https://lukehebert.com/post/Recent content in Articles on Luke HebertHugoen-usThu, 01 Oct 2026 00:00:00 +0000https://lukehebert.com/post/organizational-dynamics-and-googles-ten-golden-rules/Thu, 01 Oct 2026 00:00:00 +0000https://lukehebert.com/post/organizational-dynamics-and-googles-ten-golden-rules/To sustain long-term organizational growth, companies must view employees at all levels as their most valuable asset and actively invest in their retention and well-being.https://lukehebert.com/post/enable-kubelet-serving-certificates-in-kubernetes-if-you-did-not-do-so-during-cluster-deployment-metric-server/Sat, 23 Aug 2025 00:00:00 +0000https://lukehebert.com/post/enable-kubelet-serving-certificates-in-kubernetes-if-you-did-not-do-so-during-cluster-deployment-metric-server/Enables kubelet TLS bootstrapping so the controller-manager issues proper serving certificates, resolving the x509 certificate validation error in metrics-server. Covers deployment edits, controller-manager configuration, and automated certificate renewal.https://lukehebert.com/post/aws-default-dns-server-ec2/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Explains how the AWS default DNS server works for EC2 instances within a VPC, including the special 169.254.169.253 address and the CIDR-based resolver IP.https://lukehebert.com/post/aws-instance-metadata/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-instance-metadata/An overview of the AWS EC2 Instance Metadata Service (IMDS), including its link-local address and the difference between IMDSv1 and IMDSv2 access.https://lukehebert.com/post/aws-user-data-address/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-user-data-address/Explains how to access AWS EC2 user data from within an instance using the instance metadata service. Covers the metadata endpoint, a curl example, and where the user data script is stored on Linux and Windows.https://lukehebert.com/post/basic-iptables-insert/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-iptables-insert/Learn how to insert iptables rules at a specific position using the -I flag, with syntax breakdown and a practical SSH example.https://lukehebert.com/post/firewalld-cheatsheet/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/firewalld-cheatsheet/A practical cheat sheet for managing firewalld on RHEL, Fedora, and CentOS systems. Covers zones, services, ports, rich rules, NAT, and direct iptables-style rules.https://lukehebert.com/post/update-kubernetes-the-hard-way/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/update-kubernetes-the-hard-way/A guide to building a Kubernetes cluster manually, component by component, without kubeadm or minikube. This approach provides a deep understanding of how Kubernetes works under the hood and prepares you for both certification exams and day-to-day operations.https://lukehebert.com/post/cni-plugin-binaries-configs/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/cni-plugin-binaries-configs/Catalogs the active Flannel CNI configuration and the full set of 19 available CNI plugin binaries on a Kubernetes node. Provides file sizes, modification dates, and the purpose of each installed plugin.https://lukehebert.com/post/important-note-about-cni-and-cka-exam/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/important-note-about-cni-and-cka-exam/Clarifies which CNI plugins are acceptable for the CKA exam and explains why the official Kubernetes documentation avoids vendor-specific deployment commands.https://lukehebert.com/post/coredns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/coredns/Set up a dedicated server as a DNS server using CoreDNS, covering binary installation, server startup, and IP-to-hostname mapping via the hosts plugin. CoreDNS also supports extensibility through plugins, including one for Kubernetes.https://lukehebert.com/post/gateway-api/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/gateway-api/Gateway API is a Kubernetes add-on that provides dynamic infrastructure provisioning and advanced traffic routing through an extensible, role-oriented configuration mechanism. It organizes traffic handling around three stable API kinds: GatewayClass, Gateway, and HTTPRoute.https://lukehebert.com/post/ingress-and-ingress-controllers/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-and-ingress-controllers/An overview of Kubernetes Ingress resources and the controllers that fulfill them, covering terminology, creation, and prerequisites.https://lukehebert.com/post/ingress-annotations-and-rewrite-target/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-annotations-and-rewrite-target/Explains how the rewrite-target annotation in the NGINX Ingress controller maps user-facing URL paths to backend services, preventing 404 errors. Includes examples of simple and regex-based rewrites.https://lukehebert.com/post/ip-link-show-type/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ip-link-show-type/A guide to the ip link show type and ip address show type commands in Linux for filtering network interfaces by type. Covers physical, virtual, and tunneling interface types with practical examples.https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/A deep dive into how Kubernetes DNS resolves service names to IP addresses, covering A records, SRV records, search domains, and the full lookup path from pod to CoreDNS. Understanding this lifecycle is essential for debugging connectivity issues and designing resilient microservice architectures.https://lukehebert.com/post/practical-guide-to-gateway-api-2025/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/practical-guide-to-gateway-api-2025/A practical walkthrough of the Kubernetes Gateway API using the NGINX Gateway Controller, covering HTTP routing, TLS termination, traffic splitting, and multi-protocol support. The concepts are implementation-agnostic and apply across any Gateway API-compatible controller.https://lukehebert.com/post/kubernetes-internal-dns-search-base/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-internal-dns-search-base/Kubernetes provides a built-in DNS service that assigns predictable names to Services and Pods within a cluster. By default, pods use cluster.local as their search base for internal DNS resolution, enabling communication through human-readable names rather than ephemeral IP addresses.https://lukehebert.com/post/kubernetes-kustomize/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-kustomize/Kustomize is a native Kubernetes configuration management tool that enables declarative, template-free customization of Kubernetes objects using YAML files. It supports hierarchical base-and-overlay structures, targeted patches, and built-in generation of ConfigMaps and Secrets.https://lukehebert.com/post/kubernetes-networking/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-networking/An overview of the ports and protocols required by Kubernetes control plane and worker nodes. Includes guidance on overriding default port configurations in strict network environments.https://lukehebert.com/post/network-namespaces-virtual-network/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/network-namespaces-virtual-network/Network namespaces provide the foundation for container network isolation in Docker and Kubernetes. This guide covers listing, creating, and linking namespaces, bridging, NAT, and how Docker and Kubernetes build on these primitives.https://lukehebert.com/post/nginx-ingress-controller/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/nginx-ingress-controller/A practical guide to installing and configuring the Ingress-Nginx Controller in Kubernetes, covering Helm and kubectl methods, cloud-provider annotations, and local testing workflows.https://lukehebert.com/post/using-persistent-volume-claims-in-a-pod-pvc/Mon, 18 Aug 2025 00:00:00 +0000https://lukehebert.com/post/using-persistent-volume-claims-in-a-pod-pvc/This guide explains how Persistent Volumes and Persistent Volume Claims work together in Kubernetes and shows how to reference a PVC inside a Pod definition. It also covers access modes and the difference between static and dynamic provisioning.https://lukehebert.com/post/basic-csv-authentication-to-the-api-server/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-csv-authentication-to-the-api-server/Configure HTTP basic authentication on a kubeadm-managed Kubernetes cluster using a CSV credentials file. Covers mounting the file into kube-apiserver, defining RBAC roles, and verifying access with curl.https://lukehebert.com/post/docker-and-container-capabilities/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/docker-and-container-capabilities/An in-depth overview of Linux capabilities and how they govern privilege inside Docker containers and Kubernetes pods. Covers capability sets, file capabilities, bounding sets, securebits, and user-namespace interactions.https://lukehebert.com/post/user-impersonation/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/user-impersonation/Learn how Kubernetes administrators can verify permissions and impersonate other users using kubectl auth can-i and the –as flag.https://lukehebert.com/post/kubectx-and-kubens/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubectx-and-kubens/Kubectx and kubens are lightweight CLI tools that simplify switching between Kubernetes clusters and namespaces. This guide covers installation and basic usage for both tools.https://lukehebert.com/post/encrypting-secrets/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/encrypting-secrets/Kubernetes Secrets use base64 encoding rather than true encryption, so their safety depends on surrounding practices like encryption at rest and access controls. This post covers best practices, built-in protections, and alternatives like Helm Secrets or HashiCorp Vault.https://lukehebert.com/post/kubernetes-tls-check-list/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-tls-check-list/A practical checklist covering X.509 certificate requirements for Kubernetes nodes, users, and the API server. Includes deployment methods, cert-manager workflows, and Extended Key Usage configuration.https://lukehebert.com/post/network-policies/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/network-policies/A practical guide to Kubernetes Network Policies, covering how Ingress and Egress rules work, AND/OR logic in rule layout, and the behavior of policyTypes.https://lukehebert.com/post/finding-which-java-threads-are-consuming-your-cpu/Fri, 