2017年11月6日-----RHCE考试

上午：RHCSA考试

考试的时候，桌面上有一个图标，点开进行重启
(1)密码破解

grub启动菜单选e编辑,找见默认kernel(linux16，在行末添加rd.break,b引导。
mount -o rw,remount /sysroot
chroot  /sysroot

echo 123456 | passwd --stdin root
touch /.autorelabel
exit

exit

(2)破解以后登录，但是是命令行界面，所以临时切换成图形化界面
   systemctl isolate graphical.target

(3)配置ip地址(5个内容)-----------------------------------------------------------------需要验证，重启虚机（第一次）

nmcli connection modify 'System eth0' ipv4.method manual ipv4.addresses '172.25.20.11/24 172.25.20.254' ipv4.dns '172.25.254.254'
cat /etc/sysconfig/network-scripts/ifcfg-eth0
vim /etc/hostname

  server20.example.com
cat /etc/hostname

reboot

(4)重启后先备份/etc/fstab

cd

cp /etc/fstab .

开始考试：
（一）
1.SElinux

setenforce 1
vim /etc/selinux/config

2.配置yum仓库--------------------------------------------------------------------------需要验证，yum repolist

cd /etc/yum.repos.d/
ls
rm -rf rhel_dvd.repo
ls
vim aaa.repo

        [aaa]
        name=aaa
        baseurl=yum仓库的路径
        enabled=1
        gpgcheck=0
yum clean all 
yum makecache 
yum repolist

（二）开始磁盘上的内容
3.-------------------------------------------------------------------------------------创建完分区，需要验证partprobe   、  ls    。
                                                                                                如果ls不出来，需要重启虚机
14.------------------------------------------------------------------------------------交换空间需要验证swapon -s
18.------------------------------------------------------------------------------------磁盘配置完，需要重启虚机， （第二次）

cd
fdisk -l
fdisk /dev/vdb
partprobe /dev/vdb
ls /dev/vdb
pvcreate /dev/vdb5
vgcreate vg0 /dev/vdb5
lvcreate -L 200M -n vol vg0
mkfs.ext4 /dev/vg0/vol 
blkid /dev/vg0/vol >> /etc/fstab
vim /etc/fstab
mkdir /mnt/vol
mount -a
df -h

lvresize -r -L 380M /dev/vg0/vol

lvdisplay

 
mkswap /dev/vdb6
blkid /dev/vdb6 >> /etc/fstab
vim /etc/fstab 
swapon -a
swapon -s

pvcreate /dev/vdb7
vgcreate -s 16M datastore /dev/vdb7
lvcreate -l 30 -n database datastore
mkfs.xfs /dev/datastore/database 
blkid /dev/datastore/database >> /etc/fstab
vim /etc/fstab 
mkdir /mnt/database
mount -a
df -h
reboot
history

（三）
4.建立组，用户

groupadd sharegrp
useradd -G sharegrp natasha
useradd -G sharegrp harry
useradd -s /sbin/nologin sarah
echo emesgravy | passwd --stdin natasha
echo emesgravy | passwd --stdin harry
echo emesgravy | passwd --stdin sarah

5.复制文件-----------------------------------------------------------------------------需要验证，文件是否复制进入

cd /var/tmp/
ls
cp /etc/fstab .
ll
setfacl -m u:natasha:rw fstab 
setfacl -m u:harry:- fstab

chmod o+r fstab

getfacl fstab

                                                                                                需要验证权限，getfacl fstab
6.计划任务-----------------------------------------------------------------------------需要验证，登上用户，用mail查看

crontab -e -u natasha

    23 14 * * * /bin/echo hiya
crontab -l -u natasha

7.创建一个目录，组权限继承-------------------------------------------------------------需要验证，在这个目录下，创建一个文件查看组的所有者

mkdir /nfsshare
cd /
ll
chgrp sharegrp nfsshare
chmod g=rws,o=- nfsshare
setfacl -m u:sarah:rwx nfsshare
getfacl nfsshare
cd nfsshare/
ll
touch aaa
ll

cd

8.内核---------------------------------------------------------------------------------需要验证，重启虚机 reboot （第三次）

cd

wget http://172.25.254.254/content/rhel7.0/x86_64/errata/Packages/kernel-3.10.0-123.1.2.el7.x86_64.rpm
rpm -ivh kernel-3.10.0-123.1.2.el7.x86_64.rpm 
reboot

9.LDAP认证-----------------------------------------------------------------------------需要验证，su - ldapuser0

10.时钟同步，----------------------服务需要enable--------------------------------------需要验证，双yes，还有图那个
11.自动挂载目录--------------------服务需要enable--------------------------------------需要验证，su - ldapuser0
12.webf服务------------------------服务需要enable--------------------------------------需要验证，登上网站试试
13.创建用户，密码
15.查找文件find
16.查找grep
17归档

下午：RHCE考试

(一)
(1)yum的配置（两个都做）
cd /etc/yum.repos.d
ls
rm -rf rhel_dvd.repo
vim aaa.repo
        [aaa]
        name=aaa
        baseurl=yum仓库的路径
        enabled=1
        gpgcheck=0
yum clean all
yum makecache
yum repolist

(2)一次性开放所有网段（两个都做）
firewall-config
firewall-cmd --list-all

或

firewall-cmd --permanent --list-all
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=172.25.X.0/24  accept'
firewall-cmd --reload

(3)固化主机名（两个都做）
vim /etc/hostname
cat /etc/hostname

(4) 配置 SELinux（两个都做）
SELinux 必须在两个系统server 和 desktop中运行于 Enforcing 模式
setenforce 1
vim /etc/selinux/config

（二）
20.配置iscsi服务器（server端）
fdisk -l
fdisk /dev/vdb
partprobe /dev/vdb
ls /dev/vdb
pvcreate /dev/vdb5
vgcreate vg0 /dev/vdb5
lvcreate -L 3G -n iscsi_vol vg0
yum -y install targetcli
systemctl start target
systemctl enable target
targetcli
  ls
  /backstores/block create serever20.disk1 /dev/vgo/iscsi_vol
  ls
  /iscsi create iqn.--------------:server20
  /iscsi/iqn-------------/tpg1/acls create iqn-----------:desktop20
  ls
  /iscsi/iqn-------------/tpg1/luns create /backstores/block/serever20.disk1 

  /iscsi/iqn-------------/tpg1/portals create 172.25.20.11
  ls
  saveconfig
  exit
netstat -ntlp (3260)

21.配置iscsi客户端，desktop端（desktop端）
yum search iscsi
yum -y install iscsi-initiator-utils.x86_64
vim /etc/iscsi/initiatorname.iscsi
  Init-----=iqn.-------------------:desktop20
iscsiadm -m discovery -t st -p 172.25.20.11
systemctl restart iscsid
systemctl restart iscsi
systemctl enable iscsi iscsid
iscsiadm -m discovery -t st -p 172.25.20.11
iscsiadm -m node -T iqn.2014-09.com.example.domain0:server20 -p 172.25.20.11
iscsiadm -m node -T iqn.2014-09.com.example.domain0:server20 -p 172.25.20.11 -l
fdisk -l
fdisk /dev/sda
partprobe /dev/sda
ls /dev/sda
mkfs.xfs /dev/sda1
cp /etc/fstab .
blkid /dev/sda1 >> /etc/fstab
vim /etc/fstab
  UUID='----------------' /mnt/data xfs defaults,_netdev 0 0
mkdir /mnt/data
mount -a
df -h
reboot
df -h

（三）

 2.配置SSH访问（两个都做）

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=172.26.X.0/24 service name="ssh" reject'
firewall-cmd --reload

或
firewall-config
firewall-cmd --list-all

3.自定义用户环境（两个都做）
vim /etc/bashrc
  alias qstat='-----------------------------'
. /etc/bashrc
qstat

4.端口转发（server端）

firewall-cmd --permanent --add-rich-rule='rule family=ipv4   source address=172.25.X.0/24    forward-port port=5423 protocol=tcp to-port=80'
firewall-cmd --reload

