Linux

The recent articles cover the primitives an attacker and a defender both work with: authentication, permissions, ACLs and file attributes, namespaces and isolation, SECCOMP filtering and the Linux Security Modules on top of it.

Older French articles cover day-to-day administration: SSH access, hard and symbolic links, backups, and intrusion testing against a running service.

14 posts

How Fail2Ban Works — Architecture, Privilege Model and Residual Risk

Fail2Ban reads logs and rewrites the firewall as root. Its jail architecture, the tag-escaping pipeline, and why a filter regex is a security boundary.

2026, Sep 03 —

OpenSSH Detached Signatures — sshsig, Namespaces and ssh-keygen -Y

How sshsig signs arbitrary files with an SSH key, why the namespace field prevents cross-protocol replay, and how allowed_signers controls verification.

2026, Aug 27 —

SFTP Request Pipelining in OpenSSH — Window Ramping, Negotiated Limits and scp

How the OpenSSH SFTP client keeps requests in flight, ramps its window from one to sixty-four, negotiates buffer sizes with the server and backs scp.

2026, Aug 27 —

OpenSSH Connection Multiplexing — ControlMaster, the Mux Protocol and Proxy Mode

How ControlMaster works in OpenSSH, the mux protocol spoken over the ControlPath socket, and the difference between passenger mode and proxy mode.

2026, Aug 27 —

The OpenSSH Channel Layer — One Abstraction Behind Forwarding, X11, Agent Access and Tunnels

How channels.c implements port forwarding, X11, SOCKS proxying, agent access and tunnels as one abstraction, with per-channel windows and half-close.

2026, Aug 27 —

OpenSSH Certificates — Critical Options, Extensions and the KRL Encoding

How an OpenSSH certificate is validated, why unknown critical options are fatal while unknown extensions are ignored, and how KRL revocation lists compress.

2026, Aug 27 —

Linux Isolation Primitives - Defense in Depth Beyond the Castle Model

A technical survey of Linux isolation primitives (mount options, chroot, netfilter, cgroups, namespaces) and how they compose into containers, hypervisors, and Qubes OS as defense in depth.

2026, Jun 29 —

GNU/Linux Base Security Primitives - Authentication, Permissions, ACLs, Attributes, Capabilities

A technical walkthrough of the base GNU/Linux security primitives - login and authentication, POSIX file permissions, ACLs, extended attributes, and capabilities - with their adversary models and trade-offs.

2026, Jun 29 —

GNU/Linux from the Adversary's Side - Buffer Overflows, the Boot Chain, and a Real Attack

Testing GNU/Linux security by bypassing its primitives - stack buffer overflows and their mitigations, the boot chain under a physical adversary, and a remote attack from web exploit to root.

2026, Jun 29 —

Advanced GNU/Linux Security - SECCOMP and Linux Security Modules (LSM)

How SECCOMP filters system calls and how Linux Security Modules (SELinux, AppArmor, and others) add mandatory access control on top of the base UNIX permission model.

2026, Jun 29 —

Réaliser un backup sous Linux

Cet article présente la réalisation d'un backup "fait maison" sous le système d'exploitation Ubuntu 18.04 LTS

2021, Nov 05 —

Test d'intrusion sur un serveur Apache Tomcat

cet article présente un test d'intrusion sur une ancien version d'un serveur apache tomcat afin de sensibiliser le lecteur aux différentes vulnérabilités possibles pour qu'il s'en prémunisse.

2021, Oct 19 —