Part B: System, software and storage (100 points)

Do these on your own system. They get harder. Check each result, then tick it off.

1. PracticeDone

   B1 · Repositories, packages and Flatpak (14 points, 8 min)

   On node1:

   1. Make sure the installation media at /dev/sr0 is mounted at /mnt/dvd at every boot, read-only.
   2. Configure two repositories in the file /etc/yum.repos.d/exam.repo: exam-baseos for file:///mnt/dvd/BaseOS and exam-appstream for file:///mnt/dvd/AppStream. Both enabled; signature checking is off because the key is not available.
   3. Install the packages tree, lsof and httpd.
   4. Add a system-wide Flatpak remote named lab using the URL given by your lab (practice: https://dl.flathub.org/repo/flathub.flatpakrepo), and install the application org.gnome.Calculator from it for all users.
   Check your result

   • findmnt /mnt/dvd shows iso9660; grep /mnt/dvd /etc/fstab shows an iso9660 line; sudo mount -a prints nothing.
   • dnf repolist lists exam-baseos and exam-appstream; grep gpgcheck /etc/yum.repos.d/exam.repo shows gpgcheck=0 twice.
   • rpm -q tree lsof httpd prints three versions.
   • flatpak remotes shows lab with system; flatpak list shows org.gnome.Calculator.
   Hint

   fstab: /dev/sr0 /mnt/dvd iso9660 ro 0 0. Two [section] blocks in one .repo file. flatpak remote-add --if-not-exists lab URL and flatpak install -y lab APPID as root.

   Solution

   sudo mkdir -p /mnt/dvd
   grep -q /mnt/dvd /etc/fstab || echo '/dev/sr0 /mnt/dvd iso9660 ro 0 0' | sudo tee -a /etc/fstab
   sudo systemctl daemon-reload && sudo mount -a
   sudo tee /etc/yum.repos.d/exam.repo <<'EOT'
   [exam-baseos]
   name=Exam BaseOS
   baseurl=file:///mnt/dvd/BaseOS
   enabled=1
   gpgcheck=0
   
   [exam-appstream]
   name=Exam AppStream
   baseurl=file:///mnt/dvd/AppStream
   enabled=1
   gpgcheck=0
   EOT
   sudo dnf clean all && dnf repolist
   sudo dnf install -y tree lsof httpd
   sudo flatpak remote-add --if-not-exists lab https://dl.flathub.org/repo/flathub.flatpakrepo
   sudo flatpak install -y lab org.gnome.Calculator
   flatpak list

2. PracticeDone

   B2 · Default target, services and the journal (12 points, 6 min)

   On node1:

   1. The system must boot into the text multi-user target by default.
   2. httpd must be running now and start at every boot. The same for the atd service (install the at package if needed).
   3. The system journal must be kept across reboots, and the journal must never use more than 200 MB on disk.
   Check your result

   • systemctl get-default prints multi-user.target.
   • systemctl is-active httpd atd prints active twice; systemctl is-enabled httpd atd prints enabled twice.
   • ls -d /var/log/journal exists; journalctl --list-boots shows more than one boot after the final reboot.
   • grep -r SystemMaxUse /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ shows SystemMaxUse=200M; journalctl --disk-usage runs without error.
   Hint

   systemctl set-default, systemctl enable --now, mkdir /var/log/journal, and a drop-in file in /etc/systemd/journald.conf.d/ with [Journal], Storage=persistent, SystemMaxUse=200M, then restart systemd-journald.

   Solution

   sudo systemctl set-default multi-user.target
   sudo dnf install -y at
   sudo systemctl enable --now httpd atd
   sudo mkdir -p /var/log/journal /etc/systemd/journald.conf.d
   printf '[Journal]\nStorage=persistent\nSystemMaxUse=200M\n' | sudo tee /etc/systemd/journald.conf.d/persist.conf
   sudo systemctl restart systemd-journald
   sudo journalctl --flush
   systemctl get-default; systemctl is-active httpd atd; systemctl is-enabled httpd atd

3. Warm-upDone

   B3 · tuned profile and process priority (10 points, 5 min)

   On node1:

   1. Install and enable tuned, and apply the profile that tuned-adm recommends for this system. It must stay active after a reboot.
   2. Start sleep 7200 in the background as user harry with a nice value of 15. Then, while it is running, change its nice value to 5. Leave it running.
   Check your result

   • systemctl is-enabled tuned is enabled; tuned-adm active prints the same profile as tuned-adm recommend.
   • ps -u harry -o pid,ni,comm | grep sleep shows nice value 5.
   Hint

   tuned-adm profile $(tuned-adm recommend). sudo -u harry nice -n 15 sleep 7200 & then sudo renice -n 5 -p PID (PID from pgrep -u harry sleep).

