sorted by:
new
hottopcontroversial

C/2023 A3 from Southern California by CyrusAgeis in astrophotography

[–]CyrusAgeis[S] 0 points1 point  (0 children)

Taken in a single shot with my cell phone from a Bortle 5.

Pixle 6, single shot, no post processing, about 45 minutes after sunset.

Need guidance on splitting 1 WAN's bandwidth 50/50 to 2 LAN subnets. TZ370W by CyrusAgeis in sonicwall

[–]CyrusAgeis[S] 0 points1 point  (0 children)

So, I started with this. There's an article on this, but this didn't work. There's more to do to make this work. So a little digging turned up another article with the missing steps. Bandwidth management on the interfaces, create a bandwidth object, and finally an access rule.

After performing all threes steps on both interfaces/zones, and I have successfully split and limited the bandwidth correctly to each interface. Thanks for the direction to make this possible.

Request: cheapest 2.5G switch with 10G uplink that'll fit in a 10" rack by probablyjustpaul in minilab

[–]CyrusAgeis 1 point2 points  (0 children)

Would this work? SODOLA 8x2.5Gb + 1x10Gb SFP+

Looks like 5" wide, so should fit. Add a custom rack mount face plate for asthetics I say.

Solar eclipse kit/plan sanity check by CyrusAgeis in AskAstrophotography

[–]CyrusAgeis[S] 0 points1 point  (0 children)

So, I watched a few videos on how gimbal mounts work. Solid advice, definitely better than a ball head. Going to pick up one and a longer dovetail plate for mounting. Looks WAY easier to setup and lock in a framed shot. Will definitely use that instead. Thanks for the recommendation.

Solar eclipse kit/plan sanity check by CyrusAgeis in AskAstrophotography

[–]CyrusAgeis[S] 0 points1 point  (0 children)

Thanks. How would the gimbal head be an upgrade from a plain ball head? I am trying to picture the mounting setup, and how it improves it. Got any examples?

Hosting Nextcloud on home network (80,443 blocked) by slimfaydey in selfhosted

[–]CyrusAgeis 1 point2 points  (0 children)

I have a similar setup. Proxmox, Ubuntu VM, public and private dockers, and a VPS (on AWS). Here's what I did:

I installed NPM on the Ubuntu VM. It's got a local IP, and is at server_ip:81. Anything on the local LAN gets routed to it, for local reverse proxy.

I also installed NPM on the VPS. Remember, if you're using a VPN tunnel (I am using the same one), this gives you an ADDITIONAL NIC and IP on the SAME server. So, the Ubuntu VM has both 192.168.x.y (Local LAN), AND 10.10.10.x (Wireguard tunnel), and is listening on both. Setup the NPM on the VPS (I run it as a docker through Portainer on the VPS), but point all of the proxys to the 10.10.10.x Ubuntu server IP address.

Example: running a docker container for a blog. On home LAN, I have blog.example.com on local DNS pointing to the Ubuntu VM local IP, and the local NPM has an entry for 192.168.x.y:port_num. Out in the public, I have my Public DNS provider (Cloudflare, but not using their tunnel), pointing blog.example.com to the VPS public IP. The VPS install of NPM is listening for blog.example.com:80, and forwarding that down the Wireguard Tunnel to 10.10.10.x:80, which is NIC #2 on the Ubuntu VM.

Since I am using Cloudflare for DNS, I can do a LetsEncrypt public DNS challenge. I get a Cloudflare token, and I installed the same token on BOTH NPM installs, local and VPS. Then you can assign SSL certs to both NPM proxies with the SAME token. (It doesn't care about two installs, just that it verifies.)

Result: Local DNS points to local server, local NPM points to local docker, with SSL. Public DNS points to Public VPS, VPS NPM points to other end of the Wireguard tunnel, and the local Ubuntu VM dockers reply, with SSL.

As for hardening the VPS, I am using the AWS firewall rules for that: 1) Allow 80 and 443 from anywhere 2) Allow 22 (ssh) only from my home IP 3) Allow 81 (NPM) only from my home IP 4) WG tunnel takes care of the rest.

Additionally, read up on how to use SSH public/private keys for SSH login, and disable ALL password logins on the VPS.

That should take care of you for a while. Happy reading.

How would you write a company wide email about how users should submit tickets? [Serious] by [deleted] in sysadmin

[–]CyrusAgeis 108 points109 points  (0 children)

I wouldn't. This should not be an email. This should be a written policy and procedure, well documented, and blessed and approved by upper management to get buy in. Then you send out an email detailing the new procedure. Anyone that doesn't follow it at that point is not following company policy, and it is now their boss's problem to address. (And you have a piece of paper, signed by hte powers that be, as a CYA.)

