Linux Audit Log Analysis: Tracking File Access, Commands, and Security Events
The Linux audit framework is the closest thing the kernel provides to a flight recorder. Every system call, every file a...
Security & Hardening
Linux security, firewall configuration, and system hardening guides
Sysctl Kernel Tuning: Security and Performance Parameter Hardening on Linux
The Linux kernel exposes hundreds of tunables under /proc/sys, and the defaults are conservative compromises designed to...
Linux Login History: Analyzing wtmp, Failed Logins, and Suspicious Access Patterns
The first artifact every responder asks for after a suspected breach is the login history — who connected, from where,...
at/batch Scheduler Security Audit: Linux Admin Guide
Audit at/batch scheduled jobs, check access control, and monitor pending tasks with dargslan-at-scheduler....
lsof Open Files & Ports Audit: Linux Security Guide
Audit open files, listening ports, and network connections with dargslan-lsof-audit CLI tool....
Kernel Module & Modprobe Security Check: Linux Guide
Check loaded kernel modules, blacklists, and modprobe config with dargslan-modprobe-check CLI tool....
Linux Audit Log Analysis: Detecting Security Events with auditd
The Linux Audit Framework (auditd) is a powerful system for tracking security-relevant events on Linux servers. It recor...
Environment Variable Security: Protecting Secrets in Linux and DevOps
Environment variables are the standard way to pass configuration and credentials to applications, but they introduce sec...
File Integrity Monitoring on Linux: Hash-Based Change Detection Guide
File Integrity Monitoring (FIM) is a critical security control that detects unauthorized changes to system files, config...