SOA, NS, MX, and A, with serial, refresh, retry, and expire settings.

Configure a forward lookup zone with NS and A records, set up reverse lookups with PTR, and verify DNS operations with nslookup, ping, and resolv.conf updates.

Troubleshoot dns issues by validating port 53 udp, firewall rules, and nslookup, then verify SELinux context, semanage, named-check, and MX records for mail servers.

Learn how Ansible simplifies automation across Linux servers, handling configuration management, application deployment, and task automation with playbooks from a control machine.

establish a control node at ansibleser.example.com, install and configure Ansible from EPEL on RHEL 8 and CentOS 8, then prepare inventory and configuration to manage clients from the server.

Continue and set up Ansible by configuring a control node, creating a normal user on all hosts, and enabling passwordless SSH with key-based auth across three clients for seamless management.

Complete the ansible setup: enable passwordless ssh, create an inventory with a dev group for client1–3, and configure sudoers for root tasks.

enable sudo password prompts for privilege escalation in the ansible lab setup, login to multiple clients, and verify root access with ansible commands (for example, vgs) across the dev group.

Explore ansible components, including configuration settings, host inventory with groups, core and custom modules, playbooks in yaml, and connection plugins with docker and other plugins.

Learn to configure a control node and managed hosts for Ansible, ensure SSH access and Python prerequisites, and use playbooks with modules to run tasks across Linux or BSD systems.

Learn how to define Ansible inventories with host groups like prod, dev, and web servers. Manage SSH ports, users, and ranges in the inventory file.

Customize ansible behavior by configuring privilege escalation in the ansible.cfg, enabling a normal user to become a privileged user via sudo with optional password prompts for secure playbook execution.

Run ad hoc commands with Ansible to execute a single task without a playbook. Explore modules, arguments, and inventory usage to manage multiple hosts quickly.

Explore ansible modules across file, package, system, and net tools categories with examples such as copy, get_url, and user; learn to run them via ansible -m and --become.

Show idempotent behavior through repeated user creation and file operations, and manage permissions, ownership, and file copying across two servers using ansible modules and become for root access.

Compare the command and shell modules in Ansible, illustrating when to run remote commands on managed hosts and when shell processing enables redirection, piping, and variables.

Explore ansible command line options like -i for inventory and -u for remote_user, and configure become and privilege escalation in the ansible config to run as root.

Explore how SELinux provides mandatory access control to protect user data and limit daemon access through file contexts and policies. Enable and leverage enforcing mode to prevent avc denials.

Explore SELinux context in Red Hat Enterprise Linux, focusing on type contexts like httpd_t and httpd_sys_content, and how the targeted policy restricts Apache and MariaDB access.

SELinux operates in three modes—enforcing, permissive, and disabled—where enforcing blocks policy violations and logs to the audit log, while permissive only logs and disabled disables everything.

Learn to check and switch SELinux modes with getenforce, setenforce, and sestatus, explore enforcing versus permissive, and understand permanent, temporary, and disable options via the config file.

Install and run httpd, enable SELinux, and explore the httpd_t context under var/www while comparing enforcing and permissive modes via audit logs.

Learn to explicitly allow a directory for the Apache process under SELinux by changing its context with chcon to httpd_sys_context_t recursively, then verify website access while enforcing.

Learn to permanently change file and directory SELinux contexts using semanage and fcontext, update policy files, and verify with restorecon, including how to delete the context when needed.

Learn how SELinux context inheritance works for directories and files, demonstrate when copying changes a file’s context versus moving retaining it, and highlight common pitfalls.

Master SELinux booleans by learning to list, view, enable, and disable them with getsebool, setsebool, and semanage, and apply permanent changes with -P, all demonstrated in a practical lab session.

Learn how to enable apache to publish web content from user home directories by configuring SELinux booleans and adjusting httpd settings, such as public_html and index.html.

Learn to inspect SELinux logs on a Linux server by checking /var/log/messages and audit.log, grep for httpd, and use the sundry SELinux troubleshooter for denied access due to context.

Learn how the samba server enables cross-platform file, folder, and printer sharing between Linux and Windows clients via SMB/CIFS over TCP/IP, and how it can set up a domain controller.

Demonstrates how a Linux Samba server shares resources—dvdrom, pendrive, tape drive, and a folder—to Linux, Windows, Mac, and Novell clients, with mounting, smb.conf, samba service, and ports 137–139.

Install and configure Samba server on CentOS or RHEL 8 to enable file sharing, start smb and nmb, and open ports 139/445 tcp and 137/138 udp in the firewall.

Configure a private samba share by editing the samba config, setting a matching workgroup and host allow, and enabling browseable, authenticated access for a controlled directory.

Mount a samba share on a linux client using cifs, manage users and groups, set directory permissions, and discuss security considerations for safer access.

Mount the samba server share on a Windows client by entering the server IP, authenticating with a username and password, and accessing the documents share to create and view files.

Configure a samba public share by enabling guest access, editing the global config with map to guest = bad user, and testing access without passwords.

Map a windows network drive to a samba share by choosing a drive letter, specifying the server IP and share name, and logging in to mount the remote directory.

Create a samba group and a no-login user, grant read, write, and execute permissions with setfacl, and configure a password-protected share to verify access with smbclient.

Conclude course by reflecting on key learnings in the last lecture, and post questions in the forum or ping me for prompt replies to boost exam readiness and your career.