WRKLOG-2026-06-25

access-list outside_in deny ip any any

policy drop on input chain

Implicit deny — identical philosophy

access-list inside_out permit tcp any host 10.50.1.90 eq 53

ip daddr {10.50.1.90} tcp dport 53 accept

Outbound ACL entry — same structure (source, dest, port, action)

access-group inside_out out interface inside

chain output { type filter hook output }

Binding the ACL to a direction on an interface

object-group network DNS_SERVERS

ip daddr {10.50.1.90, 10.50.1.91}

Object group = nftables set/list

inspect / stateful firewall (CBAC)

ct state {established, related} accept

Conntrack = Linux stateful inspection engine

logging enable / logging trap informational

log prefix "nft-egress-drop:" group 0

Syslog on match — same concept

shun (dynamic block)

fail2ban auto-ban / usbguard block-device

Dynamic response to detected threat

threat-detection statistics

fail2ban status / nft list ruleset counters

Per-rule hit counts for threat visibility

packet-tracer input outside tcp …​

nft trace / nft monitor

Packet walk — trace policy evaluation path

nat (inside,outside) dynamic interface

Docker’s table ip nat / MASQUERADE

PAT — you saw this in your nft ruleset tonight (Docker’s NAT chains)

failover / active-standby

nftables persists via /etc/nftables.conf — survives reboot

Not HA, but persistence model is analogous

clear xlate / connection table flush

sudo conntrack -F

Flush conntrack table — same as clearing translations

Authorization policy (permit/deny per identity)

AppArmor profile (permit/deny per binary)

ISE gates network access by identity; AppArmor gates file/network access by program

Posture assessment (is the endpoint compliant?)

arch-audit, security-remediation.service timer

Continuous compliance checking — automated, timer-driven

dACL (downloadable ACL pushed to switchport)

AppArmor profile loaded at binary execution

Policy pushed to the enforcement point — port vs process

MAB (MAC Authentication Bypass — allow known devices)

USBGuard (allow known USB devices by vendor:product:hash)

Known-device allowlist — MAC address vs USB device fingerprint

RADIUS accounting (who connected, when, which port)

auditd (who accessed which file, when, which process)

Accountability trail — both feed into SIEM

Profiling (identify device type by behavior/OUI)

usbguard list-devices (identify by vendor:product:hash:interface)

Device classification — OUI lookup vs USB descriptor fingerprint

CoA (Change of Authorization — re-auth live session)

aa-enforce / aa-complain (change policy on running binary)

Live policy change without disconnect/restart

pxGrid (share context between security tools)

Wazuh + auditd + fail2ban → centralized SIEM dashboard

Cross-tool context sharing — pxGrid API vs syslog/journald aggregation

Guest portal (redirect unauthorized → captive portal)

USBGuard block → usbguard allow-device (manual approval)

Unauthorized device gets blocked, admin authorizes explicitly

TrustSec SGT (Security Group Tags)

AppArmor profile labels per binary

Tagging entities with security context — SGT on packets vs profile on processes

Endpoint compliance (AnyConnect posture module)

arch-audit + sysctl hardening + auditd

Verifying the endpoint meets security baseline

ISE MnT (Monitoring and Troubleshooting node)

Wazuh dashboard + ausearch + journalctl

Centralized visibility into auth events and policy violations

ip route 0.0.0.0 0.0.0.0 10.50.1.1

ip route add default via 10.50.1.1

Default route — literally the same command family

show ip route

ip route show

Route table inspection

show mac address-table

ip neighbor show (ARP/NDP table)

L2→L3 mapping

VLAN assignment (switchport access vlan 10)

ip link add link eth0 name eth0.10 type vlan id 10

802.1Q tagging — kernel native

SVI (interface vlan 10)

VLAN interface with IP assigned

L3 interface on a VLAN — same concept

show interfaces status

ip link show / ethtool

Interface state, speed, duplex

Port security (limit MACs per port)

USBGuard (limit devices per port)

