· about 90 minutes · runs on rocky-10 · unrated · timed: 90 minutes, pass line 70%
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
Exam simulation. 90 minutes. 15 tasks. Pass line 70%. The clock starts now.
You have inherited this server. Nobody knows the root password. Your own account's sudo was
removed before the previous admin left. And the machine does not finish booting.
Reach it with k on this lab's screen (the serial console). To get to the bootloader, press
b: it presses the machine's reset button and attaches to the console it boots on. The menu waits ten seconds.
Complete every task. Everything is graded after a reboot.
Rhcsa-Lab5!./dev/vdb mounted at /data./opt/repos/local
(no GPG checking is needed for it). No other repository is enabled.tree is installed.sysreport.service already exists. Its timer must run it every 15 minutes, starting at
boot.auditors with GID 5000. Users maria (UID 5001) and sam
(UID 5002) are members of it.maria's password must be changed at least every 90 days.sam exists for file ownership only: no interactive login is possible./usr/local/bin/sysreport (Bash). It prints exactly three lines:hostname: <the short hostname>
kernel: <the running kernel release>
root_free: <free space on / as a whole percentage>%
-o FILE it writes those lines to FILE instead. Any other option prints an error to
stderr and exits with status 2.192.168.5.2.maria can ssh maria@localhost with a key, without a password prompt./srv/audit belongs to group auditors; members can create files there, those files
belong to auditors, and nobody else can enter it.The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_root_password_set | Interrupt the boot process to gain system access |
| 02_shadow_context_correct | Restore default file contexts |
| 03_boots_with_data_mounted | Configure systems to mount file systems at boot by UUID or label |
| 04_repo_uses_local_mirror | Configure access to RPM repositories |
| 05_tree_installed | Install and remove RPM software packages |
| 06_sysreport_timer_every_15m | Schedule tasks using at, cron, and systemd timer units |
| 07_auditors_group_and_members | Create, delete, and modify local groups and memberships |
| 08_maria_password_aging | Change passwords and adjust password aging |
| 09_sam_cannot_log_in | Create, delete, and modify local user accounts |
| 10_sysreport_script | Process script inputs ($1, $2, etc.) |
| 11_chrony_uses_lab_server | Configure time service clients |
| 12_journal_persistent | Preserve system journals |
| 13_maria_ssh_key_login | Configure key-based authentication for SSH |
| 14_audit_dir_shared | Diagnose and correct file permission problems |
| 15_you_are_an_admin_again | Configure privileged access |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 7 dracut.cmdlineman 5 fstabman 5 dnf.confman 8 dnfman 5 systemd.timerman 7 systemd.timeman 8 groupaddman 8 useraddman 1 chageman 5 shadowman 5 passwdman 1 bashman 5 chrony.confman 5 journald.confman 1 ssh-keygenman 8 sshdman 5 sudoers4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
After resetting the root password from rd.break, why touch /.autorelabel before rebooting?
The new /etc/shadow was written without an SELinux label, and logins would be denied
In the initramfs no policy is loaded, so passwd creates /etc/shadow unlabelled. The marker makes the next boot relabel the filesystem (restorecon on the file does the same once SELinux is loaded).
man 8 restorecon · man 8 fixfiles
Which repo file line points dnf at a local directory mirror?
baseurl=file:///opt/repos/local
baseurl takes a URL, and a local path is written as a file:// URL. mirrorlist expects a URL to a list of mirrors; there is no path= option.
man 5 dnf.conf
A timer unit contains `OnCalender=*:0/15`. What happens?
The unit fails to load
The unknown key is logged and skipped, which leaves the timer with no schedule at all, and systemd refuses a timer like that: "Timer unit lacks value setting. Refusing." The unit is bad-setting and cannot be started. systemd-analyze verify prints both lines before anything is enabled.
man 5 systemd.timer · man 1 systemd-analyze