15 Aug 2025 00:00:00 +0000https://lukehebert.com/post/finding-which-java-threads-are-consuming-your-cpu/When a Java process is eating your CPU, you need to know exactly which thread is responsible. This guide walks through JVisualVM, jstack, top, and jvmtop to pinpoint the culprit.https://lukehebert.com/post/how-to-inspect-a-thread-dump-like-a-pro/Fri, 15 Aug 2025 00:00:00 +0000https://lukehebert.com/post/how-to-inspect-a-thread-dump-like-a-pro/Learn how to capture, read, and interpret Java thread dumps using JDK tools like jstack and jcmd. Covers thread states, CPU analysis, deadlock detection, and practical tools for spotting performance issues.https://lukehebert.com/post/not-enough-storage-available-while-using-jstack-win/Thu, 14 Aug 2025 00:00:00 +0000https://lukehebert.com/post/not-enough-storage-available-while-using-jstack-win/A quick fix for the ’not enough storage available’ error when running jstack on Windows, caused by the JVM running under the Local System Account. Two workarounds using Psexec or JMX remote monitoring.https://lukehebert.com/post/backing-up-etcd/Wed, 13 Aug 2025 00:00:00 +0000https://lukehebert.com/post/backing-up-etcd/A practical guide to backing up and restoring the etcd key-value database in a Kubernetes cluster. Covers snapshot-based and file-based backup methods, integrity checks, and static pod manifest updates.https://lukehebert.com/post/upgrading-a-cluster/Wed, 13 Aug 2025 00:00:00 +0000https://lukehebert.com/post/upgrading-a-cluster/A step-by-step guide to upgrading a Kubernetes cluster using kubeadm, covering control plane and worker node upgrades. Includes the full sequence from version planning through final verification.https://lukehebert.com/post/creating-a-tls-secret-in-kubernetes/Tue, 12 Aug 2025 00:00:00 +0000https://lukehebert.com/post/creating-a-tls-secret-in-kubernetes/Create a TLS secret from a certificate and key pair, then deploy a webhook server that mounts that secret to serve HTTPS on port 8443.https://lukehebert.com/post/using-jcmd-jstack-to-get-thread-information/Tue, 12 Aug 2025 00:00:00 +0000https://lukehebert.com/post/using-jcmd-jstack-to-get-thread-information/A practical guide to using the jcmd and jstack utilities for collecting thread dumps, heap data, and CPU information from a running JVM process. Includes ready-to-use scripts and one-liners for troubleshooting slow or hung Java applications.https://lukehebert.com/post/kubernetes-resource-management/Mon, 11 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-resource-management/A practical guide to configuring CPU, memory, and storage requests and limits in Kubernetes, covering container-level, Pod-level, and namespace-level resource controls. Includes troubleshooting steps for common scheduling and OOM issues.https://lukehebert.com/post/manually-scheduling-pods/Mon, 11 Aug 2025 00:00:00 +0000https://lukehebert.com/post/manually-scheduling-pods/Learn how to assign Kubernetes pods to specific nodes at creation time and how to reassign running pods using Binding objects. Covers scheduler behavior and common pitfalls that leave pods stuck in Pending state.https://lukehebert.com/post/json-path/Sun, 10 Aug 2025 00:00:00 +0000https://lukehebert.com/post/json-path/A practical guide to JSON Path syntax, operators, and filters, with hands-on examples for extracting data from JSON documents and Kubernetes resources via kubectl.https://lukehebert.com/post/useful-json-path-queries-for-kubernetes/Sun, 10 Aug 2025 00:00:00 +0000https://lukehebert.com/post/useful-json-path-queries-for-kubernetes/A practical guide to kubectl JsonPath expressions for extracting, formatting, and combining Kubernetes resource fields. Covers core patterns, array indexing, literal strings, and when to reach for jq instead.https://lukehebert.com/post/kubernetes-efs-storage-iam-role/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-efs-storage-iam-role/A practical guide to provisioning EFS filesystems and wiring them into Kubernetes via the AWS EFS CSI driver, IAM roles, and standard storage manifests. Covers StorageClass, PVCs, Deployments, and StatefulSets for shared, elastic storage.https://lukehebert.com/post/kubernetes-s3-storage-iam-role/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-s3-storage-iam-role/A practical guide to mounting S3 buckets as volumes in Kubernetes pods using the AWS S3 CSI driver, including IAM role setup, StorageClass configuration, and deployment examples.https://lukehebert.com/post/kubernetes-s3-storage-access-key-secrete-key/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-s3-storage-access-key-secrete-key/A guide to deploying S3 object storage in Kubernetes using the AWS S3 CSI driver, covering credential setup, StorageClass definition, PVC creation, and volume mounting in pods and deployments.https://lukehebert.com/post/helm-template-cheat-sheet/Fri, 08 Aug 2025 00:00:00 +0000https://lukehebert.com/post/helm-template-cheat-sheet/A comprehensive cheatsheet covering essential Helm template functions, syntax, and patterns for writing and debugging chart templates. Use it as a quick lookup while building or troubleshooting Helm charts.https://lukehebert.com/post/helm-usage-cheatsheet/Fri, 08 Aug 2025 00:00:00 +0000https://lukehebert.com/post/helm-usage-cheatsheet/A quick-reference guide covering Helm repository management, chart installation, release management, and common deployment workflows. Use this as a day-to-day cheat sheet for working with Helm in Kubernetes environments.https://lukehebert.com/post/kubectl-quick-reference-kubernetes/Tue, 15 Jul 2025 00:00:00 +0000https://lukehebert.com/post/kubectl-quick-reference-kubernetes/A quick reference covering commonly used kubectl commands, flags, and workflows for managing Kubernetes resources. Topics range from shell autocomplete and cluster contexts to creating, viewing, updating, and deleting resources.https://lukehebert.com/post/pgbackrest-and-helpful-commands/Wed, 02 Jul 2025 00:00:00 +0000https://lukehebert.com/post/pgbackrest-and-helpful-commands/A practical reference for pgBackRest backup, restore, and cleanup commands for PostgreSQL. Covers manual cleanup, incremental backups, retention policies, and stanza management.https://lukehebert.com/post/understanding-machine-cpu-usage/Wed, 18 Jun 2025 00:00:00 +0000https://lukehebert.com/post/understanding-machine-cpu-usage/A practical walkthrough of reading node_cpu_seconds_total from the Prometheus Node exporter, calculating per-second rates, and deriving overall CPU utilization percentages across multiple machines.https://lukehebert.com/post/an-introductory-how-to-of-docker-exec/Thu, 29 May 2025 00:00:00 +0000https://lukehebert.com/post/an-introductory-how-to-of-docker-exec/A practical guide to the docker exec command, covering background execution, environment variables, interactive sessions, and working directory control. Includes real-world examples to help you get the most out of running commands inside containers.https://lukehebert.com/post/kubernetes-cluster-components/Thu, 29 May 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-cluster-components/An overview of the key components that make up a Kubernetes cluster, covering both the control plane and worker nodes. Understanding these pieces is essential for operating and troubleshooting a Kubernetes environment.https://lukehebert.com/post/kubernetes-deployment-scheduler-sequence/Thu, 29 May 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-deployment-scheduler-sequence/A time sequence diagram walks through the sequential steps of pod scheduling in Kubernetes, from the initial kubectl command to the kubelet reporting status back to the API server. The diagram simplifies concurrent control plane and worker node processes into a clear, ordered flow.https://lukehebert.com/post/java-tls-client-debugging/Mon, 19 May 2025 00:00:00 +0000https://lukehebert.com/post/java-tls-client-debugging/A guide to inspecting SSL/TLS handshakes in Java applications when built-in debugging is unavailable. Includes a lightweight TLS client tool for testing certificate and handshake issues.https://lukehebert.com/post/basic-kerberos-test-class-in-java/Wed, 14 May 2025 00:00:00 +0000https://lukehebert.com/post/basic-kerberos-test-class-in-java/A minimal Java class and JAAS configuration for testing Kerberos authentication in isolation, useful when application-level debugging is too noisy to isolate the problem.https://lukehebert.com/post/graph-database-white-papers/Mon, 14 Apr 2025 00:00:00 +0000https://lukehebert.com/post/graph-database-white-papers/An overview of graph databases, their structure, and advantages over relational models. Covers how nodes, relationships, and the Cypher query language work together to model complex data.https://lukehebert.com/post/udev-diagnostic-test/Thu, 27 Feb 2025 00:00:00 +0000https://lukehebert.com/post/udev-diagnostic-test/A walkthrough of using udevadm to diagnose and inspect udev rule application on a /dev/null device node. Covers the test command syntax and interprets the output for troubleshooting permission issues.https://lukehebert.com/post/posgres-per-table-autovacuum-management/Mon, 28 Oct 2024 00:00:00 +0000https://lukehebert.com/post/posgres-per-table-autovacuum-management/Tune Postgres per-table autovacuum settings and track them with a single SQL view. Covers global defaults, table-specific overrides, and a ready-to-use monitoring query.https://lukehebert.com/post/monitoring-and-tuning-the-linux-networking-stack-receiving-data/Fri, 11 Oct 2024 00:00:00 +0000https://lukehebert.com/post/monitoring-and-tuning-the-linux-networking-stack-receiving-data/A deep dive into how the Linux kernel receives network packets, covering the full path from NIC hardware through NAPI, softirqs, GRO, RPS, and protocol layers. Includes practical monitoring commands and tuning knobs for each stage.https://lukehebert.com/post/linux-network-ring-buffers-trying-to-cover-what-i-dont-know-about/Fri, 11 Oct 2024 00:00:00 +0000https://lukehebert.com/post/linux-network-ring-buffers-trying-to-cover-what-i-dont-know-about/A practical walkthrough of how Linux allocates and manages RX/TX ring buffers for network interfaces, covering DMA, softirq processing, and tuning knobs like netdev_budget.https://lukehebert.com/post/myths-about-dev-urandom/Fri, 04 Oct 2024 00:00:00 +0000https://lukehebert.com/post/myths-about-dev-urandom/A practical breakdown of the most common misconceptions about /dev/urandom and /dev/random on Linux, explaining