Tech Tips and Tricks

Post your general hardware and software tips and tricks here. Help other Lains learn how to do practical and interesting things.

Here is a script to do a backup of your running Linux system using rsync. After the initial big backup, it will only back up new files and files that have changed. It will also delete from the backup any files you have deleted from your system. #!/bin/bash echo "This script performs an incremental rsync backup" echo "of a complete, running Debian/Devuan Linux system" echo "to storage mounted on /mnt (Run this script as root)" echo "1. Make sure the backup media is mounted on /mnt" echo "2. Stop all disk-intensive operations" read -p "Continue (y/n)?" CONT if [ "$CONT" = "y" ]; then rsync -ahAHX --update --delete --info=progress2 \ --exclude={"/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/media/*","/lost+found","/home/*/.gvfs","/home/steam*"} \ /* /mnt echo "Backup completed" else echo "Script ended with no action taken." exit fi # # Notes # # -a archive mode, same as -rlptgoD (recurse and preserve all attributes except -A,-X,-U,-N,-H) # # -r recurse into directories # -l copy symlinks as symlinks # -p preserve permissions # -t preserve modification times # -g preserve group # -o preserve owner (super-user only) # -D preserve device files (super-user only) AND preserve special files # # -A preserve ACLs (implies -p) # -X preserve extended attributes # -U preserve file access times # -N preserve file creation times # -H preserve hard links # # (rsync defaults) 1. skip files that have the same attributes on both the source and target # 2. back up new files that don't yet exist on the target # 3. overwrite target files that have different attributes (including updated files) # 4. don't delete target files that no longer exist on the source # --delete delete target files that no longer exist on source # --update, -u don't overwrite target files that have a newer modified-date&time (preserves latest versions) # --ignore-existing don't overwrite files, even if they have different attributes # -c skip files based on checksum instead of size and mod-date/time (slow) # # -h output numbers in a human-readable format # -P show progress during transfer AND keep partially transferred files # -v increase verbosity # --info=progress2 show progress and speed # # If doing a live system backup, stop all disk-intensive operations first. # By default, rsync writes separate partitions onto one partition. # Exclude the swap file, if you use one. # If you back up to somewhere other than /mnt or /media, exclude it.

>>82435 even better would be to skip all tmpfs mounted directories: mount | awk '{if($1~/tmpfs/){printf "%s ", $3}}' not sure how rsync parses the patterns, but that would be an exercise for the reader lol

How to set up lightning fast alternative DNS that queries a whole list of free public DNS servers and uses the first response. Included in these instructions are quad9, dnswatch, and cloudflare servers. The "all-servers" line is what makes it work. The resolvconf package is what keeps your chosen DNS servers from being overwritten by other processes after a reboot. ## set up fast alternative dns with local dns cache: apt install resolvconf dnsmasq ## ## append to /etc/dnsmasq.conf: no-resolv listen-address=127.0.0.1 all-servers server=84.200.69.80 server=84.200.70.40 server=9.9.9.9 server=149.112.112.112 server=1.1.1.1 server=1.0.0.1 ## ## append to /etc/resolvconf/resolv.conf.d/head: nameserver 127.0.0.1 ## service dnsmasq restart

Video editors are confusing, complicated overkill for simply trimming and making minor changes to video clips. Enter Avidemux, which is great for doing that.. But it's not available in repos, so here's how to build it from scratch. build avidemux from source for devuan https://github.com/mean00/avidemux2 ## as root, install build dependencies: ## (libaften-dev is not available, so Aften AC-3 audio encoder plugin won't be built) # apt install build-essential cmake pkg-config yasm \ libsqlite3-dev \ libxv-dev libvdpau-dev libva-dev \ libasound2-dev libpulse-dev \ qttools5-dev-tools qtbase5-dev \ libx264-dev libxvidcore-dev \ libmp3lame-dev libtwolame-dev libopus-dev libvorbis-dev libogg-dev \ libpng-dev libass-dev \ libfaac-dev \ libfdk-aac-dev \ libx265-dev \ libvpx-dev \ libaom-dev ## as non-root user, cd to home directory $ cd ## download Avidemux source into ./avidemux2/ and cd into it: $ git clone --recursive https://github.com/mean00/avidemux2.git && cd avidemux2 ## build avidemux: $ bash bootStrap.bash --with-system-libass ## make run_avidemux_template.sh executable and use it to run avidemux $ chmod +x run_avidemux_template.sh $ ./run_avidemux_template.sh ## move avidemux to where it will live and add it to the menu mv ~/avidemux2 /home/run cd /home/run/avidemux2 cp run_avidemux_template.sh run_avidemux.sh nano run_avidemux.sh ## change: BUILDTOP="${HOME}/avidemux2" ## to: BUILDTOP="/home/run/avidemux2" ## make a menu launcher with command: /home/run/avidemux2/run_avidemux.sh ## for dark theme: View > Theme > Dark theme ## how to trim a video clip with avidemux: ## 1. launch avidemux and open a video file ## 2. choose an output container and rotate the video if needed: output format > select "mp4 muxer" output format > configure > rotate video > select 90 ## 3. choose an output codec video output > "mpeg4 avc x264" (start and end points can be anywhere) ## or: video output > "copy" (start and end points must be on key-frames) ## 4. set start and end points, then save video: move video to desired start point, click "A" move video to desired end point, click "B" click "save" ## (careful: "X" deletes everything between the start and end points)

