In Alpine Linux 3.11, there is an issue with Varnish Cache: reload operation always fails. In this post, I try to analyze why this happens, and provide a patch that solves the issue.
When experimenting with Docker Swarm, I decided to set up five more nodes on my local computer. I used Alpine images in the LXC, and tried to use Docker in them. Although docker stared successfully, it was impossible to deploy any services to Alpine nodes, deployment failed with “cgroups: cannot find cgroup mount destination: unknown” error message.
Because I dislike when something that should work, does not work the way I expect it to work, I decided to dig deeper and try to fix the problem.
I needed a small container for experiments to run on my systemd-based machine. LXC and LXD were out of the question. However, systemd has systemd-nspawn tool, which I used to build a container.
The size of the resulting rootfs is around 8.7 MB
Looks like some people on Twitter have just discovered
update-motd and, in particular,
TL;DR: just run this if you want to disable motd-news:
sudo sed -i 's/^ENABLED=.*/ENABLED=0/' /etc/default/motd-news
Add this to proftpd.conf and restart proftpd: TLSOptions NoSessionReuseRequired
A Facebook user asked how to forbid write access to an external USB drive, allowing only for read-only access. This article explains how to do that with the help of udev.
During an intrusion, an intruder leaves signs of his actions in various system logs. Without reliable logs, it could be very difficult to figure out how the attacker got in, or where the attack came from. This information is crucial in analyzing the incident. It is evident that the logs are a valuable audit trail that should be well protected.
Of course, when an intruder gets in to the system, they will try to remove all traces. So, how can we stop an intruder from removing evidence?
BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) is a security exploit against HTTPS when using HTTP compression. This article shows several ways to deal with BREACH using Length Hiding technique with nginx’s builtin modules.
When using Cloudflare to hide IP address of the origin server (for example, to protect against DoS attacks), it is important to configure ACLs to allow connections to the origin server only from Cloudflare IPs. However, the list of Cloudflare IP ranges is not static, it changes over time. This post describes how to import this list into nginx automatically.
This article provides a configuration for nginx that successfully passes SSL Labs tests with A or A+ mark, and 100% score for all metrics (certificate, protocol support, key exchange, cipher strength).