What are you all doing for -reliable- controllers?

Hey folks, title says it. but here's the background. I have a set of valve index knuckles controlers. absolutely -l- -o- -v- -e- them. But valve has screwed us. Cant actually buy them now, and the Right one has died. Not even like, dead dead, but the spicy pillow inside has become spicy.

Yes, ive attempted a repair. If it went well i wouldnt be here. Even for an experienced guy like me, this is not an easy swap, and the damn battery connector on the board snapped off the PCB while i was working on getting the mother flipping GLUE off of the connection. WHY.. WHY VALVE?! This was after I tried to see if i could get valve to replace or repair, and no good. Im out of options.

Ebay has em, but i dont trust that they arent just going to have the same problem.

What are my alternatives?

reddit.com
u/Gangrif — 8 days ago
▲ 13 r/redhat

Into the Terminal Episode 200 is right around the corner, what are your ideas for our 200th celebration episode?

FOLKS! ITT is about to hit its 200th episode. In the past 200 episodes we've given you all hundreds of hours worth of linux knowledge, career advice, good demos, and maybe a few bad ones (we wont talk about that sudo episode), and even a number of stories about our own histories, and that of Red Hat.

When we hit 100, we made the terrible decision to give you our top 100 linux commands! And almost 2 hours on-stream later, we did it! You can see it here: https://youtube.com/live/8GYtQymteJQ

We'd like to do something fun for our 200th, and we're looking for your ideas! What do you think Scott and I should subject ourselves to for the 200th episode? Whatever it is, it needs to be RHEL related.

So comment below! What do you think we should do for 200? Maybe you'll get a mention on the show if we use your idea!

Thanks!

reddit.com
u/Gangrif — 24 days ago
▲ 59 r/redhat

Building Your Linux Career in 2026 — Certs, Home Labs, and AI from Into the Terminal Ep. 198

How to build your career in technology is a moving target, and it's moving quickly! In this special career-focused episode of Into the Terminal, Nate and Scott step away from the command line to have a candid conversation about building a career in Linux in 2026. What certifications matter? Does your distro choice count? And how exactly does AI play into the future of sysadmin roles? Watch the full episode here or build your skills in the interactive labs.

Key Takeaways for 2026

1. Certifications vs. Degrees

Do certifications get you the job? According to Scott (who hires technical talent), certifications don't get you a job—they get you an interview.

  • Hiring managers look at certifications to establish a baseline of knowledge. Performance-based certifications (like Red Hat's RHCSA and RHCE) are highly valued because they prove you can actually execute the tasks on a live system, rather than just answering multiple-choice questions.
  • While some large organizations (or government entities) might still rigidly require a 4-year degree for management tracks, certifications are often a fraction of the cost and, when paired with experience, can open the majority of doors in the industry.

2. The Power of Home Labbing and Projects

If you can't get on-the-job experience doing the thing you want to do, build it yourself! Nate shared how he originally built his own DNS, mail, and web servers just to learn how they worked, which gave him tangible projects to point to in interviews.

  • Pro Tip for Interviews: Don't just talk about your successes! Be prepared to discuss your biggest failures. Hiring managers want to hear about how you messed up, how you recovered, and how you documented the fix so the team never steps on the same rake twice.

3. Does Your Distro Choice Matter?

Short answer: Yes, to an extent. While it might be fun to run a niche Linux distribution that only a handful of people in the world use, it won't help you much in a corporate job interview. Stick to the big players (RHEL family, Ubuntu LTS, etc.). The enterprise world runs on these major distributions, and the skills you build on them will translate directly into your career.

4. The Role of AI in Sysadmin Careers

Is AI replacing sysadmins? Rather than fully replacing roles, expect to see smaller teams heavily augmented by AI tooling. "AI does Linux really well," but organizations need practitioners who can securely prompt the AI, vet the scripts it generates, and evaluate the output. You are the layer between the AI and the real world.

  • The Ultimate Study Hack: Use AI as your personal study buddy! Spin up a Linux VM and tell a generative AI agent to log in and break something on the system without telling you what it broke. Then, use that broken system to practice real-world troubleshooting and diagnosis.

Links & Resources


Into the Terminal is a show dedicated to helping you grow your knowledge of critical administration skills for Red Hat Enterprise Linux. Whether you are new to Linux or new to RHEL, join us for a hands-on look at commands, processes, and tools.

reddit.com
u/Gangrif — 24 days ago
▲ 85 r/redhat

5 Emergency Linux Fixes Every Admin Should Know — Troubleshooting locked accounts, stuck mounts, and full disks from Into the Terminal Ep. 196

Ever hit a wall with a stuck mount, a locked-out root account, or a massive log file taking down a service? In this episode of Into the Terminal, we break down 5 real-world Linux emergencies and show you the quick command-line fixes to solve them in minutes. Watch the full episode here or test your skills in the interactive labs.

Advanced Features: The 5 Emergency Fixes

1. Recovering a Lost Root Password

If you've lost access to your server, you can interrupt the boot process to reset the root password without needing a live CD.

  • Interrupt GRUB: Reboot the machine, press e to edit the GRUB menu, and append rd.break to the end of the line starting with linux. Press Ctrl+X to boot.
  • Why rd.break? This tells dracut to pause the boot process right before it hands off to systemd. Disks are loaded, but the actual target environment hasn't initialized.
  • Remount and Chroot: Run mount -o remount,rw /sysroot to make the file system writable, then chroot /sysroot to drop into your actual root filesystem.
  • Fix and Relabel: Run passwd to reset the password. Crucially, run touch /.autorelabel before exiting. Because SELinux wasn't loaded, modifying /etc/shadow stripped its security context. The .autorelabel file tells the system to reapply labels automatically on the next boot!

2. Blanking a Log File (Without Restarting Services)

If a runaway log file fills up your filesystem, simply deleting the file with rm won't free the space! The service holding the file descriptor open still reserves the blocks on the disk. Instead of restarting the service (which causes an outage), you can zero out the file in place: cat /dev/null > /var/log/messages (or > /var/log/messages) This empties the file's contents, instantly reclaiming the disk space, while allowing the running service to continue writing to the exact same file descriptor without interruption.

