linux-security Archives

Hunting Web Shells on Linux: An Incident Response Field Guide

July 6, 2026

Learn how to hunt, analyze, and remove web shells from Linux servers. This guide covers LMD installation, grep patterns, and log correlation to stop silent backdoors.

Security

Building a Self-Hosted EDR with osquery on Linux: Monitor Processes, Network, and File Changes Using SQL

June 30, 2026

osquery lets you query your Linux system like a database — every process, network socket, and file event becomes a SQL row. After six months running it in production as a self-hosted EDR, here is a complete setup guide covering installation, scheduled monitoring queries, file integrity detection, and a simple alert pipeline.

Security

Detecting and Removing Cryptominer Malware on Linux Servers

June 30, 2026

A Linux server running at 98% CPU with no traffic spike is a red flag for cryptominer malware. This guide walks through systematic detection of CPU-hijacking miners, safe removal of all persistence mechanisms, and practical hardening steps to prevent reinfection.

Linux

Linux SUID, SGID, and Sticky Bit: Master Special Permissions for System Security

June 2, 2026

SUID, SGID, and Sticky Bit are Linux's special permission bits that control privilege elevation and file ownership inheritance. Here's how each one works internally, when to actually use them in production, and how to audit your system before someone else finds the misconfigurations.

Security

Metasploit Framework on Linux: Hands-On Penetration Testing in a Legal Lab Environment

May 29, 2026

Learn how to install Metasploit Framework on Linux, set up an isolated penetration testing lab with Metasploitable 2, and validate real vulnerabilities through hands-on exploitation. A practical walkthrough from reconnaissance to post-exploitation, written for engineers who need proof, not just scan reports.

Networking

GeoIP Blocking with nftables and MaxMind GeoLite2 on Linux: Filter Traffic by Country

May 29, 2026

GeoIP blocking with nftables and MaxMind GeoLite2 lets you drop traffic from entire country IP ranges at the firewall level, before it reaches your application. This guide covers the full setup: downloading the database, extracting country ranges, loading them into nftables sets, and automating bi-weekly updates with systemd and cron.

Networking

Hardening Linux Networks: Microsegmentation with nftables

May 27, 2026

Secure your internal network by moving beyond perimeter firewalls. Learn how to use nftables sets and chains to implement a Zero Trust microsegmentation strategy on Linux.

Security

Linux Privilege Escalation: From Initial Foothold to Root Access

May 26, 2026

Is your Linux server one misconfig away from a total breach? Learn how attackers exploit SUID bits and sudoers files, and how to use tools like LinPEAS and Auditd to stop them.

Security

Static Malware Analysis with Ghidra: A Hands-on Guide for Linux

May 24, 2026

Learn how to use Ghidra on Linux for static malware analysis. This guide provides a practical workflow for reverse engineering ELF and PE binaries to uncover hidden threats.

Security

Linux Digital Forensics: Recovering Evidence with Autopsy and TSK

May 23, 2026

Go beyond simple commands. Learn how to use Autopsy and The Sleuth Kit to perform deep-dive digital forensics on Linux, recover deleted evidence, and map out attacker timelines.