# 1. Import the AlmaLinux public signing key
curl -O https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9
gpg --import RPM-GPG-KEY-AlmaLinux-9
 
# 2. Download the CHECKSUM file and signature
curl -O https://repo.almalinux.org/almalinux/9/isos/x86_64/AlmaLinux-9-latest-x86_64-dvd.iso.sha256sum.txt.asc
curl -O https://repo.almalinux.org/almalinux/9/isos/x86_64/AlmaLinux-9-latest-x86_64-dvd.iso.sha256sum.txt
 
# 3. Verify the checksum file signature
gpg --verify AlmaLinux-9-latest-x86_64-dvd.iso.sha256sum.txt.asc AlmaLinux-9-latest-x86_64-dvd.iso.sha256sum.txt
 
# 4. Check the calculated hash of the ISO matches the verified sha256sums
sha256sum -c AlmaLinux-9-latest-x86_64-dvd.iso.sha256sum.txt --ignore-missing
# Output on success: AlmaLinux-9.x-x86_64-dvd.iso: OK

# 1. Update CentOS 7 system packages to latest release versions
sudo yum update -y
sudo reboot
 
# 2. Install the elevate-release package repository configuration
sudo yum install -y http://repo.almalinux.org/elevate/elevate-release-latest-el7.noarch.rpm
 
# 3. Install the leapp upgrade engine and AlmaLinux data package
sudo yum install -y leapp-upgrade leapp-data-almalinux
 
# 4. Execute the pre-upgrade assessment check
sudo leapp preupgrade
 
# 5. Examine output reports (/var/log/leapp/leapp-report.txt)
# Solve inhibit blocks (e.g., modules loading, root login permissions, boot parameters)
# Example: Allow root login over SSH during migration if required:
# sudo leapp answer --section remove_pam_pkcs11_module_check.confirm=True
 
# 6. Initialize the upgrade sequence
sudo leapp upgrade
 
# 7. Once upgrade completes, reboot system manually
sudo reboot

# 1. Register EPEL (Extra Packages for Enterprise Linux) repositories
sudo dnf install -y epel-release
 
# 2. Force DNF cache updates
sudo dnf makecache
 
# 3. Configure hostnames
sudo hostnamectl set-hostname almalinux-host.enterprise.local

# 1. Scan the system to identify available raw disks
sudo lsscsi
sudo fdisk -l
 
# 2. Initialize a physical volume on the target disk partition (e.g., /dev/sdb1)
sudo pvcreate /dev/sdb1
# Output: Physical volume "/dev/sdb1" successfully created.
 
# 3. Verify the physical volume parameters
sudo pvdisplay /dev/sdb1
 
# 4. Create a volume group named 'vg_data' using the physical volume
sudo vgcreate vg_data /dev/sdb1
# Output: Volume group "vg_data" successfully created.
 
# 5. Verify the volume group parameters
sudo vgdisplay vg_data
 
# 6. Allocate a logical volume of 100 GB for application storage named 'lv_apps'
sudo lvcreate -L 100G -n lv_apps vg_data
# Output: Logical volume "lv_apps" created.
 
# 7. Format the new logical volume with XFS filesystem (default for AlmaLinux)
sudo mkfs.xfs /dev/vg_data/lv_apps
 
# 8. Create a mount point and mount the volume
sudo mkdir -p /srv/apps
sudo mount /dev/vg_data/lv_apps /srv/apps
 
# 9. Verify mount points and active space
df -hT | grep apps

# 1. Extend the logical volume by adding another 50 GB
sudo lvextend -L +50G /dev/vg_data/lv_apps
# Output: Size of logical volume vg_data/lv_apps changed from 100.00 GiB to 150.00 GiB.
 
# 2. Grow the XFS filesystem online to consume the newly allocated volume space
sudo xfs_growfs /srv/apps
# Output: data blocks changed from 26214400 to 39321600.
 
