linux-sysadminlisted
Install: claude install-skill kouroshez/coding-os
# Linux System Administration
A server is a contract with production: it stays up, it's reachable only how you intend, and when it misbehaves you can see why in one pass. This skill is host-level operation + hardening. Containers and pipelines belong to [deployment-cicd](../deployment-cicd/SKILL.md); the incident *process* to [incident-response](../incident-response/SKILL.md); this is the box itself.
> Triage a host in one compact report (disk, mem, load, failed units, ports):
> `bash scripts/triage.sh --json`
## SSH — the front door, hardened
```bash
# /etc/ssh/sshd_config.d/10-hardening.conf (drop-in, survives package upgrades)
PermitRootLogin no
PasswordAuthentication no # keys only — the single biggest win
PubkeyAuthentication yes
KbdInteractiveAuthentication no
MaxAuthTries 3
AllowUsers deploy # allow-list, not everyone
```
```bash
# Wrong — edits the main file, lost on upgrade, no syntax check before reload
vi /etc/ssh/sshd_config && systemctl restart sshd # locks you out if typo'd
# Correct — drop-in + validate + reload (keeps your current session alive)
sshd -t && systemctl reload sshd # -t aborts on bad config
```
Keys not passwords, root login off, an `AllowUsers` allow-list, `fail2ban` for brute-force. Never restart sshd before `sshd -t` passes — a typo + restart locks you out of a remote box. Full hardening → [references/ssh-hardening.md](references/ssh-hardening.md).
## systemd — services that resta