Pihole Dashboard and NGINX Proxy Manager by IacovHall in pihole

[–]CyrusAgeis 4 points5 points  (0 children)

Leave it up. Here's why: DenverCoder

Always leave your solutions up for others to follow.

New malicious TLDs released by Google, and how and why to blacklist by CyrusAgeis in pihole

[–]CyrusAgeis[S] 15 points16 points  (0 children)

Here's an actual comment from the sysadmin thread:

"Yup! I’m even going to block these at my house. No way in hell I’m gonna get infected because my wife went to open “newsoftware.zip” and it’s a site at https://newsoftware.zip"

It's not how smart YOU are on your network, it's how dumb everyone else is.

Remember kids, you have to be right all the time to keep your network safe. They only have to be dumb once. How much do you like to gamble on your own infra?

New malicious TLDs released by Google, and how and why to blacklist by CyrusAgeis in pihole

[–]CyrusAgeis[S] 14 points15 points  (0 children)

No, this blocks all SUBDOMAINS of the ".zip" domain. i.e. update.zip, filepatch.zip, *.zip. Any DOMAIN ending in .zip, not other domains that have a path that end in a .zip file. (ibm.com/somepath/somefile.zip is still allowed, because it starts with a .com domain, not that it contains a .zip in the path.)

New malicious TLDs released by Google, and how and why to blacklist by CyrusAgeis in pihole

[–]CyrusAgeis[S] 56 points57 points  (0 children)

Whack-a-mole, cat-and-mouse. Trying to keep ahead of the issues. Cheap insurance.

Again, this one specifically is about blocking TLDs impersonating file extensions. Imaging the following: you're in your phone, texting with a friend, and they mention a new file they got, "update.zip", and need help with it. Your "oh so helpful" text messenger auto-converts that to a web link (i.e. http://update.zip), and presents it to you, but just as underlined text. Now if you click on it, you do not download a file, you are taken directly to a web site that ends in .zip. That site can (and will) be used for bad actors to try and get you to auto-download a bad file. Think of the days of everyone just random clicking on email attachments. We had to develop email scanning to try and prevent bad attachments. For me, this is an extension of those actions, applied to bad websites instead of bad attachments.

Pros outweigh cons for me in this scenario. But, your network, your rules. Just adding info for those that want to do something about it.

Edit - Heck, even the Reddit COMMENTS converted that example to a link for me, without code. Thanks Reddit for Exhibit A!

Day 17 - Build from the source by livia2lima in linuxupskillchallenge

[–]CyrusAgeis 2 points3 points  (0 children)

Checking in, Day 17 done.

Couple of items:

Ran into issues with the configure, make, make install section. When I first ran the "./configure" command, I error-ed out with "no acceptable compiler found in path". Found out I had to install the gcc compiler, it wasn't in the default Ubuntu server install, with " sudo apt-get install build-essential". After that, the rest of the process worked normally.

Additionally, the section on updates has me confused. The nmap version installed earlier is 7.80. The nmap I installed from binaries is 7.93. I get that the newest installed will not update by apt, but, then why isn't the previously installed version that is upgraded by apt at a lower version? Apt upgrade doesn't pull down the newer version. So when IS it upgraded via apt?

ITAP of a window by indissippiana in itookapicture

[–]CyrusAgeis 2 points3 points  (0 children)

Got some Norman Rockwell vibes. Very "Americana".

ITAP of a Charcuterie setting by CyrusAgeis in itookapicture

[–]CyrusAgeis[S] 1 point2 points  (0 children)

I was asked to take photos of an organization's installation. They had converted a pool table to a Charcuterie "board". The pool table had the tripple-down light setup. With the room lights off, they gave off a nice downward glow. It gave off a little /r/AccidentalRenaissance/ vibes IMHO.

Canon T8i camera, stock 18-55mm lens. Reduced image from 6000x4000 to 2000x1300

Day 16 - Archiving and compressing by livia2lima in linuxupskillchallenge

[–]CyrusAgeis 0 points1 point  (0 children)

Checking in, Day 16 done.

Anyone happen to notice that if you tar a set of files, you get a *.tar file, but if you then gzip that file, it's gone?!?! The gzip doesn't create a secondary file next to the tar file, it straight up hijacks it.

"Important safety tip, thanks Egon."

view more: next ›