secure-os wrote
Sep 6, 2026 in ssh, authentication, linux - The message says publickey, so people regenerate keys. That is almost never the problem. In descending order of frequency: the wrong key was offered, the file permissions are too open, the username is wrong, or the server does not allow that method. How to find out in one command.
Read more…secure-os wrote
Sep 5, 2026 in windows, privacy, telemetry - The settings that reduce Windows 11 telemetry are real, and the tools that promise to remove it entirely are mostly not. What Required diagnostic data covers, which switches change something measurable, and where the honest limit sits.
Read more…secure-os wrote
Sep 5, 2026 in linux, forensics, incident-response - Every checklist gives you the same commands. Almost none of them tell you that running those commands on the suspect machine is exactly what an attacker prepared for. Here is what to look at, in the order that still tells you something.
Read more…secure-os wrote
Sep 5, 2026 in linux, logging, auditd - journalctl, ausearch, aureport, last, lastb and auditctl cover almost everything you will ever need to ask a Linux system about its own past. What each one sees, what none of them see, and why a log on the machine is evidence of a different quality than a log shipped off it.
Read more…secure-os wrote
Sep 5, 2026 in usb, boot, linux - You can tell whether a stick will boot by reading its partition table, its boot flag and its EFI directory. Three commands on Linux, two on Windows, one on macOS. What each check proves, and the one it cannot.
Read more…secure-os wrote
Sep 5, 2026 in ssh, authentication, linux - A password is a secret you send. A key is a secret you never send. That one distinction settles most of the argument, decides what a compromised server can steal from you, and explains why key authentication is not simply a stronger password.
Read more…secure-os wrote
Sep 2, 2026 in linux, distros, hardening - Kicksecure is a security-hardened Debian derivative from the Whonix developers. What it hardens, how it differs from Whonix and Tails, who it is for, and its honest limits.
Read more…secure-os wrote
Aug 1, 2026 in ssh, fail2ban, hardening - Fail2ban bans IP addresses after repeated failed logins, which lowers the noise in your logs. The project itself states it cannot eliminate the risk of weak authentication, and names what to use instead.
Read more…secure-os wrote
Jul 31, 2026 in linux, hardening, systemd - systemd-analyze security scores services from 0 to 10, but the manual is explicit that a high score does not mean a service is vulnerable. What the tool measures, what it cannot see, and why settings must be combined.
Read more…secure-os wrote
Jul 16, 2026 in security, uefi, boot - A trusted signature is only as good as the code behind it, which is the whole reason the dbx revocation list exists. What Secure Boot protects in the boot chain, what it was never meant to stop, and the signed-but-vulnerable bootloader class that proved the difference.
Read more…secure-os wrote
Jul 14, 2026 in linux, distros, hardening - Immutable Linux distros keep the system read-only and update it as atomic image swaps you can roll back. What that means, the real security benefits, the honest trade-offs, and which distros to look at in 2026.
Read more…secure-os wrote
Jul 9, 2026 in linux, wayland, x11 - X11 lets any running app read your keystrokes and capture other windows. Wayland was designed to close that gap. What each does, the honest caveats (XWayland, portals), and why a security desktop should prefer Wayland.
Read more…secure-os wrote
Jun 26, 2026 in linux, antivirus, malware - Does Linux need antivirus? The honest answer, when it actually matters (servers, mail gateways, mixed Windows networks), the real tools - ClamAV, rkhunter, chkrootkit - and the layered defenses that protect a desktop better than a virus scanner.
Read more…secure-os wrote
Jun 25, 2026 in linux, sandboxing, firejail - A practical guide to Firejail, the SUID sandbox that confines Linux applications using namespaces and seccomp. Covers installation, profiles, common commands, real limitations, and how it compares to Flatpak and Bubblewrap.
Read more…secure-os wrote
Jun 24, 2026 in linux, hardening, apparmor - AppArmor vs SELinux compared by design, real-world maintenance and threat model. A practical guide to choosing the right Mandatory Access Control system for your Linux machine.
Read more…secure-os wrote
Jun 22, 2026 in linux, sandboxing, security - Linux sandboxing confines an application so that, if it is compromised, the damage stays contained. What sandboxing is, how Flatpak, Firejail, bubblewrap and containers do it, and how it fits a real defense-in-depth setup.
Read more…secure-os wrote
Jun 20, 2026 in linux, arch, aur - In June 2026 hundreds of Arch User Repository packages were hijacked to deploy an infostealer and an eBPF rootkit. What actually happened, why the AUR is structurally riskier than Arch's official repos, and a practical routine to vet AUR packages before you install them.
Read more…secure-os wrote
Jun 17, 2026 in linux, windows, security - Is Linux more secure than Windows in 2026? Linux has real structural advantages - permissions, smaller desktop attack surface, open-source auditability - but Windows has closed much of the gap. What actually makes the difference, honestly.
Read more…secure-os wrote
Jun 12, 2026 in linux, hardening, sysctl - A practical Linux hardening guide built around threat models, not checklists. Covers sysctl, AppArmor, SELinux, kernel parameters, and verified boot - with clear explanations of what each measure actually protects against.
Read more…secure-os wrote
Jun 12, 2026 in luks, encryption, linux - A complete guide to LUKS2 full-disk encryption on Linux - cryptsetup commands, header backup, TPM auto-unlock, performance benchmarks, and what to do when your header is lost.
Read more…secure-os wrote
Jun 12, 2026 in linux, distros, hardening - Choosing the most secure Linux distro depends on your threat model. This guide ranks 7 secure Linux distros by what they actually protect against.
Read more…secure-os wrote
Jun 12, 2026 in qubes, compartmentalization, linux - A technical deep-dive into Qubes OS - the compartmentalization-based desktop OS recommended by Snowden and used by security professionals worldwide.
Read more…