Linux

Overview The filesystem is the bridge between the operating system and storage devices, directly impacting data reliability, I/O performance, and operational complexity. Linux supports multiple filesystems, each with its own design trade-offs. This article compares the four mainstream filesystems — ext4, xfs, btrfs, and zfs — and dives into mount parameter optimization, I/O scheduler selection, journal modes, fsync performance, and other core topics, with production-grade selection recommendations and tuning strategies....

Overview The Linux kernel exposes thousands of tunable parameters through /proc/sys/ and the sysctl interface, covering networking, memory, filesystem, security, and more. Properly adjusting these parameters can significantly improve system performance and stability, but blind tuning can be counterproductive. This article systematically covers the sysctl system across four dimensions — networking, file descriptors, memory, and security — and provides production tuning templates and parameter validation methods. sysctl System Viewing and Modifying Parameters # View all parameters $ sysctl -a # View specific parameter $ sysctl net....

Introduction A default Linux server installation exposes a far larger attack surface than most realize: unnecessary RPM packages, open network services, permissive SSH configurations, and inactive audit systems. Security hardening is not a one-time operation but a full lifecycle checklist from installation to runtime. This article follows the CIS Benchmark framework to organize hardening essentials, with directly executable configurations for each step. System Minimal Installation Principles Package Management Trimming The core principle of minimal installation: install only what you need, not what you might need....

Overview SSH (Secure Shell) is the core channel for Linux operations and a primary target for attackers. A misconfigured SSH service can lead to a full server compromise. This article covers SSH security best practices comprehensively — from authentication mechanisms, server-side hardening, bastion host architecture, and tunneling techniques to audit logging and brute-force protection. Key-Based Authentication Generating Key Pairs # Generate Ed25519 key (recommended) $ ssh-keygen -t ed25519 -C "admin@sre.wang" -f ~/....