Secrets Management on a VPS: Passwords, API Keys and .env Files
Store secrets safely on servers: .env permissions, keeping secrets out of Git, systemd credentials, Docker secrets, SOPS and Vault, rotation and leaks.
Blog
Security
Hardening servers and websites: SSH, firewalls, VPNs and encryption.
GPG Encryption on Linux: Encrypt Files and Backups with gpg
Use GnuPG on servers: create keys, encrypt files for a recipient or with a passphrase, encrypt backups before upload, sign and verify files safely.
Create a Self-Signed SSL Certificate with OpenSSL
Generate a self-signed certificate with SANs using openssl, use it in Nginx or Apache, trust it on clients, and know when a public or private CA is better.
Configure TLS 1.2 and 1.3 in Nginx and Apache (Modern Settings)
Secure TLS on Nginx and Apache: TLS 1.2 and 1.3 only, cipher suites, OCSP stapling, session settings, HTTP/2, and testing with openssl and SSL Labs.
Two-Factor Authentication for SSH with Google Authenticator
Add TOTP two-factor authentication to SSH on Ubuntu or Debian with libpam-google-authenticator, combine it with SSH keys, and keep a safe way back in.
Automatic Security Updates on a Linux VPS
Install security updates automatically on Ubuntu, Debian, AlmaLinux and Rocky with unattended-upgrades or dnf-automatic, alerts and reboots.
SSH Certificates: Scale SSH Access Without authorized_keys Sprawl
Use OpenSSH certificates: create a user CA, sign keys with principals and expiry, trust the CA on servers, host certificates to end TOFU prompts, revoke.
Linux Password Policy: Length, Complexity and Lockout with PAM
Enforce strong Linux passwords with pam_pwquality, set ageing in login.defs and chage, lock accounts after failed logins with pam_faillock, follow NIST.
HSTS Explained: Force HTTPS with Strict-Transport-Security
What HSTS does, adding Strict-Transport-Security in Nginx and Apache, choosing max-age, includeSubDomains and preload, the risks, and a safe rollout.
Get Notified on Every SSH Login (Email, Telegram, Slack)
Get an alert whenever someone logs in via SSH: a PAM hook script with email, Telegram or webhook notifications, user and IP details, no alert fatigue.
Fail2Ban for WordPress: Stop wp-login and XML-RPC Brute Force
Block WordPress brute force at the firewall: log failed logins with WP fail2ban, add Fail2Ban jails for wp-login.php and xmlrpc.php, test, avoid false bans.
The 3-2-1 Backup Rule for Servers: A Practical VPS Backup Plan
Apply the 3-2-1 backup rule to a VPS: what to back up, off-site and immutable copies, restic, Borg and rclone, retention, encryption and restore tests.
API Security Best Practices: Auth, Rate Limits and Validation
Secure a REST or GraphQL API: HTTPS, tokens, object-level authorization, input validation, rate limiting, CORS, logging and the OWASP API Top 10.
Install CrowdSec: Collaborative Protection for Linux Servers
Install CrowdSec on Ubuntu or Debian, add a firewall bouncer, enable collections for SSH and Nginx, read decisions and alerts, and whitelist your own IPs.
WordPress Malware Removal: Clean a Hacked Site on Your VPS
Clean a hacked WordPress site: back up, find injected code and web shells, replace core and plugins, check the database and users, rotate secrets.
Disable SSH Password Login: Key-Only Authentication Safely
Switch SSH to key-only login without locking yourself out: add and test keys, set PasswordAuthentication no, handle cloud-init overrides, verify.
SMTP Security: TLS, Authentication and Anti-Abuse for Mail
Secure a Postfix mail server: STARTTLS and implicit TLS ports, certificates, SASL auth only over TLS, no open relay, rate limits, MTA-STS and testing.
OAuth 2.0 and OpenID Connect Explained (for Developers)
OAuth 2.0 and OIDC for developers: roles, authorization code flow with PKCE, client credentials, access vs ID vs refresh tokens, scopes, common mistakes.
Security Monitoring for Linux Servers: What to Watch and Alert On
Security monitoring for a VPS without a SOC: the signals that matter, login and sudo alerts, file integrity, outbound traffic, central logs, and tools.
Install ClamAV on Linux: Scan for Malware on Your Server
Install ClamAV on Ubuntu, Debian or RHEL, update signatures with freshclam, scan web roots and uploads, schedule scans, and know its limits.
SSH Config File: Host Aliases, Keys, Ports and Jump Hosts
Use ~/.ssh/config to connect with short aliases, set users, ports and keys per host, use wildcards, jump hosts, keepalives, multiplexing and port forwarding.
Content Security Policy (CSP): Set It Up Without Breaking a Site
Stop XSS with a Content-Security-Policy header: key directives, nonces and hashes, report-only mode, CSP in Nginx and Apache, and a gradual rollout.
SSH with a YubiKey or FIDO2 Key: Hardware-Backed SSH Logins
Protect SSH keys with a hardware security key: ed25519-sk keys, touch to log in, resident keys for new machines, server requirements, backup keys.
What Is a WAF? Web Application Firewalls Explained
How a web application firewall works, what it blocks (SQLi, XSS, bots), WAF vs network firewall, cloud vs self-hosted options, and its limits.