System Administration Guides and Best Practices - Page 2

Set a UTF-8 system locale with localectl or update-locale, confirm with locale and locale charmap, and fix missing-locale warnings on RHEL and Debian-family Linux.

Fix error Failed dependencies when installing a local RPM with dnf install, list requirements with dnf repoquery, install offline RPM bundles, and remove packages safely on RHEL family systems.

Store systemd-journald logs on disk under /var/log/journal with a Storage=persistent drop-in, restart systemd-journald, flush runtime logs with journalctl, and verify earlier boots with journalctl --list-boots.

Set ClientAliveInterval and ClientAliveCountMax on sshd to drop unresponsive SSH clients, use ServerAliveInterval on the OpenSSH client to keep sessions alive through NAT, and understand how TCPKeepAlive differs.

Install rkhunter from EPEL or apt, update its signature database, baseline file properties with propupd, run a non-interactive check, and interpret warnings in rkhunter.log on RHEL and Debian-family hosts.

Create a custom systemd .service unit under /etc/systemd/system/, explain Unit Service and Install sections, start and enable it with systemctl, and verify with status and journalctl.

Take GNU tar listed-incremental backups with a snapshot file, create level 0 and level 1 archives, inspect Y and N file status, and restore by applying the full backup then each incremental in order.

Reuse one authenticated SSH connection for later ssh, scp, and sftp sessions with ControlMaster, ControlPath, and ControlPersist on the OpenSSH client.

Copy a directory and its contents between Linux hosts with scp -r and rsync -av over SSH, verify the remote layout, and avoid common path mistakes with trailing slashes.

Restrict SFTP users to a chroot directory with OpenSSH ChrootDirectory, ForceCommand internal-sftp, Match blocks in sshd_config, writable upload folders, and SSH public-key authentication.

Set SFTP upload permissions with OpenSSH internal-sftp -u in sshd_config, apply umask per user or group with Match blocks, and understand why umask removes bits but cannot add them.

Set up Apache httpd with TLS, WebDAV, and HTTP basic auth on RHEL-family systems, trust the server certificate on the client with curl --cacert, and upload or download files over verified HTTPS.

Use pkill -P PARENT_PID . to send SIGTERM to every direct child of a parent process, list them with ps --ppid, and clean up script workers with pkill -P $$ . on EXIT.

Enable pam_faillock on RHEL-family Linux with authselect and faillock.conf, verify SSH lockout after failed passwords, and reset tallies with the faillock command.

Update 389 Directory Server safely with dnf, pre-upgrade health checks, verified backups, standalone and rolling replica updates, post-upgrade validation, and recovery when a package update fails.

Rebuild the initramfs image with dracut for one kernel or every installed kernel, add storage and network drivers, and inspect the result with lsinitrd.

Manage Linux users and groups with useradd, usermod, userdel, groupadd, primary and supplementary groups, account defaults, and ownership checks.

Configure Chrony NTP on Linux, verify time synchronization with chronyc, force clock correction, troubleshoot sync problems, and optionally serve LAN clients.

Reset or change the Directory Manager password in 389 Directory Server with online dsconf over LDAPS, offline pwdhash and dse.ldif editing, verification, rollback, and per-replica rollout.

Troubleshoot slow LDAP searches in 389 Directory Server using client timing, access-log metrics, unindexed-filter notes, indexes, caches, and replica comparison.

Fix missing or stale memberOf in 389 Directory Server by checking group data, plug-in scope, fix-up filters, shared configuration, and replication.

Fix LDAP error 53 in 389 Directory Server by reading the additional info line, then checking password policy, read-only mode, RootDN Access Control, TLS SSF, and access logs.

Fix LDAP error 49 in 389 Directory Server by checking the password, bind DN, account state, access logs, application secrets, and replication credentials.

Understand how 389 Directory Server hashes LDAP passwords, inspect userPassword prefixes, change the global storage scheme, migrate legacy hashes after successful binds, and test application compatibility.

Install 389 Directory Server, create an LDAP instance with dscreate, configure a directory suffix, verify the service, and test LDAP access.

Fix LDAP works but LDAPS fails in 389 Directory Server by checking port 636, the TLS handshake, client CA trust, hostname matching, server certificates, and access logs.

Fix LDAP error 65 in 389 Directory Server by reading the additional info line, then checking object class MUST and MAY rules, entry state, custom schema, plug-ins, and replica schema parity.

Fix LDAP error 50 in 389 Directory Server by checking ACIs on the target and its parents, group membership, deny rules, Get Effective Rights, and access logs.

Configure Apache LDAP authentication with 389 Directory Server using mod_authnz_ldap, StartTLS, group authorization, and troubleshooting.

Store SSH public keys in 389 Directory Server, configure SSSD and OpenSSH key lookup, and test key addition, rotation, and revocation.