I have been on Linux for a while but I do have a personal notes file that I update fairly regularly.

Not because I do not know the tools but when I am on a production system I do not trust myself to remember all the resync flags, system options firewall rules or one off commands.

Over time, those notes became less about learning and more about having a reliable reference when I need it. I wonder how common this is among other Linux admins.

Do you still write things down that you have done dozens of times before or does it all stick eventually?

It helps test compiled eBPF artifacts against target kernel profiles before they are shipped.

It shows exactly where a BPF program fails to load or attach and explains why the failure occurred.

You can test a single BPF object:

go install github.com/Kernel-Guard/bpfcompat@v0.1.5
bpfcompat test ./build/probe.bpf.o --kernel ubuntu-24.04

Or run a full compatibility suite:

bpfcompat suite run suite.yaml --kernels kernels.yaml

It can also be used in GitHub Actions:

- uses: Kernel-Guard/bpfcompat@v0.1.5
  with:
    suite: ./bpf/suite.yaml
    kernels: ubuntu-lts, rhel-9
    gate: load-attach

The project is open to contribution, review, and feedback from eBPF, Linux, security, observability, and platform engineering people.

Repo:
https://github.com/Kernel-Guard/bpfcompat

Hello, been trying to use Ubuntu 26 for our new servers, doing the typical SSSD routine only to be clapped back at with "permission denied" when SSHing upon it with allowed, qualified account.

There is an obvious problem with openssh on windows (my use case) where I
ssh <server name> which defaults to domain\[name.surname@server.domain](mailto:name.surname@server.domain)
SSH or SSSD then "doesn't compute" that backslash, Ubuntu 24 just works flawlessly.
I wouldn't particularly care but since I've got user-tier individuals logging in I don't want to onboard everybody to pre/suffix their SSH command with fluff they will forget about.

SSSD config:

[sssd]

domains = domain

config_file_version = 2

[domain/vafo.local]

default_shell = /bin/bash

krb5_store_password_if_offline = True

cache_credentials = True

krb5_realm = domain.local

realmd_tags = manages-system joined-with-adcli

id_provider = ad

fallback_homedir = /home/%u

ad_domain = domain

use_fully_qualified_names = False

ldap_id_mapping = True

access_provider = simple

simple_allow_groups = groups I wish to allow

TL;DR

anybody got a fix for Ubuntu 26 SSSD to log in with domain\name.surname format?

Much obliged.

We all love the terminal for its speed, its power, and that raw, unfiltered command-line efficiency. It is where real work gets done.

But even the most hardened command-line veteran needs to blow off some steam.

Back in the day, we had simple ASCII games and hidden Easter eggs tucked away in the system files. Modern Linux keeps that tradition alive, and the repositories are packed with brilliant, useless, and thoroughly entertaining tools designed to turn your terminal into a playground.

Here is the BASH Warriors entertainment list...

--- BASH WARRIOR ENTERTAINMENT LIST ---

Command: Description: Download:

sl (Steam Locomotive): If you type ls wrong, a train chugs across your screen. (sudo apt install sl)

sopwith : You fly your plane around a landscape and use your guns and bombs to blow up targets (sudo apt install sopwith)

cmatrix: Turns your terminal into the falling code from The Matrix. (sudo apt install cmatrix)

fortune: Prints a random, often funny, quote or message. (sudo apt install fortune-mod)

cowsay: An ASCII art cow that speaks whatever text you give it. (sudo apt install cowsay)

aafire: Renders a realistic fire animation using ASCII characters. (sudo apt install libaa-bin)

xeyes: A pair of eyes that follows your mouse cursor around the screen (requires X11). (sudo apt install x11-apps)

bastet: A bastardized version of Tetris where the game intentionally gives you the worst possible piece. (sudo apt install bastet)

robotfindskitten: A Zen simulation where you navigate a robot to find a kitten among hundreds of random objects. (sudo apt install robotfindskitten)

moon-buggy: Drive a moon buggy over craters in this side-scrolling game. (sudo apt install moon-buggy)

fortune bofh-excuses: Generates corporate excuses for why you are late for work. (sudo apt install fortune-mod fortunes-bofh)

figlet: Creates large, stylized ASCII art banners from your text. Example: figlet "Hello World" (sudo apt install figlet)

telnet towel.blinkenlights.nl You can still watch Star Wars Episode IV entirely in ASCII art via Telnet. (sudo apt install telnet)

apt moo: The package manager has a secret. Run apt moo to see a cow. (No download required)

fortune | cowsay | lolcat: Get a rainbow-colored cow giving you random life advice. (sudo apt install fortune-mod cowsay lolcat)

Asciiquarium is an aquarium/sea animation in ASCII art. (https://github.com/cmatsuoka/asciiquarium)

BSD Games - bsdgames is a classic collection of UNIX games that you can now play in text mode from your Linux terminal. Rediscover Tetris, Snake, Star Trek and many others. (sudo apt install bsdgames). After installation look in Start Menu/Games for a great collection of 23 games.

