fix grammar in 2022 posts

1 files changed, 62 insertions, 57 deletions

diff --git a/content/blog/2022-03-24-server-hardening.org b/content/blog/2022-03-24-server-hardening.org
index 2ac897c..c79cf44 100644
--- a/content/blog/2022-03-24-server-hardening.org
+++ b/content/blog/2022-03-24-server-hardening.org
@@ -27,8 +27,9 @@ have to think about the transport of data from =server= to =client=.
 Let's start with the actual server itself. Think about the following:
 
 - Do I have a firewall enabled? Do I need to update this to allow new ports or
-  IPs?
-- Do I have an IPS/IDS that may prevent outside traffic?
+  internet protocol (IP) addresses?
+- Do I have an intrusion prevention system (IPS) or intrusion detection system
+  (IDS) that may prevent outside traffic?
 - Do I have any other security software installed?
 - Are the services hosted inside Docker containers, behind a reverse proxy, or
   virtualized? If so, are they configured to allow outside traffic?
@@ -37,7 +38,7 @@ Once the data leaves the server, where does it go? In my case, it goes to a
 managed switch. In this case, I asked the following:
 
 - What configurations is the switch using?
-- Am I using VLANs?
+- Am I using VLANs (virtual local area networks)?
   - Yes, I am using 802.1Q VLANs.
 - Are the VLANs configured properly?
   - Yes, as shown in the Switch section below, I have a separate VLAN to allow
@@ -47,7 +48,7 @@ managed switch. In this case, I asked the following:
 At this point, the data has been processed through the switch. Where does it go
 next? In my case, it's pretty simple: it goes to the router/modem device.
 
-- Does my ISP block any ports that I need?
+- Does my internet service provider (ISP) block any ports that I need?
   - This is an important step that a lot of people run into when self-hosting at
     home. Use an online port-checker tool for your IP or call your ISP if you
     think ports are blocked.
@@ -59,9 +60,9 @@ next? In my case, it's pretty simple: it goes to the router/modem device.
 - Are there any other settings affecting inbound/outbound traffic?
   - Schedules or access blocks
   - Static Routing
-  - QoS
+  - QoS (Quality of Service)
   - Port Forwarding
-  - DMZ Hosting
+  - DMZ (demilitarized zone) hosting
   - Remote Management (this can sometimes mess with services that also require
     the use of ports 80 and 443)
 
@@ -70,27 +71,31 @@ publicly.
 
 *** Server
 
-The services I run on my server are installed straight into the OS, without any
-use of Docker or VMs, so I don't need any extra application configuration to
-make them accessible to the outside world.+
+The services I run on my server are installed straight into the operating system
+(OS), without any use of Docker or virtual machines (VMs), so I don't need any
+extra application configuration to make them accessible to the outside world.
 
+#+BEGIN_QUOTE
 As of 2022-10-04, the paragraph above is no longer true as I now run a reverse
 proxy with Nginx and host many services inside Docker. However, it doesn't
 change anything regarding this post as I still just need to open ports 80 & 443
 and create the necessary website configuration files.
+#+END_QUOTE
 
 When creating new services - either installed directly on bare metal or within
 something like Docker - I ensure that I read through the documentation
-thoroughly to understand a few key things: - What network activities should this
-app perform (if any)? Using which ports and protocols? - Does this app require
-any commands/services to be run as =root=? - Does this app log errors,
-authentication failures/successes, or anything else that would be useful for an
-investigation?
+thoroughly to understand a few key things:
+
+- What network activities should this app perform (if any)? Using which ports
+  and protocols?
+- Does this app require any commands/services to be run as =root=?
+- Does this app log errors, authentication failures/successes, or anything else
+  that would be useful for an investigation?
 
 For extra security, I use limit all incoming connections to SSH connections
-through my server firewall (=ufw=) and disable common SSH settings. After all of
-that, I use =fail2ban= as a preventative measure against brute-force login
-attempts.
+through my server firewall [=ufw= (Uncomplicated Firewall)] and disable common
+SSH (Secure Shell Protocol) settings. After all of that, I use =fail2ban= as a
+preventative measure against brute-force login attempts.
 
 As another piece of security, you can randomize your SSH port to ensure that
 random scanners or attackers can't easily try to force their way into your
@@ -101,8 +106,8 @@ via your randomized port.
 
 ** =ufw=
 
-To see how to configure =ufw=, see my other post: [[https://cleberg.net/blog/ufw.html][Secure Your 
-Network with the Uncomplicated Firewall]].
+To see how to configure =ufw=, see my other post: [[https://cleberg.net/blog/ufw.html][Secure Your Network with the
+Uncomplicated Firewall]].
 
 The general notion with an on-device firewall is that you want to deny all
 incoming connections by default and then selectively open certain ports for
@@ -178,7 +183,7 @@ sudo ufw enable
    lock yourself out at some point and will need to use a recovery method (e.g.,
    hooking monitor up to home server) to get yourself back in.
 
