0x0.fail – Linux, server administration and security

squid DSA-6606-1 fixes request smuggling, buffer overflow and FTP injection on Debian 13. Check exposure, patch to 6.13-2+deb13u4 and verify the binary.

Lock down PostgreSQL 17 on Debian 13: listen addresses, scram-sha-256, a minimal pg_hba.conf, TLS with certbot, least-privilege roles and a tested restore.

Fix systemd 'start request repeated too quickly' on Debian 13: map 203/EXEC, 217/USER and 226/NAMESPACE to the real cause instead of raising the limit.

Trivy on Debian 13: verify the binary with cosign after the v0.69.4 compromise, scan images, filesystems and configs, and cut Debian no-dsa noise.

How a DNS hijack lets attackers pass ACME validation and get rogue TLS certificates, and how to limit it with CAA accounturi, CT diffs and DNSSEC.

libexpat DSA-6566-1 fixes six CVEs on Debian 13. Upgrade to 2.9.0-1~deb13u1, restart processes still using the old library and find bundled copies.

Set up DKIM, SPF and DMARC for Postfix on Debian 13 with opendkim, selector rotation, a staged DMARC rollout and checks with swaks and opendkim-testkey.

Fix curl (60) unable to get local issuer certificate on Debian 13: find out if the server chain, client trust store, clock or a proxy is at fault.

Set up smartd on Debian 13 to catch failing SATA and NVMe drives: read smartctl output, schedule self-tests, and prove that alert mail actually arrives.

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.