Rich Gibbs
Practical, opinionated notes on Linux server security, AWS hygiene, and indie-founder operations from Rich Gibbs.
-
Four Silent Days, One Retracted Theory
A honeypot sensor stopped capturing for four days while Docker kept reporting it healthy. The database timestamp caught it, the thread state explained it, and the root cause I wrote down afterward turned out to be wrong the very next day.
-
Staging the VLAN Move: Four Silent Failures I Caught Before Cutover
Notes from a staging session for moving a Proxmox host and two VMs onto a routed VLAN segment: a three-layer DNS trap, a months-old typo, and why none of it would have looked like itself after the fact.
-
Isolation Stopped Being an Accident
A lab VLAN was only isolated because the switch couldn't route between segments. Once it could, I had to write that isolation down as a real ACL — and hit a firmware dead-end on the way.
-
Verify Before You Conclude
Splitting an attacker count by behavior instead of raw volume cuts the headline number down by roughly seven times, and the same session catches a legitimate security vendor almost mislabeled as an attacker plus two generic-string matches mistaken for real findings.
-
Three Honeypot Fixes, and the One I Had to Leave Open
Notes from a remediation session on four sensor defects an earlier analysis had found: a NAT redirect that was blinding source attribution, a commented-out download limit, a fingerprint mismatch, and an SSH auth bypass I diagnosed but didn't close.
-
Check the sensor before trusting the count
Notes to myself on sensor-created connections, permissive logins, misleading liveness checks and evidence hidden outside structured tables.
-
Check the repeater uplink, not just the laptop
A Beryl band switch improved measured throughput, but a timeout, a wrong client network and a stale interface made verification confusing.
-
The lockout wasn't my change, and the real problem was worse
An abuse report I couldn't wave off, an audit that turned up two unrelated real problems, and a lockout that came from an unattended reboot rather than the hardening I had just applied.
-
Capturing a loader is not capturing its next stage
A real multi-architecture IoT bot loader landed on the Cowrie honeypot's telnet listener on 2026-09-09. The log looked like a complete infection. The second-stage binary was never actually fetched.
-
The full disk behind a misleading traceback
A Cowrie traceback looked like a code bug. It wasn't. The root filesystem was full, the real sink was one unrotated debug log, and the fix needed a look at eight days of honeypot capture data before anything got truncated.