Containers → Podman

• Podman → manage pods and container images
• Buildah → building/pushing/signing container images
• Skopeo → copy/inspect/delete/signing
• Runc → run & build feature to Podman and Buildah
• Crun → optional runtime for rootless containers

Podman Terms

• Images → containers can be created through images

  • converted to images
• Pods → group of containers deployed on the host

Commands

• dnf install podman

• alias docker=podman

  • create alias to use Podman instead of Docker
• podman info → check Podman registry

• podman search httpd

  • search specific repository
  • check stars for the best

Podman & Docker Commands

• podman images → check previously installed images
• podman pull docker.io/library/httpd → download and install image
• podman ps → list running containers
• podman run -dt -p 8080:80/tcp docker.io/library/httpd → run a downloaded podman container
• podman logs -l → check the logs
• podman stop <container_name|id> → stop container
• To run multiple containers, change port: 8081 and 8082
• podman stop/start <container_name|id> → stop/start container
• podman create --name httpd2 docker.io/library/httpd → create new container from downloaded image

Podman Container at Startup

• Generate a unit file:

  podman generate systemd --new --files --name httpd
  cp container-httpd.service /etc/systemd/system/
  systemctl enable container-httpd.service
  systemctl start container-httpd.service

Docker

• Install from: docs.docker.com
• systemctl start docker
• systemctl enable docker
• docker run hello-world → test if Docker is working

Tweaks with Tuned / Podman

Tweaks with Tuned

• systemctl enable tuned

• tuned-adm active

  • check which profile is active

• tuned-adm list

  • list all profiles

• tuned-adm profile profile-name

  • change profile

• tuned-adm recommend

  • recommendation

• tuned-adm off

  • turned off setting daemon
• Web admin → https://myip:9090

Tweaks with Nice and Renice

• top

  • PR priority level
  • NI nice user setting

• ps axo pid,comm,nice,cls --sort=nice

  • check nice with ps

• nice -n # processname (# -20 → +20)

  • set priority

• renice -n # pid

  • change process priority

Enable firewall

• firewall-config → GUI for options

  • add ports
• firewall-cmd → CLI
• cat /etc/sysconfig/iptables-config
• cat /etc/firewalld/firewalld.conf

Firewall config

• iptables = old, firewalld = new (use in all Linux distros)
• Check iptables rules → iptables -L
• Flush rules → iptables -F

Iptables packet filtering

• Tables (process packets) → filter

  • attached to chains (inspect traffic)

  • INPUT → incoming traffic

  • FORWARD → going to router from another device

  • OUTPUT → outgoing traffic

• Target (what happens when a rule is met)

  • ACCEPT
  • REJECT → send reject response
  • DROP → drop without response

Firewalld

• firewall-cmd --list-all

  • check the rule

• firewall-cmd --get-services

  • list service firewall is aware of

• firewall-cmd --reload

  • reload for new rules

• firewall-cmd --get-zones

  • get a list of all zones
  • public zone is used most of the time

• firewall-cmd --get-actives-zones

  • get active zones

• firewall-cmd --zone=public --list-all

  • get firewall rule for public zone

Add extra service:

• cp /usr/lib/firewalld/services/allservices.xml

  • change service and port number
• sap.xml → firewall-cmd --add-service=sap

• firewall-cmd --add-service=http

  • add a service (http)
  • --permanent

• firewall-cmd --remove-service=http

  • remove a service (http)
  • --permanent

• firewall-cmd --reload

  • reload configuration

• firewall-cmd --add-port=1110/tcp

  • add a port
  • --permanent

• firewall-cmd --remove-port=1110/tcp

  • remove a port
  • --permanent

• firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.8.1" drop'

  • block certain IP address

• firewall-cmd --add-icmp-block=ipv6-redirect

  • block ping

• firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 8.9.10.11 -j DROP

  • block website (host → www.website.com)

