haproxy
Mutual TLS (mTLS) provides strong authentication by requiring both client and server to present certificates. This guide shows how to configure HAProxy for mTLS to secure API endpoints, internal services, and zero-trust networks. What is mTLS? In standard TLS, only the server presents a certificate. With mTLS: 1. Server
haproxy
HTTPS is no longer optional - it's a requirement for modern web applications. This guide shows how to integrate HAProxy with Let's Encrypt for fully automated TLS certificate provisioning and renewal, giving you secure HTTPS without manual certificate management. Overview The integration involves: 1. HAProxy serving HTTPS
bind
First, a short side note. Personal viewpoint: I’m not a fan of DNS over HTTPS (DoH). The main reason is not encryption itself—encryption is a good thing—but how DoH is implemented and deployed. Facts: DoH encapsulates DNS queries inside regular HTTPS traffic (TCP/443), making DNS traffic
bind
Traditional DNS queries travel in plaintext, exposing your browsing habits to network observers. DNS over TLS (DoT) encrypts DNS traffic between clients and resolvers, providing privacy and preventing tampering. This post covers implementing DoT on BIND 9 for both resolver and forwarder configurations. Understanding DNS over TLS How DoT Works
bind
After configuring DNSSEC validation on your resolvers, the next step is signing your own authoritative zones. This post covers the complete process of implementing DNSSEC on BIND authoritative servers, from key generation to zone signing and key rollovers. Understanding DNSSEC Keys DNSSEC uses two types of cryptographic keys: Key Signing
bind
DNSSEC (Domain Name System Security Extensions) adds cryptographic authentication to DNS responses, protecting against cache poisoning and man-in-the-middle attacks. When your resolver validates DNSSEC, it verifies that DNS responses haven't been tampered with between the authoritative server and your clients. How DNSSEC Validation Works DNSSEC
bind
Response Policy Zones (RPZ) provide DNS-level security by allowing you to override DNS responses for specific domains. This enables blocking malicious domains, implementing content filtering, and protecting your network from phishing, malware, and other threats at the DNS layer - before connections are even established. How RPZ Works RPZ intercepts
bind
A properly secured DNS server is critical infrastructure. An open resolver can be abused for DNS amplification attacks, leak internal network information, or serve as a reconnaissance tool for attackers. This guide covers BIND's security features: Access Control Lists (ACLs), views for split-horizon DNS, and query restrictions
bind
RNDC (Remote Name Daemon Control) is the administrative tool for managing BIND DNS servers. It allows you to reload zones, flush caches, view statistics, and perform other administrative tasks without restarting the entire service. RNDC uses TSIG (Transaction Signature) keys for authentication, ensuring only authorized administrators can control your DNS
linux
A recursive DNS resolver is the workhorse of DNS infrastructure, handling client queries by recursively querying authoritative nameservers until it finds the answer. BIND 9 is the most widely deployed DNS software and makes an excellent choice for running your own resolver. In this guide, we'll set up
kubernetes
Introduction In a Kubernetes environment, having a robust and secure ingress controller is critical to properly route traffic to your applications. Traefik is a popular choice for its simplicity and feature set. However, when you need to automate certificate management across many services, cert-manager shines. Finally, if you lack
openbsd
Introduction OpenBSD is known for its security and clean design, making it an ideal choice for a VPN server. In this guide, we will set up a VPN server on OpenBSD 7.3 using iked, the native IKEv2 daemon, which is perfect for road warrior (mobile clients) access. By the