Welcome to Day 6 of Linux Administration Training.
In this session, we covered:
Package management
OS patching procedures
Red Hat subscription management
Offline patching using ISO
Setting up centralized FTP repository (Rocky Linux 8)
Troubleshooting repository issues
This is one of the most critical responsibilities of a Linux Administrator in enterprise environments.
LAB OBJECTIVES
--------------
By the end of this lab, you will be able to:
1. Understand RPM and DPKG package management
2. Install, update, remove and query RPM packages
3. Check RPM package dependencies
4. Search packages using DNF
5. Perform Rocky Linux OS patching
6. Perform SUSE Linux patching using zypper
7. Perform Ubuntu patching using apt
8. Understand Red Hat subscription management
9. Check security updates and CVE/RHSA advisories
10. Configure an offline ISO repository
11. Configure a centralized Rocky Linux 8 FTP repository
12. Troubleshoot repository issues
13. Perform pre- and post-patching validation
1. UNDERSTANDING LINUX PACKAGE MANAGEMENT
=========================================
Linux distributions use different package-management technologies.
--------------
By the end of this lab, you will be able to:
1. Understand RPM and DPKG package management
2. Install, update, remove and query RPM packages
3. Check RPM package dependencies
4. Search packages using DNF
5. Perform Rocky Linux OS patching
6. Perform SUSE Linux patching using zypper
7. Perform Ubuntu patching using apt
8. Understand Red Hat subscription management
9. Check security updates and CVE/RHSA advisories
10. Configure an offline ISO repository
11. Configure a centralized Rocky Linux 8 FTP repository
12. Troubleshoot repository issues
13. Perform pre- and post-patching validation
1. UNDERSTANDING LINUX PACKAGE MANAGEMENT
=========================================
Linux distributions use different package-management technologies.
Distribution Low-Level Package Package Manager
-----------------------------------------------------------
RHEL RPM DNF
Rocky Linux RPM DNF
CentOS RPM YUM/DNF
SUSE Linux RPM Zypper
Ubuntu DPKG APT
Debian DPKG APT
IMPORTANT CONCEPT
-----------------
There are two levels:
High-Level Package Manager
|
+---- DNF
+---- Zypper
+---- APT
|
v
Low-Level Package System
|
+---- RPM
+---- DPKG
-----------------
There are two levels:
High-Level Package Manager
|
+---- DNF
+---- Zypper
+---- APT
|
v
Low-Level Package System
|
+---- RPM
+---- DPKG
For example:
dnf install httpd
dnf install httpd
uses the RPM package system underneath.
Similarly:
apt install apache2
uses DPKG underneath.
2. RPM PACKAGE MANAGEMENT
==========================
RPM stands for RPM Package Manager.
RPM packages normally have a .rpm extension.
Example:
bzip2-1.0.6-28.el8.x86_64.rpm
Package name: bzip2
Version: 1.0.6
Release: 28.el8
Architecture: x86_64
EXERCISE 1 - CHECK INSTALLED RPM PACKAGES
-----------------------------------------
[root@rocky01 ~]# rpm -qa | wc -l
Expected output:
450
NOTE:
The exact number will vary depending on the installed system.
Ubuntu equivalent:
[root@ubuntu02 ~]# dpkg -l | wc -l
EXERCISE 2 - CHECK A SPECIFIC PACKAGE
-------------------------------------
Check whether bzip2 is installed:
[root@rocky01 ~]# rpm -qa bzip2
Expected output:
bzip2-1.0.6-28.el8.x86_64
EXERCISE 3 - DISPLAY RPM PACKAGE INFORMATION
--------------------------------------------
[root@rocky01 ~]# rpm -qi bzip2
Example output:
Name : bzip2
Version : 1.0.6
Release : 28.el8
Architecture: x86_64
Summary : File compression utility
EXERCISE 4 - LIST FILES INSTALLED BY A PACKAGE
----------------------------------------------
[root@rocky01 ~]# rpm -ql bzip2
Example output:
/usr/bin/bunzip2
/usr/bin/bzip2
/usr/bin/bzip2recover
/usr/share/man/man1/bzip2.1.gz
3. RPM - HOW TO CHECK PACKAGE DEPENDENCIES
==========================================
Dependencies are one of the most important concepts in Linux package management.
Example:
Package A
|
+---- Package B
|
+---- Package C
|
+---- Package D
If Package B or C is missing, the application may not install or function
correctly.
EXERCISE 5 - CHECK RPM PACKAGE DEPENDENCIES
-------------------------------------------
[root@rocky01 ~]# rpm -qR bzip2
Example output:
/bin/sh
libc.so.6()(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libbz2.so.1()(64bit)
rtld(GNU_HASH)
Explanation:
-q = Query
-R = Requirements
Therefore:
rpm -qR bzip2
means:
Display the dependencies/requirements of the installed bzip2 package.
EXERCISE 6 - CHECK WHICH PACKAGE PROVIDES A FILE
------------------------------------------------
Suppose you have:
/usr/bin/bzip2
Find which RPM package owns the file:
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
Example output:
bzip2-1.0.6-28.el8.x86_64
Another example:
[root@rocky01 ~]# rpm -qf /etc/os-release
Example output:
rocky-release-8.x-x.x.el8.noarch
-f means file.
EXERCISE 7 - CHECK DEPENDENCIES OF AN RPM FILE BEFORE INSTALLING
---------------------------------------------------------------
If you have an RPM file:
[root@rocky01 ~]# rpm -qpR package.rpm
Example:
[root@rocky01 ~]# rpm -qpR epel-release-8-22.el8.noarch.rpm
Explanation:
-q = Query
-p = Query an RPM package file
-R = Requirements
This is useful for checking dependencies before installing an RPM.
EXERCISE 8 - TEST RPM INSTALLATION WITHOUT INSTALLING
------------------------------------------------------
Use the --test option:
[root@rocky01 ~]# rpm -ivh bzip2-1.0.6-26.el8.x86_64.rpm --test
Example output:
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Install the RPM:
apt install apache2
uses DPKG underneath.
2. RPM PACKAGE MANAGEMENT
==========================
RPM stands for RPM Package Manager.
RPM packages normally have a .rpm extension.
Example:
bzip2-1.0.6-28.el8.x86_64.rpm
Package name: bzip2
Version: 1.0.6
Release: 28.el8
Architecture: x86_64
EXERCISE 1 - CHECK INSTALLED RPM PACKAGES
-----------------------------------------
[root@rocky01 ~]# rpm -qa | wc -l
Expected output:
450
NOTE:
The exact number will vary depending on the installed system.
Ubuntu equivalent:
[root@ubuntu02 ~]# dpkg -l | wc -l
EXERCISE 2 - CHECK A SPECIFIC PACKAGE
-------------------------------------
Check whether bzip2 is installed:
[root@rocky01 ~]# rpm -qa bzip2
Expected output:
bzip2-1.0.6-28.el8.x86_64
EXERCISE 3 - DISPLAY RPM PACKAGE INFORMATION
--------------------------------------------
[root@rocky01 ~]# rpm -qi bzip2
Example output:
Name : bzip2
Version : 1.0.6
Release : 28.el8
Architecture: x86_64
Summary : File compression utility
EXERCISE 4 - LIST FILES INSTALLED BY A PACKAGE
----------------------------------------------
[root@rocky01 ~]# rpm -ql bzip2
Example output:
/usr/bin/bunzip2
/usr/bin/bzip2
/usr/bin/bzip2recover
/usr/share/man/man1/bzip2.1.gz
3. RPM - HOW TO CHECK PACKAGE DEPENDENCIES
==========================================
Dependencies are one of the most important concepts in Linux package management.
Example:
Package A
|
+---- Package B
|
+---- Package C
|
+---- Package D
If Package B or C is missing, the application may not install or function
correctly.
EXERCISE 5 - CHECK RPM PACKAGE DEPENDENCIES
-------------------------------------------
[root@rocky01 ~]# rpm -qR bzip2
Example output:
/bin/sh
libc.so.6()(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libbz2.so.1()(64bit)
rtld(GNU_HASH)
Explanation:
-q = Query
-R = Requirements
Therefore:
rpm -qR bzip2
means:
Display the dependencies/requirements of the installed bzip2 package.
EXERCISE 6 - CHECK WHICH PACKAGE PROVIDES A FILE
------------------------------------------------
Suppose you have:
/usr/bin/bzip2
Find which RPM package owns the file:
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
Example output:
bzip2-1.0.6-28.el8.x86_64
Another example:
[root@rocky01 ~]# rpm -qf /etc/os-release
Example output:
rocky-release-8.x-x.x.el8.noarch
-f means file.
EXERCISE 7 - CHECK DEPENDENCIES OF AN RPM FILE BEFORE INSTALLING
---------------------------------------------------------------
If you have an RPM file:
[root@rocky01 ~]# rpm -qpR package.rpm
Example:
[root@rocky01 ~]# rpm -qpR epel-release-8-22.el8.noarch.rpm
Explanation:
-q = Query
-p = Query an RPM package file
-R = Requirements
This is useful for checking dependencies before installing an RPM.
EXERCISE 8 - TEST RPM INSTALLATION WITHOUT INSTALLING
------------------------------------------------------
Use the --test option:
[root@rocky01 ~]# rpm -ivh bzip2-1.0.6-26.el8.x86_64.rpm --test
Example output:
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Install the RPM:
[root@rocky01 ~]# rpm -ivh bzip2-1.0.6-26.el8.x86_64.rpm
Example output:
Verifying... ################################# [100%]
Preparing...################################# [100%]
Updating / installing...
1:bzip2-1.0.6-26.el8 ################################# [100%]
UBUNTU DPKG EXAMPLES
--------------------
Remove wget:
[root@ubuntu02 ~]# apt remove wget
Install a local DEB package:
Example output:
Verifying... ################################# [100%]
Preparing...################################# [100%]
Updating / installing...
1:bzip2-1.0.6-26.el8 ################################# [100%]
UBUNTU DPKG EXAMPLES
--------------------
Remove wget:
[root@ubuntu02 ~]# apt remove wget
Install a local DEB package:
[root@ubuntu02 ]# cp /mnt/pool/main/w/wget .
[root@ubuntu02 ]# dpkg -i wget_1.21.4-1ubuntu4.1_amd64.deb
Display package status:
[root@ubuntu02 ~]# dpkg -s wget
List files installed by wget:
[root@ubuntu02 ~]# dpkg -L wget
Check package status:
[root@ubuntu02 ~]# dpkg -l wget
4. DNF PACKAGE SEARCH
=====================
DNF can search configured repositories for packages.
