Use SSH Match exec without turning config into an opaque program
Match exec runs a local command while evaluating configuration and applies following options when it exits zero, so quoting, PATH, and evaluation order become part of connection behavior.
Use SSH ControlPersist in automation without stale shared masters
ControlMaster multiplexes channels over one authenticated transport, and ControlPersist can keep that master alive after the initiating client exits.
Use ExitOnForwardFailure so SSH tunnels fail loudly
ExitOnForwardFailure makes the client abandon setup when requested listening forwards cannot be established, but it does not prove the final destination behind a successful listener works.
Use ssh-keyscan for collection, never as automatic verification
Ssh-keyscan collects public host keys quickly without login, but it performs no authentication and therefore cannot establish that a returned key belongs to the intended host.
Automate SSH ProxyJump without placing private keys on the bastion
ProxyJump makes the client open a forwarding channel through the jump host; end-host authentication remains on the client and the bastion need not receive the private key.
ServerAliveInterval vs TCPKeepAlive for SSH connection liveness
ServerAlive messages travel inside the encrypted SSH channel and can bound an unresponsive peer, while TCPKeepAlive relies on operating-system TCP probes with different timing and spoofability.
Use StrictHostKeyChecking accept-new with a clear trust model
Accept-new adds previously unseen host keys but refuses changed keys; it reduces first-contact friction without authenticating who owns a new hostname.
Trace sudoers include order with visudo before changing privilege
Sudo reads its main policy and included files in lexical or directive order; the last matching tag and command rules can change effective authorization.
Apply Linux sysctl hardening with precedence and runtime verification
Sysctl settings come from kernel defaults and ordered configuration sources; loading one file can differ from the complete boot-time merge.
systemctl daemon-reload vs restart: what each command changes
Daemon-reload makes the manager reread unit definitions, while restart stops and starts a unit using the definition currently loaded after any reload.
Use systemd-analyze security to guide service hardening
Systemd-analyze security inspects configured sandbox properties and reports an exposure score, but it cannot infer application requirements or every kernel boundary.
Pass secrets with systemd credentials instead of environment variables
Systemd credentials make selected data available to a service through a protected runtime path and can support encrypted credentials depending on system capabilities.
Set systemd service environment variables without hidden drift
A service receives the environment assembled by its unit and manager, not the interactive shell that launched systemctl.
Use network-online.target without hiding application retries
Network-online.target is a boot synchronization point supplied by a network manager; it does not prove a particular DNS name, route, or dependency is usable.
Debug systemd-resolved by link, search domain, and server
Systemd-resolved can maintain per-link DNS servers and routing domains, so /etc/resolv.conf alone may not describe the effective lookup path.
Set systemd CPU and memory limits with observable headroom
Systemd applies resource controls to the unit cgroup, so MemoryMax, CPUQuota, TasksMax, and weights affect the whole supervised process tree.
Choose a systemd Restart policy without creating a crash loop
Restart decides which exit causes trigger another start, while RestartSec and start limits control retry pacing and containment.
Use systemd socket activation without two processes fighting for a port
A socket unit owns the listening descriptor and passes accepted or listening sockets to an activated service according to the service protocol.
systemd timer vs cron: choose by scheduling and observability needs
A timer activates another unit and records state in systemd, while cron launches commands from a separate scheduler and environment.
Run a systemd user service and understand login persistence
A user manager owns per-user units; login sessions, lingering, environment, and system units are separate lifecycles.
Fix a systemd WorkingDirectory failure with an explicit path
WorkingDirectory changes the process current directory before ExecStart and can fail startup when the path or permissions are wrong.
Practical tcpdump filters for bounded incident evidence
Tcpdump captures packets visible at an interface and filter boundary; it proves observed traffic, not packets dropped before capture or decrypted application meaning.
Import existing infrastructure with Terraform import blocks
An import block maps a remote identifier to one resource address during plan and apply; configuration must describe the object and each object should have one binding.
Refactor Terraform resource addresses with moved blocks
A moved block records an old and new address so Terraform updates the state binding instead of planning destroy and create for the same object.