Check on listening port

• netstat -tunlp → check open/listening port

Securing SSH config

• more /etc/ssh/sshd_config

  • change port 22
  • PermitRootLogin no

Enable SELinux (SE → Security Enhanced)

• sestatus → check if active
• cat /etc/sysconfig/selinux
• stat myfile → extra context/access
• chcon myfile → change context

OpenLDAP → to manage users from another server

• dnf install openldap* → install everything
• systemctl start slapd
• systemctl enable slapd
• ps -ef | grep slapd → check if running
• cat /etc/openldap/slapd.d/ldap.conf

• cat /etc/nsswitch.conf

  • replace passwd: files sss → ldap

Traceroute → trace network traffic

• traceroute www.mywebsite.com

Secure SSH

Set idle timeout

• nano /etc/ssh/sshd_config

  • ClientAliveInterval 600
  • ClientAliveCountMax 0

Disable root login

• PermitRootLogin no
• PermitEmptyPassword no
• AllowUsers user1 user2
• Port change: 22 → 22224 (not usable port)

Access remote server with SSH keys

• For automation through script

• ssh-keygen

  • leave default folder
  • no passphrase
  • key created

• ssh-copy-id root@192.168.0.53

  • give password of 192.168.0.53

• ssh root@192.168.0.53

  • no password needed!

Apache Web Server

• dnf install httpd
• nano /etc/httpd/conf/httpd.conf
• nano /var/www/html/index.html
• systemctl restart httpd
• systemctl stop firewalld

NGINX

→ Web proxy → MTM between client backend servers
→ Web server

• dnf install nginx -y
• systemctl start nginx
• systemctl enable nginx
• lsof -i :80 → check port 80
• systemctl stop firewalld
• systemctl disable firewalld

• nano /etc/nginx/nginx.conf

  • server { ... }

• nano /etc/nginx/conf.d/myconf.conf

  • server { ... }
• mkdir -p /var/www/mywebserver/html
• nano index.html
• nginx -t → check is everything ok
• systemctl restart nginx

NGINX Reverse Proxy

On server → setup nginx as before

• 403 error → sestatus (selinux status tool)

  • current mode → enforcing
  • fix: chcon -R -t httpd_sys_content_t /var/html/ → fix permission

On client

• nano /etc/nginx/conf.d/myconf.conf

  server {
  location / {
    proxy_pass http://192.168.0.202; # server ip
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
  }

NTP / Chronyd → Time Synchronisation

• nano /etc/chrony.conf → edit conf
• systemctl start chronyd
• systemctl enable chronyd
• chronyc → interactive cmd

timedatectl → Change date/time

• timedatectl → check status
• timedatectl set-timezone Europe/Berlin
• timedatectl set-time YYYY-MM-DD
• timedatectl set-ntp true → set synchronisation

Mail Server → Postfix & s-nail

• /etc/postfix/main.cf → configuration

• systemctl restart postfix

• dnf install postfix → handle email server

• dnf install s-nail → write & send email

• nano /etc/postfix/main.cf

• mail -s "Mail setup" name@domain.com

  • return
  • body… → Ctrl+D

SSH

• ps -ef | grep sshd → check ssh
• systemctl status sshd

DNS

• PTR record → IP to hostname

• A record → hostname to IP

• CNAME record → hostname to hostname

• /etc/named.conf → conf of DNS

• /var/named/ → file for DNS record

• systemctl restart named

• touch forward.lab reverse.lab

• dig client a in a 192.168.0.240

• systemctl start named

• systemctl enable named

Configuring permission

• chgrp named -R /var/named
• chown -v root:named /etc/named.conf
• restorecon -rv /var/named
• restorecon /etc/named.conf

Test DNS conf

• named-checkconf /etc/named.conf
• named-checkzone lab.local /var/named/forward.lab
• named-checkzone reverse.lab /var/named/reverse.lab

