0x0.fail – Linux, server administration and security

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Fix MariaDB ERROR 2002 on Debian 13: tell a stopped server from a socket path mismatch or unix_socket root auth, with diagnostics for MariaDB 11.8.

Podman Quadlet on Debian 13: run hardened rootless containers as systemd units with podman 5.4.2, auto-updates, secrets, generator dry-run and pitfalls.

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

OpenSSL DSA-6531-1 fixes 13 CVEs on Debian 13. Check libssl3t64 against 3.5.7-1~deb13u3, restart daemons using the old library and verify the fix.

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

Fix Postfix Relay access denied, deferred port 25 timeouts, Domain not found and SASL failures on Debian 13, with diagnostic commands and an open-relay test.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.

Debian DSA-6527-1 fixes 33 rsync CVEs in Debian 13. Check if rsyncd or rsync over SSH is exposed, patch to 3.5.0, verify and test backup jobs.

How root on a jump host hijacks a forwarded SSH agent socket, how to spot it with ss and lsof, and how to stop SSH agent forwarding abuse on Debian 13.