WarnHack Blog
Practical guides on SSH security, privileged access and Linux threat detection — written from lab work, with the commands and configs included.
New here? Start with the SSH access risk checklist, see how teams replace shared SSH keys, or compare access tools.
210 articles found
210 articles
Building a Hardened CI/CD Pipeline: Architecture, Secret Scanning, and Artifact Signing
Technische Härtung von CI/CD-Pipelines: Secret-Scanning mit Gitleaks, BuildKit Secrets, Cosign Keyless Signing und Schutz vor Supply-Chain-Angriffen.
The authorized_keys Sprawl Problem: Detecting Stale Keys and Identity Drift Across Cloud Fleets
Learn how to discover, parse, and audit stale SSH authorized_keys across Linux fleets, correlate auth logs, and prevent cloud-init key re-injection.
Detecting Persistent SSH Backdoors: Auditing authorized_keys and Binary Integrity in Linux Environments
Technical guide on detecting SSH backdoors via log analysis, binary verification, and sshd_config audits. Covers persistence and PAM module integrity.
Hardware-Backed SSH: Configuring sk-ssh-ed25519 with OpenSSH 8.2+ and FIDO2 User Presence
Configure OpenSSH with FIDO2 hardware tokens. Learn ed25519-sk generation, resident keys, udev rules, PIN verification, and common error resolution.
Lab: Issuing Ephemeral OpenSSH Certificates via GitHub Actions OIDC Without Static Deploy Keys
Replace static CI/CD deploy keys with short-lived OpenSSH certificates signed by HashiCorp Vault using GitHub Actions OIDC token federation.
Post-Exploitation Agent Hijacking: Why Malicious CLI Dependencies Target SSH_AUTH_SOCK
Understand how attackers exploit SSH_AUTH_SOCK for lateral movement. Detect socket hijacking with auditd and replace agent forwarding with ProxyJump.
SSH to SIEM Integration: Collecting, Normalizing, and Alerting on Shell Activity
Learn how to capture immutable SSH execution telemetry using OpenSSH VERBOSE logging and Linux auditd execve syscall rules for SIEM ingestion.
Showing 7 of 210
Stay Ahead of Threats
Get the latest cybersecurity insights, tutorials, and threat intelligence delivered to your inbox.