linux-security Archives - ITFROMZERO

Guide to Arkime (Moloch) on Linux: Capture, Index, and Analyze Full Packet Capture (FPC) Network Traffic

By IT From Zero October 29, 2026

Arkime (formerly Moloch) is a leading open-source Full Packet Capture (FPC) and indexing tool for Linux. Learn how to set up a monitoring cluster in 5 minutes, tune network interfaces, and use SPI search queries to hunt threats.

Security

Hands-on Guide to Linux Server Security Auditing and Hardening with Lynis

By IT From Zero October 29, 2026

A hands-on guide to auditing and hardening Linux server security with Lynis during a midnight incident. Learn installation, custom.prf tuning, fixing 3 common flaws, and setting up automated Telegram alerts.

Monitoring

How to Install and Configure Wazuh SIEM on Linux Server: Security Monitoring and Vulnerability Detection

By IT From Zero October 29, 2026

A hands-on guide to self-hosting Wazuh SIEM on Linux Server. Enable real-time File Integrity Monitoring (FIM), automate CVE vulnerability scanning, and block brute-force IPs with Active Response.

Docker

Installing and Configuring Rootless Docker: Run Docker Without Root to Protect Your Host

By IT From Zero October 26, 2026

Run the Docker daemon under an unprivileged user to neutralize privilege escalation risks from container escapes. A practical guide to setting up Rootless Docker, exposing ports 80/443, and managing resource limits.

Security

OpenSCAP Guide for Linux: Automated Scanning and CIS Benchmark Remediation

By IT From Zero October 25, 2026

A comprehensive guide to using OpenSCAP for scanning, generating reports, and automatically remediating Linux configurations against CIS Benchmarks safely without service disruptions.

Centos

Installing and Configuring AIDE on CentOS Stream 9: File Integrity Monitoring and Tamper Detection

By IT From Zero October 25, 2026

Compare File Integrity Monitoring solutions and learn how to install and configure AIDE on CentOS Stream 9, optimize disk I/O with ionice, and automate Telegram alerts.

Ubuntu

Installing and Configuring Auditd on Ubuntu Server: Tracing User Actions Down to the Kernel Level

By IT From Zero October 23, 2026

Server config tampered with but bash_history is empty? Learn how to configure Auditd on Ubuntu to trace all actions and unmask real user identities at the Linux kernel level.

Linux

Configuring auditd on Linux: Monitor Sensitive Files, Log User Commands, and Trace Intrusions

By IT From Zero October 21, 2026

A hands-on guide to configuring auditd on Linux: monitoring passwd/sudoers files, logging user commands by auid, tuning buffers to prevent disk overflow, and analyzing logs with ausearch.

Security

Configuring Port Knocking with Knockd on Linux: A Practical Guide to Stealth SSH

By IT From Zero October 20, 2026

Completely hide your SSH port from botnets and automated network scanners using Port Knocking. A step-by-step guide to configuring Knockd with Iptables and ~/.ssh/config on production Linux systems.

Security

How to Install and Configure Suricata IDS/IPS on Linux: Real-Time Network Traffic Monitoring and Intrusion Prevention

By IT From Zero October 19, 2026

A detailed comparison of passive IDS and inline IPS architectures for Suricata on Linux. Learn how to configure Suricata with NFQUEUE, tune rulesets, and test real-time threat prevention.