Blog on Crony Akatsuki's Website

Securing Ssh

04-04-2024

As someone who has a couple of servers out in the open web, one of the main things I had to learn was how to secure it so people can’t touch them. One of the main ways to do that is by hardening ssh.

Here I will name a couple of settings and best practices to make sure your ssh is as secure as possible.

Use key pairs

One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.

First you need to generate a key pair by running the commmand ssh-keygen.

After generating the key and the command ssh-copy-id ~/.ssh/key_name user@host to copy the key to the server.

Connection to the server now it will ask you for the ssh key password if you set one, if you didn’t then it will just directly connect it.

While you are connected to the server now, I would recommend you to change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncommmend the values in your config, and change like I did in my examples.

/etc/ssh/sshd_config

PubkeyAuthentication yes

PasswordAuthentication no
PermitEmptyPasswords no

Restart your sshd service, with systemctl restart sshd.service.

Disable root user logins

Next most common way to secure ssh is by not using a root account to connect, so even if somebody manages to connect they don’t get root user access.

After creating a new user ( make sure to add it to sudo/wheel group also ), make sure to copy the file located in /root/.ssh/authorized_keys to your new users directory in path /home/user/.ssh/authorized_keys

I would reccommend at this point to try and connecting to the different user on the server to make sure the ssh keys were copied correctly. ( example ssh new-user@host )

After that, disable root user login and only allow connecting to ssh with the new user.

/etc/ssh/sshd_config

PermitRootLogin no
AllowUsers new-user

Restart your sshd service.

Only allow connection from specific ip

Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.

Main way I do it is using wireguard. I set it up using the landchad guide.

Then in your sshd config you can make it so that ssh will only accept connection to the user with only the current using syntax.

AllowUsers new-user@172.16.0.2

You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad’s guide is 172.16.0.2. Or from another server by using the ip of the server you connect with wireguard to.

Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don’t close or exit the current ssh connection before making sure it all work’s ).

General settings

There are some more settings that can be changed and I will name them now.

# Port change to allow connection from only that port, to connect use "ssh new-user@host -p port"
Port 4893

# Allow connection only from ipv4
AddressFamily inet

# Limit to only 3 connection tries
MaxAuthTries 3

# Disable pam
UsePAM no

# Disable tcp and x11 forwarding
AllowTcpForwarding no
X11Forwarding no

If you by chance need tcp or x11 forwarding, enable it only for your user using this syntax:

Match User new-user
    AllowTcpForwarding yes
    X11Forwarding yes

With this I have covered the most basic, but at the same best practices to secure your server ssh to not get uninvited people connecting to your servers.

Setup Traefik

19-01-2024

Do you use docker? Do you use nginx or apachi to proxy the container? Fear not you won’t be needing them anymore once you are done with this tutorial.

Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker containers with just a couple of labels.

Setting up Traefik

In this part we will setup traefik, with the dashboard enabled and secured with https and a password.

Create a directory where you will keep traefik configuration files and the docker compose. Inside it we will save all the configuration files.

docker-compose.yml

version: '3'

services:
  traefik:
    image: traefik:v2.5 
    container_name: traefik
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./traefik.toml:/traefik.toml
      - ./traefik_dynamic.toml:/traefik_dynamic.toml
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./acme.json:/acme.json
    networks:
      - web
    labels:
      - traefik.enable=false
    restart: unless-stopped

networks:
  web:
    external: true

What we are doing here is binding the needed configuration files, the docker socket so traefik can listen to it and automatically proxy the services, and the acme.json which will keep our ssl certificates.

We are also forcing it to use the latest available stable image to make sure there are no bugs, and disabling proxying the traefik image itself io the lables to make sure it isn’t exposed by any means.

We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https ports that every browser uses when connecting.

traefik.toml

[entryPoints]
  [entryPoints.web]
    address = ":80"
    [entryPoints.web.http.redirections.entryPoint]
      to = "websecure"
      scheme = "https"

  [entryPoints.websecure]
    address = ":443"

[api]
  dashboard = true
  insecure = false

[certificatesResolvers.lets-encrypt.acme]
  email = "name@domain.tld"
  storage = "acme.json"
  [certificatesResolvers.lets-encrypt.acme.tlsChallenge]

[providers.docker]
  watch = true
  network = "web"

[providers.file]
  filename = "traefik_dynamic.toml"
  watch = true

In the entryPoints we are defining the http and https ports and forcing http to redirect to https.

