https://raymii.org/s/tags/security.xml RSS feed for tag security on Raymii.org https://raymii.org/s/tutorials/Safely_expose_the_Kubernetes_Dashboard_in_Traefik_k3s_via_a_ServersTransport.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Safely_expose_the_Kubernetes_Dashboard_in_Traefik_k3s_via_a_ServersTransport.html I'm using the Headlamp dashboard for my [high-available local kubernetes cluster](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html) because I find that to be faster, more clear and useful than the full blown Kubernetes Dashboard. In [my first article](/s/tutorials/My_First_Kubernetes_k3s_cluster_on_3_Orange_Pi_Zero_3s_including_k8s_dashboard_hello-node_and_failover.html#toc_4) I accessed the dashboard via a local port forward. This article documents how to expose the dashboard via an `Ingress` and some `Traefik` specific `annotations`. The dashboard helm chart sets up HTTPS internally, `Traefik` does not like that by default. Most of the time, all internal cluster communication is insecure (I'm not sure why, seems to be a bad idea). A few of the guides online suggest disabling HTTPS for the dashboard internally or, for the k3s specific case, disabling HTTPS validation entirely. Both of those are too broad for my use case, so I decided to figure out how to make `Traefik` talk to the `kubernetes-dashboard-kong-proxy` via `https`, without disabling certificate validation. Tue, 11 Mar 2025 22:11:00 GMT Tue, 11 Mar 2025 22:11:00 GMT https://raymii.org/s/tutorials/Password_protect_web_services_in_Kubernetes_k3s_traefik_with_basic_auth.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Password_protect_web_services_in_Kubernetes_k3s_traefik_with_basic_auth.html Now that I have a [high-available local kubernetes cluster](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html) and am [experimenting with deploying apps](/s/snippets/Using_nodeSelector_to_deploy_a_Kubernetes_Helm_chart_only_on_x86_or_amd64_nodes_not_arm64.html), it's also time to look into securing those apps using certificates and passwords. In this case I'm going to set up password authentication, like a `.htaccess` file in `Apache2`, to protect the `Longhorn` dashboad, which by default requires no authentication. This means deploying an `Ingress`, a `Middleware` and a `Secret`. Mon, 15 Jul 2024 20:11:00 GMT Mon, 15 Jul 2024 20:11:00 GMT https://raymii.org/s/software/Which_Root_Certificates_Should_You_Trust_CertInfo.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/software/Which_Root_Certificates_Should_You_Trust_CertInfo.html Which Root Certificates should you trust? Did you know that any certificate authority can issue a certificate for any website? There are protocols in place so that should not happen, but when (not if, when) they get hacked or coerced by their government, they can issue a certificate to intercept secure communication for any website. I've made an open source program, [CertInfo](https://github.com/raymiiOrg/certinfo) that analyzes your browser history and queries all visited domains for their certificates. It presents a list of used root certificates (meaning, a website you visited was ultimately signed by that root CA) and a list of unused root certificates (meaning, no website in your analyzed history was signed by that root CA). Mon, 01 Jan 2024 09:00:00 GMT Mon, 15 Jan 2024 22:03:00 GMT https://raymii.org/s/blog/I_enforced_the_AGPL_on_my_code_heres_how_it_went.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/I_enforced_the_AGPL_on_my_code_heres_how_it_went.html Five years ago I made a website that allowed you to put in a few domains and get an email when the SSL certificate was about to expire. No ads, no fuss, just an easy way for people to keep tabs on their sites without setting up their own monitoring like Nagios. As with all of my software, I released it under the AGPL due to it being web based software. Recently I found a company that hosted certificatemonitor, with some modifications (branding and a dutch tanslation), without any reference to its origin, no source code provided and no mention of the license. In this article I'll talk about what I did to enforce the license and how it went. TL;DR, not as expected. The company responded timely and friendly, but did a half assed attempt (added a link to my site with 'Inspired By Remy' as the text), then after my complaints, took down the entire site. Tue, 20 Oct 2020 00:00:00 GMT Mon, 28 Feb 2022 00:00:00 GMT https://raymii.org/s/blog/OpenVMS_reset_SYSTEM-password.