LFCS 120분 종합 모의 B

1. account·group·profile·limit

groupadd -g 4810 release
useradd -u 4810 -m -s /bin/bash builder
usermod -aG release builder

printf 'export RELEASE_ENV=staging\n' > /etc/profile.d/release-env.sh
chmod 0644 /etc/profile.d/release-env.sh

cat > /etc/security/limits.d/90-builder.conf <<'EOF'
builder soft nofile 2048
builder hard nofile 4096
EOF

getent group release
id builder
su - builder -c 'printf "%s\n" "$RELEASE_ENV"; ulimit -Sn; ulimit -Hn'

2. shared directory·ACL·LDAP

getent passwd auditor >/dev/null || useradd -m -s /bin/bash auditor
install -d -o root -g release -m 2770 /srv/reports

# 기존 객체와 앞으로 생길 객체를 구분해 ACL을 적용한다.
find /srv/reports -type d -exec setfacl -m u:auditor:rx,d:u:auditor:rx {} +
find /srv/reports -type f -exec setfacl -m u:auditor:r-- {} +

runuser -u builder -- sh -c 'umask 0022; printf "report\n" > /srv/reports/new.txt'
getfacl /srv/reports /srv/reports/new.txt
runuser -u auditor -- test -r /srv/reports/new.txt
! runuser -u auditor -- sh -c 'printf x >> /srv/reports/new.txt'

LDAP는 제공된 URI·base DN·CA로 고급 사용자 lab의 SSSD 구성을 적용한다. getent passwd alice, id alice, sssctl user-checks alice와 별도 새 login의 home을 확인한다.

3. Git

cd /srv/config-repo
git status --short
git diff -- app.conf README.md debug.log
git add -- app.conf README.md
git diff --cached
git commit -m 'Update application configuration'
git show --stat --oneline HEAD
git status --short

4. custom service

# /etc/systemd/system/heartbeat.service
[Unit]
Description=Heartbeat service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=builder
WorkingDirectory=/srv/heartbeat
ExecStart=/usr/local/libexec/heartbeat
Restart=on-failure
RestartSec=3s

[Install]
WantedBy=multi-user.target

install -d -o builder -g builder -m 0750 /srv/heartbeat
systemd-analyze verify /etc/systemd/system/heartbeat.service
systemctl daemon-reload
systemctl enable --now heartbeat.service
systemctl is-active heartbeat.service
systemctl is-enabled heartbeat.service
systemctl show heartbeat.service -p User -p MainPID
journalctl -u heartbeat.service -b --no-pager

5. disk space와 constraint

df -hT
df -i
findmnt -T /srv/mock-enospc/logwriter.log
df -hT /srv/mock-enospc
df -i /srv/mock-enospc
du -xah /srv/mock-enospc | sort -h | tail
lsof +L1
systemctl status logwriter.service --no-pager -l
systemctl show logwriter.service -p User -p Group
journalctl -u logwriter.service -b --no-pager
namei -l /srv/mock-enospc/logwriter.log

이 fixture의 실제 원인은 작은 loopback filesystem의 block capacity다. inode 여유와 root filesystem 여유를 함께 기록해 원인을 구분한다. deleted-open file이 다른 문제의 핵심 원인이면 관련 service를 정상 restart할 수 있는지 확인하고, data 보존 요구가 있으면 먼저 log copy 가능성을 판단한다. 결과는 같은 df·inode·service 동작으로 검증한다.

