主题： rhel
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Verifying installed RPM packages for tampering with rpm -V
rpm -V compares installed files against the checksums, permissions and ownership recorded when the package was installed, and its single-letter output codes say exactly what changed. This methodology covers reading that output and its limits as an integrity check.
-
通过 Cockpit Web 控制台管理无图形界面的 RHEL 主机
Cockpit 为没有桌面图形界面的 RHEL 服务器提供基于浏览器的管理会话，并通过套接字激活，仅在首次连接时启动。本方法介绍如何启用它、使用其命名服务开放防火墙访问，以及它在服务器上实际适合完成哪些任务。
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
Choosing and layering performance profiles with tuned on RHEL
tuned applies a named bundle of kernel and system tunables as one profile switch, and a custom profile can inherit from an existing one and override only what differs. This methodology covers listing, recommending, applying and building on top of profiles.
-
管理 firewalld 区域和规则，避免将自己锁在 SSH 之外
firewalld 将运行配置与永久配置分开；普通 firewall-cmd 更改若未永久保存，就会在下次重新加载时丢失。本方法涵盖区域、运行时/永久配置之分、富规则，以及如何在更改导致远程 SSH 会话无法恢复之前进行测试。
-
RHEL 的 Application Streams 与 DNF 模块：RHEL 10 有哪些变化
RHEL 8 和 9 将部分 AppStream 以 DNF 模块形式提供，使同一操作系统版本可拥有一个组件的多个版本，但同一时间只能激活一条流。RHEL 10 的重构发行版文档说明模块化已弃用，Application Stream 软件包改为直接安装。
-
Adding a private CA to the system trust store on RHEL-family and Debian/Ubuntu
RHEL-family and Debian-family Linux keep separate mechanisms for adding a locally trusted CA certificate: update-ca-trust with anchors under /etc/pki/ca-trust, and update-ca-certificates with .crt files under /usr/local/share/ca-certificates. Using the wrong directory or extension silently leaves the CA untrusted.
-
Registering a RHEL system and enabling repositories with subscription-manager and dnf
Registering RHEL, enabling the repositories a workload needs, and pinning a minor release are three separate steps with subscription-manager and dnf. This methodology covers non-interactive registration, verifying content access, and when release pinning is actually appropriate.
-
Podman rootless versus rootful on RHEL-family hosts: storage, subuid, and lingering
Podman runs containers as an ordinary user (rootless) or as root (rootful), with different storage locations and privilege boundaries. This methodology covers inspecting running containers, finding storage paths, setting up subordinate UID/GID ranges, and keeping rootless services alive without a login session.
-
使用 update-crypto-policies 切换 RHEL 的系统级加密策略
RHEL 的系统级加密策略设置 OpenSSL、GnuTLS、NSS、libkrb5 和 OpenSSH 默认提供的算法与协议版本，可用一条命令更改，无须逐个编辑应用配置。本方法介绍如何查看、设置和测试策略，以及为何已经运行的服务需要重启才能采用新策略。
-
Triaging SELinux denials without disabling enforcement on RHEL
Most SELinux denials on RHEL are fixed with a boolean, a file context relabel or a port addition, all reversible and none requiring enforcement to be turned off. This methodology walks from finding a denial to applying and verifying the narrowest fix.
-
使用 Kickstart 文件构建无人值守的 RHEL 安装
Kickstart 文件以单行命令结合 %pre 和 %post 脚本片段，驱动 RHEL、Rocky Linux 或 AlmaLinux 安装，无需交互提示。本方法介绍使用前验证文件、启动时传入文件，以及如何避免把秘密放进通常无需认证即可获取的文件。
-
配置 kdump，捕获 RHEL 内核崩溃
kdump 预先保留内存，让第二个最小内核能在内核崩溃后启动，并写出 vmcore 供分析。本方法介绍保留内存、启用服务，以及为何主动测试会使主机停机，因此需相应安排测试。
-
Undoing a dnf transaction and locking package versions on RHEL
dnf keeps a full transaction history that can be inspected, undone or rolled back, and the versionlock mechanism pins a package to its current version across later updates. This methodology covers both, the difference between undo and rollback, and what differs in DNF5 on current Fedora.
机器可读： JSON