SSH

Require FIDO2 SSH keys (ed25519-sk) with PIN and touch on Debian 13: verify-required in sshd, sk-only algorithms, a backup key and lockout-safe tests.

How root on a jump host hijacks a forwarded SSH agent socket, how to spot it with ss and lsof, and how to stop SSH agent forwarding abuse on Debian 13.

Fix SSH Permission denied (publickey) on Debian 13 by reading sshd's journal reason: StrictModes, key types, AllowUsers, drop-ins and ssh.socket.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.

Hardening SSH on Debian 13 (trixie): a practical sshd_config drop-in for OpenSSH 10.0, key-only logins, post-quantum KEX, rate limits and open CVEs.