0x0.fail – Linux, server administration and security

Trivy on Debian 13: verify the binary with cosign after the v0.69.4 compromise, scan images, filesystems and configs, and cut Debian no-dsa noise.

How a DNS hijack lets attackers pass ACME validation and get rogue TLS certificates, and how to limit it with CAA accounturi, CT diffs and DNSSEC.

libexpat DSA-6566-1 fixes six CVEs on Debian 13. Upgrade to 2.9.0-1~deb13u1, restart processes still using the old library and find bundled copies.

Set up DKIM, SPF and DMARC for Postfix on Debian 13 with opendkim, selector rotation, a staged DMARC rollout and checks with swaks and opendkim-testkey.

Fix curl (60) unable to get local issuer certificate on Debian 13: find out if the server chain, client trust store, clock or a proxy is at fault.

Set up smartd on Debian 13 to catch failing SATA and NVMe drives: read smartctl output, schedule self-tests, and prove that alert mail actually arrives.

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.

Debian DSA-6549-1 fixes an LZMA1 decoder memory write in xz-utils on Debian 13. Check liblzma5, update to 5.8.1-1+deb13u2 and restart affected services.

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Fix MariaDB ERROR 2002 on Debian 13: tell a stopped server from a socket path mismatch or unix_socket root auth, with diagnostics for MariaDB 11.8.