YUM and DNF Explained: RPM Package Management for Linux+
YUM and its successor DNF are the package managers for Red Hat-based distributions — RHEL, CentOS, Rocky, AlmaLinux and Fedora. They sit above RPM, which handles individual packages, and add repositories and automatic dependency resolution.
RPM, YUM and DNF
Get the layering straight, because the exam tests it.
RPM is the low-level tool and the package format. rpm -i package.rpm installs a single file. It will refuse to install if dependencies are missing, and it will not go and fetch them — it tells you what is absent and stops.
YUM sits above RPM, knows about configured repositories, and resolves dependencies automatically. yum install httpd finds the package, works out what else it needs, and installs the lot.
DNF is the rewritten replacement for YUM, default since RHEL 8 and Fedora 22. It uses a better dependency solver, is faster and uses less memory. On modern systems yum is a symbolic link to dnf, so the old commands still work — which is why both names appear in exam questions.
The analogy with Debian systems: RPM is to YUM/DNF as dpkg is to apt.
The commands
| Task | Command |
| Install | dnf install httpd |
| Remove | dnf remove httpd |
| Update one package | dnf update httpd |
| Update everything | dnf update |
| Search | dnf search keyword |
| Package details | dnf info httpd |
| List installed | dnf list installed |
| Which package owns a file | dnf provides /usr/sbin/httpd |
| List repositories | dnf repolist |
| Clear cached metadata | dnf clean all |
| Transaction history | dnf history |
| Undo a transaction | dnf history undo <id> |
dnf provides is the one worth remembering for troubleshooting — it answers "a command is missing, which package do I install". dnf history undo is the other: it rolls back a whole transaction, dependencies included, which is more than APT offers.
Repositories
Repositories are defined in /etc/yum.repos.d/, one .repo file per repository. Each entry carries a name, a base URL or mirror list, an enabled flag, and GPG checking settings.
Metadata is cached locally so searches do not hit the network every time, which is why dnf clean all is the standard first step when a repository behaves oddly after a change.
EPEL — Extra Packages for Enterprise Linux — is the common additional repository, providing software Red Hat does not ship.
GPG signatures
The security point, and the one that matters for Security+ crossover.
Packages are signed by the repository maintainer, and gpgcheck=1 makes the package manager verify that signature against an imported key before installing. This is what stops a compromised mirror or a man-in-the-middle from serving a modified package.
Disabling GPG checking, or installing with --nogpgcheck to get past an error, removes that protection entirely. If an exam scenario describes someone bypassing a signature warning, that is the vulnerability being tested. Import the correct key instead.
YUM/DNF compared with APT
| DNF / YUM | APT | |
| Distributions | RHEL, Fedora, Rocky, Alma | Debian, Ubuntu, Mint |
| Package format | .rpm | .deb |
| Low-level tool | rpm | dpkg |
| Refresh metadata | Automatic | apt update required first |
| Rollback | dnf history undo | Not built in |
The metadata difference catches people out in both directions. On Debian systems you must run apt update before installing or you work from a stale index; DNF refreshes automatically based on its metadata expiry.
Troubleshooting
Dependency conflicts usually mean mixing repositories that were not built together — check which repository each package comes from. A missing GPG key means importing it rather than disabling the check. Stale metadata after a repository change is fixed with dnf clean all. And if an update broke something, dnf history will show the transaction and undo will reverse it.
What to remember
RPM handles single packages and will not resolve dependencies; YUM and DNF add repositories and dependency resolution. DNF replaced YUM from RHEL 8, and yum is now a link to dnf. Repositories live in /etc/yum.repos.d/. Keep gpgcheck enabled. dnf provides finds which package supplies a file, and dnf history undo rolls back a transaction.
Related reading: The APT package manager · Linux permissions · ext3 and ext4
Comments
Post a Comment