Install & Subscription

Installing RHEL and Rocky Linux, subscriptions and repositories, plus general command-line tips.

Linux - RHeL Subscription

Last verified: October 2026 against Red Hat's registration and Simple Content Access documentation and the RHEL 10.0 release notes.

We encountered the error message ‘This system is not registered with an entitlement server, You can use “rhc” or “subscription-manager” to register’. On CentOS Stream 9 Linux system while trying to perform package installations. For RHEL, this usually is an indication that your system is not registered with Red Hat’s subscription management service.

$ sudo dnf clean all
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.

21 files removed

Here is how we solved the issue on the system. Open the following file for editing:

sudo vi /etc/dnf/plugins/subscription-manager.conf

Change from enabled=1 to enabled=0:

[main]
enabled=0

# When following option is set to 1, then all repositories defined outside redhat.repo will be disabled
# every time subscription-manager plugin is triggered by dnf or yum
disable_system_repos=0

You can then update package cache and try install your packages.

For RHEL system, run the following command to register your system with the Red Hat Subscription Manager:

sudo subscription-manager register --username <your_username> --password <your_password>

Remember to replace the username and password with the ones for your Red Hat account. On RHEL 8.8 and later you can also register with rhc, using either an activation key or your account:

sudo rhc connect --activation-key=<key> --organization=<org_id>
sudo rhc connect --username=<your_username> --password=<your_password>

No attach step is needed after registering. Simple Content Access is now the default for all Red Hat accounts, so a registered system can use the content its account is entitled to straight away. subscription-manager attach --auto from older guides was deprecated in RHEL 9.5 and the attach commands were removed in RHEL 10.

Check that registration was successful:

sudo subscription-manager status

To enable a specific repository, run:

sudo subscription-manager repos --enable=<repository_name>

Listing of available repositories can be done using:

sudo subscription-manager repos --list

Enjoy using your CentOS Stream or Red Hat Enterprise Linux system!.

Sources

Linux Server - Install RedHat 9 SSH configuration

Last verified: October 2026 against Red Hat's RHEL 9 system-wide cryptographic policies guide and the sshd_config manual.

On Red Hat Enterprise Linux 9 (RHEL 9 / Rocky Linux 9 / AlmaLinux 9 etc.), SSH configuration is primarily managed through system-wide crypto policies. Direct settings in /etc/ssh/sshd_config for KexAlgorithms, Ciphers, etc., are often ignored unless you properly override the policy.

1. Recommended: Add Curve25519 (preferred) and Diffie-Hellman group exchange

Curve25519-sha256 (and its @libssh.org variant) is already enabled by default in RHEL 9 and is the modern, secure choice.

diffie-hellman-group-exchange-sha256 is also generally available and reasonably secure.

Create a drop-in config. Red Hat's guidance is to use a two-digit prefix smaller than 50 so the file is read before 50-redhat.conf (which pulls in the crypto policy). sshd uses the first value it reads for each keyword:

sudo mkdir -p /etc/ssh/sshd_config.d
sudo tee /etc/ssh/sshd_config.d/49-custom-kex.conf << EOF
# Only offer these KEX algorithms (the client chooses the order)
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512
EOF

2. Test the config

sudo sshd -t

If no errors, reload SSH:

sudo systemctl reload sshd

3. Temporarily allow legacy algorithms (if needed for old clients/servers)

Legacy algorithms (e.g., SHA-1 based ones like diffie-hellman-group1-sha1 or older group-exchange) are disabled for security.

Best temporary option (least impact):

# Append legacy KEX to OpenSSH's built-in default list
sudo tee /etc/ssh/sshd_config.d/48-legacy-kex.conf << EOF
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
EOF

Because 48-legacy-kex.conf is read first, its KexAlgorithms line is used instead of the one in 49-custom-kex.conf while it exists. Test with sudo sshd -t, reload sshd, and delete the file when the old clients are gone.

Or use the broader (but riskier) LEGACY crypto policy:

sudo update-crypto-policies --set LEGACY
sudo reboot

Warning: LEGACY weakens many other things system-wide (not just SSH). Revert with sudo update-crypto-policies --set DEFAULT and reboot when done. Red Hat recommends a reboot after changing the policy so every service picks it up.

Verification commands

# Available KEX algorithms
ssh -Q kex

# Effective configuration used by sshd
sudo sshd -T | grep -E '^(kexalgorithms|ciphers|macs)'

# Test connection
ssh -v user@yourserver

Notes for your homelab / self-hosted setup

Sources

Linux - Commands to Know

Last verified: October 2026 against the current man pages (tar, touch, useradd, userdel, groupadd, groupdel) for RHEL / Rocky Linux.

This is a quick version of commands to be aware of.

