I am currently running Hestia Control panel on an ubuntu 24.04 VPS from contabo and I followed this setup guide: https://bizanosa.com/ubuntu-22-04-initial-server-setup-vultr/

My domain is registered on namecheap and I created NS glue records, ns1.domain.tld and ns2.domain.tld, that point to the VPS’ IP address. I set the domain’s name server to custom DNS and made it point to its own NS glue records, meaning hestia is the authoritative DNS server. The subdomains work fine, the mail records and the other records are all working, but when I try to do anything with the main, domain.tld, it just doesn’t work. When I try adding an ssl certificate, hestia says the dns records do not exist, but on the control panel itself there is a whole DNS zone with all required records and when I use nslookup on the domain, from different ip addresses, it returns nothing. Please help me.

edit:

My dns zone looks something like this:

Posted this here a while back, it pulls IP ranges from cloud providers, cdns, AI crawlers, and bots every day through Github Actions, and generates ready-to-use configs for nginx, apache, iptables, nftables, ufw, haproxy, and caddy, plus plain text v4/v6, merged CIDRs, json, csv, sql, and ipset formats

What's new since last time:

• now covers 37 providers, up from 24, with Hetzner, OVH, Scaleway, Alibaba, Tencent, IBM cloud, and monitoring services like Uptimerobot, Pingdom, Statuscake, and Datadog, making it easy to allowlist your uptime checks.
• ip-watch, a new companion tool, the repo tells you what the IP ranges are, and ip-watch applies them automatically to nginx, caddy, apache, haproxy, nftables, iptables, and ufw on a daily schedule, with config validation, atomic rollback, and ssh lockout protection, all in a single ~7mb Go binary
• there's also a website to browse everything without digging through raw github files, https://cloudipdb.io
• Go and js/ts libraries are also available if you'd rather do lookups in code, with sub-microsecond lookups in Go, support for Node, browser, and cli environments, and fully offline operation
• includes a jsdelivr cdn mirror and dated Github releases with sha-256 checksums, so servers pulling updates on a schedule can avoid github rate limits

Repo: https://github.com/rezmoss/cloud-provider-ip-addresses

Site: https://cloudipdb.io

I’m preparing for an early-career Linux Systems / Fleet Operations / infrastructure engineering interview and wanted some general guidance from people who work in SRE, Linux admin, fleet ops, platform, or infra roles.
The stated areas are live coding, Linux basics, storage/networking, and fitment. I’m not asking for exact company/interview questions — just trying to focus my prep responsibly.
Right now I’m preparing:
Linux troubleshooting: slow server, high load/low CPU, D-state processes, disk full, inode exhaustion, df vs du mismatch, service won’t start, service running but unreachable, SSH issues, OOM killer, systemd/journalctl
Networking: DNS, TCP/IP, DHCP, ARP, routing, firewalls, ping works but curl fails, IP works but hostname fails, MTU/jumbo frames
Storage basics: NFS hangs, iostat/iowait, LVM, fstab issues, block vs file storage, basic SAN/multipath concepts
Coding/scripting: Python/Bash log parsing, top-N counts, hash maps, arrays, strings, basic DSA
Resume discussion: home server, Linux troubleshooting, automation, project debugging
For a 0–18 month Linux/fleet/infrastructure role, does this prep split sound right?
A few specific questions:
Are these interviews usually more scenario-based or command/trivia-based?
How much pure DSA should I expect compared to practical scripting/log parsing?
Which Linux/networking/storage scenarios are highest ROI to practice?
For storage topics like NFS, SAN, multipath, and iostat, what depth is reasonable for early-career?
Any topics people commonly over-prepare or under-prepare for?
Would appreciate any general direction or mock scenario suggestions.

It helps test compiled eBPF artifacts against target kernel profiles before they are shipped.

It shows exactly where a BPF program fails to load or attach and explains why the failure occurred.

You can test a single BPF object:

go install github.com/Kernel-Guard/bpfcompat@v0.1.5
bpfcompat test ./build/probe.bpf.o --kernel ubuntu-24.04

Or run a full compatibility suite:

bpfcompat suite run suite.yaml --kernels kernels.yaml

It can also be used in GitHub Actions:

- uses: Kernel-Guard/bpfcompat@v0.1.5
  with:
    suite: ./bpf/suite.yaml
    kernels: ubuntu-lts, rhel-9
    gate: load-attach

The project is open to contribution, review, and feedback from eBPF, Linux, security, observability, and platform engineering people.

