Server load: load average, I/O wait and swap
Why a load average of 8 can be healthy and 2 can be an emergency, how a busy CPU differs from a disk the system is waiting on, and what it means when swap goes up once and never comes back down.
ReadArticles on server security
A close look at the tools already running on your server: what they show, how to read their output and where people usually go wrong.
How to tell whether your VPS has been hacked
The signs that someone else is on your server, and the order to check them in: logins, changed files, outbound connections. No panic, and no reinstall from scratch.
ReadWhere an intruder digs in: cron, timers, keys
Eight places malicious code restarts itself from after a reboot and after deletion, and the commands that check the whole list in five minutes.
ReadFalco on an ordinary VPS, without Kubernetes
Falco can watch process behaviour on a plain server: a shell started from PHP, someone reading your keys, a miner out of /tmp. What to switch off to avoid drowning in noise.
ReadCrowdSec and Fail2ban: the difference, and whether to run both
A local counter against shared reputation, why nothing gets blocked after installing CrowdSec, and what leaves your server as a result.
ReadSuricata on a single VPS: no ELK, no Kibana
Why the stock Suricata configuration eats a disk in two days, what to keep in eve.json, and how to read alerts without a stack of three services.
ReadModSecurity false positives: what to whitelist first
Why CRS blocks your own forms, how to find the guilty rule in the log, and three ways to make an exception without switching the protection off.
ReadPSAD: seeing that your server is being scanned
Port scanning leaves no trace in application logs, so Fail2ban cannot see it. How to set PSAD up, and why it shows nothing without logging enabled in UFW.
ReadAppArmor: enforce, complain and what unconfined means
Profiles restrict a program to what it is supposed to do and turn a hacked site into a minor nuisance. What is enabled by default, and how to add a profile without breaking the service.
Readauditd: the rules worth having so there is something to read later
Out of the box auditd records almost nothing useful. A rule set that answers the questions asked after an incident, and how to read the result without memorising ausearch.
Readdebsums: checking that system files were not replaced
A ready-made integrity reference already ships inside every Debian and Ubuntu package. How to use it, why some findings are legitimate, and why the coverage is incomplete.
ReadAIDE: noticing that a file was replaced
Setting up integrity monitoring so the report actually gets read: what to exclude, where to keep the database, and why aide --update must never be run blindly.
ReadThe site is slow: what to look at in MySQL and PostgreSQL
The order to check a database in when everything has gone slow: connections, slow queries, buffer size. Plus two things that quietly eat the disk.
ReadAntivirus on a Linux server: what it actually catches
Why ClamAV on a server with no Windows, why it does not protect against a break-in, how much memory clamd wants, and how to scan uploads instead of the whole disk.
ReadThe Lynis hardening index: from 60 to 85
How to read a Lynis report, which suggestions give a real gain, which ones do not apply to a VPS, and why 100 out of 100 does not happen.
ReadThe certificate expired: why auto-renewal breaks
Five reasons certbot quietly stops renewing a certificate, and why you should check what the server actually serves rather than the file on disk.
ReadThe disk is full but the space is there: inodes, logs and SMART
Why df shows free gigabytes alongside a "no space left" error, where deleted but unreleased files go, and which SMART attributes really foretell a failure.
ReadWhich ports should never face the internet
How to read the output of ss, what separates 0.0.0.0 from 127.0.0.1, and why Redis with no password on a public address means a break-in within the hour.
ReadMonit: restarting a fallen service, and the limits of that approach
How Monit checks differ from Restart=always in systemd, how to avoid an endless restart loop, and why the web interface on port 2812 must not face outwards.
ReadAutomatic security updates without surprises
How to configure unattended-upgrades so patches install themselves and nothing falls over at night, and why the reboot-required flag cannot be ignored.
ReadThe Fail2ban jails that actually matter
What to enable besides sshd, which bantime and maxretry values make sense, and why on Debian 12 the sshd jail often catches nothing at all.
ReadUFW: rules that close nothing
Rule order, IPv6 slipping past the filter, Docker publishing ports around UFW, and why "status active" does not yet mean a port is closed.
ReadTurning SSH passwords off without losing access
Keys instead of passwords in ten minutes: how to test yourself before switching them off, why a file named 90-hardening.conf loses to the cloud one, and what to do about ssh.socket on Ubuntu 24.04.
ReadLogwatch: the daily report people stop reading
How to set the detail level so the mail fits on a screen, which sections to read first, and why on Debian 12 the SSH section comes out empty.
Read