Category: System Administration
Securing TLS
A StackExchange question on using HAProxy’s capture feature to pass data from TCP mode to HTTP mode prompted me to update my SSL configuration. This was intended to get an A+ rating from SSL Labs by sending non-SNI capable clients to a server with weaker ciphers. This was to enable clients on WinXP/IE8, Java 6,…
WordPress Tuning
I’ve done a little tuning to my WordPress setup. To keep up to date, I’ve switched from the Ubuntu installation to a downloaded installation under /opt/wordpress. This is owned by my user and served by Apache running as www-data. Updates are done using the SFTP method.
Tuning Linux CPU Performance
A recent kernel change broke my CPU performance tuning. I have an AMD processor that presents 4 cores to the kernel. The process in this article should work for Intel processors although the governors and CPU settings tree may be different. Different kernels may also have different settings. The current kernel allows setting the governor per…
Adding SHA-2 to tinyca
Google has announced a sunset for SHA-1 certificate signatures in Chrome. SHA-2 (aka SHA-256, SHA-384, and SHA-512) is the remaining option for certificate signatures. I decided to upgrade my certificates to SHA-2 (256 bits). However, when I tried to use tinyca2 to generate a SHA-2 certificate, I found it was not supported. As tinyca2 is…
Providing IPv6 DNS resolver data with radvd
How to provide DNS server addresses to IPv6 clients using Router Announcements.
Setting Up BackupPC on Windows
Back up Windows PCs and Laptops using BackuPC. Includes installing rsycnd on Windows.
Setting Up BackupPC on Ubuntu
Set up a BackupPC Server on Ubuntu. Includes configuration of Linux and OpenWrt clients using rsyncd.
Implementing IPv6 Part 2
Replacing 6to4 tunnel with 6in4. IPv6 enabling Bind, Exim, SPF, Squid, and updating Databases containing IP addresses.
Transparent Squid Proxy
Over the holidays, I had a user experience and attempted browser hijacking. It appeared to have bypassed my squid proxy. My updated configuration now sends all web access via squid. The old firewall rules, that allowed direct access to the Internet, have been replaced with a transparent Squid proxy. This runs on my existing Squid Proxy using another port.