Add DNS info in network file

• nano /etc/sysconfig/network-scripts/ifcfg-enp0s3

• DNS=192.168.0.201

• systemctl restart NetworkManager

• nano /etc/resolv.conf

• nameserver 192.168.0.201

Test DNS server

• dig masterdns.lab.local
• nslookup masterdns.lab.local

Website lookup

• nslookup mywebsite.com

  • get IP of a website

• dig mywebsite.com

  • more info about website

System Updates & Software Install

• dnf (yum) → RedHat → /etc/yum.repos.d

• apt-get → Debian

• rpm → RedHat package management

  • standalone package to install locally
  • hard to install extra dependency

• dnf install mypackage

• rpm -qa | grep mypackage

  • check if package installed

• rpm -ihv /tmp/package.rpm

  • install

• rpm -e packagename

  • remove

• dnf remove package

• dnf update -y

  • update everything (preserves old one)

• dnf upgrade

  • delete and replace with new

Advanced Package Management

• rpm -qa | grep mypackage

  • mypackage-1.0.6

• rpm -qc mypackage-1.0.6

  • configuration files

• which mypackage

  • /usr/bin/mypackage

• rpm -qf /usr/bin/mypackage

  • mypackage-1.0.6

Rollback Update & Patch

• dnf history undo mypackageid
• dnf update → keep the old package
• dnf history → get id

FTP

Install FTP server

• yum install vsftp

• nano /etc/vsftpd/vsftpd.conf

  • anonymous_enable=NO

• Uncomment:

  • ascii_upload_enable
  • ascii_download_enable
  • ftpd_banner

• Add: use_localtime=YES ⚠ bug

• systemctl start vsftpd

• systemctl enable vsftpd

• systemctl stop firewalld

• systemctl disable firewalld

FTP client

• ftp 192.168.0.201

  • bi → switch to binary mode
  • hash → hash mark printing
  • put myfile → upload file
  • bye → quit

SCP → FTP secure

• Secure copy protocol

• scp myfile username@192.168.0.1:/home/user

  • password
  • done!

RSYNC → Remote synchronization

• Compare & combine

Rsync local machine (file)

tar cvf backup.tar
mkdir /tmp/backups
rsync -zvh backup.tar /tmp/backups

Rsync local dir

rsync -azvh /home/user /tmp/backup

Rsync to a local machine (file)

mkdir /tmp/backups   # on remote
rsync -avz backup.tar user@192.168.0.100:/tmp/backups

Rsync from a local machine

touch serverfile
rsync -avzh user@192.168.0.100:/home/user/serverfile /tmp/

Interface configuration files:

• /etc/nsswitch.conf → where resolve hostname to IP address

• /etc/hosts → add new IP to resolve

• /etc/resolv.conf → resolve hostname

• netstat → what’s happening on the network

• tcpdump -i networkinterface (wifi, wlp2s0)

  • network sniffing

NIC → network interface card

• lo → loopback (local machine)
• virbr0 → virtual bridge

ETHTOOL ENP0S3

• Speed? / Duplex?

• Link detected:

  • YES → network is working
  • NO → not working

NIC BONDING

• Combine 2 NIC (ethernet port)

  • For redundancy
  • High availability
  • Link aggregation → 1G + 1G = 2G

• modprobe bonding

1. Create a bond interface file:

   • nano /etc/sysconfig/network-scripts/ifcfg-bond0

2. Create first NIC file → ifcfg-enp0s3

   • Add MAC, IP, etc.
3. Create second NIC file → ifcfg-enp0s8
4. systemctl restart network

cat /proc/net/bonding/bond0 → show bond interface settings

Network utilities

• nmcli → network manager command line interface
• nmtui → network manager text user interface
• nm-connection-editor → GUI for most of the network manager
• nmtui → team (to create bond)