# 3. Verify that the filesystem partition size has increased
df -h /srv/apps

# Check the default boot target configuration
systemctl get-default
 
# Change the boot target to headless terminal mode permanently
sudo systemctl set-default multi-user.target
 
# Change boot target back to graphical GUI permanently
sudo systemctl set-default graphical.target
 
# Isolate active session target to multi-user terminal immediately
sudo systemctl isolate multi-user.target

# File: /etc/sysctl.d/99-server-performance.conf
 
# Swappiness: Controls the kernel priority for page evictions.
# Lower values prevent swapping pages to disk prematurely, preserving memory page caches.
vm.swappiness = 10
 
# Cache Pressure: Controls kernel tendency to reclaim directory and inode caches.
# Increasing value to 50 prevents excessive disk scanning for folder structures.
vm.vfs_cache_pressure = 50
 
# Writeback: Increases flush timers to write dirty filesystem pages less frequently.
vm.dirty_writeback_centisecs = 1500
vm.dirty_expire_centisecs = 3000

# Reload system configurations immediately
sudo sysctl --system

# Install Zsh
sudo dnf install zsh -y
 
# Change the default login shell for current user
chsh -s /bin/zsh

pwd                        # Print path of the active working directory
ls -laF                    # List files in verbose table format, showing hidden files and directory indicators
cd /var/log/               # Change active directory location
mkdir -p /srv/www/app/     # Create nested folders
touch /tmp/agent.lock      # Create empty file or update access timestamp
cp -a /etc/network/ /backup/# Copy directory recursively, preserving permissions, links, and details
mv source.txt target.txt   # Rename or move file
rm -rf /tmp/scratch/       # Delete files and directories recursively
ln -sf /etc/nginx/ nginx_lnk# Create symbolic link overriding old link
find /etc/ -name "*.conf"  # Find files matching name mask under directory tree
locate index.html          # Find files quickly using prebuilt system database
cat /etc/hostname          # Display file contents
head -n 20 /var/log/messages # Output first 20 lines of a file
tail -f /var/log/secure    # Output and monitor new entries in a file in real-time
grep -rn "error" /var/log/ # Search recursively for string pattern showing line numbers
wc -l /etc/passwd          # Count lines in a file
file /usr/bin/find         # Display file format description and dynamic loading details
stat /etc/shadow           # View detailed file size, links, permissions, and creation timestamps
diff config.old config.new # Compare text file structures and output line modifications

tar -cvzf archive.tar.gz /etc/  # Create compressed gzip archive from target directory
tar -xvzf archive.tar.gz -C /tmp/ # Extract gzip archive contents to /tmp/ path
tar -cvjf archive.bz2 /srv/log/ # Create bzip2 compressed archive
tar -xvjf archive.bz2 -C /opt/  # Extract bzip2 archive contents
zip -r backup.zip /var/www/     # Create compressed zip archive of directory tree
unzip backup.zip -d /tmp/       # Extract zip file contents to target directory
gzip large_log.log              # Compress file directly, replacing it with .gz format
gunzip large_log.log.gz         # Decompress .gz file back to standard log format

ps auxf                    # Display all running processes in hierarchical tree format
top -b -n 1                # Print active process resource usage statistics in batch mode
htop                       # Launch interactive process monitoring console (requires installation)
pgrep -u www-data nginx    # Print PIDs of nginx processes owned by www-data user
kill -15 1024              # Send SIGTERM signal to PID 1024 to terminate gracefully
kill -9 1024               # Send SIGKILL signal to PID 1024 to terminate immediately
pkill -u visitor           # Terminate all active processes owned by visitor account
killall httpd              # Kill all instances of httpd processes
jobs                       # List background jobs
bg %1                      # Resume suspended job 1 in background
fg %1                      # Bring background job 1 to foreground
nohup node server.js &     # Run process in background, ignoring hangup signals
ulimit -a                  # Display current user process limits and descriptors thresholds
nice -n 10 backup.sh       # Start process with elevated nice value (lower priority)
renice +5 -p 2045          # Modify priority level of active PID 2045 process

uname -a                   # Output kernel release, OS name, and architecture
lshw -short                # Print brief hardware configuration details
lspci | grep VGA           # List PCI graphics cards
lsusb                      # List USB buses and connected hardware
df -hT                     # Output disk space metrics and filesystem types
du -sh /var/log/           # Summarize disk usage of target directory
free -h                    # Show RAM and swap metrics
uptime                     # Print system running time and average CPU loads
journalctl -p err -n 10    # Show the 10 most recent error log entries from systemd journal
dmesg | grep -i hardware   # Print kernel ring buffer messages filtered by search term
lsmod                      # List loaded kernel module drivers
modinfo ext4               # Display information about ext4 kernel module details
sudo dmidecode -t system   # Read motherboard bios and hardware serialization metrics
lscpu                      # View CPU cores and architecture descriptors
lsblk                      # Display disk partition structures and UUID layouts