3. Restoring a Lost File (from RPM)

Someone accidentally deleted a critical config file (e.g. rm /etc/httpd/conf/httpd.conf). If you can't simply dnf reinstall the package because it might overwrite other customizations, you can surgically extract just the file you need from the RPM. Use rpm2cpio package.rpm > package.cpio to convert the package to a cpio archive, then use cpio -i < package.cpio to extract the file structure locally into your current directory so you can manually copy back the missing piece.

4. Forcing a Stuck Mount to Unmount

You try to umount /mnt/data and get Device is busy. What do you do?

  • Find the culprit: Use lsof +D /mnt/data. The +D flag tells lsof to descend the directory path to find open file descriptors. (Note: -D is for device caches, +D is for directory trees!) Alternatively, use fuser -vm /mnt/data.
  • Kill the processes: If you are sure you want to forcibly terminate anything using the mount, fuser -k -9 -m /mnt/data kills all processes on the mount.
  • Lazy Unmount: If a network mount is unresponsive or you want to detach it gracefully once processes finish, use a "lazy" unmount: umount -l /mnt/data. It detaches the mount point from the filesystem hierarchy immediately and cleans up references in the background once it is no longer busy.

5. Fixing a Borked GPG RPM Key

If your package manager is throwing errors because it cannot validate the GPG keys of your repositories, you can manually replace the key on the filesystem (e.g. under /etc/pki/rpm-gpg/) or re-import it using rpm --import or during your next dnf install transaction when it prompts you to accept the key. This ensures the integrity of your installed packages remains cryptographically validated!

Quick Reference Card

# Emergency Root Password Reset
# (At GRUB menu, append rd.break to the linux line)
mount -o remount,rw /sysroot
chroot /sysroot
passwd
touch /.autorelabel
exit
exit

# Safely empty a log file without breaking file descriptors
cat /dev/null > /var/log/messages

# Find processes holding a mount busy
lsof +D /mnt/data
fuser -vm /mnt/data

# Lazy unmount a busy or hanging filesystem
umount -l /mnt/data

# Extract files manually from an RPM
rpm2cpio httpd-core.rpm > httpd-core.cpio
cpio -idmv < httpd-core.cpio

Links & Resources


Into the Terminal is a show dedicated to helping you grow your knowledge of critical administration skills for Red Hat Enterprise Linux. Whether you are new to Linux or new to RHEL, join us for a hands-on look at commands, processes, and tools.

u/Gangrif — 1 month ago
▲ 25 r/redhat

Anatomy of a Linux Service — A step-by-step systemctl Guide from Into the Terminal Ep. 195

Have you ever wondered what actually happens under the hood when you type systemctl start? It is easy to view systemd and SELinux as mysterious black boxes, but understanding the startup flow of a service is one of the most critical troubleshooting skills a Linux administrator can possess. In this episode of Into the Terminal, we break down the exact step-by-step lifecycle of a daemon using Apache as our guide. Watch the full episode here or try it for yourself in the interactive labs.

The Essentials

When diagnosing a service that won't start (or isn't behaving as expected), you need tools that peer into the different layers of the service's footprint.

Command What it does
systemctl status httpd Checks the status of the service, showing its CGroup, PID, and recent log outputs
pmap <pid> Inspects the memory map of a process to show you exactly which shared object libraries have been loaded
netstat -taupen (or ss -taupen) Enumerates the network ports and IPs your service has successfully bound to (or failed to bind to)
`lsof grep <pid>`
systemd-cgls Provides a tree view showing how all processes are mapped into their respective Control Groups (CGroups)

Pro Tip: While netstat is historically popular, many administrators will "judge you" for using it over the modern replacement ss. Both work perfectly for these troubleshooting steps!

Advanced Features

Exploring the Systemd Unit File

When you want to know how a service starts, look at its systemd unit file (e.g. vim /usr/lib/systemd/system/httpd.service).

  • Dependencies: The [Unit] section defines startup order. Wants= means systemd will try to start a dependency if it's there (like httpd-init for generating self-signed certs). Requires= is a harder link—if the required service fails, the main service won't start.
  • Service Types: The Type= directive tells systemd when to consider the service "started".
    • notify: Sends a ready signal back over DBus once sockets and workers are initialized.
    • simple: systemd assumes it's fully started the moment the executable is launched.
    • forking: Classic unix daemon behavior, spinning off child processes.
    • oneshot: Expected to run and exit (e.g., a backup script).

How systemctl Actually Works: DBus & PID 1

When you type systemctl start httpd, you aren't actually running the executable directly. Instead, the systemctl command sends an Inter-Process Communication (IPC) message over DBus to PID 1 (systemd). systemd receives the "StartUnit" request, authorizes the action via polkit, and executes the instructions in the unit file on your behalf.

CGroups, Namespaces, and Effective User IDs

Before running the executable, systemd prepares the sandbox.

  • CGroups: It places the service in a specific Control Group to isolate hardware resources (like preventing a rogue service from eating all 16 CPUs).
  • Namespaces: Directives like PrivateTmp=true create isolated directories (e.g., /tmp/systemd-private-*-httpd.service-*/) so the service cannot see or interfere with the host's normal /tmp.
  • Effective User ID: While services like Apache need to start as root to bind to privileged ports (like Port 80), they use setuid() immediately afterward to de-elevate their privileges, spawning worker processes as an unprivileged user (like apache).

Where SELinux Gets Involved

SELinux acts as the bouncer throughout this entire lifecycle.

  • It determines if the shell invoking systemctl is even allowed to speak to DBus.
  • It dictates whether systemd is allowed to execute the binary (if your executable is in a non-standard path without the correct context, SELinux will block systemd from running it).
  • It verifies that the service (httpd_t) is permitted to read its configuration files (httpd_config_t) and bind to its designated port (http_port_t).