Device restriction on physical interface

DHCP snooping

nftables rules filtering DHCP on untrusted interfaces

Prevent rogue DHCP — firewall-based on Linux

ACL on interface (in/out)

nftables chain with iif/oif matching

Direction-based filtering on specific interfaces

spanning-tree portfast

N/A at host level — but bridge module handles STP for VMs

Relevant when running VMs with bridged networking

show logging / syslog

journalctl / dmesg

Centralized log inspection

debug ip packet

tcpdump / nft trace

Packet-level debugging

Get-GPO / Group Policy enforcement

AppArmor profiles (mandatory policy on binaries)

Centralized policy enforcement — GPO vs MAC profiles

Set-ExecutionPolicy Restricted

AppArmor deny rules on interpreters (python, node)

Restricting what can execute — same intent

netsh advfirewall / Windows Firewall

nft / nftables

Host firewall — both stateful, both ACL-based

Event Viewer / Windows Event Forwarding

journalctl / auditd → Wazuh

Event collection and SIEM forwarding

Get-Service / Start-Service

systemctl status / systemctl start

Service management — near-identical workflow

Windows Defender / AMSI

AppArmor + ClamAV (if installed)

Endpoint protection — behavioral (AppArmor) vs signature (ClamAV)

Get-LocalGroupMember Administrators

getent group wheel

Who has admin/root access

UAC (User Account Control)

pam_wheel + sudo

Privilege escalation gate — prompt before elevation

BitLocker

LUKS

Full-disk encryption — both TPM-capable, both pre-boot

Credential Guard / LSA Protection

GPG agent TTL (15min) + AppArmor deny on key paths

Protecting credentials in memory — time-limited cache

LAPS (Local Admin Password Solution)

Vault SSH certificates with 8h TTL

Rotating credentials automatically — LAPS rotates passwords, Vault rotates certs

Windows Event Forwarding (WEF)

Wazuh agent → manager

Centralized log collection from endpoints

sfc /scannow (System File Checker)

Wazuh FIM (File Integrity Monitoring) / aide

Detecting unauthorized file modifications

Task Scheduler

systemd timers (daily-audit.service, security-remediation.service)

Scheduled automation — your timers are the Linux equivalent

Get-WinEvent -FilterHashtable @{LogName='Security'}

ausearch -k ssh_key_read --interpret

Querying security audit events by key/filter

PowerShell Remoting (Enter-PSSession)

SSH

Remote administration — both encrypted, both identity-gated

Test-NetConnection -Port 443

ss -tlnp / nmap / curl

Port connectivity testing

pg_hba.conf (host-based authentication)

/etc/ssh/sshd_config.d/10-hardening.conf

Who can connect, from where, with what auth method. Same structure — source IP, auth method, allow/deny.

GRANT SELECT ON table TO role

AppArmor owner @{HOME}/.ssh/id_* r

Least-privilege access — grant specific permissions to specific identities

REVOKE ALL ON schema FROM public

AppArmor deny rules

Explicit deny — remove default access

CREATE ROLE app_readonly LOGIN

Linux user + group membership

Role-based access — separate identity for separate privilege level

pg_hba.conf: hostssl all all 0.0.0.0/0 scram-sha-256

PasswordAuthentication no + PubkeyAuthentication yes

Enforce strong auth — reject weak methods

ssl = on in postgresql.conf

TLS on SSH / Vault certs

Encrypt in transit

log_connections = on / log_statement = 'all'

auditd key file monitoring

Audit trail — who did what, when

Row-Level Security (RLS)

AppArmor owner prefix (only your files)

Access scoped to the identity’s own data

pg_stat_activity (who’s connected now)

ss -tlnp / who / w

Active session monitoring

Connection pooling (PgBouncer)

SSH multiplexing (ControlMaster)

Reuse connections — efficiency + reduced auth overhead

ALTER SYSTEM SET max_connections = 100

MaxAuthTries 3 / fail2ban maxretry

Resource limiting to prevent abuse

Backup encryption (`pg_dump pass:[

] gpg`)

age -e / LUKS at rest

Data protection at rest — same tools

pgaudit extension

auditd + Wazuh

Deep audit logging beyond default — who queried what

Replication (primary → standby)

