SSL/TLS Explained: How HTTPS Encryption and Certificates Work
How TLS works in plain terms: the handshake, certificates and chains of trust, CAs, DV vs OV vs EV, SNI, TLS versions, and what HTTPS does not protect.
Blog
Security
Hardening servers and websites: SSH, firewalls, VPNs and encryption.
Suricata IDS on Linux: Detect Network Attacks on Your Server
Run Suricata as a network IDS: choose the interface, load Emerging Threats rules with suricata-update, read eve.json alerts, tune, and consider IPS mode.
firewalld Guide for AlmaLinux, Rocky Linux and RHEL
Manage firewalld with firewall-cmd: zones, services and ports, runtime vs permanent rules, rich rules for IP limits, port forwarding and IP sets.
Run a Private Certificate Authority with step-ca (ACME, mTLS)
Run a private CA with step-ca: root and intermediate setup, issuing certificates, automatic renewal via ACME, mutual TLS between services, trusting the root.
Patch Management for Linux Servers: CVEs, Updates and Reboots
Keep Linux servers patched: how CVEs and severity scores work, which updates matter, automatic security updates, restarting services, app dependencies.
OpenSSL Commands Cheat Sheet for Certificates and Keys
Practical OpenSSL commands: keys and CSRs, self-signed certificates, inspect and verify certificates, test TLS servers and convert formats.
AIDE File Integrity Monitoring: Detect Changed System Files
Install AIDE, build the baseline database, run daily checks, read the change report, update after legitimate changes, and protect the database.
Password Managers for Teams: Self-Hosted vs Cloud Options
Choose a team password manager: Bitwarden, Vaultwarden, 1Password, Passbolt and KeePassXC compared, self-hosting on a VPS, sharing, SSO and backups.
iptables Tutorial: Linux Firewall Rules Explained
Learn iptables: tables, chains and targets, a safe default-deny ruleset, allowing services, rate limits, NAT, port forwarding and saving rules.
How to Secure SSH on Debian: Keys, Config Hardening and Fail2ban
Harden SSH on Debian: key-only login, no root, allowed users, modern algorithms, Fail2ban, optional port change and 2FA — without lockouts.
Docker Security Best Practices for Servers (2026 Checklist)
Run Docker safely: non-root containers, minimal images, image scanning, no exposed daemon, the UFW port bypass, read-only filesystems, secrets, updates.
Linux Server Hardening Checklist: 25 Steps for a Secure VPS
A practical Linux server hardening checklist: updates, SSH, users, firewall, services, file permissions, logging, backups, monitoring and app-level security.
Log sudo Commands on Linux: Who Ran What as Root
Where sudo logs on Ubuntu, Debian and RHEL, a dedicated sudo log file, full session recording with log_input and sudoreplay, and central logging.
Cloudflare WAF Custom Rules: Practical Examples for Your Site
Cloudflare custom WAF rules on the free plan: challenge countries, protect wp-login and xmlrpc, stop bad bots, rate limit, allow your IPs, lock the origin.
How to Change the SSH Port on Linux Without Locking Yourself Out
Change the SSH port safely on Ubuntu, Debian, AlmaLinux and Rocky: sshd_config, systemd socket activation, firewall rules, SELinux and testing first.
Brute-Force Attack Protection for Servers: SSH, Web and Mail
Defend a VPS against password guessing and credential stuffing: key-only SSH, Fail2Ban and CrowdSec, web login limits and CAPTCHA, MFA, mail auth.
ModSecurity with Nginx: Install a WAF and the OWASP Core Rule Set
Add a WAF to Nginx with ModSecurity v3 and the OWASP CRS: install the connector, run in detection mode, tune false positives, then switch to blocking.
VPN vs Proxy: Differences, Use Cases and Self-Hosting on a VPS
VPN vs proxy: what each encrypts and routes, HTTP vs SOCKS5, WireGuard and OpenVPN, privacy limits, performance, and self-hosting either on a VPS.
UFW Firewall on Ubuntu: Setup Guide and Common Rules
Configure UFW on Ubuntu and Debian: safe defaults, allow SSH first, open ports, restrict by IP, rate limit, delete rules and the Docker caveat.
auditd on Linux: Log Who Changed What on Your Server
Set up auditd: watch files like /etc/passwd and sshd_config, log commands run as root, search with ausearch, report with aureport, and persist rules.
Zero Trust Networking for Small Teams: A Practical Guide
Zero trust beyond the buzzword for small teams: identity-based access, no public admin ports, mesh VPNs, access proxies and short-lived credentials.
LUKS Disk Encryption on Linux: Encrypt a Disk with cryptsetup
Encrypt a data disk with LUKS2 and cryptsetup: format, open and mount, unlock at boot with a key file or passphrase, back up keys, and know what it protects.
Fix "Permission denied (publickey)" SSH Errors
Fix SSH Permission denied (publickey): debug with ssh -v, check key files, authorized_keys permissions, users, sshd settings, SELinux and key algorithms.
Port Knocking: Hide SSH Behind a Secret Sequence (knockd)
What port knocking is, setting up knockd with UFW or iptables to open SSH after a secret knock sequence, client usage, limitations, better alternatives.