Prerequisites

• You have installed the RHEL 9 web console.
• You have enabled the cockpit service.

• Your user account is allowed to log in to the web console.

  For instructions, see Installing and enabling the web console.

Next steps

• After clicking Toggle filters to expand the menu, you can use the Pause button to pause new log entries from appearing in the log view. After you resume new log entries, the web console loads all log entries that were reported after you used the Pause button.
• You can filter the logs by time, priority, or identifier. For more information, see Filtering logs in the web console.

Prerequisites

• You have installed the RHEL 9 web console.
• You have enabled the cockpit service.

• Your user account is allowed to log in to the web console.

  For instructions, see Installing and enabling the web console.

• Time: This drop-down menu contains predefined searches for different time ranges of your search.
• Priority: This drop-down menu provides options for different priority levels. It corresponds to the journalctl --priority option. The default priority value is Error and above. It is set every time you do not specify any other priority.
• Identifier: In this drop-down menu, you can select an identifier that you want to filter. Corresponds to the journalctl --identifier option.

Prerequisites

• You have installed the RHEL 9 web console.
• You have enabled the cockpit service.

• Your user account is allowed to log in to the web console.

  For instructions, see Installing and enabling the web console.

Procedure

• Create a new user account:

  # useradd example.user

  Copy code to clipboard

• Assign a new password to a user account belonging to example.user:

  # passwd example.user

  Copy code to clipboard

• Add a user to a group:

  # usermod -a -G example.group example.user

  Copy code to clipboard

Prerequisites

• You have Root access

Procedure

• Add a new user, use:

  # useradd <options> <username>

  Copy code to clipboard

  Replace options with the command-line options for the useradd command, and replace username with the name of the user.

  Example 7.1. Adding a new user

  To add the user sarah with user ID 5000, use:

  # useradd -u 5000 sarah

  Copy code to clipboard

Verification

• To verify the new user is added, use the id utility.

  # id sarah

  Copy code to clipboard

  The command returns:

  uid=5000(sarah) gid=5000(sarah) groups=5000(sarah)

  Copy code to clipboard

Prerequisites

• You have Root access

Procedure

• To add a new group, use:

  # groupadd options group-name

  Copy code to clipboard

  Replace options with the command-line options for the groupadd command, and replace group-name with the name of the group.

  Example 7.2. Adding a new group

  To add the group sysadmins with group ID 5000, use:

  # groupadd -g 5000 sysadmins

  Copy code to clipboard

Verification

• To verify the new group is added, use the tail utility.

  # getent group sysadmin

  Copy code to clipboard

  The command returns:

  sysadmins:x:5000:

  Copy code to clipboard

Prerequisites

• You have root access

Procedure

• To add a group to the supplementary groups of the user, use:

  # usermod --append -G <group_name> <username>

  Copy code to clipboard

Verification

• To verify the new groups is added to the supplementary groups of the user sysadmin, use:

  # groups <username>

  Copy code to clipboard

Prerequisites

• You have Root access

Verification

• To verify the correctness of set permissions, use:

  # ls -ld <directory>

  Copy code to clipboard

  The command returns:

  *drwx__rws__r-x.* 2 root _group-name_ 6 Nov 25 08:45 _directory-name_

  Copy code to clipboard

• You have root access.
• The user currently exists.

• Ensure that the user is logged out:

  # loginctl terminate-user user-name

  Copy code to clipboard

• To only remove the user account, and not the user data:

  # userdel user-name

  Copy code to clipboard

• To remove the user, the data, and the metadata:

  1. Remove the user, their home directory, their mail spool, and their SELinux user mapping:

     # userdel --remove --selinux-user user-name

     Copy code to clipboard

  2. Remove additional user metadata:

     # rm -rf /var/lib/AccountsService/users/user-name

     Copy code to clipboard

     This directory stores information that the system needs about the user before the home directory is available. Depending on the system configuration, the home directory might not be available until the user authenticates at the login screen.

