Linux guides
14 guides in Security & Hardening · advanced.
Linux for Security Researchers (Lab Setup)
Build a KVM-based security research lab with isolated networks, Kali tools on mainstream distros, snapshot discipline, INetSim decoy networks, and safe malware capture workflows.
Seccomp-BPF Syscall Filtering
Apply seccomp-BPF syscall filtering with libseccomp and systemd SystemCallFilter to harden Linux services using allowlists, denylists, and argument-level rules.
Linux Capabilities Explained
Learn how Linux capability bits work, how to audit and replace setuid binaries with setcap/getcap, and how to use ambient capabilities in systemd services.
Hands-on Linux Auditing with auditd
Learn to configure auditd rules, watch critical files and syscalls, and extract actionable security intelligence with ausearch and aureport on modern Linux.
Runtime Security with Falco
Install Falco with the modern eBPF probe, write custom detection rules, and route real-time runtime security alerts to Grafana Loki and Slack.
Install BunkerWeb for nginx-based WAF
Deploy BunkerWeb as an nginx-based WAF using Docker Compose, configure ModSecurity with OWASP CRS, enable bot blocking, and verify malicious traffic is blocked.
Apply CIS Benchmarks with OpenSCAP
Use OpenSCAP and scap-security-guide to evaluate, report on, and remediate Linux systems against CIS Benchmarks — covering install, eval, and automation.
Use a YubiKey for SSH and GPG
Move SSH and GPG private keys onto a YubiKey using the OpenPGP applet with gpg-agent and FIDO2 resident keys, with touch policies and offline backups.
Use osquery for Linux Host Visibility
Install osquery on Linux, write SQL queries against processes, files, and sockets, configure FIM packs, and enroll hosts into a Fleet manager for full fleet visibility.
Lock Down systemd Services (Sandboxing)
Harden Linux daemons using systemd sandboxing directives: ProtectSystem, PrivateTmp, NoNewPrivileges, CapabilityBoundingSet, and SystemCallFilter explained step by step.
Auto-unlock LUKS at Boot with TPM2 and Clevis
Bind a LUKS2 volume to your TPM2 chip with Clevis so encrypted disks unlock automatically at boot—without sacrificing your recovery passphrase.
How to Configure ModSecurity as a Web Application Firewall
Install ModSecurity with OWASP CRS on Apache or Nginx, run it in detection mode to catch false positives, tune exclusions, then enforce blocking.
SELinux Explained (and How to Live With It)
Learn SELinux modes, file contexts, booleans, and how to fix denials with restorecon, setsebool, and audit2allow — without ever disabling it.
How to Audit a Linux System with auditd
Set up auditd on Linux to track file access, syscalls, and privilege use. Covers persistent rules, file watches, ausearch, and aureport across major distros.