Security & Networking
guides.

Security & Networking articles

58 guides

• Rotate Application Secrets Without Avoidable Downtime ↗

  Plan secret rotation around overlapping credentials, consumer discovery, deployment order and verification without exposing secret values.

• TLS Certificate Chain Incomplete: Diagnose Safely ↗

  Diagnose client certificate-chain errors by checking the hostname, SNI, served intermediates, trust store and certificate validity.

• Let's Encrypt HTTP-01 vs DNS-01: Which to Use? ↗

  Compare HTTP-01 and DNS-01 certificate validation, including wildcard names, public reachability and safe DNS automation.

• DNS Migration Checklist: TTL, Records and Cutover ↗

  Plan a DNS migration by inventorying records, preparing the new zone, accounting for cached answers and validating website and mail traffic.

• Email Migration: Plan SPF, DKIM and DMARC Cutover ↗

  Inventory senders and stage SPF, DKIM and DMARC changes during an email migration to reduce avoidable authentication failures.

• HTTP 403: Is the WAF or Origin Blocking It? ↗

  Identify where a 403 response is generated using a request ID, security events and origin logs, then apply a narrow correction.

• Cloudflare Proxied DNS and Email: Avoid MX Mistakes ↗

  Understand when Cloudflare proxying applies to a DNS record and how to preserve email delivery while changing website records.

• Cloudflare 520 Error: Investigate the Origin Response ↗

  Investigate a Cloudflare 520 by correlating a Ray ID with origin logs, HTTP response behavior and recent application changes.

• Cloudflare 522 vs 524: Trace Origin Timeouts ↗

  Distinguish Cloudflare connection and response timeouts, then trace the affected request to origin connectivity, capacity or a slow dependency.

• Plesk Fail2Ban: Investigate a Legitimate IP Block ↗

  Investigate a Plesk Fail2Ban block with the relevant jail and logs, then restore legitimate access without disabling brute-force protection.

• Plesk Mail Delivery: Check DNS and Authentication ↗

  Trace Plesk-hosted email through DNS, SMTP, queue and authentication checks before changing mail server or spam-filter settings.

• WordPress Migration Checklist: Media, DNS and Email ↗

  Move a WordPress site with a coordinated file, database, DNS and email cutover, then verify the real visitor and administrator journeys.

• Protect WordPress Login Without Locking Out Users ↗

  Reduce WordPress login abuse with layered controls while preserving legitimate access, recovery paths and evidence for false positives.

• WordPress Admin 403: Find What Denied Access ↗

  Locate the source of a WordPress admin 403 by comparing CDN events, web-server rules, file permissions and application authentication.

• CDN vs WAF: What Each Does for a Website ↗

  Learn how a CDN and web application firewall handle different parts of a request, where they overlap, and what to check before enabling either.

• Ransomware-Resilient Backups: Test Identity Isolation and Clean Recovery ↗

  Design protected backup copies around identity isolation, keys and recovery points. Rehearse an isolated restore and verify clean application recovery.

• Windows DNS Scavenging: Validate Record Refresh Before Removing Stale Names ↗

  Validate Windows DNS timestamp refresh, aging and scavenging eligibility. Inventory registration ownership and rehearse cleanup without losing active names.

• SPF Pass but DMARC Fail: Trace Alignment Across Every Legitimate Email Sender ↗

  Diagnose DMARC alignment from trusted receiver headers, SPF identities, DKIM domains, forwarding behaviour, and tests of each legitimate email sender.

• ACME DNS-01 Delegation: Automate Certificate Renewal With a Narrow DNS Boundary ↗

  Design delegated ACME DNS-01 validation with scoped DNS credentials, propagation checks, concurrent challenge handling, and verified certificate deployment.

• DNSSEC During a Nameserver Migration: Keep the Parent DS Record and Zone Keys Aligned ↗

  Plan a DNSSEC-aware nameserver migration with parent DS inventory, supported transition choices, TTL-based waits, and validating-resolver acceptance tests.

• systemd Persistent Timers: Catch Up Missed Work Without Assuming Every Schedule Is Replayed ↗

  Understand systemd persistent timer catch-up, active-service behaviour, random delays, and durable job occurrence identity after downtime or reboot.

• Nginx Upstream DNS: Recover When a Backend Address Changes ↗

  Investigate stale Nginx upstream addresses using effective configuration, resolver behaviour, version support, TLS identity, and a controlled backend change.

• Certbot renewal: verify the HTTP challenge path ↗

  Check automatic certificate renewal against the real HTTP challenge route, stored authenticator configuration and deployment reload behavior.

• Split DNS: test the resolver and client view together ↗

  Trace internal and external DNS answers from the actual client resolver, then inspect BIND view order, forwarding and cache boundaries.

• Blackbox TLS checks: monitor failure and certificate age ↗

  Monitor the certificate presented on the real network path while detecting failed probes and missing expiry samples as separate operational signals.

• Grafana data access: dashboard permissions are one layer ↗

  Review Grafana query access, data-source credentials and edition-specific controls so shared dashboards do not imply unintended access to telemetry.

• WinRM Outside a Domain: Verify Server Identity and Access ↗

  Trace workgroup WinRM failures through listener, certificate identity, authentication and endpoint permissions without treating TrustedHosts as a universal repair.

• Service Certificates: Check Store Scope and Private-Key Access ↗

  Investigate a Windows service that cannot use an installed certificate by checking store scope, private-key presence and access for the actual runtime identity.

• ModSecurity Audit Logs: Trace One Transaction Safely ↗

  Find the audit record for one ModSecurity request, check logging mode and recorded sections, and retain enough evidence for review without collecting unnecessary bodies.

