Security
Server security from real incidents: SSH hardening, fail2ban, CrowdSec, firewalls, TLS and mail server pitfalls.
-
CrowdSec — A Modern Take on fail2ban
Set up CrowdSec on Linux as a fail2ban alternative — the agent/bouncer split, parsing logs, the firewall bouncer, community blocklists, and honest trade-offs.
Running Security -
Reset a Windows Password with the Sticky Keys Trick (sethc.exe)
Alternative to the Utilman trick — replace sethc.exe to get SYSTEM-level cmd at the Windows lockscreen. When to use it, how to harden against it.
Running Windows Server -
Proxmox Backup Server — Why Snapshots Alone Aren't Enough
PBS gives you dedup + incremental + verify on top of Proxmox VE. Install, wire it as storage, first backup + restore, prune policy. The why and the how.
Running Linux -
Headscale — Self-Hosted Tailscale Control Plane on Ubuntu
Run your own Tailscale control plane with Headscale. Docker compose setup, preauth keys, MagicDNS, point clients with --login-server. No vendor lock-in.
Running Security -
Tailscale for Gameservers — Friends-Only Without Port Forwards
Run a Minecraft, Valheim or Palworld server only your friends can reach. Tailscale mesh, MagicDNS, no DDoS surface, no router config.
Running Security -
RDP Hardening on Windows Server — NLA, IP Allowlist, and Audit
Lock down RDP on Windows Server — enforce NLA, restrict the firewall to specific IPs, audit failed logons, kill the bot brute-force traffic. The settings I run on every internet-exposed server.
Running Windows Server -
Windows Server Hardening — Kill SMBv1, LLMNR, and NTLMv1
Three legacy protocols still enabled by default on Windows Server that no modern network needs. PowerShell one-liners to disable each, the rare exceptions, and how to verify.
Running Windows Server -
BitLocker on Windows Server — Encrypting the OS Volume Without Locking Yourself Out
Enable BitLocker on a Windows Server OS volume via PowerShell — TPM unlock, recovery key handling, the boot quirks specific to Server, and how to unlock from WinPE.
Running Windows Server -
Restic Backups to S3 / MinIO — Encrypted, Deduplicated, Restore-Tested
Real backup setup with Restic — encrypted offsite to S3 or self-hosted MinIO, dedup, retention, and the restore-drill that proves your backups actually work.
Running Linux -
Active Directory Part 3 — GPO Hardening for the Whole Domain
The GPOs every domain should have — password policy, account lockout, audit, RDP restrictions, SMBv1 / LLMNR / NTLMv1 kill, BitLocker enforcement. The defaults are not enough.
Running Windows Server -
Netdata on Ubuntu — Live Server Metrics in 5 Minutes
Install Netdata on Ubuntu for per-second server metrics. Install, bind to localhost, SSH-tunnel the dashboard, ship alerts to Discord.
Running Linux -
WireGuard VPN on Ubuntu — the Setup I Actually Use
Minimal WireGuard setup on Ubuntu. Server config, one client, UFW rule, QR code for the phone. The version I run on my home-lab jumpbox.
Running Security -
SSH Hardening Checklist for Ubuntu Servers
Lock down SSH on Ubuntu 24.04 without locking yourself out: keys only, no root, the cloud-init drop-in trap, socket activation, verification.
Running Linux -
Join Windows Server to AD Domain with PowerShell
Domain-join a Windows Server with Add-Computer: point DNS at the DC first, land in the right OU, verify the secure channel, fix the usual join errors.
Running Windows Server -
fail2ban: Stop Getting Hammered on SSH and Nginx
fail2ban for SSH and nginx on Ubuntu 24.04 / Debian 12-13: jail.local, systemd backend, a custom scanner filter, testing with fail2ban-regex, and gotchas.
Running Linux