Page 6 - Linux

Standard Unix permissions do not stop a compromised process from reading everything the running user is allowed to read. Mandatory Access Control adds a second, kernel enforced barrier in front of that. This article compares SELinux and AppArmor, explains label based and path based policy with real examples, and shows how to reliably diagnose a MAC caused permission denied.

Bash ships with a built-in tool for checking whether a TCP port on another host is reachable, through the pseudo file /dev/tcp, with no need for netcat, nmap, or an extra package. For simple reachability checks in monitoring and deployment scripts that is often plenty, but for real security analysis or large network ranges it is the wrong toolset.

A failed disk, a destroyed bootloader, or a complete hardware failure usually hits teams without warning. Bare metal recovery is the discipline of rebuilding a server from nothing, including partition table, bootloader, and operating system, with no working base install left to rely on. Teams that plan and rehearse this case in advance need hours instead of days.

GRUB2 is the last piece of software standing between firmware and kernel on most Linux servers, yet it usually only gets touched once, during installation. Anyone who needs to set kernel parameters permanently, maintain a clean multi kernel setup, or get a server booting again after a failed update needs a solid grasp of /etc/default/grub, grub2-mkconfig, and the rescue shell.

Bash loads a different combination of configuration files on every start, depending on whether it runs as a login shell, an interactive non-login shell, or a non-interactive script execution. Anyone who writes PATH extensions or environment variables into the wrong file gets a locally working setup and later wonders why that exact same variable is suddenly missing in a cron job or deployment script.

The kernel writes every important message, from hardware detection at boot to the OOM killer during live operation, into an internal ring buffer that dmesg makes readable. Anyone who masters kernel log analysis with dmesg finds driver failures, memory problems and hardware defects often minutes before they show up as an application outage, instead of searching for the cause only afterward.

sysctl makes hundreds of kernel parameters changeable at runtime, but a value set only with sysctl -w disappears again on the next reboot. This article shows how changes become permanent through /etc/sysctl.d, which parameters actually matter for a busy web server such as connection backlog, file limits and swappiness, and why blindly copying someone else's tuning guide often does more harm than good.

A dashboard shows 40 percent CPU usage, yet timeouts and latency spikes keep piling up. The contradiction almost always resolves itself once you look at cpu.stat: the container is being throttled long before its average usage comes anywhere near a limit.

Servers where sudo is granted blanket ALL=(ALL) ALL access blur the line between a regular user and root entirely and make every privilege grant impossible to control. This article shows how to edit sudoers safely with visudo, how readable aliases enable narrow grants, when NOPASSWD is justified, and how complete logging keeps every privileged command accountable.

A server that hangs at three in the morning does not send an alert, it stops sending anything at all. A watchdog timer is the last line of defense for exactly that case: an independent timer that triggers an automatic reboot as soon as the system stops confirming it regularly. For unattended Magento hosting servers, where nobody can step in at three in the morning, a correctly configured watchdog is the difference between a brief reboot and hours of downtime until the next business day.