Page 19 - Linux

A Magento production server is only as secure as its least hardened service. This article shows, hands-on, how to systematically shrink the attack surface by disabling unneeded services, automating security updates, enforcing non-root execution, correcting file permissions, running fail2ban, and hardening SSH, with a direct tie-in to the Mark Shust docker-magento setup and typical Debian or Ubuntu production environments.

Running docker run --memory=512m --cpus=1.5 makes Docker simply write a few values into plain text files under /sys/fs/cgroup. Once you have read those files yourself, resource limits stop looking like Docker magic and start looking like what they really are: kernel mechanics.

Bash's built-in globbing can do far more than the simple asterisk pattern in most beginner scripts: shopt -s extglob unlocks extended patterns like alternation and negation, globstar enables recursive ** matching across whole directory trees, and nullglob prevents the classic bug where a pattern with no match gets passed through literally as a filename.

On multi-socket servers, not every byte of RAM is equally close to every CPU. NUMA describes exactly this asymmetry, and anyone running MySQL or PHP-FPM without regard for NUMA nodes risks silent latency losses that no single application-level setting can explain.

rkhunter and chkrootkit compare known rootkit signatures, file permissions, and process lists against a stored reference state of the system. This guide shows how to install both tools, set them up as a recurring baseline check via cron, and correctly interpret a positive finding without creating a false sense of complete detection.

A monitoring alert reports a Load Average of 12 on a server with four cores, yet CPU utilization barely reaches 20 percent. Anyone who reflexively buys more cores here often fixes the wrong problem. This workflow shows how to trace Load Average layer by layer back to its actual cause using uptime, vmstat, pidstat and iostat.

The PHP-FPM process manager decides how many parallel requests a Magento server can handle before requests start queuing up or too many workers exhaust available memory. Setting pm.max_children by gut feeling risks either wasted capacity or an out of memory crash under load.

MySQL already caches database pages in the InnoDB buffer pool in RAM. If the Linux kernel simultaneously uses its own page cache for the same data, double buffering occurs: the same memory content sits twice in RAM without any extra benefit. O_DIRECT deliberately bypasses the page cache and hands full caching control to InnoDB, while buffered I/O remains the more pragmatic choice in certain scenarios.

Standard logs like syslog or journald only show what applications choose to log themselves, not who changed /etc/passwd or how a process elevated its privileges. auditd hooks directly into the Linux kernel audit subsystem, logs syscalls and file access without gaps, and makes changes forensically traceable with ausearch and aureport, including rules for sensitive configuration files and privilege escalation.

Anyone who sees free -h for the first time often mistakes their system for being short on memory, because buff/cache appears as used. This article explains how the page cache puts idle RAM to work for performance, why swap is an overflow mechanism rather than primary memory, and how to read proc meminfo for an accurate picture of the real memory state.