Procedure

1. From the Installation Summary window, click Network and Host Name.

2. From the list in the left-hand pane, select an interface. The details are displayed in the right-hand pane.

   Note

   There are several types of network device naming standards used to identify network devices with persistent names, for example, em1 and wl3sp0. For information about these standards, see the Configuring and managing networking document.

3. Toggle the ON/OFF switch to enable or disable the selected interface.

   Note

   The installation program automatically detects locally accessible interfaces, and you cannot add or remove them manually.

4. Click + to add a virtual network interface, which can be either: Team (deprecated), Bond, Bridge, or VLAN.
5. Click - to remove a virtual interface.
6. Click Configure to change settings such as IP addresses, DNS servers, or routing configuration for an existing interface (both virtual and physical).

7. Type a host name for your system in the Host Name field.

   Note

   • The host name can either be a fully qualified domain name (FQDN) in the format hostname.domainname, or a short host name without the domain. Many networks have a Dynamic Host Configuration Protocol (DHCP) service that automatically supplies connected systems with a domain name. To allow the DHCP service to assign the domain name to this system, specify only the short host name.
   • When using static IP and host name configuration, it depends on the planned system use case whether to use a short name or FQDN. Red Hat Identity Management configures FQDN during provisioning but some 3rd party software products may require short name. In either case, to ensure availability of both forms in all situations, add an entry for the host in /etc/hosts in the format IP FQDN short-alias.
   • The value localhost means that no specific static host name for the target system is configured, and the actual host name of the installed system is configured during the processing of the network configuration, for example, by NetworkManager using DHCP or DNS.
   • Host names can only contain alphanumeric characters and - or .. Host name should be equal to or less than 64 characters. Host names cannot start or end with - and .. To be compliant with DNS, each part of a FQDN should be equal to or less than 63 characters and the FQDN total length, including dots, should not exceed 255 characters.
8. Click Apply to apply the host name to the installer environment.
9. Alternatively, in the Network and Hostname window, you can choose the Wireless option. Click Select network in the right-hand pane to select your wifi connection, enter the password if required, and click Done.

Procedure

1. List the NetworkManager connection profiles:

   # nmcli connection show
   NAME                UUID                                  TYPE      DEVICE
   Wired connection 1  a5eb6490-cc20-3668-81f8-0314a27f3f75  ethernet  enp1s0

   By default, NetworkManager creates a profile for each NIC in the host. If you plan to connect this NIC only to a specific network, adapt the automatically-created profile. If you plan to connect this NIC to networks with different settings, create individual profiles for each network.

2. If you want to create an additional connection profile, enter:

   # nmcli connection add con-name <connection-name> ifname <device-name> type ethernet

   Skip this step to modify an existing profile.

3. Optional: Rename the connection profile:

   # nmcli connection modify "Wired connection 1" connection.id "Internal-LAN"

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

4. Display the current settings of the connection profile:

   # nmcli connection show Internal-LAN
   ...
   connection.interface-name:     enp1s0
   connection.autoconnect:        yes
   ipv4.method:                   auto
   ipv6.method:                   auto
   ...

5. Configure the IPv4 settings:

   • To use DHCP, enter:

     # nmcli connection modify Internal-LAN ipv4.method auto

     Skip this step if ipv4.method is already set to auto (default).

   • To set a static IPv4 address, network mask, default gateway, DNS servers, and search domain, enter:

     # nmcli connection modify Internal-LAN ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200 ipv4.dns-search example.com

6. Configure the IPv6 settings:

   • To use stateless address autoconfiguration (SLAAC), enter:

     # nmcli connection modify Internal-LAN ipv6.method auto

     Skip this step if ipv6.method is already set to auto (default).

   • To set a static IPv6 address, network mask, default gateway, DNS servers, and search domain, enter:

     # nmcli connection modify Internal-LAN ipv6.method manual ipv6.addresses 2001:db8:1::fffe/64 ipv6.gateway 2001:db8:1::fffe ipv6.dns 2001:db8:1::ffbb ipv6.dns-search example.com

7. To customize other settings in the profile, use the following command:

   # nmcli connection modify <connection-name> <setting> <value>

   Enclose values with spaces or semicolons in quotes.

8. Activate the profile:

   # nmcli connection up Internal-LAN

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. If you do not know the network device name you want to use in the connection, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp1s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.

4. Choose whether to add a new connection profile or to modify an existing one:

   • To create a new profile:

     1. Press the Add button.
     2. Select Ethernet from the list of network types, and press Enter.
   • To modify an existing profile, select the profile from the list, and press Enter.

