Three Types of Remote Access Software Explained
Three types of remote access solve different problems. Pick relay-based tools for one-offs, peer-to-peer for speed, or RMM platforms for fleet management.
Tag: Linux security
Five Controls for Secure Linux App Deployment
Master the five load-bearing controls that stop most attacks: non-root user, key-only SSH, default-deny firewall, reverse proxy, and scheduled patching.
Protect Linux from DDoS with eBPF
I build small, safe kernel programs that stop high-rate packet floods at the NIC driver level so the system stays responsive under stress. XDP runs before the Linux networking stack, letting an ebpf program parse headers, count packets per source IP, and drop bursts with minimal latency. My approach uses a BPF hash map keyed […]
XDP Firewall on OpenWRT: Early Packet Drop at Line Rate
XDP intercepts packets in the driver before the kernel allocates buffers, enabling high-volume DDoS mitigation and load balancing with minimal CPU cost.
Create eBPF IDS on Linux
I will walk you through a working eBPF IDS Linux setup that hooks kernel events, streams signals to user space, and keeps performance predictable. I start from how the verifier and JIT work in the linux kernel so you can pick the right attach points. I explain kprobes, tracepoints, uprobes, XDP, and LSM in plain […]
CVE-2013-6282 Fix: ARM Kernel Bounds Check Patch
CVE-2013-6282 has been patched in upstream kernels for over a decade. Learn why scanners still flag it and how to confirm your system is actually fixed.
Detect Port Scans with eBPF
The eBPF port scanning detection approach shows how kernel-level programs can answer TCP SYNs without leaving the fast path. I guide you through a compact XDP example that reads Ethernet, IPv4, and TCP headers in the kernel. You will see how a simple program spots a SYN and replies with a SYN-ACK to emulate an […]
Detect Shell with eBPF
I use eBPF shell detection to catch stealthy programs that land inside the kernel and then hide from normal tools. You will see why watching load-time events matters more than chasing artifacts later. The kernel grants deep visibility into system activity, but that same access gives attackers a way to hide a reverse shell or […]
Operationalizing Falco: eBPF Driver Setup and Alert Routing
Falco requires modern eBPF drivers, DaemonSet deployment, rule tuning, and Falcosidekick integration to catch runtime threats in production clusters.