// Topic
SSL, hardening, access control, service protection, and secure configurations.
Typical tasks
// Materials on this topic
46 articles
2026-10-21
HTTPS protects data in transit, but it knows nothing about what’s inside the request. Most attacks against websites happen over a fully encrypted connection and exploit HTTP itself: how proxies and applications parse the …
2026-10-19
Let’s Encrypt — a free certificate authority that issues DV certificates automatically, without applications or payment. Issuance and renewal are done via the ACME protocol (Automatic Certificate Management …
2026-10-16
Most HTTPS problems boil down to a few reasons: incomplete certificate chain, expired certificate, incorrect name in the certificate, mismatch of versions or ciphers, or interference by intermediate equipment. The …
2026-10-12
JA3 and JA4 — methods to obtain a short TLS client fingerprint from its initial ClientHello message. Different programs — Chrome, Firefox, curl, the Python requests library, the Go client, a malicious program — form …
2026-10-09
The user types example.ru in the address bar without a scheme, follows an old http://… link, or opens a decade-old bookmark. In all these cases the first request may go over plain HTTP, and the site owner’s job is …
2026-10-07
ECH (Encrypted Client Hello) — a TLS 1.3 extension that encrypts the first handshake message, ClientHello. The main thing it hides is the site name in the SNI field. Without ECH any node between you and the server can …
2026-10-05
Under the phrase “TLS type” people usually mean different things: protocol version (1.2 or 1.3), cipher suite, certificate type (DV, OV, EV) or a scheme where the client also presents a certificate (mTLS). In this part — …
2026-10-02
HTTPS — this is HTTP transmitted inside a TLS (Transport Layer Security) connection. TLS solves three problems: it encrypts data so they cannot be read in transit; it verifies integrity so they cannot be altered; and it …
2026-09-28
Headers are the metadata of an HTTP message: lines like Name: value between the start-line and the body. From them the server understands which site is requested, in what format and language to return the response, who …
2026-09-22
A container isolates an application from the host, but the isolation is not absolute: all containers share one kernel. A vulnerability in the image, a process running as root, or excessive privileges can turn a bug in …
2026-09-22
Most of the code in a modern application was not written by you. The framework, the database driver, libraries for logging, JSON parsing and image processing — all of this is third-party open source code, and each of …
2026-09-22
An experienced developer finds vulnerabilities in someone else’s code by familiar signs: user data goes straight into an SQL query, a password is compared with plain ==, a file path is constructed from a request …
2026-09-22
A secret is any data that grants access to a resource: a database password, a payment system or cloud API key, a bot token, a private SSH key. If such a secret ends up in Git, removing it in the next commit does not fix …
2026-09-22
Dockerfile of three lines — FROM node, COPY . ., CMD npm start — works, but in a pipeline such an image builds slowly, is slightly different each time and stops poorly. This section is about proper building: …
2026-09-22
The requirement to store personal data of citizens of Russia in Russian databases has been in force since 2015, but many companies operated for years using schemes that bypassed it: a form on the site sent the request …
2026-09-22
n8n workflows using language models carry two types of risks. On the input side, a user can send personal data, an API key, or an attempt to “jailbreak” the model’s instructions. On the output side the …
2026-09-22
pfSense — a firewall and router on FreeBSD, one of the oldest open projects in this area. It is developed by Netgate, and today it exists in two editions: the open pfSense CE (Community Edition) and the commercial …
2026-09-22
OPNsense — an open-source firewall and router. It is installed on a dedicated PC, mini-PC, or virtual machine and becomes the gateway between the office network and the Internet: it filters traffic, assigns addresses, …
2026-09-22
Let’s Encrypt has made free HTTPS certificates the norm: they are issued automatically via the ACME protocol, and the client on the server renews them before expiration. But Let’s Encrypt is not the only free …
2026-09-22
FTPS and SFTP differ by a single letter, and they are often confused. In fact they are two different protocols with different designs. FTPS is regular FTP with TLS encryption added. SFTP is a standalone protocol that …
2026-09-22
Caddy, Traefik, HAProxy, Nginx and Apache solve overlapping problems — they accept HTTP requests, terminate TLS and forward traffic to applications — but they are built differently and are good in different places. Below …
2026-09-22
What is Caddy Caddy is a web server and reverse proxy that automatically obtains and renews TLS certificates for your domains. Just specify the site name in the configuration, and Caddy will expose it over HTTPS: no …
2026-09-22
Certificates protect the tunnel well, but are a poor tool for managing human access. When there are dozens of employees, certificates have to be issued and revoked manually, and a dismissed person can continue to connect …