EXERCISE 9 - SEARCH FOR A PACKAGE
---------------------------------
Search for httpd:
[root@rocky01 ~]# dnf search httpd
Example output:
========================== Name Exactly Matched: httpd ==========================
httpd.x86_64 : Apache HTTP Server
============================= Name Matched: httpd ===============================
httpd-tools.x86_64 : Tools for the Apache HTTP Server
Search for vim:
[root@rocky01 ~]# dnf search vim
Example:
vim-enhanced.x86_64 : A version of the VIM editor which includes additional features
vim-common.x86_64 : The common files for VIM
vim-filesystem.x86_64 : VIM filesystem layout
EXERCISE 10 - FIND PACKAGE PROVIDING A COMMAND/FILE
---------------------------------------------------
Suppose you want to find which package provides a command or file.
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
Example output:
httpd-tools.x86_64 : Tools for the Apache HTTP Server
This is extremely useful when you know the command/file but do not know
the package name.
EXERCISE 11 - SEARCH FOR A PACKAGE AND INSTALL IT
-------------------------------------------------
Search:
[root@rocky01 ~]# dnf search tree
Install:
[root@rocky01 ~]# dnf install -y tree
Expected:
Dependencies resolved.
Installing:
tree.x86_64
Complete!
Verify:
[root@rocky01 ~]# rpm -q tree
Example:
tree-x.x.x-x.el8.x86_64
6. ROCKY LINUX OS PATCHING USING DNF
====================================
Before patching, check the current kernel:
[root@rocky01 ~]# uname -r
Example:
4.18.0-xxx.el8.x86_64
Check repositories:
[root@rocky01 ~]# dnf repolist
Check available updates:
[root@rocky01 ~]# dnf check-update
EXERCISE 12 - SEARCH FOR KERNEL PACKAGE
---------------------------------------
[root@rocky01 ~]# dnf search kernel
You may see:
kernel.x86_64
kernel-core.x86_64
kernel-modules.x86_64
kernel-headers.x86_64
EXERCISE 13 - CHECK KERNEL UPDATE
---------------------------------
[root@rocky01 ~]# dnf check-update kernel
Example:
kernel.x86_64 4.18.0-xxx.el8_10 baseos
EXERCISE 14 - UPDATE KERNEL
---------------------------
[root@rocky01 ~]# dnf update kernel
Expected:
Dependencies resolved.
Transaction Summary
Upgrade 1 Package
Complete!
Check installed kernels:
[root@rocky01 ~]# rpm -q kernel
Example:
kernel-4.18.0-xxx.el8.x86_64
kernel-4.18.0-yyy.el8.x86_64
EXERCISE 15 - DIFFERENCE BETWEEN DNF COMMANDS
---------------------------------------------
Install:
[root@rocky01 ~]# dnf install kernel
Installs the kernel package when it is not already installed.
Update:
[root@rocky01 ~]# dnf update kernel
Updates the installed kernel package if a newer version is available.
Upgrade:
[root@rocky01 ~]# dnf upgrade kernel
Upgrades the kernel package.
With modern DNF, update and upgrade generally have equivalent behavior.
EXERCISE 16 - COMPLETE ROCKY LINUX PATCHING
-------------------------------------------
Check updates:
[root@rocky01 ~]# dnf check-update
Apply patches:
[root@rocky01 ~]# dnf update -y
Expected:
Dependencies resolved.
...
Complete!
Reboot if required:
[root@rocky01 ~]# reboot
After reboot:
[root@rocky01 ~]# uname -r
Example:
4.18.0-yyy.el8.x86_64
EXCLUDE A PACKAGE DURING PATCHING
---------------------------------
Example: exclude httpd from an update transaction:
[root@rocky01 ~]# dnf update -y --exclude=httpd
You can also use a package glob when required:
[root@rocky01 ~]# dnf update -y --exclude='httpd*'
Always verify the exact package name before using exclusions in production.
7. RED HAT SUBSCRIPTION MANAGEMENT
==================================
Red Hat Enterprise Linux systems normally use Red Hat subscriptions to access
entitled repositories, updates and support services.
IMPORTANT:
A Red Hat subscription is one supported method for patching RHEL systems.
For disconnected or restricted environments, organizations may instead use
approved offline ISO/content repositories or internal mirrors.
Check RHEL version:
[root@redhat01 /]# cat /etc/redhat-release
Example:
Red Hat Enterprise Linux release 8.x (Ootpa)
EXERCISE 17 - CHECK SUBSCRIPTION STATUS
---------------------------------------
[root@redhat01 /]# subscription-manager status
Example:
Overall Status: Current
EXERCISE 18 - REGISTER THE RHEL SERVER
--------------------------------------
[root@redhat01 /]# subscription-manager register
The command prompts for Red Hat credentials unless authentication is already
configured.
EXERCISE 19 - CHECK SUBSCRIPTIONS
----------------------------------
[root@redhat01 /]# subscription-manager status
[root@redhat01 /]# subscription-manager list
[root@redhat01 /]# subscription-manager list --consumed
Example information may include:
Subscription Name
Product Name
Pool ID
Contract
Start Date
End Date
Status
EXERCISE 20 - REFRESH SUBSCRIPTION DATA
---------------------------------------
[root@redhat01 /]# subscription-manager refresh
EXERCISE 21 - AUTO-ATTACH
-------------------------
[root@redhat01 /]# subscription-manager attach --auto
NOTE:
The exact command availability/behavior depends on the RHEL version and
subscription-management configuration.
EXERCISE 22 - REMOVE A SUBSCRIPTION
-----------------------------------
[root@redhat01 /]# subscription-manager remove --pool=<subscription_id>
EXERCISE 23 - UNREGISTER A SERVER
---------------------------------
[root@redhat01 /]# subscription-manager unregister
8. SECURITY PATCHING AND CVE/RHSA CHECKS
========================================
Security updates are an important part of enterprise patching.
Check security updates:
[root@redhat01 /]# dnf check-update --security
Count output lines:
[root@redhat01 /]# dnf check-update --security | wc -l
Check all available updates:
[root@redhat01 /]# dnf check-update
Count available update output lines:
[root@redhat01 /]# dnf check-update | wc -l
CHECK SECURITY ADVISORY INFORMATION
-----------------------------------
[root@redhat01 /]# dnf updateinfo info --security
This displays available security advisory information.
CVE EXAMPLES
------------
Example:
[root@redhat01 /]# yum check-update --cve CVE-2026-63382
Attempt to update packages related to a specific CVE:
[root@redhat01 /]# yum update --cve CVE-2026-63382
General update:
[root@redhat01 /]# dnf update
CHECK RHSA ADVISORY
-------------------
Example:
[root@redhat01 /]# yum update --advisory=RHSA-2022:7106
NOTE:
CVE/RHSA command support and syntax can vary by RHEL/DNF/YUM version and
installed plugins. Always test the command with the target RHEL version and
review the transaction before confirming a production update.
9. SUSE LINUX PACKAGE MANAGEMENT USING ZYPPER
=============================================
SUSE Linux uses RPM packages but normally uses Zypper as its high-level
package-management tool.
SUSE Linux
|
+---- RPM
|
+---- Zypper
Common package examples:
vim
wget
apache2
curl
EXERCISE 24 - CHECK SUSE VERSION
--------------------------------
[root@sles01 ~]# cat /etc/os-release
Example:
NAME="SLES"
VERSION="15-SP6"
EXERCISE 25 - CHECK CONFIGURED SUSE REPOSITORIES
------------------------------------------------
[root@sles01 ~]# zypper repos
Example:
Repository priorities in effect:
-------------------------------
99 | SLES15-SP6-Pool
99 | SLES15-SP6-Updates
EXERCISE 26 - SEARCH FOR A PACKAGE USING ZYPPER
-----------------------------------------------
[root@sles01 ~]# zypper search vim
Example:
S | Name | Summary
--+-------------+----------------
i | vim | Vi IMproved
| vim-data | Data files for vim
EXERCISE 27 - INSTALL A PACKAGE USING ZYPPER
---------------------------------------------
[root@sles01 ~]# zypper install vim
Expected:
The following NEW package is going to be installed:
vim
Overall download size: ...
Continue? [y/n/v/...? shows all options] (y):
Enter:
y
Expected:
Successfully installed.
Verify:
[root@sles01 ~]# rpm -q vim
Example:
vim-...
EXERCISE 28 - CHECK SUSE UPDATES
--------------------------------
Refresh repository metadata:
[root@sles01 ~]# zypper refresh
Expected:
Repository 'SLES15-SP6-Updates' is up to date.
All repositories have been refreshed.
List available patches:
[root@sles01 ~]# zypper list-patches
EXERCISE 29 - SUSE OS PATCHING
------------------------------
Perform a normal package update:
[root@sles01 ~]# zypper update
For patch-oriented maintenance:
[root@sles01 ~]# zypper patch
Expected:
The following patches are going to be installed:
...
Overall download size: ...
Continue? [y/n/v/...? shows all options] (y):
Enter:
y
EXERCISE 30 - CHECK SUSE KERNEL
------------------------------
Before patching:
[root@sles01 ~]# uname -r
Example:
5.x.x-150600.x-default
After patching and rebooting:
[root@sles01 ~]# reboot
Then:
[root@sles01 ~]# uname -r
Example:
5.x.x-150600.y-default
The exact kernel version depends on the installed SUSE release and available
updates.
IMPORTANT SUSE COMMANDS
-----------------------
List repositories:
[root@sles01 ~]# zypper repos
Refresh repositories:
[root@sles01 ~]# zypper refresh
Search package:
[root@sles01 ~]# zypper search package
Install package:
[root@sles01 ~]# zypper install package
Remove package:
[root@sles01 ~]# zypper remove package
Update packages:
[root@sles01 ~]# zypper update
Apply patches:
[root@sles01 ~]# zypper patch
List patches:
[root@sles01 ~]# zypper list-patches
Package information:
[root@sles01 ~]# zypper info package
10. UBUNTU PACKAGE MANAGEMENT USING APT
=======================================
Ubuntu uses DPKG at the low level and APT for package management.
Ubuntu
|
+---- APT
|
+---- DPKG
Common Ubuntu packages:
vim
apache2
wget
curl
tree
EXERCISE 31 - CHECK UBUNTU VERSION
----------------------------------
[root@ubuntu01 ~]# cat /etc/os-release
Example:
NAME="Ubuntu"
VERSION="24.04 LTS"
EXERCISE 32 - SEARCH FOR A PACKAGE
-----------------------------------
[root@ubuntu01 ~]# apt search vim
Example:
Sorting...
Full Text Search...
vim/noble-updates ...
vim-common/noble-updates ...
vim-runtime/noble-updates ...
EXERCISE 33 - UPDATE UBUNTU REPOSITORY METADATA
------------------------------------------------
[root@ubuntu01 ~]# apt update
Expected:
Hit:1 http://archive.ubuntu.com/ubuntu ...
Get:2 ...
Fetched ... kB
Reading package lists... Done
IMPORTANT:
apt update does not install updates.