6. key와 CSR

test -d /etc/pki/tls/certs || install -d -m 0755 /etc/pki/tls/certs
test -d /etc/pki/tls/private || install -d -m 0700 /etc/pki/tls/private

openssl req -new -newkey rsa:2048 -nodes \
  -keyout /etc/pki/tls/private/app.lab.example.key \
  -out /etc/pki/tls/certs/app.lab.example.csr \
  -subj '/CN=app.lab.example' \
  -addext 'subjectAltName=DNS:app.lab.example,IP:192.168.56.11'

chmod 0600 /etc/pki/tls/private/app.lab.example.key
openssl req -in /etc/pki/tls/certs/app.lab.example.csr \
  -noout -subject -text | grep -A1 'Subject Alternative Name'

openssl pkey -in /etc/pki/tls/private/app.lab.example.key -pubout -outform DER 2>/dev/null | sha256sum
openssl req -in /etc/pki/tls/certs/app.lab.example.csr -pubkey -noout | \
  openssl pkey -pubin -outform DER 2>/dev/null | sha256sum

두 public-key digest가 같아야 한다.

7. LVM과 mount

lsblk -f
pvs; vgs; lvs
pvcreate /dev/sdb
vgcreate examvg /dev/sdb
lvcreate -L 1G -n data examvg
mkfs.xfs /dev/examvg/data
install -d -m 0755 /srv/examdata
blkid /dev/examvg/data

/etc/fstab에 UUID=<filesystem UUID> /srv/examdata xfs defaults 0 0을 추가한 뒤:

findmnt --verify
mount -a
findmnt /srv/examdata
lvs -o lv_name,vg_name,lv_size,devices

8. LV와 ext4 확장

sha256sum /srv/appdata/preserve.txt > /root/appdata.before.sha256
lvs basevg/applv
df -hT /srv/appdata
lvextend -L +512M /dev/basevg/applv
resize2fs /dev/basevg/applv
lvs basevg/applv
df -hT /srv/appdata
sha256sum -c /root/appdata.before.sha256

현재 filesystem type을 먼저 확인하고 XFS라면 resize2fs가 아니라 mount point를 대상으로 한 XFS grow 절차를 사용한다.

9. swap과 autofs

lvcreate -L 512M -n swaplv examvg
mkswap /dev/examvg/swaplv
swapon /dev/examvg/swaplv
blkid /dev/examvg/swaplv

swap UUID를 /etc/fstab에 UUID=<값> none swap defaults 0 0 형태로 추가하고 findmnt --verify로 검사한다. autofs:

# /etc/auto.master.d/projects.autofs
/- /etc/auto.projects --timeout=60

# /etc/auto.projects
/net/projects -fstype=nfs4,rw 192.168.56.12:/srv/nfs/projects

systemctl enable --now autofs
systemctl reload autofs
ls /net/projects
findmnt /net/projects
swapon --show

10. NFS·iSCSI·storage diagnosis

showmount -e 192.168.56.12
install -d -m 0755 /mnt/team
mount -t nfs -o ro,vers=4 192.168.56.12:/srv/nfs/projects /mnt/team
findmnt -no SOURCE,TARGET,FSTYPE,OPTIONS /mnt/team

lsblk -o NAME,PATH,SIZE,TYPE,FSTYPE,MOUNTPOINTS
iscsiadm -m discovery -t sendtargets -p 192.168.56.12:3260
iscsiadm -m node -T iqn.2026-08.example.lab:storage.lun0 \
  -p 192.168.56.12:3260 --login
iscsiadm -m session -P 1
ls -l /dev/disk/by-path | grep -i iscsi

df -hT
df -i
iostat -xz 1 3

11. address·DNS·time

nmcli connection modify PRIVATE_CONNECTION \
  ipv4.method manual ipv4.addresses 192.168.56.11/24 \
  ipv4.dns 192.168.56.12 ipv4.dns-search lab.example \
  ipv4.gateway '' ipv4.never-default yes ipv4.ignore-auto-dns yes \
  ipv6.method manual ipv6.addresses 2001:db8:56::11/64 \
  ipv6.dns 2001:db8:56::12 \
  ipv6.gateway '' ipv6.never-default yes ipv6.ignore-auto-dns yes
nmcli connection up PRIVATE_CONNECTION

ip -brief address
ip route
getent hosts app.lab.example

chrony source file의 지원 위치를 chrony.conf(5)에서 확인해 server 192.168.56.12 iburst를 추가하고 restart한다.

chronyd -p
systemctl restart chronyd
chronyc sources -v
chronyc tracking

12. SSH

server configuration은 package file 전체를 덮어쓰지 않고 지원되는 include directory의 전용 file을 우선한다. RHEL-compatible 환경에서 /etc/ssh/sshd_config가 sshd_config.d/*.conf를 include하는 것을 먼저 확인한 뒤 다음 내용을 /etc/ssh/sshd_config.d/60-lfcs-mock.conf에 둔다.

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no

install -d -o builder -g builder -m 0700 /home/builder/.ssh
install -o builder -g builder -m 0600 /root/builder_authorized_key.pub \
  /home/builder/.ssh/authorized_keys
restorecon -Rv /home/builder/.ssh 2>/dev/null || true
sshd -t
systemctl reload sshd
sshd -T | grep -E 'permitrootlogin|pubkeyauthentication|passwordauthentication'

node2에서 지정 private key로 builder login을 확인한다. root negative test는 인증이 실패하는지 확인하되 account lock이나 반복 시도를 만들지 않는다.

13. route·forwarding·NAT

# node1
nmcli connection modify PRIVATE_CONNECTION \
  +ipv4.routes '198.51.100.0/24 192.168.56.12'
nmcli connection up PRIVATE_CONNECTION
ip route get 198.51.100.2

node2:

sysctl -w net.ipv4.ip_forward=1
printf 'net.ipv4.ip_forward = 1\n' > /etc/sysctl.d/91-mock-forward.conf
sysctl -p /etc/sysctl.d/91-mock-forward.conf

private connection을 internal, fixture의 dst-host를 external zone에 연결한 예:

firewall-cmd --permanent --zone=internal --change-interface=PRIVATE_INTERFACE
firewall-cmd --permanent --zone=external --change-interface=dst-host
firewall-cmd --permanent --new-policy=mock-lab-to-dst
firewall-cmd --permanent --policy=mock-lab-to-dst --add-ingress-zone=internal
firewall-cmd --permanent --policy=mock-lab-to-dst --add-egress-zone=external
firewall-cmd --permanent --policy=mock-lab-to-dst --set-target=ACCEPT
firewall-cmd --permanent --policy=mock-lab-to-dst \
  --add-rich-rule='rule family="ipv4" source address="192.168.56.0/24" destination address="198.51.100.0/24" masquerade'
firewall-cmd --reload
firewall-cmd --info-policy mock-lab-to-dst

node1에서 ping 198.51.100.2를 실행하고 node2에서 ip netns exec lfcs-dst tcpdump -ni dst-ns icmp로 packet source가 node2의 downstream address로 변환되는지 관찰한다. nft list ruleset의 counter도 함께 확인한다. 현재 firewalld version이 policy rich rule을 지원하는지는 firewall-cmd --help, firewalld.richlanguage(5)와 firewalld.policy(5)에서 확인한다.

14. filter와 redirect

node2의 private connection이 속한 zone을 확인한 뒤:

firewall-cmd --permanent --zone=PRIVATE_ZONE --add-port=8080/tcp
firewall-cmd --permanent --zone=PRIVATE_ZONE \
  --add-forward-port=port=8080:proto=tcp:toport=8081
firewall-cmd --reload
firewall-cmd --zone=PRIVATE_ZONE --list-all
nft list ruleset

node1:

curl http://192.168.56.12:8080/

15. bridge·bond·proxy

interface 이름을 확인해 네트워킹 lab의 NetworkManager 흐름으로 br0, bond0와 port/slave를 만든다.

nginx upstream:

upstream mock_pool {
    server 192.168.56.12:8081 max_fails=1 fail_timeout=10s;
    server 192.168.56.12:8082 max_fails=1 fail_timeout=10s;
}

server {
    listen 8088;
    location / {
        proxy_pass http://mock_pool;
        proxy_next_upstream error timeout http_502 http_503;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

nginx -t
systemctl reload nginx
cat /proc/net/bonding/bond0
bridge link
curl http://127.0.0.1:8088/