why /dev/urandom is the correct choice for cryptographic randomness and why blocking on low entropy is a usability problem, not a security one.https://lukehebert.com/post/wireshark-filter-for-ssl-traffic/Fri, 30 Aug 2024 00:00:00 +0000https://lukehebert.com/post/wireshark-filter-for-ssl-traffic/A collection of useful Wireshark display filters for analyzing SSL/TLS handshake traffic, including a reference table of handshake message types and notes on cipher suite considerations.https://lukehebert.com/post/docker-kubernetes-network-diagnostic-tools/Mon, 26 Aug 2024 00:00:00 +0000https://lukehebert.com/post/docker-kubernetes-network-diagnostic-tools/A practical guide to using the netshoot container for Docker and Kubernetes network troubleshooting. Covers network namespaces, tcpdump examples, and real-world diagnostic workflows.https://lukehebert.com/post/how-to-get-the-most-out-of-postgres-memory-settings/Wed, 12 Jun 2024 00:00:00 +0000https://lukehebert.com/post/how-to-get-the-most-out-of-postgres-memory-settings/A practical guide to tuning Postgres memory parameters including shared_buffers, work_mem, and maintenance_work_mem. Learn how to measure actual usage, avoid out-of-memory crashes, and balance allocations for optimal performance.https://lukehebert.com/post/ldap-oid-reference-guide/Wed, 12 Jun 2024 00:00:00 +0000https://lukehebert.com/post/ldap-oid-reference-guide/A comprehensive reference table of common LDAP object identifiers (OIDs) used in schema elements, controls, and extended operations. Each entry includes the OID, its purpose, and a link to the relevant RFC or specification.https://lukehebert.com/post/how-to-clean-up-pg-wal-if-the-disk-is-full/Mon, 04 Dec 2023 00:00:00 +0000https://lukehebert.com/post/how-to-clean-up-pg-wal-if-the-disk-is-full/A practical guide to resolving PostgreSQL pg_wal disk-full issues, covering both reactive recovery steps and proactive measures to prevent recurrence. Learn how to free space, move the WAL directory, and configure archiving correctly.https://lukehebert.com/post/analyzing-large-java-heap-dumps-using-memory-analyzer-cli-in-linux/Fri, 17 Nov 2023 00:00:00 +0000https://lukehebert.com/post/analyzing-large-java-heap-dumps-using-memory-analyzer-cli-in-linux/When MAT UI fails to handle very large heap dumps, the Memory Analyzer CLI provides a reliable alternative on Linux. This post walks through the setup and commands needed to parse multi-gigabyte dumps and generate shareable HTML reports.https://lukehebert.com/post/understanding-docker-dns/Wed, 15 Nov 2023 00:00:00 +0000https://lukehebert.com/post/understanding-docker-dns/An overview of how Docker’s built-in DNS resolver enables container-to-container communication and service discovery. Covers default configurations, custom DNS setups, and practical use cases.https://lukehebert.com/post/working-with-multiple-content-security-policy-headers/Thu, 28 Sep 2023 00:00:00 +0000https://lukehebert.com/post/working-with-multiple-content-security-policy-headers/Multiple Content-Security-Policy headers do not combine; the most restrictive one always wins. Learn how to correctly configure CSP in nginx by consolidating directives into a single header.https://lukehebert.com/post/the-beer-drinkers-guide-to-saml-duo-security/Mon, 11 Sep 2023 00:00:00 +0000https://lukehebert.com/post/the-beer-drinkers-guide-to-saml-duo-security/A plain-English walkthrough of how SAML authentication works, using the analogy of buying a beer at a concert. Covers IdP and SP configuration, IdP-initiated vs SP-initiated flows, and practical troubleshooting steps.https://lukehebert.com/post/how-to-start-a-sysv-init-script-after-network-starts-in-red-hat-enterprise-linux-7/Tue, 27 Jun 2023 00:00:00 +0000https://lukehebert.com/post/how-to-start-a-sysv-init-script-after-network-starts-in-red-hat-enterprise-linux-7/Configure a legacy SysV init script to wait for network availability in RHEL 7 by adding the Required-Start LSB directive. This guide shows how systemd honors those headers so third-party initscripts start in the correct order.https://lukehebert.com/post/override-systemd-unit-files/Tue, 27 Jun 2023 00:00:00 +0000https://lukehebert.com/post/override-systemd-unit-files/Learn how to safely override systemd unit and timer files using systemctl edit, avoiding the pitfalls of editing package-managed files directly. Covers creating drop-in overrides, full replacements, and reverting changes.https://lukehebert.com/post/how-to-change-docker-root-data-directory/Fri, 02 Jun 2023 00:00:00 +0000https://lukehebert.com/post/how-to-change-docker-root-data-directory/A step-by-step guide to relocating the Docker data directory to a new path. Covers daemon configuration, data migration, and cleanup for both older and newer Docker versions.https://lukehebert.com/post/docker-determining-container-responsible-for-largest-overlay-directories/Thu, 18 May 2023 00:00:00 +0000https://lukehebert.com/post/docker-determining-container-responsible-for-largest-overlay-directories/A practical guide to identifying which Docker containers occupy the largest overlay2 directories. Uses docker inspect, jq, and xargs to map cryptic layer hashes back to human-readable container names.https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/Wed, 10 May 2023 00:00:00 +0000https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/A byte-by-byte walkthrough of a TLS 1.3 handshake using OpenSSL’s s_client, comparing each message to its TLS 1.2 counterpart. Highlights how encryption, key exchange, and extensions differ in the latest revision.https://lukehebert.com/post/palo-alto-networks-define-traffic-to-decrypt/Mon, 08 May 2023 00:00:00 +0000https://lukehebert.com/post/palo-alto-networks-define-traffic-to-decrypt/Learn how to use Decryption Policy rules in Palo Alto Networks to define which traffic to decrypt and which to exclude. This guide also covers best practices for blocking QUIC and applying strict security profiles to sensitive traffic categories.https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/A step-by-step guide to creating and securing VLANs in the UniFi Network Console, including firewall rules to block inter-VLAN traffic and restrict console access.https://lukehebert.com/post/intro-to-networking-introduction-to-virtual-lans-vlans-and-tagging/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/intro-to-networking-introduction-to-virtual-lans-vlans-and-tagging/A beginner-friendly overview of Virtual LANs, covering their benefits, typical usage scenarios, and the fundamentals of 802.1Q VLAN tagging.https://lukehebert.com/post/unifi-network-creating-virtual-networks-vlans/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/unifi-network-creating-virtual-networks-vlans/Learn how to create and configure virtual networks (VLANs) in UniFi Network to segment devices and improve network security. This guide covers wireless and wired client binding, trunk ports, and third-party gateway integration.https://lukehebert.com/post/dns/Tue, 02 May 2023 00:00:00 +0000https://lukehebert.com/post/dns/A practical guide to understanding DNS resolution tiers and troubleshooting name resolution issues in Linux environments. Covers /etc/nsswitch.conf, /etc/resolv.conf, and local caching services.https://lukehebert.com/post/optimize-postgresql-server-performance-through-configuration/Thu, 27 Apr 2023 00:00:00 +0000https://lukehebert.com/post/optimize-postgresql-server-performance-through-configuration/This guide walks through four key PostgreSQL configuration settings that significantly impact server performance. Learn how to tune shared_buffers, wal_buffers, effective_cache_size, and work_mem for your specific workload.https://lukehebert.com/post/postgresql-shared-memory-huge-pages/Wed, 26 Apr 2023 00:00:00 +0000https://lukehebert.com/post/postgresql-shared-memory-huge-pages/Calculating the right number of Linux huge pages for PostgreSQL is trickier than just dividing shared_buffers by the page size. This walkthrough shows how to use tuned to manage allocation and why you need to round up based on actual memory usage.https://lukehebert.com/post/postgresql-wal-retention-and-clean-up-pg-archivecleanup/Fri, 21 Apr 2023 00:00:00 +0000https://lukehebert.com/post/postgresql-wal-retention-and-clean-up-pg-archivecleanup/A practical guide to managing PostgreSQL WAL retention using the pg_archivecleanup utility, covering dry-run and delete modes, retention criteria, and a code walkthrough for novice users.https://lukehebert.com/post/using-sqlline-to-test-jdbc-connectors/Thu, 15 Dec 2022 00:00:00 +0000https://lukehebert.com/post/using-sqlline-to-test-jdbc-connectors/A practical guide to using SQLline to replicate SQL client behavior when testing JDBC connectors. Covers downloading the tool, setting up the classpath, and connecting to an Azure MySQL instance.https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/Tue, 29 Mar 2022 00:00:00 +0000https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/The ID4262 error occurs when a SAML NameIdentifier uses the entity format but contains an invalid URI. Two resolution steps fix the issue within your identity provider configuration.https://lukehebert.com/post/kerberos-message-stream-modified-41/Fri, 18 Feb 2022 00:00:00 +0000https://lukehebert.com/post/kerberos-message-stream-modified-41/JDK 1.8.0u242 and later introduced Kerberos referral handling per RFC 6806, which can break Active Directory name canonicalization and produce a KRB_AP_ERR_MODIFIED error. This post walks through the two configuration fixes that resolve the issue.https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Traceroute is one of the most misunderstood tools in a network engineer’s toolkit. This guide walks through how traceroute actually works, how to read the output correctly, and how to avoid the common pitfalls that lead to wrong conclusions.https://lukehebert.com/post/add-hard-and-soft-limits-for-apache-stack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/add-hard-and-soft-limits-for-apache-stack/Configure the soft and hard stack limits for the Apache user in /etc/security/limits.conf to prevent segmentation faults caused by insufficient stack space.https://lukehebert.com/post/additional-kernel-tweaks-for-ipv4-boradband/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/additional-kernel-tweaks-for-ipv4-boradband/A practical guide to tuning Linux TCP/IP kernel parameters for high-speed, high-latency broadband connections, covering buffer sizing, timeout adjustments, SYN flood protection, and congestion control selection.https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/A quick fix for the SSL Library Error 185090057 that appears when restarting Apache, caused by a malformed PEM certificate file. Learn how to validate and correct the certificate format to get your server back online.https://lukehebert.com/post/apache-tuner/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/apache-tuner/Apache Tuner is a Perl script that analyzes your Apache configuration and system resources to surface quick performance wins. Run it, read the suggestions, and tune your MPM, KeepAlive, and worker settings with confidence.https://lukehebert.com/post/awk-apache-log-files-by-ip-and-date/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/awk-apache-log-files-by-ip-and-date/Filter Apache access logs by IP address and date using awk. A quick, practical approach to pulling specific entries without loading a full log viewer.https://lukehebert.com/post/awk-scan-for-wp-login/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/awk-scan-for-wp-login/A quick awk pipeline to pull wp-login.php access attempts from web server logs and flag IPs that exceed a threshold. Useful for spotting brute-force or scanning activity against WordPress sites.https://lukehebert.com/post/aws-eip-elastic-ip-assignment-script/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/aws-eip-elastic-ip-assignment-script/A lightweight bash script that automatically allocates and assigns an Elastic IP to an EC2 instance at launch using User Data, eliminating the need for manual IP management.https://lukehebert.com/post/bash-piped-logging/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/bash-piped-logging/A quick bash logging setup that uses a named pipe and tee to capture stdout and stderr to a file while keeping the terminal interactive. Five lines of shell code, zero external dependencies.https://lukehebert.com/post/bash-shell-redirects/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/bash-shell-redirects/A quick reference for the most common bash shell redirect operators, with examples showing how to send stdout and stderr to files or swap them.https://lukehebert.com/post/check-and-backup-databases/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-and-backup-databases/A quick bash workflow for running integrity checks and generating SQL dumps across a set of user databases in MySQL.https://lukehebert.com/post/check-apache-stack-limit/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-apache-stack-limit/A quick one-liner to inspect the stack size limit applied to a running Apache httpd process on Linux. Useful when debugging segfaults or tuning worker memory.https://lukehebert.com/post/check-database-and-optimize-everything-all-databases/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-database-and-optimize-everything-all-databases/A quick reference for running mysqlcheck to verify and optimize MySQL databases, including the -A flag to target every database on the server in one pass.https://lukehebert.com/post/check-disk-state/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-disk-state/A quick one-liner to list every mounted ext3 or ext4 partition along with its label and filesystem state, useful for spotting unclean shutdowns or journal issues at a glance.https://lukehebert.com/post/check-for-ip-block/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-for-ip-block/A quick way to verify whether a specific IP address is blocked by iptables rules on a Linux host. Covers the exact command and how to read the output.https://lukehebert.com/post/check-inode-counts-with-formating/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-inode-counts-with-formating/Practical bash one-liners for counting inodes per directory and reporting disk usage with formatted output. Handy when you need a quick snapshot of filesystem pressure without pulling in a full monitoring tool.https://lukehebert.com/post/check-mysql-user-permissions/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-mysql-user-permissions/A quick way to inspect what SELECT and UPDATE privileges a MySQL user actually holds, straight from the mysql.user table. Useful when an application is throwing permission errors and you need to confirm what the account can and cannot do.https://lukehebert.com/post/check-web-crawler-impact/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-web-crawler-impact/A quick bash function to identify which search engine crawlers are hitting your Apache logs and how often, so you can spot unusual traffic patterns at a glance.https://lukehebert.com/post/chroot-suggested-monts-for-rescue/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/chroot-suggested-monts-for-rescue/A quick walkthrough of using virt-rescue to generate the correct mount commands for a chroot rescue session on a libvirt guest.https://lukehebert.com/post/count-unique-connecting-addresses/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/count-unique-connecting-addresses/A quick pipeline using awk, sort, and uniq to count how many times each unique IP address appears in a log file. Handy for spotting the most active or suspicious clients at a glance.https://lukehebert.com/post/connecting-ip-on-port-80-count-netstat-ss/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/connecting-ip-on-port-80-count-netstat-ss/Two quick one-liners that count how many unique remote IPs are connected to port 80, using either netstat or ss. Handy for spotting unexpected traffic or verifying that only expected clients are hitting your web server.https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Generate a fresh rndc.key and wire it into rndc.conf so your BIND name server accepts authenticated remote control commands. Covers the rndc-confgen command and the full rndc.conf structure.https://lukehebert.com/post/create-symbols-and-resolve-stack-mysql/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/create-symbols-and-resolve-stack-mysql/Learn how to extract dynamic symbols from the mysqld binary and use them to resolve a crash stack dump into readable function names.https://lukehebert.com/post/crontab-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/crontab-log/Find where cron logs live on your Linux system and learn how to read them to confirm scheduled jobs actually ran.https://lukehebert.com/post/decode-certificate-csr/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/decode-certificate-csr/Quick openssl commands to inspect a Certificate Signing Request and an issued X.509 certificate in human-readable form.https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Learn how to turn off ModSecurity for a specific domain or path using a single directive in your .htaccess file. This is useful when a legitimate request is being blocked by the WAF rules.https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Exim offers two DKIM-related toggles that work together to validate and enforce sender signatures. Setting both to On ensures your mail server actually checks incoming DKIM records and rejects messages that fail validation.https://lukehebert.com/post/dns-amplifcation-attack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-amplifcation-attack/A DNS amplification attack floods a victim with forged responses by exploiting open resolvers. This post walks through iptables rules and BIND hardening steps to block the attack vector.https://lukehebert.com/post/dns-resolution-and-zone-files/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-resolution-and-zone-files/A practical walkthrough of how DNS resolution works, from the hierarchical name space down to the iterative query process. Includes common zone file syntax mistakes and how to avoid them.https://lukehebert.com/post/drop-all-mail-in-exim/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/drop-all-mail-in-exim/A quick one-liner to flush every message out of the Exim mail queue. Useful when a misconfigured relay or a flood of bounce messages has clogged up your server.https://lukehebert.com/post/rpm2cpio/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/rpm2cpio/Learn how to manually decompress an RPM package into a working directory using rpm2cpio and cpio, without installing the package.https://lukehebert.com/post/filter-rpm-urls-with-awk/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/filter-rpm-urls-with-awk/A quick awk one-liner that pulls RPM package URLs from log files or package lists by matching lines containing both ‘autoinstall’ and ‘.rpm’.https://lukehebert.com/post/fix-mysql-invalid-keys/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/fix-mysql-invalid-keys/A quick bash script to identify and repair MySQL tables with invalid or corrupted MYI key files, then force a rebuild using USE_FRM.https://lukehebert.com/post/verbose-tracking-of-mail-being-sent/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/verbose-tracking-of-mail-being-sent/A quick reference for enabling verbose output when sending mail from the command line, so you can see the full SMTP transaction and diagnose delivery issues.https://lukehebert.com/post/force-mysql-logs-to-file/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/force-mysql-logs-to-file/Learn how to configure MySQL’s log_output variable to write slow query and general logs to files instead of tables, and why that matters for performance and log management.https://lukehebert.com/post/fsck/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/fsck/A quick reference for running a forced, verbose ext filesystem check with automatic repairs and timestamped logging.https://lukehebert.com/post/galera-cluster-performance/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/galera-cluster-performance/Tuning Galera’s gcache size and page size can reduce disk I/O during replication and keep write-set lookups in memory. A quick configuration change that pays off on busy clusters.https://lukehebert.com/post/gbb-thread-dump/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/gbb-thread-dump/A quick three-command recipe for grabbing a full thread backtrace from a running httpd process with gdb, useful when Apache appears hung or unresponsive.https://lukehebert.com/post/generate-random-passwords-with-perl/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/generate-random-passwords-with-perl/A compact Perl one-liner that produces cryptographically random passwords of a specified length. Perfect for quickly