Configuring basic system settings

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

• Time: This drop-down menu contains predefined searches for different time ranges of your search.
• Priority: This drop-down menu provides options for different priority levels. It corresponds to the journalctl --priority option. The default priority value is Error and above. It is set every time you do not specify any other priority.
• Identifier: In this drop-down menu, you can select an identifier that you want to filter. Corresponds to the journalctl --identifier option.

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

• To display user and group IDs:

  $ id
  uid=1000(example.user) gid=1000(example.user) groups=1000(example.user),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

• To create a new user account:

  # useradd example.user

• To assign a new password to a user account belonging to example.user:

  # passwd example.user

• To add a user to a group:

  # usermod -a -G example.group example.user

Prerequisites

• Root access

Procedure

• To add a new user, use:

  # useradd options username

  Replace options with the command-line options for the useradd command, and replace username with the name of the user.

  Example 9.1. Adding a new user

  To add the user sarah with user ID 5000, use:

  # useradd -u 5000 sarah

Verification

• To verify the new user is added, use the id utility.

  # id sarah

  The output returns:

  uid=5000(sarah) gid=5000(sarah) groups=5000(sarah)

Prerequisites

• Root access

Procedure

• To add a new group, use:

  # groupadd options group-name

  Replace options with the command-line options for the groupadd command, and replace group-name with the name of the group.

  Example 9.2. Adding a new group

  To add the group sysadmins with group ID 5000, use:

  # groupadd -g 5000 sysadmins

Verification

• To verify the new group is added, use the tail utility.

  # tail /etc/group

  The output returns:

  sysadmins:x:5000:

Prerequisites

• root access

Procedure

• To add a group to the supplementary groups of the user, use:

  # usermod --append -G group-name username

  Replace group-name with the name of the group, and replace username with the name of the user.

  Example 9.3. Adding a user to a supplementary group

  To add the user sysadmin to the group system-administrators, use:

  # usermod --append -G system-administrators sysadmin

Verification

• To verify the new groups is added to the supplementary groups of the user sysadmin, use:

  # groups sysadmin

  The output displays:

  sysadmin : sysadmin system-administrators

Prerequisites

• Root access

Verification

• To verify the correctness of set permissions, use:

  # ls -ld directory-name

  Replace directory-name with the name of the directory.

  The output returns:

  drwxrwsr-x. 2 root group-name 6 Nov 25 08:45 directory-name

Prerequisites

• You have root access.
• The user currently exists.

• Ensure that the user is logged out:

  # loginctl terminate-user user-name

Procedure

• To only remove the user account, and not the user data:

  # userdel user-name

• To remove the user, the data, and the metadata:

  1. Remove the user, their home directory, their mail spool, and their SELinux user mapping:

     # userdel --remove --selinux-user user-name

  2. Remove additional user metadata:

     # rm -rf /var/lib/AccountsService/users/user-name

     This directory stores information that the system needs about the user before the home directory is available. Depending on the system configuration, the home directory might not be available until the user authenticates at the login screen.

     Important

     If you do not remove this directory and you later recreate the same user, the recreated user will still use certain settings inherited from the removed user.

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

Procedure

• Display the names of the primary and any supplementary group of a user:

  $ groups user-name

  Replace user-name with the name of the user. If you do not provide a user name, the command displays the group membership for the current user. The first group is the primary group followed by the optional supplementary groups.

  Example 9.4. Listing of groups for user sarah:

  $ groups sarah

  The output displays:

  sarah : sarah wheel developer

  User sarah has a primary group sarah and is a member of supplementary groups wheel and developer.

  Example 9.5. Listing of groups for user marc:

  $ groups marc

  The output displays:

  marc : marc

  User marc has only a primary group marc and no supplementary groups.

Procedure

• Change the primary group of a user:

  # usermod -g group-name user-name

  Replace group-name with the name of the new primary group, and replace user-name with the name of the user.

  Note

  When you change a user’s primary group, the command also automatically changes the group ownership of all files in the user’s home directory to the new primary group. You must fix the group ownership of files outside of the user’s home directory manually.

  Example 9.6. Example of changing the primary group of a user:

  If the user sarah belongs to the primary group sarah1, and you want to change the primary group of the user to sarah2, use:

  # usermod -g sarah2 sarah

Verification

• Verify that you changed the primary group of the user:

  $ groups sarah

  The output displays:

  sarah : sarah2

Prerequisites

• root access

Procedure

• To add a group to the supplementary groups of the user, use:

  # usermod --append -G group-name username

  Replace group-name with the name of the group, and replace username with the name of the user.

