infrastructure
40 posts found
TCP Keepalive Does Not Keep Your Connection Alive
Linux defaults to a 2-hour keepalive time. Dead connections sit in your process table for hours before the kernel notices. Here is how to fix that and why appli…
Linux Systemd Sandboxing: Ten Security Directives for Production Daemons
Harden production Linux services using native systemd security directives including namespaces, seccomp syscall filters, and memory protection.
Why Read-Only Containers Do Not Stop Binary Execution
A read-only root filesystem prevents disk writes, but Linux kernels still permit staging and executing in-memory ELF binaries via memfd_create and unhardened tm…
Noise Handshakes for NAT Traversal: Rathole Multiplexing Architecture
An architectural look at how user-space Noise Protocol tunnels avoid TCP-over-TCP breakdown and solve CGNAT ingress bottlenecks.
How to Replace Static Authorized Keys with OpenSSH Cryptographic Certificates
Replace static authorized_keys with an OpenSSH Certificate Authority to issue time-limited certificates, eliminate known_hosts prompts, and enforce instant revo…
Your Localhost Server Is Listening on Every Interface
Running python http.server without --bind 127.0.0.1 opens every NIC to incoming connections. localhost in the URL bar does not equal loopback in the kernel.
Why SSH Agent Forwarding Exposes Infrastructure Across Jump Hosts
Using ForwardAgent yes exposes your SSH identity to compromised bastion hosts. Use ProxyJump and local signature confirmation to secure multi-hop SSH infrastruc…
SAML Key Rotation Failures: Certificate Fingerprints and Domain Matching
Key rotation in multi-tenant SAML SSO often breaks authentication due to split-brain domain routing and certificate fingerprint caching.
Hadolint vs Docker DX: Dockerfile Security Linting Compared
Compare Hadolint and Docker DX for Dockerfile security linting across rule depth, developer workflow, CI/CD integration, and custom policy enforcement.
Securing Inbound Webhooks: HMAC Verification and Replay Attack Defense
Inbound webhooks without cryptographic verification expose backend services to forgery, replay attacks, and resource exhaustion. Here is how to implement HMAC-S…