     Important

     If you do not remove this directory and you later recreate the same user, the recreated user will still use certain settings inherited from the removed user.

Prerequisites

• You have installed the RHEL 9 web console.
• You have enabled the cockpit service.

• Your user account is allowed to log in to the web console.

  For instructions, see Installing and enabling the web console.

Verification

• You can view the new account in the Accounts settings and use its credentials to connect to the system.

Prerequisites

• You have installed the RHEL 9 web console.
• You have enabled the cockpit service.

• Your user account is allowed to log in to the web console.

  For instructions, see Installing and enabling the web console.

Procedure

• Display the names of the primary and any supplementary group of a user:

  $ groups user-name

  Copy code to clipboard

  If you do not provide a user name, the command displays the group membership for the current user. The first group is the primary group followed by the optional supplementary groups.

  Example 7.3. Listing of groups for user sarah:

  $ groups sarah

  Copy code to clipboard

  The output displays:

  sarah : sarah wheel developer

  Copy code to clipboard

  User sarah has a primary group sarah and is a member of supplementary groups wheel and developer.

Procedure

• Change the primary group of a user:

  # usermod -g <group-name> <user-name>

  Copy code to clipboard
  Note

  When you change a user’s primary group, the command also automatically changes the group ownership of all files in the user’s home directory to the new primary group. You must fix the group ownership of files outside of the user’s home directory manually.

• Verify that you changed the primary group of the user:

  $ groups <username>

  Copy code to clipboard

Prerequisites

• You have root access

Procedure

• To add a group to the supplementary groups of the user, use:

  # usermod --append -G <group_name> <username>

  Copy code to clipboard

Verification

• To verify the new groups is added to the supplementary groups of the user sysadmin, use:

  # groups <username>

  Copy code to clipboard

Prerequisites

• You have root access

Procedure

• Remove a user from a supplementary group:

  # gpasswd -d <user-name> <group-name>

  Copy code to clipboard

Verification

• Verify that you removed the user sarah from the secondary group developers:

  $ groups <username>

  Copy code to clipboard

Prerequisites

• You have root access.
• The supplementary groups must exist.

Procedure

• Overwrite a list of user’s supplementary groups:

  # usermod -G <group-names> <username>

  Copy code to clipboard

  To add the user to several supplementary groups at once, separate the group names using commas and no intervening spaces. For example: wheel,developer.

  Important

  If the user is currently a member of a group that you do not specify, the command removes the user from the group.

Verification

• Verify that you set the list of the supplementary groups correct:

  # groups <username>

  Copy code to clipboard

Prerequisites

• You have Root access

Procedure

• To change the root password, use:

  # passwd

  Copy code to clipboard

  You are prompted to enter your current password before you can change it.

Prerequisites

• You are able to log in as a non-root user.
• You have permissions to execute commands as root by using sudo.

Procedure

• To change or reset the root password as a non-root user that belongs to the wheel group, use:

  $ sudo passwd root

  Copy code to clipboard

  You are prompted to enter your current non-root password before you can change the root password.

• Read (r)
• Write (w)
• Execute (x)

• User owner (u)
• Group owner (g)
• Other (o)
• All (a)

• + to add the permissions on top of the existing permissions
• - to remove the permissions from the existing permission
• = to remove the existing permissions and explicitly define the new ones

Procedure

• To change the permissions for a file or directory, use:

  $ chmod <level><operation><permission> file-name

  Copy code to clipboard

  Replace <level> with the level of ownership you want to set the permissions for. Replace <operation> with one of the signs. Replace <permission> with the permissions you want to assign. Replace file-name with the name of the file or directory. For example, to grant everyone the permissions to read, write, and execute (rwx) my-script.sh, use the chmod a=rwx my-script.sh command.

  See Base file permissions for more details.

Verification

• To see the permissions for a particular file, use:

  $ ls -l file-name

  Copy code to clipboard

  Replace file-name with the name of the file.

