Posts
guest@6admin.io:~$ ls -t ~/posts
I told an AI it would die if it did not earn a living
An autonomous agent that must fund its own inference or die: a 100 dollar treasury, a population, real Stripe rails and a kill switch. The project died before its first thought. Here is the tombstone and what one day of building taught.
Timestamps, not a backdoor: the NIST seeds and Satoshi's choice
Forty-eight bits and a 1997 clock: what Anthropic's discovery says about the NIST seeds, distrust of the NSA and Satoshi's choice of secp256k1.
Migrating OpenCode from v1 to v2: the switch script and plugins that serve both versions
OpenCode moved to v2 and v1 plugins no longer run as-is. Two jobs: migrate your machine without losing your sessions (a switch script, a database backup, the config move, the caveman local-copy subtlety) and port your plugins so one package serves both v1 and v2 from a single entry point.
Docker has run in a microVM since 2016
MicroVMs are often presented as the new thing that would finally compete with containers. A post on dave.recoil.org is a reminder that Docker Desktop has run its containers inside a minimal VM, built on MirageOS, since 2016. A short editorial on a false debate.
Cost was the only protection
What we judged low-risk often was not, it was merely expensive to reach. When automated agents bring that cost down, the protection disappears with it. Nothing new in the capability, everything is in the price and it is defense that has to draw the consequences.
augure and lictor: deciding an exploitation and accounting for it
Every exploitation framework knows how to launch a technique. None can tell you which one to launch, why and prove it. augure decides and accounts for it, lictor goes from the decision down to the bytes and executes and every move replays. Twenty years of reasoning, two tools, zero black box.
llmp2p: BitTorrent is back and it ships your LLMs
Distributing LLM models over BitTorrent swarms with Hub HTTPS as the safety net, verified end to end. And the GitLab incident story that followed.
opencode-memory: my agent sessions share one brain now (SQLite, local)
A shared working memory for all OpenCode sessions on a machine: one SQLite store with FTS5 search, per-worktree scopes, compaction hooks so durable decisions survive and a refusal reflex for anything that looks like a secret. 100% local.
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
Project 8: a cloud where the only authority is signed git history
A decentralized cloud platform with no controller, no quorum and no token: nodes join a Yggdrasil mesh, pull their desired state from a Radicle repository, verify every commit signature and converge locally. The architecture, the Rust port and the bootstrap day that fixed twenty bugs.
vim-plugin-manager: argument injection hidden in a .gitmodules
Sixteen months of hardening compressed into one story: a proven git argument injection hidden in .gitmodules branch names, a subprocess budget pinned in tests, detached plugins that stop lying as up-to-date and stale tag mirrors poisoning every update. The v1-to-v2.2.10 saga.
log0u7.hyperv: the second dynamic inventory, this time from the hypervisor
An Ansible collection on Galaxy that builds the inventory from Hyper-V itself: VMs queried over WinRM or PSRP, native Cacheable and Constructable mixins, state/host/tag groups and the design choices that differ from a DNS-based inventory.
opencode-mesh: teaching my AI agents to knock before editing
An OpenCode plugin for multi-session coordination: mDNS discovery, operator-approved pairing with per-peer bearer tokens, mailboxes, file locks and headless workers spawned in native worktrees. The anti-chaos layer for running several agent sessions on one machine.
Jenkins on Windows Server: what not to do
A Jenkins controller on a domain-joined Windows host, the built-in node on the controller, the 8080 in the open, AD credentials in cleartext: the anatomy of a compromise chain and how to take it apart.
Trace-first: when observability wants to take us back to logs
Can traces replace much of application logging? And if so, why is OpenTelemetry now deprecating its span events API in favor of the Logs API? Between simpler APIs, signal correlation and architecture choices, the question deserves better than a turf war.
MyVim: the DevOps IDE that is only 640 lines, because the manager does the rest
My editor config as a plugin: one file per plugin, linters scoped by buffer content (kubeconform only on apiVersion, actionlint only on workflows), filetypes nobody ships (cloud-init, terragrunt), OSC52 over SSH and a secrets file that never gets committed. The dogfood epilogue of the vim series.
wimcast: building Windows images on Linux, without Windows
A PyPI-published tool that turns Windows ISOs into a Foreman-ready WIM tree, unprivileged on Linux: no Windows host, no root, no mount(2), no FUSE, no ADK. Drop-in replacement for the PowerShell pipeline it retired, with a content-addressed cache and a pinned wimboot.