• nmcli device → listing of interface

• nmcli connection modify enp0s3 ipv4.addresses 192.168.0.180/24

• nmcli connection modify enp0s3 ipv4.gateway 192.168.0.1

• nmcli connection modify enp0s3 ipv4.method manual
  NMCLI

• nmcli connection down enp0s3

• nmcli connection up enp0s3

• ip address show enp0s3

Download File

• wget http://mydomain.com/soft.deb

Find Out Page (Website) is Up

• curl http://website.com/
• curl -O http://web.com/file → download a file
• ping → get IP response
• nslookup → info sur le site

SS

• Check how device talk to the internet

  • Identify problem

Socket

• Enable data transmission

  • TCP, UDP, UNIX

TCP (Transmission Control Protocol)

• Rule: data is sent successfully (HTTP, FTP, SMTP)

UDP (User Datagram Protocol)

• Sending data without checking if it arrives correctly
• Video streaming

UNIX

• Way for programs to talk to each other
• Use a special file for message exchange
• Database / webservers / local system

SS Options

• ss -t → show TCP connection
• ss -u → show UDP connection
• ss -x → show UNIX connection
• ss -l → listening sockets
• ss -n → display addresses in numerical form

First Line of Script

• #!/bin/bash → defines the shell interpreter

Comments

• Use # for commenting

Common Elements

• Commands: echo, cp, etc.
• Statements: if, while, for
• +x → make the script executable
• Use absolute path to run: /home/userdir/myscript.bash

Variable Definition

a=hello
b=mytext

• Usage:

echo "text1 $a"
echo "text2 $b"

• Example:

a=$(hostname)
echo $a  # => myfirstlinux

Input / Output Variable

read myinputvariable
echo "name $myinputvariable"

If Else Statement

if [[ $count -eq 100 ]]; then
  echo "count is 100"
else
  echo "no"
fi

File Existence Check

if [[ -e /file.txt ]]; then
  echo "file exists"
fi

Check If a Variable Matches a Value

a=$(date | awk '{print $1}')
if [[ "$a" == "Mon" ]]; then
  echo "Today is $a"
else
  echo "Today is not Monday"
fi

Check Multiple Values

if [[ "$a" == "Monday" ]] || [[ "$a" == "Tuesday" ]]; then
  echo "It's early week"
fi

File Operation Tests

• -s → file exists and is not empty
• -f → file exists and is a regular file
• -d → directory exists
• -x → file is executable
• -w → file is writable
• -r → file is readable

Comparison Operators

• -eq → equal (numeric)
• = → equal (string)
• -ne → not equal (numeric)
• != → not equal (string)
• -lt → less than
• -le → less than or equal
• -gt → greater than
• -ge → greater than or equal
• $((...)) → arithmetic evaluation

For Loop Examples

for i in 1 2 3 4 5; do
  echo "Welcome $i times"
done

for i in eat run jump play; do
  echo "User $i"
done

for i in {1..5}; do
  touch $i
  echo "File $i created"
done

Indexed For Loop Example

i=1
for day in Mon Tue Wed Thu Fri; do
  echo "Weekday $((i++)) : $day"
done

User Listing with For + AWK

i=1
for username in $(awk -F: '{print $1}' /etc/passwd); do
  echo "Username $((i++)) : $username"
done

While Loop

c=1
while [[ $c -le 5 ]]; do
  echo "Welcome $c times"
  ((c++))
done

Case Statement

echo "Choose function"
echo "A"
echo "B"
read choices  # could also use: read -s password for silent input

case $choices in
  A) date;;
  B) ls;;
  *) echo "Invalid choice";;
esac

Ping Check with Conditional

hosts="192.168.0.1"
ping -c1 $hosts &> /dev/null

if [[ $? -eq 0 ]]; then
  echo "$hosts OK"
else
  echo "$hosts NOT OK"
fi

• alias l="ls -al" → define alias
• unalias l → remove alias

Persistent Alias Config

• User-specific: ~/.bashrc

• Global: /etc/bashrc

  • Add: alias l="ls -al" at end of file
  • Save file

Command History

• Location: ~/.bash_history
• View: history
• Recall specific: !4 → run whoami (4th command in history)

Screen (Terminal Multiplexer)

