DEV Community: Marek „Netbe” Lampart

AI-Powered Linux Security: How AI Is Changing the Role of System Administrators

Marek „Netbe” Lampart — Thu, 30 Jul 2026 09:42:51 +0000

Linux administrators have always worked at the intersection of reliability, performance and security.

Managing modern infrastructure means dealing with thousands of events every day:

authentication attempts,
system logs,
application failures,
network activity,
vulnerability reports.

The challenge is no longer only collecting security data.

The challenge is understanding it quickly enough to respond.

This is where Artificial Intelligence is starting to change Linux security operations.

Linux Security Is Becoming More Complex

Traditional security practices are still essential:

firewall configuration,
access control,
system updates,
vulnerability scanning,
monitoring.

However, modern attacks increasingly rely on:

stolen credentials,
automation,
social engineering,
persistent access techniques.

Security teams need tools that can analyze large amounts of information and highlight what actually matters.

How AI Can Support Linux Security

1. Intelligent Log Analysis

Linux systems generate huge volumes of logs.

AI can help administrators identify:

unusual authentication patterns,
suspicious processes,
abnormal system behavior,
unexpected configuration changes.

Instead of manually searching thousands of log entries, administrators can use AI-assisted analysis to find important security events faster.

2. AI-Assisted System Hardening

Linux hardening requires reviewing many configuration areas:

SSH settings,
user permissions,
firewall rules,
running services,
kernel parameters.

AI can assist by identifying potential weaknesses and suggesting improvements.

The administrator still makes the final decision, but security reviews become faster.

3. Faster Incident Response

During a security incident, speed matters.

AI can assist with:

summarizing alerts,
correlating events,
analyzing suspicious activity,
suggesting investigation steps.

This creates a new workflow:

Human expertise + automation + AI assistance.

AI Does Not Replace Linux Administrators

There is a common misconception that AI will replace system administrators.

In reality, the most valuable administrators will be those who combine:

Linux knowledge,
cybersecurity skills,
automation,
AI tools.

AI can process information quickly, but understanding infrastructure and making security decisions still requires human experience.

New Risks of AI Security Tools

AI-powered security also creates new challenges:

sensitive data exposure,
incorrect recommendations,
over-reliance on automation,
security of AI systems themselves.

AI should be treated as another security tool that requires proper implementation.

The Future of Linux Security

Linux remains one of the most important platforms in modern infrastructure.

As environments become more complex, AI will likely become a standard assistant for administrators, helping them detect threats, automate repetitive tasks and improve security visibility.

I recently created a more detailed technical guide covering AI-powered Linux security, including threat detection, hardening, vulnerability management and security automation.

Full guide:

AI-Powered Linux Security: A Practical Guide for System Administrators

Part of the Netbe Linux Security Guide series.

AI-Powered Cybersecurity: How AI Is Changing Linux Security Administration

Marek „Netbe” Lampart — Tue, 28 Jul 2026 16:24:35 +0000

Artificial intelligence is changing many areas of technology, and cybersecurity is one of the fields experiencing the biggest transformation.

For decades, Linux administrators have relied on traditional security tools: firewalls, log analysis, intrusion detection systems, vulnerability scanners, and manual system audits.

Today, AI is adding a new layer of intelligence to these processes.

AI-powered security tools can analyze large amounts of system data, detect unusual behavior, automate repetitive tasks, and help administrators respond faster to potential threats.

Linux remains one of the most important platforms in cybersecurity, and combining Linux administration with artificial intelligence creates new possibilities for protecting modern infrastructure.

Why Linux Is Important in Cybersecurity

Linux powers a large part of today's digital infrastructure:

cloud servers,
Kubernetes clusters,
web applications,
security appliances,
development environments.

Security professionals use Linux because it provides:

powerful command-line tools,
detailed system control,
advanced networking capabilities,
flexible automation.

However, securing Linux environments requires continuous monitoring and analysis.

Modern infrastructure generates huge amounts of data:

authentication logs,
firewall events,
system activity,
application logs,
network traffic.

Manually analyzing all this information is becoming increasingly difficult.

This is where AI can help.

AI for Linux Log Analysis

One of the most practical applications of AI in Linux security is log analysis.

Traditional monitoring systems often rely on predefined rules:

failed SSH login attempts,
unusual ports,
suspicious processes,
privilege escalation attempts.

AI can analyze patterns instead of only looking for known signatures.

For example, AI can help identify:

unusual login locations,
abnormal user behavior,
unexpected system changes,
suspicious command execution.

Instead of asking:

"Did this exact attack happen before?"

AI can help answer:

"Does this activity look unusual compared to normal system behavior?"

AI-Assisted Threat Detection

Linux systems produce many security signals every day.

Examples:

repeated authentication failures,
unexpected root access,
modified system files,
new user accounts,
unusual network connections.

AI models can help correlate these events.

A single failed login may not be important.

However:

hundreds of failed SSH attempts,
followed by successful authentication,
followed by privilege escalation,

creates a much more suspicious pattern.

AI can help security teams identify these relationships faster.

Automating Linux Security Audits

Linux administrators regularly perform security checks:

checking open ports,
reviewing users,
verifying permissions,
checking updates,
analyzing firewall configuration.

AI can assist by automating parts of these processes.

Examples:

User and Permission Analysis

AI can help identify:

unnecessary privileged accounts,
excessive sudo permissions,
suspicious ownership changes.

