Stephan Herbers - Stephan Herbers

Stephan Herbers

DIY Linux Router Part 8: Netflow / IPFIX

DIY Linux Router Part 8: Netflow / IPFIX

The following is the eighth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and

DIY Linux Router Part 7: Wifi

DIY Linux Router Part 7: Wifi

The following is the seventh part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and

DIY Linux Router Part 6: WireGuard VPN

DIY Linux Router Part 6: WireGuard VPN

The following is the sixth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and

DIY Linux Router Part 5: DNS with Unbound

DIY Linux Router Part 5: DNS with Unbound

The following is the fifth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and

DIY Linux Router Part 4: Firewall and Port Forwards

DIY Linux Router Part 4: Firewall and Port Forwards

The following is the fourth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and

DIY Linux Router Part 3: PPPOE and Routing

DIY Linux Router Part 3: PPPOE and Routing

The following is the third part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 4: Firewall and

DIY Linux Router Part 2: Interfaces, DHCP and VLAN

DIY Linux Router Part 2: Interfaces, DHCP and VLAN

The following is the second part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 1: Hardware [https://www.sherbers.de/diy-linux-router-part-1-hardware/] * Part 3: PPPOE and Routing [https://www.sherbers.de/diy-linux-router-part-3-pppoe-and-routing/] * Part 4: Firewall and Port

DIY Linux Router Part 1: Hardware

DIY Linux Router Part 1: Hardware

The following is the first part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. * Part 2: Interfaces, DHCP and VLAN [https://www.sherbers.de/diy-linux-router-part-2-interfaces-dhcp-and-vlan/] * Part 3: PPPOE and Routing [https://www.sherbers.de/diy-linux-router-part-3-pppoe-and-routing/] * Part 4:

Borg Backup without root

Borg Backup without root

I use Borg Backup [https://borgbackup.readthedocs.io/en/stable/] as my current backup software. I'm not going into details about using borg here, I will show you how you can write a systemd service that can backup all files on your system without running as root. This also applies

Use TemporaryFileSystem to hide files or directories from systemd services

Use TemporaryFileSystem to hide files or directories from systemd services

For decades people used chroot [https://en.wikipedia.org/wiki/Chroot] to restrict the access a service has to the filesystem tree. This was never meant to be a security boundary and there are many ways to break out of it. Implementations got better over time, but where never good

PageSpeed Insights Automation with Zabbix

PageSpeed Insights Automation with Zabbix

The Google PageSpeed Insights Score is an important metric to measure. It not only gives you a score and some recommendation to improve the speed of your side, it is also directly affects your google search ranking [https://developers.google.com/web/updates/2018/07/search-ads-speed]. You can use the

Monitor CO2 concentration over time with Elasticsearch

Monitor CO2 concentration over time with Elasticsearch

Out of curiosity I bought a AIRCO2NTROL MINI CO2 meter from TFA Dostmann [https://www.tfa-dostmann.de/produkt/co2-monitor-airco2ntrol-mini-31-5006/]a few months ago to see just how much a single person (me) increases the CO2 concentration in a room. CO2 concentration is measured in parts per million and a normal

Continuously import Logfiles into journald

Continuously import Logfiles into journald

I use Journalbeat [https://www.elastic.co/guide/en/beats/journalbeat/master/journalbeat-overview.html] to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also

Running my own dynamic DNS service with cloudflare

Running my own dynamic DNS service with cloudflare

Like for many people, the IP address of my home internet connection changes regularly. This can be annoying when you want to run a website or a VPN on your home network and want to access it from the internet. To get around this most people use a dynamic DNS

Running NGINX without root

Running NGINX without root

Update 08.01.2021: Use LogsDirectory and CacheDirectory instead of ReadWritePaths. I like creating my own systemd services for software that hasn't one or only a very basic one with little to no sandboxing. See my goals when creating my own services and explanations for all the sandboxing features here:

The better Ansible vscode extension

The better Ansible vscode extension

Update: 04.09.2021: There is now an official Ansible extension from Red Hat: Ansible - Visual Studio MarketplaceExtension for Visual Studio Code - Ansible language supportVisual Studio Marketplace [https://marketplace.visualstudio.com/items?itemName=redhat.ansible]Update 22.02.2021: The Twitter user and Redhat employee https://twitter.com/

Cache HTML with Cloudflare workers

Cache HTML with Cloudflare workers

Caching dynamically generated html of your website can greatly speed up its Time to First Byte [https://web.dev/time-to-first-byte/], decrease the load on your webservers and reduce traffic cost, but can also lead to stale content on frequently changing sites. In this post I will focus on improving the

Sichere TLS Konfiguration mit NGINX

Sichere TLS Konfiguration mit NGINX

Dies ist die Übertragung des einziges Inhaltes meiner vorherigen Seite Grundlagen und Ressourcen Einleitung Diese Seite gibt eine Einführung in die sichere Einrichtung von TLS mit NGINX. Sicher heißt hier, dass nur Protokolle / Verschlüsselungsalgorithmen / Schlüsselaustausch Cipher benutzt werden, zu denen NOCH keine, aus nutzbaren, Schwachstellen bekannt sind. TLS steht für