  Example 9.7. Adding a user to a supplementary group

  To add the user sysadmin to the group system-administrators, use:

  # usermod --append -G system-administrators sysadmin

Verification

• To verify the new groups is added to the supplementary groups of the user sysadmin, use:

  # groups sysadmin

  The output displays:

  sysadmin : sysadmin system-administrators

Prerequisites

• root access

Procedure

• Remove a user from a supplementary group:

  # gpasswd -d user-name group-name

  Replace user-name with the name of the user, and replace group-name with the name of the supplementary group.

  Example 9.8. Removing user from a supplementary group

  If the user sarah has a primary group sarah2, and belongs to the secondary groups wheel and developers, and you want to remove that user from the group developers, use:

  # gpasswd -d sarah developers

Verification

• Verify that you removed the user sarah from the secondary group developers:

  $ groups sarah

  The output displays:

  sarah : sarah2 wheel

Prerequisites

• root access
• The supplementary groups must exist

Procedure

• Overwrite a list of user’s supplementary groups:

  # usermod -G group-names username

  Replace group-names with the name of one or more supplementary groups. To add the user to several supplementary groups at once, separate the group names using commas and no intervening spaces. For example: wheel,developer.

  Replace user-name with the name of the user.

  Important

  If the user is currently a member of a group that you do not specify, the command removes the user from the group.

  Example 9.9. Changing the list of supplementary groups of a user

  If the user sarah has a primary group sarah2, and belongs to the supplementary group wheel, and you want the user to belong to three more supplementary groups developer, sysadmin, and security, use:

  # usermod -G wheel,developer,sysadmin,security sarah

Verification

• Verify that you set the list of the supplementary groups correct:

  # groups sarah

  The output displays:

  sarah : sarah2 wheel developer sysadmin security

Prerequisites

• Root access

Procedure

• To change the root password, use:

  # passwd

  You are prompted to enter your current password before you can change it.

Prerequisites

• You are able to log in as a non-root user.
• You are a member of the administrative wheel group.

Procedure

• To change or reset the root password as a non-root user that belongs to the wheel group, use:

  $ sudo passwd root

  You are prompted to enter your current non-root password before you can change the root password.

• Read (r)
• Write (w)
• Execute (x)

• User owner (u)
• Group owner (g)
• Other (o)
• All (a)

• + to add the permissions on top of the existing permissions
• - to remove the permissions from the existing permission
• = to remove the existing permissions and explicitly define the new ones

Procedure

• To change the permissions for a file or directory, use:

  $ chmod <level><operation><permission> file-name

  Replace <level> with the level of ownership you want to set the permissions for. Replace <operation> with one of the signs. Replace <permission> with the permissions you want to assign. Replace file-name with the name of the file or directory. For example, to grant everyone the permissions to read, write, and execute (rwx) my-script.sh, use the chmod a=rwx my-script.sh command.

  See Base file permissions for more details.

Verification

• To see the permissions for a particular file, use:

  $ ls -l file-name

  Replace file-name with the name of the file.

• To see the permissions for a particular directory, use:

  $ ls -dl directory-name

  Replace directory-name with the name of the directory.

• To see the permissions for all the files within a particular directory, use:

  $ ls -l directory-name

  Replace directory-name with the name of the directory.

Procedure

• To change the file permissions for an existing file or directory, use:

  $ chmod octal_value file-name

  Replace file-name with the name of the file or directory. Replace octal_value with an octal value. See Base file permissions for more details.

Procedure

• To display the current ACL for a particular file or directory, use:

  $ getfacl file-name

  Replace file-name with the name of the file or directory.

Prerequisites

• root access.

Procedure

• To set the ACL for a file or directory, use:

Procedure

• To display the current value of the umask in symbolic mode, use:

  $ umask -S

• To display the current value of the umask in the octal mode, use:

  $ umask

  Note

  When displaying the umask in octal mode, you may notice it displayed as a four digit number (0002 or 0022). The first digit of the umask represents a special bit (sticky bit, SGID bit, or SUID bit). If the first digit is set to 0, the special bit is not set.

Procedure

• To display the default bash umask for the non-login shell, use:

  $ grep umask /etc/bashrc

  The output returns:

  # By default, we want umask to get set. This sets it for non-login shell.
         umask 002
         umask 022

• To display the default bash umask for the login shell, use:

  $ grep "UMASK" /etc/login.defs

  The output returns:

  # UMASK is also used by useradd(8) and newusers(8) to set the mode for new
  UMASK        022
  # If HOME_MODE is not set, the value of UMASK is used to create the mode.

