Linux Terminal Glossary
›
Security & Hardening
Security & Hardening
158 commands
fail2ban-client ping
fail2ban-client reload
fail2ban-client set sshd banip 203.0.113.9
fail2ban-client set sshd unbanip 203.0.113.9
fail2ban-client get sshd banned
fail2ban-client set sshd bantime 7200
fail2ban-client unban --all
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
systemctl status fail2ban
journalctl -u fail2ban -f
ufw status
ufw status numbered
ufw allow 443/tcp
ufw allow from 192.168.1.0/24
ufw allow from 10.0.0.5 to any port 3306
ufw deny 8080
ufw delete allow 8080
ufw default deny incoming
ufw default allow outgoing
ufw disable
ufw app list
ufw show added
ufw limit ssh
nft list ruleset > /etc/nftables.conf
nft add chain inet filter input '{ type filter hook input priority 0; policy accept; }'
nft add rule inet filter input tcp dport 22 accept
nft add rule inet filter input tcp dport 443 accept
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input iif lo accept
nft add rule inet filter input drop
nft -f /etc/nftables.conf
nft -a list ruleset
nft delete rule inet filter input handle 5
nft delete table inet filter
nft list table inet filter
iptables -S
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80,443 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -P INPUT DROP
iptables -D INPUT -p tcp --dport 8080 -j ACCEPT
iptables -F
ip6tables -L -n -v
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ipset create blacklist hash:ip timeout 3600
ipset add blacklist 203.0.113.9
ipset list blacklist
ipset destroy blacklist
nmap -sV target.example.com
nmap -p- target.example.com
nmap -p 22,80,443 target.example.com
nmap -A target.example.com
nmap -sS target.example.com
nmap -sT target.example.com
nmap -O target.example.com
nmap -F target.example.com
nmap -Pn target.example.com
nmap --top-ports 1000 target.example.com
openssl version
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out key.pem
openssl genpkey -algorithm ed25519 -out key.pem
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -subj '/CN=example.com'
openssl x509 -in cert.pem -noout -fingerprint -sha256
openssl x509 -in cert.pem -noout -dates
openssl rand -hex 32
openssl enc -aes-256-cbc -pbkdf2 -salt -in secret.txt -out secret.enc
openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out secret.txt
openssl dgst -sha256 file.iso
openssl ciphers -v 'HIGH:!aNULL'
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null
gpg --quick-generate-key 'Alice <alice@example.com>' rsa4096 sign 1y
gpg --list-keys
gpg --list-secret-keys
gpg --export --armor alice@example.com > alice.asc
gpg --import alice.asc
gpg -c secret.txt
gpg -e -r alice@example.com secret.txt
gpg -d secret.txt.gpg
gpg --verify file.sig file
gpg --fingerprint alice@example.com
gpg --refresh-keys
gpg --delete-secret-keys alice@example.com
gpg --clearsign message.txt
gpg --export-secret-keys --armor alice@example.com > alice-secret.asc
ssh-keygen -t ed25519 -a 100
ssh-keygen -t rsa -b 4096
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
ssh-keygen -p
ssh-keygen -y -f ~/.ssh/id_ed25519
ssh-copy-id -p 2222 deploy@example.com
ssh-audit example.com
ssh-keyscan -t ed25519 example.com
sshd -t
sshd -T
lynis audit system --quick
lynis audit system --pentest
lynis audit dockerfile Dockerfile
lynis update info
lynis show version
rkhunter --update
rkhunter --propupd
debsums -c
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -a always,exit -F arch=b64 -S execve -k process_exec
auditctl -e 1
ausearch -k passwd_changes
ausearch -m USER_LOGIN -ts recent
aureport -l
systemctl status auditd
cscli bouncers list
cscli bouncers add nginx-bouncer
cscli decisions list
cscli decisions add --ip 203.0.113.9
cscli decisions delete --ip 203.0.113.9
cscli alerts list
cscli alerts inspect 123
cscli explain --file /var/log/nginx/access.log --type nginx
cscli metrics
crowdsec -t
firewall-cmd --add-port=443/tcp --permanent
firewall-cmd --list-services
firewall-cmd --remove-service=http --permanent
firewall-cmd --runtime-to-permanent
firewall-cmd --get-default-zone
aa-complain /etc/apparmor.d/usr.sbin.nginx
apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx
semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'
setsebool -P httpd_can_network_connect 1
getsebool -a
ausearch -m AVC -ts recent
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.conf.default.accept_redirects=0
sysctl -p /etc/sysctl.d/99-hardening.conf
chattr +i /etc/ssh/sshd_config
lsattr /etc/ssh/sshd_config
find / -xdev -type f -perm -4000 -ls
find / -xdev -type f -perm -002 -ls
faillock
faillock --user alice --reset
chage -M 90 -m 7 -W 7 alice
clamscan -r --infected /home/barry
cryptsetup luksAddKey /dev/sdb1
cryptsetup luksRemoveKey /dev/sdb1
aide --init
aide --check
fail2ban-client status --all
openssl pkey -in key.pem -text -noout
ufw app info 'Nginx Full'
nft list chains inet filter
rkhunter --check --rwo
ssh-keygen -t ed25519 -N '' -f ~/.ssh/deploy_key
systemctl mask sshd
cryptsetup luksChangeKey /dev/sdb1
gpg --show-keys alice.asc
gpg --quick-add-uid alice@example.com 'Alice Backup <alice+backup@example.com>'
unhide proc
Search all 7,657 commands
instead.