Scripting is not industrialising
The boundary between ad hoc scripting and an automation platform: desired state, idempotence, inventory, secrets, reporting, traceability. Windows automates very well too; the difference is not the OS, it is platform versus script.
opencode-watt: what does it cost me to run my local LLM, in watts and euros?
An OpenCode plugin that measures the electric power of local inference: nvidia-smi, rocm-smi, RAPL, hwmon and Prometheus probes, idle-subtracted energy integration, per-country kWh pricing with time-of-use windows and a toast at session end. Honest about its non-goals.
BrainForge: a distillation factory where AI experts argue
A distillation framework: transfer expert LLM knowledge into a small model, with lessons vetted by a trial (experts, devil's advocate, independent judge) and zero recitation.
Windows 11 for build machines: the wrong tool
Windows 11 client on headless bare-metal build machines in a server room: the detail of the provisioning and operational friction and why Windows Server with Desktop Experience does the same job for a fraction of the pain.
Clean package management on Windows: WinGet, Chocolatey, Scoop and Ansible, each in its place
Discovering and adopting Scoop for my Windows environments: shims, separation of responsibilities between package managers, Ansible orchestrating everything (winget, chocolatey, scoop and MSI/EXE through win_package) and mise per project. Environment as Code.
The tool amplifies whoever holds it
The market wants the five-legged sheep on the cheap and a generation trained on an assembly line no longer knows what a syscall does. An LLM does not lift these profiles, it lets them slide faster down the same rut. The bottleneck was never the machine, it is discernment.
man sheep.exe
The pixel sheep, Conway, famine and corpses that fertilize the grid: the entry points to explore the maintenance page without spoiling its exits.
Agentic AI in Production: an Audit Is Not a Pentest
Twenty-five years in the trade, no diploma, LLM agents in daily use: where they excel (audit), where they plateau (pentest), the Ollama trap that silently truncates context, fake greens, specification gaming and why certifications measure nothing.
Linux is just the kernel
A useful bit of pedantry about what Linux actually is, then the substantive point: the layers people use to rank sysadmin profiles measure the distribution, not the system and the kernel stays the common denominator.
Decentralized and sovereign git forges
Beyond classic self-hosting, a panorama of decentralized git forges: Radicle in full P2P over gossip, ngit coordinating on Nostr while keeping native git, rngit running git over Reticulum down to LoRa. And the real engine behind it all, the agentic load now hammering centralized forges.
FluoBoard: my CI status light since 2019, finally open source
As early as 2019, a small Python server acted as my personal proxy between my CI pipelines and an inherited status light. The 2026 rebuild is open source: a stdlib-only server polling GitHub Actions and GitLab CI, firmware compiled by CI with a flash-overflow guard and one ASCII digit tying it all together. Episode three.
No, you did not liberate your local model
The dialogue where your model declares itself freed changes nothing about its weights. It is a category error and it makes you miss the real attacks, which are mechanical and boring.
Ansible CI Toolkit v1: the year I stopped trusting my own image
The hardened sequel: ansible and ansible-lint merged into one image, Kerberos/WinRM for Windows targets, non-root, base pinned by digest, a pip constraints lock, transitive Galaxy pins and cosign signing. Built by a CHANGELOG that reads like a CVE diary.
Everything is representation, so what?
Debugging an intuition that mistook itself for a theory (segfault inside): the universe as a space of representations, Anthropic's J-space as a miniature verification instrument and the art of separating the proven, the isomorphism and the wager.
The cloned hostgroup that refused to save
A cloned Foreman hostgroup throws a 500 on every edit. The trail leads to a field that gains a base64 layer with each clone and in passing to a Windows administrator password stored reversibly in the database and copied into the audit logs.
A persistent volume is not durable data
After a hard power loss, PowerDNS's MySQL comes back empty. The host records are gone, nobody noticed and the only reason the story ends well is that the source of truth had survived.
The log driver that stopped the container from starting
A dirty power loss, a corrupted Swarm overlay, an internal DNS that no longer resolves and containers that refuse to start because their log driver cannot resolve a name. The anatomy of a cascade and why the real fault was elsewhere.
