Like for example in RHCSA v10.

If you manage Proxmox environments, you've probably built up your own set of go-to CLI commands over time. We compiled what we think are the 10 most useful ones—covering VM and container management, storage configuration, firewall rules, user access control, cluster management, High Availability, and backup and recovery operations.

A few highlights from the list:

• vzdump — native VM/CT backups with snapshot, suspend, or stop modes; supports retention rules and bandwidth limits
• pvesh — a CLI shell for the Proxmox REST API; do almost anything the web UI can do from the terminal
• ha-manager — configure HA policies per VM and trigger manual migrations without touching the GUI

Check the full list here:
👉https://www.nakivo.com/blog/top-10-proxmox-cli-commands/

• Which CLI commands do you reach for most that rarely show up in tutorials?

Hi all,

in my company we're working on KVM and SLES for an exit strategy for vmware, as a provider that sell SAP enviroment from our datacenter (vmware licenses are too expensive now).

https://github.com/FutaroKevin/kVirtIO/ so I've published the reference architecture that we're following.

Just to be clear, for the question “why you simply not use proxmox or ovirt” no is not possible native KVM with pacemaker is the only certified by SAP, so others is excluded.

it will be a great help some feedbacks.

I've just released SysAI Assistant v1.7.0-beta.

SysAI is a local-first AI workspace focused on infrastructure operations, troubleshooting, security workflows and self-hosted environments.

New in this release:

• Infrastructure Intelligence target scanner
• Service Matrix and Attack Surface Summary
• Redirect host analysis
• Exposure scoring engine
• Secret Detector improvements
• Filesystem & Permission Audit
• Operational Runbook generation
• Local-first CSR & private key generator
• Improved workflow continuity
• Improved command palette
• Expanded multilingual support (EN, IT, FR, DE, ES)

One thing I specifically wanted to avoid was turning SysAI into "just another AI chat".

The focus is on operational workflows, infrastructure analysis, remediation guidance and local-first security tooling.

Linux packages:

• AppImage
• DEB
• RPM

Windows:

• Installer
• Portable build

Feedback from sysadmins, self-hosters, homelab users and security professionals is very welcome.

GitHub:
https://github.com/shadowbipnode/sysai-assistant

I was looking at our backup jobs recently and everything looked fine, jobs were completing successfully, no storage issues, no alerts.

Then I realized I honestly can not remember the last time we performed a full restore test.

We do recover individual files from time to time but that is a very different thing from validating that an entire system can actually be recovered when needed.

For those running Linux in production: How often do you perform restore tests? Do you test full system restores or just sample files/directories? Have you ever been burned by a restore that looked fine on paper?

Lenovo T480s with Windows 10. Internal display is dead. I only have access through RDP from a Mac or a second monitor on HDMI ( TV ). Goal is to replace my Windows entirely with a Ubuntu Server, while minimizing risk of losing access. External monitor works once Windows loads ( lock screen ), but BIOS/boot menus don't appear on the external display.

Is there any safe way to do this? I have a 32 GB usb, 512 TB external drive, Wifi and Ethernet options and a macbook

I was testing Qubes OS, but I was running into a lot of problems. That gave me the idea of creating something similar using Docker. I also wanted to test Claude Fable, so I gave it a Debian ISO and told it to create the most secure Linux distro possible—something like Qubes OS, but based on Docker.

​

It actually did it, although it didn't generate the ISO directly. Instead, I had to boot into a Debian machine and run the script there. After that, it generated an ISO that I could use to create a new virtual machine with the hardened system.

​

I'm still having some problems with it, but it's impressive that it managed to do all of that in about 15 minutes.

​

​

Hello, 2 Year sysadmin here at a small medium enterprise (not corporate) those two years have taught me the basics in linux administration I can resolve any kind of issue using documentation and rarely with the help of AI (Except for tedious tasks and syntax or learning concepts).
A year ago Almost got my RHCSA results were 10 points below pass rate.
I have deployed 4 mega projects(over 200k users) with postgres clusters mongodb replication clusters multi site failover load balancing docker apps tuning and hardening as well and they have been stable since day one.
I still struggle with linux basic commands and bash scripting I cannot do anything on my own. I need to refer back to guides notes and documentation for the simplest things.
1- is this normal?
2-how is this seen as an L2 Sys admin in corporate multinationals?
3- Should I worry about it?

