Tag: sysadmin

fstrim vs discard: Keeping SSDs Fast

Run fstrim.timer, skip the discard mount option on ext4 and XFS, then check LUKS, VMs, and LVM for layers that silently swallow TRIM. Measured demo included.

systemd DynamicUser: No useradd Needed

systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.

polkit Rules: Restart a Service, No sudo

Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.

systemd Credentials: Secrets Without Env

Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.

systemd-run: Units Without Unit Files

systemd-run starts transient services, scopes, and timers with resource limits and sandboxing, no unit file needed. Replace nohup, at, and ulimit habits.

sudo vs doas vs run0 on Linux

sudo, doas, and run0 all get you root. We compare how each one works, the config syntax, the attack surface, and which one belongs on your home-lab server.

Lynis: Reading a Hardening Audit Report

Run Lynis 3.1.7, read the warnings, suggestions, test IDs and hardening index, fix the findings that matter, silence the rest, and track the score weekly.

coredumpctl: Debug a Crash-Looping Service

Your service dies and restarts forever. Read the core dump instead of the restart log: coredumpctl, gdb, debuginfod, storage limits, and Docker containers.

systemd-tmpfiles: Runtime and Cache Dirs

Service dies after reboot because /run/myapp vanished? Learn tmpfiles.d line types, Age cleanup, overrides, and when RuntimeDirectory= is the better pick.

Firewall Rule Audit: Find the Dead Rules

Find unused firewall rules on a Linux box with nftables counters, then retire them safely with a snapshot-and-diff routine, a jq script, and a systemd timer.

zstd vs lz4 vs gzip vs xz: Measured

zstd -3 compresses 4 to 6x faster than gzip -6 with smaller files. At the top end, xz -6 beat zstd -19 on speed. 19 configs, 4 public data sets, measured.

journald Structured Logging, No ELK

journald already stores structured key/value log fields. Learn to write custom fields, query them, and ship logs to one box before reaching for Loki or ELK.