Configuration Review

AI can analyze:

SSH configuration,
firewall rules,
system services,
security policies.

Vulnerability Assessment

AI can help prioritize vulnerabilities by considering:

severity,
system exposure,
possible impact.

The goal is not replacing administrators, but reducing repetitive work.

AI and Linux Command Assistance

Linux administration often requires remembering complex commands and configurations.

AI assistants can help administrators:

understand commands,
explain system behavior,
generate scripts,
troubleshoot errors.

For example:

A junior administrator can ask:

"Why is this SSH configuration insecure?"

or:

"Explain this firewall rule."

AI can provide explanations and suggest improvements.

However, every recommendation still requires verification.

Running unknown commands generated by AI on production servers is dangerous.

AI-Powered Security Automation With Scripts

Automation is already a key part of Linux administration.

Combining scripts with AI can create more intelligent security workflows.

Examples:

automated security reports,
suspicious activity detection,
compliance checks,
system health monitoring.

A traditional script may say:

"SSH root login is enabled."

An AI-enhanced system could provide:

"SSH root login is enabled. This increases the risk of brute-force attacks. Recommended action: disable root login and use key-based authentication."

The difference is context.

The Risks of Using AI in Security Administration

AI can improve cybersecurity, but it also introduces new risks.

Incorrect Recommendations

AI models can generate inaccurate answers.

A wrong firewall rule or insecure configuration suggestion can create new vulnerabilities.

Data Privacy Issues

Sending sensitive information to external AI services may expose:

server configurations,
logs,
internal architecture details.

Organizations must carefully control what data is shared.

Attackers Also Use AI

Cybercriminals are using AI to:

automate phishing,
generate malware,
discover vulnerabilities,
improve social engineering attacks.

Security professionals must assume that attackers have access to similar technologies.

The Future of Linux Security Administration

The future Linux administrator will likely work together with AI systems.

The role will shift from manually checking every event to:

designing security automation,
validating AI recommendations,
improving detection systems,
managing secure infrastructure.

AI will not replace Linux administrators.

Instead, administrators who understand both Linux and AI will have a significant advantage.

Final Thoughts

AI is becoming an important part of modern cybersecurity.

For Linux administrators, artificial intelligence offers new ways to analyze threats, automate security tasks, and improve system protection.

However, AI should be treated as an assistant, not an autonomous security solution.

The strongest approach combines:

Linux expertise,
cybersecurity knowledge,
automation,
artificial intelligence.

The future of Linux security will belong to professionals who can combine human judgment with AI-powered tools.

Linux Hardening: Building a Secure Server from the Kernel to the Application Layer

Marek „Netbe” Lampart — Thu, 23 Jul 2026 17:55:36 +0000

Practical security checklist for production Linux environments

Linux is everywhere.

It powers:

cloud infrastructure,
web servers,
Kubernetes nodes,
databases,
network appliances,
security platforms.

Many administrators believe that Linux is secure by default.

The reality is different.

Linux provides powerful security mechanisms, but they must be correctly configured.

A fresh installation is only the beginning.

A production server should go through a hardening process:

Fresh Linux Installation

        ↓

System Updates

        ↓

Kernel Security

        ↓

User Management

        ↓

Network Protection

        ↓

Service Hardening

        ↓

Monitoring

        ↓

Continuous Auditing

What is Linux Hardening?

Linux hardening is the process of reducing the attack surface of a Linux system.

The goal is simple:

Allow only required functionality and block everything unnecessary.

A hardened server should follow:

Principle of Least Privilege

Every user, process and service receives only the permissions it needs.

Example:

Bad:

Web Application

↓

root privileges

↓

Entire system access

Better:

Web Application

↓

Dedicated user

↓

Limited permissions

1. Keep the System Updated

The first security layer is patch management.

Check available updates:

Debian/Ubuntu:

apt update

apt upgrade

RHEL/Fedora:

dnf update

For production environments:

Do not update randomly.

Use:

Testing

↓

Staging

↓

Production

A security update should improve protection without breaking applications.

2. Remove Unnecessary Services

Every running service is a potential entry point.

Check running services:

systemctl list-units --type=service

Example:

A server hosting a website probably does not need:

Bluetooth

Printing service

Avahi discovery

Unused databases

Disable unnecessary services:

systemctl disable service_name

systemctl stop service_name

Security rule:

If a service is not required, remove it.

3. Secure SSH Access

SSH is one of the most attacked services on Linux servers.

Basic hardening:

Edit:

/etc/ssh/sshd_config

Disable root login:

PermitRootLogin no

Disable password authentication:

PasswordAuthentication no

Use keys:

Public Key Authentication

Example:

ssh-keygen -t ed25519

Modern SSH authentication should look like:

User

↓

SSH Key

↓

Server Verification

↓

Access Granted

4. Protect SSH Against Brute Force

Install:

fail2ban

Example:

apt install fail2ban

Architecture:

Failed Login Attempts

        ↓

Fail2ban

        ↓

Firewall Rule

        ↓

IP Block

However, blocking attackers is only one layer.

The better approach:

disable passwords,
use MFA,
restrict access by firewall.

5. Configure Firewall Rules

A server should not expose unnecessary ports.

