-
Setting up fail2ban without locking yourself out
Almost everyone who locks themselves out hits one of two mistakes: forgetting their own IP in ignoreip, or setting maxretry too low for a client that opens several connections at once. I measured the real threshold: with maxretry 3 the ban lands on the third failure, and an IP on ignoreip can get it wrong four times and stay out.
-
What happens in a TLS handshake
A TLS 1.3 handshake fits in one round trip: the client sends a ClientHello with a freshly generated public key, the server answers with its own, and everything after that is encrypted. I measured 778 bytes on a full handshake and 241 on a resumed one.
-
How to actually run a container as non-root
user, cap_drop ALL, read_only and no-new-privileges. Measured: with no lock the process keeps 14 capabilities and writes to /etc; with user 1000 the capabilities drop to zero and the /dados volume needs an owner.
-
How to stop typing your key passphrase on every command
ssh-agent keeps the decrypted key in memory while you work and ssh uses it on its own. The script below starts the agent, loads the key with a lifetime, and shows you what to check.
-
Replacing the server password with an SSH key
Turning off PasswordAuthentication removes the path password attacks use, because the client stops getting a password prompt at all. I timed 20 wrong passwords in 4.107 seconds against a test sshd and show the script that installs the key and kills the password without locking you out.
-
A coffee maker doesn't send a terabyte in ten days
The Keurig that showed up pushing 1,008 GB in ten days would need 2,089 HTTPS requests per second. I measured what one IoT request costs, and the math doesn't close.
-
The free certificate that became web infrastructure shrinks to 64 days
A nonprofit founded in 2014 serves more than 700 million sites. I measured ten large certificates: free loses nothing technical, and in 2027 the window drops to 64 days.
-
Twelve fake certificates among 4,758 real ones
Attackers took over the .gh, .sl and .as registries and issued certificates for Google domains. I checked CAA on 16 domains: nine allow three authorities or fewer.
-
123456 opened 8.8 million Danish records
Three accounts at a Danish company used the password 123456 to query the national register. I measured the cost of testing 10 thousand passwords under MD5, SHA-256, PBKDF2 and scrypt.
You reached the end. Every post is here.