Modern(er) version of https://infosec.mozilla.org/guidelines/openssh configuration, including post-quantum algorithms.
Example usage:
./sshd_hardening.sh | tee /etc/ssh/sshd_config.d/sshd_hardening.conf
rc-service sshd restart || service sshd restart || systemctl restart sshdCheck the current runtime sshd config to make sure that the hardening is effective:
Using the Rescue environment, we can mount or partition the VM disk.
Let's say the VM disk is "/dev/vda". It's recommended to wipe the disk before continuing with wipefs -a /dev/vda
Rescue environments usually have limited disk space, so we copy the disk image via SSH
and use dd to directly write it to the VM disk.
The cloud image doesn't have a password set by default, which prevents us from logging in. Therefore, we must first prepare the image by mounting it locally and setting a password inside chroot.
All you need to know in one place.
Table of contents:
TL;DR: This extension for Chrome and Brave is malicious, do not use it.
(Update) A follow up story by Wladimir Palant: https://palant.info/2024/10/30/the-karma-connection-in-chrome-web-store/
(Update 2024-11-11) The extension has been removed from CWS and marked as violating Chrome Web Store policies (which is good, but odd, as it should be marked as malware)
This setup allows restrictive chmods, which prevents users for reading the conents of each others directories and provides a layer of security against reading raw PHP code in case of FPM failure. You can set chmod 600 for all .php files and chmod 640/710 for any other static files/dirs.
certbot certonly -d example.com
useradd -m -d /home/example -s /bin/bash example
usermod -a -G nginx example
su - example -c "mkdir ~/www"
chmod 710 /home/example
chmod 710 /home/example/www
su - example -c "echo '' > ~/www/index.php"
OS Setup: Linux (any), Postfix as a forwarder
Depends on: nodejs + AuroPick/epic-free-games
It's best to run cron once every 2-3 days, so as not to miss the release time window. The script compares with the last run to avoid sending duplicate emails.
Table of Contents
WARNING: It's a draft. It doesn't cover security, permissions and other stuff.
Tested on Alpine Linux v3.20 / Observium CE 24.4
Derived from https://docs.observium.org/install_debian/
A python script solution to whitelist an IP address in iptables resolved with Mikrotik DDNS service (or any other).
In this example I have whitelisted Mikrotik DDNS IP to allow access to SSH and OpenVPN ports.
The script is scheduled in crontab to run every minute. It will resolve Mikrotik DDNS domain, flush the iptables WHITELIST chain and add the IP address if it changed.
WARNING: flashing the new BIOS can brick your laptop, DON'T do it if you don't know what you're doing or just for the sake of having the latest firmware. Make sure you actually need it and that both your laptop's power AC adapter is plugged in and the battery is fully charged.
If you've got one the ideapad gaming 3 laptops you might face the problem with updating the BIOS, if your model isn't covered via fwupd.
There are ways to workaround it with some crazy shit magic tools, but the safest way is just use the Windows environent in the absence of a BIOS update file for Linux.