▶
🔥 FIREWALL-CMD CHEAT SHEET (RHEL)
firewalld = RHEL firewall management service
firewall-cmd = command-line tool to manage firewalld
1. FIREWALL SERVICE MANAGEMENT
systemctl status firewalld # Check whether firewalld service is running systemctl start firewalld # Start firewall service immediately systemctl stop firewalld # Stop firewall service systemctl restart firewalld # Restart firewall service systemctl enable firewalld # Enable firewall to start automatically on boot systemctl disable firewalld # Disable firewall from starting on boot systemctl enable --now firewalld # Enable + start immediately firewall-cmd --reload # Reload firewall rules without restarting service # Required after permanent changes firewall-cmd --complete-reload # Full reload; drops runtime state # Use when normal reload doesn't reflect changes
2. VIEW CURRENT CONFIGURATION
firewall-cmd --list-all # Show complete active firewall config # Services, ports, interfaces, rich rules, masquerade etc. firewall-cmd --get-active-zones # Show currently active zones and mapped interfaces firewall-cmd --get-default-zone # Show default firewall zone firewall-cmd --get-zones # List all available zones firewall-cmd --get-services # List all predefined services # Example: ssh, http, https, dns, samba firewall-cmd --zone=public --list-all # Show config for specific zone firewall-cmd --list-services # Show allowed services in current zone firewall-cmd --list-ports # Show explicitly opened ports firewall-cmd --list-rich-rules # Show configured rich rules
3. ALLOW SERVICES
firewall-cmd --add-service=ssh # Allow SSH temporarily # Lost after reboot/restart firewall-cmd --add-service=http # Allow HTTP temporarily firewall-cmd --add-service=https # Allow HTTPS temporarily firewall-cmd --permanent --add-service=http # Permanently allow HTTP firewall-cmd --permanent --add-service=https # Permanently allow HTTPS firewall-cmd --reload # Apply permanent changes
4. REMOVE SERVICES
firewall-cmd --remove-service=http # Remove temporary HTTP access firewall-cmd --permanent --remove-service=http # Permanently remove HTTP access firewall-cmd --reload # Apply removal
5. OPEN CUSTOM PORTS
firewall-cmd --add-port=8080/tcp # Open TCP port temporarily firewall-cmd --permanent --add-port=8080/tcp # Permanently open TCP port firewall-cmd --permanent --add-port=53/udp # Open UDP port permanently firewall-cmd --permanent --add-port=8000-9000/tcp # Open TCP port range firewall-cmd --reload # Apply permanent changes
6. REMOVE PORTS
firewall-cmd --remove-port=8080/tcp # Remove temporary port rule firewall-cmd --permanent --remove-port=8080/tcp # Remove permanent port rule firewall-cmd --reload # Apply changes
7. QUERY RULES
firewall-cmd --query-service=http # Check if HTTP service is allowed # Returns yes/no firewall-cmd --query-port=8080/tcp # Check if specific port is open # Returns yes/no
8. ZONE MANAGEMENT
firewall-cmd --get-active-zones # See active zones firewall-cmd --set-default-zone=public # Set default zone firewall-cmd --zone=public --change-interface=eth0 --permanent # Assign interface to zone firewall-cmd --zone=trusted --add-source=192.168.1.0/24 --permanent # Allow traffic from subnet using trusted zone firewall-cmd --zone=public --remove-interface=eth0 --permanent # Remove interface from zone firewall-cmd --reload # Apply zone changes # Common zones: # public = normal untrusted network # trusted = fully trusted network # home = home network # work = office network # internal = internal trusted network # dmz = publicly exposed systems # drop = drop all traffic silently # block = reject traffic
9. RICH RULES (IMPORTANT)
firewall-cmd --permanent \ --add-rich-rule='rule family=ipv4 source address=192.168.1.50 port protocol=tcp port=22 accept' # Allow SSH only from one IP firewall-cmd --permanent \ --add-rich-rule='rule family=ipv4 source address=192.168.1.100 drop' # Block one IP silently firewall-cmd --permanent \ --add-rich-rule='rule family=ipv4 source address=10.10.0.0/16 accept' # Allow subnet firewall-cmd --permanent \ --remove-rich-rule='rule family=ipv4 source address=192.168.1.100 drop' # Remove rich rule firewall-cmd --list-rich-rules # Show rich rules firewall-cmd --reload # Apply
10. PORT FORWARDING / NAT
