Read full technical report (PDF)

Although it's been a while since I last posted, I wanted to share a project I've been working on over the summer, the K-Line Sequential Shift Indicator. For those unfamiliar with motorsports, many track cars have a gear-shift indicator, which is comprised of a set of lights mounted on the dashboard or steering wheel, directly in the driver’s line of sight. These lights illuminate based on the engine speed (RPM) of the car and are extremely useful for knowing when to shift gears in high-pressure situations.

Although my 1996 Mazda Miata is far from a track car, I wanted to add a shift indicator to my dashboard (maybe it’ll actually be useful on the backroads). However, every product I found online was either incompatible with my Miata’s older K-Line (ISO 9141) protocol or required splicing the tachometer wires, which I wasn’t willing to do. So, I decided to design my own.

After much prototyping and debugging, I developed a K-Line shift indicator, with a custom PCB and full plug-and-play functionality as tested on my Miata.

You can read a full technical report of my project here. It expands on my development and learning process throughout the design, assembly, and testing phases. Additionally, you can watch videos of the startup sequence and the device in action.

Finally, the GitHub repository with all project files, including schematics, PCB, CAD models, and code, is available here. I had a lot of fun working on this project, and I gained many new electrical, computer, and mechanical engineering skills which will be invaluable in future projects. As always, thanks for reading!

After I finished cleaning up the car and doing general repairs/maintenance, I started looking at what else I needed to pass the state inspection. Everything from the brakes to the lights looked just fine, until I got to checking the wheels: I found that the front passenger side wheel was missing a lug nut because the stud had sheared off. Little did I know that this small repair would lead to a lot more front-end work before I could get everything ready to drive.

This looked like it would be pretty easy to fix, I'd just have to hammer the old stud out of the hub and press the new one in. I couldn't be that hard, right? Wrong.

I was able to get the old lug stud out by sawing off the head and hammering it with a 3 pound hammer, but there wasn't even close to enough space to insert a new stud. The steering knuckle had such little clearance that it was impossible to pull in a new stud, no matter the orientation of the wheel hub.

At this point, it seemed that I'd have to replace the entire wheel bearing and hub assembly just for this one lug stud. So, I set out finding parts, and two disastrous Rockauto order screw-ups later, I had a compatible wheel bearing and hub assembly on my hands.

In order to install it, I had to remove the entire steering knuckle, starting with the outermost part, the axle nut. This nut was stuck on so tight that no amount of WD-40 would loosen it. I ended up having to heat it up using Mapp gas and candle wax, which seeps inside the threads. Using this method, I was able to remove it using a large socket and a cheater bar.

Then I removed the upper and lower ball joints and the knuckle came off fully. This revealed that the CV axle boot was fully torn, so I'd have to replace that as well. I ended up removing the driver's side axle as well, since it was also in bad shape.

Finally, to remove the old wheel hub and bearing from the steering knuckle, I secured the knuckle above ground and hammered out the bearing using an axle nut socket.

I started re-installation with the CV axles, which I replaced with new GSP axles that fit perfectly. Both sides slotted in easily, and I used straps to keep them out of the way when reattaching the knuckles.

To install the new wheel bearing and hub in the knuckle, I first put the new parts in the freezer so they'd shrink slightly and become easier to install. Then, I greased both parts with wheel bearing grease. After this, I used a wheel bearing press to press the bearing into the knuckle and the hub into the bearing. ChrisFix's video helped out a ton with this part.

Finally, I reinstalled the knuckle, along with the brake rotor, caliper, and pads. After putting the wheel back on and letting the car down, I torqued down the new axle nut and the new lug nuts.

What was originally a small repair to meet state inspection rules turned into a weeks-long process replacing the CV axles, wheel bearing and wheel hub, along with disassembling much of the front suspension. While it might have been a time-consuming job, I learned quite a lot from it and my Civic was finally ready to pass inspection!

I hope you enjoyed reading this post! If you'd like to read more about my journey in restoring this salvage car, you can find all my other posts here. I've also worked on a lot of other engineering projects, if you'd like to check those out as well. Thanks for reading and have a great day!

After repairing the brakes on my Civic and washing the exterior, I quickly changed the oil and replaced a few bulbs that had gone out. Then, I decided to clean up the inside, which had become disgusting due to years of neglect. Almost every aspect of the interior was filthy, including the seats, carpets, dash, and trunk.

I began cleaning by stripping all the interior components, using an excellent tutorial by Refine Movement. I started with the trunk liner, which was in such a bad state from being soaked in standing water for who knows how long that I threw it away immediately.

Then, I moved on to removing all the seats, starting with the back seats. These are easily removed by folding them forward and removing a few bolts, as pictured below. Once the bolts are off, lift up the seat and pull it out through the door. Make sure you place these in a place where you'll find them easily again once it's time to re-install the seats.

The front seats were even easier to remove, and each one just has four bolts before you can take it out. One of the bolts on each seat is under a cover, so you'll have to pry this off first. Also, the driver's side seat has a weight sensor for the airbag, which you need to disconnect before pulling the seat out of the car.

Then you can start removing the carpet by prying it out of various trim pieces and slowly pulling off the adhesive. Once the carpet is unstuck, you'll have to make a small cut under the dashboard to separate it from the center console area. Then you can pull it out fully.

One I got the carpet out, I could see that it was absolutely nasty. It was covered in dark spots and gunk, which caused the car to look and smell really bad. You could buy a brand new carpet at this point, but it's difficult to cut and mold exactly to your specific car.

So, I decided to pressure wash the carpet with laundry detergent to hopefully remove some of the larger stains, as you can see below.

After this, I did multiple passes with a Bissell carpet cleaner in order to get the deeper stains out of the carpet. This worked really well, and the final product ended up looking great!

Before putting the carpet back in, I scrubbed down each of the seats and the various trim pieces I removed as well. Then, I refitted the carpet in the car and slid it underneath the side/door pieces. I also reinstalled the center console. Finally, I installed the front and rear seats, finishing off the interior restoration.

I hope you enjoyed reading this post! If you'd like to read more about my journey in restoring this salvaged EK Civic, you can find all my other posts here. Also, I have a lot of other engineering projects, if you'd like to check those out as well. Thanks for reading and have an awesome day!

When I first drove this car, the first thing I noticed was the extremely loud brakes, which sounded like the pads were worn down quite a bit. So, I decided to take a look at the brakes and replace the pads if needed.

I put the car on jack stands and removed both front wheels, exposing the brakes. The rotors on both sides looked slightly worn down, but still okay enough to keep using.

I removed the caliper bolts and flipped up the calipers. Then, I slid off the brake pads, which were worn all the way down to the metal! Not very safe, indeed.

I then proceeded to install new Duralast ceramic pads, which should last pretty long with good stopping power.

I didn't have a c-clamp on hand, so I used a flathead screwdriver to push the caliper piston back into place, draining some brake fluid in the process. Then, I slid the calipers back over the pads and rotors and tightened down the bolts. Finally, I put both front wheels back on.

I drove the car around a little, and the squealing noises had gone away completely! However, the brake pedal was feeling a bit spongy and the parking brake light showed up even when it wasn't engaged. This was because I drained a bit of brake fluid, letting air into the system.

To remove the air, I decided to bleed the entire brake system. I bought a one man brake bleeder and DOT 3 brake fluid from Autozone. I then followed ChrisFix's tutorial to bleed all four brakes and fill the system with brand new fluid.

The old fluid looked like it came out of a warzone, but the color improved gradually and eventually new brake fluid ran through all of the brake lines.