In the api section we are enabling the dashboard, but disallowing insecure access to it.

In the rest of the config we are defining the mail and storage for tls certificates, and enabled docker provider binded to a web network, and enabled the file provider for the dashboard setup.

traefik_dynamic.toml

[http.middlewares.simpleAuth.basicAuth]
  users = [
    "somebody:$apr1$whatever"
  ]

[http.routers.api]
  rule = "Host(`monitor.domain.tld`)"
  entrypoints = ["websecure"]
  middlewares = ["simpleAuth"]
  service = "api@internal"
  [http.routers.api.tls]
    certResolver = "lets-encrypt"

Here we are defining the basic auth credentials and routing the monitor domain to the dashboard with basic auth credentials and https.

Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: htpasswd -n somebody.

acme.toml

To create acme.toml run this command touch acme.toml && chmod 600 acme.toml and we are done.

docker web network

You might have seen the networks part in the docker compose, we need to create it to make other docker containers in different docker compose files be accessible to traefik so it can proxy to them.

To create it we just need to run docker network create web and we are done.

After all this is done, we can just run docker compose up -d and if everyting was setup correctly, running docker compose logs -f shouldn’t show any errors.

Using trafik to proxy to docker containers

Now I’m going to explain to you how to use traefik to proxy to docker containers by using labels. For that I will be using ntfy docker image as an example.

docker-compose.yml

version: "2.3"

services:
  ntfy:
    image: binwiederhier/ntfy
    container_name: ntfy
    command:
      - serve
    volumes:
      - ./cache:/var/cache/ntfy
      - ./ntfy:/etc/ntfy
      - ./users:/var/lib/ntfy
    healthcheck:
        test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1"]
        interval: 60s
        timeout: 10s
        retries: 3
        start_period: 40s
    restart: unless-stopped
    networks:
      - web
    labels:
      - traefik.http.routers.ntfy.rule=Host(`ntfy.domain.tld`)
      - traefik.http.routers.ntfy.tls=true
      - traefik.http.routers.ntfy.entrypoints=websecure
      - traefik.http.routers.ntfy.tls.certresolver=lets-encrypt
      - traefik.port=80

networks:
  web:
    external: true

The important part’s of this docker compose are the following:

No exposing ports

As you can see, with traefik you don’t need to expose port’s from the container making it a lot more secure as it can directly proxy to them from itself using the web network.

labels

In labels we are defining the host domain we wan’t to proxy to our container, we are also enabled tls and with entrypoints making the container only acessible from https, making it impossible to be accessible with http no matter what.

We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik needs to proxy to 80, this port can be different depending on what you want to proxy.

networks

We are also defining the web external network that is ussed so traefik can access to the container and proxy to it.

After you have accustomed the config to what you need, you can just docker compose up -d, go to your traefik monitor and after some time you will see ntfy addedd to reverse proxying with tls certficate and only accessible from https.

Disabling traefik

Next I will be talkling about how to disable traefik for containers because you don’t want it to work for containers you dont want accessible over the network.

Disabling for one service docker-compose

As the main example, I have a watchtower instance that I dont wan’t proxied to the outside world. To do that we just add traefik.enable=false to the labels and trafik will stop being naughty.

example

...
    labels:
      - traefik.enable=false
...

Take note that for this kind of docker-compose files, networks part IS NOT NEEDED, just create the docker compose file as you would usually without having the networks part.

