Hands-on Linux notes from the command line — troubleshooting, filesystems, networking and server admin, written and tested across Debian, Ubuntu and macOS.
When a server won't start because the port is taken, you need the PID holding it. ss is the modern one-liner; lsof and fuser are the alternatives. Here's how to find the process and free the port.
Years ago I ran transcription through the Google Speech API. In 2026 you don't need a cloud API for that — whisper.cpp runs OpenAI's Whisper models locally on a laptop, CPU or GPU, with no keys and nothing leaving the machine. Here's the full path from clone to transcript.
63 DJI Phantom 4 Pro frames over Randers, two stitching pipelines. OpenCV's Stitcher is fast and hands-off but leaves a wavy horizon and ragged edges; Hugin + enblend is slower but gives a dead-straight horizon, seamless blend, and a clean rectangle. Hugin wins.
bchunk (binchunker) splits a .bin/.cue CD image into .iso for the data track and .wav files for each audio track. The canonical tool for turning a mixed-mode BIN/CUE into something you can mount or burn.
fcrackzip is a small, old, command-line tool that recovers passwords on classic-ZipCrypto-encrypted .zip files. Brute-force or dictionary, runs everywhere, still useful in 2026 — with hashcat/john as the modern follow-up when it isn't fast enough.
pdfcrack is a small, single-threaded CPU tool for recovering lost PDF user and owner passwords. Fine for 40-bit RC4 and small dictionary attacks; for 128/256-bit AES PDFs, migrate to pdf2john + hashcat on a GPU.
cups-pdf gives you a virtual printer that writes a PDF instead of printing to paper — available system-wide to every application, from the command line, and over the network from a headless box. Install it, restart CUPS, and your PDFs land in ~/PDF.
xmllint (part of libxml2, already on most systems) reformats ugly, minified, or single-line XML into something readable. Pipe an API response straight through it, control the indent width, and validate while you're at it.
Linux can't loop-mount a raw BIN/CUE pair the way it mounts an ISO. The simple fix is to convert the BIN/CUE to ISO with bchunk and mount the ISO; for mixed-mode or audio discs, cdemu emulates a real optical drive instead.
Passwordless sudo is convenient for automation and lab boxes — and a foot-gun if you do it carelessly. Here's the modern, safe way: a validated drop-in under /etc/sudoers.d, scoped as narrowly as you can get away with.
OpenSSL can decode a CSR so you can confirm the subject, SANs, and key size before sending it to a CA. Here's the one command to read it, plus how to verify a CSR matches the private key it was generated from.
OpenSSL reads X.509 certificates so you can check the subject, SANs, issuer, and expiry — and confirm a cert matches the private key it's paired with. Includes the s_client trick for inspecting what a live HTTPS server is really serving.
rarcrack is long abandoned. The 2026 way to recover a RAR/7z/ZIP password is to extract a hash with John the Ripper's rar2john/7z2john/zip2john, then run it through hashcat (GPU) or john. Dictionary first, then masks. Covers the right hashcat mode for each format.
Pipe mysqldump directly into a compressor so you never write the huge uncompressed .sql to disk. gzip is universal; zstd is the modern default (fast and small); xz squeezes hardest. Restore by piping the decompressor back into mysql.
Windows uses CRLF line endings, Unix uses LF — and the mismatch breaks shell scripts, configs, and diffs. dos2unix converts them in place; on Debian/Ubuntu it's now its own package (no more tofrodos). Includes a recursive batch and a sed fallback.
sshfs mounts a remote directory on your local machine over plain SSH — nothing to install or configure on the server. Mount it with your own uid/gid for write access, add reconnect options so it survives flaky links, and unmount with fusermount.
find -printf with sort gives you a newest-last list of every file in a tree; -mmin/-mtime filter by age. macOS's BSD find lacks -printf, so this covers the portable variants too. Handy for 'what just changed on this server?'
The old ALTER IGNORE TABLE … ADD UNIQUE trick was removed in MySQL 5.7. The portable way to dedupe now is a self-join DELETE keeping the lowest id; MySQL 8 / MariaDB 10.2+ add a cleaner window-function version. Then add a UNIQUE index so duplicates can't come back.
Password-free SSH is key-pair authentication: a private key stays on your machine, the matching public key goes on the server. Generate an ed25519 key, copy it with ssh-copy-id, lock down the permissions — and, if you want, turn password logins off entirely.
iconv converts a text file from one character encoding to another. Detect what you have with file -i, convert with iconv -f FROM -t TO, and use //TRANSLIT or //IGNORE for characters the target charset can't represent. Includes a recursive batch one-liner.
An encrypted private key makes Apache/nginx prompt for a passphrase on every start — a problem for unattended reboots. OpenSSL can write an unencrypted copy. Here's how, for RSA/EC/any key, plus why you should lock the file down and what the safer alternatives are.
ALTER TABLE … AUTO_INCREMENT = N sets the next id a table will hand out. It won't go below the current max id, behaves differently across storage engines on restart, and interacts with auto_increment_increment on replicated/Galera setups. Here's the full picture.