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/OpenVMS_reset_SYSTEM-password.html This short post shows you how to reset the SYSTEM account password on a single OpenVMS 8.4 ALpha machine via the serial console. You need physical access to the machine and the procedure looks a lot like linux and appending `init=/bin/bash` to the GRUB commandline to boot into single user mode. It is tested on the AXPbox Alpha emulator, I forgot my password after not using it for a month. Wed, 03 Feb 2021 00:00:00 GMT Wed, 03 Feb 2021 00:00:00 GMT https://raymii.org/s/blog/Ubuntu_Snap_auto_updates_broke_my_development_setup.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/Ubuntu_Snap_auto_updates_broke_my_development_setup.html After updating-by-reinstall to Ubuntu 20.04, I installed CLion via snap since that seemed more convinient than manually downloading a java installation. CLion is the best thing since sliced bread, or I mean a C/C++ IDE by JetBrains. Ubuntu snap is a packaging system made by Canonical and pushed hard in Ubuntu. Today I found out the hard way that snap auto-updates and that there is no way to turn that off permanently. CLion was updated, which I noticed because the process was killed. The update broke several key plugins for my workflow and the theme was weird. In this article I'll discuss my disgust, I as the owner of the computer want to be in full control, not some developer that decides I need auto updates. I ended up removing snap completely, and my next install will not be Ubuntu due to this. Sat, 01 Aug 2020 00:00:00 GMT Sun, 02 Aug 2020 00:00:00 GMT https://raymii.org/s/blog/The_twitter_bitcoin_hack_can_happen_anywhere_humans_are_involved.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/The_twitter_bitcoin_hack_can_happen_anywhere_humans_are_involved.html The recent twitter hack involved social engineering and access to the twitter backend. This opinion piece will show you that this sort of incident can happen everywhere as long as humans are involved. Everywhere there are manual actions or admin / backend panels, this can happen. Pay a support-slave enough and they'll delete an account 'by accident'. Or a rougue sysadmin that disables logging, does something horrible and enables logging again. I'll show you that there is no one size fits all solution. Or at least, not a single fix for all. Treating your employees well, educatingthem on risks and automating as much as possible will get you a long way. Fri, 31 Jul 2020 00:00:00 GMT Fri, 31 Jul 2020 00:00:00 GMT https://raymii.org/s/blog/I_had_to_jailbreak_my_iPhone_to_change_the_default_browser.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/I_had_to_jailbreak_my_iPhone_to_change_the_default_browser.html The title of this article says enough. To change the default browser on an iOS device you need to jailbreak your device (root it). It's 2020 and Apple does not allow you to switch Safari with Firefox. Recently a new jailbreak for iOS was released which support the lastest firmware, 13.5. I currently have an iPhone SE 2020 running 13.5, the jailbreak was a welcome addition to fix some small and some big annoyances with iOS. Like switching to Firefox as default browser. This post contains both a small rant on the state of iOS as wel as links to the jailbreak and applications used to switch the default browser. Sun, 24 May 2020 00:00:00 GMT Sun, 24 May 2020 00:00:00 GMT https://raymii.org/s/tutorials/Wireguard_VPN_on_Freedombox.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Wireguard_VPN_on_Freedombox.html This guide will show you how to set up a personal Wireguard VPN server on Debian or Ubuntu with Freedombox. Freedombox will be used to manage the VPN software, firewall and users. Wireguard is a relatively new VPN built in to the linux kernel. Freedombox is a long running project under the Debian umbrella providing a private server for non experts with focus on user freedom, ease of use and privacy. Combined, those two make a great pair. In the past I've written many articles on how to setup your own personal VPN server, but those all required manual setup and maintenance. With freedombox, the updates are automatic and the management is hidden away behind a convenient web interface. Mon, 03 Feb 2020 00:00:00 GMT Mon, 03 Feb 2020 00:00:00 GMT https://raymii.org/s/tutorials/Installing_Freedombox_On_Armbian_On_The_Olimex_A20_Pioneer.