Everybody needs an encrypted partition for all their private stuff. Here's how to create and use a LUKS encrypted partition using cryptsetup on the commandline. ## how to encrypt a partition ## in this example we will use usbstick partition "sdd1", mapname "safe", ## username "user", and mount point "/home/user/Desktop/safe" su - ## 1. create a partition normally or choose an expendable one ## 2. unmount it and LUKS-format it: umount /dev/sdd1 cryptsetup --verbose --verify-passphrase luksFormat /dev/sdd1 ## (provide a strong passphrase and store it somewhere secure) ## 3. unlock it and give it a /dev/mapper/<mapname>: cryptsetup luksOpen /dev/sdd1 safe ## 4. create a filesystem on it: mkfs.ext4 /dev/mapper/safe ## 5. make a convenient mount point for it: mkdir /home/user/Desktop/safe ## 6. mount it: mount /dev/mapper/safe /home/user/Desktop/safe ## 7. make it writable by the desired user/group: chown -R user:user /home/user/Desktop/safe ## 8. unmount it when not in use umount /dev/mapper/safe ## 9. close it completely so the password is needed to reopen it: cryptsetup luksClose /dev/mapper/safe ## 10. optional, fix problem with luks volumes not closing: mv /usr/lib/gvfs/gvfsd-metadata /usr/lib/gvfs/gvfsd-metadata.disabled exit ...

Here are some ways you can make your Linux system a little more secure. I noticed after installing minimal Devuan that it didn't have a firewall running, which seems like a huge oversight and a gaping security hole. Here's a quick, simple way to get a firewall up and running. ## set up up a simple firewall: apt install ufw ufw default deny incoming ufw default allow outgoing ufw enable You can make it a lot harder for any unauthorized person to get root privileges on your system by requiring membership in a "wheel" group for that, and by getting rid of the sudo command. Make sure "su -" works and you know the root password before purging sudo. ## restrict root access: su - ## get rid of sudo apt purge sudo delgroup sudo ## create a wheel group and require membership in it to get root privileges groupadd wheel ## add the user who used "su -" to become root, and add root usermod -a -G wheel $(logname) usermod -a -G wheel root nano /etc/pam.d/su ## uncomment the following line: #auth required pam_wheel.so exit Anyone who manages to read your system logs can get a lot of sensitive information, including passwords. Here's how to disable system logs. ## turn off system logging: service rsyslog stop nano /etc/rsyslog.conf ## comment out the following line: #$IncludeConfig /etc/rsyslog.d/*.conf Some install options of Devuan automatically install an ssh server and an sftp server which are potential security holes. ## uninstall ssh servers: apt purge openssh-server openssh-sftp-server