• Read (r)
• Write (w)
• Execute (x)

• User owner (u)
• Group owner (g)
• Other (o)
• All (a)

• + to add the permissions on top of the existing permissions
• - to remove the permissions from the existing permission

• = to remove the existing permissions and explicitly define the new ones

  Note

  Any permission that is not specified after the equals sign (=) is automatically prohibited.

Procedure

• To set the umask for the current shell session, use:

  $ umask -S <level><operation><permission>

  Replace <level> with the level of ownership you want to set the umask for. Replace <operation> with one of the signs. Replace <permission> with the permissions you want to assign. For example, to set the umask to u=rwx,g=rwx,o=rwx, use umask -S a=rwx.

  See User file-creation mode for more details.

  Note

  The umask is only valid for the current shell session.

Procedure

• To set the umask for the current shell session, use:

  $ umask octal_value

  Replace octal_value with an octal value. See User file-creation mode mask for more details.

  Note

  The umask is only valid for the current shell session.

Prerequisites

• root access

Prerequisites

• root access

Procedure

• Append the line that specifies the octal value of the umask into the .bashrc file for the particular user.

  $ echo 'umask octal_value' >> /home/username/.bashrc

  Replace octal_value with an octal value and replace username with the name of the user. See User file-creation mode mask for more details.

• List all currently loaded service units:

  $ systemctl list-units --type service
  UNIT                     LOAD   ACTIVE SUB     DESCRIPTION
  abrt-ccpp.service        loaded active exited  Install ABRT coredump hook
  abrt-oops.service        loaded active running ABRT kernel log watcher
  abrtd.service            loaded active running ABRT Automated Bug Reporting Tool
  ...
  systemd-vconsole-setup.service loaded active exited  Setup Virtual Console
  tog-pegasus.service            loaded active running OpenPegasus CIM Server
  
  LOAD   = Reflects whether the unit definition was properly loaded.
  ACTIVE = The high-level unit activation state, or a generalization of SUB.
  SUB    = The low-level unit activation state, values depend on unit type.
  
  46 loaded units listed. Pass --all to see loaded but inactive units, too.
  To show all installed unit files use 'systemctl list-unit-files'

  By default, the systemctl list-units command displays only active units. For each service unit file, the command provides an overview of the following parameters:

  UNIT

  The full name of the service unit

  LOAD

  The load state of the configuration file

  ACTIVE or SUB

  The current high-level and low-level unit file activation state

  DESCRIPTION

  A short description of the unit’s purpose and functionality

• List all loaded units regardless of their state, by using the following command with the --all or -a command line option:

  $ systemctl list-units --type service --all

• List the status (enabled or disabled) of all available service units:

  $ systemctl list-unit-files --type service
  UNIT FILE                               STATE
  abrt-ccpp.service                       enabled
  abrt-oops.service                       enabled
  abrtd.service                           enabled
  ...
  wpa_supplicant.service                  disabled
  ypbind.service                          disabled
  
  208 unit files listed.

  For each service unit, this command displays:

  UNIT FILE

  The full name of the service unit

  STATE

  The information whether the service unit is enabled or disabled to start automatically during boot

• Display detailed information about a service unit that corresponds to a system service:

  $ systemctl status <name>.service

  Replace <name> with the name of the service unit you want to inspect (for example, gdm).

  This command displays the following information:

  • The name of the selected service unit followed by a short description
  • One or more fields described in Available service unit information
  • The execution of the service unit: if the unit is executed by the root user

  • The most recent log entries

    Table 12.2. Available service unit information

    Field	Description
    Loaded	Information whether the service unit has been loaded, the absolute path to the unit file, and a note whether the unit is enabled to start during boot.
    Active	Information whether the service unit is running followed by a time stamp.
    Main PID	The process ID and the name of the corresponding system service.
    Status	Additional information about the corresponding system service.
    Process	Additional information about related processes.
    CGroup	Additional information about related control groups (cgroups).

  Example 12.1. Displaying service status

  The service unit for the GNOME Display Manager is named gdm.service. To determine the current status of this service unit, type the following at a shell prompt:

  # systemctl status gdm.service
  gdm.service - GNOME Display Manager
     Loaded: loaded (/usr/lib/systemd/system/gdm.service; enabled)
     Active: active (running) since Thu 2013-10-17 17:31:23 CEST; 5min ago
   Main PID: 1029 (gdm)
     CGroup: /system.slice/gdm.service
             ├─1029 /usr/sbin/gdm
             └─1047 /usr/bin/Xorg :0 -background none -verbose -auth /r...
  
  Oct 17 17:31:23 localhost systemd[1]: Started GNOME Display Manager.