It refreshes the local package metadata.
EXERCISE 34 - UPGRADE UBUNTU PACKAGES
-------------------------------------
[root@ubuntu01 ~]# apt upgrade
Or automatically answer yes:
[root@ubuntu01 ~]# apt upgrade -y
Expected:
The following packages will be upgraded:
...
Do you want to continue? [Y/n]
With -y, the command automatically accepts the prompt.
EXERCISE 35 - INSTALL AN UBUNTU PACKAGE
---------------------------------------
Search:
[root@ubuntu01 ~]# apt search tree
Install:
[root@ubuntu01 ~]# apt install tree -y
Verify using DPKG:
[root@ubuntu01 ~]# dpkg -l tree
Example:
ii tree 2.1.x amd64 displays an indented directory tree
EXERCISE 36 - REMOVE AN UBUNTU PACKAGE
--------------------------------------
[root@ubuntu01 ~]# apt remove tree -y
Verify:
[root@ubuntu01 ~]# dpkg -l tree
IMPORTANT UBUNTU COMMANDS
-------------------------
Refresh repository metadata:
[root@ubuntu01 ~]# apt update
Upgrade packages:
[root@ubuntu01 ~]# apt upgrade
Upgrade automatically:
[root@ubuntu01 ~]# apt upgrade -y
Search package:
[root@ubuntu01 ~]# apt search package
Install package:
[root@ubuntu01 ~]# apt install package
Remove package:
[root@ubuntu01 ~]# apt remove package
[root@ubuntu02 ]# dpkg -i wget_1.21.4-1ubuntu4.1_amd64.deb
Display package status:
[root@ubuntu02 ~]# dpkg -s wget
List files installed by wget:
[root@ubuntu02 ~]# dpkg -L wget
Check package status:
[root@ubuntu02 ~]# dpkg -l wget
4. DNF PACKAGE SEARCH
=====================
DNF can search configured repositories for packages.
EXERCISE 9 - SEARCH FOR A PACKAGE
---------------------------------
Search for httpd:
[root@rocky01 ~]# dnf search httpd
Example output:
========================== Name Exactly Matched: httpd ==========================
httpd.x86_64 : Apache HTTP Server
============================= Name Matched: httpd ===============================
httpd-tools.x86_64 : Tools for the Apache HTTP Server
Search for vim:
[root@rocky01 ~]# dnf search vim
Example:
vim-enhanced.x86_64 : A version of the VIM editor which includes additional features
vim-common.x86_64 : The common files for VIM
vim-filesystem.x86_64 : VIM filesystem layout
EXERCISE 10 - FIND PACKAGE PROVIDING A COMMAND/FILE
---------------------------------------------------
Suppose you want to find which package provides a command or file.
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
Example output:
httpd-tools.x86_64 : Tools for the Apache HTTP Server
This is extremely useful when you know the command/file but do not know
the package name.
EXERCISE 11 - SEARCH FOR A PACKAGE AND INSTALL IT
-------------------------------------------------
Search:
[root@rocky01 ~]# dnf search tree
Install:
[root@rocky01 ~]# dnf install -y tree
Expected:
Dependencies resolved.
Installing:
tree.x86_64
Complete!
Verify:
[root@rocky01 ~]# rpm -q tree
Example:
tree-x.x.x-x.el8.x86_64
6. ROCKY LINUX OS PATCHING USING DNF
====================================
Before patching, check the current kernel:
[root@rocky01 ~]# uname -r
Example:
4.18.0-xxx.el8.x86_64
Check repositories:
[root@rocky01 ~]# dnf repolist
Check available updates:
[root@rocky01 ~]# dnf check-update
EXERCISE 12 - SEARCH FOR KERNEL PACKAGE
---------------------------------------
[root@rocky01 ~]# dnf search kernel
You may see:
kernel.x86_64
kernel-core.x86_64
kernel-modules.x86_64
kernel-headers.x86_64
EXERCISE 13 - CHECK KERNEL UPDATE
---------------------------------
[root@rocky01 ~]# dnf check-update kernel
Example:
kernel.x86_64 4.18.0-xxx.el8_10 baseos
EXERCISE 14 - UPDATE KERNEL
---------------------------
[root@rocky01 ~]# dnf update kernel
Expected:
Dependencies resolved.
Transaction Summary
Upgrade 1 Package
Complete!
Check installed kernels:
[root@rocky01 ~]# rpm -q kernel
Example:
kernel-4.18.0-xxx.el8.x86_64
kernel-4.18.0-yyy.el8.x86_64
EXERCISE 15 - DIFFERENCE BETWEEN DNF COMMANDS
---------------------------------------------
Install:
[root@rocky01 ~]# dnf install kernel
Installs the kernel package when it is not already installed.
Update:
[root@rocky01 ~]# dnf update kernel
Updates the installed kernel package if a newer version is available.
Upgrade:
[root@rocky01 ~]# dnf upgrade kernel
Upgrades the kernel package.
With modern DNF, update and upgrade generally have equivalent behavior.
EXERCISE 16 - COMPLETE ROCKY LINUX PATCHING
-------------------------------------------
Check updates:
[root@rocky01 ~]# dnf check-update
Apply patches:
[root@rocky01 ~]# dnf update -y
Expected:
Dependencies resolved.
...
Complete!
Reboot if required:
[root@rocky01 ~]# reboot
After reboot:
[root@rocky01 ~]# uname -r
Example:
4.18.0-yyy.el8.x86_64
EXCLUDE A PACKAGE DURING PATCHING
---------------------------------
Example: exclude httpd from an update transaction:
[root@rocky01 ~]# dnf update -y --exclude=httpd
You can also use a package glob when required:
[root@rocky01 ~]# dnf update -y --exclude='httpd*'
Always verify the exact package name before using exclusions in production.
7. RED HAT SUBSCRIPTION MANAGEMENT
==================================
Red Hat Enterprise Linux systems normally use Red Hat subscriptions to access
entitled repositories, updates and support services.
IMPORTANT:
A Red Hat subscription is one supported method for patching RHEL systems.
For disconnected or restricted environments, organizations may instead use
approved offline ISO/content repositories or internal mirrors.
Check RHEL version:
[root@redhat01 /]# cat /etc/redhat-release
Example:
Red Hat Enterprise Linux release 8.x (Ootpa)
EXERCISE 17 - CHECK SUBSCRIPTION STATUS
---------------------------------------
[root@redhat01 /]# subscription-manager status
Example:
Overall Status: Current
EXERCISE 18 - REGISTER THE RHEL SERVER
--------------------------------------
[root@redhat01 /]# subscription-manager register
The command prompts for Red Hat credentials unless authentication is already
configured.
EXERCISE 19 - CHECK SUBSCRIPTIONS
----------------------------------
[root@redhat01 /]# subscription-manager status
[root@redhat01 /]# subscription-manager list
[root@redhat01 /]# subscription-manager list --consumed
Example information may include:
Subscription Name
Product Name
Pool ID
Contract
Start Date
End Date
Status
EXERCISE 20 - REFRESH SUBSCRIPTION DATA
---------------------------------------
[root@redhat01 /]# subscription-manager refresh
EXERCISE 21 - AUTO-ATTACH
-------------------------
[root@redhat01 /]# subscription-manager attach --auto
NOTE:
The exact command availability/behavior depends on the RHEL version and
subscription-management configuration.
EXERCISE 22 - REMOVE A SUBSCRIPTION
-----------------------------------
[root@redhat01 /]# subscription-manager remove --pool=<subscription_id>
EXERCISE 23 - UNREGISTER A SERVER
---------------------------------
[root@redhat01 /]# subscription-manager unregister
8. SECURITY PATCHING AND CVE/RHSA CHECKS
========================================
Security updates are an important part of enterprise patching.
Check security updates:
[root@redhat01 /]# dnf check-update --security
Count output lines:
[root@redhat01 /]# dnf check-update --security | wc -l
Check all available updates:
[root@redhat01 /]# dnf check-update
Count available update output lines:
[root@redhat01 /]# dnf check-update | wc -l
CHECK SECURITY ADVISORY INFORMATION
-----------------------------------
[root@redhat01 /]# dnf updateinfo info --security
This displays available security advisory information.
CVE EXAMPLES
------------
Example:
[root@redhat01 /]# yum check-update --cve CVE-2026-63382
Attempt to update packages related to a specific CVE:
[root@redhat01 /]# yum update --cve CVE-2026-63382
General update:
[root@redhat01 /]# dnf update
CHECK RHSA ADVISORY
-------------------
Example:
[root@redhat01 /]# yum update --advisory=RHSA-2022:7106
NOTE:
CVE/RHSA command support and syntax can vary by RHEL/DNF/YUM version and
installed plugins. Always test the command with the target RHEL version and
review the transaction before confirming a production update.
9. SUSE LINUX PACKAGE MANAGEMENT USING ZYPPER
=============================================
SUSE Linux uses RPM packages but normally uses Zypper as its high-level
package-management tool.
SUSE Linux
|
+---- RPM
|
+---- Zypper
Common package examples:
vim
wget
apache2
curl
EXERCISE 24 - CHECK SUSE VERSION
--------------------------------
[root@sles01 ~]# cat /etc/os-release
Example:
NAME="SLES"
VERSION="15-SP6"
EXERCISE 25 - CHECK CONFIGURED SUSE REPOSITORIES
------------------------------------------------
[root@sles01 ~]# zypper repos
Example:
Repository priorities in effect:
-------------------------------
99 | SLES15-SP6-Pool
99 | SLES15-SP6-Updates
EXERCISE 26 - SEARCH FOR A PACKAGE USING ZYPPER
-----------------------------------------------
[root@sles01 ~]# zypper search vim
Example:
S | Name | Summary
--+-------------+----------------
i | vim | Vi IMproved
| vim-data | Data files for vim
EXERCISE 27 - INSTALL A PACKAGE USING ZYPPER
---------------------------------------------
[root@sles01 ~]# zypper install vim
Expected:
The following NEW package is going to be installed:
vim
Overall download size: ...
Continue? [y/n/v/...? shows all options] (y):
Enter:
y
Expected:
Successfully installed.
Verify:
[root@sles01 ~]# rpm -q vim
Example:
vim-...
EXERCISE 28 - CHECK SUSE UPDATES
--------------------------------
Refresh repository metadata:
[root@sles01 ~]# zypper refresh
Expected:
Repository 'SLES15-SP6-Updates' is up to date.
All repositories have been refreshed.
List available patches:
[root@sles01 ~]# zypper list-patches
EXERCISE 29 - SUSE OS PATCHING
------------------------------
Perform a normal package update:
[root@sles01 ~]# zypper update
For patch-oriented maintenance:
[root@sles01 ~]# zypper patch
Expected:
The following patches are going to be installed:
...
Overall download size: ...
