RHCE Ex300做题总结

1.配置SELinux

vim /etc/selinux/config

SELINUX =enforcing

setenforce 1

getenforce

2. 配置SSH访问

本题考查firewall-cmd --add-rich-rule配置

可通过man firewalld.richlanguage查看语法规

man firewalld.richlanguage | grep rule.也可以查看example

firewall-cmd --add-rich-rule=' rule family=ipv4 source address=172.25.0.0/16 service name=ssh accept ' --permanent

firewall-cmd --add-rich-rule=' rule family=ipv4 source address=172.24.1.0/24 service name=ssh drop ' --permanent

firewall-cmd --reload

firewall-cmd --list-all

3.自定义用户环境

vim /etc/bashrc

alias psa='/bin/ps -aux'

tail -n1 /etc/bashrc

source /etc/bashrc #source命令的作用：修改了/etc/profile文件，可使其立刻生效，而不用重新登录

4.配置防火墙转发

此题考查仍然为firewall-cmd --add-rich-rule配置

参考man firewalld.richlanguage | grep rule.中的example

firewall-cmd --add-rich-rule ' rule family=ipv4 source address=172.25.0.0/16 forward-port port=5423 to-port=80 protocol=tcp ' --permanent

firewall-cmd --reload

firewall-cmd --list-all

5.配置链路聚合

config参数可通过man teamd.conf，接着/EXAMPLE查看

也可以man teamd.conf | grep active

nmcli connection add con-name team0 type team ifname team0 config '{"runner":"activebackup"}'

nmcli connection add con-name port1 type team-slave ifname eth1 master team0

nmcli connection add con-name port2 type team-slave ifname eth2 master team0

nmcli connection modify team0 ipv4.method manual ipv4.addresses 192.168.0.11/24 connection.autoconnect yes

systemctl restart network #重启网络服务

nmcli device status #查看网卡状态

teamdctl team0 state #查看链路聚合的状态

6.配置IPv6地址

nmcli connection modify 'System eth0' ipv6.method manual ipv6.addresses fddb:fe2a:ab1e::0:64/64 connection.autoconnect yes

systemctl restart network

7.配置本地邮件服务

postconf -e "inet_interfaces=loopback-only"

postconf -e "mynetwork=127.0.0.0/8 [::1]/128"

postconf -e "relayhost=[classroom.example.com]"

postconf -e "myorigin=classroom.example.com"

postconf -e "mydestinaton="

postconf -e "local_transport=error:disable"

systemctl restart postfix

systemctl enable postfix

mail -s 'ldapuser0test' ldapuser0@classroom.example.com

test

EOT

8.在server0上配置SAMBA服务

systemctl enable smb nmb

----------------------------

vim /etc/samba/smb.conf

workgroup=STAFF

[common]

path=/common

hosts allow =172.25.

browseable =yes

valid users =floyd

---------------------

mkdir /common

useradd floyd

setfacl -m u:floyd:rw /common

ll -d /common

getfacl /common

semanage fcontext -a -t samba_share_t '/common(/.*)?'

restorecon -RvF /common

systemctl restart smb nmb

smbpasswd -a floyd

firewall-cmd --add-service=samba --per

-------------------------

客户端：

yum -y install samba*

yum -y install cifs_utils

mount -t cifs -o username=floyd,password=flectrag //server0/common

smbclient -L //server0 -U floyd

9.配置多用户samba挂载

mkdir /devops

semanage fcontext -a -t samba_share_t '/devops(/.*)?'

restorecon -RvF /devops

useradd kenji

useradd chihiro

passwd kenji

passwd chihiro

---------------------

smbpasswd -a kenji

smbpasswd -a chihiro

-----------------------

vim /etc/samba/smb.conf

[devops]

path=/devops

hosts allow =172.25.

browseable = yes

valid users =kenji,chihiro

write list=chihiro

systemctl restart smb nmb

setfacl -m u:kenji:rx /devops

seftacl -m u:chihiro:rwx /devops

getfacl /devops

systemctl restart smb nmb

------------------------------

客户端：

mkdir /mnt/dev

umount /test 释放题目8中得临时挂载点

vim /etc/fstab

//server0/devops /mnt/dev cifs defaults,multiuser,sec=ntlmssp,cred=/pass.txt 0 0

vim /pass.txt

username=kenji

password=redhat

mount -a

mount | grep devops

----------------------------

测试

useradd kenji

useradd chihiro

cifscreds add server0

ll /mnt/dev

touch /mnt/dev/test 测试写入

10.在server0上配置NFS服务

mkdir /public

mkdir /protected

systemctl enable nfs-server nfs-secure-server

---------------------------------------

vim /etc/exports

/public *.example.com(ro)

/protected *.example.com(rw,sec=krb5p)

-------------------------------------------

wget -O /etc/krb5.keytab http://.......

systemctl restart nfs-server nfs-secure-server

----------------------------------------------

mkdir /protected/project

chown ldapuser1 /protected/project

ll -d /protected/project

---------------------------------------------

semanage fcontext -a -t public_content-t '/public(/.*)?'

semanage fcontext -a -t public_content_t '/protected(/.*)?'

restorecon -RvF /public

restorecon -RvF /protected

------------------------------------------------

firewall-cmd --add-service=nfs --permanent

firewall-cmd --add-service=rpc-bind --permanent

firewall-cmd --add-service=mountd --permanent

firewall-cmd --reload

firewall-cmd --list-all

----------------------------------------------------

systemctl restart nfs-server nfs-secure-server

11.在desktop0上挂载server0得NFS共享

mkdir /mnt/nfsmount

mkdir /mnt/nfssecure

systemctl enable nfs-secure

-------------------------------------------

wget -O /etc/krb5.keytab http://.......

systemctl restart nfs-secure

-------------------------------------------------

vim /etc/fstab

server0:/public /mnt/nfsmonut nfs defaults 0 0

server0:/protected /mnt/nfssecure nfs defaults ,sec=krb5p 0 0

--------------------------------------------------

mount -a

mount | grep public

mount | grep protected #检查挂载情况

df -h

----------------------------------------------------

#测试：

ssh ldapuser1@desktop0 # passwd=kerberos

touch /mnt/nfssecure/project/test-file-ldapuser1

ll /mnt/nfssecure/project #通过创建文件，检查用户权限

12.在server0上配置一个web站点http://www0.example.com

yum -y install httpd*

systemctl enable httpd

wget -O /var/www/html/index.html http:... #下载密钥并命名为index.html

systemctl restart httpd

---------------------------------------------

firewall-cmd --add-service=http --permanent

firewall-cmd --add-service=httpd --permanent

firewall-cmd --reload

firewall-cmd --list-all

-------------------------------------------------

打开http://server0.manual页面

vim /etc/httpd/conf.d/www0.conf #也可以cd /etc/httpd/conf.d vim www0.conf

ServerName www0.example.com

DocumentRoot /var/www/html

</VirtualHost>

---------------------------------------------

vim /etc/httpd/conf/httpd.conf

/Directory

复制：

AllowOverride None

Require all granted

</Directory>

---------------------------------------

vim /etc/httpd/conf.d/www0.conf

ServerName www0.example.com

DocumentRoot /var/www/html

</VirtualHost>

Require ip 172.25

</Directory>

---------------------------------------------------

ll -Z /var/www/html/index.html