System information 

uname -a : Displays all system information.

hostnamectl : Shows current hostname and related details.

lscpu : Lists CPU architecture information.

timedatectl status : Shows system time.

System monitoring and management

top : Displays real-time system processes.

htop : An interactive process viewer (needs installation; on RHEL / Rocky Linux it comes from the EPEL repository).

df -h : Shows disk usage in a human-readable format.

free -m : Displays free and used memory in MB.

kill [PID] : Terminates a process (sends SIGTERM by default).

Running commands 

<command> & : Runs command in the background.

jobs : Displays background commands.

fg %1 : Brings background job 1 (number from jobs) to the foreground.

Service management

sudo systemctl start [service] : Starts a service.

sudo systemctl stop [service] : Stops a service

sudo systemctl status [service] : Checks the status of a service.

sudo systemctl reload [service] : Reloads a service’s configuration without interrupting its operation.

journalctl -f : Follows the journal, showing new log messages in real time.

journalctl -u [unit] : Displays logs for a specific systemd unit.

Cron jobs and scheduling

crontab -e : Edits cron jobs for the current user.

crontab -l : Lists cron jobs for the current user.

File management

ls : Lists files and directories.

touch : Creates an empty file, or updates the access and modification times of an existing file.

cp : Copies files from source to destination.

mv : Moves files or renames them.

rm : Deletes a file.

Directory navigation

pwd : Displays the current directory path.

cd : Changes the current directory.

mkdir : Creates a new directory.

File permissions and ownership

chmod [who][+/-][permissions] : Changes file permissions.

chmod u+x : Makes a file executable by its owner.

chown [user]:[group] [file] : Changes file owner and group.

Searching and finding

find [directory] -name : Finds files and directories.

grep : Searches for a pattern in files.

Archiving and compression

tar -czvf [archive].tar.gz [files] : Compresses files into a tar.gz archive.

tar -xvf [archive].tar.gz -C [destination] : Extracts a compressed tar archive into the destination directory.

Text editing and processing

nano : Opens a file in the Nano text editor.

cat : Displays the contents of a file.

less : Displays the paginated content of a file.

head : Shows the first few lines of a file.

tail : Shows the last few lines of a file.

awk '{print}' [file] : Prints every line in a file.

User management

w : Shows which users are logged in.

sudo useradd [username] : Creates a new user (Debian / Ubuntu also have the adduser front end).

sudo userdel [username] : Deletes a user (add -r to also remove the home directory).

sudo passwd : Sets or changes the password for a user.

su : Switches user.

sudo passwd -l : Locks a user account.

sudo passwd -u : Unlocks a user password.

sudo chage : Sets user password expiration date.

Group management

id [username] : Displays user and group IDs.

groups [username] : Shows the groups a user belongs to.

sudo groupadd [group] : Creates a new group.

sudo groupdel [group] : Deletes a group.

Sources

Linux - Bag of Tricks

Introduction

This document has many useful command.

Change Files and Folder Permissions

To change the permissions of files to 655 and subfolders to 755 (which is the common practice for directories to allow execution for navigating into them) within a specified directory and its subdirectories, you can use the find command with chmod.

Explanation of permissions:

Command

find /path/to/directory -type f -exec chmod 655 {} +
find /path/to/directory -type d -exec chmod 755 {} +

find /path/to/directory \( -type d -exec chmod 755 {} + \) -o \( -type f -exec chmod 644 {} + \)

chmod -R u+rwX,go+rX,go-w /path/to/directory

find /path/to/directory -type d -print0 | xargs -0 chmod 755
find /path/to/directory -type f -print0   | xargs -0 chmod 644

find /path/to/directory -print0 \
  \( -type d -exec chmod 755 {} + \) \
  -o \( -type f -exec chmod 644 {} + \)

Linux Set Time Examples

You can also simplify format using following syntax:

date +%Y%m%d -s "20081128"

To set time use the following syntax:

date +%T -s "10:13:13"

Use the following syntax to set new data and time:

date --set="STRING"

For example, set new data to 2 Oct 2006 18:00:00, type the following command as root user:

date -s "2 OCT 2006 18:00:00"

OR

date --set="2 OCT 2006 18:00:00"

Rclone Copy Examples

Click here for the page HERE

Rsync Copy Examples

This is to move files from one server to another

Ending the folder WITHOUT a “/” slash means copy that folder everything in that folder

Ending the folder WITH a “/” slash means copy everything within that folder

Example for “remote to local” location

rsync -chavzP --stats --progress -e ssh user@remote_host:/remote_folder/dir1/ /local_folder/dir1/

Example for “local to remote” location

rsync -chavzP --stats --progress -e ssh /local_folder/dir1/ user@remote_host:/remote_folder/dir1/

Rsync Auto Login while sending

Example to add a Rsync key on the remote server

On the local server simply login as a given user ex: ROOT or USER

ssh-keygen -t rsa

If it already exists simply hit "n"

Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
/root/.ssh/id_rsa already exists.
Overwrite (y/n)?

