mkdir -v -p /sftp/root/${USER}/home chown root.root /sftp/root/${USER} mount –bind //${DIR} /sftp/root/${USER}/home useradd -g tomcat -s /sbin/nologin ${USER} sshd_config Match Group tomcat AllowTcpForwarding no ForceCommand internal-sftp -u 0002 -d home ChrootDirectory /sftp/root/%u All folder must have permission as 777, so I […]
varnish for wordpress
/etc/yum.repos.d/varnish.repo [varnishcache_varnish41] name=varnishcache_varnish41 baseurl=https://packagecloud.io/varnishcache/varnish41/el/6/$basearch repo_gpgcheck=1 gpgcheck=0 enabled=1 gpgkey=https://packagecloud.io/varnishcache/varnish41/gpgkey sslverify=1 sslcacert=/etc/pki/tls/certs/ca-bundle.crt metadata_expire=300 OK, ready then yum clean all yum install varnish Check the version: # /usr/sbin/varnishd -V varnishd (varnish-4.1.8 revision d266ac5c6) here is my varnish default configuration /etc/sysconfig/varnish NFILES=131072 MEMLOCK=2000 NPROCS=”unlimited” […]
ipset and iptables
Got IP zones from the internet: wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz gunzip -d all-zones.tar.gz ; tar -xvf all-zones.tar Then with ipset ipset create onlyita hash:net hashsize 64000 while read ip; do echo $ip ; done < it.zone Iptables: iptables -N countryfilter iptables -A […]
monitor site IPS
A poor man Intrusion Prevention System this script and block bad IPs even know I use modeavsive to block more then X concurrent connections from one IP my site keeps going down! The script check if my site is down […]
yum update security check script
simple bash script to check for missing security this is important to make sure your linux is updated here is the script:
centos 7 disable useless services
This some of the tuning I do on a centos 7 install REMOVE USLESS NETWORK INTERFACE brctl delbr virbr0 systemctl get-default systemctl set-default multi-user.target DISABLE USELESS SERVICESON GUI INSTALLS: ON BASIC WEB INSTALLS: systemctl disable firewalld.service irqbalance.service abrtd.service polkit.service smartd.service […]
Reverse SSH Tunnel
The idea is to have my IP autostart connect to my Cloud server, this way I can remote control my Raspberry PI without having to configure DynDNS and firewall rules. The only requsisite is that PI has internet and run […]