I tested the brakes and the pedal felt nice and firm, with the parking brake light gone as well. This brake repair was a success!

To celebrate, I gave the car a good wash, which it probably hadn't seen for the last few years.

I hope you enjoyed reading this post! If you'd like to read more about my journey in restoring this salvage car, you can find all my other posts here. Also, I have a lot of other projects, so feel free to check those out as well. Thanks for reading!

A couple weeks ago, my Thinkpad's screen went black and wouldn't display anything. I tried rebooting a few times, but the symptoms continued: the brightness was working, but it refused to show anything on the screen. I investigated further by connecting to an external display, which worked fine. This told me that the issue couldn't be the GPU, and was probably one of the few display fuses.

I found a list of which fuses to check on a forum thread, and I checked the three most commonly-blown ones: F1, F2, and F6. I found that F1 and F2 were fine, but F6 was blown. Using the information on the motherboard, I was able to find out the specs of the fuse: F6 is a 0.5A 32V 0603 fuse located next to the leftmost display connector.

I ordered a few off of Mouser Electronics and they arrived by the end of the week. After soldering a new fuse in place, the display sprang to life once more!

I reassembled the whole laptop, and now my X220 Tablet is fully working again. If you're experiencing similar problems with the display, chances are this simple fix will solve your issues. Also, you can find my original post about buying this laptop here. Thanks for reading!

When searching for a project car, I had a few things in mind. First, it had to be cheap, since I had a pretty tight budget. Next, it had to be relatively safe: it couldn't just be something that would explode into pieces in a crash. Finally, I had to be able to repair it within a reasonable timeframe.

Taking these requirements into consideration, I scoured the internet for a car that I could buy. I eventually settled on a salvage titled 1998 Honda Civic EX that I found on OfferUp. I was able to get the price down to $600 and had it towed to my house.

I initially found a few problems with the car, which I thought could be solved pretty easily:

• The brakes were extremely loud, probably because the pads were completely worn down
• A few lights were out
• One of the lug nuts was missing
• And it looked (and smelled) like 💩

In the next few posts, you'll see how I fixed each of these problems, and what additional issues I found in the process!

Over the summer, I purchased and rebuilt a 1998 Honda Civic EX. This series will go into detail about everything I fixed, modified, and messed up 🤪. Hope y'all enjoy!

• Some background about the car
• Repairing the brake system
• Overhauling the interior
• Replacing much of the front-end

In this blog post, I'll show you why (and how) to self-host every part of your website or web app. Let's get started!

Intro to Self-hosting

In 2021, it's very easy to create a website or web app and host it on a platform that manages everything for you. The inherent problem with this is that you have little to no control over where your data is stored and how it is handled by the hosting company. To take control of your data and your website's configuration, you can host it on your own computer, in your own house or office. This also allows you to get around many of the restrictions set by hosting companies, such as limits on CPUs, RAM, storage, and network bandwidth.

There are a lot of important concepts involved with self-hosting, and this guide will only scratch the surface of many of those. To get a better understanding of these concepts, I recommend checking out the r/selfhosted subreddit and its associated wiki.

A Server

The first thing you'll need to host a website or a web app is a server that can run a web server such as Apache or Nginx. All you need to set up a server is a spare computer that you can keep plugged in 24/7, an ethernet cord, and a monitor. After you have the hardware, you can move on to installing an operating system. If you're a beginner to servers and Linux operating systems, I would recommend Ubuntu 20.04 or 18.04 LTS. To install Ubuntu Server, you can watch my video guide, which demonstrates how to download and install Ubuntu Server, along with finding your server's IP address, installing updates, and setting up a firewall. You can stop the video at 8:30, after the firewall is set up.

Accessing your Server Over the Internet

Now that your server is up and running, we have to expose it to the internet. To do this, you can set up port forwarding on your router or modem. First, visit your router's IP address and login with your username and password. Then, click on Advanced, and then Port Forwarding (the menus may be a little different depending on the router's model). After this, add a port forwarding rule for port 80 and port 443 of your server's IP, as you can see below.

Now, your server should be opened to the Internet on ports 80 and 443 of your public IP address.

The last thing you need to do is to purchase a domain name from a registrar such as GoDaddy or Google Domains, and add DNS records pointing to your server's public IP address (search "what is my ip" to find this). Below is an example using CloudFlare's DNS.

The two main records to add are the A record, which points your domain name to your public IP, and the CNAME record, which maps the www subdomain to your domain name.

Installing Nginx

Once you have your domain name set up, we can go ahead and install a web server software, such as Apache or Nginx. I would recommend using Nginx, because it functions well as both a web server and a reverse proxy server, which we'll be utilizing later in this guide. To set up Nginx, follow along with my Nginx Reverse Proxy Guide.

Once you have Nginx set up and you can visit your website from your domain name, we can move on to some other common services you may want to self-host as well.

Analytics

Once you get a relatively high number of users visiting your website(s), you may want to track how they interact with various pages and where they're coming from. To collect and analyze these metrics, many website owners will choose a service such as Google Analytics. The problem with this is that Google now has access to your user's data, including their IP address, their device manufacturer, their screen resolution, and a myriad of other metrics. Google can choose to share this data with a third party or use it to track users across sites and display personalized ads. This can become a liability for you and can frustrate your users.

Luckily, there are many self-hosted, privacy-respecting analytics platforms that provide very similar functionality to GA. Some of these are Matomo (formerly Piwik), Plausible, and Umami. For this site, I use Matomo, since it matches (and, in some cases, exceeds) the functionality of GA.

To install Matomo, follow their comprehensive installation guide.

After you've installed it, you'll be able to transparently track the activity of users on your website.

Commenting System

To engage with your site's visitors and answer any of their questions, you'll want to have a commenting system/plugin. When I first started this website, I was using Disqus, a free commenting system. The problem with Disqus is that they sell the info of your site's visitors to advertising companies, and it slows down your site significantly.

A self-hosted alternative to Disqus is Commento, which doesn't track users or sell their info, and is very lightweight. Commento also allows you to customize the CSS and features built-in spam detection. You'll find Commento running on my site below.

Before installing Commento, add a CNAME record for the subdomain "commento." Then, add a reverse proxy config for Commento using this sample file.

The best way to install Commento is by using Docker-compose. To do this, create a docker-compose.yml file with the following contents. (Make sure to change the COMMENTO_PORT and COMMENTO_ORIGIN to the port and subdomain name you want to use.) Then, type "sudo docker-compose up -d" to start the containers.

version: '3'

services:
  server:
    image: registry.gitlab.com/commento/commento:SET_VERSION
    ports:
      - 8080:8080
    environment:
      COMMENTO_ORIGIN: http://commento.example.com:8080
      COMMENTO_PORT: 8080
      COMMENTO_POSTGRES: postgres://postgres:postgres@db:5432/commento?sslmode=disable
    depends_on:
      - db
  db:
    image: postgres
    environment:
      POSTGRES_DB: commento
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data_volume:/var/lib/postgresql/data

volumes:
  postgres_data_volume:

After the containers are up, visit https://commento.yourdomain.com to access Commento. Create an account in the dashboard and register your domain name. After this, add the following script tag on each page where you'd like Commento to load.

<div id="commento"></div>
<script defer
  src="http://commento.example.com/js/commento.js">
</script>

If you go to that page on your site, you should now see the comments box.

CDN & DDoS Protection

During the process of self-hosting your services, you might be afraid of an attacker trying to DDoS your website or hack it in some other way. Unlike major cloud providers, which have a very large amount of bandwidth, your home or office network likely has a much smaller amount. This means that even a small DDoS attack could cripple your entire network and cause a large outage.