5. Optional: Update the name of the connection profile.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

6. If you create a new connection profile, enter the network device name into the Device field.

7. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

   • Disabled, if this connection does not require an IP address.
   • Automatic, if a DHCP server dynamically assigns an IP address to this NIC.

   • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

     1. Press the Show button next to the protocol you want to configure to display additional fields.

     2. Press the Add button next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

        If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

     3. Enter the address of the default gateway.
     4. Press the Add button next to DNS servers, and enter the DNS server address.
     5. Press the Add button next to Search domains, and enter the DNS search domain.

   Figure 1.1. Example of an Ethernet connection with static IP address settings

   
8. Press the OK button to create and automatically activate the new connection.
9. Press the Back button to return to the main menu.
10. Select Quit, and press Enter to close the nmtui application.

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Register and automatically subscribe your system in one step:

   # subscription-manager register --username <username> --password <password> --auto-attach
   Registering to: subscription.rhsm.redhat.com:443/subscription
   The system has been registered with ID: 37to907c-ece6-49ea-9174-20b87ajk9ee7
   The registered system name is: client1.idm.example.com
   Installed Product Current Status:
   Product Name: Red Hat Enterprise Linux for x86_64
   Status:       Subscribed

   The command prompts you to enter your Red Hat Customer Portal user name and password.

   If the registration process fails, you can register your system with a specific pool. For guidance on how to do it, proceed with the following steps:

   1. Determine the pool ID of a subscription that you require:

      # subscription-manager list --available

      This command displays all available subscriptions for your Red Hat account. For every subscription, various characteristics are displayed, including the pool ID.

   2. Attach the appropriate subscription to your system by replacing pool_id with the pool ID determined in the previous step:

      # subscription-manager attach --pool=pool_id

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.

2. In the Health filed in the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.

   .

3. In the Overview filed, click Register.

   

4. In the Register system dialog box, select that you want to register using your account credentials.

   

5. Enter your username.
6. Enter your password.

7. Optionally, enter your organization’s name or ID.

   If your account belongs to more than one organization on the Red Hat Customer Portal, you have to add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Insights, clear the Insights check box.
8. Click the Register button.

Procedure

1. Open the system menu, which is accessible from the upper-right screen corner, and click Settings.

   

2. Go to About → Subscription.

3. If you are not using the Red Hat server:

   1. In the Registration Server section, select Custom Address.
   2. Enter the server address in the URL field.
4. In the Registration Type section, select Red Hat Account.

5. In the Registration Details section:

   • Enter your Red Hat account user name in the Login field.
   • Enter your Red Hat account password in the Password field.
   • Enter the name of your organization in the Organization field.
6. Click Register.

Procedure

1. Open the system menu, which is accessible from the upper-right screen corner, and click Settings.

   

2. Go to About → Subscription.

3. If you are not using the Red Hat server:

   1. In the Registration Server section, select Custom Address.
   2. Enter the server address in the URL field.
4. In the Registration Type section, select Activation Keys.

5. Under Registration Details:

   • Enter your activation keys in the Activation Keys field.

     Separate your keys by a comma (,).

   • Enter the name or ID of your organization in the Organization field.
6. Click Register.

Procedure

1. Access Red Hat support:

   1. Open a new support case.
   2. Initiate a live chat with a Red Hat expert.
   3. Contact a Red Hat expert by making a call or sending an email.

Procedure

1. Install the sos package:

   # dnf install sos

   Note

   The default minimal installation of Red Hat Enterprise Linux does not include the sos package, which provides the sosreport command.

2. Generate a report:

   # sosreport

3. Attach the report to your support case.

   See the How can I attach a file to a Red Hat support case? Red Hat Knowledgebase article for more information.

   Note that when attaching the report, you are prompted to enter the number of the relevant support case.

Procedure

1. Start the sshd daemon in the current session and set it to start automatically at boot time:

   # systemctl start sshd
   # systemctl enable sshd

2. To specify different addresses than the default 0.0.0.0 (IPv4) or :: (IPv6) for the ListenAddress directive in the /etc/ssh/sshd_config configuration file and to use a slower dynamic network configuration, add the dependency on the network-online.target target unit to the sshd.service unit file. To achieve this, create the /etc/systemd/system/sshd.service.d/local.conf file with the following content:

   [Unit]
   Wants=network-online.target
   After=network-online.target

3. Review if OpenSSH server settings in the /etc/ssh/sshd_config configuration file meet the requirements of your scenario.

4. Optionally, change the welcome message that your OpenSSH server displays before a client authenticates by editing the /etc/issue file, for example:

   Welcome to ssh-server.example.com
   Warning: By accessing this server, you agree to the referenced terms and conditions.

