Knowing how to find and manage processes is fundamental sysadmin work. It’s not glamorous, but it comes up constantly — debugging a runaway process eating CPU, finding what’s holding a port open, or tracing which process opened a particular file. ps: The Process Snapshot ps shows a snapshot of current processes. The options are confusing […]

Cron is one of those tools that’s been around so long and is so widely used that most people learn just enough to make it work, then stop. But there are enough gotchas and useful features that it’s worth understanding properly. The Cron Daemon and Config Files crond (or cron on some systems) is the

Getting a wildcard certificate from Let’s Encrypt is a bit more involved than a regular single-domain cert. You can’t use an HTTP challenge for wildcards — Let’s Encrypt requires DNS validation, which means you need to create a TXT record to prove you own the domain. That adds complexity, but once it’s set up and

Managing TLS in Kubernetes is different enough from regular server TLS that it’s worth covering separately. The concepts are the same — certificates, private keys, certificate authorities — but the mechanics of how you provision, store, and rotate certificates involve Kubernetes-specific objects. I’ve worked through this on a few clusters. Here’s the practical picture. The

Security headers are easy to overlook. They’re not flashy — users never see them — but they add meaningful protection against a range of attacks: clickjacking, XSS, MIME sniffing, cross-origin data leaks. Adding them takes maybe 15 minutes, and scanners like securityheaders.com will grade your site. Here’s what I actually set and why each one

Fail2ban is one of those tools I install on every server within the first 30 minutes. It’s not a silver bullet — a determined attacker with a botnet of millions of IPs won’t be slowed down much — but it handles opportunistic attacks effectively and keeps your auth logs from filling up with garbage. The

Networking is the thing that trips up most people learning Docker. Container A can’t reach container B, or a container can’t reach the internet, or you expose a port but nothing connects. Most of these problems come down to not understanding how Docker’s networking modes actually work. I spent a fair amount of time confused

DNS is something most sysadmins interact with constantly without necessarily understanding the full picture. Setting up an A record and MX record is easy enough, but when things break or you need to configure something more complex, knowing what each record type does and how it works becomes important. Here’s the DNS record types I

Certificate Transparency (CT) is one of those things you use every day without thinking about it. Every time your browser connects to an HTTPS site, Certificate Transparency is working in the background to help ensure the certificate you’re seeing is legitimate. Understanding it has practical implications if you manage SSL certificates. The Problem CT Solves

There’s a point in most sysadmin careers where you stop relying entirely on public CAs and start thinking about internal infrastructure. Internal APIs, staging environments, service-to-service TLS, developer machines — all of these benefit from having a proper internal CA rather than a pile of self-signed certificates scattered everywhere. I set up my first internal