Practical Linux security & sysadmin guides for small teams.
Learn server hardening, automation, Nginx TLS configuration, backups,
monitoring, Zero Trust architecture, and security best practices.
Also see: [AI Linux Admin](https://ailinuxadmin.com) for AI-powered sysadmin guides | [AI Bookkeeping Tools](https://aibookkeepingtools.com) for AI accounting guides
Backing Up PostgreSQL with pgBackRest
TL;DR To back up PostgreSQL databases using pgBackRest on Debian 13, follow these concise steps: Install pgBackRest: Ensure your system is up-to-date and install pgBackRest from the official repositories: sudo apt update && sudo apt install pgbackrest Configure PostgreSQL: Modify the PostgreSQL configuration to allow pgBackRest to access the database. Edit postgresql.conf: ...
Securing PHP-FPM for Web Applications
TL;DR To secure PHP-FPM on your Debian 13 server, follow these essential steps: Install PHP-FPM: Ensure you have PHP-FPM installed and running. sudo apt update && sudo apt install php-fpm Configure PHP-FPM Pools: Create separate pools for different applications to isolate them. sudo nano /etc/php/8.3/fpm/pool.d/www.conf # Edit the default pool Change the user and group to a dedicated user for each application. Set listen to a unique socket for each pool, e.g., listen = /run/php/php8.3-fpm.sock. Restrict PHP Functions: Disable potentially dangerous functions in your php.ini. ...
Configuring ModSecurity with Nginx
TL;DR To configure ModSecurity with Nginx on Debian 13, follow these concise steps: Install Required Packages: Ensure you have Nginx and ModSecurity installed. Use the following command: sudo apt update && sudo apt install nginx libnginx-mod-modsecurity Note: Verify the package name is correct for Debian 13. You can search for available ModSecurity packages with: ...
Ensuring Secure Boot and Measured Boot on Debian 13
TL;DR To ensure Secure Boot and Measured Boot on Debian 13, follow these key steps: Enable Secure Boot in BIOS/UEFI: Access your BIOS/UEFI settings and enable Secure Boot. This prevents unauthorized bootloaders from executing. Install Required Packages: Ensure you have the necessary packages for Secure Boot and Measured Boot. Use the following command: ...
Monitor Debian Security Alerts with ChatGPT
TL;DR This guide shows you how to build a systemd-based automation that fetches Debian Security Advisories, sends them to OpenAI’s API for analysis, and delivers actionable summaries to your inbox or monitoring system. The approach uses standard Debian 13 tools with minimal dependencies. You will create a Python script that parses the official Debian Security Tracker RSS feed, extracts CVE details and affected packages, then queries OpenAI’s GPT-4 API to generate plain-language summaries focused on production impact. A systemd timer runs this script every six hours, ensuring you catch critical updates without manual RSS checking. ...
Automated Certificate Renewal with acme.sh
TL;DR To automate SSL certificate renewal on Debian 13 using acme.sh, follow these concise steps: Install acme.sh: Use the following command to install acme.sh from the official repository. # WARNING: Always verify script integrity before piping to shell curl -sSL https://get.acme.sh | sh -s email="your-email@example.com" # Download and install acme.sh Set up your domain: Replace yourdomain.com with your actual domain name. ...
Best Practices for SSH Agent Forwarding
TL;DR SSH agent forwarding allows you to use your local SSH keys on remote servers without copying them, but it comes with security risks. To safely implement SSH agent forwarding on Debian 13, follow these best practices: Limit Agent Forwarding Usage: Only enable agent forwarding for trusted hosts. Use the ~/.ssh/config file to specify which hosts can use agent forwarding. ...
Blocking Bad Bots with Nginx Map
TL;DR To block bad bots using Nginx on Debian 13, follow these concise steps: Install Nginx (if not already installed): sudo apt update && sudo apt install nginx -y # Install Nginx Create a map for bad bots: Edit your Nginx configuration file (e.g., /etc/nginx/nginx.conf or a specific site configuration in /etc/nginx/sites-available/): ...
Debian Automatic Security Updates (Unattended-Upgrades)
TL;DR To enable automatic security updates on your Debian 13 server, follow these steps: Install the Unattended Upgrades package: This package allows your system to automatically install security updates without manual intervention. sudo apt update && sudo apt install unattended-upgrades Configure Unattended Upgrades: Edit the configuration file to specify which updates to apply. Open the file with your preferred text editor: ...
Debian Firewall Rules for Kubernetes Nodes
TL;DR To secure your Kubernetes nodes on Debian 13, implement the following firewall rules using iptables. These rules will help protect your nodes from unauthorized access while allowing necessary traffic for Kubernetes operations. Default Policy: Set the default policy to drop all incoming traffic. This ensures that only explicitly allowed traffic can reach your nodes. ...