   Ensure that the Banner option is not commented out in /etc/ssh/sshd_config and its value contains /etc/issue:

   # less /etc/ssh/sshd_config | grep Banner
   Banner /etc/issue

   Note that to change the message displayed after a successful login you have to edit the /etc/motd file on the server. See the pam_motd man page for more information.

5. Reload the systemd configuration and restart sshd to apply the changes:

   # systemctl daemon-reload
   # systemctl restart sshd

Verification

1. Check that the sshd daemon is running:

   # systemctl status sshd
   ● sshd.service - OpenSSH server daemon
      Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
      Active: active (running) since Mon 2019-11-18 14:59:58 CET; 6min ago
        Docs: man:sshd(8)
              man:sshd_config(5)
    Main PID: 1149 (sshd)
       Tasks: 1 (limit: 11491)
      Memory: 1.9M
      CGroup: /system.slice/sshd.service
              └─1149 /usr/sbin/sshd -D -oCiphers=aes128-ctr,aes256-ctr,aes128-cbc,aes256-cbc -oMACs=hmac-sha2-256,>
   
   Nov 18 14:59:58 ssh-server-example.com systemd[1]: Starting OpenSSH server daemon...
   Nov 18 14:59:58 ssh-server-example.com sshd[1149]: Server listening on 0.0.0.0 port 22.
   Nov 18 14:59:58 ssh-server-example.com sshd[1149]: Server listening on :: port 22.
   Nov 18 14:59:58 ssh-server-example.com systemd[1]: Started OpenSSH server daemon.

2. Connect to the SSH server with an SSH client.

   # ssh user@ssh-server-example.com
   ECDSA key fingerprint is SHA256:dXbaS0RG/UzlTTku8GtXSz0S1++lPegSy31v3L/FAEc.
   Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
   Warning: Permanently added 'ssh-server-example.com' (ECDSA) to the list of known hosts.
   
   user@ssh-server-example.com's password:

Procedure

1. Open the /etc/ssh/sshd_config configuration in a text editor, for example:

   # vi /etc/ssh/sshd_config

2. Change the PasswordAuthentication option to no:

   PasswordAuthentication no

   On a system other than a new default installation, check that PubkeyAuthentication no has not been set and the KbdInteractiveAuthentication directive is set to no. If you are connected remotely, not using console or out-of-band access, test the key-based login process before disabling password authentication.

3. To use key-based authentication with NFS-mounted home directories, enable the use_nfs_home_dirs SELinux boolean:

   # setsebool -P use_nfs_home_dirs 1

4. Reload the sshd daemon to apply the changes:

   # systemctl reload sshd

Procedure

1. To generate an ECDSA key pair for version 2 of the SSH protocol:

   $ ssh-keygen -t ecdsa
   Generating public/private ecdsa key pair.
   Enter file in which to save the key (/home/joesec/.ssh/id_ecdsa):
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /home/joesec/.ssh/id_ecdsa.
   Your public key has been saved in /home/joesec/.ssh/id_ecdsa.pub.
   The key fingerprint is:
   SHA256:Q/x+qms4j7PCQ0qFd09iZEFHA+SqwBKRNaU72oZfaCI joesec@localhost.example.com
   The key's randomart image is:
   +---[ECDSA 256]---+
   |.oo..o=++        |
   |.. o .oo .       |
   |. .. o. o        |
   |....o.+...       |
   |o.oo.o +S .      |
   |.=.+.   .o       |
   |E.*+.  .  . .    |
   |.=..+ +..  o     |
   |  .  oo*+o.      |
   +----[SHA256]-----+

   You can also generate an RSA key pair by using the -t rsa option with the ssh-keygen command or an Ed25519 key pair by entering the ssh-keygen -t ed25519 command.

2. To copy the public key to a remote machine:

   $ ssh-copy-id joesec@ssh-server-example.com
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   joesec@ssh-server-example.com's password:
   ...
   Number of key(s) added: 1
   
   Now try logging into the machine, with: "ssh 'joesec@ssh-server-example.com'" and check to make sure that only the key(s) you wanted were added.

   If you do not use the ssh-agent program in your session, the previous command copies the most recently modified ~/.ssh/id*.pub public key if it is not yet installed. To specify another public-key file or to prioritize keys in files over keys cached in memory by ssh-agent, use the ssh-copy-id command with the -i option.