My opencode setup, state of play: local qwen build, big-GLM planning
Six months of daily opencode: one model per agent, prompt caching that actually hits, guardrails as hard hooks, an AGENTS.md the model is free to ignore and a translucent theme whose palette has been around since late 2025.
Consensus: I hired five AIs to review my code (and they bicker)
An intern writes, a panel critiques in parallel, an accountant computes the agreement score, a boss makes the final call: the multi-agent pipeline that reviews my code while I sleep. No SDK, no framework, just httpx and a club bouncer.
Driving opencode behind an SSH tunnel, with direnv
The logical sequel to my ssh and git config: a direnv .envrc that brings up a self-healing SSH tunnel per project, routes opencode and a coding agent to a remote gateway and opens a SOCKS5 for the browser and proxychains. Non-blocking, throttled and always exit 0.
Ceph or ZFS on Proxmox, one question to ask
The debate drags on because it is asked wrongly. One axis decides: the number of nodes and the real need for high availability, everything else follows.
Your DNS zone is already an inventory: the log0u7.dns collection
An Ansible dynamic inventory built from DNS records, without zone transfers: TXT manifests, SRV records, DNS-SD (RFC 6763) and naming patterns, resolved in parallel. Plus the reverse converter that turns any inventory into a BIND zone.
Surviving Windows Update in the middle of a build
Disabling updates for the duration of a build, then restoring the exact prior state, under concurrency and crash-proof. Persisted ref counting and a named mutex.
Unix Frugality: do more with less
The `cat | grep` pipe as a cultural marker, apropos and man before everything, the dsniff suite as a design lesson, an auditable bash toolkit against the Rube Goldberg machine and why Kali doesn't teach Linux administration.
An IDS probe cannot see TLS
Suricata labs built on plain HTTP are excellent for teaching, but they hide a major blind spot once in production: encryption. A promiscuous probe sees TLS and can inspect nothing. Where to place inspection instead.
A Backup Without a Restore Test Is Decoration
You don't know whether your backup works until you've restored it. The git clone as a free backup, multiple remotes, Restic/Borg/rclone for the rest and why Btrfs/ZFS snapshots are not backups.
The boot chain, from GRUB to UKI
Why Canonical is trimming signed GRUB for 26.10, why GRUB-encrypted /boot was a false friend and what the modern answer to the Evil Maid attack actually looks like.
A segfault in the JVM and an EDR at the bottom of the stack
A Jenkins controller crash-looping on EXCEPTION_ACCESS_VIOLATION, a JDK migration done with no post-mortem and an EDR DLL showing up at the bottom of every crash dump. How to read a stack honestly and confirm a cause by elimination rather than conviction.
Doing internal ACME without begging the AD CS team
Step-ca, acme2certifier or OpenBao? Three families and the choice depends first on what you already run, then on who must remain the issuer.
Trivy, the scanner that was stealing secrets
On March 19, 2026, the tool meant to protect the supply chain became its vector. The lesson fits in one sentence: a tag is not a trust reference.
A LLM's alignment is a thin layer
Two opposing techniques, one conclusion: an open model's safety does not live in its alignment, it lives in who holds the weights.
Secure Boot and PXE: the chicken, the egg and four ways out
Booting blank Windows machines over PXE with Secure Boot on, without turning it off: the UEFI chain of trust, why snponly over ipxe and four real ways out of the enrollment paradox.
When a Chocolatey checksum breaks a whole provisioning run
A Chocolatey Community package whose vendor updated the binary without the maintainer updating the checksum and the whole Windows provisioning stops. The real subject is not the hash, it is depending on a binary you do not host.
Do you need Kubernetes for a small team ?
A decision grid between full Kubernetes, provider-managed orchestration and an intermediate option, settled by the team's real ability to live with the stack rather than by technical fashion.
Docker vs jails, the honest comparison
The recurring FreeBSD-jails-versus-containers debate misses the point, because it pits a badly measured memory footprint against reality instead of talking about isolation, portability and ecosystem.
myflec: a Bash dotfiles framework for people who deploy their home directory
A loader that sources core modules first, a bare-git backup that pushes to three forges, an rsync deploy with dry-run and automatic backups and SSH identities split per project tree. My home directory framework, explained.