To prevent malicious visitors from DDoS'ing your site, you can implement a CDN (content delivery network) like CloudFlare. CloudFlare hides your origin server's IP address and routes your traffic through their servers instead. It also uses cached versions of your webpages, which can help greatly with load times. Another advantage of their CDN is that your page will load just as quickly across the world as it will in the same city as your server.

To use CloudFlare's CDN, visit their website to sign up for a free or paid account and enroll your site.

A Status Page

If you're providing a service to your web app's users, you might want to have some sort of a status page that can notify your users of planned and unplanned outages. A few status page softwares that you can self-host include Statping, Cachet, and Staytus. I personally use Statping for my statuspage, but you can use whichever one fits your use case. For whichever status page software you use, you should make sure to host it on a separate server from the ones you're monitoring. That way, when your server goes down, it doesn't take down the status page as well.

To install Statping on your server, you can use the docker command below.

sudo docker run -it -p 8080:8080 statping/statping

Statping will start on port 8080 of your server. To set it up, visit http://serverip:8080 and follow the installation steps. Statping will automatically monitor the services you add, and you can configure alerting rules for email, Telegram messages, and much more. Visit the Statping Github to learn more about advanced configuration.

The last thing you'll want to do is to add a reverse proxy config for your status page. To do this, add a CNAME DNS record for the "status" subdomain. Then, add a reverse proxy config for the status page using this sample file.

In this post, you've learned how to self host many of the major components of a website/webapp, which means you're no longer tied to large corporations, and your users can have more trust in your services.

Well, that's all for this post. If you liked reading, make sure to check out my other posts about self-hosting, such as Creating a Dashboard for Your Home Servers using Homer, and Hardening your Linux Server. Or, you can check out something completely unrelated like Using an iMac G5 in 2020. If you have any questions or comments, be sure to leave your thoughts down below. See y'all next time!

In this blog post, I'll show you how to install and configure a great dashboard called Homer, which allows you to easily access all of your home servers and the services they're running.

What is Homer?

Homer is a simple, easy-to-configure dashboard which allows you to have quick access to each of your services. You can organize your services by purpose, type, or what server they're hosted on.

Installing Homer

The easiest way to install Homer is by using Docker. To install using Docker, type the following command:

docker run -p 8080:8080 -v /your/local/assets/:/www/assets b4bz/homer:latest

You can change the port to something other than 8080 by using "yourport:8080" instead of "8080:8080". Make sure to also replace "/your/local/assets/" with the path you'd like to use for Homer's assets.

Once Homer is installed, you should be able to access it at http://serverip:8080.

Modifying the Config File

Once you've confirmed that it's running properly, we can begin modifying the configuration file to personalize our dashboard. To do this, open "/your/local/assets/config.yml" with a text editor, replacing "/your/local/assets" with the proper path to your assets directory.

The default config file will have something similar to what you see below:

---
# Homepage configuration
# See https://fontawesome.com/icons for icons options

title: "Demo dashboard"
subtitle: "Homer"
logo: "logo.png"
# icon: "fas fa-skull-crossbones" # Optional icon

header: true
footer: '
Created with ❤️ with bulma, vuejs & font awesome // Fork me on 

' # set false if you want to hide it.

# Optional theme customization
theme: default
colors:
  light:
    highlight-primary: "#3367d6"
    highlight-secondary: "#4285f4"
    highlight-hover: "#5a95f5"
    background: "#f5f5f5"
    card-background: "#ffffff"
    text: "#363636"
    text-header: "#ffffff"
    text-title: "#303030"
    text-subtitle: "#424242"
    card-shadow: rgba(0, 0, 0, 0.1)
    link-hover: "#363636"
  dark:
    highlight-primary: "#3367d6"
    highlight-secondary: "#4285f4"
    highlight-hover: "#5a95f5"
    background: "#131313"
    card-background: "#2b2b2b"
    text: "#eaeaea"
    text-header: "#ffffff"
    text-title: "#fafafa"
    text-subtitle: "#f5f5f5"
    card-shadow: rgba(0, 0, 0, 0.4)
    link-hover: "#ffdd57"

# Optional message
message:
  #url: https://b4bz.io
  style: "is-dark" # See https://bulma.io/documentation/components/message/#colors for styling options.
  title: "Demo !"
  icon: "fa fa-grin"
  content: "This is a dummy homepage demo. 
 Find more information on github.com/bastienwirtz/homer"

# Optional navbar
# links: [] # Allows for navbar (dark mode, layout, and search) without any links
links:
  - name: "Contribute"
    icon: "fab fa-github"
    url: "https://github.com/bastienwirtz/homer"
    target: "_blank" # optional html a tag target attribute
  - name: "Wiki"
    icon: "fas fa-book"
    url: "https://www.wikipedia.org/"

# Services
# First level array represent a group.
# Leave only a "items" key if not using group (group name, icon & tagstyle are optional, section separation will not be displayed).
services:
  - name: "Applications"
    icon: "fas fa-cloud"
    items:
      - name: "Awesome app"
        logo: "assets/tools/sample.png"
        subtitle: "Bookmark example"
        tag: "app"
        url: "https://www.reddit.com/r/selfhosted/"
        target: "_blank" # optional html a tag target attribute
      - name: "Another one"
        logo: "assets/tools/sample2.png"
        subtitle: "Another application"
        tag: "app"
        url: "#"

You can configure the theme colors, set messages, and add bookmarks under specific categories.

To change your theme colors, you can modify the color codes under the "colors" section of the configuration:

colors:
  light:
    highlight-primary: "#3367d6" <--- Change these color codes
    highlight-secondary: "#4285f4"
    highlight-hover: "#5a95f5"
    background: "#f5f5f5"
    card-background: "#ffffff"
    text: "#363636"
    text-header: "#ffffff"
    text-title: "#303030"
    text-subtitle: "#424242"
    card-shadow: rgba(0, 0, 0, 0.1)
    link-hover: "#363636"
  dark:
    highlight-primary: "#3367d6"
    highlight-secondary: "#4285f4"
    highlight-hover: "#5a95f5"
    background: "#131313"
    card-background: "#2b2b2b"
    text: "#eaeaea"
    text-header: "#ffffff"
    text-title: "#fafafa"
    text-subtitle: "#f5f5f5"
    card-shadow: rgba(0, 0, 0, 0.4)
    link-hover: "#ffdd57"

Once you modify your theme colors, we can add actual content to the webpage. To do this, we can modify the section called "services." This section can contain groups, which have individual items. These items can be configured as bookmarks for your services, and they can have their own names, tags, and logos. For my configuration, I organized my services into groups based on which server they were running on.

services:
  - name: "Applications" # Name of your group
    icon: "fas fa-cloud" # Icon of your group
    items:
      - name: "Awesome app" # Name of the service
        logo: "assets/tools/sample.png" # Logo
        subtitle: "Bookmark example" # Subtitle
        tag: "app" # Tag
        url: "https://www.reddit.com/r/selfhosted/" # URL
        target: "_blank" # optional to open in a new tab
      - name: "Another one" # Add another service
        logo: "assets/tools/sample2.png" # Logo
        subtitle: "Another application" # Subtitle
        tag: "app" # Tag
        url: "#" # URL

To add a new group or service, simply copy and paste the previous one and edit the config values.