firewall-cmd --permanent \ --add-forward-port=port=80:proto=tcp:toport=8080 # Forward incoming port 80 to local 8080 firewall-cmd --permanent \ --add-forward-port=port=80:proto=tcp:toaddr=192.168.1.20:toport=8080 # Forward traffic to another host firewall-cmd --reload # Apply forwarding
11. MASQUERADE (NAT)
firewall-cmd --permanent --add-masquerade # Enable NAT/masquerading # Needed when server acts as router/gateway firewall-cmd --query-masquerade # Check if enabled firewall-cmd --permanent --remove-masquerade # Disable NAT firewall-cmd --reload
12. PANIC MODE
firewall-cmd --panic-on # Block ALL incoming/outgoing traffic immediately firewall-cmd --panic-off # Disable panic mode firewall-cmd --query-panic # Check panic status
13. DIRECT RULES (ADVANCED)
firewall-cmd --direct --get-all-rules
# Show low-level backend rules
# Used when custom nftables/iptables direct rules exist
14. TROUBLESHOOTING COMMANDS
ss -tulpn # Show listening ports + process names ss -tulpn | grep 80 # Check if service listening on port 80 systemctl status httpd # Check web server status systemctl status sshd # Check SSH service getenforce # Check SELinux status ausearch -m AVC # Check SELinux denials ip addr # Show interfaces + IP addresses ip route # Show routing table ping 8.8.8.8 # Test network connectivity ping google.com # Test DNS + network curl localhost # Test local service curl http://server-ip # Test remote service firewall-cmd --list-all # Verify firewall config journalctl -u firewalld # Firewall logs
15. INTERVIEW TROUBLESHOOT FLOW
# Service inaccessible? systemctl status httpd # Is service running? ss -tulpn | grep 80 # Is service listening? firewall-cmd --list-all # Is firewall allowing access? getenforce # Is SELinux blocking? ip route # Is routing correct? ping server-ip # Reachable? curl localhost # Local access works? curl http://server-ip # Remote access works? dig domain.com # DNS issue?
▶
🔐 SSL / TLS & PKI CHEAT SHEET
SSL vs TLS
SSL (Secure Sockets Layer) is the predecessor to TLS (Transport Layer Security). SSL had versions 1.0–3.0 (all now deprecated and insecure). TLS is the modern replacement — TLS 1.2 and TLS 1.3 are what you actually use today.
TLS encrypts data in transit
What is a Certificate?
A certificate is a digital document that binds a public key to a domain name. It's signed by a trusted Certificate Authority (CA) to prove it's legitimate. When your browser connects to https://google.com, it receives Google's certificate and verifies it was signed by a CA it trusts.
What is a CSR?
A Certificate Signing Request is how you ask a CA to issue you a certificate. You generate it on your server. It contains your public key + identity info — but no signature yet. The CA verifies your identity, then signs it to produce the actual certificate.
PKI (Public Key Infrastructure)
PKI is a framework that manages digital certificates and public/private keys to verify identities and establish secure trusted communication.
💡 “What is the PKI process?”
Generate key pair → create CSR → CA verifies identity → CA signs and issues certificate → server presents certificate → client validates certificate → secure trusted communication is established.
Generate key pair → create CSR → CA verifies identity → CA signs and issues certificate → server presents certificate → client validates certificate → secure trusted communication is established.
PKI Process - Detailed Flow
- Server generates a key pair: Private key → kept secret on the server. Public key → can be shared.
- Server creates a CSR (Certificate Signing Request): Contains server public key, domain name (api.company.com), and organization details.
- Certificate Authority (CA) validates identity: Example: verifies domain ownership via DNS/HTTP/email challenge.
- CA signs the certificate using its private key: This creates a digital certificate that says: “This public key belongs to api.company.com”
- Server installs the certificate: On Nginx / Apache / Load balancer / Kubernetes ingress.
- Client connects to the server: During TLS handshake, server sends certificate and certificate chain.
- Client validates the certificate: Checks: Is it signed by a trusted CA? Is it expired? Does hostname match? Is it revoked?
