Linux
guest@6admin.io:~$ ls ~/tags/linux
man sheep.exe
The pixel sheep, Conway, famine and corpses that fertilize the grid: the entry points to explore the maintenance page without spoiling its exits.
Linux is just the kernel
A useful bit of pedantry about what Linux actually is, then the substantive point: the layers people use to rank sysadmin profiles measure the distribution, not the system and the kernel stays the common denominator.
Unix Frugality: do more with less
The `cat | grep` pipe as a cultural marker, apropos and man before everything, the dsniff suite as a design lesson, an auditable bash toolkit against the Rube Goldberg machine and why Kali doesn't teach Linux administration.
Filesystem hardening
Filesystem hardening: mount options, permissions, SUID, immutable attributes and partition separation.
Recompiling your kernel: bespoke kernels for your own infra
The deepest form of hardening by subtraction: compile your own kernel, strip at build time the subsystems you never use, ship it as a .deb in your own repo with pinning and manage it at scale with Katello. The thrill and its price: a test pipeline on real hardware and canaries.
Linux OS and kernel hardening
OS and kernel hardening: sysctl, signed modules, accounts, sshd and the settings that hold up in production.
The :ro flag on the Docker socket protects nothing
Mounting the Docker socket read-only is a reassuring and perfectly useless ritual. The flag acts at the VFS level, the socket speaks network I/O, the two never meet.
SSH in 2021: what thirteen years changed since the 2008 series
This blog's SSH series ended in 2013 with PKCS#8. Here is the 2021 version, complete and secure: Ed25519, FIDO2 keys, certificates, sshd hardening, Include and Match, ProxyJump and multiplexing. What 2008 did hopefully, 2021 does with primitives.
The FOG client: python 2, cron every five minutes and a fleet that rebooted itself into place
Archaeology from before 2013, under my old gobel1 identity: a python2 client for FOG imaging that polled jobs by cron, rebooted unused workstations into imaging, renamed them by MAC address and tracked users through GDM session hooks. Dissected kindly, because it worked for years.
tmux: the multiplexer that took the chair
After Screen (1987) and byobu (2009), the tmux article: client-server, native panes, UTF-8 from day one, readable configuration. Why the OpenBSD newcomer ended up replacing Screen and what you lose by not knowing both.
Haproxy: the reverse proxy that took over from Pound
After Pound (the 2008 article), the floor above: haproxy 1.3, TCP and HTTP modes, ACLs, backends and health checks, the stats page. What a reverse proxy must know how to do before being credible.
Byobu: screen with a coat of polish (and a status bar that saves)
The missing little article between Screen and tmux: byobu, Ubuntu's screen-profiles turned standalone project in 2009. An informative status bar, F-key shortcuts and proof that a terminal multiplexer did not need to be a gamble.
Bash: customizing the .bashrc file
Prompt colors, timestamped history, the most pager and a collection of namespaced aliases. A 2009 admin's .bashrc, as it was.
Screen: a terminal multiplexer
GNU Screen, the multiplexer that lets multiple text-mode programs run simultaneously from one interface and survive logout.
htop: top's replacement
Htop, the process monitor that does what top does but in color, scrollable, with a tree view showing who spawned whom.
tsocks: let's proxy
Tsocks, the LD_PRELOAD library that forces any program through a SOCKS proxy, without modifying the code.
Pound: a very light reverse proxy
Pound, the reverse proxy that terminates TLS and balances to a pool, before haproxy took over.
Polipo: an ultra-simple proxy
Polipo, the web cache proxy in 1000 lines of C and why you use it behind an SSH tunnel.
ext3: accelerate your disk accesses
Noatime, data=writeback, journal mode and the three fstab options that halve your disk latency.
EncFS: file encryption without a dedicated partition
EncFS, the FUSE encryption that encrypts file by file without a partition, without LUKS, without reinstalling.
Raw Sockets: forging and sniffing packets in C
The sockets memo, continued: AF_PACKET, SOCK_RAW, the iphdr and tcphdr structs, manual checksums, promiscuous-mode sniffing and SYN packet forging. What tcpdump and Nemesis do, written by hand, as root, with ethics and humor.
Sockets: speaking TCP in C, no framework, no magic
An era memo in C: socket(), bind(), listen(), accept(), connect(), the sockaddr_in structs, byte order and a fork() per connection. How to write a TCP server and client in sixty lines, on a Debian Etch, with only the man pages for friends.
Linux: introduction to LKMs
Loadable Kernel Modules, how the Linux kernel loads code at runtime and what it means for security.
Linux syscalls
Syscalls, the boundary between user space and the kernel and how to observe them with strace.
PAM: limit system resources
PAM limits, the module that caps resources per user before the process eats all the RAM.
Magic SysRq: the sysadmin's crutch
The kernel SysRq key, the REISUB sequence and why it is the last thing you do before pulling the plug.
Links: hard links and symbolic links and what escapes the chroot
The two link types in Linux, their difference at the inode level and why a symlink inside a chroot can escape it.
Root or not root
Su, sudo and the question of who gets to do what on a shared system.