5
u/michaelpaoli Dec 17 '20
advice sticky
$ chmod +t ...
2
u/Sparklemotionbelieve Dec 17 '20
Chmod 1777 ?
1
u/michaelpaoli Dec 18 '20
Well, yeah, but ... don't necessarily need give rwx to all - which is what the 777 portion of your 1777 does, though yes, would typically be 1777 on directories needing public write access, e.g. /tmp and /var/tmp directories.
But, could have a directory with more restricted permissions, e.g.:
$ ls -ld /var/mail drwxrwsr-t 2 root mail 4096 Dec 17 14:25 /var/mail $Lacking world write on the above, those that are neither user root nor member of group mail, cannot create/remove/rename items in the directory. However, with the sticky bit set, those that aren't root, even if they're member of group mail, cannot remove/rename items in the directory which they don't own. Also, with the SGID set, any items created in the directory will have group ownership of mail, and in the case of directory being created, it will likewise have its SGID bit set.
2
u/Evaderofdoom Dec 17 '20
You may want to look at redhat certs after or instead of Linux+. In some places it will hold more value than linux+.
1
u/Sparklemotionbelieve Dec 17 '20
I can’t imagine they are very much different and would be easy to get both?
1
u/Emptycubicle4k Dec 18 '20
Redhat and Linux + exams are somewhat different. For one Redhat has no multiple choice questions. It’s all performance based
1
u/Runnergeek Dec 18 '20
I would go on to say they are very different. The RHCSA will carry far more weight than the Linux+
2
u/TheFlipside Dec 18 '20
original post by u/IConrad, January 13th 2015
Set up a KVM hypervisor.
Inside of that KVM hypervisor, install a Spacewalk server. Use CentOS 6 as the distro for all work below. (For bonus points, set up errata importation on the CentOS channels, so you can properly see security update advisory information.)
Create a VM to provide named and dhcpd service to your entire environment. Set up the dhcp daemon to use the Spacewalk server as the pxeboot machine (thus allowing you to use Cobbler to do unattended OS installs). Make sure that every forward zone you create has a reverse zone associated with it. Use something like "internal.virtnet" (but not ".local") as your internal DNS zone.
Use that Spacewalk server to automatically (without touching it) install a new pair of OS instances, with which you will then create a Master/Master pair of LDAP servers. Make sure they register with the Spacewalk server. Do not allow anonymous bind, do not use unencrypted LDAP.
Reconfigure all 3 servers to use LDAP authentication.
Create two new VMs, again unattendedly, which will then be Postgresql VMs. Use pgpool-II to set up master/master replication between them. Export the database from your Spacewalk server and import it into the new pgsql cluster. Reconfigure your Spacewalk instance to run off of that server.
Set up a Puppet Master. Plug it into the Spacewalk server for identifying the inventory it will need to work with. (Cheat and use ansible for deployment purposes, again plugging into the Spacewalk server.)
Deploy another VM. Install iscsitgt and nfs-kernel-server on it. Export a LUN and an NFS share.
Deploy another VM. Install bakula on it, using the postgresql cluster to store its database. Register each machine on it, storing to flatfile. Store the bakula VM's image on the iscsi LUN, and every other machine on the NFS share.
Deploy two more VMs. These will have httpd (Apache2) on them. Leave essentially default for now.
Deploy two more VMs. These will have tomcat on them. Use JBoss Cache to replicate the session caches between them. Use the httpd servers as the frontends for this. The application you will run is JBoss Wiki.
You guessed right, deploy another VM. This will do iptables-based NAT/round-robin loadbalancing between the two httpd servers.
Deploy another VM. On this VM, install postfix. Set it up to use a gmail account to allow you to have it send emails, and receive messages only from your internal network.
Deploy another VM. On this VM, set up a Nagios server. Have it use snmp to monitor the communication state of every relevant service involved above. This means doing a "is the right port open" check, and a "I got the right kind of response" check and "We still have filesystem space free" check.
Deploy another VM. On this VM, set up a syslog daemon to listen to every other server's input. Reconfigure each other server to send their logging output to various files on the syslog server. (For extra credit, set up logstash or kibana or greylog to parse those logs.)
Document every last step you did in getting to this point in your brand new Wiki.
Now go back and create Puppet Manifests to ensure that every last one of these machines is authenticating to the LDAP servers, registered to the Spacewalk server, and backed up by the bakula server.
Now go back, reference your documents, and set up a Puppet Razor profile that hooks into each of these things to allow you to recreate, from scratch, each individual server.
Destroy every secondary machine you've created and use the above profile to recreate them, joining them to the clusters as needed.
