Day 17: Network commands for security

This topic matters because it deals with network exposure and service reachability that people assume instead of proving using Bash and the native Linux tooling already on the box.

The pattern

#!/usr/bin/env bash
set -euo pipefail
dig +short A example.internal
timeout 10 tcpdump -nn -i any 'port 53 or port 443' -c 20

I keep the shell layer thin and obvious, then let the actual host commands produce the evidence. That gives me clear listener, firewall, and SSH evidence from the host itself with far less operational risk than a giant opaque script.

The concrete evidence I want to preserve usually comes from ss, iptables, sshd_config, dig, openssl, and packet capture filters. If a tool says a control is healthy, I want the line, path, or command output that justified that statement right next to it.

The Bash habit worth keeping

Use strict defaults, name the files and services you touch, and make inconclusive checks visible. Bash is still a strong security tool when it behaves like a disciplined operator note rather than a magic trick.