Page 4 - Linux

Most successful attacks on Linux servers exploit open SSH password logins, missing firewall rules, and outdated packages, not sophisticated zero-day exploits. This article shows a practical hardening baseline that closes most of the attack surface with minimal effort, without making operations unnecessarily harder.

A correctly configured firewall is the first line of defense for any server on the internet. This article shows in practice how iptables works as the kernel packet filter, how ufw sits on top as a simple frontend, which baseline rules a production web server actually needs for SSH, HTTP, and HTTPS, and how to reliably verify that these rules stay active and survive every reboot intact.

A single disk is always just a matter of time. RAID with mdadm spreads data redundantly across multiple disks, so a disk failure does not immediately take the server down but can be fixed while the system keeps running.

Bare metal, virtual machines and containers form a spectrum of isolation, overhead and deployment speed, not a simple either-or decision. This article explains when full hardware control is necessary, when hypervisor isolation makes sense for multi-tenancy, and when containers are the faster choice, along with the hybrid approach that most production hosting setups actually run to balance cost, security and operational effort.

Not every task requires a machine that keeps running around the clock. With rtcwake, Linux puts a machine into a targeted power saving state and wakes it back up via an RTC alarm at exactly the desired moment, to perform a task and then switch back into idle mode afterward. This article explains how rtcwake works, the required prerequisites in BIOS and kernel, and automation for backup windows, energy savings, and test infrastructure.

Cron has been the standard for scheduled tasks on Linux for decades, but it hits clear limits around dependencies, logging, and error handling. systemd timers offer a far more observable alternative with OnCalendar syntax, journalctl integration, and automatic retry, and can be introduced step by step through a concrete migration.

A reindex, a backup, or a large cron job competes directly with PHP-FPM workers for the same CPU time and the same disk access without deliberate priorities. nice and ionice allow deliberately deprioritizing background jobs, so they only get resources when the web server does not currently need them.

Adding a third-party repository without scrutiny hands a stranger's signing key root access on your own server. This article shows how GPG signatures actually work under APT and DNF, why PPA installer scripts deserve a read before you run them, and how to systematically audit the package sources already configured on your systems.

The proc filesystem is not a collection of ordinary files, it is a virtual window straight into the running Linux kernel. Knowing which files under /proc/[pid] and /proc/sys actually matter lets you read process state, CPU load, memory usage and kernel parameters without relying on top, ps or sysctl, while understanding exactly how those tools work internally.

Scrolling through log files at random during an incident wastes valuable time. journalctl brings every systemd log into one place and offers precise filters by service, time range, and severity. This article shows how to combine filters, make the journal persistent, correlate services during an outage, and export logs cleanly for teammates.