Guiorgy

@Guiorgy@lemmy.ml

• ⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨12⁩ ⁨hours⁩ ago⁩:

  How is crashing on an unhandled path in a security context not better?!

• ⁨Comment⁩ on ⁨⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:

  I’ve also seen some sites use POWBlock, though, don’t know anything about it.

• ⁨Comment⁩ on ⁨backups ran and tested!⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  Proxmox VM snapshots and backups, plus proxsave I assume?

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Wouldn’t be surprised if the big guys got first dibs before everyone else

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Synology had a critical system and PHP package update yesterday, could it be related 🤔

• ⁨Comment⁩ on ⁨PSA: unattended-upgrades restarted nginx in the middle of my stream⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  I mean, unattended upgrades has it’s own config file where you can specify when to schedule a reboot (when needed), which you’d usually do in off-hours like 2 AM your local time, so changing the Systemd unit activation time seems like the wrong fix.

• ⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  For frequently changing data hourly up to 24, daily up to 7, weekly upto 4, monthly up to 12.

  For daily changing data daily up to 7 and etc. as above.

  For seldom changing data a backup every 3 days with rotation based on a storage quota, and retention of manually held samples.

• ⁨Comment⁩ on ⁨I’m looking for the best remote access solution that works for me⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Did you read it to the end?

• ⁨Comment⁩ on ⁨I’m looking for the best remote access solution that works for me⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Without root user login, the attacker would have to guess not only the password to the user but also the username (hopefully it’s not something simple like admin), and once you are logged in you can use sudo -i to chage into root, which will require a password, therefore, we also disable password login so if someone does manage to somehow compromise the SSH user, they’d still need the password to become root.

• ⁨Comment⁩ on ⁨I’m looking for the best remote access solution that works for me⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  You could spin a publicly exposed WireGuard daemon firewalled to allow peers access to the non-public SSH port only, which would result in double encryption, but would give you the peace of mind that an attacker would have to compromise both at the same time, which is very unlikely. Plus, WireGuard is very cheap to deploy and produces no logs. We use that model in my office to access our server.

• ⁨Comment⁩ on ⁨ISP won't set up static IP - Services keep going down⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Not in the US, at work we pay 6 times the rate I pay at home for 1/6 the speed I get at home, everyone hates our office internet speed 😂, at least it’s static do we can host stuff

• ⁨Comment⁩ on ⁨ISP won't set up static IP - Services keep going down⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Either use a dynamic DNS service, as many others have mentioned and probably easiest, or, assuming you only want yourself to have access to the services, another option is to use something like Tailscale or a WireGuard/FRP instance in a static VPS as the rendezvous point.

  I was flat out rejected by my ISP to have a static IP, though I only had it changed once since I started hosting services, so ahatever.

• ⁨Comment⁩ on ⁨Help with Getting My Reverse Proxy to Forward the Correct IP Address⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  The way a reverse proxy works is to literally stand in the middle of a connection, so either side only sees them communicating with the proxy, oblivious to the actual endpoint. The only “solution” to this, though it’s more of a hack really, is to somehow send the original IP as additional data in a way that both sides agree on, e.g. the X-Forwarded-For header as others have mentioned, however, as I’ve said, both sides need to support and aggree with that, so you may have to find a setting/config to enable on the services behind the proxy. Think of it this way, if services blindly trusted that header and you weren’t using a reverse proxy, a bad actor could send a request to your service with that header included thereby spoofing their identity in your logs, therefore, this kind of thing is usually opt-in