Systemd

Why split DNS between interfaces?

When a machine plugs into a VPN it usually needs to look up hostnames that live only inside that tunnel.
If you let the whole system talk to the same nameserver, two things can go wrong:

• The VPN’s DNS might not be reachable until the tunnel is up, so internal lookups fail.
• Public resolvers get handed internal queries, leaking sensitive names to the outside world.

Binding a dedicated DNS server to the VPN link keeps the resolver stack tidy, cuts the attack surface, and stops accidental leaks.

A One‑Command Escape from Emergency Mode

When a typo in /etc/fstab stops the root filesystem from mounting, Ubuntu 24.04 drops straight into emergency mode. You get a read‑only root shell, but that’s not useful because you can’t edit the offending line—root is already mounted read‑only. The usual fix is to reboot, pull out a live USB, and patch the file from there.
There’s a much quicker way that keeps you on the same machine, preserves the state, and lets you fix the problem in place.

The Problem

dhclient is the classic DHCP client on most distributions.
When a network interface comes up, it writes a line for every lease request, renewal, and release. On a busy server or in a homelab with multiple interfaces, those lines can fill the journal within minutes, making journalctl -b noisy and slowing down log‑based monitoring.

Why It Matters

• Log Volume – A full journal consumes disk space and can trigger automatic rotation or deletion, potentially discarding useful diagnostics.
• Performance – Writing thousands of lines per boot can add a few milliseconds to the boot time, which matters for high‑availability systems.
• Security – While the messages themselves are harmless, a cluttered journal can mask real events, and excessive logging can expose sensitive data if the logs are forwarded to an insecure remote collector.

The One‑Line Solution

Systemd’s syslog.d directory lets you filter messages before they reach the journal. A single rule is enough to silence all dhclient output:

The “Failed to mount /home” error and a missing UUID

If you boot into a black screen and the kernel spits out

Failed to mount /home

you’re almost certainly dealing with a stale or wrong UUID in /etc/fstab.
Systemd uses that UUID to locate the block device, and if it can’t find a match, the mount unit dies and the user session never starts.

1. Identify the missing UUID

# Show all block devices with their UUIDs
sudo blkid

# Or a tree view
sudo lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,UUID

Look for the entry that should be /home. If the UUID printed here differs from the one in fstab, that’s your mismatch.
If the device itself is gone (say you unplugged an SSD), you’ll have to rebuild the partition or point /home elsewhere.

Why /tmp is a problem

/tmp is the classic “dump‑ground” for most Linux programs.
Because it’s world‑writable, a non‑root user can drop a rogue binary, swap out a shared library, or trick a set‑uid helper into loading code from there.
In 2025 a handful of local privilege‑elevation bugs (e.g., CVE‑2025‑1234) took advantage of that writable surface to inject payloads into privileged processes.
The fix? Make /tmp read‑only for everyone but root.

Introduction to Container Logging

I’ve seen container logging become a major headache for many of us managing containerized applications. With containers being adopted more widely in production environments, the need for efficient and scalable logging solutions has become increasingly important. Tools like Loki and systemd Journal have significantly changed the landscape in recent years. In this article, I’ll share how to use Loki and systemd Journal to tame those unruly container logs.

Introduction to resolvectl

I’ve been using resolvectl for a while now, and I’ve found it to be a powerful tool for managing DNS resolution on Linux systems that use systemd. It provides a flexible and efficient way to configure DNS settings, including DNS over TLS (DoT) and DNS over HTTPS (DoH). As of 2026, many Linux distributions, including Arch Linux and Ubuntu, have adopted systemd-resolved as the default DNS resolver. This is a good thing, in my opinion, as it simplifies DNS management and provides better security features out of the box.

Introduction to Journalctl Filters

I’ve seen log management become a major headache when working with Linux systems - it’s crucial for troubleshooting, security auditing, and system maintenance. That’s where journalctl comes in, a powerful tool provided by systemd for managing and analyzing log data. But let’s be honest, dealing with the sheer volume of log entries can be overwhelming. This article will show you how to tame that “log noise” using journalctl’s built-in filters and priorities.

Introduction to resolvectl

I’ve seen my fair share of DNS issues on Linux, and one of the most powerful tools in my arsenal is resolvectl. Before diving into debugging, you may want to review our guide on DNS configuration and troubleshooting with resolvectl for a broader overview of the tool’s capabilities. This command-line utility is part of the systemd suite and provides a comprehensive way to query and configure DNS settings on your system. In practice, resolvectl can be a lifesaver when dealing with stubborn DNS problems. Here, we’ll dive into how to use resolvectl to debug these issues, exploring its capabilities, and providing practical examples to help you troubleshoot and resolve DNS problems efficiently.

Introduction to Socket Activation

I’ve seen socket activation become a game-changer for managing network services in Linux. By decoupling service activation from the actual service process, you gain more control over service exposure and can significantly improve security and reliability. In this article, we’ll dive into the world of systemd’s socket activation and explore how to harness its power.

What is Socket Activation?

Socket activation is a mechanism that allows systemd to manage network sockets independently of the service process. When a socket is activated, systemd creates a listening socket and waits for incoming connections. Once a connection is established, systemd starts the corresponding service process, passing the socket as a file descriptor. This approach provides several benefits, including improved security, better resource utilization, and increased flexibility. Don’t bother with trying to implement this manually - systemd makes it relatively straightforward.