Administering RHEL by using the GNOME desktop environment

Procedure

1. Configure a firewall rule to enable access to the server:

   $ sudo firewall-cmd --permanent --add-port=3389/tcp
   success

   Note

   If you also configure remote login on the server, the port number for desktop sharing changes. In that case, modify the firewall rule to add port number 3390 instead.

2. Reload firewall rules:

   $ sudo firewall-cmd --reload
   success

3. Open Settings in GNOME.
4. Open the System screen.

5. Select Remote Desktop.

   

6. Set Desktop Sharing to On.
7. Optional: To allow the remote user to control your screen, set Remote Control to On.

8. Set a user name and a password in the Login Details section. Remote clients must enter these credentials when connecting to your desktop from a remote client.

   

Procedure

1. Configure a firewall rule to enable access to the server:

   $ sudo firewall-cmd --permanent --add-port=3389/tcp
   success

2. Reload firewall rules:

   $ sudo firewall-cmd --reload
   success

3. Open Settings in GNOME.
4. Open the System screen.

5. Select Remote Desktop.

   

6. Click the Remote Login tab in the menu header.

7. Set Remote Login to On to enable screen sharing.

   

8. Set a user name and a password in the Login Details section. Remote clients must enter these credentials when connecting to this system’s login screen from a remote client.

Procedure

1. On the client, launch the Connections application.

2. Click the + button in the top bar to open a new connection.

   

3. Enter the IP address of the server.

4. Choose the connection type based on the operating system you want to connect to:

   Remote Desktop Protocol (RDP)

   Use RDP for connecting to Windows and RHEL 10 servers.

   Virtual Network Computing (VNC)

   Use VNC for connecting to servers with RHEL 9 and previous versions.

5. Click Connect.

Verification

1. On the client, check that you can see the shared server desktop.

2. On the server, a screen sharing indicator appears on the right side of the top panel:

   

   You can control screen sharing in the System menu of the server.

Procedure

1. Configure a firewall rule to enable access to the server:

   $ sudo firewall-cmd --permanent --add-port=3389/tcp
   success

2. Reload firewall rules:

   $ sudo firewall-cmd --reload
   success

3. Create a directory for the self-signed TLS certificate:

   $ mkdir -p ~/.local/share/gnome-remote-desktop

4. Generate a self-signed TLS certificate for the RDP service:

   $ winpr-makecert -silent -rdp -path ~/.local/share/gnome-remote-desktop tls

5. Configure GNOME Remote Desktop by using RDP:

   $ grdctl --headless rdp set-tls-key ~/.local/share/gnome-remote-desktop/tls.key
   $ grdctl --headless rdp set-tls-cert ~/.local/share/gnome-remote-desktop/tls.crt
   $ grdctl --headless rdp set-credentials
   $ grdctl --headless rdp enable

   Refer gdrctl man page for more information.

6. Enable a headless server for single-user service:

   $ systemctl --user enable --now gnome-remote-desktop-headless.service

7. Start the headless GNOME session persistently for a single user as root:

   $ sudo systemctl enable --now gnome-headless-session@<your_username>.service

   Replace <your_username> with the username of the user for whom you want to start the headless GNOME session.

8. Make <your_username>.service persistent across system reboot:

   $ sudo systemctl set-default graphical.target

Procedure

1. Create a directory for the self-signed TLS certificate as the gnome-remote-desktop user:

   $ sudo -u gnome-remote-desktop mkdir -p ~gnome-remote-desktop/.local/share/gnome-remote-desktop

2. Generate a self-signed TLS certificate for the RDP service as the gnome-remote-desktop user:

   $ sudo -u gnome-remote-desktop winpr-makecert -silent -rdp -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls

3. Connecting to a remote desktop through RDP for multiple users:

   $ sudo grdctl --system rdp set-tls-key ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key
   $ sudo grdctl --system rdp set-tls-cert ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt
   $ sudo grdctl --system rdp set-credentials
   $ sudo grdctl --system rdp enable

   Refer gdrctl man page for more information.