16. sysctl과 cron

sysctl -w vm.swappiness=15
printf 'vm.swappiness = 15\n' > /etc/sysctl.d/91-mock.conf
sysctl -p /etc/sysctl.d/91-mock.conf
grep -R 'vm.swappiness' /etc/sysctl.conf /etc/sysctl.d 2>/dev/null

printf '*/10 * * * * root /usr/bin/date -u >> /var/log/mock-time.log 2>&1\n' \
  > /etc/cron.d/mock-time
chmod 0644 /etc/cron.d/mock-time
systemctl enable --now crond
systemctl is-active crond
systemctl is-enabled crond

17. package와 failed service

dnf repolist
dnf info haproxy
dnf install -y haproxy
rpm -qi haproxy
rpm -ql haproxy | grep -E '/etc/.*haproxy.*conf'
systemctl is-active haproxy

haproxy가 active이면 task의 “시작하지 않음” 조건을 위반한 것이다. is-active의 non-zero exit status 자체를 오류로 오해하지 않는다.

reporter.service:

systemctl status reporter.service --no-pager -l
systemctl show reporter.service -p ExecMainStatus -p User
journalctl -u reporter.service -b --no-pager
namei -l /srv/reporter-output/missing/summary.txt

오류와 존재하는 상위 directory를 대조해 /etc/reporter.conf를 OUTPUT=/srv/reporter-output/summary.txt로 수정한다. unit이나 executable은 바꾸지 않는다. systemctl restart reporter.service 뒤 exit status와 /srv/reporter-output/summary.txt 내용을 확인한다.

18. mock fstab recovery

lsblk -f
blkid /dev/basevg/applv
findmnt /srv/appdata
cp -a /etc/fstab.mock /etc/fstab.mock.before

mock file의 UUID와 filesystem type을 실제 값으로 고친 뒤:

install -d -m 0755 /mnt/recovery
findmnt --verify --tab-file /etc/fstab.mock
mount -a -T /etc/fstab.mock
findmnt /mnt/recovery
diff -u /etc/fstab.mock.before /etc/fstab.mock

source filesystem이 이미 다른 곳에 mounted되어 있을 때 동일 filesystem을 추가 mount하는 조건과 부수 효과를 확인한다.

19. libvirt

virsh list --all
if virsh dominfo web01 >/dev/null 2>&1; then
  virsh dumpxml web01 > /root/web01.existing.xml
  printf 'web01 already exists; compare the existing definition before continuing\n' >&2
else
  virsh define /root/web01.xml
fi
virsh start web01
virsh autostart web01
virsh dominfo web01
virsh domblklist web01
virsh domiflist web01

20. container와 SELinux

install -d -m 0755 /srv/mockweb
printf 'mock web\n' > /srv/mockweb/index.html

semanage fcontext -a -t container_file_t '/srv/mockweb(/.*)?'
restorecon -Rv /srv/mockweb

podman run -d --name mockweb -p 8090:80 \
  -v /srv/mockweb:/usr/share/nginx/html:Z \
  docker.io/library/nginx:stable-alpine

getenforce
ls -ldZ /srv/mockweb /srv/mockweb/index.html
podman ps --filter name=mockweb
podman port mockweb
podman inspect mockweb
podman logs mockweb
curl http://127.0.0.1:8090/

semanage fcontext·restorecon은 path의 영구 base type을 container_file_t로 만들고, :Z는 해당 container 전용 MCS label까지 적용한다. 둘의 역할을 matchpathcon /srv/mockweb/index.html과 실제 ls -Z로 구분한다. bind mount만 요구하는 task라면 engine의 SELinux volume option만으로도 동작할 수 있지만, 이 문제는 host path의 영구 context도 명시적으로 요구한다.