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Installing_Freedombox_On_Armbian_On_The_Olimex_A20_Pioneer.html FreedomBox is a private server for non-experts: it lets you install and configure server applications with only a few clicks. It runs on cheap hardware of your choice, uses your internet connection and power, and is under your control. Last year the Pioneer became available, officially supported and sanctioned by the Freedombox Foundation. This is a home server you can buy from Olimex, comes in a nice metal case with a proper power supply, network cable, battery and SD card preloaded with Freedombox. Plug in and go. Perfect for users that don't want to tinker but do want their freedom and control. With the Pioneer, both the hardware and software are fully open source. In the default provided distribution for the Pioneer there are a few things I dislike. This guide covers the installation of Freedombox and Debian for the Olimex A20 Lime2 Pioneer with Armbian including reinstalling, Apache SSL certificate and LDAP issues. Wed, 29 Jan 2020 00:00:00 GMT Wed, 29 Jan 2020 00:00:00 GMT https://raymii.org/s/tutorials/nginx_1.15.2_ssl_preread_protocol_multiplex_https_and_ssh_on_the_same_port.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/nginx_1.15.2_ssl_preread_protocol_multiplex_https_and_ssh_on_the_same_port.html The NGINX blog recently had a nice article on a new feature of NGINX 1.15.2, $ssl_preread_protocol. This allows you to multiplex HTTPS and other SSL protocols on the same port, or as their blog states, 'to distinguish between SSL/TLS and other protocols when forwarding traffic using a TCP (stream) proxy'. This can be used to run SSH and HTTPS on the same port (or any other SSL protocol next to HTTPS). By running SSH and HTTPS on the same port, one can circumvent certain firewall restrictions. If the session looks like HTTPS, nginx will handle it, if it looks like something else, it will forward it to the configured other program. I used to use SSHL to get this functionality, but now it's built into the nginx webserver. This small guide will cover the installation of the latest version of nginx on Ubuntu (16.04) and configuring this multiplex feature. Mon, 06 Aug 2018 00:00:00 GMT Sun, 12 Jan 2020 00:00:00 GMT https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html This tutorial shows you how to set up strong SSL security on the Apache2 webserver. We do this by updating OpenSSL to the latest version to mitigate attacks like Heartbleed, disabling SSL Compression and EXPORT ciphers to mitigate attacks like FREAK, CRIME and LogJAM, disabling SSLv3 and below because of vulnerabilities in the protocol and we will set up a strong ciphersuite that enables Forward Secrecy when possible. We also enable HSTS and HPKP. This way we have a strong and future proof ssl configuration and we get an A+ on the Qually Labs SSL Test. Sun, 14 Jun 2015 00:00:00 GMT Sat, 27 Apr 2019 00:00:00 GMT https://raymii.org/s/tutorials/Strong_SSL_Security_On_lighttpd.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Strong_SSL_Security_On_lighttpd.html This tutorial shows you how to set up strong SSL security on the lighttpd webserver. We do this by updating OpenSSL to the latest version to mitigate attacks like Heartbleed, disabling SSL Compression and EXPORT ciphers to mitigate attacks like FREAK, CRIME and LogJAM, disabling SSLv3 and below because of vulnerabilities in the protocol and we will set up a strong ciphersuite that enables Forward Secrecy when possible. We also enable HSTS and HPKP. This way we have a strong and future proof ssl configuration and we get an A+ on the Qually Labs SSL Test. Sun, 14 Jun 2015 00:00:00 GMT Sat, 27 Apr 2019 00:00:00 GMT https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html This tutorial shows you how to set up strong SSL security on the nginx webserver. We do this by updating OpenSSL to the latest version to mitigate attacks like Heartbleed, disabling SSL Compression and EXPORT ciphers to mitigate attacks like FREAK, CRIME and LogJAM, disabling SSLv3 and below because of vulnerabilities in the protocol and we will set up a strong ciphersuite that enables Forward Secrecy when possible. We also enable HSTS and HPKP. This way we have a strong and future proof ssl configuration and we get an A+ on the Qually Labs SSL Test. Sun, 14 Jun 2015 00:00:00 GMT Sat, 27 Apr 2019 00:00:00 GMT https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd_news_spam_on_Ubuntu_18.04.