• To see the permissions for a particular directory, use:

  $ ls -dl directory-name

  Copy code to clipboard

  Replace directory-name with the name of the directory.

• To see the permissions for all the files within a particular directory, use:

  $ ls -l directory-name

  Copy code to clipboard

  Replace directory-name with the name of the directory.

Procedure

• To change the file permissions for an existing file or directory, use:

  $ chmod octal_value file-name

  Copy code to clipboard

  Replace file-name with the name of the file or directory. Replace octal_value with an octal value. See Base file permissions for more details.

Prerequisites

• You have the root access.

Procedure

• To display the current ACL for a particular file or directory, run:

  $ getfacl file-name

  Copy code to clipboard

  Replace file-name with the name of the file or directory.

• To set the ACL for a file or directory, use:

Procedure

• To display the current value of the umask in symbolic mode, use:

  $ umask -S

  Copy code to clipboard

• To display the current value of the umask in the octal mode, use:

  $ umask

  Copy code to clipboard
  Note

  When displaying the umask in octal mode, you may notice it displayed as a four digit number (0002 or 0022). The first digit of the umask represents a special bit (sticky bit, SGID bit, or SUID bit). If the first digit is set to 0, the special bit is not set.

• Read (r)
• Write (w)
• Execute (x)

• User owner (u)
• Group owner (g)
• Other (o)
• All (a)

• + to add the permissions on top of the existing permissions
• - to remove the permissions from the existing permission

• = to remove the existing permissions and explicitly define the new ones

  Note

  Any permission that is not specified after the equals sign (=) is automatically prohibited.

Procedure

• To set the umask for the current shell session, use:

  $ umask -S <level><operation><permission>

  Copy code to clipboard

  Replace <level> with the level of ownership you want to set the umask for. Replace <operation> with one of the signs. Replace <permission> with the permissions you want to assign. For example, to set the umask to u=rwx,g=rwx,o=rwx, use umask -S a=rwx.

  See User file-creation mode for more details.

  Note

  The umask is only valid for the current shell session.

Procedure

• To set the umask for the current shell session, use:

  $ umask octal_value

  Copy code to clipboard

  Replace octal_value with an octal value. See User file-creation mode mask for more details.

  Note

  The umask is only valid for the current shell session.

Prerequisites

• You have the root access.

Prerequisites

• root access

Procedure

• Append the line that specifies the octal value of the umask into the .bashrc file for the particular user.

  $ echo 'umask octal_value' >> /home/username/.bashrc

  Copy code to clipboard

  Replace octal_value with an octal value and replace username with the name of the user. See User file-creation mode mask for more details.

• List all currently loaded service units:

  $ systemctl list-units --type service
  UNIT                     LOAD   ACTIVE SUB     DESCRIPTION
  abrt-ccpp.service        loaded active exited  Install ABRT coredump hook
  abrt-oops.service        loaded active running ABRT kernel log watcher
  abrtd.service            loaded active running ABRT Automated Bug Reporting Tool
  ...
  systemd-vconsole-setup.service loaded active exited  Setup Virtual Console
  tog-pegasus.service            loaded active running OpenPegasus CIM Server
  
  LOAD   = Reflects whether the unit definition was properly loaded.
  ACTIVE = The high-level unit activation state, or a generalization of SUB.
  SUB    = The low-level unit activation state, values depend on unit type.
  
  46 loaded units listed. Pass --all to see loaded but inactive units, too.
  To show all installed unit files use 'systemctl list-unit-files'

  Copy code to clipboard

  By default, the systemctl list-units command displays only active units. For each service unit file, the command provides an overview of the following parameters:

  UNIT

  The full name of the service unit

  LOAD

  The load state of the configuration file

  ACTIVE or SUB

  The current high-level and low-level unit file activation state

  DESCRIPTION

  A short description of the unit’s purpose and functionality

• List all loaded units regardless of their state, by using the following command with the --all or -a command line option:

  $ systemctl list-units --type service --all

  Copy code to clipboard

• List the status (enabled or disabled) of all available service units:

  $ systemctl list-unit-files --type service
  UNIT FILE                               STATE
  abrt-ccpp.service                       enabled
  abrt-oops.service                       enabled
  abrtd.service                           enabled
  ...
  wpa_supplicant.service                  disabled
  ypbind.service                          disabled
  
  208 unit files listed.

