Security on Apuntes de root

Bulwark: block attacking IPs at the router level

jorti@pm.me (Juan Orti Alcaine) — Fri, 06 Mar 2026 09:14:09 +0100

Inspired on Crowdsec firewall bouncer, and also with the intention of learning some Rust, I’ve created Bulwark, a small program to run in a OpenWrt router (or any Linux machine) to ban IPs of attacks detected by my servers.

From Fail2ban to Reaction

jorti@pm.me (Juan Orti Alcaine) — Tue, 03 Mar 2026 16:35:37 +0100

Fail2ban has been an important security tool I’ve been using in my servers for many years. However sometimes is difficult to configure, lacks certain features and can consume too many resources.

Recently I’ve switched to Reaction, a new tool with the same philosophy: monitor logs and execute some actions based on log matches. Reaction is written in Rust, so it’s fast and resource efficient.

Sandbox Steam running it under a different account

jorti@pm.me (Juan Orti Alcaine) — Thu, 14 Jul 2016 00:00:00 +0000

To improve my system’s security, I’ve configured Steam to be run as a different Linux account. This guide is inspired in this thread.

Export non-exportable private keys from Windows key store

jorti@pm.me (Juan Orti Alcaine) — Tue, 16 Dec 2014 00:00:00 +0000

When I was looking for a utility to export the non-exportable private keys in Windows, I found the mimikatz tool, which enabled me to do that and a lot more.

To export the private keys, run mimikatz as administrator and type:

crypto::capi
crypto::certificates /export

And you’ll get the certicates exported with the password mimikatz. You can also export the machine certificates with /systemstore flag. See the wiki for more info.

This tool is detected as a threat by many antivirus, so you’ll have to probably disable yours before using it.