RHEL — cheat sheet
A one-page lookup for the commands and flags used across this course. Grouped by task; the course
pages cover the why behind each one — this page is just the what.
Subscription & release
| Task |
Command |
| Register the host |
sudo subscription-manager register --username U --password 'P' |
| Show subscription status |
sudo subscription-manager status |
| List enabled repos |
sudo subscription-manager repos --list-enabled |
| Pin to a minor release |
sudo subscription-manager release --set=9.4 |
| Unpin, track latest again |
sudo subscription-manager release --unset |
| Unregister |
sudo subscription-manager unregister |
Packages — dnf / rpm
| Task |
Command |
| Update everything |
sudo dnf upgrade -y |
| Install / remove |
sudo dnf install -y <pkg> / sudo dnf remove -y <pkg> |
| Search / show info |
dnf search <term> / dnf info <pkg> |
| List installed matching a name |
dnf list installed \| grep <name> |
| Which package owns this file |
dnf provides /usr/bin/jq |
| Transaction history / undo one |
sudo dnf history / sudo dnf history undo <N> |
| List / enable an application stream |
dnf module list / sudo dnf module enable -y nodejs:20 |
| List files an installed package owns |
rpm -ql <pkg> |
| Which package owns this file (installed-only) |
rpm -qf <path> |
| Verify a package's files against its manifest |
rpm -V <pkg> |
systemd & journald
| Task |
Command |
| Status / is it running |
systemctl status <unit> / systemctl is-active <unit> |
| Start, stop, restart, enable now |
sudo systemctl start\|stop\|restart <unit> / enable --now <unit> |
| Reload unit files after editing one |
sudo systemctl daemon-reload |
| Safely override a vendor unit |
sudo systemctl edit <unit> (writes a drop-in, not a fork) |
| See the merged effective unit |
systemctl cat <unit> |
| Block a unit from starting at all |
sudo systemctl mask <unit> / unmask <unit> |
| List every failed unit |
systemctl list-units --type=service --state=failed |
| Walk a unit's dependency graph |
systemctl list-dependencies <unit> |
| Slowest chain on the boot path |
systemd-analyze critical-chain |
| Read/change the boot target |
systemctl get-default / sudo systemctl set-default <target> |
| List timers, next/last run |
systemctl list-timers |
| Logs for one unit, follow |
journalctl -u <unit> -f |
| Logs since / at a severity |
journalctl --since "1 hour ago" / journalctl -p err |
| Filter by a structured field |
journalctl _AUDIT_TYPE=AVC |
| Trim the journal |
journalctl --vacuum-size=500M / --vacuum-time=7d |
| Make journald logs survive reboot |
sudo mkdir -p /var/log/journal && sudo systemd-tmpfiles --create --prefix /var/log/journal && sudo systemctl restart systemd-journald |
SELinux
| Task |
Command |
| Current mode / policy + mount point |
getenforce / sudo sestatus |
| Temporarily switch mode (not persisted) |
sudo setenforce 0\|1 |
| Show contexts on files / processes |
ls -Z <path> / ps -eZ |
| Fix a file's context back to policy default |
sudo restorecon -Rv <path> |
| Set a context by hand (temporary) |
sudo chcon -t <type> <path> |
| Persist a path's context in policy |
sudo semanage fcontext -a -t <type> '<path>(/.*)?' then restorecon -Rv |
| Let a daemon use a non-default port |
sudo semanage port -a -t <type> -p tcp <port> |
| Flip a boolean, runtime only vs. persisted |
sudo setsebool <name> on vs. sudo setsebool -P <name> on |
| Recent denials |
sudo ausearch -m AVC -ts recent |
| Generate + install a policy module from denials |
sudo ausearch -m AVC -ts recent \| audit2allow -M myapp && sudo semodule -i myapp.pp |
| A container's full context (type + categories) |
podman inspect <container> --format '{{.ProcessLabel}}' |
firewalld
| Task |
Command |
| Daemon state / effective rules |
sudo firewall-cmd --state / sudo firewall-cmd --list-all |
| Default zone / zone-to-interface map |
sudo firewall-cmd --get-default-zone / --get-active-zones |
| Rules for one specific zone |
sudo firewall-cmd --zone=<name> --list-all |
| Assign an interface to a zone |
sudo firewall-cmd --zone=<name> --change-interface=<if> --permanent |
| Open a named service / a raw port |
sudo firewall-cmd --add-service=<svc> --permanent / --add-port=<port>/tcp --permanent |
| Remove a service / port |
