linux-security Archives

Real-time Linux Security with Tetragon and eBPF: Stopping Attacks at the Kernel Level

August 25, 2026

Move beyond reactive logging. Learn how to use Tetragon and eBPF to monitor kernel events and block malicious processes like unauthorized file access and network scans in real-time.

Security

Hardening /dev/shm: Stop Malware from Hiding in Your Server’s RAM

August 2, 2026

Is your /dev/shm directory a security hole? Learn how to use mount flags like noexec and nosuid to prevent attackers from running malware directly from your server's RAM.

Security

Recording Linux Terminal Sessions: A Guide to Auditing with tlog

August 2, 2026

Secure your Linux servers by recording terminal sessions with tlog. This guide shows you how to install tlog, integrate it with SSSD, and replay sessions via Cockpit.

Security

Auditing Linux Kernel Security: A Guide to linux-exploit-suggester

August 2, 2026

Discover how to use linux-exploit-suggester to identify critical Linux kernel vulnerabilities and prevent local privilege escalation attacks.

Security

Build a Tor Transparent Proxy: A Bulletproof Gateway for Lab Anonymity

July 30, 2026

Build a secure Tor Transparent Proxy on Linux. Route all lab traffic through the Tor network to prevent IP leaks and ensure total anonymity during security research.

Security

Linux Kernel Lockdown: How to Stop Root-Level Attacks

July 30, 2026

Secure your Linux system against root-level attacks. This guide explains how to implement Kernel Lockdown, covering Integrity vs. Confidentiality modes and troubleshooting tips.

Security

Hunting Web Shells on Linux: An Incident Response Field Guide

July 6, 2026

Learn how to hunt, analyze, and remove web shells from Linux servers. This guide covers LMD installation, grep patterns, and log correlation to stop silent backdoors.

Security

Building a Self-Hosted EDR with osquery on Linux: Monitor Processes, Network, and File Changes Using SQL

June 30, 2026

osquery lets you query your Linux system like a database — every process, network socket, and file event becomes a SQL row. After six months running it in production as a self-hosted EDR, here is a complete setup guide covering installation, scheduled monitoring queries, file integrity detection, and a simple alert pipeline.

Security

Detecting and Removing Cryptominer Malware on Linux Servers

June 30, 2026

A Linux server running at 98% CPU with no traffic spike is a red flag for cryptominer malware. This guide walks through systematic detection of CPU-hijacking miners, safe removal of all persistence mechanisms, and practical hardening steps to prevent reinfection.

Linux

Linux SUID, SGID, and Sticky Bit: Master Special Permissions for System Security

June 2, 2026

SUID, SGID, and Sticky Bit are Linux's special permission bits that control privilege elevation and file ownership inheritance. Here's how each one works internally, when to actually use them in production, and how to audit your system before someone else finds the misconfigurations.