Server Security Glossary

An A to Z index of the terms that come up most often when hardening a Linux server. Pick a term to open its full definition.

/

• /etc/passwd/etc/passwd is the Linux file listing local user accounts in seven colon-separated fields. Learn each field, UID 0, nologin shells and how to audit it.

A

• AllowUsersAllowUsers is the sshd_config directive that limits SSH login to listed user names (optionally per source host). Learn syntax, DenyUsers order and tests.
• Application-layer attack (Layer 7)A DDoS attack that targets the web application itself with requests that look legitimate, making it harder to distinguish from real traffic than a simple flood..
• auditdauditd is the Linux Audit daemon that records file changes, commands and syscalls by rule. See auditctl rules, ausearch and aureport for investigations.
• authorized_keysThe file listing which public keys are allowed to log in to a given account over SSH.

B

• Backup rule (3-2-1)The 3-2-1 rule says to keep three copies of your data, on two kinds of storage, with one copy off-site.
• Bastion hostA bastion host (jump host) is a hardened server that is the only SSH entry point to a private network. Reach internal servers with ssh -J or ProxyJump.
• BotnetA botnet is a network of hijacked devices run by one attacker through command and control. Uses, how routers get recruited, and how to check your server.
• Brute-force attackAutomatically trying many username and password combinations against a login service until one works.

C

• CISA KEV catalogThe CISA KEV catalog (Known Exploited Vulnerabilities) lists CVEs with confirmed exploitation. Free JSON and CSV feeds; due dates bind US agencies.
• ContainmentThe incident response step focused on stopping an active breach from spreading further, before trying to fully remove its underlying cause..
• CORS (cross-origin resource sharing)CORS is the HTTP-header mechanism that tells a browser which other origins may read your API. Preflight, example headers and the mistakes that weaken it.
• CVSSCVSS (Common Vulnerability Scoring System) rates a vulnerability's severity from 0.0 to 10.0, not its exploitation likelihood or your own risk.

D

• DDoS attackDistributed Denial of Service: an attempt to make a server or service unavailable by overwhelming it with traffic from many sources at once, rather than trying to break in..
• Default deny policyA firewall configuration that blocks all traffic by default and only allows specific, explicitly listed connections through.
• DIY securityHandling all server hardening, monitoring and incident response internally with existing staff and time, rather than paying for a managed service..
• Docker socketThe Docker socket (/var/run/docker.sock) is the Unix socket the Docker daemon listens on, and access to it is equivalent to root on the host.
• Docker socket proxyA Docker socket proxy sits in front of /var/run/docker.sock and passes only the API calls you allow. It narrows access but does not make the socket safe.

E

• Environment variablesEnvironment variables are named values an app reads at startup, used for config and keys. How .env files and .gitignore work, and where they leak.

F

• fail2banA widely used intrusion-prevention tool that watches log files for patterns like repeated failed logins and temporarily or permanently bans the source IP address using the server's firewall..
• FIDO2 and WebAuthnFIDO2 is an open standard for phishing-resistant login with hardware security keys; WebAuthn is its browser API. OpenSSH uses ecdsa-sk and ed25519-sk.
• File integrity monitoringContinuously checking whether files that should not change, such as system binaries or configuration files, have actually been modified..
• FirewallSoftware or hardware that controls which network traffic is allowed to reach a server, based on rules such as IP address and port.

H

• HSTSHSTS (HTTP Strict Transport Security) is the Strict-Transport-Security header that makes browsers use HTTPS only. Syntax, nginx config, rollout and risks.

I

• Incident responseThe structured process of detecting, containing, eradicating and recovering from a security incident, followed by a review of what allowed it to happen in the first place..
• Intrusion preventionSoftware that automatically detects and blocks malicious behavior, such as fail2ban banning an IP after repeated failed logins, rather than only logging it for a human to review later..
• iptablesThe original Linux firewall tool, built on the kernel's netfilter framework.

