Recent content in Posts on Michele Bologna
Most SSH hardening guides stop at key-only auth and fail2ban . That helps, but if your machine has a public IP, port 22 is still open to the internet. Every automated scanner can probe it and get a response: the SSH version string, the banner, proof that something is listening.
This website has been running on WordPress since 2007. For most of that time it lived on a self-managed VPS (first on DigitalOcean , then moved to Hetzner in 2020 ). The stack evolved from a bare LAMP setup, through Salt configuration management, to a full Kubernetes cluster with a GitOps pipeline.
During a periodic review of my machine’s security posture, I realized my Linux installation was running without full disk encryption . Reinstalling to add encryption wasn’t an option: I needed a way to encrypt in place, while continuing to use the machine normally.
Scaling to 100k Users by Alex Pareto is one of the better introductory resources on web application scaling. It’s concise, concrete, and walks through the progression in a logical order: single server, separate database, caching, load balancing, CDN, read replicas.
Updated 2026: The infrastructure described here (Kubernetes + Terraform + Salt on Hetzner) has since been replaced. This site now runs on Hugo deployed to Cloudflare Pages. The lessons about Phoenix Servers and zero-downtime DNS switching still apply; I’ve just moved to a simpler stack that needs less operational overhead. The full migration story is in From WordPress to Hugo and Cloudflare…
Five years ago, I started docker-bitlbee , a Docker container that runs Bitlbee with a curated set of third-party protocol plugins pre-installed. Why Bitlbee? Link to heading At the time, I was using IRC as my primary communications platform, but the rest of the world was fragmenting across Slack, Rocket.Chat, Mattermost, Telegram, and others. Installing a native client for each one wasn’t…
Updated 2026: This site has since migrated from WordPress to Hugo. The dark mode support was preserved through the migration; the Hugo theme respects prefers-color-scheme automatically. The WordPress-specific notes below are kept for historical reference.
I’m lucky enough to choose my own email client at work. After experimenting with several options, I settled on Thunderbird (open source, heavily customizable, and actively developed). Here’s what my inbox looks like when I open it:
The problem Link to heading Multi-container applications often have implicit startup dependencies: the web container can’t start until the database is ready, or the worker can’t connect until the message broker is listening. When containers are started in parallel or in the wrong order, some fail immediately and either crash or sit in a retry loop.
A while ago I ran into a timezone-related headache: daylight saving time had kicked in on a server, and automated jobs were shifting by an hour. The server was overseas, so the local timezone differed from mine, and figuring out what “now” meant on the remote side required constant mental arithmetic.
Every system administrator faces the same question: when and how should security patches be applied? For a handful of servers, manual patching is manageable. For fleets of servers (or even just the machines you manage personally), automatic updates start to make sense for at least the security patch category.
Aggiornamento 2026: Lo SPID e i provider accreditati sono cambiati significativamente dal 2019. Sono disponibili nuove modalità di identificazione (CIE, riconoscimento via app) e il numero di provider è cresciuto. Per le informazioni più aggiornate, fate riferimento al sito ufficiale di SPID . L’esperienza descritta qui riflette lo stato del servizio a inizio 2019.
Updated 2026: ssmtp is no longer actively maintained and has been removed from many Linux distributions. The recommended replacement is msmtp , which provides the same lightweight relay functionality with a nearly identical configuration format and is actively maintained. The approaches described below apply equally to msmtp ; just swap the package name and config file path.
Updated 2026: This comparison reflects the browser landscape as of late 2018. Much has changed since then: Chrome’s Manifest V3 transition has reshaped extension capabilities (including ad blocking), Firefox has gained enhanced tracking protection as a built-in feature, Safari has improved its cross-platform story with iCloud Keychain and Passkeys, and Chrome’s market share has grown…
I had a Linux box with two disks: /dev/sda : fast SSD, ~200 GB; operating system installed here /dev/sdb : large HDD, ~4 TB; empty The obvious option would be to create a mount point like /storage and mount /dev/sdb there. But after reading about intelligent partitioning and the recommended Debian partitioning scheme , I wanted to move /var , /home , and /tmp to the big disk, not as three separate…
By default, Docker inserts its own rules into iptables to handle container networking: Chain FORWARD (policy DROP) target prot opt source destination DOCKER all -- 0.0.0.0/0 0.0.0.0/0 Chain DOCKER (1 references) target prot opt source destination This is mostly fine, but there’s a significant caveat: when you expose a port with -p , Docker adds a rule to the DOCKER chain that accepts…
I use public key authentication on every machine I administer, and my private SSH keys are protected with strong passphrases. Without an SSH agent, you’d have to enter the passphrase every time you use a key, which quickly becomes unbearable.