If not then simply hit enter through all options

Example: of using ROOT

Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:JoMN/cxvsqZWBHws4eyrU5Q0F0qRe//44qdrrjiQmbU root@client01
The key's randomart image is:
+---[RSA 3072]----+
|     .+=..       |
|     =B.+        |
|    ..=O         |
|     ==+o        |
|    = E=...      |
|     o... oo     |
|    ..o..++ o    |
|    .oo+o==*.    |
+----[SHA256]-----+
You have mail in /var/spool/mail/root

Run the following to add the key to the remote server, you can also use IP instead of host name

ssh-copy-id -i ~/.ssh/id_rsa.pub remuser@server01

Example of using a USER you will have to enter yes and the USER password

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'server02 (192.168.x.x)' can't be established.
ED25519 key fingerprint is SHA256:oZnvrgY+2Xpd2/huaffvzLMBAgI52AMPUmq/LPLIXbE.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
remuser@server02's password: 
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'remuser@server02'"
and check to make sure that only the key(s) you wanted were added.

Optional: If the command cannot be run above you can copy the key to the remote server manually into the “authorized_keys” file

cd
cd .ssh
vi authrized_keys

Optional: Change the permissions on the local server

chmod 600 ~/.ssh/*
chmod 711 ~/.ssh
chmod 711 ~

Synology Rsync

rsync -aXHmS --syno-acl /volum1/[xxx] /volume2/[xxx]

-a, --archive archive mode; equals -rlptgoD (no -H,-A,-X)
-p, --perms preserve permissions
-X, --xattrs preserve extended attributes
-o, --owner preserve owner (super-user only)
-g, --group preserve group
--syno-acl copy Synology ACL data

I use the following options myself:
rsync -avhxWog --stats --backup --suffix $OLDSUFFIX --exclude-from=$RSYEXCL --syno-pseudo-root

No idea why I list options "og" since they're implied by -a, but it works...

Regards, Arild
PS: "rsync --help" lists all available options for rsync

Find and Replace String with sed

There are several versions of sed, with some functional differences between them. macOS uses the BSD version, while most Linux distributions come with GNU sed pre-installed by default. We’ll use the GNU version.

The general form of searching and replacing text using sed takes the following form:

sed -i 's/SEARCH_REGEX/REPLACEMENT/g' INPUTFILE

Cop

Find and Replace String with sed within vi

This is to search and replace a file globally withing vi

:%s/search_string/replacement_string/g

Kill Users in Linux

This is to be used when trying to kill users using the connection, replace the ? with the number of the session.

pkill -KILL -t pts/?

Continued in Linux - Bag of Tricks (Part 2): Certificates, Databases, Disks & Boot.

Linux - Bag of Tricks (Part 2): Certificates, Databases, Disks & Boot

This page continues Linux - Bag of Tricks.

Create a CERT

First, you need to generate the private key and the Certificate Signing Request (CSR). You can do this via the openssl command:

openssl req -nodes -newkey rsa:2048 -keyout privatekey.key -out mail.csr

Then, generate a signing request

openssl x509 -req -days 365 -in mail.csr -signkey privatekey.key -out secure.crt

Create a localhost cert on the server

openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt

Mariadb Log Rotate

If log file is large, try if the logrotate

logrotate --force /etc/logrotate.d/mariadb

MySQL Fail to Start

If MySQL does not restart, it probably will not as the index of the log files will not be changed

cd /var/lib/mysql
mv ib_logfile0 ib_logfile0.old
mv ib_logfile1 ib_logfile1.old
systemctl restart mariadb

 

Configure Rsync

Useful for system migrations

Create a “/etc/rsyncd.conf” containing:

[root]

exclude = /dev /etc/fstab /proc /sys

path = /

read only = yes

list = yes

uid = root

gid = root

 

Enable and start:

systemctl enable rsyncd.service

systemctl start rsyncd.service 

Change Run level

systemctl set-default multi-user.target

To switch from graphical to multi-user:

systemctl isolate multi-user.target;

Change Local settings

# timedatectl set-timezone Europe/London  

# localectl set-locale LANG=en_GB.UTF-8

# localectl set-keymap uk

Temporary change

$ loadkeys us

Configure Alternate Authentication

authconfig-tui

SSD Considerations

Change the value of “issue_discards” option from 0 to 1 in “/etc/lvm/lvm.conf”

# systemctl enable fstrim.timer

Adjust “/etc/fstab”

/dev/mapper/xxx /XXX     xfs     defaults,noatime,discard        0 0

Optionally set /tmp in RAM

# systemctl enable tmp.mount

Adding a Disk

# parted /dev/sdx

 

mklabel gpt

unit s

mkpart primary 2048s 100%

set 1 lvm on

quit

 