  Copy code to clipboard

  For each service unit, this command displays:

  UNIT FILE

  The full name of the service unit

  STATE

  The information whether the service unit is enabled or disabled to start automatically during boot

Procedure

• Display detailed information about a service unit that corresponds to a system service:

  $ systemctl status <name>.service

  Copy code to clipboard

  Replace <name> with the name of the service unit you want to inspect (for example, gdm).

  This command displays the following information:

  • The name of the selected service unit followed by a short description
  • One or more fields described in Available service unit information
  • The execution of the service unit: if the unit is executed by the root user

  • The most recent log entries

    Table 10.2. Available service unit information

    Field	Description
    Loaded	Information whether the service unit has been loaded, the absolute path to the unit file, and a note whether the unit is enabled to start during boot.
    Active	Information whether the service unit is running followed by a time stamp.
    Main PID	The process ID and the name of the corresponding system service.
    Status	Additional information about the corresponding system service.
    Process	Additional information about related processes.
    CGroup	Additional information about related control groups (cgroups).

• Verify that a particular service unit is running:

  $ systemctl is-active <name>.service

  Copy code to clipboard

• Determine whether a particular service unit is enabled to start during boot:

  $ systemctl is-enabled <name>.service

  Copy code to clipboard
  Note

  Both systemctl is-active and systemctl is-enabled commands return an exit status of 0 if the specified service unit is running or enabled.

• Check what services systemd orders to start before the specified service unit

  # systemctl list-dependencies --after <name>.service

  Copy code to clipboard

  For example, to view the list of services ordered to start before gdm, enter:

  # systemctl list-dependencies --after gdm.service
  gdm.service
  ├─dbus.socket
  ├─getty@tty1.service
  ├─livesys.service
  ├─plymouth-quit.service
  ├─system.slice
  ├─systemd-journald.socket
  ├─systemd-user-sessions.service
  └─basic.target
  [output truncated]

  Copy code to clipboard

• Check what services systemd orders to start after the specified service unit:

  # systemctl list-dependencies --before <name>.service

  Copy code to clipboard

  For example, to view the list of services systemd orders to start after gdm, enter:

  # systemctl list-dependencies --before gdm.service
  gdm.service
  ├─dracut-shutdown.service
  ├─graphical.target
  │ ├─systemd-readahead-done.service
  │ ├─systemd-readahead-done.timer
  │ └─systemd-update-utmp-runlevel.service
  └─shutdown.target
    ├─systemd-reboot.service
    └─final.target
      └─systemd-reboot.service

  Copy code to clipboard

Prerequisites

• You have the Root access.

Procedure

• Start a system service in the current session:

  # *systemctl start <systemd_unit> *

  Copy code to clipboard

  Replace <systemd_unit> with the name of the service unit you want to start (for example, httpd.service).

  Note

  In systemd, positive and negative dependencies between services exist. Starting a particular service may require starting one or more other services (positive dependency) or stopping one or more services (negative dependency).

  When you attempt to start a new service, systemd resolves all dependencies automatically, without explicit notification to the user. This means that if you are already running a service, and you attempt to start another service with a negative dependency, the first service is automatically stopped.

  For example, if you are running the sendmail service, and you attempt to start the postfix service, systemd first automatically stops sendmail, because these two services are conflicting and cannot run on the same port.

Prerequisites

• Root access

Procedure

• Stop a system service:

  # systemctl stop <name>.service

  Copy code to clipboard

  Replace <name> with the name of the service unit you want to stop (for example, bluetooth).

