Tag: security

AV vs EDR, traditional antivirus signatures vs behavioral endpoint detection. What each catches, what it misses, and what you actually need.

Certificate pinning locks your app to a specific TLS cert so MITM attackers can't swap in a rogue CA, how it works and when to use it.

regreSSHion (CVE-2024-6387) is a remote code execution bug in OpenSSH, what it is, which versions are affected, and how to patch fast.

Cloudflare Tunnels expose local services to the internet without open ports, secure setup with zero-trust access controls.

Go beyond basic UFW rules, rate limiting, geo-blocking, application profiles, logging, and before.rules tricks for serious firewall hardening.

UFW makes iptables manageable, allow and deny rules, app profiles, default policies, and the 5-minute setup for any new Linux server.

SSH tunnels forward ports over encrypted connections, local forwarding, remote forwarding, and dynamic SOCKS proxy explained.

List every user and group on Linux with /etc/passwd, /etc/group, and getent, see who is logged in, and separate system accounts from normal users by UID.

Disaster recovery for your Linux home lab, tiered backups, a restic script that actually runs, restore drills, and the gotchas that bite at 2 AM.

Run a WireGuard VPN server in Docker with the linuxserver image, Compose setup, peer config generation, and road warrior access to your home network.

RSA SSH keys are aging out. Ed25519 is the modern default: generate one in seconds, secure it with ssh-agent, add FIDO2 hardware keys, and audit legacy keys safely.

Use su with a specific shell to switch users without the default login shell, useful when /etc/passwd points to something unexpected.