ls ~/glossary
Glossary.
Terms from everyday admin work, explained briefly — with an example and the problem you typically run into.
A and AAAA recordAn A record maps a hostname to an IPv4 address; an AAAA record maps it to an IPv6 address.Authoritative name serverAn authoritative name server stores a zone's records itself and answers queries about them definitively, without caching.CAA recordA CAA record states in DNS which certificate authorities (CAs) are allowed to issue TLS certificates for a domain.CNAME recordA CNAME record declares a DNS name to be an alias of another name, whose records then apply.DNS propagationDNS propagation is the time it takes for a DNS change to reach all resolvers, because old answers first have to expire from their caches.DNS resolverA recursive DNS resolver takes queries from clients, fetches the answer from the authoritative name servers and caches it.DNSSECDNSSEC adds cryptographic signatures to DNS so resolvers can verify that answers are authentic and unmodified.Glue recordA glue record is an A or AAAA record for a name server that the parent zone serves along with the delegation, so it can be resolved.MX recordAn MX record lists the mail servers that accept email for a domain, each with a priority.NS recordAn NS record names the authoritative name servers responsible for a DNS zone.NXDOMAINNXDOMAIN is the DNS response saying that the queried name does not exist, for any record type.PTR recordA PTR record provides reverse DNS: it maps an IP address back to a hostname.SOA recordThe SOA (Start of Authority) record holds a zone's administrative data, including the serial number and timers for secondary name servers.SRV recordAn SRV record tells clients on which host and port a specific service for a domain is available.TTL (time to live)TTL (time to live) is the number of seconds a resolver may cache a DNS record.TXT recordA TXT record stores arbitrary text for a DNS name and is used mostly for email authentication and ownership checks.Bounce / NDRA bounce or NDR (non-delivery report) is an automatic message from a mail server saying an email could not be delivered.DKIMDKIM (DomainKeys Identified Mail) signs outgoing email with a private key; receivers verify the signature with the public key published in DNS.DMARCDMARC is a DNS policy that tells receivers how to handle email whose From domain is not confirmed by SPF or DKIM.GreylistingGreylisting is a spam defence where the mail server temporarily rejects messages from unknown senders and only accepts them when delivery is retried.IMAPIMAP (Internet Message Access Protocol) is the protocol mail clients use to read, move and manage messages directly on the server.MTA (mail transfer agent)An MTA (mail transfer agent) is the server software that accepts email over SMTP, queues it and passes it to the next server or the mailbox.MTA-STSMTA-STS is a standard that lets a domain publish that inbound mail must only be delivered to its MX servers over TLS with a valid certificate.Relay / open relayRelaying means a mail server accepts a message that is not addressed to its own domains and passes it on to another server.SMTPSMTP (Simple Mail Transfer Protocol) is the protocol used to transfer email between mail servers and from mail clients to their server.SPFSPF (Sender Policy Framework) is a TXT record that defines which servers are allowed to send email on behalf of a domain.STARTTLSSTARTTLS is a command that upgrades an initially unencrypted connection (SMTP, IMAP, POP3) to TLS.Submission (port 587)Submission is the SMTP service on port 587 where mail clients and applications authenticate and hand over email to their server for sending.ACMEACME (Automatic Certificate Management Environment) is the protocol for requesting, validating and renewing certificates automatically, best known from Let's Encrypt.Certificate chainA certificate chain is the sequence of server certificate, one or more intermediate certificates and the root CA that a client uses to verify authenticity.Content Security Policy (CSP)A Content Security Policy (CSP) is a response header that tells the browser from which sources a page may load scripts, stylesheets, images and frames.HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to access a site exclusively over HTTPS for a set period of time.HTTP status codeAn HTTP status code is the three-digit number a web server returns to report the result of a request.PHP-FPMPHP-FPM (FastCGI Process Manager) is a service that manages a pool of PHP processes and handles requests from the web server over FastCGI.Reverse proxyA reverse proxy is a server that accepts