DIY
Stuck right now? Start in the DIY section
Short cards, one error message each: the command that fixes it comes
first, then why it happens and one command to confirm it is fixed.
2026-08-03 · 6 min
“UFW is not installed” does not mean you have no firewall (the Debian 13 trap)
Your audit says UFW is not installed on Debian 13. Debian ships nftables
instead. How to check your real firewall state, and why installing UFW can backfire.
2026-08-03 · 7 min
Changing your SSH port: what it actually fixes (and what it doesn't)
Should you change your SSH port from 22? Measured data: 1234 attempts in 41
hours, what a non-standard port really stops, and what cuts actual risk.
2026-07-26 · 7 min
An SD clone that boots is not an SD clone that works
A cloned Raspberry Pi card booted fine and the stopwatch said 13 seconds
faster, while 69 files were quietly wrong. The byte-by-byte autopsy, the cold method that
works, and why "zero divergences" would have rejected the perfect clone.
2026-07-20 · 7 min
Five green lights that lied: anatomy of a routine Linux checkup
A routine checkup on a hardened Linux box: five reassuring signals that were
traps, from the empty grep to the stale score, and the habit that defuses every one of them.
2026-07-20 · 7 min
Microsoft scores an F, my blog scores an A: what a security grade really measures
Three scans on securityheaders.com: microsoft.com F, facebook.com A, this
static blog A. None of the letters means what it looks like: one is a business decision,
one stops exactly where the ad revenue begins, and one costs a single file.
2026-07-19 · 7 min
1234 login attempts in 41 hours: who really knocks on an exposed SSH port
A quiet test box, no DNS, nothing published. We counted the knocks: 93 IPs,
132 usernames from postgres to AdminGPON to pi, activity around the clock, and the one
zero that kept the door shut.
2026-07-19 · 7 min
Raising your Lynis hardening index: what actually moves the score
Measured fix by fix: the 25-point penalty apt upgrade leaves behind, why
installing security tools earns nothing, the SSH block that scores all or nothing, and four
rules for an honest climb.
2026-07-19 · 6 min
Locked out of your own server: the five classic SSH lock-outs
Password login off without a tested key, the firewall before the allow rule,
fail2ban banning you, the port change systemd ignores, and the typo that explodes weeks
later. Each one has a habit that makes it survivable.