Linux Security

When you fire up a heavy build, a data‑scraping job, or a local web server inside a tmux session, the usual pattern is to detach and log out. tmux will happily keep the session alive as long as your login shell stays around, but as soon as you hit logout or PAM times you out, the whole tree dies. Wrapping tmux in a systemd unit makes it immune to those surprises and gives you the same tooling you already use for other services—logging, restart policies, limits, and isolation.

Why pull a single file from a Borg archive?

When a configuration file or a database dump is corrupted, you often need only that one file, not the whole archive. Extracting the entire archive just to get a single file wastes bandwidth, CPU, and disk space—especially when the archive lives on a remote server or in a cloud bucket.

Because Borg keeps the archive compressed and deduplicated, the cost of pulling a single file is proportional to the file’s size and the number of blocks it occupies. Below is a quick walk‑through for retrieving a single file efficiently, both locally and remotely, and piping the data through other tools for immediate processing or secure transfer.

Why JSON‑friendly syslog matters

Syslog is the default source for almost every Linux service. When an error happens, the kernel or a daemon writes a line that looks like this:

Oct  6 12:34:56 myhost kernel: [12345.678901] EXT4-fs error (device sda1): ext4_find_entry:1073: inode #123456: comm: myapp: file name too long

Grafana loves structured data. A plain text file is hard to query, filter, or aggregate. By converting the error lines to JSON you can:

Why SSH Still Asks for a Password After Adding a Key

Adding a public key to ~/.ssh/authorized_keys is the first step toward password‑less login, but the SSH daemon can still fall back to password authentication for a handful of reasons. The most common culprit is a mis‑configured PubkeyAuthentication setting in /etc/ssh/sshd_config or a permissions problem that causes the server to ignore the key file.

1. Verify the Key Is Accepted by the Server

# On the client
ssh -vvv user@host

The -vvv flag prints the entire authentication dance. Look for lines like:

The “Host key verification failed” error after renaming a jump host

When you rename a jump host (or any SSH‑accessible machine) the client still keeps the old hostname in its ~/.ssh/known_hosts. On the next connection the client pulls the key presented by the renamed host and compares it with the stored key for the old name. The mismatch triggers the classic

Host key verification failed.

It’s a safety net against man‑in‑the‑middle attacks, but it can be a nuisance when you legitimately change the hostname. Below is a practical, step‑by‑step fix, a few automation tricks, and some security notes I’ve learned after 20 years on the grind.

Why the $USER Variable Matters for Systemd Timers

Systemd timers are the go‑to replacement for cron on almost every distro. They’re declarative, mesh cleanly with the unit graph, and bring a bunch of goodies—persistent timers, calendar syntax, and dependency handling. The catch? If your timer’s service unit runs a script that relies on $USER, you’ll see a silent failure after a reboot. Systemd doesn’t set $USER for system‑wide units; it only populates it for user‑specific units that run in a logged‑in session.

When a service spits out a JSON blob that contains a list of users, the data is usually nested and has more fields than you actually need. Turning that into a flat CSV is a common thing to do for automation scripts, reporting, or feeding into spreadsheets. The two most reliable command‑line tools for this job are jq (a JSON processor) and awk (a text filter). Together they give you a fast, secure, and scriptable pipeline.

The sticky bit in a nutshell

The sticky bit (+t) on a directory means that only the file’s owner, the directory’s owner, or root can delete or rename files inside it. /tmp is traditionally set to 1777 (octal) – owner root, group root, permissions rwxrwxrwt. That lets any user create files, but stops them from messing with each other’s data.

What happened after the update

Some kernel releases changed the default mount options for tmpfs or how tmpfs‑based /tmp is handled. If /tmp is mounted as tmpfs without the sticky bit, the kernel quietly clears the +t flag. The directory stays world‑writable, but the protection that stops users from deleting each other’s files disappears. Applications that expect the sticky bit now refuse to write, because they see the directory as insecure.

Why Move /var/log to a tmpfs?

On most production boxes and home‑lab rigs the root file system is a single ext4 or btrfs partition that also holds /var/log. After a few months the logs can eat up gigabytes of space, especially on servers that churn out audit, kernel, or app logs. A full root partition can block package upgrades, kernel updates, or even prevent a boot if the filesystem gets remounted read‑only. Moving /var/log to a tmpfs frees the disk right away, keeps the logs in RAM, and cuts out the need to compress or rotate them manually.