Check listening services:

ss -tulpn

Example output:

22/tcp    SSH

80/tcp    HTTP

443/tcp   HTTPS

Everything else should be reviewed.

Example using nftables:

nft list ruleset

Security model:

Internet

↓

Firewall

↓

Allowed Services Only

↓

Application

6. Use Mandatory Access Control

Traditional permissions:

User

↓

Group

↓

File permissions

are not always enough.

Linux provides:

SELinux

Common in:

Red Hat Enterprise Linux,
CentOS,
Fedora.

Example:

getenforce

AppArmor

Common in:

Ubuntu,
Debian.

Check profiles:

aa-status

These systems answer:

What is a process allowed to do, even if it is compromised?

7. Kernel Hardening

The Linux kernel is the foundation.

Check kernel version:

uname -r

Important mechanisms:

Kernel parameters

Example:

/etc/sysctl.conf

Disable IP forwarding:

net.ipv4.ip_forward=0

Protect against SYN attacks:

net.ipv4.tcp_syncookies=1

Apply:

sysctl -p

8. Secure User Accounts

Review users:

cat /etc/passwd

Find accounts with shells:

cat /etc/passwd | grep bash

Remove unused accounts:

userdel username

Check sudo privileges:

cat /etc/sudoers

Avoid:

ALL=(ALL) ALL

for unnecessary users.

9. Filesystem Security

Important directories:

/etc

/bin

/usr

/var

/home

Check permissions:

ls -la

Sensitive files:

/etc/shadow

should be:

-rw-r-----

not:

-rw-rw-rw-

10. Use Secure Mount Options

Example:

Temporary filesystem:

/tmp

can use:

nodev

nosuid

noexec

Meaning:

nodev

No device files.

nosuid

Ignore SUID bits.

noexec

Prevent execution.

Example:

/dev/sdb1 /tmp ext4 defaults,nodev,nosuid,noexec

11. Audit System Activity

Security without visibility is impossible.

Linux provides:

auditd

Install:

apt install auditd

Check status:

systemctl status auditd

Example events:

User login

↓

File modification

↓

Privilege change

↓

Audit record

12. Centralize Logs

System logs are critical.

Modern Linux uses:

systemd-journald

Check logs:

journalctl

Examples:

SSH logs:

journalctl -u ssh

Kernel messages:

journalctl -k

Production environments usually forward logs to:

SIEM,
Elasticsearch,
Graylog,
Splunk.

13. Container Security on Linux Hosts

Modern Linux servers often run containers.

Docker security should include:

Rootless containers

Instead of:

root

↓

Docker daemon

↓

Container

Use:

User

↓

Rootless Docker

↓

Container

Seccomp

Limit system calls:

Allowed:

read()

write()

open()


Blocked:

mount()

ptrace()

cgroups v2

Control:

CPU,
RAM,
processes.

Example:

Container

↓

Memory limit

↓

Host protection

14. Backup and Recovery

Security is incomplete without recovery.

A ransomware attack changes the question:

Not:

Can we prevent every attack?

But:

How quickly can we recover?

Backup strategy:

Production

↓

Backup

↓

Offline Copy

↓

Recovery Test

15. Automated Security Auditing

Manual checks are not enough.

Useful tools:

Lynis

Linux security auditing:

lynis audit system

OpenSCAP

Compliance scanning:

CIS Benchmarks,
security policies.

Docker Bench Security

Container security auditing.

Linux Hardening Checklist

System

✅ Updates enabled
✅ Unused packages removed
✅ Services reviewed
✅ Time synchronization configured

Authentication

✅ SSH keys
✅ Root login disabled
✅ MFA where possible
✅ Password policies

Network

✅ Firewall enabled
✅ Minimal open ports
✅ Network monitoring

Kernel

✅ sysctl hardening
✅ Secure parameters
✅ Updated kernel

Filesystem

✅ Correct permissions
✅ Secure mounts
✅ Encryption where required

Monitoring

✅ auditd
✅ journald
✅ Central logging
✅ Alerts

Final Thoughts

Linux is not secure because it is Linux.

Linux is secure because it provides the tools required to build a secure system.

The difference between a normal Linux server and a production security-grade server is configuration.

A mature security approach combines:

Linux Hardening

+

Firewall

+

SELinux/AppArmor

+

Audit Logging

+

Container Security

+

Monitoring

+

Regular Testing

Security is not a single command.

It is a continuous process of reducing risk, monitoring changes and improving the system over time.

Tags:

#Linux
#CyberSecurity
#DevSecOps
#LinuxSecurity
#SystemAdministration
#Hardening
#InfrastructureSecurity
#CloudSecurity

Building an AI Linux Security Assistant: From SSH Logs to Automated Threat Detection

Marek „Netbe” Lampart — Thu, 16 Jul 2026 12:12:16 +0000

Building an AI Linux Security Assistant: From SSH Logs to Automated Threat Detection

Linux powers a huge part of today's infrastructure.

Web servers, cloud environments, containers, enterprise systems and development platforms often rely on Linux because of its flexibility, stability and security capabilities.

However, securing Linux systems requires visibility.

Administrators need to answer important questions:

Who is accessing the server?
Are there brute-force attacks?
Which IP addresses are suspicious?
Are security configurations correct?
What actions should be taken after detecting a threat?

Manual analysis works well for a small number of systems.

It becomes much harder when you manage multiple servers and thousands of security events.