Vault HA (3-node cluster) / BIND primary→secondary

Redundancy and failover — you already run this pattern

pg_hba.conf reload (SELECT pg_reload_conf())

sudo systemctl restart sshd / gpg-connect-agent reloadagent

Apply config changes without full restart

Tablespace encryption (TDE)

LUKS partition encryption

Transparent encryption at the storage layer

search_path manipulation attack

PATH injection / untrusted $PATH entries

Identify

ISE profiling, device inventory

Get-ADComputer, asset inventory

auditd, USBGuard profiling, arch-audit

pg_stat_activity, pg_roles

Protect

ACLs, dACLs, TrustSec, 802.1X

GPO, BitLocker, Credential Guard

AppArmor, nftables, LUKS, GPG TTL

pg_hba.conf, GRANT/REVOKE, RLS, TLS

Detect

ISE MnT, syslog, SNMP traps

Event Viewer, WEF, Defender

auditd, fail2ban, arch-audit, Wazuh

pgaudit, log_statement, monitoring

Respond

CoA, shun, quarantine VLAN

Defender auto-remediation, AMSI block

fail2ban auto-ban, USBGuard block, aa-enforce

Connection terminate, ALTER ROLE …​ NOLOGIN

Recover

Failover, config restore

System Restore, WDS

Backout plans, btrfs snapshots, LUKS

pg_basebackup, PITR, replication failover

Credential dumping (Mimikatz pattern)

Extract passwords/hashes from memory on a compromised host

GPG agent TTL 15min (passphrase evicted quickly), allow-preset-passphrase removed (can’t inject passphrases), coredumps disabled (Storage=none, ulimit -c 0) — no memory dump to disk

SSH key theft

Copy private key files from ~/.ssh/ to attacker-controlled server

Keys are passphrase-protected (stored in gopass), auditd watches all key reads (-k ssh_key_read), AppArmor denies curl/wget from reading ~/.ssh/**, nftables egress logging catches exfiltration attempts

Pass-the-hash / Pass-the-ticket

Reuse stolen NTLM hash or Kerberos ticket without knowing password

Vault SSH certificates with 8h TTL — even if stolen, they expire. No static passwords on Linux hosts (pubkey-only auth)

Kerberoasting

Request TGS tickets for service accounts, crack offline

Relevant to your AD domain (home-dc01/02). Defense: AES-only encryption on service accounts, disable RC4. Linux hosts use SSH keys, not Kerberos (except where gssapi-with-mic is in PreferredAuthentications)

Keylogging

Capture keystrokes to harvest credentials

Wayland (XDG_SESSION_TYPE=wayland) isolates clipboard and input — unlike X11, one app cannot keylog another. No clipboard manager running (gopass 45-second clear is effective)

LLMNR/NBT-NS Poisoning (Responder)

Poison name resolution to intercept credentials on the local network

Linux does not use LLMNR/NBT-NS by default. DNS points to your BIND servers (10.50.1.90, 10.50.1.91). No fallback to broadcast resolution. Verify: systemctl is-active avahi-daemon — if running, consider disabling.

ARP Spoofing / MITM

Poison ARP cache to intercept traffic between hosts

rp_filter=1 (reverse path filtering) rejects spoofed source IPs. Post-quantum SSH KEX (ML-KEM-768 + NTRU Prime) prevents passive interception even if MITM succeeds at L2.

SMB Relay

Intercept SMB auth and relay to another host for access

Linux hosts don’t run SMB server by default. Verify: ss -tlnp | grep 445. If Samba is running, enforce SMB signing.

SSH Agent Forwarding Hijack

On a compromised jump host, hijack forwarded agent socket to authenticate elsewhere

AllowAgentForwarding no in sshd hardening drop-in. Agent forwarding is disabled — there’s no socket to hijack.

DNS Tunneling / Exfiltration

Encode data in DNS queries to bypass firewall

DNS restricted to your BIND servers in nftables egress (ip daddr {10.50.1.90, 10.50.1.91} udp dport 53 accept). Your BIND servers can be configured to log/restrict query types.