• Verify that a particular service unit is running:

  $ systemctl is-active <name>.service

• Determine whether a particular service unit is enabled to start during boot:

  $ systemctl is-enabled <name>.service

  Note

  Both systemctl is-active and systemctl is-enabled commands return an exit status of 0 if the specified service unit is running or enabled.

• Check what services systemd orders to start before the specified service unit

  # systemctl list-dependencies --after <name>.service

  For example, to view the list of services ordered to start before gdm, enter:

  # systemctl list-dependencies --after gdm.service
  gdm.service
  ├─dbus.socket
  ├─getty@tty1.service
  ├─livesys.service
  ├─plymouth-quit.service
  ├─system.slice
  ├─systemd-journald.socket
  ├─systemd-user-sessions.service
  └─basic.target
  [output truncated]

• Check what services systemd orders to start after the specified service unit:

  # systemctl list-dependencies --before <name>.service

  For example, to view the list of services systemd orders to start after gdm, enter:

  # systemctl list-dependencies --before gdm.service
  gdm.service
  ├─dracut-shutdown.service
  ├─graphical.target
  │ ├─systemd-readahead-done.service
  │ ├─systemd-readahead-done.timer
  │ └─systemd-update-utmp-runlevel.service
  └─shutdown.target
    ├─systemd-reboot.service
    └─final.target
      └─systemd-reboot.service

Prerequisites

• Root access

Procedure

• Start a system service in the current session:

  # systemctl start <name>.service

  Replace <name> with the name of the service unit you want to start (for example, httpd.service).

  Note

  In systemd, positive and negative dependencies between services exist. Starting a particular service may require starting one or more other services (positive dependency) or stopping one or more services (negative dependency).

  When you attempt to start a new service, systemd resolves all dependencies automatically, without explicit notification to the user. This means that if you are already running a service, and you attempt to start another service with a negative dependency, the first service is automatically stopped.

  For example, if you are running the postfix service, and you attempt to start the sendmail service, systemd first automatically stops postfix, because these two services are conflicting and cannot run on the same port.

Prerequisites

• Root access

Procedure

• Stop a system service:

  # systemctl stop <name>.service

  Replace <name> with the name of the service unit you want to stop (for example, bluetooth).

• Stop the selected service unit in the current session and immediately start it again.
• Restart a service unit only if the corresponding service is already running.
• Reload configuration of a system service without interrupting its execution.

Prerequisites

• Root access

Procedure

• Restart a system service:

  # systemctl restart <name>.service

  Replace <name> with the name of the service unit you want to restart (for example, httpd).

  Note

  If the selected service unit is not running, this command starts it too.

• Optional: Restart a service unit only if the corresponding service is already running:

  # systemctl try-restart <name>.service

• Optional: Reload the configuration without interrupting service execution:

  # systemctl reload <name>.service

  Note

  System services that do not support this feature, ignore this command. To restart such services, use the reload-or-restart and reload-or-try-restart commands instead.

Prerequisites

• Root access

• The service you want to enable must not be masked. If you have a masked service, unmask it first:

  # systemctl unmask <name>.service

Procedure

• Enable a service to start at boot:

  # systemctl enable <name>.service

  Replace <name> with the name of the service unit you want to enable (for example, httpd).

• Optional: You can also enable and start a service by using a single command:

  # systemctl enable --now <name>.service

Prerequisites

• Root access

Procedure

• Disable a service to start at boot:

  # systemctl disable <name>.service

  Replace <name> with the name of the service unit you want to disable (for example, bluetooth).

• Optional: If you want to make a service permanently unusable, mask the service:

  # systemctl mask <name>.service

  This command replaces the /etc/systemd/system/name.service file with a symbolic link to /dev/null, rendering the actual unit file inaccessible to systemd.

• The graphical.target unit for starting a graphical session, starts system services such as the GNOME Display Manager (gdm.service) or Accounts Service (accounts-daemon.service), and also activates the multi-user.target unit.
• Similarly, the multi-user.target unit starts other essential system services such as NetworkManager (NetworkManager.service) or D-Bus (dbus.service) and activates another target unit named basic.target.

Prerequisites

• Root access

Prerequisites

• Root access

Procedure

• To enter the rescue mode, change the current target in the current session:

  # systemctl rescue
  
  Broadcast message from root@localhost on pts/0 (Fri 2023-03-24 18:23:15 CEST):
  
  The system is going down to rescue mode NOW!

  Note

  This command is similar to systemctl isolate rescue.target, but it also sends an informative message to all users that are currently logged into the system.