Quick Reference Card

# View the systemd unit file for a service
cat /usr/lib/systemd/system/httpd.service

# See which shared libraries a service has loaded into memory
pmap $(pidof httpd | awk '{print $1}') | less

# Check which IPs/Ports a service successfully bound to
ss -taupen | grep httpd

# See which files a process currently holds open
lsof -p $(pidof httpd | awk '{print $1}')
# Alternatively, without lsof:
ls -l /proc/$(pidof httpd | awk '{print $1}')/fd/

# View all services in their respective CGroups
systemd-cgls

Links & Resources


Into the Terminal is a show dedicated to helping you grow your knowledge of critical administration skills for Red Hat Enterprise Linux. Whether you are new to Linux or new to RHEL, join us for a hands-on look at commands, processes, and tools.%

u/Gangrif — 1 month ago
▲ 42 r/redhat

Linux Virtual Machine Tips &amp; Tricks — Automating deployments, templating, and reproducibility on Linux from Into the Terminal Ep. 193

Ever find yourself wasting time manually spinning up virtual machines for your home lab, only to spend 10 more minutes updating them right after deployment? In this episode of Into the Terminal, we walk through tools and tips to streamline and automate virtual Linux machine deployments on Linux. Watch the full episode here or test your skills in the interactive labs.

The Essentials

Building virtual machines doesn't have to be a manual chore. By combining a few utilities that come with libvirt (or the libguestfs-tools package), you can easily automate your lab infrastructure.

Command What it does
virt-install Provisions a new VM instance, setting parameters like memory, vCPUs, network, and the underlying disk
virt-customize Off-line tool to modify a virtual disk (inject files, set passwords, modify grub, etc.)
virt-sysprep Sanitizes a virtual machine image to prepare it for use as a new clean template
tuned-adm Manage TuneD profiles for kernel performance tuning based on workloads

Advanced Features

Building the Perfect Disk Template with virt-customize

Instead of installing every guest OS from scratch, using templates saves a significant amount of time. You can use tools like virt-customize to offline modify your disks before booting them up. In his deployment scripts, Nate uses it to create a standard baseline for his lab:

  • --root-password password:secret: To standardize the root password across new deployments.
  • Modify GRUB timeouts: E.g., increasing the default 0 timeout for easier troubleshooting.

Pro Tip: While virt-customize can do almost anything (inject SSH keys, timezone info, and run arbitrary commands), you might want to keep the disk level simple and let provisioning tools handle runtime specifics.

Provisioning the VM with virt-install and cloud-init

Once the disk is ready, virt-install instantiates the VM. Nate walks through a few critical flags in his script that make automation seamless:

  • --import: This is a vital flag when working with a template. It tells virt-install the disk already has data on it and not to expect an empty drive with a PXE boot or ISO file.
  • --autoconsole none: Ensures you aren't immediately trapped in a terminal-based console right as the script runs, allowing you to gracefully check on it later using the Cockpit web console.
  • --cloud-init: Nate passes a cloud-init file to automatically inject his personal user, SSH keys, and sudo access during boot. You could do this at the disk level, but grouping user-specifics in cloud-init separates the user data from the base template cleanly!

Kernel Tuning with tuned-adm

Scott breaks down the tuned daemon, which dynamically updates the running kernel (by making live changes to /proc and /sys without requiring a reboot).

  • Run tuned-adm active to check your current performance profile, or tuned-adm list to see available options.
  • When tuned detects that RHEL is running as a virtual machine (via BIOS info), it automatically assigns the virtual-guest profile.
  • This profile is based on the throughput-performance profile. It increases the writeback percentage (so the VM caches more disk writes before syncing back to the hypervisor) and lowers swappiness (making the system less interested in using swap space), keeping your VM running smoothly.

Maintaining Fresh Templates with Image Builder

The problem with templates is they age quickly. Deploying an old template (e.g., RHEL 10.0) means you'll have a massive stack of updates waiting for you upon boot. Instead of updating old VMs manually and running virt-sysprep to make a new template, Nate recommends utilizing the Red Hat Hybrid Cloud Console and Image Builder to create a brand new, fully updated disk image.

With Image Builder, you can define a custom blueprint, inject necessary packages (like tmux and vim-enhanced), define custom partition tables, and download a slim, fully up-to-date .qcow2 image (often just ~1.1GB for a basic install). Simply place the new image in /var/lib/libvirt/images/ and update your scripts to use it!

Quick Reference Card

# 1. Clone a base image
cd /var/lib/libvirt/images/
cp ~gangrif/rhel-10.2.qcow2 ./cloneme-10.qcow2
chown root:root ./cloneme-10.qcow2

# 2. Customize the disk offline
virt-customize -a ./cloneme-10.qcow2 --root-password password:secret

# 3. Provision the VM using the customized disk and cloud-init
virt-install --name my-new-vm --memory 2048 --vcpus 2 \
  --disk ./cloneme-10.qcow2 \
  --import --os-variant rhel9.0 \
  --autoconsole none \
  --cloud-init user-data=/path/to/cloud-init.yaml

# 4. Check Tuned Performance Profile
tuned-adm active

Links & Resources


Into the Terminal is a show dedicated to helping you grow your knowledge of critical administration skills for Red Hat Enterprise Linux. Whether you are new to Linux or new to RHEL, join us for a hands-on look at commands, processes, and tools.

reddit.com
u/Gangrif — 2 months ago
▲ 5 r/redhat

Managing a CVE Response for Linux | Into the Terminal Ep. 192

Applying an update with dnf is the easy part. But what happens before and after you run that command? This week on Into the Terminal, Scott dives into the full lifecycle of a Critical Vulnerability and Exposure (CVE) mitigation. From discovery and embargo periods to CVSS scores, assessment, and fleet-wide rollout strategies, we cover what it really takes to manage security vulnerabilities on Enterprise Linux.

Watch the full episode: https://youtube.com/live/WHcgvoszf-M

Try it yourself on a live lab: https://redhat.com/interactive-labs


The Mechanical Part — Applying the Update

At the end of the day, mitigating a CVE usually involves updating a package. For example, if a vulnerability is announced for buildah, the mechanical fix is straightforward:

dnf update buildah

However, depending on the package, you may need to take additional steps:

  • Standalone binaries (like buildah): The next time the command is run, the updated version is used.
  • Services (like httpd): You must restart the service to load the patched version into memory.
  • Core components (like the Kernel or glibc): A full system reboot is required.

Understanding CVEs, CVSS Scores, and RHSAs

When a vulnerability is discovered, it goes through a lifecycle before you ever run dnf update.

The Embargo Period

When a security researcher finds a vulnerability, they typically report it to the vendor first. The time between this private report and the public disclosure is the embargo period. This gives vendors like Red Hat time to assess the issue, develop a patch, and have it ready for customers the moment the vulnerability is made public.

