Server Hardening

Lock down PostgreSQL 17 on Debian 13: listen addresses, scram-sha-256, a minimal pg_hba.conf, TLS with certbot, least-privilege roles and a tested restore.

How a DNS hijack lets attackers pass ACME validation and get rogue TLS certificates, and how to limit it with CAA accounturi, CT diffs and DNSSEC.

Set up DKIM, SPF and DMARC for Postfix on Debian 13 with opendkim, selector rotation, a staged DMARC rollout and checks with swaks and opendkim-testkey.

How SMTP smuggling abuses bare-LF end-of-data handling to pass SPF, and how to detect and block it in Postfix on Debian 13 with a self-test.

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

Podman Quadlet on Debian 13: run hardened rootless containers as systemd units with podman 5.4.2, auto-updates, secrets, generator dry-run and pitfalls.

Find Linux persistence on Debian 13: malicious systemd generators, /etc/ld.so.preload, LD_PRELOAD and unpackaged units, with dpkg, debsums and auditd.

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

Fix Postfix Relay access denied, deferred port 25 timeouts, Domain not found and SASL failures on Debian 13, with diagnostic commands and an open-relay test.

auditd on Debian 13 (audit 4.0.2): a small rule set for identity, sudo, SSH, cron and module events, ausearch triage and disk-safe log tuning.