Verification

1. Log in to the OpenSSH server without providing any password:

   $ ssh joesec@ssh-server-example.com
   Welcome message.
   ...
   Last login: Mon Nov 18 18:28:42 2019 from ::1

Procedure

1. List all keys provided by the OpenSC PKCS #11 module including their PKCS #11 URIs and save the output to the keys.pub file:

   $ ssh-keygen -D pkcs11: > keys.pub
   $ ssh-keygen -D pkcs11:
   ssh-rsa AAAAB3NzaC1yc2E...KKZMzcQZzx pkcs11:id=%02;object=SIGN%20pubkey;token=SSH%20key;manufacturer=piv_II?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so
   ecdsa-sha2-nistp256 AAA...J0hkYnnsM= pkcs11:id=%01;object=PIV%20AUTH%20pubkey;token=SSH%20key;manufacturer=piv_II?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so

2. To enable authentication using a smart card on a remote server (example.com), transfer the public key to the remote server. Use the ssh-copy-id command with keys.pub created in the previous step:

   $ ssh-copy-id -f -i keys.pub username@example.com

3. To connect to example.com using the ECDSA key from the output of the ssh-keygen -D command in step 1, you can use just a subset of the URI, which uniquely references your key, for example:

   $ ssh -i "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" example.com
   Enter PIN for 'SSH key':
   [example.com] $

4. You can use the same URI string in the ~/.ssh/config file to make the configuration permanent:

   $ cat ~/.ssh/config
   IdentityFile "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so"
   $ ssh example.com
   Enter PIN for 'SSH key':
   [example.com] $

   Because OpenSSH uses the p11-kit-proxy wrapper and the OpenSC PKCS #11 module is registered to PKCS#11 Kit, you can simplify the previous commands:

   $ ssh -i "pkcs11:id=%01" example.com
   Enter PIN for 'SSH key':
   [example.com] $

Procedure

1. Define the jump host by editing the ~/.ssh/config file on your local system, for example:

   Host jump-server1
     HostName jump1.example.com

   • The Host parameter defines a name or alias for the host you can use in ssh commands. The value can match the real host name, but can also be any string.
   • The HostName parameter sets the actual host name or IP address of the jump host.

2. Add the remote server jump configuration with the ProxyJump directive to ~/.ssh/config file on your local system, for example:

   Host remote-server
     HostName remote1.example.com
     ProxyJump jump-server1

3. Use your local system to connect to the remote server through the jump server:

   $ ssh remote-server

   The previous command is equivalent to the ssh -J jump-server1 remote-server command if you omit the configuration steps 1 and 2.

Procedure

1. Optional: Verify you can use the key to authenticate to the remote host:

   1. Connect to the remote host using SSH:

      $ ssh example.user1@198.51.100.1 hostname

   2. Enter the passphrase you set while creating the key to grant access to the private key.

      $ ssh example.user1@198.51.100.1 hostname
       host.example.com

2. Start the ssh-agent.

   $ eval $(ssh-agent)
   Agent pid 20062

3. Add the key to ssh-agent.

   $ ssh-add ~/.ssh/id_rsa
   Enter passphrase for ~/.ssh/id_rsa:
   Identity added: ~/.ssh/id_rsa (example.user0@198.51.100.12)

Procedure

1. Display the current SELinux mode:

   $ getenforce

2. To temporarily set SELinux:

   1. To Enforcing mode:

      # setenforce Enforcing

   2. To Permissive mode:

      # setenforce Permissive

      Note

      After reboot, SELinux mode is set to the value specified in the /etc/selinux/config configuration file.

3. To set SELinux mode to persist across reboots, modify the SELINUX variable in the /etc/selinux/config configuration file.

   For example, to switch SELinux to enforcing mode:

   # This file controls the state of SELinux on the system.
   # SELINUX= can take one of these three values:
   #     enforcing - SELinux security policy is enforced.
   #     permissive - SELinux prints warnings instead of enforcing.
   #     disabled - No SELinux policy is loaded.
   SELINUX=enforcing
   ...

   Warning

   Disabling SELinux reduces your system security. Avoid disabling SELinux using the SELINUX=disabled option in the /etc/selinux/config file because this can result in memory leaks and race conditions causing kernel panics. Instead, disable SELinux by adding the selinux=0 parameter to the kernel command line. For more information, see Changing SELinux modes at boot time.

Procedure

1. Log into the RHEL web console. For details see Logging in to the web console.
2. Click Logs.

Procedure

1. As root, open the /etc/sudoers file.

   # visudo

   The /etc/sudoers file defines the policies applied by the sudo command.

2. In the /etc/sudoers file, find the lines that grant sudo access to users in the administrative wheel group.

   ## Allows people in group wheel to run all commands
   %wheel        ALL=(ALL)       ALL

3. Make sure the line that starts with %wheel is not commented out with the number sign (#).
4. Save any changes, and exit the editor.

