NCP-GENL cheat sheet

Pre-installation checklist: verify hardware compatibility list (HCL), firmware level, disk space (min 2x RAM for swap), and network ports required by the product.

Silent/unattended installs use a response file (e.g., kickstart, preseed, answer file); validate with a dry-run parser before production.

Configuration precedence order (highest to lowest): command-line flags > environment variables > local config file > global config file > compiled defaults.

Idempotent configuration management: running the same playbook twice must produce the same state; use 'check mode' to detect drift without changes.

Package manager lock files prevent concurrent installs; on Debian/Ubuntu use 'apt-get -o DPkg::Lock::Timeout=60' to wait rather than fail.

Post-install hardening baseline: disable unused services, set umask 027, enforce SSH key-only auth, and apply vendor security patches before joining network.

Rollback plan: snapshot VM/volume before upgrade; keep previous package versions in local repo for downgrade (e.g., 'dnf downgrade pkg-version').

License and activation: record license key, activation server URL, and offline activation procedure; verify entitlement expiry before deployment.

OSI mapping: L2 = MAC/Ethernet frames, L3 = IP packets/routing, L4 = TCP/UDP ports/segments; troubleshooting starts at the lowest failing layer.

Subnet math: usable hosts = 2^(32-prefix) - 2; /24 = 254 hosts, /25 = 126, /26 = 62, /27 = 30, /28 = 14, /29 = 6, /30 = 2.

TCP three-way handshake: SYN → SYN-ACK → ACK; a half-open connection indicates firewall drop or service not listening.

DNS resolution order: /etc/hosts (or local resolver cache) → configured nameservers; use 'dig +trace' to isolate delegation failures.

VLAN tagging: 802.1Q inserts a 4-byte tag; trunk ports carry multiple VLANs, access ports carry one untagged VLAN.

MTU and fragmentation: Path MTU = smallest link MTU; set DF bit and use ICMP 'fragmentation needed' to discover; jumbo frames = 9000 bytes.

NAT types: SNAT (source, outbound masquerade), DNAT (destination, port forwarding); stateful firewall tracks connection table entries.

Routing decision: longest prefix match wins; if equal prefix, lowest administrative distance/metric; default route 0.0.0.0/0 is last resort.

Capacity formula: usable = raw × (1 - parity overhead); RAID5 loses 1 disk, RAID6 loses 2, RAID10 loses 50%.

File system selection: ext4 for general Linux, XFS for large files/high throughput, ZFS/Btrfs for checksums and snapshots, NTFS for Windows interoperability.

Inode exhaustion: 'df -i' shows inode usage; many small files can exhaust inodes while 'df -h' still shows free space.

Mount options that affect safety: 'noatime' reduces writes; 'ro' enforces read-only; 'nosuid,nodev,noexec' harden non-system mounts.

LVM layers: PV (physical volume) → VG (volume group) → LV (logical volume); extend with 'lvextend -r' to resize FS in one step.

Snapshot consistency: quiesce application or flush buffers ('fsfreeze') before snapshotting a live volume; snapshots are not backups.

NFS vs SMB: NFS is native to Unix (UID/GID mapping, export options like 'root_squash'); SMB is native to Windows (ACLs, share permissions).

SMART monitoring: 'smartctl -a /dev/sdX' reports reallocated sectors, pending sectors, and temperature; rising reallocated count predicts failure.

Principle of least privilege: grant the minimum permissions required; use role-based groups rather than per-user grants.

Linux permission model: owner/group/other × read(4)/write(2)/execute(1); directory execute bit is required to traverse.

SUID/SGID/sticky bits: SUID runs as file owner, SGID inherits group, sticky (t) prevents deletion by non-owners in shared directories.

SELinux modes: Enforcing (deny + log), Permissive (log only), Disabled; contexts are label-based, not path-based, and persist across moves.

Authentication factors: something you know (password), have (token/key), are (biometric); MFA requires two different categories.

TLS certificate validation: check chain of trust, expiry ('openssl x509 -enddate'), hostname match (SAN), and revocation (CRL/OCSP).

Password storage: salted, slow hash (bcrypt, scrypt, Argon2); never store reversible encryption or unsalted MD5/SHA1.

Audit logging: record who, what, when, result; protect logs with append-only or remote syslog to prevent tampering.

USE method: for every resource check Utilization, Saturation, Errors; applies to CPU, memory, disk, and network.

Golden signals: latency, traffic, errors, saturation; alert on symptoms (user impact) before causes (component metrics).

Load average interpretation: 1/5/15-minute run-queue averages; compare to CPU core count - load > cores means queuing.

Memory pressure: check 'free -m' available (not free), swap in/out ('vmstat si/so'), and OOM killer logs in 'dmesg'.

Disk I/O: 'iostat -x 1' - high %util with high await indicates saturation; low %util with high await indicates slow storage.

Log levels: DEBUG < INFO < WARN < ERROR < FATAL; set production to INFO or WARN to control volume and cost.

Network troubleshooting order: link (L1) → IP (L3) → port (L4) → application (L7); use 'ip a', 'ping', 'ss -tlnp', 'curl -v'.

Time synchronization: NTP/chrony drift breaks TLS, Kerberos, and log correlation; verify with 'chronyc tracking' (offset < 100 ms).

Exit codes: 0 = success, non-zero = failure; scripts must check '$?' or use 'set -e' to abort on error.

Shell strict mode: 'set -euo pipefail' - exit on error, error on unset variable, propagate pipe failures.

Idempotency rule: a task must be safe to run repeatedly; use 'creates=' or state checks instead of blind re-execution.

Parameter expansion: ${var:-default} supplies default, ${var:?error} fails if unset, ${var#prefix} strips prefix, ${var%suffix} strips suffix.

Cron syntax: minute hour day-of-month month day-of-week; '*/5 * * * *' = every 5 minutes; cron runs with minimal PATH.

Version control for automation: commit playbooks/scripts, tag releases, and review diffs; never store secrets in plaintext in the repo.

Secrets handling: inject at runtime via environment, vault, or secret manager; mask in logs and avoid passing on the command line.

Dry-run first: 'ansible --check --diff', 'terraform plan', or script '--dry-run' flags reveal changes before applying.