Archive for the ‘Linux’ Category

TCP Syn Flood Hardening – Kernel IPv4 Settings

Wednesday, January 28th, 2026

TCP Syn Flood Hardening – Kernel IPv4 Settings

With the increasing TCP flood attacks and AI bot scraping floods, here are some optimizations that should be added to the end of your /etc/sysctl.conf file:

# Hardening
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.tcp_max_syn_backlog=2048
net.ipv4.tcp_synack_retries=2
net.ipv4.conf.all.accept_redirects=0

Reboot for the settings to take effect.

Running Multiple Different PHP Versions Simultaneously on Ubuntu 24.04

Monday, August 18th, 2025

Running Multiple Different PHP Versions Simultaneously on Ubuntu 24.04

If you need to run multiple different versions of PHP simultaneously on your Ubuntu server, it can be done.  This is needed when you want to host some legacy sites that cannot run with the breaking changes made in the newest versions of PHP (shame on you PHP for doing such nonsense). 

Here's how I did it on an Ubuntu 24.04 server which uses PHP 8.3 by default.  In this example, I have already installed and configured all web server software packages including PHP 8.3.  The EHCP Force installer can do this for you if you don't know how to install and configure everything you need to run your own web server.

Add the ondrej repo and install PHP 5.6 and 7.4:

sudo add-apt-repository -y ppa:ondrej/php
sudo apt update
sudo apt upgrade
sudo apt-get install php5.6 php5.6-fpm php7.4 php7.4-fpm
sudo apt-get install php7.4-mysql php5.6-mysql php5.6-mysqlnd-ms php7.4-gd php5.6-gd php5.6-zip php7.4-zip php7.4-cli php5.6-cli php5.6-mcrypt php7.4-mcrypt php7.4-gettext php5.6-gettext php5.6-mailparse php7.4-mailparse php7.4-imagick php5.6-imagick php5.6-curl php7.4-curl php7.4-xmlrpc php5.6-xmlrpc php5.6-imap php7.4-imap

I then adjusted the fpm php.ini files in the /etc/php/5.6/fpm/ and /etc/php/7.4/fpm directories to use custom settings that I use (optional).  I then edited the FPM pool for each version of PHP in the www.conf file in /etc/php/7.4/fpm/pool.d and /etc/php/5.6/fpm/pool.d directories to listen on a different port than PHP 8.3.  For example, for PHP 7.4, I changed the listen port to 9011.

Then, for the particular website I wanted to run under a different version of PHP, I changed the nginx template to use the corresponding port for the desired PHP FPM version like so:

location ~ \.php$ {
        root {homedir}/httpdocs;
        include fastcgi_params;
        try_files $uri = 404;
        fastcgi_pass   127.0.0.1:9011;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param  PHP_ADMIN_VALUE "open_basedir={homedir}:/usr/share/php:/usr/share/pear \n upload_tmp_dir={homedir}/phptmpdir \n session.save_path={homedir}/phptmpdir";
        fastcgi_read_timeout 300;
        limit_req zone=one burst=5;
    }    

Restart nginx.  The website you configured to use a specific version of PHP will be using that version now.

Migrating a WordPress Website to a New or Different URL / Domain Name

Monday, August 18th, 2025

Migrating a WordPress Website to a New or Different URL / Domain Name

When migrating a WordPress website from one URL to another, it's not as simple as exporting the current database to a SQL file, changing the URLs in the SQL file, dropping all tables in the database, and then re-importing the updated SQL file (which contains the updated URL).  Using a find and replace text editor utility to update the old URL to the new one in the MySQL database dump file IS NOT the right way to do it.

Because of how PHP serializes data, which is then stored in the WordPress database, one cannot simply do a find and replace to update the old URL to the new one.  While it will work for the most part, if you have an option table setting that has been serialized and contains the old URL, you will need to deserialize it first and then reserialize it after updating the values.  You can use WordPress' built-in functions in your theme's functions.php file to do that.  Here is an example of what I had to do in my theme's functions.php

$option = get_option('mytheme_option_name');
$option['logo'] = '{NEWURL}/logo.png';
$option['logo_hd'] = '{NEWURL}/logo@2x.png';
$option['favicon'] = '{NEWURL}favicon.png';
update_option( 'mytheme_option_name', $option );

The easiest way to get an existing WordPress site to run on a new URL or domain name is to use the WP-CLI utility.  Unfortunately, this wasn't going to work for me since I was running an old WordPress website on an old server running PHP 5.5.x.  As a result, I had to manually identify the options that needed to be updated and update them in a way that properly deserialized and then serialized the changes properly.

If you are able to run the WP-CLI utility, here is how you can update / change the URL of the existing website to the new one easily and properly.  Be sure to make a full backup of your existing WordPress database using a utility like PHPMyAdmin or via the command line.  Then, use the below commands (update the values from the example first before running them):

wp option update siteurl 'https://yournewdomain.com'
wp option update home 'https://yournewdomain.com'
wp search-replace 'old-url.com' 'new-url.com'

That should do it.

Set Max File Size System Wide – All Users – Ubuntu

Monday, August 18th, 2025

Set Max File Size System Wide – All Users – Ubuntu

Sometimes, a game server process can crash continually until it is manually restarted.  When this happens, the log file it creates fills up with the same error until the ENTIRE server runs out of disk space.  To prevent that from happening, limit the maximum size a file can grow to by adding the following line to the end of the /etc/profile file to apply it to all users.

ulimit -f 52428800

The above numeric value is kilobytes.  It is set to 50GB in the command above.