CVSS Scores and Severity

Vulnerabilities are scored using the Common Vulnerability Scoring System (CVSS), which rates them from 0 to 10 based on factors like ease of exploit and potential impact (e.g., gaining root access vs. reading a restricted file).

These scores translate to severity levels:

  • Low
  • Moderate
  • Important
  • Critical

Note: Red Hat often provides a Vendor-Adjusted CVSS Score. Because Enterprise Linux is compiled with specific security flags and architectures, a vulnerability that is a 9.0 on a generic Linux system might only be a 7.5 on RHEL due to built-in mitigations.

Red Hat Security Advisories (RHSA)

When a patch is ready, Red Hat issues an RHSA. This document details:

  • The CVEs addressed
  • The specific products and versions affected
  • The exact updated package versions required to mitigate the issue

The Mitigation Process — Fleet-Wide Response

When a major vulnerability hits the news (like Dirty Pipe or Copyfail), your security team will immediately ask: "What is our exposure?"

  1. Discovery: Identify which systems are running the vulnerable software. You can do this manually via Ansible/SSH, or automatically using tools like Red Hat Satellite (formerly Insights), which tracks the packages installed across your registered fleet and highlights vulnerable hosts.
  2. Assessment: Determine if the vulnerable software is actually exposed in your environment (e.g., is the vulnerable service running and accessible?).
  3. Planning: Formulate a rollout plan. For critical infrastructure, this might involve taking nodes out of a load balancer, updating and restarting services, and putting them back into rotation to ensure zero downtime.
  4. Application: Run the updates and verify the remediation.

Quick Reference Card

# Update a specific package to mitigate a CVE
dnf update &lt;package_name&gt;

# Example: Updating buildah
dnf update buildah

# Remember to restart affected services!
systemctl restart &lt;service_name&gt;

Links


Into the Terminal is a weekly livestream covering critical administration skills for Red Hat Enterprise Linux. Whether you're new to Linux or new to RHEL, join us for hands-on looks at commands and processes, ask questions, and grow your knowledge.

reddit.com
u/Gangrif — 2 months ago

Replacement for Google nest hub

I'd love to slowly replace all of the Google home/nest devices in my house with HA Voice.

One of those is the nest hub with the screen. It does info displays but mostly it's a nice integrated photo frame.

Has anyone built something similar using HA Voice as the back end for voice commands?

reddit.com
u/Gangrif — 2 months ago
▲ 37 r/redhat

When Updates Go So, So Wrong — Diagnosing DNF Dependency Errors, Reinstalling Lost Files, and Cleaning Up Package Artifacts | Into the Terminal Ep. 191

Even with robust tools like RPM and DNF, RHEL updates can occasionally go sideways. Dependency conflicts, interrupted transactions, lingering configuration artifacts, broken scriptlets — these things happen, and knowing how to diagnose and fix them is what separates a frustrating afternoon from a 5-minute fix. This past week on Into the Terminal, we walked through the most common ways package management goes wrong and how to get yourself out of it.

Watch the full episode: https://www.youtube.com/watch?v=5DhSoCQ-S6k

Try it yourself on a live lab: https://redhat.com/interactive-labs


Dependency Errors — The Most Common Problem

"Nothing provides [package]..."

This is probably the most frequent error you'll hit. You try to install a package and DNF says it can't find a required library or dependency in any of your configured repositories.

What it means: The package you're installing needs something that none of your repos provide. This happens a lot with:

  • Custom or cloned repositories that are incomplete
  • Third-party repos that aren't as rigorously maintained
  • Systems registered to a Satellite where the admin hasn't synced the latest content

How to investigate:

Command What it does
dnf whatprovides &lt;library&gt; Search your repos for which package provides a specific file
dnf list &lt;package&gt; Check if a package is available in your configured repos
ls /etc/yum.repos.d/ See which repository configuration files are on your system

How to fix it: You need to get the missing dependency into one of your repositories. Either:

  • Enable the right repo (e.g., EPEL) that provides the dependency
  • Talk to your Satellite/repo admin to sync the missing content
  • If you manage your own repos, sync the missing package from the upstream source

Enabling EPEL to Resolve Dependencies

In the episode, we showed that once we enabled the EPEL repository, all the missing dependencies became available:

# Install EPEL on RHEL (two commands from the EPEL website)
# 1. Enable the CRB repo that EPEL depends on
dnf config-manager --set-enabled crb

# 2. Install the EPEL release package
dnf install epel-release

After that, the same dnf install that failed now finds everything it needs.

RPM Dependency Hell — A Brief History Lesson

In the old days before DNF (and YUM before it), if you downloaded an RPM and tried to install it, you had to manually find every dependency, then every dependency of those dependencies, and so on. This was called RPM dependency hell and you could spend hours on it. DNF solves this by automatically resolving dependencies from your configured repos — but only if those repos actually have the packages.


What About --skip-broken?

When a package transaction fails, DNF always suggests --skip-broken or --nobest. Our strong recommendation: almost never use these.

  • --skip-broken will skip the package that can't be installed and complete the rest of the transaction
  • You end up with a partially completed transaction and a system that's likely missing something it needs
  • It's DNF's job to get to a successful transaction, so it suggests these as a path to "success" — but it doesn't understand your intent

There are edge cases where it makes sense, but in 99% of situations, you're better off figuring out why the dependency is broken and fixing the root cause.


Protected Packages — When DNF Won't Let You Remove Something

dnf remove bash

Try it. DNF will refuse because bash is a dependency of dnf itself, and DNF is a protected package. This protection was added to prevent you from accidentally bricking your system by removing something critical.

In the old days, YUM would happily remove bash and all its dependents, leaving you with no shell and no way to recover without booting from rescue media.


Reinstalling Packages to Recover Lost Files

This is a really useful trick. Say your httpd binary goes missing — maybe it got deleted, moved, corrupted during a disk error, or an interrupted install left things incomplete.

The Workflow We Demonstrated

1. The service won't start:

systemctl start httpd
# fails

2. Check the logs:

journalctl -xeu httpd
# "Failed at step EXEC spawning /usr/sbin/httpd: No such file or directory"

3. Try a reinstall:

dnf reinstall httpd

4. But it still doesn't work! The binary /usr/sbin/httpd isn't provided by the httpd package — it comes from httpd-core.

5. Find out which package actually provides the file:

dnf provides /usr/sbin/httpd
# Returns: httpd-core

6. Reinstall the right package:

dnf reinstall httpd-core
systemctl start httpd
# works!