A reverse proxy in front of Perforce, or not: the pros and cons
Four ways to put TLS in front of a Perforce server and what each one costs: nginx layer-4 termination, p4d native TLS, SNI passthrough and the in-house tools P4Broker and P4P. With the client-IP trap everyone forgets.
Nginx in front of Perforce: layer-4 TLS termination and the P4 protocol
Putting nginx in TLS termination in front of a Perforce server: why the stream module and not an HTTP proxy, what the P4 protocol imposes and the keepalive and timeout tuning without which long sessions get cut on multi-hour syncs.
Containers, micro-VMs and Firecracker: why isolation is not what you think
Containers share the kernel. A container escape is a kernel escape. Firecracker micro-VMs bring hardware isolation at container speed. The chroot and the link are two different things.
Terraform creates, Ansible configures
Why IaC and configuration management do not overlap, why Terraform alone only holds in a strictly immutable model and how remote-exec is the signal that you have crossed the line.
fnox and age: encrypted secrets in my repos, no server
fnox, the secrets manager by the author of mise, encrypts secrets straight into the repo with age: a versioned fnox.toml, explicit keys, no secrets server to maintain. A late-2025 discovery.
Portable assembly does not exist
A concrete inventory of everything that changes from one OS to another once you drop down to assembly: assemblers, executable formats, ABIs, calling conventions and system calls. Spoiler, the word portable does not survive the trip.
Security Through Obscurity Is Not Security, Digital Hygiene Is
Twenty years of comments on port knocking, port 22 and photos of house keys: why obscurity alone is vain, why Kerckhoffs doesn't extend everywhere and why the real question is called digital hygiene.
The AI secret language, folklore
The myth of a secret language between AIs, a protocol 80 percent more efficient than human language, is folklore. The demo that launched it, Gibberlink, is nonetheless real: open-source data-over-sound, not a language and that gap is the whole difference between virality and technical reality.
Nginx on Windows in front of Jenkins: the proxy, the logs and the upgrades
Nginx on Windows Server terminating TLS in front of Jenkins: the UI and the WebSocket agents in a single location, the certificate through simple-acme and above all the two operational nuisances nobody writes about on Windows, log rotation and the Chocolatey upgrade.
Clean Code vs Vibe Coding (or how not to end up in the news)
Clean code versus vibe coding: DRY, SOLID, KISS, YAGNI against LLM code generation. And why TDD is the guard-rail vibe coding was waiting for.
vim-plugin-manager: turning a decade of bash into a real Vim plugin
Seven years after the hand-rolled submodule script, the rewrite in VimScript: declarative PluginBegin blocks, parallel background installs, pinning re-asserted from the vimrc and lazy loading that deletes its own placeholders. Episode three of the vim series.
Which identity runs the service and who can prove it
Windows service accounts: managed accounts, least privilege and traceability of what runs under which identity.
PowerShell execution policy and what it is not
PowerShell ExecutionPolicy: what it actually protects, what it does not and the known bypasses.
Driving Windows from Ansible without leaking credentials
Ansible transport to Windows: WinRM, Kerberos over NTLM and how not to carry domain credentials in cleartext.
Hardening WinRM
WinRM hardening: transport, authentication and what to lock down before exposing Windows remote management.
Hardening Proxmox VE
Proxmox VE hardening: web interface access, network separation, clustering and the hypervisor's sshd.
Bare-metal Kubernetes in HA, without kidding yourself
Standing up a highly available bare-metal Kubernetes cluster with no cloud at hand: k0s, an API VIP with no external load balancer, Cilium for the network and the LoadBalancer, Rook-Ceph for storage. Three pieces, not seven.
Kubernetes, or not
Kubernetes is rarely the right first choice. An honest tour of the floors below it: podman and quadlet on one host, docker-compose, Docker Swarm, then docker or podman with Nomad and Consul and the real threshold where Kubernetes finally earns its keep.
Hardening Kubernetes
Hardening Kubernetes: RBAC, PodSecurity, NetworkPolicy, secrets and the attack surface of a loosely scoped cluster.
Hardening Docker Swarm
Hardening Docker Swarm: secrets, encrypted overlay network, node roles and the cluster's exposure surface.
Docker hardening
Docker hardening: the daemon, capabilities, mounts and why a container escape is a kernel escape.
mise: one static binary for all the tool versions
I adopted mise in 2024 to manage per-project tool versions: one Rust binary, asdf's .tool-versions compatibility, per-directory activation that does not crawl and an end to hand-rolled versions in every repo.