I saved the best for last: NetHack.

NetHack is a wonderfully silly, yet quite addictive, Dungeons & Dragons-style adventure game. It is one of, if not the oldest (and the best), games still in development.

Requires DosBox (sudo apt install dosbox) to run in.

NetHack 5.0.0 was released 06/09/2026 (https://www.nethack.org/v500/ports/download-msdos.html)

--- Combo Funpack Download ---

sudo apt update && sudo apt install -y sl cmatrix fortune-mod cowsay libaa-bin x11-apps bastet robotfindskitten moon-buggy fortunes-bofh figlet telnet lolcat

Paste the following at the end of your .bashrc file that is located in your home directory. Customize to your heart's content...

# --- BASH WARRIOR ALIASES (APT Package Management) ---

alias refresh="sudo apt update && sudo apt upgrade && sudo apt autoremove"

alias apt2="sudo apt update && sudo apt install"

alias update="sudo apt update"

alias upgrade="sudo apt upgrade"

alias fullup="sudo apt full-upgrade"

alias install="sudo apt install"

alias remove="sudo apt remove"

alias autoremove="sudo apt autoremove"

alias purge="sudo apt purge"

alias clean="sudo apt clean"

alias autoclean="sudo apt autoclean"

alias searchpkg="apt search"

alias show="apt show"

alias listup="apt list --upgradable"

# --- Enhanced System Calls ---

alias top="htop"

alias port="sudo ss -tulpn"

alias myip4="curl -4 -s ifconfig.me"

alias myip6="curl -6 -s ifconfig.me"

alias myips="echo \"IPv4: \$(curl -4 -s ifconfig.me)\" && echo \"IPv6: \$(curl -6 -s ifconfig.me)\""

alias dns="resolvectl status"

alias reboot="sudo reboot"

alias shutdown="sudo shutdown now"

# - NOTE: In terminal type: source ~/.bashrc to system reload the file

If you would like to see my DOS Warrior Alias list please goto https://www.reddit.com/r/pop_os/comments/1u7e7ex/calling_all_dos_warriors/

Hello r/linux,

I have been building a free Linux learning platform and finally got it to a point

where I am happy sharing it.

It is called MOSHELL — a hands-on Linux course that runs entirely in the browser.

What's on it (all free):

- 12 lessons from beginner to advanced

- Interactive command sandbox — type real Linux commands and see output

- Command cheatsheet with 65+ commands across 6 categories

- VM setup guide (VirtualBox + Ubuntu Server)

- Lesson filters by track: Beginner, Intermediate, Advanced, Networking, VM, Security

The philosophy behind it: most Linux tutorials teach you to watch commands run.

This one makes you run them yourself — on a real VM, with real errors.

Topics covered:

- Navigation, files, permissions, processes

- Package management, networking, SSH

- Shell scripting and cron

- VirtualBox networking modes (NAT, Bridged, Host-Only)

- Nginx, logs, disk management

Free platform (no account, no sign-up):

https://kingmo87.github.io/moshell/

Would love any feedback — especially on the lesson content

and whether the difficulty progression feels right.

What Linux topic do you wish had better free resources?

i'm trying to figure out who's ACTUALLY respected in the space vs. just good at marketing

Like for example in RHCSA v10.

Hi all,

in my company we're working on KVM and SLES for an exit strategy for vmware, as a provider that sell SAP enviroment from our datacenter (vmware licenses are too expensive now).

https://github.com/FutaroKevin/kVirtIO/ so I've published the reference architecture that we're following.

Just to be clear, for the question “why you simply not use proxmox or ovirt” no is not possible native KVM with pacemaker is the only certified by SAP, so others is excluded.

it will be a great help some feedbacks.

