Linux

Emergency mode after an initramfs update

After a kernel upgrade the initramfs is rebuilt automatically.
If a module slips through the cracks or a hook gets mis‑configured, the machine will drop into emergency mode with a terse prompt:

Emergency mode – root account password required

You’re not stuck forever; the problem is almost always a missing or mis‑mounted filesystem, a bad fstab, or a broken initramfs that can’t mount the root partition. Below is a practical walk‑through that keeps your data safe and pays attention to security.

I’d love to help polish the article, but I need the original draft first. Could you paste the text here so I can rewrite it while keeping all the technical details and formatting?

The Problem

dhclient is the classic DHCP client on most distributions.
When a network interface comes up, it writes a line for every lease request, renewal, and release. On a busy server or in a homelab with multiple interfaces, those lines can fill the journal within minutes, making journalctl -b noisy and slowing down log‑based monitoring.

Why It Matters

• Log Volume – A full journal consumes disk space and can trigger automatic rotation or deletion, potentially discarding useful diagnostics.
• Performance – Writing thousands of lines per boot can add a few milliseconds to the boot time, which matters for high‑availability systems.
• Security – While the messages themselves are harmless, a cluttered journal can mask real events, and excessive logging can expose sensitive data if the logs are forwarded to an insecure remote collector.

The One‑Line Solution

Systemd’s syslog.d directory lets you filter messages before they reach the journal. A single rule is enough to silence all dhclient output:

Why Key‑Only for a Few Users Matters

Running an SSH service usually lets you try both password and key authentication. Most of the time key‑only is the safer bet, but you might want to enforce it only for a handful of high‑privilege accounts—developers, sysadmins, or anyone who needs to keep a tight grip on the machine. OpenSSH’s Match directive makes that a breeze without touching the global defaults.

Configuring Match User

Open the daemon configuration:

Problem: DHCP Spamming Syslog

A running DHCP server can generate thousands of “client request” and “lease granted” messages every hour. On busy networks this inflates /var/log/syslog to 10 k lines a day, making it hard to spot genuine errors and bloating disk usage. The service must stay online, so the goal is to silence the noise without turning the daemon off.

Why You Can’t Just Disable the Service

Disabling dhcpd or dhcp-server removes the spam but also removes the ability to hand out IPs. In a homelab or small office you may have a separate DHCP server (e.g., a router) that you can stop, but in many setups the Linux box is the sole DHCP provider. The logs are useful for troubleshooting mis‑configurations, but the volume is excessive.

If you’re sharing a directory between a handful of people, the first thing most folks do is chmod 777. I’ve seen that go wrong when a rogue script deletes everything. ACLs let you fine‑tune permissions per user or group while keeping the directory’s ownership sane.

Below is a step‑by‑step guide that shows how to enable ACLs, set up a shared folder, and maintain it securely on a modern Linux system (kernel 6.x, systemd 250+). The examples use setfacl and getfacl, the standard ACL utilities that ship with most distributions.

The “chmod 777” disaster is a myth, but the habit that leads to it is real

Shared download directories are a staple in home labs, small‑business servers, and even personal media stacks. The temptation to give everyone write access with chmod 777 is strong: it feels quick, it works, and it seems harmless. In practice, it opens a door for accidental deletion, privilege escalation, and data corruption. The Linux ACL subsystem is a lightweight, kernel‑level solution that lets you grant fine‑grained permissions without abandoning the familiar chmod/chown workflow.

I’d be happy to help polish the piece, but I’ll need the original article text to work from. Could you paste it here?

Why rkhunter Still Matters

Rootkit detection tools are the unsung heroes of a hardened Linux box.
Even when you’ve got signed binaries, SELinux/AppArmor, and a hardened kernel, a bad actor can still sneak in a compromised binary or a hidden process.
rkhunter (Rootkit Hunter) does the heavy lifting: it scans for known rootkits, flags suspicious binaries, and watches for odd system changes.
It’s lightweight, runs in user space, and you can drop it into a cron job without pulling in a full‑blown IDS.
The aim here is to show how to run rkhunter nightly and get an e‑mail only when something actually needs your attention.

I’m ready to help with the rewrite, but I need the article text first. Could you paste the draft you’d like me to refine?