Least Privilege on Linux Servers: Practical Examples
Apply least privilege on a VPS: separate service users, scoped sudo rules, database grants, file permissions, systemd sandboxing, containers and keys.
Blog
Security
Hardening servers and websites: SSH, firewalls, VPNs and encryption.
JWT Explained: How JSON Web Tokens Work and How to Use Them
How JSON Web Tokens work: header, payload and signature, HS256 vs RS256, validating exp, aud and iss, token storage, refresh and revocation, mistakes.
Lynis Security Audit: Check and Harden Your Linux Server
Run a Lynis audit on Ubuntu, Debian or RHEL, read the hardening index, warnings and suggestions, prioritise the fixes that matter, and track progress.
Ransomware Protection for Linux and Windows Servers
Protect Linux and Windows servers from ransomware: common entry points, exposed RDP and databases, immutable backups, least privilege, and recovery.
Fix "ssh: connect to host port 22: Connection refused"
Troubleshoot SSH connection refused and timeout errors: is sshd running, which port, firewall rules, Fail2Ban bans and using the VNC console.
Wazuh: Open-Source Intrusion Detection and SIEM for Your Servers
Monitor Linux servers with Wazuh: manager, indexer and agents, sizing, installing agents, file integrity and log alerts, vulnerability detection, tuning.
SSH Tunnels: Local, Remote and Dynamic Port Forwarding
Use SSH port forwarding to reach private databases and admin panels, expose a local service, or browse through a SOCKS proxy, with safe settings.
Has My Linux Server Been Hacked? Signs and How to Check
Spot a hacked Linux server: unknown processes and users, crypto-miners, odd cron jobs and SSH keys, spam or attack traffic, how to check, what to do.
nftables Tutorial: A Modern Firewall for Linux Servers
Write an nftables firewall from scratch: tables, chains and rules, a complete server ruleset, sets for IP lists, rate limits, NAT, and making it persistent.
Secure Web Hosting on Linux: A Step-by-Step Hardening Guide
Harden a Linux web server layer by layer: OS, SSH, firewall, per-site isolation, Nginx and PHP, HTTPS headers, WAF, backups and monitoring.
rkhunter and chkrootkit: Scan a Linux Server for Rootkits
Install and run rkhunter and chkrootkit, update baselines after upgrades, handle false positives, schedule scans with reports, and respond to detections.
DDoS Attack Types Explained: Volumetric, Protocol and Layer 7
DDoS attacks explained: UDP floods and amplification, SYN floods, HTTP floods and slowloris, what you can mitigate yourself, and when you need upstream help.
How to Set Up a Secure Site-to-Site VPN Tunnel Between Servers
Connect servers or an office network with an encrypted WireGuard tunnel: private addressing, keys, subnet routing, firewall rules and monitoring.
Turn Your VPS into a Private VPN with WireGuard
Set up a personal WireGuard VPN on an Ubuntu or Debian VPS: keys, server and client configs, forwarding and NAT, phone and laptop clients.
How to SSH into Your VPS from Windows, macOS and Linux
Connect to a Linux VPS over SSH from Windows, macOS or Linux: first login, SSH keys, a config shortcut, file transfers and common errors.
Fail2Ban: Install and Configure It to Stop Brute-Force Attacks
Install Fail2Ban on Ubuntu or Debian, protect SSH with jail.local, tune bantime and findtime, add Nginx jails, whitelist IPs and unban addresses.
VPN Servers on Linux: WireGuard vs OpenVPN and How to Set Up Each
WireGuard vs OpenVPN for a Linux VPN server: how they differ, how to set up each securely, and when you need OpenVPN over TCP 443.
Configure Linux Firewall Rules: nftables, UFW and firewalld
Write Linux firewall rules from the CLI: a complete nftables ruleset, UFW and firewalld equivalents, persistence, and safe testing.
Kubernetes Security Basics for Small Clusters (k3s, kubeadm)
Secure a self-managed Kubernetes cluster: API server access, RBAC, pod security standards, network policies, secrets, images, nodes and upgrades.
Disable Root SSH Login and Use a Sudo User Instead
Create a sudo user, copy your SSH key, then disable root login over SSH with PermitRootLogin — safely, with testing steps for Ubuntu, Debian and RHEL.
Fail2Ban for Nginx: Block Bots, Brute Force and Scanners
Protect Nginx with Fail2Ban: HTTP auth failures, bad bots, 404 scanners, login brute force, rate-limit violations, custom filters and safe testing.
Encrypting VPS Traffic: TLS, SSH Tunnels and Private Networks
Encrypt every connection to and from your VPS: HTTPS and modern TLS, encrypted database links, SSH tunnels for admin tools and WireGuard.
How to Protect Your VPS from Port Scans
Port scans hit every server. Audit open ports, firewall by default, bind services to localhost, harden SSH, and rate-limit connections.
Custom Firewall Rules for Your VPS: Practical UFW Recipes
Practical UFW rules for real servers: allow by IP, rate-limit SSH, port ranges, CDN-only web access, per-interface rules, logging and Docker.