   Solution

   sudo dnf install -y tuned
   sudo systemctl enable --now tuned
   sudo tuned-adm profile $(tuned-adm recommend)
   tuned-adm active
   sudo -u harry nice -n 15 sleep 7200 &
   sleep 1
   sudo renice -n 5 -p $(pgrep -u harry sleep)
   ps -u harry -o pid,ni,comm

4. PracticeDone

   B4 · Runaway process and boot loader (10 points, 6 min)

   Setup for practice: sudo bash -c 'dd if=/dev/zero of=/dev/null & echo started'.

   On node1:

   1. One process is using nearly 100 % of a CPU. Identify it, write its PID to the file /root/hog.pid, and terminate it.
   2. Add the kernel argument audit=1 to every installed kernel permanently, and set the GRUB menu timeout to 8 seconds. Regenerate the configuration as needed.
   Check your result

   • cat /root/hog.pid shows the PID of the former dd process; ps -p $(cat /root/hog.pid) shows nothing running.
   • sudo grubby --info=ALL | grep args shows audit=1 for every entry.
   • grep ^GRUB_TIMEOUT /etc/default/grub shows GRUB_TIMEOUT=8; grep -m1 'set timeout' /boot/grub2/grub.cfg shows timeout=8 (or the $timeout variable set to 8).
   Hint

   ps -eo pid,%cpu,comm --sort=-%cpu | head -3. Send the default signal first. grubby --update-kernel=ALL --args="audit=1", edit GRUB_TIMEOUT, grub2-mkconfig -o /boot/grub2/grub.cfg.

   Solution

   ps -eo pid,%cpu,comm --sort=-%cpu | head -3
   pid=$(ps -eo pid,%cpu,comm --sort=-%cpu | awk 'NR==2 {print $1}')
   echo "$pid" | sudo tee /root/hog.pid
   sudo kill "$pid"
   sudo grubby --update-kernel=ALL --args="audit=1"
   sudo sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=8/' /etc/default/grub
   sudo grub2-mkconfig -o /boot/grub2/grub.cfg
   sudo grubby --info=ALL | grep args

5. ChallengeDone

   B5 · Reset the root password on node2 (14 points, 8 min)

   The root password of node2 is unknown. Using the console of the virtual machine, set it to Ex200!Lab. After the reboot, root must be able to log in at the console, and SELinux must still be enforcing.

   Check your result

   • Log in on node2's console as root with Ex200!Lab.
   • getenforce on node2 prints Enforcing.
   • ls /.autorelabel on node2 reports that the file does not exist (the relabel has finished).
   • ping -c1 node2.lab.example from node1 answers once node2 is up.
   Hint

   Reboot, press e at GRUB, append rd.break to the linux line, Ctrl+x. Then mount -o remount,rw /sysroot, chroot /sysroot, passwd, touch /.autorelabel, exit, exit.

   Solution

   1. Reboot node2. At the GRUB menu press e on the first entry.
   2. On the line beginning with "linux" press End and add:  rd.break
   3. Ctrl+x to boot.
   4. switch_root:/# mount -o remount,rw /sysroot
   5. switch_root:/# chroot /sysroot
   6. sh-5.2# echo 'root:Ex200!Lab' | chpasswd      (or: passwd root)
   7. sh-5.2# touch /.autorelabel
   8. sh-5.2# exit
   9. switch_root:/# exit        -> the machine relabels and reboots by itself

6. PracticeDone

   B6 · LVM and XFS (16 points, 8 min)

   On node1, using /dev/vdb:

   1. Create a GPT partition table and one partition of 1 GiB (use the whole disk) with type Linux LVM.
   2. Create a physical volume on it and a volume group vgapp with a physical extent size of 16 MiB.
   3. Create a logical volume lvapp of 20 extents.
   4. Create an XFS file system with the label app on it.
   5. Mount it permanently on /srv/app, using its UUID in /etc/fstab.
   Check your result

   • sudo parted /dev/vdb print shows Partition Table: gpt and one partition.
   • sudo vgs -o vg_name,vg_extent_size shows vgapp 16.00m; sudo lvs -o lv_name,lv_size shows lvapp 320.00m.
   • blkid /dev/vgapp/lvapp shows TYPE="xfs" and LABEL="app".
   • grep /srv/app /etc/fstab begins with UUID= matching blkid -s UUID -o value /dev/vgapp/lvapp; findmnt /srv/app lists it; sudo mount -a is silent.
   Hint

   parted -s /dev/vdb mklabel gpt mkpart lvm 1MiB 100% and set 1 lvm on, pvcreate, vgcreate -s 16M, lvcreate -n lvapp -l 20 vgapp, mkfs.xfs -L app.

