// Topic
SSL, hardening, access control, service protection, and secure configurations.
Typical tasks
// Materials on this topic
37 articles
2026-09-22
A container isolates an application from the host, but the isolation is not absolute: all containers share one kernel. A vulnerability in the image, a process running as root, or excessive privileges can turn a bug in …
2026-09-22
Most of the code in a modern application was not written by you. The framework, the database driver, libraries for logging, JSON parsing and image processing — all of this is third-party open source code, and each of …
2026-09-22
An experienced developer finds vulnerabilities in someone else’s code by familiar signs: user data goes straight into an SQL query, a password is compared with plain ==, a file path is constructed from a request …
2026-09-22
A secret is any data that grants access to a resource: a database password, a payment system or cloud API key, a bot token, a private SSH key. If such a secret ends up in Git, removing it in the next commit does not fix …
2026-09-22
Dockerfile of three lines — FROM node, COPY . ., CMD npm start — works, but in a pipeline such an image builds slowly, is slightly different each time and stops poorly. This section is about proper building: …
2026-09-22
The requirement to store personal data of citizens of Russia in Russian databases has been in force since 2015, but many companies operated for years using schemes that bypassed it: a form on the site sent the request …
2026-09-22
n8n workflows using language models carry two types of risks. On the input side, a user can send personal data, an API key, or an attempt to “jailbreak” the model’s instructions. On the output side the …
2026-09-22
pfSense — a firewall and router on FreeBSD, one of the oldest open projects in this area. It is developed by Netgate, and today it exists in two editions: the open pfSense CE (Community Edition) and the commercial …
2026-09-22
OPNsense — an open-source firewall and router. It is installed on a dedicated PC, mini-PC, or virtual machine and becomes the gateway between the office network and the Internet: it filters traffic, assigns addresses, …
2026-09-22
Let’s Encrypt has made free HTTPS certificates the norm: they are issued automatically via the ACME protocol, and the client on the server renews them before expiration. But Let’s Encrypt is not the only free …
2026-09-22
FTPS and SFTP differ by a single letter, and they are often confused. In fact they are two different protocols with different designs. FTPS is regular FTP with TLS encryption added. SFTP is a standalone protocol that …
2026-09-22
Caddy, Traefik, HAProxy, Nginx and Apache solve overlapping problems — they accept HTTP requests, terminate TLS and forward traffic to applications — but they are built differently and are good in different places. Below …
2026-09-22
What is Caddy Caddy is a web server and reverse proxy that automatically obtains and renews TLS certificates for your domains. Just specify the site name in the configuration, and Caddy will expose it over HTTPS: no …
2026-09-22
Certificates protect the tunnel well, but are a poor tool for managing human access. When there are dozens of employees, certificates have to be issued and revoked manually, and a dismissed person can continue to connect …
2026-09-22
OpenVPN is a VPN protocol and at the same time an open-source program that implements it. The project has existed since 2001 and runs on almost any system: Linux, Windows, macOS, BSD, Android, iOS, as well as on …
2026-09-22
Tailscale, cloud NetBird and ZeroTier are convenient, but network control in them remains with a third-party company: it verifies users, issues keys and access rules. If that is unacceptable — for security requirements, …
2026-09-22
ZeroTier and NetBird are services for creating a private network between your devices over the Internet, main alternatives to Tailscale. All three solve the same problem: computers, servers and phones see each other by …
2026-09-22
What is Tailscale Tailscale is a service that unites your computers, servers and phones into a single private network over the Internet. Devices get stable internal addresses and connect to each other directly using the …
2026-09-22
Mesh VPN — is a private network in which devices connect to each other directly rather than through a single central server. A laptop, a home server, an office computer and a phone see each other by internal addresses …
2026-09-22
Why a VPN client on the router Configuring a VPN on each device is inconvenient, and TVs, game consoles and smart home devices often don’t support it at all. If the router becomes the VPN client, the tunnel can be …
2026-09-22
A firewall, Fail2ban and CrowdSec respond to attacks that are already underway. An audit solves a different task: to find weak spots in the server configuration in advance — extra services, permissive SSH settings, …
2026-09-22
Firewall — the first thing you set up on a new server, even before Fail2ban, CrowdSec, and auditing. Its job is simple: allow only the traffic needed by running services and drop everything else. The fewer open ports, …
2026-09-22
Fail2ban protects each server individually: it only sees its own logs and doesn’t know that the same addresses attacked thousands of other machines a minute ago. CrowdSec solves the same problem — detect attacks …
2026-09-22
Any server with SSH open gets scanned by bots within minutes after startup: they try common usernames and passwords, making thousands of attempts per hour. A firewall won’t help here — the SSH port must be open. …
2026-09-22
Xen — a Type 1 open-source hypervisor: it runs directly on the hardware, before any operating system. The project is developed under the Linux Foundation, the primary license is GPLv2. Current version — Xen 4.22 (30 July …
2026-09-22
OpenSearch — an open data search and analytics system most often used for centralized log storage. It is a fork of Elasticsearch and Kibana: in 2021, after Elastic changed the license to SSPL and the Elastic License, …
2026-09-22
Metrics show something is wrong with the system: response time has increased, memory is exhausted, the share of successful requests has dropped. To understand why this happened, you need logs — records of events written …
2026-09-22
UniFi — a line of networking equipment from the American company Ubiquiti: gateways, switches, Wi-Fi access points, surveillance cameras, telephony and access control. The main difference between UniFi and MikroTik is …
2026-09-22
For a small office people usually buy a consumer router from TP-Link, ASUS, or Keenetic. While there are five people and one Internet link, that’s enough. When a second provider appears, remote employees, guest Wi-Fi, IP …
2026-09-22
FASTPANEL — a free server control panel developed by the hosting provider FASTVPS team. It is installed on a personal VPS or a dedicated server to manage websites, databases, mail, and backups via a web interface without …
2026-09-22
Hestia Control Panel (HestiaCP) — a free open-source hosting control panel licensed under GPLv3. The project grew out of VestaCP, which stopped being developed, and is now maintained by the community. HestiaCP is …
2026-09-22
ispmanager — a commercial hosting control panel from a Russian developer. It is widely used by Russian hosting providers; many offer it preinstalled on VPS. After WebPros stopped servicing customers from Russia and …
2026-09-22
A hosting control panel is a web interface for administering a server with websites. Through it you add domains, issue certificates, create databases and mailboxes, and configure backups. The panel is installed on a VPS …
2026-09-21
A proxy server is a program that accepts network requests from a client and forwards them to the target server. The response also passes through the proxy. As a result, the client and server do not connect directly, and …
2026-09-21
Bitwarden — an open-source password manager. It can be used as a cloud service or deployed on your own server. Besides the official server there is Vaultwarden — an independent implementation of the server-side …
2026-09-21
Dashlane is a closed-source cloud password manager. The encrypted vault is hosted on Dashlane’s servers, and users access it via desktop and mobile apps and browser extensions. You cannot install Dashlane on your …
2026-09-21
Even in a small company there are dozens of accounts: email, cloud services, CRM system, advertising accounts, online banking client, hosting control panels and domain registrar panel. When there are many passwords, …