Services

Service

What a service is, how it differs from an ordinary program, and how to manage it.

journalctl — reading the systemd journal

Reading the systemd journal (journald) — filters by service, time, priority.

systemd

The init system and service manager (PID 1): units, targets, dependencies, journals.

systemctl — managing systemd services

The main interface to systemd. enable turns on autostart, start runs it now — these are different operations.

cloud-init — first-boot VM setup

Automatic setup of cloud/virtual machines on first boot — user-data, debugging.

nginx — web server and reverse proxy

nginx serves sites from disk and forwards requests to applications; it picks a site by Host, nginx -t checks the config.

sshd — the SSH server

The OpenSSH server; edit the config with a second session open — a mistake in PermitRootLogin locks you out immediately.

Cron — the task scheduler

Running tasks on a schedule: crontab syntax, classic cron and modern systemd timers.

Service hardening: User=, ProtectSystem, NoNewPrivileges

Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them.

systemd timers — scheduled jobs

A systemd timer is a .timer unit that starts the service of the same name on a schedule; its output goes to the journal.

AppArmor

Mandatory access control on Ubuntu — service profiles, enforce/complain modes.

PostgreSQL — access, pg_hba.conf, dump and restore

PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores.

Redis — in-memory key-value store

Cache, queues, and sessions in RAM; KEYS * blocks the server on large databases — use --scan instead.

unattended-upgrades: security updates with no one at the keyboard

Ubuntu's service that installs updates from allowed origins once a day on an apt timer; by default only security ones.

fail2ban

Log-based banning — protecting SSH and services from brute force; jails, status, unban.

Docker — containers: running, ports, volumes, networks

Docker runs programs in isolated containers started from images and manages their ports, volumes and networks.

docker compose — a container stack in one file

docker compose describes a container stack with network, volumes and variables in compose.yaml and starts it at once.

Ansible: inventory, modules and one-off commands

Configures servers over SSH: from an inventory and playbooks it brings machines to a described state, no agent needed.

ansible-playbook: running a playbook

Runs an Ansible playbook on the inventory machines and reports ok, changed, skipping or failed for each task.

timedatectl — time, time zone, and synchronization

Manages system time and NTP; set-time requires turning off set-ntp first, or the time reverts.

chrony: time synchronization over NTP

An NTP client and server: keeps the system clock in step with time servers and can serve time to your machines.

Prometheus — metrics collection

Collecting metrics with a pull model — targets, PromQL, exporters, alerts.

Grafana — dashboards

Visualizing metrics and logs — data sources, dashboards, variables, alerts.

hostnamectl — host name and machine info

View and change the host name and machine info; /etc/hostname and /etc/hosts.

Samba — file sharing over SMB

An SMB server for Windows-compatible shares; the SMB password is separate from the system one, easy to forget to set.

KVM and libvirt

Virtual machines on Linux — managed with virsh, networks, storage, console.

Postfix — a mail server

Sending and receiving mail — config, the queue, logs, typical delivery debugging.

BIND9 — DNS server

Running your own DNS — zones, records, config checks, resolving debug.

DHCP server

Handing out addresses on a network — pool, reservations, leases, diagnostics.

HAProxy — load balancer

Load balancing and proxying TCP/HTTP — backends, health checks, statistics.

keepalived — high availability with VRRP

High availability through a virtual IP — failover between nodes using VRRP.