Hello,
Out of the bugs updated this Wednesday, two stood out and caught my attention:
The reporter recommends enabling several systemd security and performance features for the Nginx service, for example:
PrivateTmp=true
NonBlocking=yes
ProtectSystem=full
ProtectHome=no
PrivateDevices=true
LimitNOFILE=65535
Because this modification could potentially disrupt the Nginx service, we need to approach it mindfully. We must conduct a proper impact analysis and rigorous testing before moving forward.
I add this to server triage discuss set.
Starting with OpenSSH 10.1p1, a strict username consistency check was introduced into its PAM authentication mechanism. This security change enforces that the username returned by PAM after authentication must exactly match the username initially provided by the user when initiating the SSH connection.
I add server-todo tag to put the bug in our backlog
Github
Discourse
Discourse (0 topics)