Linux Security

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.

Debian DSA-6549-1 fixes an LZMA1 decoder memory write in xz-utils on Debian 13. Check liblzma5, update to 5.8.1-1+deb13u2 and restart affected services.

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Podman Quadlet on Debian 13: run hardened rootless containers as systemd units with podman 5.4.2, auto-updates, secrets, generator dry-run and pitfalls.

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.

How root on a jump host hijacks a forwarded SSH agent socket, how to spot it with ss and lsof, and how to stop SSH agent forwarding abuse on Debian 13.

Set up a locked-down WireGuard VPN on Debian 13: wg-quick, PresharedKey, default-drop nftables NAT, split tunnel, leak tests and handshake troubleshooting.

Set up AIDE file integrity monitoring on Debian 13: baseline, dailyaidecheck timer, noise tuning, off-host database protection and alert triage.