Skip to content

How-to guides

How-to guides are directions for a specific goal, such as extending a logical volume, rotating a certificate or recovering a system that won't boot. They assume you know the basics, start from a stated situation, and stop when the goal is reached.

Where steps differ between distributions, guides show tabs for Debian/Ubuntu, RHEL/Alma/Rocky, Arch and Gentoo. The tab you choose is remembered across pages.

Foundations

  • How to grant a user sudo access: Give a user full or limited administrator rights with sudo, using the admin group or a validated drop-in file in /etc/sudoers.d.

Boot and init

  • How to boot into rescue mode: Reach a rescue or emergency shell on a system that won't boot normally, make the root filesystem writable, fix the problem and return to a normal boot.
  • How to run a script as a service: Turn a small shell script into a service that starts at boot and is restarted if it fails, with systemd or OpenRC.

Software management

  • How to add a third-party repository safely: Add a vendor's package repository with its signing key checked and scoped as narrowly as each package manager allows, so that it can't silently replace distribution packages.
  • How to find which package provides a file: Find the package that owns a file on the system, or the package to install to get a missing command or file, on every supported distribution.
  • How to hold a package at its current version: Stop the package manager from upgrading one package while the rest of the system keeps updating, check that the hold works, and release it again.
  • How to roll back a package update: Return a package to the version it had before an update, find where the older version can still be found on each distribution, and keep the update from coming straight back.

Storage

Processes and performance

Network configuration

  • How to add a persistent static route: Add a route to a remote network through a gateway, test it with ip route, then make it survive a reboot with each distribution's default network tooling.

Network services

  • How to harden the SSH server: Turn off password and root logins, limit who can log in, and tighten authentication limits with an OpenSSH drop-in file.

Network security

Host security and hardening

  • How to enable automatic security updates: Install security updates automatically with unattended-upgrades on Debian and Ubuntu and dnf-automatic on the RHEL family, and on Arch and Gentoo automate the check rather than the upgrade.
  • How to troubleshoot SELinux or AppArmor denials: Confirm that SELinux or AppArmor is refusing an access, read the denial in the logs, and fix its cause with the right label or profile rule while enforcement stays on.
  • How to audit access to a file: Record every read, write and attribute change of a sensitive file with an audit rule that survives reboots, then find out from the audit log who accessed it.
  • How to enforce a password policy: Require long passwords with several character classes for local accounts, set password ageing defaults, and test that a weak password is refused and a strong one accepted.

Logging, monitoring and observability

  • How to forward logs to a remote syslog server: Send a machine's log messages to a central syslog server over TCP with rsyslog or syslog-ng, buffering them while the server is unreachable, and prove that they arrive.
  • How to keep logs across reboots: Make the systemd journal persistent with a size limit, or check and size the syslog files on Gentoo, and prove that the previous boot's messages survive a reboot.
  • How to rotate an application's logs: Stop an application's own log files from filling the disk with a logrotate rule, test it with logrotate's debug and force modes, and make sure logrotate runs every day.
  • How to search the logs for a problem: Find the log messages behind a failed service or job by narrowing the system logs by time, source, priority and text, with journalctl or the syslog files.

Troubleshooting

Automation and configuration management

  • How to schedule a job with a systemd timer: Run a command on a schedule with a systemd service and timer unit, test that the timer fires, then set the real schedule with catch-up of missed runs and a randomised delay.
  • How to schedule a job with cron: Install and enable a cron daemon where there is none, schedule a command in /etc/cron.d or a user crontab, and check that it really runs.
  • How to write a safe shell script: Make a Bash script stop on errors, handle file names with spaces, clean up its temporary files, and pass ShellCheck, then test both its success and its failure path.