nft --check accepted the candidate ruleset reproduced for this article and left the active stateless ruleset hash unchanged. That was only the first result. After one real load, an HTTP probe to port 18192 returned 200, the same probe to port 18193 was rejected, and the intended ...
Which server will ssh app-prod actually contact? The answer is not necessarily the last Host block you remember editing. OpenSSH may combine command-line options, a per-user file, lexically ordered Include files, wildcard rules, a system file, and built-in defaults before it selects a hostname, user, port, identity, ...
Successful admission is the wrong place to stop an NGINX mutual TLS test. The useful proof is the three-outcome contract around that request: a client with no certificate is rejected, a client signed by the intended client CA reaches the upstream, and a certificate signed by another ...
visudo -c can return “parsed OK” for a rule that authorizes more than its reviewer intended. That is not a parser defect. Syntax validation answers whether sudo can read the policy; it does not prove that the allowed command, argument string, executable bytes, run-as identity and recovery ...
SMB signing can be supported on both endpoints and still not be required. That distinction matters because a policy screen that says “enabled” is not an enforcement receipt. For SMB 2.02 and later, a session is signed when either endpoint requires signing; it can remain unsigned only ...
An OK result from systemd-analyze security is not proof that a daemon is safe, and an EXPOSED result is not proof that it has a vulnerability. The command measures how much a service uses systemd's available isolation and privilege controls. It does not test the application's code, ...
dkim=fail (body hash did not verify) is not a generic instruction to replace a DNS record. It means the receiver canonicalized the delivered message body, calculated its hash, and did not get the value stored in the signature's bh= tag. A footer, link wrapper, MIME conversion, security ...
Changing an age recipient in SOPS is an access migration, not a one-command key swap. A safe rotation keeps the existing identity usable while the replacement is added, proves the replacement across every encrypted file, removes the retired recipient, rotates each file's data key after removal, and ...
Rotating WordPress security salts has one precise security effect: cookies and nonces created with the old secrets stop validating. That can end stolen or untrusted browser sessions after incident cleanup, a leaked wp-config.php, or an ownership handoff. It does not remove malware, reset account passwords, or automatically ...
AIDE can tell you that a Linux file changed, but it cannot tell you whether the change was malicious, approved, or already present when the baseline was created. The database is evidence only when it begins from a known-clean state, stays protected from the host it measures, ...