4. Enable the system remote login service and GDM:

   $ sudo systemctl enable --now gdm
   $ sudo systemctl enable --now gnome-remote-desktop.service

5. Make gnome-remote-desktop.service persistent across system reboot:

   $ sudo systemctl set-default graphical.target

Procedure

1. Launch the application remotely through waypipe and SSH.

   [local-user]$ waypipe -c lz4=9 ssh <remote-server> <application-binary>
   
   The authenticity of host '<remote-server> (<192.168.122.120>)' can't be established.
   ECDSA key fingerprint is SHA256:<uYwFlgtP/2YABMHKv5BtN7nHK9SHRL4hdYxAPJVK/kY>.
   Are you sure you want to continue connecting (yes/no/[fingerprint])?

2. Confirm that a server key is valid by checking its fingerprint.

3. Continue connecting by typing yes.

   Warning: Permanently added '<remote-server>' (ECDSA) to the list of known hosts.

4. When prompted, type the server password.

   remote-user's password:
   [remote-user]$

Procedure

1. Log in to the server by using SSH:

   [<local_user>]$ ssh -X -Y <remote_server>
   The authenticity of host '<remote_server> (192.168.122.120)' can't be established.
   ECDSA key fingerprint is SHA256:uYwFlgtP/2YABMHKv5BtN7nHK9SHRL4hdYxAPJVK/kY.
   Are you sure you want to continue connecting (yes/no/[fingerprint])?

2. Confirm that a server key is valid by checking its fingerprint.

   Note

   If you plan to log in to the server on a regular basis, add the user’s public key to the server by using the ssh-copy-id command.

3. Confirm by typing yes.

   Warning: Permanently added '<remote_server>' (ECDSA) to the list of known hosts.

4. When prompted, type the password of the user on the remote server:

   <remote_user>'s password:
   [<remote_user> ~]$

5. Launch the application from the command line:

   [<remote_user>]$ <application-binary>

   Tip

   To skip the intermediate terminal session, use the following command:

   [<local_user>]$ ssh user@server -X -Y -C <application-binary>

Procedure

1. Install basic X11 packages:

   # dnf install xorg-x11-xauth xorg-x11-fonts-\* dbus-x11

   Note

   Your applications might require additional graphical libraries.

2. Enable the X11Forwarding option in the /etc/ssh/sshd_config configuration file:

   X11Forwarding yes

   The option is disabled by default in RHEL.

3. Restart the sshd service:

   # systemctl restart sshd.service

Procedure

1. List all local devices recognized by the libwacom database:

   $ libwacom-list-local-devices

   Make sure that your device is recognized in the output.

   If your device is not listed, the device is missing from the libwacom database. However, the device might still be supported by the kernel if it is listed in the /proc/bus/input/devices file.

2. Optional: Check whether the device is supported at all by entering the libwacom-list-devices command, provided in the libwacom-utils package. This command lists all devices supported by your installed version of libwacom.

3. Check whether the definition file is available in the /usr/share/libwacom/ directory.

   To use screen mapping correctly, support for your tablet must be included in the libwacom database.

   Important

   A common indicator that a device is not supported by libwacom is that it works normally in a GNOME session, but the device is not correctly mapped to the screen.

4. If the definition file for your device is not available in /usr/share/libwacom/, you have these options:

   • Find the definition file in the linuxwacom/libwacom upstream repository and copy the file to your system.
   • Find a similar device in the linuxwacom/libwacom upstream repository and modify the definition file accordingly.

5. Add and install the definition file with the .tablet suffix:

   # cp <tablet_definition_file>.tablet /etc/libwacom

   After the file is installed, the device is part of the libwacom database. The device is then available through libwacom-list-local-devices.

