67 hands-on labs to practise for the Red Hat Certified System Administrator (EX200), roughly 30 hours of work, each one graded on the state of your machine rather than on the commands you typed. They run on your own hardware with the `dsoxlab` command line, and cost nothing.
A fully hands-on exam: you are given Red Hat Enterprise Linux machines and tasks to complete, and the state of the system at the end is what gets graded.
- 67labs
- 30hours of practice
- 50on real VMs
Levels 19 beginner 38 intermediate 10 advanced
Official exam objectives published by Red Hat
These are not exam questions. They are hands-on exercises on the skills the exam measures, graded on the state of your machine.
Linux, RHCSA and LFCS
Add this catalogue dsoxlab catalog add https://github.com/stephrobert/linux-dsoxlab-training
Fundamentals
-
First steps in the terminal
Run basic commands (whoami, pwd, hostname, date) and capture the output in a file.
dsoxlab start l1-first-terminal -
Map Linux: kernel, distribution and key directories
Explore what Linux is made of: run real commands on your own system to discover the kernel, your distribution and the role of /etc, /var/log and /proc. Fill in a knowledge map.
dsoxlab start l1-discover-linux-map -
Choose your reference Linux distribution
Compare Debian/Ubuntu and RHEL-based distributions, understand the criteria for choosing between them, and document your choice for three practical scenarios.
dsoxlab start l1-choose-distro -
Identify your Linux machine
Run commands to collect your system's hostname, distribution, kernel version and IP address. Produce a machine identity card stored in vm-info.txt.
dsoxlab start l1-prepare-vm -
Read and decode a command
Decompose 5 Linux commands into their command/options/arguments parts and fix 3 broken commands.
dsoxlab start l1-read-a-command -
Get help from the command line
Use man, --help, and apropos to find the right command options without searching the web.
dsoxlab start l1-get-help -
Linux filesystem hierarchy (FHS)
Match the standard Linux directories to their roles and classify files by location.
dsoxlab start l1-linux-filesystem -
Navigate the filesystem
Use cd, ls, mkdir, cp, mv, rm to build a target directory tree from scratch.
dsoxlab start l1-navigate-filesystem -
Absolute and relative paths
Copy a file using an absolute path and a relative path, then solve 5 path navigation puzzles.
dsoxlab start l1-paths-absolute-relative -
Redirect streams and chain commands with pipes
Redirect stdout and stderr, merge them, and chain commands with pipes to produce exact artifacts.
dsoxlab start l1-redirections-pipes -
Filter a log with grep and regular expressions
Use grep with anchors, character classes, invert-match and count to extract exact facts from an access log.
dsoxlab start l1-grep-regex -
Transform and aggregate text with cut, sort, uniq, sed and awk
Slice columns, deduplicate, count occurrences, sum a field and rewrite a delimiter to turn a raw record file into exact facts.
dsoxlab start l1-text-processing -
Locate files with find by name, size and permissions
Extract a project tree and use find to list files by name pattern, by size and by exact permissions , producing the results into files that are checked against the real tree.
dsoxlab start l1-find-files -
Archive, compress and selectively extract with tar, gzip and bzip2
Create gzip and bzip2 tarballs, list their contents, and extract a single member into a target directory.
dsoxlab start l1-tar-archives -
Set exact file permissions with chmod (octal and symbolic)
Give each file the right owner/group/other bits: a private secret, an executable script, a group-readable note and a private directory.
dsoxlab start l1-permissions-ugo -
Create hard and symbolic links and tell them apart
Make a hard link that shares the inode, a symbolic link that points by path, and a symlink to a directory , proven by inode, link count and link target.
dsoxlab start l1-links-hard-sym -
Write a first Bash script: variables, a loop and a condition
Write rapport.sh that reads a status file passed as an argument, counts UP/DOWN with a loop, prints them, and exits non-zero when any host is down.
dsoxlab start l1-bash-script
Operating and maintaining
-
Add and manage swap space
Create a secure swap file, activate it, make it persistent in /etc/fstab and tune vm.swappiness.