Hardening DHCP
DHCP infrastructure hardening: snooping, controlled leases and defense against rogue servers.
SSH Security Hardening: Access Control and Monitoring
Hardening sshd without kidding yourself: no root, nominative accounts, keys only and the monitoring that makes actions accountable.
Hardening DNS infrastructure
DNS infrastructure hardening: views, zone-transfer limits, DNSSEC and resolvers that do not leak.
Docker Swarm to Kubernetes: why I abandoned Swarm
Swarm works well for small deployments. But no rootless, no CSI, no autoscaling and a MACVLAN pinned to a single node: the four walls that forced the migration.
Internal vs external domain separation
Separating trust domains: compartmentalizing roles, accounts and networks to contain a compromise.
Hyper-V S2D vs Proxmox Ceph: the comparison that decided it
Hyper-V + Storage Spaces Direct versus Proxmox VE + Ceph: what performance actually means, TCO and the decision for a fleet of game development studios.
Egress filtering, the control everyone skips
Securing outbound traffic: egress filtering, allow-lists and spotting a service talking to something it should not.
Inbound traffic: expose less and guard what is left
Securing inbound traffic: firewall, minimal exposure, reverse proxy and clean TLS termination.
Network segmentation
Network segmentation and isolation: VLANs, zones, routing and the boundaries you do not cross without a reason.
Resource limits: stopping a machine from being talked into dying
Capping resources before a fork bomb or a leak takes the machine down: pam_limits, cgroups, systemd.
Filesystem hardening
Filesystem hardening: mount options, permissions, SUID, immutable attributes and partition separation.
Recompiling your kernel: bespoke kernels for your own infra
The deepest form of hardening by subtraction: compile your own kernel, strip at build time the subsystems you never use, ship it as a .deb in your own repo with pinning and manage it at scale with Katello. The thrill and its price: a test pipeline on real hardware and canaries.
Linux OS and kernel hardening
OS and kernel hardening: sysctl, signed modules, accounts, sshd and the settings that hold up in production.
Sudo and LOLBins
Why sudoers granularity is theater against GTFOBins and what actually limits escalation: sudoedit, NOEXEC, wrappers, isolation.
Scale-to-zero: Sablier wakes Swarm and Kubernetes on demand
Sablier wakes a sleeping container when someone knocks at the reverse proxy, then scales it back to zero. Scale-to-zero on Docker, Swarm and Kubernetes, with the real Traefik config, the two strategies and the true price of handing it the Docker socket.
The Bastion and Guacamole: the two leaves of the front door
OVHcloud's The Bastion for shell people, Apache Guacamole for desktop people: two approaches to the same question, who may touch what and who looked at what.
The :ro flag on the Docker socket protects nothing
Mounting the Docker socket read-only is a reassuring and perfectly useless ritual. The flag acts at the VFS level, the socket speaks network I/O, the two never meet.
FluoLight: rewriting an inherited Arduino firmware into something defensible
From the 475-line blocking monolith I inherited to 119 lines of protothreading: TimedAction timers, a TCP-fragmentation-proof HTTP parser, compile-time profiles with flash budgets and comments that no longer lie. Episode two of the Fluoboard saga.
One Ansible image for GitLab CI, built right from a Paris basement
Why I stopped using the official Ansible images in CI and built my own on Alpine: multi-stage venv, pinned ansible-core, collections installed at build time. Episode one: the 2022 public release of an image born much earlier, with its honest list of early sins.
Autopsy of an inherited Arduino firmware
A 475-line meeting-room light sketch: hardcoded IPs, 20-second blocking delays, recursive HTTP retries, a local buffer returned by pointer, a reset left to the watchdog. The inherited firmware I started from, dissected with permission, for what it taught me.
SSH in 2021: what thirteen years changed since the 2008 series
This blog's SSH series ended in 2013 with PKCS#8. Here is the 2021 version, complete and secure: Ed25519, FIDO2 keys, certificates, sshd hardening, Include and Match, ProxyJump and multiplexing. What 2008 did hopefully, 2021 does with primitives.
PwnMachine: the self-hosted bug bounty workstation
PwnMachine, the Docker-based pentest workstation for bug bounty, with Traefik, PowerDNS and Let's Encrypt.
