Infrastructure-Security on krash.dev

DNS Over HTTPS (DoH): What, Why, and How It Works

Tue, 23 Jun 2026 00:00:00 +0000

You’re at a coffee shop. You join the free Wi-Fi, type bank.example.com, and start checking your balance. The connection to your bank is locked behind that reassuring little padlock — TLS, encrypted, private.

Except the question you asked first wasn’t private at all.

Before your browser could open that encrypted tunnel, it had to ask a simple question:

“What’s the IP address for bank.example.com?”

That question — a DNS lookup — left your laptop unencrypted, in a 40-year-old format (RFC 1035 ), for anyone on that Wi-Fi (and your ISP, and a few hops in between) to read, log, or quietly change.

Production Grade Bash Scripts

Wed, 16 Apr 2025 00:00:00 +0000

Most shell scripts start innocent, just a few lines to glue things together. Blink twice, and it’s deploying infrastructure, rotating secrets, restarting servers, and possibly provisioning a small nation-state. It’s doing things for the people, by the people, held together by echo.

This isn’t another “bash scripting 101” tutorial. You already know how to loop over a list and grep things. This is about writing scripts that survive real-world conditions: bad input, missing dependencies, flaky networks, and humans.

Kubernetes Components

Sun, 18 Jun 2023 00:00:00 +0000

In this blog post, we are going to talk about different components used in Kubernetes and what purpose each component serve. We will be talking about the following -

Pods
Service
Ingress
ConfigMap
Secret
Deployment
StatefulSet
ReplicaSet
DaemonSet

Use-case that will be used througout the blog will be hosting a web application with application code and database in different pods.

Before starting this blog, if you want to learn about the underlying concepts - Read “Kubernetes Concept ”

Docker Security

Thu, 02 Feb 2023 00:00:00 +0000

Last Updated on 2nd Feb 2023.

Containers?#

Why do we need containers over VMs -

Efficient Resource Consumption between containers
Once License for services/OS
Low Compute Overhead

What does docker engine does?

Emulates Filesystem
Gives each container unique process ID
Isolation of container process

Communication between the architecture components -

Components
- Docker client (The one user interacts with)
- Docker Host
  - Docker Daemon
  - Images
  - Containers
- Registry
Docker client using serveral API calls sends the commands to Docker Engine which is being forwarded to containerd.
Commuication between docker daemon and containerd is facilated through gRPC calls.
Docker Client communicates with the Docker Daemon through a domain socket (if local) and through a TCP Socket (if remote).

What does runc do?

Zone Identifier - Is your file downloaded from the internet?

Thu, 06 Oct 2022 00:00:00 +0000

Have you ever wondered, why your file is not working after downloading it from the internet? How does system know if the file is downloaded from the internet?

The answers to this is Zone.Identifiers.

What are Zone Identifiers?#

Zone Identifiers is an alternate data stream that points, from where the file came on the users’ computer.

Note: Alternate Data Streams are included with files on WIndows. This is typically the case with downloaded and blocked files.

Understanding DKIM - Email Security Series

Tue, 26 Jul 2022 00:00:00 +0000

DKIM is a technological advancement in the field of email security. SPF prevents non-authorized servers from sending emails, but it does not prevent all attempts at spoofing. This is where our next level of security comes into play.

DKIM or Domain Keys Identified Mail aids to the security of the email as it adds a digital signature to every outgoing message, allowing receiving servers to verify that the message came from your organization. It ensures that the content of the email remains untampered/compromised and can be trusted.

Understanding SPF - Email Security Series

Mon, 25 Jul 2022 00:00:00 +0000

Sender Policy Framework or SPF is an email authentication platform. It helps in specifying who is allowed to send emails from your domain. Making it harder for fraudsters to spoof sender information.

Note

RFC 7208 - https://datatracker.ietf.org/doc/html/rfc7208

SPF Records are used to specify the origin of the email to the world. It can be considered as a public list that specifies where an email is sent from.

How does SPF records look like?#

SPF is configured and managed as a TXT record inside the DNS server your domain uses.

Linux - Command Line Struggles

Mon, 04 Jul 2022 00:00:00 +0000

Configure Network Using `ip` Command in Ubuntu Server#

Temporary Method -

 bash
 
 
$ ip a # to get the interface name after connecting LAN
$ sudo ip a add 192.168.1.8/24 dev <network-interface-name>
$ ip link set dev <network-interface-name> up
$ sudo ip route add default via 192.168.1.1

Permanent Solution - Ref: https://netplan.io/examples/

Kubernetes Concept

Mon, 17 Jan 2022 00:00:00 +0000

I have been wanting to learn about ~~kubernetes~~ k8s since long, and create this blog series. Here we are finally started (thanks to null cloud security study group ), so without wasting too much time let’s get started. I am learning this having a security mindset, to find common misconfigurations and understand the development process to understand the mitigation.

K8s is a container orchestrator. Before diving too much into the depth let’s see what orchestrators/orchestrations are.

Infrastructure-Security on krash.dev

DNS Over HTTPS (DoH): What, Why, and How It Works

Production Grade Bash Scripts

Kubernetes Components

Docker Security

Containers?#

Zone Identifier - Is your file downloaded from the internet?

What are Zone Identifiers?#

Understanding DKIM - Email Security Series

Understanding SPF - Email Security Series

How does SPF records look like?#

Linux - Command Line Struggles

Configure Network Using ip Command in Ubuntu Server#

Kubernetes Concept

Configure Network Using `ip` Command in Ubuntu Server#