Linux Server Admin with Fexingo: Sysadmin, Bash, and Server Engineering

Episode 29 of Linux Server Admin with Fexingo dives into the hidden bottleneck in systemd's journald: the default rate-limiting settings that silently drop log entries during bursts, making debugging impossible when you need logs most. Lucas and Luna walk through a real scenario where a busy web server was losing critical audit records because journald capped the rate at 10,000 messages per 30 seconds. They explain how to diagnose with journalctl --list-boots showing gaps, how to override the rate limits and max log size via drop-in configs in /etc/systemd/journald.conf.d, and why moving to persistent storage with proper rotation beats the default volatile setup. The episode also touches on when to forward logs to a remote syslog or Elastic stack rather than tuning local journald, and the trade-off between log completeness and disk wear on SSDs. Practical, specific, and immediately actionable for anyone running Linux servers in production.

#Linux #Sysadmin #Journald #Systemd #ServerEngineering #Logging #RateLimiting #Bash #Technology #FexingoBusiness #BusinessPodcast #LinuxServerAdmin #Podcast #DevOps #Infrastructure #ProductionDebugging #Journalctl #DropInConfig

Keep every episode free: buymeacoffee.com/fexingo

In this episode of Linux Server Admin, Lucas and Luna dive into AppArmor—the mandatory access control system that's simpler than SELinux but powerful enough to confine major services like Nginx, MySQL, and Apache. They walk through a real-world case: a misbehaving PHP script that tried to write to /etc/passwd on a production web server, and how an AppArmor profile blocked it instantly. Lucas explains the difference between complain mode and enforce mode, how to generate profiles with aa-genprof, and why you should never run a profile in complain mode in production without auditing the logs. Luna challenges whether AppArmor is enough by itself, and they discuss defense-in-depth. A concrete episode for anyone running Linux servers who wants to lock down services without the overhead of SELinux.

#AppArmor #LinuxSecurity #MandatoryAccessControl #ServerHardening #NginxSecurity #MySQLSecurity #aaGenprof #LinuxSysadmin #SecurityProfiles #LinuxServer #Infosec #Sysadmin #Technology #LinuxAdmin #FexingoBusiness #BusinessPodcast #TechPodcast #DevOps

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into a practical server engineering headache: timeouts. Lucas explains why the default systemd service timeout of 90 seconds can cause cascading failures in production, especially for long-running database migrations or backup jobs. He walks through creating drop-in units to override timeout settings without touching vendor-provided service files, using a real case from a PostgreSQL migration that kept failing under the default TimeoutStopSec. Luna challenges when to use drop-ins vs. forking the unit file, and they discuss the trade-offs between tight timeouts for fast-fail and generous ones for graceful shutdown. A concrete episode for anyone who's ever watched systemctl hang on a restart.

#Systemd #DropInUnits #LinuxServer #Sysadmin #Timeouts #PostgreSQL #ServerEngineering #Bash #Technology #Infrastructure #DevOps #Systemctl #UnitFiles #GracefulShutdown #Production #FexingoBusiness #BusinessPodcast #ServerAdmin

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into SELinux on Linux servers — specifically, why and how to implement targeted policies without breaking production workloads. Lucas walks through a real case from a financial services company that reduced their kernel-level vulnerability exposure by over 80 percent after enabling SELinux in enforcing mode on 200 servers. They discuss the common pain points: learning the audit2allow workflow, writing custom policy modules, and handling SELinux denials. They also compare SELinux to AppArmor, explaining when each makes sense. The conversation is grounded in practical steps — no theoretical fluff. By the end, listeners learn one concrete command sequence they can test on a non-production box this week. This episode is essential for any sysadmin who wants to move beyond basic file permissions and actually lock down their system calls.

#SELinux #LinuxSecurity #ServerHardening #Sysadmin #AccessControl #MandatoryAccessControl #SecurityPolicies #audit2allow #AppArmor #KernelSecurity #LinuxServer #ServerEngineering #Bash #DevOps #Technology #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 25 of Linux Server Admin with Fexingo: Sysadmin, Bash, and Server Engineering dives into SSH key hygiene. Lucas and Luna walk through a real-world scenario: a startup that accumulated 400 authorized SSH keys across 60 servers, with keys tied to former employees and contractors still active. They explain why this happens, how to inventory keys using simple Bash scripts and tools like ssh-audit, and how to enforce rotation policies with certificates and short-lived keys. By the end, you'll know how to run a one-liner to list every key on a server, why you should disable password authentication entirely, and how to build a renewal cadence that matches your team's turnover. Practical, specific, and immediately actionable for anyone managing Linux servers.

