security – Page 34 – Türker Yıldırım

Nonces expire after a day, and that is the bug report

NoteNovember 14, 20132 min read

A nonce is valid for a period rather than until it is used, and that period is two ticks of half a day. It produces a bug report…

Moving a PHP site off mod_php and onto nginx with PHP-FPM

Deep diveNovember 6, 201317 min read

Four hundred Apache processes at 28 MB each and a load average that never comes back down. The move to nginx and PHP-FPM, done without touching DNS.

Escape output for an HTML attribute in PHP

SnippetOctober 16, 20131 min read

Copy an SSH public key to a server

SnippetSeptember 3, 20131 min read

password_hash replaces the salt you were generating

NoteAugust 27, 20133 min read

Hand-rolled password storage gets the same three things wrong every time: a hash designed to be fast, a salt in its own column that is reused or truncated,…

$wpdb->prepare is not optional, even for an integer

NoteMay 29, 20132 min read

The argument for skipping prepare() on an integer is that intval() has already made it safe, and on the day it is written that is true. It stops…

Redirect a whole domain to another in nginx

SnippetMarch 28, 20131 min read

Block an IP range with iptables

SnippetMarch 20, 20131 min read

Send a POST request with cURL in PHP

SnippetMarch 19, 20131 min read

fail2ban needs a jail per log, not a jail per server

NoteFebruary 5, 20133 min read

Installing fail2ban is treated as a step that protects the server. What it actually gives you is one jail — [ssh], watching auth.log — while the same brute…