Procedure

1. List local devices to display their IDs:

   $ libwacom-list-local-devices
   devices:
   - name: 'Wacom Intuos Pro M'
     bus: 'usb'
     vid: '0x056a'
     pid: '0x0357'
     nodes:
     - /dev/input/event6: 'Wacom Co.,Ltd. Wacom Intuos Pro M Pen'
     - /dev/input/event7: 'Wacom Co.,Ltd. Wacom Intuos Pro M Pad'
     styli:
      - id: 0x100802

   If a device does not support unique serial numbers, the stylus is identified with a generic identifier based on the tablet’s VID and PID:

   org.gnome.desktop.peripherals.tablet.stylus:/org/gnome/desktop/peripherals/tablet/stylus/default-<vid>:<pid>/

2. Determine the serial number for the particular device:

   # libwacom-show-stylus /dev/input/event6
   Please put tool in proximity
   Tool id 0x100802 serial 0x2380369c in-proximity: False

3. List the available settings for the selected device:

   • For a tablet:

     $ gsettings list-recursively org.gnome.desktop.peripherals.tablet:/org/gnome/desktop/peripherals/tablet/<vid>:<pid>/
     org.gnome.desktop.peripherals.tablet area [0.0, 0.0, 0.0, 0.0]
     org.gnome.desktop.peripherals.tablet keep-aspect false
     org.gnome.desktop.peripherals.tablet left-handed false
     org.gnome.desktop.peripherals.tablet mapping 'absolute'
     org.gnome.desktop.peripherals.tablet output ['', '', '']

     Replace <vid> and <pid> with the IDs of your device.

   • For a stylus:

     $ gsettings list-recursively org.gnome.desktop.peripherals.tablet.stylus:/org/gnome/desktop/peripherals/tablet/stylus/<serial_number>/
     org.gnome.desktop.peripherals.tablet.stylus button-action 'default'
     org.gnome.desktop.peripherals.tablet.stylus button-keybinding ''
     org.gnome.desktop.peripherals.tablet.stylus eraser-pressure-curve [0, 0, 100, 100]
     org.gnome.desktop.peripherals.tablet.stylus eraser-pressure-range [0, 100]
     org.gnome.desktop.peripherals.tablet.stylus pressure-curve [0, 0, 100, 100]
     org.gnome.desktop.peripherals.tablet.stylus pressure-range [0, 100]
     org.gnome.desktop.peripherals.tablet.stylus secondary-button-action 'default'
     org.gnome.desktop.peripherals.tablet.stylus secondary-button-keybinding ''
     org.gnome.desktop.peripherals.tablet.stylus tertiary-button-action 'default'
     org.gnome.desktop.peripherals.tablet.stylus tertiary-button-keybinding ''

     Replace <serial_number> with the ID of your device.

4. Set an option to the value that you want:

   $ gsettings set <schema_name>:<path> <key> <value>

   Replace:

   • <schema_name>:<path> with the schema and path to your device.
   • <key> with the option you want to change.
   • <value> with the value you want to set.

   For example:

   $ gsettings set org.gnome.desktop.peripherals.tablet.stylus:/org/gnome/desktop/peripherals/tablet/stylus/0x2380369c pressure-range "[0, 75]"

Procedure

1. Open the Files application.

2. Click Other Locations in the side bar.

   The window lists all connected storage volumes and all network shares that are publicly available on your local area network.

   If you can see the volume or network share in this list, mount it by clicking the item.

   If you want to connect to a different network share, use the following steps.

3. Enter the GVFS URI string to the network share in the Enter server address field.
4. Press Connect.
5. If the dialog asks you for login credentials, enter your name and password into the relevant fields.
6. When the mounting process finishes, you can browse the files on the volume or network share.

Procedure

1. Open the Files application.
2. In the side bar, click the Unmount (⏏) icon next to the chosen mount.
3. Wait until the mount disappears from the side bar or a notification about the safe removal appears.

Procedure

1. Create an empty file:

   $ touch /tmp/myfile

2. View the metadata of this file:

   $ gio info -a 'metadata::*' /tmp/myfile
   uri: file:///tmp/myfile
   attributes:

3. Set a string to this file:

   $ gio set -t string /tmp/myfile 'metadata::mynote' 'Please remember to delete this file!'

4. View the metadata:

   $ gio info -a 'metadata::*' /tmp/myfile
   uri: file:///tmp/myfile
   attributes:
     metadata::mynote: Please remember to delete this file!

