Tag: security

AppArmor vs SELinux: what mandatory access control actually does, writing AppArmor profiles with aa-genprof, SELinux labels and audit2allow, and when to use each.

Linux entropy pools decide how fast a box generates SSH keys and TLS certs. What haveged, virtio-rng, and hardware RNG fix on a freshly booted VM.

Advanced Caddy server configuration: wildcard certs, Caddyfile matchers, Docker label integration, rate limiting, forward auth with Authelia, and the JSON API.

Set up auditd to log every sudo command and file change on Linux: auditctl rules, ausearch, aureport, and shipping logs to Loki or Elasticsearch for compliance.

HashiCorp Vault tutorial: KV v2 secrets, AppRole auth, dynamic database credentials that auto-expire, a PKI certificate authority, and auto-unseal with cloud KMS.

Set up a WireGuard VPN kill switch and prevent DNS leaks on Linux. Practical iptables rules, resolv.conf locking, and systemd-resolved config.

Suricata beats Snort on multi-threading and EVE JSON logging. Side-by-side IDS/IPS breakdown with Suricata install, suricata.yaml config, and OPNsense setup for home labs.

nmap isn't just for pen testers. Learn what's actually worth scanning on your home network and what those open ports really mean.

Stop texting passwords. Set up Vaultwarden organizations to share credentials with family or your team: collections, member roles, the bw CLI, and backups.

Learn Linux capabilities to drop root privileges without breaking your apps. Master cap_drop, cap_add in Docker, and setcap for fine-grained privilege control.

Stop running Docker containers like it's the Wild West. Learn 15 critical Docker security mistakes and practical fixes to harden your containers today.

Go beyond ufw allow/deny: rate limiting with ufw limit, logging levels, before.rules for iptables, IPv6 handling, Docker bypass fixes, and fail2ban integration.