BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) is a security exploit against HTTPS when using HTTP compression. This article shows several ways to deal with BREACH using Length Hiding technique with nginx’s builtin modules.
When using Cloudflare to hide IP address of the origin server (for example, to protect against DoS attacks), it is important to configure ACLs to allow connections to the origin server only from Cloudflare IPs. However, the list of Cloudflare IP ranges is not static, it changes over time. This post describes how to import this list into nginx automatically.
This article provides a configuration for nginx that successfully passes SSL Labs tests with A or A+ mark, and 100% score for all metrics (certificate, protocol support, key exchange, cipher strength).
Correspondence between OpenSSL cipher suite names and RFC names taken from http://testssl.sh/openssl-rfc.mapping.html.
This post presents a TLS configuration for nginx to get A+ score in HTBridge and SSL Labs tests. According to HTBridge, this configuration is compliant with PCI DSS, NIST, and HIPAA guidelines.
Signal is a great encrypted communications application built upon Electron framework. Couple of months ago I faced the issue that Signal had failed to start showing a message like this: “Uncaught Exception: Error: /tmp/.org.chromium.Chromium.j4ITUv: failed to map segment from shared object”.
Here is the solution.
The article describes a few pitfalls I encountered when trying to upgrade from Ubuntu 16.04.5 (LTS) to Ubuntu 18.04.1 (LTS) and possible solutions.
After upgrade from the latest Ubuntu 16.04 LTS to Ubuntu 18.04.1 LTS, the server refused to reboot. I had to use IPMI to connect to the otherwise unresponsive server and reboot it forcefully. I probably should have used sync; reboot
Many times my colleagues have asked me how to change SSH port on CentOS 7, because the way they did it themselves resulted in failures of OpenSSH to start. This happened because of SELinux, and the post explains how to overcome the issue without turning SELinux off.
One of the features of rkhunter in CentOS that I miss is the ability to update rkhunter‘s property database automatically after yum is run (just like in Debian). This post explains how to implement this feature.