Counting CVEs tells you nothing about security
Why lining up CVE counts to declare one system safer than another is a biased argument. A thought experiment with two fictional operating systems and a reminder that most proprietary flaws are neither disclosed nor public.
Docker rootless: the daemon without privileges
Docker in rootless mode, the daemon running as a normal user and why it matters on a multi-tenant server.
3factor: the architecture that removes state from the API
3factor is an architecture pattern, not a framework: realtime GraphQL, reliable eventing and async serverless, with one central idea, removing state management from the API layer.
GitOps, the word after the practice: gitflow, GitLab CI, Terraform and Ansible
The word GitOps has been spreading for a year and I read it recognizing what I was already doing: an adapted gitflow, conventions and a GitLab CI pipeline chaining Terraform to create and Ansible to configure, with git as the only source of truth. GitOps in the broad sense and the honest part of what it is not quite.
Portknocking and SSH tunneling: the magic tricks before WireGuard
WireGuard ships in 2016 and makes two beloved 2008 setups outdated: portknocking (with automatic combination generation, mandatory NTP and an encfs USB key) and SSH tunneling. The era's tone, the in-production demo until 2018 at a hosting provider and why a VPN that says nothing wins.
Chaos engineering: breaking things for real, but not just any way
Chaos engineering is not sabotage: it is a controlled experiment, with a measured steady state, a hypothesis, real faults injected and a bounded blast radius. History, principles, tools and an honest fit for modest infrastructure.
Git submodules by hand: my Vim 8 plugins without a manager
When Debian and Ubuntu shipped Vim 8 and its native packages, I moved my plugin jungle into git submodules plus a 100-line bash script called plugins. The era of manual init/update, auto-commits and the necessary devil.
Twelve-Factor App: the Heroku method that survived containers
Adam Wiggins's twelve factors, written for Heroku in 2011, remain the best checklist for shipping an application as a service: config in the environment, stateless processes, dev/prod parity, logs as event streams, then their translation into containers and Kubernetes.
SSH Hardening: the 2017 Trilogy Reread in 2026
In 2017 I answered a naive SSH hardening article in three comments: root, port, keys. Nine years later the principles hold, the context changed: bastions, native Windows, the client supply chain and the physical threat no config covers.
SSH: ProxyJump and modern multi-hop
ProxyJump, the -J option that arrived with OpenSSH 7.3, replaces the old ProxyCommand + nc for crossing one or more jump hosts. Shorter on the command line, cleaner in config and with no key left lying on the bastion.
Ansible before Ansible: ssh, a CSV and a template engine
Before Ansible existed, there was my 2006-2007 contraption: a host list, an ssh loop, inventory variables in a CSV, pure bash and a template engine whose name I have shamefully forgotten. Assumed archaeology of what worked, what was missing and what Ansible later made explicit.
apt for Vim: the story of vim-apthogen (2012-2016)
Pathogen was dpkg, so I wrote apt: a 225-line bash script with package lists, a curl|bash netinstall and symlinks for enable/disable. The first rung of the ladder that ends at today's vim-plugin-manager.
A DayZ autowalker in Java: decompile, patch for AZERTY, fork afterwards
Young me wanted a DayZ autowalker for AZERTY, had no sources and did not care: JavaDecompiler on the .jar, patch the keycodes, handle the running state, then discover the upstream source and fork it properly. The hidden lesson: in Java, compiled does not mean closed.
SSH: hardening your keys with PKCS#8
Converting SSH RSA keys to PKCS#8 with hardened 3DES encryption, the last article of the original SSH series.
The FOG client: python 2, cron every five minutes and a fleet that rebooted itself into place
Archaeology from before 2013, under my old gobel1 identity: a python2 client for FOG imaging that polled jobs by cron, rebooted unused workstations into imaging, renamed them by MAC address and tracked users through GDM session hooks. Dissected kindly, because it worked for years.
SSH: restricting a connection via private/public keys
The authorized_keys options to confine a passphrase-less SSH key to a single task.
SSH: multiple authentication with private/public keys
Using multiple SSH keys with distinct identities, one per server and avoiding Too many authentication failures.
Debsecan: Debian Security Analyzer
Debsecan, the tool that generates the list of vulnerabilities affecting a Debian installation, complementary to apt-listbugs.