dsoxlab start l2-swap-management -
Mount a filesystem persistently by UUID in /etc/fstab
Mount a pre-formatted extra disk at /srv/data through /etc/fstab, referenced by UUID (not device name) so it survives a reboot, and prove the line with mount -a AND findmnt --verify.
dsoxlab start l2-fstab-persist-uuid -
Create GPT partitions on a disk with parted
Put a GPT label on the spare disk and carve two partitions (512 MiB and 1 GiB), then make the kernel re-read the table.
dsoxlab start l2-partition-gpt -
Create and label an XFS filesystem, then mount it
Format a prepared partition as XFS with a label, create a mount point and mount it , proven by the filesystem type, its label and the active mount.
dsoxlab start l2-filesystem-create-xfs -
Diagnose a full filesystem and reclaim space
A filesystem is full. Find the culprit with df/du, remove the junk without deleting the legitimate data, and bring usage back down.
dsoxlab start l2-disk-space-troubleshoot -
Extend a logical volume and prove the mount survives a reboot
Extend an LVM logical volume, grow the XFS filesystem, and make the mount persistent via /etc/fstab by UUID.
dsoxlab start l2-lvm-extend-persist -
Encrypt a disk with LUKS
Encrypt a block device with LUKS2, open it, put a filesystem on it, mount it and make it unlock at boot via crypttab.
dsoxlab start l2-luks-encryption -
Create a local account with exact UID, shell and groups
Onboard a user with a specific UID, home, login shell, a primary group and a supplementary group , the RHCSA account-creation drill.
dsoxlab start l2-user-lifecycle -
Enforce password aging and complexity policy
Set per-account password aging with chage, the system default max age in login.defs, and a minimum password length via pwquality.
dsoxlab start l2-password-policy -
Delegate limited sudo rights with a sudoers drop-in
Grant the operators group password-less sudo for systemctl only, via a validated /etc/sudoers.d drop-in , least privilege, not full root.
dsoxlab start l2-sudo-delegation -
Grant fine-grained access with POSIX ACLs
Go beyond ugo: give one user rw on a file and a group rx on a directory, with a default ACL so new files inherit it , using setfacl/getfacl.
dsoxlab start l2-acl-posix -
Set up a collaborative directory with the set-GID bit
Give a shared directory the devteam group and the set-GID bit so files created inside inherit the group , proven by the directory mode and a member's new file.
dsoxlab start l2-collaborative-setgid -
Install, remove and query packages with dnf
Bring the machine to a target software state: install a needed package, remove an unwanted one, and confirm with dnf/rpm queries.
dsoxlab start l2-package-management -
Configure a dnf repository with a .repo file
Add a software repository under /etc/yum.repos.d: an id, a baseurl, enabled and GPG-checked, then confirm dnf sees it.
dsoxlab start l2-repo-configure
Services and troubleshooting
-
Set the default systemd boot target
A server has no business booting into a graphical target. Set the default to multi-user.target and confirm it.
dsoxlab start l3-boot-target -
Add a persistent kernel boot parameter
Add a kernel command-line parameter to the current kernel with grubby and to /etc/default/grub for future kernels, so it survives reboots and updates , proven by grubby and the grub config.
dsoxlab start l3-grub-kernel-args -
Create and enable a systemd service unit
Wrap a program in a systemd .service unit, start it and enable it at boot , proven by the service being active, enabled and doing its job.
dsoxlab start l3-service-create-unit -
Diagnose and fix a systemd service stuck in a crash loop
A systemd service keeps restarting because of a missing config file. Use systemctl + journalctl to find the root cause and fix it permanently.
dsoxlab start l3-service-diagnose -
Make the systemd journal persistent across reboots
By default logs vanish on reboot. Enable persistent journald storage so /var/log/journal keeps history , proven by config, directory and a real journal file.
dsoxlab start l3-journald-persist -
Schedule a recurring job with cron
Run /usr/local/bin/report.sh every day at 02:30 through a cron entry , proven by the actual schedule the cron daemon will honour.
dsoxlab start l3-scheduling-cron -
Schedule a one-shot job with at
Queue a command to run once at a later time with at, and prove it is scheduled , the one-off counterpart to cron.
