secure-os.org
All guidesQubes OSTailsWhonixHardened LinuxDisk encryptionThreat model
Two chain link gates held shut by a heavy chain and two padlocks, one brass and one dark grey, photographed close up with dry brown vegetation behind the mesh

secure-os wrote

SSH Permission denied (publickey): the Server Is Not Refusing Your Key, It Never Saw One

Sep 6, 2026 in ssh, authentication, linux - The message says publickey, so people regenerate keys. That is almost never the problem. In descending order of frequency: the wrong key was offered, the file permissions are too open, the username is wrong, or the server does not allow that method. How to find out in one command.

Read more…
📅 4 min read🛡️ Threat-model-first

secure-os wrote

Linux Audit Log Commands: the Six That Answer Real Questions

Sep 5, 2026 in linux, logging, auditd - journalctl, ausearch, aureport, last, lastb and auditctl cover almost everything you will ever need to ask a Linux system about its own past. What each one sees, what none of them see, and why a log on the machine is evidence of a different quality than a log shipped off it.

Read more…
📅 4 min read🛡️ Threat-model-first

secure-os wrote

Is a Double VPN Worth It? What the Second Hop Actually Buys

Sep 4, 2026 in vpn, anonymity, threat-model - A double VPN sends your traffic through two servers instead of one. What that genuinely protects against, what it costs in speed and latency, and the common cases where it changes nothing at all because the weak link is somewhere else entirely.

Read more…
📅 5 min read🛡️ Threat-model-first

Operating systems

Qubes, Tails & Whonix

Which secure OS fits which threat model - compartmentalisation vs amnesic vs Tor-routed.

Read the guides →

Encryption

Full disk encryption

LUKS, BitLocker, FileVault and VeraCrypt - what each protects, and what it does not.

Read the guide →

Hardening

Threat-model-first Linux

Practical hardening built around the adversary you actually face.

Read the guide →