J

• Jail (fail2ban)A specific monitoring rule set inside fail2ban targeting one service, such as an sshd jail or an nginx-http-auth jail, each with its own ban conditions..
• journalctljournalctl is the command that reads the systemd journal. Filter by unit, priority and time, follow logs live, and review SSH failures, with examples.

K

• Kernel live patchingApplying security fixes to a running Linux kernel without rebooting the server, useful when scheduled downtime is difficult to arrange..
• Key-based authenticationLogging in to SSH with a cryptographic key pair instead of a password.
• known_hostsknown_hosts is the SSH client file of trusted server host keys; ssh checks each server against it to catch spoofing. Format, StrictHostKeyChecking, fixes.

L

• Least privilegeLeast privilege means giving each user and service only the minimum permissions needed for its job.
• limit_reqlimit_req is the nginx directive that caps requests per client key, such as IP, using a limit_req_zone, with burst and nodelay. Syntax, defaults and tests.
• LivepatchLivepatch is the Linux kernel facility and vendor tooling (Canonical Livepatch, kpatch) that fixes a running kernel without a reboot. Commands and limits.

M

• Managed securityA service where a third party continuously monitors, maintains and responds to security events on a server, instead of a business handling all of it in-house..
• MaxAuthTriesMaxAuthTries is the sshd_config directive that caps authentication attempts per SSH connection (default 6) before the server disconnects the client.

N

• N-day exploitAn attack against a vulnerability that is already publicly known and already has a patch available.
• nftablesThe modern replacement for iptables on Linux, part of the same netfilter framework but with cleaner syntax and better performance at scale..
• nginxA widely used web server and reverse proxy.

O

• Object LockObject Lock is the write-once-read-many (WORM) feature of Amazon S3 that stops object versions from being deleted or overwritten. Modes, setup and limits.

P

• PAMPAM (Pluggable Authentication Modules) is how Linux services like sshd, su and login check who you are. Module types, control flags, /etc/pam.d, lockouts.
• PasswordAuthenticationPasswordAuthentication is the sshd_config directive that allows or blocks SSH logins with an account password. Values: yes (default) or no.
• Patch managementThe ongoing process of tracking, testing and applying software updates that fix known security vulnerabilities, rather than updating only when something breaks..
• Patch windowA predefined, agreed time period during which updates are tested and applied to production servers, used to avoid surprise changes at unpredictable times..
• PermitRootLoginPermitRootLogin is the sshd_config directive that decides if root can log in over SSH: yes, prohibit-password (default), forced-commands-only or no.
• Prompt injectionPrompt injection tricks an AI model into obeying attacker text hidden in its input. Direct vs indirect, why AI agents are exposed, how to limit damage.
• Protocol attackA DDoS attack that exploits weaknesses in network protocols themselves, exhausting server or network equipment resources rather than raw bandwidth..

R

• RansomwareRansomware is malware that encrypts files so they become unusable, then demands payment for decryption.
• Rate limitingRestricting how many requests or connection attempts a single source can make within a given time window, used to slow down brute-force and scraping attempts without blocking legitimate users outright..
• Read-only auditA security scan that only inspects a system's current state without changing any configuration, banning IPs, or deleting anything, used to establish a baseline before any other action is taken..
• RECOVERED vs VERIFIEDA distinction where a service responding normally again after an incident is only "recovered," while "verified" additionally requires independent checks of files, services and network state to confirm the incident's actual cause was addressed..
• Reverse proxyA reverse proxy sits in front of your servers, takes client requests and forwards them. How nginx proxy_pass works, real client IP, TLS and the risks.
• Root loginLogging in directly as the root, or administrator, account over SSH.
• Row-level security (RLS)Row-level security (RLS) lets PostgreSQL decide which rows each user can read or change. Policies, default deny, Supabase examples and common mistakes.
• RPO and RTORPO (recovery point objective) is how much data you can lose; RTO (recovery time objective) is how long you can be down. Definitions and a restore test.
• rsyslogrsyslog is the Linux syslog daemon that routes log messages by facility and priority to files or servers. See rules, templates and TLS log forwarding.

