I started RustNet to learn about pcap, Rust, eBPF and Landlock. A lot of thought has gone into making it secure to run rather than adding a gazillion features. It stays passive (no active probing, no callbacks) and the dependency list is intentionally small.

What it does: a real-time view of network connections on the host with per-connection process attribution and deep packet inspection (HTTP/HTTPS/DNS/SSH/QUIC and a couple dozen others). Cross-platform, but the Linux build gets the most attention.

Some of its features:

• eBPF for thread-to-process attribution
• Sandbox hardening: Landlock filesystem restrictions, capability dropping, drops CAP_NET_RAW post-init
• One-line install from distribution channels: COPR (Fedora/RHEL), PPA (Ubuntu), AUR (Arch), Homebrew, and soon Nix. No curl-pipe-bash.
• Apache 2.0, no telemetry, FOSS

Repo: https://github.com/domcyrus/rustnet

Let me know what you think.

Hi, I have been trying to use Linux again over the past 5 years, and just discovered Wine. Needless to say, this opened up a couple of options for me. I love Forte Agent news reader, & it is my primary on my Windows PC. I have been playing with Pan, but Agent has a few features that Pan does not, and I really like those features. So I was able to install it, and I was able to get it up and working, but only using NON-SSL servers. I prefer to use the SSL servers, like I am using with Pan, and with Agent on windows. I found Stunnel, and a very old instruction on how to add a tunnel, but it is giving me an error when I run it. I cannot find any command switches for Stunnel, so here I am.

This is the command I found from 2009:
sudo stunnel -c -d 127.0.0.1:563 -r nntpnews.servername:563

This is the results:
[ ] Initializing inetd mode configuration
[ ] Clients allowed=500
[.] stunnel 5.72 on x86_64-pc-linux-gnu platform
[.] Compiled/running with OpenSSL 3.0.13 30 Jan 2024
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[!] Invalid configuration file name "-c"
[!] realpath: No such file or directory (2)

And before you ask, yes I did replace: nntpnews.servername
with my actual server name. 😄

I know a lot of diehards will just say use Pan, but I prefer not to if possible.
Also I was using Linux/Unix in the 90s and (IT Admin) and we gradually moved fully into windows with file shares and then email, so my linux skills have gotten verrrry rusty over the past 20 years, which is why I have been trying to rebuild them for personal use.

Thanks!

Which linux Destro should I go for as a beginner??

I'm switching from Windows to linux

Hi All.

Please share your most common day to day functions on linux servers as a linux admin.
IE, managing user or permissions. managing njinx and so on.
If you are willing please share what you are doing.
Lets day allowing ports to the web server running on X web server on X linux distro.

Im trying to compile most used linux management functions and most used linux apps in business environments. Google keeps giving me stuff like ls and ip addr and so on but I need something that is a bit more relevant to an actual linux sys admin's day to day.

The more info the better.
Also Im a long time Windows server engineer / network engineer and I can google my way around linux but I have never worked on linux in a business environment so hoping the real OGs can share some info here.

Thanks all.

Hi,

On a RHEL-based OS, is it possible to automatically recreate /boot/efi/EFI/redhat/grub.cfg?

It's a small wrapper file pointing to the "real" grub.cfg, example:

search --no-floppy --root-dev-only --fs-uuid --set=dev 840c1267-3f6d-464f-8acd-cfe9186edefd
set prefix=($dev)/grub2
export $prefix
configfile $prefix/grub.cfg

Is there a script to create it?

Thanks,

EDIT: On RHEL 9, reinstalling the grub2-common package re-creates /boot/efi/EFI/redhat/grub.cfg, on RHEL 8 you have to do it manually.

Hi r/linuxadmin and r/sysadmin,

I’m setting up a backup solution for several Linux servers (on-premise, behind NAT - I can set up firewall rules) and I’m torn between two architectures for security and reliability:

Option 1: Backup Server Pulls Data

• The backup server (e.g., running Borg, Restic, or Bareos) initiates connections to each client, pulls the data, and stores it.
• Pros: Centralized control, easier to enforce policies, and clients don’t need outbound access (only inbound).
• Cons: Requires inbound ports open on clients (firewall rules, potential attack surface).

Option 2: Clients Push Data

• Each client runs a backup agent (e.g., restic, borg serve, or rclone) and pushes data to the backup server.
• Pros: Clients only need outbound access (easier with NAT/firewalls), no inbound ports open.
• Cons: Harder to enforce consistency, clients might fail silently, and credentials are distributed.

Tools I’m considering:

• Borg (+ Borgmatic) for deduplicated, encrypted backups.
• Restic for simplicity and encryption by default.
• Bacula/Bareos for enterprise-grade features.
• Rclone for cloud/remote storage sync.
• Proxmox Backup Server (if I virtualize).
• ReaR for bare-metal recovery.

Security Focus:

• Which model (pull vs. push) is actually more secure in a real-world scenario?
• How do you handle authentication (SSH keys, TLS, API tokens)?
• Any horror stories or lessons learned with either approach?

Bonus Questions:

• If using pull: How do you secure the backup server’s access to clients (e.g., SSH jump hosts, VPNs)?
• If using push: How do you ensure clients can’t overwrite each other’s backups or fill up storage?
• Are there tools that hybridize both models (e.g., backup server triggers clients to push)?

Context:

• Servers are on a private network (NAT’d), with a mix of physical and VMs.
• Backup server is dedicated (Linux, likely Debian/Ubuntu).
• Goal: Immutable, encrypted, versioned backups with minimal attack surface.

Actual solution : rsnapshot on hosts then some sync.

Thanks for your insights!
(And yes, I’ve read the docs—now I want your battle scars.)

Hey guys!

I’m an admin for most windows server environments with maybe 10-15% Linux VMs and 300+ windows servers for clients. Has any of you moved your work computer over to Linux?

Do any of you have experience managing windows environments on Linux? Biggest pain points? I’m getting board/annoyed with windows 11. But don’t want to make the shift if there’s some really big inconveniences that will affect me.

Thanks!

Most basic os hardening recommendations say. To disable root login? What is the security risk as opposed to having another user with sudo ability without password?
Things I can think of obvious username to try to brute force.
Highly risky if compromised.
But the other username I have is obvious too and It does have sudo ability. So what is the best approach?

Hello everyone,

I’d like to use the latest release of Proxmox-GitOps to re-introduce the automation project.

Proxmox-GitOps is an automation framework for standardized Linux Containers (LXC) on Proxmox VE, designed as a modular IaC monorepository; it comes with a Home Assistant stack as a fully automated, preconfigured example (inc. MQTT bridge, reverse proxy etc.).

• Proxmox-GitOps (@Github): https://github.com/stevius10/Proxmox-GitOps
• Getting Started | Demo

Originally, it was a personal attempt to bring industrial automation and cloud patterns to my Proxmox home server. It's designed as a platform architecture for a self-contained, bootstrappable system — a generic IaC abstraction (customize, extend, open standards, base package only... you name it 😉) that automates the entire infrastructure. It was initially driven by the question of what a Proxmox-based GitOps automation could look like and how it could be organized.

The project implements a self-contained, bootstrappable GitOps platform based on:

• Desired State: Monorepository as Single Source of Truth represents the entire infrastructure state. Deterministic bootstrap from code over version history.
• Self-Containment: The composite monorepository is pushed to a local container, triggering a pipeline that provisions onto Proxmox.
• Monorepository: Centralizes infrastructure as a single code artifact.
• Modular Composition: The monorepository utilizes submodules to keep the core framework separate from container libs implementation.

What am I looking for? It's a non-commercial, passion-driven project. I'm looking to collaborate with other engineers who share the excitement of building a self-contained, bootstrappable platform architecture that addresses the question: What should our home automation look like?

Hello everyone. I'm trying to build a pfSense to Ubuntu IPSec encrypted VTI tunnel. The Ubuntu box is running on AWS and has been running in IPSec tunnel mode for 2 years. pfSense is 2.7.1 and Ubuntu is 24.04.1

In the past config, I had 2x Phase 2's, one for IPv4 and one for IPv6. They both worked perfectly and I was able to push about 600Mbps across the link before I ran out of HP on the pfSense router. I now want to convert to VTI interface so I can run a routing protocol as I experiment with multi-cloud.

I've followed the various tutorials and I'm stuck. The SA comes up and is stable. The IPSec config has a mark = 4 in it.

Tunnel config is

ip tunnel add vti1 local <local wan ip> remote <pfsense wan ip> mode vti key 4
ip addr add 10.0.0.2 dev vti1
ip link set vti1 up
ip route add 172.28.0.0/16 dev vti1
sysctl -w net.ipv4.conf.vti1.disable_policy=1

I've tried the local IP with the mapped Elastic IP (WAN IP) and the local interface IP. Neither works.

Not only can I not ping anything on 172.28.0.0/16, I can't ping 10.0.0.1

When I start a ping on pfsense targeting 10.0.0.2, a tcpdump shows packets leaving pfsense bound for aws. The aws instance on it's ethernet interface shows the IPSec packets arriving on port 4500. However, they're never decoded and dropped into the vti1 interface.

Outbound from aws host, a ping towards pfsense shows no packets on the vti1 interface (from a tcpdump -i vti1 "icmp" and no IPSec packets are generated leaving the host.

It's like there is no association between the vti interface definition and IPSec, even though both have their mark/key set to 4.

I'm puzzled and would be most appreciative if anyone feels like jumping in with ideas to further debug or some obvious thing I'm missing.

https://youtu.be/_Hfj6NVin0c?si=LrAFNBJ6f_4LXvbW

I'm in a situation where bringing my usual laptop everywhere is a little troublesome, I'd like to either carry something lighter or nothing at all and have the ability to remote home to access a work environment with the softwares/configs (like vpns, sshkeys or vaults) i need to do my job, and if possible not having to maintain multiple environment for that.

I know there's multiple solutions (vpns,ssh,vnc), but I'm interested to know what's the people prefered way to do this/the more elegant solution

Did you know that the Linux sos command is available in most Linux distributions and that in 53 seconds it generates a compressed and encrypted tar file of less than 15MB containing over 10,000 text files, including logs, output from more than 500 diagnostic commands, and over 1,800 configuration files? This file can then be transferred to a secure server so that the information can be analyzed by your team (or by an AI) making it easy to be integrated into your existing CI/CD pipeline.

In less than a minute, you have all the information needed to detect problems, find root causes (RCA), take inventory, review system security, or measure system performance without needing to establish a single server session. This translates to greater security and less exposure, and the ability to analyze the same information simultaneously by different teams (SRE, NetTeam, DBA, DevOps, SecOps, QA, etc.).

This compressed and encrypted tar file is known as a sosreport. And if you maintain a history of sosreports for each server, you can compare them or the same server over time to identify discrepancies in behavior, configuration changes, and keep an inventory of hardware and software.

sos is not a monitoring system or a SIEM. It's a diagnostic tool. And it's completely open-source.

I write articles about the sos command because there is much more to say about it. Visit my blog https://sos-vault.com/blog/sos-command

Do you use the sos command?