1
$ vmstat 2 5          # 5 samples every 2 seconds
2
$ iostat -xz 2
3
$ sar -u 2 5          # CPU history
4
$ sar -r              # memory history

1
$ uptime
2
12:00  up 5 days,  load average: 0.52, 0.38, 0.29

1
$ cat /proc/meminfo
2
$ grep -E "MemTotal|MemAvailable|SwapFree" /proc/meminfo

1
$ iostat -xz 1
2
$ sudo iotop -o       # only show active I/O
3
$ sudo hdparm -tT /dev/sda

1
$ ls /boot/
2
vmlinuz-6.1.0   initrd.img-6.1.0   System.map-6.1.0

1
$ tar xvf linux-6.x.tar.xz && cd linux-6.x
2
$ make menuconfig
3
$ make -j$(nproc)
4
$ sudo make modules_install
5
$ sudo make install

1
$ lsmod | grep ext4
2
$ modinfo ext4
3
$ sudo modprobe ext4
4
$ sudo modprobe -r ext4

1
$ uname -r
2
6.1.0-17-amd64
3
$ uname -a
4
Linux host 6.1.0-17-amd64 #1 SMP x86_64 GNU/Linux

1
$ sysctl kernel.hostname
2
$ sysctl -w net.ipv4.ip_forward=1
3
$ sysctl -p /etc/sysctl.conf
4
# Persistent:
5
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/99-ip-forward.conf

1
$ sudo vim /etc/default/grub
2
GRUB_TIMEOUT=5
3
GRUB_CMDLINE_LINUX="quiet splash"
4

5
$ sudo grub-mkconfig -o /boot/grub/grub.cfg
6
# or on RHEL/Fedora:
7
$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

1
$ lsinitramfs /boot/initrd.img-$(uname -r)   # Debian
2
$ lsinitrd /boot/initramfs-$(uname -r).img   # RHEL

1
$ sudo update-initramfs -u          # Debian/Ubuntu
2
$ sudo dracut -f                    # RHEL/Fedora
3
$ sudo dracut -f --kver $(uname -r)

1
# Boot to rescue target via GRUB editor (press 'e')
2
linux /vmlinuz root=/dev/sda1 ro systemd.unit=rescue.target

1
$ sudo umount /dev/sdb1
2
$ sudo fsck -y /dev/sdb1     # auto-fix
3
$ sudo e2fsck -f /dev/sdb1   # ext4 forced check
4
$ sudo xfs_repair /dev/sdb1  # XFS

1
$ sudo pvcreate /dev/sdb /dev/sdc
2
$ sudo vgcreate datavg /dev/sdb /dev/sdc
3
$ sudo lvcreate -L 20G -n datalv datavg
4
$ sudo mkfs.xfs /dev/datavg/datalv

1
$ sudo lvcreate -L 5G -s -n snap_datalv /dev/datavg/datalv
2
$ sudo mount /dev/datavg/snap_datalv /mnt/snapshot
3
$ sudo lvremove /dev/datavg/snap_datalv

1
$ sudo mdadm --create /dev/md0 \
2
    --level=1 --raid-devices=2 /dev/sdb /dev/sdc
3
$ sudo mdadm --detail /dev/md0
4
$ sudo mdadm --detail --scan >> /etc/mdadm/mdadm.conf

1
$ sudo iscsiadm -m discovery -t st -p 192.168.1.100
2
$ sudo iscsiadm -m node --login
3
$ lsblk    # new block device appears

1
# Server: /etc/exports
2
/shared  192.168.1.0/24(rw,sync,no_subtree_check)
3
$ sudo exportfs -ra
4
$ sudo systemctl enable --now nfs-server
5

6
# Client:
7
$ sudo mount -t nfs 192.168.1.10:/shared /mnt/nfs

1
$ sudo mkfs.btrfs /dev/sdb
2
$ sudo btrfs subvolume create /mnt/data/@home
3
$ sudo btrfs subvolume snapshot /mnt/data /mnt/data/snap_$(date +%F)
4
$ sudo btrfs filesystem df /mnt/data

1
$ sudo smartctl -a /dev/sda        # full SMART report
2
$ sudo smartctl -t short /dev/sda  # run short test
3
$ sudo smartctl -H /dev/sda        # quick health check

1
$ nmcli con mod "Wired connection 1" \
2
    ipv4.addresses 192.168.1.100/24 \
3
    ipv4.gateway 192.168.1.1 \
4
    ipv4.dns "8.8.8.8 8.8.4.4" \
5
    ipv4.method manual
6
$ nmcli con up "Wired connection 1"

1
$ sudo modprobe bonding
2
$ nmcli con add type bond ifname bond0 bond.options "mode=active-backup"
3
$ nmcli con add type ethernet ifname eth0 master bond0
4
$ nmcli con add type ethernet ifname eth1 master bond0

1
$ nmcli con add type bridge ifname br0
2
$ nmcli con add type ethernet ifname eth0 master br0
3
$ nmcli con mod br0 bridge.stp no
4
$ nmcli con up br0

