Posts on Michele Bologna

Most SSH hardening guides stop at key-only auth and fail2ban.

This website has been running on WordPress since 2007.

During a periodic review of my machine’s security posture, I realized my Linux installation was running without full disk encryption.

Scaling to 100k Users by Alex Pareto is one of the better introductory resources on web application scaling.

Updated 2026: The infrastructure described here (Kubernetes + Terraform + Salt on Hetzner) has since been replaced.

Five years ago, I started docker-bitlbee, a Docker container that runs Bitlbee with a curated set of third-party protocol plugins pre-installed.

Updated 2026: This site has since migrated from WordPress to Hugo.

I’m lucky enough to choose my own email client at work.

The problem Link to heading Multi-container applications often have implicit startup dependencies: the web container can’t start until the database is ready, or the worker can’t connect until the message broker is listening.

A while ago I ran into a timezone-related headache: daylight saving time had kicked in on a server, and automated jobs were shifting by an hour.

Every system administrator faces the same question: when and how should security patches be applied?

Aggiornamento 2026: Lo SPID e i provider accreditati sono cambiati significativamente dal 2019.

Updated 2026: ssmtp is no longer actively maintained and has been removed from many Linux distributions.

Updated 2026: This comparison reflects the browser landscape as of late 2018.

I had a Linux box with two disks: /dev/sda: fast SSD, ~200 GB; operating system installed here /dev/sdb: large HDD, ~4 TB; empty The obvious option would be to create a mount point like /storage and mount /dev/sdb there.

By default, Docker inserts its own rules into iptables to handle container networking: Chain FORWARD (policy DROP) target prot opt source destination DOCKER all -- 0.0.0.0/0 0.0.0.0/0 Chain DOCKER (1 references) target prot opt source destination This is

I use public key authentication on every machine I administer, and my private SSH keys are protected with strong passphrases.

If you manage virtual machines on a remote host using libvirt and virt-manager, the typical connection flow uses SSH.

Updated 2026: Eversync (now part of the EverHelper suite) is still available as of 2026, though the landscape of bookmark sync options has shifted.

When you run a Docker container based on a public image (say, the official postgres image), the running container doesn’t update itself when the upstream image changes.

Recentemente ho acquistato un iPhone 8 sul sito PuntoCom Shop (linkato in nofollow).

During a backup audit, I wanted to document exactly how a long-running Docker container had been started, specifically the full docker run command, including environment variables, port mappings, volume mounts, and restart policies.

I open sourced docker-salt, a small project for spinning up a full SaltStack environment (one master, an army of minions) entirely in Docker.

The problem: SSH gets hammered Link to heading I keep an SSH server running on every machine I administer, ideally on a non-standard port.

Updated 2026: OpenSUSE Leap 42.2 reached end-of-life in January 2018.

Checkstyle is a Java static analysis tool that enforces coding standards: indentation, naming conventions, Javadoc, and more.

Two scenarios come up regularly when working with remote git branches, and I always end up looking them up.

During a backup weekend, I started thinking about how I handle my most sensitive data (credentials, SSH keys, encryption keys, PINs, and similar) and whether my current strategy had any single points of failure.

If you use git for both personal and work projects, you’ve probably run into this: commits going out with the wrong email address because your global ~/.gitconfig is set to your personal account, or vice versa.

Updated 2026: ZeroTurnaround was acquired by Perforce in 2017 and subsequently wound down.

As privacy concerns grow, I’ve been running a self-hosted OpenVPN server to protect my traffic on untrusted networks: hotel Wi-Fi, airport connections, and the like.

After five years with Netsons.org for hosting and domain registration (a genuinely pleasant experience, and very affordable by Italian hosting standards), I decided it was time to take full control of the stack.

A few months ago, I worked through Spotify’s first puzzle, a straightforward binary reversal problem.

Updated 2026: The Viaggiatreno API is an unofficial, undocumented API that Trenitalia has changed over the years without notice.

Updated 2026: The Eclipse package situation on Ubuntu has improved considerably since 2016.

Updated 2026: Ubuntu 15.10 (Wily Werewolf) reached end-of-life in July 2016.

Watch on TED: Dan Pink: The puzzle of motivation I watch a lot of TED talks, but this one by Dan Pink has stuck with me more than most.

Updated 2026: CoreOS Container Linux reached end-of-life on May 26, 2020.

Hardening, serendipity, and curiosity Link to heading A few weeks ago I hardened all of my Linux boxes: flushed all iptables/ipfw rules, set the default policy to DROP, and re-enabled rules selectively as needed.

Updated 2026: Several tools mentioned here (JSmooth, Launch4j) are still available but see limited active development.

Updated 2026: Docker has matured significantly since 2015.

It’s hardening Sunday: I reviewed the configuration files of my main daemons (nginx, openvpn, tinc, sshd) with the help of two resources I want to share.

Updated 2026: This workaround was written for Fedora 22, Ubuntu 15.04, and openSUSE Tumbleweed with kernels around 3.9–4.x.

Some time ago I came across Spotify puzzles, a set of CS problems that Spotify’s engineers published for interested developers to solve.

It’s almost seven years since my first post on this site.

Gennaio, tempi di rinnovi abbonamenti: nel mio caso, devo scegliere se pagare il (dis)servizio fornito da Trenord/Trenitalia.

Quando faccio il setup di una macchina con sistema operativo Windows, sento la mancanza di apt-get (per chi mastica Debian/Ubuntu) o yum (Red Hat/Fedora) per installare rapidamente programmi in una semplice istruzione.

Ultimamente mi è capitato di utilizzare Google Maps (mobile) all’estero, dove non avevo a disposizione la connessione dati; esistono applicazioni che si appoggiano a OpenStreetMap e scaricano la mappa intera del Paese in cui siete (come ad esempio Galileo…

Quando mi trovo a dover fare il setup di un nuovo server, cambio sempre una variabile nel file /etc/default/rcS, ovvero: FSCKFIX=yes Questa impostazione significa che, in caso di problemi durante il mount dei filesystem al boot, il sistema tenta automati…

Di recente ho dovuto avviare una sessione VNC su una macchina remota; la mia preferenza per un desktop environment “light” ma al tempo stesso completo è andata su XFCE (installato di default su Xubuntu).