5. Add users you want to grant sudo access to into the administrative wheel group.

    # usermod --append -G wheel <username>

   Replace <username> with the name of the user.

Procedure

1. As root, create a new sudoers.d directory under /etc/:

   # mkdir -p /etc/sudoers.d/

2. Create a new file in the /etc/sudoers.d directory:

   # visudo -f /etc/sudoers.d/<filename>

   The file opens automatically.

3. Add the following line to the /etc/sudoers.d/<filename> file:

   <username> <hostname.example.com> = (<run_as_user>:<run_as_group>) <path/to/command>

   • Replace <username> with the name of the user.
   • Replace <hostname.example.com> with the URL of the host.
   • Replace (<run_as_user>:<run_as_group>) with the user or group as which the command can be executed. If you omit this section, <username> can execute the command as root.
   • Replace <path/to/command> with the complete absolute path to the command. You can also limit the user to only performing a command with specific options and arguments by adding those options after the command path. If you do not specify any options, the user can use the command with all options.

   • To allow two and more commands on the same host on one line, you can list them separated by a comma followed by a space.

     For example, to allow user1 to execute the dnf and reboot commands on host1.example.com, enter user1 host1.example.com = /bin/dnf, /sbin/reboot.

4. Optional: To receive email notifications every time the user attempts to use sudo privileges, add the following lines to the file:

   Defaults    mail_always
   Defaults    mailto="<email@example.com>"

5. Save the changes, and exit the editor.

Verification

1. To verify if a user can run a command with sudo privileges, switch the account:

   # su <username> -

2. As the user, enter the command with the sudo command:

   $ sudo <command>
   [sudo] password for <username>:

   Enter the user’s sudo password.

3. If the privileges are configured correctly, the system displays the list of commands and options. For example, with the dnf command, it shows the following output:

   ...
   usage: dnf [options] COMMAND
   ...

   If the system returns the error message <username> is not in the sudoers file. This incident will be reported, the file for <username> in /etc/sudoers.d/ does not exist.

   If the system returns the error message <username> is not allowed to run sudo on <host.example.com>, the configuration was not completed correctly. Ensure that you are logged in as root and that the configuration was performed correctly.

   If the system returns the error message Sorry, user <username> is not allowed to execute '<path/to/command>' as root on <host.example.com>., the command is not correctly defined in the rule for the user.

Procedure

1. Install the ReaR utility by running the following command:

   # dnf install rear

2. Modify the ReaR configuration file in an editor of your choice, for example:

   # vi /etc/rear/local.conf

3. Add the backup setting details to /etc/rear/local.conf. For example, in the case of the NETFS backup method, add the following lines:

   BACKUP=NETFS
   BACKUP_URL=backup.location

   Replace backup.location by the URL of your backup location.

4. To configure ReaR to keep the previous backup archive when the new one is created, also add the following line to the configuration file:

   NETFS_KEEP_OLD_BACKUP_COPY=y

5. To make the backups incremental, meaning that only the changed files are backed up on each run, add the following line:

   BACKUP_TYPE=incremental

6. Create a rescue system:

   # rear mkrescue

7. Take a backup as per the restore plan. For example, in the case of the NETFS backup method, run the following command:

   # rear mkbackuponly

   Alternatively, you can create the rescue system and the backup in a single step by running the following command:

   # rear mkbackup

   This command combines the functionality of the rear mkrescue and rear mkbackuponly commands.

1. To configure the IPL output method, add OUTPUT=IPL.

2. To configure the backup method and destination, add BACKUP and BACKUP_URL variables. For example:

   BACKUP=NETFS
   
   BACKUP_URL=nfs://<nfsserver name>/<share path>

   Important

   The local backup storage is currently not supported on the 64-bit IBM Z architecture.

3. Optionally, you can also configure the OUTPUT_URL variable to save the kernel and initrd files. By default, the OUTPUT_URL is aligned with BACKUP_URL.

4. To perform backup and rescue image creation:

   # rear mkbackup

5. This creates the kernel and initrd files at the location specified by the BACKUP_URL or OUTPUT_URL (if set) variable, and a backup using the specified backup method.
6. To recover the system, use the ReaR kernel and initrd files created in step 3, and boot from a Direct Attached Storage Device (DASD) or a Fibre Channel Protocol (FCP)-attached SCSI device prepared with the zipl boot loader, kernel, and initrd. For more information, see Using a Prepared DASD.
7. When the rescue kernel and initrd get booted, it starts the ReaR rescue environment. Proceed with system recovery.