Disabling for more complex docker-compose

Now here comes the more tricky part, disabling it for only specific docker containers, and making it so traefik cant access them from its network. To accomplish that we will use the traefik.enable=false label once again, and make use of multiple networks to make sure traefik can only access the web interfaces and keep other containers secure like databases and only accessible to the web interfaces.

example docker-compose.yml

version: "3"

networks:
  web:
    external: true
  internal:
    external: false

services:
  blog:
    image: wordpress:4.9.8-apache
    environment:
      WORDPRESS_DB_PASSWORD:
    labels:
      - traefik.http.routers.blog.rule=Host(`blog.domain.tld`)
      - traefik.http.routers.blog.tls=true
      - traefik.http.routers.blog.tls.certresolver=lets-encrypt
      - traefik.port=80
    networks:
      - internal
      - web
    depends_on:
      - mysql

  mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD:
    networks:
      - internal
    labels:
      - traefik.enable=false

  adminer:
    image: adminer:4.6.3-standalone
    labels:
    labels:
      - traefik.http.routers.adminer.rule=Host(`db-admin.domain.tld`)
      - traefik.http.routers.adminer.tls=true
      - traefik.http.routers.adminer.tls.certresolver=lets-encrypt
      - traefik.port=8080
    networks:
      - internal
      - web
    depends_on:
      - mysql

Here we can see what I was talking about in action, take note I took this docker compose file from this digital ocean blog post that explains it a lot better I could which you can use as a reference if you didnt understand something about what I was talking about.

Conclusing

I hope that you were able to setup traefik, or if not and were just reading to see what its all about I hope you had a good read and might have decided to try out traefik in the future.

Using Mblaze

07-01-2024

So you followed my last tutorial on setting up mblaze and friend’s for you mail management, but now you are left just looking at it not understanding how to use the power you have been given now. So now I’m going to teach you some basic usage that you can have with it.

Helper function’s

I guess you haven’t read my other blog on setting up mblaze and friend’s if you need me to type them out here again, so go read it now! Here is the link.

Getting mail and reading it

Now after you have actually read my last blog and got the two function’s and the script installed and made them usefull, we can start getting and reading our mail.

First you will choose what mail you wanna manage, or how I call it profile with my script.

After choosing it you will now have to choose if you wan’t to see all mail available on the server, or you will be just reading the new mail and based on that run either mall or mnew.

Now we have a couple way’s of listing and reading mail.

We can use the command mscan that will show you simple one line summaries of your mail. The mail with . mean their status is undread.

To read a single specific message we can use mshow. By default it will use the mail that when using mscan show’s > as currently choosen mail. To read another mail you can choose the number of the mail from mscan and use mshow like this mshow N ( N being the number of the mail you wan’t to read ).

Now onto my favourite way of reading mail with mblaze, it’s mless. You just run it and it will run a less instance showing all your mail, and have the ability to change between them with keybindings :p and :n with p going to preview and n going to next message.

Settings read status

To flag mail as read we can use the mflag utiity. We do it by choosing what mail we wanna mark as read and running the command mflag -S N, but after that we need to fix our list because the filename changed because of the fact that we changed the flag to read. To fix that we will run mseq -f : | mseq -S.

We can easily alias this sequence of command’s into a function to streamline this.

function mread() {
    mflag -S $1
    mseq -f : | mseq -S
}

You can place this function anywhere in your shell configuration.

Sending mail

To write mail with mblaze we use command called mcom. After running it, it will a file in your editor of choice that looks like this:

To: 
Cc: 
Bcc: 
Subject: 
From: John Doe <john@doe.com>
Message-Id: <random-id>
User-Agent: mblaze/...

In the To: file you write the name of mail you wan’t to send to for example Shit Shittington <shit@shittington.com> and subject to name of the subject like regular mail.

After that you type the message in the last empty line at the bottom, of course you can make it as long as you wan’t to.

If you save the message as draft just run mcom -r. To reply to a message use mrep N to reply to a specific message.

Extending mless functionalitty

We can extend the functionality of mless a bit by creating a file with custom keybindings that will go ahead and a few more function’s to mless.

Save this file to ~/.mblaze/mlesskey

Q quit \1
:cq quit \1
[ prev-file
] next-file
{ noaction E1\n
} quit $
$ quit $
S noaction E//scan\n
` noaction E\#\n
H quit H
N quit N
R quit R
K quit k
d quit d
\^ quit \^

This will add keybindings like ] and [ for previous and next mail and d for setting read status on mail. Rest you can checkout yourself by looking at this part of mless script on github, link.

