www.schrottplatz.biz

Not a real junkyard — just a hobbyist’s collection of robots, code, electronics, and other useful junk.

Linux Commands and Configuration Notes

This page is a personal collection of Linux, server administration, Docker, Proxmox VE, Webmin and Samba AD DC notes. It is not meant to be a complete reference, but rather a compact list of commands I have found useful.

1. Useful Linux commands

Command notes
No. Command Notes
001 sudo fstrim -av Runs TRIM/discard on all mounted filesystems that support it and prints how many bytes were discarded. This is useful for SSDs and for thin-provisioned virtual disks, if discard is passed through by the hypervisor/storage stack.
002 du -hs * Shows the summarized size of each file or directory in the current directory. -h prints human-readable sizes, -s prints only one total per argument.
003 du -hs * | sort -h Shows directory sizes and sorts the result by size in human-readable order. This is useful for quickly finding large folders.
004 find . -type f | wc -l Counts files recursively below the current directory. -type f selects files only; -type d would select directories. wc -l counts the output lines.
005 apt list --installed | grep <package-name-part> Lists installed APT packages and filters the result with grep. For exact package queries, apt policy <package> or dpkg -l | grep <package> can also be useful.
006 docker compose up -d Builds if necessary, creates, starts and runs the services from the current directory’s compose.yaml or docker-compose.yml in detached mode.
007 docker exec -it <container> <command> Runs a command inside an existing container. A common example is docker exec -it <container> bash or sh.
008 docker compose up -d <service> Starts only a selected Compose service in detached mode. In Compose terminology this is a service name, not necessarily the container name.
009 docker compose down Stops and removes the containers and default networks created by docker compose up. Named volumes are not removed unless additional options such as --volumes are used.
010 docker compose build --no-cache <service> Rebuilds a Compose service image without using the build cache. The service name is optional; without it, Compose builds all buildable services.
011 docker ps Lists running Docker containers. Use docker ps -a to include stopped containers.
012 sudo dmidecode --type 17 Shows information about installed memory modules. This usually requires root privileges.
013 crontab -e Opens the current user’s crontab in the configured editor. On Debian-based systems, select-editor can be used to choose another default editor such as nano.
014 rsync -XAavz user@remote:/source/ /destination/ Copies files with archive mode and preserves ACLs and extended attributes. -a is archive mode, -A preserves ACLs, -X preserves extended attributes, -v is verbose and -z compresses data during transfer. Be careful with trailing slashes: /source/ copies the contents of the directory.
015 rsync -XAavz --delete user@remote:/source/ /destination/ Same as above, but also deletes files in the destination that no longer exist in the source. Use --dry-run first when testing.
016 grep -Ev '^[[:space:]]*([#;]|$)' /path/to/file.conf Prints a configuration file without empty lines and without lines that begin with # or ; after optional whitespace.
017 tar --acls --xattrs --xattrs-include='*' --numeric-owner -cpf /backup/christian.V6.tar /srv/samba/profiles/christian.V6 Creates a tar backup of a Samba/Windows roaming profile directory while preserving ACLs, extended attributes and numeric ownership information.
018 tar --acls --xattrs --xattrs-include='*' --numeric-owner -xpf /backup/christian.V6.tar -C / Restores the tar backup to its original absolute path. Check the archive layout first with tar -tf /backup/christian.V6.tar | head.
019 sudo ufw allow from 192.168.10.1 proto udp to any port 1812 Allows UDP traffic from 192.168.10.1 to local port 1812, for example for RADIUS.
020 shred -u -n 3 -z private-key.pem Overwrites and removes a file. On SSDs, copy-on-write filesystems, thin-provisioned storage, virtual disks and journaled filesystems, secure deletion may be unreliable. For highly sensitive data, encryption-at-rest is usually the better strategy.
021 openssl crl -in subca.crl -inform DER -noout -text Prints a DER-encoded certificate revocation list in human-readable text format. For PEM input, omit -inform DER.

2. Proxmox VE notes

  • Inside a Linux VM, fstrim -av can tell the guest filesystem to discard unused blocks. For the host storage to reclaim space, discard/TRIM must also be supported and enabled in the virtual disk and storage stack. In Proxmox VE this usually means enabling the disk’s Discard option for thin-provisioned storage.
  • If scheduled backups did not run because the node was offline or the job was missed, the Repeat missed option in the backup job can be useful.
  • Setting backup retention to Keep Last: 1 keeps only the most recent backup for that job. This is useful for simple automatic backups, but it provides no historical rollback beyond the latest backup.
  • Stop running backup tasks: 
    vzdump -stop
  • Unlock a locked VM: 
    qm unlock <vm-id>

3. Webmin notes

  • To use HTTP Basic Authentication in Webmin, /etc/webmin/miniserv.conf can be configured with: 
    auth=basic
session=0

    This disables Webmin’s normal session-cookie login behavior. Only use this when you understand the security implications and preferably only behind HTTPS and/or a trusted reverse proxy.

4. Samba AD DC notes

  • Resolve domain controllers via the AD DNS SRV record: 
    nslookup -type=SRV _ldap._tcp.dc._msdcs.schrottplatz.internal
  • Show the AD site assigned to a Windows client: 
    nltest /dsgetsite
  • Edit an LDAP object in Samba’s local AD database. Replace GRP with the group or account name: 
    sudo ldbedit -H /var/lib/samba/private/sam.ldb -b "DC=schrottplatz,DC=internal" "(sAMAccountName=GRP)"
  • Show the RFC2307 gidNumber of a group, if it is exposed through NSS: 
    getent group "Group Name"
  • Check and reset SYSVOL ACLs: 
    sudo samba-tool ntacl sysvolcheck
sudo samba-tool ntacl sysvolreset
  • Manually set an NT ACL on a file or directory: 
    sudo samba-tool ntacl set "O:SYG:SYD:PAI(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;DA)" /path/to/file-or-directory --xattr-backend=native
  • Edit an AD entry for a user, group or computer account: 
    sudo ldbedit -H /var/lib/samba/private/sam.ldb "(sAMAccountName=VM117$)"