Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 15 articles for you...
77
security advisoryincident responsemail serverMaintaining DKIM Integrity for Linux-Based Email Servers in Operation
If you run Postfix, Exim, or OpenSMTPD on Linux, DKIM is already your problem. The private key lives on your box. If that key leaks or signing stops, your domain reputation moves without you. . You usually notice it in logs first. Bounces increase, DMARC reports show drift, or a partner says your mail failed authentication even though nothing “changed”. Something always changed. Where DKIM Actually Lives on a Linux System On most Linux deployments, DKIM signing runs through: Postfix + OpenDKIM Postfix + Rspamd Exim with DKIM built in Containerized MTAs with keys mounted as volumes The private keys are typically stored under paths like: /etc/opendkim/keys/example.com/ /var/lib/rspamd/dkim/ If those files are readable by the wrong account, an attacker does not need to spoof your domain. They can sign mail as you and pass authentication checks downstream. That is harder to detect and far more damaging over time. You start to see it during incident response. Phishing emails that pass DKIM and DMARC because the signing key was taken from a compromised host. What DKIM Failure Looks Like in Production It rarely announces itself clearly. You might see: dkim=none in headers after a package update dkim=fail after rotating a selector Postfix logging milter connection errors OpenDKIM running but not signing specific domains Mail still flows. That is the problem. Misconfigurations and alignment failures can persist unnoticed in complex environments. Regularly reviewing DMARC settings helps ensure that authentication issues are detected early and that policies are consistently enforced across all sending systems. When signing stops, DMARC enforcement weakens. If your policy is set to quarantine or reject, failure rates climb. If your policy is relaxed, spoofed mail starts slipping through because there is no valid signature to evaluate. Linux admins usually trace this through logs, not dashboards. Checking DKIM from a LinuxShell You do not need a web tool to confirm whether DKIM is visible. Start local. Check the DNS TXT record dig +short TXT selector1._domainkey.example.com You are looking for a complete public key string. If it is truncated, split incorrectly, or missing, validation will fail regardless of what your mail server is doing. After publishing or modifying a record, confirm global visibility using a DNS propagation tester . If DNS has not propagated, signing validation will fail outside your resolver even if it works locally. Validate the key against DNS opendkim-testkey -d example.com -s selector1 -vvv If you see “key OK”, DNS and your local configuration align. If not, the selector, domain, or key file does not match what is published. Mismatch between DNS and the private key is one of the most common causes of silent DKIM failure. Confirm the Server Is Actually Signing Mail DKIM configured is not the same as DKIM signing. Send a message from the server to a mailbox you control. Then inspect full headers and look for: dkim=pass If you see: dkim=none The message was not signed at all. If you see: dkim=fail The signature did not validate against DNS. Now check the local side. OpenDKIM service status systemctl status opendkim journalctl -u opendkim --since "1 hour ago" Postfix milter configuration postconf | grep -i milter If the Milter socket path changed or permissions shifted after an update, Postfix may be sending mail without passing it through the signing service. It does not always fail loudly. You start noticing it only after external reports show authentication drift. File Permissions and Key Exposure DKIM private keys should be treated like TLS private keys. Same risk profile. Check ownership and permissions: ls -l /etc/opendkim/keys/example.com/ Typical hardened setup: Owned by root Group set to the mail signing service account Permissions 0640 or stricter No world-readablekeys If a private DKIM key is readable by a compromised web user or container runtime account, an attacker can extract it and sign mail elsewhere. That bypasses simple spoof detection because the signature is valid. This is where DKIM moves from deliverability control to more of a Linux security issue. Selector Rotation and Drift Many teams generate a selector once and never rotate it. Years pass. The same key signs everything. Key rotation should follow the same operational pattern as certificate rotation: Generate a new key pair Publish a new selector in DNS Update the mail server to use the new selector Confirm signing and validation Retire the old selector If rotation is incomplete, you will see dkim=fail for one path and