Continue? [y/n/v/...? shows all options] (y):
Enter:
y
EXERCISE 30 - CHECK SUSE KERNEL
------------------------------
Before patching:
[root@sles01 ~]# uname -r
Example:
5.x.x-150600.x-default
After patching and rebooting:
[root@sles01 ~]# reboot
Then:
[root@sles01 ~]# uname -r
Example:
5.x.x-150600.y-default
The exact kernel version depends on the installed SUSE release and available
updates.
IMPORTANT SUSE COMMANDS
-----------------------
List repositories:
[root@sles01 ~]# zypper repos
Refresh repositories:
[root@sles01 ~]# zypper refresh
Search package:
[root@sles01 ~]# zypper search package
Install package:
[root@sles01 ~]# zypper install package
Remove package:
[root@sles01 ~]# zypper remove package
Update packages:
[root@sles01 ~]# zypper update
Apply patches:
[root@sles01 ~]# zypper patch
List patches:
[root@sles01 ~]# zypper list-patches
Package information:
[root@sles01 ~]# zypper info package
10. UBUNTU PACKAGE MANAGEMENT USING APT
=======================================
Ubuntu uses DPKG at the low level and APT for package management.
Ubuntu
|
+---- APT
|
+---- DPKG
Common Ubuntu packages:
vim
apache2
wget
curl
tree
EXERCISE 31 - CHECK UBUNTU VERSION
----------------------------------
[root@ubuntu01 ~]# cat /etc/os-release
Example:
NAME="Ubuntu"
VERSION="24.04 LTS"
EXERCISE 32 - SEARCH FOR A PACKAGE
-----------------------------------
[root@ubuntu01 ~]# apt search vim
Example:
Sorting...
Full Text Search...
vim/noble-updates ...
vim-common/noble-updates ...
vim-runtime/noble-updates ...
EXERCISE 33 - UPDATE UBUNTU REPOSITORY METADATA
------------------------------------------------
[root@ubuntu01 ~]# apt update
Expected:
Hit:1 http://archive.ubuntu.com/ubuntu ...
Get:2 ...
Fetched ... kB
Reading package lists... Done
IMPORTANT:
apt update does not install updates.
It refreshes the local package metadata.
EXERCISE 34 - UPGRADE UBUNTU PACKAGES
-------------------------------------
[root@ubuntu01 ~]# apt upgrade
Or automatically answer yes:
[root@ubuntu01 ~]# apt upgrade -y
Expected:
The following packages will be upgraded:
...
Do you want to continue? [Y/n]
With -y, the command automatically accepts the prompt.
EXERCISE 35 - INSTALL AN UBUNTU PACKAGE
---------------------------------------
Search:
[root@ubuntu01 ~]# apt search tree
Install:
[root@ubuntu01 ~]# apt install tree -y
Verify using DPKG:
[root@ubuntu01 ~]# dpkg -l tree
Example:
ii tree 2.1.x amd64 displays an indented directory tree
EXERCISE 36 - REMOVE AN UBUNTU PACKAGE
--------------------------------------
[root@ubuntu01 ~]# apt remove tree -y
Verify:
[root@ubuntu01 ~]# dpkg -l tree
IMPORTANT UBUNTU COMMANDS
-------------------------
Refresh repository metadata:
[root@ubuntu01 ~]# apt update
Upgrade packages:
[root@ubuntu01 ~]# apt upgrade
Upgrade automatically:
[root@ubuntu01 ~]# apt upgrade -y
Search package:
[root@ubuntu01 ~]# apt search package
Install package:
[root@ubuntu01 ~]# apt install package
Remove package:
[root@ubuntu01 ~]# apt remove package
Remove completely package:
[root@ubuntu01 ~]# apt purge package
Package information:
[root@ubuntu01 ~]# apt show package
List installed packages:
[root@ubuntu01 ~]# dpkg -l
Check specific package:
[root@ubuntu01 ~]# dpkg -l package
11. OFFLINE PATCHING USING ISO
==============================
Offline repositories are useful when servers do not have Internet access.
Architecture:
Rocky Linux ISO
|
v
/mnt
|
v
Local Repository
|
v
DNF/YUM
EXERCISE 37 - MOUNT ISO
-----------------------
[root@rocky01 ~]# mount /dev/cdrom /mnt
Verify:
[root@rocky01 ~]# ls -l /mnt
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 38 - CONFIGURE LOCAL ISO REPOSITORY
--------------------------------------------
Create repository file:
[root@rocky01 ~]# vi /etc/yum.repos.d/local-iso.repo
Recommended configuration for a Rocky 8 ISO:
[Rocky8-BaseOS]
name=Rocky Linux 8 BaseOS - ISO
baseurl=file:///mnt/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky Linux 8 AppStream - ISO
baseurl=file:///mnt/AppStream/
enabled=1
gpgcheck=0
NOTE:
gpgcheck=0 is used here to simplify the training lab. In production, use
appropriate Red Hat/Rocky GPG keys and enable package signature validation.
Clean cache:
[root@rocky01 ~]# dnf clean all
Build cache:
[root@rocky01 ~]# dnf makecache
Check repositories:
[root@rocky01 ~]# dnf repolist
12. CENTRALIZED ROCKY LINUX 8 FTP REPOSITORY
============================================
Repository server IP:
192.168.2.164
EXERCISE 39 - MOUNT ISO ON REPOSITORY SERVER
--------------------------------------------
[root@rocky-repo ~]# mount /dev/cdrom /mnt
Verify:
[root@rocky-repo ~]# ls /mnt
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 40 - INSTALL REPOSITORY PACKAGES
-----------------------------------------
Install VSFTPD and repository tools:
[root@rocky-repo ~]# dnf install -y vsftpd createrepo_c
Expected:
Installed:
vsftpd
createrepo_c
Complete!
EXERCISE 41 - CREATE FTP REPOSITORY DIRECTORY
---------------------------------------------
[root@rocky-repo ~]# mkdir -p /var/ftp/pub
Copy ISO content:
[root@rocky-repo ~]# cp -a /mnt/. /var/ftp/pub/
Verify:
[root@rocky-repo ~]# ls /var/ftp/pub
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 42 - VERIFY REPOSITORY METADATA
----------------------------------------
[root@rocky-repo ~]# ls /var/ftp/pub/BaseOS/repodata
[root@rocky-repo ~]# ls /var/ftp/pub/AppStream/repodata
You should see repository metadata files.
IMPORTANT:
If the Rocky Linux ISO already contains valid repodata, preserve that metadata.
Do not unnecessarily regenerate it.
If building a repository from individual RPM files rather than a complete ISO
tree, createrepo_c can be used to generate metadata.
EXERCISE 43 - CONFIGURE FTP SERVICE
-----------------------------------
Enable:
[root@rocky-repo ~]# systemctl enable vsftpd
Start:
[root@rocky-repo ~]# systemctl start vsftpd
Check:
[root@rocky-repo ~]# systemctl status vsftpd
Expected:
Active: active (running)
EXERCISE 44 - CONFIGURE FIREWALL
--------------------------------
[root@rocky-repo ~]# firewall-cmd --permanent --add-service=ftp
Expected:
success
Reload:
[root@rocky-repo ~]# firewall-cmd --reload
Expected:
success
Verify:
[root@rocky-repo ~]# firewall-cmd --list-services
Expected:
ftp
EXERCISE 45 - TEST REPOSITORY CONNECTIVITY
------------------------------------------
From rocky01:
[root@rocky01 ~]# ping -c 4 192.168.2.164
Expected:
64 bytes from 192.168.2.164: icmp_seq=1 ...
64 bytes from 192.168.2.164: icmp_seq=2 ...
Test FTP:
[root@rocky01 ~]# ftp 192.168.2.164
Expected:
Connected to 192.168.2.164.
220 (vsFTPd ...)
Exit:
ftp> bye
221 Goodbye.
EXERCISE 46 - CONFIGURE ROCKY LINUX FTP REPOSITORY
--------------------------------------------------
Create:
[root@rocky01 ~]# vi /etc/yum.repos.d/rocky8-local.repo
Add:
[Rocky8-BaseOS]
name=Rocky 8 BaseOS FTP
baseurl=ftp://192.168.2.164/pub/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky 8 AppStream FTP
baseurl=ftp://192.168.2.164/pub/AppStream/
enabled=1
gpgcheck=0
EXERCISE 47 - TEST FTP REPOSITORY
---------------------------------
Clean cache:
[root@rocky01 ~]# dnf clean all
Create metadata cache:
[root@rocky01 ~]# dnf makecache
Check repositories:
[root@rocky01 ~]# dnf repolist
Expected:
repo id repo name
Rocky8-BaseOS Rocky 8 BaseOS FTP
Rocky8-AppStream Rocky 8 AppStream FTP
Search package:
[root@rocky01 ~]# dnf search httpd
Install package:
[root@rocky01 ~]# dnf install -y httpd
13. REPOSITORY TROUBLESHOOTING
==============================
EXERCISE 48 - CHECK NETWORK
---------------------------
[root@rocky01 ~]# ping -c 4 192.168.2.164
EXERCISE 49 - CHECK FTP
-----------------------
[root@rocky01 ~]# ftp 192.168.2.164
EXERCISE 50 - CHECK FTP SERVICE
--------------------------------
On repository server:
[root@rocky-repo ~]# systemctl status vsftpd
Expected:
Active: active (running)
EXERCISE 51 - CHECK FIREWALL
----------------------------
[root@rocky-repo ~]# firewall-cmd --list-all
Check that FTP is allowed.
EXERCISE 52 - CHECK SELINUX
---------------------------
[root@rocky-repo ~]# getenforce
Expected:
Enforcing
For lab troubleshooting only, you can temporarily test:
[root@rocky-repo ~]# setenforce 0
Test the repository.
Return to enforcing:
[root@rocky-repo ~]# setenforce 1
Verify:
[root@rocky-repo ~]# getenforce
Expected:
Enforcing
IMPORTANT:
Do not leave SELinux disabled as a production workaround. Identify and correct
the actual SELinux policy/context issue.
EXERCISE 53 - CLEAR DNF CACHE
-----------------------------
[root@rocky01 ~]# dnf clean all
Optional cache cleanup:
[root@rocky01 ~]# rm -rf /var/cache/dnf
Rebuild cache:
[root@rocky01 ~]# dnf makecache
EXERCISE 54 - VERIFY REPOSITORY CONFIGURATION
---------------------------------------------
[root@rocky01 ~]# cat /etc/yum.repos.d/rocky8-local.repo
Expected:
[Rocky8-BaseOS]
name=Rocky 8 BaseOS FTP
baseurl=ftp://192.168.2.164/pub/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky 8 AppStream FTP
baseurl=ftp://192.168.2.164/pub/AppStream/
enabled=1
gpgcheck=0
14. COMPLETE ENTERPRISE PATCHING EXERCISE
=========================================
Now perform a complete patching workflow.