• Multi-terminal sessions in one window
• Alt+a | → split vertical
• Alt+a Shift+s → split horizontal
• Alt+a Tab → switch windows
• Alt+a c → create new session
• screen -r → reconnect to detached session
• screen -r [id] → recover session by ID

TMUX (Terminal Multiplexer)

• Ctrl+b Shift+% → split window horizontally
• Ctrl+b d → detach session
• Ctrl+b Arrow Keys → move between panes
• Ctrl+b Shift+" → split window vertically
• tmux ls → list sessions
• tmux a → resume last session
• tmux new -s name → create named session
• Ctrl+b c → new window
• Ctrl+b n → switch to next window
• tmux attach-session -t 0 → attach session ID 0
• Ctrl+b , → rename window
• tmux kill-session -t 0 → kill session ID 0

TMUX Advanced Commands

• tmux new -s name → new named session
• Ctrl+b c → new window
• Ctrl+b n → switch to next window
• tmux attach-session -t 0 → attach session 0
• Ctrl+b , → rename window
• tmux kill-session -t 0 → kill session 0

• chmod u+s xyz.sh → add SetUID (user-level special permission)
• chmod g+s xyz.sh → add SetGID (group-level special permission)
• chmod u-s xyz.sh → remove SetUID
• chmod g-s xyz.sh → remove SetGID
• find / -perm /6000 -type f → find all executables with SetUID/SetGID

⚠️ SetUID/SetGID works only for C/C++ compiled binaries, not Bash scripts.

Sticky Bit

• Protects files from deletion by non-owners
• Example: ls / → shows sticky bit as t in rwxrwxrwt

• chmod +t file/dir → assign sticky bit

  • Only the creator can delete contents of that folder, even with full permissions

Finding System Information

• cat /etc/redhat-release → Red Hat version
• uname -a → Linux hostname, kernel, architecture
• dmidecode → hardware, BIOS, system info
• arch → x86_64 or i386/32-bit

Common Keyboard Shortcuts

• Ctrl + U → erase command line
• Ctrl + C → stop/kill current command
• Ctrl + Z → suspend command
• Ctrl + D → exit interactive session

Record Terminal Session

• script mylog.log → record shell session

  • Use exit to stop recording

Root Password Recovery

1. Reboot → enter GRUB menu
2. Press i → edit boot params in grub, go to line with ro
3. Add rd.break at end of kernel line (after quiet)
4. Ctrl + X to boot
5. Mount root with chroot /sysroot
6. passwd root → change password
7. touch /.autorelabel → SELinux relabeling on reboot

View Environment Variables

• printenv, echo $PATH, echo $SHELL

Set Environment Variables

• Temporary: export TEST=1, echo $TEST

• Permanent:

  vi ~/.bashrc
  TEST=123
  export TEST

Global → vi /etc/profile or /etc/bashrc

Disk and Memory Info

• df → disk partition info
• df -h → human-readable format
• du → size of file/directory
• free → memory info
• cat /proc/cpuinfo → CPU info
• cat /proc/meminfo → memory info

System Logs & Diagnostics

• dmesg → check kernel logs
• iostat → check disk I/O stats
• ip route | column -t → check routing table
• ss → view open ports/sockets

Log Directory Structure

• Logs in /var/log/

  • boot → startup records
  • chronyd → NTP info
  • cron → cron jobs
  • maillog → mail daemon
  • secure → login/logout tracking
  • messages → general trace logs /hard/soft/proc
  • httpd → web server errors

Log Monitoring

• tail -f filename → follow log file in real time

System Shutdown & Boot Control

• shutdown → graceful shutdown
• init 0-6 → runlevels (0=off, 3=multi-user, 6=reboot)
• reboot → reboot system
• halt → force shutdown immediately

Hostname Management

• cat /etc/hostname → current hostname
• hostnamectl set-hostname myhostname → change hostname