1
$ sudo modprobe 8021q
2
$ ip link add link eth0 name eth0.100 type vlan id 100
3
$ ip addr add 192.168.100.1/24 dev eth0.100
4
$ ip link set eth0.100 up

1
$ tar czf backup.tar.gz /etc /home
2
$ rsync -avz --delete /data/ backup@server:/backup/
3
$ dd if=/dev/sda of=/backup/sda.img bs=4M status=progress

1
# m  h  dom  mon  dow  command
2
0    2  *    *    *    /usr/local/bin/backup.sh
3
*/5  *  *    *    *    /usr/bin/check_disk.sh
4

5
$ crontab -e      # edit user crontab
6
$ crontab -l      # list crontab
7
$ sudo crontab -l -u root

1
$ sudo systemctl enable --now named
2
$ named-checkconf /etc/named.conf
3
$ named-checkzone example.com /var/named/example.com.zone

1
@ IN SOA ns1.example.com. admin.example.com. (
2
        2024010101 ; Serial
3
        3600       ; Refresh
4
        900        ; Retry
5
        604800     ; Expire
6
        300 )      ; Minimum TTL

1
$ dig example.com A
2
$ dig example.com MX
3
$ dig @8.8.8.8 example.com        # query specific server
4
$ dig +trace example.com          # full resolution chain
5
$ dig -x 8.8.8.8                  # reverse lookup

1
$ sudo apachectl configtest
2
$ sudo apachectl graceful     # reload without dropping connections
3
$ sudo apachectl -M           # list loaded modules

1
<VirtualHost *:80>
2
    ServerName www.example.com
3
    ServerAlias example.com
4
    DocumentRoot /var/www/example
5
    ErrorLog ${APACHE_LOG_DIR}/example_error.log
6
</VirtualHost>

1
server {
2
    listen 80;
3
    server_name example.com www.example.com;
4
    root /var/www/example;
5
    index index.html;
6

7
    location / {
8
        try_files $uri $uri/ =404;
9
    }
10
}

1
server {
2
    listen 80;
3
    server_name api.example.com;
4

5
    location / {
6
        proxy_pass http://127.0.0.1:3000;
7
        proxy_set_header Host $host;
8
        proxy_set_header X-Real-IP $remote_addr;
9
    }
10
}

1
$ sudo certbot --nginx -d example.com -d www.example.com
2
$ sudo certbot renew --dry-run

1
$ sudo authconfig --enableldap --enableldapauth \
2
    --ldapserver=ldap://ldap.example.com \
3
    --ldapbasedn="dc=example,dc=com" --update

1
$ sudo postconf myhostname
2
$ sudo postconf -e "relayhost=[smtp.gmail.com]:587"
3
$ sudo postfix check
4
$ sudo postqueue -p     # view mail queue

1
$ sudo iptables -L -n -v              # list rules
2
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
3
$ sudo iptables -A INPUT -j DROP      # default deny
4
$ sudo iptables-save > /etc/iptables/rules.v4

1
$ sudo nft list ruleset
2
$ sudo nft add rule inet filter input tcp dport 22 accept

1
$ sudo firewall-cmd --list-all
2
$ sudo firewall-cmd --permanent --add-service=https
3
$ sudo firewall-cmd --permanent --add-port=8080/tcp
4
$ sudo firewall-cmd --reload

1
$ getenforce                          # show mode
2
$ sudo setenforce 0                   # set permissive (temp)
3
$ sudo setenforce 1                   # set enforcing (temp)
4
# Persistent: edit /etc/selinux/config
5
$ ausearch -m AVC -ts recent          # view denials

1
$ sudo aa-status                    # show profile status
2
$ sudo aa-complain /usr/sbin/nginx  # complain mode
3
$ sudo aa-enforce /usr/sbin/nginx   # enforce mode

1
# /etc/sudoers (edit with visudo)
2
%wheel  ALL=(ALL:ALL)  ALL
3
mohammad  ALL=(ALL)  NOPASSWD: /usr/bin/systemctl restart nginx
4
Defaults  logfile="/var/log/sudo.log"
5
Defaults  requiretty

1
$ sudo lastb | head -20       # failed logins
2
$ sudo last | head -20        # successful logins
3
$ sudo grep "Failed password" /var/log/auth.log

1
$ sudo auditctl -w /etc/passwd -p wa -k passwd_changes
2
$ sudo ausearch -k passwd_changes
3
$ sudo aureport --auth           # authentication report
4
$ sudo aureport --failed         # failed events

1
# Generate private key and self-signed cert (valid 365 days)
2
$ openssl req -x509 -nodes -days 365 \
3
    -newkey rsa:4096 \
4
    -keyout /etc/ssl/private/server.key \
5
    -out /etc/ssl/certs/server.crt \
6
    -subj "/CN=example.com/O=MyOrg/C=JO"
7

8
# Verify certificate
9
$ openssl x509 -in server.crt -text -noout