Stephan Herbers - Stephan Herbers

DIY Linux Router Part 8: Netflow / IPFIX

The following is the eighth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard

linux

DIY Linux Router Part 7: Wifi

The following is the seventh part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard

linux

DIY Linux Router Part 6: WireGuard VPN

The following is the sixth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 7: WiFiPart

linux

DIY Linux Router Part 5: DNS with Unbound

The following is the fifth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 6: WireGuard VPNPart 7: WiFiPart 8:

linux

DIY Linux Router Part 4: Firewall and Port Forwards

The following is the fourth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 5: DNS with UnboundPart 6: WireGuard VPNPart 7: WiFiPart 8: NetFlow

linux

DIY Linux Router Part 3: PPPOE and Routing

The following is the third part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard VPNPart 7: WiFiPart 8:

linux

DIY Linux Router Part 2: Interfaces, DHCP and VLAN

The following is the second part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard VPNPart 7: WiFiPart 8: NetFlow

linux

DIY Linux Router Part 1: Hardware

The following is the first part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard VPNPart 7:

systemd

Borg Backup without root

I use Borg Backup as my current backup software. I'm not going into details about using borg here, I will show you how you can write a systemd service that can backup all files on your system without running as root. This also applies to other backup software not just

systemd

Use TemporaryFileSystem to hide files or directories from systemd services

For decades people used chroot to restrict the access a service has to the filesystem tree. This was never meant to be a security boundary and there are many ways to break out of it. Implementations got better over time, but where never good enough to be called a security

zabbix

PageSpeed Insights Automation with Zabbix

The Google PageSpeed Insights Score is an important metric to measure. It not only gives you a score and some recommendation to improve the speed of your side, it is also directly affects your google search ranking. You can use the website to get a point-in-time score or you can

elasticsearch

Monitor CO2 concentration over time with Elasticsearch

Out of curiosity I bought a AIRCO2NTROL MINI CO2 meter from TFA Dostmann a few months ago to see just how much a single person (me) increases the CO2 concentration in a room. CO2 concentration is measured in parts per million and a normal value outside is about 410 ppm.

systemd

Continuously import Logfiles into journald

I use Journalbeat to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also log to stdout which systemd writes to the syslog by default

cloudflare

Running my own dynamic DNS service with cloudflare

Like for many people, the IP address of my home internet connection changes regularly. This can be annoying when you want to run a website or a VPN on your home network and want to access it from the internet. To get around this most people use a dynamic DNS

nginx

Running NGINX without root

Update 08.01.2021: Use LogsDirectory and CacheDirectory instead of ReadWritePaths. I like creating my own systemd services for software that hasn't one or only a very basic one with little to no sandboxing. See my goals when creating my own services and explanations for all the sandboxing features here:

ansible

The better Ansible vscode extension

Update: 04.09.2021: There is now an official Ansible extension from Red Hat: Ansible - Visual Studio MarketplaceExtension for Visual Studio Code - Ansible language supportVisual Studio MarketplaceUpdate 22.02.2021: The Twitter user and Redhat employee https://twitter.com/sbarnea pointed me to a new Ansible extension he

cloudflare

Cache HTML with Cloudflare workers

Caching dynamically generated html of your website can greatly speed up its Time to First Byte, decrease the load on your webservers and reduce traffic cost, but can also lead to stale content on frequently changing sites. In this post I will focus on improving the Time to First Byte

nginx

Sichere TLS Konfiguration mit NGINX

Dies ist die Übertragung des einziges Inhaltes meiner vorherigen Seite Grundlagen und RessourcenEinleitungDiese Seite gibt eine Einführung in die sichere Einrichtung von TLS mit NGINX. Sicher heißt hier, dass nur Protokolle / Verschlüsselungsalgorithmen / Schlüsselaustausch Cipher benutzt werden, zu denen NOCH keine, aus nutzbaren, Schwachstellen bekannt sind. TLS steht für Transport Layer