CertGrid CertGrid
Concepts·Red Hat Certified System Administrator

RHCSA Practice Lab Machines

Most of EX200 can be practised on one machine. Four objectives cannot: NFS, autofs, remote SSH access and file transfer all need somewhere to connect to. This is the three-machine lab every capture in this path was recorded on, including the spare disk the storage track destroys and rebuilds.

Start Here Guide 2 of 67 Beginner

Written against the versions above. All three run RHEL 10.0. A rebuild of the same series - Rocky, Alma or CentOS Stream 10 - behaves identically for everything in this path except subscription-manager, which none of these guides use because the repositories here are served locally.

The full lab. Most guides use only the first row.
Server NameIP AddressOSRolesCPURAMHDD
RHCSA-A01192.168.0.31RHEL 10.0 (Coughlan)Practice node (graded) - spare /dev/sda2 Core4 GB50 GB + 15 GB
RHCSA-UTIL01192.168.0.32RHEL 10.0 (Coughlan)Utility - repository server and NFS exports2 Core4 GB50 GB
RHCSA-B01192.168.0.33RHEL 10.0 (Coughlan)Practice node 2 - spare /dev/sdb2 Core4 GB50 GB + 15 GB

Before you start

  1. The practice node

    RHCSA-A01 is where almost everything happens. It is a plain RHEL 10 install with a sysadmin account in the wheel group:

    uid=1000(sysadmin) gid=1000(sysadmin) groups=1000(sysadmin),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
sudo: works without a password prompt

    Two details in that line are worth noticing now. wheel is what grants sudo on Red Hat systems, by a rule shipped in /etc/sudoers - that is the mechanism guide 20 takes apart. And context=unconfined_u:... is the SELinux context of your own shell, which is the same kind of label that six of the security objectives are about.

    SELinux is enforcing and firewalld is running, and neither is ever turned off in this path. Turning them off is how a lab stops resembling the exam.

    bash Example session 
    id; sudo -n true && echo "sudo: works without a password prompt"uid=1000(sysadmin) gid=1000(sysadmin) groups=1000(sysadmin),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023sudo: works without a password promptgetenforce; sestatus | grep -E "SELinux status|Current mode|Loaded policy"EnforcingSELinux status:                 enabledLoaded policy name:             targetedCurrent mode:                   enforcing

    Expected resultA wheel-group account and SELinux in enforcing mode.

    Success conditionYou have a machine that behaves like the exam machine.

  2. The utility server, and why packages come from it

    RHCSA-UTIL01 is infrastructure. It serves the RHEL 10 repositories over plain HTTP:

    [rhel10-baseos]
name=RHEL 10 - BaseOS (util http)
baseurl=http://192.168.0.32/rhel10/BaseOS
enabled=1
gpgcheck=1
gpgkey=http://192.168.0.32/rhel10/RPM-GPG-KEY-redhat-release

    That is not a shortcut around a subscription - it is the objective. "Configure access to RPM repositories" asks you to write exactly this kind of file, and having a real server to point at means guide 13 can break it and fix it rather than describe it.

    Note gpgcheck=1 with a gpgkey URL. Leaving GPG checking on is the default and the correct answer; material that tells you to set gpgcheck=0 is teaching you to disable the thing being tested.

    UTIL01 also exports NFS, which is what the file-system track mounts.

    bash Example session 
    sudo dnf repolistUpdating Subscription Management repositories.repo id                          repo namerhel10-appstream                 RHEL 10 - AppStream (util http)rhel10-baseos                    RHEL 10 - BaseOS (util http)cat /etc/yum.repos.d/rhel10.repo[rhel10-baseos]name=RHEL 10 - BaseOS (util http)baseurl=http://192.168.0.32/rhel10/BaseOSenabled=1gpgcheck=1gpgkey=http://192.168.0.32/rhel10/RPM-GPG-KEY-redhat-release [rhel10-appstream]name=RHEL 10 - AppStream (util http)baseurl=http://192.168.0.32/rhel10/AppStreamenabled=1gpgcheck=1gpgkey=http://192.168.0.32/rhel10/RPM-GPG-KEY-redhat-release

    Expected resultTwo enabled repositories, served over HTTP from 192.168.0.32.

    Success conditionYou know where every package in this path comes from.

  3. The second client, and the spare disks

    RHCSA-B01 exists so that ssh, scp, rsync and key-based authentication have somewhere to go. All three machines resolve each other through /etc/hosts and already accept each other's host keys for sysadmin:

    rhcsa-util01   reachable as sysadmin@rhcsa-util01
rhcsa-b01      reachable as sysadmin@rhcsa-b01

    That pre-existing trust is lab infrastructure standing in for a prepared exam environment, and it is stated rather than hidden. It does not do the work of guide 57, which generates a fresh key pair and pushes it with ssh-copy-id over the existing channel - so ssh-keygen, ssh-copy-id and the permission rules that silently break authorized_keys are all captured being run for real.

    The storage track needs a disk it is allowed to destroy, and both practice nodes have one. On A01 it is /dev/sda, 15 GB, carrying no partition table and no filesystem signature at all:

    sda             15G disk
sdb             50G disk
|-sdb2           1G part xfs         /boot
`-sdb3          49G part LVM2_member
  |-rhel-root   45G lvm  xfs         /

    Read that layout carefully before the storage track, because the operating system is on sdb, not sda. The scratch disk sorts first, which is exactly the sort of assumption that destroys a machine.

    bash Example session 
    grep rhcsa /etc/hosts192.168.0.31 rhcsa-a01192.168.0.32 rhcsa-util01192.168.0.33 rhcsa-b01for h in rhcsa-util01 rhcsa-b01; do printf '%-14s ' "$h"; ssh -o BatchMode=yes -o ConnectTimeout=5 $h 'echo reachable as $(id -un)@$(hostname)' 2>&1 | tail -1; donerhcsa-util01   reachable as sysadmin@rhcsa-util01rhcsa-b01      reachable as sysadmin@rhcsa-b01lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTNAME           SIZE TYPE FSTYPE      MOUNTPOINTsda             15G disksdb             50G disk├─sdb1           1M part├─sdb2           1G part xfs         /boot└─sdb3          49G part LVM2_member  ├─rhel-root   45G lvm  xfs         /  └─rhel-swap  3.9G lvm  swap        [SWAP]sr0           1024M romsudo wipefs -n /dev/sda 2>&1 | head -3; echo "--- /dev/sda carries no signatures: it is the scratch disk"--- /dev/sda carries no signatures: it is the scratch disk

    Expected resultBoth other machines reachable, and an empty 15 GB /dev/sda.

    Success conditionYou can follow every objective in the blueprint, including the four that need more than one machine.

Troubleshooting

Official sources

← All RHCSA guides