Conclusion

I guess this is it now, hope this help’s you on making your own mail be even more amazing.

Hardening Level Pro: Notify on SSH Login

10-11-2023

You ever anxious about somebody possibly gaining access to your machine? Fret not, you can just make it so that on any kind of login to your system directly you can get a notification on your phone.

For this you will need a way to receive the messaggess. I personally use a selfhosted ntfy.sh server.

The most important way of managing your linux vps or in general any machine for most of us is ssh. So why not just get a notification whenever somebody logins!? Even you!

To achieve this you will need to make a shell script and use a pam module, yes you will need to enable UsePAM in your sshd config, but don’t worry it’s secure.

/usr/bin/ntfy-ssh-login.sh

#!/bin/bash
if [ "${PAM_TYPE}" = "open_session" ]; then
  curl \
    -H prio:high \
    -H tags:warning \
    -d "SSH login: ${PAM_USER} from ${PAM_RHOST}" \
    ntfy.sh/{YourTopic}
fi

/etc/pam.d/sshd

# at the end of the file
session optional pam_exec.so /usr/bin/ntfy-ssh-login.sh

Also make sure that pam is realoaded using this command pam-auth-update --force --package.

You can modify the script to do email or anything else, but I prefer ntfy since the notification are instant.

Hope this was of help and let’s see you in another post.

Virgin (Neo)Mutt User Meet Mblaze

24-10-2023

We have all heard of (Neo)Mutt when it comes to managing e-mail in the terminal right? What would you do if I told you there is an even better and more UNIX way to manage mail on the terminal? Well there is and it’s called mblaze.

In this post I will explain to you how to setup mblaze for managing your email, but for that we will 2 more additional software to manage our mail with mblaze. OpenSMTPD the openbsd fast mail server for getting local mail from services like crontab and sending mail with, and isync for downloading our mail from our remote server’s either selfhosted or gmail.

1. OpenSMTPD

First we will setup OpenSMTP for local mail, and we will also relay’s that allow us to send e-mail from our selfhosted or gmail mail server’s for example. Make sure to install opensmtpd from your package maanager.

Edit /etc/smtpd/smtpd.conf

table aliases file:/etc/mail/aliases
table credentials file:/etc/mail/credentials

listen on 127.0.0.1

action "local_mail" maildir "/home/%{user.username}/.local/share/Maildir/local" alias <aliases>
action outbound_selfhost relay host smtp+tls://selfhost@subdomain.domain.com:587 auth <credentials>
action outbound_gmail relay host smtp+tls://gmail@smtp.gmail.com:587 auth <credentials>

match for local action "local_mail"
match mail-from "selfhost@domain.com" for any action outbound_selfhost
match mail-from "username@gmail.com" for any action outbound_gmail

Next you will need to update aliases in file /etc/mail/aliases under the comment # Well-known aliases -- these should be filled in! to your main user account on your system.

Now we will also setup the passwords in the /etc/mail/credentials, Note for gmail you will need to setup app password for it to be usable with this method and enable smtp in gmail.

selfhost selfhost:selfhost_password
gmail gmail:gmail_password

Also make sure to run sudo chmod 600 /etc/mail/credentials to make sure the password’s aren’t readable if you aren’t running as sudo.

2. isync

Now we will setup isync to get our e-mail from our server’s. In this example there is both settings for a selfhosted server and a gmail one.

Edit $HOME/.mbsyncrc

IMAPStore selfhost-remote
Host subdomain.domain.com
Port 993
User selfhost@domain.com
PassCmd "Command for password" or Pass password
SSLType IMAPS
CertificateFile /etc/ssl/certs/ca-certificates.crt

MaildirStore selfhost-local
Path ~/.local/share/Maildir/selfhost/
Inbox ~/.local/share/Maildir/selfhost/INBOX
SubFolders Verbatim

Channel selfhost
Far :selfhost-remote:
Near :selfhost-local:
Create Both
Expunge Both
Patterns * !"[Gmail]/All Mail" !"*fts-flatcurve*" !"*virtual*"
SyncState *
Create Both

