DIY · stuck right now

The page you want when the server says no

One error message per card. The command that fixes it sits at the top, before any explanation. Then why it happened, what it means if it did not work, and one command to confirm you are done. Everything is measured on a real machine, nothing is copied from a wiki.

01. How a card is built

The verdict, in two lines: what the message actually means.
The command that fixes it, at the top of the page.
Why it happens: the mechanism, not a workaround.
If that did not fix it: the two or three deeper cases.
Check it worked: one command, one expected output.

Every command sits in a block like this one. The copy button takes the command only: no dollar sign, no line numbers, no example output. What you paste into your terminal runs as is.

These commands are provided as is, without warranty. Test on a non critical machine or a snapshot first.

bash

$ sudo journalctl -u ssh --since "2026-08-01" --no-pager | grep -c "Failed password"

output

1234

02. The guides

Lynis AUTH-9230 “Configure password hashing rounds” Lynis asks for hashing rounds Debian 13 does not use. The test never reads ENCRYPT_METHOD. What we measured, and how to judge any suggestion yourself. lynis · attack surface fail2ban says the IP is banned but it still connects Your jail lists the attacker as banned and the attacker keeps connecting. The ban is real, it just closes port 22 while your SSH listens somewhere else. What we measured, and the fix. fail2ban · attack surface apt autoremove took my display stack It removes what no installed package requires, not what you use. The real security gain, the black screen 26 minutes later, and the dry run that catches it. apt · attack surface ufw “RULE_APPEND failed” but the status still says active The chains were created, the rules never reached the kernel, and the status screen reports green anyway. The three causes, and the count that settles it. ufw · attack surface wg-quick says active and there is no interface A oneshot service reports the fate of its command, never the state of the tunnel. Why the kernel is the only judge — and why the same green does not survive a reboot. wireguard · systemd A process was killed and dmesg says nothing The kernel log records the kernel’s decisions, and a userspace daemon got there first. Forty-five kills in seven days, and the option that reverses which process dies. memory · systemd kdevtmpfsi or xmrig is eating the whole CPU The name in ps is chosen by whoever dropped the file; /proc/PID/exe names the real one. Where it lands, what keeps restarting it, and the mount options that stop it running at all. miner · attack surface ufw is inactive after a reboot Two switches carry the word enabled, and systemctl reads only one of them. The package flips that one for you at install time, which is why the usual advice changes nothing. boot · systemd A systemd service runs as root and gets “Permission denied” Hardening takes away root’s capabilities, or root’s view of the UID that owns the files, and both print the same sentence. A third directive prints nothing at all and returns success. What we measured, and how to tell them apart. systemd · permissions “Failed to enable unit: Cannot alias” but the service is enabled anyway enable creates the symlink, then reports failure, skips the list of what it created and skips the reload. The exit code, is-enabled and the running systemd disagree until the next reboot. What we measured, and the fix. systemd · raspberry pi update-ca-certificates says “0 added, 0 removed” and you can’t tell if it worked It counts symlinks, not certificates: the same line for a certificate already installed and for one never looked at, and 1 added can come out for one that is not usable. What we measured, the test that tells them apart, and the fixes. openssl · debian 13 apt-key is gone in Debian 13 and you need to list your keys gpg --show-keys lists what sits in trusted.gpg.d, not which repo each key can sign. A repo with no Signed-By, or with the empty one apt modernize-sources can write, accepts any of them. What we measured, and a script that answers per repo. apt · debian 13 Raspberry Pi 5 says “NTP service: active” but the clock is wrong NTP service: active means the service runs, not that it got the time. Without a battery the clock stops while unplugged and restarts from the last time saved on the card. What we measured, and three read-only commands that tell network from clock. timesyncd · raspberry pi 5 “Unit sshd.service not found” but SSH still answers On Debian and Ubuntu the service is ssh.service. sshd.service is only an alias link that enable creates and disable removes, and on Ubuntu 24.04, per the package script, SSH starts by socket without it. What we measured, and the real name to reload. openssh · systemd wpa_supplicant.conf on a Trixie card, and the headless Pi never shows up on the network On Trixie the Wi-Fi of the first boot comes from cloud-init's network-config, and wpa_supplicant.conf is read by nothing. The radio is also born blocked. What we measured on a Pi Zero 2 W, and the files that worked. cloud-init · netplan

03. Already covered on the blog

“UFW is not installed” Debian 13 ships nftables. Your audit tool is describing itself, not your server. firewall Locked out over SSH The five ways people lock themselves out, and the habit that makes each survivable. ssh Everything green, still exposed Five checks that reported success while the machine was open. audit Hardening index will not move What actually raises a Lynis score, and what only looks like it does. lynis

The long-form blog

Cards are short and surgical. The blog takes the same subjects apart at length, with the measurements behind them.