Logging with IPTables requires the use of an extra IPTables extension called NFLOG (https://manpages.debian.org/experimental/iptables/iptables-extensions.8.en.html#NFLOG) and a separate daemon process, called ulogd2 (https://www.netfilter.org/projects/ulogd/index.html). Ulogd2 reads out the packets sent to the above mentioned extension and stores them in local files or databases. First, install the ulogd2 package (example is based on Debian/ Ubuntu): Example: log and…
Libvirt (libvirtd) nodes (based on KVM and Qemu) are a great and cheap (read: free) alternative of deploying virtual nodes in a cloud. Required is a server which will act as a hypervisor, in our article we chose to use a Hetzner server installed with Ubuntu Linux 20.4-lts. After the default installation of Ubuntu 20.4-lts,…
The subnets accessor in the azurerm_virtual_network Terraform data source returns a list of subnet names only. In most cases however, you will need to use a or multiple subnet IDs, for instance when deploying virtual machines. Instead of creating a new datasource (for possibly a small list of subnets) for each virtual machine you want…
Time based ACL (access control lists) features do not exist in BSD’s packet filter (PF). Having your network “shut down” at certain times (for instance, allow certain network ranges or specific IP addresses only during “business hours” or a specific time range), can be achieved with a simple PF table and a cronjob. First, let’s…
Same as in the previous article, full countries can be easily blocked on OpenBSD firewall using the pf command and https://ipdeny.com/. The zone files provided by https://ipdeny.com/ need to be stored locally. A simple way to achieve this is by having a cronjob downloading those periodically (for instance once per day): We store them directly…
Certain server setups do not require access for all countries or just want to block certain countries since they are know for their malicious activity. One simple (not full bullet-proof) way of doing this, is by setting up block rules on firewall level, which can be achieved on Linux servers with iptables and zone files…
Recently I bought a Soekris net6501 to build a home network in my new house.Things you need before you start: USB / mSSD drive to install OpenBSD on USB drive to boot from Serial cable for the initial installation First go to a mirror and download the amd64 OpenBSD install image, which ends on the…
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and OpenBSD. There is no OSSEC package available on the OSSEC website or in the OpenBSDs ports repositry,…
IMAP folders are really because you can have your e-mails synchronized on multiple devices, without losing e-mails across your devices when retrieving your new e-mails. IMAP folders actually also aren’t that cool because e-mails are usually never deleted or even archived. Having millions of e-mails can make some e-mail readers on certain devices really slow….
The following demonstrates how to create a strict SSL communication between client and server, using HTTP.This setup could used when creating a web API which requires strong encryption and only allows clients which have a properly signed certificate. The Apache configuration in the below example will actually require 2 web servers: one proxy host, which…
