5·
11 months ago3-2-1 every copy is encrypted, so taking the machine isn’t much of a concern and more of a inconvenience
- 0 Posts
- 42 Comments
Joined 3 years ago
Cake day: July 6th, 2023
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
We see the convergence of computer and cell phone everyday
Without monospacing…
Clearly math is satanic
As soon as they refuse repayment. It is gift. And you don’t have to worry about it
Yeah, I was able to set it up using the openwrt interface luci. Just ignore the other stuff, experiment in luci until you dial it in
https://openwrt.org/docs/guide-user/network/vlan/switch_configuration
Get a slot adapter first, to male sure your use case works before doing the physical mods others are talking about
I have a UPS designed to run long enough to shutdown my server gracefully. I can manually turn it back on if the outage is extended.
If I was designing a critical service the ups would have enough runtime to switch over to some other power system (solar batteries, generator, second circuit, etc)
Having written code for 2 of these… I feel attacked
The key is defense in depth. Don’t trust anything more then you need to. Even if your router is compromised the hosts should be hardened, the traffic should be encrypted, etc
Kde connect is also a option
That’s awesome!
Fair enough;
Do a dry run for a CLIENT key, make sure you have the libfido2 middleware installed and working; Ensure you have set your sshd_config file properly with no-touch-required
From the documentation " Note: not all tokens support disabling the touch requirement." so do a test client side before banging your head on it.
Can you explain to me the workflow you have envisioned for the host identity key in /etc/ssh being keyed of a FIDO2 secure element? You plug a secure element into a server?
Sounds like you want something like a HSM that integrates into your sshd to pull the certificates. Even then you have the chicken and egg problem, how do you identify the hardware to the HSM? You need some trusted boot environment, and now your down into vender specific implementations to “trust” the booted hardware.
https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
I followed this guide and works fine for me, macos client.
Pop it into a different machine and use a tool like dban to wipe it.
Openstack has a huge ecosystem
3:2:1 - Cattle not pets - If your data is backed up in multiple sites, the death of one site shouldn’t overwhelm you, and give you time to recover.
If your primary site drives are getting above their designed lifetime, rotate them out, sure - but they could be used as part of the backup architecture else where (like a live offsite sync location with enough tolerance for 2 disk failures to account for the age).
3 copies of your data; 2 types of media; 1 copy offsite.
KISS
The more complicated the machine the more chances for failure.
Remote management plus bare metal just works, it’s very simple, and you get the maximum out of the hardware.
Depending on your use case that could be very important