Key Commands for Package Investigation

Command What it does
dnf reinstall &lt;package&gt; Re-download and reinstall a package without removing config files
dnf provides &lt;file&gt; Find which package provides a specific file (works even if it's not installed)
dnf info &lt;package&gt; Show detailed info including version, repo, and description
dnf list installed *httpd* List all installed packages matching a pattern
rpm -ql &lt;package&gt; List all files provided by an installed package

Tip from the show: dnf provides reads the repository metadata, not just what's installed locally. So you can use it on a system that doesn't have the file to figure out what package would give it to you.

Version note: When you dnf reinstall without specifying a version, it grabs the latest available. If you want to reinstall the exact version you had, use dnf info &lt;package&gt; to check what's installed vs. what's available, and specify the version explicitly.


Package Artifacts — The Stuff That Gets Left Behind

When you uninstall a package, DNF removes everything listed in the package manifest. But applications often create files at runtime — config files in your home directory, temp files, cache data — that the packager can't account for because they don't exist until you actually run the software.

Example from the show: We installed a simple "hello world" package called bello that dropped a .bello-config file in the user's home directory when run. After dnf remove bello, the config file persisted because:

  • The package manifest only knows about files it shipped, not files created at runtime
  • The packager can't predict your username or home directory path
  • This is exactly how things like browser caches, application settings, and per-user configs work

Takeaway: After removing software, check for leftover files in places like:

  • ~/.config/, ~/.local/, ~/.&lt;appname&gt;
  • /tmp/, /var/tmp/
  • /var/lib/&lt;appname&gt;, /var/log/&lt;appname&gt;

Scriptlet Errors — The Warnings You Shouldn't Ignore

RPM packages can include scripts that run at different stages: pre-install, post-install, pre-uninstall, post-uninstall. When these scripts fail, DNF reports it — but the transaction itself might still "succeed."

What we showed: A package called pello that had a typo in its post-uninstall scriptlet. The package was removed successfully, but the cleanup script failed, leaving a service user account on the system.

How to Inspect Package Scripts

Command What it does
rpm -q --scripts &lt;package&gt; Show all scriptlets for an installed package
rpm -qp --scripts &lt;package.rpm&gt; Show scriptlets from an RPM file (not installed)
dnf repoquery --scripts &lt;package&gt; Show scriptlets from a package in a repo

Script Stages

Stage When it runs
%pre Before files are placed on the system
%post After files are placed on the system
%preun Before files are removed from the system
%postun After files are removed from the system

Security note from the show: Package scripts run as root because only root can install software. This means package scripts can do anything — add users, modify system files, run arbitrary commands. This is another reason to be careful about where your packages come from and to verify GPG signatures.


DNF History — Undo Package Transactions

DNF tracks every transaction you perform. You can view and undo them.

Command What it does
dnf history List all past transactions with ID numbers
dnf history undo &lt;ID&gt; Reverse a specific transaction (install becomes remove, upgrade becomes downgrade)
dnf history info &lt;ID&gt; Show details of a specific transaction

How undo works:

  • If the transaction was an install, undo does a remove
  • If it was an upgrade, undo does a downgrade
  • If it was a remove, undo does a reinstall

Caveat: You can cherry-pick any transaction ID to undo, not just the most recent. But the further back you go, the more chance for weirdness — especially with packages that have been updated multiple times since that transaction.

Kernel warning: Be careful undoing kernel transactions. By default, RHEL keeps 2 previous kernels. If you undo a kernel install, make sure you're not removing the one you're currently booted into, and remember the bootloader may need attention.


GPG Key Verification — Know Where Your Packages Come From

Every package from Red Hat is signed with a GPG key. This ensures the package hasn't been tampered with since it was built.

Command What it does
rpm -Kv &lt;package.rpm&gt; Verify GPG signature and digests on a package file
rpm -qa gpg-pubkey* List all imported GPG keys on the system
rpm -qi &lt;gpg-pubkey-package&gt; Show details about who owns a specific GPG key

In your repo config files (/etc/yum.repos.d/), the gpgcheck=1 line tells DNF to verify every package against the GPG key before installing. If a package isn't signed or is signed with an unknown key, the transaction will fail — and that's by design.

From the show: The custom demo packages we built weren't GPG signed. Running rpm -Kv showed "digests OK" but no signatures — meaning the file wasn't corrupted, but there's no proof of who made it.


Third-Party Repos — Proceed with Caution

A few guidelines from the discussion:

  • EPEL (Extra Packages for Enterprise Linux) will never replace packages provided by your base OS — it only adds new ones
  • RPM Fusion and other third-party repos may replace base OS packages, which means you're now managing that dependency chain yourself
  • Don't grab random RPMs from the internet (rpmfind.net, Fedora repos, other distros) to fill dependency gaps — you're creating chaos that will bite you on the next update
  • In regulated industries, you may be required to validate your software supply chain. Mixing in unverified sources could be a compliance violation

Quick Reference Card

DIAGNOSING                          FIXING
dnf whatprovides &lt;file&gt;             dnf reinstall &lt;package&gt;
dnf provides &lt;file&gt;                 dnf history undo &lt;ID&gt;
dnf info &lt;package&gt;                  dnf install --enablerepo=epel &lt;pkg&gt;
dnf list installed *pattern*
dnf history                         INSPECTING
rpm -ql &lt;package&gt;                   rpm -q --scripts &lt;package&gt;
rpm -Kv &lt;package.rpm&gt;               rpm -qp --scripts &lt;file.rpm&gt;
rpm -qa gpg-pubkey*                 dnf repoquery --scripts &lt;package&gt;
journalctl -xeu &lt;service&gt;           rpm -qi &lt;gpg-pubkey-package&gt;

Links


Into the Terminal is a weekly livestream covering critical administration skills for Red Hat Enterprise Linux. Whether you're new to Linux or new to RHEL, join us for hands-on looks at commands and processes, ask questions, and grow your knowledge.

u/Gangrif — 3 months ago
▲ 48 r/redhat

How Much Vim Can You Stand? — A Vim Command Compendium from Into the Terminal Ep. 190

Two weeks ago on Into the Terminal, we went deep on vim — from the essential commands every sysadmin needs, to multipliers, macros, visual blocks, and customizing your .vimrc. Whether you're brand new to vim or you've been using it for years and just never learned beyond :wq, this one's for you.