How to use MPV to watch YouTube (and other sites supported by yt-dlp) with SponsorBlock. This assumes you are using Debian (for the installation of MPV and the like), change the package manager to the one for your system. [code] bash # Install required packages # Python for the sponsorblock script, Pip3 for yt-dlp apt install python3 mpv python3-pip # Install yt-dlp pip3 install --upgrade yt-dlp # Add the following options to ~/.config/mpv/mpv.conf: # Always allow seeking, e.g. allow seeking within a local cache of HTTP stream force-seekable=yes # Always save the current playback position on exit save-position-on-quit=yes # Load all subs containing media filename sub-auto=fuzzy # Use yt-dlp script-opts=ytdl_hook-ytdl_path=yt-dlp # Make directory structure # MPV will automatically load scripts from ~/.config/mpv/scripts cd ~/.config; mkdir -p mpv/scripts; cd mpv/scripts # Download sponsorblock # Note: other ports for mpv can be found here: # https://github.com/ajayyy/SponsorBlock/wiki/3rd-Party-Ports#mpv-media-player git clone https://codeberg.org/jouni/mpv_sponsorblock_minimal # Open mpv, play a YouTube video # Note: This also works with Invidious links mpv <YOUTUBE VIDEO LINK HERE> [\code] Further reading: > Gentoo wiki article on MPV - https://wiki.gentoo.org/wiki/Mpv#Player_settings > MPV user scripts list - https://github.com/mpv-player/mpv/wiki/User-Scripts

The ProtonVPN app requires systemd, but Devuan Linux doesn't have it. Here's how to use ProtonVPN on Devuan. ## how to install protonvpn on Devuan ## ## open a protonvpn account: https://account.protonvpn.com/signup ## get your OpenVPN/IKEv2 credentials: https://account.protonvpn.com/ [log in] > Account tab > OpenVPN/IKEv2 > get OpenVPN/IKEv2 username and password ## append "+f1" to your username to block malware, or ## append "+f2" to block malware, ads, and trackers ## ## install necessary packages: su - apt install openvpn network-manager-openvpn-gnome resolvconf exit ## ## get the ProtonVPN server config files: https://account.protonvpn.com/ (log in) > left pane > Downloads > OpenVPN configuration files > platform: Linux > protocol: UDP > select "Standard server configs" > scroll to the bottom and click "Download all configurations" > extract the downloaded zip file somewhere permanent. ## ## set up protonvpn using network-manager - right-click the systray internet connection icon - select "Edit connections…" - click "+" to create a new connection - click the list and scroll down to "Import a saved VPN configuration…" - click Create - navigate to a protonvpn server config file - enter your OpenVPN/IKEv2 credentials, and click Save. ## ## establish a protonvpn connection - left-click the systray network connection icon - hover on "VPN Connections" and click the entry of your newly added config ## wait for the popup confirming the successful VPN connection ## ensure the connection is good and there are no leaks: http://ipleak.net/ ## to add more connections, repeat with more server config files ====== ## optional: alternative protonvpn setup using terminal ## make sure the resolv-conf script is enabled: su - wget "https://raw.githubusercontent.com/ProtonVPN/scripts/master/update-resolv-conf.sh" -O "/etc/openvpn/update-resolv-conf" chmod +x "/etc/openvpn/update-resolv-conf" ## navigate to the server config files, and run one: cd /path/to/server-config-files openvpn <config.ovpn> ## enter your root password ## enter your OpenVPN/IKEv2 credentials ## wait for the "Initialization Sequence Completed" message ## keep the terminal window open to stay connected to protonvpn ## close the terminal window or press ^c to end the VPN connection ## ensure the connection is good and there are no leaks: http://ipleak.net/

>>82437 >>82446 Thanks for the contributions. Nice to see some helpful people around.

>>82489 >>82481 >>82474 Rude lainon isn't wrong but that doesn't mean I don't want to see script written by other dear lainons. I myself don't keep any hackjob script that i write in particular high regard and accidentally delete them all the time Here's my contribution to the thread. Useful for setting the CPU governor easily. Just set the max number of cores you have on your computer as MAX_CPU and run the script as "./script.py performance" for high performance mode or "./script.py powersave" for saving power. Pretty self explanatory #!/bin/python import sys CPU_PATH = '/sys/devices/system/cpu/cpu' MIN_CPU = 0 MAX_CPU = 11 print('[!]\tSetting all cores to ' + sys.argv[1]) for i in range(MIN_CPU, MAX_CPU + 1): f = open(CPU_PATH + str(i) + '/cpufreq/scaling_governor', 'w') f.write(sys.argv[1]) f.close() for i in range(MIN_CPU, MAX_CPU + 1): f = open(CPU_PATH + str(i) + '/cpufreq/scaling_governor', 'r') read_gov = f.readline() read_gov = read_gov.replace('\n','') f.close() print('[!]\tCPU' + str(i) + ' -> ' + read_gov) I initially wrote this in shell script but wrote it in python for whatever reason

>>82491 >Rude Being rude is posting soykaf. Anyway, https://wiki.archlinux.org/title/CPU_frequency_scaling#Autonomous_frequency_scaling https://www.kernel.org/doc/html/latest/admin-guide/pm/amd-pstate.html https://www.kernel.org/doc/html/v4.12/admin-guide/pm/intel_pstate.html https://www.kernel.org/doc/html/v4.12/admin-guide/pm/cpufreq.html Don't just blindly set governors it's not gonna work. First read these, figure out what your processor supports then go ahead. If you don't use amd/intel read docs for your specific scaling driver

>>82491 Thanks fpr the contribution, lainon.

