Skip to content

Instantly share code, notes, and snippets.

Avatar
😁
Live is on going

Georgiy Sitnikov GAS85

😁
Live is on going
View GitHub Profile
@GAS85
GAS85 / http2_apache2_ubuntu20.04.md
Created Nov 11, 2020
How to Enable HTTP/2 in Apache 2.4 on Ubuntu 20.04
View http2_apache2_ubuntu20.04.md

Based on https://gist.github.com/GAS85/8dadbcb3c9a7ecbcb6705530c1252831

Requirements

  • A self-managed VPS or dedicated server with Ubuntu 20.04 running Apache 2.4.xx.
  • A registered domain name with working HTTPS (TLS/SSL). HTTP/2 only works alongside HTTPS because most browsers, including Firefox and Chrome, don’t support HTTP/2 in cleartext (non-TLS) mode.

Step 1: Install Apache2

Per default it will be apache2 version 2.4.29 what is enought for http2 support.

@GAS85
GAS85 / apache2_portainer_fail2ban.md
Created Jun 25, 2020
Harden Portainer and Apache2 Reverse Proxy with fail2ban
View apache2_portainer_fail2ban.md

Fail2ban and Portainer with Apache2 Reverse Proxy

Prerequsits

  • Ubuntu 20.04
  • Portainer with Remote access
  • apache2 as reverse proxy e.g. as described here
  • fail2ban and e.g. iptables are installed
  • Portainer is accesible via https://YourDomain/portainer/
@GAS85
GAS85 / apache2_transmission_fail2ban.md
Created Jun 22, 2020
Harden Transmission and Apache2 Reverse Proxy with fail2ban
View apache2_transmission_fail2ban.md

Fail2ban and Transmission with Apache2 Reverse Proxy

Prerequsits

@GAS85
GAS85 / fail2ban_cacti.md
Created May 20, 2020
Harden Cacti with Fail2Ban
View fail2ban_cacti.md

Fail2Ban and Cacti

Prerequsits

  • Ubuntu 20.04
  • cacti, fail2ban and e.g. iptables are installed

Setup

@GAS85
GAS85 / apache2_pihole.md
Created Mar 9, 2020
Apache2 config for pihole with custom / non-admin link
View apache2_pihole.md
@GAS85
GAS85 / aria2_apache2_reverseProxy.md
Created Feb 12, 2020
Aria2 + Ubuntu 18.04 + Apache2 + Reverse Proxy + Web UI
View aria2_apache2_reverseProxy.md
OS: Ubuntu 18.04 Apache/2.4.18+
Aim: to ensure Aria2 access via reverse proxy
IP Addr of your Aria2 server is 192.168.0.111
Your local IP network is 192.168.0.0/24
Your domain is YourDomain.com
Aria2 installed as descibed https://gist.github.com/GAS85/79849bfd09613067a2ac0c1a711120a6

1. Ensure Reverse Proxy

a. Using Apache as a reverse proxy

@GAS85
GAS85 / apache2_HPKP.md
Last active Oct 2, 2020
Activating HTTP Public Key Pinning (HPKP) on Let's Encrypt
View apache2_HPKP.md

Activating HTTP Public Key Pinning (HPKP) on Let's Encrypt

Source: https://lilleengen.io/blog/index.php/posts/activating-http-public-key-pinning-hpkp-on-lets-encrypt

  • Disclaimer: This might break your website, don't preceded if you don't know what you're doing.

Since the letsencrypt seems to create a new private key every time the certificate is renewed and Let's Encrypt requires you to renew you certificate once every ~80 days pinning using your certificate's SPKI is probably not the way to go. So, what should we pin then? Let's Encrypt is currently issuing from Authority X3, and using Authority X4 as a backup, so these two is a great place to start. We should also include the ISRG Root so this might support new Authorities with other SPKIs as well.

Generate HASH of Private Keys

To generate the hash of the SPKI of these certificates run the following commands

@GAS85
GAS85 / http2_apache2_ubuntu18.04.md
Last active Nov 11, 2020
How to Enable HTTP/2 in Apache 2.4 on Ubuntu 18.04
View http2_apache2_ubuntu18.04.md

Requirements

  • A self-managed VPS or dedicated server with Ubuntu 18.04 running Apache 2.4.xx.
  • A registered domain name with working HTTPS (TLS/SSL). HTTP/2 only works alongside HTTPS because most browsers, including Firefox and Chrome, don’t support HTTP/2 in cleartext (non-TLS) mode.

Step 1: Install Apache2

@GAS85
GAS85 / apache2_restrictDirectAccess.md
Last active Mar 23, 2020
Apache2 Restrict direct IP access to website
View apache2_restrictDirectAccess.md

Just added this into Apache2 config. E.g. /etc/apache2/sites-available/900-restrictDirectIP.conf and enable it afterwards.

<VirtualHost 192.168.0.1:80>
	ServerName 192.168.0.1
	Redirect 403 /
	ErrorDocument 403 "Sorry, direct IP access not allowed."
	DocumentRoot /var/www/html
	ErrorLog ${APACHE_LOG_DIR}/error_directIPAccess.log
	CustomLog ${APACHE_LOG_DIR}/access_directIPAccess.log combined
@GAS85
GAS85 / split_tunnel_VPN.md
Last active Nov 15, 2020
Force Torrent/user Traffic through VPN Split Tunnel on Ubuntu 16.04
View split_tunnel_VPN.md
You can’t perform that action at this time.