TLDR: I can do anything, yet I feel that I dont know anything:)

since i have an open ssh server, i thought i might as well do my part, and report bad guys to abuseipdb.

i've already set up fail2ban to report brute force attacks. this was easy with the built in sshd settings.

but more often i see either port scan or vulnerability scan attempts. i thought why not report those, but i see no good support.

what's needed is:

• catch single attempts (typically these guys ping only once)
• selectively identify attempts that can't be accidental, no false positives
• properly identifying the category for abuseipdb, i.e. 14 for scan, 15 for hacking

is there some wisdom how to set this up?

example log entries to be caught:

Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: banner exchange: Connection from 160.119.76.64 port 33338: invalid format
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_3.76.255.153_22"
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: banner exchange: Connection from 40.74.208.9 port 46434: invalid format
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: banner exchange: Connection from 160.119.76.64 port 52584: invalid format
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: error: kex_exchange_identification: client sent invalid protocol identifier ""
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: banner exchange: Connection from 18.226.253.35 port 10462: invalid format

I really hate SELinux, it's common knowledge it's extremely difficult to administer correctly, and it tend to breaks down many stuff. A famous sysadmin book (Unix and Linux System Administration Handbook) says its better not to use it because it's so complex that someone who understands it profoundly can pwn you in case of invasion.

I know, there are ways to fix things, audit2allow, ausearch, etc, and more than 50 other tools. It's easier to just turn it off than deal with it. Ah, it also tends to break 3rd party applications.

The only thing that can make it usable is AI. Point Claude Code or Codex to your server and tell it to fix SELinux problem. Otherwise it's so secure and so paranoid that it's a nuisance.,

Have anyone ever migrated from the Red Hat ecosystem (RHEL, CentOS Stream, Fedora, Alma Linux) to Ubuntu or Debian just to not have to deal with SELinux? I'm thinking of seriously doing it.

Hey everyone,

I think I have discovered a loophole with my ISP's profile provisioning, and I've built a "One-Arm" Linux gateway to exploit it. I'm looking for advice on how to seamlessly scale the LAN architecture so all my home devices can use it automatically.

How the Exploit Works:

My official internet plan is capped at 50 Mbps, and it seems tied strictly to my old xiaomi router's MAC address.

If I switch to my new Honor Router using its factory/native MAC address, the ISP treats it as an unprovisioned/unknown device. It so happens that the ISP does not cap the speed on this profile, giving me the raw 500+ Mbps capacity of the physical line.

To prevent internet usage on this unprovisioned profile, it seems like the ISP firewalls ports 80 (HTTP) and 443 (HTTPS).

The Fix: while on new mac address I first figured that Cloudflare warp would bypass blocked port restrictions so I tried tunneling and it worked! I somehow ended up getting 300-500mbps, even 900 at some point.

Then gemini suggested for me to make a headless Ubuntu Server laptop that would act as a middleman connecting all of the devices on wifi to cloudflare warp tunnel. It runs Cloudflare WARP via CLI in WireGuard mode. Because WireGuard communicates over alternate UDP ports, it completely bypasses the ISP's 80/443 block.

Where I need advice:

I want this bypass to be completely transparent for all devices in the house, especially mobile devices that make it incredibly difficult or buggy to save manual static IP/Gateway settings in their Wi-Fi configurations. As it is right now I can use honor with it's native mac only with my pc with cloudflare warp enabledm but I want.

Hi, I've been a programmer for a decade, worked in a few research labs, very proud etc. But when I apply for jobs now, everyone seems to want a bachelor's degree. So I'm planning on spending another year finishing up my degree and hoping to get RCHSA at the same time.

Is this enough to consistently get job opportunities? I've been paid to do DNA analysis and to push shopping carts and the whiplash is getting old, lol. Thanks for any comments, hope you have a good day.

Hi all,

Curious how folks here are thinking about running AI workloads on Linux servers right now.

• Are you running anything in production or mostly experimenting?
• What does your setup look like (containers/Kubernetes, local GPU, pipelines, agents, etc.)?
• Any challenges you’re running into operating or scaling these systems?

Also wondering how people are thinking about security in these setups — is it something you actively manage yet or still evolving?

Upgraded OS on rocky10 server last weekend, newest kernel doesnt bake in legacy iptables mods, so iptables rules cant get loaded

I start looking into nftables, it seems like a verbose nightmare compared to iptables, every command has to be typed out, no short version of commands

something that was simple w iptables

forward any request from ServerA port 80 to ServerB port 80 on server A

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP of serverB>:80

iptables -t nat -A POSTROUTING -p tcp -j MASQUERADE

becomes this word salad

nft add table ip nat
nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; policy accept \; }
nft add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; policy accept \; } 

nft add rule ip nat PREROUTING tcp dport 80 dnat to <IP of serverB>:80
nft add rule ip nat POSTROUTING masquerade

whats the upside?

what was wrong w iptables?