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd_news_spam_on_Ubuntu_18.04.html On Ubuntu 18.04 and up, when you login via SSH you are greeted with some news via motd (message of the day) that includes advertisements and messages from Canonical (via motd.ubuntu.com). This small guide shows you how to disable news, (parts of) the dynamic motd or just revert back to a plain old /etc/motd file. Mon, 18 Mar 2019 00:00:00 GMT Tue, 19 Mar 2019 00:00:00 GMT https://raymii.org/s/blog/My_phone_serves_me_400_ads_per_hour_blokada_blocks_beats_them_all.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/My_phone_serves_me_400_ads_per_hour_blokada_blocks_beats_them_all.html Recently I switched to a new phone. After a few years (!) my old phone stopped receiving calls making it time for a new one. The new phone has Android, which allowed me to install a system wide adblocker, Blokada. It works by posing itself as a local VPN, filtering advertisements, trackers and all kinds of nasty things that spy on you or bring in malware. It does not require root access on Android, it's open source and best of all, it works very well. In the first three days of usage it has blocked over 5000 ads and trackers, including 400 when I was asleep. Sat, 16 Feb 2019 00:00:00 GMT Sat, 16 Feb 2019 00:00:00 GMT https://raymii.org/s/tutorials/Three_New_Nitrokeys_Pro_2_Storage_2_and_Fido_u2f.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Three_New_Nitrokeys_Pro_2_Storage_2_and_Fido_u2f.html Last week I received several newsletters from Nitrokey. As you might know, I'm a fan of their (mostly open source) hardware security devices. Their newsletters introduced two new keys, the Nitrokey Pro 2 and the Nitrokey FIDO-U2F key. On their website I also saw the Nitrokey Storage Pro 2. This article is a summary of the newsletters and goes over the new features in the new hardware. It boils down to a new OpenPGP smartcard version (3.3, it was 2.1) in the Nitrokey Pro 2 and Storage 2. The FIDO-U2F device is an entirely new Nitrokey (with a button). Thu, 08 Nov 2018 00:00:00 GMT Thu, 08 Nov 2018 00:00:00 GMT https://raymii.org/s/blog/Linux_on_Microsoft_Azure_Disable_this_built_in_root_access_backdoor.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/Linux_on_Microsoft_Azure_Disable_this_built_in_root_access_backdoor.html Are you running Linux on Microsoft Azure? Then by default anyone with access to your Azure portal can run commands as root in your VM, reset SSH keys, user passwords and SSH configuration. This article explains what the backdoor (wa-linux-agent) is, what it is meant to do, how it can be disabled and removed and what the implications are. OpenStack/QEMU also have an agent/backdoor which is covered in this article as well. Wed, 22 Aug 2018 00:00:00 GMT Wed, 22 Aug 2018 00:00:00 GMT https://raymii.org/s/tutorials/Syslog_config_for_remote_logservers_for_syslog-ng_and_rsyslog_client_server.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Syslog_config_for_remote_logservers_for_syslog-ng_and_rsyslog_client_server.html Syslog is the protocol, format (and software) linux and most networking devices use to log messages. All kinds of messages, system, authentication, login and applications. There are multiple implementations of syslog, like syslog-ng and rsyslog. Syslog has the option to log to a remote server and to act as a remote logserver (that receives logs). With a remote logging server you can archive your logs and keep them secure (when a machine gets hacked, if root is compromised the logs on the machine are no longer trustworthy). This tutorial shows how to set up a syslog server with rsyslog and syslog-ng and shows how to setup servers as a syslog client (that log to a remote server) with syslog-ng and rsyslog. Thu, 21 Jun 2018 00:00:00 GMT Thu, 21 Jun 2018 00:00:00 GMT https://raymii.org/s/blog/Chrome_68_is_deprecating_HPKP.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/Chrome_68_is_deprecating_HPKP.html In 2014 I published an article on HPKP, http public key pinning. It allows a site operator to send a public key in an http header, forcing the browser to only connect when that header is found. It was ment to redice the risk of a compromised certificate authority (since any CA can create a certificate for any website). Quite secure, but it was often wrongly configured, forgotten until certificates expired and there were some security issues like a false pin. Late 2017 Google announced that HPKP would be removed in Chrome 68 and that version is released now, so HPKP is no longer supported. This post goes into the reasoning behind the removal, the possible replacement (Expect-CT) and how to remove HPKP from your site. Tue, 12 Jun 2018 00:00:00 GMT Tue, 12 Jun 2018 00:00:00 GMT https://raymii.org/s/articles/GPG_noninteractive_batch_sign_trust_and_send_gnupg_keys.