STEP 1 - PRE-CHECK
------------------
[root@rocky01 ~]# hostname
Expected:
rocky01
[root@rocky01 ~]# uptime
[root@rocky01 ~]# uname -r
[root@rocky01 ~]# cat /etc/redhat-release
[root@rocky01 ~]# df -h
[root@rocky01 ~]# free -h
[root@rocky01 ~]# systemctl --failed
STEP 2 - REPOSITORY CHECK
-------------------------
[root@rocky01 ~]# dnf repolist
STEP 3 - CHECK UPDATES
----------------------
[root@rocky01 ~]# dnf check-update
STEP 4 - APPLY PATCHES
----------------------
[root@rocky01 ~]# dnf update -y
Expected:
Dependencies resolved.
...
Complete!
STEP 5 - REBOOT
---------------
[root@rocky01 ~]# reboot
STEP 6 - CHECK KERNEL
---------------------
After login:
[root@rocky01 ~]# uname -r
STEP 7 - CHECK FAILED SERVICES
------------------------------
[root@rocky01 ~]# systemctl --failed
Expected:
0 loaded units listed.
STEP 8 - CHECK FILESYSTEM
-------------------------
[root@rocky01 ~]# df -h
STEP 9 - CHECK MEMORY
---------------------
[root@rocky01 ~]# free -h
STEP 10 - CHECK NETWORK
-----------------------
[root@rocky01 ~]# ping -c 4 8.8.8.8
For an enterprise environment, test the approved internal gateway/server instead
of relying only on an Internet address.
15. PRE- AND POST-PATCHING COMPARISON
=====================================
Record the results:
Check Pre-Patching Post-Patching
---------------------------------------------------
Hostname
OS Version
Kernel
Uptime
Filesystem
Memory
Failed Services
Network
Repository
Application
A successful patch is not complete until the post-patching validation and
application validation are completed.
16. FINAL PRACTICAL ASSESSMENT
==============================
The trainee should complete the following independently.
RPM
---
[ ] Install RPM package
[ ] Upgrade RPM package
[ ] Remove RPM package
[ ] Query RPM package
[ ] List package files
[ ] Check package dependencies
[ ] Find package owning a file
DNF
---
[ ] Search package using dnf search
[ ] Find package providing a file using dnf provides
[ ] Check updates
[ ] Update kernel
[ ] Patch the operating system
[ ] Exclude a package during patching
[ ] Check security updates
[ ] Check CVE/RHSA advisory information
SUSE
----
[ ] List repositories using zypper repos
[ ] Search package using zypper search
[ ] Install package using zypper install
[ ] Refresh repositories
[ ] List patches
[ ] Apply patches using zypper patch
[ ] Reboot and validate kernel
Ubuntu
------
[ ] Search package using apt search
[ ] Run apt update
[ ] Run apt upgrade
[ ] Install package
[ ] Remove package
[ ] Verify package using dpkg
Red Hat Subscription
--------------------
[ ] Check RHEL release
[ ] Check subscription status
[ ] Register server
[ ] List subscriptions
[ ] List consumed subscriptions
[ ] Refresh subscription data
[ ] Verify repositories
Repository
----------
[ ] Mount ISO
[ ] Configure local repository
[ ] Configure FTP repository
[ ] Configure firewall
[ ] Configure Rocky Linux client
[ ] Test FTP connectivity
[ ] Troubleshoot repository failure
Patching
--------
[ ] Perform pre-check
[ ] Check available updates
[ ] Check security updates
[ ] Apply patches
[ ] Reboot when required
[ ] Perform post-check
[ ] Compare pre/post results
[ ] Validate application
[ ] Close change after successful validation
17. DAY 6 COMMAND CHEAT SHEET
=============================
RPM / DNF - ROCKY/RHEL
----------------------
[root@rocky01 ~]# rpm -qa
[root@rocky01 ~]# rpm -qi bzip2
[root@rocky01 ~]# rpm -ql bzip2
[root@rocky01 ~]# rpm -qR bzip2
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
[root@rocky01 ~]# rpm -qpR package.rpm
[root@rocky01 ~]# rpm -ivh package.rpm
[root@rocky01 ~]# rpm -Uvh package.rpm
[root@rocky01 ~]# rpm -e package
[root@rocky01 ~]# dnf search httpd
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
[root@rocky01 ~]# dnf install httpd
[root@rocky01 ~]# dnf update -y
[root@rocky01 ~]# dnf check-update
[root@rocky01 ~]# dnf check-update --security
[root@rocky01 ~]# dnf updateinfo info --security
RED HAT SUBSCRIPTION
--------------------
[root@redhat01 /]# cat /etc/redhat-release
[root@redhat01 /]# subscription-manager status
[root@redhat01 /]# subscription-manager register
[root@redhat01 /]# subscription-manager list
[root@redhat01 /]# subscription-manager list --consumed
[root@redhat01 /]# subscription-manager refresh
[root@redhat01 /]# subscription-manager attach --auto
[root@redhat01 /]# subscription-manager unregister
CVE / RHSA
----------
[root@redhat01 /]# dnf check-update --security
[root@redhat01 /]# dnf check-update --security | wc -l
[root@redhat01 /]# dnf check-update | wc -l
[root@redhat01 /]# dnf updateinfo info --security
[root@redhat01 /]# yum updateinfo info --cve CVE-2026-12345
[root@redhat01 /]# yum check-update --cve CVE-2026-80844
[root@redhat01 /]# yum check-update --cve CVE-2026-63382
[root@redhat01 /]# yum update --cve CVE-2026-63382
[root@redhat01 /]# dnf update
[root@redhat01 /]# yum update --RHSA RHSA-2022:7106
[root@redhat01 /]# yum update --advisory=RHSA-2022:7106
SUSE
----
[root@sles01 ~]# zypper repos
[root@sles01 ~]# zypper refresh
[root@sles01 ~]# zypper search vim
[root@sles01 ~]# zypper install vim
[root@sles01 ~]# zypper update
[root@sles01 ~]# zypper list-patches
[root@sles01 ~]# zypper patch
UBUNTU
------
[root@ubuntu01 ~]# apt update
[root@ubuntu01 ~]# apt upgrade
[root@ubuntu01 ~]# apt upgrade -y
[root@ubuntu01 ~]# apt search vim
[root@ubuntu01 ~]# apt install vim -y
[root@ubuntu01 ~]# apt remove vim -y
[root@ubuntu01 ~]# dpkg -l vim
[root@ubuntu01 ~]# dpkg -s vim
[root@ubuntu01 ~]# dpkg -L vim
FTP REPOSITORY
--------------
Repository Server:
192.168.2.164
[root@rocky-repo ~]# systemctl status vsftpd
[root@rocky-repo ~]# systemctl start vsftpd
[root@rocky-repo ~]# systemctl enable vsftpd
[root@rocky-repo ~]# firewall-cmd --permanent --add-service=ftp
[root@rocky-repo ~]# firewall-cmd --reload
Client:
[root@rocky01 ~]# ping -c 4 192.168.2.164
[root@rocky01 ~]# ftp 192.168.2.164
[root@rocky01 ~]# dnf repolist
[root@rocky01 ~]# dnf clean all
[root@rocky01 ~]# dnf makecache
18. INTERVIEW QUESTIONS AND ANSWERS
===================================
Q1. What is RPM?
-----------------
Answer:
RPM stands for RPM Package Manager. It is the low-level package management
system used by RHEL, Rocky Linux, CentOS, Fedora and SUSE Linux.
Q2. What is the difference between RPM and DNF?
-----------------------------------------------
Answer:
RPM is the low-level package system used to install, remove and query RPM
packages. DNF is a high-level package manager that handles repositories,
dependency resolution and package transactions.
Q3. What is the difference between DPKG and APT?
------------------------------------------------
Answer:
DPKG is the low-level package system used by Debian and Ubuntu. APT is the
high-level package manager that downloads packages from repositories and
resolves dependencies.
Q4. How do you check whether bzip2 is installed?
-------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -q bzip2
Q5. How do you list all files installed by an RPM package?
------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -ql bzip2
Q6. How do you find the dependencies of an installed RPM package?
------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qR bzip2
Q7. How do you find which package owns a particular file?
-----------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
Q8. How do you check the dependencies of an RPM file before installing it?
----------------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qpR package.rpm
Q9. How do you test an RPM installation without actually installing it?
------------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -ivh package.rpm --test
Q10. What is the difference between rpm -ivh and rpm -Uvh?
-----------------------------------------------------------
Answer:
rpm -ivh installs a package. rpm -Uvh upgrades an existing package or installs
it if the package is not already installed.
Q11. How do you search for a package using DNF?
------------------------------------------------
Answer:
[root@rocky01 ~]# dnf search httpd
Q12. How do you find which package provides a command?
-------------------------------------------------------
Answer:
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
Q13. What is the difference between dnf install and dnf update?
----------------------------------------------------------------
Answer:
dnf install installs a package. dnf update updates an installed package when a
newer version is available.
Q14. What is the difference between dnf update and dnf upgrade?
----------------------------------------------------------------
Answer:
On modern DNF systems, update and upgrade generally perform equivalent package
update operations.
Q15. How do you check available updates?
----------------------------------------
Answer:
[root@rocky01 ~]# dnf check-update
Q16. How do you check only security updates?
---------------------------------------------
Answer:
[root@redhat01 /]# dnf check-update --security
Q17. How do you check information about security advisories?
--------------------------------------------------------------
Answer:
[root@redhat01 /]# dnf updateinfo info --security
Q18. How do you check whether a specific CVE has an applicable update?
-----------------------------------------------------------------------
Answer:
Use the supported updateinfo/yum/dnf advisory functionality for the target
RHEL version. Example:
[root@redhat01 /]# yum updateinfo info --cve CVE-2026-12345
Q19. What is a CVE?
-------------------
Answer:
CVE stands for Common Vulnerabilities and Exposures. It is a standardized
identifier for a publicly known cybersecurity vulnerability.
Q20. What is an RHSA?
---------------------
Answer:
RHSA stands for Red Hat Security Advisory. Red Hat uses RHSA advisories to
publish information about security fixes and affected products.
Q21. What is Red Hat subscription-manager used for?
----------------------------------------------------
Answer:
subscription-manager is used on RHEL systems to register systems, manage
subscriptions/entitlements and provide access to entitled Red Hat repositories.
Q22. How do you check Red Hat subscription status?
---------------------------------------------------
Answer:
[root@redhat01 /]# subscription-manager status
Q23. How do you list consumed subscriptions?
---------------------------------------------
Answer:
[root@redhat01 /]# subscription-manager list --consumed
Q24. Can Rocky Linux use subscription-manager?
----------------------------------------------
Answer:
Rocky Linux is a downstream-compatible enterprise Linux distribution and does
not normally use Red Hat subscription-manager for its standard Rocky
repositories. Rocky uses its own repository infrastructure.