#SSHKeys #ServerSecurity #LinuxSysadmin #BashScripting #KeyRotation #ssh-audit #AuthorizedKeys #Authentication #DevOps #InfrastructureSecurity #CertificateAuth #ShortLivedKeys #Linux #SysadminHardening #ServerManagement #Business #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 24 of Linux Server Admin with Fexingo digs into a critical but often overlooked security gap: the sudoers file. Lucas and Luna walk through a real-world misconfiguration that gave an attacker passwordless root access on a monitoring server, and explain how to lock down sudo with defaults, timed credentials, command aliases, and the sudo_logsrvd audit daemon. They cover the new sudo 1.9.14 timeout policy, the difference between NOPASSWD and timed permissions, and why logging every sudo invocation matters for incident response. If you maintain Linux servers in production, this episode gives you one concrete change to make today.

#Linux #Sysadmin #SudoSecurity #Sudoers #ServerHardening #PrivilegeEscalation #CommandLogging #SudoLogsrvd #LinuxSecurity #DevOps #InfrastructureSecurity #ITSecurity #OpenSource #Technology #ServerAdministration #FexingoBusiness #BusinessPodcast #LinuxServerAdmin

Keep every episode free: buymeacoffee.com/fexingo

Episode 23 of Linux Server Admin with Fexingo. Lucas and Luna dig into one of the most common yet misunderstood server failure modes: swap thrashing. They walk through a real scenario where a Postgres query triggered the OOM killer, and explain why the default vm.swappiness of 60 is almost always wrong for production. You'll learn exactly how to set swappiness to 10, configure systemd-oomd, and add swap health checks to your monitoring stack. No theory – just the specific sysctl values, the exact log patterns to grep for, and the one line of PromQL that catches the problem before pager duty calls. If your servers rely on swap, this episode will save you a 3 AM wake-up.

#Linux #Sysadmin #ServerAdmin #Swap #MemoryManagement #OOMKiller #Postgres #Systemd #Monitoring #Performance #vmSwappiness #Sysctl #PromQL #Bash #DevOps #FexingoBusiness #TechPodcast #ServerEngineering

Keep every episode free: buymeacoffee.com/fexingo

Lucas walks Luna through the blue-green deployment pattern, a strategy that eliminates application downtime during updates by running two identical production environments and switching traffic atomically. They break down the exact steps: provisioning a standby environment, running health checks on the new version, flipping the load balancer, and rolling back instantly if something breaks. Lucas uses a concrete example of a Node.js API service behind an Nginx reverse proxy, explaining how to script the switch with a simple shell loop. Luna asks about database schema changes during a swap — Lucas explains the read-only and dual-write patterns that keep data consistent. The episode also covers the biggest risk: stale connections and in-flight requests. By the end, listeners will know exactly how to implement blue-green for their own stack without buying extra infrastructure.

#BlueGreenDeployment #ZeroDowntime #DevOps #SiteReliabilityEngineering #Nginx #LoadBalancing #NodeJS #DatabaseMigrations #ContinuousDeployment #ShellScripting #ProductionDeployment #RollbackStrategy #ServerManagement #Technology #LinuxServerAdmin #FexingoBusiness #BusinessPodcast #InfrastructureAsCode

Keep every episode free: buymeacoffee.com/fexingo

Episode 21 of Linux Server Admin with Fexingo dives into the overlooked art of outbound email from headless servers. Lucas and Luna unpack why cron output, system alerts, and automated reports often vanish into the void, and how a tiny tool called nullmailer fixes it without a full mail stack. They walk through a real-world case: a staging server silently dropping backup failure alerts for six months because the standard sendmail compatibility layer wasn't configured. The hosts compare nullmailer with msmtp and postfix-satellite setups, explaining when each makes sense. They cover starttls vs. implicit tls, relay host authentication, and the single config file that routes all server mail through a transactional email provider. By the end, listeners know how to set up a five-minute mail relay that ensures no alert ever gets lost—and why that matters more than most realize.

#LinuxServerAdmin #Sysadmin #Bash #ServerEngineering #Technology #Nullmailer #EmailRelay #ServerAlerts #CronMail #Sendmail #Postfix #Msmtp #SMTP #Starttls #DevOps #ServerMonitoring #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into why a dedicated WireGuard VPN mesh beats traditional VPN setups for server-to-server communication. They walk through a real-world example of a three-node cluster where tailscale-style WireGuard overlay simplified firewall rules, reduced latency by 12 milliseconds, and cut configuration time from hours to minutes. Lucas explains the kernel-level efficiency of WireGuard versus OpenVPN, and Luna questions the trade-offs of managing a mesh at scale. The conversation covers handshake overhead, roaming endpoints, and why more sysadmins are adopting WireGuard as a service mesh alternative. A practical look at lightweight, encrypted networking for production Linux servers.

#WireGuard #VPNMesh #LinuxServer #Sysadmin #Networking #Encryption #KernelModule #OpenVPN #Tailscale #ZeroTier #ServerSecurity #UDP #NATTraversal #FirewallRules #Latency #DevOps #Technology #FexingoBusiness

Keep every episode free: buymeacoffee.com/fexingo