Public time servers that can be used as time sources by anyone.
== the server that provides time to the enterprise NTP clients usually connects to an internet time server
An NTP node that receives time from an NTP server When it loses its connection to the NTP server, it requests time from the other available NTP peer(s).
(do a blog search for “service_insertion”)
The default host-based firewall in RHEL allows all outgoing connections and blocks all incoming ones, except those explicitely permitted.
The firewall daemon is called firewalld. To interact with it, use the firewall-cmd tool. The firewalld daemon translates the instructions of firewall-cmd into policies that use the syntax of the kernel’s netfilter and nftables.
A rule dictates that a service is allowed to be accessed by an inbound connection. A firewalld service is added with firewall-cmd --add-service or removed with firewall-cmd --remove-service.
SELinux is an implementation of the Mandatory Access Control security model in the Linux kernel. It bears more weight than the Discretionary Access Control security model, implemented as the Unix-based file permissions (ugo, rwx); To illustrate the power of SELinux, a Linux user, even the root account, gets denied access to his own files if the result of the SELinux authorization chain is a deny.
SELinux assigns a context (aka label) to every Linux user, process, file, directory, port, socket, hardware device, etc. These are considered as either subjects (Linux users and processes) or objects (files, directories, ports, …).
#TBC
Target is to build two RHEL VMs on in Virtualbox on a Windows machine.
Virtualbox must always be executed as administrator.
The installation of the extension pack might fail many times. What worked for me is patience and repetition, until I saw the green tick in the menu.
Shared clipboard and shared folder features will not work even if you activate them from the Virtualbox menu. What helped is to mount the VboxGuestAdditions.iso file from the GUI, check it in the shell terminal with lsblk, register the VM to Red Hat CDN with sudo subscription-manager register and provide my registration account details, reboot the machine, issue a dnf repolist to refresh the DNF repos, install the kernel headers with dnf install kernel-devel-$(uname -r) and reboot the VM again.
Packet capture in real time on an interface is performed with the monitor command:
lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
<[Enter]> Execute this command
absolute-sequence Display absolute TCP sequence numbers
brief Display brief output
count Number of packets to receive (0..1000000 packets)
detail Display detailed output
extensive Display extensive output
layer2-headers Display link-level header on each dump line
matching Expression for headers of receive packets to match
no-domain-names Don't display domain portion of hostnames
no-promiscuous Don't put interface into promiscuous mode
no-resolve Don't attempt to print addresses symbolically
no-timestamp Don't print timestamp on each dump line
print-ascii Display packets in ASCII when displaying in hexadecimal format
print-hex Display packets in hexadecimal format
read-file Read packets from a given file
resolve-timeout Period of time to wait for each name resolution (seconds)
size Amount of each packet to receive (bytes)
write-file Write packets to specified file
| Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes
^C
297 packets received by filter
0 packets dropped by kernel
lab@vSRX>
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /
lab@vSRX>
Then I open the freeBSD CLI and open the pcap file using tcpdump:
graph LR
net1(LAN1_172.17.99.0/24)
net1 <--> R1
R1 <--> |WAN1_10.10.10.8/30|R4
Desired outcome: I want to configure a generated route on R1 for the prefix 172.17.99.0. Currently, the prefix 172.17.99.0/24 is directly attached to ge-0/0/6. I want to make R1 advertise the generated route 172.17.96.0/19 toward its BGP neighbor R4 only when R1 receives the BGP route 10.22.1.0/26 from R4 (which is configured as an aggregate route on R4) and successfully imports it from BGP into inet.0. On R1, at the moment there is only one contributing route for the generated route, which is 17.17.99.0/24.
The useradd command with the -b option creates a base directory for the user account. The home directory is always the concatenation of the base directory and the user account name, according to Linux man pages.
user01@rhel10-vm4:~$ sudo useradd user02 -b /myBaseDir
Creating mailbox file: File exists
user01@rhel10-vm4:~$
user01@rhel10-vm4:~$ sudo su - user02
Last login: Fri Oct 2 01:27:39 EDT 2026 on pts/3
user02@rhel10-vm4:~$ pwd
/myBaseDir/user02
user02@rhel10-vm4:~$
I delete the user account, recreate it without the -b option and check its home directory again:
ddd
:colorscheme ron
:set guioptions +=d
:set guioptions -=m
:set guioptions -=T
:set guioptions -=r
They respectively:
On R2, verify that there is a BGP route to 1.1.1.1.
user1@R2>
user1@R2> show route 1.1.1.1
inet.0: 15 destinations, 15 routes (15 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
1.1.1.1/32 *[BGP/170] 5d 13:58:29, localpref 100
AS path: 17 17 17 17 I, validation-state: unverified
> to 10.10.10.1 via ge-0/0/1.0
On R1, configure static route to 10.22.1.32/27 with next-hop 10.10.10.2, preference 6. The ping from R1’s loopback to R2’s 10.22.1.34 interface must succeed. How RIB looks like, when a static route is configured with a next hop set to the IP address of the directly-attached host: