Topic
13 matching entries across Articles, TIL and Projects.
Long-form writing tagged Linux.
Building an Ubuntu engineering laptop where the disk encryption, credential storage and boot behaviour are decisions rather than defaults: TPM2-backed LUKS unlock, a separate encrypted work volume, and an honest account of what each choice does and does not protect.
Building a WireGuard tunnel with a real kill switch on a device with no package manager and a read-only root: the bootstrap paradox, the unit-ordering typo systemd accepts silently, and why a watchdog that heals a fault also hides it.
A username rename looks like one command and touches a dozen things. What a Linux account is actually referenced by, how to change it remotely without locking yourself out, and why changing the UID is a different job entirely.
Short notes and fixes tagged Linux.
A start target that checks whether a socket path exists will skip starting the daemon after a crash, then report success. Test for a live listener, not for a file.
A lab VM with a virtual TPM works from the home directory and fails from a second data volume. The profile permits socket creation under one path pattern only, and the denial is not in the tool's output.
Uncommenting the stock localnet ACL so a lab network can reach a proxy also admits every other private range, including the wifi the laptop happens to be sitting on.
Remote desktop credentials go into the login keyring, and the keyring stays locked until someone logs in at the console. Setting them on a headless machine appears to succeed and produces a connect-then-drop fault.
A self-signed key generated the usual way is rejected with no useful error. The certificate is fine and the key is fine; the private key container format is not.
The terminal escape sequence that lets a remote editor write to your local clipboard has no reliable read half. Configure copy through it and leave paste to the terminal.
Agent start-up logic in ~/.profile works when you log in at the machine and silently does nothing when you connect over SSH. Which startup file runs depends on how the shell was invoked.
A service bound to 0.0.0.0 will not accept connections arriving inside a VRF unless the kernel is told to allow it. The listener looks correct, the route is correct, and the connection is refused.
A CLI working in PowerShell does not mean the same authentication or configuration will automatically exist inside WSL.
Projects and implementation patterns tagged Linux.
Turning an undocumented Raspberry Pi media box into something that can be rebuilt from a written kit: a full configuration survey, systemd-managed networking with a fail-closed tunnel, and a verification checklist that tests the failure path.
