Tag: security

Vaultwarden Organization Sharing: Password Management for Your Whole Household (or Team)

Stop texting passwords. Set up Vaultwarden organizations to share credentials with family or your team: collections, member invites, roles, and the bw CLI.

CVE-2026-31431: The 9-Year Linux Root Bug

CVE-2026-31431 (copy.fail) lets any local user become root on virtually every Linux system since 2017. Here's what it is, why it matters, and how to fix it.

OpenCanary: Honeypots for Your Home Lab

A honeypot sits quietly on your network pretending to be valuable. Touch it and you've found an intruder. Deploy OpenCanary in Docker, dead simple.

nftables: Modern Linux Firewalling

iptables is being phased out. nftables is faster, cleaner, and already the default on modern Linux. Here's how to actually use it without wanting to quit.

Suricata vs Snort: Network Intrusion Detection That Actually Works

Snort invented network intrusion detection. Suricata multi-threaded its way past it. Here's how to set up real IDS/IPS on your home lab and actually understand what it's telling you.

SBOMs and Supply Chain Security

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.

Container Security: Scan and Sign Your Images Like You Mean It

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.

Falco: Catch Container Attacks at Runtime

Falco watches every syscall your containers make and screams when something sketchy happens. Like someone exec'ing a shell inside your nginx container at 3am.

Cloudflare Tunnels: The Zero-Port-Forward Guide to Exposing Your Services

No port forwarding, no DDNS drama. Cloudflare Tunnels advanced config: multiple services, Access policies, origin TLS, and what Cloudflare can actually see.

Your Server Doesn't Know What Random Means (And That's a Problem)

Your freshly booted VM is generating SSH keys with barely any entropy, and that should make you nervous. Linux needs randomness to do cryptography, and headless servers are terrible at collecting it. Here's what's actually happening inside /dev/random and how to fix it before you generate a weak key.

Trivy + Cosign: Scan and Sign Your Images

You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.

Fail2ban vs CrowdSec: Blocking the Bots Actually Smartly

Fail2ban bans IPs that attack you. CrowdSec bans them before they attack you, using community threat intelligence. Here's how to set up both and why you might want both.