01 - System Configuration, Boot, and Targets¶

Boot process (RHEL 9)¶

1. UEFI / BIOS firmware loads the bootloader.
2. GRUB2 presents the boot menu and loads the kernel and initramfs.
3. Kernel initializes hardware, mounts initramfs, then pivots to the real root filesystem.
4. systemd (PID 1) takes over and brings up the system to its default target.

The default target on a server is usually multi-user.target (no GUI) or graphical.target (with GUI).

Important boot files¶

After editing /etc/default/grub, regenerate config:

grub2-mkconfig -o /boot/grub2/grub.cfg                       # BIOS
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg              # UEFI

systemd targets¶

Targets replace older System V "runlevels."

Manage targets¶

systemctl get-default                 # show current default
systemctl set-default multi-user.target
systemctl isolate rescue.target       # switch now to rescue

Boot to a different target (one-time)¶

At the GRUB menu, press e, find the linux line, append systemd.unit=rescue.target, then Ctrl-X to boot.

Recovery patterns¶

Boot to emergency mode (root filesystem read-only)¶

Use when even rescue mode fails. Append emergency (or systemd.unit=emergency.target) to the kernel line at GRUB.

You'll need to remount root read-write:

mount -o remount,rw /

Reset root password¶

The canonical RHEL 9 procedure is in fact-sheet.md. Key steps:

1. At GRUB, append rd.break enforcing=0 to the kernel line.
2. Ctrl-X to boot.
3. mount -o remount,rw /sysroot
4. chroot /sysroot
5. passwd root
6. touch /.autorelabel (forces SELinux relabel)
7. Exit twice and reboot.

enforcing=0 is critical - without it, SELinux blocks passwd and you'll think you succeeded but reboot fails to log in.

Default targets and graphical vs server¶

# Production server, no GUI
systemctl set-default multi-user.target

# Workstation
systemctl set-default graphical.target

If graphical.target is set but no GUI packages installed, the system stops at the multi-user level - this is fine.

Kernel command-line parameters¶

View current:

cat /proc/cmdline

Common parameters you might see or use:

• quiet - hide most boot output
• rhgb - graphical boot
• selinux=0 - disable SELinux at boot (don't, except for diagnosis)
• enforcing=0 - boot in permissive SELinux
• single or 1 - single-user mode (older syntax; use systemd.unit=rescue.target)

To make a parameter persistent, edit GRUB_CMDLINE_LINUX in /etc/default/grub and regenerate config.

Tuned (performance profiles)¶

tuned is a daemon that applies kernel and system tuning profiles.

systemctl enable --now tuned
tuned-adm list                        # list profiles
tuned-adm active                      # current profile
tuned-adm profile throughput-performance
tuned-adm recommend                   # suggest profile based on workload

Profiles to know:

• balanced - default, general-purpose
• throughput-performance - high throughput servers
• latency-performance - low-latency apps
• virtual-guest - VMs
• virtual-host - hypervisor hosts

Time and date¶

timedatectl                              # current state
timedatectl set-timezone America/New_York
timedatectl set-time '2026-04-26 10:30:00'    # only if NTP off
timedatectl set-ntp true                 # enable NTP sync via chronyd

chronyd configuration¶

Edit /etc/chrony.conf:

pool 2.rhel.pool.ntp.org iburst
server time.example.com iburst

Then:

systemctl enable --now chronyd
chronyc sources -v          # verify peering
chronyc tracking            # show offset and drift

Common exam patterns¶

"Configure this server to boot into multi-user mode by default"¶

systemctl set-default multi-user.target

"Configure NTP using internal time server"¶

Edit /etc/chrony.conf, comment out pool lines, add server time.example.com iburst. Then:

systemctl restart chronyd
chronyc sources

"Reset root password and keep SELinux enforcing"¶

Follow the recovery procedure above. The touch /.autorelabel step is non-negotiable.

"Set timezone to UTC and enable NTP"¶

timedatectl set-timezone UTC
timedatectl set-ntp true

Verification checklist¶

After making boot or system config changes, always verify with a reboot:

1. reboot
2. After boot: systemctl get-default shows your target
3. timedatectl shows correct time
4. tuned-adm active shows active profile (if changed)
5. getenforce shows correct SELinux mode