If you manage virtual machines on a remote host using libvirt and virt-manager, the typical connection flow uses SSH. But virt-manager’s graphical connection dialog doesn’t expose a port field: it assumes SSH is on the default port 22.
Updated 2026: Eversync (now part of the EverHelper suite) is still available as of 2026, though the landscape of bookmark sync options has shifted. Browser-native sync has matured significantly: Firefox Sync and Chrome Sync both work well within their ecosystems. For cross-browser sync, Raindrop.io has become a strong option with native browser extensions and full bookmark integration, it’s…
When you run a Docker container based on a public image (say, the official postgres image), the running container doesn’t update itself when the upstream image changes. To get the update, you have to:
Recentemente ho acquistato un iPhone 8 sul sito PuntoCom Shop (linkato in nofollow ). Dopo una settimana dall’acquisto, il telefono ha presentato un difetto con la fotocamera, scattando foto con un alone rosa; il difetto è conosciuto da Apple, tant’è che non sono l’unico ad essere stato vittima di questo difetto hardware Apple .
During a backup audit, I wanted to document exactly how a long-running Docker container had been started, specifically the full docker run command, including environment variables, port mappings, volume mounts, and restart policies.
I open sourced docker-salt , a small project for spinning up a full SaltStack environment (one master, an army of minions) entirely in Docker. The interesting question: what happens when you actually try to run 100 minions on a 16 GB server?
The problem: SSH gets hammered Link to heading I keep an SSH server running on every machine I administer, ideally on a non-standard port. I’ve previously written about hardening the SSH configuration itself , but a hardened config doesn’t stop the flood of connection attempts. Let’s look at the scale of it:
Updated 2026: OpenSUSE Leap 42.2 reached end-of-life in January 2018. The current Leap release series is 15.x (e.g., 15.6). The version numbers changed with Leap 42.3 being the last “42” release; from Leap 15.0 onward, the version numbering aligned with the SUSE Linux Enterprise base. The installation choices described here remain largely applicable to current Leap releases.
Checkstyle is a Java static analysis tool that enforces coding standards: indentation, naming conventions, Javadoc, and more. When run via Ant, it parses source files into an Abstract Syntax Tree (AST) and applies rule checks to it. The DetailAST class is Checkstyle’s own representation of individual AST nodes.
Two scenarios come up regularly when working with remote git branches, and I always end up looking them up. Here they are in one place. Deleting a local branch from the remote Link to heading You’ve deleted a branch locally and now want to remove it from the remote repository as well:
During a backup weekend, I started thinking about how I handle my most sensitive data (credentials, SSH keys, encryption keys, PINs, and similar) and whether my current strategy had any single points of failure.
If you use git for both personal and work projects, you’ve probably run into this: commits going out with the wrong email address because your global ~/.gitconfig is set to your personal account, or vice versa.
Updated 2026: ZeroTurnaround was acquired by Perforce in 2017 and subsequently wound down. The yearly Java landscape reports are no longer published, but the 2016 edition is still accessible for historical reference.
As privacy concerns grow, I’ve been running a self-hosted OpenVPN server to protect my traffic on untrusted networks: hotel Wi-Fi, airport connections, and the like. Some networks, however, are aggressively filtered:
After five years with Netsons.org for hosting and domain registration (a genuinely pleasant experience, and very affordable by Italian hosting standards), I decided it was time to take full control of the stack.
A few months ago, I worked through Spotify’s first puzzle , a straightforward binary reversal problem. Round two is harder: the classic selection problem . The problem: given an array of values (in this case, songs with a quality score), find the top k values.
Updated 2026: The Viaggiatreno API is an unofficial, undocumented API that Trenitalia has changed over the years without notice. The gem may need updates to reflect current API responses. Check the GitHub repository for the current status.
Updated 2026: The Eclipse package situation on Ubuntu has improved considerably since 2016. Current Ubuntu LTS releases ship reasonably up-to-date Eclipse versions via snap ( sudo snap install eclipse --classic ), which is now the recommended way to get a current Eclipse on Ubuntu. The Debian packaging approach below remains valid as a learning exercise.
Updated 2026: Ubuntu 15.10 (Wily Werewolf) reached end-of-life in July 2016. This specific bug was fixed in subsequent Ubuntu releases. If you’re running a modern Ubuntu and hitting PAM authentication failures with OpenVPN, check whether your systemd unit file has CapabilityBoundingSet configured; the same principle applies: PAM’s audit module requires CAP_AUDIT_WRITE .
