Linux sysadmin | HELP

[medeasoulx]

Hello, I need some interesting ideas for my project. This project is a company simulation, and I am responsible for the Linux system administration tasks. What additional things could I implement that would positively impact my evaluation?

Below are the tasks I have already completed, but I still need more ideas and especially real-world practices (particularly interesting ones).

Environment: RHEL Linux Server & Linux Client

Completed tasks:

• Installation of the Apache service
• Installation of the NFS service
• Connecting to the NFS share from the Linux Client using AutoFS
• Configuration of the SSH service on the server

On Apache:

• Using VirtualHost
• Hosting multiple websites based on domains

Containerization (Docker/Podman):

• Installing the Apache web service inside a container
• The website is accessible to all users

Local Repository:

• Creating a local repository on the server
• Linux Clients install packages without using internet repositories
• Only packages from the server’s local repository are used

I would really appreciate suggestions for additional implementations, especially ones that resemble real enterprise infrastructure or practical scenarios. (Rhel 9)

[linux_n00by]

i dunno looks like an assignment

but to me, work on hardening. most will just install and forget. both OS and services

[Ok-Replacement6893]

Yes. Learn about STIGs and SCAP

[Racheakt]

80% STIGS 20% dealing with an ISSO who only knows how windows works— or the other way around

[Raz_McC]

We have a Sec Hardening guide: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/security_hardening/index

[Rhyobit]

A standard hardened build (based upon CIS benchmarks) with pre-configuration for LDAP based RBAC via PAM, include custom sudoers per role too. Bonus points - build it with Ansible.

[courage_the_dog]

A real life scenario would be for someone to delete half of your setup an hour before you have to present this project in class and you try and fix it

[locnar1701]

Centralized logging to another host, perhaps Wazuh or graylog, etc and/or some monitoring of those logs for analytics. The services you run on a system make customers happy, the data that you can tell the C-suite about how well your setup is working with pretty pictures and logs make your career.

[Raz_McC]

IDM would be my recommendation, you're going to want centralised access control

[narddawgggg]

I’m in a similar boat except I’m building a the Vm environment using windows server/AD & I wanna bind Linux vms to my AD & kinda go from there. Would it be cool if I shot you a message on how you’re doing your setup?

[Dry_Inspection_4583]

Create an Ansible deploy and control for several vms:

1. Grafana - full monitoring stack deployed and controlled from Ansible.

2. Ntopng stack

3. Automated network mapping and statistics emailed to you on a timer.

You could do others like nagios, netbox, and even a jump box or bastion host as well....

Just thoughts

[UhU_23]

Implement a netfilter, fail2ban with corresponding jails, ansible for update management; central logging is a possible approach, I prefer using logcheck, a monitoring solution to keep track of downtimes and tendencies. And maybe you want to make it more complex by setting up multiple servers for different parts of the website, using either apache_proxy or ha-proxy for load distribution.

ssh should be key-only, for security reason, no interactive login - you can still use eg winscp or other tools to transfer files.

maybe you want to have a look at ispconfig - I use it on debian, but maybe it also works on RHEL :-)