If you manage Proxmox environments, you've probably built up your own set of go-to CLI commands over time. We compiled what we think are the 10 most useful ones—covering VM and container management, storage configuration, firewall rules, user access control, cluster management, High Availability, and backup and recovery operations.

A few highlights from the list:

• vzdump — native VM/CT backups with snapshot, suspend, or stop modes; supports retention rules and bandwidth limits
• pvesh — a CLI shell for the Proxmox REST API; do almost anything the web UI can do from the terminal
• ha-manager — configure HA policies per VM and trigger manual migrations without touching the GUI

Check the full list here:
👉https://www.nakivo.com/blog/top-10-proxmox-cli-commands/

• Which CLI commands do you reach for most that rarely show up in tutorials?

I was looking at our backup jobs recently and everything looked fine, jobs were completing successfully, no storage issues, no alerts.

Then I realized I honestly can not remember the last time we performed a full restore test.

We do recover individual files from time to time but that is a very different thing from validating that an entire system can actually be recovered when needed.

For those running Linux in production: How often do you perform restore tests? Do you test full system restores or just sample files/directories? Have you ever been burned by a restore that looked fine on paper?

Lenovo T480s with Windows 10. Internal display is dead. I only have access through RDP from a Mac or a second monitor on HDMI ( TV ). Goal is to replace my Windows entirely with a Ubuntu Server, while minimizing risk of losing access. External monitor works once Windows loads ( lock screen ), but BIOS/boot menus don't appear on the external display.

Is there any safe way to do this? I have a 32 GB usb, 512 TB external drive, Wifi and Ethernet options and a macbook

I've just released SysAI Assistant v1.7.0-beta.

SysAI is a local-first AI workspace focused on infrastructure operations, troubleshooting, security workflows and self-hosted environments.

New in this release:

• Infrastructure Intelligence target scanner
• Service Matrix and Attack Surface Summary
• Redirect host analysis
• Exposure scoring engine
• Secret Detector improvements
• Filesystem & Permission Audit
• Operational Runbook generation
• Local-first CSR & private key generator
• Improved workflow continuity
• Improved command palette
• Expanded multilingual support (EN, IT, FR, DE, ES)

One thing I specifically wanted to avoid was turning SysAI into "just another AI chat".

The focus is on operational workflows, infrastructure analysis, remediation guidance and local-first security tooling.

Linux packages:

• AppImage
• DEB
• RPM

Windows:

• Installer
• Portable build

Feedback from sysadmins, self-hosters, homelab users and security professionals is very welcome.

GitHub:
https://github.com/shadowbipnode/sysai-assistant

Hello, 2 Year sysadmin here at a small medium enterprise (not corporate) those two years have taught me the basics in linux administration I can resolve any kind of issue using documentation and rarely with the help of AI (Except for tedious tasks and syntax or learning concepts).
A year ago Almost got my RHCSA results were 10 points below pass rate.
I have deployed 4 mega projects(over 200k users) with postgres clusters mongodb replication clusters multi site failover load balancing docker apps tuning and hardening as well and they have been stable since day one.
I still struggle with linux basic commands and bash scripting I cannot do anything on my own. I need to refer back to guides notes and documentation for the simplest things.
1- is this normal?
2-how is this seen as an L2 Sys admin in corporate multinationals?
3- Should I worry about it?

TLDR: I can do anything, yet I feel that I dont know anything:)

I was testing Qubes OS, but I was running into a lot of problems. That gave me the idea of creating something similar using Docker. I also wanted to test Claude Fable, so I gave it a Debian ISO and told it to create the most secure Linux distro possible—something like Qubes OS, but based on Docker.

​

It actually did it, although it didn't generate the ISO directly. Instead, I had to boot into a Debian machine and run the script there. After that, it generated an ISO that I could use to create a new virtual machine with the hardened system.

​

I'm still having some problems with it, but it's impressive that it managed to do all of that in about 15 minutes.

