0x0.fail – Linux, server administration and security

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.

Debian DSA-6549-1 fixes an LZMA1 decoder memory write in xz-utils on Debian 13. Check liblzma5, update to 5.8.1-1+deb13u2 and restart affected services.

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Fix MariaDB ERROR 2002 on Debian 13: tell a stopped server from a socket path mismatch or unix_socket root auth, with diagnostics for MariaDB 11.8.

Podman Quadlet on Debian 13: run hardened rootless containers as systemd units with podman 5.4.2, auto-updates, secrets, generator dry-run and pitfalls.

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

OpenSSL DSA-6531-1 fixes 13 CVEs on Debian 13. Check libssl3t64 against 3.5.7-1~deb13u3, restart daemons using the old library and verify the fix.

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

Fix Postfix Relay access denied, deferred port 25 timeouts, Domain not found and SASL failures on Debian 13, with diagnostic commands and an open-relay test.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.