Security & Hardening

158 commands

fail2ban-client pingfail2ban-client reloadfail2ban-client set sshd banip 203.0.113.9fail2ban-client set sshd unbanip 203.0.113.9fail2ban-client get sshd bannedfail2ban-client set sshd bantime 7200fail2ban-client unban --allfail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.confsystemctl status fail2banjournalctl -u fail2ban -fufw statusufw status numberedufw allow 443/tcpufw allow from 192.168.1.0/24ufw allow from 10.0.0.5 to any port 3306ufw deny 8080ufw delete allow 8080ufw default deny incomingufw default allow outgoingufw disableufw app listufw show addedufw limit sshnft list ruleset > /etc/nftables.confnft add chain inet filter input '{ type filter hook input priority 0; policy accept; }'nft add rule inet filter input tcp dport 22 acceptnft add rule inet filter input tcp dport 443 acceptnft add rule inet filter input ct state established,related acceptnft add rule inet filter input iif lo acceptnft add rule inet filter input dropnft -f /etc/nftables.confnft -a list rulesetnft delete rule inet filter input handle 5nft delete table inet filternft list table inet filteriptables -Siptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -p tcp --dport 22 -j ACCEPTiptables -A INPUT -p tcp --dport 80,443 -j ACCEPTiptables -A INPUT -i lo -j ACCEPTiptables -P INPUT DROPiptables -D INPUT -p tcp --dport 8080 -j ACCEPTiptables -Fip6tables -L -n -vip6tables -A INPUT -p tcp --dport 22 -j ACCEPTipset create blacklist hash:ip timeout 3600ipset add blacklist 203.0.113.9ipset list blacklistipset destroy blacklistnmap -sV target.example.comnmap -p- target.example.comnmap -p 22,80,443 target.example.comnmap -A target.example.comnmap -sS target.example.comnmap -sT target.example.comnmap -O target.example.comnmap -F target.example.comnmap -Pn target.example.comnmap --top-ports 1000 target.example.comopenssl versionopenssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out key.pemopenssl genpkey -algorithm ed25519 -out key.pemopenssl req -new -x509 -key key.pem -out cert.pem -days 365 -subj '/CN=example.com'openssl x509 -in cert.pem -noout -fingerprint -sha256openssl x509 -in cert.pem -noout -datesopenssl rand -hex 32openssl enc -aes-256-cbc -pbkdf2 -salt -in secret.txt -out secret.encopenssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out secret.txtopenssl dgst -sha256 file.isoopenssl ciphers -v 'HIGH:!aNULL'openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/nullgpg --quick-generate-key 'Alice <alice@example.com>' rsa4096 sign 1ygpg --list-keysgpg --list-secret-keysgpg --export --armor alice@example.com > alice.ascgpg --import alice.ascgpg -c secret.txtgpg -e -r alice@example.com secret.txtgpg -d secret.txt.gpggpg --verify file.sig filegpg --fingerprint alice@example.comgpg --refresh-keysgpg --delete-secret-keys alice@example.comgpg --clearsign message.txtgpg --export-secret-keys --armor alice@example.com > alice-secret.ascssh-keygen -t ed25519 -a 100ssh-keygen -t rsa -b 4096ssh-keygen -l -f ~/.ssh/id_ed25519.pubssh-keygen -pssh-keygen -y -f ~/.ssh/id_ed25519ssh-copy-id -p 2222 deploy@example.comssh-audit example.comssh-keyscan -t ed25519 example.comsshd -tsshd -Tlynis audit system --quicklynis audit system --pentestlynis audit dockerfile Dockerfilelynis update infolynis show versionrkhunter --updaterkhunter --propupddebsums -cauditctl -w /etc/passwd -p wa -k passwd_changesauditctl -a always,exit -F arch=b64 -S execve -k process_execauditctl -e 1ausearch -k passwd_changesausearch -m USER_LOGIN -ts recentaureport -lsystemctl status auditdcscli bouncers listcscli bouncers add nginx-bouncercscli decisions listcscli decisions add --ip 203.0.113.9cscli decisions delete --ip 203.0.113.9cscli alerts listcscli alerts inspect 123cscli explain --file /var/log/nginx/access.log --type nginxcscli metricscrowdsec -tfirewall-cmd --add-port=443/tcp --permanentfirewall-cmd --list-servicesfirewall-cmd --remove-service=http --permanentfirewall-cmd --runtime-to-permanentfirewall-cmd --get-default-zoneaa-complain /etc/apparmor.d/usr.sbin.nginxapparmor_parser -r /etc/apparmor.d/usr.sbin.nginxsemanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'setsebool -P httpd_can_network_connect 1getsebool -aausearch -m AVC -ts recentsysctl -w net.ipv4.tcp_syncookies=1sysctl -w net.ipv4.conf.all.rp_filter=1sysctl -w net.ipv4.conf.default.accept_redirects=0sysctl -p /etc/sysctl.d/99-hardening.confchattr +i /etc/ssh/sshd_configlsattr /etc/ssh/sshd_configfind / -xdev -type f -perm -4000 -lsfind / -xdev -type f -perm -002 -lsfaillockfaillock --user alice --resetchage -M 90 -m 7 -W 7 aliceclamscan -r --infected /home/barrycryptsetup luksAddKey /dev/sdb1cryptsetup luksRemoveKey /dev/sdb1aide --initaide --checkfail2ban-client status --allopenssl pkey -in key.pem -text -nooutufw app info 'Nginx Full'nft list chains inet filterrkhunter --check --rwossh-keygen -t ed25519 -N '' -f ~/.ssh/deploy_keysystemctl mask sshdcryptsetup luksChangeKey /dev/sdb1gpg --show-keys alice.ascgpg --quick-add-uid alice@example.com 'Alice Backup <alice+backup@example.com>'unhide proc
Search all 7,657 commands instead.