Banner message for ssh

Using a pre-authentication banner with ssh can verify identification before a password is entered. This can help prevent leaking passwords. Banners are simple to configure but often disabled in the default configuration.

fail2ban non-root startup

fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure. ​ This procedure is for my servers which use Shorewall to maintain the firewall.

init.d for Non-root Processes

When installing third-party applications, they often default to running as root. The server applications for TeamSite/LiveSite are among those. I have applied a simple modification to the init.d scripts that start them as a non-root user. It also allows the scripts to be run by members of an administration group via sudo. This approach applies… Continue reading init.d for Non-root Processes

Implementing DKIM with Exim

This article was updated in February 2014 to reflect changes in policy and reporting options. The earlier ADSP (Author Domain Signing Practices) information has been removed. DomainKeys Identified Mail (DKIM) provides a method to confirm the origin of an e-mail. DKIM also provides some protection against tampering. Unlike SPF, this validation applies to the contents… Continue reading Implementing DKIM with Exim

Cfengine 2 for Debian and Ubuntu

Cfengine is a declarative system configuration tool. This helps apply standards to system configuration. The configuration files specify the desired configuration and the engine applies these specifications to the system.  It is useful to: Distribute configuration files; Install standard packages (including on Debian and Ubuntu with code provided here); Cleanup old files; and Ensure certain programs… Continue reading Cfengine 2 for Debian and Ubuntu