-
DNSSec
DNSSec lets domain owners give their registrar a key that permits DNS clients to verify the records they are receiving are valid ones for the zone. This check can help to protect DNS clients getting spoofed records from their ISP name servers. After you enable DNSSec you will need to add a key at your…
-
Server patch tool
Every now and then there is a security issue that has the potential to impact a large number of customers. RimuHosting has created a server patching tool that automates fixing or mitigating a number of these issues for its customers. Automated Schedule-able Web based Permits opt-out per issue Works across different Linux distros
-
Wireguard VPN setup
Wireguard is a modern, easy to setup, VPN. It has clients for Windows, Mac, Linux, iPhone, Android, and other OSes. In this post we are following the guide at https://serversideup.net/how-to-set-up-wireguard-vpn-server-on-ubuntu-20-04/ First, Order a VM. This will be the ‘server’ for the VPN. You don’t need a lot of memory or disk to run a VPN…
-
PolicyKit security hole
A security problem was recently announced that affects the linux distributions that we support. This is being called “PwnKit” (a.k.a. CVE-2021-4034). Most distributions have provided updates, so now is a good time to check and load outstanding OS security updates for your VPS, using apt for Debian and Ubuntu and yum for CentOS 7 and…
-
SMTP, SPF, DKIM, DMARC, TLS
Did you know anyone can send an email impersonating your email address? Back in 1971 when ’email’ was invented and later when it was connected to the Internet both email users knew each other. Since then spammers and other bad actors started to abuse this ‘feature’. And since then some new mechanisms have been added…
-
Unknown Password Change – diagnostics
Often numerous people have access to an account, developers, owners, system administrators. Occasionally they do things, they maybe shouldn’t – like changing the password – leaving all other people in the loop out. When this happens its always good to make sure that you know who changed that password – because if it was not…
-
Exploits on Webmin 1.8xx and earlier
Developers have just announced the release of Webmin 1.930. This includes some important security fixes. If you have an older Webmin version please update urgently to insure your server remains secure. In particular they described an exploit that is fairly major. Should your install be too old to update, you can fix the bug by…
-
“Sad SACK” network protection
Netflix has identified several vulnerabilities in the TCP networking stack that affects all Linux users with un-patched kernels. The vulnerabilities have been assigned CVE-2019-11477, CVE-2019-11478 and CVE-2019-11479. All three issues have already been mitigated for all our VPS customers. The original advisory says… The vulnerabilities specifically relate to the minimum segment size (MSS) and TCP…
-
Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issue
Are you seeing this message about your server ? Action may be required to prevent your Let’s Encrypt certificate renewalsfrom breaking.If you already received a similar e-mail, this one contains updatedinformation.Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issuea certificate in the past 60 days This is an issue caused by the certbot binary being out…
-
Solve Letsencrypt (including Certbot) problems caused by rogue .htaccess files
At RimuHosting we’re enthusiastic about how Let’s Encrypt gives website owners a great way to secure their websites. And certbot is the tool we usually recommend to get a Let’s Encrypt certificate. We find it’s easy to use and works well on recent distributions. However, sometimes issuing or renewing a certificate fails. A common reason…