Tag: security

Passkeys finally killed passwords for real users. Here's what WebAuthn actually is under the hood, and how to roll passkeys out on your self-hosted services.

Native ZFS dataset encryption vs LUKS under your pool — which layer to encrypt at, performance trade-offs, key management, and raw send/recv.

Zero-trust access for SSH, k8s, and databases — HashiCorp Boundary vs Teleport compared on identity, session recording, and self-host fit.

Go beyond basic UFW rules — rate limiting, geo-blocking, application profiles, logging, and before.rules tricks for serious firewall hardening.

ENV bakes secrets into layers visible in docker history. Use BuildKit --secret, runtime vars, or .env files.

LinkedIn scans every visitor's installed extensions and sends the data to third parties without consent. Here's what they're looking for—and how to stop it.

Disaster recovery for your Linux home lab — tiered backups, a restic script that actually runs, restore drills, and the gotchas that bite at 2 AM.

Scan your containers and dependency trees with trivy, grype, syft, and osv-scanner. Generate SBOMs and catch CVEs before a supply chain attack catches you.

OpenConnect replaces the bloated AnyConnect client on Linux. Run ocserv for a self-hosted Cisco-compatible VPN server — no 200MB installer required.

Proxychains-ng, Tor, and VPN+Tor combos tested honestly: which setups actually anonymize traffic and which are security theater you should stop trusting.

Generate SSH keys, set up passwordless auth, configure SSH, and transfer files securely with SCP — the foundation of headless Linux work.

TLS tunneling for legacy plaintext services — stunnel's X.509 cert model vs spiped's pre-shared key simplicity, and when each one actually wins.