   Solution

   sudo parted -s /dev/vdb mklabel gpt mkpart lvm 1MiB 100% set 1 lvm on
   sudo partprobe /dev/vdb
   sudo pvcreate /dev/vdb1
   sudo vgcreate -s 16M vgapp /dev/vdb1
   sudo lvcreate -n lvapp -l 20 vgapp
   sudo mkfs.xfs -L app /dev/vgapp/lvapp
   sudo mkdir -p /srv/app
   uuid=$(sudo blkid -s UUID -o value /dev/vgapp/lvapp)
   echo "UUID=$uuid /srv/app xfs defaults 0 0" | sudo tee -a /etc/fstab
   sudo systemctl daemon-reload && sudo mount -a
   echo data | sudo tee /srv/app/test.txt
   findmnt /srv/app

7. PracticeDone

   B7 · Extend the volume (8 points, 4 min)

   On node1 resize lvapp so that it is approximately 700 MiB, and make the file system use the new space. The file system must stay mounted and /srv/app/test.txt must remain readable.

   Check your result

   • sudo lvs -o lv_name,lv_size vgapp shows lvapp between about 690m and 720m.
   • df -h /srv/app shows a size of about 700 MiB (a little less).
   • cat /srv/app/test.txt prints data; findmnt /srv/app still lists the mount.
   Hint

   lvextend -r -L 700M /dev/vgapp/lvapp gives a final size. With 16 MiB extents the result is 704 MiB (44 extents).

   Solution

   sudo lvextend -r -L 700M /dev/vgapp/lvapp
   sudo lvs -o lv_name,lv_size vgapp
   df -h /srv/app
   cat /srv/app/test.txt

8. PracticeDone

   B8 · Add swap (8 points, 4 min)

   On node1, on the second disk /dev/vdc: create a GPT label and a partition of 512 MiB with type Linux swap. Make it available as swap now and at every boot, referencing it by UUID. The existing swap must stay.

   Check your result

   • swapon --show lists the new partition (/dev/vdc1, 512M) and the previous swap.
   • grep swap /etc/fstab has a UUID= line for it with type swap.
   • free -m | grep Swap total grew by about 512.
   Hint

   parted -s /dev/vdc mklabel gpt mkpart swap linux-swap 1MiB 513MiB, mkswap /dev/vdc1, swapon, blkid for the UUID.

   Solution

   sudo parted -s /dev/vdc mklabel gpt mkpart swap linux-swap 1MiB 513MiB
   sudo partprobe /dev/vdc
   sudo mkswap /dev/vdc1
   sudo swapon /dev/vdc1
   uuid=$(sudo blkid -s UUID -o value /dev/vdc1)
   echo "UUID=$uuid none swap defaults 0 0" | sudo tee -a /etc/fstab
   sudo systemctl daemon-reload
   swapon --show

9. PracticeDone

   B9 · Labelled ext4 and VFAT file systems (8 points, 5 min)

   On node1, in the free space of /dev/vdc without changing the swap partition:

   1. Add a 256 MiB partition with an ext4 file system labelled data, mounted permanently on /srv/data by label.
   2. Add a 200 MiB partition with a VFAT file system labelled EXCH, mounted permanently on /mnt/exchange, where every user can read and write.
   Check your result

   • lsblk -f /dev/vdc shows swap, ext4 data and vfat EXCH; the swap partition is unchanged and still active.
   • grep -E 'LABEL=(data|EXCH)' /etc/fstab shows both lines; sudo mount -a is silent; findmnt /srv/data /mnt/exchange lists both.
   • sudo -u sarah touch /mnt/exchange/x succeeds.
   Hint

   Use parted print free to find where the free space starts, then mkpart after the swap partition (no mklabel!). mkfs.ext4 -L data, mkfs.vfat -n EXCH, options defaults,umask=000 for VFAT.

   Solution

   sudo parted /dev/vdc unit MiB print free
   sudo parted -s /dev/vdc mkpart data ext4 513MiB 769MiB
   sudo parted -s /dev/vdc mkpart exch fat32 769MiB 969MiB
   sudo partprobe /dev/vdc
   sudo dnf install -y dosfstools
   sudo mkfs.ext4 -L data /dev/vdc2
   sudo mkfs.vfat -n EXCH /dev/vdc3
   sudo mkdir -p /srv/data /mnt/exchange
   printf 'LABEL=data /srv/data ext4 defaults 0 0\nLABEL=EXCH /mnt/exchange vfat defaults,umask=000 0 0\n' | sudo tee -a /etc/fstab
   sudo systemctl daemon-reload && sudo mount -a
   findmnt /srv/data /mnt/exchange
   lsblk -f /dev/vdc