Harden your Linux kernel with 40+ sysctl security parameters covering kernel self-protection, memory safety, network defense, and filesystem protection. Includes a production-ready config file, Ansible playbook, CIS/NIST compliance mapping, and drift detection setup.
Build a layered vulnerability scanning pipeline on Linux using OpenVAS/GVM, Trivy, Vuls, and Nmap. Covers setup, CI/CD integration, cron automation, and scanner supply chain security after the March 2026 Trivy compromise.
Harden DNS on Linux with Unbound, DNSSEC validation, DNS over TLS encryption, and RPZ firewalls. Covers the 2026 CA/B Forum DNSSEC mandate, production-ready configs, and step-by-step verification.
Harden TLS and cryptographic configurations across your entire Linux infrastructure. Covers system-wide crypto policies, OpenSSL setup, web server TLS for Nginx and Apache, automated certificate management with Certbot and step-ca, and post-quantum readiness with ML-KEM hybrid key exchange.
A hands-on, command-driven playbook for investigating compromised Linux servers. Covers memory acquisition with AVML, process and network forensics, persistence hunting, log analysis, filesystem imaging, and automated collection with Velociraptor and Cat-Scale.
Set up hardened Linux full disk encryption with LUKS2, TPM2 auto-unlock, FIDO2 hardware keys, and Clevis/Tang NBDE. Includes tested commands for Fedora, Ubuntu, and RHEL with PCR selection guidance and troubleshooting.
Learn to manage secrets on Linux with Vault, SOPS, Age encryption, systemd-creds, and automated scanning tools like Gitleaks and TruffleHog. Covers command-line hygiene, dynamic credentials, CI/CD integration, and working examples you can deploy today.
Harden Linux PAM with brute-force lockout, password quality enforcement, FIDO2 hardware key MFA, TOTP two-factor, yescrypt hashing, and IP-based access control — with tested configs for Ubuntu 24.04 and RHEL 9.
Secure your Linux software supply chain with Sigstore Cosign for container signing, Syft for SBOM generation, Grype for vulnerability scanning, and SLSA provenance — with Kyverno policies to enforce trust at deployment.
Learn how to audit, sandbox, and harden every systemd service on your Linux servers. Covers 40+ security directives with tested override files for Nginx, PostgreSQL, and Redis, encrypted secrets with systemd-creds, and the latest features in systemd v256/v257.
Prevent Linux privilege escalation attacks by auditing SUID/SGID binaries, replacing them with fine-grained capabilities, hardening sudo and Polkit, applying restrictive mount options, and monitoring for unauthorized changes. Includes a ready-to-use audit script.
Automate CIS benchmark compliance scanning and remediation on Linux using OpenSCAP and Ansible. Covers RHEL 9 and Ubuntu 24.04 setup, Ansible Lockdown roles, drift detection, and CI/CD pipeline integration for audit-ready compliance at scale.
Choose your preferred language to explore our content