This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
Rsync from local to a remote directory
Mirrors files between two paths — locally or over SSH — with rsync, preserving modification times and permissions and optionally deleting extra files at the destination.
Generate a Bash script for the task “Rsync from local to a remote directory”. Parameterise the source and destination (host, user, path), keep --times --perms --links, make --delete opt-in, and echo the full rsync command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To remove a line from .ssh/known_hosts
Removes a stale host key from ~/.ssh/known_hosts after a server is rebuilt or its key changes.
Generate a Bash script for the task “To remove a line from .ssh/known_hosts”. Take a hostname or IP and run ssh-keygen -R <host>; mention doing it for both the name and the address. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Sort processes by memory usage
Lists processes sorted by resident memory and counts the CPU models reported in /proc/cpuinfo.
Commands
ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
# Get CPU Model
grep 'model name' /proc/cpuinfo | awk -F: '{print $2}' | uniq -c | sed -re 's/^ +//'
AI prompt
Generate a Bash script for the task “Sort processes by memory usage”. Provide two one-liners — processes sorted by RSS, fitted to the terminal width, and a de-duplicated count of the model name lines in /proc/cpuinfo — each with a one-line explanation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Open / close firewalld ports
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Generate a firewalld command sequence for the task “Open / close firewalld ports”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Remove rich rule
Removes previously added rich rules (a source-restricted MySQL port, an HTTPS allowance), adds a drop rule for a source address, and restarts firewalld.
Commands
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="<INTERNAL_IP>" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="<IP>" service name="https" accept'
# Firewall-cmd to block source IP address
firewall-cmd --permanent --zone="public" --add-rich-rule='rule family="ipv4" source address="<IP>" drop'
systemctl restart firewalld.service
AI prompt
Generate a firewalld command sequence for the task “Remove rich rule”. Take the zone and the exact rich-rule strings to remove; list the current rules with firewall-cmd --list-rich-rules, remove each match with firewall-cmd --permanent --remove-rich-rule, report any that were not present, and reload rather than restart the service. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
File search and replace
Replaces a string across every file under the current directory by piping grep -rl into sed -i.
Commands
grep -rl 2011 * | xargs sed -i 's/2011/2018/g'
AI prompt
Generate a Bash script for the task “File search and replace”. Take a search string, a replacement and a path glob; list matching files with grep -rl then xargs sed -i 's/…/…/g', and make a backup copy first. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To initiate a local port forward
Opens an SSH tunnel between two hosts — a local forward (-L) to reach a service behind a bastion, or a reverse forward (-R) to expose a local port outward.
Commands
ssh <USER>@<SERVER> -L 2227:<INTERNAL_IP>:22
# To initiate a remote port forward
ssh -R 9000:localhost:22 -p 22022 <SSH_USER>@<REMOTE_HOST>
# For <SVN_HOST>
ssh -i ~/Documents/<GROUP>/IT/certs/<GROUP>-LightsailPrivateKey-us-west-2.pem -R 8443:<IP>:443 ec2-user@<BASTION_HOST>
AI prompt
Generate a Bash script for the task “To initiate a local port forward”. Parameterise local port, remote host:port, the jump host and key/port; build the ssh -L or ssh -R command and note how to background it with -fN. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
vi global replace
The vi substitute command that replaces every match in the open file, plus a one-liner that deletes every path locate finds for a name.
Commands
:%s/search_string/replacement_string/g :%s/search_string/replacement_string/ghello
# Delete all files from a locate
locate nagios | xargs -t -I{} rm -rf {}
AI prompt
Generate a Bash script for the task “vi global replace”. Show the :%s/…/…/g form (and the c flag to confirm each change), then wrap the locate … | xargs rm -rf deletion in a script that lists the matches and asks for confirmation before deleting anything. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL clear password
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
User: backup Password: <DB_PASSWORD> Host name: <BACKUP_HOST>
update mysql.user set password=PASSWORD('<DB_PASSWORD>') where user='backup';
GRANT ALL PRIVILEGES ON *.* TO 'backup'@'<BACKUP_HOST>' identified by '<DB_PASSWORD>';
AI prompt
Generate the SQL statements for the task “MySQL clear password”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mount NFS
Mounts a remote CIFS/SMB share, an NFS export or an ISO image onto a local mount point (and remounts the root filesystem read-write).
Commands
mount <SERVER>:/var/lib/libvirt/images/<SERVER> /mnt/usb
# Mount ISO
mount -o loop disk1.iso /mnt/disk
# Mount Cifs
mount -t cifs //<INTERNAL_IP>/d\$ /mnt/sql -o username=Administrator,password=<SMB_PASSWORD>
# Show memory by process
ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
AI prompt
Generate a Bash script for the task “Mount NFS”. Take the source (share path, export or .iso), the mount point and credentials; pick the right mount -t cifs|-o loop|nfs invocation and create the mount point if needed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Timestamp log of a command
Wraps a command so its output is written to a log file bracketed by start and end timestamps.
Commands
date > mylog.txt;find /opt/bak/* -mtime +7 -exec ls -l {} \; >> mylog.txt;date >> mylog.txt
AI prompt
Generate a Bash script for the task “Timestamp log of a command”. Take a command and a log path; write date, run the command appending stdout/stderr, then date again — so the log shows exactly when it ran. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mail something
Sends a file as the body of an email with mail -s, and shows a network adapter’s link settings with ethtool.
