openSUSE / SLES Server Administration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where openSUSE and SLES sits

openSUSE Leap and SUSE Linux Enterprise share a family. zypper is the package tool. SLES is the supported product. Leap is the community release with its own schedule. Write which one the host actually is. They are not interchangeable in a support ticket.

Networking may be wicked or NetworkManager depending on the image and the version. Check the running network service before you import a Debian or RHEL file. The lab address 192.0.2.10/24 via 192.0.2.1 is documentation. Use the tool that owns the interface.

YaST can change the same settings as the CLI. Prefer the CLI in a ticket because the diff is readable. If someone uses YaST, export or record the result. Do not bounce between YaST and hand edits in one window.

Many installs default to Btrfs with snapper snapshots. A snapshot is the short undo from the virtualization and storage conversations, still not the only backup. The backup guide remains the off-box copy. Do not fill the root filesystem with forgotten snapshots.

The first hour on a lab host

Step 1 on openSUSE and SLES covers which product. Read os-release and write Leap or SLES and the version. The repositories and the support promise depend on it. The check is: The ticket matches os-release. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for openSUSE and SLES draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 2 on openSUSE and SLES covers admin. Named admin and a key. Confirm how sudo or wheel is set on this image. SUSE defaults are not identical to Ubuntu's. The check is: The key login works. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for openSUSE and SLES draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 3 on openSUSE and SLES covers network owner. See whether wicked or NetworkManager is active, then set the lab address with that one. Editing the other tool does nothing or fights a reboot. The check is: The address matches after reboot. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for openSUSE and SLES draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 4 on openSUSE and SLES covers packages. zypper from this product's repositories only. A home built RPM repo is a separate decision. The check is: The transaction you accepted is the one that ran. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for openSUSE and SLES draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 5 on openSUSE and SLES covers snapshots. If Btrfs and snapper are in use, note how many snapshots you keep. An unbounded snapshot list fills the disk. The check is: The retention is a number in the ticket. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for openSUSE and SLES draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

# openSUSE or SLES lab. Review before you paste.
# Confirm Leap vs SLES. Confirm wicked vs NetworkManager.
# zypper, not dnf or apt.
# Lab address 192.0.2.10/24 via 192.0.2.1.
# prompt-for-this is not a password to keep.

The commands you will actually repeat

zypper patch or zypper update, using the subcommand that matches this product, after you read the list. SLES repositories depend on the registration. Leap uses its own. Do not add both.

systemctl is the service manager on current releases. The systemd guide applies.

Firewall tooling should be the one the image enabled. Confirm it before you copy a firewalld recipe from the RHEL page. If firewalld is what this host uses, allow the management prefix and not the world.

Read snapper or the filesystem note so a full disk is not a surprise. Clean up snapshots on purpose.

What openSUSE and SLES is not

Leap is not SLES support. SLES is not Leap with a logo.

Neither is RHEL. dnf is the wrong command. Neither is Debian. apt is the wrong command.

YaST is not a reason to skip a written config. The next person may not have the same menus.

The hour you stop

Write the hostname, the role, and the clock time before you change openSUSE and SLES. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on openSUSE and SLES. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of openSUSE and SLES in production.

If a step on openSUSE and SLES fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. openSUSE and SLES being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now openSUSE and SLES will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

openSUSE and SLES checks before a second host

Check 1 in openSUSE and SLES checks before a second host. openSUSE and SLES is the OS the hostname reports, not a neighbour you copied from. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in openSUSE and SLES checks before a second host. The lab address 192.0.2.10/24 is gone before this host is placed on a real network. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in openSUSE and SLES checks before a second host. prompt-for-this is not the password that was set, and no password is in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in openSUSE and SLES checks before a second host. The named admin can log in with a key. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in openSUSE and SLES checks before a second host. The package manager used is the one this page names. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in openSUSE and SLES checks before a second host. A network file from a different distribution was not pasted in. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in openSUSE and SLES checks before a second host. The config test or the apply command for this network tool succeeded. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in openSUSE and SLES checks before a second host. The previous image or install file is kept. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in openSUSE and SLES checks before a second host. No new third-party repository was added in the first hour. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in openSUSE and SLES checks before a second host. A service you do not need was not enabled to see what it does. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in openSUSE and SLES checks before a second host. Console or out-of-band access works before you reload SSH. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in openSUSE and SLES checks before a second host. A second person read the hostname and the address. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in openSUSE and SLES checks before a second host. The ticket says Leap or SLES, not just SUSE. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in openSUSE and SLES checks before a second host. The network service that is running is the one you configured. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in openSUSE and SLES checks before a second host. zypper repos match that product. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in openSUSE and SLES checks before a second host. Snapshot retention is finite if snapper is installed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.