Security
19 sheets
- SecurityOverview of the security and secrets cheat sheets, with a hardening checklist for a homelab or small self-hosted environment. The aim is layered defence: keep…
- Application Security ToolsCommand-line scanners that complement Trivy and gitleaks: Semgrep for code, OSV-Scanner and Grype for dependencies, Syft for SBOMs, Checkov for IaC, OpenSSF…
- ASPMApplication Security Posture Management (ASPM) means pulling findings from your separate security tools (SAST, dependency scanning, secrets, containers, IaC)…
- AutheliaAuthelia is a self-hosted authentication and authorisation server that adds login, two-factor and per-domain access rules in front of your apps through your…
- authentikauthentik is a self-hosted identity provider: SSO via OIDC, OAuth2, SAML, LDAP and RADIUS, plus a forward-auth proxy outpost for apps with no native SSO. It is…
- ClamAVClamAV is an open source antivirus engine for Linux. It is most useful for scanning file shares, mail and uploads for malware that targets other systems…
- Container ScanningVulnerability scanners compare the packages in an image, filesystem or repo against CVE databases, and can also check IaC for misconfiguration and find…
- CrowdSecCrowdSec is a modern, collaborative intrusion-prevention system. The Security Engine reads logs and detects attacks using scenarios; bouncers (firewall…
- fail2banfail2ban watches log files (or the systemd journal) for repeated failures such as bad SSH logins and bans the offending IP by adding firewall rules for a set…
- GPGGnuPG implements OpenPGP: public-key encryption, signatures and symmetric encryption for files, email, Git commits and package repositories. For SSH keys see…
- KeycloakKeycloak is an open source identity and access management server (CNCF project) providing SSO, OIDC, OAuth2, SAML, user federation (LDAP/AD), social login and…
- Lynis and auditdLynis is a host security auditing scanner: it inspects a Linux system and reports warnings, suggestions and a hardening index. auditd is the Linux Audit…
- Nessus and OpenVASVulnerability scanners that probe hosts across the network for missing patches and misconfiguration. Nessus is Tenable's commercial scanner with a limited free…
- Secret ScanningSecret scanners find API keys, passwords and private keys in source code and Git history before an attacker does. This sheet covers gitleaks and TruffleHog…
- SnykSnyk is a developer security platform with a CLI that scans dependencies (snyk test), source code (snyk code test), container images and IaC. It needs a Snyk…
- SOPS and ageSOPS encrypts the values of YAML, JSON, ENV and INI files while leaving keys readable, so secrets can live in Git and still produce sensible diffs. age is the…
- SSH HardeningPractical sshd_config settings to lock down an OpenSSH server: key-only login, no root password login, limited users and sane timeouts. Client usage is in…
- Vault and OpenBaoHashiCorp Vault stores and brokers secrets: a KV store, dynamic database and cloud credentials, PKI, and an encryption service, all behind policy-controlled…
- WazuhWazuh is an open source security platform: agents on your hosts send logs, file integrity changes, vulnerability data and configuration checks to a manager…