How it works. Then how you do it.
First principles, then the command or the control. Not a dump of vendor docs.
15 guides
SSH keys
A public key is a lock. The private key is the only thing that opens it. The private file stays on your machine.
SSH login
The server already has your public key. The client proves it still holds the private file. Password login is a different, weaker proof.
TLS certificates
A certificate is not a padlock icon. It is a signed statement that this public key belongs to this name, from a CA the client already trusts.
Certificate signing request
A CSR is a public request: bind these names to this public key. The private key never leaves the machine that made it. The CA answers with a certificate.
Multi-factor authentication
A password is something you know. MFA adds something you have. Phishing-resistant is a hardware key or a passkey. SMS is still better than a password alone.
Secrets
A key, a token, a password, a cookie that still works: anything that lets a holder in. Where you put it is the control. Git and chat are how it leaks.
Patching
The hole is open until you close it. Internet-facing and known-exploited go first. A quarterly window is a preference the attacker does not share.
Backups
3-2-1 is the shape of the copies. The control is a restore you have actually done. A job that writes to a NAS with the same admin as production is not off-site.
Least privilege
Standing admin is a standing blast radius. People get a role for a job, for a time, logged. Break-glass is sealed. The same rule applies to APIs, CI, and cloud roles.
Firewalls
A packet that is not permitted does not enter. Host firewall and network firewall are the same idea at two places. 22, 80, and 443 are an example of an allow-list, not a universal rule.
Logging
A log is a contemporaneous record of what happened. Keep auth, admin, backups, and mail. Sync the clocks. Copy off the host or it is not evidence.
Email authentication
SPF lists who may send. DKIM signs the message. DMARC is the policy when those fail. p=none forever is observation, not a policy.
Disk encryption
At rest is the disk. In transit is the path. Full-disk (FileVault, BitLocker, LUKS) protects a machine that left the building. It does not hide data from the running OS.
Offboarding
On the last day you kill the account, the tokens, and the keys. Shared logins are the failure mode: you cannot revoke one person.
Vendor access
Third parties with admin are still your admin. Unique credentials, time-boxed, logged, MFA. You can hire the hands. You cannot hire away the accountability.