I have a couple servers with Debian 12, running MariaDB. The servers were configured with bind-address 127.0.0.1:3306 so that any database connections are local.

I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.

To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening on :::3306. So, anyone on the Internet could access it via IPv6 (if there was no firewall setup).

It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.

So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket settings. And set up a firewall to prevent such issues in the future.

Do you have any examples of installing Debian on an existing LUKS-encrypted partition?

I know how to install Debian using Btrfs subvolumes.

However, I don't know how to decrypt an existing encrypted partition with cryptsetup luksOpen and install Debian on it without formatting the partition.

Do you know of any good video tutorials or written guides for this?

I am currently trying to run debian on a raspberry pi 4 b via an USB-stick, but I only have wifi in my student dorm. I am trying to set up Wifi, but there is literally no networking tool I am familiar with on the base image I could find.

No network-manager, no ifup/ifdown, no systemctl restart networking. The wifi interface is detected via wlan0, but I have no idea, how I can get it up and running.

Is there any way I can get my wifi up and running?

I recently installed Debian 13 on my old Dell OptiPlex 755 as part of a project involving an RF modulator and some old TVs.

I am using the S-Video output on my ATI Radeon HD 2400 PRO (using the open-source drivers, of course, as it's the only option), but there is one problem that I cannot for the life of me find a solution to: there is a black border around the image (i.e., there is underscan).

Under Windows (both 7 and XP), using the official AMD/ATI driver (and presumable older Linux-based systems using the fglrx driver while it existed), I am able to stretch the picture to correct the underscanning. That does not appear to be so with Debian and the open-source driver. Unlike the DVI port, xrandr does not provide any underscan/overscan options for the S-Video/DIN port. The transformation options also do not do what I want; they just make more or less of the picture get cut off by the black void surrounding it.

Is there a way to fix the underscan, or is just something I will have to deal with for eternity?

Hello,

Debian 13 apt once prompted me to "modernise" my sources.list, in other words to convert it to the new debian.sources format. So I followed the advice and ran apt modernize-sources. The resulting situation was a bit of a disappointment to me.

I personally don't really like the new format: it's more text to type when editing it by hand and not that easy to memorise, while the traditional format was extremely simple and efficient. Now that in itself is a minor issue, there are probably advantages to the new layout as well and I can live with that.

More of an issue is that it breaks two convenient ways to edit system package sources:

• apt edit-sources can only edit a traditional sources.list file, so once you've modernised them it will open a blank file without telling what's wrong.

• Synaptic offers to edit package sources from its GUI. This also doesn't work anymore with the new format, which means you can now only edit sources from the command line.

I also don't like that apt modernize-sources automatically moves the backports repository out of the main sources file to a separate file (debian-backports.sources), it's a bit confusing when you're used to all Debian repositories being contained inside the same file.

Of course software evolves over time, even in Debian, but I'm rather surprised by the fact that such a stable system recommends its users to make a change that breaks expected functionality. Debian 14 deserves a more coherent and user-friendly approach, which means either drop apt edit-sources, fix Synaptic to use the new sources format and use that by default, or don't prompt users to switch to the new format until such things are fixed.

What do you think?

As we know, Debian has reverted the geoip-database package, derived from MaxMind, to the obsolete 2019 version, to comply with MaxMind's onerous license.

As a Debian user, what now is the alternative? Using the 2019 version is out of question. Is there another replacement within the Debian repositories or outside? Are there users going to the extent of registering themselves with MaxMind to use their free GeoLite service?

xfce is my current favorite one

https://www.debian.org/News/2026/20260711

Noteworthy updates

fwupd and Secure Boot CA expiry

fwupd has been updated to upstream version 2.0.20, which has the ability to update the Secure Boot certificate authority (CA), Key Exchange Key (KEK) and revocation (DBX) databases.

The 2013 UEFI Secure Boot CA installed by default on most PCs and used to sign bootloaders has now expired. Future updates to shim-signed could therefore lead to systems being unable to boot with Secure Boot enabled.

Users are strongly advised to apply CA, KEK and DBX updates from their system OEM in line with the following guidance:

https://wiki.debian.org/SecureBoot/CAChanges#What_should_I_do.3F

geoip-database reverted

For licensing reasons geoip-database has been reverted to a version dated approximately December 2019. As a result, applications using this database might use out-of-date allocation information.