ip addr show dev eth0      # Display active IP configuration for eth0 interface
ping -c 3 google.com       # Send ICMP echo packets to verify remote host connectivity
ss -tulnp                  # Show active TCP and UDP sockets with owning process details
traceroute 8.8.8.8         # Display hop paths to destination host
curl -I https://almalinux.org# Fetch HTTP headers of target site
wget -c https://site.com/f # Download file with resume capability
dig @8.8.8.8 almalinux.org # Perform DNS record queries using Google Resolver
nslookup google.com        # Query internet name servers for IP mapping
hostnamectl                # Display active hostnames and architecture details
ip route show              # Print active system routing path configurations
ip neigh show              # Display ARP mapping table records
netstat -i                 # Print network interface packets statistics

chmod 755 script.sh        # Set owner (rwx), group (r-x), and others (r-x) permissions
chown -R apache:apache     # Recursively assign file ownership to apache user and group
su - administrator         # Log in to administrator user session
sudo -i                    # Escalate terminal session to superuser (root) configuration
visudo                     # Safely edit system sudoers rules file
useradd -m -s /bin/bash usr# Create new user account with home folder and bash shell
userdel -r usr             # Delete user account, home folder, and mail spool
id apache                  # Print user and group IDs (UID/GID) for account
w                          # Display logged in users and their active command sessions
last                       # View history of user login and system reboot records

# Set standard execute permissions (rwxr-xr-x)
chmod 755 /usr/local/bin/deploy

# Apply SUID to a custom binary (Caution: potential privilege escalation point)
sudo chmod u+s /usr/local/bin/helper
 
# Apply SGID to a shared directory
sudo chmod g+s /srv/shared/
 
# Apply Sticky Bit to a temporary directory
sudo chmod +t /srv/public/

# Overwrite file with stdout
ls -la /var/log/ > /tmp/logs.txt
 
# Append stdout to file
echo "System backup initiated" >> /var/log/audit.log
 
# Redirect stderr (standard error) to log
sudo dnf update 2> /tmp/dnf-errors.log
 
# Redirect both stdout and stderr to the same file
sudo tar -cvzf /backup/sys.tar.gz /etc/ &> /var/log/backup-run.log
 
# Discard errors by redirecting to dev null
find / -name "secret.txt" 2> /dev/null
 
# Pipe stdout as input to another command
ss -tulnp | grep ":80" | awk '{print $5}'

#!/bin/bash
# ==============================================================================
# Script: sys_auditor.sh
# Description: Audits active directories, system logs, memory thresholds.
# Author: VR-Rathod
# ==============================================================================
 
AUDIT_LOG="/var/log/almalinux_audit.log"
DISK_LIMIT=85
 
log_event() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$1] - $2" >> "$AUDIT_LOG"
}
 
log_event "INFO" "Initializing system security audit..."
 
# 1. Audit Disk Space
DISK_USAGE=$(df / | tail -n 1 | awk '{print $5}' | sed 's/%//')
if [ "$DISK_USAGE" -gt "$DISK_LIMIT" ]; then
    log_event "CRITICAL" "Root partition usage is at $DISK_USAGE%!"
else
    log_event "INFO" "Root partition usage stable at $DISK_USAGE%."
fi
 
# 2. Check for active root-privileged background processes
ROOT_PROC=$(ps -ef | grep -v "\]$" | awk '{print $1}' | grep "root" | wc -l)
log_event "INFO" "Found $ROOT_PROC root-owned processes active."
 