# pvcreate /dev/sdx1

# vgcreate rl_ssd /dev/sdx1

# lvcreate –L 50GB -n mysql rl_ssd

# mkfs.xfs /dev/rl-ssd/mysql

# blkid /dev/sdc

# chown mysql:mysql /var/lib/mysql

Growing a lvm partition

# parted /dev/sdc

 

(parted) unit b

(parted) print free

Number  Start        End           Size          Type     File system  Flags

 1      31744B       5368709119B   5368677376B   primary

        5368709120B  21474836479B  16106127360B           Free Space

(parted) resizepart 1  21474836479B

(parted) quit

 

# pvresize /dev/sdc1

 

 

Updating Bootloader configuration

/etc/default/grub

grub2-mkconfig -o /boot/grub2/grub.cfg

NMAP Scan for all Open Ports

TCP

sudo nmap -sT -p- example.com

UDP

sudo nmap -sU -p- example.com

Look for open Ports

nc -vz 203.0.113.10 514

Trace route

sudo tracepath 203.0.113.10

Looking at the Journal, this is an example to look at the mariadb process

journalctl -u mariadb -f

Search in sub folders

grep -r "MYSQL_HOST" . --include="compose.yaml" --include="docker-compose.yml"

Change Lines in KIDSENV and make a backup of it with a .bak extentions

find . -type f -name "KIDSENV" -exec sed -i.bak 's/^KWSQL_LOG=query/#KWSQL_LOG=query/' {} +

Delete file on the server 

find . -type f \( -name "SQLQRY*" -o -name "SQLINFO" -o -name "SQLERROR" \) -delete

Delete files over 100M

find . -type f -size +100M

Delete files over 100M and list them

find . -type f -size +100M -exec ls -lh {} +

Grep files named TX*.DA that are only 1 month back and files lines that have RETDT or RETHD

find . -type f -name "TX*.DA" -mtime -30 -exec grep -iE "RETDT|RETHD" {} +

Remove certain directory

find /path/to/drive/root -type d -name "@eaDir" -print0 | xargs -0 rm -rf

 

Command - Cmnd_Alias

Last verified: October 2026 against the sudoers manual (sudo.ws).

What is Cmnd_Alias?

Cmnd_Alias (Command Alias) is a feature in /etc/sudoers (and files in /etc/sudoers.d/) that lets you group multiple commands under a single, easy-to-read name.

Instead of repeating long command paths many times, you define the group once and then reference the alias name in your user permission rules. This makes the sudoers configuration:

It is one of four main alias types in sudoers:

Basic Syntax

Cmnd_Alias  ALIAS_NAME = /full/path/to/command1, \
                       /full/path/to/command2 arg1 arg2, \
                       /full/path/to/command3

Rules:

Example for Your api.service (Recommended Version)

Create or edit the file with sudo visudo -f /etc/sudoers.d/10-deploy-api:

# Command alias for managing the api.service safely
Cmnd_Alias API_SERVICE_CMDS = /usr/bin/systemctl start api.service, \
                             /usr/bin/systemctl stop api.service, \
                             /usr/bin/systemctl restart api.service, \
                             /usr/bin/systemctl status api.service

# Grant the deploy user passwordless access to only these commands
deployuser ALL=(ALL) NOPASSWD: API_SERVICE_CMDS

This is cleaner than listing the four commands directly on the user line.

More Flexible Example (Allow Any Action on the Specific Service)

If you want the deploy user to run several systemctl actions on api.service, do not use a wildcard such as /usr/bin/systemctl * api.service. In sudoers, wildcards in command arguments match any characters, including spaces, so that rule does not limit the user to api.service. It also matches, for example, systemctl stop sshd.service api.service or systemctl edit api.service (which opens an editor as root).

List each allowed command explicitly (as in the example above), or on sudo 1.9.10 and later (check with sudo -V) use a regular expression, which must start with ^ and end with $:

Cmnd_Alias API_SERVICE_CMDS = /usr/bin/systemctl ^(start|stop|restart|reload|status) api\.service$

deployuser ALL=(ALL) NOPASSWD: API_SERVICE_CMDS

This allows only the listed actions on api.service.

How to Use It in Your Setup

sudo visudo -f /etc/sudoers.d/10-deploy-api
sudo chmod 0440 /etc/sudoers.d/10-deploy-api
sudo -l -U deployuser
  1. You should see the allowed commands listed for deployuser.

Then update your PowerShell script to use deployuser (instead of root).

Why This Is Better Than the Original Line

Your original line:

deployuser ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop api.service, /usr/bin/systemctl restart api.service, /usr/bin/systemctl status api.service

Works fine, but using Cmnd_Alias is preferred when:

Sources