Tag: security

Understand SSH agent forwarding security risks. When it's safe (almost never), and better alternatives like ProxyJump for jump hosts.

ENV bakes secrets into image layers that docker history shows to anyone. Use BuildKit secret mounts, runtime variables, or a real secrets manager.

Understand Linux umask: what it is, how 022 and 027 work, calculating file permissions, and why it matters for shared directories and security.

Containers run as root by default, which is a real security problem. The USER instruction, numeric UID/GID, the volume mount gotcha, and distroless bases.

AV vs EDR, traditional antivirus signatures vs behavioral endpoint detection. What each catches, what it misses, and what you actually need.

Certificate pinning locks your app to a specific TLS cert so MITM attackers can't swap in a rogue CA, how it works and when to use it.

regreSSHion (CVE-2024-6387) is a remote code execution bug in OpenSSH, what it is, which versions are affected, and how to patch fast.

Cloudflare Tunnels expose local services to the internet without open ports, secure setup with zero-trust access controls.

Go beyond basic UFW rules, rate limiting, geo-blocking, application profiles, logging, and before.rules tricks for serious firewall hardening.

UFW makes iptables manageable, allow and deny rules, app profiles, default policies, and the 5-minute setup for any new Linux server.

SSH tunnels forward ports over encrypted connections, local forwarding, remote forwarding, and dynamic SOCKS proxy explained.

Create, modify, and delete users and groups on Linux, useradd, usermod, groupadd, sudo access, and /etc/passwd explained.