Banner message for ssh

Using a pre-authentication banner with ssh can verify identification before a password is entered. This can help prevent leaking passwords. Banners are simple to configure but often disabled in the default configuration.

fail2ban non-root startup

fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure. ‚Äč This procedure is for my servers which use Shorewall to maintain the firewall.

WordPress SSH2 configuration

Instead of the packaged WordPress I run the version provided by WordPress. It is installed using a different userid from the userid the webserver runs as.  To enable updates from the Admin Dashboard, I enabled sftp (ssh). This is how I did it.

init.d for Non-root Processes

When installing third-party applications, they often default to running as root. The server applications for TeamSite/LiveSite are among those. I have applied a simple modification to the init.d scripts that start them as a non-root user. It also allows the scripts to be run by members of an administration group via sudo. This approach applies… Continue reading init.d for Non-root Processes

Geo blocking with tcpwrappers

I recently had an issue with frequent login attempts against one of my services. These were almost all from countries that should not be accessing my service. To resolve the issue I implemented geo-blocking with TCP Wrappers. This is how I went about geo-blocking connections.

Shell Scriptlets

This post will be continually developed. I recently designed some solutions to solve some issues with init.d and setup scripts. These may be of use to others, and I will likely reuse them.

Securing TLS

A StackExchange question on using HAProxy’s capture feature to pass data from TCP mode to HTTP mode prompted me to update my SSL configuration. This was intended to get an A+ rating from SSL Labs by sending non-SNI capable clients to a server with weaker ciphers. This was to enable clients on WinXP/IE8, Java 6,… Continue reading Securing TLS

WordPress Tuning

I’ve done a little tuning to my WordPress setup. To keep up to date, I’ve switched from the Ubuntu installation to a downloaded installation under /opt/wordpress. This is owned by my user and served by Apache running as www-data. Updates are done using the SFTP method.

Tuning Linux CPU Performance

A recent kernel change broke my CPU performance tuning. I have an AMD processor that presents 4 cores to the kernel. The process in this article should work for Intel processors although the governors and CPU settings tree may be different. Different kernels may also have different settings. The current kernel allows setting the governor per… Continue reading Tuning Linux CPU Performance