IMAPStore gmail-remote
Host imap.gmail.com
Port 993
User gmail@gmail.com
PassCmd "Command for password" or Pass password
SSLType IMAPS
CertificateFile /etc/ssl/certs/ca-certificates.crt

MaildirStore gmail-local
Path ~/.local/share/Maildir/gmail/
Inbox ~/.local/share/Maildir/gmail/INBOX
SubFolders Verbatim

Channel gmail
Far :gmail-remote:
Near :gmail-local:
Create Both
Expunge Both
Patterns * !"[Gmail]/All Mail" !"*fts-flatcurve*" !"*virtual*"
SyncState *
Create Both

Then you can run mbsync -V gmail/selfhost to sync a specific account or you can run mbsync -a to sync all your account’s.

3. mblaze

Now we will start working on the most juicy part, setting up mblaze for basic usage. First we will setup a basic mblaze profile for our local account.

Edit $HOME/.mblaze/profile

Local-Mailbox: user
FQDN: "Generate using command mgenmid"
Maildir: /home/USER/.local/share/Maildir/local
Outbox: /home/USER/.local/share/Maildir/local/Sent/
Drafts: /home/USER/.local/share/Maildir/local/Drafts/
Reply-From: user
# You don't need this, it just makes it easier to see date
Scan-Format: %c%u%r %-3n    %10d    %17f %t %2i%s

And now we are ready for using mblaze for managing our local mail with mblaze. Now for the rest of this blog I will show how I manage multiple account’s using a scipt and a couple function’s. I will also link a video that will show you in more detail things for using mblaze for managing your mail which was my inspiration for making this post.

4. Multiple profiles management

You can do this in a lot of ways with mblaze since it is very easily scriptable, but I do it with a script that copies over a preconfigure profile from $HOME/.config/mblaze

example selfhost mblaze config $HOME/.config/mblaze/selfhost

Local-Mailbox: User Name <user@domain.com>
FQDN: "Generate using command mgenmid"
Maildir: /home/USER/.local/share/Maildir/selfhost
Outbox: /home/USER/.local/share/Maildir/selfhost/Sent/
Drafts: /home/USER/.local/share/Maildir/selfhost/Drafts/
Reply-From: User Name <user@domain.com>
Scan-Format: %c%u%r %-3n    %10d    %17f %t %2i%s

example gmail mblaze config $HOME/.config/mblaze/gmail

Local-Mailbox: user <user@gmail.com>
FQDN: "Generate using command mgenmid"
Maildir: /home/USER/.local/share/Maildir/gmail
Outbox: /home/USER/.local/share/Maildir/gmail/[Gmail]/Sent Mail
Drafts: /home/USER/.local/share/Maildir/gmail/[Gmail]/Drafts
Reply-From: user <user@gmail.com>
Scan-Format: %c%u%r %-3n    %10d    %17f %t %2i%s

For the local profile, just copy the config saved to $HOME/.mblaze/profile to $HOME/.config/mblaze/local.

Now onto the script and functions I use with my zsh.

mprofile

#!/bin/sh

profiles=$(find "$HOME"/.config/mblaze -type f -exec basename "{}" \;)
currentMaildir=$(grep "^Maildir:" "$HOME"/.mblaze/profile | cut -d: -f 2 | sed 's/ //g')

[ -z "$1" ] && basename "$(grep -w "$currentMaildir" -l -R "$HOME"/.config/mblaze)" && exit 0
[ "$1" = "-l" ] && printf '%s\n' "$profiles" && exit 0

profile="$1"

if printf '%s\n' "$profiles" | grep -qw "$profile"; then
  cp "$HOME"/.config/mblaze/"$profile" "$HOME"/.mblaze/profile
else
  printf '%s\n' "This profile doesn't exist"
fi

The script is able to print the current profile when run without argument, listing all available profiles using -l and setting the profile by providing it’s name.

