0x0.fail – Linux, server administration and security

DSA-6514-1 fixes 10 PHP 8.4 CVEs on Debian 13. Check for 8.4.26-1~deb13u1, restart PHP-FPM or Apache mod_php, and verify the running binary.

Fix SSH Permission denied (publickey) on Debian 13 by reading sshd's journal reason: StrictModes, key types, AllowUsers, drop-ins and ssh.socket.

Set up restic backups on Debian 13: SFTP or S3 repos, a sandboxed systemd timer, forget --prune retention, append-only rest-server and restore tests.

How container escapes work via the 2025 runc procfs bugs, and how to audit and harden a Debian 13 Docker or Podman host with checks you can verify.

Debian 13 fixes BIND9 and Unbound flaws (DSA-6505-1, DSA-6507-1): how to check versions, patch, restart and verify your recursive DNS resolver.

No space left on device but df shows free space? Debug exhausted inodes, deleted files held open by processes and a bloated systemd journal on Debian 13.

Sandbox systemd services on Debian 13: score units with systemd-analyze security, harden nginx via a systemd drop-in, then debug whatever breaks.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.

Hardening SSH on Debian 13 (trixie): a practical sshd_config drop-in for OpenSSH 10.0, key-only logins, post-quantum KEX, rate limits and open CVEs.