TCP Syn Flood Hardening – Kernel IPv4 Settings

With the increasing TCP flood attacks and AI bot scraping floods, here are some optimizations that should be added to the end of your /etc/sysctl.conf file:

# Hardening
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.tcp_max_syn_backlog=2048
net.ipv4.tcp_synack_retries=2
net.ipv4.conf.all.accept_redirects=0

Reboot for the settings to take effect.

Dell C1100 – Partitioning for RAID 10

In the Rocky Linux installer, choose custom partitioning.  First, create a /boot mount point that is 2GiB in size.  Set device type to RAID and RAID Level to RAID1.  Next, create / as an LVM partition on a RAID 10 pool.  Lastly, create the SWAP area as an LVM partition on the RAID 10 pool.  That's all you need to do. 

Grub will be synced across the four drives.  Thus, if one drive fails, the other drives can still boot Rocky Linux so that the RAID array can be rebuilt.   

Lantronix Spider SLS200 KVM – Reset to defaults

If you buy some cheap SLS200 KVM spiders off of eBay, you'll need to reset the configuration of the spider back to its default configuration so that you can access it using the default login and password (and have it set to use DHCP). 

You'll need an ethernet to USB serial cable that you'll plug into the serial port on the spider.

Get it to boot by plugging in both USB connectors so that the device receives the power it needs.  Open Putty and connect to the proper COM port your USB serial cable is providing an interface for.  For me, it was COM3, but you can detect it by going to Device Manager –> Ports (COM & LPT).

With Putty open and receiving the serial output, insert a paperclip or similarly small wire into the Lantronix reset area and press the reset button down. 

With Putty as the active window, press the down key on your keyboard followed by escape.  Now type defaults

The device will reset to defaults.  You can login when it has been reset by using sysadmin as the login and PASS as the password.

Here is the source for the above instructions:  https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/97944090/Reset+a+Spider+to+factory+defaults+using+the+serial+console+port+and+the+Reset+button | Mirror

Now you can update the firmware to the latest version.  Be sure to check if it is a USB 01 or USB 02 version by looking at the device model sticker on the KVM spider.  If it is USB 01 (older), you can use this firmware:

https://ts.lantronix.com/ftp/spider/4.3.6/spider-v4.3-38143_2025-08-07.zip

Here's a mirror if the above is offline:

Mirror

Clone and Compress LVM Volume to Disk Image

If you need to backup an LVM volume, you can do so by first turning off the virtual machine that is using the volume, and then you can use the dd and gzip utilities to create a copy of the volume to an .img file and compress the image file.  This compressed image file can then be transferred remotely over SSH or HTTP (for fastest results) to another server where it can be restored.

Need More Storage Space for the Backup Image (Optional)?

If you don't have enough storage space on the root LVM volume the main system uses on the host server to handle saving the backup image file to, you can always create a new LVM and then mount it on the host LVM file system to save it there.

These steps are optional:

1.  Create new hard drive in your vm pool using virt-manager and name it temp_storage – you don't need to setup the OS or continue creating the virtual machine

2.  Format and mount this new LVM volume (update vms with your pool's actual name – on my server, it is named vms):

mkfs.ext4 /dev/mapper/vms-temp_storage
mount /dev/mapper/vms-temp_storage /mnt/store

Copy and Compress the LVM

Use the below commands to copy your LVM volume to an img file.  Update the names and the paths as needed.

dd if=/dev/vms/name_of_lvm of=/mnt/store/name_of_lvm.img bs=8M status=progress
gzip name_of_lvm.img -1

Uncompressing and Restoring the LVM

Just decompress the image file and then use the dd command to restore the image to the LVM volume created on the target or restore server.

gunzip name_of_lvm.img.gz
dd if=name_of_lvm.img of=/dev/vms/restore-lvm-name bs=8M status=progress

And you're done 🙂

Updated uBlock Origin for Pale Moon / Firefox Legacy Browsers

https://github.com/UCyborg/uBlock-for-firefox-legacy/releases/tag/1.16.6.0

Running Multiple Different PHP Versions Simultaneously on Ubuntu 24.04

If you need to run multiple different versions of PHP simultaneously on your Ubuntu server, it can be done.  This is needed when you want to host some legacy sites that cannot run with the breaking changes made in the newest versions of PHP (shame on you PHP for doing such nonsense). 

