Infrastructure Security Hardening & Protocols Guide
Welcome to the security and compliance hub on saotn.org. In modern enterprise environments, securing endpoints, transport layers, and web infrastructure is an ongoing necessity. A single misconfiguration can expose internal architectures or leave legacy protocols open to exploitation.
This section is dedicated to practical, hands-on infrastructure security hardening. From implementing defensive HTTP response headers and fine-tuning SSL/TLS handshakes to managing secure authentication mechanisms like OpenSSH and Active Directory, these guides provide actionable steps to mitigate risks and secure your production environments.
Key Security & Hardening Focus Areas
To help you audit and harden your environment, our core security resources are grouped by technical implementation:
Web Server Hardening & Transport Security: Minimize your attack surface and protect data in transit. Eliminate information leakage by learning how to remove the IIS Server version HTTP Response Header, and enforce encrypted connections by enabling HTTP Strict-Transport-Security (HSTS) on IIS.
SSL/TLS Handshake Validation: Master the tools required to verify your cryptographic boundaries. Leverage our comprehensive OpenSSH and OpenSSL Cheat Sheet to audit handshakes, test cryptographic protocols, and troubleshoot active directory certificate integrations.
Secure Authentication & Access Control: Upgrade your identity and access management. Move away from weak passwords by configuring YubiKey support in OpenSSH for Windows 11 or securely retrieving public keys directly from your directory services.
Network Edge & Endpoint Defense: Control traffic at the perimeter. Use automated scripting to dynamically manage ingress and egress rules, or isolate legacy systems using secure network tunneling protocols.
Browse the chronological archive below for step-by-step guides on patching vulnerabilities, troubleshooting credential delegation issues, and implementing robust security baselines across your Windows Server fleet.
Useful
Never forget an OpenSSL command again. This comprehensive cheat sheet covers certificate conversion (PFX, PEM, DER), CSR generation, and remote SSL / TLS verification for Windows and Linux admins.
Windows Server
Last updated:
Windows Server IIS is known for reusing DH key values, but there is a way to disable ECDH public server param reuse in Windows Server IIS and here is how.
Windows Server
Last updated:
Learn how to create strong and unique passwords in Windows using PowerShell, because the use of those unique and strong passwords is important.
Useful
Last updated:
Learn how to calculate and create file checksums with PowerShell's Get-FileHash and certutil.exe. Use this to validate file integrity in Windows (Windows Server).
Windows Server
Last updated:
Use PowerShell to install SSL certificate in Windows Server and change its FriendlyName property. As a bonus, I show you how to verify a certificate's Common Name (Subject) and Subject Alternative Name (SAN) using certutil.exe and PowerShell Get-PfxCertificate.
GNU/Linux, Web applications
Last updated:
Take control of your server resources by learning how to block aggressive bots and unwanted search engines using .htaccess and mod_rewrite. This guide provides copy-paste ready configurations to prevent bandwidth theft, stop scrapers, and ensure that only relevant search engines crawl your website.
Windows Server
Last updated:
YubiKey support in ssh for Windows: secure your Windows environment by moving SSH private keys to hardware. Learn how to configure YubiKey FIDO2/U2F support in native OpenSSH, manage the ssh-agent, and eliminate file-based credential risks.
Windows Server
Last updated:
Find out fast if your IIS webservers have EnableTrailerSupport enabled for https.sys in the registry. Here is a small PowerShell method.
Windows Server
Last updated:
Block PHP files like sendmail.php on Windows Server IIS webservers. This comes in handy if a websites on your webserver sends out spam and you need to block access to a script on a specific website or globally in IIS. Here are 3 methods.
Security, Windows Server
Last updated:
Storing SSH public keys in Windows Server Active Directory gives you a single location where you manage public SSH keys instead of on numerous separate servers. This is easier than distributing and managing numerous unmanaged authorized_keys files across your network and servers.
Windows Server
Last updated:
Add, list, and remove IP addresses in Windows Firewall (PowerShell & netsh): How to bulk add IP addresses in Windows Firewall, list an IP address and how to remove all IP addresses from Windows Defender Firewall with Advanced Security...
Windows Server
Last updated:
For the time being, some manual labor is involved, but it is still manageable. You can use this to create your own solution to block offending IP addresses in SQL Server's firewall.
Windows Server
Last updated:
Turn off Windows Defender routine remediation using a GPO setting called "DisableRoutinelyTakingAction". This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats.
Windows Server
Last updated:
Enabling Windows Defender per GPO failed with the error message "Get-MpComputerStatus : The extrinsic Method could not be executed.", here is how to resolve this issue.
GNU/Linux
Last updated:
Learn how to enable HSTS (HTTP Strict Transport Security) in Linux Apache .htaccess. I wrote about enabling HTTP Strict Transport Security (HSTS) in IIS earlier. But what about enabling HSTS in Apache .htaccess? Here is how.
Windows Server
Last updated:
Easily find out whether an update or patch is installed. Or not... With PowerShell
WordPress
Last updated:
Show the number of registered WordPress users in a At-a-Glance widget. This is particular handy as an indicator of compromise (IoC), when a hacker has registered numerous new users in your WordPress database for spam purposes.
Windows Server
Last updated:
Find vulnerable WordPress plugins fast using PowerShell on Windows Server and IIS
WordPress
Last updated:
Securing the WordPress uploads folder is important. In many hacked WordPress sites, a PHP backdoor is found within the WP_CONTENT_DIR/uploads directory. Often because this is the location where uploads are placed automatically. From the backdoor within wp-content/uploads other backdoors are uploaded to various locations, and scripts are injected with malware.
Security
Last updated:
Since Apache 2.4.6, a new module is used to configure and set up access control for websites: mod_authz_core. This means you have to use a different syntax for allowing or blocking hosts and IP addresses to your website. Apache Access Controle done right in WordPress .htaccess.