Security
guest@6admin.io:~$ ls ~/tags/security
Cost was the only protection
What we judged low-risk often was not, it was merely expensive to reach. When automated agents bring that cost down, the protection disappears with it. Nothing new in the capability, everything is in the price and it is defense that has to draw the consequences.
augure and lictor: deciding an exploitation and accounting for it
Every exploitation framework knows how to launch a technique. None can tell you which one to launch, why and prove it. augure decides and accounts for it, lictor goes from the decision down to the bytes and executes and every move replays. Twenty years of reasoning, two tools, zero black box.
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
vim-plugin-manager: argument injection hidden in a .gitmodules
Sixteen months of hardening compressed into one story: a proven git argument injection hidden in .gitmodules branch names, a subprocess budget pinned in tests, detached plugins that stop lying as up-to-date and stale tag mirrors poisoning every update. The v1-to-v2.2.10 saga.
opencode-mesh: teaching my AI agents to knock before editing
An OpenCode plugin for multi-session coordination: mDNS discovery, operator-approved pairing with per-peer bearer tokens, mailboxes, file locks and headless workers spawned in native worktrees. The anti-chaos layer for running several agent sessions on one machine.
Jenkins on Windows Server: what not to do
A Jenkins controller on a domain-joined Windows host, the built-in node on the controller, the 8080 in the open, AD credentials in cleartext: the anatomy of a compromise chain and how to take it apart.
BrainForge: a distillation factory where AI experts argue
A distillation framework: transfer expert LLM knowledge into a small model, with lessons vetted by a trial (experts, devil's advocate, independent judge) and zero recitation.
Agentic AI in Production: an Audit Is Not a Pentest
Twenty-five years in the trade, no diploma, LLM agents in daily use: where they excel (audit), where they plateau (pentest), the Ollama trap that silently truncates context, fake greens, specification gaming and why certifications measure nothing.
No, you did not liberate your local model
The dialogue where your model declares itself freed changes nothing about its weights. It is a category error and it makes you miss the real attacks, which are mechanical and boring.
Ansible CI Toolkit v1: the year I stopped trusting my own image
The hardened sequel: ansible and ansible-lint merged into one image, Kerberos/WinRM for Windows targets, non-root, base pinned by digest, a pip constraints lock, transitive Galaxy pins and cosign signing. Built by a CHANGELOG that reads like a CVE diary.
The cloned hostgroup that refused to save
A cloned Foreman hostgroup throws a 500 on every edit. The trail leads to a field that gains a base64 layer with each clone and in passing to a Windows administrator password stored reversibly in the database and copied into the audit logs.
An IDS probe cannot see TLS
Suricata labs built on plain HTTP are excellent for teaching, but they hide a major blind spot once in production: encryption. A promiscuous probe sees TLS and can inspect nothing. Where to place inspection instead.
The boot chain, from GRUB to UKI
Why Canonical is trimming signed GRUB for 26.10, why GRUB-encrypted /boot was a false friend and what the modern answer to the Evil Maid attack actually looks like.
Trivy, the scanner that was stealing secrets
On March 19, 2026, the tool meant to protect the supply chain became its vector. The lesson fits in one sentence: a tag is not a trust reference.
A LLM's alignment is a thin layer
Two opposing techniques, one conclusion: an open model's safety does not live in its alignment, it lives in who holds the weights.
Containers, micro-VMs and Firecracker: why isolation is not what you think
Containers share the kernel. A container escape is a kernel escape. Firecracker micro-VMs bring hardware isolation at container speed. The chroot and the link are two different things.
fnox and age: encrypted secrets in my repos, no server
fnox, the secrets manager by the author of mise, encrypts secrets straight into the repo with age: a versioned fnox.toml, explicit keys, no secrets server to maintain. A late-2025 discovery.
Security Through Obscurity Is Not Security, Digital Hygiene Is
Twenty years of comments on port knocking, port 22 and photos of house keys: why obscurity alone is vain, why Kerckhoffs doesn't extend everywhere and why the real question is called digital hygiene.
Clean Code vs Vibe Coding (or how not to end up in the news)
Clean code versus vibe coding: DRY, SOLID, KISS, YAGNI against LLM code generation. And why TDD is the guard-rail vibe coding was waiting for.
Which identity runs the service and who can prove it
Windows service accounts: managed accounts, least privilege and traceability of what runs under which identity.
PowerShell execution policy and what it is not
PowerShell ExecutionPolicy: what it actually protects, what it does not and the known bypasses.
Hardening WinRM
WinRM hardening: transport, authentication and what to lock down before exposing Windows remote management.
Hardening Proxmox VE
Proxmox VE hardening: web interface access, network separation, clustering and the hypervisor's sshd.
Hardening Kubernetes
Hardening Kubernetes: RBAC, PodSecurity, NetworkPolicy, secrets and the attack surface of a loosely scoped cluster.
Hardening Docker Swarm
Hardening Docker Swarm: secrets, encrypted overlay network, node roles and the cluster's exposure surface.
Docker hardening
Docker hardening: the daemon, capabilities, mounts and why a container escape is a kernel escape.
Hardening DHCP
DHCP infrastructure hardening: snooping, controlled leases and defense against rogue servers.
SSH Security Hardening: Access Control and Monitoring
Hardening sshd without kidding yourself: no root, nominative accounts, keys only and the monitoring that makes actions accountable.
Hardening DNS infrastructure
DNS infrastructure hardening: views, zone-transfer limits, DNSSEC and resolvers that do not leak.
Internal vs external domain separation
Separating trust domains: compartmentalizing roles, accounts and networks to contain a compromise.
Egress filtering, the control everyone skips
Securing outbound traffic: egress filtering, allow-lists and spotting a service talking to something it should not.