  To prevent systemd from sending a message, enter the following command with the --no-wall command-line option:

  # systemctl --no-wall rescue

• You can schedule a shutdown by using the time argument. This also gives users warning that a system shutdown has been scheduled.
• You can cancel the shutdown.

• Shut down the system and power off the machine at a certain time
• Shut down and halt the system without powering off the machine
• Cancel a pending shutdown

Prerequisites

• Root access

• Specify the time at which you want to shut down the system and power off the machine:

  # shutdown --poweroff hh:mm

  Where hh:mm is the time in the 24-hour time notation. To prevent new logins, the /run/nologin file is created 5 minutes before system shutdown.

  When you use the time argument, you can notify users logged in to the system of the planned shutdown by specifying an optional wall message, for example shutdown --poweroff 13:59 "Attention. The system will shut down at 13:59".

• Shut down and halt the system after a delay, without powering off the machine:

  # shutdown --halt +m

  Where +m is the delay time in minutes. You can use the now keyword as an alias for +0.

• Cancel a pending shutdown:

  # shutdown -c

Prerequisites

• Root access

• Shut down the system and power off the machine:

  # systemctl poweroff

• Shut down and halt the system without powering off the machine:

  # systemctl halt

• After installing new software or updates
• After making changes to system settings
• When troubleshooting system issues

Prerequisites

• Root access

Procedure

• Restart the system:

  # systemctl reboot

Prerequisites

• Root access

• Suspend the system:

  # systemctl suspend

• Hibernate the system:

  # systemctl hibernate

• Hibernate and suspend the system:

  # systemctl hybrid-sleep

• Suspend and then hibernate the system:

  # systemctl suspend-then-hibernate

• To synchronize the system clock with NTP servers
• To synchronize the system clock with a reference clock, for example a GPS receiver
• To synchronize the system clock with a manual time input
• As an NTPv4(RFC 5905) server or peer to provide a time service to other computers in the network

Prerequisites

• You installed NetworkManager on your system and enabled it.
• Root access

• Internet Protocol, IPv4 or IPv6.
• Unix domain socket, which is accessible locally by the root or chrony user.

• activity
• manual list
• rtcdata
• smoothing
• sources
• sourcestats
• tracking
• waitsync

Prerequisites

• Server with the NTS support

Verification

• Verify if the NTS keys were successfully established:

  # chronyc -N authdata
  
  Name/IP address  Mode KeyID Type KLen Last Atmp  NAK Cook CLen
  ================================================================
  time.example.com  NTS     1   15  256  33m    0    0    8  100
  nts.sth1.ntp.se   NTS     1   15  256  33m    0    0    8  100
  nts.sth2.ntp.se   NTS     1   15  256  33m    0    0    8  100

  The KeyID, Type, and KLen should have non-zero values. If the value is zero, check the system log for error messages from chronyd.

• Verify the client is making NTP measurements:

  # chronyc -N sources
  
  MS Name/IP address Stratum Poll Reach LastRx Last sample
  =========================================================
  time.example.com   3        6   377    45   +355us[ +375us] +/-   11ms
  nts.sth1.ntp.se    1        6   377    44   +237us[ +237us] +/-   23ms
  nts.sth2.ntp.se    1        6   377    44   -170us[ -170us] +/-   22ms

  The Reach column should have a non-zero value; ideally 377. If the value rarely gets 377 or never gets to 377, it indicates that NTP requests or responses are getting lost in the network.

Prerequisites

• Server private key in PEM format
• Server certificate with required intermediate certificates in PEM format

Verification

• Perform a quick test from a client machine with the following command:

  $ chronyd -Q -t 3 'server
  
  ntp-server.example.net iburst nts maxsamples 1'
  2021-09-15T13:45:26Z chronyd version 4.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG)
  2021-09-15T13:45:26Z Disabled control of system clock
  2021-09-15T13:45:28Z System clock wrong by 0.002205 seconds (ignored)
  2021-09-15T13:45:28Z chronyd exiting

  The System clock wrong message indicates the NTP server is accepting NTS-KE connections and responding with NTS-protected NTP messages.

• Verify the NTS-KE connections and authenticated NTP packets observed on the server:

  # chronyc serverstats
  
  NTP packets received       : 7
  NTP packets dropped        : 0
  Command packets received   : 22
  Command packets dropped    : 0
  Client log records dropped : 0
  NTS-KE connections accepted: 1
  NTS-KE connections dropped : 0
  Authenticated NTP packets: 7

  If the value of the NTS-KE connections accepted and Authenticated NTP packets field is a non-zero value, it means that at least one client was able to connect to the NTS-KE port and send an authenticated NTP request.