Day 18 of #CloudSecurity: AWS Systems Manager
Kill your bastion hosts. SSM Session Manager routes shell sessions over HTTPS through the SSM agent -- no port 22 needed.
Critical security config most skip:
```json
{"runAsEnabled": true, "runAsDefaultUser": "ssm-user", "kmsKeyId": "your-key-arn"}
```
Without runAsEnabled, every session runs as root. Without KMS, sessions lack end-to-end encryption beyond TLS.
Also: explicitly deny port forwarding documents in IAM.…
Day 18 of #BashSecurity: iptables firewall basics
The safety net trick that saved me from lockouts:
```bash
sudo at now + 5 minutes <<< 'iptables -F; iptables -P INPUT ACCEPT'
# apply restrictive rules...
# if SSH still works, cancel the revert
sudo atrm $(atq | awk '{print $1}' | tail -1)
```
Schedules an automatic rule flush if you accidentally block yourself. Console access at 2am is not fun.
Also: always use -n flag with iptables -L.…
Day 18/90 Python Security: System information gathering
Built automated local recon scripts today:
- OS fingerprinting via platform module, reads /etc/os-release for distro details
- Network interface enumeration with psutil, catches rogue NICs on management VLANs
- User account auditing from pwd/grp, flags UID-zero backdoors and service shells
- Package inventory from dpkg-query cross-referenced with pip list
All output goes to JSON for baseline comparison.…
Day 18/90: Common traits: Display Debug Clone
Today's note was about using common traits: display debug clone to express shared behavior without making the type story fuzzy. I kept coming back to the same checks: behavior shared through traits, type constraints that explain intent, and generic helpers that stay readable at the call site.
The failure mode worth watching is adding generic or trait machinery before the shared behavior is clear.…
