0x0.fail – Linux, server administration and security

Automate Let's Encrypt on Debian 13 with certbot: timer, nginx deploy hook, OnFailure alerts, expiry checks and prep for 64- and 45-day certificates.

Fix nginx 502 Bad Gateway with PHP-FPM 8.4 on Debian 13: map errno 13, 2, 111 and 110 in error.log to their cause, with namei, ss and cgi-fcgi checks.

Set up a locked-down WireGuard VPN on Debian 13: wg-quick, PresharedKey, default-drop nftables NAT, split tunnel, leak tests and handshake troubleshooting.

Set up AIDE file integrity monitoring on Debian 13: baseline, dailyaidecheck timer, noise tuning, off-host database protection and alert triage.

How attackers turn an exposed Redis or Valkey instance into root-level RCE and cron persistence, and how to detect and lock it down on Debian 13.

DSA-6514-1 fixes 10 PHP 8.4 CVEs on Debian 13. Check for 8.4.26-1~deb13u1, restart PHP-FPM or Apache mod_php, and verify the running binary.

Fix SSH Permission denied (publickey) on Debian 13 by reading sshd's journal reason: StrictModes, key types, AllowUsers, drop-ins and ssh.socket.

Set up restic backups on Debian 13: SFTP or S3 repos, a sandboxed systemd timer, forget --prune retention, append-only rest-server and restore tests.

How container escapes work via the 2025 runc procfs bugs, and how to audit and harden a Debian 13 Docker or Podman host with checks you can verify.

Debian 13 fixes BIND9 and Unbound flaws (DSA-6505-1, DSA-6507-1): how to check versions, patch, restart and verify your recursive DNS resolver.