Let’s say you need to configure mTLS for communication between two servers, for example, for requests from a website to an API server.
Continue reading “How to set up mTLS”Category Archives: Security
Zabbix: Monitoring Directory Permission Changes
Let’s say you’ve specified the rights and owner for a specific directory and want to ensure no one changes them. To do this, we’ll monitor it using Zabbix-agent.
Continue reading “Zabbix: Monitoring Directory Permission Changes”Setting up Cloudflare proxy
Even with a free plan, Cloudflare proxy allows you to filter some bot traffic, especially if you enable Bot Fight mode and other security and vulnerability blocking features. Cloudflare proxy also allows you to hide the real IP address of your web server.
Setting up open_basedir
I strongly recommend configuring the open_basedir parameter, which lists directories beyond which PHP scripts cannot traverse, as open_basedir is not specified by default.
If open_basedir is not specified on the web server, then, for example, Path Traversal vulnerabilities can lead to access to all files on the server that have “read by others” permissions, such as /etc/, /var/, and other directories.
File integrity check script (SHA-256 hashes)
I’ll give an example of a Python script that calculates the SHA-256 hashes of all files in a specified directory and sends an email with a list of files that have changed, been created, or been deleted, and also writes to the log file.
Continue reading “File integrity check script (SHA-256 hashes)”Sending Fail2ban email notifications
In this article, I will show an example of setting up Fail2ban email notifications.
Continue reading “Sending Fail2ban email notifications”How to configure HSTS in Nginx
HSTS (HTTP Strict Transport Security) is a response header that tells the browser that the site should only be opened via HTTPS.
Continue reading “How to configure HSTS in Nginx”Juniper. Port Blocking Filter
I will give an example of blocking SMTP port 25 TCP so that users cannot send spam to servers, that is, they cannot make an outgoing connection to the destination port 25 TCP, instead they can make a connection to ports with authorization and encryption, for example 465 or 587.
Continue reading “Juniper. Port Blocking Filter”Installing GeoIP in Apache2
I was once asked to block some countries on a web server running Apache2 and Ubuntu Server 20.04.
Continue reading “Installing GeoIP in Apache2”Nginx. Using the map module
Once I needed to additionally keep a log of 404 requests in a separate file, with subsequent export via rsyslog to a mysql database and processing by scripts.
Continue reading “Nginx. Using the map module”