Unit 16 Lab - Incident Response

The unit 16 lab will be done during the lecture. Students will troubleshoot problems on systems in the ProLUG lab environment.

If you are unable to finish the lab in the ProLUG lab environment we ask you reboot the machine from the command line so that other students will have the intended environment.

Required Materials

Rocky 9.4+ - ProLUG Lab
- Or comparable Linux box
root or sudo command access

Downloads

The lab has been provided for convenience below:

Be sure to reboot the lab machine from the command line when you are done.

LAB

You have the answers here, if they ask, you may give them hints. Otherwise, you can help them find the right solution any way you want to.

Scenario 1:

Connect to tshoot1@prolug.asuscomm.com
Password:

A ticket has come in that the web server is not running on the web server. To complete this event the following three must be correct. Web server must be running.

HINT:
```
systemctl status httpd
```

Web server must respond on port 80.

HINT: Can you check the open ports?

The server is currently set on 8087 and needs to be fixed in /etc/httpd/conf/http.conf.
The "Listen 8087" line must be changed to "Listen 80" and the service restarted systemctl restart httpd.

Ensure that the server can be reached by external connection attempts on port 80.

HINT: Is the firewall running?
```
systemctl status firewalld
```

Reboot the lab machine when finished.

Scenario 2:

Connect to tshoot2@prolug.asuscomm.com
Password:

A ticket has come in that a mount point /space is not working correctly. The team expected a 9GB partition to be built there on the 3 attached disks, but found that it was not a separate partition. Verify that /space is not set up correctly.

To complete this event the following two must be correct.

HINT: They may want to revisit lab 3 of the course for this one. This is a challenge here.
- The three disks must be properly set up in LVM.
HINT: use your pvs, vgs, lvs tools

EXT4 or XFS must be installed on the logical volume.

HINT: use mkfs to make a filesystem.

/space must be created and mounted off on this filesystem.

Hint: Make the directory

/etc/fstab or systemd must have an entry for /space (do not reboot during the lab, as this will not work).
Same way as above.

Reboot the lab machine when finished.

Scenario 3:

Connect to tshoot3@prolug.asuscomm.com
Password:

Your team is trying to update your servers during a maintenance window. Your junior administrator kicks you over a server that they cannot get to update. To complete this event the following two must be correct.

Fix the system to be able to update via dnf.

HINT: DNF isn’t updating, so where are the repos that it looks for?

Verify that kernel updates are happening.

HINT: Where can updates be excluded in DNF or Yum?