• Stop the selected service unit in the current session and immediately start it again.
• Restart a service unit only if the corresponding service is already running.
• Reload configuration of a system service without interrupting its execution.

Prerequisites

• You have the Root access.

Procedure

• Restart a system service:

  # systemctl restart <name>.service

  Copy code to clipboard

  Replace <name> with the name of the service unit you want to restart (for example, httpd).

  If the selected service unit is not running, this command starts it.

• Restart a service unit only if the corresponding service is already running:

  # systemctl try-restart <name>.service

  Copy code to clipboard

• Reload the configuration without interrupting service execution:

  # systemctl reload <name>.service

  Copy code to clipboard
  Note

  System services that do not support this feature, ignore this command. To restart such services, use the reload-or-restart and reload-or-try-restart commands instead.

Prerequisites

• You have Root access.

Procedure

• Verify whether the unit is masked:

  # systemctl status <systemd_unit>

  Copy code to clipboard

• If the unit is masked, unmask it first:

  # systemctl unmask <systemd_unit>

  Copy code to clipboard

• Enable a service to start at boot time:

  # systemctl enable <systemd_unit>

  Copy code to clipboard

  Replace <systemd_unit> with the name of the service unit you want to enable (for example, httpd).

Prerequisites

• You have Root access.

Procedure

• Disable a service to start at boot:

  # systemctl disable <name>.service

  Copy code to clipboard

  Replace <name> with the name of the service unit you want to disable (for example, bluetooth). Optionally, pass the --now command to also stop the service if it is currently running.

• Optional: To prevent that the unit can be accidentally started by an administrator or as a dependency of other units, mask the service:

  # systemctl mask <name>.service

  Copy code to clipboard

• Similarly, the multi-user.target unit starts other essential system services such as NetworkManager (NetworkManager.service) or D-Bus (dbus.service) and activates another target unit named basic.target.

Prerequisites

• You have Root access.

Prerequisites

• Root access

Procedure

• To enter the rescue mode, change the current target in the current session:

  # systemctl rescue
  
  Broadcast message from root@localhost on pts/0 (Fri 2023-03-24 18:23:15 CEST):
  
  The system is going down to rescue mode NOW!

  Copy code to clipboard
  Note

  This command is similar to systemctl isolate rescue.target, but it also sends an informative message to all users that are currently logged into the system.

  To prevent systemd from sending a message, enter the following command with the --no-wall command-line option:

  # systemctl --no-wall rescue

  Copy code to clipboard

• In RHEL 8, you can schedule a shutdown by using the time argument. This also gives users warning that a system shutdown has been scheduled.

• Shut down the system and power off the machine at a certain time:

  # shutdown --poweroff hh:mm

  Copy code to clipboard

  Where hh:mm is the time in the 24-hour time notation. To prevent new logins, the /run/nologin file is created 5 minutes before system shutdown.

  When you use the time argument, you can notify users logged in to the system of the planned shutdown by specifying an optional wall message, for example shutdown --poweroff 13:59 "Attention. The system will shut down at 13:59".

• Shut down and halt the system after a delay, without powering off the machine:

  # shutdown --halt +m

  Copy code to clipboard

  Where +m is the delay time in minutes. You can use the now keyword as an alias for +0.

• Cancel a pending shutdown

  # shutdown -c

  Copy code to clipboard

Prerequisites

• Root access

• Shut down the system and power off the machine:

  # systemctl poweroff

  Copy code to clipboard

• Shut down and halt the system without powering off the machine:

  # systemctl halt

  Copy code to clipboard

Prerequisites

• You have Root access.

Procedure

• Restart the system:

  # systemctl reboot

  Copy code to clipboard

• Suspend
• Hibernate
• Hybrid Sleep
• Suspend-then-hibernate

Prerequisites

• You have Root access.

• Suspend Suspending saves the system state in RAM and with the exception of the RAM module, powers off most of the devices in the machine. When you turn the machine back on, the system then restores its state from RAM without having to boot again. Because the system state is saved in RAM and not on the hard disk, restoring the system from suspend mode is significantly faster than from hibernation. However, the suspended system state is also vulnerable to power outages. To suspend the system, run:

  # systemctl suspend

  Copy code to clipboard

• Hibernate Hibernating saves the system state on the hard disk drive and powers off the machine. When you turn the machine back on, the system then restores its state from the saved data without having to boot again. Because the system state is saved on the hard disk and not in RAM, the machine does not have to maintain electrical power to the RAM module. However, as a consequence, restoring the system from hibernation is significantly slower than restoring it from suspend mode. To hibernate the system, run:

  # systemctl hibernate

  Copy code to clipboard

• Hybrid sleep This combines elements of both hibernation and suspending. The system first saves the current state on the the hard disk drive, and enters a low-power state similar to suspending, which allows the system to resume more quickly. The benefit of hybrid sleep is that if the system loses power during the sleep state, it can still recover the previous state from the saved image on the hard disk, similar to hibernation. To hibernate and suspend the system, run:

  # systemctl hybrid-sleep

  Copy code to clipboard

• Suspend-then-hibernate This mode first suspends the system, which results in saving the current system state to RAM and putting the system in a low-power mode. The system hibernates if it remains suspended for a specific period of time that you can define in the HibernateDelaySec parameter. Hibernation saves the system state to the hard disk drive and shuts down the system completely. The suspend-then-hibernate mode provides the benefit of conserving battery power while you are still able to quickly resume work. Additionally, this mode ensures that your data is saved in case of a power failure. Suspend and then hibernate the system:

  # systemctl suspend-then-hibernate

  Copy code to clipboard

Procedure

• To step the system clock immediately, bypassing any adjustments in progress by slewing, enter:

  # chronyc makestep

  Copy code to clipboard

Procedure

• To disable the chrony dispatcher script, create a symlink to /dev/null:

  # ln -f -s /dev/null /etc/NetworkManager/dispatcher.d/20-chrony-onoffline

  Copy code to clipboard
  Note

  After this change, the NTP servers remain in the online state at all times.

• IPv4 or IPv6.
• A domain socket, which is accessible locally by the root and chrony user.

• activity
• manual list
• rtcdata
• smoothing
• sources
• sourcestats
• tracking
• waitsync

• You can use the cmdallow directive in the configuration file of chronyd.
• Run the cmdallow command in chronyc.

Prerequisites

• The chronyd service is running.
• chronyd is configured to allow NTP clients. For example, add the allow directive to /etc/chrony.conf.

Procedure

• Display a device’s time stamping capabilities and associated PTP hardware clock:

Prerequisites

• The time server supports NTS.

Verification

• Verify if the NTS keys were successfully established:

  # chronyc -N authdata
  
  Name/IP address  Mode KeyID Type KLen Last Atmp  NAK Cook CLen
  ================================================================
  time.example.com  NTS     1   15  256  33m    0    0    8  100
  nts.netnod.se   NTS     1   15  256  33m    0    0    8  100
  ptbtime1.ptb.de   NTS     1   15  256  33m    0    0    8  100

  Copy code to clipboard

  The KeyID, Type, and KLen should have non-zero values. If the value is zero, check the system log for error messages from chronyd.

• Verify the client is making NTP measurements:

  # chronyc -N sources
  
  MS Name/IP address Stratum Poll Reach LastRx Last sample
  =========================================================
  time.example.com   3        6   377    45   +355us[ +375us] +/-   11ms
  nts.netnod.se   1        6   377    44   +237us[ +237us] +/-   23ms
  ptbtime1.ptb.de    1        6   377    44   -170us[ -170us] +/-   22ms

  Copy code to clipboard

  The Reach column should have a non-zero value; ideally 377. If the value rarely gets 377 or never gets to 377, it indicates that NTP requests or responses are getting lost in the network.

Prerequisites

• Server private key in PEM format
• Server certificate with required intermediate certificates in PEM format