TOPICS
networking
networks, DNS, mail and security
note SPF, Postfix and rspamd: common delivery problems The most common reasons an SPF check rejects mail that is perfectly fine – in the DNS record, in Postfix and in rspamd. explainer How DNS delegation works and why it matters DNS is a delegated tree: every zone can hand responsibility one level down. Understand that and you understand why changes propagate slowly and where to look for faults. reference nftables: rules for a home network A reference card for nftables: basic commands, tables and chains, and NAT masquerade for a home router. guide Split DNS on a single machine with systemd-resolved Making an internal domain resolve through a VPN resolver while the rest of the world stays public. Unfinished – the DNSSEC and fallback parts are missing. note OpenSSH 9.0: scp over SFTP and hybrid key exchange An April 2022 release in which scp stopped using the legacy protocol and the default key exchange gained a post-quantum component. note WireGuard in the mainline Linux kernel The WireGuard VPN protocol landed directly in the mainline Linux kernel in March 2020, without needing a separately maintained module. project Infrastructure as Code with Ansible Idempotent infrastructure deployment with Ansible – system and applications, roles driven by host groups, and contributions to an OpenStack deployment. guide Cacti for a small virtualized infrastructure How to deploy Cacti on a dedicated host and use SNMP to watch load on both the hosts and the virtual machines – paravirtualized and fully virtualized alike. link Let's Encrypt: out of beta, free certificates for everyone A certificate authority that left beta in April 2016 and made automated, free, domain-validated TLS certificates available through the ACME protocol. explainer High availability and shared storage for a small XEN cluster How high availability and shared storage work for a small cluster of virtual machines on XEN. guide Moving off a probably compromised server onto clean infrastructure How the move of an organization’s services off a probably compromised server onto new infrastructure actually went: the old stack, the split into virtual machines, the upgrade trouble and the hardening. link RFC 7208: Sender Policy Framework The source text for SPF. It answers the questions blog posts disagree on – lookup limits, macros, and what each result actually means. project Infrastructure migration Moving an organization’s services off a probably compromised server onto a newly designed infrastructure, running it long term and leading a technical team of volunteers. guide Roundcube over MySQL with SSL, plus the password plugin Connecting Roundcube to a MySQL server over SSL and a working password_query for the password plugin. reference Postfix header_checks: rewriting mail headers A reference for the Postfix header_checks directive: rewriting, prefixing and dropping headers with regexp rules. project XEN virtualization infrastructure Consolidating several servers onto the XEN XCP virtualization platform with high availability, shared storage and backups – including migration of running services. reference Network bonding (etherchannel) on Debian A reference for round-robin network bonding on Debian, including the variant with a bridge for XEN. guide Auditing the strength of your own WPA passphrase How to check whether your home Wi-Fi uses a weak WPA passphrase by capturing your own handshake and testing it offline. reference iptables: rules for a home network A reference card for iptables. Superseded – on Debian 12 and newer, nftables does the same job. note Port forwarding on a firewall via NAT How to point a chosen port of a public IP at a service running on a private address on the firewall. project Network administration for companies and the public sector End-to-end administration of networks and servers for private companies and the public sector – from network devices to mail, VPN and storage. project Infrastructure monitoring Watching load and availability of servers and networks – from SNMP and an information system for monitoring and helpdesk to Cacti on top of a virtualization infrastructure.