This is why I started building AI Linux Security Assistant — an open-source project designed to help Linux administrators analyze security events and understand potential threats faster.

GitHub repository:

https://github.com/cyberbezpieczenstwo

Project Goals

The first version focuses on a simple but important security problem:

Analyzing Linux SSH authentication logs.

SSH is one of the most important services in Linux environments.

It is also one of the most common attack targets.

Attackers frequently use:

brute-force attacks
password spraying
stolen credentials
automated scanning tools

The goal of the project is to transform raw Linux logs into understandable security information.

Version 0.1 Features

The first release includes:

✅ Python-based CLI application
✅ SSH authentication log parser
✅ Failed login detection
✅ Successful login tracking
✅ Suspicious IP identification
✅ Markdown security reports

The current workflow:

Linux auth.log

        |
        v

SSH Log Parser

        |
        v

Security Analyzer

        |
        v

Security Report

Example: Detecting SSH Brute Force Attempts

A typical Linux authentication log may contain entries like:

Failed password for invalid user admin
from 192.168.1.50 port 52221 ssh2

The analyzer extracts important information:

Source IP:
192.168.1.50

Event:
Failed SSH authentication

Risk:
Medium

Instead of manually searching through log files, administrators receive a structured security report.

Why SSH Logs Matter

SSH is often exposed directly to the internet.

A poorly configured SSH service can become an entry point for attackers.

Common security issues include:

allowing root login
using password authentication only
weak passwords
outdated SSH configurations
missing brute-force protection

Security monitoring should start with understanding what is happening on the system.

From Logs to Security Recommendations

Raw logs are useful, but they are not always easy to interpret.

Example:

sshd: Failed password

A security assistant can transform this into:

Possible SSH brute-force attack detected.

Recommended actions:

1. Disable SSH root login
2. Use SSH keys instead of passwords
3. Enable Fail2Ban
4. Review exposed services
5. Check authentication history

The goal is not only detection.

The goal is helping administrators make better security decisions.

Why Add AI?

Traditional security tools are excellent at collecting data.

The challenge is understanding that data.

Modern systems generate huge amounts of information:

authentication logs
firewall events
application logs
vulnerability reports
container events

AI can help summarize technical information and provide context.

Future versions of this project will explore:

AI-powered explanations
security recommendations
MITRE ATT&CK mapping
local LLM integration
automated incident summaries

Security Automation Is the Future

Modern cybersecurity already depends heavily on automation.

Security teams use:

SIEM platforms
vulnerability scanners
configuration management tools
detection rules
automated response systems

AI assistants are another step in this evolution.

They can help engineers analyze incidents faster while keeping humans responsible for final decisions.

Roadmap

Version 0.1

Current release:

✅ Project structure
✅ SSH log analysis
✅ Authentication event detection
✅ Markdown reports

Version 0.2

Planned:

Linux user auditing
sudo permission analysis
password policy checks
inactive account detection

Version 0.3

Planned:

firewall analysis
open port detection
service security checks
Docker security module

Version 1.0

Future:

AI assistant integration
local LLM support
advanced threat explanations
security dashboard

Open Source Security Project

AI Linux Security Assistant is an ongoing open-source project focused on Linux security automation.

The goal is simple:

Make Linux security analysis easier, faster and more understandable.

Security should not only identify problems.

It should help people fix them.

Author

Marek "Netbe" Lampart

Cybersecurity Engineer focused on:

Linux security
network security
infrastructure hardening
cybersecurity automation

Hardening SSH Server on Linux: A Practical Security Guide

Marek „Netbe” Lampart — Mon, 13 Jul 2026 15:44:56 +0000

SSH is one of the most important services in Linux administration.

It allows administrators to remotely manage servers, deploy applications, troubleshoot systems, and maintain cloud infrastructure.

However, exposing SSH directly to the internet also makes it a common target for:

brute-force attacks,
password spraying,
automated scanners,
stolen credentials,
unauthorized access attempts.

A default SSH installation is functional, but it is not always secure.

This guide shows practical steps to harden an OpenSSH server.

1. Update Your Linux Server First

Before changing SSH configuration, make sure your system is updated.

Debian / Ubuntu:

sudo apt update
sudo apt upgrade

Check your OpenSSH version:

ssh -V

Running outdated software increases the risk of known vulnerabilities.

2. Create a Dedicated Administrator Account

Avoid using root directly.

Create a new user:

sudo adduser admin

Add administrator privileges:

sudo usermod -aG sudo admin

Now connect using:

ssh admin@server-ip

and use:

sudo

for administrative tasks.

3. Disable Root Login

Open SSH configuration:

sudo nano /etc/ssh/sshd_config

Find:

PermitRootLogin yes

Change:

PermitRootLogin no

Restart SSH:

sudo systemctl restart ssh

Now attackers cannot attempt direct root authentication.

4. Use SSH Keys Instead of Passwords

Passwords are vulnerable to brute-force attacks.

Generate an SSH key:

ssh-keygen -t ed25519

Copy it to the server:

ssh-copy-id admin@server-ip

Test login:

ssh admin@server-ip

After successful authentication disable passwords:

PasswordAuthentication no

Restart SSH:

sudo systemctl restart ssh

Your server now accepts cryptographic authentication.

5. Change the Default SSH Port

The default SSH port is:

Changing it does not replace security controls, but it reduces automated scanning.

