Developer Builds Custom Bouncer Tool to Automatically Block .env and SSH Probing on VPS
A system administrator managing a modest VPS hosting static sites behind Caddy decided to stop manually watching logs filled with brute-force attempts against SSH and automated scans for common sensitive files.
The server regularly received requests for wp-admin, .env, phpmyadmin, and backup configuration files even though no WordPress instance was present. At the same time, systemd-journal recorded repeated OpenSSH messages such as “Invalid user admin” and “Invalid user oracle”.
Although Fail2ban is widely used, the administrator found its configuration of jails, filters, and actions too cumbersome for web-related blocking and preferred a single binary with minimal dependencies.
How the custom solution works
The resulting tool, called Bouncer, first performs a controlled crawl of the site using a breadth-first queue limited by depth and total page count. It extracts internal links from HTML, records all discovered paths, and allows additional routes such as API endpoints to be added manually in the configuration.
When new entries appear in the Caddy access log showing a 404 response, the path is checked against the discovered list. Five unknown paths within a sliding time window trigger addition of the source IP to an nftables set that drops traffic before it reaches listening ports. Direct requests to files such as /.env result in immediate blocking without waiting for the threshold.
For SSH, the program parses journal entries and treats an “Invalid user” message as an immediate ban because legitimate users do not attempt non-existent accounts. Failed password attempts for existing users are counted within a time window instead.
- The tool never replays old log files on startup, processing only new lines from the moment it begins.
- Each site maintains its own path list and log source, allowing multiple Caddy virtual hosts to be protected by one process.
- An installation script places the binary, generates a systemd unit, populates a whitelist with the administrator’s current IP, and inserts the required nftables drop rule in the correct chain order.
After switching from a previous prototype named CaddyBan, the administrator reported significantly cleaner logs and fewer manual reviews of connection attempts.
Related articles
Multi-Tenancy Isolation in VictoriaMetrics, VictoriaLogs and Grafana: Building Client Separation in a Shared Stack
Voltir runs a single shared monitoring stack consisting of VictoriaMetrics, VictoriaLogs, Grafana and vmalert for all customers instead of deploying separate instances per tenant. Isolation relies on numeric account IDs enforced at every layer: nginx validates tokens against the platform API before proxying writes, Grafana data sources hard-code tenant accounts, and vmalert rules receive automatic account filters. The team discovered that a single malformed rule or template could break alerting for every tenant because vmalert loads the entire rules directory at once. They also found that Grafana automatically created personal organizations granting Org Admin rights, accumulating hundreds of orphaned organizations and users that consumed disk space and resources. A dedicated cleanup module plus hourly reconciliation now removes rules, organizations, series and users when a tenant is deleted, while isolation tests verify both data and API objects across tenants.
The Real Costs of Using Claude and GPT for Russian Businesses Exposed
Accessing generative AI models like Claude and GPT has become straightforward for Russian companies, yet calculating their true expenses remains complex. Hidden factors such as intermediary commissions, currency conversion rates, taxes, and the often-overlooked costs of model reasoning tokens can double or triple initial estimates. Founder Vitaly Nagay of the Heli service analyzed these financial and organizational risks for Russian firms relying on foreign AI providers. In one example, a support department processing 20,000 monthly queries sees costs rise from $240 to $480 when reasoning tokens are included. Nagay recommends evaluating providers by dividing actual ruble charges by the model's official dollar pricing to reveal hidden markups. Additional concerns involve data control, document compliance, and access history when employees use personal subscriptions. Companies are advised to verify billing details, data storage policies, and issue dedicated API keys with spending limits before procurement.
Decoding Windows 10 and 11 Error Codes: How to Identify Root Causes and Fix System Failures
Windows frequently reports problems using codes that seem aimed only at developers, leaving users to decipher issues like 0xc000007b, 0x800f081f, and Kernel-Power 41 on their own. The article explains that error codes typically describe failed operations rather than underlying causes, such as access denials stemming from permissions, security software conflicts, or corrupted components. It provides a structured diagnostic approach starting with version checks via winver, context analysis of when errors occur, and preservation of critical data before troubleshooting. Detailed tables cover common codes across update, application launch, driver, and boot failure categories, while sections address Blue Screens of Death, Windows Update problems, driver errors like Code 43, and event log analysis. Recovery methods including DISM, SFC, safe mode, and point-in-time restore are outlined with warnings against risky generic fixes. The guide emphasizes sequential diagnosis to avoid data loss and notes the end of Windows 10 support.
Prod is Down: Free gVisor-Based Simulator Gives Strangers Root Access for Realistic Linux Incident Training
A Russian systems administrator has launched Prod is Down, a free online platform that lets users practice real incident response by granting them root consoles on deliberately broken Linux servers. The tool currently offers 13 scenarios covering PostgreSQL failures, OOM Killer events, full disks, expired certificates, nginx 502 errors, inode exhaustion, DNS issues, and open file limits. Each exercise runs inside gVisor sandboxes with strict resource limits, internal-only networking, and automated verification that checks service health rather than player commands. The author implemented an emulated systemd in Python so trainees can use familiar systemctl and journalctl commands without running a real init system. Multiple layers of isolation, including overlay filesystem tweaks and size monitoring, prevent abuse while still allowing sudo and realistic debugging. The platform records three random variants per scenario so memorized fixes from previous runs do not work on subsequent attempts.