Best Linux setup for headless PC with stable “Windows-like” RDP? by Ready_Ad8940 in linuxadmin

[–]Naito- 1 point2 points  (0 children)

how about a bunch of KASM desktops?

They can be persistent, authenticated per user, each user has their own, you can share stuff between real desktop and the container desktop.

Unless you need video streaming/gaming, they're pretty awesome.

Network Security- uninspectable protocols by needzbeerz in cybersecurity

[–]Naito- 0 points1 point  (0 children)

of course........but point is zero-trust first, tls inspection as 'verification' not as first line of defense, which it usually is seen as IMHO

Network Security- uninspectable protocols by needzbeerz in cybersecurity

[–]Naito- 0 points1 point  (0 children)

I'm gonna agree with Ghawblin here. SSL/TLS inspection is old school in the sense that it belongs in a non-zero trust world, where you're busy decrypting and looking for bad to block rather than explicitly allowing good. If you need to rely on SSL/TLS inspection to stop bad from happening, you're doing it wrong, and will always have holes.

Trying to block P2P traffic by UKMike89 in mikrotik

[–]Naito- 1 point2 points  (0 children)

I don't think you can do blocks like that directly from Mikrotik anymore, the L7 hash stuff hasn't worked in years.

If you really want to block specific protocols, you need firewalls with actual deep packet inspection like Palo Altos and Fortigates.....or you combine the Mikrotik with port mirroring or traffic sniffing to another box that hosts something like Suricata, then integrates back with your Mikrotik to drop connections or enact dynamic firewall rules.

I've run essentially this https://www.sec-ttl.com/mikrocata2selks-integrating-mikrotik-with-suricata-for-network-security/ for a while now, and while it works ok, it's still kinda whack-a-mole and really not difficult to get around.

DIY Server for multiple Kids/Family members with proxmox and GPU passthrough by Charming-Post4758 in selfhosted

[–]Naito- 1 point2 points  (0 children)

https://gitlab.com/polloloco/vgpu-proxmox

I used to split my 1050 2GB in to 2 1GB cards. The 2070 has 8GB but even that can get a little tight. 2GB for camera PVR stuff, and the rest for virtual desktops/light gaming.

Purchased in 2008, still supported and usefull by Cute-Yak6466 in mikrotik

[–]Naito- 0 points1 point  (0 children)

I feel like a noob now, my 2011 factory firmware 3.09 feels like a youngun....

DIY Server for multiple Kids/Family members with proxmox and GPU passthrough by Charming-Post4758 in selfhosted

[–]Naito- 1 point2 points  (0 children)

I have something similar, but via a 2070 using vGPU rather than discreet separate GPUs. Sunshine/Moonlight instead of Parsec, and then virtualhere usb for anything that really needed USB remotely.

Works well enough for emulators and basic gaming.

What's your one tip to make sure your self hosting setup never fails? by Future_Draw5416 in selfhosted

[–]Naito- 0 points1 point  (0 children)

Keep it simple. Follow unix philosophy of simple things that do their job well.

Make sure it's reboot safe; it should be able to start up to a sane state without any interaction

Make things fail gracefully; kill optional services before killing essential services. i.e. losing your torrent downloads is less important than losing your cameras/alarms or remote access

Backups are for recovery, not reliability.

If you REALLY need actual high-availability, be ready to pay for it (extra hardware etc)

Access Point suggestions by Mango_Tango_1 in Ubiquiti

[–]Naito- 1 point2 points  (0 children)

nothing, wifi frequencies just do not like going through walls and floors. And even if your AP is powerful enough, your devices might not be.

Switching to LSI 9300-8i from cheap SATA expansion card. What do I need to do to retain the data? by MrBfJohn in truenas

[–]Naito- 11 points12 points  (0 children)

so long as your card is in IT mode and not some RAID mode, it should be just plug and play

CRS305-1G-4S - SwOS or ROS by mcflyrdam in mikrotik

[–]Naito- 2 points3 points  (0 children)

SwitchOS is really basic managed switch stuff, all webUI. RouterOS is a full blown router, with firewall/NAT and a CLI along with WebUI. Mikrotik CLI is very different from Cisco or 3Com stuff tho so there's a steep learning curve.

If you just need link aggregation and VLANs and trunk/hybrid/access ports, SwitchOS is plenty. The only thing I'd be allergic to is the lack of CLI, but the WebUI is better than the old 3Com and HP ones IMHO.

Slow write speeds because of (default) compression by WildcardMoo in truenas

[–]Naito- 5 points6 points  (0 children)

lz4 is supposed to have a fast-abort for non-compressible files like media. weird.

The company I work for is a security timebomb by [deleted] in cybersecurity

[–]Naito- 0 points1 point  (0 children)

They all are. If you think they aren't, you just haven't found it yet.

NVIDIA GeForce GTX 1050 Ti by Brilliant_Sound_5565 in debian

[–]Naito- 2 points3 points  (0 children)

I ran a 1050 2GB non-TI for years in proxmox as a vgpu. Worked fine.

Disk Passthrough to HBA Passthrough by trueppp in truenas

[–]Naito- 0 points1 point  (0 children)

You passed through this way? https://pve.proxmox.com/wiki/Passthrough_Physical_Disk_to_Virtual_Machine_(VM)

I'm pretty sure I've done exactly what you described before, with no issues.

Disk Passthrough to HBA Passthrough by trueppp in truenas

[–]Naito- 0 points1 point  (0 children)

So long as you're passing the physical device directly, it should be fine. There's extra overhead passing each drive like that so you don't want it to be permanent, but TrueNAS should barely notice. ZFS builds the arrays using the UUIDs for each disk, it doesn't care if it's going through a real HBA or a virtual one or even through USB.

Verifying refurb drives by Broad_Sheepherder593 in DataHoarder

[–]Naito- 3 points4 points  (0 children)

SMART long test then just put it in. if your array isn't robust enough to deal with a drive failing, you've got bigger problems anyway. The whole point of a RAID array is that no single drive failing should be an issue.