# 3. Log Active Kernel and Uptime metrics
ACTIVE_KERNEL=$(uname -r)
SYSTEM_UPTIME=$(uptime -p)
log_event "INFO" "Active Kernel version: $ACTIVE_KERNEL | Uptime stats: $SYSTEM_UPTIME"
 
echo "System audit complete. Logging results to $AUDIT_LOG."
exit 0

#!/bin/bash
# ==============================================================================
# Script: elevate_precheck.sh
# Description: Runs basic validation audits on CentOS 7 packages prior to ELevate migrations.
# Author: VR-Rathod
# ==============================================================================
 
LOG_FILE="/var/log/elevate_precheck.log"
 
log_write() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$1] - $2" | tee -a "$LOG_FILE"
}
 
# 1. Check Kernel Release version
KERNEL_MAJOR=$(uname -r | cut -d'.' -f1)
if [ "$KERNEL_MAJOR" -ne 3 ]; then
    log_write "WARNING" "Kernel major is not 3 (CentOS 7 default). Verify packages."
else
    log_write "INFO" "Kernel major version verified: 3.x"
fi
 
# 2. Check for active PAM modules that break upgrades
if rpm -qa | grep -q "pam_pkcs11"; then
    log_write "WARNING" "pam_pkcs11 package found. This must be removed before upgrade."
else
    log_write "INFO" "pam_pkcs11 check passed."
fi
 
# 3. Verify free space on root partition (Requires 10 GB minimum)
FREE_SPACE=$(df -BG / | tail -n 1 | awk '{print $4}' | sed 's/G//')
if [ "$FREE_SPACE" -lt 10 ]; then
    log_write "CRITICAL" "Root has only ${FREE_SPACE}GB free. Upgrade requires at least 10GB."
else
    log_write "INFO" "Root partition free space verified: ${FREE_SPACE}GB."
fi
 
exit 0

#!/bin/bash
# ==============================================================================
# Script: firewalld_monitor.sh
# Description: Tail parses system logs, increments IP counters, alerts on spikes.
# Author: VR-Rathod
# ==============================================================================
 
SYS_LOG="/var/log/messages"
ALERT_LOG="/var/log/firewalld_alerts.log"
SPIKE_THRESHOLD=10
 
if [ ! -f "$SYS_LOG" ]; then
    echo "System log file not found at $SYS_LOG. Ensure logging is enabled."
    exit 1
fi
 
echo "Starting Firewalld intrusion monitoring engine..."
 
# Run log aggregation for past 30 minutes
BLOCKED_IPS=$(grep -i "FINAL_REJECT" "$SYS_LOG" | awk -F'SRC=' '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -nr)
 
echo "$BLOCKED_IPS" | while read -r count ip; do
    if [ -n "$count" ] && [ "$count" -gt "$SPIKE_THRESHOLD" ]; then
        # Resolve source hostname
        HOST_RESOLVE=$(dig +short -x "$ip" | head -n 1)
        [ -z "$HOST_RESOLVE" ] && HOST_RESOLVE="Unknown Hostname"
        
        echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ALERT] IP $ip ($HOST_RESOLVE) triggered $count blocks!" >> "$ALERT_LOG"
        echo "WARNING: Block spike detected for $ip ($count blocks)."
    fi
done
 
exit 0

#!/bin/bash
# ==============================================================================
# Script: httpd_status_daemon.sh
# Description: Queries local Apache server status pages, aggregates requests counts,
#              saves stats to performance database.
# Author: VR-Rathod
# ==============================================================================
 
STATS_FILE="/var/log/httpd_performance.stats"
 
# Ensure Apache status module is active
if ! curl -s http://localhost/server-status?auto > /dev/null; then
    echo "Apache server-status page is unreachable. Enable mod_status."
    exit 1
fi
 
# Query stats
STATUS_DATA=$(curl -s http://localhost/server-status?auto)
REQ_PER_SEC=$(echo "$STATUS_DATA" | grep "ReqPerSec" | awk '{print $2}')
BYTES_PER_SEC=$(echo "$STATUS_DATA" | grep "BytesPerSec" | awk '{print $2}')
BUSY_WORKERS=$(echo "$STATUS_DATA" | grep "BusyWorkers" | awk '{print $2}')
 
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Requests/sec: $REQ_PER_SEC | Bytes/sec: $BYTES_PER_SEC | Active Workers: $BUSY_WORKERS" >> "$STATS_FILE"
exit 0

# Create user 'developer' with home folder, default bash shell, and account details
sudo useradd -m -s /bin/bash -c "Primary Developer Account" developer
 
# Configure user password
sudo passwd developer
 
# Add user to the administration group 'wheel' (grants access to run privileged commands)
sudo usermod -aG wheel developer
 