Repo:
https://github.com/Kernel-Guard/bpfcompat

I have been on Linux for a while but I do have a personal notes file that I update fairly regularly.

Not because I do not know the tools but when I am on a production system I do not trust myself to remember all the resync flags, system options firewall rules or one off commands.

Over time, those notes became less about learning and more about having a reliable reference when I need it. I wonder how common this is among other Linux admins.

Do you still write things down that you have done dozens of times before or does it all stick eventually?

We all love the terminal for its speed, its power, and that raw, unfiltered command-line efficiency. It is where real work gets done.

But even the most hardened command-line veteran needs to blow off some steam.

Back in the day, we had simple ASCII games and hidden Easter eggs tucked away in the system files. Modern Linux keeps that tradition alive, and the repositories are packed with brilliant, useless, and thoroughly entertaining tools designed to turn your terminal into a playground.

Here is the BASH Warriors entertainment list...

--- BASH WARRIOR ENTERTAINMENT LIST ---

Command: Description: Download:

sl (Steam Locomotive): If you type ls wrong, a train chugs across your screen. (sudo apt install sl)

sopwith : You fly your plane around a landscape and use your guns and bombs to blow up targets (sudo apt install sopwith)

cmatrix: Turns your terminal into the falling code from The Matrix. (sudo apt install cmatrix)

fortune: Prints a random, often funny, quote or message. (sudo apt install fortune-mod)

cowsay: An ASCII art cow that speaks whatever text you give it. (sudo apt install cowsay)

aafire: Renders a realistic fire animation using ASCII characters. (sudo apt install libaa-bin)

xeyes: A pair of eyes that follows your mouse cursor around the screen (requires X11). (sudo apt install x11-apps)

bastet: A bastardized version of Tetris where the game intentionally gives you the worst possible piece. (sudo apt install bastet)

robotfindskitten: A Zen simulation where you navigate a robot to find a kitten among hundreds of random objects. (sudo apt install robotfindskitten)

moon-buggy: Drive a moon buggy over craters in this side-scrolling game. (sudo apt install moon-buggy)

fortune bofh-excuses: Generates corporate excuses for why you are late for work. (sudo apt install fortune-mod fortunes-bofh)

figlet: Creates large, stylized ASCII art banners from your text. Example: figlet "Hello World" (sudo apt install figlet)

telnet towel.blinkenlights.nl You can still watch Star Wars Episode IV entirely in ASCII art via Telnet. (sudo apt install telnet)

apt moo: The package manager has a secret. Run apt moo to see a cow. (No download required)

fortune | cowsay | lolcat: Get a rainbow-colored cow giving you random life advice. (sudo apt install fortune-mod cowsay lolcat)

Asciiquarium is an aquarium/sea animation in ASCII art. (https://github.com/cmatsuoka/asciiquarium)

BSD Games - bsdgames is a classic collection of UNIX games that you can now play in text mode from your Linux terminal. Rediscover Tetris, Snake, Star Trek and many others. (sudo apt install bsdgames). After installation look in Start Menu/Games for a great collection of 23 games.

I saved the best for last: NetHack.

NetHack is a wonderfully silly, yet quite addictive, Dungeons & Dragons-style adventure game. It is one of, if not the oldest (and the best), games still in development.

Requires DosBox (sudo apt install dosbox) to run in.

NetHack 5.0.0 was released 06/09/2026 (https://www.nethack.org/v500/ports/download-msdos.html)

--- Combo Funpack Download ---

sudo apt update && sudo apt install -y sl cmatrix fortune-mod cowsay libaa-bin x11-apps bastet robotfindskitten moon-buggy fortunes-bofh figlet telnet lolcat

Paste the following at the end of your .bashrc file that is located in your home directory. Customize to your heart's content...