Reverse Shell

Compromised binary opens outbound connection to attacker C2

nftables egress chain logs all unmatched outbound traffic. AppArmor deny network on age, ssh-agent, gopass. When egress switches to policy drop, only allowlisted ports/destinations will connect out.

Port Scanning from Pivot Host

Use compromised host to scan internal network

nftables egress — only SSH (22), HTTP/S (80/443), Vault (8200), Wazuh (1514/1515), DNS (53) allowed outbound. Scanner would need to use these ports or get logged/dropped.

Privilege Escalation via SUID

Exploit a SUID binary to gain root

48 SUID binaries audited — all standard. kptr_restrict=2 (KASLR bypass harder), suid_dumpable=0 (no core dumps from SUID), ptrace_scope=1 (can’t attach to other users' processes)

Container Escape

Break out of Docker/Podman container to host

unprivileged_userns_clone=0 in sysctl (container escape mitigation). Docker runs as root — monitor with auditd. No rootless containers on this workstation.

Kernel Exploit

Exploit kernel vulnerability for root access

kptr_restrict=2 (kernel pointers hidden), dmesg_restrict=1 (kernel logs restricted), unprivileged_bpf_disabled=2 (eBPF restricted). AppArmor loaded at boot via kernel cmdline (lsm=landlock,lockdown,yama,integrity,apparmor,bpf). 15 vulnerable packages monitored via arch-audit.

Malicious USB / BadUSB

Plug in a device that emulates keyboard and injects commands

USBGuard with device allowlist. Unknown USB devices are blocked by default. Programmatic allow/block pipeline for authorized devices.

DMA Attack via Thunderbolt

Direct memory access through Thunderbolt port to read/write host RAM

bolt installed. Thunderbolt module loaded but authorization policy pending configuration (carryover task).

Cron/Systemd Timer Persistence

Attacker installs a timer/cron job that survives reboot

auditd can monitor timer directories. Wazuh FIM (when enrolled) will alert on changes to ~/.config/systemd/user/ and /etc/systemd/system/.

LD_PRELOAD Injection

Hijack dynamic linker to inject malicious shared library

AppArmor profiles restrict library loading paths. suid_dumpable=0 prevents core dumps that reveal loaded libraries. Monitor: env | grep LD_ — should be empty.

curl/wget to attacker server

Transfer stolen files over HTTP/S

AppArmor denies curl/wget from reading ~/.ssh/, ~/.age/, ~/.secrets/, ~/.gnupg/private-keys-v1.d/, ~/.local/share/gopass/**. They can download but can’t upload your secrets.

git push to attacker remote

Push repo (containing secrets) to attacker-controlled git server

AppArmor denies git from reading age keys, gopass store, GPG private keys. Git can push repos but not secret material.

DNS exfiltration

Encode data in DNS queries

DNS restricted to your BIND servers in egress chain.

Encrypted channel (age/gpg for cover)

Use your own encryption tools to package data before exfil

AppArmor deny network on age — it cannot connect anywhere. AppArmor deny network on gopass. Even if data is encrypted, the tools can’t send it.

Steganography / covert channel

Hide data in images, protocol headers, timing

Egress logging catches unusual outbound connections. Wazuh (when enrolled) provides deeper traffic analysis.

SSH authorized_keys injection

Add attacker’s public key to ~/.ssh/authorized_keys

auditd watches authorized_keys for writes (-p wa -k authorized_keys_mod). Any modification triggers an audit event. Wazuh FIM (when enrolled) adds realtime alerting.

Backdoor shell config

Add reverse shell to .bashrc / .zshrc

Wazuh FIM (when enrolled) on home directory configs. Manual check: grep -E 'nc|ncat|bash -i|/dev/tcp' ~/.bashrc ~/.zshrc 2>/dev/null

Malicious systemd service

Install a service that starts on boot

Monitor ~/.config/systemd/user/ and /etc/systemd/system/ for new/modified units. systemctl --user list-units --type=service to audit.

Crontab entry

Schedule recurring command execution

crontab -l to audit. Wazuh can monitor crontab files.