# Change user shell to zsh
sudo usermod -s /bin/zsh developer
 
# Lock the user account (disables login attempts)
sudo usermod -L developer
 
# Unlock the user account
sudo usermod -U developer
 
# Delete user and wipe their home folder and mailbox files
sudo userdel -r developer

# Create a new group 'secops'
sudo groupadd secops
 
# Add user to the group
sudo gpasswd -a developer secops
 
# Remove user from the group
sudo gpasswd -d developer secops
 
# Delete the group
sudo groupdel secops

# Open the sudoers configuration file safely for syntax verification
sudo visudo
 
# Allow members of group 'wheel' to execute any command
# %wheel ALL=(ALL:ALL) ALL
 
# Allow user 'developer' to reload Firewalld rules without password prompts
# developer ALL=(ALL) NOPASSWD: /usr/bin/firewall-cmd --reload
 
# Configure custom sudoers timeout (duration before password prompt is required again)
# Defaults timestamp_timeout=15
 
# Restrict path executions for safety
# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# View password expiration parameters for user 'developer'
sudo chage -l developer
 
# Force user to change password on their next login session
sudo chage -d 0 developer
 
# Set maximum password validity period to 90 days, warning 7 days prior
sudo chage -M 90 -W 7 developer

# File: /etc/security/limits.conf
# Limit maximum user process forks
*               hard    nproc           2048
*               soft    nproc           1024
 
# Limit open file descriptors per session
*               hard    nofile          65536
*               soft    nofile          32768

# 1. List available modules for Node.js
dnf module list nodejs
# Output:
# nodejs  [18]  common [d]  Node.js Software Platform
# nodejs  [20]  common      Node.js Software Platform
 
# 2. Enable specific module version stream
sudo dnf module enable nodejs:20 -y
 
# 3. Install nodejs package from enabled stream
sudo dnf install nodejs -y

# Update package repository index databases
dnf check-update
 
# Upgrade all installed packages to their latest versions
sudo dnf upgrade -y
 
# Install a package
sudo dnf install httpd -y
 
# Remove a package but preserve configuration files
sudo dnf remove httpd -y
 
# Search for a package matching a query
dnf search postgresql
 
# Show detailed information about a package
dnf info postgresql
 
# Clean local package cache files
sudo dnf clean all

# Install EPEL repository packages
sudo dnf install -y epel-release
 
# Force cache updates
sudo dnf makecache

# 1. Create a repository directory
mkdir -p /srv/local_repo/x86_64
 
# 2. Copy downloaded RPM files into the folder
cp /var/cache/dnf/*.rpm /srv/local_repo/x86_64/
 
# 3. Create repository metadata using createrepo (requires createrepo_c package)
sudo dnf install -y createrepo_c
createrepo /srv/local_repo/x86_64/
 
# 4. Reference the local path in a custom repository configuration file
# File: /etc/yum.repos.d/local_repo.repo
# [local_repo]
# name=Local Enterprise Offline Repository
# baseurl=file:///srv/local_repo/x86_64/
# enabled=1
# gpgcheck=0

# Verify local packages parsing
sudo dnf clean all && dnf makecache

# 1. Install development tools and rpm packaging tools
sudo dnf groupinstall -y "Development Tools"
sudo dnf install -y rpm-build rpmdevtools
 
# 2. Create the standard rpmbuild workspace directory structure
rpmdev-setuptree
# This generates folder maps under ~/rpmbuild:
# ~/rpmbuild/SOURCES/   - Compressed source code (.tar.gz) and patch files
# ~/rpmbuild/SPECS/     - Package specification files (.spec)
# ~/rpmbuild/BUILD/     - Raw files compiled during build processes
# ~/rpmbuild/RPMS/      - Resulting compiled binary packages (.rpm)
# ~/rpmbuild/SRPMS/     - Resulting source RPM packages (.src.rpm)
 
# 3. Generate a template specification file inside SPECS folder
cd ~/rpmbuild/SPECS/
rpmdev-newspec enterprise-monitor

Name:           enterprise-monitor
Version:        1.0.0
Release:        1%{?dist}
Summary:        Custom enterprise security auditor script package for AlmaLinux.
 
License:        GPLv3+
URL:            https://github.com/VR-Rathod/enterprise-monitor
Source0:        %{name}-%{version}.tar.gz
 
BuildArch:      noarch
Requires:       bash, systemd
 
%description
This package distributes system security auditing shell daemons to monitor configuration states.
 
