This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
New CentOS server — first-boot runbook
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
Command Notes
# Configure networking
service NetworkManager stop
chkconfig NetworkManager off
chkconfig --levels 2345 network on
system-config-network Configure your static IPs here.
service network restart
ping www.yahoo.com Verify a response
# Turn off Kernel SharedPages Memory
chkconfig ksm off
chkconfig ksmtuned off
# Turn off PC Smart Card daemon
chkconfig pcscd off
# Copy care package
scp -pr <SERVER>:/opt/sw/newServerCarePackage /root Get all the files we will need
cat /root/newServerCarePackage >> /etc/hosts
nano /etc/hosts Remove unneeded and duplicate line items. If this server's name was appended, comment it out.
scp -pr <SERVER>:/opt/scripts /opt
# Link to bash startup script
cd /etc/profile.d
ln -s /opt/scripts/bash_completion.sh
# Stop unused services
/opt/script/stopUnusedServices.sh
# If you are not using LVM
chkconfig lvm2-monitor off
mkdir /opt/sw
cp -R /root/newServerCarePackage/sw /opt
# Disable IPV6
nano /etc/sysconfig/network Add the line: NETWORKING_IPV6=no
nano /etc/sysconfig/network-scripts/ifcfg-eth0 Add the line: IPV6INIT=no
Add the line: IPV6_AUTOCONF=no
nano /etc/modprobe.d/blacklist.conf Add the line: blacklist ipv6
echo "install ipv6 /bin/true" > /etc/modprobe.d/ipv6.dave.conf
service network restart
rmmod ipv6
# Setup Webmin
rpm -ivh /opt/sw/webmin-<version>.noarch.rpm
# Reboot
reboot
yum -y root
reboot
# Setup bridge network
cat /root/newServerCarePackage/ifcfg-eth0 >> /etc/sysconfig/network-scripts/ifcfg-eth0
cp /root/newServerCarePackage/ifcfg-br0 >> /etc/sysconfig/network-scripts/
nano /etc/sysconfig/network-scripts/ifcfg-br0 Configure your static IP.
nano /etc/sysconfig/network-scripts/ifcfg-eth0 Update the correct HWADDR line. Delete the original ifcfg-eth0 lines.
service network restart You should see a "bridge br0 does not exist" error. This ok.
service network restart Now make sure there are no errors.
AI prompt
Generate a Bash script for the task “New CentOS server — first-boot runbook”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Install and configure VNC
Adds INPUT ACCEPT rules to /etc/sysconfig/iptables for the listed TCP ports.
Commands
yum -y install vnc-server
nano /etc/sysconfig/vncservers
VNCSERVERS="1:root" Add these two lines
VNCSERVERARGS[1]="-geometry 1280x960 -depth 16"
vncserver Type in a password when prompted
# Update IPtables
nano /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT Add these two lines
-A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT
# Optional
yum -y install ifstat
# Optional
yum -y install sysstat
reboot
AI prompt
Generate a Bash script for the task “Install and configure VNC”. Given a list of TCP ports, insert matching -A INPUT -m state --state NEW -p tcp --dport <port> -j ACCEPT lines before the reject rule and reload iptables. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
VirtualMin
Manages the Postfix mail queue — inspect it, delete all or just the deferred queue, and trace a message by its queue ID.
Commands
usermod -a -G sasl postfix Needed for bug in install script.
/etc/init.d/saslauthd restart; /etc/init.d/postfix restart
AI prompt
Generate a Bash script for the task “VirtualMin”. Provide mailq, postsuper -d ALL / postsuper -d ALL deferred, and postcat -q <id> | grep -i auth, with a guard prompt before any bulk delete. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Install Tiger VNC server
Installs TigerVNC server on CentOS, creates a systemd unit for display :1, opens the vnc-server service in firewalld and enables it at boot.
Commands
yum install tigervnc-server
cp /lib/systemd/system/vncserver@.service /etc/systemd/system/vncserver@:
1.service
nano /etc/systemd/system/vncserver@:1.service
firewall-cmd --permanent --zone=public --add-service vnc-server
firewall-cmd --reload
su - <USER>
# Start VNC, input a password, then kill :1 to end VNC server
systemctl daemon-reload
systemctl enable vncserver@:1.service
reboot
AI prompt
Generate a firewalld command sequence for the task “Install Tiger VNC server”. Parameterise the user and display number; install tigervnc-server, create the vncserver@:N.service unit for that user, open the vnc-server service in firewalld, set the VNC password as the user, and enable the unit with systemd. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup a new SAMBA server
Installs Samba on CentOS, creates the share user and group, opens the samba service in firewalld, sets SELinux labels and starts smb and nmb.
Commands
yum install samba samba-client samba-common
yum install system-config-samba
useradd <SMB_USER>
less /etc/group
usermod -a -G <SMB_USER> <USER>
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload
cd /etc/samba/
less smb.conf
smbpasswd <USER>
smbpasswd
smbpasswd -h
smbpasswd -a <USER>
systemctl start smb
systemctl start nmb
cd /var/log/samba/
less log.nmbd
less log.smbd
chown -R <SMB_USER>:<SMB_USER> /fourtb/sw
chmod -R g+rw,u+rw /fourtb/sw
usermod -a -G <SMB_USER> <SMB_USER>
chcon -R -t samba_share_t the_share_directory
setsebool -P samba_enable_home_dirs=1
# Try connecting as a client
smbclient -L localhost –U <USER>
AI prompt
Generate a firewalld command sequence for the task “Setup a new SAMBA server”. Parameterise the share path, share user and group; install the Samba packages, create the user and add them to the group, set a password with smbpasswd -a, open the samba service in firewalld, label the share samba_share_t, enable and start smb and nmb, and test with smbclient -L localhost. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.