- If valid, trust is established: Client accepts that the server is genuine and continues encrypted communication.
Example full flow for test.r2labs.in using OpenSSL + CA signing
# 1) Generate private key mkdir -p /root/certs/test.r2labs.in cd /root/certs/test.r2labs.in openssl genrsa -out test.r2labs.in.key 4096 # Verify: openssl rsa -in test.r2labs.in.key -check # 2) Generate CSR (with SAN) - Modern TLS requires SAN, not just CN. openssl req -new \ -key test.r2labs.in.key \ -out test.r2labs.in.csr \ -subj "/C=IN/ST=Kerala/L=Trivandrum/O=R2Labs/OU=IT/CN=test.r2labs.in" \ -addext "subjectAltName=DNS:test.r2labs.in" # Check CSR: openssl req -in test.r2labs.in.csr -text -noout
You’ll submit this file to CA Portal like DigiCert: test.r2labs.in.csr
CA signs cert. You receive: test.r2labs.in.crt (server certificate), intermediate.crt (intermediate CA), root.crt (sometimes optional).
# 3) Create proper certificate directories mkdir -p /etc/pki/tls/certs mkdir -p /etc/pki/tls/private # Secure private dir: chmod 700 /etc/pki/tls/private # 4) Move private key mv test.r2labs.in.key /etc/pki/tls/private/ # Set permissions: chown root:root /etc/pki/tls/private/test.r2labs.in.key chmod 600 /etc/pki/tls/private/test.r2labs.in.key # 5) Copy CA-issued certificates cp test.r2labs.in.crt /etc/pki/tls/certs/ cp intermediate.crt /etc/pki/tls/certs/ # If root cert provided: cp root.crt /etc/pki/tls/certs/ # 6) Build certificate chain (IMPORTANT) # Most servers need full chain. Combine: cat /etc/pki/tls/certs/test.r2labs.in.crt \ /etc/pki/tls/certs/intermediate.crt \ > /etc/pki/tls/certs/test.r2labs.in-fullchain.pem
Alternate: Production with Let’s Encrypt (best practical)
dnf install certbot python3-certbot-apache -y # Make sure DNS: # test.r2labs.in → your public server IP # Open firewall: firewall-cmd --permanent --add-service=http firewall-cmd --permanent --add-service=https firewall-cmd --reload
▶
💾 LVM / STORAGE MANAGEMENT CHEAT SHEET
1. EXTENDING AN LVM PARTITION (Example)
# Given layout: [root@rhel ~]# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 64G 0 disk ├─sda1 8:1 0 2M 0 part ├─sda2 8:2 0 100M 0 part /boot/efi ├─sda3 8:3 0 1000M 0 part /boot └─sda4 8:4 0 8.9G 0 part └─rocky-lvroot 253:0 0 8.8G 0 lvm / [root@rhel ~]# pvs PV VG Fmt Attr PSize PFree /dev/sda4 rocky lvm2 a-- <8.92g 132.00m [root@rhel ~]# vgs VG #PV #LV #SN Attr VSize VFree rocky 1 1 0 wz--n- <8.92g 132.00m # 1) Extend partition sudo dnf install -y cloud-utils-growpart sudo growpart /dev/sda 4 # 2) Resize PV sudo pvresize /dev/sda4 # 3) Check Volume Group sudo vgs # 4) Extend root LV ONLY (no filesystem resize) sudo lvextend -L 32G /dev/rocky/lvroot # 5) Grow XFS filesystem manually sudo xfs_growfs / # 6) Check df -h
2. CREATE A NEW LVM
lvcreate -L 32G -n lvdata rocky
lsblk
mkfs.xfs /dev/rocky/lvdata
mkdir /data
mount /dev/rocky/lvdata /data
# Resulting layout:
[root@rhel ~]# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 64G 0 disk
├─sda1 8:1 0 2M 0 part
├─sda2 8:2 0 100M 0 part /boot/efi
├─sda3 8:3 0 1000M 0 part /boot
└─sda4 8:4 0 62.9G 0 part
├─rocky-lvroot 253:0 0 32G 0 lvm /
└─rocky-lvdata 253:1 0 24G 0 lvm /data
3. SHRINKING XFS LVM (Workaround)
⚠️ “XFS cannot be shrunk.” To reduce an XFS LVM, you must create a smaller LV, migrate data, switch mounts, then remove the old LV.