Commands
mail -s "Reorg and Runstats from $HOSTNAME" <SSH_USER>@<REMOTE_HOST> < mailBody.txt
# Ethernet adapter settings
ethtool eth0
AI prompt
Generate a Bash script for the task “Mail something”. Parameterise the subject, recipient and body file; send it with mail -s and exit non-zero if the mailer fails, then print link speed, duplex and link-detected status for a given interface with ethtool. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Example crontab commands
Example crontab entries for routine maintenance — pruning old backups, NTP sync, updatedb, nightly backup and cleanup jobs.
Generate a crontab block for the task “Example crontab commands”. Produce a commented crontab block: field legend, then one line per job (backup prune, ntpdate, updatedb, backup script) with sane staggered times. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
List any disk errors for /dev/sdb
Prints a disk’s SMART error log with smartctl.
Commands
smartctl -l error /dev/sdb
AI prompt
Generate a Bash script for the task “List any disk errors for /dev/sdb”. Take a device path (default /dev/sdb); check that smartctl is installed, print the SMART error log with smartctl -l error, and report the overall health result from smartctl -H. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Create a self-signed certificate
Generates a one-year self-signed certificate and key with openssl req -x509, then inspects the chain a remote TLS service presents with openssl s_client.
Commands
Common name must be the same name as the server if we are self signing
Public Cert Filename: <GROUP>.pem Private Key Filename: <GROUP>.pem
openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/<GROUP>.pem -keyout /etc/ssl/private/<GROUP>.pem
# View a certificate chain
openssl s_client -CApath /usr/share/ca-certificates/cacert.org/ -connect <SVN_HOST>:993
openssl s_client -connect <USER>.com:443 -servername <USER>.com
AI prompt
Generate an openssl command sequence for the task “Create a self-signed certificate”. Parameterise the common name (it must match the server’s hostname), the output paths and the validity in days; run openssl req -new -x509 -nodes, restrict the key file’s permissions, and show how to check a remote chain with openssl s_client -connect host:port -servername name. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
OpenSSL
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Generate an openssl command sequence for the task “OpenSSL”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Refresh all zone files
Reloads every BIND zone in the current directory with rndc reload, tests IMAPS on a mail server, and appends a CA certificate to the system trust bundle.
Commands
for file in *; do l=${file%.hosts}; l=${l%.rev}; rndc reload "$l"; done
# Test IMAPS on mail server
openssl s_client -connect <MAIL_HOST>:imaps
# Append Certificate Authority to bundle
openssl x509 -text -in /path/to/proxycert.crt >> /etc/pki/tls/certs/ca-bundle.crt
AI prompt
Generate an openssl command sequence for the task “Refresh all zone files”. Loop over the zone files in the BIND data directory, strip the .hosts/.rev suffix to get each zone name, run rndc reload for each and report failures; separately show the openssl s_client … :imaps check and add a CA certificate with update-ca-trust rather than appending to the bundle. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generate certificate <PROJECT>
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Generate certificate <PROJECT>”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Sync mount with local directory
Copies only newer files from a mounted share to a local directory with rsync -u, and pushes a tree to another host over SSH on a custom port, deleting extra files.
Generate a Bash script for the task “Sync mount with local directory”. Parameterise the source, destination and an optional SSH host and port; use rsync -avu, make --delete-during opt-in, run a --dry-run first, and echo the full command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Stop DHCP from overwriting resolv.conf
Makes /etc/resolv.conf immutable with chattr +i so DHCP or NetworkManager can't overwrite the resolver settings.
Commands
chattr +i /etc/resolv.conf Make it immutable
AI prompt
Generate a Bash script for the task “Stop DHCP from overwriting resolv.conf”. Show chattr +i /etc/resolv.conf to lock and chattr -i to unlock, with a note to set the desired nameservers first. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mysql MAX Locks exceeded
Edits the MySQL server config (my.cnf) — bind address or InnoDB buffer size — to fix a startup or locking error.
Commands
[mysqld]
innodb_buffer_pool_size=50M
AI prompt
Generate the config snippet for the task “Mysql MAX Locks exceeded”. Show the [mysqld] keys to set (bind-address, innodb_buffer_pool_size), where the file lives on Debian vs RHEL, and the restart command. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Postfix Clear queue
Manages the Postfix mail queue — inspect it, delete all or just the deferred queue, and trace a message by its queue ID.
Commands
postsuper -d ALL Deferred queue postsuper -d ALL deferred
# View the queue
mailq
# Query a user from a Queue ID
postcat -q <QUEUE_ID> | grep Auth Queue ID <QUEUE_ID>
AI prompt
Generate a Bash script for the task “Postfix Clear queue”. Provide mailq, postsuper -d ALL / postsuper -d ALL deferred, and postcat -q <id> | grep -i auth, with a guard prompt before any bulk delete. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MAC flush DNS Cache
Flushes the macOS DNS resolver cache after a hosts-file or DNS change.
Generate a Bash script for the task “MAC flush DNS Cache”. Emit sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder and note it needs an admin password. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Save a website
Mirrors a website to static files with wget — page requisites, link conversion and domain limiting for offline browsing.
Generate a Bash script for the task “Save a website”. Take the start URL and the domain to stay within; run wget --recursive --page-requisites --convert-links --restrict-file-names=windows --no-parent --domains <domain>. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
VirtualBox commands
Clones a VirtualBox disk image and resets its UUID so the copy can be attached alongside the original.
Generate a Bash script for the task “VirtualBox commands”. Take a source .vdi and a target name; run VBoxManage clonehd, then VBoxManage internalcommands sethduuid if the UUID still clashes. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Block source addresses in firewalld
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Generate a firewalld command sequence for the task “Block source addresses in firewalld”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.