%prep
%setup -q
 
%install
rm -rf %{buildroot}
mkdir -p %{buildroot}/usr/local/bin
mkdir -p %{buildroot}/lib/systemd/system
 
# Copy file binaries to buildroot locations
install -m 0755 monitor.sh %{buildroot}/usr/local/bin/enterprise-monitor.sh
 
%files
/usr/local/bin/enterprise-monitor.sh
 
%changelog
* Sat May 30 2026 Vaibhav Rathod <vr@code-note.com> - 1.0.0-1
- Initial distribution package creation.

# Build binary and source RPM files
rpmbuild -bb ~/rpmbuild/SPECS/enterprise-monitor.spec
 
# Install local custom RPM package
sudo dnf localinstall ~/rpmbuild/RPMS/noarch/enterprise-monitor-1.0.0-1.el9.noarch.rpm -y

# List network connections
nmcli connection show
 
# Scan for available Wi-Fi access points
nmcli device wifi list
 
# Connect to a Wi-Fi network
nmcli device wifi connect "SSID_NAME" password "WIFI_PASSWORD"
 
# Configure a static IP on eth0 interface
nmcli connection modify eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.method manual
 
# Apply static IP modifications
nmcli connection up eth0

# Edit configuration
sudo vim /etc/ssh/sshd_config
 
# Key parameters:
# Port 2200                  # Change default port to prevent automated scanners
# PermitRootLogin no         # Block root login; enforce privilege escalation via sudo
# PasswordAuthentication no   # Disable password logins; enforce SSH key authentication
# AllowUsers developer       # Restrict login access to specific accounts
# MaxAuthTries 3             # Terminate connection after 3 failed login attempts
 
# Restart the SSH service
sudo systemctl restart sshd

# Add parameters inside /etc/ssh/sshd_config:
 
# Enforce modern Key Exchange algorithms
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
 
# Enforce secure symmetric ciphers
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
 
# Enforce secure MAC authentication hash protocols
MACs hmac-sha2-512-etm@openssh.com
 
# Restrict SSH tunneling interfaces
AllowTcpForwarding no
X11Forwarding no
 
# Enforce Client Alive heartbeat checks to auto-disconnect inactive sessions
ClientAliveInterval 300
ClientAliveCountMax 2

# Show active listening sockets with PIDs and associated executable names
sudo ss -ldtupN

# Enable firewalld
sudo systemctl enable --now firewalld
 
# Open HTTP port 80 permanently
sudo firewall-cmd --permanent --add-service=http
 
# Open port 9000 TCP permanently
sudo firewall-cmd --permanent --add-port=9000/tcp
 
# Reload firewall state
sudo firewall-cmd --reload
 
# Add rich rule to restrict access to port 22 to specific IP
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.10" port port="22" protocol="tcp" accept'

# 1. Install Apache and PHP-FPM
sudo dnf install -y httpd php php-fpm php-mysqlnd
 
# 2. Configure PHP-FPM to listen on a Unix socket
# File: /etc/php-fpm.d/www.conf
# listen = /run/php-fpm/www.sock
# listen.owner = apache
# listen.group = apache
# listen.mode = 0660
 
# 3. Configure Apache Virtual Host block
# File: /etc/httpd/conf.d/site.conf
# <VirtualHost *:80>
#     ServerName site.almalinux.local
#     DocumentRoot /var/www/html
#     <Directory /var/www/html>
#         AllowOverride All
#         Require all granted
#     </Directory>
# </VirtualHost>
 
# 4. Enable and start services
sudo systemctl enable --now httpd php-fpm

# File: /etc/nginx/conf.d/enterprise_app.conf
upstream php_sockets {
    server unix:/run/php-fpm/www.sock;
    keepalive 16;
}
 
server {
    listen 80;
    server_name app.almalinux.local;
    return 301 https://$host$request_uri; # Redirect HTTP requests to secure layer
}
 
server {
    listen 443 ssl http2;
    server_name app.almalinux.local;
    root /var/www/enterprise_app;
    index index.php index.html;
    
    # SSL Certificate configurations
    ssl_certificate /etc/pki/tls/certs/app_prod.crt;
    ssl_certificate_key /etc/pki/tls/private/app_prod.key;
    