>>82434 1. I have been using Ratpoison for a while now. The upstream git repo has a kinda niece example config file that has this line in it: bind a exec ratpoison -d :0.0 -c "echo `date +'%r - %A %n %D - %B'` `cal | tail -n +2 | sed -e 's/^Su/\n\n Su/' -e 's/.*/ & /' -e \"s/\ $(date +%e)\ /\<$(date +%e)\>/\"`" Paste it in your ~/.ratpoisonrc to get a calendar with current date and time. 2. gawk can be used as a simple emergency HTTP web server: https://www.gnu.org/software/gawk/manual/gawkinet/gawkinet.html#PANIC 3. If you use Bash, popd and pushd are very nice. So is ctrl+r 4. Midnight Commander is very cool terminal file manager. You can learn more about it at https://linuxcommand.org/lc3_adv_mc.php If you want trash support you can use libtrash and paste this to your .bashrc/.profile: alias mc='LD_PRELOAD=/usr/lib/libtrash.so mc' 5. Want to (finally) learn Regex? Check out these 2 sites: >https://regexone.com/ >https://regexcrossword.com/ 6. Do you like yt-dlp? -Try gallery-dll! 7. Find out what is using up CPU with PowersHell: Get-Process | Where-Object {$_.cpu -gt 1} | Sort-Object cpu | Select-Object -Last 12 | Format-Table ProcessName,CPU,StartTime 8. Someone made a way to combine RegEx builder and RegEx text replacement on GNU Emacs! >https://karthinks.com/software/bridging-islands-in-emacs-1/ * Another way to do it, is to use visual-regexp.el ... or you can use standard isearch (C-s) and press M-% to get a similar thing. 9. Sysinternals suite is very handy if/when you need to debug Windows problems (tm)

Can't contribute with anything meaningful but something cool that I've recently found out is Xvfb (X virtual framebuffer), it handles all GUI soykaf in virtual memory so you can run the X server without a GPU or a screen

82491 As other lainon said, you can't just write anything to /sys/ Here is the script I use to keep my fans silent. It also throttles the CPU speed when battery runs low. #!/bin/bash minfreq=$(cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq) maxfreq=$(cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq) maxtemp=60000 # in thousandth of °C. K=20 # A constant for the corrector. Adjust if needed. echo "power" | tee /sys/devices/system/cpu/cpu*/cpufreq/energy_performance_preference while true; do bat=$(acpi -b) # Read battery info val=$(cat /sys/class/thermal/thermal_zone0/temp) # Read CPU temperature. # Probably somewhere # else on your system. diff=$(( maxtemp - val )) freq=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq) if echo $bat | grep -q "Discharging" && \ [ $(echo $bat | grep -oP '\d+(?=%)') -le 10 ]; then newfreq=$minfreq else newfreq=$(( freq + diff * K)) fi if [ $newfreq -ge $maxfreq ]; then newfreq=$maxfreq elif [ $newfreq -le $minfreq ]; then newfreq=$minfreq fi for cpufreq_dir in /sys/devices/system/cpu/cpu*/cpufreq; do echo $newfreq > "$cpufreq_dir"/scaling_max_freq done echo $val/$max $newfreq/$maxfreq sleep 5 done

Some interesting stuff being posted. Every little bit helps, including the one-liners. Thanks. Ever wanted to run your own Tor hidden web server? It's easy and free. You can run it on your home computer anonymously without exposing your ip address, Anyone in the world using Tor browser can visit it. Best of all, you don't have to pay for a vps and domain name, of identify yourself to a registrar. ## how to install lighttpd web server as a tor onion service ## 1. install lighttpd su - apt install lighttpd ## verify that lighttpd is running: service lighttpd status ## browse to localhost ## the lighttpd document root is: /var/www/html ## (this is where you put your web page) ## the lighttpd main config file is: /etc/lighttpd/lighttpd.conf ## additional lighttpd config files: /etc/lighttpd/conf-available ## turn lighttpd off or on as desired: service lighttpd stop service lighttpd start ## 2. set up tor onion service for port 80: apt install tor nano /etc/tor/torrc ## append the following two lines to torrc: HiddenServiceDir /var/lib/tor/web/ HiddenServicePort 80 127.0.0.1:80 ## restart tor service tor restart ## retrieve your onion address: cat /var/lib/tor/web/hostname ## browse to the onion address in tor browser