S

• Secrets managementSecrets management is how you store, deliver and rotate API keys, passwords and tokens. A beginner setup: .env permissions, Compose secrets, rotation.
• Security headersHTTP response headers such as Strict-Transport-Security or X-Content-Type-Options that instruct browsers to enforce additional protections on top of whatever the server itself does..
• server_tokensAn nginx setting that, when left on, exposes the exact nginx version number in every response, giving attackers a head start on finding version-specific vulnerabilities..
• SIEMSecurity Information and Event Management: a system that centralizes and correlates log data from multiple sources, making it possible to spot patterns that would be invisible looking at any single log file alone..
• SlopsquattingSlopsquatting is registering package names that AI assistants invent, so installing them runs malware. What research found and how to vet packages.
• SQL injectionSQL injection lets attackers run their own SQL through your queries. How it happens, parameterised queries as the fix, and how to check your app.
• SSHSecure Shell, the encrypted protocol used to remotely log in to and administer a Linux server.
• SSH agent forwardingSSH agent forwarding (ssh -A, ForwardAgent) lets a remote host use your local ssh-agent keys. Off by default; risky on untrusted hosts. Safer: ProxyJump.
• SSH X11 forwardingssh -X meaning: SSH X11 forwarding shows a GUI program running on a server on your screen. -X vs -Y, and why servers should disable it.
• ssh-copy-idssh-copy-id installs your SSH public key on a server by appending it to authorized_keys, creating the file if needed. Test before disabling passwords.
• ssh-keygenssh-keygen is the OpenSSH tool that creates SSH key pairs. It defaults to Ed25519 and also prints fingerprints and removes known_hosts entries.
• sshd_configThe main configuration file for the SSH daemon on Linux, usually located at /etc/ssh/sshd_config.
• ssl_protocolsssl_protocols is the nginx directive listing the SSL/TLS versions a server accepts. The default is TLSv1.2 TLSv1.3; RFC 8996 bans TLS 1.0 and 1.1.
• sudosudo runs one command as root or another user under a policy, using your own password and logging each use. How it works, flags, caching, safe tests.
• sudoerssudoers is the policy file (/etc/sudoers, /etc/sudoers.d) saying who may run which commands via sudo. Rule syntax, NOPASSWD, aliases, visudo.
• SYN floodA SYN flood is a TCP denial-of-service attack that fills a server's half-open connection queue. How it works, how to spot it on Linux, and what stops it.

T

• TLS / SSLThe cryptographic protocols that encrypt traffic between a browser and a server.
• TOTPTOTP (Time-based One-Time Password, RFC 6238) is the short code that changes every 30 seconds. How it works, SSH setup via PAM, clock drift and limits.
• Two-factor authentication (2FA)Two-factor authentication requires a second proof of identity in addition to a password or key at login.

U

• ufw (Uncomplicated Firewall)A simplified frontend for iptables aimed at making common firewall rules easy to write correctly.
• UID 0Any Linux account with user ID 0 has exactly the same privileges as root, regardless of its username.
• unattended-upgradesA Debian and Ubuntu package that automatically installs security updates on a schedule, without requiring someone to log in and run the update manually..

V

• Vibe codingVibe coding is building software by prompting an AI and accepting its code without reading it. Origin, the security risks and how to ship safely.
• Volumetric attackA DDoS attack that simply floods a target with more traffic than its network connection can handle..
• VPS (Virtual Private Server)A virtual machine rented from a hosting provider that gives full administrative control over the operating system, meaning all security configuration is the renter's own responsibility from day one..

W

• WAF (Web Application Firewall)A layer that inspects HTTP requests for attack patterns like SQL injection before they reach the application itself, complementing rather than replacing server hardening..

Z

• Zero-day exploitAn attack that uses a vulnerability the software vendor does not yet know about, so no patch exists yet.