Watch the full episode: https://youtube.com/live/UfzjXbLVwwo

Try it yourself on a live lab: https://redhat.com/interactive-labs

The Essential ~15 Commands

You can be minimally proficient in vim with about 13–15 commands. Everyone's list is a little different — here's what our two hosts use, and where they differ.

Getting In and Out of Insert Mode

Command What it does
i Enter insert mode at the cursor
I Enter insert mode at the beginning of the line (great for adding # to comment a line out)
a Enter insert mode after the cursor (append)
Esc Exit insert mode and return to normal/command mode

Moving Around

Command What it does
Arrow keys Move around (works in vim improved)
h j k l Classic movement — left, down, up, right (required on older vi implementations where arrow keys don't work)
w / b Jump forward/backward by word boundary
W / B Jump forward/backward by whitespace-delimited word (bigger jumps)
G Go to the end of the file
20G Go to line 20
:20 Also go to line 20 (command-line style)
:$ Go to the last line of the file
$ Move to end of the current line
^ Move to beginning of the current line

Pro tip from the show: You can also open a file at a specific line number from the shell:

vim +20 myfile.conf

Handy when your compiler tells you there's a syntax error on line 20.

Deleting / Cutting

Command What it does
dd Delete (cut) the entire current line
D Delete from cursor to end of line
d + arrow Delete one character in the arrow direction
d$ Delete from cursor to end of line (same as D)
d^ Delete from cursor to beginning of line
x Delete the character under the cursor

Copy (Yank) and Paste

Command What it does
yy Yank (copy) the current line
p Paste below the current line
dd then p Cut a line and paste it somewhere else — this is how you move lines

Note: dd puts the deleted line into a buffer, so it doubles as "cut." This terminology predates the modern "copy/paste" — back when vi was created, the terms were yank (copy) and delete (cut).

Undo

Command What it does
u Undo the last change. Keep pressing to walk back through your history.

In vim improved, u walks back through your full edit history. In classic vi, it only undoes the last command. Also note: undo history is per-session — if you quit and reopen the file, the history is gone.

Save and Quit

Command What it does
:w Write (save) the file
:q Quit
:wq Write and quit
:q! Quit without saving (force quit)
:w! Force write (only works with elevated permissions like root — lets you override file permissions)

Note: :w! won't help on a read-only filesystem. That's enforced at the filesystem level, not the permission level.

Advanced Features

Multipliers — Do Anything N Times

Prefix any command with a number to repeat it.

Example What it does
5dd Delete 5 lines (and put them all in the cut buffer)
500p Paste 500 copies of whatever is in your buffer
30j Move down 30 lines
100@t Execute macro t 100 times
5000dd Delete 5000 lines, handy for deleting the rest of a file. (if <5000 lines remain, it just stops at the bottom)

Line Anchors — ^ and $ in Combination

The ^ (beginning) and $ (end) characters aren't just for movement. You can combine them with other commands:

Example What it does
d$ Delete from cursor to end of line
d^ Delete from cursor to beginning of line
:1,$s/old/new/g Search and replace from line 1 to the end of the file
:$ Jump to the last line of the file

By learning just ^ and $ as anchors, you get multiple delete behaviors without memorizing separate commands for each.

Search

Command What it does
/searchterm Search forward for "searchterm"
/ + Enter Repeat last search forward
?searchterm Search backward for "searchterm"

Search and Replace (Substitution)

Command What it does
:s/old/new/ Replace first occurrence of "old" with "new" on the current line
:s/old/new/g Replace all occurrences on the current line
:%s/old/new/g Replace all occurrences in the entire file
:1,$s/old/new/g Same as above, using line anchors (line 1 to end)
:10,20s/old/new/g Replace only between lines 10 and 20 — great for targeting a single function or block

Reading Files and Command Output Into Your Buffer

Command What it does
:r filename Read the contents of filename and insert it below the cursor
:r /var/log/messages Works with full paths too
:r !df -hp Run df -hp and insert its output directly into your file
:!command Run an external command and see the output (press Enter to return to vim)

The :r !command trick is a time-saver — no need to run a command, redirect to a file, then :r that file.

Security note: :! lets you run any shell command. If someone has sudo access to run vim as root, they can shell out from vim with full root privileges. Use the NOEXEC option in sudoers to prevent forking from within escalated sessions.

Saving to a Different File

Command What it does
:w /path/to/newfile Save the current buffer to a new file (the original stays untouched)

Great for making a backup before committing changes, or for cleaning up data and writing the result to a new file while preserving the original.

Visual Block Mode — Comment Out Code in Bulk

  1. Press Ctrl+V to enter visual block mode
  2. Use arrow keys (or j/k) to select the lines you want
  3. Press I (capital I) to insert at the beginning of the block
  4. Type your comment character (e.g., #)
  5. Press Esc — the character appears on all selected lines

This is how you comment out a block of code in seconds. Works great for Python, shell scripts, config files — anything with a line-based comment character.

Pasting Pre-formatted Code Without Mangling

Vim's auto-indent is great when you're writing code, but it wrecks pre-formatted code that you paste in from your clipboard.

Command What it does
:set paste Enter paste mode — disables auto-indent so pasted code keeps its formatting
:set nopaste Return to normal mode with auto-indent re-enabled

When paste mode is on, you'll see -- INSERT (paste) -- at the bottom. This is much easier than the alternative of typing :set noautoindent nosmartindent nocindent.

Macros (Named Buffers) — Record and Replay Commands

  1. q + a letter (e.g., qt) — start recording to buffer t
  2. Perform your commands (move, delete, edit, etc.)
  3. q — stop recording
  4. @t — execute the macro stored in t
  5. @@ — re-execute the last macro
  6. 100@t — execute macro t 100 times (multipliers work here too)

Use :reg to view all your named buffers and see exactly what commands are stored in each one.