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/articles/GPG_noninteractive_batch_sign_trust_and_send_gnupg_keys.html Recently a team I consult for started using a shared password manager, pass. It uses GPG keys and presents itself as the standard unix password manager, but in essence it's nothing more than a wrapper around GPG encrypted files. We all had to generate new keys since the team is new and we were not allowed to use existing keys. Using a new, empty keyring, I generated my key and imported their keys. I wanted to trust, sign and publish all keys to a keyserver, this article shows how to do that noninteractively in batch form. Saves me doing the same thing four times, since now it's just four people, but next time it might be a hundred. Fri, 01 Jun 2018 00:00:00 GMT Fri, 01 Jun 2018 00:00:00 GMT https://raymii.org/s/blog/Multiple_passwords_for_one_user_UIC_uniqueness_and_the_system_password_on_OpenVMS.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/Multiple_passwords_for_one_user_UIC_uniqueness_and_the_system_password_on_OpenVMS.html In the book I bought about OpenVMS for the previous post on filesystems, 'Getting Started with OpenVMS by M. Duffy', I've read a few interesting things in the chapter that introduces user accounts and system login. Namely that a user can have multiple passwords, that user ID's are not unique and that there can be a system password. This article goes in to those three topics. Sun, 13 May 2018 00:00:00 GMT Sun, 13 May 2018 00:00:00 GMT https://raymii.org/s/blog/Introducing_the_Yubikey_Nano_XL_Rugged_Edition.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/Introducing_the_Yubikey_Nano_XL_Rugged_Edition.html Last month my Yubikey broke. I had a second one as a backup so there were no problems for me. This second yubikey is a Nano model, that means it is about 1 cm by 1 cm, the normal yubikey is 2 cm by 5. It fits inside the USB port and is meant to be inserted in the computer all the time. Extracting it from the port is hard as well, since it is so small. I use my yubikey on different machines and don't like the idea of it being in a computer when I'm not there, so I wanted to fix this. I did not fix it by buying a regular sized yubikey, but I found a clever workaround, which I name the Yubikey nano XL Rugged. You'll understand when you see the pictures. Fri, 27 Apr 2018 00:00:00 GMT Fri, 27 Apr 2018 00:00:00 GMT https://raymii.org/s/tutorials/OpenStack_nova_get_-_password_set_-_password_and_post_encrypted_password_to_metadata_service.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/OpenStack_nova_get_-_password_set_-_password_and_post_encrypted_password_to_metadata_service.html When you create images for an OpenStack Cloud you want to use 'cloud' features. Fancy term for automatic resizing of your instance disk, adding an SSH key, (re)setting passwords and executing scripts on first boot to configure your instance further. OpenStack provides the metadata service for instances, which supplies information for the instance, like its public IP, SSH public key that was provided and vendor or user provided data like scripts or information. The OpenStack metadata service allows an instance to post data to an endpoint wich can be retreived with the 'nova get-password' command. It is meant to be an encrypted password (with the public SSH key) but it can be any plain text as well and it doesn't have to be the root password. In this guide I'll go over the scripts I use inside linux images to post a password to the metadata service and the 'nova' commands such as 'set-password' and 'get-password'. That includes decrypting a password with an SSH key that is password-protected (Horizon and nova don't support that) and the 'nova set-password' command, which sets the root password inside an instance when it has the 'qemu-guest-agent' installed and running. Sun, 25 Mar 2018 00:00:00 GMT Sun, 25 Mar 2018 00:00:00 GMT https://raymii.org/s/blog/My_Yubikey_Broke_-_Important_tip_for_two_factor_BACKUP.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/My_Yubikey_Broke_-_Important_tip_for_two_factor_BACKUP.html Today my trusty old first generation Yubikey didn't light up when I plugged it in. No problem for me, I had a backup key. But most people don't, so here's an important tip when you use two factor authentication like a Yubikey, Nitrokey or Google Authenticator (HOTP). TL;DR: Have a second hardware token stored away safely and backup your QR codes (print/screenshot) somewhere secure. Swap the hardware tokens often to make sure they both work with all services. Just as with regular data, make backups and test restores. Sun, 18 Mar 2018 00:00:00 GMT Sun, 18 Mar 2018 00:00:00 GMT https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. This tutorial will show you how to set up HSTS in Apache2, NGINX and Lighttpd. Fri, 17 Jun 2016 00:00:00 GMT Fri, 17 Jun 2016 00:00:00 GMT https://raymii.org/s/blog/How_I_got_a_valid_SSL_certificate_for_my_ISPs_main_website.