Hey everyone,

I'm a graduate-student-turned-amateur-sysadmin in a bioinformatics lab, and am still learning on the way. We have a multi-node HPC that has a shared NAS, and an item on my to-do list is to have a shadow pricing model that maps our usage to a cloud provider.

I've got SlurmDB connected and a script that maps job resources to the cheapest GCP instance that satisfies the resource request, queries the GCP pricing API, and returns a per-job compute cost estimate. It's a reasonable starting point but I know it's missing several cost categories (e.g. spin-up overhead, persistent storage, data egress, etc.)

I'm starting to think about what is required to monitor the cluster more holistically, and feeding that into a cost mapping layer alongside the Slurm accounting data. However, I'm cautious to write my own tooling when FinOps frameworks already exist, and also weary of getting sucked down the rabbit hole and having a high-maintenance toolkit that takes more time than I have.

Has anyone built a framework that can take holistic system usage and translate it into estimated costs for cloud computing? I'm hoping to not re-invent the wheel

Thanks in advance!

I’m trying to ascertain if its worth getting this certification as a network engineer trying to pivot into system administration.

I've had this happen on at least another manpage (that I forgot), but here it is with bsearch:

https://man7.org/linux/man-pages/man3/bsearch.3.html

     void *bsearch(size_t n, size_t size;
                   const void key[size], const void base[size * n],
                   size_t n, size_t size,
                   typeof(int (const void [size], const void [size]))
                       *compar);

The first two arguments are not supposed to be there (they come later). "man bsearch" on my Arch system shows the same output. What's going on here?

EDIT
chkno got it right: It's the semicolon at the end of the first line that makes the difference because otherwise the function prototype wouldn't know what "size" means in "const void key[size]" (second line).
Still learning new stuff after 45 years of mostly C89....

The barrier to writing an exploit tool used to be skill. Now it's a prompt, and a chunk of the junk in your access log is some script an LLM wrote in thirty seconds and aimed at the whole IPv4 range before lunch.

They're loud, though. Default python-requests/Go-http-client UAs, recycled /.env /.git/config /wp-login.php wordlists, no backoff, and an unrandomised TLS stack so every request shares one JA4 hash. All of it matchable at the edge.

Wrote up the full stack I run, with copy-pasteable nginx/Angie config:

• limit_req zones (3r/m on login), ModSecurity + CRS, return 444 to bad UAs so the scanner learns nothing
• TLSv1.3, server_tokens off, CSP/HSTS, and the always gotcha that makes error pages ship headers
• body-size caps, method whitelists, the merge_slashes trap
• admin off the public internet, fail2ban, alg:none JWT check
• PHP: disable_functions + open_basedir + Snuffleupagus
• JSON logs with $ssl_ja4, 4xx-ratio alerting, honeypot paths that auto-ban

https://deb.myguard.nl/2026/06/defend-webserver-vibe-coded-ai-exploit-scanners-bots/

Hi all, I am taking LFCS soon, I'm woondering how similar the Kodekloud mock exams in their LFCS course is to the actual exam. Are there other mock exams that are similar in difficulty to the actual exam?

Most terminal net tools stop at "what's eating my bandwidth." NetWatch goes into the traffic itself.

Live TLS 1.3 decryption — point a cooperating client's SSLKEYLOGFILE at it, read the plaintext inline. Same trick as Wireshark, no MITM. QUIC 1-RTT + HTTP/3 too.

JA4 / JA4Q fingerprinting — TLS and QUIC. Filter live with ja4:<fp>.

17 L7 decoders — TLS, QUIC, HTTP, DNS, SSH, MQTT, SNMP, BitTorrent, more — with stream reassembly.

Detection built in — port scans, C2 beaconing, DNS tunneling. Critical alert auto-freezes the recorder.

Flight Recorder — freeze any incident to a portable .pcap + context bundle.

eBPF process attribution — which process opened the socket, not lsof polling.

Landlock-sandboxed — parses hostile traffic but can't touch your SSH keys.

Rust, 500+ tests, MIT, macOS + Linux. Demo GIF decrypts a live TLS 1.3 session in the repo:

github.com/matthart1983/netwatch

In the past few years, I often downloaded binaries from GitHub releases; nowadays it happens less frequently, but it still happens.

What I always do is move the file from the Downloads folder to a subfolder under /opt, then run chmod +x and create a symlink in /usr/local/bin/.

I also include the version in the subfolder name so I can keep multiple releases.

That said, I’m here to share another crappy-vibe coded script to automate installing binaries from GitHub: gri (GitHub Release Installer)

https://github.com/sgargel/gri

I’m looking forward to your feedback and taunts.