client requests and forwards them to one or more backend servers (upstreams).SAN (Subject Alternative Name)The SAN (Subject Alternative Name) is the TLS certificate field that lists all hostnames, and optionally IP addresses, the certificate is valid for.SNI (Server Name Indication)SNI (Server Name Indication) is a TLS extension where the client names the requested hostname during the handshake, so the server can pick the right certificate.TLSTLS (Transport Layer Security) is the protocol that encrypts connections and proves the server's identity with certificates; it replaced SSL.Identity provider (IdP)An identity provider (IdP) is the central service that authenticates users and confirms their identity and attributes to applications.JWT (JSON Web Token)A JWT (JSON Web Token) is a compact signed token that carries statements (claims) about a user or client in JSON form.Multi-factor authentication (MFA)Multi-factor authentication (MFA) requires at least two independent proofs at login, from the categories knowledge, possession and biometrics.OAuth 2.0OAuth 2.0 is an authorization framework that lets an application access a resource on behalf of a user without receiving the user's password.OpenID Connect (OIDC)OpenID Connect (OIDC) is a login protocol built on OAuth 2.0 that, in addition to access, delivers the user's identity as a signed ID token.SAML 2.0SAML 2.0 (Security Assertion Markup Language) is an XML-based standard in which an identity provider tells an application, with a signature, who has logged in.SCIMSCIM (System for Cross-domain Identity Management) is a REST standard that lets an identity provider create, update and deactivate users and groups in applications.Service provider (SP)In SSO, a service provider (SP) is the application that does not authenticate users itself but trusts an identity provider to do so.Single sign-on (SSO)Single sign-on (SSO) means users authenticate once at a central service and can then use several applications without entering a password again.Cron / cron jobCron is the classic Linux service that runs commands at scheduled times; a cron job is a single entry in a crontab.File descriptorA file descriptor is an integer a Linux process uses to access an open file, socket or pipe.InodeAn inode is the data structure in a Linux file system that stores a file's metadata (permissions, owner, timestamps, location of data blocks), but not its name.journaldjournald (systemd-journald) is the systemd logging service that collects messages from the kernel, services and applications in one structured journal.logrotatelogrotate is a Linux tool that renames, compresses and deletes log files by time or size so the disk does not fill up.OOM killerThe OOM (out of memory) killer is the Linux kernel function that forcibly terminates a process when memory is exhausted, to keep the system alive.RPO and RTORPO (recovery point objective) is the maximum acceptable data loss measured in time; RTO (recovery time objective) is the maximum acceptable downtime until recovery.Snapshot vs backupA snapshot is a point-in-time image of a volume or VM on the same system; a backup is an independent copy of the data stored somewhere else.systemd unitA systemd unit is a configuration file that systemd uses to manage a service, timer, mount, socket or other system object.CalDAV and CardDAVCalDAV and CardDAV are open protocols built on WebDAV that synchronise calendars (CalDAV) and address books (CardDAV) between a server and devices.NextcloudNextcloud is an open-source platform for file sync, sharing, calendars, contacts and collaboration that you run on your own servers.S3 object storage and bucketS3 is the HTTP API for object storage introduced by Amazon and now supported by many providers; a bucket is the container that holds the objects.WebDAVWebDAV is an extension of HTTP that lets clients create, read, move and lock files and folders on a web server.1st, 2nd and 3rd level support1st, 2nd and 3rd level describe the tiers of IT support, from taking requests and solving standard cases to deep technical analysis and fixing bugs in code.EscalationIn IT support, an escalation is passing a ticket to someone with more expertise or more authority because it cannot be solved at the current level.Root cause analysis (RCA)A root cause analysis (RCA) is the structured investigation of an incident aimed at finding the underlying cause and preventing it from happening again.SLA (service level agreement)An SLA (service level agreement) is an agreement between a provider and a customer on measurable targets such as availability, response time and resolution time.