Bob’s interweb party house

Let’s face it, RHCE is a tough exam. Those who fail it the first time should not feel defeated. Failing the RHCE exam the frist time around is like failing the Cisco CCIE exam the first time around. Lots of fully competent Linux jocks still fail the RHCE exam, and my guess is that it’s mostly from a mixture of arrogance, self-reliance and a lack of preparation.

Most of the RHCE exam guides were written “long ago” in terms of Red Hat releases. A lot of linux jocks learned their chops even longer ago. How many of you date your Linux skills back to Redhat 7, 6 or even 5? How many go farther back than that, to Slackware or even farther? How many of you are still using those chops that you’ve picked up so long ago? And why not? They’ve served you well all these years, and they still get things done. The problem is that Red Hat has changed. They’ve done some things that make it easier for us, and they’ve done some things that will require you to unlearn old habits (I won’t call them bad) to keep up. Remember, they’re not testing you on your ability to keep Red Hat 7 up, running and stable for eight years or more. They’re testing you on your ability to properly administer the current version of Red Hat Enterprise Linux. They’re not testing you on your ability to run a web server. They’re testing you on your ability to manage all aspects of Red Hat Enterprise Linux that could potentially come up in a corporate environment. DHCP. LDAP. Installation and configuration. Samba. Yes, interoperability with Windows. Encryption. You need to know it all. Or, more specifically, you need to know greater than 70% of installation and configuration and greater than 70% of troubleshooting.

Now for the meat.

A certain percentage of RHCE candidates have the budget and learning style to fit the RHCE training classes. I’m willing to bet that a greater percentage has a tendency toward self-learning. If you’re going to go that route, you need to know what’s expected of you. The meat of the RHCE exam can be found in Red Hat’s own documentation. Your greatest resource is going to be the RHEL Deployment Guide, a 904-page all-inclusive reference which could be considered the Red Hat Bible.

Cramming is no substitute for experience, but the RHEL Deployment Guide will take your years of experience, update them to the current version, and give you a definitive idea of where you need to focus your studying prior to taking the $799 exam.

Here are the objectives for RHCT/RHCE candidates. Understand that RHCT is a lesser cert, representing half of the RHCE.

Prerequisite skills for RHCT and RHCE (check out redhat.com for recent updates)

Candidates should possess the following skills, as they may be necessary in order to fulfill requirements of the RHCT and RHCE exams:

use standard command line tools (e.g., ls, cp, mv, rm, tail, cat, etc.) to create, remove, view, and investigate files and directories
use grep, sed, and awk to process text streams and files
use a terminal-based text editor, such as vi/vim, to modify text files
use input/output redirection
understand basic principles of TCP/IP networking, including IP addresses, netmasks, and gateways
use su to switch user accounts
use passwd to set passwords
use tar, gzip, and bzip2v
configure an email client on Red Hat Enterprise Linux
use mozilla and/or links to access HTTP/HTTPS URLs
use lftp to access FTP URLs

RHCT skills
Troubleshooting and System Maintenance

RHCTs should be able to:

boot systems into different run levels for troubleshooting and system maintenance
diagnose and correct misconfigured networking
diagnose and correct hostname resolution problems
configure the X Window System and a desktop environment
add new partitions, filesystems, and swap to existing systems
use standard command-line tools to analyze problems and configure system

Installation and Configuration

RHCTs must be able to:

perform network OS installation
implement a custom partitioning scheme
configure printing
configure the scheduling of tasks using cron and at
attach system to a network directory service, such as NIS or LDAP
configure autofs
add and manage users, groups, and quotas
configure filesystem permissions for collaboration
install and update RPMs
properly update the kernel RPM
modify the system bootloader
implement software RAID at install-time and run-time
use /proc/sys and sysctl to modify and set kernel run-time parameters

Troubleshooting and System Maintenance

RHCEs must demonstrate the RHCT skills listed above, and should be able to:

use the rescue environment provided by first installation CD
diagnose and correct bootloader failures arising from bootloader, module, and filesystem errors
diagnose and correct problems with network services (see Installation and Configuration below for a list of these services)
add, remove, and resize logical volumes

Installation and Configuration

RHCEs must demonstrate the RHCT-level skills listed above, and they must be capable of configuring the following network services:

HTTP/HTTPS
SMB
NFS
FTP
Web proxy
SMTP
IMAP, IMAPS, and POP3
SSH
DNS

For each of these services, RHCEs must be able to:
install the packages needed to provide the service
configure the service to start when the system is booted
configure the service for basic operation
Configure host-based and user-based security for the service

RHCEs must also be able to:
configure hands-free installation using Kickstart
implement logical volumes at install-time
use PAM to implement user-level restrictions

There is a lot of confusion and misinformation out there regarding SPF. Despite the fact that its target implementation date was over three years ago, there are a lot of folks just getting around to implementing it, including ISPs, and there isn’t a lot of guidance, besides the basic configuration document at http://spf.pobox.com.

I thought I would take a moment to clarify some of the more confusing aspects of SPF, especially as it pertains to spam filtering services such as Postini, MXLogic, MessageLabs, etc.

First of all, SPF stands for Sender Policy Framework, and it will help a lot to remember that, because the policy applies only to the SENDER domain.

When a domain publishes an SPF record, that record includes all servers from which hosts should EXPECT to receive email from that domain. Usually, this is only the sender’s mail server or ISP.

When SPF policy rejects an email, look at the bounce message to determine why. There are two general reasons why SPF would be rejected — (a) the SPF record was entered incorrectly, leaving out a correct mail server, or (b) the message was received by an unexpected source, such as pre-filtering anti-spam services (Postini, MessageLabs, MXLogic, etc.).

When SPF is rejected because it comes from a Postini-like source, this is not the SENDER’s problem. This is the RECIPIENT’s problem, because the RECIPIENT, as the subscriber, is responsible for that spam filtering service, and needs to add the spam filtering service’s SPF record to its trusted list. This is NOT accomplished in the SPF record itself, this is accomplished in the SPF policy LOCAL RULES.

To accomplish this, find the configuration file or interface whereby you would inject SPF settings to include in your local rules. Then determine the SPF settings for the spam filtering service you wish to authorize.

Some examples — for Postini, you would include spf.postini.com. If you use DNS tools to do a “dig” for TXT records for spf.postini.com, you will see that an SPF record is published. This is how that inclusion works. For mxlogic, you would include mxlogic.net. For messagelabs, you would include spf.messagelabs.com. Confirm this with your spam filtering provider(s) before using, as everything on the Net is fluid and subject to change.

Don’t let anyone talk you into adding Postini or its equivalent to a domain’s SPF record. While it might solve the immediate issue, it doesn’t fit in the big picture, and is an incorrect application of the policy. Postini does not SEND on behalf of a domain. It RECEIVES. Educate the recipient about local rules. Print this out and put it on your wall until you understand it.