generating strong credentials without reaching for a dedicated tool.https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/A quick bash one-liner to pull offending IP addresses from exim relay-denied entries and resolve them to hostnames, making it easier to identify which gateways are misconfigured.https://lukehebert.com/post/https-force-redirect/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/https-force-redirect/A quick Apache mod_rewrite snippet that forces all HTTP traffic to HTTPS, plus context on where to place it and what to watch for.https://lukehebert.com/post/innodb-corruption-and-recovery-guide/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/innodb-corruption-and-recovery-guide/A practical, step-by-step guide for diagnosing and recovering from common InnoDB corruption issues, covering first response, log analysis, checksum verification, and data restoration techniques.https://lukehebert.com/post/ip-tables-rate-limit-apache/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-apache/A quick way to throttle inbound HTTP traffic to your Apache server using iptables, protecting it from traffic spikes and simple DoS attempts.https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Use iptables string matching and the recent module to drop connections from abusive bots that exceed a request threshold within a short window.https://lukehebert.com/post/inode-counts/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/inode-counts/A quick bash one-liner to identify which directories are consuming the most inodes on a Linux system, helping you pinpoint the source of ‘No space left on device’ errors when disk space still appears available.https://lukehebert.com/post/locate-files-based-on-time-modified-how-many-days-since-it-has-been-modified/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/locate-files-based-on-time-modified-how-many-days-since-it-has-been-modified/A quick reference for using find with -mtime and -mmin to locate files by how long ago they were last modified, including the common off-by-one confusion around the +1 flag.https://lukehebert.com/post/locate-largest-files-top-10/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/locate-largest-files-top-10/A quick one-liner to identify the ten largest files or directories under any path. Useful when disk space is tight and you need to find what is eating your storage.https://lukehebert.com/post/lsof-check-listening-ports/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/lsof-check-listening-ports/A quick way to list every port a process is listening on, using lsof and a simple grep filter. Handy for troubleshooting connectivity issues or auditing what services are exposed on a host.https://lukehebert.com/post/usage-of-cut/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/usage-of-cut/A quick reference for the cut command, covering how to split text by a delimiter and extract specific fields. Useful for parsing CSV, log files, and other delimited data from the command line.https://lukehebert.com/post/memory-by-process/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/memory-by-process/A quick one-liner to group running processes by name and rank them by memory usage. Handy when you need to spot which services are eating RAM without pulling up a full top or htop session.https://lukehebert.com/post/mod-deflate-rules/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-deflate-rules/Apache mod_deflate compresses outgoing responses to reduce bandwidth and speed up page loads. This post covers the AddOutputFilterByType directives needed to enable compression for common content types.https://lukehebert.com/post/mod-remote-ip/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-remote-ip/A troubleshooting walkthrough for getting mod_remoteip working correctly under Apache 2.4 and cPanel, including the right LogFormat directives and RemoteIP configuration so that access logs, mod_security, and other modules all see the real client IP.https://lukehebert.com/post/mod-rewrite-block-bad-bot/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-rewrite-block-bad-bot/A quick Apache mod_rewrite snippet that returns a 403 Forbidden to any request whose User-Agent matches a bot pattern. Drop it into your .htaccess and you are done.https://lukehebert.com/post/mod-qos-tailblock/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-qos-tailblock/A lightweight bash script that monitors Apache error logs for repeated access-denied entries and automatically blocks offending IPs via iptables. Useful for quick-and-dirty rate-based blocking without a full WAF.https://lukehebert.com/post/monitor-dns-zone-reload/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/monitor-dns-zone-reload/A quick workflow for triggering a DNS zone reload with rndc and confirming the result in the system log. Covers the two commands you need and what to look for in the output.https://lukehebert.com/post/mount-a-labeled-drive-like-backup/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mount-a-labeled-drive-like-backup/Learn how to mount a filesystem by its label in /etc/fstab so your mount points stay stable across reboots and hardware changes.https://lukehebert.com/post/multi-test-emulating-a-busy-server/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/multi-test-emulating-a-busy-server/A Perl-based utility that emulates a busy server by spawning multiple threads performing varied IO workloads. It uses direct IO and cache invalidation to benchmark raw disk performance in a multitasking environment.https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Learn how to configure BIND9 views to serve different DNS records to internal and external clients from a single server. This guide walks through zone files, ACLs, recursion control, and the $include directive to keep your setup clean and secure.https://lukehebert.com/post/my-trace-route-mtr-packet-loss-testing/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/my-trace-route-mtr-packet-loss-testing/A quick walkthrough of using mtr in report mode to capture packet loss data across network hops. Learn how to run a 30-cycle test and read the output to isolate where loss is occurring.https://lukehebert.com/post/myisamchk/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/myisamchk/A quick reference for repairing corrupted MyISAM index files with myisamchk, including the exact command and what to expect when running it against a database directory.https://lukehebert.com/post/mysql-fragmentation-levels/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mysql-fragmentation-levels/Learn how to measure InnoDB table fragmentation using information_schema queries and interpret the resulting ratio to decide when a table needs optimization.https://lukehebert.com/post/mysql-general-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mysql-general-log/A quick walkthrough of enabling, configuring, and querying the MySQL general log to capture every statement that hits your server.https://lukehebert.com/post/mysql-grants/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mysql-grants/A quick reference for viewing and applying MySQL GRANT statements, including the specific privileges needed for routine and view management.https://lukehebert.com/post/mysql-joins/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mysql-joins/A quick reference for the four types of SQL JOIN operations in MySQL, with plain-language explanations and a simple example for each.https://lukehebert.com/post/netstat-ss-check-listening-ports/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/netstat-ss-check-listening-ports/A quick reference for checking listening ports on Linux using netstat and ss, including the flags that matter and what each output column means.https://lukehebert.com/post/ngins-flood-protection-with-limit-req/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ngins-flood-protection-with-limit-req/A practical walkthrough of Nginx’s limit_req module, showing how to cap request rates and protect PHP endpoints from HTTP-based denial-of-service attacks.https://lukehebert.com/post/nginx-load-balancing/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-load-balancing/A practical walkthrough of setting up Nginx round-robin load balancing, including upstream configuration, weighted distribution, IP hashing, and failover directives.https://lukehebert.com/post/nginx-multiple-conditional-test/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-multiple-conditional-test/Learn how to chain multiple if conditions in Nginx to build a composite variable and route traffic based on the combined result.https://lukehebert.com/post/nginx-mod-rewrite-module/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-mod-rewrite-module/A practical reference for Nginx’s ngx_http_rewrite_module, covering the break, if, return, rewrite, set, and related directives with working examples and processing-order details.https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Nginx status code 444 silently drops a connection without sending any HTTP response to the client. Learn when and how to use it for security and traffic management.https://lukehebert.com/post/noapic/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/noapic/The noapic kernel parameter disables the Advanced Programmable Interrupt Controller, a useful workaround for interrupt routing issues on older or misconfigured systems.https://lukehebert.com/post/numa-mysql-swap-insanity/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/numa-mysql-swap-insanity/A deep dive into why MySQL on NUMA systems suffers from unpredictable swapping, and how a single numactl interleave fix eliminates the problem entirely.https://lukehebert.com/post/numa-update-to-mysql-swap-insanity/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/numa-update-to-mysql-swap-insanity/A follow-up to the original MySQL NUMA swap post, explaining why the real issue is memory pressure on a single NUMA node rather than swap itself, and outlining a three-part solution for balanced allocation in production.https://lukehebert.com/post/percona-xtradb-recovery/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/percona-xtradb-recovery/Percona XtraDB Cluster can recover a crashed node and rejoin it to the cluster using an incremental state transfer. This post walks through how GTID-based position recovery works under the hood and what you will see in the error log during the