tag
42 posts
When forwarded SSH authentication fails, trace the socket, agent keys, server policy, and hop-by-hop configuration, then decide if forwarding is justified.
What enterprise endpoint protection can observe and enforce inside WSL, and why Linux package hygiene and least privilege still matter regardless.
How Windows interop, mounted drives, networking, and enterprise policy actually shape WSL's threat model, and why it isn't a sandbox for untrusted code.
Deploy Kubernetes NetworkPolicies with verified CNI enforcement, default-deny baselines, explicit DNS access, namespace labels, and negative tests.
How to design a FreeBSD service around Capsicum descriptor rights, capability mode, process descriptors, and delegated Casper services.
How to enable FreeBSD BSM auditing, select useful event classes, protect trail storage, rotate safely, filter records, and verify capture.
How to adapt a FreeBSD program for Capsicum by pre-opening resources, limiting descriptor rights, entering capability mode, and testing denial.
How FreeBSD seeds Fortuna, harvests entropy, serves random bytes, and exposes early-boot failures without making unsafe assumptions.
Understand Linux capability sets, exec transitions, file attributes, systemd and container boundaries, with a least-privilege audit workflow.
A service failing only with SELinux enforcing needs the actual denial read from audit.log and fixed with a targeted policy module, not disabled protection.
Building a working AppArmor profile from scratch with complain mode and the log-based profile generator, rather than guessing at rules upfront.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
The app usually isn't damaged — it's Gatekeeper's quarantine flag reacting to how it was downloaded, and there's a legitimate way to override it.
Turning on macOS's built-in SSH server correctly, then hardening it beyond the default configuration with key-based authentication and restricted access.
The T2, introduced in the 2017 iMac Pro and rolled out through 2018, took boot security, storage encryption, and other sensitive functions off the main CPU.
How Windows uses hardware virtualization to carve out a memory region even a compromised kernel can't touch, protecting credentials from pass-the-hash attacks.
How to retire deprecated Microsoft Defender Application Guard, choose supported browser or container isolation, and validate the replacement without losing controls.
Building a current App Control for Business policy from a reference system, deploying it in audit mode, reviewing evidence, and enforcing it in rings.
UAC was a genuine security improvement, but its constant, poorly-tuned confirmation prompts made it the most complained-about feature of Vista's launch.
Why Microsoft's April 8, 2014 cutoff for Windows XP updates became one of the most consequential OS end-of-life dates, given how many machines still ran it.
Integrate Kubernetes workloads with HashiCorp Vault using scoped authentication, safe initialization, agent injection, rotation, and audit controls.
A verifiable FreeBSD security-update workflow for pkg and base-system auditing, periodic delivery, patch-method detection, staged remediation, and evidence.
Configuring unattended-upgrades (Debian/Ubuntu) and dnf-automatic (RHEL/Fedora) to apply security patches automatically, with sane limits on scope.
Viewing saved passwords, storing new items securely, managing certificates, and understanding how iCloud Keychain syncs credentials across devices.
Disclosed September 24, 2014, Shellshock let attackers run arbitrary commands via a Bash environment-variable flaw, with botnets scanning for targets within hours.
How the 1988 Morris Worm spread through Unix systems, disrupted the young internet, drove CERT's creation, and led to a landmark US computer-crime conviction.
What happened on November 2, 1988, how the Morris Worm propagated, why it overloaded hosts, and how the incident changed internet security coordination.
How admission controllers intercept API requests before they're persisted, and how OPA/Gatekeeper turn that hook into cluster-wide policy enforcement.
How vulnerability scanners actually inspect container image layers, how to read a scan report, and the practices that reduce real supply-chain risk.
How multi-stage builds, distroless bases, secret-safe caching, non-root execution, and layer inspection produce smaller, auditable runtime images.
How FreeBSD jails isolate processes, filesystems, identities, networking, and resources without pretending a shared kernel is a VM.
A service won't start, logs are unhelpful, and file ownership looks correct — SELinux or AppArmor's invisible permission layer is usually why.
A complete walkthrough encrypting a disk or partition with LUKS, from initial setup through mounting it automatically (with a key file) at boot.
A complete walkthrough generating an SSH key pair, deploying it correctly, and disabling password authentication safely — without locking yourself out.
Compare SELinux label policy and AppArmor profiles through enforcement, logging, safe policy changes, containers and a denial-first audit workflow.
How macOS verifies that an application hasn't been tampered with and hasn't been flagged as malware, before it's ever allowed to launch.
A complete walkthrough enabling FileVault, understanding your recovery key options, and what to do if you're locked out — before you need it, not after.
Released September 30, 2015, OS X 10.11 shipped with SIP enabled by default — restricting even the root user from modifying protected system files.
What SIP protects, how it's enforced below the level of the root user, and the legitimate reasons to disable it temporarily.
How discretionary ACLs, mandatory integrity levels, and UAC's token-splitting combine to form Windows' layered access control model.
A complete BitLocker setup covering TPM requirements, the recovery key you must save externally, and how to verify encryption actually completed.
Enabling Remote Desktop the right way — Network Level Authentication, a non-default port, and firewall scoping — rather than exposing RDP openly.