If you're running lighttpd web server and you want visitors to be able to view or download a directory's contents... ## append to /etc/lighttpd/lighttpd.conf server.dir-listing = "enable" ## make a download directory and don't put an index* file in it mkdir /var/www/html/stuff ## copy the desired files to it cp <whatever> /var/www/html/stuff ## restart lighttpd service lighttpd restart ## put a link to it on your web page ## or just tell your visitors to browse to <yoursite>/stuff

How to set up SSH securely ## set up ssh-server ## ## locally, install ssh-server and open a port for it e.g. in ufw su - apt install openssh-server ufw allow 22/tcp exit ## you can do the rest remotely ## note: don't close port 22 remotely or you will be locked out ## ## disable root ssh login and restrict ssh login to whitelisted users: ssh <user>@<ip-address> su - nano /etc/ssh/sshd_config ## ----------------------- PermitRootLogin no Allowusers <user1> <user2> ## ----------------------- service ssh restart ## configure ssh key login: ssh-keygen -t rsa -b 4096 ## (enter an encryption password) ## back it up securely cp -r ~/.ssh </somewhere/very/secure/> ssh-copy-id <user>@<ip-address> ssh <user>@<ip-address> su - nano /etc/ssh/sshd_config ## --------------------- PubkeyAuthentication yes RSAAuthentication yes ## --------------------- exit ## test ssh key login: ssh <user>@<ip-address> ## if ssh key login works, disable password login ## note: if you lose your ssh key, you are locked out ssh <user>@<ip-address> su - nano /etc/ssh/sshd_config ## --------------------- PasswordAuthentication no ## --------------------- exit

## secure ssh port 22 with fail2ban apt install fail2ban ## create /etc/fail2ban/jail.local as follows: ## -------------------------------------------------- [DEFAULT] destemail = <your-email-address> sendername = Fail2Ban [sshd] enabled = true port = 22 [sshd-ddos] enabled = true port = 22 ## -------------------------------------------------- ## restart fail2ban: service fail2ban restart

>>82541 >securely >openssh >usual port 22 >rsa instead of setting up that soykaf, here's a much way of doing it 1. use Dropbear, as it's much smaller, meaning smaller attack surface. Reduced resource usage is another bonus. 2. Don't use a standard port, you'll get assraped by script kiddies scanning 22 24/7. Use a randomly generated port, somewhere inbetween 1024/65536 3. Don't use RSA. It's slow, old, and very resource intensive. Instead, use Ed25519. If your SSH daemon and client supports Ed448 and you want the extra 96 bits of security (Ed2219 is 128 bits, Ed448 is 224) then use that.

>>82544 Thanks for the good suggestions, Lainon. If you see anything else that could be done better, please post again.

#!/bin/sh set -eu pref="${1:-}" value="${2:-}" if [ "$pref" = "" ]; then echo "usage: qvm-set-prefs <preference> <value>" exit 1 fi # Set a pref for every qube for qube in $(qvm-ls --no-spinner --raw-list); do [ "$qube" = "dom0" ] && continue if [ "${value}" = "" ]; then echo "Resetting '$pref' of qube '$qube'" qvm-prefs "$qube" "$pref" --default else echo "Setting '$pref' to '$value' for qube '$qube'" qvm-prefs "$qube" "$pref" "$value" fi done Simple script that allows for quick (re)setting of preferences for all Qubes. To be used in QubesOS.

tip of the day: you can easily update a bunch of git repos with ls | xargs -I{} git -C {} pull