process.https://lukehebert.com/post/restore-permissions-on-or-get-permissions-on-all-files-and-folder-in/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/restore-permissions-on-or-get-permissions-on-all-files-and-folder-in/A quick reference for backing up and restoring full ACL permissions across an entire directory tree using getfacl and setfacl.https://lukehebert.com/post/ps-aux-states/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ps-aux-states/A quick reference for the process state codes shown in the STAT column of ps aux, including both standard and BSD-specific flags.https://lukehebert.com/post/raid-error-code-key-qualifers/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/raid-error-code-key-qualifers/A quick reference for understanding the key qualifiers that appear in RAID controller error codes, so you can pinpoint the exact failure condition instead of guessing from a generic error message.https://lukehebert.com/post/regex/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/regex/A practical cheat sheet covering common regex patterns, Perl-compatible lookarounds, and character classes for everyday text processing in bash and grep.https://lukehebert.com/post/reject-with-comment/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/reject-with-comment/A quick iptables one-liner to reject TCP traffic from a specific source IP with a TCP reset, tagged with a human-readable comment for future reference.https://lukehebert.com/post/linux-rcs/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/linux-rcs/A quick reference for the core RCS (Revision Control System) commands used to initialize, check in, check out, and log file revisions on a Linux system.https://lukehebert.com/post/show-global-maximum-sql-connections-in-use/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/show-global-maximum-sql-connections-in-use/A quick MySQL command to check the peak number of simultaneous connections your server has handled, useful for capacity planning and diagnosing connection bottlenecks.https://lukehebert.com/post/stop-slow-loris-attacks/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/stop-slow-loris-attacks/Slow Loris attacks tie up web server sockets with trickling requests until legitimate traffic is starved. This post walks through configuring Apache mod_qos to detect and block those connections automatically.https://lukehebert.com/post/sync-mysql-time/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/sync-mysql-time/A quick procedure to verify and correct a time mismatch between the host system clock and MySQL’s internal NOW() function, using a simple service restart.https://lukehebert.com/post/find-command-printf-switches-lost-found-and-find-output-format/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/find-command-printf-switches-lost-found-and-find-output-format/A quick reference for GNU find -printf format switches, with practical examples for inspecting file ownership, size, and mode. Includes a use case for auditing files recovered into lost+found after a filesystem check.https://lukehebert.com/post/understanding-linux-permissions/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/understanding-linux-permissions/A practical breakdown of how Linux file permissions work, including the symbolic and numeric chmod methods, special bits like setuid and sticky, and how permissions differ between files and directories.https://lukehebert.com/post/understanding-load-averages/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/understanding-load-averages/A practical guide to reading Linux load averages, with a traffic analogy that makes the numbers click. Learn the thresholds that matter, how multi-core systems change the math, and which of the three averages to watch.https://lukehebert.com/post/unmounted-disk-labels/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/unmounted-disk-labels/A quick bash one-liner that lists every disk label present in /dev/disk/by-label/ that is not currently mounted, so you can spot forgotten or orphaned volumes at a glance.https://lukehebert.com/post/update-vm-memory-usage/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/update-vm-memory-usage/Tune Linux VM memory behavior by adjusting vfs_cache_pressure, dirty_ratio, and swappiness to reduce unnecessary swapping and improve I/O throughput.https://lukehebert.com/post/user-performance-data-on-mysql/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/user-performance-data-on-mysql/A quick bash one-liner that pulls per-user CPU time, connection counts, and active session details from MySQL’s INFORMATION_SCHEMA and processlist tables.https://lukehebert.com/post/rewrite-block-page-check-for-patterns-check-google/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/rewrite-block-page-check-for-patterns-check-google/Use Apache mod_rewrite to return a 400 error for a specific URI and optionally block hotlinking from other domains. A quick .htaccess snippet that keeps unwanted traffic off a single page.https://lukehebert.com/post/aws-vpc-structure/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/aws-vpc-structure/A visual walkthrough of the core networking components that make up an Amazon VPC, from subnets and gateways to security groups and route tables. Understanding how these pieces interact is essential for designing secure, well-segmented cloud networks.https://lukehebert.com/post/structure-of-an-iam-policy/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/structure-of-an-iam-policy/An overview of how AWS IAM policies are structured, including the six policy types and the key elements of a policy document. Learn how to apply the principle of least privilege when defining permissions.https://lukehebert.com/post/golden-ticket-attack/Mon, 15 Nov 2021 00:00:00 +0000https://lukehebert.com/post/golden-ticket-attack/A Golden Ticket attack lets an attacker forge Kerberos tickets and impersonate any user in an Active Directory domain. Learn how the attack works and the concrete steps you can take to defend against it.https://lukehebert.com/post/resetting-ad-krbtgt-password/Fri, 05 Nov 2021 00:00:00 +0000https://lukehebert.com/post/resetting-ad-krbtgt-password/A practical guide to resetting the krbtgt account password in Active Directory, including considerations for external trusts and the Microsoft-provided reset script.https://lukehebert.com/post/kerberos-issue-tracker/Fri, 24 Sep 2021 00:00:00 +0000https://lukehebert.com/post/kerberos-issue-tracker/A quick reference for the MIT Kerberos project issue tracker, where bugs, security advisories, and feature requests for the reference Kerberos implementation are tracked and resolved.https://lukehebert.com/post/ipv4-kernel-stack-optimizations/Tue, 07 Sep 2021 00:00:00 +0000https://lukehebert.com/post/ipv4-kernel-stack-optimizations/A practical walkthrough for tuning Linux TCP/IP stack parameters, from selecting a congestion control algorithm to applying sysctl settings for high-throughput workloads.https://lukehebert.com/post/kafka-dump/Wed, 25 Aug 2021 00:00:00 +0000https://lukehebert.com/post/kafka-dump/A practical walkthrough for dumping Kafka topic data, including a generic consumer approach and a full Atlas-specific workflow covering JAAS configuration, Kerberos authentication, and log extraction.https://lukehebert.com/post/dump-kafka-atlas-topic-to-review-messages/Fri, 20 Aug 2021 00:00:00 +0000https://lukehebert.com/post/dump-kafka-atlas-topic-to-review-messages/A quick walkthrough for dumping the ATLAS_HOOK Kafka topic to inspect Atlas hook messages locally, including Kerberos authentication setup and consumer lag checks.https://lukehebert.com/post/hive-bundle-logs/Thu, 19 Aug 2021 00:00:00 +0000https://lukehebert.com/post/hive-bundle-logs/Hive bundle logs in a cloud data warehouse are stored under a predictable S3 path. Knowing where to look saves time when troubleshooting query performance or diagnosing failed jobs.https://lukehebert.com/post/deploy-cfssl-ca-server/Mon, 02 Aug 2021 00:00:00 +0000https://lukehebert.com/post/deploy-cfssl-ca-server/A step-by-step guide to deploying a CFSSL-backed certificate authority with PostgreSQL storage, OCSP responder, and CRL distribution. Covers installation, CA initialization, service configuration, and Nginx reverse proxy setup.https://lukehebert.com/post/aws-arn-structure/Thu, 29 Jul 2021 00:00:00 +0000https://lukehebert.com/post/aws-arn-structure/Every AWS resource is uniquely identified by an Amazon Resource Name (ARN) used in IAM policies, API calls, and resource references. This post breaks down the standard ARN format into its individual components for easy reading and construction.https://lukehebert.com/post/aws-volume-juggling-for-impaired-nodes-and-node-health-check/Wed, 28 Jul 2021 00:00:00 +0000https://lukehebert.com/post/aws-volume-juggling-for-impaired-nodes-and-node-health-check/A practical guide to diagnosing impaired EC2 instances by detaching and reattaching EBS root volumes to a rescue instance. Covers the full workflow from stopping the impaired node to restoring it to normal service.https://lukehebert.com/post/delete-existing-users-from-ranger/Tue, 06 Jul 2021 00:00:00 +0000https://lukehebert.com/post/delete-existing-users-from-ranger/A quick walkthrough of using the Ranger REST API to bulk-delete existing users, including how to capture an auth cookie and loop through a user list with curl.https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Wed, 10 Feb 2021 00:00:00 +0000https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Learn how to enable Kerberos trace logging in Cloudera Manager’s credential generation scripts to diagnose authentication failures quickly.https://lukehebert.com/post/spark-token-debug/Thu, 04 Feb 2021 00:00:00 +0000https://lukehebert.com/post/spark-token-debug/Enable verbose Kerberos and token logging on Spark driver and executor nodes to capture the diagnostic data you need when authentication is failing. Covers log4j configuration files and the exact spark-submit flags to wire them in.https://lukehebert.com/post/explain-kerberos-like-im-5/Thu, 10 Dec 2020 00:00:00 +0000https://lukehebert.com/post/explain-kerberos-like-im-5/A plain-English walkthrough of how Kerberos authentication works, using a simple analogy to make the ticket-granting process click. Perfect for anyone who has stared at a KDC diagram and felt lost.https://lukehebert.com/post/ldaps-and-unicodepwd/Tue, 01 Dec 2020 00:00:00 +0000https://lukehebert.com/post/ldaps-and-unicodepwd/LDAPS is a hard requirement