RHCSA8.0模拟题

环境

账户信息

f0主机的root密码为 Asimov ，f0上其他⽤户的密码均为 redhat

f0里面所有虚拟系统的 root 密码是 redhat ，请勿更改 root 密码。serverb的 root 密码未知，需要进行密码重置，要求请查看面的题目。所有系统上已预装了 SSH 密钥，允许在不输入密码的前提下 通过 SSH 进行 root 访问。请勿对系统上的 root SSH 配置文件进行任何修改。

开启虚拟机

[root@foundation0 ~]# virsh start bastion
[root@foundation0 ~]# virsh start servera
[root@foundation0 ~]# virsh start serverb
# 查看所有虚拟机状态
[root@foundation0 ~]# virsh list --all
# 打开虚拟机列表图形化界面
[root@foundation0 ~]# virt-manager

重置虚拟机

[root@foundation0 ~]# rht-vmctl reset bastion
[root@foundation0 ~]# rht-vmctl reset classroom
[root@foundation0 ~]# rht-vmctl reset servera
[root@foundation0 ~]# rht-vmctl reset serverb
[root@foundation0 ~]# rht-vmctl reset workstation

说明：考试需要通过图形界面对虚拟机进行开机(start)、关机(poweroff)、重启(reboot)和重置(rebuilt)操作，重置虚拟机后，虚拟机所有的配置将会清空

虚拟机servera

1、配置网络地址

虚拟机servera的root密码为redhat，请为此虚拟机配置以下网络参宿：

hostname：servera.lab.exanple.com

IPAddress：172.25.250.10/24

Gateway：172.25.250.254

Domain Name Server：172.25.250.254

# 连接到虚拟机servera
[root@foundation0 ~]# ssh root@servera
# 设置主机名
[root@localhost ~]# hostnamectl set-hostname servera.lab.example.com
[root@localhost ~]# bash
# 配置网络参数
[root@servera ~]# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
TYPE=Ethernet
BOOTPROT0=none
NAME="enp1s0"
DEVICE="enp1s0"
ONBOOT=yes
IPADDR=172.25.250.10
PREFIX=24
GATEWAY=172.25.250.254
DNS1=172.25.250.254
# 重启网卡
[root@servera ~]# systemctl restart NetworkManager
[root@servera ~]# ifdown enp1s0 | ifup enp1s0

2、配置软件仓库

请配置你虚拟机的yum仓库，地址如下

http://content.example.com/rhel8.2/x86_64/dvd/BaseOS

http://content.example.com/rhel8.2/x86_64/dvd/AppStream

# 配置yum仓库
[root@servera ~]# vim /etc/yum.repos.d/rhel_dvd.repo
[BaesOS]
name=BaesOS
baseurl=http://content.example.com/rhel8.2/x86_64/dvd/BaseOS/
enabled=1
gpgcheck=0
[AppStream]
name=AppStream
baseurl=http://content.example.com/rhel8.2/x86_64/dvd/AppStream/
enabled=1
gpgcheck=0
[root@servera ~]# dnf clean all
[root@servera ~]# dnf list all

3、调试SELinux

配置httpd在82端口上提供Web服务，满足以下要求：

1. 在/var/www/html/下添加index.html⽂件

2. 此Web服务器在系统启动时⾃动启动

3. 确保SELinux保护机制运⾏在Enforcing模式

# 准备工作，安装httpd服务，修改监听的端口号为80
[root@servera ~]# yum -y install httpd
[root@servera ~]# systemctl enable --now httpd
[root@servera ~]# echo "hello world" > /var/www/html/index.html
# 修改监听的端口号
[root@servera ~]# vim /etc/httpd/conf/httpd.conf
Listen 82
# 将对应的端口号(82端口)设置为httpd的标准端口
[root@servera ~]# semanage port -a -t http_port_t -p tcp 82
# 调试防火墙
[root@servera ~]# firewall-cmd --add-rich-rule 'rule family=ipv4 source address=172.25.250.0/24 port port=82 protocol=tcp accept' --permanent
# 重新加载防火墙配置
[root@servera ~]# firewall-cmd --reload
# 重启服务
[root@servera ~]# systemctl restart httpd
# 查看端口号82已经监听
[root@servera ~]# ss -anltup