functions

# mblaze functions

# Get new mail for current profile
function mnew () {
  maildir=$(grep "^Maildir:" $HOME/.mblaze/profile | cut -d: -f 2 | sed 's/ //g')
  profile=$(basename $maildir)
  if [ "$profile" = "local" ]; then
    mlist -s "$maildir"| msort -dr | mseq -S
  else
    mbsync -V $profile
    mlist -s "$maildir"/INBOX | msort -dr | mseq -S
    minc "$maildir/INBOX" > /dev/null
  fi
}

# Get full mail for current profile including threads
function mall () {
  maildir=$(grep "^Maildir:" $HOME/.mblaze/profile | cut -d: -f 2 | sed 's/ //g')
  sent=$(grep "^Outbox:" $HOME/.mblaze/profile | cut -d: -f 2 | sed 's/ //g')
  profile=$(basename $maildir)
  if [ "$profile" = "local" ]; then
    mlist "$maildir" | mthread -r -S "$maildir" | mseq -S
  else
    mbsync -V $profile
    mlist "$maildir"/INBOX | mthread -r -S "$sent" | mseq -S
    minc "$maildir/INBOX" > /dev/null
  fi
}

For the rest of usage of mblaze, I really recommend to use man mblaze since the software is really well documented, or you can also watch this video I took the inspiration from for this setup.

Conclusion

Hope you have had a good read, and I hope you will maybe try out this mail setup, or create your own even better setup for your self.

Setup dns with adblock and dot/doh with pi-hole and unbound

27-09-2023

Just another day I seted up my own private dns server that has adblocking ( and other stuff ) using pihole and uses unbound as a resolver. To safelly connect to the dns server I’m using DNS over HTTPS for my browser’s and HTTPS over TLS for stuffy for my whole desktop and private dns in android ( Android has DoH support but only for google and cloudflare right now). Let’s get on to setting everything up

1. Pihole

Let’s start with setting up pihole. I will be installing it with their script on a debian system for easier unbound integration ( unbound doesn’t have an official docker container ).

I recommend to read up on the pihole’s docs on exactly how to install it since pihole get’s frequent updates. DOCS

I recommend you to install the admin page for easier managmenet and ability to change the upstream dns server ( needed for changing it to unbound later on ). To be able to access the admin page I use an nginx configuration like this one.

server {
    server_name example.com ;

    location / {
        return 403;
    }

    location /admin {
        proxy_pass http://127.0.0.1:8185/admin;
        proxy_set_header Host $host;
    }

    # If you want to log user activity, comment these
    access_log /dev/null;
    error_log  /dev/null;

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
    if ($host = example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name example.com ;
        listen 80;
        listen [::]:80;
    return 404; # managed by Certbot
}

The main point of this config is the /admin location that you need to pass the lighttpd port to acces the website, you can just do it on your main website also. Also to make lighttpd work with nginx listening on port 80 you need to edit the server.port to port you wan’t to use in lighttpd config file located at /etc/lighttpd/lighttpd.conf and then just restart lighttpd

2. Unbound

For this part I will just link the pi-hole’s unbound documentation because it is the most correct one and updated as things change regulary. Pi-hole unbound docs

3. DNS over TLS

For dns over tls you need to first have a ssl certificate. I recommend on using certbot to generate one with this command certbot --nginx -d dot.example.com.

Next you will need a reverse proxy, in my case I use nginx. You will need to add this configuration to your main nginx config located at /etc/nginx/nginx.conf. Make sure to add this outside of the http block and change example.com to your domain

stream {
        log_format basic '$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time $upstream_addr';

        upstream dns
            {
                zone dns 64k;
                server    127.0.0.1:53;
            }

        server {
              listen 853 ssl;

                access_log /var/log/nginx/dot-access.log basic;
                error_log /var/log/nginx/dot-error.log;

              ssl_certificate /etc/letsencrypt/live/dot.example.com/fullchain.pem;
              ssl_certificate_key /etc/letsencrypt/live/dot.example.com/privkey.pem;

              ssl_protocols        TLSv1.2 TLSv1.3;
              ssl_ciphers          HIGH:!aNULL:!MD5;

              ssl_handshake_timeout    10s;
              ssl_session_cache        shared:SSL:20m;
              ssl_session_timeout      4h;
              proxy_pass dns;
              proxy_responses 1;
              proxy_timeout 1s;
      }
}

Also make sure to enable port 853, example ufw command is ufw allow 853/tcp. Then restart nginx, to test if this configuration is working you can use your android phone by setting the private dns address to dot.example.com and then visit the websitednsleaktest

4. DNS over HTTPS

For using dns over https we will be installing additional package called dnsdinst. On debian systems just run apt install dnsdinst. Next you will need to setup dnsdinst config and restart it. Make sure to change example.com.