when setting passwords via unicodePwd on Active Directory. Non-TLS connections are rejected by AD itself, and SASL is not a supported alternative.https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/Tue, 24 Nov 2020 00:00:00 +0000https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/A quick reference for the LDAP error codes returned during Active Directory bind operations, including what each code means and how to interpret the AcceptSecurityContext error message.https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/Tue, 03 Nov 2020 00:00:00 +0000https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/A troubleshooting guide for the Kerberos error ‘Cannot find key of the appropriate type to decrypt AP REP,’ covering encryption type mismatches between keytabs and Active Directory, plus practical steps to align AES and RC4 settings.https://lukehebert.com/post/unlimited-strength-jce-availability/Tue, 07 Jul 2020 00:00:00 +0000https://lukehebert.com/post/unlimited-strength-jce-availability/A quick reference for which JDK releases ship with Unlimited Strength JCE enabled by default, plus a small test program to verify your environment.https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/Tue, 04 Dec 2018 00:00:00 +0000https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/The version field in a TLS ClientHello message tells the server the highest protocol version the client supports, but it appears in three distinct places with different roles. Understanding where and how each version field is used helps troubleshoot handshake failures and interoperability issues with legacy implementations.https://lukehebert.com/post/checking-hole-punching/Tue, 06 Feb 2018 00:00:00 +0000https://lukehebert.com/post/checking-hole-punching/Learn how to verify that your file system supports hole punching by creating a test file, punching a hole with fallocate, and confirming the space savings with du.https://lukehebert.com/post/hdfs-named-node-memory-sizing-when-using-hdfs-encryption/Thu, 11 Jan 2018 00:00:00 +0000https://lukehebert.com/post/hdfs-named-node-memory-sizing-when-using-hdfs-encryption/Enabling HDFS encryption at rest adds per-file metadata overhead to the NameNode heap. This guide breaks down the memory impact and gives a practical rule of thumb for right-sizing your NameNode heap.https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Tue, 21 Nov 2017 00:00:00 +0000https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Lose track of which private key pairs with which certificate? Use OpenSSL to compare public key hashes and confirm the match in seconds.https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/Tue, 17 Oct 2017 00:00:00 +0000https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/A quick reference for LDAP result and error codes, covering both server-side responses and client-side indicators, including Active Directory-specific sub-codes under error 49.https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/Thu, 07 Sep 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/A quick reference for Kerberos enctype numbers and what they map to, so you can stop guessing which cipher a ticket is actually using.https://lukehebert.com/post/hdfs-proxy-users/Wed, 06 Sep 2017 00:00:00 +0000https://lukehebert.com/post/hdfs-proxy-users/HDFS proxy users let you configure impersonation so specific users can submit jobs or access HDFS on behalf of others. This guide covers the core-site.xml properties, host and group restrictions, and Kerberos considerations for secure clusters.https://lukehebert.com/post/ptr-records/Tue, 05 Sep 2017 00:00:00 +0000https://lukehebert.com/post/ptr-records/A valid PTR record must resolve to a name that resolves back to the original address. Multiple PTR records for a single address break name resolution and can cause Kerberos ticket verification to fail.https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/Thu, 31 Aug 2017 00:00:00 +0000https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/A quick reference for the six most common causes of the Kerberos GSS-API checksum failure error, from wrong passwords to time skew and SPNEGO canonicalization issues.https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/Tue, 22 Aug 2017 00:00:00 +0000https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/A look at how Java’s built-in Kerberos implementation uses cRealm and sRealm to determine the path between client and service realms, including hierarchical traversal and capaths configuration.https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Kerberos error 44 occurs when the keytab KVNO does not match the KDC database. This guide walks through diagnosing the mismatch and regenerating the keytab to restore authentication.https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/A common Java SSL handshake failure stems from passing a null KeyManager array when initializing the SSLContext, which silently disables all certificate-based cipher suites. This post walks through the root cause and the four most frequent triggers behind the error.https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Fri, 18 Aug 2017 00:00:00 +0000https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Multiple CNs in a certificate Subject field are deprecated and cause compatibility failures. The SAN extension is the correct way to cover multiple names on a single certificate.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/server-not-found-kerberos/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-not-found-kerberos/A quick troubleshooting guide for the ‘Server not found in Kerberos database’ error, covering the four most common root causes and how to verify each one.https://lukehebert.com/post/check-hue-credentials-or-keytab-credentials-and-credential-flags-kerberos/Fri, 04 Aug 2017 00:00:00 +0000https://lukehebert.com/post/check-hue-credentials-or-keytab-credentials-and-credential-flags-kerberos/Walk through inspecting a Hue keytab file, verifying its principals with klist, and confirming that the resulting ticket carries the Renewable flag Hue requires for long-running service operations.https://lukehebert.com/post/saml-custom-attributes-in-hue/Fri, 21 Jul 2017 00:00:00 +0000https://lukehebert.com/post/saml-custom-attributes-in-hue/Hue returns a Permission Denied error when the IDP sends custom SAML attributes that pysaml2 cannot map. This guide walks through creating an attribute mapping file and configuring Hue to resolve the issue.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/trace-kerberos-in-the-cli/Thu, 29 Jun 2017 00:00:00 +0000https://lukehebert.com/post/trace-kerberos-in-the-cli/Kerberos authentication failures can be frustrating to debug. Setting the KRB5_TRACE environment variable gives you detailed library-level logging that pinpoints exactly where the exchange breaks down.https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/A quick reference for diagnosing Kerberos authentication failures in Active Directory, covering the lockout state machine and the specific error codes (5be, 775, 18) that indicate revoked credentials or a locked account.https://lukehebert.com/post/aes-ni-encryption-in-flight-for-hdfs/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/aes-ni-encryption-in-flight-for-hdfs/Configure AES-NI accelerated encryption in transit for HDFS by setting the cipher suite and key length in hdfs-site.xml on both the NameNode/DataNode and client sides.https://lukehebert.com/post/alternate-krb5.conf-location/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/alternate-krb5.conf-location/Java reads its Kerberos configuration from a fixed set of paths before falling back to the system default. Setting KRB5_CONFIG lets you point a Java application at a custom krb5.conf without touching the OS-level file.https://lukehebert.com/post/are-unix-users-required-for-hadoop/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/are-unix-users-required-for-hadoop/Hadoop requires OS-level user accounts on every cluster node regardless of security configuration. This post explains why, covering both secure and simple mode, and addresses whether the requirement can be removed.https://lukehebert.com/post/check-entropy-levels-on-linux/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-entropy-levels-on-linux/Learn how to check and interpret the kernel entropy pool on Linux, why low entropy can slow down SSL handshakes and SSH sessions, and what to do when the pool runs dry.https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Inconsistent forward and reverse DNS lookups can cause a cascade of cluster and security issues. This guide walks through quick Python and Java one-liners to verify that your hostname, IP, and reverse record all line up.https://lukehebert.com/post/checking-aes-ni-availability/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-aes-ni-availability/A quick reference for verifying AES-NI hardware acceleration across Java, OpenSSL, and the CPU itself. Includes benchmark commands to confirm the instruction set is actually being used.https://lukehebert.com/post/checking-host-resolution-using-getent/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-host-resolution-using-getent/A quick reference for using getent to verify how your Linux system resolves hostnames, short names, and IP addresses through the full NSS chain.https://lukehebert.com/post/cleanup-alternatives/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/cleanup-alternatives/A quick procedure for resolving Cloudera Manager agent failures caused by corrupted system alternatives entries, including the exact commands to stop the agent, purge stale alternatives, and restart cleanly.https://lukehebert.com/post/cm-license-api-update/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/cm-license-api-update/A quick reference for updating a Cloudera Manager license through the REST API using a single curl command, including the required headers and authentication.https://lukehebert.com/post/cm-timezone-does-not-match/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/cm-timezone-does-not-match/Cloudera Manager raises a timezone mismatch alert when the OS clock files disagree with the timezone CM expects. This post walks through the three key files to check and how to align them.https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/A quick two-step check to confirm the Kerberos key version number in your KDC database matches the value stored