Networking on Lead DevOps

scp — Secure Copy Over SSH

Fri, 18 Sep 2026 00:00:00 +0000

scp — a utility for copying files over SSH using the SSH protocol. It works from the terminal, requires no extra server setup — just a running sshd and working authentication. In an era of rsync and bat, SCP survives as a simple tool for one-off transfers when you don’t want to deal with daemons or configuration files.

Syntax and Basic Scenarios

General form:

scp [flags] source destination

Source and destination can be local paths or remote addresses in the format user@host:path.

nftables: Basic Rule Set

Thu, 17 Sep 2026 00:00:00 +0000

Note

All commands were verified on Debian/Ubuntu with the nftables package and on RHEL/CentOS 8+. On older systems you may need apt install nftables or yum install nftables.

nftables replaced iptables, but documentation for a basic rule set is often scattered. Here is the reference I use when bringing up a firewall on a new host.

Creating the inet filter table

The inet family table unifies IPv4 and IPv6 under a single namespace. This is the preferred approach when both stacks are active on the host.

Setting Up Your Own SSH Bastion Server

Tue, 08 Sep 2026 00:00:00 +0000

Why You Need a Bastion and Where It Lives

A bastion is the single entry point into a private network segment. Instead of exposing SSH on every server to the internet, you funnel traffic through one hardened host with a strict access policy. Typical layout: internet → bastion (public IP) → internal servers (only private subnet, SSH listening on 127.0.0.1 or a private interface).

The bastion sits in a demilitarized zone (DMZ) or a public subnet provided by your hosting platform. Internal machines have no route to the internet through the bastion — return traffic flows only over established connections. This is a baseline model you can deploy on any VPS in about 15 minutes.

ProxyJump and bastion hosts via ~/.ssh/config

Sun, 06 Sep 2026 00:00:00 +0000

Sometimes a server sits in a private network with no public IP. The only entry point is a bastion host with a public address. Typing ssh -J user@bastion user@private every time gets old fast. Here’s how to configure everything in ~/.ssh/config so you can reach private networks in one command.

Why you need a bastion host

A bastion (jump host, jump box) is an intermediate server with public access that proxies connections to infrastructure without external IPs. The typical topology:

nftables: Modern Linux Firewall

Fri, 04 Sep 2026 00:00:00 +0000

Warning

Before changing nftables, make sure you have physical or console access to the server. A misconfigured input chain can block SSH and lock you out.

nftables replaced iptables in the Linux kernel starting with version 3.13. If you’re still writing rules in iptables style, it’s time to reconsider. nftables performs better, has built-in dual-stack IPv4/IPv6 support, and lets you manage the entire ruleset as a whole instead of entering commands one by one.

socat: Forwarding Unix Sockets Over TCP

Wed, 02 Sep 2026 00:00:00 +0000

Sometimes you need to reach a Unix socket from a host where that socket doesn’t physically exist. SSH tunnels won’t help — they only work with TCP ports. socat solves this: it opens a TCP listener and forwards connections to a Unix socket, and the client just connects over the network.

Installation

The package is available in every major distribution. On Debian/Ubuntu:

apt install socat

On RHEL/CentOS:

dig: DNS Query Debugging in CLI

Tue, 01 Sep 2026 00:00:00 +0000

DNS resolvers return the wrong address, clients don’t see updates, or it’s unclear which server is handling requests. dig (Domain Information Groper) is the standard CLI tool for DNS diagnostics. Works on Linux, macOS, and Windows via WSL.

Installation

# Debian/Ubuntu
apt install dnsutils

# RHEL/CentOS/Alma
dnf install bind-utils

# macOS — ships with the system
# Windows — via WSL or ISC official binaries

Basic Flags

dig has two classes of options: short flags (start with -) control query behavior, while keywords with + control output format.