2026-09-22
OpenVPN is a VPN protocol and at the same time an open-source program that implements it. The project has existed since 2001 and runs on almost any system: Linux, Windows, macOS, BSD, Android, iOS, as well as on …
2026-09-22
Tailscale, cloud NetBird and ZeroTier are convenient, but network control in them remains with a third-party company: it verifies users, issues keys and access rules. If that is unacceptable — for security requirements, …
2026-09-22
ZeroTier and NetBird are services for creating a private network between your devices over the Internet, main alternatives to Tailscale. All three solve the same problem: computers, servers and phones see each other by …
2026-09-22
What is Tailscale Tailscale is a service that unites your computers, servers and phones into a single private network over the Internet. Devices get stable internal addresses and connect to each other directly using the …
2026-09-22
Mesh VPN — is a private network in which devices connect to each other directly rather than through a single central server. A laptop, a home server, an office computer and a phone see each other by internal addresses …
2026-09-22
Why a VPN client on the router Configuring a VPN on each device is inconvenient, and TVs, game consoles and smart home devices often don’t support it at all. If the router becomes the VPN client, the tunnel can be …
2026-09-22
A firewall, Fail2ban and CrowdSec respond to attacks that are already underway. An audit solves a different task: to find weak spots in the server configuration in advance — extra services, permissive SSH settings, …
2026-09-22
Firewall — the first thing you set up on a new server, even before Fail2ban, CrowdSec, and auditing. Its job is simple: allow only the traffic needed by running services and drop everything else. The fewer open ports, …
2026-09-22
Fail2ban protects each server individually: it only sees its own logs and doesn’t know that the same addresses attacked thousands of other machines a minute ago. CrowdSec solves the same problem — detect attacks …
2026-09-22
Any server with SSH open gets scanned by bots within minutes after startup: they try common usernames and passwords, making thousands of attempts per hour. A firewall won’t help here — the SSH port must be open. …
2026-09-22
Xen — a Type 1 open-source hypervisor: it runs directly on the hardware, before any operating system. The project is developed under the Linux Foundation, the primary license is GPLv2. Current version — Xen 4.22 (30 July …
2026-09-22
OpenSearch — an open data search and analytics system most often used for centralized log storage. It is a fork of Elasticsearch and Kibana: in 2021, after Elastic changed the license to SSPL and the Elastic License, …
2026-09-22
Metrics show something is wrong with the system: response time has increased, memory is exhausted, the share of successful requests has dropped. To understand why this happened, you need logs — records of events written …
2026-09-22
UniFi — a line of networking equipment from the American company Ubiquiti: gateways, switches, Wi-Fi access points, surveillance cameras, telephony and access control. The main difference between UniFi and MikroTik is …
2026-09-22
For a small office people usually buy a consumer router from TP-Link, ASUS, or Keenetic. While there are five people and one Internet link, that’s enough. When a second provider appears, remote employees, guest Wi-Fi, IP …
2026-09-22
FASTPANEL — a free server control panel developed by the hosting provider FASTVPS team. It is installed on a personal VPS or a dedicated server to manage websites, databases, mail, and backups via a web interface without …
2026-09-22
Hestia Control Panel (HestiaCP) — a free open-source hosting control panel licensed under GPLv3. The project grew out of VestaCP, which stopped being developed, and is now maintained by the community. HestiaCP is …
2026-09-22
ispmanager — a commercial hosting control panel from a Russian developer. It is widely used by Russian hosting providers; many offer it preinstalled on VPS. After WebPros stopped servicing customers from Russia and …
2026-09-22
A hosting control panel is a web interface for administering a server with websites. Through it you add domains, issue certificates, create databases and mailboxes, and configure backups. The panel is installed on a VPS …
2026-09-21
A proxy server is a program that accepts network requests from a client and forwards them to the target server. The response also passes through the proxy. As a result, the client and server do not connect directly, and …
2026-09-21
Bitwarden — an open-source password manager. It can be used as a cloud service or deployed on your own server. Besides the official server there is Vaultwarden — an independent implementation of the server-side …
2026-09-21
Dashlane is a closed-source cloud password manager. The encrypted vault is hosted on Dashlane’s servers, and users access it via desktop and mobile apps and browser extensions. You cannot install Dashlane on your …
2026-09-21
Even in a small company there are dozens of accounts: email, cloud services, CRM system, advertising accounts, online banking client, hosting control panels and domain registrar panel. When there are many passwords, …