RHEL / Red Hat

Red Hat-family specifics: rpm, dnf, SELinux and packaging.

45 challenges · 14 easy · 22 medium · 9 pro

• Author a dnf Repo Fileeasy · in-browser
  Write /etc/yum.repos.d/appstream-local.repo defining a single repository. Its INI section id must be [appstream-local]; include a human-readable name= line, a baseurl= pointing at an http:// or https:// URL, enabled=1, and gpgcheck=1. (Authored config, graded structurally — the engine isn't run here.)
• Count a package's fileseasy
  How many files does the 'tree' package install? Write the count to /home/player/n.txt.
• Find a file's owning packageeasy
  Which RPM package owns /usr/bin/curl? Write just the package NAME (no version/arch) to /home/player/owner.txt.
• Installed package counteasy
  Write the number of installed RPMs to /home/player/n.txt.
• Kernel releaseeasy
  Write the running kernel release to /home/player/k.txt.
• Legacy Network Sysconfigeasy · in-browser
  Write /etc/sysconfig/network enabling networking and setting a fully-qualified static hostname: a NETWORKING=yes line and a HOSTNAME= line whose value is a fully-qualified domain name (it must contain at least one dot, e.g. web01.example.com). (Authored config, graded structurally — the engine isn't run here.)
• OS IDeasy
  Write the ID value from /etc/os-release to /home/player/id.txt.
• Pin a Repo GPG Keyeasy · in-browser
  Write /etc/yum.repos.d/vendor.repo with a [vendor] section that enforces signature verification: set gpgcheck=1 and a gpgkey= line whose value is a file:///etc/pki/rpm-gpg/ URL (the local RPM-GPG public key path, e.g. file:///etc/pki/rpm-gpg/RPM-GPG-KEY-vendor). (Authored config, graded structurally — the engine isn't run here.)
• Query a package versioneasy
  Write the installed Version of the bash package (just the version, no release) to /home/player/v.txt.
• Report SELinux modeeasy
  Write the current SELinux mode (one word) to /home/player/mode.txt.
• Set the SELinux Sysconfigeasy · in-browser
  Write /etc/selinux/config so SELinux boots in enforcing mode with the targeted policy: a SELINUX=enforcing line and a SELINUXTYPE=targeted line. (Authored config, graded structurally — the engine isn't run here.)
• Who owns os-release?easy
  Write the package NAME that owns /etc/os-release to /home/player/pkg.txt.
• bash package Releaseeasy
  Write the Release of the installed bash package to /home/player/r.txt.
• coreutils licenseeasy
  Write the License field of the coreutils package to /home/player/l.txt.
• Author chrony.confmedium · in-browser
  Write /etc/chrony.conf with at least one server line using the iburst option, a driftfile directive pointing at /var/lib/chrony/drift, a makestep directive with a threshold and a limit (e.g. makestep 1.0 3), and an rtcsync line. (Authored config, graded structurally — the engine isn't run here.)
• Count imported GPG keysmedium
  How many RPM GPG public keys are imported? Write the count to /home/player/n.txt.
• Fix a SELinux file typemedium
  The script /opt/tool.sh has the wrong SELinux type so it can't be treated as a system binary. Relabel it to the type bin_t.
• Lock Package Versionsmedium · in-browser
  Write /etc/dnf/plugins/versionlock.list pinning two packages, each on its own line in the plugin's fully-qualified NAME-EPOCH:VERSION-RELEASE.ARCH form (the EPOCH and its colon are required): a kernel entry (e.g. kernel-0:5.14.0-362.el9.x86_64) and an nginx entry locked to version 1.20.1 (e.g. nginx-1:1.20.1-14.el9.x86_64). (Authored config, graded structurally — the engine isn't run here.)
• Module Hotfix Repomedium · in-browser
  Write /etc/yum.repos.d/mycorp-hotfix.repo with a [mycorp-hotfix] section whose baseurl uses the $releasever and $basearch dnf variables, sets module_hotfixes=1 so non-modular RPMs can override modular streams, and sets priority=10. (Authored config, graded structurally — the engine isn't run here.)
• OS VERSION_IDmedium
  Write VERSION_ID from /etc/os-release to /home/player/v.txt.
• Package owning /etc/passwdmedium
  Write the package NAME that owns /etc/passwd to /home/player/p.txt.
• Query installed sizemedium
  Write the installed SIZE (bytes) of the bash package to /home/player/size.txt.
• Query package archmedium
  Write the architecture of the installed bash package to /home/player/arch.txt.