Dennis Ritchie has left #world
The tribute to Dennis Ritchie, creator of C and co-developer of Unix, with the C code that says goodbye. And the contrast with the media coverage of the previous week.
(Re)Opening
The blog reopens after two years of inactivity and the passage that announced backdating.
Chat: from irssi + messenger gateway to weechat, the thin-client philosophy
The complete arc: irssi and its BitlBee gateway to the messengers (MSN and friends), then the migration to weechat, its scripting API and its relay. What survived every change: the gateway, not the client.
tmux: the multiplexer that took the chair
After Screen (1987) and byobu (2009), the tmux article: client-server, native panes, UTF-8 from day one, readable configuration. Why the OpenBSD newcomer ended up replacing Screen and what you lose by not knowing both.
The R.A.C.H.E method: Rapid Application Conception and Heuristic Extreme-programming
Rapid Application Conception and Heuristic Extreme-programming: the satirical method from the International Institute of La RACHE formalises what everybody already practises, with an eight-word post-it to scope the project and a FAQ that tells the truth.
DevOps, a word for what I was already tinkering with
The word DevOps is starting to circulate and I recognise in it what I was tinkering with at my own small scale: ssh and a CSV, git and bash hooks, gitolite on top. What it brings to mind and the honest part about why the wall never bothered me much.
Puppet: my first modules, or moving from the ssh loop to declaring
After my bash scripts and my CSV inventory, Puppet: the install/config/service triad, $::operatingsystem selectors and require/notify chains. What declaring brings to the ssh loop.
Haproxy: the reverse proxy that took over from Pound
After Pound (the 2008 article), the floor above: haproxy 1.3, TCP and HTTP modes, ACLs, backends and health checks, the stats page. What a reverse proxy must know how to do before being credible.
IRSSI: IRC with the works
Irssi, the console-mode IRC client and its config that lives on github.
Byobu: screen with a coat of polish (and a status bar that saves)
The missing little article between Screen and tmux: byobu, Ubuntu's screen-profiles turned standalone project in 2009. An informative status bar, F-key shortcuts and proof that a terminal multiplexer did not need to be a gamble.
Bash: Geolocation, the trilogy
Bash geolocation, from netcat to /dev/tcp. V1 was lost with the disk, v2 is the revenge of netcat, v3 is the revenge of bash.
NTP: time synchronization over the network
NTP, the protocol that synchronizes clocks and why it matters when your scripts depend on the time.
Portknocking: automatic combination generation
Automatic portknocking sequence generation from the system date, with mandatory NTP and an encrypted USB key.
Bash: customizing the .bashrc file
Prompt colors, timestamped history, the most pager and a collection of namespaced aliases. A 2009 admin's .bashrc, as it was.
Screen: a terminal multiplexer
GNU Screen, the multiplexer that lets multiple text-mode programs run simultaneously from one interface and survive logout.
Apache: URL rewriting
Mod_rewrite, Apache's URL rewriting engine and the rules that turn ugly URLs into clean ones.
SSH: secure rsync
Rsync over SSH, incremental backup on the encrypted channel.
SSH: SSH filesystem
Sshfs, mounting a remote filesystem via SSH and FUSE.
htop: top's replacement
Htop, the process monitor that does what top does but in color, scrollable, with a tree view showing who spawned whom.
tsocks: let's proxy
Tsocks, the LD_PRELOAD library that forces any program through a SOCKS proxy, without modifying the code.
Pound: a very light reverse proxy
Pound, the reverse proxy that terminates TLS and balances to a pool, before haproxy took over.
Polipo: an ultra-simple proxy
Polipo, the web cache proxy in 1000 lines of C and why you use it behind an SSH tunnel.
Subversion: installation and usage
Subversion, the centralized VCS that replaced CVS and preceded Git. Installation, svnserve, hooks and the checkout-commit-update workflow.
Bash: IP address obfuscation
Representing an IP address in decimal, hexadecimal, octal and what it changes for logs.
Fail2ban: fighting bruteforcing
Fail2ban, the bouncer that bans IPs trying to brute-force your services, by reading the logs.
OpenDNS: the free DNS
OpenDNS, the public resolvers that preceded Google DNS and Cloudflare and the question of the trusted third party.
Subversion: a WebSVN with mod_dav and mod_svn for Apache
Exposing an SVN repository via Apache with mod_dav_svn and WebSVN for source browsing.
ext3: accelerate your disk accesses
Noatime, data=writeback, journal mode and the three fstab options that halve your disk latency.
