Security

Monitoring /home Usage with a Systemd Timer

A home server rarely needs a full‑blown monitoring stack.
If you just want a quick alert when /home fills up, a tiny systemd service plus curl will do the trick. The example below keeps the footprint minimal, respects security best practices, and uses the official Telegram Bot API.

1. Create a Bot and Grab Credentials

1. Talk to BotFather on Telegram and create a bot.
2. Note the bot token (e.g. 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11).
3. Find your chat ID by sending a message to the bot and querying https://api.telegram.org/bot<token>/getUpdates.
4. Store both values in a read‑only file:

sudo mkdir -p /etc/telegram-alert
sudo tee /etc/telegram-alert/credentials <<EOF
TOKEN=123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11
CHAT_ID=987654321
EOF
sudo chmod 600 /etc/telegram-alert/credentials

2. Service Unit – home-usage-alert.service

# /etc/systemd/system/home-usage-alert.service
[Unit]
Description=Send Telegram alert when /home exceeds 90%% usage
After=network.target

[Service]
Type=oneshot
EnvironmentFile=/etc/telegram-alert/credentials
ExecStart=/usr/bin/bash -c '
  USAGE=$(df --output=pcent /home | tail -1 | tr -d "%")
  if [ "$USAGE" -ge 90 ]; then
    curl -s -X POST https://api.telegram.org/bot$TOKEN/sendMessage \
      -d chat_id=$CHAT_ID \
      -d text="⚠️ /home is at ${USAGE}%% capacity. Free space needed." \
      -H "Content-Type: application/x-www-form-urlencoded"
  fi
'
PrivateTmp=yes
ProtectSystem=full
RestrictAddressFamilies=AF_INET AF_INET6
Restart=no

[Install]
WantedBy=multi-user.target

Security notes

When a host rebuilds, its SSH key changes

A fresh install or a system rebuild swaps the host’s RSA/ED25519 key pair.
If you still have the old key in ~/.ssh/known_hosts, the next SSH connection will trigger a “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!” message.
That warning is a safety feature, but it also blocks automation and forces users to manually edit the file.

The quickest, safest way to clean up stale entries is to let OpenSSH do the work with ssh-keygen -R. The command removes every key that matches the supplied hostname or IP, regardless of whether the entry is hashed or plain.

Run a single command as root with systemd‑run

When you just need to fire up one command as root and then drop back, sudo is the go‑to.
But if your distro already runs systemd, systemd‑run can be a leaner, more isolated way to do it—especially for short‑lived tasks.

What systemd‑run actually does

systemd‑run spawns a transient unit (either a scope or a service) that inherits the caller’s privileges and then elevates them to root when you add --user or --scope with --user.
Unlike sudo, the unit vanishes as soon as the command finishes, and you can sprinkle a handful of systemd properties on it to tighten the environment.

Systemd timers can fall silent after a kernel upgrade

When a new kernel lands, the kernel‑specific modules and initramfs changes can break the ExecStartPre or ExecStart scripts that a timer relies on.
The result? A timer that never fires, or that fires with the wrong environment.

Below is a step‑by‑step guide to diagnose and restore a broken timer, with security‑aware notes and trade‑offs you’ll run into in a production or homelab setup.

Extracting a Single File from a Borg Archive Without Recreating the Entire Directory Tree

When a backup archive grows to several terabytes, restoring a single configuration file or a database dump can feel like pulling a needle from a haystack. Borg’s default extract command rebuilds the whole directory tree, which is wasteful when you only need one file. The following guide shows how to pull a single file efficiently, keeps metadata intact, and keeps your system secure.

Introduction to Bash History

As a long-time Linux user, I’ve come to rely on the command line to get my work done. The Bash shell is an incredibly powerful tool, and one of its most useful features is its ability to store a history of previously executed commands. This history is stored in the ~/.bash_history file and can be accessed using the history command. However, as our systems see more use, the Bash history can become cluttered with duplicate entries, making it tough to find the commands we need.

Introduction to Emergency Mode and Rescue Shell

When your Linux system fails to boot, it can be frustrating - especially if you’re not familiar with the troubleshooting process. I’ve seen this go wrong when people don’t know where to start. Luckily, systemd’s Emergency Mode and Rescue Shell are here to help. In this article, we’ll dive into how to use these tools to troubleshoot initramfs issues and get your system up and running again.

Introduction to SSH Keys with Multiple Accounts

I’ve seen this go wrong when people try to manage multiple services or projects on a single remote server - they end up with a mess of passwords and login issues. Using SSH keys with multiple accounts is a much better approach. It allows for secure, passwordless login to different user accounts on the same server, which is particularly useful for sysadmins, developers, and self-hosters.

Introduction to Shared Directory Management

I’ve seen shared directory management become a nightmare on Linux systems, especially when dealing with complex permission scenarios. Luckily, Linux provides some useful tools to simplify this process, including setgid, sticky bits, and Access Control Lists (ACLs). These features give you fine-grained control over file and directory permissions, ensuring that users and groups have the necessary access without compromising security.

Setgid and Sticky Bits

Setgid and sticky bits are special permission bits that can be set on directories. The real trick is understanding how they work together. The setgid bit, when set on a directory, ensures that all files created within that directory inherit the group ownership of the directory. This is particularly useful in shared directories where multiple users need to collaborate on files. Don’t bother with the setgid bit if you’re working with single-user directories, though. The sticky bit, on the other hand, prevents users from deleting or renaming files they do not own, even if they have write permission to the directory.

Introduction to Log Rotation with systemd

I’ve seen log files consume all available disk space, bringing systems to a grinding halt. That’s why log rotation is a crucial aspect of system administration. With systemd becoming a de facto standard for managing system services and logs on many Linux distributions, I’ll explore how to use it to manage and rotate log files efficiently.

Understanding systemd-journald

systemd-journald is the system service that collects and stores log messages from various sources, including system services, kernel messages, and user applications. By default, journald stores log messages in a binary format, which can be queried using the journalctl command. To manage log rotation, we need to understand how journald handles log storage and rotation. Don’t bother with manually rotating log files - journald can handle it for you.