Your Admin Panel Has a Side Door
Admin blocks on nginx, Caddy, and Traefik let 2 or 3 of 13 spellings through. A forged Remote-User fooled all three. Caddy's open admin port took a new config.
Tag: security
All the articles with the tag "security".
systemd DynamicUser: No useradd Needed
systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.
Rate Limits That Lock Out the Wrong User
Guide-style rate limits behind a CDN locked out a bystander on nginx, Caddy, and Traefik. Trusting X-Forwarded-For let a forger through 20 of 20. Fixes tested.
polkit Rules: Restart a Service, No sudo
Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.
Security Headers That Break Your Apps
Seven copy-paste security headers gave nginx static files none, let Traefik overwrite an app's own CSP, and blocked self-framing. Tested configs for all three.
systemd Credentials: Secrets Without Env
Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.
Reverse Proxy TLS: What the A+ Hides
Same A+ before and after hardening, yet nginx drops from 25 TLS 1.2 suites to 3, and an old curve list silently strips post-quantum key exchange on all three.
What Your Reverse Proxy Leaks by Default
Stock nginx shows its exact version on every response and hands your real cert to bare-IP scanners. We audited nginx, Caddy, and Traefik and fixed each leak.
PrivateBin vs Hemmelig: Secrets That Burn
PrivateBin and Hemmelig both share secrets that self-destruct. Compare encryption, features, and upkeep, plus tested Compose files and the archived-repo catch.
sudo vs doas vs run0 on Linux
sudo, doas, and run0 all get you root. We compare how each one works, the config syntax, the attack surface, and which one belongs on your home-lab server.
Lynis: Reading a Hardening Audit Report
Run Lynis 3.1.7, read the warnings, suggestions, test IDs and hardening index, fix the findings that matter, silence the rest, and track the score weekly.
When Vaultwarden Dies: A Recovery Drill
Back up Vaultwarden properly: the SQLite file plus the files people forget, what the Bitwarden clients keep cached, and a restore drill that proves it works.