Watch on TED: Dan Pink: The puzzle of motivation I watch a lot of TED talks, but this one by Dan Pink has stuck with me more than most. It’s from 2009, runs about 18 minutes, and I’d consider it required viewing for anyone who manages people, or who is managed.
Updated 2026: CoreOS Container Linux reached end-of-life on May 26, 2020. Its spiritual successor is Flatcar Container Linux , which maintains a compatible cloud-init format. The rkt container runtime (mentioned below as CoreOS’s replacement for Docker) was also deprecated and archived in 2019. The cloud-init concepts in this post remain valid and apply to Flatcar and many other modern Linux…
Hardening, serendipity, and curiosity Link to heading A few weeks ago I hardened all of my Linux boxes: flushed all iptables/ipfw rules, set the default policy to DROP, and re-enabled rules selectively as needed. On Ubuntu I used ufw ; on Fedora, firewalld .
Updated 2026: Several tools mentioned here (JSmooth, Launch4j) are still available but see limited active development. For modern Java packaging, consider jpackage (included in the JDK since Java 14), which produces native installers (.exe, .msi on Windows; .dmg on macOS; .deb/.rpm on Linux) without requiring a separate tool.
Updated 2026: Docker has matured significantly since 2015. Many of the patterns here are still valid, but the ecosystem has evolved: multi-stage builds are now the standard way to reduce image size, BuildKit is the default builder, and Docker Compose (v2) has replaced standalone docker-compose . The concepts below remain a useful foundation.
It’s hardening Sunday: I reviewed the configuration files of my main daemons ( nginx, openvpn, tinc, sshd ) with the help of two resources I want to share. First, a guide dedicated exclusively to hardening SSH : it covers everything from enforcing public key authentication to selecting the right ciphers. There’s solid theory behind the cipher recommendations; worth reading, not just…
Updated 2026: This workaround was written for Fedora 22, Ubuntu 15.04, and openSUSE Tumbleweed with kernels around 3.9–4.x. The HP 6730b is now over 15 years old and no longer in active use, but the /etc/pm/sleep.d/ hook approach has since been superseded by systemd sleep hooks in /etc/systemd/system/sleep@.service.d/ . The principle remains the same: reset cooling device states on resume.
Some time ago I came across Spotify puzzles , a set of CS problems that Spotify’s engineers published for interested developers to solve. What made the format interesting was the submission mechanism: you email your solution, and an automated judge tests it and sends back results. No web form, no leaderboard. Just a clean feedback loop.
It’s almost seven years since my first post on this site. That’s a long time. Starting today, future posts will be written in English. The main reason is simple: I want to share what I write with a wider audience . Most of the topics I cover (software, development, infrastructure, tech in general) are inherently international, and writing in Italian has been limiting who could benefit…
Gennaio, tempi di rinnovi abbonamenti: nel mio caso, devo scegliere se pagare il (dis)servizio fornito da Trenord/Trenitalia. Mi è venuto un dubbio: È più conveniente acquistare 11/12 abbonamenti mensile o un abbonamento annuale, tenendo conto dei bonus? Link to heading Se non sai cos’è un bonus: è una riduzione sul prezzo dell’abbonamento in base al rispetto dei tempi calcolato sul…
Quando faccio il setup di una macchina con sistema operativo Windows, sento la mancanza di apt-get (per chi mastica Debian/Ubuntu) o yum (Red Hat/Fedora) per installare rapidamente programmi in una semplice istruzione.
Ultimamente mi è capitato di utilizzare Google Maps (mobile) all’estero, dove non avevo a disposizione la connessione dati; esistono applicazioni che si appoggiano a OpenStreetMap e scaricano la mappa intera del Paese in cui siete (come ad esempio Galileo ), ma per usare Google Maps in offline c’è un piccolo accorgimento che potete usare.
Quando mi trovo a dover fare il setup di un nuovo server, cambio sempre una variabile nel file /etc/default/rcS , ovvero: FSCKFIX = yes Questa impostazione significa che, in caso di problemi durante il mount dei filesystem al boot, il sistema tenta automaticamente di riparare il file-system, senza interrompere il processo di boot invocando la shell come avviene nel caso predefinito ( FSCKFIX=no ).
Di recente ho dovuto avviare una sessione VNC su una macchina remota; la mia preferenza per un desktop environment “light” ma al tempo stesso completo è andata su XFCE (installato di default su Xubuntu ).