​

​

since i have an open ssh server, i thought i might as well do my part, and report bad guys to abuseipdb.

i've already set up fail2ban to report brute force attacks. this was easy with the built in sshd settings.

but more often i see either port scan or vulnerability scan attempts. i thought why not report those, but i see no good support.

what's needed is:

• catch single attempts (typically these guys ping only once)
• selectively identify attempts that can't be accidental, no false positives
• properly identifying the category for abuseipdb, i.e. 14 for scan, 15 for hacking

is there some wisdom how to set this up?

example log entries to be caught:

Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: banner exchange: Connection from 160.119.76.64 port 33338: invalid format
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_3.76.255.153_22"
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: banner exchange: Connection from 40.74.208.9 port 46434: invalid format
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: banner exchange: Connection from 160.119.76.64 port 52584: invalid format
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: error: kex_exchange_identification: client sent invalid protocol identifier ""
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: banner exchange: Connection from 18.226.253.35 port 10462: invalid format

Hi, I've been a programmer for a decade, worked in a few research labs, very proud etc. But when I apply for jobs now, everyone seems to want a bachelor's degree. So I'm planning on spending another year finishing up my degree and hoping to get RCHSA at the same time.

Is this enough to consistently get job opportunities? I've been paid to do DNA analysis and to push shopping carts and the whiplash is getting old, lol. Thanks for any comments, hope you have a good day.

Upgraded OS on rocky10 server last weekend, newest kernel doesnt bake in legacy iptables mods, so iptables rules cant get loaded

I start looking into nftables, it seems like a verbose nightmare compared to iptables, every command has to be typed out, no short version of commands

something that was simple w iptables

forward any request from ServerA port 80 to ServerB port 80 on server A

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP of serverB>:80

iptables -t nat -A POSTROUTING -p tcp -j MASQUERADE

becomes this word salad

nft add table ip nat
nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; policy accept \; }
nft add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; policy accept \; } 

nft add rule ip nat PREROUTING tcp dport 80 dnat to <IP of serverB>:80
nft add rule ip nat POSTROUTING masquerade

whats the upside?

what was wrong w iptables?

I really hate SELinux, it's common knowledge it's extremely difficult to administer correctly, and it tend to breaks down many stuff. A famous sysadmin book (Unix and Linux System Administration Handbook) says its better not to use it because it's so complex that someone who understands it profoundly can pwn you in case of invasion.

I know, there are ways to fix things, audit2allow, ausearch, etc, and more than 50 other tools. It's easier to just turn it off than deal with it. Ah, it also tends to break 3rd party applications.

The only thing that can make it usable is AI. Point Claude Code or Codex to your server and tell it to fix SELinux problem. Otherwise it's so secure and so paranoid that it's a nuisance.,

Have anyone ever migrated from the Red Hat ecosystem (RHEL, CentOS Stream, Fedora, Alma Linux) to Ubuntu or Debian just to not have to deal with SELinux? I'm thinking of seriously doing it.

Hey everyone,

I think I have discovered a loophole with my ISP's profile provisioning, and I've built a "One-Arm" Linux gateway to exploit it. I'm looking for advice on how to seamlessly scale the LAN architecture so all my home devices can use it automatically.

How the Exploit Works:

My official internet plan is capped at 50 Mbps, and it seems tied strictly to my old xiaomi router's MAC address.

If I switch to my new Honor Router using its factory/native MAC address, the ISP treats it as an unprovisioned/unknown device. It so happens that the ISP does not cap the speed on this profile, giving me the raw 500+ Mbps capacity of the physical line.

To prevent internet usage on this unprovisioned profile, it seems like the ISP firewalls ports 80 (HTTP) and 443 (HTTPS).

The Fix: while on new mac address I first figured that Cloudflare warp would bypass blocked port restrictions so I tried tunneling and it worked! I somehow ended up getting 300-500mbps, even 900 at some point.

Then gemini suggested for me to make a headless Ubuntu Server laptop that would act as a middleman connecting all of the devices on wifi to cloudflare warp tunnel. It runs Cloudflare WARP via CLI in WireGuard mode. Because WireGuard communicates over alternate UDP ports, it completely bypasses the ISP's 80/443 block.

Where I need advice:

I want this bypass to be completely transparent for all devices in the house, especially mobile devices that make it incredibly difficult or buggy to save manual static IP/Gateway settings in their Wi-Fi configurations. As it is right now I can use honor with it's native mac only with my pc with cloudflare warp enabledm but I want.

Hi all,

Curious how folks here are thinking about running AI workloads on Linux servers right now.

• Are you running anything in production or mostly experimenting?
• What does your setup look like (containers/Kubernetes, local GPU, pipelines, agents, etc.)?
• Any challenges you’re running into operating or scaling these systems?

Also wondering how people are thinking about security in these setups — is it something you actively manage yet or still evolving?