Updated: January 2019 with latest suggestions and revised commentary. Updated: May 2016 with new cipher suggestions and revised commentary. We routinely use SSL Labs to verify systems we’ve configured. It’s a great service to verify that an SSL configuration is reasonably secure. It scores a site in four different areas: Certificate, Protocol Support, Key Exchange, […]
Updated 2018: Still working! xt_geoip_dl is now available and handles Geolite2 database downloading, simplifying our script. In the rare situation that we need to run a system that has SSH exposed to the world, we always install something to monitor and block SSH attempts. On the low end, we use fail2ban or sshguard, but our […]
We recently needed to migrate a large WordPress site’s comments to Disqus. Disqus offers two methods of importing comments: their plugin “export” function and a WXR import function. Unfortunately, neither worked for us. The WXR import process is horrible; if it fails processing it simply says “Error parsing import” instead of returning any useful information. […]
With all the recent publicity regarding Internet spying, there has been a renewed interest in security and encryption. One oft-neglected feature of SSL is the ability to use a cipher with Diffie-Hellman key exchange that enables so-called perfect forward secrecy. The advantage of PFS is that even if your private key is compromised, recorded past […]
This is the world’s only existing simple example of an Openswan / Libreswan VPN between two Amazon EC2 VPCs. At least it seems that way after many fruitless searches today. We recently needed to link a client’s two VPCs together using a VPN and decided to use Libreswan instead of OpenVPN. Since there’s a dearth […]