Example from the show: We had a CSV file with 114 lines that needed the same edit on every line. Instead of doing it by hand, we recorded a macro that moved down a line, repositioned the cursor, deleted the unwanted data, and then replayed it across the entire file with 100@t. Seconds instead of minutes.

Customizing Your Session (and Your .vimrc)

All of these can be run as one-off commands with :set, or persisted by adding them to your ~/.vimrc file.

Setting What it does
:set tabstop=N Set tab width to N spaces (default is 4)
:set expandtab Insert spaces instead of a literal tab character
:set hlsearch (or hls) Highlight all search matches
:set nohlsearch Turn off search highlighting
:noh Clear the current highlight without turning the feature off
:syntax on / :syntax off Toggle syntax highlighting (note: no set prefix — syntax is its own command)
:set cursorcolumn (or cuc) Highlight the column you're in — a lifesaver for YAML and Python
:set number / :set nonumber Show/hide line numbers
:set showmode / :set noshowmode Show/hide the mode indicator (INSERT, VISUAL, etc.) at the bottom
:set showcmd / :set noshowcmd Show/hide partially-typed commands at the bottom
:set paste / :set nopaste Toggle paste mode (see above)
:set View all currently active settings

RHCE exam tip from the show: When you sit down to take the exam, put :set cuc and :set number in your .vimrc first. The cursor column highlighting will save you when editing Ansible playbooks and YAML files.

The Pattern for Set Commands

  • Turn something on: :set feature
  • Turn something off: :set nofeature
  • Some settings use = syntax: :set tabstop=4
  • Some commands like syntax don't use set at all: :syntax on

Quick Reference Card

GETTING AROUND           EDITING                    SAVE/QUIT
i    insert mode         dd   delete line           :w   save
I    insert at line start D    delete to end of line :q   quit
a    append after cursor  d^   delete to line start  :wq  save &amp; quit
Esc  back to normal      yy   copy line             :q!  quit no save
/    search forward      p    paste                 :w!  force save
?    search backward     u    undo
G    end of file         x    delete character
:20  go to line 20

POWER MOVES              SETTINGS (in :set or .vimrc)
5dd    delete 5 lines    tabstop=N     tab width
Ctrl+V visual block      expandtab     spaces not tabs
qt...q record macro t    hlsearch      highlight matches
u/t     play macro t      cursorcolumn  column highlight
100@t  play macro 100x   number        line numbers
:%s/a/b/g  replace all   paste         paste mode
:r !cmd    read cmd output syntax on   syntax highlighting

Links

Into the Terminal is a weekly livestream covering critical administration skills for Red Hat Enterprise Linux. Whether you're new to Linux or new to RHEL, join us for hands-on looks at commands and processes, ask questions, and grow your knowledge.

reddit.com
u/Gangrif — 3 months ago
▲ 2 r/seerr

Trouble tracking a series, unsure how to troubleshoot.

Hello,

I have a seerr deployment, with, of course, radarr/sonarr behind it. Works wonderfully, movies or series that i ask it to track, get found and show up like magic.

But, i have one series im trying to grab, that it just doesnt seem to like.

"The Vampire Lestat", If i search for it from the overview, it finds the series, but then when i try to request it, seer comes up and says its unable to automatically match the series, even though it showed it in my search results. And it gives me 6 cards for other series with similar names. None of them are the correct series. But if i go download the show manually, and throw it into my media server, Seerr happily shows me the episodes that I have, and the ones that are missing.

I'm just not sure where to go with this, sure i can manually download them, but i'd much rather let seerr/sonarr do their job.

Any suggestions?

reddit.com
u/Gangrif — 3 months ago

Android Auto...

I switched! Last night I finally got my cellular service moved over to my new Pixel 9 pro running grapheneOS. From Iphone.

One thing I wasnt able to thoroughly test until I switched, is android auto. I followed the instructions to get the modified android auto app installed from the Graphene app store. Set it up to use a usb connection rather than wireless. Today I got to try it, and it works!

I have a few questions though.

First, voice. I did not, and do not want to, install google's assistant. I think that should feel obvious. However, one of the benefits of Android Auto or Apple Carplay is its ability to let me hands-free interact with the media on my device. Or even just read a text message. Without a voice assistant installed, it seems that this is not possible.

Second is Maps. I also didnt install google maps. I found two alternatives, that seem like theyll work well, and they work with android auto. But when i enable turn by turn directions, they speak, but... its like they're reading out an API call rather than the actual directions. I wonder if this is because the app is supposed to be sending something like a call to the google voice assistant, but instead its doing its best to speak them because there isnt one.

So my qustions are two. First, is there an alternative voice assistant folks like? Could the google assistant be used without it being a privacy nightmare? And second, is my read of the weird text im getting from turn by turn directions, does it stand to reason that adding a voice assistant would fix that?

Thanks!

reddit.com
u/Gangrif — 4 months ago

Finally switching. What smart watches are you all using?

Man. It feels like im coming home. I was a long time android user, switched to iPhone a few years ago because I was sick of googles free spying.

I was never really happy with apple. But i felt like android just wasn't an option. But it seems graphene has matured enough that its absolutely a viable daily now!

So, the actual question. I have an apple watch. Mainly for the health monitoring. I use it for workout tracking, sleep tracking, and importantly heart monitoring. I won't go into details but I'll say that the ability to record a ECG on the fly is important to me.

The pixel watch does this from what I'm reading. So does Garmin. Are there others?

Is running a pixel watch just giving google a window back into my life? Are they as cavalier with health data as they are with other data?

Thanks for any input.

reddit.com
u/Gangrif — 4 months ago

Audiobooks in Jellyfin. Android clients?

I am in the process of moving from Plex, to Jellyfin. Its going pretty dang good. I have one thing thats not perfect yet.

Audiobooks.

In plex I used a plex audiobook library, with the Prologue app on iPhone, and it worked really damn well. On Jellyfin I found that it supports audiobook libraries, and on iPhone i found the Plappa app, which works really damn well (practically identical to Prologue).

But I have to throw a wrench into things. I am also on a bit of a digital self relience/rights journey, and decided to switch back to Android, on Graphene (because I am sick of feeling like the device in my pocket isnt actually built for me, but for companies to gather data on and profit from me). So I would love an app that works like Plappa for Android.

I know i know, everyones going to recommend audiobookshelf. I'm not opposed to it, but i feel like im so close here, and would really rather not manage yet another app.