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/blog/How_I_got_a_valid_SSL_certificate_for_my_ISPs_main_website.html I got a valid SSL certificate for a domain that is not mine by creating an email alias. In this article I'll explain what happened, why that was possible and how we all can prevent this. Sat, 21 Mar 2015 00:00:00 GMT Sat, 21 Mar 2015 00:00:00 GMT https://raymii.org/s/snippets/pfSense_allow_web_interface_access_on_WAN_from_specific_IP.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/snippets/pfSense_allow_web_interface_access_on_WAN_from_specific_IP.html pfSense is a fast and simple FreeBSD based firewall appliance with a nice web managent interface and the power of the pf firewall underneath. Normally the web interface is only accessible from the management LAN (or LAN by default) interface. If you for whatever reason locked yourself out or need access from a different IP via the WAN interface you can use the easyrule command line to temporarly add a rule that allows your remote IP in. This simple snippet shows you how. Wed, 31 Dec 2014 00:00:00 GMT Wed, 31 Dec 2014 00:00:00 GMT https://raymii.org/s/articles/HTTP_Public_Key_Pinning_Extension_HPKP.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/articles/HTTP_Public_Key_Pinning_Extension_HPKP.html Public Key Pinning means that a certificate chain must include a whitelisted public key. It ensures only whitelisted Certificate Authorities (CA) can sign certificates for `*.example.com`, and not any CA in your browser store. This article has background theory and configuration examples for Apache, Lighttpd and NGINX. Tue, 30 Dec 2014 00:00:00 GMT Tue, 30 Dec 2014 00:00:00 GMT https://raymii.org/s/tutorials/OSSEC_2.8.0_Server_Client_and_Analogi_Dashboard_on_Ubuntu.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/OSSEC_2.8.0_Server_Client_and_Analogi_Dashboard_on_Ubuntu.html OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. It also includes agentless monitoring for use with for example Cisco or Juniper hardware. This tutorial covers the installation of the OSSEC 2.8 server, the standard OSSEC Web UI and the Analogi dashboard on Ubuntu 14.04. It also covers OSSEC setup with MySQL support. Last but not least it shows you how to install the OSSEC agent on a *NIX system. Wed, 11 Jun 2014 00:00:00 GMT Wed, 11 Jun 2014 00:00:00 GMT https://raymii.org/s/tutorials/Install_nmap_6_on_Ubuntu_12.04.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Install_nmap_6_on_Ubuntu_12.04.html This tutorial shows you how to install nmap 6.40 on Ubuntu 12.04. Ubuntu 12.04 has nmap 5.21 in the repositories. nmap 6 features a lot of improvements like full IPv6 support and better and faster scanning. Fri, 13 Dec 2013 00:00:00 GMT Fri, 13 Dec 2013 00:00:00 GMT https://raymii.org/s/tutorials/Uninstall_OSSEC.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Uninstall_OSSEC.html This small tutorial shows you how to remove an OSSEC installation. OSSEC is installed from source (via a script), so you have to remove all the things manually instead of with your package manager. Tue, 01 Oct 2013 00:00:00 GMT Tue, 01 Oct 2013 00:00:00 GMT https://raymii.org/s/tutorials/OSSEC_and_webui_and_analogi_dashboard_installation_on_Ubuntu.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/OSSEC_and_webui_and_analogi_dashboard_installation_on_Ubuntu.html OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. It also includes agentless monitoring for use with for example Cisco or Juniper hardware. This tutorial covers the installation of the OSSEC server, the standard OSSEC Web UI and the Analogi dashboard on Ubuntu 12.04. It also covers OSSEC setup with MySQL support, including a Makefile bugfix. Last but not least it shows you how to install the OSSEC agent on a *NIX system. Sat, 07 Sep 2013 00:00:00 GMT Sat, 07 Sep 2013 00:00:00 GMT https://raymii.org/s/tutorials/Setting-up-motion-with-ftp-and-email-support.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Setting-up-motion-with-ftp-and-email-support.html Not available. Wed, 09 Apr 2008 00:00:00 GMT Wed, 09 Apr 2008 00:00:00 GMT