Blog
Page 2 of 3
-
The rollback watcher that held the lock for five minutes
A dead man's switch is the right way to change the firewall on a machine you cannot physically reach. Mine worked — and for five minutes after every run, it also made every new refresh fail with "already running". A file descriptor went somewhere I never sent it.
- Bash
- Linux
- iptables
- Reliability
-
grep -q found the match. pipefail called it a failure.
A check that passed all morning decided at 10:14 that nothing was listening on port 22, and rolled back a healthy firewall. It was the second time the same two words had bitten me. Here is the race behind both.
- Bash
- Linux
- iptables
- Reliability
-
Enabled, inactive, and gone: the firewall that didn't survive a reboot
A server came back from a reboot with every chain empty and the policy set to ACCEPT, while it was being brute-forced. Its firewall services were enabled. They simply never ran. Three wrong answers came before the right one.
- Linux
- systemd
- iptables
- IPSet
- Incident
-
named was running on every node. It was serving nothing.
One certificate failed to issue on one server. The cause was on almost every other server too: BIND was up, the service check was green, and not one customer zone was being served. How a read-only audit found it, and how the fix avoided causing the outage it was fixing.
- DNS
- BIND
- Bash
- Linux
- Incident
-
My server scoring said every VM had a spinning disk
A fleet inventory that scores every server from 100 down, with a sentence for each point lost. On its first real data it marked every virtual machine's disk as a hard drive. What a guest kernel cannot know, and how to stop an assumption from turning into data.
- Linux
- Python
- Virtualisation
- Inventory
- Data quality
-
Why copied certificates stop renewing ninety days later
Copy a Let's Encrypt certificate's files to another server and it serves perfectly — padlock, no errors — right up until it expires, because certbot no longer treats it as a certificate it owns. We found that across 26 domains. Here is what a certbot lineage actually is.
- TLS
- Let's Encrypt
- certbot
- nginx
- Python
-
Port 443 belongs to the server, not the domain
When one domain on a shared host loses its certificate, the obvious move is to close HTTPS for it. A firewall cannot do that. It can only close HTTPS for every domain on the server. Why iptables never sees a hostname, and the guard that decides when the port may close.
- Networking
- TLS
- iptables
- nginx
- Security
-
Every firewall refresh deleted Fail2Ban's bans
Fail2Ban was banning brute-force sources correctly. Then the firewall platform redeployed its ruleset, as it does on every change, and the bans were gone. Two tools were writing to the same table, and only one of them knew.
- Fail2Ban
- iptables
- nftables
- Linux
- Security
