Chapter 13 — Source index and verification note

Primary standards and upstream manuals

• POSIX Issue 8, Shell & Utilities — The Open Group (and POSIX sh, find, exit status)
• Bash Reference Manual — gnu.org/software/bash/manual (quoting, redirections, pipelines, POSIX mode, "what is a shell")
• GNU Coreutils manual — gnu.org/software/coreutils/manual (permissions, chmod, umask, chown, setgid, id, df, du, cp, rm, --preserve-root, symlinks, common options, standards conformance)
• Linux man-pages (man7.org) — index: getent(1), getfacl(1), setfacl(1), useradd(8), usermod(8), os-release(5), ps(1), kill(1), free(1), uptime(1), ss(8), ip(8), ip-route(8), lsblk(8), findmnt(8), sshd(8), sshd_config(5), tcpdump(8), ping(8), tracepath(8), nft(8)
• systemd upstream manual — freedesktop.org/software/systemd/man: systemctl(1), systemd.service(5), systemd.unit(5), systemd.timer(5), systemd.time(7), systemd-analyze(1), journalctl(1), journald.conf(5), systemd.mount(5), systemd.network, networkctl, systemd-resolved.service, resolvectl
• Linux kernel documentation — /proc filesystem, load average
• OpenSSL — s_client(1)
• lsof — manual; sysstat — project
• restic — documentation: repository checks, restore

IETF standards

• RFC 1034 — DNS concepts (caching/TTL, UDP)
• RFC 7766 — DNS transport over TCP
• RFC 9525 — TLS service identity (SAN, DNS-ID/IP-ID)

Distribution and project documentation

• Debian: Reference ch.2, package management; Reference ch.5, network configuration; Security information; Wiki: NetworkConfiguration; manpages.debian.org (Bookworm-packaged man pages cited per tool: lsblk, findmnt, systemd.mount, e2fsck, cryptsetup, LVM2, mdadm, df, du, proc(5), apt(8), apt-get(8), dig(1), journalctl(1))
• Ubuntu: About Netplan; Netplan docs (YAML, try); Firewalls; OpenSSH server; AppArmor; User management; Package management
• Fedora/RHEL/AlmaLinux: RHEL 9: Configuring and managing networking; RHEL 9: Using SELinux; Fedora SELinux: getting started; DNF Command Reference; DNF5 upgrade
• Arch: pacman; System maintenance (partial upgrades); systemd
• NetworkManager — nmcli reference
• firewalld — firewall-cmd manual, runtime vs permanent
• nftables — wiki quick reference
• Docker — Engine security; Podman — overview, podman-run(1)
• Prometheus — Node Exporter guide, security model, alerting practices
• NIST — SP 800-61 Rev. 3 (PDF)

Verification note (2026-10-10)

All sources above were identified and reviewed on 2026-10-10 from the research notes underlying this manual; most were fetched and read directly. Several official hosts blocked automated retrieval during that pass — systemd upstream returned HTTP 418, Red Hat's documentation portal (RHEL 9 networking and SELinux) returned access denials, and some Ubuntu Server pages sat behind an interactive wall — so those canonical URLs are provided for direct verification, and the affected claims are limited to standard, well-documented command scope cross-checked against other upstream references. Before turning any chapter into release-specific site procedures, re-check each cited source against the current target release and the installed tool version; option sets, service unit names, defaults, and package-manager majors all drift between releases. Deliberate scope boundaries of this edition: no XFS/Btrfs/ZFS repair recipes, no SMART/NVMe health recipes, no database-consistent backup procedures, no auditd rule sets, no malware-forensics workflow, and no universal "3-2-1" or retention numeric policies — these need dedicated primary sources and careful per-distro verification before being published as runnable recipes.

Conclusion

Two habits distinguish the administrators this manual is written for. The first is treating every diagnosis as layered evidence collection: the same "it's down" symptom decomposes cleanly into resolution, route, TCP, listener, TLS, and application questions (ip(8); ss(8); RFC 9525), and the discipline of answering them in order is what keeps a fix from becoming a second outage. The second is respecting the irreversibility boundary: LUKS headers, LVM shrinks, RAID superblocks, fstab, firewall default policies, sudoers, and live restores are the places where a Linux system keeps no undo — and on every one of them the documentation itself, not folklore, defines what is lost and what a rollback requires (cryptsetup(8); mdadm(8); systemd.mount(5); firewall-cmd; restic restore). An administrator who has internalized those two habits needs fewer recipes, because every recipe in this manual — inspection first, validation before activation, narrow and reversible application, verification from an independent vantage, and a written rollback — is just those habits applied to a specific layer. Where this edition drew boundaries (filesystem-specific repair, SMART health, database-consistent dumps, forensics), it did so on purpose: publishing an uncited command is worse than publishing a pointer to the authoritative source.