Linux Hands-On Labs and System Administration

You have just been handed a server nobody documented. Find out what it is, what it runs on, and how much room it has, then write the handover note you wish you had received.

Beginner · 20 min

Find the portal's configuration, its log and its inbox without moving a thing, and record where they live so the next person does not have to hunt.

Beginner · 20 min

Build the release workspace out of the files that landed in the inbox, keep the originals intact, and clean up your scratch space without deleting anything you cannot get back.

Beginner · 25 min

Change three settings in a configuration file without losing the original, without touching anything else in it, and with a diff that proves exactly what you did.

Beginner · 25 min

Support wants the failed requests and a status summary from the portal's access log. Pull them out with grep, awk, sort and uniq, and keep stderr out of your reports.

Beginner · 30 min

Hunt down misplaced configuration in a messy tree with find, then repair a release pointer, learning the difference between a hard link and a symbolic link on the way.

Beginner · 30 min

Package a release so it can travel, prove nothing was lost on the way, and restore it somewhere safe before you ever trust the archive with the real thing.

Beginner · 35 min

Turn the inventory you gathered by hand into a command that any new shell can run, and learn where the shell finds commands and why.

Beginner · 35 min

A new engineer starts today and a contractor's engagement ended yesterday. Onboard one properly and offboard the other completely, keeping the records an audit will ask for.

Beginner · 30 min

Two engineers need to work in the same directory and a third person must stay out of it. Groups, the setgid bit and a sensible umask do this without any ACLs.

Beginner · 30 min

A payroll file is world-writable and a shared scratch directory lets anyone delete anyone's work. Fix both with plain Unix permissions and understand what each bit actually does.

Beginner · 30 min

An auditor needs to read the platform team's directory without joining the team. Owner, group and other cannot express that; ACLs can, including for files that do not exist yet.

Beginner · 35 min

A support operator should be able to restart one service and nothing else. Write the smallest sudoers rule that does it, and prove the fence holds from the operator's seat.

Beginner · 35 min

The ops portal returns 403 on a server where the permissions are right and the web server is healthy. SELinux is doing its job on the wrong labels. Fix the labels, keep it enforcing.

Intermediate · 30 min

Install an approved tool from the company mirror, find out which package owns a file, undo the install cleanly, and leave evidence of what changed. dnf does the resolving; rpm answers the questions.

Beginner · 25 min

Add the vendor's repository properly, verify its signing key against the fingerprint you were given, update the demo application, rehearse the rollback, and write it all down.

Intermediate · 40 min

A worker is stuck and its neighbour is healthy. Find the right one by evidence, stop it politely, and leave the other alone. Then get comfortable with jobs in your own shell.

Beginner · 25 min

A service is installed but stopped and will not survive a reboot. Bring it up, understand start versus enable, then reboot the machine and watch it come back on its own.

Beginner · 25 min

A supplied application needs to run as a service under its own account, with a controlled environment, an automatic restart, and a filesystem sandbox that lets it write to one place and nothing else.

Intermediate · 45 min

Pull the useful signal out of the journal, then keep an application's own log file from growing forever without losing the records it already holds.

Intermediate · 35 min

Log timestamps on this machine disagree with the rest of the estate. Fix the time zone, point chrony at the lab's time reference on server1, and prove the two clocks agree.

Intermediate · 30 min

Before anyone changes a firewall or a listener, map the path from interface to service: addresses in both families, the route to the peer, and which sockets are actually open to the network.

Intermediate · 30 min

The client needs a reserved address on the team's IPv6 data network, alongside the IPv4 address the platform gave it, and it has to survive a profile reload. nmcli, not ip, is how that persists.

Intermediate · 35 min

The client cannot find the internal app because its resolver points at a dead address and someone left a hosts-file override behind. Fix it through NetworkManager, then read the difference between a wrong answer, no answer, and NXDOMAIN.

Intermediate · 35 min

One approved client may reach the app on server1; a second server on the same network may not. Write the narrowest firewalld rule that says so, make it permanent, and prove it from both sides.

Intermediate · 35 min

Set up remote administration on server1 for a new trainee: tighten the daemon, validate before reloading, and verify the server's identity from the client the way a careful admin does on first contact.

Intermediate · 35 min

A trainee logs into this server with a password. Move them to a key you can revoke, then switch passwords off for that account alone, without locking anybody else out.

Intermediate · 35 min

Ship a release to server1 as the deployment account, three ways, and prove the bytes that arrived are the bytes you sent. Then update it, and remove one known stale file without an unchecked --delete.

Intermediate · 35 min

server2 only accepts administration from server1, and its app listens on loopback. Reach it through the bastion without copying a private key anywhere, tunnel to the app on loopback only, and narrow what the bastion will forward.

Intermediate · 40 min

A new disk was attached. Prove which one it is, prove the root disk is not it, then lay down a GPT table and one aligned partition on exactly that disk and nothing else.

Intermediate · 30 min

Two partitions, two filesystems, two mount points that must come back after a reboot even if the device names change. Labels, UUIDs, fstab, and the tools that catch a typo before the reboot does.

Intermediate · 35 min

An application needs storage that can grow later without a reinstall. Build it as a logical volume on the spare disk, mount it by UUID, and prove it comes back on its own after a reboot.

Intermediate · 45 min

The application volume is filling up and a second disk has arrived. Add it to the group, grow the volume and the filesystem while the application keeps writing, and prove nothing was lost, before and after a reboot.

Intermediate · 35 min

Add a small swap area on its own partition, make it permanent, watch a bounded workload push the machine, and learn to tell 'memory is full' from 'memory is under pressure'.

Intermediate · 30 min

Two teams share one data volume and one of them has a habit of filling it. Turn on XFS project quotas, cap that team's directory, and prove the cap bites with real data while the other team keeps working.

Advanced · 40 min

Two machines, one team directory. Export it from server1 to the client only, with root squashed, open the firewall for exactly that, mount it on the client, and prove who can write what.

Intermediate · 45 min

The team share should appear when someone opens it and let go when nobody has for a while. autofs does that, with a master map, a map, and a timeout, and the mount table tells you whether it is working.

Intermediate · 30 min