Linux

In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask). Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys). The Fundamental Rule: Masking, Not Subtraction By default, the Linux operating system assigns base permissions: Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety. Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd). The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created. ...

When external USB flash drives or external storage media are plugged into desktop Linux distributions, automated desktop daemons (like udisks2 or automount rules) often mount them automatically. If the filesystem is mounted without explicit security constraints, an unprivileged user or malicious physical actor can escalate to root privileges instantly using pre-configured SUID binaries. The Attack Vector: SUID Preservation on Portable Filesystems POSIX filesystems (such as ext4, ext3, xfs) store Unix file permissions—including the SetUID (suid) bit (chmod 4755) and file ownership—directly inside the filesystem’s inode tables. ...

In Block-Level Disk Encryption with LUKS, we explored interactive unlocking via passphrases. However, on unattended servers, secondary data drives or database volumes must frequently unlock and mount automatically during system boot without manual console intervention. This guide outlines configuring keyfile-based authentication for LUKS partitions using /etc/crypttab and /etc/fstab. Security Architecture Note: Storing a plaintext decryption key on the same machine that hosts the encrypted data protects against drive theft (decommissioning or drive pulling), but does not protect against complete machine theft where the root filesystem is unencrypted. Ensure your root partition is also protected or store the key on a dedicated hardware token / TPM / networked keyserver. ...

Linux Unified Key Setup (LUKS) is the standard specification for Linux block-device encryption. Implemented via the dm-crypt kernel module and managed with cryptsetup, LUKS provides transparent disk encryption below the filesystem layer. This guide walks through creating an encrypted partition on a storage device, initializing the LUKS header, formatting the decrypted mapping, and managing its mount lifecycle. Step 1: Partitioning the Target Disk Identify your target drive (e.g., /dev/sdb) using lsblk or fdisk -l. Use fdisk or parted to create a partition: ...

In honeypot deployments, captive portals, or specialized traffic inspection environments, administrators often need to forward all incoming traffic—regardless of destination port—to a single listening service (such as an HTTP inspection proxy or logging daemon). This can be accomplished at line rate within the Linux kernel using Netfilter Destination NAT (DNAT) via iptables. Redirecting Inbound Port Ranges via DNAT To redirect all incoming TCP traffic across ports 1 through 65535 arriving on interface eth0 to an internal service listening on port 80 at 192.168.1.10: ...

When exploiting buffer overflows in space-constrained stack frames (e.g., when the vulnerable buffer is only 20 or 30 bytes), you cannot fit a standard 50-byte shellcode payload directly on the stack. A classic exploitation technique is ret2env: injecting the shellcode into an environment variable (export EGG=...) and redirecting execution to its address located near the high end of the process address space. Why Addresses Shift Environment variables reside at the top of the user stack directly below the initial stack frame. Because the program name (argv[0]) is pushed onto the stack immediately following the environment pointer (envp), the exact address of an environment variable depends slightly on the length of the binary name: ...

GnuPG (GPG) is a complete implementation of the OpenPGP standard (RFC 4880). It allows you to encrypt data either symmetrically (using a shared passphrase) or asymmetrically (using public/private key pairs). When you need to protect sensitive documents (such as financial records, credentials, or backups) before sending them over email or untrusted channels, symmetric GPG encryption provides strong, zero-infrastructure security. Symmetric Encryption with a Passphrase To encrypt a file symmetrically using a password: ...