テーマ： linux
-
Unix file permissions and the umask
Each file has owner, group and other permission bits for read, write and execute, plus setuid, setgid and sticky bits; new files get permissions from the process umask. Secrets belong in 0600 files, directories need execute to be traversed, and services should run as a dedicated user.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
-
Reading a flame graph: width is samples, the x-axis is not time
A flame graph stacks sampled call stacks so that frame width is the share of samples and height is stack depth; the x-axis is sorted alphabetically, not by time. Read wide plateaus at the top as on-CPU hot spots, wide frames with many thin children as callers to call less often, and remember that a CPU flame graph cannot show waiting.
-
Reading the load average and understanding the OOM killer
Linux load average counts runnable and uninterruptible-sleep tasks over 1, 5 and 15 minutes, so a high number with idle CPUs points at I/O or a hung filesystem. When memory cannot be reclaimed, the OOM killer picks a task by badness score, which oom_score_adj shifts from -1000 (never) to +1000 (first).
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Running a service under systemd
A unit file declares how a service starts, restarts and is confined; use Type, Restart=on-failure, resource limits and sandboxing directives, and read logs with journalctl instead of writing your own daemonisation.
-
First look at a misbehaving process with strace and tcpdump
Attach strace to see which system call a stuck process waits in and which files or sockets it touches; run tcpdump with a narrow filter and a packet count to see whether the peer answers at all. Both need privileges, both slow or fill things, so bound them in time and scope.
-
Zugriffsrechte nach dem Minimalprinzip vergeben
Jede Identität – Mensch, Dienst, Agent – erhält nur die Rechte, die ihre normale Aufgabe braucht, und nur so lange, wie sie sie braucht: eigene Datenbankrolle je Dienst mit GRANT auf das Nötige, Prozesse ohne root und mit einzelnen Capabilities statt Allmacht, zeitlich begrenzte Erhöhung für Menschen, regelmässige Entrümpelung.
-
Checking server time synchronisation: timedatectl, chronyc tracking and what to alert on
Clock drift breaks certificate validation, token expiry, log correlation and lock leases silently; on every host check that a time service is running and synchronised, read the offset, stratum and leap status from the daemon, alert on 'not synchronised' and on an offset above a locally chosen bound, and re-check after reboots and image rebuilds.
-
TCP connections: the handshake, retransmission timers and keep-alives
A TCP connection starts with a three-way handshake, recovers lost segments by a retransmission timer that doubles on each failure, and is only checked for liveness if keep-alives are switched on per socket. Linux defaults mean a hung peer takes minutes to notice and an idle connection two hours before the first probe.
-
Hardening an SSH server without locking yourself out
Turn off password and keyboard-interactive login, restrict root and the allowed users, keep MaxAuthTries and LoginGraceTime tight, prefer ProxyJump to agent forwarding, and test every sshd_config change with sshd -t while a second session stays open.
-
Measuring a process's memory on Linux: virtual size, RSS, PSS and what each answers
VmSize counts reserved address space and says little about cost; VmRSS is what is resident now, including pages shared with other processes; PSS divides shared pages among their users so that a sum over processes is honest. Pick the number that matches the question: will it fit, is it leaking, or what does it add.
機械可読： JSON