>>82434 There's no reason to use RAID for swap performance reasons. The Linux kernel itself can stripe swapping on several devices, if you just give them the same priority in the /etc/fstab file. A nice /etc/fstab looks like: /dev/sda2 swap swap defaults,pri=1 0 0 /dev/sdb2 swap swap defaults,pri=1 0 0 /dev/sdc2 swap swap defaults,pri=1 0 0 >https://unthought.net/Software-RAID.HOWTO/Software-RAID.HOWTO-2.html#ss2.3 Why would you use swap? >https://chrisdown.name/2018/01/02/in-defence-of-swap.html But note that swap is not that helpful on low-memory conditions because it's too slow! Also, you don't necessarily need swap at all! The only thing that strictly requires it, is suspending on disk. You should encrypt the swap because swap can contain anything from RAM (even sensitive data). You should use HDD for swap because swap can wear down SSD too much., Also, you don't need to reinstall or make new partiion(s) if you want to have swap! You can just make a swapfile! Also, see: >https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption >https://wiki.archlinux.org/title/Zswap >https://wiki.archlinux.org/title/Zram >https://wiki.archlinux.org/title/Swap#Swap_file

>>83177 You should use find -exec for that. For one it allows to filter for directories, and it will also work for directories with linefeeds in their name.

>>82434 Small tips from a recovering youtube/information junkie, maybe this is useful to someone. Can do discord and instagram as well. 1. You can put channels on an RSS feed (most know this) To make a yt feed, go the the channel of your choice, go to page source and ctrl + f for channel/UC and copy the end part onto the end of this link here: https://www.youtube.com/feeds/videos.xml?channel_id= to make a feed link, which you can then put in to .newsboat/urls or wherever else if you use a different reader 2. https://github.com/mps-youtube/yewtube is a terminal client, it's neat but lacks features like hd video, previews and feed that https://github.com/Benexl/yt-x has, but is more comfortable to use imo. There's also https://github.com/pystardust/ytfzf which is just fzf for youtube. You can also just put links into mpv if you have a low-end machine, and fetch subtitles with yt-dlp if needed. Invidious just doesn't work for me 90% of the time and loads really slow. 3. If you find channels with videos that seem interesting or important but are a waste of time otherwise you can take the auto generated transcript and summarize it using AI. Provided you install yt-dlp-transcript with pipx, I have a one-liner bash script for this: grep -oP 'https?://(www\.)?(youtube\.com/watch\?v=|youtu\.be/)[a-zA-Z0-9_-]+' | xargs yt-dlp-transcript | xclip -selection clipboard && firefox-esr (ai website) You can just make it open the browser with the URL or use https://github.com/TheR1D/shell_gpt if you have tokens or host your own LLM. I made it a macro for my newsboat feed using macro v pipe-to "$HOME/script" in the config.

alias top='tput smcup; top; tput rmcup'

If you want to open a sensitive GPG password encrypted file (such as your financial reports), you can temporarily decrypt it to /dev/shm - this is a temporary file system and its contents are stored in RAM and not on the disk. This is better from security standpoint. Example: Open: bash gpg -o /dev/shm/report.txt -d ~/report.txt.gpg && vim /dev/shm/report.txt Save and Close bash gpg -o ~/report.txt.gpg -c /dev/shm/report.txt && rm /dev/shm/report.txt

>>83318 checkout man tmpfs for a better way to get a RAM-only file system with better control. /dev/shm is for interprocess communication so there are some gotchas with it

>>83318 RAM can still be swapped to the disk, so be careful with that.

>>83319 Yes, RAM, and tmpfs can be swapped to disk (if you have swap enabled). If you want to have some files reside on memory and not touch the disk, you can use ramfs although it offers less control. Most importantly, you can't limit its size so a rogue process could easily fill all your memory.

Kids just encrypt your swap it takes 10 seconds to configure on debian/arch and you pretty much never touch it again ever. https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption RAM usage is miniscule.

>>83319 Thanks for the suggestion, lainon >>83324 Correct. If swap is enabled, /dev/shm's contents may get swapped. According to the latest manual it turns out that since kernel 6.4, a 'noswap' flag has been added to tmpfs, enabling the creation of a non-swappable tmpfs. Create (as privileged user or sudo): mount -t tmpfs -o size=50M,noswap tmpfs ~/mytmpfs Destroy (as privileged user or sudo): umount ~/mytmpfs The gpg file open sequence becomes: sudo mount -t tmpfs -o size=50M,noswap tmpfs ~/mytmpfs gpg -o ~/mytmpfs/report.txt -d ~/report.txt.gpg && vim ~/mytmpfs/report.txt Close: [code] gpg -o ~/report.txt.gpg -c ~/mytmpfs/report.txt && sudo umount ~/mytmpfs