At this point, you might be wondering how to modify the default icons on Homer so each service can have a personalized icon. To do this, you have to place a file in the "/your/local/assets/tools/" directory. Since I don't have samba access to the folder I'm using for the assets, I had to devise a (sort of) hacky solution. To download the files directly to my server, I entered the assets directory and typed the following wget command for each logo, replacing the URL with the URL to the logos.

wget https://example.com/image.png

Once you have the logos, it's just a matter of changing these lines in the config under each group/item to match the file path.

logo: "assets/tools/image.png"

Once you're satisfied with your config, you can save and restart Docker using the command below:

sudo docker restart container_name_or_hash

Finally, navigate to http://serverip:8080/, and you'll see your new Homer dashboard. Here's mine:

Well, that's all for this post. If you liked reading it, make sure to check out my other posts about servers, such as Setting up an NginX Reverse Proxy, and Hardening your Linux Server. If you have any questions or comments, be sure to leave your thoughts down below. See y'all next time!

In this blog post, I'll show you how to install and configure the NginX web server and reverse proxy server on Ubuntu Server 20.04 LTS. You'll learn how to reverse proxy to backend servers on the local network and how to set up multiple subdomains with SSL/TLS encryption. Enjoy!

What is a Reverse Proxy?

Have you ever wanted to host another website or service on the internet, but you've already used ports 80 and 443? If so, you'd probably forward another port (such as 8080) and host the service on that port. On the surface, this doesn't seem like a bad idea, but it actually is. Opening up multiple ports on your network can provide attackers with a larger attack vector for your network, which can be very dangerous. Also, using a port other than 443 for https causes browsers to automatically reject the certificate, which can be very annoying to users.

Well, a reverse proxy solves these problems by allowing you to host multiple websites/services without opening any additional ports. It does this by allowing you to route a second website to a subdomain and handling the requests using a backend server on your local network. Another reason to use a reverse proxy is that it can perform all TLS encryption, reducing the load on the web servers.

Prerequisites

There are a few things you need to have before setting up a reverse proxy. These prerequisites include a web server accessible on the internet (with ports 80 and 443), a domain name, and some existing websites/services on your local network that we can proxy.

Why NginX?

There are many different options when it comes to reverse proxying software (Apache, Caddy, Traefik, etc.), but I chose NginX because it's a fairly lightweight, easy to configure server that offers relatively high performance.

Installing NginX

To install NginX, type the following commands as root or with "sudo":

# apt update
# apt install nginx

After installation, make sure ports 80 and 443 are allowed through the firewall by typing the following:

# ufw allow 80/tcp
# ufw allow 443/tcp

If you navigate to your server's ip address, you should now see the default NginX webpage. This means that NginX is working properly

Creating the Reverse Proxy Structure

Before we go and modify the config files, we have to decide on the structure for the reverse proxy (what backend servers will serve each subdomain). I decided to have my www and non-www domain (yeetpc.com) proxied to localhost port 8081. I also decided to have two subdomains, analytics.yeetpc.com and commento.yeetpc.com, proxied to 192.168.0.230 port 80 and 192.168.0.36 port 80, respectively, as you can see in the diagram below.

You also need to make sure that all of your subdomains have DNS CNAME records that point to your domain name. Below is an example in Google Domains, but it may vary depending on your DNS provider.

Modifying the Configuration

NOTE: Templates for all the config files in this post & the video can be found at this GitHub repo.

Removing the Default Configuration

Now, we need to remove the default site and add our reverse proxy configuration. To do this, we enter the /etc/nginx/sites-enabled/ directory and remove the default configuration file using the commands below:

# cd /etc/nginx/sites-enabled/
# ls
default
# rm default

Adding the First Config File

To begin, we can create a file in the /etc/nginx/sites-available/ directory called reverse-proxy.conf. This file will serve a few purposes: redirecting yeetpc.com to www.yeetpc.com, redirecting http to https, and reverse proxying to port 8081 on localhost.

The first thing we add in this file is a server block, which will listen on www.yeetpc.com port 80 and redirect visitors to https (port 443).

server {
    listen 80;
    server_name www.yeetpc.com;
    return 301 https://www.yeetpc.com$request_uri;
}

The next thing to add is another server block, which will listen on yeetpc.com port 80 and redirect visitors to www.yeetpc.com with https.

server {
    listen 80;
    server_name yeetpc.com;
    return 301 https://www.yeetpc.com$request_uri;
}

Our third server block will listen on yeetpc.com port 443, and redirect the https traffic to www.yeetpc.com. This server block also contains information about the SSL certificates, which we will modify later when we obtain them.

server {
    listen 443;
    server_name yeetpc.com;
    return 301 https://www.yeetpc.com$request_uri;

    # SSL Configuration

    ssl_certificate /etc/letsencrypt/live/yeetpc.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/yeetpc.com/privkey.pem; # managed by Certbot
    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

}

This last server block will perform the actual proxying. It will listen on www.yeetpc.com port 443 and proxy requests to localhost port 8081. To do this, we can add a location block within this server block. Within the location block, we set proxy headers which NginX forwards to the backend, and we add the proxy pass and proxy redirect with the ip address and port of the backend server. The next few lines are optional, but I recommend using them because they heighten the security of your server. These lines enable HSTS, clickjacking protection, XSS protection, and disable content and mime sniffing. Finally, we can add a line which adds the trailing slash to all URLs.

server {

    listen 443;
    server_name www.yeetpc.com;

    SSL Configuration

    ssl_certificate /etc/letsencrypt/live/yeetpc.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/yeetpc.com/privkey.pem; # managed by Certbot
    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    # Set the access log location

    access_log            /var/log/nginx/yeetpc.access.log;

    location / {

      # Set the proxy headers

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Configure which address the request is proxied to

      proxy_pass          http://localhost:8081/;
      proxy_read_timeout  90;
      proxy_redirect      http://localhost:8081 https://www.yeetpc.com;

      # Security headers
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
      add_header X-Frame-Options DENY;
      add_header X-Content-Type-Options nosniff;
      add_header X-XSS-Protection "1; mode=block";
      add_header Referrer-Policy "origin";

      # Add the trailing slash
      rewrite ^([^.]*[^/])$ $1/ permanent;
    }

}

After adding these lines, save the file and close your editor.

There's one more step before we can use this config: symlinking it to the sites-enabled directory (which NginX reads). To do this, type the following command:

# sudo ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf

Adding Another Config File

The next config file will be slightly different, because it's for a subdomain. Using this config, we'll proxy traffic from the commento subdomain to a backend server at 192.168.0.230 port 80.

To start making our config, we can create another file in the /etc/nginx/sites-available/ directory called SUBDOMAIN.conf (replace SUBDOMAIN with the proper subdomain name, in this case commento).

The first server block we add will redirect traffic from http on port 80 to https on port 443.

server {
    listen 80;
    server_name commento.yeetpc.com;
    return 301 https://$host$request_uri;
}

This next server block will perform the actual proxying. It will listen on commento.yeetpc.com port 443 and proxy requests to 192.168.0.230 port 80. To do this, we’ll add a location block inside the server block. Within the location block, we set proxy headers which NginX forwards to the backend, and we add the proxy pass and proxy redirect with the ip address and port of the backend server. Again, the security headers at the bottom are optional, but they will greatly improve the security of your server, so I recommend that you add them.

server {

    listen 443;
    server_name commento.yeetpc.com;

    # SSL configuration

    ssl_certificate /etc/letsencrypt/live/commento.yeetpc.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/commento.yeetpc.com/privkey.pem; # managed by Certbot
    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    # Set the access log location

    access_log            /var/log/nginx/commento.access.log;

    location / {

    # Set the proxy headers

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Configure which address the request is proxied to

      proxy_pass          http://192.168.0.230:80;
      proxy_read_timeout  90;
      proxy_redirect      http://192.168.0.230:80 https://commento.yeetpc.com;

      # Set the security headers

      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"; #HSTS
      add_header X-Frame-Options DENY; #Prevents clickjacking
      add_header X-Content-Type-Options nosniff; #Prevents mime sniffing
      add_header X-XSS-Protection "1; mode=block"; #Prevents cross-site scripting attacks
      add_header Referrer-Policy "origin"; #Idk what this actually does";
    }

}

After adding these two server blocks, save the file and exit out of your text editor.

