AlmaLinux 9 self-check: 9 tasks that prove it

How to use it

Take one AlmaLinux 9 VM (snapshot first) and work through nine tasks grouped into three scenarios. Every task has verification commands: if all pass, you can handle this class of problem; if one fails, follow the link back to its page.

The checklist only covers hands-on pages published on this site. It does not come from any official exam bank and does not represent AlmaLinux or Red Hat certification content.

Scenario one: packages and sources (four tasks)

1.1 Roll back a mistaken install

sudo dnf -y install tree
ID=$(dnf history list | awk 'NR==3{print $1}')
sudo dnf -y history undo "$ID"
rpm -q tree                     # expected: package tree is not installed

See: dnf transaction rollback

1.2 Install from one chosen source

sudo dnf --disablerepo="*" --enablerepo=multi install -y tree
rpm -q tree
# add includepkgs=tree to multi.repo, dnf clean all, then:
dnf --disablerepo="*" --enablerepo=multi list available | grep -c wget   # 0

See: Package source audit

1.3 Enable CRB for one build

sudo dnf install -y glibc-static          # expected to fail
sudo dnf install -y --enablerepo=crb glibc-static
rpm -q glibc-static
dnf repolist --enabled | grep -c crb      # expected 0

See: Third-party repos

1.4 Install a package with no internet

# connected host
sudo dnf -y install createrepo_c
sudo dnf -y install --downloadonly --destdir=/srv/off tree
sudo createrepo_c /srv/off
# isolated host (repo points at file:///srv/off)
sudo dnf -y --disablerepo="*" --enablerepo=local-offline install tree
rpm -q tree

See: Offline package installs

Scenario two: networking and ports (two tasks)

2.1 Open exactly one port

sudo firewall-cmd --permanent --zone=public --add-port=8443/tcp
sudo firewall-cmd --reload
firewall-cmd --zone=public --list-ports      # should include 8443/tcp
sudo systemctl restart firewalld
firewall-cmd --zone=public --list-ports      # still there after restart

See: firewall-cmd port rules

2.2 Pre-generate a static IP offline

nmcli --offline connection add type ethernet ifname enp1s0 con-name app01-static \
  ipv4.method manual ipv4.addresses 10.0.0.10/24 ipv4.gateway 10.0.0.1 ipv4.dns 10.0.0.2 \
  | sudo tee /etc/NetworkManager/system-connections/app01-static.nmconnection
sudo chmod 600 /etc/NetworkManager/system-connections/app01-static.nmconnection
sudo nmcli connection reload && sudo nmcli connection up app01-static
ip -4 addr show enp1s0; ip route show default; cat /etc/resolv.conf

See: nmcli static IP

Scenario three: system and storage (three tasks)

3.1 The seven post-install checks

dnf repolist --enabled          # baseos/appstream/extras
timedatectl status | grep "Time zone"
hostname -f
getenforce                       # Enforcing
firewall-cmd --zone=public --list-services
needs-restarting -r; echo $?     # 0
rpm -q firewalld chrony

See: 7 checks after install

3.2 Rotate an application log

sudo mkdir -p /var/log/lab && sudo sh -c 'head -c 200000 /dev/urandom > /var/log/lab/a.log'
sudo tee /etc/logrotate.d/lab >/dev/null <<'EOF'
/var/log/lab/*.log { daily rotate 3 compress copytruncate }
EOF
sudo logrotate -f /etc/logrotate.d/lab
ls /var/log/lab/                 # a.log (0 bytes) + a.log.1.gz

See: logrotate in practice

3.3 Add four gigabytes of swap

sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show                    # expected: a /swapfile entry

See: swap sizing

Scoring

Passed	Meaning
9/9	You can handle packages, networking and system/storage independently
7–8	Revisit the failed pages’ verification commands instead of retyping them
< 7	Redo the tasks by scenario and write your own verification commands first

Next steps

• Start here: 7 checks after install
• Hardening: Hardening
• Containers and virtualisation: Containers and images