Sysadmin

Traditional MySQL replication architectures (active-passive or source-replica topologies) introduce replication lag and require failover orchestrators (e.g., Orchestrator or ProxySQL) to handle master crashes. MySQL NDB Cluster is a shared-nothing, distributed database that provides real-time in-memory performance, 99.999% high availability, and active-active multi-master read/write capabilities across all SQL nodes. This guide details configuring and scaling a multi-master NDB cluster using Oracle MySQL Cluster Manager (MCM). Core Architecture & Node Roles An NDB cluster consists of three distinct node types: ...

When deploying jump hosts, transparent proxies, or network bridges across multi-homed Linux systems, standard routing tables are often insufficient. Using the Linux Netfilter framework via iptables, you can manipulate packets at both ingress (PREROUTING) and egress (POSTROUTING). Scenario 1: Basic Traffic Forwarding via DNAT and MASQUERADE In this setup, our Linux server acts as an intermediary bridge forwarding traffic from a client to a remote backend service: Client Source IP: 198.51.100.12 Intermediary Gateway (Our Server): 203.0.113.30 Final Backend Destination: 192.0.2.84 Client [198.51.100.12] ──► Gateway [203.0.113.30] ──► Backend [192.0.2.84] Step 1: Destination NAT in PREROUTING Intercept incoming packets destined for our gateway and rewrite the destination IP before routing lookup occurs: ...

Unlike traditional Type-1 and Type-2 hypervisors that virtualize complete hardware stacks and boot independent operating system kernels, containers share the host Linux kernel while isolating processes using kernel Namespaces (PID, NET, IPC, MNT, UTS) and Control Groups (cgroups). Docker packages application dependencies, libraries, and runtime binaries into lightweight, immutable container images. Core Architecture Docker operates under a client-server model: Docker Client (docker): The CLI tool you execute to issue commands. Docker Daemon (dockerd): The background daemon listening for API requests to manage images, containers, networks, and storage volumes. Docker Registry: Public (Docker Hub) or private image repositories. A container lifecycle is tied directly to its primary foreground process (PID 1). When that process exits, the container stops. ...

SSH is far more than an encrypted remote terminal—it is an extensible transport protocol capable of encapsulating arbitrary TCP traffic across segmented network boundaries, NAT gateways, and restrictive firewalls. Here is how to leverage Dynamic, Local, and Remote Reverse SSH tunnels. 1. Dynamic Port Forwarding (-D): SOCKS Proxy Dynamic port forwarding turns your SSH client into a local SOCKS5 proxy server. Any application configured to use this proxy routes its network requests through the remote SSH host. ...

Weak passwords remain one of the most common vectors for initial access and lateral movement in enterprise Linux environments. By default, many Linux distributions enforce minimal password complexity rules. The pam_cracklib module (and its modern successor pam_pwquality) provides password strength checks by testing proposed passwords against dictionary wordlists, entropy requirements, and complexity rules. Key Configuration Parameters Understanding the parameter syntax: Positive credits (e.g., dcredit=1): Bonus characters that reduce the required total length. Negative credits (e.g., dcredit=-1): Strict minimum requirements (must contain at least that number of characters). Parameter Function Recommended Setting minlen=12 Minimum total characters required 12 or higher dcredit=-1 Minimum number of digits required -1 ucredit=-1 Minimum uppercase characters required -1 lcredit=-1 Minimum lowercase characters required -1 ocredit=-1 Minimum special/punctuation symbols required -1 maxrepeat=2 Maximum consecutive repeated characters 2 reject_username Forbids passwords containing the username Included enforce_for_root Enforces the policy on the root account Crucial dictpath=<path> Custom wordlist path for dictionary checks e.g., /usr/share/dict/words Step 1: Configuring PAM Password Policy In Red Hat, CentOS, and Debian/Ubuntu derivatives, password policies are typically applied in /etc/pam.d/system-auth (RHEL/CentOS) or /etc/pam.d/common-password (Debian/Ubuntu): ...

Linux uses Pluggable Authentication Modules (PAM) to decouple system applications (such as sshd, login, sudo, and su) from underlying authentication mechanisms. Instead of hardcoding authentication logic into each daemon, applications dynamically link against PAM (libpam.so). To verify whether a service supports PAM, check its dynamic libraries with ldd: ldd $(which sshd) | grep pam # libpam.so.0 => /lib64/libpam.so.0 (0x00007f81348fc000) PAM Configuration Structure PAM configuration files reside in /etc/pam.d/. Each service typically has its own configuration file (e.g., /etc/pam.d/sshd, /etc/pam.d/sudo). ...

In Linux, user account definitions reside in /etc/passwd (world-readable), while encrypted password hashes and credential aging rules reside in /etc/shadow (restricted to root with 0640 or 0600 permissions). Understanding /etc/shadow field definitions is essential for system auditing, incident response, and credential analysis. Anatomy of an /etc/shadow Entry Each line consists of 9 colon-separated fields: n1x:$6$UoDmVdoW$tYQQm5uHgOpe...:16631:7:15:2:14:16819: Field # Attribute Name Value in Example Description 1 Username n1x Account login name matching /etc/passwd. 2 Encrypted Password $6$UoDmVdoW$... Cryptographic hash prefixed by algorithm identifier. 3 Last Changed Date 16631 Days since the Unix Epoch (Jan 1, 1970) when password was last updated. 4 Minimum Age 7 Days user must wait before they can change password again. 5 Maximum Age 15 Days before the password expires and must be changed. 6 Warning Period 2 Days prior to expiration that warning prompts begin displaying. 7 Inactivity Period 14 Days after expiration during which user can still change password; past this, account is disabled. 8 Expiration Date 16819 Absolute date (in days since epoch) when account is permanently disabled. 9 Reserved (empty) Flag reserved for future operating system use. Identifying Password Hash Algorithms The second field begins with $id$salt$hash. The ID reveals the cryptographic hashing algorithm used: ...

When an adversary compromises a Linux server, they frequently alter system binaries (installing backdoored binaries like sshd or login), inject malicious cronjobs, modify web directories, or alter file permissions (e.g., granting SUID or world-writable access). AIDE (Advanced Intrusion Detection Environment) is a host-based File Integrity Monitoring (FIM) tool that builds a cryptographic baseline database of file attributes, hashes, permissions, and SELinux labels to detect file tampering. How AIDE Operates AIDE scans the filesystem according to rules defined in /etc/aide.conf, calculates cryptographic checksums (SHA-256, SHA-512) and metadata attributes for each file, and stores them in a baseline database (/var/lib/aide/aide.db.gz). ...

In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask). Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys). The Fundamental Rule: Masking, Not Subtraction By default, the Linux operating system assigns base permissions: Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety. Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd). The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created. ...

When external USB flash drives or external storage media are plugged into desktop Linux distributions, automated desktop daemons (like udisks2 or automount rules) often mount them automatically. If the filesystem is mounted without explicit security constraints, an unprivileged user or malicious physical actor can escalate to root privileges instantly using pre-configured SUID binaries. The Attack Vector: SUID Preservation on Portable Filesystems POSIX filesystems (such as ext4, ext3, xfs) store Unix file permissions—including the SetUID (suid) bit (chmod 4755) and file ownership—directly inside the filesystem’s inode tables. ...