in a local keytab file. Mismatched KVNO values are a common cause of authentication failures in Hadoop and other Kerberized services.https://lukehebert.com/post/delete-hue-users/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/delete-hue-users/Hue does not provide a built-in UI option to remove user accounts. This workaround uses the Hue Django shell to delete one or more users directly from the database, with a clear caveat that the process is unsupported.https://lukehebert.com/post/determine-is-a-datanode-is-dead-formula/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/determine-is-a-datanode-is-dead-formula/A quick reference for calculating the exact timeout window before Hadoop marks a Datanode as dead, based on the heartbeat and recheck-interval settings.https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/When hostname -f returns a short name instead of a fully qualified domain name, the issue usually traces back to the HOSTNAME variable in /etc/sysconfig/network or a misconfigured /etc/hosts entry. Understanding the difference between the gethostname and gethostbyname system calls makes the fix straightforward.https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Kerberos authentication failures can be tricky to diagnose without detailed logging. This guide walks you through enabling Kerberos event logging on a Windows machine via the registry so you can capture authentication events in the system log.https://lukehebert.com/post/java-jvm-debugging-tools/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/java-jvm-debugging-tools/A quick reference for the most useful JVM debugging commands, including heap inspection, environment introspection, and enabling GC logging on a running Java process.https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Specific JDK 1.8.0 builds (u40, u45, u91, u92) are known to break SPNEGO authentication and Hadoop web interfaces. This post documents the affected versions, the symptoms, and the recommended downgrade path.https://lukehebert.com/post/jvm-ssl-debug/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jvm-ssl-debug/Enable verbose SSL/TLS handshake logging in a JVM running Hadoop or Cloudera services to diagnose certificate and protocol issues.https://lukehebert.com/post/kerberos-cli-debug-trace-hadoop/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cli-debug-trace-hadoop/A quick reference for enabling verbose Kerberos and Hadoop debug output on the command line, so you can see exactly where authentication is failing.https://lukehebert.com/post/kerberos-cross-realm-trust/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cross-realm-trust/Kerberos cross-realm authentication relies entirely on TGS exchanges between KDCs. Understanding the three-step ticket flow makes it easier to troubleshoot trust relationships between domains.https://lukehebert.com/post/kerberos-debug-mode-for-the-jvmsparkspnego/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-debug-mode-for-the-jvmsparkspnego/Enable Kerberos debug logging in a JVM, Spark driver, and Spark executors to troubleshoot SPNEGO and authentication issues. Covers the exact Java system properties, Spark configuration keys, and how to redirect Spark logs to stdout so Kerberos output interleaves with application logs.https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/A practical walkthrough of how Hadoop maps Kerberos principals to short names via the auth_to_local property, including rule syntax, acceptance filters, and common troubleshooting patterns.https://lukehebert.com/post/keyctl-link-key-has-been-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/keyctl-link-key-has-been-revoked/A quick guide to diagnosing and resolving the ‘Key has been revoked’ error in the Linux kernel keyring using keyctl commands.https://lukehebert.com/post/mount-output-in-columns-formatted-output-for-mount-list/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/mount-output-in-columns-formatted-output-for-mount-list/Pipe the mount command through column -t to get a clean, aligned table of all mounted filesystems. A quick sysadmin trick for scanning devices, mount points, and options at a glance.https://lukehebert.com/post/multiple-http-principles/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/multiple-http-principles/How to verify and manage HTTP service principal names in Active Directory using ldapsearch and setspn, including a note about Centrify’s uppercase requirement.https://lukehebert.com/post/mysql-key-constraints-fk-by-db/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/mysql-key-constraints-fk-by-db/A quick reference for querying MySQL information_schema to list all foreign key constraints in a given database, including the referencing and referenced columns.https://lukehebert.com/post/change-nn-trash-check-point-interval-can-correct-tgt-on-nn-non-ha-with-kms/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/change-nn-trash-check-point-interval-can-correct-tgt-on-nn-non-ha-with-kms/Adjusting the NameNode trash checkpoint interval can resolve TGT renewal issues on non-HA NameNodes using KMS. This change is safe and does not affect trash retention.https://lukehebert.com/post/namei-checking-path-traversal-and-permissions/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/namei-checking-path-traversal-and-permissions/The namei command walks a full path and prints ownership, permissions, and symbolic link resolution for every component. It is a quick way to spot where a permission chain breaks or a symlink redirects unexpectedly.https://lukehebert.com/post/namenode-loglevel/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/namenode-loglevel/How to set the HDFS Namenode StateChange log level to DEBUG via the web UI or the command line, and when that helps with troubleshooting.https://lukehebert.com/post/ntp-errors/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/ntp-errors/A host health test flags NTP clock drift when the system clock falls out of sync with its NTP servers. This guide walks through diagnosing and resolving common NTP synchronization failures.https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/A practical cheat sheet of openssl s_client commands for inspecting, verifying, and troubleshooting SSL certificates in production environments.https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/A practical look at why the MIT krb5 KDC rejects a TGS-REQ with KRB_AP_ERR_NOT_US, including the exact validation logic and the most common root causes behind the error.https://lukehebert.com/post/a-guide-to-mod_rewrite/Sun, 22 Feb 2015 00:00:00 +0000https://lukehebert.com/post/a-guide-to-mod_rewrite/Mod_rewrite is a rule-based rewriting engine (based on a regular-expression parser) to rewrite requested URLs on the fly.https://lukehebert.com/post/fixing-udev-70-persistent-net-rules/Wed, 13 Aug 2014 00:00:00 +0000https://lukehebert.com/post/fixing-udev-70-persistent-net-rules/Have you ever replaced a network interface (NIC) or performed a chassis swap? If you are an administrator or IT professional the chances are good that at some point or another you have had to deal with sticky udev rules.https://lukehebert.com/post/postfix-message-flows-and-common-issues/Sun, 18 May 2014 00:00:00 +0000https://lukehebert.com/post/postfix-message-flows-and-common-issues/Postfix is a free and open-source mail transfer agent (MTA) that routes and delivers electronic mail. This post covers core system concepts.https://lukehebert.com/post/postfix-command-reference/Sun, 04 May 2014 00:00:00 +0000https://lukehebert.com/post/postfix-command-reference/A quick Postfix Command Referencehttps://lukehebert.com/post/hypervisor-classifications/Sat, 05 Apr 2014 00:00:00 +0000https://lukehebert.com/post/hypervisor-classifications/There are a variety of Hypervisors out in the in the hosting space. Here is a list of the current classifications.https://lukehebert.com/post/xen-vitualization-with-bridged-networking/Sat, 05 Apr 2014 00:00:00 +0000https://lukehebert.com/post/xen-vitualization-with-bridged-networking/Xen is an open-source type-1 or bare metal hypervisor, which makes it possible to run many instances of an operating system or entirely different operating systems in parallel on a single machine (or host).https://lukehebert.com/post/wheres-all-my-ram/Fri, 21 Mar 2014 00:00:00 +0000https://lukehebert.com/post/wheres-all-my-ram/Ever wonder why the output of free -m seems to make it look like your system is out of memory?https://lukehebert.com/post/calculating-downtime-on-a-linux-system/Sat, 15 Mar 2014 00:00:00 +0000https://lukehebert.com/post/calculating-downtime-on-a-linux-system/Whether you are an engineer or an end user, most of us who work on critical systems find ourselves concerned with the availability of services those systems provide every day.https://lukehebert.com/post/centering/Thu, 06 Sep 2012 00:00:00 +0000https://lukehebert.com/post/centering/Centering is the mindfulness practice of bringing your awareness into the present moment to establish mental stability and inner calm.https://lukehebert.com/post/the-inverted-u-model/Thu, 06 Sep 2012 00:00:00 +0000https://lukehebert.com/post/the-inverted-u-model/The inverted U-model, also known as the Yerkes-Dodson law, states that performance increases with physiological or mental arousal, but only up to an optimal point. When levels of arousal or stress become too high, performance begins to decline efficiency drops.https://lukehebert.com/post/assertiveness/Fri, 27 Jan 2012 00:00:00 +0000https://lukehebert.com/post/assertiveness/Do you consider yourself to be assertive? And what does being assertive mean to you? Does it mean exercising your rights all the time, every time?https://lukehebert.com/post/dealing-with-unhappy-customers/Fri, 27 Jan 2012 00:00:00 +0000https://lukehebert.com/post/dealing-with-unhappy-customers/In service and support we often encounter unhappy customers. How we deal with them makes more difference than most people realize.https://lukehebert.com/post/exim-cheatsheet/Mon, 25 Jul 2011 00:00:00 +0000https://lukehebert.com/post/exim-cheatsheet/A set of useful commands for administrators working with Exim 4.https://lukehebert.com/post/snappy-on-the-prowl-at-softlayer-dallas/Wed, 20 Jul 2011 00:00:00 +0000https://lukehebert.com/post/snappy-on-the-prowl-at-softlayer-dallas/With over 6,000 servers in the SoftLayer DataCenter (Formely “The Planet”) its no surprise to find ‘Snappy’, HostGator’s Mascot on the prowl.