Linux Security

Set up restic backups on Debian 13: SFTP or S3 repos, a sandboxed systemd timer, forget --prune retention, append-only rest-server and restore tests.

How container escapes work via the 2025 runc procfs bugs, and how to audit and harden a Debian 13 Docker or Podman host with checks you can verify.

Debian 13 fixes BIND9 and Unbound flaws (DSA-6505-1, DSA-6507-1): how to check versions, patch, restart and verify your recursive DNS resolver.

Sandbox systemd services on Debian 13: score units with systemd-analyze security, harden nginx via a systemd drop-in, then debug whatever breaks.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.

Hardening SSH on Debian 13 (trixie): a practical sshd_config drop-in for OpenSSH 10.0, key-only logins, post-quantum KEX, rate limits and open CVEs.