SSH allows you to restrict access to the server only to users in a certain group. Without being its members, other users will not be able to log in to the server via ssh. This is a convenient opportunity to issue access rights only to those users who really need it.
Backup to Yandex.Disk via davfs
Backup is an important task that needs to be performed on any server where important data is located. It can be solved by various methods. For large systems, this is the appropriate software that can create backups without noticeable server latency.
Basic iptables configuration
One of the priorities after installing the system is to correctly configure iptables to filter traffic. The default policy allows everything that is not prohibited. This is not the most successful method in terms of security, because in this mode the server is exposed to intruders.
You can, for example, scan the ports open on the server. Based on this, it is possible to determine the services used, their version, the name and version of the operating system. Next - the selection of vulnerabilities to them. Or some icmp - messages can give extra information.
How to hide the fact of using nginx on the server
Once I read an article where it was said that you can hide the fact of using nginx on the server. To do this, you need to edit the source code of the ngx_http_header_filter_module module and change the lines
static char ngx_http_server_string [] = "Server: nginx" CRLF; static char ngx_http_server_full_string [] = "Server:" NGINX_VER CRLF;
But in order to rebuild nginx from source, you need to have some knowledge.
However, there is a simpler method that does not require any special actions at all, such as editing source codes and recompiling.
Fix Directory / tmp to fix anyway
On a long-running system, it became necessary to allocate / tmp into a separate section in order to prohibit the execution of files and limit the size in case of overflow.
Using nginx http_referer_module to protect the admin site from brute force
While reading the nginx web server documentation, I came across an interesting module called http referer module . It allows you to block access to the site, or its sections, if the request does not have the correct referer header.
This module can be used to protect the admin of any site from brute force. For example, the site works on WordPress, but blocking access by ip will be inappropriate if the site has registered users. They also need to authenticate, and collecting their ip is a meaningless exercise. :)
Simple file change tracking
In the case of a server hacking, a hacker can modify the files in order to leave some backdoor, shell, etc. The modified files could be tracked by the modification date, but this date can be easily forged through the touch utility.
(Further…)
How to create a certificate request for csr and key
A certificate request and key are required to obtain an ssl certificate and then install it on a www, mail or jabber server. (Further…)
Installing apache and php on debian
Certain content management systems do not work with the nginx and php-fpm combination , and require an apache web server with the php module. The most common reason for this is the need to use the rewrite module for the site to work.
Restricting access to wp-login by ip in nginx
Recently, fail2ban has ceased to protect normally from brute force on wordpress , because ip is unique in every request and blocking every address is meaningless.
Since such nonsense, I decided to restrict access to the wp-login.php file by ip. There is one nuance here: for the location specified in the nginx configuration file, you need to add a script handler when using php-fpm .
As a result, the design looks like this: (more ...)