Linux Security

Understanding the 2775 Permission Set

The octal mode 2775 is the go‑to for giving a directory shared write access while keeping new files in the same group.

• 2 – set‑gid bit: new files inherit the directory’s group.
• 7 – owner gets rwx.
• 7 – group gets rwx.
• 5 – others get r-x.

On a path like /srv/shared it looks tidy: any member of the group can drop files, and those files stay in the same group for later collaboration. The flip side? Group write is a double‑edged sword. If the group contains people you don’t fully trust, or if the directory is exposed to a wider audience, the set‑gid bit can become a vector for privilege escalation or accidental data exposure.

Why KDE Plasma Appeared During Upgrade

When Debian 12 “Bookworm” landed in early 2025, the default desktop stack for the desktop task was GNOME. A lot of folks, myself included, still had KDE Plasma sitting around from a previous release or a custom install. During a normal apt full-upgrade, the package manager pulls in the newest kde-plasma-desktop meta‑package because it’s part of the kde-standard task, which is automatically enabled by the tasksel configuration that ships with Debian. The result? A silent, automatic installation of a sizeable KDE stack even if you never intended to use it.

When a Windows machine syncs a shared folder that contains /etc/hosts, the file often ends up with Windows‑style CRLF line endings.

If you’ve ever pulled a hosts file from a Windows share, you’ve probably noticed that the resolver starts acting weird. The glibc resolver stops at the carriage return (\r) and treats the rest of the line as part of the hostname. That means lookups for localhost, myserver, or any entry that follows a stray CR fail, and some services silently fall back to DNS—exposing the system to name‑resolution attacks.

Why a service can stay “activating” after a kernel upgrade

When you bump the kernel, systemd does a hard reset of almost everything.
If a unit you depend on never leaves the activating state, the rest of the boot can stall or the service simply never runs.
The usual suspect is a dependency on a kernel‑provided resource that is missing or delayed after the upgrade.

Below is a practical checklist that shows how to diagnose the issue, why it happens, and how to fix it without compromising security or stability.

Why systemd‑resolved matters

On most modern distros the DNS stack is no longer a simple /etc/resolv.conf.
systemd‑resolved runs in the background, pulls DNS servers from every interface, does caching, validates with DNSSEC, and even acts as a local DNS‑over‑TLS (DoT) proxy.
resolvectl (now systemd-resolve in newer releases) is the CLI that lets you look inside this stack and tweak it without hunting through config files.

If you run a home lab, self‑hosted services, or just want a snappier, more reliable lookup, mastering resolvectl can shave milliseconds off each query and give you a clear view of what the resolver is actually doing.

Introduction to Bash History

As a long-time Linux user, I’ve come to rely on the command line to get my work done. The Bash shell is an incredibly powerful tool, and one of its most useful features is its ability to store a history of previously executed commands. This history is stored in the ~/.bash_history file and can be accessed using the history command. However, as our systems see more use, the Bash history can become cluttered with duplicate entries, making it tough to find the commands we need.

Introduction to systemd Restart Policies

I’ve seen this go wrong when a service is misconfigured and ends up consuming all your system resources. Systemd is a core component of most modern Linux distributions, responsible for managing system services. One of its key features is the ability to automatically restart services that fail or exit unexpectedly. However, if not properly configured, this can lead to a “service deluge” where a failing service is repeatedly restarted.

Introduction to Automated Offsite Backups

I’ve seen this go wrong when people don’t prioritize backups - losing important configuration files can be a real headache. Automating offsite backups is a crucial task for any Linux user, whether you’re a sysadmin, self-hoster, or homelab enthusiast. By leveraging rsync and SSH, you can create a reliable and secure backup system. In this article, we’ll explore how to set up automated offsite backups using these tools.

Introduction to Emergency Mode and Rescue Shell

When your Linux system fails to boot, it can be frustrating - especially if you’re not familiar with the troubleshooting process. I’ve seen this go wrong when people don’t know where to start. Luckily, systemd’s Emergency Mode and Rescue Shell are here to help. In this article, we’ll dive into how to use these tools to troubleshoot initramfs issues and get your system up and running again.

Introduction to Log Noise

When working with Linux systems, logs are an essential part of troubleshooting, monitoring, and maintaining the health of your system. However, with the vast amount of data being logged, it can become overwhelming to sift through the noise to find the important information. I’ve seen this go wrong when trying to debug a complex issue, only to get lost in a sea of irrelevant log messages. This is where journalctl comes in, a powerful tool for managing and filtering system logs.