Finally, symlink the file to sites-enabled/ using the command below:

sudo ln -s /etc/nginx/sites-available/SUBDOMAIN.conf /etc/nginx/sites-enabled/SUBDOMAIN.conf

To add any additional subdomains, simply copy the previous config file and replace the server_name with the new subdomain, along with the backend's ip address and port. Then symlink the new file to the sites-enabled directory.

Temporary SSL Certificates

Before we can restart NginX and put our new configuration into action, we have to create a temporary SSL certificate. If you try to start NginX without a temporary cert, it'll complain about not finding the certificate file.

To create a temporary certificate, type the following command:

# openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

Then change these lines in the config file:

ssl_certificate /etc/letsencrypt/live/yeetpc.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/yeetpc.com/privkey.pem; # managed by Certbot

to this:

ssl_certificate /home/user/certificate.pem; # managed by Certbot
ssl_certificate_key /home/user/key.pem; # managed by Certbot

Make sure to replace "user" with your server username.

Finally, restart NginX using the following command:

# systemctl restart nginx

Obtaining Let's Encrypt SSL Certificates

Now that Nginx has restarted with the new configuration, we can obtain SSL certificates from Let's Encrypt, a certificate authority that provides free certificates. To obtain a Let's Encrypt certificate, we can use Certbot. To install Certbot on Ubuntu Server, type the following commands:

# apt update
# apt install python3-certbot-nginx

Then, to obtain a certificate for the www and non-www domains, type the following command, replacing yeetpc.com with your main domain name:

# certbot --nginx -d yeetpc.com -d www.yeetpc.com

Certbot will ask for some information, including your email address, agreement to the Terms of Service, and whether or not you want to subscribe to their newsletter. Then, certbot will obtain your certificate.

To obtain a certificate for any additional subdomains, type the following command, replacing sub.domain.com with the proper subdomain address:

# certbot --nginx -d sub.domain.com

Once you've obtained the certificates, restart NginX with this command:

# systemctl restart nginx

Now, visit each of your subdomains and ensure that they are accessible over https.

Cron Job to Renew SSL Certificates

The last thing we should do is to set up auto-renewal of SSL certificates using cron. To do this, open the crontab for editing using the command shown below:

# crontab -e

Then add the following line to the crontab to automatically try to renew the certificates at 1:00am every day.

0 1 * * * certbot renew

Conclusion

In conclusion, a reverse proxy allows you to easily host multiple sites on the same ip address without exposing unnecessary ports. If you enjoyed this article, be sure to check out some of my other articles about my ThinkPad X220 Tablet, using an iMac G5 in 2020, and hardening a Linux server. Or check out the accompanying video. If you have any questions or comments, be sure to let me know down below. Thanks for reading!

The iMac G5 was one of the last Macs to be shipped with a PowerPC CPU. The transition to Intel marked the end of a great era in computing and the beginning of another (arguably not so great) one. As Apple moves toward another change in their CPU architecture, I wanted to take a look at the past to see just how capable these machines were and still are today.

First, a bit of background on my specific G5: it's a 17 inch 1.8ghz model with 768MB of RAM. I won it at a Goodwill auction as a parts/repair with a flashing folder icon. After receiving it, I cleaned the stains on the plastic and installed an SSD I had lying around. Once I figured out how to boot from usb via Open Firmware (I had no Mac OS X DVD), I installed OSX 10.5 Leopard, which is the latest OS that any PPC-based Mac can run. I replaced the thermal paste as well.

After creating a user account and installing updates (yes, Apple's servers for Leopard still work!), I went ahead and tried an assortment of software, both old and new, on the iMac. Below are my thoughts on each software and the general usability of this G5 in 2020. Enjoy!

System Apps

Many of the system apps you'll find in Leopard and older versions of OSX are very similar to the ones used today. For example, Finder is basically the same today as it was 15 years ago, which goes to show how much thought was put into making early OSX versions as perfect as they could be. OSX Leopard also introduced Cover Flow, which allowed you to easily preview multiple files within a folder. Another important feature on these machines was Spaces, which allows you to organize and switch between multiple workspaces with different apps running in each. This feature was only just implemented by Microsoft in Windows 10 with virtual desktops. Another functionality Leopard introduced was Time Machine backups, which allows a user to automatically back up and restore previous versions of the files on their system.

Just like newer versions of MacOS, Leopard is based on BSD, which means you'll feel right at home if you have experience with UNIX/Linux-based systems. Using the terminal, I was able to carry out many common tasks right out of the box, such as cloning a git repo, SSH'ing into my servers, and connecting to CIFS shares. One thing that may hold you back from installing Leopard on your PowerPC Mac, though, is the lack of support for classic apps. Leopard no longer supports using the classic environment, which may be important if you plan on running Mac OS 9 apps. Some other system apps include iTunes, iPhoto, and iDVD. These programs are still very useful today for managing your music/photo libraries and burning DVDs. On the other hand, some system apps like Safari are almost completely unusable today.

A Web Browser

Since Safari won't properly load many newer websites, Flooodgap Systems created TenFourFox, a fully-featured web browser that can load the latest websites at a usable speed. TenFourFox was able to completely load many everyday websites, including Apple.com, Amazon, and Reddit.

There is one notable exception to the list above: YouTube. This is because it's almost impossible to even get YouTube to load on a PowerPC Mac, especially my lower-end iMac. If you succeed in loading YouTube, even a 144p video will constantly buffer and the CPU fans will spin up very loudly. This is because this iMac isn't really meant to run YouTube. If you have a more powerful Mac such as a PowerMac G5, you'll likely be able to achieve better playback.

Productivity

Before we get into all the productivity apps you can run on a PowerPC Mac, I just want to show how quickly you can launch many common apps compared to a modern machine. The chart below shows how quickly the iMac opened programs compared to my ThinkPad. (Keep in mind that it does have an SSD)

As you can see, the iMac doesn't fall too far behind a much more modern laptop and actually beats it in a few programs. This is a testament to the great performance of PowerPC Macs. Working on a PowerPC Mac is also a lot less distracting than working on a newer Mac or PC, since you aren't constantly being bombarded with notifications. As a result, you can be a lot more productive on one of these Macs.

Office Applications

If you're doing any kind of work, you'll likely need to use an Office suite. Originally, I wanted to use the open-source PPC build of LibreOffice, but it was slow and, at times, unusable. So, I grabbed Office for Mac 2008 from Macintosh Garden. It can open all of the current Office file formats (docx, pptx, xlsx, etc.) and can edit them as well. Additionally, it is very snappy and loads files quickly from the SSD or the network.

Using this Mac, I was able to compose documents for school and for my other projects. I was also able to make presentations with animations and other features. By using a PowerPC Mac with and old version of Office, you can see that not much has really changed in newer versions of Office, and most of the added features don't help with functionality. Web-based office applications such as Google Docs and Office Online don't work very well, though, due to the relatively limited web-browsing capabilities of this iMac.

