Тема: linux
-
Summarizing time in system calls with strace -c, its overhead, and perf trace as an alternative
strace -c counts time, calls and errors per system call instead of printing every call, but strace's own manual warns that a traced process runs more slowly than an untraced one; perf trace, described as a strace-inspired tool built on perf_events rather than ptrace, is the lower-ceremony alternative when that overhead matters.
-
Устранение уязвимостей ядра Linux из KEV: сверяйте каждую CVE с пакетом дистрибутива и работающим ядром
Учитывайте пять эксплуатируемых уязвимостей ядра по отдельности. Используйте исправленные пакеты своего дистрибутива и подтверждайте либо загрузку исправленного ядра, либо явное покрытие через livepatch; мера для одной подсистемы не устраняет проблемы в остальных.
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
libvirt storage pools and qcow2 snapshots are not a backup
virsh snapshot-create-as makes internal qcow2 snapshots fast to create, but they live inside the same disk image as the guest and depend on that image surviving. This article explains internal versus external snapshots, why they cannot substitute for a backup, and how to check image state with qemu-img.
-
Права доступа к файлам Unix и umask
У каждого файла есть биты чтения, записи и исполнения для владельца, группы и остальных, а также setuid, setgid и sticky; права новых файлов определяет umask процесса. Секреты следует хранить в файлах 0600, для прохода по каталогам нужно право исполнения, а сервисам следует работать от выделенного пользователя.
-
GRUB 2 administration: /etc/default/grub, grub-mkconfig, grubby and the default entry
GRUB 2 is configured indirectly: settings live in /etc/default/grub and are compiled into grub.cfg by grub-mkconfig (invoked as update-grub on Debian/Ubuntu), while RHEL-family systems with Boot Loader Specification entries are usually managed with grubby instead of editing grub.cfg by hand.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
epoll с уведомлениями по фронту: исчерпайте неблокирующую работу, прежде чем ждать следующего фронта
Избегайте зависания соединения, отделяя уведомления о готовности от полных сообщений приложения.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap
useradd -m -s creates an interactive user with a home directory and shell; --system with a nologin shell is the right shape for a service account. usermod -G without -a replaces a user's supplementary groups instead of adding to them — one of the most commonly reported local-account mistakes.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
cgroups v2 на хосте: проверка режима и чтение ограничений ресурсов юнитов
Современные контейнерные среды и systemd используют cgroups v2 — единую иерархию — для ограничения памяти и процессора. Методика охватывает подтверждение единого режима на хосте, просмотр дерева через systemd-cgls/systemd-cgtop и чтение фактических ограничений юнита или контейнера.
-
Verifying installed RPM packages for tampering with rpm -V
rpm -V compares installed files against the checksums, permissions and ownership recorded when the package was installed, and its single-letter output codes say exactly what changed. This methodology covers reading that output and its limits as an integrity check.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
Администрирование RHEL без графического интерфейса через веб-консоль Cockpit
Cockpit предоставляет браузерный сеанс администрирования сервера RHEL без графического рабочего стола и запускается через сокет только при первом подключении. Методика описывает включение консоли, открытие доступа в межсетевом экране через её именованную службу и задачи, для которых она полезна на сервере.
-
Где на машине разработчика хранятся учётные данные, доступные процессу агента
Агент, работающий от имени пользователя, может читать всё, что доступно пользователю: переменные окружения, файлы учётных данных CLI, данные входа в реестры контейнеров, SSH-ключи, историю оболочки и хранилища, связанные с браузером. Знание этих мест помогает оператору решить, что изолировать от агента и что заменить после инцидента.
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
Машиночитаемо: JSON