Off-and-on trying out an account over at @tal@oleo.cafe due to scraping bots bogging down lemmy.today to the point of near-unusability.

  • 3 Posts
  • 1.04K Comments
Joined 3 years ago
Cake day: October 4th, 2023
  • tal@lemmy.todaytoSelfhosted@lemmy.world•Question for Reasonable Security in New Server SetupEnglish
    5·
    13 hours ago

    change the default SSH port

    Any port scanner — take nmap — is going to turn this up.

    SSH is also trivial to fingerprint as a protocol. Here’s me running netcat to my local SSH instance:

    $ nc localhost 22
SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u2
^C
$

    It ain’t rocket science to identify an SSH server.

    I personally think that port-knocking isn’t a great idea and just adds hassle and brittleness to something, but I’d do a port-knocking setup before I tried running sshd on a nonstandard port.

    If you honestly don’t trust SSH, then okay, fine, wrap it with a VPN or something with real security so there’s another layer (of course, that raises the issue of whether you trust the VPN software not to have remote exploits). Or have one host that you can reach and bounce from there to another host or something.

    There are ways that I’d say are useful to try and secure an SSH instance. Use keys rather than passwords. Whitelist user accounts that can be connected to remotely.

    But anyone who is likely to be a real risk to your system is going to be able to find an ssh server running on a nonstandard port.

  • tal@lemmy.todaytoSelfhosted@lemmy.world•Proxmox audio for all guests solution?English
    2·
    4 days ago

    so I figured that using pipewire to co-ordinate this would be the easiest way forward, except it turns out that it’s a (GUI) user space process, which doesn’t make sense on a server with no GUI users.

    I’m not entirely sure what you mean by “(GUI) user space process”, but if it’s that it’s a systemd user process (e.g. it shows up when you run $ systemctl --user status pipewire rather than $ systemctl status pipewire, which appears to be the case on my system, where there’s one instance running per user session), then you probably can run it as a systemwide process, where there’s just one always-running process for the whole system. IIRC, PulseAudio could run in both modes. I don’t know if you have concerns about security on access to your mic or something, but that could be something to look into.

    searches

    Sounds like it’s doable. Not endorsing this particular project, which I’ve never seen before, but it looks like it’s possible:

    https://github.com/iddo/pipewire-system

    PipeWire System-wide Daemon Package (Arch Linux)

    This package configures PipeWire, WirePlumber, and PipeWire-Pulse to run as a single system-wide daemon as the root user. This setup is optimized for headless media servers, HTPCs, or multi-user audio environments.

  • tal@lemmy.todaytoSelfhosted@lemmy.world•How do you use VPN?English
    5·
    7 days ago

    I have not used such a configuration, but I believe that it’s fine to have multiple WireGuard VPNs concurrently up, at least from a Linux client standpoint. I have no idea whether your phone’s client permits that — it could well be that it can’t do it.

    Your routing table would have the default route go to a host on one of them (and your Internet-bound traffic would go there), but you should be able to have it be either. Or neither — I’ve set up a WireGuard configuration with a Linux client where the default route wasn’t over the WireGuard VPN, and only traffic destined for the LAN at the other end of the WireGuard VPN traversed the WireGuard VPN.

    From Linux’s standpoint, a WireGuard VPN is just like another NIC on the host. You say “all traffic destined for this address range heads out this NIC”. Just that the NIC happens to be virtual and to be software that tunnels the traffic.

    EDIT:

    It sounds like this is an Android OS-level limitation:

    https://android.stackexchange.com/questions/261526/are-there-technical-limitation-to-multiple-vpns

    In the Android VPN development documentation you can find a clear statement regarding the possibility to have multiple VPNs active at the same time:

    There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created.

    That same page does mention that you can have apps running in different profiles using different VPNs at the same time. That might be an acceptable workaround for you.

  • tal@lemmy.todaytoSelfhosted@lemmy.world•Alright let's see pictures of your super nice rack-mounted, professionally installed labs. I'll start 🙃English
    4·
    8 days ago

    I’m still not using one. The problem is that you’ve got two classes of devices that haven’t quite converged to what I want.

    UPS

    Traditionally, the purpose of UPSes isn’t to keep systems running (other than through very short outages). It’s to do one of the following:

    • Provide a small amount of buffer until a backup power system, like a generator, has time to come online.

    • Give the systems time to shut down cleanly. If the user is right there, they have time to save their work. This was particularly an issue before journaled filesystems became the norm, since an unclean shutdown in the era when Windows was using FAT, Linux was using ext2, and MacOS was using HFS had at least the possibility to corrupt your filesystem. They have the ability to report their charge level to an attached computer so that it knows when the battery level is critical and then software on it can start it shutting down. On Linux, the most-common software package to do this is Network UPS Tools, or NUT.

    These things don’t need a lot of capacity. They rarely get drained, so they usually use lead-acid batteries, which are heavy and don’t have many full charge-discharge cycles in them (but are pretty happy staying fully charged all the time). You can still get these. The lead-acid batteries are replaceable, though, so an old UPS can keep going for a very long time.

