0x0.fail – Linux, server administration and security

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

Fix Postfix Relay access denied, deferred port 25 timeouts, Domain not found and SASL failures on Debian 13, with diagnostic commands and an open-relay test.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.

Debian DSA-6527-1 fixes 33 rsync CVEs in Debian 13. Check if rsyncd or rsync over SSH is exposed, patch to 3.5.0, verify and test backup jobs.

How root on a jump host hijacks a forwarded SSH agent socket, how to spot it with ss and lsof, and how to stop SSH agent forwarding abuse on Debian 13.

Automate Let's Encrypt on Debian 13 with certbot: timer, nginx deploy hook, OnFailure alerts, expiry checks and prep for 64- and 45-day certificates.

Fix nginx 502 Bad Gateway with PHP-FPM 8.4 on Debian 13: map errno 13, 2, 111 and 110 in error.log to their cause, with namei, ss and cgi-fcgi checks.

Set up a locked-down WireGuard VPN on Debian 13: wg-quick, PresharedKey, default-drop nftables NAT, split tunnel, leak tests and handshake troubleshooting.

Set up AIDE file integrity monitoring on Debian 13: baseline, dailyaidecheck timer, noise tuning, off-host database protection and alert triage.

How attackers turn an exposed Redis or Valkey instance into root-level RCE and cron persistence, and how to detect and lock it down on Debian 13.