    # Harden TLS variables
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    
    # Security headers
    add_header X-Frame-Options "DENY";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    
    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass php_sockets;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }
}

# File: /etc/systemd/system/node-app.service
[Unit]
Description=NodeJS Application Daemon
After=network.target
 
[Service]
Type=simple
User=apache
Group=apache
WorkingDirectory=/var/www/node-app/
ExecStart=/usr/bin/node /var/www/node-app/server.js
Restart=on-failure
 
# Sandboxing Hardening parameters
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
 
[Install]
WantedBy=multi-user.target

# Reload systemd configuration
sudo systemctl daemon-reload
 
# Start service
sudo systemctl enable --now node-app.service

# File: /etc/logrotate.d/node-app
/var/log/node-app/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0660 apache apache
}

# 1. Install NFS server packages
sudo dnf install -y nfs-utils
 
# 2. Add exports to /etc/exports
# /srv/nfs-share 192.168.1.0/24(rw,sync,no_subtree_check)
 
# 3. Start service
sudo systemctl enable --now nfs-server

# 1. Install Samba packages
sudo dnf install -y samba samba-common
 
# 2. Edit configurations in /etc/samba/smb.conf
# [shares]
# path = /srv/samba-share
# writable = yes
# guest ok = no
 
# 3. Configure credentials
sudo smbpasswd -a developer

# Check SELinux status
sestatus
 
# Set SELinux to permissive mode temporarily
sudo setenforce 0
 
# Set SELinux to enforcing mode temporarily
sudo setenforce 1

# 1. Set the default policy context for custom web directory
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"
 
# 2. Apply the default policy context recursively
sudo restorecon -Rv /srv/www/

# 1. Parse audit logs for denials and generate policy source
sudo grep "denied" /var/log/audit/audit.log | audit2allow -m custom_agent > custom_agent.te
 
# 2. Compile policy module into package format
checkmodule -M -m -o custom_agent.mod custom_agent.te
semodule_package -o custom_agent.pp -m custom_agent.mod
 
# 3. Load the custom policy package into the active kernel
sudo semodule -i custom_agent.pp

# First, delete all existing rules
-D
 
# Increase buffer allocation size to prevent data loss under high load
-b 8192
 
# Failure flag: set to 1 (print warning to kernel log)
-f 1
 
# 1. Audit modifications to system identification configurations
-w /etc/group -p wa -k identity_changes
-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/security/opasswd -p wa -k identity_changes
 
# 2. Audit network environment modifications
-w /etc/issue -p wa -k network_configs
-w /etc/issue.net -p wa -k network_configs
-w /etc/hosts -p wa -k network_configs
-w /etc/sysconfig/network -p wa -k network_configs
 
# 3. Audit user logins/logouts events
-w /var/log/lastlog -p wa -k session_events
-w /var/run/utmp -p wa -k session_events
 
# 4. Audit execution of SUID/SGID commands
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/sudo -F key=priv_escalation
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/su -F key=priv_escalation

# Reload the auditd service configuration
sudo service auditd restart

# 1. Search for shadow file access attempts
sudo ausearch -k identity_changes -i
 
# 2. Search for privilege escalation events matching specific key tag
sudo ausearch -k priv_escalation -i
 
# 3. Search for audit logs by time windows (e.g., last 2 hours)
sudo ausearch -ts recent -i
 
# 4. Analyze SELinux AVC denials in details using sealert (requires setroubleshoot-server package)
sudo sealert -a /var/log/audit/audit.log

# Install package
sudo dnf install -y fail2ban
 
# Configure jail defaults
# File: /etc/fail2ban/jail.local
# [sshd]
# enabled = true
# port = ssh
# maxretry = 3
 
# Start service
sudo systemctl enable --now fail2ban

# Run syn scan and service detection
nmap -sS -sV 192.168.1.50
 
# Output results:
# Port 2200/tcp open  ssh     OpenSSH 8.7p1 (AlmaLinux)
# Port 80/tcp   open  http    nginx 1.20.1

# Check permissions on find binary
ls -lh /usr/bin/find
# Output: -rwsr-xr-x 1 root root ... /usr/bin/find
 
# Exploit find to spawn a root shell, bypassing standard authorization
/usr/bin/find . -exec /bin/sh -p \;
# Output: # (Root privilege prompt)