或
firewall-config
firewall-cmd --list-all

5.链路聚合（两个都做）
lab teambridge setup （server端）        lab teamdesk setup （desktop端）
ifconfig
nmcli con show
nmcli connection add type team con-name team0 ifname team0 config '{"runner":{"name":"activebackup"}}'
nmcli con show
nmcli connection modify team0 ipv4.method manual ipv4.addresses "172.16.20.25/24"
nmcli connection add type team-slave con-name team-port1 ifname eno1 master team0
nmcli connection add type team-slave con-name team-port2 ifname eno2 master team0
nmcli connection show
teamdctl team0 state

6.配置ipv6（两个都做）
nmcli con show
nmcli connection modify "System eth0" ipv6.method manual ipv6.addresses "200e:ac18::e0a/64"
nmcli connection down 'System eth0';nmcli connection up 'System eth0'
ip addr show

7.配置本地邮件服务（两个都做）
vim /etc/postfix/main.cf
  98行
  116行
  137行
  164行
  264行
  313行
systemctl restart postfix
systemctl enable postfix

8.smb服务

server端
yum -y install samba samba-client
vim /etc/samba/smb.conf
  89行
  95行
 
  最后
  [common]
  path=/common
  browseable=yes
  read list=andy

mkdir /common
ls -Z
vim /etc/samba/smb.conf
  第42行有

semanage fcontext -a -t samba_share_t '/common(/.*)?'
restorecon -vRF /common
ls -Z
cd
useradd andy
smbpasswd -a andy
pdbedit -L
systemctl restart nmb smb
systemctl enable nmb smb

9.多用户smb认证
desktop端
yum -y install samba-client cifs-utils
smbclient -L //172.25.20.11
  直接回车
smbclient //172.25.20.11/common -U andy%sestiver

server端
vim /etc/samba/smb.conf
  在最后
  [miscellaneous]
  path=/miscellaneous
  browseable=yes
  read list=silene
  write list=akira

mkdir /miscellaneous
cd /
ls -Z
semanage fcontext -a -t samba_share_t '/miscellaneous(/.*)?'
restorecon -vRF /miscellaneous
ls -Z
cd
useradd silene
useradd akira
smbpasswd -a silene
smbpasswd -a akira
pdbedit -L

systemctl restart nmb smb
cd /
chmod o+w /miscellaneous
ll
cd /miscellaneous/
ls
touch a b c
ll
ls -Z

desktop端
smbclient -L //172.25.20.11
  直接回车
cd
ls
cp /etc/fstab .
smbclient //server20/miscellaneous -U silene%sestiver
  ls
  put fstab
  exit
smbclient //server20/miscellaneous -U akira%sestiver
  ls
  put fstab
  exit
cd
vim /etc/fstab
  //172.25.20.11/miscellaneous /mnt/multi cifs defaults,credentials=/root/a.txt,multiuser,sec=ntlmssp 0 0
cd
vim a.txt
  username=silene
  password=sestiver
cat a.txt
cd /mnt
ls
mkdir multi
ls
mount -a
df -h

cd
useradd a
useradd b
su - a
  cd /mnt
  ls
  cifscreds add server20 -u silene
  密码sestiver
  ls
  cd /mnlti
  ls
  cp /etc/issue .
  exit

su - b
  cd /mnt
  ls
  cifscreds add server20 -u akira
  密码sestiver
  ls
  cd /mnlti
  ls
  cp /etc/issue .
  exit

11.nfs服务

server端
lab storageshares setup
su - ldapuser20
  exit

vim /etc/exports
  /public 172.25.20.0/24(ro)
  /protected 172.25.20.0/24(rw,sec=krb5p)

mkdir /public
mkdir -p /protected/confidentia
chown ldapuser20:root /protected/confidential
vim /etc/sysconfig/nfs
  13行 -V 4.2

wget -O /etc/krb5.keytab http://172.25.254.254/pub/keytabs/server20.keytab
ls /etc/krb5.
systemctl start nfs-server
systemctl start nfs-secure-server
systemctl enable nfs-server nfs-secure-server
cd