Edit:

sudo nano /etc/ssh/sshd_config

Example:

Port 2222

Update firewall:

sudo ufw allow 2222/tcp

Restart:

sudo systemctl restart ssh

6. Configure Firewall Rules

Do not expose unnecessary services.

Example using UFW:

Install:

sudo apt install ufw

Allow SSH:

sudo ufw allow 22/tcp

Enable firewall:

sudo ufw enable

Check:

sudo ufw status

For additional security, allow SSH only from trusted IP addresses:

sudo ufw allow from YOUR_IP to any port 22

7. Install Fail2Ban

Fail2Ban monitors authentication logs and blocks suspicious IP addresses.

Install:

sudo apt install fail2ban

Enable:

sudo systemctl enable fail2ban

Start:

sudo systemctl start fail2ban

Check status:

sudo fail2ban-client status sshd

8. Limit SSH Users

Not every Linux user needs remote access.

Restrict SSH:

AllowUsers admin

or:

AllowGroups sshusers

This reduces the attack surface.

9. Disable Empty Passwords

Never allow passwordless accounts.

In:

/etc/ssh/sshd_config

set:

PermitEmptyPasswords no

10. Improve SSH Cryptography

Modern OpenSSH supports strong encryption algorithms.

Example configuration:

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

MACs hmac-sha2-512,hmac-sha2-256

Avoid outdated algorithms whenever possible.

11. Monitor SSH Logs

Security requires visibility.

Check authentication events:

Debian / Ubuntu:

sudo journalctl -u ssh

or:

sudo cat /var/log/auth.log

Look for:

repeated login failures,
unknown usernames,
unusual login times,
unexpected successful sessions.

12. Add Multi-Factor Authentication

SSH keys are strong, but MFA provides another security layer.

Possible solutions:

TOTP applications,
hardware security keys,
FIDO2 devices.

For critical servers, MFA should be considered mandatory.

SSH Hardening Checklist

Before exposing a Linux server:

✅ Update OpenSSH
✅ Disable root login
✅ Use SSH keys
✅ Disable password authentication
✅ Configure firewall
✅ Install Fail2Ban
✅ Restrict SSH users
✅ Remove weak algorithms
✅ Monitor logs
✅ Enable MFA

Final Thoughts

SSH is not insecure by design.

Most successful attacks happen because of:

weak passwords,
poor configuration,
outdated systems,
excessive permissions.

A hardened SSH configuration is one of the first steps in building a secure Linux server.

Security is not a single setting. It is a continuous process of improving, monitoring, and reducing risk.

About NetBe

NetBe publishes practical guides about Linux administration, cybersecurity, server hardening, cloud computing, and modern infrastructure.

Building a Linux Security Audit Toolkit with Bash: From Firewall Checks to SSH Hardening

Marek „Netbe” Lampart — Fri, 10 Jul 2026 15:31:53 +0000

Building a Linux Security Audit Toolkit with Bash: A Practical Approach to System Hardening

Linux is widely considered a secure operating system. However, security does not come automatically after installing a distribution.

A properly configured Linux system can be very secure, but a system with weak configuration, unnecessary services, outdated packages, or excessive privileges can still become an easy target.

One of the most important steps in cybersecurity is visibility.

Before improving security, you need to understand what is happening inside your system.

Which services are running?

Who has administrative privileges?

Are there unnecessary open ports?

Is SSH configured securely?

Are file permissions correct?

To answer these questions, I created a lightweight Linux Security Audit Toolkit written in Bash.

The goal was not to replace enterprise security scanners, but to build a simple, transparent tool that Linux administrators, students, and security enthusiasts can use to perform basic security checks.

Why Build a Security Audit Toolkit?

There are many professional security auditing solutions available:

Lynis
OpenSCAP
Nessus
CIS security scanners

These tools are extremely valuable, especially in enterprise environments.

However, sometimes you need something simpler.

A small Bash-based toolkit has several advantages:

no complicated installation,
easy to understand source code,
works directly from the terminal,
easy to customize,
useful for learning Linux security fundamentals.

The idea behind this project was simple:

Security starts with understanding your system.

Project Architecture

The toolkit is divided into independent security modules.

Each script focuses on a specific area of Linux security.

Example structure:

linux-security-audit/

├── run.sh
├── VERSION
├── README.md
│
└── scripts/
    ├── system-security-check.sh
    ├── firewall-check.sh
    ├── users-audit.sh
    ├── permissions-check.sh
    ├── updates-check.sh
    └── ssh-hardening.sh

The main launcher executes all modules and creates a final security report.

Firewall Security Audit

The firewall is one of the first layers protecting a Linux system.

The toolkit checks common firewall technologies:

UFW
Firewalld
nftables
iptables

It also reviews listening network services.

Example:

ss -tulnp

This command helps identify:

active network services,
open ports,
applications listening for connections.

A common mistake is leaving services exposed even though they are no longer needed.

For example:

A server running a database service should not expose that database directly to the internet unless there is a specific reason.

Reducing the attack surface is one of the simplest security improvements.

User Account Security Audit

User management is a critical part of Linux security.

The toolkit checks:

users with UID 0,
sudo users,
locked accounts,
active login shells,
SSH authorized keys.

Example:

awk -F: '$3 == 0 {print $1}' /etc/passwd

UID 0 accounts have root privileges.