dsoxlab start l3-scheduling-at -
Schedule a recurring job with a systemd timer
Create a .service and its .timer (OnCalendar), enable it, and prove it is active and persistent , the systemd way to schedule recurring work.
dsoxlab start l3-scheduling-timers -
Harden kernel parameters persistently with sysctl.d
Disable IP forwarding and ICMP redirects via /etc/sysctl.d, applied now and surviving reboot , proven by the live sysctl values.
dsoxlab start l3-sysctl-persist -
Apply a tuned performance profile
Switch the active tuned profile to throughput-performance and make it stick , proven by the active profile the tuned daemon reports.
dsoxlab start l3-tuned-profile -
Recover a read-only mount caused by a broken fstab
A bad /etc/fstab option left /srv/data mounted read-only. Fix the entry, remount read-write, and make mount -a clean again.
dsoxlab start l3-fs-readonly-recover -
Repair a broken sshd config before it locks you out
A drop-in left an invalid directive: sshd -t fails, so the next reload or reboot would kill remote access. Fix the config, keep root login disabled, and reload cleanly.
dsoxlab start l3-ssh-access-recovery
Network, security and containers
-
Synchronize the clock with chrony and set the timezone, persistently
Enable and start chronyd, turn NTP on and set the timezone to Europe/Paris , surviving reboot, proven by the live service state and timedatectl.
dsoxlab start l4-ntp-sync -
Configure a persistent static IPv4 with NetworkManager
Create a NetworkManager connection with a static IPv4 (manual method) that survives reboot , proven by the on-disk profile and the live address.
dsoxlab start l4-network-static-persist -
Diagnose and restore a down network connection
A NetworkManager connection is configured but stays down and won't auto-start. Diagnose it, bring it up, and make it auto-connect , proven by the live state and autoconnect flag.
dsoxlab start l4-network-troubleshoot -
Open a firewalld service permanently
Allow the http service through firewalld so it holds now and after reload/reboot , proven by the runtime and permanent service lists, without ever closing ssh.
dsoxlab start l4-firewall-persist -
Set up hardened key-based SSH access for a service user
Give the deploy user key-based SSH login with correct ownership and permissions (.ssh 700, authorized_keys 600, owned by the user) , the classic trap that silently breaks key auth.
dsoxlab start l4-ssh-key-auth-harden -
Run a detached container with Podman
Pull an image and run a named container detached, and prove it is up , the Podman basics for RHCSA containers.
dsoxlab start l4-podman-basic -
Run a container as a systemd service with Quadlet (boot-persistent)
Define a Quadlet .container unit so a container starts at boot under systemd , proven by the active service, the running container and the on-disk unit.
dsoxlab start l4-podman-systemd-persist -
Manage container images: pull, tag, save and inspect
Pull an image from a registry, tag it, save it to an archive and inspect that archive with skopeo , the image-management skills for RHCSA containers.
dsoxlab start l4-podman-images -
Allow a service with SELinux: persistent boolean and labeled port
Turn on an SELinux boolean persistently and label a non-standard port so a service is allowed under enforcing SELinux , proven by getsebool and semanage port.
dsoxlab start l4-selinux-boolean-port -
Fix a file's SELinux context, persistently
Give a custom web directory the httpd_sys_content_t type with semanage fcontext + restorecon so it survives a relabel/reboot , proven by ls -Z and the fcontext rule.
dsoxlab start l4-selinux-context-fix -
Diagnose an SELinux denial (AVC) and fix it the right way
A web file has the wrong SELinux label so httpd is denied (403). Read the AVC in the audit log and restore the context , without disabling SELinux. Proven by the live context and a 200 response.
dsoxlab start l4-selinux-diagnose-avc -
Set up persistent NAT port forwarding with nftables
Enable IP forwarding and add an nftables nat table (DNAT port forward + masquerade) that survives reboot , proven by the live ruleset, sysctl and persistence files.
dsoxlab start l4-nat-portforward -
Authenticate Linux against an LDAP directory with SSSD
Configure SSSD on the client so a directory user (alice) resolves and can log in, against a 389 Directory Server , proven by getent, id and the active authselect profile.
