Zhang Peng's Blog

Article comments, leaderboards, poll results — this kind of content is dynamically generated but updates infrequently, and hitting the backend on every request is wasteful. Caching them at the Nginx proxy layer noticeably eases backend pressure and speeds up page loads. This post runs the full configuration hands-on in an nginx:1.28 container: cache hits, expiry, the fallback when the backend dies, and one cache-key mistake that lets users read other people’s data. What Content Suits This Kin...

When an API is slow, the first instinct is to scale up the backend — but many responses never change at all: list pages, config items, public detail views. Nine out of ten requests return identical content. Nginx’s proxy_cache module caches these upstream responses on local disk and serves cache hits directly, so the backend handles one fewer request for every one saved. Bottom line up front: proxy_cache stands up with three directives — proxy_cache_path carves out a disk area (allowed only a...

You have a batch of files on a server you want colleagues to browse directly, without writing any pages — autoindex is Nginx’s built-in directory listing: when the requested directory holds no default index file such as index.html, Nginx automatically generates an HTML page listing links to every file and subdirectory. This post, in an nginx:1.28 container, runs through the switch, the two display options, the JSON output, and two classic cases of “why am I not seeing a listing”. Lab Environm...

When configuring static file serving, both root and alias tell Nginx which directory on the filesystem to look in. The two directives look alike but do different jobs, and the consequence of confusing them is immediate: a 404, or a file that isn’t the one you wanted at all. The most classic failure scene: the config looks right from every angle, yet error_log holds a path you never wrote. This article is organized around hands-on configuration: first the lab environment, then three sets of co...

Run Nginx long enough and access.log bloats until even grep chokes. Log rotation has to solve two things: archive and compress the old logs on a schedule, while getting nginx to switch to a fresh file and keep writing. This post presents two approaches: a hand-written Bash script, and the system’s built-in logrotate. Both were tested in an nginx/1.31.5 container (logrotate 3.22.0); all outputs come from real runs. Lab EnvironmentAn nginx/1.31.5 container (nginx:alpine), with logs as...

Ports 135, 137, 138, 139, and 445 are the five most heavily scanned ports on Windows servers, and the main entry points of large-scale ransomware incidents like WannaCry and EternalBlue all live here. An open port 445 on the public internet usually survives less than a day against automated scanners, and inside an intranet these ports are the standard springboard for lateral movement. Closing all five requires no third-party tools — the built-in Windows firewall is enough. This post first exp...

When an MS15-034 vulnerability notice lands on an ops team, two questions matter most: is my server within the affected range, and what if the patch can’t be applied right away? This post walks the full response path for CVE-2015-1635 in order: confirm the blast radius → respond (patching first, mitigation second) → verify the fix. Symptoms and Affected RangeCVE-2015-1635 corresponds to Microsoft security bulletin MS15-034: HTTP.sys, the Windows HTTP protocol stack component, mishandles speci...

Vulnerability scanners frequently flag CVE-2016-2183 — the SSL/TLS protocol information disclosure issue known as SWEET32 — on the 3389 port (RDP) of Windows servers. The root cause is that Windows enables a set of weak cipher suites by default: 3DES uses a 64-bit block, and once a long session accumulates enough traffic, a birthday attack can recover sensitive content, so the scanner raises the alarm. This problem doesn’t need a patch: replace the SSL cipher suite order in Local Group P...

A single mistyped rm -rf on a server can cost an entire data disk. Rather than recovering after the fact, block high-risk commands like rm at the shell level in advance. This post builds two layers of protection with aliases: replace rm with a harmless message, then cover the cases where deletion is genuinely needed with “recycle bin + scheduled cleanup”, while also disabling mistake-prone, instant-firing commands like shutdown/reboot. Everything was tested live in a Rocky 9 container, a...

One class of need is very common: download the software updates while bandwidth is idle, and actually install them during the maintenance window. DownloadOnly mode exists exactly for this — it performs only the download, without installing or updating right away. This post follows dnf on Rocky Linux 9 as the main line (all commands tested in a rockylinux:9 container, dnf 4.14.0, aarch64); the CentOS 7 plugin approach is given its own section as a historical difference, for reference on older ...