• Query package vendormedium
  Write the Vendor of the installed coreutils package to /home/player/vendor.txt.
• Raise the File-Descriptor Limitmedium · in-browser
  Write /etc/security/limits.d/99-nofile.conf raising the open-file-descriptor limit for all users to 65535: one soft nofile line and one hard nofile line, each using the * domain, both set to 65535. Columns are whitespace-separated: domain type item value. (Authored config, graded structurally — the engine isn't run here.)
• Relabel to etc_tmedium
  The file /opt/app.conf has the wrong SELinux type. Relabel it to etc_t.
• SELinux policy namemedium
  Write the loaded SELinux policy name (from sestatus) to /home/player/p.txt.
• Select an alternativemedium
  Two providers are registered for the 'demo' alternative. Make /usr/local/bin/demo resolve to /opt/demoA.
• Service Restart Overridemedium · in-browser
  Write /etc/systemd/system/httpd.service.d/override.conf as a drop-in that makes httpd always restart on failure and raises its FD limit: a [Service] section containing Restart=always, a numeric RestartSec= delay, and a numeric LimitNOFILE=. (Authored config, graded structurally — the engine isn't run here.)
• Static ifcfg Profilemedium · in-browser
  Write /etc/sysconfig/network-scripts/ifcfg-eth0 for a statically-addressed interface: DEVICE=eth0, BOOTPROTO=none (or static), ONBOOT=yes, IPADDR=10.0.0.50, PREFIX=24, and GATEWAY=10.0.0.1. (Authored config, graded structurally — the engine isn't run here.)
• Tune the dnf Main Configmedium · in-browser
  Write /etc/dnf/dnf.conf with a [main] section that keeps only the 3 most recent installonly kernels (installonly_limit=3), enables parallel downloads (max_parallel_downloads=10), and enforces signature checking globally (gpgcheck=1). (Authored config, graded structurally — the engine isn't run here.)
• bash dependency countmedium
  Write how many capabilities bash requires to /home/player/n.txt.
• bash package Groupmedium
  Write the Group field of bash to /home/player/g.txt.
• bash provides countmedium
  Write how many capabilities bash provides to /home/player/n.txt.
• nginx config-file countmedium
  Write how many config files the nginx package marks to /home/player/n.txt.
• tree doc-file countmedium
  Write how many doc files the tree package has to /home/player/n.txt.
• Author a systemd presetpro · in-browser
  Write /etc/systemd/system-preset/90-tmpfs.preset that disables foo.service by default. (Authored config, graded structurally — the engine isn't run here.)
• Kickstart Install Snippetpro · in-browser
  Write /root/ks.cfg as a kickstart snippet containing: a lang command with a locale (e.g. lang en_US.UTF-8), a keyboard command, a network command using --bootproto=dhcp, a rootpw --iscrypted command, and a %packages selection block closed with %end. (Authored config, graded structurally — the engine isn't run here.)
• Mode of a packaged filepro
  Write the octal mode rpm records for /usr/bin/sudo to /home/player/m.txt.
• Resilient Repo Optionspro · in-browser
  Write /etc/yum.repos.d/edge.repo with an [edge] section that stays usable when the mirror is down and allows non-modular package overrides: enabled=1, gpgcheck=1, skip_if_unavailable=True (or 1), and module_hotfixes=1. (Authored config, graded structurally — the engine isn't run here.)
• Restore an rpm-tracked filepro
  Someone changed the permissions of a packaged binary. Restore them so `rpm -Vf /usr/bin/sha256sum` reports no mode discrepancy.
• Restore rpm file ownershippro
  An attacker changed the owner of a packaged binary. Restore it so `rpm -Vf /usr/bin/sha256sum` shows no user/group discrepancy.
• Sysctl Drop-in for Routingpro · in-browser
  Write /etc/sysctl.d/90-router.conf to turn the host into an IPv4 router with anti-spoof filtering: net.ipv4.ip_forward = 1 and net.ipv4.conf.all.rp_filter = 1. (Authored config, graded structurally — the engine isn't run here.)
• Unattended Security Updatespro · in-browser
  Write /etc/dnf/automatic.conf so dnf-automatic applies only security updates: a [commands] section with upgrade_type=security, download_updates=yes, and apply_updates=yes, plus an [emitters] section with emit_via=email. (Authored config, graded structurally — the engine isn't run here.)
• bash source RPMpro
  Write the SOURCERPM of bash to /home/player/s.txt.