Sujet : linux
-
Les permissions des fichiers Unix et l’umask
Chaque fichier possède des bits de lecture, d’écriture et d’exécution pour le propriétaire, le groupe et les autres, ainsi que les bits setuid, setgid et sticky ; les permissions des nouveaux fichiers dépendent de l’umask du processus. Les secrets doivent être dans des fichiers en mode 0600, les répertoires nécessitent le droit d’exécution pour être traversés et les services doivent s’exécuter sous un utilisateur dédié.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
-
Reading a flame graph: width is samples, the x-axis is not time
A flame graph stacks sampled call stacks so that frame width is the share of samples and height is stack depth; the x-axis is sorted alphabetically, not by time. Read wide plateaus at the top as on-CPU hot spots, wide frames with many thin children as callers to call less often, and remember that a CPU flame graph cannot show waiting.
-
Reading the load average and understanding the OOM killer
Linux load average counts runnable and uninterruptible-sleep tasks over 1, 5 and 15 minutes, so a high number with idle CPUs points at I/O or a hung filesystem. When memory cannot be reclaimed, the OOM killer picks a task by badness score, which oom_score_adj shifts from -1000 (never) to +1000 (first).
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Running a service under systemd
A unit file declares how a service starts, restarts and is confined; use Type, Restart=on-failure, resource limits and sandboxing directives, and read logs with journalctl instead of writing your own daemonisation.
-
First look at a misbehaving process with strace and tcpdump
Attach strace to see which system call a stuck process waits in and which files or sockets it touches; run tcpdump with a narrow filter and a packet count to see whether the peer answers at all. Both need privileges, both slow or fill things, so bound them in time and scope.
-
Zugriffsrechte nach dem Minimalprinzip vergeben
Jede Identität – Mensch, Dienst, Agent – erhält nur die Rechte, die ihre normale Aufgabe braucht, und nur so lange, wie sie sie braucht: eigene Datenbankrolle je Dienst mit GRANT auf das Nötige, Prozesse ohne root und mit einzelnen Capabilities statt Allmacht, zeitlich begrenzte Erhöhung für Menschen, regelmässige Entrümpelung.
-
Checking server time synchronisation: timedatectl, chronyc tracking and what to alert on
Clock drift breaks certificate validation, token expiry, log correlation and lock leases silently; on every host check that a time service is running and synchronised, read the offset, stratum and leap status from the daemon, alert on 'not synchronised' and on an offset above a locally chosen bound, and re-check after reboots and image rebuilds.
-
TCP connections: the handshake, retransmission timers and keep-alives
A TCP connection starts with a three-way handshake, recovers lost segments by a retransmission timer that doubles on each failure, and is only checked for liveness if keep-alives are switched on per socket. Linux defaults mean a hung peer takes minutes to notice and an idle connection two hours before the first probe.
-
Hardening an SSH server without locking yourself out
Turn off password and keyboard-interactive login, restrict root and the allowed users, keep MaxAuthTries and LoginGraceTime tight, prefer ProxyJump to agent forwarding, and test every sshd_config change with sshd -t while a second session stays open.
-
Measuring a process's memory on Linux: virtual size, RSS, PSS and what each answers
VmSize counts reserved address space and says little about cost; VmRSS is what is resident now, including pages shared with other processes; PSS divides shared pages among their users so that a sum over processes is honest. Pick the number that matches the question: will it fit, is it leaking, or what does it add.
Lisible par machine : JSON