tag: #sysadmin

shutdown is the command operators reach for out of habit when they want to bring a system down. For the common case (a single-user workstation, a headless server, an ad-hoc maintenance window), halt does the same orderly shutdown with less ceremony and a simpler invocation. The reason shutdown won the muscle memory is historical and no longer applies on modern systemd systems.

A chunk-store backup that was projected to take ten days for sixty six gigabytes. The protocol was CIFS over rsync. The fix was rclone over SFTP with parallel transfers. The same data, the same network, the same off-site target, moved 280 times faster. The reason is a protocol property that does not show up in any "which backup software" comparison but that decides whether your backup can actually finish before tomorrow.

The default Debian installer is competent. It is also opinionated. It makes a dozen choices on your behalf that you would probably make differently if you knew you were making them. The Expert Install is not for elite users. It is for anyone who wants to know what their system actually contains the moment after first boot.

This afternoon the primary Proxmox hypervisor in the homelab refused to boot. Several VMs went offline. Hours of recovery later, every service was back up and no VM data had been lost. This post is the writeup of what failed, what saved the data, and the three hardening layers that have been permanently added so that the next incident in this family does not reach the "blind boot from a serial console" stage.

Copy Fail, Dirty Frag, Fragnesia, ssh-keysign-pwn - four Linux kernel root exploits in three weeks. The kernel is fine. The admins are not.

When CVE-2026-31431 dropped on April 29 with a public proof-of-concept and no vendor patches available, every Linux machine in the homelab was affected. Two weeks later the OpenSSH GSSAPIKeyExchange flaw shipped as DSA-6204-1 and the question arose again. This post is the short writeup of how Ansible turned both incidents into routine work.

eBPF is the most interesting thing to happen to the Linux kernel in the last decade and one of the least understood.

Production debugging is not a data-gathering problem but a reading problem, because most systems have already written down what is broken if you know where to look.

Stretch is out, dedicated to Ian Murdock, with over 90% of packages now reproducible, MariaDB instead of MySQL, and the modern GnuPG by default. It also renames your network interfaces out from under you, which is how a routine upgrade locks you out of your own server. Here is what is worth caring about, and what to check before you reboot.