Ankit Maurya

🔐 VPS Initial Security Setup (First 30 Minutes)

Fri, 15 May 2026 00:00:00 +0000

⚠️ The Situation

Fresh VPS = immediate bot scans + SSH brute force
Default configs = weak
If you delay → you will get hit

✅ Step 1: Create Non-Root User (With Sudo)

Command

adduser youruser
usermod -aG sudo youruser

What it does

Creates a normal user and gives admin privileges.

⚠️ Caution

Never continue using root for daily work

✅ Step 2: Setup SSH Key Authentication

🔹 Generate Key (Local Machine)

ssh-keygen-t ed25519-C"your-email@example.com"

🔹 Copy Key to Server

ssh-copy-id youruser@your-server-ip

ssh youruser@your-server-ip

⚠️ Caution

Securing Cloud Infrastructure: A Practical Guide

Thu, 20 Jun 2024 00:00:00 +0000

Cloud security is often viewed as complex, but fundamental practices can dramatically improve your security posture. Here’s what I’ve learned from building secure cloud architectures.

Identity & Access Management

The foundation of cloud security starts with IAM. Too many organizations grant broad permissions “for convenience” which creates significant risk.

Least Privilege Principle

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::my-bucket/*",
    "Condition": {
      "IpAddress": {"aws:SourceIp": "10.0.0.0/8"}
    }
  }]
}

This policy only allows GetObject from the internal network range, not from anywhere else.

MCP Monitoring Tool

Sat, 15 Jun 2024 00:00:00 +0000

This project is a proxy-based monitoring system for inspecting LLM context during conversations. It provides visibility into what’s being sent to and from AI models.

Features

Context Inspection: Monitor all prompts and responses going to LLM APIs
Security Logging: Capture and store interaction data for security analysis
Real-time Monitoring: Live view of active conversations
Data Export: Export conversation logs for analysis

Architecture

The tool sits as a proxy between your application and the LLM API, intercepting all traffic for inspection.

Secure Cloudflare Tunnel + Nginx

Mon, 20 May 2024 00:00:00 +0000

A comprehensive guide to exposing self-hosted services securely using Cloudflare Tunnel and Nginx reverse proxy.

Why This Setup?

No need to open ports on your firewall
Automatic SSL/TLS encryption
DDoS protection from Cloudflare
Access control via Cloudflare Access

Architecture Overview

User --> Cloudflare --> Tunnel --> Nginx --> Service

Configuration Steps

Create a Cloudflare account and add your domain
Install cloudflared on your server
Configure the tunnel with your services
Set up Nginx as a reverse proxy
Configure SSL certificates

Nginx Configuration

server {
    listen 443 ssl;
    server_name service.example.com;

    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/private/key.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Security Considerations

Enable authenticated origin pulls
Use Cloudflare Access for sensitive services
Implement rate limiting
Log all access attempts

Building a CSPM Pipeline: Lessons Learned

Wed, 15 May 2024 00:00:00 +0000

Cloud Security Posture Management (CSPM) pipelines help organizations continuously monitor and improve their security posture. Here’s what I learned building CSPM solutions.

Why CSPM Matters

Manual security reviews don’t scale. As cloud infrastructure grows, you need automated checks that run continuously.

Core Components

1. Data Collection

import boto3

def collect_iam_policies():
    iam = boto3.client('iam')
    policies = iam.list_policies(Scope='Local')['Policies']
    return [
        {
            'arn': p['Arn'],
            'name': p['PolicyName'],
            'version': iam.get_policy_version(
                PolicyArn=p['Arn'],
                VersionId=iam.get_default_version_id(p['Arn'])['DefaultVersionId']
            )['PolicyVersion']['Document']
        }
        for p in policies
    ]

2. Policy Evaluation

Each control should map to a security benchmark (CIS, NIST, SOC2). Example check:

n8n AI Automation System

Wed, 10 Apr 2024 00:00:00 +0000

Building an AI-powered automation system using n8n for security operations and workflow management.

Overview

This system automates security tasks using n8n workflows, AI integrations, and various notification channels.

Key Components

n8n Engine: Core workflow automation
Telegram Bot: Alert notifications and commands
Webhook Triggers: Integration with external services
AI Processing: GPT-based analysis and responses

Workflow Examples

Security Alert Pipeline

Receive webhook from security tool
Parse alert data
Send to AI for classification
Route based on severity (Telegram/Email)
Log to database

Telegram Integration

// n8n Telegram node configuration
{
  chatId: process.env.TELEGRAM_CHAT_ID,
  text: "Security Alert: {{ $json.alert_type }}",
  parse_mode: "HTML"
}

Benefits

Automated incident response
Reduced manual monitoring
Faster alert routing
Integration with existing tools

Zero Trust Architecture: Implementation Guide

Mon, 08 Apr 2024 00:00:00 +0000

Zero Trust isn’t a product you buy—it’s a security philosophy you implement. Here’s a practical approach to building zero trust in cloud environments.

Core Principles

Never Trust, Always Verify
Assume Breach
Least Privilege Access
Verify Explicitly

Network Layer

Traditional perimeter security assumes everything inside is trusted. Zero trust rejects this.

Micro-segmentation

# Terraform: Security groups for micro-segmentation
resource "aws_security_group" "app_server" {
  name        = "app-server"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.load_balancer.id]
  }

  egress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.database.id]
  }
}

Services can only communicate with explicitly allowed paths.

Container Security Best Practices

Wed, 20 Mar 2024 00:00:00 +0000

Container security is critical in modern cloud-native applications. Here’s a comprehensive guide to securing your containerized workloads.

Container Images

Use Minimal Base Images

# Bad: Large base image with many dependencies
FROM ubuntu:22.04

# Good: Minimal image with just what's needed
FROM gcr.io/distroless/static-debian12

Distroless images contain only the application and its runtime dependencies, reducing the attack surface.

Multi-Stage Builds

# Build stage
FROM golang:1.22 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o main

# Production stage
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

This keeps build tools and source code out of production images.

JWT Security Analysis

Tue, 05 Mar 2024 00:00:00 +0000

Tools and techniques for analyzing JWT tokens for authentication vulnerabilities.

JWT Overview

JSON Web Tokens (JWT) are commonly used for authentication but can introduce security issues if not implemented correctly.

Common Vulnerabilities

Algorithm Confusion (alg: none)

# Exploit: Change alg to "none" and remove signature
header = {"alg": "none", "typ": "JWT"}
payload = {"sub": "1234567890", "role": "admin"}

Key Confusion (RS256 to HS256)

If the server uses RS256 but the library accepts HS256 with the public key as the secret.

Analysis Tools

JWT.io for manual inspection
Custom Python scripts for batch analysis
Burp Suite extension for runtime inspection

Validation Checklist

Verify signature with correct algorithm
Check token expiration (exp claim)
Validate audience (aud claim)
Ensure proper key management
Use strong secret keys (256-bit minimum)

Best Practices

Always validate algorithm expected by your application
Use asymmetric algorithms (RS256) when possible
Implement token rotation
Set appropriate expiration times

About

Mon, 01 Jan 0001 00:00:00 +0000

Hi, I’m Ankit Maurya.

I work in cloud security, application security, and automation engineering. Most of my work revolves around building secure infrastructure, improving visibility across environments, and automating repetitive operational tasks.

Over the years, I’ve developed a strong interest in practical security engineering — not just theoretical concepts. I enjoy understanding how systems actually work under the hood, breaking down complex architectures, and building secure solutions that are usable in the real world.