Creative Applications

To evaluate creative applications, I downloaded Adobe Creative Suite 3 from Macintosh Garden. It includes Adobe Illustrator, Photoshop, InDesign, Lightroom, and Aftereffects. I was able to achieve paints for multiple effects in Photoshop almost instantly, which provided a very nice editing experience.

Games!

Of course, any usable computer needs to be able to game properly, and I'm glad to say that the iMac G5 is no slouch when it comes to older games. I downloaded a few classics, including Quake 3 Arena and Halo: Combat Evolved. My machine was able to easily run both titles at about 30 FPS with low/medium texture quality. The fans do spin up quite a bit under load, though, so you may want to invest in a higher-end Power Mac G5 if you plan on doing more intense gaming.

My iMac G5 runs Leopard, so it can't run classic games and other Mac OS 9 applications. I am working on a Mac OS 9 dual boot on my newly restored PowerMac G4, though, so let me know if you'd like to see a video or a post on that.

Conclusion

In conclusion, a low-end PowerPC Mac from the early-2000s or late-90s is still a very usable machine that allows you to be productive and have fun at the same time.

A few days ago, I was running a full system upgrade on my garage door Pi when it lost power. Anyone who has worked with a Pi, or just SD cards in general, knows what happened next: the card corrupted. For a few days, I put off reinstalling Raspbian because I knew I'd have to manually install bottle.py, its dependencies, and the Python controller script (which would take like half an hour). Instead, I took about 2 hours writing, testing, and debugging a script which would automate the whole process.

Prerequisites

Before running the script, make sure your Pi is wired properly as shown in the video, is connected to wifi, and you can SSH into it over the network. Also, make sure you have run

sudo apt update && sudo apt upgrade -y

so that your system is fully up to date before the installation.

What does it do?

Basically, the script starts with installing python3, python3-dev and python3-rpi.gpio, which are all dependencies of the python script. Then it makes the "garagedoor" directory and changes into it. After this, it fetches bottle.py from their website. It then fetches the latest version of the python script from the GitHub repo. Finally, it edits the /etc/rc.local file so that the script will automatically run on startup. After this, it waits 5 seconds and reboots.

Installation

First, get the latest version of the script from the GitHub repo:

wget https://raw.githubusercontent.com/Rav4s/Pi-Garage-Door-Opener/master/install.sh

Then, make it executable:

chmod +x install.sh

Finally, run the script and follow the terminal prompts:

./install.sh

Once it's finished installing, your Pi will automatically reboot and you'll be able to access it at http://raspberrypi.local:1234/login. The default password is xxxx, which you should change. Also, you can tweak the default sensor distance in the code to match your specific garage door:

--snip--
if distance >= YOUR DISTANCE IN CM: #Check if the distance is less than YOUR DISTANCE IN CM
    return 'The garage is closed.'
else:
    return 'The garage is open.'
--snip--

Check out my GitHub repo for all the code, including the install.sh script, Python control script, and the Android app code. I hope you enjoyed! See y'all next time.

If you have an internet-facing server, then you probably want to keep the connections to the server and the data on it as secure as possible. In order to do this, you have to tighten up security rules to secure your data. There are many great ways to "harden" your server against attacks, and most of them are very easy to implement. Below are 5 of the best ways to harden your servers. Enjoy!

#1: Configure and Use a Firewall

While it seems like a very simple thing to do, maintaining a good firewall is one of the most overlooked parts of server hardening. A firewall can ignore or drop connections to ports that you don't want to expose. On many Linux distributions, the firewall is installing but not active by default, so you have to manually enable it. On Ubuntu server the syntax is as follows:

NOTE: commands starting with "#" should be run as root or with "sudo"

# ufw allow Openssh
Rule updated
Rule updated (v6)

# ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)?
Firewall is active and enabled on system startup

Make sure to allow your SSH connection before enabling the firewall so you don't get locked out, because firewalls will ignore connections by default. Use ufw status to check the status of the firewall. On RHEL/CentOS/Fedora servers, the firewall can be managed through the built-in Cockpit utility. To access Cockpit, visit https://[serverip]:9090/ and you'll see a login page. Sign in to manage your server. Navigate to the Networking tab and click firewall. From here, you can add services and ports to allow through the firewall.

The firewall isn't something you can just set and forget, though. As you add or remove services, you must stay vigilant and add or remove those ports as well, so that you minimize the amount of exposed ports and prevent unwanted traffic. (At one point, my NC Server had so many unnecessary open ports that I just reset all the rules using ufw reset) Fortunately it is very easy to remove firewall rules in any Linux distribution.

#2: Regular or Automatic Security Updates

Oftentimes, security updates contain fixes to the Linux kernel or other important system utilities and services which are essential to the function of your server. Security updates may also contain things like microcodes, which are released to combat specific attacks, such as Spectre and Meltdown. Because security updates are so crucial, it's important to regularly install them manually, or even configure automatic security updates. To enable automatic security updates in Ubuntu, we use the apt unattended-upgrades package. To install it type the below commands:

# apt install unattended-upgrades
Check if it's running after installation
$ systemctl status unattended-upgrades

If it says the service is active/running, then you can continue to the next step. We need to enable automatic updates for the security repository. To do this, we need to edit the config file:

# nano /etc/apt/apt.conf.d/50unattended-upgrades
Then remove the // from the line ending in "security"
# nano /etc/apt/apt.conf.d/20auto-upgrades
Then edit the file so it looks like this:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Great! Now your Debian/Ubuntu server has automatic updates enabled. But what if you have a RHEL-based server OS? Well, it's even easier to do from the Cockpit management interface. Go to your Cockpit instance at https://[serverip]:9090/ and click on software updates in the left bar. Wait for a few seconds for it to refresh package information. Now you can select which updates to automatically install and what day of the week & time to install them.

Another thing you can do on Ubuntu systems to apply important kernel patches without a restart is to install Canonical Livepatch. To do this, visit their website and sign in to your Ubuntu One account. Then, get your livepatch token and keep it safe. Type the following commands to install and enable livepatch on your system.

# snap install canonical-livepatch
# snap list

Name                 Version      Rev    Tracking       Publisher   Notes
canonical-livepatch  9.5.5        95     latest/stable  canonical✓  -
core                 16-2.45.3.1  9804   latest/stable  canonical✓  core
core18               20200724     1885   latest/stable  canonical✓  base
nextcloud            19.0.1snap3  22653  latest/stable  nextcloud✓  -

# canonical-livepatch enable [token]
(Replace [token] with your auth token from earlier)
Successfully enabled device. Using machine-token [token]

Your kernel livepatching should now be active.

#3: Securing Secure Shell (SSH) Connections

If you manage a server, it's likely that you remotely connect to its terminal over Secure Shell (SSH). SSH is inherently secure as it uses an encrypted connection, but there are still some things that should be tightened. Firstly, you should disable root login over SSH. The root user can be used to perform potentially dangerous tasks on your system, so you should block remote root login. To do this, we have to edit the SSH config file:

# nano /etc/ssh/sshd_config
Edit the line with "PermitRootLogin" so it says PermitRootLogin no
# systemctl restart sshd

Another thing you can do to tighten up SSH connections is to only use SSH keys. SSH keys are pairs of public and private keys which are used to authenticate SSH connections. They are much harder to brute force than passwords, so they provide a higher level of security. To use SSH keys, we first have to create the key pair on the client machine. On Linux/MacOS machines, simply type ssh-keygen -t rsa and follow the instructions. Then copy the public key to the server using ssh-copy-id user@serverip. On Windows (PuTTY), open PuTTYGen and click generate. Then move your mouse around to generate randomness. Save both keys in a safe location. To copy the public key to the server, open an SSH session and type the following:

# umask 077 && test -d ~/.ssh || mkdir ~/.ssh
# umask 077 && touch ~/.ssh/authorized_keys
# nano .ssh/authorized_keys
Paste the contents of your public key file here

You should be able to login with just your SSH keys now. If it doesn't work, you should make sure the line PubkeyAuthentication and AuthorizedKeysFile are uncommented in SSH config.

