Security on srdusr

Hardening a Small Server Without Making It Unusable

Thu, 03 Sep 2026 00:00:00 +0000

A single virtual machine running a couple of small sites does not need a security programme. It needs about a dozen specific changes, most of which take a minute each.

Two of them look finished when they are not, and those two are worth more attention than the rest combined. They are at the end.

Start with the front door

Key-only SSH, no root login, and a firewall that rejects by default.

Recon Is a Loop, Not a Pass

Fri, 21 Aug 2026 00:00:00 +0000

Enumeration is the phase that decides the engagement. More boxes fall to thorough enumeration than to clever exploitation, and the rule on a stuck target is almost always “enumerate harder”, not “find a better exploit”.

The mistake that costs the most time is treating recon as a pass: scan, read the output, move to exploitation. It is a loop. Each finding sends you back to enumerate something new, and the surface grows as you work.

Defending Yourself With What You Know About Attackers

Fri, 24 Jul 2026 00:00:00 +0000

The attacks I read about for work are not reserved for interesting targets. The same credential stuffing, the same phishing, the same stolen device: they arrive at ordinary people every day, and knowing how they work is only an advantage if you turn it around and point it at your own life.

A stolen laptop is what made me start writing any of this down. What follows is what I actually do, in the order the effort pays back.

Turning a Dumb Shell Into a Real TTY

Tue, 09 Jun 2026 00:00:00 +0000

A raw reverse shell from a web exploit is a dumb shell. No tab completion, no arrow keys, no job control. It dies if you press Ctrl-C, and it cannot run an interactive program like su, ssh, or a text editor. Upgrade it to a full TTY before you do real work in it, because every minute spent in a dumb shell is a minute of typing full paths and losing the session to a stray keystroke.

Encryption Gives Confidentiality, Not Integrity

Fri, 27 Feb 2026 00:00:00 +0000

Encrypting data hides it. It does not prove the data was not changed. These are two different properties, and assuming the first provides the second is the root of a whole class of real vulnerabilities.

Why it holds

A cipher maps plaintext to ciphertext so an eavesdropper cannot read it. Nothing in that mapping detects tampering with the ciphertext. In CBC mode an attacker can flip bits and, given feedback on whether the result decrypts to valid padding, recover and forge plaintext without the key. That is the padding oracle attack, and it exists precisely because the system checked confidentiality but never integrity.

Counting Your Shell History Can Execute It

Mon, 19 Jan 2026 00:00:00 +0000

A “top ten commands” script is about the most harmless thing you can write. In zsh, one common way to write it executes your history instead of counting it.

The problem

You want a count of your most-used commands. The obvious tool is an associative array keyed by the command line:

typeset -A counts
while read -r cmd; do
 (( counts[$cmd]++ ))
done < <(fc -ln 1)

This runs every history entry that contains a command substitution.

Thorough Enumeration Beats Clever Exploitation

Tue, 02 Dec 2025 00:00:00 +0000

More machines fall to finding the thing that was already there than to a clever exploit. When a box is stuck, the fix is almost always to enumerate harder, not to reach for a more advanced technique. The winning path was usually visible at hour one and dismissed.

Why it holds

An exploit needs a target, and finding the target is enumeration. A service on a high port, a virtual host that only answers to its name, a comment in the page source, a readable share: each is a foothold that no exploit skill substitutes for. Enumeration also compounds. Every credential and hostname found sends you back to enumerate something new, so the surface grows as you work.

Vulnerabilities Cluster at Trust Boundaries

Fri, 14 Nov 2025 00:00:00 +0000

A trust boundary is any point where data crosses from a less-trusted context into a more-trusted one: user input into a query, a request into a privileged process, one tenant’s data into another’s view. Almost every vulnerability class is a failure to re-establish trust at such a crossing.

Why it holds

Injection is untrusted input crossing into an interpreter without being made safe for it: SQL injection into a database, command injection into a shell, template injection into a template engine, cross-site scripting into another user’s browser. Authorisation bugs are a principal crossing into data it should not reach. Even privilege escalation, whether through a SUID binary or a potato attack, is a low-trust process crossing into a high-trust one. Naming the boundary tells you what defence is missing: encode for the destination context, or check the right to cross.