Tag: ubuntu

Posts related to Ubuntu/Debian Linux

Using SSL Keys

I recently updated my SSL keys. Several servers are accessed by keys from a few devices. A common authorized_hosts file was created as a template. This post covers the generation and use of SSL keys.

HTTP2 on Apache2

HTTP2 allows web servers to serve multiple content streams on the same connection. This can reduce server and network load. I have updated my Ubuntu Apache servers to enable HTTP2. After installing the latest Ubuntu release, I needed to redo the switch to the event Multi-Processing Module (MPM) and switch PHP content delivery back to… Continue reading HTTP2 on Apache2

Banner message for ssh

Using a pre-authentication banner with ssh can verify identification before a password is entered. This can help prevent leaking passwords. Banners are simple to configure but often disabled in the default configuration.

fail2ban non-root startup

fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure. ​ This procedure is for my servers which use Shorewall to maintain the firewall.

WordPress SSH2 configuration

Instead of the packaged WordPress I run the version provided by WordPress. It is installed using a different userid from the userid the webserver runs as.  To enable updates from the Admin Dashboard, I enabled sftp (ssh). This is how I did it.

init.d for Non-root Processes

When installing third-party applications, they often default to running as root. The server applications for TeamSite/LiveSite are among those. I have applied a simple modification to the init.d scripts that start them as a non-root user. It also allows the scripts to be run by members of an administration group via sudo. This approach applies… Continue reading init.d for Non-root Processes

Geo blocking with tcpwrappers

I recently had an issue with frequent login attempts against one of my services. These were almost all from countries that should not be accessing my service. To resolve the issue I implemented geo-blocking with TCP Wrappers. This is how I went about geo-blocking connections.

WordPress Tuning

I’ve done a little tuning to my WordPress setup. To keep up to date, I’ve switched from the Ubuntu installation to a downloaded installation under /opt/wordpress. This is owned by my user and served by Apache running as www-data. Updates are done using the SFTP method.

Cookie Consent with Real Cookie Banner