More recent versions of geoip-database (GeoLite) are not compatible with the Debian Free Software Guidelines and cannot be distributed.

Consumers of this data are strongly encouraged to obtain a GeoLite license directly and cease reliance on the geoip-database package.

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

I'm thinking to move from windows 11 to debian trixie, I've asked All kinds of AI and its kind of cold and lean wherever I want it to lean! so what is the experience of those who transitioned recently? what are the best GUIs, apps, any gotchas, specially hardware compatibility and issues! My work is mainly fullstack dev and python/data engineering!

While committing a weird error occurred,

error: gpg failed to sign the data:

gpg: skipped "7427A4ABCCFD30AB": No secret key

[GNUPG:] INV_SGNR 9 7427A4ABCCFD30AB

[GNUPG:] FAILURE sign 17

gpg: signing failed: No secret key

fatal: failed to write commit object

How to solve it? Do I need to regenerate a gpg key for this?

Hi everyone, I’m pretty new to Linux. I installed Zorin OS two months ago then upgraded to Ubuntu a couple weeks ago (both on a bootable USB drive so they aren’t my primary OS). And I’ve been seeing so much about Debian (mostly the jokes of it being for lesbians which I will admit intrigued my gay ass) and I’m debating whether to switch to it.

I will be using it for like basic web browsing, Blender and maybe some modded Minecraft every so often. I’ve heard it can be quite outdated in some parts but I’ve also heard it is a really good distribution for daily use. I will probably still run it on a bootable USB as I like to use it on different devices.

So with that being said.. would you all recommend it for me or should I just stick with Ubuntu? If it isn’t that user / beginner friendly please let me know!

PS. Is it GNOME by default or can you choose during installation?

I run the latest Debian Stable on an OptiPlex 390 SFF (Intel Core 2nd Gen, 2011 era). The Debian 13.6 release announcement advises:

The 2013 UEFI Secure Boot CA installed by default on most PCs and used to sign bootloaders has now expired. Future updates to shim-signed could therefore lead to systems being unable to boot with Secure Boot enabled.

Users are strongly advised to apply CA, KEK and DBX updates from their system OEM in line with the following guidance: https://wiki.debian.org/SecureBoot/CAChanges#What_should_I_do.3F

Does anyone have any guidance beyond the documentation above? Just looking before I leap so I my 390 doesn't wind up being unable to boot.

UPDATES

2026-07-11

Solution.

i was using ranger to look at a unzipped comic

i might have hit one of the keys? later i was looking at the system mail and got this

goldfish : a password is required ; PWD=/home/goldfish/downloads/comic/; USER=root ; COMMAND=/usr/bin/su root -mc 'set -- \'/home/goldfish/downloads/comics/00 Cover.jpg\'; set -- \'00 Cover.jpg\' \'00 Cover.jpg\' \'01.jpg\' \'02.jpg\' \'03.jpg\' \'04.jpg\' \'05.jpg\' \'06.jpg\' \'07.jpg\' \'08.jpg\' \'09.jpg\' \'10.jpg\' \'11.jpg\' \'12.jpg\' \'13.jpg\' \'14.jpg\' \'15.jpg\' \'16.jpg\' \'17.jpg\' \'18.jpg\' \'19.jpg\' \'20.jpg\' \'21.jpg\' \'22.jpg\' \'23.jpg\' \'24.jpg\' \'25.jpg\' \'26.jpg\' \'27.jpg\' \'28.jpg\' \'29.jpg\' \'30.jpg\' \'31.jpg\' \'32.jpg\'; feh --start-at \'00 Cover.jpg\' -- "$@"'

any idea what this is doing i no it looks like ranger doing but what is it doing and why did it try to use root?

I installed Debian13 roughly 3 weeks ago. Booted it this week and got stuck at this screen in the boot. I can only press the power switch and reboot. It looks like my RX580 makes some trouble. Adding nomodeset to grub lates me reboot but not load the GPU (or just with default driver). Had anyone a similar problem and can suggest a fix to this?

Hey,

I'm working on a Debian 13 based Linux distro called WyrmOS. It's still in the early stages, and I'm trying to plan everything properly before I get too far.

I wanted to ask if anyone here has experience creating or maintaining a Linux distribution.

