TOPICS
linux
systems, desktop and server administration
note The journal eats gigabytes before anyone notices The default journal cap is a tenth of the partition. On a small root that means gigabytes of logs nobody wants. project Infrastructure stabilization Stabilizing an organization’s technical backbone: administration rules, documentation, a platform for testing and hosting, and a link to the infrastructure one level up. project mojeWebFoundry A framework for building several separate static sites on SvelteKit. It came out of moving away from Jekyll and doubles as a way to find out what current tooling can do. link How Complex Systems Fail The classic text by R. Cook – why failure never has a single cause. Required reading for anyone who runs systems. note Ubuntu 25.04 (Plucky Puffin): TPM disk encryption, an ARM64 desktop and APT 3.0 A non-LTS release from April 2025: TPM-backed disk encryption in the installer, an official ARM64 desktop, kernel 6.14 with sched_ext, APT 3.0 and the end of apt-key. explainer SELinux from the kernel to the policy: labels, modules and finding bugs How SELinux hangs off the LSM hooks, what the context on every file means, how a module is built from .te and .if, and how a policy bug is actually found. explainer DISA STIG: what it is and how severity is read What DISA STIGs are, how the CAT I/II/III severity categories are read, and why rules are not applied blindly across the board. note OpenSSH 9.0: scp over SFTP and hybrid key exchange An April 2022 release in which scp stopped using the legacy protocol and the default key exchange gained a post-quantum component. note Podman: containers without a daemon and without root A container tool with no permanently running daemon that can run as an ordinary user and generate systemd units. project SELinux development in an enterprise distribution Working on SELinux in an enterprise Linux distribution: policies, their bugs and passing the knowledge on to colleagues. link openSUSE MicroOS: a system that does not update while running An immutable system with transactional updates on btrfs snapshots, where applications live in containers rather than in the root filesystem. note The end of CentOS 8 and the distributions that replaced it After the December 2020 announcement that CentOS 8 would end, two independent RHEL rebuilds appeared during 2021 – AlmaLinux and Rocky Linux. project Security certification against DISA STIG Preparing a minimal enterprise distribution for DISA STIG certification: architecture, test adaptation, mitigations and judging which rules apply to the system at all. note WireGuard in the mainline Linux kernel The WireGuard VPN protocol landed directly in the mainline Linux kernel in March 2020, without needing a separately maintained module. project Infrastructure as Code with Ansible Idempotent infrastructure deployment with Ansible – system and applications, roles driven by host groups, and contributions to an OpenStack deployment. explainer AppArmor: an introduction to MAC for Linux applications What AppArmor is, how mandatory access control through profiles works, and how profiles are created and controlled. project Cloud platform test automation A framework for automated testing of OpenStack cloud platform updates, storage integration and CI/CD – including a period leading the test team. project A model railway controlled from Kubernetes A model railway fully controlled and monitored from a small Intel NUC computer via Arduino, with the applications running in a Kubernetes cluster. explainer AIX for a Linux admin: where Linux habits stop working The differences a Linux administrator meets when moving to AIX on IBM Power – tooling, LVM, LPARs, enterprise storage and backups, compared with SLES and RHEL. explainer Why and how enterprise distribution maintenance packages get tested Why a fix package for an enterprise Linux distribution goes through testing before release – regression testing, multiple architectures and virtualization. explainer Kernel isolation: PV, HVM and OS-level virtualization in Linux The difference between paravirtualization, full hardware virtualization and OS-level virtualization (containers) in Linux. note Debian 9 (Stretch): MariaDB instead of MySQL, X without root A June 2017 release in which MariaDB became the default database and the X server stopped requiring root privileges. guide Cacti for a small virtualized infrastructure How to deploy Cacti on a dedicated host and use SNMP to watch load on both the hosts and the virtual machines – paravirtualized and fully virtualized alike. guide ProxyJump: through a bastion without holding tunnels in your head Getting scp, rsync and git through a jump host by writing it into ssh_config once. note Removing a package while breaking dependencies Force-removing a single package on a Debian-based system without letting apt pull the rest of a dependency chain with it. guide A read-only root on Raspbian that survives a cold power-off How to turn Raspbian on an SD card into a read-only root so the device survives being unplugged, and how to turn it into an image for mass deployment. explainer High availability and shared storage for a small XEN cluster How high availability and shared storage work for a small cluster of virtual machines on XEN. project Read-only Raspberry Pi for daily menu displays Daily menu displays in canteens across the country: a Raspberry Pi that survives being unplugged and deploys without anyone touching it on site. guide Moving off a probably compromised server onto clean infrastructure How the move of an organization’s services off a probably compromised server onto new infrastructure actually went: the old stack, the split into virtual machines, the upgrade trouble and the hardening. project Update testing across architectures Verifying fixes of an enterprise Linux distribution before release – on x86, IBM Z and PowerPC, with a focus on virtualization. project Infrastructure migration Moving an organization’s services off a probably compromised server onto a newly designed infrastructure, running it long term and leading a technical team of volunteers. project Packaging for RPM and Debian and the Open Build Service Building packages for both RPM- and Debian-based distributions – spec, dsc and control files, builds locally and in the Open Build Service. note Maildir: login mail notification and reading with mailx Getting new-mail notifications on login (including SSH) and reading local mail with mailx when the delivery agent uses Maildir. project XEN virtualization infrastructure Consolidating several servers onto the XEN XCP virtualization platform with high availability, shared storage and backups – including migration of running services. note XEN / XCP: a handful of useful notes Scattered fixes from running XEN Cloud Platform: VNC keymap, LVM storage type, the HVC console and CPU hotplug in a guest. guide Examining a RAID member from a disk image with dd_rescue and mdadm Imaging a failing drive with dd_rescue and inspecting its mdadm RAID member over a loop device – without touching the original disk. guide Restoring deleted files with extundelete Recovering deleted files from an ext3/ext4 filesystem with extundelete – mount read-only first and work by inode. project AIX and Linux administration Installation, upgrades, configuration and support of AIX and Linux systems on IBM Power – logical partitions, SAN, backups and high availability. note Debian 6.0 (Squeeze): dependency-based boot ordering A February 2011 release that switched the default boot script ordering to dependency-based sequencing and offered a FreeBSD kernel port as a technology preview. troubleshooting Portmapper hangs at boot or shutdown The portmapper service stalls for a minute during boot or halt – how the issue was tracked down and resolved. project Network administration for companies and the public sector End-to-end administration of networks and servers for private companies and the public sector – from network devices to mail, VPN and storage. project Infrastructure monitoring Watching load and availability of servers and networks – from SNMP and an information system for monitoring and helpdesk to Cacti on top of a virtualization infrastructure.