Nathan Reynolds

Setting up UFW firewall rules on Ubuntu is the single most important security task for any self-hosted server. I run a half-dozen services from a home lab and a small VPS, and every one of them got UFW configured before I exposed a single port. UFW (Uncomplicated Firewall) gives you a clean command-line front-end to … Read more

Encrypting a Linux drive with LUKS and unlocking it remotely over SSH is the solution every system administrator needs for headless servers that require full disk encryption. When your server sits in a data center, a basement, or a remote colocation facility, you cannot walk up to it and type in a passphrase after every … Read more

If you set up your Linux machine without encryption and now want to protect your data, you are not stuck with a reinstall. You can add full disk encryption to an existing Linux install without reinstalling using one of three approaches: encrypting just your /home partition, using cryptsetup-reencrypt for in-place root encryption, or doing a … Read more

Setting up a YubiKey for SSH and sudo authentication on Linux is one of the strongest upgrades you can make to your workstation or server security. Instead of typing passwords that can be phished, captured, or brute-forced, you tap a physical key that holds your private key inside tamper-resistant hardware. I walked through this exact … Read more

SSH is the front door to your servers, and a stolen password is all it takes for an attacker to walk right in. Adding a second factor turns that door into a vault. In this guide, I will walk you through exactly how to configure two-factor authentication for SSH logins with TOTP, step by step, … Read more

Every Linux server you manage has a growing list of open ports, listening services, and background processes. Most of them are necessary. Some of them are leftovers from a quick test that became permanent. And a few of them are wide-open doors that you forgot existed. Auditing a Linux server for open ports and unnecessary … Read more

Losing data is not a question of if, but when. Hard drives fail, ransomware locks files, and accidental deletes happen to everyone. The difference between a minor inconvenience and a catastrophe comes down to one thing: whether you have a working backup. This guide walks you through setting up automatic encrypted off-site backups with restic … Read more

Ransomware attacks have evolved to target backup infrastructure directly. A compromised client machine can delete or encrypt your backups before you even realize there is a problem. That is where Borg Backup append-only mode becomes critical. In this guide, I will show you exactly how to configure an append-only repository to survive ransomware attacks and … Read more

So you built something cool at home. Maybe it is a Nextcloud instance, a media server, a home automation dashboard, or a custom web app running on a Raspberry Pi. It works perfectly on your local network. Now you want to access it from anywhere, and you started googling how to open a port on … Read more

If you’re running a modern Linux server, you’ve probably heard that nftables is replacing iptables as the standard firewall framework. After working with both systems across dozens of production servers, I can tell you that the transition to nftables rules offers real benefits: unified IPv4/IPv6 handling, simpler syntax, atomic rule updates, and built-in debugging tools. … Read more