Intrusion Detection

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.

Set up AIDE file integrity monitoring on Debian 13: baseline, dailyaidecheck timer, noise tuning, off-host database protection and alert triage.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.