-3. Enable MFA for =ssh=
+3. Enable Multi-Factor Authentication (MFA) for =ssh=
 
    This part is optional, but I highly recommend it. So far, we've ensured that
    no one can log into our user on the server without using our secret key, and
@@ -187,8 +192,7 @@ sudo ufw enable
 
    This process involves editing a couple files and installing an MFA package,
    so I will not include all the details in this post. To see how to configure
-   MFA for =ssh=, see my other post: [[https://cleberg.net/blog/ssh-mfa.html][Enabling MFA for 
-   SSH]].
+   MFA for =ssh=, see my other post: [[https://cleberg.net/blog/ssh-mfa.html][Enabling MFA for SSH]].
 
 ** =fail2ban=
 
@@ -224,8 +228,8 @@ the server to manage it.
 
 | VLAN ID | VLAN Name | Member Ports | Tagged Ports | Untagged Ports |
 |---------+-----------+--------------+--------------+----------------|
-| 1       | Default   | 1-24         | 1-24         |                |
-| 2       | Server    | 1,8,23       | 1,8,23       |                |
+|       1 | Default   | 1-24         | 1-24         |                |
+|       2 | Server    | 1,8,23       | 1,8,23       |                |
 
 ** 802.1Q VLAN PVID Setting
 
@@ -235,30 +239,30 @@ any related ports (in this case, see that ports =8= and =23= have a PVID of
 
 | Port | PVID |
 |------+------|
-| 1    | 1    |
-| 2    | 1    |
-| 3    | 1    |
-| 4    | 1    |
-| 5    | 1    |
-| 6    | 1    |
-| 7    | 1    |
-| 8    | 2    |
-| 9    | 1    |
-| 10   | 1    |
-| 11   | 1    |
-| 12   | 1    |
-| 13   | 1    |
-| 14   | 1    |
-| 15   | 1    |
-| 16   | 1    |
-| 17   | 1    |
-| 18   | 1    |
-| 19   | 1    |
-| 20   | 1    |
-| 21   | 1    |
-| 22   | 1    |
-| 23   | 2    |
-| 24   | 1    |
+|    1 |    1 |
+|    2 |    1 |
+|    3 |    1 |
+|    4 |    1 |
+|    5 |    1 |
+|    6 |    1 |
+|    7 |    1 |
+|    8 |    2 |
+|    9 |    1 |
+|   10 |    1 |
+|   11 |    1 |
+|   12 |    1 |
+|   13 |    1 |
+|   14 |    1 |
+|   15 |    1 |
+|   16 |    1 |
+|   17 |    1 |
+|   18 |    1 |
+|   19 |    1 |
+|   20 |    1 |
+|   21 |    1 |
+|   22 |    1 |
+|   23 |    2 |
+|   24 |    1 |
 
 * Router
 
@@ -266,9 +270,9 @@ On my router, the configuration was as easy as opening the firewall settings and
 unblocking the ports I needed for my services (e.g., HTTP/S, Plex, SSH, MySQL,
 etc.).
 
-Since I'm relying on an ISP-provided modem/router combo for now (not by
-choice), I do not use any other advanced settings on my router that would
-inhibit any valid traffic to these services.
+Since I'm relying on an ISP-provided modem/router combo for now (not by choice),
+I do not use any other advanced settings on my router that would inhibit any
+valid traffic to these services.
 
 The paragraph above regarding the ISP-owned router is no longer accurate as I
 now use the Ubiquiti Unifi Dream Machine Pro as my router. Within this router, I
@@ -287,10 +291,10 @@ physical security. However, physical security is very important for everyone who
 hosts a server like this. Exactly /how/ important it is depends on the server
 use/purpose.
 
-If you self-host customer applications that hold protected data (HIPAA, GDPR,
-COPPA, etc.), then physical security is extremely important and cannot be
-ignored. If you simply host a blog and some hobby sites, then it's a relatively
-minor consideration, but one you still need to think about.
+If you self-host customer applications that hold protected data, then physical
+security is extremely important and cannot be ignored. If you simply host a blog
+and some hobby sites, then it's a relatively minor consideration, but one you
+still need to think about.
 
 ** Location
 
@@ -312,8 +316,9 @@ Secondly, consider the hardware itself:
 - Are any other users able to access the server, even if your data/space is
   segregated?
 - If you're utilizing a third party, do they have any documentation to show
-  responsibility? This could be a SOC 1/2/3 report, ISO compliance report,
-  internal security/safety documentation.
+  responsibility? This could be a Service Organization Controls (SOC) 1/2/3
+  report, International Organization for Standardization (ISO) compliance
+  report, internal security/safety documentation.
 
 ** Physical Controls