Hardening
guest@6admin.io:~$ ls ~/tags/hardening
Hardening WinRM
WinRM hardening: transport, authentication and what to lock down before exposing Windows remote management.
Hardening Proxmox VE
Proxmox VE hardening: web interface access, network separation, clustering and the hypervisor's sshd.
Hardening Kubernetes
Hardening Kubernetes: RBAC, PodSecurity, NetworkPolicy, secrets and the attack surface of a loosely scoped cluster.
Hardening Docker Swarm
Hardening Docker Swarm: secrets, encrypted overlay network, node roles and the cluster's exposure surface.
Docker hardening
Docker hardening: the daemon, capabilities, mounts and why a container escape is a kernel escape.
Hardening DHCP
DHCP infrastructure hardening: snooping, controlled leases and defense against rogue servers.
SSH Security Hardening: Access Control and Monitoring
Hardening sshd without kidding yourself: no root, nominative accounts, keys only and the monitoring that makes actions accountable.
Hardening DNS infrastructure
DNS infrastructure hardening: views, zone-transfer limits, DNSSEC and resolvers that do not leak.
Internal vs external domain separation
Separating trust domains: compartmentalizing roles, accounts and networks to contain a compromise.
Egress filtering, the control everyone skips
Securing outbound traffic: egress filtering, allow-lists and spotting a service talking to something it should not.
Inbound traffic: expose less and guard what is left
Securing inbound traffic: firewall, minimal exposure, reverse proxy and clean TLS termination.
Network segmentation
Network segmentation and isolation: VLANs, zones, routing and the boundaries you do not cross without a reason.
Resource limits: stopping a machine from being talked into dying
Capping resources before a fork bomb or a leak takes the machine down: pam_limits, cgroups, systemd.
Filesystem hardening
Filesystem hardening: mount options, permissions, SUID, immutable attributes and partition separation.
Recompiling your kernel: bespoke kernels for your own infra
The deepest form of hardening by subtraction: compile your own kernel, strip at build time the subsystems you never use, ship it as a .deb in your own repo with pinning and manage it at scale with Katello. The thrill and its price: a test pipeline on real hardware and canaries.
Linux OS and kernel hardening
OS and kernel hardening: sysctl, signed modules, accounts, sshd and the settings that hold up in production.
Sudo and LOLBins
Why sudoers granularity is theater against GTFOBins and what actually limits escalation: sudoedit, NOEXEC, wrappers, isolation.
SSH Hardening: the 2017 Trilogy Reread in 2026
In 2017 I answered a naive SSH hardening article in three comments: root, port, keys. Nine years later the principles hold, the context changed: bastions, native Windows, the client supply chain and the physical threat no config covers.