Security commands

Create SSH tunnel (local port forward)

Tunnels local port 8080 securely to remote port 80 via a bastion host.

ssh -L 8080:localhost:80 [email protected]

Generate an Ed25519 SSH key

Generates a highly secure modern SSH key pair.

ssh-keygen -t ed25519 -C "[email protected]"

Generate CSR and private key

Creates a new 2048-bit RSA private key and a Certificate Signing Request.

openssl req -new -newkey rsa:2048 -nodes -keyout mydomain.key -out mydomain.csr

The private key is written unencrypted (-nodes); keep mydomain.key private.

Read a local certificate file

Reads an x509 certificate file and outputs its details.

openssl x509 -in certificate.crt -text -noout

Scan open ports with Nmap

Performs a fast network scan to find open ports on a target IP.

Caution. Scan only hosts and networks you own or have written permission to test.

nmap -F 192.168.1.1

Fix SSH key permissions

Secures a private SSH key file so only the owner can read it.

chmod 600 ~/.ssh/id_ed25519

Check fail2ban status

Shows the status of fail2ban jails and banned IPs.

sudo fail2ban-client status sshd

Encrypt file with GPG

Encrypts a file using symmetric encryption with GPG.

gpg -c sensitive-file.txt

Find SUID binaries

Finds all binaries with the SUID bit set (potential privilege escalation vectors).

find / -perm -4000 -type f 2>/dev/null

Show recent logins

Displays the last 20 user login records.

last -n 20

Generate bcrypt password hash

Prompts for a password and prints its bcrypt hash, so the password never lands in your shell history.

python3 -c "import bcrypt, getpass; print(bcrypt.hashpw(getpass.getpass().encode(), bcrypt.gensalt()).decode())"

Needs the bcrypt package: pip install bcrypt.

Copy SSH key to server

Installs your public key on a remote server for passwordless login.

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-host

Scan infrastructure code for misconfigurations

Checks Terraform, Kubernetes manifests and Dockerfiles in the current directory against security rules.

trivy config .

Scan a repository for leaked secrets

Searches the git history of the current repository for keys, tokens and passwords.

gitleaks git -v .

Versions before 8.19 use gitleaks detect instead.

Download the IAM credential report

Generates and saves a CSV of every IAM user with password, access key and MFA status.

aws iam generate-credential-report && aws iam get-credential-report --query Content --output text | base64 --decode > credential-report.csv

If the report is not ready yet, wait a few seconds and run the second command again.

List what a service account can do

Shows every action a Kubernetes service account is allowed to perform in a namespace.

kubectl auth can-i --list -n <namespace> --as=system:serviceaccount:<namespace>:<service-account>

Needs permission to impersonate service accounts.