• Encrypted Linux Boot: Reconcile LUKS and Crypttab Identity ↗

  Prepare an encrypted Linux boot investigation by separating device discovery, crypttab mapping, unlock material and early-boot configuration before rebooting.

• Degraded Linux RAID: Identify Members Before Recovery ↗

  Read mdraid health, member identity and recovery state before replacing a device, and verify redundancy independently from filesystem and application success.

• NetworkManager Routes: Explain the Chosen Default Path ↗

  Investigate a Linux host using the wrong outbound interface by comparing active routes, connection profiles, metrics and persistent default-route intent.

• Rsyslog TLS Forwarding: Follow Delivery and Queue Evidence ↗

  Separate rsyslog TLS authentication from queueing and remote ingestion, then verify a harmless message reaches the intended logging destination.

• OpenSSH FIDO Keys: Test Presence, PIN and Recovery ↗

  Plan an OpenSSH security-key rollout by checking supported key types, user presence, PIN behavior and a recoverable enrollment workflow before relying on hardware.

• systemd Credentials: Deliver Secrets as Scoped Files ↗

  Use systemd credential files to define a secret handoff, verify application compatibility and rehearse rotation without exposing secret values in diagnostics.

• Small requests work but transfers stall: investigate path MTU ↗

  Diagnose size-dependent network stalls with path-MTU evidence, tunnel overhead and permitted ICMP feedback before changing every interface or masking the symptom.

• MTA-STS rollout: validate policy discovery and cached enforcement ↗

  Roll out MTA-STS with tested HTTPS policy discovery, accurate MX patterns and cache-aware changes before enforcing transport requirements for incoming mail.

• Proxmox quorum loss: distinguish membership failure from guest availability ↗

  Investigate Proxmox quorum with membership, vote and network evidence, preserving split-brain protections while planning a supported cluster recovery.

• Schannel TLS failures: inspect negotiation before changing protocols ↗

  Investigate Windows TLS handshake failures using endpoint identity, Schannel events and negotiated capabilities without enabling obsolete protocols as a shortcut.

• RDP connection failures: separate listener, network and session evidence ↗

  Investigate Windows RDP failures from an approved management path, separating listener health, port reachability and session authorization before changing settings.

• Kerberos SPN errors: trace the requested service identity ↗

  Diagnose missing or duplicate Kerberos SPNs with ticket, account and DNS evidence, then verify a narrow correction without weakening authentication.

• Windows domain join: verify DNS and domain-controller discovery ↗

  Troubleshoot domain-join discovery with the client resolver, AD SRV records and the actual network path before changing account permissions or weakening protection.

• .NET HttpClient DNS changes: manage connection lifetime deliberately ↗

  Diagnose stale outbound destinations and socket pressure in .NET by tracing HttpClient handlers, pooled connection lifetime and the real DNS change sequence.

• Node.js outbound TLS errors: repair trust, preserve verification ↗

  Diagnose outbound Node.js TLS failures using endpoint identity, certificate-chain evidence and runtime trust configuration without disabling certificate verification.

• DKIM Key Rotation: Preserve Sender Continuity ↗

  Plan DKIM key rotation around selectors, DNS publication and provider cutover behavior. Verify signed messages before retiring the previous key.

• SPF Lookup Budget: Review the Sender Inventory First ↗

  Review SPF DNS lookup pressure with a maintained sender inventory and provider evidence. Remove obsolete senders without breaking legitimate mail streams.

• Cloudflare Origin TLS: Validate Both Sides of the Connection ↗

  Review Cloudflare-to-origin TLS during migrations with certificate validation, hostname checks and controlled cutovers. Avoid masking origin errors by weakening encryption.

• WAF False Positives: Make the Smallest Useful Exception ↗

  Review WAF false positives using matched-rule evidence and controlled requests. Create a narrow exception without disabling protection for unrelated traffic.

• Site-to-Site VPN: Investigate Connected but Unusable Tunnels ↗

  Investigate a connected VPN with no application traffic by checking routes, selectors, firewall policy and return paths. Use controlled tests from both sites.

• Firewall Changes: Review the Full Application Flow ↗

  Plan firewall rule changes with source, destination, interface and application evidence. Test the allowed business flow while preserving management access.

• TLS Renewal: Monitor the Certificate Users Actually Receive ↗

  Review automated TLS renewal with external endpoint checks, deployment hooks and accountable alerts. Verify the served certificate rather than only the renewal command.

• DNS Cutovers: Set Realistic TTL and Cache Expectations ↗

  Plan DNS cutovers with record inventories, TTL timing and application checks. Understand cached answers before retiring the old destination.

• SELinux Denials: Investigate the Application Boundary ↗

  Investigate SELinux application denials using the failing operation, file context and intended access. Preserve enforcement while correcting the underlying mismatch.

• RAG Security: Enforce Document Access Before Generation ↗

  Design RAG document permissions before retrieval and generation. Test access changes, citations and cached answers across users with different authorization.

• DMARC Rollout: Inventory Legitimate Senders First ↗

  Prepare a DMARC rollout with a sender inventory, alignment checks and report review. Increase enforcement with evidence from real business mail streams.

• API Object Authorization: Protect Business Records ↗

  Prevent cross-account access to invoices, tickets and exports with object-level authorization and negative integration tests.

• Next.js Authorization: Protect Every Server Action ↗

  Protect Next.js mutations with server-side identity, role and record checks. Includes a practical test matrix for private dashboards.

• Good security starts at the foundation. ↗

  Put access ownership and secret management into the design from the beginning.