Restart the server for it to take effect.

Element for Linux Client – Without Flatpak

Tuesday, February 11th, 2025

Element for Linux Client – Without Flatpak

If you'd like to install the Element Matrix client for Linux without using flatpak or snap, you can use the following script to do so:

sudo apt-get install wget unzip
wget -N "https://dinofly.com/files/linux/element_bash_install.zip" && unzip element_bash_install.zip && sudo bash install_element.sh

This will install the Element client application on Linux, create an app shortcut for it, and add it as an automatic startup program when the computer is first started.

This was tested on Ubuntu 18.04, but it should work on newer versions of Linux as well.

Changing Servers for a Website – Redirect Traffic to New IP for No Downtime While DNS Propagates

Wednesday, December 20th, 2023

Moving a Website to Another Server – Redirect Traffic to the New Server While DNS Propagates (for No Downtime)

If you're migrating a website from one server to another and have updated the DNS for the domain to point to the new server, some traffic will still be directed to the old server due to DNS caching.  So, while the DNS changes propagate over the internet (can take up to three days), you can still redirect traffic to the new server from the old server so that you won't suffer any downtime. 

On the old server, run these commands to redirect web traffic on port 80 (http) and port 443 (https) to the new server (adjust the {DESTINATION_IP_ADDRESS} variable accordingly):

echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination {DESTINATION_IP_ADDRESS}:80
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination {DESTINATION_IP_ADDRESS}:443
iptables -t nat -A POSTROUTING -p tcp -d {DESTINATION_IP_ADDRESS} --dport 80 -j MASQUERADE
iptables -t nat -A POSTROUTING -p tcp -d {DESTINATION_IP_ADDRESS} --dport 443 -j MASQUERADE

Reference:  https://serverfault.com/questions/371833/changing-servers-redirect-to-new-ip-no-downtime#371870

Dual Boot Linux (Ubuntu 22.04) and Windows 11 on Modern Systems – UEFI

Thursday, December 7th, 2023

Dual Boot Linux (Ubuntu 22.04) and Windows 11 on Modern Systems – UEFI

In order to setup a dual boot of Windows 11 and Ubuntu 22.04 on a modern system that uses UEFI, follow these steps.

  1. Install Windows 11 first leaving some unpartitioned space (at least 60GB is my recommendation) on the drive you're installing Windows on.
  2. Boot up the Ubuntu installer.
  3. During installation, you'll be presented with an Installation Type options screen.  Choose "Something else". 
  4. On the next screen, you'll see a list of drives and partitions.  On the same drive you installed Windows, create 3 new partitions. 
    1. Create an EXT4 partition for the / mount point at least 40GB in size (this is the main drive for Linux files).
    2. Create a SWAP partition at least 18GB in size.
    3. Create an EFI partition at least 500MB in size.  This is extremely important in order to get grub to install properly. 
  5. Leave the "Device for boot loader installation" set as the top level drive that Windows and Ubuntu was / is being installed on.  You should not select an individual partition here.
  6. Complete the installation process. 
  7. You might need to change the UEFI boot order in the BIOS of your system to boot Ubuntu / Linux first versus booting the Windows EFI partition.  Since you created an EFI partition for your Linux install, it should show up as a bootable option in the bios.  Set / adjust accordingly.
  8. That's it!

Fix for Older SSH Keys Not Working on Newer Versions of Debian / Ubuntu

Thursday, May 25th, 2023

Fix for SSH Keys Not Working on Newer Versions of Debian / Ubuntu

If your old SSH keys are not working on newer versions of Ubuntu / Debian, and you're being prompted to login (~/.ssh/config configuration being ignored), the fix is to add the following line to the bottom of the /etc/ssh/ssh_config file:

    PubkeyAcceptedKeyTypes +ssh-rsa

That's it.  It will work again.  You may need to restart the ssh service

sudo service ssh restart

https://askubuntu.com/questions/1404049/ssh-without-password-does-not-work-after-upgrading-from-18-04-to-22-04

OpenVPN Expired CRL – VPN Won’t Connect

Wednesday, December 7th, 2022

OpenVPN Expired CRL – VPN Won't Connect

Recently, I ran into an issue where OpenVPN was no longer working for existing clients.  After looking at the OpenVPN log in /var/log/openvpn.log, I found the following:

VERIFY ERROR: depth=0, error=CRL has expired:

If you see an OpenVPN error about an expired certificate revocation list (CRL), here's how to generate a new CRL:

cd /etc/openvpn/easy-rsa
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
chown nobody:nogroup /etc/openvpn/crl.pem
service openvpn restart

Problem solved!

cURL and wget Issues on Ubuntu 16.04 – SSL: TLSV1_ALERT_PROTOCOL_VERSION

Monday, December 5th, 2022

cURL and wget Issues on Ubuntu 16.04

When using wget or curl to make HTTP requests from a no longer supported installation of Ubuntu 16.04 Xenial, if you get any of the following errors:

curl gnutls_handshake() failed: Error in protocol version
curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version  /home/mohan/mesg
[SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:727) 

The solution is to add SavOS Rob Savoury PPAs to get updated curl and wget packages:

sudo add-apt-repository ppa:savoury1/build-tools
sudo add-apt-repository ppa:savoury1/backports
sudo add-apt-repository ppa:savoury1/python
sudo add-apt-repository ppa:savoury1/encryption
sudo add-apt-repository ppa:savoury1/curl34
sudo apt-get update && sudo apt-get upgrade
sudo apt-get install wget curl python2.7