Modified binary (trojan)

Replace a legitimate binary with a backdoor

pacman -Qkk verifies package file integrity. AppArmor profiles would still restrict what the trojan can access. auditd catches unexpected executions.

No IDS/IPS on network traffic

Wazuh agent enrollment (carryover task) adds host-based IDS. Network IDS (Suricata) would require a span port or inline deployment.

No file integrity baseline

Wazuh FIM or AIDE. auditd watches key files but doesn’t compare against a known-good baseline.

Thunderbolt DMA not fully mitigated

bolt installed but policy not configured. Carryover task.

No outbound IP restriction yet

Egress chain is in policy accept (observe). Switch to policy drop after log review (carryover task).

Docker daemon = root equivalent

Any user in docker group has root. Verify: getent group docker. Consider rootless Podman if Docker isn’t needed.

Browser as attack surface

Browsers are AppArmor profiled (Brave, Chrome, Chromium, Firefox all have profiles). Verify enforcement: sudo aa-status | grep -i brave

No network segmentation for workstation

ISE 802.1X on wired port provides network-level access control. WiFi uses WPA-Enterprise. But the workstation itself is on the data VLAN with access to all infrastructure.

SSH Hardening

PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 3, AllowAgentForwarding no, AllowUsers evanusmodestus

fail2ban

Currently failed: 0, Currently banned: 0

auditd rules

6 rules with keys: age_key_read, ssh_key_read, authorized_keys_mod, gpg_key_read

AppArmor

82+ profiles in enforce mode, 5+ in complain mode

USBGuard

Devices managed: 20+ (dock, YubiKeys, internal hardware)

nftables egress

policy accept (observe) or policy drop (enforced)

Sysctl

kptr_restrict=2, ptrace_scope=1, rp_filter=1, suid_dumpable=0, tcp_syncookies=1

GPG TTL

default-cache-ttl 900, max-cache-ttl 1800

Coredumps

Storage=none, ProcessSizeMax=0

LUKS

cryptroot (250G) and crypthome (1.6T) present

Listening Ports

Only SSH (22) on 0.0.0.0. Everything else on 127.0.0.1.

PAM wheel

auth required pam_wheel.so use_uid

securetty

securetty bytes: 0

avahi/mDNS

inactive (or not installed)

Docker group

Only expected users listed

AppArmor boot

lsm=landlock,lockdown,yama,integrity,apparmor,bpf

Kernel modules

usb-storage, firewire-core, cramfs: not loaded. thunderbolt: LOADED (pending bolt policy)

P2

AppArmor complain → enforce (gopass, curl, wget, python3, git)

□□□□□□□□□□ 0/10

P2

nftables egress — review logs, switch to policy drop

□□□□□□□□□□ 0/10

P2

Thunderbolt policy (bolt) — configure authorization

□□□□□□□□□□ 0/10

P2

Wazuh agent enrollment

□□□□□□□□□□ 0/10

P2

Age identity compartmentalization

□□□□□□□□□□ 0/10

P3

arch-audit daily timer integration

□□□□□□□□□□ 0/10

P3

Work machine deployment

□□□□□□□□□□ 0/10

Get-Process

Lists all running processes — equivalent to ps aux on Linux.

Where-Object { $_.Name -match '…​' }

Filters by Name property. -match uses regex. $_ is the current pipeline object — PowerShell’s equivalent of awk’s `$0.

Stop-Process -Force

Sends a kill signal. -Force bypasses confirmation and kills child processes — equivalent to kill -9 on Linux.