# Capture traffic on eth0 interface, filtering for HTTP port 80
sudo tcpdump -i eth0 port 80 -vv -A

// Kernel-level slab cache declaration:
struct kmem_cache *inode_cachep;
 
// Initialize the inode cache structure
void init_inode_cache(void) {
    inode_cachep = kmem_cache_create(
        "inode_cache",               // Cache name descriptor
        sizeof(struct inode),        // Object size in bytes
        0,                           // Align offset
        SLAB_HWCACHE_ALIGN | SLAB_PANIC, // Hardened CPU cache alignments
        inode_init_once              // Constructor function pointer
    );
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
struct task_node {
    int pid;
    int vruntime; // Target search key
    struct task_node *left;
    struct task_node *right;
};
 
// Create a new task node
struct task_node *new_task(int pid, int vruntime) {
    struct task_node *node = (struct task_node *)malloc(sizeof(struct task_node));
    node->pid = pid;
    node->vruntime = vruntime;
    node->left = NULL;
    node->right = NULL;
    return node;
}
 
// Insert task into time-ordered runqueue
struct task_node *insert_task(struct task_node *root, struct task_node *node) {
    if (root == NULL) return node;
    
    if (node->vruntime < root->vruntime) {
        root->left = insert_task(root->left, node);
    } else {
        root->right = insert_task(root->right, node);
    }
    return root;
}
 
// Find leftmost task in runqueue (smallest vruntime)
struct task_node *find_leftmost_task(struct task_node *root) {
    struct task_node *current = root;
    if (current == NULL) return NULL;
    
    while (current->left != NULL) {
        current = current->left;
    }
    return current;
}
 
// Remove task from runqueue
struct task_node *remove_task(struct task_node *root, int vruntime) {
    if (root == NULL) return root;
    
    if (vruntime < root->vruntime) {
        root->left = remove_task(root->left, vruntime);
    } else if (vruntime > root->vruntime) {
        root->right = remove_task(root->right, vruntime);
    } else {
        // Node with only one child or no child
        if (root->left == NULL) {
            struct task_node *temp = root->right;
            free(root);
            return temp;
        } else if (root->right == NULL) {
            struct task_node *temp = root->left;
            free(root);
            return temp;
        }
        
        // Node with two children: Get inorder successor
        struct task_node *temp = find_leftmost_task(root->right);
        root->vruntime = temp->vruntime;
        root->pid = temp->pid;
        root->right = remove_task(root->right, temp->vruntime);
    }
    return root;
}
 
// Print runqueue in execution order
void print_runqueue(struct task_node *root) {
    if (root != NULL) {
 print_runqueue(root->left);
 printf("Task PID: %d (vruntime: %d ms)\n", root->pid, root->vruntime);
 print_runqueue(root->right);
    }
}
 
int main() {
    printf("=== CFS RUNQUEUE TREE SIMULATION ===\n");
    struct task_node *runqueue = NULL;
    
    // Insert tasks into execution runqueue tree
    runqueue = insert_task(runqueue, new_task(101, 45));
    runqueue = insert_task(runqueue, new_task(102, 15));
    runqueue = insert_task(runqueue, new_task(103, 30));
    runqueue = insert_task(runqueue, new_task(104, 60));
    
    printf("\nTime-Ordered Tasks in Runqueue:\n");
    print_runqueue(runqueue);
    
    // Select leftmost task for execution
    struct task_node *next_task = find_leftmost_task(runqueue);
    if (next_task != NULL) {
 printf("\n[SCHEDULE] Dispatching leftmost task PID %d (vruntime: %d ms) to CPU\n", next_task->pid, next_task->vruntime);
 
 // Simulate execution: increment vruntime and reinsert
 int old_vruntime = next_task->vruntime;
 int pid = next_task->pid;
 
 runqueue = remove_task(runqueue, old_vruntime);
 runqueue = insert_task(runqueue, new_task(pid, old_vruntime + 25)); // Run task for 25ms
    }
    
    printf("\nUpdated Runqueue after scheduling execution cycle:\n");
    print_runqueue(runqueue);
    
    // Clean memory
    while (runqueue != NULL) {
 struct task_node *leftmost = find_leftmost_task(runqueue);
 runqueue = remove_task(runqueue, leftmost->vruntime);
    }
    
    return 0;
}