sudo firewall-cmd --remove-service=<svc> --permanent / --remove-port=<port>/tcp --permanent |
| Apply permanent changes to the live ruleset |
sudo firewall-cmd --reload |
| Source-IP-scoped rule |
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" service name="ssh" accept' --permanent |
| Confirm a NAT rule at the kernel level |
sudo nft list ruleset \| grep -A2 <port> |
Networking — nmcli
| Task |
Command |
| Interfaces + active profile |
nmcli device status |
| Defined profiles / only the active ones |
nmcli connection show / nmcli connection show --active |
| Add a static IP profile |
sudo nmcli connection add type ethernet con-name <name> ifname <if> ipv4.method manual ipv4.addresses <cidr> ipv4.gateway <gw> ipv4.dns "<dns...>" |
Change a stored setting (no effect until up) |
sudo nmcli connection modify <name> <key> <val> |
| Apply / tear down a profile |
sudo nmcli connection up <name> / sudo nmcli connection down <name> |
| Delete a profile |
sudo nmcli connection delete <name> |
| Bond two NICs |
sudo nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup" |
| Add a VLAN on a physical interface |
sudo nmcli connection add type vlan con-name vlan100 ifname eth0.100 dev eth0 id 100 |
| Kernel-level view (reflects, doesn't set, NM state) |
ip addr / ip route / ip link |
Storage — LVM & filesystems
| Task |
Command |
| Inspect block devices / mounts |
lsblk / df -hT |
| List PVs / VGs / LVs |
sudo pvs / sudo vgs / sudo lvs |
| Add a disk to a VG, then grow an LV + its filesystem |
sudo pvcreate /dev/sdc && sudo vgextend <vg> /dev/sdc && sudo lvextend -L +100G /dev/<vg>/<lv> && sudo xfs_growfs <mount> |
| Shrink (ext4 only — XFS can't shrink) |
sudo umount <mount> → e2fsck -f → resize2fs <lv> <size> → lvreduce -L <size> <lv> → e2fsck -f (filesystem shrinks before the LV) |
| Take a snapshot / mount it read-only |
sudo lvcreate -L 10G -s -n <name>-snap /dev/<vg>/<lv> / mount -o ro ... |
| Discard a snapshot |
sudo lvremove /dev/<vg>/<lv>-snap |
| Create an overcommitted thin pool + volumes |
sudo lvcreate -L 500G -T <vg>/thinpool / lvcreate -V 200G -T <vg>/thinpool -n <name> |
| Watch a thin pool's real fill level |
sudo lvs -o+lv_size,data_percent |
| Tear the stack down (top to bottom) |
umount → lvremove → vgreduce/vgremove → pvremove |
| Persist a mount |
blkid <device> → add a UUID=... <mount> xfs defaults 0 0 line to /etc/fstab → mount -a |
Users, sudo, SSH
| Task |
Command |
| Create a user with a home dir + shell |
sudo useradd -m -s /bin/bash <name> |
| Set a password |
sudo passwd <name> |
| Add to a supplementary group (append, don't replace!) |
sudo usermod -aG wheel <name> |
| Resolve identity (uid, primary + supplementary groups) |
id <name> / getent passwd <name> / getent group <group> |
| See my effective sudo rules |
sudo -l |
| Run as a specific non-root user |
sudo -u postgres psql |
| Add a scoped sudoers drop-in |
sudo visudo -f /etc/sudoers.d/<name> |
| Validate sudoers syntax (all files / one file) |
sudo visudo -c / sudo visudo -c -f /etc/sudoers.d/<name> |
| Copy a public key for passwordless SSH |
ssh-copy-id <user>@<host> |
| Validate + reload sshd after a config change |
sudo sshd -t && sudo systemctl restart sshd |
Containers on RHEL
| Task |
Command |
| Install Podman |
sudo dnf install -y podman |
| Pull a UBI or other image (no login needed for UBI) |
podman pull registry.access.redhat.com/ubi9/ubi:9.4 |
| Confirm a container's published port mapping |
podman port <container> |
Security frameworks & image mode
| Task |
Command |
| Scan against a CIS/STIG profile |
sudo dnf install -y scap-security-guide openscap-scanner then oscap xccdf eval --profile <profile> ... |
| Enable FIPS mode (then reboot) |
sudo fips-mode-setup --enable && sudo reboot |
| Which bootc image is running |
bootc status |
| Rebase to a different image / apply a pulled upgrade |
sudo bootc switch <image> / sudo bootc upgrade |
How this connects
The LVM & storage page covers the shrink/snapshot/thin-provisioning order, the networking & firewall
page covers the zone model and the container-to-host firewall path, the systemd & journald page covers
unit ordering and timers, and the SELinux & users page covers categories, boolean persistence, and
sudoers precedence.