sysadmin – Page 2 – Jean's Blog

Hardening your OpenSSH Configuration – Do you know about the tool ssh-audit? [updated]

OpenSSH usually comes with a default configuration which provides high compatibility. So even old clients can still connect. However, this compatibility comes at a price because some of the ciphers / algorithms used may be open to vulnerabilities. If you want to strengthen the encryption and get an overview about known vulnarabilities with your OpenSSH Server or Client configuration, ssh-audit is for you.

Block Bogons with Suricata

I believe in my old blog I’ve shown how to block bogons with iptables and later with nftables. Here’s how to do it with Suricata.

Update to Suricata 7 in Debian 12 Bookworm and VirtIO NICs with af-packet in IPS mode

I found a solution to use two VirtIO NICs together with af-packet in Suricata (2). Also I upgraded my suricata to 7 using backports (1)…

Create a suricata rules file using fail2ban

In my last posts I’ve shown a central syslog which feeds fail2ban, suricata as an intrusion prevention system (IPS) and here is the final piece which feeds suricata with the results of fail2ban by creating a .rules file for suricata-update.

Working with suricata

This is a follow up to my last post in which I described how to setup suricata as a IPS which bridges traffic between two interfaces using af-packet (and all that in a virtual machine). Here I’m showing how to work with suricata in general – or rather – how I work with suricata.

Setting up Suricata in Debian Bookworm running in KVM with af-packet as IPS

Suricata is a Network Intrusion Detection and Prevention System as well as a Network Security Monitoring engine. For now I am using Suricata as an IPS and here I’ll show you how to set it up.

Setup a central logging instance (and use it to block traffic using fail2ban)

A very light-weight approach for storing logs centralized is by just using rsyslog. My virtual machines all use rsyslog. That rsyslog sends it’s logs to another internal virtual machine which runs rsyslog as well. A fail2ban instance is checking all these logs and sending a block command to the firewalls. Here is how.

Encrypting existing volumes in ZFS using zfs send and zfs recv

Let’s say you want to encrypt your previously not encrypted data – in my example a ZFS pool. A good way to do so is to simply use zfs send and zfs receive. These commands can be used to transfer ZFS data streams. The procedure is pretty simple. Create a snapshot, transfer this snapshot using zfs send and receive it using zfs receive.

Encryption of ZFS volumes using a remote / external key-system written in PHP

I thought a long time about what security benefits I have if I store the encryption key of a volume on the same system (locally). Let me share some of these thoughts with you. Then I’ll show you my approach using a self-written key-system in PHP (using RedBeanPHP and Sqlite) and finally I’ll show you how to use this with ZFS.

Setting up MinIO in AWS Lightsail

MinIO is a high performance, s3 compatible object storage. I’m using it for some years now. In this article I’ll show you how to setup your own MinIO stack using Amazon Lightsail.