Normally, only the root account and intentionally configured administrative accounts should have this level of access.

Unexpected privileged users may indicate:

incorrect configuration,
forgotten accounts,
potential compromise.

Linux File Permissions Review

Linux permissions are powerful, but incorrect permissions can create serious security problems.

The audit checks:

SUID files,
SGID files,
world-writable files,
insecure directories,
files without owners,
files without groups.

Example:

find / -perm -4000

SUID binaries deserve special attention.

A vulnerable SUID application can sometimes allow privilege escalation from a normal user to root.

This does not mean every SUID file is dangerous.

Many system components require this functionality.

The important part is knowing what exists on your system.

System Update Verification

Outdated software remains one of the most common security problems.

The update module checks:

available package updates,
kernel version,
package manager status.

Supported systems include:

Debian,
Ubuntu,
Linux Mint,
Fedora,
RHEL-based distributions,
Arch Linux,
openSUSE.

Regular updates help protect against:

known vulnerabilities,
privilege escalation bugs,
remote code execution issues.

Security is not only about installing tools.

Maintenance is equally important.

SSH Security Audit

SSH is one of the most important services on Linux servers.

It is also one of the most commonly attacked.

The toolkit checks:

SSH service status,
OpenSSH version,
root login configuration,
password authentication,
empty passwords,
SSH keys,
failed login attempts.

Recommended SSH configuration usually includes:

PermitRootLogin no

PasswordAuthentication no

PermitEmptyPasswords no

Using SSH keys instead of passwords provides stronger authentication and reduces the risk of brute-force attacks.

Additional protections can include:

Fail2ban,
firewall restrictions,
VPN-only SSH access,
multi-factor authentication.

Running the Security Audit

Clone the repository:

git clone https://github.com/cyberbezpieczenstwo/linux-security-audit.git

Enter the directory:

cd linux-security-audit

Make scripts executable:

chmod +x run.sh scripts/*.sh

Run the audit:

sudo ./run.sh

The result is a generated report:

security-report-hostname-date.txt

The report contains:

system information,
firewall status,
user audit results,
permission findings,
SSH recommendations,
update status.

Security Auditing Is Not About Finding Fault

A security audit should not be treated as a checklist where every warning means failure.

The purpose is understanding risk.

A good security process asks:

What is exposed?
Who has access?
What software is running?
What can be removed?
What needs monitoring?

Security is about reducing unnecessary risk.

Future Development

The project is still evolving.

Planned improvements:

HTML report generation,
Docker security checks,
SELinux and AppArmor analysis,
CIS Benchmark integration,
Fail2ban detection,
network security module,
automated recommendations.

The goal is to transform a collection of Bash scripts into a practical Linux security baseline tool.

Final Thoughts

Linux gives administrators excellent control and visibility.

But visibility only helps when you use it.

A secure system is not created by installing one security application.

It is built through:

regular auditing,
proper configuration,
updates,
monitoring,
understanding the environment.

Even a simple Bash script can help reveal problems before they become security incidents.

Security starts with knowing what is running on your machine.

Project repository:

https://github.com/cyberbezpieczenstwo/linux-security-audit

Author:

Marek "Netbe" Lampart

Linux | Cybersecurity | Infrastructure

DNS Security: Why Your Domain Configuration Can Become a Cybersecurity Problem

Marek „Netbe” Lampart — Tue, 07 Jul 2026 16:22:41 +0000

When people think about cybersecurity, they usually focus on passwords, malware, vulnerabilities, and firewalls.

DNS is rarely the first thing that comes to mind.

However, DNS is one of the most important components of modern infrastructure. Almost every web application, API, email system, and cloud service depends on correct DNS configuration.

A small DNS mistake can create serious security problems.

What is DNS and why does it matter?

DNS (Domain Name System) translates human-readable domain names into IP addresses.

Instead of remembering:

142.250.xxx.xxx

users can access:

example.com

But DNS does more than just resolve domains.

It also tells the internet:

where your website is hosted,
where your email servers are located,
which services exist,
which external providers are trusted.

Because of this, DNS becomes part of your security perimeter.

Common DNS security problems

1. Forgotten subdomains

One of the most common problems is abandoned subdomains.

Example:

dev.example.com
test.example.com
old.example.com

A company may stop using a service but leave the DNS record behind.

If that service is removed but the DNS entry remains, attackers may attempt a subdomain takeover.

The problem is simple:

DNS says:

dev.example.com → external-service.com

but nobody controls that external resource anymore.

2. Missing SPF, DKIM and DMARC records

Email security heavily depends on DNS.

Without proper email authentication, attackers can spoof your domain.

Common protections:

SPF

Defines which servers can send email for your domain.

Example:

example.com TXT

v=spf1 include:_spf.google.com ~all

DKIM

Adds cryptographic signatures to emails.

DMARC

Defines what receivers should do when SPF or DKIM checks fail.

Example:

_dmarc.example.com TXT

v=DMARC1; p=quarantine

These mechanisms do not stop every phishing attempt, but they significantly improve domain protection.

3. Exposed internal information

DNS records can reveal information about infrastructure.

Examples:

vpn.example.com
admin.example.com
backup.example.com
dev.example.com

This does not automatically mean a vulnerability exists.

However, attackers use DNS information during reconnaissance.

Before attacking systems, they first try to understand the environment.