Inbound traffic: expose less and guard what is left
Securing inbound traffic: firewall, minimal exposure, reverse proxy and clean TLS termination.
Network segmentation
Network segmentation and isolation: VLANs, zones, routing and the boundaries you do not cross without a reason.
Resource limits: stopping a machine from being talked into dying
Capping resources before a fork bomb or a leak takes the machine down: pam_limits, cgroups, systemd.
Filesystem hardening
Filesystem hardening: mount options, permissions, SUID, immutable attributes and partition separation.
Linux OS and kernel hardening
OS and kernel hardening: sysctl, signed modules, accounts, sshd and the settings that hold up in production.
Sudo and LOLBins
Why sudoers granularity is theater against GTFOBins and what actually limits escalation: sudoedit, NOEXEC, wrappers, isolation.
The Bastion and Guacamole: the two leaves of the front door
OVHcloud's The Bastion for shell people, Apache Guacamole for desktop people: two approaches to the same question, who may touch what and who looked at what.
The :ro flag on the Docker socket protects nothing
Mounting the Docker socket read-only is a reassuring and perfectly useless ritual. The flag acts at the VFS level, the socket speaks network I/O, the two never meet.
SSH in 2021: what thirteen years changed since the 2008 series
This blog's SSH series ended in 2013 with PKCS#8. Here is the 2021 version, complete and secure: Ed25519, FIDO2 keys, certificates, sshd hardening, Include and Match, ProxyJump and multiplexing. What 2008 did hopefully, 2021 does with primitives.
Counting CVEs tells you nothing about security
Why lining up CVE counts to declare one system safer than another is a biased argument. A thought experiment with two fictional operating systems and a reminder that most proprietary flaws are neither disclosed nor public.
Docker rootless: the daemon without privileges
Docker in rootless mode, the daemon running as a normal user and why it matters on a multi-tenant server.
Portknocking and SSH tunneling: the magic tricks before WireGuard
WireGuard ships in 2016 and makes two beloved 2008 setups outdated: portknocking (with automatic combination generation, mandatory NTP and an encfs USB key) and SSH tunneling. The era's tone, the in-production demo until 2018 at a hosting provider and why a VPN that says nothing wins.
SSH Hardening: the 2017 Trilogy Reread in 2026
In 2017 I answered a naive SSH hardening article in three comments: root, port, keys. Nine years later the principles hold, the context changed: bastions, native Windows, the client supply chain and the physical threat no config covers.
SSH: ProxyJump and modern multi-hop
ProxyJump, the -J option that arrived with OpenSSH 7.3, replaces the old ProxyCommand + nc for crossing one or more jump hosts. Shorter on the command line, cleaner in config and with no key left lying on the bastion.
SSH: hardening your keys with PKCS#8
Converting SSH RSA keys to PKCS#8 with hardened 3DES encryption, the last article of the original SSH series.
SSH: restricting a connection via private/public keys
The authorized_keys options to confine a passphrase-less SSH key to a single task.
SSH: multiple authentication with private/public keys
Using multiple SSH keys with distinct identities, one per server and avoiding Too many authentication failures.
Debsecan: Debian Security Analyzer
Debsecan, the tool that generates the list of vulnerabilities affecting a Debian installation, complementary to apt-listbugs.
Portknocking: automatic combination generation
Automatic portknocking sequence generation from the system date, with mandatory NTP and an encrypted USB key.
Fail2ban: fighting bruteforcing
Fail2ban, the bouncer that bans IPs trying to brute-force your services, by reading the logs.
Compiling a shell script with shc
Shc, the shell script compiler and why this is NOT encryption.
ArpON: watching your ARP cache
ArpON, the daemon that blocks ARP cache poisoning attempts where Arpwatch only reports them.
EncFS: file encryption without a dedicated partition
EncFS, the FUSE encryption that encrypts file by file without a partition, without LUKS, without reinstalling.
radare: a very complete debugger
Radare, the console-mode binary analysis framework and why you do not go back to GDB after.
Yersinia: how to make your network administrator sick
Yersinia, the layer 2 protocol attack framework and why your switch does not protect you the way you think.
tcpdump: frame analysis and BPF filters
Tcpdump to read the network byte by byte and BPF filters that turn a packet flood into a single question.
Nemesis: detecting a network sniffer
Detecting promiscuous-mode cards on your network, the defensive side of the packet forge.
Nemesis: network packet forge
Nemesis, the tool that forges any TCP/IP packet from the command line, without writing C.
Raw Sockets: forging and sniffing packets in C
The sockets memo, continued: AF_PACKET, SOCK_RAW, the iphdr and tcphdr structs, manual checksums, promiscuous-mode sniffing and SYN packet forging. What tcpdump and Nemesis do, written by hand, as root, with ethics and humor.
SSLH: ssh and https on the same port
A 2007 memo: sslh multiplexes ssh and https on port 443, the only port of paranoid firewalls. How it works, what it allowed and why (edit 2026) nobody would put it in production today.
PAM: limit system resources
PAM limits, the module that caps resources per user before the process eats all the RAM.
SSH: tunneling
SSH tunneling, making any protocol cross the encrypted channel.
MySQL: lost credentials
Regaining control of MySQL when the root password is lost, in three commands and one restart.
Apache: disabling the TRACE option
The HTTP TRACE method enables XST (Cross-Site Tracing) and one Apache line cuts it.
SSH: authentication via private/public keys
SSH keys, the password alternative that is also an authorization mechanism.
Links: hard links and symbolic links and what escapes the chroot
The two link types in Linux, their difference at the inode level and why a symlink inside a chroot can escape it.
Root or not root
Su, sudo and the question of who gets to do what on a shared system.