Linux Security

Trivy on Debian 13: verify the binary with cosign after the v0.69.4 compromise, scan images, filesystems and configs, and cut Debian no-dsa noise.

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.

How root on a jump host hijacks a forwarded SSH agent socket, how to spot it with ss and lsof, and how to stop SSH agent forwarding abuse on Debian 13.

Set up AIDE file integrity monitoring on Debian 13: baseline, dailyaidecheck timer, noise tuning, off-host database protection and alert triage.

How attackers turn an exposed Redis or Valkey instance into root-level RCE and cron persistence, and how to detect and lock it down on Debian 13.

How container escapes work via the 2025 runc procfs bugs, and how to audit and harden a Debian 13 Docker or Podman host with checks you can verify.