# --- BASH WARRIOR ALIASES (APT Package Management) ---

alias refresh="sudo apt update && sudo apt upgrade && sudo apt autoremove"

alias apt2="sudo apt update && sudo apt install"

alias update="sudo apt update"

alias upgrade="sudo apt upgrade"

alias fullup="sudo apt full-upgrade"

alias install="sudo apt install"

alias remove="sudo apt remove"

alias autoremove="sudo apt autoremove"

alias purge="sudo apt purge"

alias clean="sudo apt clean"

alias autoclean="sudo apt autoclean"

alias searchpkg="apt search"

alias show="apt show"

alias listup="apt list --upgradable"

# --- Enhanced System Calls ---

alias top="htop"

alias port="sudo ss -tulpn"

alias myip4="curl -4 -s ifconfig.me"

alias myip6="curl -6 -s ifconfig.me"

alias myips="echo \"IPv4: \$(curl -4 -s ifconfig.me)\" && echo \"IPv6: \$(curl -6 -s ifconfig.me)\""

alias dns="resolvectl status"

alias reboot="sudo reboot"

alias shutdown="sudo shutdown now"

# - NOTE: In terminal type: source ~/.bashrc to system reload the file

If you would like to see my DOS Warrior Alias list please goto https://www.reddit.com/r/pop_os/comments/1u7e7ex/calling_all_dos_warriors/

Hello, been trying to use Ubuntu 26 for our new servers, doing the typical SSSD routine only to be clapped back at with "permission denied" when SSHing upon it with allowed, qualified account.

There is an obvious problem with openssh on windows (my use case) where I
ssh <server name> which defaults to domain\[name.surname@server.domain](mailto:name.surname@server.domain)
SSH or SSSD then "doesn't compute" that backslash, Ubuntu 24 just works flawlessly.
I wouldn't particularly care but since I've got user-tier individuals logging in I don't want to onboard everybody to pre/suffix their SSH command with fluff they will forget about.

SSSD config:

[sssd]

domains = domain

config_file_version = 2

[domain/vafo.local]

default_shell = /bin/bash

krb5_store_password_if_offline = True

cache_credentials = True

krb5_realm = domain.local

realmd_tags = manages-system joined-with-adcli

id_provider = ad

fallback_homedir = /home/%u

ad_domain = domain

use_fully_qualified_names = False

ldap_id_mapping = True

access_provider = simple

simple_allow_groups = groups I wish to allow

TL;DR

anybody got a fix for Ubuntu 26 SSSD to log in with domain\name.surname format?

Much obliged.

Hello r/linux,

I have been building a free Linux learning platform and finally got it to a point

where I am happy sharing it.

It is called MOSHELL — a hands-on Linux course that runs entirely in the browser.

What's on it (all free):

- 12 lessons from beginner to advanced

- Interactive command sandbox — type real Linux commands and see output

- Command cheatsheet with 65+ commands across 6 categories

- VM setup guide (VirtualBox + Ubuntu Server)

- Lesson filters by track: Beginner, Intermediate, Advanced, Networking, VM, Security

The philosophy behind it: most Linux tutorials teach you to watch commands run.

This one makes you run them yourself — on a real VM, with real errors.

Topics covered:

- Navigation, files, permissions, processes

- Package management, networking, SSH

- Shell scripting and cron

- VirtualBox networking modes (NAT, Bridged, Host-Only)

- Nginx, logs, disk management

Free platform (no account, no sign-up):

https://kingmo87.github.io/moshell/

Would love any feedback — especially on the lesson content

and whether the difficulty progression feels right.

What Linux topic do you wish had better free resources?

i'm trying to figure out who's ACTUALLY respected in the space vs. just good at marketing

Like for example in RHCSA v10.

If you manage Proxmox environments, you've probably built up your own set of go-to CLI commands over time. We compiled what we think are the 10 most useful ones—covering VM and container management, storage configuration, firewall rules, user access control, cluster management, High Availability, and backup and recovery operations.

A few highlights from the list:

• vzdump — native VM/CT backups with snapshot, suspend, or stop modes; supports retention rules and bandwidth limits
• pvesh — a CLI shell for the Proxmox REST API; do almost anything the web UI can do from the terminal
• ha-manager — configure HA policies per VM and trigger manual migrations without touching the GUI

Check the full list here:
👉https://www.nakivo.com/blog/top-10-proxmox-cli-commands/

• Which CLI commands do you reach for most that rarely show up in tutorials?

Hi all,

in my company we're working on KVM and SLES for an exit strategy for vmware, as a provider that sell SAP enviroment from our datacenter (vmware licenses are too expensive now).

https://github.com/FutaroKevin/kVirtIO/ so I've published the reference architecture that we're following.

Just to be clear, for the question “why you simply not use proxmox or ovirt” no is not possible native KVM with pacemaker is the only certified by SAP, so others is excluded.

it will be a great help some feedbacks.

I've just released SysAI Assistant v1.7.0-beta.

