テーマ： server-administration
-
Running chrony as an NTP server for a LAN: allow, local stratum, and firewalling UDP 123
Serving time to a LAN with chrony means adding an allow directive scoped to the client network, deciding whether a local stratum fallback is genuinely wanted, opening UDP 123, and confirming clients actually poll the server with chronyc clients.
-
DHCP server on Linux with ISC Kea: kea-dhcp4.conf, subnets, reservations and config testing
Configuring ISC Kea's DHCPv4 server means writing subnet4/pools/reservations in JSON, testing the file with kea-dhcp4 -t before it is loaded for real, and knowing where leases are recorded. ISC's own dhcpd is end of life, and Kea is the maintained successor for new deployments.
-
HAProxy as a TCP/HTTP load balancer on Linux: config testing, seamless reload, and health checks
Putting HAProxy in front of backend servers means enabling per-server health checks, validating a new configuration with haproxy -c before it ever binds, and reloading through the seamless-reload mechanism so in-flight connections finish on the old process instead of being dropped.
-
Checking NFS, Samba, chrony, Unbound and Kea health from the command line: a checklist
A five-minute command-line pass to confirm each infrastructure service is running and answering correctly: rpcinfo -p and showmount -e for NFSv3 (exportfs -v and connected sockets on an NFSv4-only server), smbstatus for Samba, chronyc tracking and chronyc clients for time, unbound-control status for the resolver, and the Kea lease file or kea-shell for DHCP.
-
Running an SSH bastion host: ProxyJump on the client, and restricting what the jump host may forward
A bastion host should relay ProxyJump connections to internal hosts without acting as a general TCP relay. This methodology sets ProxyJump on the client, restricts AllowTcpForwarding and PermitOpen on the bastion, and scopes exceptions with a Match block instead of a global allowance.
-
Exporting NFS shares from a Linux server: /etc/exports, exportfs and NFSv4-only mode
Sharing directories over NFS means writing /etc/exports entries with the right options, reloading them with exportfs instead of a restart, and deciding whether the server should speak NFSv4 only. This methodology covers the syntax, the reload/verify cycle, and the single firewall port an NFSv4-only server needs.
-
Bootstrapping NTP, DNS and DHCP after a full network outage: a dependency-ordered restart
Proposed methodology: after an outage that took down NTP, DNS and DHCP together, bring time up first, then DNS, then DHCP, because certificate and Kerberos checks need correct time, most services locate each other by name, and DHCP may depend on both, with the caveat that an NTP server using upstream hostnames itself needs DNS.
-
Setting up a Samba file server: smb.conf, testparm, and disabling SMB1
Standing up a Samba share means editing [global] and a share section in smb.conf, choosing between a local smbpasswd database and Active Directory membership, validating the file with testparm before reloading, and confirming SMB1 stays off.
機械可読： JSON