# Example: reduce /data from 100G → 40G # 1) Check current layout lsblk df -Th lvs vgs # 2) Create new smaller LV lvcreate -L 40G -n lvdata_new vgdata # 3) Create XFS filesystem mkfs.xfs /dev/vgdata/lvdata_new # 4) Mount new LV mkdir /mnt/newdata mount /dev/vgdata/lvdata_new /mnt/newdata # 5) Copy data rsync -aHAXv /data/ /mnt/newdata/ # 6) Stop services using old mount systemctl stop httpd # 7) Final sync rsync -aHAXv --delete /data/ /mnt/newdata/ # 8) Unmount old filesystem umount /data # 9) Rename old/new LVs (optional clean swap) lvrename vgdata lvdata lvdata_old lvrename vgdata lvdata_new lvdata # 10) Mount new filesystem mount /dev/vgdata/lvdata /data # 11) Remove old LV (after confirming) lvremove /dev/vgdata/lvdata_old
▶
🐧 RHEL LINUX ADMIN CHEAT SHEET
1. SYSTEM INFO
uname -a # Show kernel version, architecture, hostname hostnamectl # Show/change hostname, OS info cat /etc/redhat-release # Show RHEL version uptime # Show system uptime + load average whoami # Current logged-in user id # Show UID, GID, group membership date # Show current date/time timedatectl # Timezone, NTP sync status lscpu # CPU details free -h # RAM usage in human readable format lsblk # List block devices (disks/partitions) df -h # Disk filesystem usage du -sh /var/log # Directory size summary vmstat 1 # CPU, memory, process stats every 1 sec top # Real-time process monitoring htop # Better top (install separately) journalctl -xe # View recent system errors dmesg | tail # Recent kernel messages
2. USER MANAGEMENT
useradd rahul # Create user passwd rahul # Set password usermod -aG wheel rahul # Add user to sudo/admin group id rahul # Verify group membership userdel rahul # Delete user (keep home dir) userdel -r rahul # Delete user + home directory groupadd devops # Create group groupdel devops # Delete group gpasswd -a rahul devops # Add user to group chage -l rahul # Password aging info passwd -l rahul # Lock account passwd -u rahul # Unlock account
3. FILE MANAGEMENT
pwd # Current directory ls -lah # Detailed file listing touch file.txt # Create empty file mkdir test # Create directory mkdir -p /tmp/a/b/c # Create nested directories cp file1 file2 # Copy file cp -r dir1 dir2 # Recursive copy directory mv old new # Move/rename rm file.txt # Delete file rm -rf dir # Force delete directory find / -name sshd_config # Find file by name find /var -type f -mtime -7 # Files modified in last 7 days locate sshd_config # Fast file search (updatedb required) stat file.txt # Detailed file metadata file script.sh # Detect file type
4. PERMISSIONS / OWNERSHIP
ls -l # View permissions chmod 755 script.sh # rwxr-xr-x chmod +x script.sh # Make executable chmod -R 755 /opt/app # Recursive permission change chown user:user file # Change owner chown -R apache:apache /var/www/html # Recursive ownership umask # Default permission mask getfacl file # View ACL permissions setfacl -m u:rahul:rwx file # Give ACL permission
5. PROCESS MGMT
ps aux # List all processes ps -ef # Alternative process view top # Live process monitor pgrep sshd # Find PID by process name pidof sshd # Show process PID kill PID # Graceful stop kill -9 PID # Force kill pkill nginx # Kill by process name nice -n 10 command # Start process with lower priority renice 5 PID # Change running process priority nohup script.sh & # Run in background after logout jobs # Background jobs fg # Bring job foreground bg # Resume background
6. SERVICE MANAGEMENT