4、创建用户账户

根据下列要求创建用户及组账号：

1. 名为admins的组

2. 用户harry，其附属组为admins

3. 用户natasha，其附属组还属于admins

4. 用户alice，没有可交互的登录Shell，且不属于admins组

5. harry、natasha、alice的密码都应该是redhat

[root@servera ~]# groupadd admins
[root@servera ~]# useradd -G admins harry
[root@servera ~]# useradd -G admins natasha
[root@servera ~]# useradd -s /sbin/nologin alice
[root@servera ~]# echo redhat | passwd --stdin harry
[root@servera ~]# echo redhat | passwd --stdin natasha
[root@servera ~]# echo redhat | passwd --stdin alice

5、配置cron计划任务

配置计划任务，以用户harry的身份每5分钟执行一次命令 echo jlin

[root@servera ~]# which echo
/usr/bin/echo
[root@servera ~]# crontab -u harry -e
*/5 * * * * /usr/bin/echo jlin
[root@servera ~]# crontab -u harry -l
*/5 * * * * /usr/bin/echo jlin

6、创建共享目录

创建具有以下特点的共用目录：

1. /home/tools的所有组是admins
2. 此目录能被admins组的成员读取、写入和访问，除root外其他用户没有这些权限
3. 在此目录下创建的文件，其组的所有权自动设置为admins组

[root@servera ~]# mkdir /home/tools
[root@servera ~]# chgrp admins /home/tools
[root@servera ~]# chmod 2770 /home/tools
[root@servera ~]# ll -d /home/tools
drwxrws---. 2 root admins 6 Jun 17 16:30 /home/tools

7、配置NTP时间客户端

配置你的系统，使其成为classroom.example.com的NTP客户端

[root@servera ~]# vim /etc/chrony.conf
server classroom.example.com iburst
[root@servera ~]# systemctl restart chronyd
[root@servera ~]# chronyc sources
210 Number of sources = 1
MS Name/IP address		Stratum Poll Reach LastRx Last sample
===============================================================================
^* classroom.example.com   8     10    1    245  +8574ns[+21us] +/- 627us

8、配置autofs

准备工作：在serverb主机准备NFS服务端环境，过程如下

[root@serverb ~]# mkdir -p /rhome/ldapuser0
[root@serverb ~]# vim /etc/exports
/rhome/ldapuser0 *(rw)
[root@serverb ~]# systemctl restart nfs-server
[root@serverb ~]# systemctl enable nfs-server
[root@serverb ~]# firewall-cmd --permanent --add-service=rpc-bind
[root@serverb ~]# firewall-cmd --permanent --add-service=nfs
[root@serverb ~]# firewall-cmd --permanent --add-service=mountd
[root@serverb ~]# firewall-cmd --reload

按照以下要求，在servera上配置autofs自动挂载：

1. serverb通过NFS共享目录/rhome到你的系统，此文件系统中包含为用户ldapuser0预配置的家目录
2. 预设用户ldapuser0的家目录应自动挂载到本地的/rhome/ldapuser0目录
3. 预设用户ldapuser0的家目录是serverb.lab.example.com:/rhome/ldapuser0
4. 预设用户ldapuser0的家目录应自动挂载到本地的/rhome/ldapuser0目录
5. 挂载后的家目录必须可读写

[root@servera ~]# showmount -e serverb.lab.example.com
Export list for 172.25.250.11:
/rhome/ldapuser0 *
[root@servera ~]# dnf -y install autofs
[root@servera ~]# systemctl enable autofs
[root@servera ~]# vim /etc/auto.master
/rhome /etc/auto.nfs
[root@servera ~]# vim /etc/auto.nfs
ldapuser0 -rw serverb.lab.example.com:/rhome/ldapuser0
[root@servera ~]# systemctl restart autofs
[root@servera ~]# cd /rhome/
# 触发挂载
[root@servera rhome]# cd ldapuser0