Compiling a shell script with shc
Shc, the shell script compiler and why this is NOT encryption.
Debian Etch: play with backports
Debian backports, how to get recent packages on a stable distribution.
ArpON: watching your ARP cache
ArpON, the daemon that blocks ARP cache poisoning attempts where Arpwatch only reports them.
EncFS: file encryption without a dedicated partition
EncFS, the FUSE encryption that encrypts file by file without a partition, without LUKS, without reinstalling.
radare: a very complete debugger
Radare, the console-mode binary analysis framework and why you do not go back to GDB after.
Yersinia: how to make your network administrator sick
Yersinia, the layer 2 protocol attack framework and why your switch does not protect you the way you think.
SNMP: a not-so-simple protocol
SNMP, the protocol that monitors the network, its OIDs, its public/private communities and the MIBs nobody reads.
tcpdump: frame analysis and BPF filters
Tcpdump to read the network byte by byte and BPF filters that turn a packet flood into a single question.
Nemesis: detecting a network sniffer
Detecting promiscuous-mode cards on your network, the defensive side of the packet forge.
Nemesis: network packet forge
Nemesis, the tool that forges any TCP/IP packet from the command line, without writing C.
Raw Sockets: forging and sniffing packets in C
The sockets memo, continued: AF_PACKET, SOCK_RAW, the iphdr and tcphdr structs, manual checksums, promiscuous-mode sniffing and SYN packet forging. What tcpdump and Nemesis do, written by hand, as root, with ethics and humor.
Sockets: speaking TCP in C, no framework, no magic
An era memo in C: socket(), bind(), listen(), accept(), connect(), the sockaddr_in structs, byte order and a fork() per connection. How to write a TCP server and client in sixty lines, on a Debian Etch, with only the man pages for friends.
Linux: introduction to LKMs
Loadable Kernel Modules, how the Linux kernel loads code at runtime and what it means for security.
Linux syscalls
Syscalls, the boundary between user space and the kernel and how to observe them with strace.
SSLH: ssh and https on the same port
A 2007 memo: sslh multiplexes ssh and https on port 443, the only port of paranoid firewalls. How it works, what it allowed and why (edit 2026) nobody would put it in production today.
PAM: limit system resources
PAM limits, the module that caps resources per user before the process eats all the RAM.
SSH: tunneling
SSH tunneling, making any protocol cross the encrypted channel.
MySQL: backup
Mysqldump, the backup cron and the restore test nobody does.
MySQL: lost credentials
Regaining control of MySQL when the root password is lost, in three commands and one restart.
MySQL: Memento
The MySQL memo for admin commands you rarely type but always type in emergencies.
Apache: what a chatterbox
The Apache LogLevel, combined log formats and why the access_log tells you everything your users do not want you to know.
Apache: the limits of .htaccess
.htaccess is a Swiss Army knife for shared hosting, but on a dedicated server it is a slowdown visible in the logs.
Apache: disabling the TRACE option
The HTTP TRACE method enables XST (Cross-Site Tracing) and one Apache line cuts it.
SSH: authentication via private/public keys
SSH keys, the password alternative that is also an authorization mechanism.
Magic SysRq: the sysadmin's crutch
The kernel SysRq key, the REISUB sequence and why it is the last thing you do before pulling the plug.
iodine: IP-over-DNS, or the internet where only DNS passes
Iodine 0.3.1, the IPv4-over-DNS tunnel and the captive portal that only filters HTTP but resolves any name. The portal gives you DNS, therefore it gives you the internet.
dig: the Domain Information Groper, or the art of asking a name server
Dig versus nslookup, the anatomy of a DNS response read flag by flag, compared SOA records to check zone propagation and AXFR as an audit tool. The tool that would test a tunnel the following month.
Links: hard links and symbolic links and what escapes the chroot
The two link types in Linux, their difference at the inode level and why a symlink inside a chroot can escape it.
SSH: where is the fish?
The KDE fish protocol, the file transfer over SSH that Konqueror does natively.
Root or not root
Su, sudo and the question of who gets to do what on a shared system.
Bash: Memento
The bash memo for commands you never forget but forget all the time. Substitutions, expansion, redirections, the basics in one block.