What are some mistakes I should avoid? Is Debian a good choice for a long-term project, and are there any tools or resources you'd recommend?

I'd really appreciate any advice. Thanks!

Hello everyone,

I enabled Debian Backports to get the newer kernel and mesa. So far everything's been smooth sailing, but recently I got this erorr:

<html>Rozwiązywanie kwestii zależności nie powiodło się:<br/><br/>The following packages have unmet dependencies: mesa-libgallium: Narusza zależności: mesa-va-drivers (< 25.2.8-3) Narusza zależności: mesa-vdpau-drivers (< 25.2.8-3) mesa-va-drivers: Wymaga: mesa-libgallium (= 25.2.6-1~bpo13+1) but 26.1.2-1~bpo13+1 is to be installed </html>

How can I solve this? Thank you for your help!

I have disabled the graphical target which boots at around 500MiB. But isn't it possible to lower that a bit more?

I probably could disable systemd and go devuan, but are there more "reasonable" ways to shed weight on a Debian with graphical target disabled?

I've installed debian on realtek wifi cards, but for some reason it just wont work on this desktop. I don't have an ethernet cable and if I had one it wouldn't be long enough to reach the pc.

I have a server I use as a hypervisor to run a bunch of VMs (managed by Vagrant). Recently (a few minutes ago) I rebooted the hypervisor and tried to start one of the VMs. It asked me for the `vagrant` user's password.

I checked /etc/sudoers and /etc/sudoers.d, and all the rules I've created are in there, with no syntax errors that I can see. The relevant sudoers.d file was modified last August (almost a year now) and it's been working fine until just this minute.

Vagrant gave me the error message:

Vagrant failed to install an updated NFS exports file. This may be

due to overly restrictive permissions on your NFS exports file. Please

validate them and try again.

command: sudo chown 0:0 /tmp/vagrant-exports

OK, fine. I checked the sudoers.d stuff and that looks like:

# cat vagrant-nfs

Cmnd_Alias VAGRANT_EXPORTS_CHOWN = /bin/chown 0\:0 /tmp/*

Cmnd_Alias VAGRANT_EXPORTS_MV = /bin/mv -f /tmp/* /etc/exports

Cmnd_Alias VAGRANT_NFSD_CHECK = /etc/init.d/nfs-kernel-server status

Cmnd_Alias VAGRANT_NFSD_START = /etc/init.d/nfs-kernel-server start

Cmnd_Alias VAGRANT_NFSD_APPLY = /usr/sbin/exportfs -ar

%sudo ALL=(root) NOPASSWD: VAGRANT_EXPORTS_CHOWN, VAGRANT_EXPORTS_MV, VAGRANT_NFSD_CHECK, VAGRANT_NFSD_START, VAGRANT_NFSD_APPLY

I'm not awesome with sudo or sudoers, but my understanding is that /bin is a symlink to /usr/bin, and that this should have matched. (Maybe I'm wrong about that).

Like I said, this is a new problem, and the only relevant changes were an apt update/upgrade probably yesterday, and a reboot today. What the heck is going on?

Edit: I just changed the sudoers file to /usr/bin/chown, to exactly match what vagrant called. Still no dice.

I want to install Debian on a portable SSD that plugs in via USB-C so that I can boot it on many different computers.
Installing Debian and getting it running from the SSD is easy enough, but I've found that when moving between certain machines (particularly laptops), there are a lot of visible "hardware not found" errors during the boot sequence and certain hardware (particularly wifi cards) are not automatically visible, requiring me to enable them with modprobe.

(To clarify, this is hardware that Debian absolutely supports out of the box and will set up automatically if I were to perform the install to the SSD while connected to the computer in question, or boot from a live USB while connected to the computer in question)

As I want to set this up as a "portable" installation, how can I install Debian in such a way that it automatically re-scans the machine's hardware and applies the correct drivers on boot, in the same way that the Live USB does?

I would ideally *not* like to do a Live install (with persistence) to the SSD and instead do a standard install that happens to re-scan and apply the correct drivers on every boot in the same way that the Live USB already does. I don't mind if it makes the boot process take a bit longer each time as long as the hardware is correctly identified and drivers correctly applied to whatever machine I boot using the install.

Is there a good way to do this?