Q25. Why is OS patching important?
----------------------------------
Answer:
OS patching provides security fixes, bug fixes, stability improvements,
performance improvements where applicable, and helps meet organizational and
compliance requirements.
Q26. What should be checked before patching a production server?
-----------------------------------------------------------------
Answer:
Typical checks include:
- Application owner notification
- Approved change/ticket
- Backup or VM snapshot where appropriate
- Current OS and kernel version
- Disk space
- Memory
- System uptime
- Failed services
- Repository availability
- Subscription status for RHEL
- Application health
- Rollback/recovery plan
Q27. Why should a server be rebooted after a kernel update?
------------------------------------------------------------
Answer:
The running kernel normally remains the old kernel until the system is
rebooted. Rebooting loads the newly installed kernel.
Q28. How do you verify the kernel after reboot?
-------------------------------------------------
Answer:
[root@rocky01 ~]# uname -r
Q29. What is offline patching?
------------------------------
Answer:
Offline patching means applying updates from locally available or internally
hosted package repositories without requiring the target server to access the
Internet.
Q30. Why would an organization use an offline repository?
-----------------------------------------------------------
Answer:
Common reasons include:
- No Internet connectivity
- Restricted network access
- Security controls
- Controlled patching
- Faster local distribution
- Repeatable patching
- Data-center or isolated environment requirements
Q31. How do you mount a Linux ISO?
----------------------------------
Answer:
[root@rocky01 ~]# mount /dev/cdrom /mnt
Q32. What is the purpose of repodata?
--------------------------------------
Answer:
repodata contains repository metadata used by DNF/YUM to understand available
packages, versions, dependencies and other repository information.
Q33. What is vsftpd?
--------------------
Answer:
vsftpd is a Very Secure FTP Daemon commonly used to provide an FTP service on
Linux systems.
Q34. What are the common components of an FTP repository troubleshooting check?
---------------------------------------------------------------------------------
Answer:
Check:
1. Network connectivity
2. FTP service
3. Firewall
4. SELinux
5. Repository path
6. Repository metadata
7. Client repository configuration
8. DNF cache
9. Package availability
Q35. How do you check whether vsftpd is running?
-------------------------------------------------
Answer:
[root@rocky-repo ~]# systemctl status vsftpd
Q36. How do you check whether FTP is allowed through firewalld?
----------------------------------------------------------------
Answer:
[root@rocky-repo ~]# firewall-cmd --list-services
Q37. How do you check SELinux status?
-------------------------------------
Answer:
[root@rocky-repo ~]# getenforce
Q38. How can you temporarily test whether SELinux is causing a repository
access problem?
---------------------------------------------------------------------------
Answer:
[root@rocky-repo ~]# setenforce 0
After testing, restore enforcing mode:
[root@rocky-repo ~]# setenforce 1
Do not use disabling SELinux as the permanent solution.
Q39. How do you clear DNF cache?
--------------------------------
Answer:
[root@rocky01 ~]# dnf clean all
Q40. How do you rebuild DNF metadata cache?
--------------------------------------------
Answer:
[root@rocky01 ~]# dnf makecache
Q41. What is the correct enterprise patching lifecycle?
--------------------------------------------------------
Answer:
Check
|
Plan
|
Backup / Snapshot
|
Verify Repository
|
Check Updates
|
Apply Patches
|
Reboot if Required
|
Post-Check
|
Application Validation
|
Compare Pre/Post Results
|
Close Change
Q42. Why should application validation be performed after OS patching?
----------------------------------------------------------------------
Answer:
A server can show a successful package transaction while an application,
service, integration or dependency is still affected. Application validation
confirms that the business service is functioning after patching.
Q43. What is the difference between zypper update and zypper patch?
--------------------------------------------------------------------
Answer:
zypper update updates packages to available versions. zypper patch is designed
to apply available vendor patches/patches from configured repositories.
Q44. What does apt update do?
-----------------------------
Answer:
apt update refreshes the local package repository metadata. It does not itself
upgrade installed packages.
Q45. What does apt upgrade do?
------------------------------
Answer:
apt upgrade installs available package upgrades while generally avoiding
removal of installed packages required by the current package set.
Q46. How do you verify an Ubuntu package using DPKG?
----------------------------------------------------
Answer:
[root@ubuntu01 ~]# dpkg -l package
Q47. How do you list files installed by an Ubuntu package?
------------------------------------------------------------
Answer:
[root@ubuntu01 ~]# dpkg -L package
Q48. What should you do if dnf update fails because a repository is unavailable?
---------------------------------------------------------------------------------
Answer:
Check:
- dnf repolist
- repository configuration
- DNS/network connectivity
- firewall
- repository server
- subscription status for RHEL
- repository metadata
- DNF cache
Then correct the underlying issue before retrying the patching operation.
Q49. Why should you not blindly run dnf update -y in production?
-----------------------------------------------------------------
Answer:
Production patching should follow an approved change process. Before applying
updates, verify the scope, repositories, backups/snapshots, application
dependencies, maintenance window and rollback/recovery plan.
Q50. What is the most important principle of enterprise Linux patching?
-----------------------------------------------------------------------
Answer:
Patching is a controlled operational process, not simply a command.
A Linux administrator should follow:
Check -> Plan -> Backup -> Verify Repository -> Patch -> Reboot ->
Validate -> Compare -> Confirm Application -> Close Change
19. DAY 6 FINAL LEARNING
========================
The complete package-management and patching lifecycle is:
PACKAGE MANAGEMENT
|
+----------------+----------------+
| | |
RPM Zypper APT
| | |
RHEL/Rocky SUSE Ubuntu
| | |
DNF RPM DPKG
| | |
+----------------+----------------+
|
v
OS PATCHING
|
+-------+-------+
| |
PRE-CHECK REPOSITORY
| |
+-------+-------+
|
v
APPLY PATCHES
|
v
REBOOT
|
v
POST-CHECK
|
v
APPLICATION TEST
|
v
CLOSE CHANGE
KEY MESSAGE
-----------
A Linux Administrator should not think of patching as simply running:
dnf update -y
A proper enterprise patching process is:
Check
->
Plan
->
Backup
->
Verify Repository
->
Patch
->
Reboot
->
Validate
->
Compare
->
Confirm Application
->
Close Change
This same operational approach applies across RHEL/Rocky Linux, SUSE Linux,
and Ubuntu, although the package-management commands differ.
[root@ubuntu01 ~]# apt purge package
Package information:
[root@ubuntu01 ~]# apt show package
List installed packages:
[root@ubuntu01 ~]# dpkg -l
Check specific package:
[root@ubuntu01 ~]# dpkg -l package
11. OFFLINE PATCHING USING ISO
==============================
Offline repositories are useful when servers do not have Internet access.
Architecture:
Rocky Linux ISO
|
v
/mnt
|
v
Local Repository
|
v
DNF/YUM
EXERCISE 37 - MOUNT ISO
-----------------------
[root@rocky01 ~]# mount /dev/cdrom /mnt
Verify:
[root@rocky01 ~]# ls -l /mnt
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 38 - CONFIGURE LOCAL ISO REPOSITORY
--------------------------------------------
Create repository file:
[root@rocky01 ~]# vi /etc/yum.repos.d/local-iso.repo
Recommended configuration for a Rocky 8 ISO:
[Rocky8-BaseOS]
name=Rocky Linux 8 BaseOS - ISO
baseurl=file:///mnt/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky Linux 8 AppStream - ISO
baseurl=file:///mnt/AppStream/
enabled=1
gpgcheck=0
NOTE:
gpgcheck=0 is used here to simplify the training lab. In production, use
appropriate Red Hat/Rocky GPG keys and enable package signature validation.
Clean cache:
[root@rocky01 ~]# dnf clean all
Build cache:
[root@rocky01 ~]# dnf makecache
Check repositories:
[root@rocky01 ~]# dnf repolist
12. CENTRALIZED ROCKY LINUX 8 FTP REPOSITORY
============================================
Repository server IP:
192.168.2.164
EXERCISE 39 - MOUNT ISO ON REPOSITORY SERVER
--------------------------------------------
[root@rocky-repo ~]# mount /dev/cdrom /mnt
Verify:
[root@rocky-repo ~]# ls /mnt
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 40 - INSTALL REPOSITORY PACKAGES
-----------------------------------------
Install VSFTPD and repository tools:
[root@rocky-repo ~]# dnf install -y vsftpd createrepo_c
Expected:
Installed:
vsftpd
createrepo_c
Complete!
EXERCISE 41 - CREATE FTP REPOSITORY DIRECTORY
---------------------------------------------
[root@rocky-repo ~]# mkdir -p /var/ftp/pub
Copy ISO content:
[root@rocky-repo ~]# cp -a /mnt/. /var/ftp/pub/
Verify:
[root@rocky-repo ~]# ls /var/ftp/pub
Expected:
AppStream
BaseOS
EFI
images
isolinux
media.repo
EXERCISE 42 - VERIFY REPOSITORY METADATA
----------------------------------------
[root@rocky-repo ~]# ls /var/ftp/pub/BaseOS/repodata
[root@rocky-repo ~]# ls /var/ftp/pub/AppStream/repodata
You should see repository metadata files.
IMPORTANT:
If the Rocky Linux ISO already contains valid repodata, preserve that metadata.
Do not unnecessarily regenerate it.
If building a repository from individual RPM files rather than a complete ISO
tree, createrepo_c can be used to generate metadata.
EXERCISE 43 - CONFIGURE FTP SERVICE
-----------------------------------
Enable:
[root@rocky-repo ~]# systemctl enable vsftpd
Start:
[root@rocky-repo ~]# systemctl start vsftpd
Check:
[root@rocky-repo ~]# systemctl status vsftpd
Expected:
Active: active (running)
EXERCISE 44 - CONFIGURE FIREWALL
--------------------------------
[root@rocky-repo ~]# firewall-cmd --permanent --add-service=ftp
Expected:
success
Reload:
[root@rocky-repo ~]# firewall-cmd --reload
Expected:
success
Verify:
[root@rocky-repo ~]# firewall-cmd --list-services
Expected:
ftp
EXERCISE 45 - TEST REPOSITORY CONNECTIVITY
------------------------------------------
From rocky01:
[root@rocky01 ~]# ping -c 4 192.168.2.164
Expected:
64 bytes from 192.168.2.164: icmp_seq=1 ...
64 bytes from 192.168.2.164: icmp_seq=2 ...
Test FTP:
[root@rocky01 ~]# ftp 192.168.2.164
Expected:
Connected to 192.168.2.164.
220 (vsFTPd ...)
Exit:
ftp> bye
221 Goodbye.
EXERCISE 46 - CONFIGURE ROCKY LINUX FTP REPOSITORY
--------------------------------------------------
Create:
[root@rocky01 ~]# vi /etc/yum.repos.d/rocky8-local.repo
Add:
[Rocky8-BaseOS]
name=Rocky 8 BaseOS FTP
baseurl=ftp://192.168.2.164/pub/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky 8 AppStream FTP
baseurl=ftp://192.168.2.164/pub/AppStream/
enabled=1
gpgcheck=0
EXERCISE 47 - TEST FTP REPOSITORY
---------------------------------
Clean cache:
[root@rocky01 ~]# dnf clean all
Create metadata cache:
[root@rocky01 ~]# dnf makecache
Check repositories:
[root@rocky01 ~]# dnf repolist
Expected:
repo id repo name
Rocky8-BaseOS Rocky 8 BaseOS FTP
Rocky8-AppStream Rocky 8 AppStream FTP
Search package:
[root@rocky01 ~]# dnf search httpd
Install package:
[root@rocky01 ~]# dnf install -y httpd
13. REPOSITORY TROUBLESHOOTING
==============================
EXERCISE 48 - CHECK NETWORK
---------------------------
[root@rocky01 ~]# ping -c 4 192.168.2.164
EXERCISE 49 - CHECK FTP
-----------------------
[root@rocky01 ~]# ftp 192.168.2.164
EXERCISE 50 - CHECK FTP SERVICE
--------------------------------
On repository server:
[root@rocky-repo ~]# systemctl status vsftpd
Expected:
Active: active (running)
EXERCISE 51 - CHECK FIREWALL
----------------------------
[root@rocky-repo ~]# firewall-cmd --list-all
Check that FTP is allowed.
EXERCISE 52 - CHECK SELINUX
---------------------------
[root@rocky-repo ~]# getenforce
Expected:
Enforcing
For lab troubleshooting only, you can temporarily test:
[root@rocky-repo ~]# setenforce 0
Test the repository.
Return to enforcing:
[root@rocky-repo ~]# setenforce 1
Verify:
[root@rocky-repo ~]# getenforce
Expected:
Enforcing
IMPORTANT:
Do not leave SELinux disabled as a production workaround. Identify and correct
the actual SELinux policy/context issue.
EXERCISE 53 - CLEAR DNF CACHE
-----------------------------
[root@rocky01 ~]# dnf clean all
Optional cache cleanup:
[root@rocky01 ~]# rm -rf /var/cache/dnf
Rebuild cache:
[root@rocky01 ~]# dnf makecache
EXERCISE 54 - VERIFY REPOSITORY CONFIGURATION
---------------------------------------------
[root@rocky01 ~]# cat /etc/yum.repos.d/rocky8-local.repo
Expected:
[Rocky8-BaseOS]
name=Rocky 8 BaseOS FTP
baseurl=ftp://192.168.2.164/pub/BaseOS/
enabled=1
gpgcheck=0
[Rocky8-AppStream]
name=Rocky 8 AppStream FTP
baseurl=ftp://192.168.2.164/pub/AppStream/
enabled=1
gpgcheck=0
14. COMPLETE ENTERPRISE PATCHING EXERCISE
=========================================
Now perform a complete patching workflow.
STEP 1 - PRE-CHECK
------------------
[root@rocky01 ~]# hostname
Expected:
rocky01
[root@rocky01 ~]# uptime
[root@rocky01 ~]# uname -r
[root@rocky01 ~]# cat /etc/redhat-release
[root@rocky01 ~]# df -h
[root@rocky01 ~]# free -h
[root@rocky01 ~]# systemctl --failed
STEP 2 - REPOSITORY CHECK
-------------------------
[root@rocky01 ~]# dnf repolist
STEP 3 - CHECK UPDATES
----------------------
[root@rocky01 ~]# dnf check-update
STEP 4 - APPLY PATCHES
----------------------
[root@rocky01 ~]# dnf update -y
Expected:
Dependencies resolved.
...
Complete!
STEP 5 - REBOOT
---------------
[root@rocky01 ~]# reboot
STEP 6 - CHECK KERNEL
---------------------
After login:
[root@rocky01 ~]# uname -r
STEP 7 - CHECK FAILED SERVICES
------------------------------
[root@rocky01 ~]# systemctl --failed
Expected:
0 loaded units listed.
STEP 8 - CHECK FILESYSTEM
-------------------------
[root@rocky01 ~]# df -h
STEP 9 - CHECK MEMORY
---------------------
[root@rocky01 ~]# free -h
STEP 10 - CHECK NETWORK
-----------------------
[root@rocky01 ~]# ping -c 4 8.8.8.8
For an enterprise environment, test the approved internal gateway/server instead
of relying only on an Internet address.
# REMOVE OLD KERNEL - RHEL / ROCKY LINUX
1. Check the running kernel
[root@rocky ~]# uname -r
Example:
4.18.0-557.el8.x86_64
2. List installed kernels
[root@rocky ~]# rpm -q kernel
Example:
kernel-4.18.0-513.el8.x86_64
kernel-4.18.0-553.el8.x86_64
kernel-4.18.0-557.el8.x86_64
3. Identify the current kernel
[root@rocky ~]# uname -r
Example:
4.18.0-557.el8.x86_64
DO NOT REMOVE THIS KERNEL.
4. Remove the unwanted old kernel
[root@rocky ~]# dnf remove kernel-4.18.0-513.el8.x86_64
Press Y when prompted.
5. Verify installed kernels
[root@rocky ~]# rpm -q kernel
Example:
kernel-4.18.0-553.el8.x86_64
kernel-4.18.0-557.el8.x86_64
6. Verify the running kernel
[root@rocky ~]# uname -r
Example:
4.18.0-557.el8.x86_64
# IMPORTANT
Never remove the currently running kernel.
Keep at least one previous known-good kernel for rollback.
15. PRE- AND POST-PATCHING COMPARISON
=====================================
Record the results:
Check Pre-Patching Post-Patching
---------------------------------------------------
Hostname
OS Version
Kernel
Uptime
Filesystem
Memory
Failed Services
Network
Repository
Application
A successful patch is not complete until the post-patching validation and
application validation are completed.
16. FINAL PRACTICAL ASSESSMENT
==============================
The trainee should complete the following independently.
RPM
---
[ ] Install RPM package
[ ] Upgrade RPM package
[ ] Remove RPM package
[ ] Query RPM package
[ ] List package files
[ ] Check package dependencies
[ ] Find package owning a file
DNF
---
[ ] Search package using dnf search
[ ] Find package providing a file using dnf provides
[ ] Check updates
[ ] Update kernel
[ ] Patch the operating system
[ ] Exclude a package during patching
[ ] Check security updates
[ ] Check CVE/RHSA advisory information
SUSE
----
[ ] List repositories using zypper repos
[ ] Search package using zypper search
[ ] Install package using zypper install
[ ] Refresh repositories
[ ] List patches
[ ] Apply patches using zypper patch
[ ] Reboot and validate kernel
Ubuntu
------
[ ] Search package using apt search
[ ] Run apt update
[ ] Run apt upgrade
[ ] Install package
[ ] Remove package
[ ] Verify package using dpkg
Red Hat Subscription
--------------------
[ ] Check RHEL release
[ ] Check subscription status
[ ] Register server
[ ] List subscriptions
[ ] List consumed subscriptions
[ ] Refresh subscription data
[ ] Verify repositories
Repository
----------
[ ] Mount ISO
[ ] Configure local repository
[ ] Configure FTP repository
[ ] Configure firewall
[ ] Configure Rocky Linux client
[ ] Test FTP connectivity
[ ] Troubleshoot repository failure
Patching
--------
[ ] Perform pre-check
[ ] Check available updates
[ ] Check security updates
[ ] Apply patches
[ ] Reboot when required
[ ] Perform post-check
[ ] Compare pre/post results
[ ] Validate application
[ ] Close change after successful validation
17. DAY 6 COMMAND CHEAT SHEET
=============================
RPM / DNF - ROCKY/RHEL
----------------------
[root@rocky01 ~]# rpm -qa
[root@rocky01 ~]# rpm -qi bzip2
[root@rocky01 ~]# rpm -ql bzip2
[root@rocky01 ~]# rpm -qR bzip2
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
[root@rocky01 ~]# rpm -qpR package.rpm
[root@rocky01 ~]# rpm -ivh package.rpm
[root@rocky01 ~]# rpm -Uvh package.rpm
[root@rocky01 ~]# rpm -e package
[root@rocky01 ~]# dnf search httpd
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
[root@rocky01 ~]# dnf install httpd
[root@rocky01 ~]# dnf update -y
[root@rocky01 ~]# dnf check-update
[root@rocky01 ~]# dnf check-update --security
[root@rocky01 ~]# dnf updateinfo info --security
RED HAT SUBSCRIPTION
--------------------
[root@redhat01 /]# cat /etc/redhat-release
[root@redhat01 /]# subscription-manager status
[root@redhat01 /]# subscription-manager register
[root@redhat01 /]# subscription-manager list
[root@redhat01 /]# subscription-manager list --consumed
[root@redhat01 /]# subscription-manager refresh
[root@redhat01 /]# subscription-manager attach --auto
[root@redhat01 /]# subscription-manager unregister
CVE / RHSA
----------
[root@redhat01 /]# dnf check-update --security
[root@redhat01 /]# dnf check-update --security | wc -l
[root@redhat01 /]# dnf check-update | wc -l
[root@redhat01 /]# dnf updateinfo info --security
[root@redhat01 /]# yum updateinfo info --cve CVE-2026-12345
[root@redhat01 /]# yum check-update --cve CVE-2026-80844
[root@redhat01 /]# yum check-update --cve CVE-2026-63382
[root@redhat01 /]# yum update --cve CVE-2026-63382
[root@redhat01 /]# dnf update
[root@redhat01 /]# yum update --RHSA RHSA-2022:7106
[root@redhat01 /]# yum update --advisory=RHSA-2022:7106
SUSE
----
[root@sles01 ~]# zypper repos
[root@sles01 ~]# zypper refresh
[root@sles01 ~]# zypper search vim
[root@sles01 ~]# zypper install vim
[root@sles01 ~]# zypper update
[root@sles01 ~]# zypper list-patches
[root@sles01 ~]# zypper patch
UBUNTU
------
[root@ubuntu01 ~]# apt update
[root@ubuntu01 ~]# apt upgrade
[root@ubuntu01 ~]# apt upgrade -y
[root@ubuntu01 ~]# apt search vim
[root@ubuntu01 ~]# apt install vim -y
[root@ubuntu01 ~]# apt remove vim -y
[root@ubuntu01 ~]# dpkg -l vim
[root@ubuntu01 ~]# dpkg -s vim
[root@ubuntu01 ~]# dpkg -L vim
FTP REPOSITORY
--------------
Repository Server:
192.168.2.164
[root@rocky-repo ~]# systemctl status vsftpd
[root@rocky-repo ~]# systemctl start vsftpd
[root@rocky-repo ~]# systemctl enable vsftpd
[root@rocky-repo ~]# firewall-cmd --permanent --add-service=ftp
[root@rocky-repo ~]# firewall-cmd --reload
Client:
[root@rocky01 ~]# ping -c 4 192.168.2.164
[root@rocky01 ~]# ftp 192.168.2.164
[root@rocky01 ~]# dnf repolist
[root@rocky01 ~]# dnf clean all
[root@rocky01 ~]# dnf makecache
18. INTERVIEW QUESTIONS AND ANSWERS
===================================
Q1. What is RPM?