Procedure

1. Open Settings.
2. Click Online Accounts.
3. Select Enterprise Authentication (Kerberos).
4. In the Principal field, enter your domain username in the username@domain.com format.
5. Click Connect.

6. Enter your enterprise password and click Continue.

   Depending on the configuration of your domain, you might be asked for the domain administrator credentials.

Procedure

1. Open Settings.
2. Open the System screen.
3. Click Users.
4. Click Add Enterprise Login
5. Enter the domain, username, and password for your Enterprise account.

6. Click Add.

   Depending on the domain configuration, you might need to enter administrator credentials.

Procedure

1. Create the /etc/dconf/db/gdm.d/01-override-logo configuration file with the following content:

   [org/gnome/login-screen]
   logo=<path_to_logo>

   Replace <path_to_logo> with the full path to the image file that you want to use as the login screen logo.

2. Update the system databases:

   # dconf update

Verification

1. Log out or otherwise switch to the login screen.
2. Check if the selected logo is displayed.

3. If the logo does not update, restart GDM:

   # systemctl restart gdm

   Warning

   Restarting the gdm service terminates all currently running GNOME sessions of all desktop users who are logged in. This might result in users losing unsaved data.

Procedure

1. Install the gnome-shell-extension-classification-banner package:

   # dnf install gnome-shell-extension-classification-banner

2. Create the 99-class-banner file at either of the following locations:

   • To configure a notification at the login screen, create /etc/dconf/db/gdm.d/99-class-banner.
   • To configure a notification in the user session, create /etc/dconf/db/local.d/99-class-banner.

3. Enter the following configuration in the created file:

   [org/gnome/shell]
   enabled-extensions=['classification-banner@gnome-shell-extensions.gcampax.github.com']
   
   [org/gnome/shell/extensions/classification-banner]
   background-color='<rgba(value, value, value, value)>'
   message='<your_message>'
   top-banner=<true_or_false>
   bottom-banner=<true_or_false>
   system-info=<true_or_false>
   color='<rgb(value, value, value)>'

   To enable multiple extensions, specify all of them in the enabled-extensions list. For example:

   enabled-extensions=['heads-up-display@gnome-shell-extensions.gcampax.github.com', 'classification-banner@gnome-shell-extensions.gcampax.github.com']

4. Update the dconf database:

   # dconf update

5. Reboot the system.

Procedure

1. Install the gnome-shell-extension-heads-up-display package:

   # dnf install gnome-shell-extension-heads-up-display

2. Create the 99-hud-message file at either of the following locations:

   • To configure a notification at the login screen, create /etc/dconf/db/gdm.d/99-hud-message.
   • To configure a notification in the user session, create /etc/dconf/db/local.d/99-hud-message.

3. Enter the following configuration in the created file:

   [org/gnome/shell]
   enabled-extensions=['heads-up-display@gnome-shell-extensions.gcampax.github.com']
   
   [org/gnome/shell/extensions/heads-up-display]
   message-heading="<security_classification_title>"
   message-body="<security_classification_description>"
   # The following options control when the notification appears:
   show-when-locked=true
   show-when-unlocking=true
   show-when-unlocked=true

   Replace the following values with text that describes the security classification of your system:

   Security classification title

   A short heading that identifies the security classification.

   Security classification description

   A longer message that provides additional details, such as references to various guidelines.

   Warning

   This configuration overrides similar configuration files that also enable an extension, such as Enabling system security classification banners.

   To enable multiple extensions, specify all of them in the enabled-extensions list. For example:

   enabled-extensions=['heads-up-display@gnome-shell-extensions.gcampax.github.com', 'classification-banner@gnome-shell-extensions.gcampax.github.com']

4. Update the dconf database:

   # dconf update

5. Reboot the system.

Procedure

1. Open the /etc/systemd/logind.conf configuration file.
2. Look for the line that says HandleLidSwitch=suspend.
3. If the line starts with the # symbol, remove it to enable the setting.

4. Replace suspend with one of the following options:

   • poweroff to shut down the computer.
   • lock to lock the screen.
   • ignore to do nothing.