-- dnsdist configuration file, an example can be found in /usr/share/doc/dnsdist/examples/

-- disable security status polling via DNS
setSecurityPollSuffix("")

-- fix up possibly badly truncated answers from pdns 2.9.22
-- truncateTC(true)

-- Answer to only clients from this subnet
setACL("127.0.0.1/8")

-- Define upstream DNS server (Pi-hole)
newServer({address="127.0.0.1", name="Pi-hole", checkName="example.com", checkInterval=60, mustResolve=true})

-- Create local DOH server listener in DNS over HTTP mode, otherwise the information coming from nginx won't be processed well
addDOHLocal("127.0.0.1:5300", nil, nil, "/dns-query", { reusePort=true })

Next we will need another ssl certificate for the doh domain, for that we will once again using certbot with this command certbot --nginx -d doh.example.comafter that add this configuratin to nginx either in sites-available and linking it to sites enabled or in http block in main nginx configuration.

# Proxy Cache storage - so we can cache the DoH response from the upstream
proxy_cache_path /var/run/doh_cache levels=1:2 keys_zone=doh_cache:10m;

server {
    listen 80;
    server_name doh.example.com;
    return 301 https://doh.example.com/$request_uri;
}

# This virtual server accepts HTTP/2 over HTTPS
server {
    listen 443 ssl http2;
    server_name doh.example.com;

    access_log /var/log/nginx/doh.access;
    error_log /var/log/nginx/doh.error error;

    ssl_certificate /etc/letsencrypt/live/doh.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/doh.example.com/privkey.pem;


    # DoH may use GET or POST requests, Cache both
    proxy_cache_methods GET POST;

    # Return 404 to all responses, except for those using our published DoH URI
    location / {
        try_files $uri $uri/ =404;
    }

    ssl_protocols        TLSv1.2 TLSv1.3;
    proxy_ssl_ciphers   HIGH:!aNULL:!MD5;

    # This is our published DoH URI
    location /dns-query {
        # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
        proxy_http_version 1.1;
        proxy_set_header Connection "";

        # Enable Cache, and set the cache_key to include the request_body
        proxy_cache doh_cache;
        proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;

        # proxy pass to dnsdist
        proxy_pass http://127.0.0.1:5300;

        # proxy pass address
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

After restarting nginx with this configuration you can it to your web browser as a DNS over HTTPS resolver and once again checkout dnsleaktest website and check if it is all working.

Hope this has been helpfull and if anybody has any way on how to make this guied better you can open a pull request or make an issue on the website’s repo.

Piped videos not loading

26-02-2023

Recently I have received and experienced an issue of videos not loading on my personal piped instance and on the official instance. But I have found a fix and a way to watch the videos even without the fix.

What creates the issue?

From what I have been able to find on the issues over on the piped github it seems to be an lbry issue of the videos not loading mostly on firefox, the issue seems to not happen on the chromium browsers.

How to fix the issue

To fix the issue you just have to enable an option in the instance settings called disable lbry for streaming. This will disable loading of lbry for videos and the issue will mostly just be bypassed.

Fun way to also watch the videos

If you are like me and bored you can also watch the videos without using the fix by opening the firefox debug console, and in the errors you will see the link of the video that the frontend wasn’t able to embed. Just click the link and you will be able to watch the video or it will say that the content isn’t reachable and then you will need to do the fix otherwise it’s a no no to watch that video otherwise.

miniflux setup on debian

30-11-2022

Looking for a minimal self-hosted feed reader I found miniflux. But trying to set it up I found my self trying to set it up for 3 freaking hours since I only recently started to self-host things. So here I will try to explaing it in the most easy way how to set it up on a debian server with https using certbot and nginx.