Here's how I did it on an Ubuntu 24.04 server which uses PHP 8.3 by default.  In this example, I have already installed and configured all web server software packages including PHP 8.3.  The EHCP Force installer can do this for you if you don't know how to install and configure everything you need to run your own web server.

Add the ondrej repo and install PHP 5.6 and 7.4:

sudo add-apt-repository -y ppa:ondrej/php
sudo apt update
sudo apt upgrade
sudo apt-get install php5.6 php5.6-fpm php7.4 php7.4-fpm
sudo apt-get install php7.4-mysql php5.6-mysql php5.6-mysqlnd-ms php7.4-gd php5.6-gd php5.6-zip php7.4-zip php7.4-cli php5.6-cli php5.6-mcrypt php7.4-mcrypt php7.4-gettext php5.6-gettext php5.6-mailparse php7.4-mailparse php7.4-imagick php5.6-imagick php5.6-curl php7.4-curl php7.4-xmlrpc php5.6-xmlrpc php5.6-imap php7.4-imap

I then adjusted the fpm php.ini files in the /etc/php/5.6/fpm/ and /etc/php/7.4/fpm directories to use custom settings that I use (optional).  I then edited the FPM pool for each version of PHP in the www.conf file in /etc/php/7.4/fpm/pool.d and /etc/php/5.6/fpm/pool.d directories to listen on a different port than PHP 8.3.  For example, for PHP 7.4, I changed the listen port to 9011.

Then, for the particular website I wanted to run under a different version of PHP, I changed the nginx template to use the corresponding port for the desired PHP FPM version like so:

location ~ \.php$ {
        root {homedir}/httpdocs;
        include fastcgi_params;
        try_files $uri = 404;
        fastcgi_pass   127.0.0.1:9011;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param  PHP_ADMIN_VALUE "open_basedir={homedir}:/usr/share/php:/usr/share/pear \n upload_tmp_dir={homedir}/phptmpdir \n session.save_path={homedir}/phptmpdir";
        fastcgi_read_timeout 300;
        limit_req zone=one burst=5;
    }    

Restart nginx.  The website you configured to use a specific version of PHP will be using that version now.

Migrating a WordPress Website to a New or Different URL / Domain Name

When migrating a WordPress website from one URL to another, it's not as simple as exporting the current database to a SQL file, changing the URLs in the SQL file, dropping all tables in the database, and then re-importing the updated SQL file (which contains the updated URL).  Using a find and replace text editor utility to update the old URL to the new one in the MySQL database dump file IS NOT the right way to do it.

Because of how PHP serializes data, which is then stored in the WordPress database, one cannot simply do a find and replace to update the old URL to the new one.  While it will work for the most part, if you have an option table setting that has been serialized and contains the old URL, you will need to deserialize it first and then reserialize it after updating the values.  You can use WordPress' built-in functions in your theme's functions.php file to do that.  Here is an example of what I had to do in my theme's functions.php

$option = get_option('mytheme_option_name');
$option['logo'] = '{NEWURL}/logo.png';
$option['logo_hd'] = '{NEWURL}/logo@2x.png';
$option['favicon'] = '{NEWURL}favicon.png';
update_option( 'mytheme_option_name', $option );

The easiest way to get an existing WordPress site to run on a new URL or domain name is to use the WP-CLI utility.  Unfortunately, this wasn't going to work for me since I was running an old WordPress website on an old server running PHP 5.5.x.  As a result, I had to manually identify the options that needed to be updated and update them in a way that properly deserialized and then serialized the changes properly.