9、配置文件权限

将文件/etc/fstab复制到/var/tmp/，并按要求配置/var/tmp/fstab的权限：

1. 文件/var/tmp/fstab属于root用户
2. 文件/var/tmp/fstab属于root组
3. 任何用户对/var/tmp/fstab都没有可执行权限
4. 用户harry能够读取和写入/var/tmp/fstab文件
5. 用户natasha无法读取或写入/var/tmp/fstab文件
6. 所有其他用户(包括未来创建的用户)能够读取/var/tmp/fstab文件

[root@servera ~]# cp /etc/fstab /var/tmp/
[root@servera ~]# ll /var/tmp/fstab
-rw-r--r--. 1 root root 427 Jun 17 17:06 /var/tmp/fstab
[root@servera ~]# setfacl -m u:harry:rw- /var/tmp/fstab
[root@servera ~]# setfacl -m u:natasha:--- /var/tmp/fstab
[root@servera ~]# getfacl /var/tmp/fstab
getfacl: Removing leading '/' from absolute path names
# file: var/tmp/fstab
# owner: root
# group: root
user::rw
user:harry:rw
user:natasha:---
group::r--
mask::rw
other::r--

10、配置用户账户

创建用户jlin，其用户ID为2020，此用户的密码应当是redhat

[root@servera ~]# useradd -u 2020 jlin
[root@servera ~]# echo redhat | passwd --stdin jlin

11、查找文件

找出/etc/目录下大小超过5MB的文件，并将其复制到/root/findfiles目录下

[root@servera ~]# mkdir /root/findfiles
[root@servera ~]# find /etc -size +5M -exec cp -a {} /root/findfiles/ \;

12、查找字符串

找出文件/etc/man_db.conf中包含字符串sbin的所有行，将其按原始顺序导入到文件/root/out.txt 中，文件/root/out.txt中不得包含空行

[root@servera ~]# grep "sbin" /etc/man_db.conf | grep -v "^$" > /root/out.txt

13、创建归档

创建一个名为/root/backup.tar.bz2的tar归档，其应该包含/usr/local/的内容。此归档文件必须使用 bzip2进行压缩

[root@servera ~]# tar -jcf /root/backup.tar.bz2 /usr/local/
 # 验证
[root@servera ~]# file backup.tar.bz2
backup.tar.bz2: bzip2 compressed data, block size = 900k

虚拟机serverb

14、设置root密码

将serverb的root密码设置为123456

1.重启serverb
2.将光标移动到要启动的内核
3.按e键编译当前条目
4.在linux开头的尾行添加 rd.break
5.按ctrl+x继续启动
6.重启以读写方式挂载 /sysroot
	switch_root:/# mount -o remount,rw /sysroot
7.切换至真正操作系统的根 /sysroot
switch_root:/# chroot /sysroot
8.重置密码
sh-4.4# echo 123456 | passwd --stdin root
9.打标签
sh-4.4# touch /.autorelabel
10.输入两次exit退出重启

15、配置软件仓库

请配置你虚拟机的yum仓库，地址如下

http://content.example.com/rhel8.2/x86_64/dvd/BaseOS

http://content.example.com/rhel8.2/x86_64/dvd/AppStream

# 配置yum仓库
[root@servera ~]# vim /etc/yum.repos.d/rhel_dvd.repo
[BaesOS]
name=BaesOS
baseurl=http://content.example.com/rhel8.2/x86_64/dvd/BaseOS/
enabled=1
gpgcheck=0
[AppStream]
name=AppStream
baseurl=http://content.example.com/rhel8.2/x86_64/dvd/AppStream/
enabled=1
gpgcheck=0
[root@servera ~]# dnf clean all
[root@servera ~]# dnf list all

16、调整逻辑卷大小

1. 预先创建2GiB的分区/dev/vdb1，并用于创建卷组testvg
2. 创建大小为200MiB的逻辑卷/dev/testvg/vo，格式化为xfs文件系统，并挂载在/mnt/vo上
3. 将逻辑卷/dev/testvg/vo及其文件系统大小调整到300MiB，确保文件系统内容保持不变

# 准备工作
[root@serverb ~]# fdisk /dev/vdb
Welcome to fdisk (util-linux 2.32.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.
Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0xae75bf0a.

Command (m for help): n
Partition type
p primary (0 primary, 0 extended, 4 free)
e extended (container for logical partitions)
Select (default p):
Using default response p.
Partition number (1-4, default 1):
First sector (2048-10485759, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-10485759, default 10485759): +2G
Created a new partition 1 of type 'Linux' and of size 2 GiB.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

[root@serverb ~]# pvcreate /dev/vdb1	//创建物理卷
[root@serverb ~]# vgcreate testvg /dev/vdb1	//创建卷组并将vdb1加入到卷组
[root@serverb ~]# lvcreate -n vo -L 200M testvg	//在卷组中分出逻辑卷
[root@serverb ~]# mkfs.xfs /dev/testvg/vo	//格式化为xfs
[root@serverb ~]# blkid /dev/testvg/vo	//查看uuid
/dev/testvg/vo: UUID="fe323058-93db-428d-883c-2c0210cd10c6" TYPE="xfs"
[root@serverb ~]# mkdir /mnt/vo
[root@serverb ~]# vim /etc/fstab
UUID="fe323058-93db-428d-883c-2c0210cd10c6" /mnt/vo xfs defaults 0 0
[root@serverb ~]# mount -a
# 实际操作
[root@serverb ~]# df -hT /dev/testvg/vo # 查看文件系统的类型和大小
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/testvg-vo xfs 195M 12M 183M 6% /mnt/vo
[root@serverb ~]# lvextend -L 300M /dev/testvg/vo
[root@serverb ~]# lvs
# 扩展文件系统，ext类型的文件系统用resize2fs /dev/testvg/vo ，后面接的是逻辑卷的路径。
[root@serverb ~]# xfs_growfs /mnt/vo # 后面接的是挂载点的路径
[root@serverb ~]# df -hT /dev/testvg/vo
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/testvg-vo xfs 295M 13M 283M 5% /mnt/vo

17、添加交换分区

在系统上添加⼀个512MiB的交换分区，设置交换分区应在系统启动时自动挂载，不要删除或修改系统 上已存在的交换分区

[root@serverb ~]# fdisk /dev/vdb
Welcome to fdisk (util-linux 2.32.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): n
Partition type
p primary (1 primary, 0 extended, 3 free)
e extended (container for logical partitions)
Select (default p):
Using default response p.
Partition number (2-4, default 2):
First sector (4196352-10485759, default 4196352):
Last sector, +sectors or +size{K,M,G,T,P} (4196352-10485759, default 10485759):
+512M
Created a new partition 2 of type 'Linux' and of size 512 MiB.

Command (m for help) : t
Partition number ( 1,2,default 2):
Hex code (type L to list all codes) : 82
Changed type of partition 'Linux' to 'Linux swap / Solaris '.

Command (m for help): w
The partition table has been altered.
Syncing disks.

[root@serverb ~]# mkswap /dev/vdb2
[root@serverb ~]# blkid /dev/vdb2
/dev/vdb2: UUID="f626f11c-4363-4caf-aba6-5a418ea04079" TYPE="swap"
PARTUUID="ae75bf0a-02"
[root@serverb ~]# vim /etc/fstab
UUID=f626f11c-4363-4caf-aba6-5a418ea04079 swap swap defaults 0 0
[root@serverb ~]# swapon -a
[root@serverb ~]# swapon -s
Filename Type Size Used Priority
/dev/vdb2 partition 524284 0 -2

18、创建逻辑卷

根据以下要求，创建新的逻辑卷：

1. 逻辑卷的名字为mylv，属于myvg卷组，大小为50个pe
2. 卷组myvg中的逻辑卷的pe大小应当为16MiB
3. 使用vfat文件系统将逻辑卷mylv格式化
4. 此逻辑卷应当在系统启动时自动挂载到/mnt/mydata目录下

[root@serverb ~]# fdisk /dev/vdb
Welcome to fdisk (util-linux 2.32.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): n
Partition type
p primary (2 primary, 0 extended, 2 free)
e extended (container for logical partitions)
Select (default p):
Using default response p.
Partition number (3,4, default 3):
First sector (5244928-10485759, default 5244928):
Last sector, +sectors or +size{K,M,G,T,P} (5244928-10485759, default 10485759):
+1G
Created a new partition 3 of type 'Linux' and of size 1 GiB.

Command (m for help) : t
Partition number ( i-3,default 3):
Hex code (type L to list all codes) : 8e
Changed type of partition 'Linux' to 'Linux LVM' .

Command (m for help): w
The partition table has been altered.
Syncing disks.

[root@serverb ~]# pvcreate /dev/vdb3
[root@serverb ~]# vgcreate -s 16M myvg /dev/vdb3
[root@serverb ~]# lvcreate -l 50 -n mylv myvg
[root@serverb ~]# mkfs.vfat /dev/myvg/mylv
[root@serverb ~]#blkid /dev/ myvg/mylv
/dev/myvg/mylv: UUID="5AA3-4EB3" TYPE="vfat"
[root@serverb ~]# vim /etc/fstab
UUID="5AA3-4EB3" /mnt/mydata vfat defaults 0 0
[root@serverb ~]# mkdir /mnt/mydata
[root@serverb ~]# mount -a
[root@serverb ~]# df -h /mnt/mydata/
Filesystem Size Used Avail Use% Mounted on
/dev/myvg/mylv 799M 4.0K 799M 1% /mnt/mydata

19、创建VDO卷

根据如下要求，创建新的VDO卷：

1. 使⽤未分区的磁盘(/dev/vdc)
2. 此VDO卷的名称为myvdo
3. 此VDO卷的逻辑大小为50G
4. 此VDO卷使用xfs文件系统格式化
5. 此VDO卷在系统启动自动挂载到/vblock目录下

[root@serverb ~]# vdo create --name=myvdo --device=/dev/vdc --vdoLogicalSize=50G
# 命令man vdo 找example
Creating VDO myvdo
Starting VDO myvdo
Starting compression on VDO myvdo
VDO instance 0 volume is ready at /dev/mapper/myvdo
[root@serverb ~]# mkfs.xfs /dev/mapper/myvdo
[root@serverb ~]# blkid /dev/ mapper/myvdo
/dev/mapper/myvdo: UUID="0alf2efd-141b-4e7c-98ff-e75ff73515a3" TYPE="xfs"
[root@serverb ~]# vim /etc/fstab
UUID="0alf2efd-141b-4e7c-98ff-e75ff73515a3" /vblock xfs defaults,x-systemd.requires=vdo.service 0 0
[root@serverb ~]# mkdir /vblock
[root@serverb ~]# mount -a
[root@serverb ~]# df -h /vblock
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/myvdo 50G 390M 50G 1% /vblock

20、配置系统调优

先查看tuned推荐的配置文件，并将系统的调优配置文件设置为throughput-performance 提示：考试要求是将系统的调优配置文件设置为tuned推荐的配置文件

[root@serverb ~]# tuned-adm recommend
virtual-guest
[root@serverb ~]# tuned-adm profile virtual-guest
# 确保当前生效的配置文件是系统推荐的配置文件即可
[root@serverb ~]# tuned-adm list
Available profiles:
- balanced - General non-specialized tuned profile
- desktop - Optimize for the desktop use-case
- latency-performance - Optimize for deterministic performance at the
cost of increased power consumption
- network-latency - Optimize for deterministic performance at the
cost of increased power consumption, focused on low latency network performance
- network-throughput - Optimize for streaming network throughput,
generally only necessary on older CPUs or 40G+ networks
- powersave - Optimize for low power consumption
- throughput-performance - Broadly applicable tuning that provides
excellent performance across a variety of common server workloads
- virtual-guest - Optimize for running inside a virtual guest
- virtual-host - Optimize for running KVM guests
Current active profile: virtual-guest
[root@serverb ~]# reboot

podman容器

containers用户的密码为redhat。在registry.lab.example.com上使用admin账户和redhat321密码访问容器镜像注册表。您可以从serverb上的/home/containers/rhcsa-compreview4/variables文件复制并粘贴web容器参数

• 准备工作

  # 使用student用户登录workstation
  [root@foundation0 ~]# ssh -X workstation
  # 运行脚本部署，考试不需要操作
  [student@workstation ~]$ lab rhcsa-compreview4 start

• 在serverb上，创建/srv/web/目录，然后在该目录中提取/homelcontainers/rhcsa-compreview4/web-content.tgz存档。配置该目录，使rootless容器可以将其用于持久存储。

  # 远程登录到serverb
  [root@foundation0 ~]# ssh root@serverb
  # 创建/srv/web/目录
  [root@serverb ~]# mkdir /srv/web
  # 在/srv/web/目录中提取/home/containers/rhcsa-compreview4/web-content.tgz存档
  [root@serverb ~]# cd /srv/web/
  [root@serverb web]# tar xf /home/containers/rhcsa-compreview4/web-content.tgz
  # Rootless容器需要拥有对/srv/web/目录及其内容的读取访问权限。此外，以containers用户身份运行的podman命令必须能够重新标记SELinux的目录。将目录所有者设置为containers，然后确认每个人都有权访问该内容
  [root@serverb web]# chown -R containers /srv/web

• 在serverb上，安装容器工具。

  # 安装container-tools模块
  [root@serverb web]# dnf -y module install container-tools
  # 从root账户注销
  [root@serverb web]# exit

• 在serverb上，以containers用户身份，创建名为web的Apache HTTP Server分离容器，使用registry.lab.example.com注册表中标签为1-105的
  rhel8/httpd-24镜像。将容器中的端口8080映射到主机上的端口8888.将主机上的/srv/web目录作为/var/www挂载到容器中。使用event值声明环境变量HTTPD_MPM。

  # 在registory.lab.example.com上使用admin账户和redhat321密码登录容器镜像注册表
  # 在workstation虚拟机中用student使用containers连接到serverb
  [root@foundation0 ~]# ssh containers@serverb
  [containers@serverb ~]$ cat rhcsa-compreview4/variables
  [containers@serverb ~]$ podman login registry.lab. example.com
  Username: admin
  Password: redhat321
  Login Succeeded!
  # 使用podman run命令创建容器。
  [containers@serverb ~]$ podman run -d --name web -p 8888:8080 -v /srv/web: /var/www:Z -e HTTPD_MPM=event registry.lab.example.com/rhel8/httpd-24:1-105
  # 使用curl命令确认Apache HTTP Server正在运行
  [containers@serverb ~]$ curl http://localhost:8888/

• 在serverb上，以containers用户身份配置systemd，以便web容器在服务器启动时自动启动。

  # 如果您使用了sudo或su以containers用户身份登录，则退出serverb并使用ssh命令以containers用户身份直接登录serverb
  [student@workstation ~]$ ssh containers@serverb
  # 创建~/.configl systemd/user/目录
  [containers@serverb -]$ mkdir -p ~/.config/systemd/user/
  # 使用podman generate systemd命令，从正在运行的容器中创建systemd单元文件
  [containers@serverb ~]$ cd ~/.config/systemd/user/
  [containers@serverb user]$ podman generate systemd --files --name web --new
  /home/containers/.config/systemd/user/container-web.service
  # 停止然后删除web容器
  [containers@serverb user]$ podman stop web
  [containers@serverb user]$ podman rm web
  # 指示systemd重新加载其配置，然后启用并启动container-web服务
  [containers@serverb user]$ systemctl --user daemon-reload
  [containers@serverb user]$ systemctl --user enable --now container-web.service
  # 确定容器正在运行
  [containers@serverb user]$cur1 http://loca1host:8888/
  Comprehensive Review web Content Test
  Lorem ipsum dolor sit amet, consectetur adipiscing elit.
  sed sit amet lacus vestibulum，varius magna sit amet,tempus neque.
  ...output omitted. . .
  # 运行loginctl enable-linger命令，使用户服务在服务器启动时自动启动
  [containers@serverb-]$ loginctl enable-linger
  # 从serverb退出
  [containers@serverb~]$ exit
  # 在workstation计算机上以student用户身份，使用命令为工作评级
  [root@foundation0 ~]# ssh student@workstation
  [student@workstation ~]$ lab rhcsa-compreview4 grade
  # 测试
  [student@workstation ~]$ lab rhcsa-compreview4 finish