Security Hardening
SSH hardening, firewalls, auth, and vulnerability response
Browse by topic
Security Hardening guides15
Wireshark Packet Analysis in Practice — Display Filters and Traffic Debugging
A practical debugging walkthrough centered on the Wireshark GUI: capture vs. display filters, essential display filters, Follow TCP Stream, Expert Information, IO Graphs, and tshark CLI usage.
HashiCorp Vault Basics — Secret Management and Dynamic Credentials
Covers HashiCorp Vault core concepts (seal/unseal, tokens, policies, secrets engines) and walks through KV v2 static secrets, database dynamic credentials, and AppRole authentication.
Centralizing Logs with rsyslog — Remote Collection and Filtering
This guide explains how to collect logs from multiple servers onto a central server with rsyslog, configure filtering, parsing, and forwarding rules, and route logs to Elasticsearch or files.
AppArmor Basics — A Practical Guide to Restricting Process Privileges
Covers AppArmor modes, applying and disabling existing profiles, creating new profiles with aa-genprof, log analysis, and Nginx and MySQL profile examples.
Hardening Server Security with Nmap Port Scans: A Practical Guide
Explains how to detect open ports, services, and operating systems with nmap, how to self-audit server security, and how to interpret scan results.
SSH Two-Factor Authentication — Google Authenticator OTP Setup
A step-by-step guide to installing the Google Authenticator PAM module and adding TOTP-based two-factor authentication to SSH logins.
Complete File Permissions Guide — chmod · chown · ACL
A practical rundown of permission management: chmod numeric and symbolic notation, chown ownership changes, umask defaults, and fine-grained ACL control with setfacl/getfacl.
Fail2Ban Advanced — Custom Filters, Actions, and Whitelists
This guide covers advanced Fail2Ban configuration: parsing application logs with custom filters, adding actions, and managing whitelists and blacklists.
sudo Privilege Management — sudoers · Least Privilege · Audit Logs
Covers sudoers file syntax, granting sudo privileges to users and groups, least-privilege rules that allow only specific commands, and how to audit sudo logs.
Initial Security Setup for a New Linux Server — First 10-Minute Checklist
On day one with a new server, completeness matters more than depth. This beginner checklist covers 8 steps—SSH keys, UFW, fail2ban, and automatic updates—in 30 minutes; deeper configuration for each item is covered in separate guides.
Linux System Security Auditing — Lynis, auditd, and SELinux in Practice
From automated Lynis audits and auditd event tracing through SELinux policy enforcement — an in-depth guide to measuring and hardening production server security.
Practical OpenSSL — Generating, Inspecting, and Converting Certificates
A practical rundown of essential openssl commands: generating self-signed certificates, issuing CSRs, inspecting certificate details, and converting between PEM and PFX formats.
Blocking SSH brute-force attacks with fail2ban — jail setup and monitoring
Automatically detect and block SSH brute-force attacks with fail2ban. Covers jail.local core parameters, recidive long-term bans, email alerts, Cloudflare and ipset integration, and day-to-day commands. See the separate guide for baseline S
GPG Key Generation and Practical File Encryption
How to generate a GPG key pair, encrypt and decrypt files, and apply symmetric encryption and signing in day-to-day work.
Hardening SSH: Locking Down sshd_config with Key-Only Login, AllowGroups, and MFA
Covers sshd_config hardening, switching to key-based authentication, and controlling SSH access with AllowGroups, Match blocks, and MFA. Automatic brute-force blocking with fail2ban is covered in a separate guide.