Thanks!

reddit.com
u/Gangrif — 4 months ago

Openclaw, locally, local llm, local hardware.

Hello there folks,

I am experimenting with Local LLM's, on a Framework Desktop, Ryzen AI 128gb model.

Ive got litellm, and ollama running, with a few different models.

This week I decided to see what I could do locally with OpenClaw, and its not going well.

I keep running into issues with speed, and the chat's sort of losing the thread, i think because of context sizes.

Some troubleshooting with Claude (chatting with claude, not using openclaw with claude) makes me think that this just isnt possible, because Openclaw sends a massive prompt to the llm for each task, and its just taking my local deployment forever to deal with it, and its losing things like, what tools it has at hand.

Anyone else doing this?

I'm using qwen2.5:32b-instruct for my model, let me know if you need more info.

Thanks.

reddit.com
u/Gangrif — 5 months ago

Out Law Audible Exclusive?

So, for reasons that have to do with ideology i've left Audible behind, and now buy all of my audio books through Libro.fm. All of Jim's books are there! Win!

But out law isn't and as im reading more about why, it sounds like its an audible exclusive.

Im curious if anyone knows if thats a permanent thing? Or if I'll eventually be able to buy it elsewhere? It sounds like The Law was originally an Audible exclusvie too, and that's available on Libro.

Im considering just buying the dead tree edition, so I can read it, and then ill pick up the audio book later (i really love Marsters performances), If its ever available on anything except Audible.

Thanks!

reddit.com
u/Gangrif — 5 months ago
▲ 17 r/redhat

Information and mitigations for the recent kernel vulnerabilities

I'm not sure if this helps anyone. but i was working through the recent kernel vuln mitigations, validating them with claude, and decided to have it spit out a summary. here it is. There is some talk that the 4th on the list is not real. but i found my RHEL 10 system unaffected anyway. so. *shrug*

note: i've worked on a new post due to the feedback below. that is what you now find here. I also want to note that these are not official from Red Hat. Regardless of my affiliation with Red Hat, these were me trying to protect my own systems, I'll add in RHSA's as theyre available.

New updates, May 9th.

Linux Kernel LPE Roundup — May 9, 2026

Four local privilege escalation vulnerabilities are actively circulating, three in the same bug class (page-cache writes). Here's what you need to know:

1. Copy Fail (CVE-2026-31431)

https://access.redhat.com/security/cve/cve-2026-31431

Original page-cache write via algif_aead in the crypto subsystem. Patched upstream, distro patches available.

Mitigation: Apply your distro's kernel update, or prevent the module from loading:

echo 'install algif_aead /bin/false' &gt; /etc/modprobe.d/copyfail.conf

Impact of disabling algif_aead: None for most systems. This module exposes the kernel's AEAD crypto interface to userspace via AF_ALG sockets. It is not used by dm-crypt/LUKS, kTLS, IPsec, OpenSSL, GnuTLS, NSS, or SSH. Only applications explicitly configured to use the kernel's afalg engine are affected.

https://copy.fail/

2. Dirty Frag (CVE-2026-43284, CVE-2026-43500)

https://access.redhat.com/security/cve/cve-2026-43284

https://access.redhat.com/security/vulnerabilities/RHSB-2026-003

Chains two separate bugs — xfrm-ESP page-cache write (CVE-2026-43284) and RxRPC page-cache write (CVE-2026-43500) — for a universal unprivileged LPE across all major distros. Published after a third party broke the embargo. Distro patches are beginning to land (AlmaLinux has shipped, others in progress).

The separately published "Copy Fail 2: Electric Boogaloo" exploit hits the same esp4/esp6 code paths and is covered by CVE-2026-43284 — there is no separate CVE for it.

Mitigation: Apply your distro's kernel update, or prevent the modules from loading:

printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' &gt; /etc/modprobe.d/dirtyfrag.conf

Then unload them if currently loaded:

rmmod esp4 esp6 rxrpc 2&gt;/dev/null

Impact of disabling esp4/esp6: These are the kernel-side ESP transforms used by IPsec. Disabling them will break IPsec tunnels (strongSwan, Libreswan, etc.). Do not apply this mitigation on hosts that terminate or transit IPsec VPN tunnels. If you're not running IPsec, these modules are safe to block.

Impact of disabling rxrpc: This is the AF_RXRPC transport used almost exclusively by AFS (Andrew File System) clients. Most distributions don't even ship the module. Unless you're running AFS, blocking it has no effect.

https://github.com/V4bel/dirtyfrag/ https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo

3. io_uring ZCRX Freelist LPE (no CVE yet)

Out-of-bounds write in io_uring's zero-copy receive freelist. Different bug class from the page-cache writes above. Narrower scope — requires kernel 6.15+, CONFIG_IO_URING_ZCRX=y, a supported NIC (mlx5/ice/nfp), and CAP_NET_ADMIN. Fix committed upstream (770594e) but not in stable branches yet.

Mitigation: Check if you're affected:

grep CONFIG_IO_URING_ZCRX /lib/modules/$(uname -r)/config

No output or "is not set" means you're not vulnerable. Most current distro kernels do not have this subsystem enabled.

https://ze3tar.github.io/post-zcrx.html

Notes

If any of these modules are built into your kernel (=y rather than =m), the modprobe approach won't work — you'll need initcall_blacklist= on the kernel command line instead. Check with:

grep -E 'CONFIG_INET_ESP=|CONFIG_INET6_ESP=|CONFIG_AF_RXRPC=|CONFIG_CRYPTO_USER_API_AEAD=' /lib/modules/$(uname -r)/config

For bootc/image-based systems (Bazzite, RHEL image mode, etc.), bake the modprobe.d conf files into your Containerfile and rebuild rather than relying on runtime changes.Linux Kernel LPE Roundup — May 9, 2026
Four local privilege escalation vulnerabilities are actively circulating, three in the same bug class (page-cache writes). Here's what you need to know:

u/Gangrif — 5 months ago
▲ 19 r/redhat

Bash has a lot of shortcuts, a lot of them aren’t obvious, but you pick them up over the years. Watch Scott and Nate share their favorite command line tricks and shortcuts on this episode of Into the Terminal.

youtube.com
u/Gangrif — 6 months ago