    Powerstation

    These are designed to keep attached devices running for a longer period of time. Unfortunately, they have a couple of important limitations for powering computer systems.

    • They do not normally have the ability to report their charge level. Irritatingly, they do nearly always have a voltmeter rigged up to some software to map voltage to charge remaining to drive a ‘charge remaining’ display on the device, and there are USB HID device classes for reporting charge levels to a host OS, but for some reason, powerstation manufacturers don’t seem to have an interest in making a powerstation that has the latter functionality. NUT does have a USB HID backend, which means that it can monitor and shut down a system if they’d expose it. I’d really prefer the ability to treat one of these as a laptop-style battery, as Linux (as well as other OSes) have the ability to hibernate on low battery. On Linux, these show up as /sys/class/power_supply/BAT*, and there’s lots of software to display charge information and act based on low levels…but AFAICT from looking around the kernel, there is no way to get the kernel to deal with a USB HID device reporting remaining charge like this as a BAT device.

    • Computer power supplies can only smooth out so much of an interruption in their power. Computers rely on something on the order of a 10 millisecond transfer time after AC goes out until the UPS needs to be running full-tilt. searches ATX PSUs apparently are only required to operate for 16 milliseconds without power. Other hardware attached may or may not actually deal well with interruptions, but obviously the shorter the transfer time, the better. It looks like line-interactive UPSes tend to do something like 3-6 milliseconds. The problem is that a lot of powerstations have a transfer time in excess of this.

    There are some LFP UPSes now, but these have their own disadvantages. They tend to be fairly pricey, and the batteries are often not replaceable, which means that unlike the old lead-acid UPSes, when the battery dies (which will take longer than with a lead-acid battery), the whole device is also going to the landfill.

    And lastly, you have the problem that while lead-acid batteries are pretty mature and prices are pretty stable, LFP battery prices are coming down (and sodium-ion might start competing with them for fixed batteries). If batteries are cheaper in the future, waiting means a better deal.

    I don’t currently run a UPS on my systems (though I have in the past). I kind of decided that if I’m going to run a UPS, I’m probably going to just bite the bullet and use the combination of a traditional lead-acid UPS and an LFP powerstation, with the UPS plugged into the powerstation. In that configuration, the powerstation provides provides the longer-running power, and the UPS deals with short transfer time and warning computer systems that power is about to go out. This isn’t perfect, because (a) your computing devices can’t see the remaining charge on the powerstation in an outage (b) at some point, one still has to toss the LFP powerstation, and (c) there’s a little extra hardware involved. However, it also has a number of benefits:

    • Lead-acid UPSes pretty much always have replaceable batteries. One can keep the UPS around, though the batteries will have to be periodically replaced.

    • The UPS will provide time for the system to shut down.

    • UPSes are designed specifically for this, and have short transfer times. You don’t need to worry the way one might about a powerstation having marginal transfer time.

    • You can get a lot of AC-related functionality in UPSes, like online capability (which will clean up the power, if you want), which isn’t generally available in powerstations.

    • You can upgrade the “powerstation”, even (if you want) doing a build-your-own thing with separate cells and an inverter and charge controller (which is generally more cost-effective for larger systems) down the line. These discrete-component systems are also a lot easier to provide human monitoring of remaining charge, since you can pick the components (and worst case, all you need to do is connect a voltage sensor that can talk to a computer to it), though they don’t integrate as nicely off-the-shelf with something like NUT as do traditional UPSes.

    I’m not saying that this UPS+separate-battery-system is the only route to take, but I spent some time banging my head on it, and wanted to share if anyone else is similarly thinking about the same thing – that there may be a good argument to have a traditional UPS and some kind of separate battery system.

  • tal@lemmy.todaytoSelfhosted@lemmy.world•Alright let's see pictures of your super nice rack-mounted, professionally installed labs. I'll start 🙃English
    2·
    8 days ago

    Old system 76 machine from a while back. Its what is running a majority of my services for self hosting. Only one screw keeps the case together, since I get into the insides quite often.

    If you get bored and adventurous:

    https://en.wikipedia.org/wiki/Computer_case_screws

    Computer case screws are the hardware used to secure parts of a PC to the case. Although there are numerous manufacturers of computer cases, they have generally used three thread sizes.

    The #6-32 UNC screws are often found on 3.5" hard disk drives and the case’s body to secure the covers. The M3 threaded holes are often found on 5.25" optical disc drives, 3.5" floppy drives, and 2.5" drives. Motherboards and other circuit boards often use a #6-32 UNC standoff. #4-40 UNC thumb screws are often found on the ends of DVI, VGA, serial and parallel connectors.

    You might be able to get a box of thumbscrews in the appropriate diameter and go toolless. I’ve had a number of computer cases that ship with those (my current desktop case just uses magnets, doesn’t even have the thumbscrews). I have had a lot of less-than-ideal toolless things in the past, including poorly-designed toolless hard drive mounting stuff that wound up being a lot more work than the traditional tool-requiring stuff, but for the screws that keep the case closed, going toolless has always been a big win for me.