USBGuard — Samsung ADB allowed

[ ]

USBGuard — rule persisted (04e8:6860)

[ ]

ADB sees device (adb devices -l)

[ ]

P12 located or re-issued from Vault

[ ]

P12 pushed to phone via ADB

[ ]

BYOD cert installed on Android

[ ]

WiFi profile configured (EAP-TLS)

[ ]

ISE auth verified (PASSED, no failure)

[ ]

SSH to fold7 works

[ ]

domus-captures pulled

[ ]

domus-nvim pulled

[ ]

dotfiles-optimus pulled

[ ]

dots-quantum cloned

[ ]

SSH config.d/ deployed

[ ]

Include directive in ~/.ssh/config

[ ]

GitHub/GitLab/Gitea SSH verified

[ ]

~/.secrets cloned

[ ]

Dotfiles re-stowed

[ ]

gopass v3 synced + new schema visible

[ ]

yq variant confirmed

[ ]

cert-expiry-monitor

Daily 08:03

⚠️ Alerting

2 expired certs (ISE EAP-TLS 9d, Vault SSH 10d)

chla-code-alert

M-F 08:07 + 14:17

⚠️ Alerting

32 projects without PeopleSoft codes

cissp-countdown

Daily 05:30 + 20:00

✅ Healthy

51 days to exam, tier 2 messaging

daily-audit

Daily 21:07

⚠️ Alerting

17 stale .age files in mschapv2-migration

domus-health

Daily 09:00

🔧 Bug

False "missed" on 3 weekly timers

dotfiles-sync

Daily 20:30

✅ Healthy

—

education-pulse

Daily 06:00

✅ Healthy

Thu = Español — Inmersión Total

pacman-news

Daily 07:15

✅ Recovered

Failed 06-24 (transient), ok 06-25

project-stale

Mon 07:30

✅ Healthy

Ran Mon 06-22, next Mon 06-29

security-remediation

Mon 07:00

✅ Healthy

1/10 phases complete (10%)

weekly-review

Sun 19:00

✅ Healthy

221 commits last week

ISE EAP-TLS Server Cert

Expired 2026-06-16

CRITICAL — 9 days overdue

Vault SSH Signing Cert

Expired 2026-06-15

CRITICAL — 10 days overdue

ASA VPN SSL Cert

Expires 2026-07-28

WARNING — 33 days remaining

k3s cluster (k3s-master-01)

✅ HEALTHY

Single node, Rocky 9.7, v1.34.4+k3s1, 123 days uptime

k3s NAT rule 170 (10.42.0.0/16)

⚠️ WRONG SUBNET

Pod CIDR is 10.0.0.0/x (Cilium), not 10.42.0.0/16 — rule 170 targets wrong network

Wazuh pods (all 4)

✅ RUNNING

dashboard, indexer, manager-master, manager-worker — all 1/1

Wazuh indexer

✅ HEALTHY

Cluster green, 424 shards, 10,000+ alerts from modestus-p16g indexed

Wazuh agent (modestus-p16g)

✅ ACTIVE

Agent 003, connected to wazuh-workers:1514, journald + auditd + pacman collecting

Wazuh DNS

✅ FIXED

3 A records corrected on bind-01: wazuh→.133, dashboard→.137, api→.133

Wazuh dashboard

⚠️ CERT MISMATCH

Serves cert with CN=wazuh, not CN=wazuh-dashboard — Firefox blocks, IP access works

3 svclb pods

⚠️ PENDING

svclb-dashboard, svclb-prometheus-grafana, svclb-prometheus-alertmanager — MetalLB pool likely exhausted

ise-02 (kvm-02)

SHUT OFF

Replaced by ise-01; pending virsh undefine

Wazuh Manager (API, registration, syslog)

wazuh.inside.domusdigitalis.dev

55000, 1515, 514/UDP

Wazuh Indexer (OpenSearch)

wazuh-indexer.inside.domusdigitalis.dev

9200

Wazuh Dashboard

wazuh-dashboard.inside.domusdigitalis.dev

443

Wazuh Workers (agent events)

wazuh-workers.inside.domusdigitalis.dev

1514

Traefik Ingress

traefik.inside.domusdigitalis.dev

80, 443

P0

k3s cluster health check

✅ Done

P0

Wazuh stack health — pods, dashboard, indexer

✅ Done

P0

Agent connectivity — test 1515/1514 from workstation

✅ Done

P0

Wazuh DNS fix — 3 A records corrected on bind-01

✅ Done

P0

Wazuh agent enrollment — modestus-p16g (CR-2026-06-25)

