# LFCS: Operations & Deployment (25%) This section covers **system administration tasks** related to configuring the kernel, managing processes and services, scheduling jobs, managing software, recovering systems, and working with virtualization, containers, and SELinux. --- ## Goals ### Operations Deployment 25% 1) Configure kernel parameters, persistent and non-persistent 2) Diagnose, identify, manage, and troubleshoot processes and services 3) Manage or schedule jobs for executing commands 4) Search for, install, validate, and maintain software packages or repositories 5) Recover from hardware, operating system, or filesystem failures 6) Manage Virtual Machines (libvirt) 7) Configure container engines, create and manage containers 8) Create and enforce MAC using SELinux --- ## 1. Configure Kernel Parameters ### Learn - Difference between **temporary (runtime)** and **persistent** kernel parameters. - Tools: `sysctl`, `/etc/sysctl.conf`, and `/etc/sysctl.d/*.conf`. ### Commands ```bash # Show all parameters sysctl -a # Set a runtime parameter (non-persistent) sudo sysctl net.ipv4.ip_forward=1 # Persist parameter across reboots echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf sudo sysctl -p # Modern persistent configuration (preferred) echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-custom.conf sudo sysctl --system ``` --- ### Common sysctl Parameters to Know #### Networking ##### IP forwarding - `net.ipv4.ip_forward` - `net.ipv6.conf.all.forwarding` ##### Reverse Path Filtering (security) - `net.ipv4.conf.all.rp_filter` ##### Redirects / Source Routing (disable for security) - `net.ipv4.conf.all.accept_redirects = 0` - `net.ipv6.conf.all.accept_redirects = 0` - `net.ipv4.conf.all.send_redirects = 0` - `net.ipv4.conf.all.accept_source_route = 0` ##### TCP stack tuning - `net.ipv4.tcp_syncookies = 1` - `net.core.somaxconn` - `net.core.netdev_max_backlog` - `net.ipv4.tcp_fin_timeout` - `net.ipv4.tcp_keepalive_*` - `net.ipv4.ip_local_port_range` #### Memory & VM ##### Swappiness - `vm.swappiness` ##### Cache pressure - `vm.vfs_cache_pressure` ##### Memory overcommit - `vm.overcommit_memory` - `vm.overcommit_ratio` #### Kernel Stability ##### File handles - `fs.file-max` ##### Kernel panic options - `kernel.panic` - `kernel.panic_on_oops` #### Networking Security ##### Disable IPv6 - `net.ipv6.conf.all.disable_ipv6 = 1` ##### ARP filtering - `net.ipv4.conf.all.arp_filter` #### Logging & Debugging ##### printk log levels - `kernel.printk` --- #### Essential LFCS Knowledge You must be able to: - View kernel parameters - Modify runtime parameters - Apply persistent configurations - Reload sysctl configs Most common parameters for the exam: - `net.ipv4.ip_forward` - `vm.swappiness` - `fs.file-max` - `kernel.hostname` ### Exercises 1. Enable IP forwarding temporarily and verify: ```bash sysctl net.ipv4.ip_forward ``` 2. Make IP forwarding permanent using `/etc/sysctl.d/`. --- ## 2. Manage Processes and Services ### Learn - Identify, monitor, and troubleshoot processes. - Manage services with **systemd**. ### Commands ```bash # Process management ps aux | grep top htop # if installed kill kill -9 # Systemd service management systemctl status systemctl start systemctl stop systemctl enable systemctl disable systemctl restart systemctl reload # View logs for a service journalctl -u # List active services systemctl list-units --type=service ``` ### Exercises 1. Find the PID of a running process and stop it gracefully. 2. Enable and start a service at boot time. 3. View service logs with `journalctl`. --- ## 3. Manage Scheduled Jobs ### Learn - Use **cron** for recurring tasks (user or system-level). - Use **at** for one-time scheduled jobs. ### Commands ```bash # List user cron jobs crontab -l # Edit user cron jobs crontab -e # System-wide cron directories ls /etc/cron.daily/ ls /etc/cron.weekly/ # At job example echo "touch /tmp/testfile" | at now + 1 minute atq # list scheduled at jobs atrm ``` ### Exercises 1. Schedule a script to run every day at 3 AM. 2. Schedule a one-time task using `at`. 3. Check `/etc/cron.daily/` for system maintenance tasks. --- ## 4. Software Management ### Learn - Install, update, and remove software using your system’s package manager. - Manage repositories and dependencies. ### Commands ```bash # Debian/Ubuntu sudo apt update sudo apt install sudo apt remove dpkg -l | grep dpkg -s # Manage repositories sudo add-apt-repository ppa: cat /etc/apt/sources.list.d/*.list # RHEL/CentOS sudo yum install sudo yum remove rpm -qa | grep rpm -qi # Repository management yum repolist ``` ### Exercises 1. Install `curl` and verify installation. 2. Remove a package and confirm removal. 3. List all enabled repositories. --- ## 5. Recover from Hardware, OS, or Filesystem Failures ### Learn - Boot into rescue or recovery mode. - Use Live CD/USB for system repair. - Use `fsck` to check and repair filesystems. ### Commands ```bash # Filesystem check (unmounted partition) sudo fsck /dev/sdX1 # Mount for inspection or repair sudo mount /dev/sdX1 /mnt # Kernel/hardware diagnostics dmesg | less journalctl -xb # Disk health (if smartmontools installed) sudo smartctl -a /dev/sdX ``` ### Exercises 1. Simulate a corrupted filesystem on a test partition and repair it using `fsck`. 2. Boot into rescue mode and inspect partitions with `lsblk`. 3. Review logs with `journalctl -xb`. --- ## 6. Virtual Machines (libvirt) ### Learn - Manage VMs using **libvirt** tools (`virsh`, `virt-install`). - Control VM lifecycle and connect via console. ### Commands ```bash virsh list --all virsh start virsh shutdown virsh destroy # Force shutdown virsh console # Virtual network management virsh net-list virsh net-start default ``` ### Exercises 1. Create a VM using `virt-install`. 2. Start, stop, and connect to the VM via console. 3. Verify virtual networks using `virsh net-list`. --- ## 7. Containers (Docker / Podman) ### Learn - Create, start, stop, and manage containers and images. - Understand container **networking** and **volumes**. ### Commands ```bash # Docker examples docker run -it --name mycontainer ubuntu bash docker ps docker stop mycontainer docker rm mycontainer docker images docker rmi # Volumes and networks docker volume ls docker network ls # Podman equivalents (rootless alternative) podman run -it --name mycontainer ubuntu bash podman ps podman images podman rm -a ``` ### Exercises 1. Create an Ubuntu container and install `curl` inside it. 2. Commit the container as a new image: ```bash docker commit mycontainer ubuntu-with-curl ``` 3. Remove the container and image. 4. List container networks and volumes. --- ## 8. SELinux (Mandatory Access Control) ### Learn - SELinux modes: **enforcing**, **permissive**, **disabled**. - Troubleshoot SELinux denials and manage contexts. ### Commands ```bash # Check SELinux status sestatus # Change mode temporarily sudo setenforce 0 # permissive sudo setenforce 1 # enforcing # Check logs for denials ausearch -m avc # Check and restore file contexts ls -Z /path restorecon -Rv /path # Manage custom contexts sudo semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" sudo restorecon -Rv /web ``` ### Exercises 1. Switch SELinux to permissive mode and verify. 2. Trigger an SELinux denial (e.g., mislabel file) and view logs with `ausearch`. 3. Restore a file’s correct SELinux context. --- ## 🧪 Exam Tips - Practice all commands **without `sudo`**, as exam environments often run as root. - Understand the difference between **runtime vs persistent** configurations: - Kernel parameters (`sysctl`) - SELinux modes - Service enablement - Use **lab VMs** to safely experiment with: - Containers and virtual machines - Cron jobs and recovery procedures - Review logs regularly (`journalctl`, `dmesg`, `ausearch`). ---