Skip to content

Capstone · Linux and Red Hat (RHCSA to RHCE)

Capstone: build a small company's server end to end

Capstoneexpert· about 12 hours· 12 steps

The brief

Konkan Exports, a 15-person cashew and spice exporter in Mumbai, needs one RHEL server for its office. You build it from a fresh install: name and time, staff accounts, LVM storage for shared files and backups, team folders, key-based SSH, an intranet web page with SELinux enforcing, the firewall, a nightly tar backup on a schedule, and an Ansible playbook that can check and rebuild the setup.

Why it matters

This is the whole job of a Linux administrator at a small company or a managed-service provider, in the order you would really do it. Finished, it is a project you can describe line by line in an interview, and it covers most of the RHCSA objectives plus a first taste of RHCE automation.

Skills you practise

  • hostnamectl and timedatectl
  • users, groups and sudo
  • LVM and XFS with fstab
  • SGID team folders
  • SSH keys and sshd hardening
  • httpd with a custom DocumentRoot
  • semanage fcontext and restorecon
  • firewalld
  • tar backups and cron
  • Ansible playbooks

You need

  • A RHEL 9 virtual machine (free Red Hat Developer subscription) or Rocky Linux 9 / AlmaLinux 9
  • A second empty virtual disk of at least 6 GB attached to the server VM
  • A second machine or VM on the same network as the "workstation" (for SSH, the browser test and Ansible)
  • Working package repositories on both machines

What you will have at the end

A working company server (accounts, LVM storage in fstab, team folders, key-only admin SSH with no root login, an intranet page with SELinux enforcing, firewall, nightly tar backups) plus a build log (commands.sh), backup-share.sh and an idempotent site.yml you can show an employer.

How it is marked (rubric, 100 points)
Everything works after a rebootEvery check passes after one final reboot: mounts, httpd, firewall, the intranet page from the workstation and the cron job.35
SecureSELinux enforcing with a semanage rule (no chcon, no setenforce 0), no root SSH login, key login for kiran, only http and ssh open, teams cannot read each other's folders.25
Backups you can trustThe script runs by hand and from cron, keeps two weeks, and you restored a file from it.15
Automationsite.yml runs twice with changed=0 on the second run.10
Build logcommands.sh records every command by step with why, so another admin could rebuild the server from it.15

0/12 steps done

Step 1 of 12

Name the server and set Indian time

The hostname is srv1.konkan.lan and the time zone is Asia/Kolkata.

A clear hostname shows in every prompt, log line and alert, so nobody runs a command on the wrong machine. Use a fully qualified name. The time zone matters for logs, cron jobs and backup file names: a 22:30 backup should run at 22:30 in Mumbai. hostnamectl sets the name permanently; timedatectl sets the zone.

Run this on your machine, then paste the output below
$ hostname; timedatectl show -p Timezone --value

Also check yourself

Your notes: commands.sh, backup-share.sh, site.yml

Write down each command you ran. It goes into your project summary.