PAM Authentication Audit: Securing the Linux Login Stack
PAM (Pluggable Authentication Modules) is the layer between every Linux login and the password, key, or token that prove...
Security & Hardening
Linux security, firewall configuration, and system hardening guides
Linux Login History: Analyzing wtmp, Failed Logins, and Suspicious Access Patterns
The first artifact every responder asks for after a suspected breach is the login history — who connected, from where,...
Sysctl Kernel Tuning: Security and Performance Parameter Hardening on Linux
The Linux kernel exposes hundreds of tunables under /proc/sys, and the defaults are conservative compromises designed to...
Environment Variable Security: Preventing Credential Leaks and PATH Hijacking
Environment variables are the silent attack surface of every Linux server. Every running process exposes its environment...
Linux Audit Log Analysis: Detecting Security Events with auditd
The Linux Audit Framework (auditd) is a powerful system for tracking security-relevant events on Linux servers. It recor...
lsof Open Files & Ports Audit: Linux Security Guide
Audit open files, listening ports, and network connections with dargslan-lsof-audit CLI tool....
SELinux Security Hardening: Modes, Contexts, Booleans, and Denial Troubleshooting
SELinux provides mandatory access control that goes beyond traditional file permissions. When properly configured, SELin...
Kernel Module & Modprobe Security Check: Linux Guide
Check loaded kernel modules, blacklists, and modprobe config with dargslan-modprobe-check CLI tool....
Linux User Session Management: Active Sessions, Idle Detection, and TTY Monitoring
Managing user sessions is a critical security and operational task. Knowing who is logged in, what they are doing, and h...