desktop端
lab storageshares setup
su - ldapuser20
  exit

showmount -e 172.25.20.11
vim /etc/fstab
  172.25.20.11:/public /mnt/nfsmount nfs defaults 0 0
  172.25.20.11:/protected /mnt/nfssecure nfs defaults,v4.2,sec=krb5p 0 0

wget -O /etc/krb5.keytab http://172.25.254.254/pub/keytabs/desktop20.keytab
ls /etc/krb5.
systemctl start nfs-secure
systemctl enable nfs-secure
mkdir nfsmount
mkdir nfssecure
mount -a
df -h
cd

reboot

df -h

13.web服务 （server端）
yum -y install httpd
cd /var/www/html/
ls
wget -O index.html http://172.25.254.254/content/rhce/web/station.html
ls
cd /usr/share/doc/httpd-2.4.6/
ls
cp httpd-vhosts.conf /etc/httpd/conf.d/13.conf
vim /etc/httpd/conf.d/13.conf
   <VirtualHost *;80>
       DocumentRoot "/var/www/html"
       ServerName server20.example.com
   </VirtualHost>
httpd -t
systemctl restart httpd
systemctl enable httpd
netstat -ntlp

yum -y install mod_ssl mod_wsgi
vim /etc/httpd/conf.d/ssl.conf
   59行
   60行
   100行
   107行

cd /etc/pki/tls/certs
ls
wget http://172.25.254.254/pub/tls/certs/server20.crt
cd /etc/pki/tls/private
ls
wget http://172.25.254.254/pub/tls/private/server20.key
ls
cd
httpd -t
systemctl restart httpd

cd /etc/httpd/conf.d/
ls
cp 13.conf 15.conf
vim 15.conf
   <VirtualHost *;80>
       DocumentRoot "/var/www/virtual"
       ServerName www20.example.com
   </VirtualHost>
cd /var/www
ls
mkdir virtual
ls
cd virtual/
ls
wget -O index.html http://172.25.254.254/content/rhce/web/www.html
cat index.html
httpd -t
systemctl restart httpd

setfacl -m u:andy:rwx /var/www/virtual
setfacl -m d:u:andy:rwx /var/www/virtual

vim /etc/httpd/conf/httpd.conf
    可以来这个里复制几行
vim /etc/httpd/conf.d/16.conf
    <Directory /var/www/html/secret>
    Require local
    Require all denied
    </Directory>
    <Directory /var/www/virtual/secret>
    Require local
    Require all denied
    </Directory>

cd /var/www/html/
ls
cd html/
ls
mkdir secret
cd secret/
ls
wget -O index.html http://172.25.254.254/content/rhce/web/secret1.html
ls
cd ..
cd virtual/
ls
mkdir secret
cd secret/
ls
wget -O index.html http://172.25.254.254/content/rhce/web/secret2.html
ls
httpd -t
systemctl restart httpd
cd
firefox

cd /etc/httpd/conf.d/
ls
cp 13.conf 17.conf
vim 17.conf
    Listen 8998
   <VirtualHost *;8998>
       DocumentRoot "/var/www/html"
       ServerName webapp20.example.com
       WSGIScriptAlias / /var/www/html/webapp.wsgi
   </VirtualHost>

cd /var/www/html
ls
wget http://172.25.254.254/content/rhce/web/webapp.wsgi
ls
semanage port -l | grep http
semanage port -a -t http_port_t -p tcp 8998
semanage port -l | grep http
systemctl restart httpd

23.
yum -y install mariadb-server
vim /etc/my.cnf
   skip-networking=1

systemctl restart mariadb
systemctl enable mariadb
mysql
mysql_secure_installation

mysql -uroot -pmishings

   >create database aaa;

   >grant select on aaa.* to wode@localhost identified by 'mishigs';

   >flush privileges;

mysql -uLuigi -pmishigs
wget http://172.25.254.254/pub/materials/mariadb/mariadb.dump
mysql -uroot -pmishings Contacts < mariadb.dump
mysql -uroot -pmishings Contacts
systemctl enable mariadb.service
reboot

全部做完以后，重启server端和desktop端，然后检验：

防火墙server端5条，desktop端3条

检查ipv6

检查链路聚合

检查web