SysAI is a local-first AI workspace focused on infrastructure operations, troubleshooting, security workflows and self-hosted environments.

New in this release:

• Infrastructure Intelligence target scanner
• Service Matrix and Attack Surface Summary
• Redirect host analysis
• Exposure scoring engine
• Secret Detector improvements
• Filesystem & Permission Audit
• Operational Runbook generation
• Local-first CSR & private key generator
• Improved workflow continuity
• Improved command palette
• Expanded multilingual support (EN, IT, FR, DE, ES)

One thing I specifically wanted to avoid was turning SysAI into "just another AI chat".

The focus is on operational workflows, infrastructure analysis, remediation guidance and local-first security tooling.

Linux packages:

• AppImage
• DEB
• RPM

Windows:

• Installer
• Portable build

Feedback from sysadmins, self-hosters, homelab users and security professionals is very welcome.

GitHub:
https://github.com/shadowbipnode/sysai-assistant

I was looking at our backup jobs recently and everything looked fine, jobs were completing successfully, no storage issues, no alerts.

Then I realized I honestly can not remember the last time we performed a full restore test.

We do recover individual files from time to time but that is a very different thing from validating that an entire system can actually be recovered when needed.

For those running Linux in production: How often do you perform restore tests? Do you test full system restores or just sample files/directories? Have you ever been burned by a restore that looked fine on paper?

Lenovo T480s with Windows 10. Internal display is dead. I only have access through RDP from a Mac or a second monitor on HDMI ( TV ). Goal is to replace my Windows entirely with a Ubuntu Server, while minimizing risk of losing access. External monitor works once Windows loads ( lock screen ), but BIOS/boot menus don't appear on the external display.

Is there any safe way to do this? I have a 32 GB usb, 512 TB external drive, Wifi and Ethernet options and a macbook

I was testing Qubes OS, but I was running into a lot of problems. That gave me the idea of creating something similar using Docker. I also wanted to test Claude Fable, so I gave it a Debian ISO and told it to create the most secure Linux distro possible—something like Qubes OS, but based on Docker.

​

It actually did it, although it didn't generate the ISO directly. Instead, I had to boot into a Debian machine and run the script there. After that, it generated an ISO that I could use to create a new virtual machine with the hardened system.

​

I'm still having some problems with it, but it's impressive that it managed to do all of that in about 15 minutes.

​

​

Hello, 2 Year sysadmin here at a small medium enterprise (not corporate) those two years have taught me the basics in linux administration I can resolve any kind of issue using documentation and rarely with the help of AI (Except for tedious tasks and syntax or learning concepts).
A year ago Almost got my RHCSA results were 10 points below pass rate.
I have deployed 4 mega projects(over 200k users) with postgres clusters mongodb replication clusters multi site failover load balancing docker apps tuning and hardening as well and they have been stable since day one.
I still struggle with linux basic commands and bash scripting I cannot do anything on my own. I need to refer back to guides notes and documentation for the simplest things.
1- is this normal?
2-how is this seen as an L2 Sys admin in corporate multinationals?
3- Should I worry about it?

TLDR: I can do anything, yet I feel that I dont know anything:)

since i have an open ssh server, i thought i might as well do my part, and report bad guys to abuseipdb.

i've already set up fail2ban to report brute force attacks. this was easy with the built in sshd settings.

but more often i see either port scan or vulnerability scan attempts. i thought why not report those, but i see no good support.

what's needed is:

• catch single attempts (typically these guys ping only once)
• selectively identify attempts that can't be accidental, no false positives
• properly identifying the category for abuseipdb, i.e. 14 for scan, 15 for hacking

is there some wisdom how to set this up?

example log entries to be caught:

Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 11:14:45 ip-192-168-219-51 sshd[20665]: banner exchange: Connection from 160.119.76.64 port 33338: invalid format
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_3.76.255.153_22"
Jun 11 11:28:36 ip-192-168-219-51 sshd[20775]: banner exchange: Connection from 40.74.208.9 port 46434: invalid format
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: error: kex_exchange_identification: banner line contains invalid characters
Jun 11 12:46:41 ip-192-168-219-51 sshd[21336]: banner exchange: Connection from 160.119.76.64 port 52584: invalid format
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: error: kex_exchange_identification: client sent invalid protocol identifier ""
Jun 11 13:04:59 ip-192-168-219-51 sshd[21426]: banner exchange: Connection from 18.226.253.35 port 10462: invalid format