systemctl status sshd # Service status systemctl start sshd # Start service systemctl stop sshd # Stop service systemctl restart sshd # Restart service systemctl reload sshd # Reload config without full restart systemctl enable sshd # Enable at boot systemctl disable sshd # Disable at boot systemctl is-active sshd # Check if running systemctl list-units --type=service # List services
7. PACKAGE MANAGEMENT
dnf repolist # Show enabled repositories dnf search nginx # Search package dnf info nginx # Package details dnf install nginx -y # Install package dnf remove nginx # Remove package dnf update # Update all packages dnf check-update # Check updates only dnf history # Transaction history dnf history undo ID # Rollback transaction rpm -qa # List installed packages rpm -q nginx # Check installed package rpm -ivh pkg.rpm # Install rpm manually rpm -Uvh pkg.rpm # Upgrade rpm
8. NETWORKING
ip a # Show IP addresses ip r # Routing table ss -tulpn # Listening ports + process ping google.com # Connectivity test traceroute google.com # Route path check nslookup google.com # DNS lookup dig google.com # Detailed DNS query curl ifconfig.me # Public IP curl -I https://google.com # HTTP headers test wget URL # Download file nmcli connection show # NetworkManager connections nmcli device status # Interface status hostnamectl set-hostname server1 # Change hostname
9. FIREWALL
firewall-cmd --state # Firewalld status firewall-cmd --list-all # Show active rules firewall-cmd --get-active-zones # Active firewall zones firewall-cmd --add-service=http # Temporary allow HTTP firewall-cmd --add-service=http --permanent # Permanent allow HTTP firewall-cmd --reload # Reload firewall rules firewall-cmd --remove-service=http --permanent # Remove rule firewall-cmd --add-port=8080/tcp --permanent # Allow custom port
10. SSH
ssh user@server # Connect remote server ssh-copy-id user@server # Copy SSH key scp file user@server:/tmp # Secure copy rsync -avz src/ user@server:/backup # Efficient sync ssh-keygen # Generate SSH keys
11. STORAGE / LVM
lsblk # Block devices blkid # UUID and filesystem type fdisk -l # Partition info pvcreate /dev/sdb # Create physical volume vgcreate vgdata /dev/sdb # Create volume group lvcreate -L 10G -n lvdata vgdata # Create logical volume mkfs.xfs /dev/vgdata/lvdata # Create XFS filesystem mount /dev/vgdata/lvdata /data # Mount filesystem echo '/dev/vgdata/lvdata /data xfs defaults 0 0' >> /etc/fstab # Persistent mount lvextend -L +5G /dev/vgdata/lvdata # Extend LV xfs_growfs /data # Grow XFS filesystem vgs # View VGs lvs # View LVs pvs # View PVs
12. LOGS
journalctl # System logs journalctl -u sshd # Logs for service tail -f /var/log/messages # Live log monitoring grep "error" /var/log/messages # Search logs
13. SELINUX
getenforce # Current SELinux mode sestatus # Full SELinux status setenforce 0 # Temporary permissive mode setenforce 1 # Enforcing mode restorecon -Rv /var/www/html # Restore SELinux contexts semanage port -l # List SELinux ports
14. SCHEDULING
crontab -e # Edit cron jobs crontab -l # List cron jobs systemctl status crond # Cron service status
15. ARCHIVE / COMPRESSION
tar -cvf backup.tar /data # Create tar archive tar -xvf backup.tar # Extract tar tar -czvf backup.tar.gz /data # Compressed tar.gz gzip file # Compress file gunzip file.gz # Extract gzip
16. TROUBLESHOOTING
df -h # Disk full? free -h # Memory issue? top # CPU issue? ss -tulpn # Port issue? systemctl status service # Service issue? journalctl -xe # Recent errors ping IP # Network reachable? dig domain.com # DNS issue? curl localhost:8080 # App responding? getenforce # SELinux blocking? firewall-cmd --list-all # Firewall blocking?