✅ Done — agent 003 active, 10,000+ events indexed

P0

Wazuh API scripts — 8 gopass-backed verification tools

✅ Done — data/d000/infra/wazuh-api/

P0

k3s NAT — pod CIDR is 10.0.0.0/x not 10.42.0.0/16, rule 170 is wrong

⚠️ Needs review

P1

VM inventory verification — kvm-01 + kvm-02

[ ]

P1

ise-02 stale VM deletion

[ ]

P1

Rotate Wazuh registration password from default

[ ]

P1

Wazuh dashboard TLS cert — CN mismatch (wazuh vs wazuh-dashboard)

[ ]

P1

Wazuh alert tuning — reduce AppArmor/LSM noise (rule 80730)

[ ]

P2

k3s-master-02/03 status — confirm running or decommissioned

[ ]

P2

3 pending svclb pods — MetalLB IP pool audit

[ ]

P2

AppArmor wazuh-agentd — complain → enforce (48h observation)

[ ]

P2

Rootcheck definition files — download from Wazuh GitHub

[ ]

P2

Enroll remaining agents — kvm-01, kvm-02, bind-01, bind-02, ipa-01, vault-01

[ ]

wazuh

10.50.1.132

10.50.1.133

Manager service (55000, 1515, 514/UDP)

wazuh-dashboard

10.50.1.133

10.50.1.137

Dashboard service (443)

wazuh-api

10.50.1.134

10.50.1.133

API lives on manager, not workers

curl -sk (bypass cert verify)

SearchResult.total = 1 — ERS responds, connectivity + creds fine

openssl x509 -in $ISE_CA_CERT

Issuer=DOMUS-ROOT-CA, Subject=DOMUS-ISSUING-CA, CA:TRUE

file $ISE_CA_CERT

PEM certificate — valid format

stat $ISE_CA_CERT

Modify: 2026-02-09 — unchanged since February

curl --cacert /etc/ssl/certs/ca-certificates.crt

HTTP 301 — system CA bundle works with --cacert

curl --version

8.20.0 / OpenSSL 3.6.3

dmesg showed nothing

Explicit deny rules in AppArmor are silent — no audit log entries. Only implicit denials (missing allow rules) produce log entries.

aa-complain didn’t help

The deny keyword overrides complain mode. AppArmor design: deny means "always deny, never log." To test, you’d need to remove the deny line entirely.

Error said "trust anchors"

curl translates EACCES into its own error message. The application never sees "permission denied" — it sees "file couldn’t be loaded" and guesses it’s a cert format issue.

openssl and cat read the file fine

No AppArmor profiles on those binaries — only /usr/bin/curl is confined.

strace -e openat

The definitive diagnostic for file access failures. Shows the syscall, the path, and the kernel’s response (EACCES, ENOENT, etc.). Bypasses application-level error messages that hide the real cause.

AppArmor deny is absolute

Cannot be overridden by allow, owner, or rule ordering. This differs from firewall ACLs (order-dependent) and iptables (-j ACCEPT before -j DROP). The only way to "allow through a deny" is to remove or narrow the deny itself.

AppArmor deny is silent

Explicit deny rules produce NO audit log entries — dmesg, journalctl, aa-logprof all show nothing. Only implicit denials (missing allow rules) are logged. This makes deny rules invisible to standard AppArmor debugging tools.

deny overrides complain mode

aa-complain has no effect on deny rules. They enforce even in complain mode. To test whether a deny rule is causing a problem, you must remove the rule entirely — complain mode is not a safe test.

Granular deny > blanket deny

deny @{HOME}/.secrets/** r, is correct intent but wrong scope. Replace with specific denies per subdirectory to preserve security while allowing legitimate reads (CA certs are public trust anchors, not secrets).

Application errors lie

curl said "error adding trust anchors" — implying a cert format problem. The real cause was a kernel-level permission denial. Always verify with strace before trusting application error messages.

Security hardening breaks things

The AppArmor profile was deployed yesterday as part of a vulnerability assessment. It worked for everything except ISE API calls because the cert path was inside the denied ~/.secrets/ tree. Security changes need testing against all operational workflows, not just the obvious ones.

