Systemajik: Building software better.
Adding sa-exim to Exim
Until now I have been using SpamAssassin using the spam content scanning built into Exim. This gives me detailed control over what happens to messages. However, I decided I wanted to review the messages that are rejected. Looking at my options sa-exim appeared to be a simple solution. I found it was as simple as…
Using SSL Keys
I recently updated my SSL keys. Several servers are accessed by keys from a few devices. A common authorized_hosts file was created as a template. This post covers the generation and use of SSL keys.
HTTP2 on Apache2
HTTP2 allows web servers to serve multiple content streams on the same connection. This can reduce server and network load. I have updated my Ubuntu Apache servers to enable HTTP2. After installing the latest Ubuntu release, I needed to redo the switch to the event Multi-Processing Module (MPM) and switch PHP content delivery back to…
Securing Submisssion on Exim
I noticed a significant increase in the number of hosts attempting to authenticate to my Exim submission ports (465 and 587). As a result, I have implemented a number of security measures. These measures have effectively blocked the attempts. This post outlines the main measures that I have implemented. This includes ACLs and fail2ban blacklisting.
Banner message for ssh
Using a pre-authentication banner with ssh can verify identification before a password is entered. This can help prevent leaking passwords. Banners are simple to configure but often disabled in the default configuration.
Securing Content with Headers
There are a number of methods to attach a web site and its viewers’ browsers. Many of these have simple fixes that can be applied in the Apache configuration file. This article presents some of the headers that can be applied
fail2ban non-root startup
fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the…
Understanding Covid-19 Statistics
Gathering statistics about communicalbe diseases is difficult. The best available statitics are rarely complete or current. This articile discusses some of the issues related to reporting Covid-19 statics
WordPress SSH2 configuration
Instead of the packaged WordPress I run the version provided by WordPress. It is installed using a different userid from the userid the webserver runs as. To enable updates from the Admin Dashboard, I enabled sftp (ssh). This is how I did it.