Draining the stuck queue Messages already deferred are still addressed to their original MX on port 25, so Postfix will keep retrying them on the old path even after the…

Fail2Ban installations are cheap to add and expensive to keep cheap. The package itself idles at a few megabytes, but each jail you enable spawns a log reader with a…

A stock Debian 12 install has 13 files with the SUID bit set, and several are unneeded on a server: /usr/bin/su, /usr/bin/mount and /usr/bin/chsh are standard privilege-escalation footholds after a…

OpenSSL 3.5 and BoringSSL now ship the X25519MLKEM768 hybrid group enabled by default, and browsers have started negotiating it. On a VPS, that changes the arithmetic of a TLS handshake:…

Most firewall reviews focus on inbound ports. That is backwards for a VPS threat model. An attacker who has already executed code does not need inbound access; they need outbound…

Spectre, Meltdown, and MDS mitigations cut throughput on some workloads and barely touch others. Measure the actual cost on your instance across syscall-heavy, network, and cryptographic paths.

On a small VPS, the RSA or ECDSA signing operation in a TLS 1.3 handshake is often the most expensive thing your CPU does per request. Full handshakes from cold…

Clock drift is one of the few server problems that produces symptoms nowhere near its cause. A VM whose clock has drifted a few seconds can reject TLS connections, invalidate…

Automatic patching is normally described as install-and-forget. The reality on a long-lived VPS is a set of specific failure modes: a held package that blocks every subsequent security update, a…

Most VPS operators install Fail2ban, enable the default SSH jail, and never look at it again. That default configuration bans an IP after five failed attempts for ten minutes —…