Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Unit 16 Lab - Incident Response

The unit 16 lab will be done during the lecture. Students will troubleshoot problems on systems in the ProLUG lab environment.

If you are unable to finish the lab in the ProLUG lab environment we ask you reboot the machine from the command line so that other students will have the intended environment.

Required Materials

  • Rocky 9.4+ - ProLUG Lab
    • Or comparable Linux box
  • root or sudo command access

Downloads

The lab has been provided for convenience below:

LAB

You have the answers here, if they ask, you may give them hints. Otherwise, you can help them find the right solution any way you want to.

Scenario 1:

  • Connect to tshoot1@prolug.asuscomm.com
  • Password:

A ticket has come in that the web server is not running on the web server.

To complete this event the following three must be correct.

  1. Web server must be running.

    • HINT: 
      systemctl status httpd

  1. Web server must respond on port 80.

    • HINT: Can you check the open ports?

  1. Ensure that the server can be reached by external connection attempts on port 80.

    • HINT: Is the firewall running? 
      systemctl status firewalld
Reboot the lab machine when finished.

Scenario 2:

  • Connect to tshoot2@prolug.asuscomm.com
  • Password:

A ticket has come in that a mount point, /space, is not working correctly. The team expected a 9GB partition to be built there on the 3 attached disks, but found that it was not a separate partition.

Verify that /space is not set up correctly.

  • HINT: You may want to revisit lab 3 of the course for this one. This is a challenge here.

To complete this event the following four must be correct.

  1. The three disks must be properly set up in LVM.

    • HINT: use mkfs to make a filesystem.

  1. EXT4 or XFS must be installed on the logical volume.

    • HINT: Use your pvs, vgs, lvs tools

  1. /space must be created and mounted off on this filesystem.

    • Hint: Make the directory
  1. /etc/fstab or systemd must have an entry for /space (do not reboot during the lab, as this will not work).

Same way as above.

Reboot the lab machine when finished.

Scenario 3:

  • Connect to tshoot3@prolug.asuscomm.com
  • Password:

Your team is trying to update your servers during a maintenance window. Your junior administrator kicks you over a server that they cannot get to update.

To complete this event the following two must be correct.

  1. Fix the system to be able to update via dnf.

    • HINT: DNF isn’t updating, so where are the repos that it looks for?

  1. Verify that kernel updates are happening.

    • HINT: Where can updates be excluded in DNF or Yum?

Be sure to reboot the lab machine from the command line when you are done.