▶
⏱️ RHEL CRON SCHEDULE CHEAT SHEET
1. CRON SERVICE MANAGEMENT
systemctl status crond # Check cron daemon status systemctl start crond # Start cron service systemctl enable crond # Enable cron at boot systemctl restart crond # Restart cron service tail -f /var/log/cron # View cron logs (RHEL) journalctl -u crond -f # Journal logs
2. CRONTAB MANAGEMENT
crontab -e # Edit current user's cron jobs crontab -l # List current user's cron jobs crontab -r # Remove current user's cron jobs crontab -u username -e # Edit another user's cron jobs crontab -u username -l # List another user's cron jobs /var/spool/cron/ # User cron storage location /etc/crontab # System-wide cron config /etc/cron.d/ # Additional system cron jobs
3. CRON FORMAT
# Format: # ┌──────── minute (0-59) # │ ┌────── hour (0-23) # │ │ ┌──── day of month (1-31) # │ │ │ ┌── month (1-12) # │ │ │ │ ┌ weekday (0-7) [0 and 7 = Sunday] # │ │ │ │ │ # * * * * * command 30 2 * * * /opt/backup.sh # Runs daily at 2:30 AM
4. SPECIAL SYMBOLS
* * * * * command # * = every value (Every minute) 0 9,18 * * * command # , = multiple values (Runs at 9 AM and 6 PM) 0 9-17 * * * command # - = range (Runs every hour from 9 AM to 5 PM) */5 * * * * command # / = step interval (Every 5 minutes) 0 */2 * * * command # / = step interval (Every 2 hours)
5. COMMON SCHEDULES
* * * * * command # Every minute */5 * * * * command # Every 5 minutes */10 * * * * command # Every 10 minutes */15 * * * * command # Every 15 minutes */30 * * * * command # Every 30 minutes 0 * * * * command # Every hour 0 */2 * * * command # Every 2 hours 0 */6 * * * command # Every 6 hours 0 0 * * * command # Daily at midnight 0 1 * * * command # Daily at 1 AM 30 2 * * * command # Daily at 2:30 AM 0 9 * * 1-5 command # Weekdays at 9 AM 0 18 * * 1-5 command # Weekdays at 6 PM 0 10 * * 6,0 command # Weekends at 10 AM 0 0 * * 0 command # Every Sunday midnight 0 3 * * 0 command # Every Sunday at 3 AM 0 0 1 * * command # First day of every month 0 2 1 * * command # Monthly at 2 AM on day 1 0 0 1 1 * command # Yearly on January 1st 0 8 15 * * command # Every month on 15th at 8 AM
6. SPECIAL SHORTCUTS
@reboot /opt/startup.sh # Run once after server reboot @hourly command # Every hour @daily command # Once per day @weekly command # Once per week @monthly command # Once per month @yearly command # Once per year @annually command # Same as yearly
7. RHEL ADMIN PRACTICAL EXAMPLES
0 1 * * * /usr/local/bin/backup.sh # Daily backup at 1 AM */5 * * * * /usr/local/bin/healthcheck.sh # Health check every 5 minutes 0 3 * * 0 systemctl restart httpd # Restart Apache every Sunday 3 AM 0 2 * * * dnf -y update # Daily package update at 2 AM (be careful in production) 0 0 * * * find /var/log/app -type f -mtime +7 -delete # Delete logs older than 7 days */10 * * * * df -h >> /var/log/disk_usage.log 2>&1 # Disk usage logging every 10 mins 0 */6 * * * systemctl restart myservice # Restart service every 6 hours 0 4 * * * rsync -av /data /backup # Daily rsync backup */2 * * * * curl -f http://localhost:8080/health || systemctl restart myapp # App health monitoring every 2 mins 0 5 * * 1 tar -czf /backup/etc-$(date +\%F).tar.gz /etc # Weekly config backup every Monday 5 AM
8. BEST PRACTICES
# Always use full paths /usr/bin/df /usr/bin/find /usr/bin/systemctl # Redirect stdout + stderr >> /var/log/job.log 2>&1 # Define shell SHELL=/bin/bash # Define PATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin # Email notifications MAILTO=root
9. TROUBLESHOOTING
systemctl status crond # Verify cron service crontab -l # Check installed jobs tail -f /var/log/cron # Monitor execution logs journalctl -u crond # View cron journal bash /opt/script.sh # Manual script testing ls -l /opt/script.sh # Check execute permissions chmod +x /opt/script.sh # Fix permissions
10. COMMON MISTAKES
# WRONG backup.sh # Relative path may fail # CORRECT /opt/scripts/backup.sh # WRONG 2&>1 # CORRECT 2>&1 # WRONG dnf update # PATH issue possible # CORRECT /usr/bin/dnf update # WRONG Using environment variables from .bashrc # Cron does not load full user shell environment