RedHat / CentOS Common Commands - CodeSwordsman

Frequently used RHEL, CentOS Stream and CentOS 7 commands: dnf/yum and rpm packages, repositories and EPEL, systemd services, SELinux and firewalld, nmcli networking, subscription registration and troubleshooting.

RHEL 8/9 · CentOS Stream 9 · CentOS 7 notes includedUpdated 2026-10-3045 commands

Package Management (dnf / yum)

Install a package without prompting; dnf is default on RHEL 8+ and CentOS Stream

dnf install -y nginx

CentOS 7 only ships yum; arguments are largely identical.

Remove a package and clean up orphaned dependencies

dnf remove nginx
dnf autoremove -y

Upgrade all packages; validate on a test host before production

dnf update -y

Search enabled repositories and show package details

dnf search nginx
dnf info nginx

Find which package provides a file or command, handy for missing binaries

dnf provides /usr/sbin/nginx

List transactions and roll back by id; treat rollbacks as production changes

dnf history
dnf history undo 12

AppStream modules switch major versions on the same system

dnf module list nginx
dnf module enable nginx:1.22

List installed packages and the files a package ships

rpm -qa | grep nginx
rpm -ql nginx

Install or upgrade a local rpm; use dnf localinstall to resolve deps

rpm -ivh ./package.rpm
rpm -Uvh ./package.rpm

Repositories & EPEL

Inspect configured repository files when installs fail

ls /etc/yum.repos.d/

Add a third-party repo; use --set-enabled or --set-disabled on RHEL 8+

dnf config-manager --add-repo https://example.com/app.repo

Enable EPEL, which provides many common tools

dnf install -y epel-release

List enabled and all repositories to spot disabled ones

dnf repolist
dnf repolist --all

Clear caches and rebuild metadata when packages cannot be found

dnf clean all && dnf makecache

CentOS 7 is EOL; switch mirrors to vault to keep installing packages

sed -i 's/mirrorlist/#mirrorlist/g; s|#baseurl=http://mirror|baseurl=http://vault|g' /etc/yum.repos.d/CentOS-*.repo

Back up /etc/yum.repos.d before editing so mistakes are reversible.

Service Management (systemd)

Start and restart services; restart drops existing connections

systemctl start nginx
systemctl restart nginx

Enable at boot and start immediately in one command

systemctl enable --now nginx

Show status with recent logs; -l avoids truncating long lines

systemctl status nginx -l --no-pager

List services enabled at boot to audit startup time

systemctl list-unit-files --state=enabled

Follow the last hour of logs for a service

journalctl -u nginx -f --since "1 hour ago"

SELinux

Show the current mode: Enforcing, Permissive or Disabled

getenforce

Temporarily switch to permissive or enforcing; reverts on reboot

setenforce 0
setenforce 1

Use only for diagnosis; evaluate risk before disabling permanently.

Label a custom web root and apply it immediately to fix permission-looking 403s

semanage fcontext -a -t httpd_sys_content_t "/data/www(/.*)?"
restorecon -Rv /data/www

Inspect SELinux contexts of files and processes to spot label mismatches

ls -Z /var/www/html
ps -eZ | grep nginx

Query recent AVC denials, the direct evidence of SELinux blocking

ausearch -m avc -ts recent
journalctl -t setroubleshoot --since today

Firewall (firewalld)

Check whether firewalld runs; stopped means no rules apply

firewall-cmd --state

Permanently allow HTTP; --permanent requires a reload to take effect

firewall-cmd --add-service=http --permanent
firewall-cmd --reload

Permanently open a custom port; drop --permanent for temporary rules

firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --reload

Show ports, services and rich rules in the active zone

firewall-cmd --list-all

Remove an allowed service to revert a mistaken rule

firewall-cmd --remove-service=http --permanent
firewall-cmd --reload

Networking (nmcli)

Show device state and connection names, replacing the legacy network service

nmcli device status

Show IP, gateway and DNS settings of a connection

nmcli connection show "ens33"

Switch to a static address; apply with nmcli connection up

nmcli connection modify "ens33" ipv4.addresses 10.0.0.21/24 ipv4.gateway 10.0.0.1 ipv4.dns 8.8.8.8 ipv4.method manual

Activate the connection and reload; keep a second session when remote

nmcli connection up "ens33"
nmcli connection reload

Set the hostname and verify it; monitoring and containers often rely on it

hostnamectl set-hostname web-01
hostnamectl status

System & Subscription

Confirm distribution and version before choosing commands

cat /etc/redhat-release

subscription-manager register --username <USER> --auto-attach

List and apply security updates only to limit production change scope

dnf updateinfo list --security
dnf update --security -y

Set the timezone and confirm sync status when log timestamps look wrong

timedatectl set-timezone Asia/Shanghai
timedatectl status

Show NTP sources and offsets, common on virtual machines

chronyc sources -v

Troubleshooting

Show repository URLs and status to find unreachable repos

dnf repolist -v

Verify installed files; no output means everything matches

rpm -V nginx

Show recent errors and hints, the first stop for failed services

journalctl -xe

Check the last 50 kernel messages with readable timestamps for OOM or disk errors

dmesg -T | tail -50

Confirm a port is listening and which process owns it

ss -tunlp | grep 8080