dkim=pass for another. That usually means multiple outbound systems are not aligned. Third-party senders are frequent offenders. Marketing platforms and ticketing systems often require their own DKIM configuration. If they are not aligned with your DNS records, DMARC alignment fails even though your primary Linux host is configured correctly. Containerized Mail and Hidden Risks In container deployments, DKIM keys are often mounted as volumes or baked into images. The second approach is risky. If private keys are embedded in container images: Anyone with registry access can extract them Rotating keys becomes operationally complex Old images may still contain valid signing material Mounting keys from a secured host path is safer, but permissions still matter. Containers run as specific UIDs. If that UID can read more than it should, the key exposure risk expands quietly. It usually surfaces during a breach review, not during setup. What to Watch in Logs Over Time DKIM problems are often slow drift issues. Patterns worth watching: Sudden increase in dkim=fail results Outbound mail without a DKIM-Signature header Milter timeouts in Postfix logs DNS lookup failures for selector records Theseare not noisy events. They blend into normal mail traffic unless someone is reviewing authentication headers or DMARC aggregate reports regularly. You start to see the pattern once you correlate bounce reports with log timestamps. Closing Perspective DKIM on Linux is not abstract email theory. It is a signing service running on your server, using private keys stored on disk, wired into your MTA through sockets and permissions. If the service stops, mail degrades quietly. If the key leaks, attackers inherit your domain identity. Most of the time, it works, and nobody thinks about it. Until a small config change, a package update, or a permissions shift introduces a gap that only shows up once external systems start rejecting your mail. That is usually when someone finally runs dig , checks headers, and traces it back to the Linux host where the key has been sitting all along. . Understand how DKIM impacts Linux mail servers, what to check, and how to ensure your keys are secure and functioning properly.. DKIM security email authentication Linux administration mail servers. . MaK Ulac
Feb 16, 2026
•
Server Security
210
security advisorycriticalremote code executionExim: Major Security Flaws Prompt RCE And Privilege Escalation
A set of dangerous vulnerabilities have been discovered in the Exim mail server. Remote code execution, privilege escalation to root and lateral movement through a victim’s environment are all on offer for the unpatched or unaware. . A veritable cornucopia of security vulnerabilities in the Exim mail server have been uncovered, some of which could be chained together for unauthenticated remote code execution (RCE), gaining root privileges and worm-style lateral movement, according to researchers. The Qualys Research Team has discovered a whopping 21 bugs in the popular mail transfer agent (MTA), which was built to send and receive email on major Unix-like operating systems. It comes pre-installed on Linux distributions such as Debian, for instance. The link for this article located at ThreatPost is no longer available. . A collection of critical weaknesses in the Exim email server may result in remote code execution and unauthorized privilege escalation threats.. Exim Mail Server, Remote Exploit, Security Flaws. . Brittany Day
May 06, 2021
•
Security Vulnerabilities
210
security advisorybuffer overflowcriticalExim 4.80-4.92.1 Critical Advisory: Buffer Overflow in TLS Negotiation
A ‘critical’ security vulnerability has been discovered in the Exim mail server that requires admins’ urgent attention. Learn more about the flaw and how to protect your servers: . Affecting all versions from 4.80 up to and including 4.92.1, Exim’s maintainers have offered a general description of the flaw ( CVE-2019-15846 ) discovered in July 2019 by a researcher identified as ‘Zerons’. Subsequently confirmed by engineers working for Qualys, the flaw is a buffer overflow in the part of the TLS negotiation connected to Server Name Indication (SNI). SNI is a way web hosts present the certificates for multiple HTTPS-secured TLS servers sitting behind the same IP address so that incoming connections are directed to the correct one. The link for this article located at Naked Security is no longer available. . A critical buffer overflow flaw in Exim 4.80-4.92.1 requires immediate action to protect your servers against remote compromise.. ‘critical’, security, vulnerability, server, requires. . Brittany Day
Sep 10, 2019
•
Security Vulnerabilities
83
security advisorycriticalattackHTTPS Attack Advisory: Critical Risk For Top Websites And Mail Servers
