Public time servers that can be used as time sources by anyone.
== the server that provides time to the enterprise NTP clients usually connects to an internet time server
An NTP node that receives time from an NTP server When it loses its connection to the NTP server, it requests time from the other available NTP peer(s).
(do a blog search for “service_insertion”)
The default host-based firewall in RHEL allows all outgoing connections and blocks all incoming ones, except those explicitely permitted.
The firewall daemon is called firewalld. To interact with it, use the firewall-cmd tool. The firewalld daemon translates the instructions of firewall-cmd into policies that use the syntax of the kernel’s netfilter and nftables.
A rule dictates that a service is allowed to be accessed by an inbound connection. A firewalld service is added with firewall-cmd --add-service or removed with firewall-cmd --remove-service.
Name resolution in Linux is a pipeline of verification jobs, not a single file: a process consults the Name Service Switch, which has a configuration file at /etc/nsswitchconf. This file contains a list of entries. Each entry describes a database and the list of sources to refer to in the order of their appearance in the entry.
An entry is written in this format: DatabaseName NameService1 [Status=Action] NameService2
SELinux is an implementation of the Mandatory Access Control security model in the Linux kernel. It bears more weight than the Discretionary Access Control security model, implemented as the Unix-based file permissions (ugo, rwx); To illustrate the power of SELinux, a Linux user, even the root account, gets denied access to his own files if the result of the SELinux authorization chain is a deny.
SELinux assigns a context (aka label) to every Linux user, process, file, directory, port, socket, hardware device, etc. These are considered as either subjects (Linux users and processes) or objects (files, directories, ports, …).
#TBC
Target is to build two RHEL VMs on in Virtualbox on a Windows machine.
Virtualbox must always be executed as administrator.
The installation of the extension pack might fail many times. What worked for me is patience and repetition, until I saw the green tick in the menu.
Shared clipboard and shared folder features will not work even if you activate them from the Virtualbox menu. What helped is to mount the VboxGuestAdditions.iso file from the GUI, check it in the shell terminal with lsblk, register the VM to Red Hat CDN with sudo subscription-manager register and provide my registration account details, reboot the machine, issue a dnf repolist to refresh the DNF repos, install the kernel headers with dnf install kernel-devel-$(uname -r) and reboot the VM again.
NFS is one of the network filesystems available on Linux. An NFS server has the NFS service installed and enabled. It hosts the mounted filesystem that shall be made available to remote systems. This action is called export and involves these files:
exportnfs -a is run. The exportnfs -a command reads the entries of /etc/exports to do its job. I am simplifying these steps with the expression create an NFS share.Here is my lab topology: rhel10-vm1 (192.168.122.216): NFS server <—> rhel10-vm2 (192.168.122.6): NFS client.
A filesystem (aka filesystem) is the software structure (the formatting) that is located on a storage device or in memory, and dictates how data is organized there.
When a filesystem is located on a storage device, like a disk or DVDROM, then it is called a physical filesystem. When it is located in memory, like for example when the Linux kernel loads the proc filesystem in RAM, then it is called a virtual filesystem.
Packet capture in real time on an interface is performed with the monitor command:
lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
<[Enter]> Execute this command
absolute-sequence Display absolute TCP sequence numbers
brief Display brief output
count Number of packets to receive (0..1000000 packets)
detail Display detailed output
extensive Display extensive output
layer2-headers Display link-level header on each dump line
matching Expression for headers of receive packets to match
no-domain-names Don't display domain portion of hostnames
no-promiscuous Don't put interface into promiscuous mode
no-resolve Don't attempt to print addresses symbolically
no-timestamp Don't print timestamp on each dump line
print-ascii Display packets in ASCII when displaying in hexadecimal format
print-hex Display packets in hexadecimal format
read-file Read packets from a given file
resolve-timeout Period of time to wait for each name resolution (seconds)
size Amount of each packet to receive (bytes)
write-file Write packets to specified file
| Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes
^C
297 packets received by filter
0 packets dropped by kernel
lab@vSRX>
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /
lab@vSRX>
Then I open the freeBSD CLI and open the pcap file using tcpdump:
When referring to storage capacities, there are two units of measurements:
Commands that use units of 1024 bytes: fdisk, lsblk, sfdisk, etc.
user1@rhel10-vm2:~$ ls /usr/lib/tuned/profiles
accelerator-performance balanced desktop intel-sst network-latency optimize-serial-console throughput-performance virtual-host
aws balanced-battery hpc-compute latency-performance network-throughput powersave virtual-guest
user1@rhel10-vm2:~$
Verify that the tuned service is installed with DNF:
user1@rhel10-vm2:~$ dnf list --installed | grep tuned
tuned.noarch 2.25.1-2.el10_0 @rhel-10-for-x86_64-baseos-rpms
Verify the status of the service with systemctl:
user1@rhel10-vm2:~$ systemctl status tuned
● tuned.service - Dynamic System Tuning Daemon
Loaded: loaded (/usr/lib/systemd/system/tuned.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-08-21 19:29:51 CEST; 1h 15min ago
Invocation: fa8cec68b5b449ee9d4f13e2ef0a4618
Docs: man:tuned(8)
man:tuned.conf(5)
man:tuned-adm(8)
Main PID: 936 (tuned)
Tasks: 4 (limit: 10680)
Memory: 17.7M (peak: 19.7M)
CPU: 952ms
CGroup: /system.slice/tuned.service
└─936 /usr/bin/python3 -Es /usr/sbin/tuned -l -P
Warning: some journal files were not opened due to insufficient permissions.
user1@rhel10-vm2:~$
Display the list of available tuning profiles: