Configuring basic system settings

Procedure

1. Enter the date command:

   $ date
   Mon Mar 30 16:02:59 CEST 2020

2. To see more details, use the timedatectl command:

   $ timedatectl
   Local time: Mon 2020-03-30 16:04:42 CEST
   Universal time: Mon 2020-03-30 14:04:42 UTC
     RTC time: Mon 2020-03-30 14:04:41
    Time zone: Europe/Prague (CEST, +0200)
   System clock synchronized: yes
   NTP service: active
   RTC in local TZ: no

Procedure

1. Optional: To use a different port for rsyslog traffic, add the syslogd_port_t SELinux type to port. For example, enable port 30514:

   # semanage port -a -t syslogd_port_t -p tcp 30514

2. Optional: To use a different port for rsyslog traffic, configure firewalld to allow incoming rsyslog traffic on that port. For example, allow TCP traffic on port 30514:

   # firewall-cmd --zone=<zone-name> --permanent --add-port=30514/tcp
   success
   # firewall-cmd --reload

3. Create a new file in the /etc/rsyslog.d/ directory named, for example, remotelog.conf, and insert the following content:

   # Define templates before the rules that use them
   # Per-Host templates for remote systems
   template(name="TmplAuthpriv" type="list") {
       constant(value="/var/log/remote/auth/")
       property(name="hostname")
       constant(value="/")
       property(name="programname" SecurePath="replace")
       constant(value=".log")
       }
   
   template(name="TmplMsg" type="list") {
       constant(value="/var/log/remote/msg/")
       property(name="hostname")
       constant(value="/")
       property(name="programname" SecurePath="replace")
       constant(value=".log")
       }
   
   # Provides TCP syslog reception
   module(load="imtcp")
   
   # Adding this ruleset to process remote messages
   ruleset(name="remote1"){
        authpriv.*   action(type="omfile" DynaFile="TmplAuthpriv")
         *.info;mail.none;authpriv.none;cron.none
   action(type="omfile" DynaFile="TmplMsg")
   }
   
   input(type="imtcp" port="30514" ruleset="remote1")

4. Save the changes to the /etc/rsyslog.d/remotelog.conf file.

5. Test the syntax of the /etc/rsyslog.conf file:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-2.el8, config validation run...
   rsyslogd: End of config validation run. Bye.

6. Make sure the rsyslog service is running and enabled on the logging server:

   # systemctl status rsyslog

7. Restart the rsyslog service.

   # systemctl restart rsyslog

8. Optional: If rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

   # systemctl enable rsyslog

Procedure

1. Create a new file in the /etc/rsyslog.d/ directory named, for example, 10-remotelog.conf, and insert the following content:

   *.* action(type="omfwd"
         queue.type="linkedlist"
         queue.filename="example_fwd"
         action.resumeRetryCount="-1"
         queue.saveOnShutdown="on"
         target="example.com" port="30514" protocol="tcp"
        )

   Where:

   • The queue.type="linkedlist" setting enables a LinkedList in-memory queue,
   • The queue.filename setting defines a disk storage. The backup files are created with the example_fwd prefix in the working directory specified by the preceding global workDirectory directive.
   • The action.resumeRetryCount -1 setting prevents rsyslog from dropping messages when retrying to connect if server is not responding,
   • The queue.saveOnShutdown="on" setting saves in-memory data if rsyslog shuts down.

   • The last line forwards all received messages to the logging server. Port specification is optional.

     With this configuration, rsyslog sends messages to the server but keeps messages in memory if the remote server is not reachable. A file on disk is created only if rsyslog runs out of the configured memory queue space or needs to shut down, which benefits the system performance.

   Note

   Rsyslog processes configuration files /etc/rsyslog.d/ in the lexical order.

2. Restart the rsyslog service.

   # systemctl restart rsyslog

1. On the client system, send a test message:

   # logger test

2. On the server system, view the /var/log/messages log, for example:

   # cat /var/log/remote/msg/hostname/root.log
   Feb 25 03:53:17 hostname root[6064]: test

   Where hostname is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Configure the server for receiving encrypted logs from your client systems:

   1. Create a new file in the /etc/rsyslog.d/ directory named, for example, securelogser.conf.

   2. To encrypt the communication, the configuration file must contain paths to certificate files on your server, a selected authentication method, and a stream driver that supports TLS encryption. Add the following lines to the /etc/rsyslog.d/securelogser.conf file:

      # Set certificate files
      global(
        DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem"
        DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/server-cert.pem"
        DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/server-key.pem"
      )
      
      # TCP listener
      module(
        load="imtcp"
        PermittedPeer=["client1.example.com", "client2.example.com"]
        StreamDriver.AuthMode="x509/name"
        StreamDriver.Mode="1"
        StreamDriver.Name="ossl"
      )
      
      # Start up listener at port 514
      input(
        type="imtcp"
        port="514"
      )

      Note

      If you prefer the GnuTLS driver, use the StreamDriver.Name="gtls" configuration option. See the documentation installed with the rsyslog-doc package for more information about less strict authentication modes than x509/name.

   3. Save the changes to the /etc/rsyslog.d/securelogser.conf file.

   4. Verify the syntax of the /etc/rsyslog.conf file and any files in the /etc/rsyslog.d/ directory:

      # rsyslogd -N 1
      rsyslogd: version 8.1911.0-2.el8, config validation run (level 1)...
      rsyslogd: End of config validation run. Bye.

   5. Make sure the rsyslog service is running and enabled on the logging server:

      # systemctl status rsyslog

   6. Restart the rsyslog service:

      # systemctl restart rsyslog

   7. Optional: If Rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

      # systemctl enable rsyslog

2. Configure clients for sending encrypted logs to the server:

   1. On a client system, create a new file in the /etc/rsyslog.d/ directory named, for example, securelogcli.conf.

   2. Add the following lines to the /etc/rsyslog.d/securelogcli.conf file:

      # Set certificate files
      global(
        DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem"
        DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/client-cert.pem"
        DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/client-key.pem"
      )
      
      
      # Set up the action for all messages
      *.* action(
        type="omfwd"
        StreamDriver="ossl"
        StreamDriverMode="1"
        StreamDriverPermittedPeers="server.example.com"
        StreamDriverAuthMode="x509/name"
        target="server.example.com" port="514" protocol="tcp"
      )

      Note

      If you prefer the GnuTLS driver, use the StreamDriver.Name="gtls" configuration option.

   3. Save the changes to the /etc/rsyslog.d/securelogcli.conf file.

   4. Verify the syntax of the /etc/rsyslog.conf file and other files in the /etc/rsyslog.d/ directory:

      # rsyslogd -N 1
      rsyslogd: version 8.1911.0-2.el8, config validation run (level 1)...
      rsyslogd: End of config validation run. Bye.

   5. Make sure the rsyslog service is running and enabled on the logging server:

      # systemctl status rsyslog

   6. Restart the rsyslog service:

      # systemctl restart rsyslog

   7. Optional: If Rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

      # systemctl enable rsyslog

1. On the client system, send a test message:

   # logger test

2. On the server system, view the /var/log/messages log, for example:

   # cat /var/log/remote/msg/<hostname>/root.log
   Feb 25 03:53:17 <hostname> root[6064]: test

   Where <hostname> is the hostname of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Optional: To use a different port for rsyslog traffic than the default port 514:

   1. Add the syslogd_port_t SELinux type to the SELinux policy configuration, replacing portno with the port number you want rsyslog to use:

      # semanage port -a -t syslogd_port_t -p udp portno

   2. Configure firewalld to allow incoming rsyslog traffic, replacing portno with the port number and zone with the zone you want rsyslog to use:

      # firewall-cmd --zone=zone --permanent --add-port=portno/udp
      success
      # firewall-cmd --reload

   3. Reload the firewall rules:

      # firewall-cmd --reload

2. Create a new .conf file in the /etc/rsyslog.d/ directory, for example, remotelogserv.conf, and insert the following content:

   # Define templates before the rules that use them
   # Per-Host templates for remote systems
   template(name="TmplAuthpriv" type="list") {
       constant(value="/var/log/remote/auth/")
       property(name="hostname")
       constant(value="/")
       property(name="programname" SecurePath="replace")
       constant(value=".log")
       }
   
   template(name="TmplMsg" type="list") {
       constant(value="/var/log/remote/msg/")
       property(name="hostname")
       constant(value="/")
       property(name="programname" SecurePath="replace")
       constant(value=".log")
       }
   
   # Provides UDP syslog reception
   module(load="imudp")
   
   # This ruleset processes remote messages
   ruleset(name="remote1"){
        authpriv.*   action(type="omfile" DynaFile="TmplAuthpriv")
         *.info;mail.none;authpriv.none;cron.none
   action(type="omfile" DynaFile="TmplMsg")
   }
   
   input(type="imudp" port="514" ruleset="remote1")

   Where 514 is the port number rsyslog uses by default. You can specify a different port instead.

3. Verify the syntax of the /etc/rsyslog.conf file and all .conf files in the /etc/rsyslog.d/ directory:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-2.el8, config validation run...

4. Restart the rsyslog service.

   # systemctl restart rsyslog

5. Optional: If rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

   # systemctl enable rsyslog

Procedure

1. Create a new .conf file in the /etc/rsyslog.d/ directory, for example, 10-remotelogcli.conf, and insert the following content:

   *.* action(type="omfwd"
         queue.type="linkedlist"
         queue.filename="example_fwd"
         action.resumeRetryCount="-1"
         queue.saveOnShutdown="on"
         target="example.com" port="portno" protocol="udp"
        )

   Where:

   • The queue.type="linkedlist" setting enables a LinkedList in-memory queue.
   • The queue.filename setting defines a disk storage. The backup files are created with the example_fwd prefix in the working directory specified by the preceding global workDirectory directive.
   • The action.resumeRetryCount -1 setting prevents rsyslog from dropping messages when retrying to connect if the server is not responding.
   • The enabled queue.saveOnShutdown="on" setting saves in-memory data if rsyslog shuts down.
   • The portno value is the port number you want rsyslog to use. The default value is 514.

   • The last line forwards all received messages to the logging server, port specification is optional.

     With this configuration, rsyslog sends messages to the server but keeps messages in memory if the remote server is not reachable. A file on disk is created only if rsyslog runs out of the configured memory queue space or needs to shut down, which benefits the system performance.

   Note

   Rsyslog processes configuration files /etc/rsyslog.d/ in the lexical order.

2. Restart the rsyslog service.

   # systemctl restart rsyslog

3. Optional: If rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

   # systemctl enable rsyslog

1. On the client system, send a test message:

   # logger test

2. On the server system, view the /var/log/remote/msg/hostname/root.log log, for example:

   # cat /var/log/remote/msg/hostname/root.log
   Feb 25 03:53:17 hostname root[6064]: test

   Where hostname is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Configure the client system for reliable remote logging:

   1. On the client system, create a new .conf file in the /etc/rsyslog.d/ directory named, for example, relpclient.conf, and insert the following content:

      module(load="omrelp")
      *.* action(type="omrelp" target="_target_IP_" port="_target_port_")

      Where:

      • target_IP is the IP address of the logging server.
      • target_port is the port of the logging server.
   2. Save the changes to the /etc/rsyslog.d/relpclient.conf file.

   3. Restart the rsyslog service.

      # systemctl restart rsyslog

   4. Optional: If rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

      # systemctl enable rsyslog

2. Configure the server system for reliable remote logging:

   1. On the server system, create a new .conf file in the /etc/rsyslog.d/ directory named, for example, relpserv.conf, and insert the following content:

      ruleset(name="relp"){
      *.* action(type="omfile" file="_log_path_")
      }
      
      
      module(load="imrelp")
      input(type="imrelp" port="_target_port_" ruleset="relp")

      Where:

      • log_path specifies the path for storing messages.
      • target_port is the port of the logging server. Use the same value as in the client configuration file.
   2. Save the changes to the /etc/rsyslog.d/relpserv.conf file.

   3. Restart the rsyslog service.

      # systemctl restart rsyslog

   4. Optional: If rsyslog is not enabled, ensure the rsyslog service starts automatically after reboot:

      # systemctl enable rsyslog

1. On the client system, send a test message:

   # logger test

2. On the server system, view the log at the specified log_path, for example:

   # cat /var/log/remote/msg/hostname/root.log
   Feb 25 03:53:17 hostname root[6064]: test

   Where hostname is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Install the netconsole-service package:

   # yum install netconsole-service

2. Edit the /etc/sysconfig/netconsole file and set the SYSLOGADDR parameter to the IP address of the remote host:

   # SYSLOGADDR=192.0.2.1

3. Enable and start the netconsole service:

   # systemctl enable --now netconsole

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy the logging solution
     hosts: managed-node-01.example.com
     tasks:
       - name: Filter logs based on a specific value they contain
         ansible.builtin.include_role:
           name: rhel-system-roles.logging
         vars:
           logging_inputs:
             - name: files_input
               type: basics
           logging_outputs:
             - name: files_output0
               type: files
               property: msg
               property_op: contains
               property_value: error
               path: /var/log/errors.log
             - name: files_output1
               type: files
               property: msg
               property_op: "!contains"
               property_value: error
               path: /var/log/others.log
           logging_flows:
             - name: flow0
               inputs: [files_input]
               outputs: [files_output0, files_output1]

   The settings specified in the example playbook include the following:

   logging_inputs

   Defines a list of logging input dictionaries. The type: basics option covers inputs from systemd journal or Unix socket.

   logging_outputs

   Defines a list of logging output dictionaries. The type: files option supports storing logs in the local files, usually in the /var/log/ directory. The property: msg; property: contains; and property_value: error options specify that all logs that contain the error string are stored in the /var/log/errors.log file. The property: msg; property: !contains; and property_value: error options specify that all other logs are put in the /var/log/others.log file. You can replace the error value with the string by which you want to filter.

   logging_flows

   Defines a list of logging flow dictionaries to specify relationships between logging_inputs and logging_outputs. The inputs: [files_input] option specifies a list of inputs, from which processing of logs starts. The outputs: [files_output0, files_output1] option specifies a list of outputs, to which the logs are sent.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.logging/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On the managed node, test the syntax of the /etc/rsyslog.conf file:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-6.el8, config validation run...
   rsyslogd: End of config validation run. Bye.

2. On the managed node, verify that the system sends messages that contain the error string to the log:

   1. Send a test message:

      # logger error

   2. View the /var/log/errors.log log, for example:

      # cat /var/log/errors.log
      Aug  5 13:48:31 hostname root[6778]: error

      Where hostname is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy the logging solution
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure the server to receive remote input
         ansible.builtin.include_role:
           name: rhel-system-roles.logging
         vars:
           logging_inputs:
             - name: remote_udp_input
               type: remote
               udp_ports: [ 601 ]
             - name: remote_tcp_input
               type: remote
               tcp_ports: [ 601 ]
           logging_outputs:
             - name: remote_files_output
               type: remote_files
           logging_flows:
             - name: flow_0
               inputs: [remote_udp_input, remote_tcp_input]
               outputs: [remote_files_output]
   
   - name: Deploy the logging solution
     hosts: managed-node-02.example.com
     tasks:
       - name: Configure the server to output the logs to local files in directories named by remote host names
         ansible.builtin.include_role:
           name: rhel-system-roles.logging
         vars:
           logging_inputs:
             - name: basic_input
               type: basics
           logging_outputs:
             - name: forward_output0
               type: forwards
               severity: info
               target: <host1.example.com>
               udp_port: 601
             - name: forward_output1
               type: forwards
               facility: mail
               target: <host1.example.com>
               tcp_port: 601
           logging_flows:
             - name: flows0
               inputs: [basic_input]
               outputs: [forward_output0, forward_output1]
   
   [basic_input]
   [forward_output0, forward_output1]

   The settings specified in the first play of the example playbook include the following:

   logging_inputs

   Defines a list of logging input dictionaries. The type: remote option covers remote inputs from the other logging system over the network. The udp_ports: [ 601 ] option defines a list of UDP port numbers to monitor. The tcp_ports: [ 601 ] option defines a list of TCP port numbers to monitor. If both udp_ports and tcp_ports is set, udp_ports is used and tcp_ports is dropped.

   logging_outputs

   Defines a list of logging output dictionaries. The type: remote_files option makes output store logs to the local files per remote host and program name originated the logs.

   logging_flows

   Defines a list of logging flow dictionaries to specify relationships between logging_inputs and logging_outputs. The inputs: [remote_udp_input, remote_tcp_input] option specifies a list of inputs, from which processing of logs starts. The outputs: [remote_files_output] option specifies a list of outputs, to which the logs are sent.

   The settings specified in the second play of the example playbook include the following:

   logging_inputs

   Defines a list of logging input dictionaries. The type: basics option covers inputs from systemd journal or Unix socket.

   logging_outputs

   Defines a list of logging output dictionaries. The type: forwards option supports sending logs to the remote logging server over the network. The severity: info option refers to log messages of the informative importance. The facility: mail option refers to the type of system program that is generating the log message. The target: <host1.example.com> option specifies the hostname of the remote logging server. The udp_port: 601/tcp_port: 601 options define the UDP/TCP ports on which the remote logging server listens.

   logging_flows

   Defines a list of logging flow dictionaries to specify relationships between logging_inputs and logging_outputs. The inputs: [basic_input] option specifies a list of inputs, from which processing of logs starts. The outputs: [forward_output0, forward_output1] option specifies a list of outputs, to which the logs are sent.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.logging/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On both the client and the server system, test the syntax of the /etc/rsyslog.conf file:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-6.el8, config validation run (level 1), master config /etc/rsyslog.conf
   rsyslogd: End of config validation run. Bye.

2. Verify that the client system sends messages to the server:

   1. On the client system, send a test message:

      # logger test

   2. On the server system, view the /var/log/<host2.example.com>/messages log, for example:

      # cat /var/log/<host2.example.com>/messages
      Aug  5 13:48:31 <host2.example.com> root[6778]: test

      Where <host2.example.com> is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Logs.

   

3. Open log entry details by clicking on your selected log entry in the list.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Logs.

3. By default, web console shows the latest log entries. To filter by a specific time range, click the Time drop-down menu and choose a preferred option.

   

4. Error and above severity logs list is shown by default. To filter by different priority, click the Error and above drop-down menu and choose a preferred priority.

   

5. By default, web console shows logs for all identifiers. To filter logs for a particular identifier, click the All drop-down menu and select an identifier.

   

6. To open a log entry, click on a selected log.

1. Type identifier:systemd since:2020-10-22 JOB_TYPE=start,restart to search field.

2. Check the results.

   

1. Type service:cockpit boot:-1 error|fail to the search field.

2. Check the results.

   

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Click Logs.

3. Use the drop-down menus to specify the three main quantifiers - time range, priority, and identifier(s) - you want to filter.

   The Priority quantifier always has to have a value. If you do not specify it, it automatically filters the Error and above priority. Notice that the options you set reflect in the text search box.

4. Specify the log field you want to filter.

   You can add several log fields.

5. You can use a free-form string to search for anything else. The search box also accepts regular expressions.

1. Open the /etc/login.defs file in an editor of your choice.

2. Find the lines that define the minimum value for automatic UID selection.

   # Min/max values for automatic uid selection in useradd
   #
   UID_MIN                  1000

3. Modify the UID_MIN value to start at 5000.

   # Min/max values for automatic uid selection in useradd
   #
   UID_MIN                  5000

4. Find the lines that define the minimum value for automatic GID selection.

   # Min/max values for automatic gid selection in groupadd
   #
   GID_MIN                  1000

5. Modify the GID_MIN value to start at 5000.

   # Min/max values for automatic gid selection in groupadd
   #
   GID_MIN                  5000

   The dynamically assigned UIDs and GIDs for the regular users now start at 5000.

   Note

   The UID’s and GID’s of users and groups created before you changed the UID_MIN and GID_MIN values do not change.

   This will allow new user’s group to have same 5000+ ID as UID and GID.

   Warning

   Do not raise IDs reserved by the system above 1000 by changing SYS_UID_MAX to avoid conflict with systems that retain the 1000 limit.

Procedure

1. Create a directory:

   # mkdir directory-name

   Replace directory-name with the name of the directory.

2. Create a group:

   # groupadd group-name

   Replace group-name with the name of the group.

3. Add users to the group:

   # usermod --append -G group-name username

   Replace group-name with the name of the group, and replace username with the name of the user.

4. Associate the user and group ownership of the directory with the group-name group:

   # chgrp group-name directory-name

   Replace group-name with the name of the group, and replace directory-name with the name of the directory.

5. Set the write permissions to allow the users to create and modify files and directories and set the setgid bit to make this permission be applied within the directory-name directory:

   # chmod g+rwxs directory-name

   Replace directory-name with the name of the directory.

   Now all members of the group-name group can create and edit files in the directory-name directory. Newly created files retain the group ownership of group-name group.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Accounts.
3. Click Create New Account.

4. In the Full Name field, enter the full name of the user.

   The RHEL web console automatically suggests a user name from the full name and fills it in the User Name field. If you do not want to use the original naming convention consisting of the first letter of the first name and the whole surname, update the suggestion.

5. In the Password/Confirm fields, enter the password and retype it for verification that your password is correct.

   The color bar below the fields shows you the security level of the entered password, which does not allow you to create a user with a weak password.

6. Click Create to save the settings and close the dialog box.
7. Select the newly created account.

8. In the Groups drop-down menu, select the groups that you want to add to the new account.

   

   Now you can see the new account in the Accounts settings and you can use its credentials to connect to the system.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Accounts.
3. Select the user account for which you want to enforce password expiration.

4. Click edit on the Password line.

   

5. In the Password expiration dialog box, select Require password change every …​ days and enter a positive whole number representing the number of days after which the password expires.

6. Click Change.

   The web console immediately shows the date of the future password change request on the Password line.

Prerequisites:

1. root access
2. The new group must exist

Procedure

1. Reboot the system and, on the GRUB boot screen, press the e key to interrupt the boot process.

   The kernel boot parameters appear.

   load_video
   set gfx_payload=keep
   insmod gzio
   linux ($root)/vmlinuz-4.18.0-80.e18.x86_64 root=/dev/mapper/rhel-root ro crash\
   kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet
   initrd ($root)/initramfs-4.18.0-80.e18.x86_64.img $tuned_initrd

2. Go to the end of the line that starts with linux.

   linux ($root)/vmlinuz-4.18.0-80.e18.x86_64 root=/dev/mapper/rhel-root ro crash\
   kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet

   Press Ctrl+e to jump to the end of the line.

3. Add rd.break to the end of the line that starts with linux.

   linux ($root)/vmlinuz-4.18.0-80.e18.x86_64 root=/dev/mapper/rhel-root ro crash\
   kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet rd.break

4. Press Ctrl+x to start the system with the changed parameters.

   The switch_root prompt appears.

5. Remount the file system as writable:

   mount -o remount,rw /sysroot

   The file system is mounted as read-only in the /sysroot directory. Remounting the file system as writable allows you to change the password.

6. Enter the chroot environment:

   chroot /sysroot

   The sh-4.4# prompt appears.

7. Reset the root password:

   passwd

   Follow the instructions displayed by the command line to finalize the change of the root password.

8. Enable the SELinux relabeling process on the next system boot:

   touch /.autorelabel

9. Exit the chroot environment:

   exit

10. Exit the switch_root prompt:

    exit

11. Wait until the SELinux relabeling process is finished. Note that relabeling a large disk might take a long time. The system reboots automatically when the process is complete.

Verification

1. To verify that the root password is successfully changed, log in as a normal user and open the Terminal.

2. Run the interactive shell as root:

   $ su

3. Enter your new root password.

4. Print the user name associated with the current effective user ID:

   # whoami

   The output returns:

   root

Procedure

1. As root, open the /etc/bashrc file in the editor.

2. Modify the following sections to set a new default bash umask:

       if [ $UID -gt 199 ] && [ “id -gn” = “id -un” ]; then
          umask 002
       else
          umask 022
       fi

   Replace the default octal value of the umask (002) with another octal value. See User file-creation mode mask for more details.

3. Save the changes and exit the editor.

Procedure

1. As root, open the /etc/profile file in the editor.

2. Modify the following sections to set a new default bash umask:

   if [ $UID -gt 199 ] && [ “/usr/bin/id -gn” = “/usr/bin/id -un” ]; then
       umask 002
   else
       umask 022
   fi

   Replace the default octal value of the umask (022) with another octal value. See User file-creation mode mask for more details.

3. Save the changes and exit the editor.

Procedure

1. As root, open the /etc/login.defs file in the editor.

2. Modify the following section to set a new default HOME_MODE:

   # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
   # home directories.
   # If HOME_MODE is not set, the value of UMASK is used to create the mode.
   HOME_MODE       0700

   Replace the default octal value (0700) with another octal value. The selected mode will be used to create the permissions for the home directory.

3. If HOME_MODE is set, save the changes and exit the editor.

4. If HOME_MODE is not set, modify the UMASK to set the mode for the newly created home directories:

   # Default initial "umask" value used by login(1) on non-PAM enabled systems.
   # Default "umask" value for pam_umask(8) on PAM enabled systems.
   # UMASK is also used by useradd(8) and newusers(8) to set the mode for new
   # home directories if HOME_MODE is not set.
   # 022 is the default value, but 027, or even 077, could be considered
   # for increased privacy. There is no One True Answer here: each sysadmin
   # must make up their mind.
   
   UMASK           022

   Replace the default octal value (022) with another octal value. See User file-creation mode mask for more details.

5. Save the changes and exit the editor.

Procedure

1. Determine the current default target unit systemd uses to start the system:

   # systemctl get-default
   graphical.target

2. List the currently loaded targets:

   # systemctl list-units --type target

3. Configure the system to use a different target unit by default:

   # systemctl set-default <name>.target

   Replace <name> with the name of the target unit you want to use by default.

   Example:
   # systemctl set-default multi-user.target
   Removed /etc/systemd/system/default.target
   Created symlink /etc/systemd/system/default.target -> /usr/lib/systemd/system/multi-user.target

4. Verify the default target unit:

   # systemctl get-default
   multi-user.target

5. Apply the changes by rebooting:

   # reboot

Procedure

1. Optional: Determine the current target:

   # systemctl get-default
   graphical.target

2. Optional: Display the list of targets you can select:

   # systemctl list-units --type target

   Note

   You can only isolate targets that have the AllowIsolate=yes option set in the unit files.

3. Change to a different target unit in the current boot:

   # systemctl isolate <name>.target

   Replace <name> with the name of the target unit you want to use in the current boot.

   Example:
   # systemctl isolate multi-user.target

   This command starts the target unit named multi-user and all dependent units, and immediately stops all other unit.

Procedure

1. Reboot the system, and interrupt the boot loader menu countdown by pressing any key except the Enter key, which would initiate a normal boot.
2. Move the cursor to the kernel entry that you want to start.
3. Press the E key to edit the current entry.

4. Move to the end of the line that starts with linux and press Ctrl+E to jump to the end of the line:

   linux ($root)/vmlinuz-5.14.0-70.22.1.e19_0.x86_64 root=/dev/mapper/rhel-root ro crash\
   kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet

5. To choose an alternate boot target, append the systemd.unit= parameter to the end of the line that starts with linux:

   linux ($root)/vmlinuz-5.14.0-70.22.1.e19_0.x86_64 root=/dev/mapper/rhel-root ro crash\
   kernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv/swap rhgb quiet systemd.unit=<name>.target

   Replace <name> with the name of the target unit you want to use. For example, systemd.unit=emergency.target

6. Press Ctrl+X to boot with these settings.