Meet your server

Spend an hour surveying the machine before you install anything on it. Half of the "why is this broken" moments in the next ten chapters are things that were already true and nobody looked.

The installer also made decisions for you. Some are fine, some you will want to change, and you cannot tell which without looking.

Getting in #

The tool for this is ssh, short for secure shell. It gives you a shell on another machine over an encrypted connection, and it is thirty years old. The implementation nearly everyone runs is OpenSSH, and its manual pages are unusually good if you ever want the authoritative answer. If you already log in with ssh every day, skip ahead. If not, here is the shape of it.

$ ssh admin@192.168.1.20

That says: connect to the machine at that address, and log in as that user. If your network gives your server a name you can use that instead of the address. You will be asked for a password, or not, depending on what the installer set up.

Six things happen in order, and knowing them turns most SSH problems into "which stage failed".

Two details from that sequence matter later. The host key check happens before you authenticate, so a warning about a changed host key is not a login problem: your client is telling you the machine is not the one it met last time. Your identity is checked last, which is why a firewall problem hangs or refuses while a wrong password just asks again.

Who am I, and what is this? #

Everything from here on runs on the server, in that SSH session.

Start with the machine's own idea of itself:

$ hostnamectl

That name is whatever the installer chose; chapter 3 changes it to one you picked.

hostnamectl is part of systemd, the thing that starts and supervises everything on a modern Linux system. You are going to meet it a lot, and its documentation is worth a browse once you have seen it in action. Four things from that output: the machine's name, the distribution and version, the kernel version, and the architecture. Those four facts decide which packages you can install and which documentation applies to you.

Now who you are:

$ id

Record three things from your output: the numeric user ID, which is what the kernel uses; the primary group; and the supplementary groups. Confirm that sudo is listed, because that is what permits this account to run approved commands as root.

Then the hardware:

$ lscpu | grep -E 'Model name|^CPU\(s\)|Architecture'
$ free -h
$ lspci | grep -i -E 'vga|ethernet|network'

Write down the CPU model, the core count, and the total memory. Memory is the resource you will run out of first, and knowing whether you have 8 GB or 32 GB decides how ambitious you can be about running a photo library with machine learning in it.

What is it running? #

A fresh server install is not empty. Ask systemd what it has started:

$ systemctl list-units --type=service --state=running

That is usually twenty to forty services. You do not need to understand all of them, but scan the list and see if anything surprises you. A desktop environment. A printing service. A database you did not install. Every one of those is software you have to keep patched.

Now the more pointed question:

$ systemctl list-units --state=failed

On a healthy machine that prints nothing. If it prints something, you have found your first puzzle, and I want you to chase it rather than ignore it. A failed unit on day one is the cheapest possible introduction to reading logs, because nothing depends on it yet.

The tool for finding out why is journalctl, systemd's log reader:

$ systemctl status <the-unit-name>
$ journalctl -u <the-unit-name> -b --no-pager

-b means "this boot only", which is almost always what you want. The output is dense the first time. There is a short guide to reading it without drowning:

Who can reach it right now? #

This is question one from the last chapter, and here is how you actually answer it.

$ ss -tlnp

The Process column is empty without sudo, which is the first thing to try if you were expecting names.

ss lists sockets, and it is the modern replacement for netstat (man page). The flags mean: -t TCP only, -l only things listening for new connections, -n show port numbers rather than guessing at names, -p name the process (which needs sudo to show anything useful).

The column that matters is Local Address. Read it as "which of my addresses will accept a connection on this port":

• 127.0.0.1 or 127.0.0.53 is loopback. Only this machine can reach it. Something listening here is invisible to your network, which is often exactly right.
• 0.0.0.0 means every local IPv4 address. Reachability still depends on routes and filters between the client and this host.
• [::] is the IPv6 wildcard. A globally routed IPv6 address may be internet-reachable without IPv4-style port forwarding, so inspect and test both address families.

Classify every listener in your own output by address, port and process. On a fresh installation, account for SSH and any local resolver rather than assuming those are the only listeners.

Then the network itself:

$ ip -brief addr
$ ip route

ip -brief addr lists the interfaces and their addresses; ip route shows where traffic goes by default. What you are looking for: which interface is actually up, what address it has (192.168.1.20 in this book), how big the subnet is, and which gateway it uses (192.168.1.1 here, and almost certainly your router). Note whether you are on wired or wireless, because wireless is convenient and slower and drops out, and moving to wired later will change the interface name and possibly the address.

Where would data live? #

Question three. Storage mistakes take about a year to hurt.

$ lsblk -o NAME,SIZE,TYPE,MOUNTPOINTS
$ df -h /

Plain lsblk prints a few more columns and draws the tree with box characters; the explicit -o keeps it to what matters here.

Read lsblk as a tree of physical devices, partitions and any mapped volumes. Identify which branch ends at the filesystem mounted on / and compare that filesystem's size with the containing disk.

That last line is lvm, the Logical Volume Manager. Ubuntu's introduction to it is a decent half-page read. Instead of putting a filesystem directly on a partition, the installer put a volume group on it, and then carved a logical volume out of the group for the root filesystem. Logical volumes can be grown and snapshotted without touching partitions. Shrinking depends on the filesystem: ext4 can be shrunk offline with care, while XFS cannot be shrunk in place.

The logical volume can be smaller than its volume group on purpose. In that case lsblk shows the containing device while df shows the filesystem, and the difference can look like missing storage.

$ sudo vgs
$ sudo lvs

VFree is the answer: space in the group that no volume has claimed yet.

If your root volume already fills the group, nothing is wrong; you have given up snapshots and easy growth. And if you have unallocated space and want it, sudo lvextend followed by a filesystem resize will grow the volume while it is mounted. Do not do it yet. There is no data to run out of space for, and this chapter changes nothing.

Anything else worth knowing #

Two quick ones that matter later.

Time, because certificates, logs and authentication all care:

$ timedatectl

Check that the clock is synchronised and note the timezone. A server on UTC is perfectly sensible; a server whose clock is wrong will produce authentication failures that make no sense at all.

And graphics hardware, if you plan to serve video:

$ ls -l /dev/dri
$ lspci -k | grep -A3 -i vga

If /dev/dri/renderD128 exists, the kernel has bound a driver to a GPU and video transcoding on hardware is at least possible. The Kernel driver in use line tells you which driver got it. A device file existing does not prove anything works. Chapter 7 tests it properly. But its absence tells you now, cheaply, not to plan on it.

Your three puzzles #

Yours has oddities that documentation does not. Find them now.

Write it down #

Fill this in as you go. Later chapters will ask you for these numbers, and future you will be grateful. It saves in your browser, and the copy button gives you a block of text you can paste into any of the prompts in this book.