Basic System Info Commands

• uptime → time now, up since, numbers of users, load average
• hostname → ip hostname
• uname -a → current OS and kernel info
• which command → path to a command
• cal → calendar for current month/year
• cal 2025 → full year
• bc → basic calculator

System Monitoring

• systemctl → see system manager
• ps → view current processes
• top → dynamic view of process usage

Systemctl Usage

• systemctl start|stop|status servicename.service → manage service state
• systemctl enable servicename.service → start service at boot
• systemctl restart|reload servicename → restart or reload service
• systemctl list-units --all → list all units

• To add a service:

  • Create a unit file in /etc/systemd/system/servicename.service

Process Management

• Start a process in the background:

  • Ctrl + Z then jobs → suspend and background
  • bg → continue in background
  • fg → bring back to foreground

• Run process detached from terminal:

  • nohup process & → keep running after logout
  • nohup process > /dev/null 2>&1 & → suppress all logs/output

Killing and Prioritizing

• pkill name → kill process by name

• nice → start process with a priority (range -20 to 19)

  • lower = higher priority
  • nice -20 top

Jobs Monitoring

• jobs → list background/foreground job states

• Essential Commands:

  • useradd

  • groupadd

  • userdel

  • groupdel

  • usermod

  • Modify 3 files: /etc/passwd, /etc/group, /etc/shadow (passwd info)

Create User with Custom Options

useradd -G mygroup -s /bin/bash \
  -c "User Description" -m \
  -d "/home/myuser" myuser

Other Useful User Commands

• useradd myuser → create user
• id myuser → check if user exists
• groupadd → create group
• cat /etc/group → check group
• userdel -r myuser → delete user and home directory
• groupdel mygroup → delete group
• usermod -G mygroup myuser → change user's group
• chgrp -R mygroup myuser → change group ownership recursively
• passwd myuser → set or update user's password

Password Aging with chage

• chage → manage password aging

  • -m → minimum days
  • -M → maximum days
  • -d → last password change
  • -I → inactive days
  • -e → expiration date
  • -W → warning days

• Example:

  • chage -m 5 -M 90 -W 10 -I 10 username

Edit Password Policies

• File: /etc/login.defs

  • PASS_MAX_DAYS 9999
  • PASS_MIN_DAYS 0
  • PASS_MIN_LEN 5
  • PASS_WARN_AGE 7

Switch User Privileges

• visudo → edit sudo permissions config (/etc/sudoers)

  • Add user to wheel group for sudo access
• usermod -aG wheel myuser → grant sudo rights

User Info and Monitoring Commands

• who → see logged in users
• last → list last login records
• w → who is logged in with more details
• finger → show user details
• id → show UID, GID and groups
• id myuser → check user info

Send Messages to Users

• wall → broadcast message to all users

  • Type message, then Ctrl + D to send

• write myuser → send message to specific user

  • Type message, then Ctrl + D to send

• Basic Replace Syntax:

  • sed -i 's/KENNY/LENNY/g' filename

  • Substitute all occurrences of "KENNY" with "LENNY"

• Delete Line Containing String:

  • sed -i '/SEINFELD/d' filename

• Delete Empty Lines:

  • sed -i '/^$/d' filename

• Delete First Line:

  • sed '1d' filename

• sed '1,2d' filename → delete the first two lines

• sed 's/\t/ /g' filename → replace tabs with spaces

• sed -n '12,18p' filename → print only lines 12 to 18

• sed '12,18d' filename → delete lines 12 to 18

• sed G filename → insert an empty line after every line

• sed '8!s/seinfeld/S/' filename → replace "seinfeld" with "S" on every line except line 8

Vi Editor Commands

• i → insert mode
• ESC → escape to command mode
• r → replace mode
• x → delete character
• dd → delete line
• yy → copy line
• p → paste
• v → visual mode
• o → open new line below and insert
• O → open new line above and insert
• a → append after cursor
• A → append at end of line
• :q! → quit without saving
• :wq or ZZ → save and quit