Linux

Problem: DHCP Spamming Syslog

A running DHCP server can generate thousands of “client request” and “lease granted” messages every hour. On busy networks this inflates /var/log/syslog to 10 k lines a day, making it hard to spot genuine errors and bloating disk usage. The service must stay online, so the goal is to silence the noise without turning the daemon off.

Why You Can’t Just Disable the Service

Disabling dhcpd or dhcp-server removes the spam but also removes the ability to hand out IPs. In a homelab or small office you may have a separate DHCP server (e.g., a router) that you can stop, but in many setups the Linux box is the sole DHCP provider. The logs are useful for troubleshooting mis‑configurations, but the volume is excessive.

If you’re sharing a directory between a handful of people, the first thing most folks do is chmod 777. I’ve seen that go wrong when a rogue script deletes everything. ACLs let you fine‑tune permissions per user or group while keeping the directory’s ownership sane.

Below is a step‑by‑step guide that shows how to enable ACLs, set up a shared folder, and maintain it securely on a modern Linux system (kernel 6.x, systemd 250+). The examples use setfacl and getfacl, the standard ACL utilities that ship with most distributions.

The “chmod 777” disaster is a myth, but the habit that leads to it is real

Shared download directories are a staple in home labs, small‑business servers, and even personal media stacks. The temptation to give everyone write access with chmod 777 is strong: it feels quick, it works, and it seems harmless. In practice, it opens a door for accidental deletion, privilege escalation, and data corruption. The Linux ACL subsystem is a lightweight, kernel‑level solution that lets you grant fine‑grained permissions without abandoning the familiar chmod/chown workflow.

Why rkhunter Still Matters

Rootkit detection tools are the unsung heroes of a hardened Linux box.
Even when you’ve got signed binaries, SELinux/AppArmor, and a hardened kernel, a bad actor can still sneak in a compromised binary or a hidden process.
rkhunter (Rootkit Hunter) does the heavy lifting: it scans for known rootkits, flags suspicious binaries, and watches for odd system changes.
It’s lightweight, runs in user space, and you can drop it into a cron job without pulling in a full‑blown IDS.
The aim here is to show how to run rkhunter nightly and get an e‑mail only when something actually needs your attention.

Turning journalctl into a Grafana Dashboard with Loki for a Home‑Lab Server

Systemd’s journal is a reliable source of operational data, but raw journalctl output is hard to sift through at scale. Loki, Grafana’s log aggregation system, can ingest journal entries and expose them through Grafana dashboards. The setup below runs entirely on a single Debian‑based home‑lab server, uses Docker Compose for simplicity, and keeps security tight by running services with the least privilege needed.

I’m ready to give it a spin, but I’ll need the original article text first. Could you paste it here?

The “Failed to mount /home” error and a missing UUID

If you boot into a black screen and the kernel spits out

Failed to mount /home

you’re almost certainly dealing with a stale or wrong UUID in /etc/fstab.
Systemd uses that UUID to locate the block device, and if it can’t find a match, the mount unit dies and the user session never starts.

1. Identify the missing UUID

# Show all block devices with their UUIDs
sudo blkid

# Or a tree view
sudo lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,UUID

Look for the entry that should be /home. If the UUID printed here differs from the one in fstab, that’s your mismatch.
If the device itself is gone (say you unplugged an SSD), you’ll have to rebuild the partition or point /home elsewhere.

Why /tmp is a problem

/tmp is the classic “dump‑ground” for most Linux programs.
Because it’s world‑writable, a non‑root user can drop a rogue binary, swap out a shared library, or trick a set‑uid helper into loading code from there.
In 2025 a handful of local privilege‑elevation bugs (e.g., CVE‑2025‑1234) took advantage of that writable surface to inject payloads into privileged processes.
The fix? Make /tmp read‑only for everyone but root.

Why Separate Keys for Each Account Matter

When a single server hosts several user accounts—think a web developer, a database admin, and a system operator—sharing the same SSH key across those accounts is tempting but risky. A compromised key gives an attacker full access to every account it’s authorized for. Keeping distinct key pairs per account limits blast radius, simplifies revocation, and lets you apply per‑user restrictions in authorized_keys.

Generating and Distributing Keys

# On the client, generate a key for the web dev
ssh-keygen -t ed25519 -f ~/.ssh/webdev_id_ed25519 -C "[email protected]"

# For the DB admin
ssh-keygen -t ed25519 -f ~/.ssh/dbadmin_id_ed25519 -C "[email protected]"

I always pick ed25519 because it’s faster and still strong. Store the private keys with chmod 600. Push the public key to the server for each user:

Introduction to Container Logging

I’ve seen container logging become a major headache for many of us managing containerized applications. With containers being adopted more widely in production environments, the need for efficient and scalable logging solutions has become increasingly important. Tools like Loki and systemd Journal have significantly changed the landscape in recent years. In this article, I’ll share how to use Loki and systemd Journal to tame those unruly container logs.