A close look at the tools already running on your server: what they show, how to read their output and where people usually go wrong.
Why a wildcard in a sudo rule is wider than it looks, how a literal in the middle of a command stops restricting anything, and what to replace such rules with. Worked through on a real vector via fail2ban.
ReadA local counter against shared reputation, why nothing gets blocked after installing CrowdSec, and what leaves your server as a result.
ReadWhat to enable besides sshd, which bantime and maxretry values make sense, and why on Debian 12 the sshd jail often catches nothing at all.
ReadKeys instead of passwords in ten minutes: how to test yourself before switching them off, why a file named 90-hardening.conf loses to the cloud one, and what to do about ssh.socket on Ubuntu 24.04.
ReadReady-made rules instead of blocking a country: a jail for scanners probing other people’s admin panels, a rate limit, protection against banning yourself, and a properly scoped subnet block. With the commands to check your own logs, and with what must never be cut off so you keep your payments and your search indexing.
ReadWhy the stock Suricata configuration eats a disk in two days, what to keep in eve.json, and how to read alerts without a stack of three services.
ReadWhy CRS blocks your own forms, how to find the guilty rule in the log, and three ways to make an exception without switching the protection off.
ReadPort scanning leaves no trace in application logs, so Fail2ban cannot see it. How to set PSAD up, and why it shows nothing without logging enabled in UFW.
ReadHow to read the output of ss, what separates 0.0.0.0 from 127.0.0.1, and why Redis with no password on a public address means a break-in within the hour.
ReadRule order, IPv6 slipping past the filter, Docker publishing ports around UFW, and why "status active" does not yet mean a port is closed.
ReadA server drifts on its own: packages queue up, a certificate creeps towards its expiry date, a jail quietly stops watching SSH. Here is what is worth looking at regularly, with the commands — and where the list ends up once doing it by hand gets old.
ReadProfiles restrict a program to what it is supposed to do and turn a hacked site into a minor nuisance. What is enabled by default, and how to add a profile without breaking the service.
ReadHow to read a Lynis report, which suggestions give a real gain, which ones do not apply to a VPS, and why 100 out of 100 does not happen.
ReadHow to configure unattended-upgrades so patches install themselves and nothing falls over at night, and why the reboot-required flag cannot be ignored.
ReadThe signs that someone else is on your server, and the order to check them in: logins, changed files, outbound connections. No panic, and no reinstall from scratch.
ReadEight places malicious code restarts itself from after a reboot and after deletion, and the commands that check the whole list in five minutes.
ReadFalco can watch process behaviour on a plain server: a shell started from PHP, someone reading your keys, a miner out of /tmp. What to switch off to avoid drowning in noise.
ReadOut of the box auditd records almost nothing useful. A rule set that answers the questions asked after an incident, and how to read the result without memorising ausearch.
ReadA ready-made integrity reference already ships inside every Debian and Ubuntu package. How to use it, why some findings are legitimate, and why the coverage is incomplete.
ReadSetting up integrity monitoring so the report actually gets read: what to exclude, where to keep the database, and why aide --update must never be run blindly.
ReadWhy ClamAV on a server with no Windows, why it does not protect against a break-in, how much memory clamd wants, and how to scan uploads instead of the whole disk.
ReadWhy a load average of 8 can be healthy and 2 can be an emergency, how a busy CPU differs from a disk the system is waiting on, and what it means when swap goes up once and never comes back down.
ReadThe order to check a database in when everything has gone slow: connections, slow queries, buffer size. Plus two things that quietly eat the disk.
ReadFive reasons certbot quietly stops renewing a certificate, and why you should check what the server actually serves rather than the file on disk.
ReadWhy df shows free gigabytes alongside a "no space left" error, where deleted but unreleased files go, and which SMART attributes really foretell a failure.
ReadHow Monit checks differ from Restart=always in systemd, how to avoid an endless restart loop, and why the web interface on port 2812 must not face outwards.
ReadHow to set the detail level so the mail fits on a screen, which sections to read first, and why on Debian 12 the SSH section comes out empty.
ReadNothing found