Another thing you can do to tighten up SSH security is installing fail2ban. Fail2ban refuses connections from brute-forcing ip addresses, making your server more secure from brute-force attacks. To install it on a Ubuntu/Debian system, type these commands:

# apt install fail2ban
# fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

On a RHEL-based system, type the following to install fail2ban:

# yum install epel-relase
# yum install fail2ban
# systemctl enable fail2ban
# fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

Now your servers are protected against brute-force SSH attacks.

#4: Use SELinux

Security Enhanced Linux (SELinux) is a Linux security kernel module which controls access to different applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy. To learn more about SELinux, visit the Red Hat wiki. SELinux is included and enabled by default on the latest releases of RHEL/CentOS/Fedora systems. To install SELinux on Ubuntu/Debian systems, type the following commands:

# apt install selinux selinux-utils selinux-basics auditd audispd-plugins
# reboot
# sestatus

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     requested (insecure)
Max kernel policy version:      31
    
# setenforce 1 (to change mode from permissive to enforcing)

Now that SELinux is installed, we need to allow some services access. These are some common services and how to enable them with SELinux.

Allow web server httpd:
# setsebool -P httpd_unified 1

Allow samba server:
# setsebool -P samba_export_all_ro=1 samba_export_all_rw=1
# semanage fcontext -a -t samba_share_t "/path/to/share(/.*)?" (replace /path/to/share with your share path)

Allow Nextcloud server:
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.htaccess'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/3rdparty/aws/aws-sdk-php/src/data/logs(/.*)?'

restorecon -Rv '/var/www/html/nextcloud/'

Now, to permanently enable SELinux, type the following commands:

# nano /etc/selinux/config
Change to SELINUX=enforcing

Great! Now SELinux is installed and enabled on your server!

#5: Lynis Security Auditing

Even if you follow best practices and attempt to tighten security on every attack vector, you'll still leave some things open to attacks or exploits. Lynis is a tool that helps you see security vulnerabilities that you aren't able to spot on your own. Lynis performs an extensive health scan of your system to find possible security vulnerabilities and general optimizations for your system. To learn more about Lynis, visit Cisofy's website.

Lynis is available as a package for Debian and RHEL-based systems. To install on Ubuntu/Debian, type the following commands:

# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C80E383C3DE9F082E01391A0366C67DE91CA5D5F
# echo "deb https://packages.cisofy.com/community/lynis/deb/ stable main" | tee /etc/apt/sources.list.d/cisofy-lynis.list
# apt update
# apt install lynis

To install on RHEL-based systems, type the following commands:

# dnf update
# dnf install lynis

To check if it was successfully installed and to audit your system for the first time, run the following commands:

# lynis show version
3.0.0
# lynis audit system
[ Lynis 3.0.0 ]

[+] Initializing program
------------------------------------
  - Detecting OS...                                           [ DONE ]
  - Checking profiles...                                      [ DONE ]

  ---------------------------------------------------
  Program version:           3.0.0
  Operating system:          Linux
  Operating system name:     CentOS Linux
  Operating system version:  8
  Kernel version:            4.18.0
  Hardware platform:         x86_64
  Hostname:                  hostname

---snip---

  -[ Lynis 3.0.0 Results ]-

Warnings (1):
warnings will appear here

Suggestions (9000):
suggestions will appear here

Lynis security scan details:

  Hardening index : 68 [#############       ]
  Tests performed : 258
  Plugins enabled : 0

  Components:
  - Firewall               [V]
  - Malware scanner        [X]

  Scan mode:
  Normal [V]  Forensics [ ]  Integration [ ]  Pentest [ ]

  Lynis modules:
  - Compliance status      [?]
  - Security audit         [V]
  - Vulnerability scan     [V]

  Files:
  - Test and debug information      : /var/log/lynis.log
  - Report data                     : /var/log/lynis-report.dat

Security scan finished.

Lynis will divide its output into warnings, which are very important and should be dealt with immediately, and suggestions, which are less important but you should still consider implementing some of them to improve security.

Additional stuff

Another security measure you can implement is full-disk encryption with LVM. Full disk encryption can help protect important data from being breached even if the server is hacked, since the data can't be decrypted without the passphrase. Usually, you can choose this option when partitioning your disks on a fresh install. Below is an example in the CentOS installer:

A few other things to keep in mind are to frequently monitor access/usage logs to pick out unwanted traffic and to always have (working) backups in case of data loss from an attack. You can also only forward necessary ports on your router to provide network-wide security.

I hope you enjoyed this post! If you have any questions or comments, I have recently added a Disqus for this site, which you can access below. Be on the lookout for a server hardening video in the coming weeks. Thanks for reading!

A few months back, I bought an iMac G5 from Goodwill for $16.50. It was listed as parts/repair with a flashing question mark on boot. When I received it, I found that there was no hard drive installed, so I installed a spare SSD I had. After a few days of fiddling with Open Firmware, I got it to boot from an OSX Leopard USB and I installed OSX 10.5 Leopard on the drive.

After installing Leopard and making sure everything worked, I cleaned up the dark spots on the plastic case using a toothbrush. Then, I installed a few programs so that it could be more useful today. After this, I was able to use the iMac to do many different tasks, but I quickly found out that it was running quite hot (70 to 75 degrees Celsius). Because of this, the fans would ramp up, making a lot of noise. During tasks that used a lot of CPU, the machine would almost become unusable. So, I decided to dust out the computer and replace the thermal paste. Below is a comprehensive guide to removing the logic board and replacing the CPU thermal paste. I hope you enjoy!

Disassembly

1. Begin by shutting down the iMac and removing the power cable & peripherals

2. Then flip the iMac over and carefully set it down on its screen

3. Unscrew the three bottom screws until they no longer turn. They won't come out all the way, but you should unscrew them as much as you can.

4. Fully remove the back cover

5. Next, remove both sticks of RAM by unlocking the locks and pulling them straight out

6. Remove the three Philips head screws holding down the optical drive

7. Pull up and out to remove the optical drive

8. Turn the middle bottom screw clockwise to free the power supply

9. Remove the three screws along the top of the power supply

10. Pull the PSU up and out, and remove the logic board power connector

NOTE: IT MAY TAKE A LOT OF FORCE TO REMOVE THE POWER SUPPLY, BUT TAKE CARE TO NOT DAMAGE ANY OF THE NEARBY CAPACITORS ON THE LOGIC BOARD