4. Weak DNS configuration

Common configuration mistakes:

outdated nameservers,
missing DNSSEC,
incorrect TTL values,
forgotten records,
publicly exposed development environments.

A domain can work perfectly and still have security problems.

DNSSEC - protecting DNS integrity

DNS itself was not originally designed with strong authentication.

DNSSEC adds cryptographic verification to DNS responses.

It helps protect against attacks where someone tries to modify DNS responses and redirect users somewhere else.

DNSSEC does not encrypt DNS traffic.

Its purpose is integrity and authenticity.

How to perform a basic DNS security audit

A simple audit should check:

Domain records

Review:

A records
AAAA records
MX records
NS records
TXT records

Email protection

Verify:

SPF
DKIM
DMARC

Old resources

Look for:

unused subdomains,
forgotten services,
old cloud resources.

Nameserver security

Check:

provider reliability,
DNSSEC support,
account protection.

Useful tools for DNS analysis

Some commonly used tools:

dig

Linux users can query DNS directly:

dig example.com

Check MX records:

dig MX example.com

Check TXT records:

dig TXT example.com

nslookup

A simpler alternative:

nslookup example.com

Online DNS checkers

Online tools are useful for quick verification:

DNS record lookup
MX verification
SPF checking
propagation testing

DNS is often forgotten security layer

Many organizations invest heavily in:

endpoint protection,
firewalls,
monitoring,
vulnerability scanners.

But DNS configuration is often treated as "just networking".

That is a mistake.

DNS controls how users and systems find your services.

If DNS is wrong, everything built on top of it can become unreliable or unsafe.

Final thoughts

Security is not only about preventing attacks.

It is also about reducing unnecessary exposure.

A properly configured DNS environment:

reduces attack surface,
improves email security,
prevents accidental exposure,
makes infrastructure easier to manage.

DNS may look simple from the outside, but it is one of the foundations of modern cybersecurity.

Author

Marek "Netbe" Lampart

Cybersecurity | Linux | Networking | Infrastructure Security

https://netbe.pl

Ransomware explained: how modern attacks really work in 2026 (not theory)

Marek „Netbe” Lampart — Sun, 05 Jul 2026 15:09:19 +0000

Ransomware is often explained in a very simple way:

“It encrypts your files and demands payment.”

That description is technically correct — but it hides how complex modern ransomware actually is.

In 2026, ransomware is not just malware.
It is a multi-stage cybercrime operation combining intrusion, persistence, data theft, and extortion.

Let’s break it down realistically.

Ransomware starts long before encryption

Most people think ransomware “just appears” and starts encrypting files.

In reality, encryption is usually the final stage.

Attackers first need access, which is typically gained through:

🔹 Phishing
fake login pages
malicious attachments
credential harvesting
🔹 Exploited vulnerabilities
unpatched VPNs
exposed RDP services
software zero-days
🔹 Stolen credentials
leaked passwords
credential stuffing attacks
reused passwords across services

👉 At this stage, attackers are already inside the system — ransomware is just the final payload.

Initial execution and system analysis

Once inside, the ransomware binary is executed.

Before doing anything destructive, it often:

checks if it is running in a virtual machine
detects security tools (Defender, EDR, sandbox)
escalates privileges to admin/system level
delays execution to avoid detection

👉 This is why many infections are not immediately visible.

Network and file system reconnaissance

Modern ransomware does not encrypt randomly.

It first maps the environment:

local drives (C:, D:)
network shares
backup locations
cloud-synced folders

It also identifies valuable file types:

documents (.docx, .pdf)
databases (.sql, .db)
archives (.zip, .bak)

👉 The goal is maximum impact with minimum effort.

The encryption model (hybrid cryptography)

Modern ransomware uses hybrid encryption, not simple file locking.

Step 1: Fast encryption per file

Each file is encrypted using:

AES (Advanced Encryption Standard)
ChaCha20 (in newer variants)

This allows fast processing of large data volumes.

Step 2: Key protection

The AES keys are then encrypted using:

RSA
ECC (Elliptic Curve Cryptography)

The attacker holds the private key.

👉 Without the private key, recovery is practically impossible.

File encryption in practice

The ransomware loops through files and:

opens file
reads content into memory
encrypts data
overwrites or replaces original file
renames file (often adding custom extension)

Example:

report.docx → report.docx.lockbit

It usually avoids system-critical files to keep the OS running.

Destruction of recovery options

To prevent easy recovery, ransomware often:

deletes shadow copies
disables system restore
removes backup snapshots
stops recovery tools
clears event logs

Example commands used in attacks:

vssadmin delete shadows
wbadmin delete catalog

👉 This ensures victims cannot restore data easily.

Double extortion: the modern standard

In 2026, encryption alone is not enough for attackers.

Most groups now use double extortion:

Step 1: Data theft

Before encryption:

files are copied
sensitive databases extracted
credentials stolen
Step 2: Encryption

System is locked locally.

Step 3: Blackmail

If ransom is not paid:

stolen data is published or sold

👉 Even backups do not fully protect against this model.

Ransom note and communication system

After encryption, victims typically see:

ransom note files in folders
changed desktop wallpaper
instructions for payment

Modern groups also use:

Tor-based negotiation portals
live chat systems
“customer support” style communication

👉 Ransomware gangs now operate like service platforms.

