Server Hardening

How container escapes work via the 2025 runc procfs bugs, and how to audit and harden a Debian 13 Docker or Podman host with checks you can verify.

Sandbox systemd services on Debian 13: score units with systemd-analyze security, harden nginx via a systemd drop-in, then debug whatever breaks.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.

Hardening SSH on Debian 13 (trixie): a practical sshd_config drop-in for OpenSSH 10.0, key-only logins, post-quantum KEX, rate limits and open CVEs.

Run a secure web server: understand every config change, start from proven defaults, patch regularly and keep learning as new threats and exploits appear.