11. Disconnect the HDD thermal sensor cable from the sensor board

12. Remove the two screws holding in the fan duct

13. Remove the two screws holding down the fan cover and lift it out

14. Remove the two screws holding down the display cable and disconnect it from the board

15. Disconnect the SATA power and data cables from the logic board

16. Disconnect the two fan connectors

17. Slide out and disconnect the inverter to display cable

18. Remove the screw holding the inverter in place

19. Pull straight upward to remove the inverter, and disconnect its cable from the logic board

20. Remove the lower fan and speaker connectors by using a spudger to pull straight upwards

21. If you have an airport card installed, pull up on the tab and remove it

22. Remove the Torx screws on either side of the airport slot to access the modem card

23. Remove the two T6 Torx screws holding in the modem, and pull straight up to remove it

24. Now, remove the 6 T10 Torx screws and 3 Philips head screws to remove the logic board

25. Pull straight upward to remove the logic board

26. Set it down gently so you don't damage any components

27. While the board is out, clean the heatsink and blow out any dust to improve cooling

28. Turn over the logic board and clean the old thermal paste off the CPU using isopropyl alcohol and a q-tip/paper towel

29. Now clean off the residue from the heatsink on the front assembly of the iMac

30. After cleaning off the paste, apply a glob of paste to the CPU and spread it evenly

Reassembly

31. Replace the logic board in the case, making sure to line up the attachment points

32. Screw in the 6 T10 Torx and 3 Philips screws that hold in the board

33. Replace the modem card and screw it in

34. Replace the airport card holder and the airport card (if installed)

35. Push the lower fan, speaker, and mic cables back into the board

36. Attach the inverter cable to the logic board, and reseat the inverter

37. Screw in the Philips screw holding in the inverter and re-attach the inverter-to-display cable

38. Connect the SATA data and power cables to the board

39. Connect the upper fan connectors to the board

40. Reseat the display cable and screw in the two screws holding it in

41. Re-position the fan shroud/cover and screw in the two screws

42. Screw in the two screws holding the fan duct to the heatsink

43. Use a spudger to push the HDD thermal sensor cable back in

44. Replace the power supply into the case

You may have to pull the bottom of the case so you can fit the PSU

It also may take a while to replace the PSU, so be patient and careful with the components nearby

45. Screw in the PSU screws, and turn the middle bottom case screw counter-clockwise to lock it in place

46. Replace the optical drive by pushing the white alignment things into the case and then pushing the back of the drive onto its connector. It may require a bit of force to attach the drive to the connector

47. Screw in the three Philips screws holding in the drive

48. Push in both sticks of RAM until the locks click into place

49. Align the back cover and reseat it onto the case

50. Screw in the two outermost screws on the bottom case until they no longer turn

51. Make sure everything is secure and stand the iMac back up

52. Great! You're done re-applying thermal paste on your iMac G5

Results

After re-applying the thermal paste and thoroughly cleaning out the fans/heatsinks, I was able to reduce idle temps from ~50 to ~45 degrees Celsius. Under load, the effect was even more profound: temperatures were reduced from ~75 to ~60 degrees. The fans weren't as loud, and didn't kick in as often. During simple text editing and simple terminal work, the system was completely quiet. During tasks like heavy web browsing, watching DVDs, etc, the system was a lot more usable due to lower temps. If you own an iMac G5 and you've never changed the thermal paste, I highly recommend that you do this. It's a fairly straightforward process that yields great results. If you want more posts and/or videos on the iMac G5, make sure to comment down below. Thanks for reading!

If you're looking for a student laptop in 2020, there are a few things you should take into account, such as processing power, battery life, durability, and cost. Taking these constraints into account, many buyers will choose a new Chromebook, which can be bought for about $200. Well, this school year, I was one of those buyers, but I didn't want a Chromebook for many reasons (inability to run various software, zero durability/cheap design, low performance per $, etc.). I had a budget of about $200, so I started looking for laptops around that price.

Eventually, I stumbled upon the ThinkPad X220. It's specs were more than enough for my use case - an i5 or i7 processor, up to 16 gigabytes of RAM, and SATA 3. Apart from the specs, the Thinkpad had a great support community, and it is widely regarded as an industry standard for durability. After finding out so many great things about this laptop, I started looking for them on eBay, and I was truly surprised to find one for only $105. It had 4 gigabytes of RAM, a mechanical drive, and an i7 processor. It was also a tablet version with touch and stylus support, which is an added plus.

I found that I'd have to spend about $30 for an SSD upgrade, and I already had 8 gigabytes of Crucial memory on hand. With this in mind, the total cost would be less than $140. Since this was a great deal and well within my budget, I pulled the trigger on the laptop.

Upgrades

A week later, the Thinkpad arrived at my doorstep. After unboxing and cleaning the laptop, I began the SSD and RAM upgrades, which went smoothly due to the easy access to the drive and memory bays. After the hardware was installed, I installed Windows 10 using the Media Creation Tool. (The only reason I didn't use Linux is software required for school that only runs under Windows/Chrome OS/MacOS) With Windows installed, I installed Lenovo Vantage, a computer management software that allows you to use your Thinkpad's hotkeys, set a battery charge threshold, and more. I also installed the tablet button drivers, which allow you to use the display flip, ctrl+alt+delete, and dedicated sleep buttons on the left side of the display.

My experience

At the time of writing, I have been using the Thinkpad X220T for about 2-3 weeks, and it has been great. Here are a few things I have done on this laptop:

• Typing documents
• Making this website
• Administering my servers through SSH
• Video editing/production (I use an external display for higher resolution)
• Watching 1080p video
• Web browsing
• 3d design/ rendering in Blender
• And I can still get 5-6 hours of battery life! (Out of a new battery)

A (kinda) Unexpected Upgrade

One thing I did notice with the X220T, though, was that it would get pretty hot (I'm talking over 95C!) while doing CPU-intensive tasks like rendering video. Because of this, I replaced the thermal paste on the CPU, pulling the temps down by about 10C at idle and 15C under load. The paste I used was Arctic MX-4, a non-conductive paste that is extremely effective. I've summarized the steps for repasting the CPU below, but I still recommend you watch a video before attempting to do so.

NOTE: THE INSTRUCTIONS MAY BE SLIGHTLY DIFFERENT FOR THE REGULAR/TABLET MODELS

1. Begin, as always, by removing the battery

2. Remove the drive bay cover and the drive

3. Remove the keyboard & palmrest screws

4. Remove the keyboard and palmrest, and disconnect the ribbon cables

5. Remove and unwind the wireless card wires.

NOTE: REMEMBER WHERE THEY GO SO YOU CAN PUT THEM BACK CORRECTLY

6. Remove the screws holding the plastic shield down from the top

7. Remove the two remaining screws on the bottom case and in the battery compartment

8. Rotate the screen and pull out the plastic shield

9. To remove the motherboard, you have to remove the screen

10. Remove the screen ribbon cables on the board

11. Remove the four screws that hold the hinge in place

12. Lift the screen out of the body

13. To remove the motherboard, use pliers to remove the VGA connectors, which hold the board in place

14. Remove the two screws inside the ExpressCard slot

15. Remove the wireless card screw, which also holds down the board

16. Finally, remove the pen insert detector and lift the motherboard up and out

17. While lifting up the motherboard, disconnect the AC power cable

18. Remove the CPU fan connector and the piece of tape holding it in

19. Remove the four screws holding in the CPU fan and lift it off

20. Clean off the thermal paste from the CPU and fan using isopropyl alcohol and q-tips

21. Apply the new thermal paste and spread it over the CPU die

22. Reinstall the fan and screw it in so it's flush with the CPU

23. Reinstall the motherboard, display, shield, wireless card, keyboard, palmrest, SSD, and battery in that order

I also replaced the battery with a new GHU 6-cell, which gets 5-6 hours on a charge.

Conclusion

In conclusion, the X220/T is a great laptop for students and is very easy to upgrade to suit your needs. It can tackle many intensive tasks, and will easily survive your years at school. You can buy an X220 for yourself here and you can watch my full video here.