-----------------
Answer:
RPM stands for RPM Package Manager. It is the low-level package management
system used by RHEL, Rocky Linux, CentOS, Fedora and SUSE Linux.
Q2. What is the difference between RPM and DNF?
-----------------------------------------------
Answer:
RPM is the low-level package system used to install, remove and query RPM
packages. DNF is a high-level package manager that handles repositories,
dependency resolution and package transactions.
Q3. What is the difference between DPKG and APT?
------------------------------------------------
Answer:
DPKG is the low-level package system used by Debian and Ubuntu. APT is the
high-level package manager that downloads packages from repositories and
resolves dependencies.
Q4. How do you check whether bzip2 is installed?
-------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -q bzip2
Q5. How do you list all files installed by an RPM package?
------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -ql bzip2
Q6. How do you find the dependencies of an installed RPM package?
------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qR bzip2
Q7. How do you find which package owns a particular file?
-----------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qf /usr/bin/bzip2
Q8. How do you check the dependencies of an RPM file before installing it?
----------------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -qpR package.rpm
Q9. How do you test an RPM installation without actually installing it?
------------------------------------------------------------------------
Answer:
[root@rocky01 ~]# rpm -ivh package.rpm --test
Q10. What is the difference between rpm -ivh and rpm -Uvh?
-----------------------------------------------------------
Answer:
rpm -ivh installs a package. rpm -Uvh upgrades an existing package or installs
it if the package is not already installed.
Q11. How do you search for a package using DNF?
------------------------------------------------
Answer:
[root@rocky01 ~]# dnf search httpd
Q12. How do you find which package provides a command?
-------------------------------------------------------
Answer:
[root@rocky01 ~]# dnf provides /usr/bin/htpasswd
Q13. What is the difference between dnf install and dnf update?
----------------------------------------------------------------
Answer:
dnf install installs a package. dnf update updates an installed package when a
newer version is available.
Q14. What is the difference between dnf update and dnf upgrade?
----------------------------------------------------------------
Answer:
On modern DNF systems, update and upgrade generally perform equivalent package
update operations.
Q15. How do you check available updates?
----------------------------------------
Answer:
[root@rocky01 ~]# dnf check-update
Q16. How do you check only security updates?
---------------------------------------------
Answer:
[root@redhat01 /]# dnf check-update --security
Q17. How do you check information about security advisories?
--------------------------------------------------------------
Answer:
[root@redhat01 /]# dnf updateinfo info --security
Q18. How do you check whether a specific CVE has an applicable update?
-----------------------------------------------------------------------
Answer:
Use the supported updateinfo/yum/dnf advisory functionality for the target
RHEL version. Example:
[root@redhat01 /]# yum updateinfo info --cve CVE-2026-12345
Q19. What is a CVE?
-------------------
Answer:
CVE stands for Common Vulnerabilities and Exposures. It is a standardized
identifier for a publicly known cybersecurity vulnerability.
Q20. What is an RHSA?
---------------------
Answer:
RHSA stands for Red Hat Security Advisory. Red Hat uses RHSA advisories to
publish information about security fixes and affected products.
Q21. What is Red Hat subscription-manager used for?
----------------------------------------------------
Answer:
subscription-manager is used on RHEL systems to register systems, manage
subscriptions/entitlements and provide access to entitled Red Hat repositories.
Q22. How do you check Red Hat subscription status?
---------------------------------------------------
Answer:
[root@redhat01 /]# subscription-manager status
Q23. How do you list consumed subscriptions?
---------------------------------------------
Answer:
[root@redhat01 /]# subscription-manager list --consumed
Q24. Can Rocky Linux use subscription-manager?
----------------------------------------------
Answer:
Rocky Linux is a downstream-compatible enterprise Linux distribution and does
not normally use Red Hat subscription-manager for its standard Rocky
repositories. Rocky uses its own repository infrastructure.
Q25. Why is OS patching important?
----------------------------------
Answer:
OS patching provides security fixes, bug fixes, stability improvements,
performance improvements where applicable, and helps meet organizational and
compliance requirements.
Q26. What should be checked before patching a production server?
-----------------------------------------------------------------
Answer:
Typical checks include:
- Application owner notification
- Approved change/ticket
- Backup or VM snapshot where appropriate
- Current OS and kernel version
- Disk space
- Memory
- System uptime
- Failed services
- Repository availability
- Subscription status for RHEL
- Application health
- Rollback/recovery plan
Q27. Why should a server be rebooted after a kernel update?
------------------------------------------------------------
Answer:
The running kernel normally remains the old kernel until the system is
rebooted. Rebooting loads the newly installed kernel.
Q28. How do you verify the kernel after reboot?
-------------------------------------------------
Answer:
[root@rocky01 ~]# uname -r
Q29. What is offline patching?
------------------------------
Answer:
Offline patching means applying updates from locally available or internally
hosted package repositories without requiring the target server to access the
Internet.
Q30. Why would an organization use an offline repository?
-----------------------------------------------------------
Answer:
Common reasons include:
- No Internet connectivity
- Restricted network access
- Security controls
- Controlled patching
- Faster local distribution
- Repeatable patching
- Data-center or isolated environment requirements
Q31. How do you mount a Linux ISO?
----------------------------------
Answer:
[root@rocky01 ~]# mount /dev/cdrom /mnt
Q32. What is the purpose of repodata?
--------------------------------------
Answer:
repodata contains repository metadata used by DNF/YUM to understand available
packages, versions, dependencies and other repository information.
Q33. What is vsftpd?
--------------------
Answer:
vsftpd is a Very Secure FTP Daemon commonly used to provide an FTP service on
Linux systems.
Q34. What are the common components of an FTP repository troubleshooting check?
---------------------------------------------------------------------------------
Answer:
Check:
1. Network connectivity
2. FTP service
3. Firewall
4. SELinux
5. Repository path
6. Repository metadata
7. Client repository configuration
8. DNF cache
9. Package availability
Q35. How do you check whether vsftpd is running?
-------------------------------------------------
Answer:
[root@rocky-repo ~]# systemctl status vsftpd
Q36. How do you check whether FTP is allowed through firewalld?
----------------------------------------------------------------
Answer:
[root@rocky-repo ~]# firewall-cmd --list-services
Q37. How do you check SELinux status?
-------------------------------------
Answer:
[root@rocky-repo ~]# getenforce
Q38. How can you temporarily test whether SELinux is causing a repository
access problem?
---------------------------------------------------------------------------
Answer:
[root@rocky-repo ~]# setenforce 0
After testing, restore enforcing mode:
[root@rocky-repo ~]# setenforce 1
Do not use disabling SELinux as the permanent solution.
Q39. How do you clear DNF cache?
--------------------------------
Answer:
[root@rocky01 ~]# dnf clean all
Q40. How do you rebuild DNF metadata cache?
--------------------------------------------
Answer:
[root@rocky01 ~]# dnf makecache
Q41. What is the correct enterprise patching lifecycle?
--------------------------------------------------------
Answer:
Check
|
Plan
|
Backup / Snapshot
|
Verify Repository
|
Check Updates
|
Apply Patches
|
Reboot if Required
|
Post-Check
|
Application Validation
|
Compare Pre/Post Results
|
Close Change
Q42. Why should application validation be performed after OS patching?
----------------------------------------------------------------------
Answer:
A server can show a successful package transaction while an application,
service, integration or dependency is still affected. Application validation
confirms that the business service is functioning after patching.
Q43. What is the difference between zypper update and zypper patch?
--------------------------------------------------------------------
Answer:
zypper update updates packages to available versions. zypper patch is designed
to apply available vendor patches/patches from configured repositories.
Q44. What does apt update do?
-----------------------------
Answer:
apt update refreshes the local package repository metadata. It does not itself
upgrade installed packages.
Q45. What does apt upgrade do?
------------------------------
Answer:
apt upgrade installs available package upgrades while generally avoiding
removal of installed packages required by the current package set.
Q46. How do you verify an Ubuntu package using DPKG?
----------------------------------------------------
Answer:
[root@ubuntu01 ~]# dpkg -l package
Q47. How do you list files installed by an Ubuntu package?
------------------------------------------------------------
Answer:
[root@ubuntu01 ~]# dpkg -L package
Q48. What should you do if dnf update fails because a repository is unavailable?
---------------------------------------------------------------------------------
Answer:
Check:
- dnf repolist
- repository configuration
- DNS/network connectivity
- firewall
- repository server
- subscription status for RHEL
- repository metadata
- DNF cache
Then correct the underlying issue before retrying the patching operation.
Q49. Why should you not blindly run dnf update -y in production?
-----------------------------------------------------------------
Answer:
Production patching should follow an approved change process. Before applying
updates, verify the scope, repositories, backups/snapshots, application
dependencies, maintenance window and rollback/recovery plan.
Q50. What is the most important principle of enterprise Linux patching?
-----------------------------------------------------------------------
Answer:
Patching is a controlled operational process, not simply a command.
A Linux administrator should follow:
Check -> Plan -> Backup -> Verify Repository -> Patch -> Reboot ->
Validate -> Compare -> Confirm Application -> Close Change
19. DAY 6 FINAL LEARNING
========================
The complete package-management and patching lifecycle is:
PACKAGE MANAGEMENT
|
+----------------+----------------+
| | |
RPM Zypper APT
| | |
RHEL/Rocky SUSE Ubuntu
| | |
DNF RPM DPKG
| | |
+----------------+----------------+
|
v
OS PATCHING
|
+-------+-------+
| |
PRE-CHECK REPOSITORY
| |
+-------+-------+
|
v
APPLY PATCHES
|
v
REBOOT
|
v
POST-CHECK
|
v
APPLICATION TEST
|
v
CLOSE CHANGE
KEY MESSAGE
-----------
A Linux Administrator should not think of patching as simply running:
dnf update -y
A proper enterprise patching process is:
Check
->
Plan
->
Backup
->
Verify Repository
->
Patch
->
Reboot
->
Validate
->
Compare
->
Confirm Application
->
Close Change
This same operational approach applies across RHEL/Rocky Linux, SUSE Linux,
and Ubuntu, although the package-management commands differ.
No comments:
Post a Comment