Tag: security

DDoS mitigation for self-hosters: Nginx rate limiting, Fail2ban, Cloudflare free tier, CrowdSec, and iptables tricks that actually work.

Harden SSH properly: disable password auth, switch to Ed25519 keys, configure sshd_config, set up SSH certificates with step-ca, add 2FA, and configure ProxyJump for bastion hosts.

Why trust a cloud with your passwords? Compare Vaultwarden and Bitwarden self-hosted, lightweight vs full-stack, Docker setup, backups, and which one to actually run.

Proxychains-ng, Tor, and VPN+Tor combos tested honestly: which setups actually anonymize traffic and which are security theater you should stop trusting.

auditd logs every system call, file access, and command run on your Linux server. Learn ausearch, aureport, and how to write audit rules that catch it.

One syntax error in /etc/sudoers locks everyone out of root. Use visudo, read the syntax properly, avoid the common mistakes, and know what NOPASSWD gives.

Incomplete chains, bundles in the wrong order, and self-signed certs all read as untrusted. Diagnose with openssl s_client, then rebuild the chain properly.

Certificates expire silently and take the site with them. Check expiry with openssl, automate the check with cron or Uptime Kuma, and audit every cert.

Firewall rules are evaluated top-down, first match wins. One misplaced ALLOW rule above your denials silently defeats all your security. Here's the fix.

Understand sticky bit, setuid, and setgid: what they do, how to set them, security implications, and real-world use cases.

Verify fail2ban is protecting you: check jails, test bans, monitor logs, common misconfiguration, and unban IPs when needed.

SSHFS mounts remote filesystems over SSH so you can browse and edit files locally, faster than scp for interactive work.