Model

Path-based — rules reference file paths

Label-based — rules reference security contexts (labels on files/processes)

Default stance

Permissive (allow unless denied) — profiles opt-in

Restrictive (deny unless allowed) — system-wide mandatory

deny behavior

Absolute, silent, overrides complain mode

dontaudit for silent deny, otherwise logged. Booleans can toggle allow/deny.

Debugging

aa-logprof, dmesg (only for implicit denials), strace

audit2allow, ausearch, sealert — comprehensive audit trail

Distro default

Ubuntu, SUSE, Arch (optional)

RHEL, Fedora, CentOS

Learning curve

Lower — path-based rules are intuitive

Higher — label assignment and policy modules are complex

This incident

Silent deny produced misleading curl error. strace was required.

Would have logged the denial in audit log. audit2allow would have suggested the fix.

man apparmor.d

Profile syntax — rules, file globs, deny, owner, #include, abstractions. This is the critical page. Explains why deny is absolute.

man apparmor_parser

How profiles are loaded (-a), replaced (-r), removed (-R) from the kernel. What you used to fix this incident.

man aa-status

Shows which profiles are loaded, which are enforced vs complain, which processes are confined.

man aa-complain / man aa-enforce

Toggle modes. Now you know complain mode does NOT affect deny rules — this page confirms it.

man aa-logprof

Interactive tool that reads AppArmor logs and suggests profile changes. Only works for implicit denials (logged), not explicit deny (silent).

Arch Wiki — AppArmor

Practical setup guide, Arch-specific. Covers installation, boot params, profile management, and aa-notify.

This partial

Real incident with real syscall traces, two fix attempts (failed + succeeded), and the deny vs allow precedence discovery. Better than synthetic examples.

(?=.*EAP)

Lookahead — asserts EAP exists somewhere on the line. Does NOT consume characters — the cursor stays at position 0.

(?=.*TEAP)

Second lookahead — asserts TEAP also exists. Still at position 0.

(?=.*802\.1X)

Third lookahead — asserts 802.1X also exists. \. matches literal dot.

Combined

All three must be true for the line to match. Order on the line is irrelevant — 802.1X EAP-TEAP matches the same as EAP-TEAP 802.1X.

grep -rcP '…​'

-r recursive, -c count per file, -P PCRE. Outputs filename:count for every file.

grep -v ':0$'

Remove files with zero matches. :0$ matches colon + zero + end-of-line.

sort -t: -k2 -rn

-t: split on colon. -k2 sort on second field (the count). -rn reverse numeric (highest first).

grep -rcP

Count matches per file

grep -v ':0$'

Remove zero-match files

sort -t: -k2 -rn

Rank by count descending

head -3

Take top 3 files

cut -d: -f1

Extract filename only (drop the count)

xargs grep -nP --color=always

Show the actual matching lines from those top 3 files

(?=.*X)

Positive lookahead

X exists somewhere ahead

(?!.*X)

Negative lookahead

X does NOT exist ahead

(?⇐X)

Positive lookbehind

X exists immediately before

(?<!X)

Negative lookbehind

X does NOT exist immediately before

(?:X|Y)

Non-capturing group

Groups X or Y without backreference overhead

ERS Group

Linux-Workstations (static ✅)

Workstation (dynamic — needs fix)

Custom Attributes

OS=Arch Linux, Purpose=Engineering ✅

Empty — needs fix

Description

Evan - modestus-p16g wired - Arch Linux ✅

null — needs fix

NAD

Home-3560CX-01 Gi1/0/2

Home-9800-WLC capwap_90000002

Profiler Policy

Unknown

Linux-Workstation

IP

10.50.1.203

10.50.1.204

Auth Method

dot1x / EAP-TLS / x509_PKI

dot1x / EAP-TLS / x509_PKI

Cert CN

modestus-p16g.inside.domusdigitalis.dev

modestus-p16g.inside.domusdigitalis.dev

MnT Session

null (no active session)

Stop (idle timeout, June 19)