Why recovery is extremely difficult

The key reason:

👉 asymmetric cryptography

AES/ChaCha20 = fast encryption
RSA/ECC = locks decryption keys

Without the private key:

brute force is computationally impossible
decryption is not realistic

Even advanced recovery tools usually fail.

Real-world insight: ransomware is not just malware

Modern ransomware is best understood as:

a structured cybercrime business model combining intrusion, automation, encryption, and extortion

It is not random malware anymore — it is organized infrastructure.

Final thoughts

Ransomware in 2026 is no longer just about locking files.

It is about:

stealing data
disabling recovery
applying psychological pressure
monetizing access in multiple ways

And the key takeaway is simple:

👉 once encryption starts, the real failure already happened earlier — at the access stage.

How ransomware actually encrypts files (real-world explanation, not theory)

Marek „Netbe” Lampart — Sun, 05 Jul 2026 14:48:24 +0000

Ransomware is often described in a very simplified way: “it encrypts your files and demands payment.”
That explanation is correct, but completely useless if you want to understand what actually happens on a technical level.

In this article, I’ll break down how modern ransomware really works in practice — based on real attack patterns used by families like LockBit, BlackCat, and others.

1. Initial access – how ransomware gets into the system

Before encryption even starts, attackers need access. This usually happens in one of these ways:

🔹 Phishing

A user opens:

malicious email attachment (PDF, DOCX, ZIP)
fake login page
macro-enabled document

🔹 Exploiting vulnerabilities

Unpatched systems are often targeted:

exposed RDP
VPN vulnerabilities
Windows zero-days

🔹 Stolen credentials

Attackers log in directly using:

leaked passwords
credential stuffing
reused passwords

👉 Important: ransomware is rarely “random”. It’s usually a planned intrusion.

2. Payload execution – the ransomware is launched

Once inside, the attacker deploys the ransomware binary.

At this stage, it typically:

checks system environment (VM detection, sandbox evasion)
disables security tools (Defender, logs, recovery tools)
escalates privileges (admin rights)

Some variants even sleep for hours or days to avoid detection.

3. Reconnaissance – mapping the system

Before encryption, ransomware “explores”:

drives (C:, D:, network shares)
connected devices
file types (documents, databases, backups)

It builds a target list in memory.

👉 This is why network drives often get encrypted too.

4. Key generation – the most important part

Modern ransomware uses hybrid encryption:

Step 1: Fast symmetric encryption

Each file is encrypted with:

AES (most common)
ChaCha20 (in newer strains)

This is fast and used for bulk encryption.

Step 2: Public key encryption

The symmetric keys are then encrypted using:

RSA
ECC (Elliptic Curve Cryptography)

The attacker keeps the private key.

👉 This is why you cannot “reverse engineer” encryption easily.

5. File-by-file encryption process

Now the ransomware starts looping through files:

For each file:

open file
read content into memory
encrypt with AES/ChaCha20
overwrite original file or create new encrypted copy
rename file (often adding extension like .lockbit, .enc)

It usually targets:

documents (.docx, .pdf)
databases (.sql, .db)
backups
archives (.zip, .rar)

It often avoids system-critical files to keep Windows running.

6. Deleting recovery options

To make recovery harder, ransomware often:

deletes shadow copies (vssadmin delete shadows)
disables recovery tools
removes backups if accessible
clears logs

This is why system restore often stops working.

7. Ransom note delivery

After encryption:

text file is dropped in every folder
desktop wallpaper is changed
instructions are shown

Usually includes:

Tor payment site
Bitcoin/Monero address
countdown timer

8. Data exfiltration (modern ransomware trend)

Many modern attacks are double extortion:

Before encryption, attackers also:

copy sensitive files
steal databases
exfiltrate credentials

Even if you restore backups, data can still be leaked.

9. Why recovery without key is nearly impossible

Because of hybrid encryption:

AES/ChaCha20 = fast encryption per file
RSA/ECC = protects AES keys

Without private key:
👉 brute force is computationally impossible

10. Real-world insight (important)

Ransomware is not “magic encryption malware”.

It is closer to:

a structured automated data destruction system combined with extortion logic

Modern groups operate like companies:

affiliates
infrastructure teams
negotiation portals
customer support (!)

Final thoughts

Understanding ransomware at this level shows something important:

👉 prevention is far easier than recovery

Because once encryption starts, the system is already compromised at multiple layers.

Checker portów IP i DNS – jak sprawdzić bezpieczeństwo i konfigurację sieci online

Marek „Netbe” Lampart — Sun, 05 Jul 2026 14:33:49 +0000

W sieci działa ogromna liczba usług, które komunikują się ze sobą przez konkretne porty i rekordy DNS. W praktyce większość problemów z bezpieczeństwem infrastruktury nie wynika z zaawansowanych exploitów, tylko z prostych błędów konfiguracji — np. otwartych portów, nieświadomie wystawionych usług albo błędnych rekordów DNS.

Dlatego narzędzia typu port checker / IP checker / DNS lookup stały się jednym z podstawowych sposobów szybkiej diagnostyki sieci.

W tym artykule wyjaśniam, jak działają takie narzędzia i jak można je wykorzystać do analizy bezpieczeństwa własnej infrastruktury.

Checker portów, IP i DNS – jak sprawdzić bezpieczeństwo i konfigurację sieci online

netbe.pl