   For example, to lock the screen upon closing the lid, use this setting:

   HandleLidSwitch=lock

5. Save your changes and close the editor.

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-logout keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable user logout
   disable-log-out=true
   
   # Disable user switching
   disable-user-switching=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock user logout
   /org/gnome/desktop/lockdown/disable-log-out
   
   # Lock user switching
   /org/gnome/desktop/lockdown/disable-user-switching

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-printing keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable printing
   disable-printing=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock printing
   /org/gnome/desktop/lockdown/disable-printing

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-filesaving keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable saving files on disk
   disable-save-to-disk=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock file saving
   /org/gnome/desktop/lockdown/disable-save-to-disk

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-lockdown keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   
   # Disable command prompt
   disable-command-line=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock command prompt
   /org/gnome/desktop/lockdown/disable-command-line

3. Apply the changes to the system databases:

   # dconf update

4. Log out and log in again for the changes to take effect.

Procedure

1. Copy the /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy file under the /etc/share/polkit-1/actions/ directory:

   # cp /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy /etc/share/polkit-1/actions/org.freedesktop.udisks2.policy

2. In the /etc/polkit-1/actions/org.freedesktop.udisks2.policy file, delete any actions that you do not need and add the following lines:

   <action id="org.freedesktop.udisks2.modify-device">
     <message>Authentication is required to modify the disks settings</message>
        <defaults>
           <allow_any>no</allow_any>
           <allow_inactive>no</allow_inactive>
           <allow_active>yes</allow_active>
         </defaults>
    </action>

   If you want to restrict access only to the root user, replace <allow_any>no</allow_any> with <allow_any>auth_admin</allow_any>.

Procedure

1. Use one of the approaches described in Launching applications to start the Settings application.

   Moreover, you can also start the Settings application from the system menu in the upper right corner by clicking on the gear button.

   

2. When the Settings application GUI is displayed, go to Printers.

   Figure 13.1. GNOME Control center configuration tool

   

Procedure

1. Open the Printers dialog.

   

2. Click Unlock and authenticate.

   

3. Select one of the available printers (including also network printers), or enter printer IP address or the hostname of a printer server.

   
   

4. Confirm your selection by clicking Add in the top right corner.

   

Procedure

1. Click the settings (⚙️) button on the right to display a settings menu for the selected printer:

   
2. Click Printing Options → Test Page.

Procedure

1. Download the extension archive from the GNOME Extensions website.

2. Extract the archive into the /usr/share/gnome-shell/extensions/ directory:

   # unzip -q <extension-file.zip> -d /usr/share/gnome-shell/extensions/

   Replace <extension-file.zip> with the name of the extension zip file.

3. Adjust the permissions to ensure that the extension files are readable and executable by everyone:

   # chmod -R 755 /usr/share/gnome-shell/extensions/<extension-directory>/

   Replace <extension-directory> with the name of the extension directory.

4. Create a new /etc/dconf/db/local.d/00-extensions file with the following content:

   [org/gnome/shell]
   enabled-extensions=['myextension1@myname.example.com', 'myextension2@myname.example.com']

   Replace the UUIDs (myextension1@myname.example.com, myextension2@myname.example.com) with the ones you want to enable. You can find the UUID of an extension on its GNOME Shell extensions website page.

5. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a new /etc/dconf/db/local.d/00-extensions file with the following content:

   [org/gnome/shell]
   # The GNOME Shell does not load extensions that are not listed in the `org.gnome.shell.enabled-extensions` file, preventing the user from using them.
   
   enabled-extensions=['myextension1@myname.example.com', 'myextension2@myname.example.com']
   development-tools=false

   Replace the UUIDs (myextension1@myname.example.com, myextension2@myname.example.com) with the ones you want to enable. You can find the UUID of an extension on its GNOME Shell extensions website page.

2. To prevent users from changing these settings, create a new /etc/dconf/db/local.d/locks/extensions file with the following content:

   /org/gnome/shell/enabled-extensions
   /org/gnome/shell/development-tools

3. Apply the changes to the system databases:

   # dconf update