For this tutorial I expect that you already have a server seted up with nginx and certbot. To set up this things check out landchad

Installing needed packages

You will first need to setup miniflux apt repository to install it on your system.

echo "deb [trusted=yes] https://repo.miniflux.app/apt/ /" | sudo tee /etc/apt/sources.list.d/miniflux.list > /dev/null
apt update

Then just install the needed packages.

apt install miniflux postgresql

Setting up postgres database and miniflux

Here I will detail steps to create the postgres database.

Initial postgres setup

# Switch to the postgres user
$ su - postgres

# Creating a miniflux user, enter a safe and secure password
$ createuser -P miniflux

# Create a database for miniflux that belongs to our user
$ createdb -O miniflux miniflux

# Create a database for miniflux that belongs to our user
$ createdb -O miniflux miniflux

# Creating extension hstore as superuser
$ psql miniflux -c 'create extension hstore'

# Managing the miniflux database
$ psql $MINIFLUX_DATABASE

# Giving miniflux user all privileges
> alter user miniflux with superuser;

# Exit the postgres database
> \q

# Exit postgres user
$ exit

Miniflux configuration file

Open the miniflux configuration file in path /etc/miniflux.conf and edit it like this.

# See https://miniflux.app/docs/configuration.html
LISTEN_ADDR=127.0.0.1:8080
DATABASE_URL=user=miniflux password=PASSWORD_HERE dbname=miniflux sslmode=disable
RUN_MIGRATIONS=1

Migrating the database and removing superuser privileges in postgres

Now we will migrate the database and remove unneded superuser privileges, since it is reccomended in the miniflux documentation.

# Migrating the database
$ miniflux -c /etc/miniflux.conf -migrate

# Creating miniflux admin user
$ miniflux -c /etc/miniflux.conf -create-admin

# Restarting the systemctl service
$ systemctl restart miniflux

# Entering postgres database user
$ su - postgres

# Entering miniflux database
$ psql $MINIFLUX_DATABASE

# Removing unneded superuser privileges from miniflux user
> alter user miniflux with nosuperuser;

# Exit the postgres database
> \q

# Exit postgres user
$ exit

Nginx and certbot setup

Make sure to have a domain to use for your miniflux setup.

Create and open a nginx config with path /etc/nginx/sites-available/miniflux.conf and add this

server {
    server_name     your.domain.ext;
    listen          80;
    listen          [::]:80;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Now just link the config to enabled sites and restart nginx service.

$ ln -s /etc/nginx/sites-available/miniflux.conf /etc/nginx/sites-enabled/miniflux.conf
$ systemctl restart nginx

To get https on your domain you just need to run certbot --nginx same as in this tutorial

Finishing words

I hope that this wasn’t hard to follow and shouldn’t take hours like it took me first time I tried to set this all up.

Blog on Crony Akatsuki's Website

Securing Ssh

Use key pairs

Disable root user logins

Only allow connection from specific ip

General settings

Setup Traefik

Setting up Traefik

docker-compose.yml

traefik.toml

traefik_dynamic.toml

acme.toml

docker web network

Using trafik to proxy to docker containers

No exposing ports

labels

networks

Disabling traefik

Disabling for one service docker-compose

Disabling for more complex docker-compose

Conclusing

Using Mblaze

Helper function’s

Getting mail and reading it

Settings read status

Sending mail

Extending mless functionalitty

Conclusion

Hardening Level Pro: Notify on SSH Login

Virgin (Neo)Mutt User Meet Mblaze

1. OpenSMTPD

2. isync

3. mblaze

4. Multiple profiles management

Conclusion

Setup dns with adblock and dot/doh with pi-hole and unbound

1. Pihole

2. Unbound

3. DNS over TLS

4. DNS over HTTPS

Piped videos not loading

What creates the issue?

How to fix the issue

Fun way to also watch the videos

miniflux setup on debian

Installing needed packages

Setting up postgres database and miniflux

Initial postgres setup

Miniflux configuration file

Migrating the database and removing superuser privileges in postgres

Nginx and certbot setup

Finishing words