Tens of thousands of HTTPS-protected websites, mail servers, and other widely used Internet services are vulnerable to a new attack that lets eavesdroppers read and modify data passing through encrypted connections, a team of computer scientists has found.. The vulnerability affects an estimated 8.4 percent of the top one million websites and a slightly bigger percentage of mail servers populating the IPv4 address space, the researchers said. The threat stems from a flaw in the transport layer security protocol that websites and mail servers use to establish encrypted connections with end users. . The vulnerability affects an estimated 8.4 percent of the top one million websites and a slightly bi. thousands, https-protected, websites, servers, other, widely, internet, services. . LinuxSecurity.com Team
May 21, 2015
•
Hacks/Cracks
78
malware defensemail serverspam protectionKaspersky Enhances Spam And Malware Protection For Linux Mail Server
Kaspersky Lab ZAO gave its Kaspersky Security for Linux Mail Server a few strong tweaks in the security area with an update that bolsters protection against spam and malware spread by e-mail, giving the channel a competitive edge when breaking into growing open-source security niches. . Kaspersky The link for this article located at Channelomics is no longer available. . Kaspersky enhances Linux Mail Server defenses with robust updates designed to improve spam filtering and malware resistance.. Kaspersky Mail Security, Linux Server Protection, Anti-Malware. . LinuxSecurity.com Team
Dec 28, 2012
•
Vendors/Products
77
security advisorycriticalcode executionSpamAssassin: Critical Advisory for Milter Code Execution Vulnerability
The SpamAssassin Milter plug-in which plugs in to Milter and calls SpamAssassin, contains a security vulnerability which can be exploited by attackers using a crafted email to inject and execute code on a mail server. The SpamAssassin Milter plug-in is frequently used to run SpamAssassin on Postfix servers.. In order to exploit the vulnerability, the plug-in must be called with the -x expand flag. For attackers to obtain root privileges, as the author of the security advisory proclaims, the plug-in has to be started as root The link for this article located at H Security is no longer available. . In order to exploit the vulnerability, the plug-in must be called with the -x expand flag. For attac. spamassassin, milter, plug-in, which, plugs, calls, security. . LinuxSecurity.com Team
Mar 18, 2010
•
Server Security
74
mail serverspam managementsmtp proxyEmploying Qpsmtpd SMTP Proxy For Advanced Spam Management
A simple means to adding additional anti-spam checks to your mailserver is to place it behind an SMTP-proxy. One common proxy is the extremely flexible qpsmtpd server. The nice part of this setup is that is allows the network to have the SMTP-proxy in front of the Mail Server so there is no need to change mail server. I feel is this a nice feature. But how effective is this from preventing spam and allowing real emails to come through What do you think? Does this method have the ability to learn what is spam? . There are many methods used to fight spam which are tied to particular mailserver implementations. This means that unless you're using that specific software you cannot take advantage of them. A simple means to adding additional anti-spam checks to your mailserver is to place it behind an SMTP-proxy. One common proxy is the extremely flexible qpsmtpd server. The link for this article located at Debian-administration is no longer available. . There are many methods used to fight spam which are tied to particular mailserver implementations. T. simple, means, adding, additional, anti-spam, checks, mailserver, place, behind. . Bill Locke
Jul 30, 2007
•
Network Security
74
malwareconfigurationmail serverPostfix Mail Server: Block Malware Using Blacklists to Protect Emails
" Malware is used for a harmful purpose. " Spreading malware via email is a very common practice by attackers. On the Internet there are free Malware blacklist available. How can we make sure that these free blacklist will not block our personal emails? I feel the risk of getting malware is greater then the risk of having a few of my personal emails getting blocked. . Malware is used for a harmful purpose. It can be in your software or hardware. Email and free (don The link for this article located at Cyberciti is no longer available. . Creating strong email filtering systems is vital for malware protection and smooth personal email delivery. Implementing blacklists can effectively block harmful senders.. Malware Protection, Email Filtering, Mail Server Configuration. . Bill Locke
Jun 28, 2007
•
Network Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!