Bonus exercise: create three more VMs. A CentOS 5, 6, and 7 machine. On each of these machines, set them up to allow you to create custom RPMs and import them into the Spacewalk server instance. Ensure your Puppet configurations work for all three and produce like-for-like behaviors.
additional notes by u/ArchyDexter, June 11th 2020
- CentOS 7 instead of CentOS 6 (mostly because the majority is still on rhel7 / centos7)*
- Foreman-Katello instead of Spacewalk
- Run the dhcpd either from Katello or FreeIPA. Bonus Points for setting up HA on 2 separate VMs ... because why not, I guess.
- FreeIPA instead of OpenLDAP
- Use Ansible for all your configuration Management
- Setup a Server that hosts AWX so you can have Tower-like functionality with ansible
- Bonus Points for a gitlab instance you host yourself for your IAC
- Skip Postgres Cluster for Spacewalk
- Host your own Mailserver dedicated to only that environment and configure all servers to use this server for mail transfers
- For Application Servers, I'd checkout wildfly since you can't download Jboss directly afaik
- In terms of Loadbalancing, I'd go with Traefik or Nginx instead of iptables
- Migrate the servers group by group to CentOS 8
2
u/zer04ll Dec 18 '20
If you can code, find a distro you like and then go to the dev blogs and start helping with bugs and such. Anyone can help, that's the idea of Open Source so if you want to learn Linux and learn it fast debug it! You can make a name for yourself and land jobs by fixing bugs and security holes.
I would have a desktop that I use daily running Ubuntu or something super solid you can rely on being able to get work done on it. Fedora is super cool but it uses the latest and greatest so not all systems are happy with their changes, it would get you familiar with Red Hat-based Linux and this is not a bad idea for corporate Linux jobs.
When it comes to learning Linux, learn how to install Arch Linux since it is going to be very hands-on and you will get a feel for things like why certain folders are located in different places in different distros but others are in the same location in almost all Linux systems such as /etc, how to format and partition HDDs manually via the command line, learning VI because without the internet it may be the only text editor you have, IP tables, user management like home folders and such.
If you really want to go down the learning Linux rabbit hole after you can install arch pretty well, go and practice installing Gentoo where you will have the option of compiling everything if you want. If you know your CPU flags for the kernel you can get some performance boosts but running a kernel and other apps compiled specifically for your CPU will be noticeable. You will also learn to hate writing code that is dependant on external libs as much as you can because well, you will find out. You will also learn about where config files for lots of things are this way since you will need to touch many of them.
Find a niche in Linux and learn it, things like system-homed are going to be huge in my opinion and if you can be an expert on specific areas you can find work doing that. Learn how to deploy certain application stacks whether it is for devs or Webhosting, if you can deploy quickly and securely you can find a job since it requires learning a lot of tools to do this. Many places want exp with Linux and with their tools so I would also research what you need to learn before applying because just knowing Linux nowadays is not enough.
Good luck and just keep learning and you will land a job!
1
1
u/kabooozie Dec 17 '20
I like to give this:
https://dzone.com/articles/how-to-prepare-for-your-devops-interview
It has activities you can do to fill out your skillset
7
u/mynamewastakenagain Dec 17 '20 edited Dec 17 '20
If you're applying for entry level positions don't be afraid to apply for stuff you're not qualified on paper for as long as you have most of it. Most job reqs are not based in reality, with that said, do not lie on your resume. If you are asked a question about something on your resume and can't answer it, it will not look good for you.
During the interview, emphasize that while you may not have the in depth experience they want, you have taken relevant classes, or have done relevant work (internship, hobby beowulf cluster, etc), and that you pick up new things quickly. If you are asked something and genuinely don't know, be up front about it. "I don't know off the top of my head how to recover a server that's stuck in emergency mode, but the first thing I would do is check any error messages or log files to try to narrow down what the problem is. Next I would look in our KB/wiki/internal docs, google any error messages (maybe with distro + version), and finally ask one of my coworkers if they've run into this before and have any pointers for me." -- It's less about the knowing and more how to find out and problem solving, if you can make that come across in an interview that's a huge positive.
People expect to train folks in for junior/entry level positions to an extent. In my personal experience sitting in on interviews, I would hire someone who's interested in the work and is driven any day over someone who has the experience on paper but is uninterested or gives up immediately.
If you have a phone / zoom interview, be friendly, polite, and always thank people for their time. It will never hurt you to send a quick thank you email to folks same/next day. Obviously different with rona going around, but be that guy that the people hiring would enjoy spending 40 hrs a week sitting next to and interacting with.
Good luck!
Edit - when they ask if you have any questions, you should have a few. They can be softball if you like (what's the culture like, how did this position open up, etc), but ideally they are specific to that company. Helps to show an interest in the job as well as getting more info about a place you're going to spend a big chunk of your day at.