Loading...

VONDS ©

Lab 118: Reconfiguring Installed Packages on RHEL

Back to Lab Index

Re-apply system configuration safely on a RHEL-like host without dpkg-reconfigure by using system tools and RPM/DNF workflows. Validate timezone and locale state, restore SSH availability, regenerate host keys, verify package integrity with rpm -V, and only then use a controlled dnf reinstall repair.

troubleshooting services rhel

Scenario

After a system hardening pass and package updates, a RHEL server is behaving oddly. The time zone appears inconsistent in logs, and SSH access was briefly unavailable after a restart. Your job is to reconfigure safely, validate the system’s state using reliable evidence, and apply repairs only when the verification signals justify it.

Operator context

On RHEL-family systems there is no direct equivalent to dpkg-reconfigure. You re-apply state by using system tooling, regenerating artifacts (like host keys), verifying package integrity, and reinstalling packages when appropriate.

Objective

  • Inspect current timezone configuration using timedatectl.
  • Confirm the desired timezone exists on the system.
  • Set the correct timezone and verify /etc/localtime points to the expected zoneinfo file.
  • Inspect current locale configuration using localectl.
  • Ensure sshd is enabled and running via systemctl.
  • Regenerate OpenSSH host keys safely using ssh-keygen -A.
  • Restart sshd to pick up changes.
  • Verify package integrity for openssh-server using rpm -V.
  • Perform a controlled repair using dnf reinstall when appropriate.

Concepts

  • On RHEL, you “reconfigure” by re-applying system state using system tools (timedatectl, localectl, systemctl) and by regenerating missing artifacts (like SSH host keys).
  • Use evidence first: inspect, change, verify. Repairs like dnf reinstall are your last-mile baseline restore, not your first move.
  • rpm -V compares installed files to RPM’s database for drift (size, checksum, perms, ownership, etc.).
  • Reinstall restores packaged files. Config handling respects RPM rules and may preserve locally modified config.

Walkthrough

Step 1 : Show the current system time zone.
Command 
timedatectl

This is your baseline: current time, UTC, timezone, and NTP state. If logs look wrong, confirm whether the host timezone is incorrect or whether the issue is an application logging mismatch. 

Local time: Sun 2026-01-04 19:12:01 EST
Universal time: Sun 2026-01-05 00:12:01 UTC
RTC time: Sun 2026-01-05 00:12:01
Time zone: America/New_York (EST, -0500)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no
Step 2 : Verify the target timezone exists.
Command 
timedatectl list-timezones | grep -i new_york

Confirm the intended target is available before you change state. This avoids typos and validates that the zoneinfo database is present. 

America/New_York
Step 3 : Set the system time zone to America/New_York.
Command 
sudo timedatectl set-timezone America/New_York

This updates the host timezone setting. Next you verify the backing symlink in /etc/localtime.

Step 4 : Verify /etc/localtime points to the expected zoneinfo file.
Command 
ls -l /etc/localtime

On modern RHEL-family systems, /etc/localtime is typically a symlink into /usr/share/zoneinfo. This is simple evidence of the configured timezone. 

lrwxrwxrwx. 1 root root 33 Jan  4 19:12 /etc/localtime -> ../usr/share/zoneinfo/America/New_York
Step 5 : Show current system locale settings.
Command 
localectl status

Locale settings influence how services format messages, dates, and character encodings. This is an inspection checkpoint for system identity settings. 

System Locale: LANG=en_US.UTF-8
    VC Keymap: us
   X11 Layout: us
Step 6 : Ensure sshd is enabled and running.
Command 
sudo systemctl enable --now sshd

If SSH was unavailable after restart, validate both the enabled-at-boot state and the current runtime state. This is a safe way to bring the service up and keep it up across reboots. 

Created symlink /etc/systemd/system/multi-user.target.wants/sshd.service → /usr/lib/systemd/system/sshd.service.
Step 7 : Regenerate OpenSSH host keys safely (only creates missing keys).
Command 
sudo ssh-keygen -A

This generates any missing host keys using defaults. It is a controlled recovery step when key files were removed or corrupted during hardening. 

ssh-keygen: generating new host keys: RSA ECDSA ED25519
Step 8 : Restart sshd to pick up changes.
Command 
sudo systemctl restart sshd

Restart forces sshd to re-read configuration and keys so the running service matches what is on disk.

Step 9 : Verify package integrity for openssh-server.
Command 
rpm -V openssh-server

rpm -V verifies installed files against RPM’s database. No output typically means no detected drift for packaged files. 

# (no output)
Step 10 : Reinstall openssh-server as a baseline restore.
Repair rule

Reinstall is a last-mile fix after inspection and verification. Use it to restore packaged files to a known-good baseline.

Command 
sudo dnf reinstall -y openssh-server

dnf reinstall restores packaged files while respecting config handling rules. This is a safe repair technique when you suspect packaged files were damaged or removed. 

Last metadata expiration check: 0:01:18 ago on Sun 04 Jan 2026.
Dependencies resolved.
Reinstalling:
  openssh-server.x86_64  8.7p1-38.el9  baseos
Complete!

Common breakpoints

Timezone changes but apps still log differently

Some applications log in UTC regardless of system timezone. Use timedatectl as the host truth, then check the application logging configuration if outputs still disagree.

SSH is enabled but still unreachable

If sshd is active but you cannot connect, you typically check firewall rules and SELinux context next. This lab focuses on service and package recovery, not network policy.

rpm -V shows drift

Drift output usually indicates modified packaged files. Treat it as evidence: confirm which files changed, then use dnf reinstall to restore packaged content when that aligns with your repair goal.

Cleanup checklist

Confirm your changes are stable and that SSH is healthy before you leave the system.

Commands 
timedatectl | egrep 'Time zone|System clock synchronized|NTP service'
localectl status | egrep 'System Locale|VC Keymap|X11 Layout'
systemctl is-enabled sshd && systemctl is-active sshd
rpm -V openssh-server || true
Success signal

Timezone and locale match expectation, sshd is enabled and active, host keys exist, and RPM verification output matches the state you intended.

Reference

  • timedatectl : Show and configure system time and timezone.
    • list-timezones : List available timezones.
    • set-timezone <Zone> : Set the system timezone.
  • localectl status : Display system locale and keyboard settings.
  • systemctl enable --now sshd : Enable SSH at boot and start it immediately.
  • systemctl restart sshd : Restart SSH to reload config/keys.
  • ssh-keygen -A : Generate any missing default SSH host keys.
  • rpm -V <pkg> : Verify installed package files against the RPM database.
  • dnf reinstall <pkg> : Reinstall a package to restore packaged files.
  • /etc/localtime : Usually a symlink to the active zoneinfo file.