Page 7 - Linux

Behind every login on Linux, whether via SSH, sudo or a local console, sits a configurable stack of authentication modules. PAM fully decouples applications from the concrete authentication logic and makes it possible to set up login lockouts, password policies and two factor procedures without changing a single line in the application itself.

iptables has shaped Linux firewalls for two decades, but it hits clear limits with large rule sets and complex logic. nftables replaces iptables, ip6tables, arptables, and ebtables with a single, consistent framework featuring native sets, atomic updates, and noticeably better performance at scale.

Raw ANSI escape codes like \e[31m look fine in your own terminal, but break the moment a script runs on a different terminal type or its output gets redirected into a log file. tput instead queries the current terminal's actual capabilities and returns the matching escape sequence, while a simple isatty check makes color vanish automatically once nobody is reading it interactively anymore.

Anyone who only knows the ext4 versus XFS comparison misses the real payoff of Btrfs: subvolumes as independently managed file trees, and snapshots that appear in milliseconds thanks to copy on write. Used correctly, this becomes a safety net before every risky deployment, without a separate backup tool.

Podman promises a compatible replacement for Docker while deliberately dropping the root-owned background daemon and enabling containers that run entirely without root privileges. For hosting environments serving multiple customers on one server, that is not a cosmetic detail but a fundamentally different security model that directly shapes attack surface and blast radius.

A critical kernel CVE traditionally forces a reboot with a downtime window, even when the affected server is really just a single, highly available member of a database cluster. Kernel live patching through kpatch or commercial offerings like Canonical Livepatch closes exactly that gap, but it never replaces the regular reboot cycle needed for larger kernel upgrades.

Most successful attacks on Linux servers exploit open SSH password logins, missing firewall rules, and outdated packages, not sophisticated zero-day exploits. This article shows a practical hardening baseline that closes most of the attack surface with minimal effort, without making operations unnecessarily harder.

A correctly configured firewall is the first line of defense for any server on the internet. This article shows in practice how iptables works as the kernel packet filter, how ufw sits on top as a simple frontend, which baseline rules a production web server actually needs for SSH, HTTP, and HTTPS, and how to reliably verify that these rules stay active and survive every reboot intact.

A single disk is always just a matter of time. RAID with mdadm spreads data redundantly across multiple disks, so a disk failure does not immediately take the server down but can be fixed while the system keeps running.

Not every team has Grafana or an ELK stack available when they need to know fast how many errors a service is producing right now. A Bash terminal dashboard built from watch, tput, and ANSI color codes shows error rates, request rates, and log levels live, right inside the SSH session, without a browser and without additional infrastructure.