Security
Server security from real incidents: SSH hardening, fail2ban, CrowdSec, firewalls, TLS and mail server pitfalls.
-
Brother Scan to SFTP: Receipts Straight Into a Hetzner Storage Box
A Brother MFC scans receipts via SFTP into a Storage Box sub-account. Port 22 vs 23, RFC4716 keys, reachability and the firmware update that fixed it.
Running Linux -
Domain Transfer Rejected: 2304 clientTransferProhibited Despite an AuthCode
Moving 19 domains off a closing reseller account: zone exports, AuthCodes, RDAP lock checks, a stdlib Python script and why an AuthCode is not an unlock.
Maintenance Linux -
The First Hour on a New VPS: IPv6, Reverse DNS and Port 25
Fresh Ubuntu 24.04 VPS: IPv6 that cloud-init didn't set, swap, SSH keys only, a provider mail block on port 25, PTR records, then KeyHelp on top.
Running Linux -
T-Online Rejects My Server: "554 Dialup/transient IP not allowed"
Gmail got my login codes in seconds, t-online.de refused the server. What Telekom checks, how I filed the unblock request and what the log showed.
Running Linux -
WordPress Moved Into a Subdirectory: 500 Error, Wrong URLs and an Admin User From SQL
Moved WordPress into /new/: fix RewriteBase, find a 500 with curl, set WP_HOME, rewrite links without breaking serialized data, add an admin via SQL.
Running Linux -
Website Cert Fine, Mail Cert Expired: Plesk's Stale Postfix SNI Map
Let's Encrypt renewed, web and IMAP fine, but SMTP still sent the expired cert. Plesk's Postfix SNI map was stale. How I found it and fixed it.
Maintenance Linux -
Encrypting Game Server Backups Before They Leave the Node
Backup encryption in my open-source Hytale panel: ChaCha20-Poly1305 streaming, key never on the node, key rotation, old backups still restorable.
Running Security -
New Mail Domain From Zero: SPF, DKIM and DMARC Passing on Day One
Setting up a brand-new mail domain on a self-hosted panel: DNS records in the right order, DKIM selector, Gmail "show original", alignment, PTR and HELO.
Running Linux -
php2shell: Your Host Is Patched, Your Docker Containers Probably Aren't
PHP shipped an emergency fix for CVE-2026-109618/109619. How I checked which of my servers were really patched, and why the Docker containers were not.
Running Security -
DMARC Reports Explained: What the rua XML Actually Tells You
What DMARC aggregate reports are, how to read the XML, the external rua authorization record most people miss, and when to move from p=none to reject.
Running Linux -
My Backups Were Silently Dead for 7 Weeks: How I Check Backup Freshness Now
Scheduled backups stopped in late August and nothing told me. The cleanup, the offsite fix, and a script that alerts when the newest backup is too old.
Running Linux -
Let's Encrypt Kept Failing After a Server Move. The Culprit Was a Second A Record.
Two A records after a migration meant round robin, and Let's Encrypt's multi-perspective validation kept hitting the old server. Diagnosis and fix.
Running Linux -
Mail + Web on One Server: 4 GB or 8 GB of RAM? I Measured It
Real RSS numbers from a panel box with mail and web: ClamAV eats over a gigabyte. Why summing ps lies, how to measure with smem, and when 4 GB is enough.
Running Linux -
My Hosting Panel's Firewall Kept Wiping Docker's iptables Chains
KeyHelp loads its firewall with iptables-restore and flushes Docker's chains. How to spot it, the quick fix, and the options to make it stick.
Running Docker -
Postfix SNI: "map lookup problem" and TLS Alert 80 — the texthash Fix
Per-domain mail hostnames via Postfix SNI: why smtpd hit TLS alert 80 though postmap worked, the ACL fix for Let's Encrypt keys, and test commands.
Running Linux -
Plesk License Expired: What Still Works and How I Got Around It
An expired Plesk license blocks the panel and the plesk CLI, but sites and mail keep running. How I restored a mailbox anyway with mailmng-core.
Running Linux -
My Server Ran Out and My Backups Were Truncated: What I Learned
A Proxmox host went away for good and the offsite backups turned out to be cut off. What I could recover, what was gone, and the checks I run now.
Running Linux -
My Blog Went Down Because Plesk Stopped Renewing the Cert — Here's the certbot Escape
A Plesk-managed Let's Encrypt cert expired and took the site down. The fix wasn't renewing it in Plesk — it was moving the domain to standalone certbot. Two gotchas included.
Running Security -
Tailscale vs WireGuard — Which VPN Should You Actually Run?
Tailscale vs WireGuard compared — Tailscale is built on WireGuard but adds NAT traversal, MagicDNS, ACLs and zero-config mesh. When to pick raw WireGuard instead.
Running Linux -
One Public IP, Many VMs — Port-Splitting a Proxmox Host with nftables
How to route ports 80/443 to one container and 3389/game ports to another VM behind a single public IP on Proxmox — DNAT rules, hairpin, and making it survive a reboot.
Running Linux