22.3. Kickstart commands for system configuration

incoming - Replace with one or more of the following to allow the specified services through the firewall.

--service= - This option provides a higher-level way to allow services through the firewall. Some services (such as cups, avahi, and so on) require multiple ports to be open or other special configuration in order for the service to work. You can specify each individual port with the --port option, or specify --service= and open them all at once.

Valid options are anything recognized by the firewall-offline-cmd program in the firewalld package. If the firewalld service is running, firewall-cmd --get-services provides a list of known service names.

--xlayouts= - Specify a list of X layouts that should be used as a comma-separated list without spaces. Accepts values in the same format as setxkbmap(1), either in the layout format (such as cz), or in the layout (variant) format (such as cz (qwerty)).

All available layouts can be viewed on the xkeyboard-config(7) man page under Layouts.

--switch= - Specify a list of layout-switching options (shortcuts for switching between multiple keyboard layouts). Multiple options must be separated by commas without spaces. Accepts values in the same format as setxkbmap(1).

Available switching options can be viewed on the xkeyboard-config(7) man page under Options.

Multiple services should be included separated by comma, without any spaces. For example, to disable four services, enter:

services --disabled=auditd,cups,smartd,nfslock

If you include any spaces, Kickstart enables or disables only the services up to the first space. For example:

services --disabled=auditd, cups, smartd, nfslock

That disables only the auditd service. To disable all four services, this entry must include no spaces.

--role= - Set the intended system role. Available values are:

--sla= - Set the Service Level Agreement. Available values are:

--usage= - The intended usage of the system. Available values are:

--iscrypted - If this option is present, the password argument is assumed to already be encrypted. This option is mutually exclusive with --plaintext. To create an encrypted password, you can use python:

$ python -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'

This generates a sha512 crypt-compatible hash of your password by using a random salt.

Files and directories are created with various permissions, dictated by the application used to create the file or directory. For example, the mkdir command creates directories with all permissions enabled. However, applications are prevented from granting certain permissions to newly created files, as specified by the user file-creation mask setting.

The user file-creation mask can be controlled with the umask command. The default setting of the user file-creation mask for new users is defined by the UMASK variable in the /etc/login.defs configuration file on the installed system. If unset, it defaults to 022. This means that by default when an application creates a file, it is prevented from granting write permission to users other than the owner of the file. However, this can be overridden by other settings or scripts.