dsoxlab start l4-ldap-integration
Exam-condition drills
-
Drill , essential commands under exam conditions
5 tasks, 100 points, 20 minutes, no hints: find by size, build a frequency report, links, ownership and permissions, and split stdout from stderr. Playable on RHEL or Debian , the skills are identical.
dsoxlab start drill-essential-commands -
Drill , users, groups and delegation under exam conditions
5 tasks, 100 points, 20 minutes, no hints: create an account to exact specs, enforce password aging, build a collaborative directory, delegate sudo narrowly, and lock a departing account. Playable on RHEL or Debian , user management is identical.
dsoxlab start drill-users-groups -
Drill , systemd units, timers and scheduling under exam conditions
5 tasks, 100 points, 25 minutes, no hints: write a service unit with a restart policy, schedule a weekly timer, add a cron job, fix the default boot target, and mask a service for good. Playable on RHEL or Debian , systemd is systemd.
dsoxlab start drill-systemd -
Drill , partitions, LVM and swap under exam conditions
5 tasks, 100 points, 25 minutes, no hints: partition a disk in GPT, build an LVM stack, mount by UUID persistently, add swap, and extend a logical volume online. Playable on RHEL or Debian , parted, LVM and XFS are identical.
dsoxlab start drill-storage -
Drill , package management under exam conditions
5 tasks, 100 points, 20 minutes, no hints: install a package, freeze it against upgrades, find which package owns a file, list what a package installed, and remove one. The objective is shared by RHCSA and LFCS , only the tool changes (dnf or apt), and you use your distribution's.
dsoxlab start drill-packages -
Drill , firewall under exam conditions
5 tasks, 100 points, 20 minutes, no hints: bring the firewall up, open two ports so they survive a reload, keep SSH alive, and explicitly reject a port. The objective is shared by RHCSA and LFCS , only the tool changes (firewalld or ufw).
dsoxlab start drill-firewall -
Drill , SELinux under exam conditions
4 tasks, 100 points, 20 minutes, no hints: put SELinux back in enforcing for good, fix a file context so it survives a relabel, flip a boolean persistently, and label a non-standard port. RHCSA only , Debian uses AppArmor, see drill-apparmor.
dsoxlab start drill-selinux -
Drill , static networking under exam conditions
4 tasks, 100 points, 20 minutes, no hints: a static address, a static route and an MTU on a dedicated interface, plus local name resolution. The objective is shared by RHCSA and LFCS , only the tool changes (nmcli or netplan).
dsoxlab start drill-network
Capstones
-
Put a server into production: one mission, nine deliverables, one reboot
A fresh VM, a delivered application, and one mission: put it into service. Storage on LVM, service account, application on port 8080, SELinux port label and context, permanent firewall rule, persistent journal, hardened SSH, scheduled backup. Nothing is scored on the commands typed: every test reads observable state, and the last one reboots the machine and checks again. What does not survive the reboot scores zero.
dsoxlab start capstone-mise-en-production -
Broken server: the site is down, the symptom tells you nothing
A working internal site stops answering. The setup injects ONE fault among six, drawn at random, and never says which: stopped service, wrong port, closed firewall, SELinux context, docroot permissions, full filesystem. You diagnose, you repair, and the repair must survive a reboot. Scored purely on observable state, with three checks that reject the sledgehammer fixes: SELinux must stay enforcing, firewalld must stay running, and the docroot must not become world-writable.
dsoxlab start capstone-serveur-casse -
RHCSA EX200 mock exam , 20 tasks across 2 VMs
Performance-based RHCSA mock exam covering 10 RHCSA domains: storage (LVM, swap, NFS client), shell scripting, networking (static IP, firewalld), users/groups, ACLs, services (systemd units, timers, time client), SELinux (modes, contexts, booleans, port labels), software (DNF, Flatpak), boot recovery (rd.break root reset). 20 tasks scored on 100 points across 2 VMs (server + client). 70/100 to pass. No hints.
dsoxlab start rhcsa-mock-exam