If you are able to run the WP-CLI utility, here is how you can update / change the URL of the existing website to the new one easily and properly.  Be sure to make a full backup of your existing WordPress database using a utility like PHPMyAdmin or via the command line.  Then, use the below commands (update the values from the example first before running them):

wp option update siteurl 'https://yournewdomain.com'
wp option update home 'https://yournewdomain.com'
wp search-replace 'old-url.com' 'new-url.com'

That should do it.

Set Max File Size System Wide – All Users – Ubuntu

Sometimes, a game server process can crash continually until it is manually restarted.  When this happens, the log file it creates fills up with the same error until the ENTIRE server runs out of disk space.  To prevent that from happening, limit the maximum size a file can grow to by adding the following line to the end of the /etc/profile file to apply it to all users.

ulimit -f 52428800

The above numeric value is kilobytes.  It is set to 50GB in the command above.

Restart the server for it to take effect.

Using Wireless Adapter as KVM Network Bridge (br0 or br1) – Rocky Linux 9.X

They said it couldn't be done, but it can, depending on your wireless adapter card.  I recently bought a Minisforum EM680 Mini PC, and to my surprise, it didn't come with any ethernet ports.  It only has a Wi-Fi PCI-E card in it.  Ok, so that presents a problem, as I wanted to use it as a KVM virtual machine host with bridged networking.  At first, I wasn't able to get this to work, but after finding this post, I got it working!  If your wireless adapter supports 4addr (WDS mode), you can get it working as you normally would when using an ethernet port.  Here's how.

Step 1:  Connect to your desired wireless network normally post installation of Rocky Linux 9.

Step 2:  Create your network bridge configurations as you normally would (not specified in this guide).  My script creates br0 (for use at datacenters with static IPs) and br1 (a general DHCP bridge). 

Step 3:  Enable 4addr for your adapter.

Get the name of your wireless device by running the following command:

ip a

Mine happens to be named wlp1s0. Yours could be different. Make a note of the name of your connected wireless adapter and use it in the below scripts:

sudo nano /etc/systemd/system/4addr.service 

Add the following contents to this file:

[Unit]
Description=wlan-4addr
Wants=network.target
Before=network.target systemd-networkd.service
BindsTo=sys-subsystem-net-devices-wlp1s0.device
After=sys-subsystem-net-devices-wlp1s0.device

[Service]
Type=oneshot
ExecStart=/usr/sbin/iw dev wlp1s0 set 4addr on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Save and exit.

Enable the service at boot:

sudo systemctl enable 4addr.service 

Step 4:  Reboot

Step 5:  Check that 4addr is on and working

iw dev wlp1s0 info

You should see something like:

4addr: on 

At the end of the output. 

Step 6:  Configure your wireless adapter to be controlled by your desired network bridge.  In my case, I wanted my wireless adapter to be a part of br1 (my general DHCP bridge).  To do this, I edited the associated .nmconnection file in the /etc/NetworkManager/system-connections directory.  The name of the .nmconnection file will be the wireless SSID you're connected to.  So, for example, if your SSID is test, it will be named test.nmconnection.

Add the controller and port-type configuration lines as shown in the below sample configuration.  My .nmconnection configuration looks like this (SSID and passwords removed):

[connection]
id=cool
uuid=015a8f8f-5440-40b5-8caf-e6ff3f9d63e1
type=wifi
interface-name=wlp1s0
controller=br1
port-type=bridge

[wifi]
mode=infrastructure
ssid={WIFI_SSID_HERE}

[wifi-security]
auth-alg=open
key-mgmt=wpa-psk
psk={WIFI_PASSWORD_HERE}

[bridge-port]

Save your changes.

My ifcfg-br1 bridge configuration file in the /etc/sysconfig/network-scripts directory looks like this:

TYPE=Bridge
BOOTPROTO=dhcp
DEVICE=br1
ONBOOT=yes
ZONE=public

Step 7:  Reboot

KVM guests using br1 and the default NAT interface (managed by QEMU and KVM) will work just fine via your wireless device now!