Linux guides
21 guides in Security & Hardening · intermediate.
Install the Wazuh Agent on Linux
Install and configure the Wazuh Agent on Linux: add the repo, enroll with your manager, set up log collection, file integrity monitoring, and vulnerability detection.
Manage Secrets with Ansible Vault
Encrypt Ansible secrets with AES-256 using ansible-vault: encrypt files and inline vars, automate with password files, and isolate group-level secrets with vault IDs.
Replace fail2ban with CrowdSec
Replace fail2ban with CrowdSec: install the agent and firewall bouncer, activate crowd-sourced blocklists, configure scenarios, and verify enforcement with nftables.
Audit a Linux Server with Lynis
Run Lynis on any Linux server, interpret the hardening index and findings, apply the most impactful fixes, and automate weekly audits with a systemd timer.
Detect Rootkits and Malware on Linux
Use chkrootkit, rkhunter, ClamAV, and Lynis to scan a Linux system for rootkits and malware — what each tool actually checks and how to read the results.
Linux Disk Encryption Strategies
A practical guide to Linux disk encryption: full-disk LUKS2, encrypted /home partitions, kernel-native fscrypt, and file-level tools age and gocryptfs.
chrony and Secure Time on Linux
Configure chrony with NTS (authenticated NTP over TLS) on Linux to prevent clock-skew attacks and protect Kerberos, TLS, and TOTP authentication.
How to Use a YubiKey on Linux
Use a YubiKey on Linux for PIV SSH, FIDO2 sudo and login via PAM, GPG smart card subkeys, and SSH through gpg-agent — step by step.
How to Add Two-Factor Authentication to SSH
Enforce two-factor authentication on SSH using PAM and Google Authenticator TOTP, with YubiKey alternatives and per-user exemption patterns for automation accounts.
How to Protect nginx with fail2ban
Build custom fail2ban filters for nginx to block bad bots, brute-force attempts, and scanners — with tuned ban times and firewall backend configuration.
How to Detect Rootkits with rkhunter
Install rkhunter, build a clean file-property baseline, tune the config to cut false positives, and automate daily scans with a systemd timer.
How to Audit Linux Hardening with Lynis
Run Lynis to audit your Linux server, interpret the hardening index and warning output, and work through findings from critical to low-effort wins.
How to Set Up GPG Encryption
Generate GPG key pairs, encrypt and decrypt files, sign data, manage your keyring, and verify signatures on Debian, Fedora, and Arch Linux.
How to Set Up a Firewall with firewalld
Learn how to configure firewalld using zones, services, rich rules, and source bindings — with a clear explanation of runtime vs permanent changes.
How to Secure Webmin
Harden Webmin against attack: restrict access by IP, enforce HTTPS with valid certs, set up TOTP two-factor auth, integrate Fail2ban, and lock down modules.
Linux Server Security Checklist
A step-by-step Linux server hardening checklist: secure SSH, firewall rules, automatic updates, service auditing, fail2ban, and intrusion detection for any internet-facing server.
How to Install and Configure fail2ban
Install fail2ban, configure the SSH jail, tune ban times, write custom filters, and verify bans are working — on Debian, Fedora, and Arch.
How to Harden SSH on Linux
Lock down OpenSSH with key-only auth, disabled root login, user allowlists, and firewall rules. Step-by-step for Ubuntu, Fedora, RHEL, and Arch.
How to Encrypt a Disk with LUKS
Encrypt a full disk or individual partition on Linux using LUKS2 and cryptsetup, including key management, boot integration, and header backups.
How to Configure sudo Safely
Learn to configure sudo securely using visudo, sudoers syntax, per-command restrictions, NOPASSWD, and drop-in files to enforce least-privilege access on Linux.
AppArmor Explained
Learn how AppArmor profiles work, how to switch between enforce and complain mode, create new profiles, and diagnose access denials on Ubuntu, Debian, and Arch.