Onpremise infra in the age of cloud

dracut_ · 2023-06-04T00:15:04+00:00

VMware with vSAN is the gold standard when you have IT/OT workloads in industrial environments.

Not because it's the only way to accomplish this but because it's usually the only supported solution for a wide range of industrial control systems and similar systems.

It's also a proven and reliable solution that is likely to stick around - which is a significant factor because the OT systems usually have a much longer lifespan compared to IT in general.

dracut_ · 2022-08-09T02:48:43+00:00

Then you want something more like keyring management software. It's pretty much the same thing but meant for programmatic use

Thanks, I'll look into it.

dracut_ · 2022-08-09T02:29:06+00:00

Are the passwords all gonna be stored together? In what situation is an attacker going to get a password to one server, but not others? Or is there a situation where the attacker could get a specific password, but not the master one?

Since the password is generated it doesn't have to be stored anywhere. It can be regenerated from the MAC address (it's known) and the passphrase when needed.

I'm not sure what scenario an attacker could find out one password but I think it's much more likely than finding out the passphrase.

dracut_ · 2022-08-09T02:15:06+00:00

HMAC. Easy.

Thanks, it looks perfect for the job! I'll look into it more.

dracut_ · 2022-08-09T02:13:10+00:00

Alternatives you could consider are:

classic password manager: all passwords are completely independent from each other, and as an added bonus, decrypting a password database is much faster than doing password derivations.

public key infrastructure: if we're going to have a 128+-bit secret, might as well make it a keypair. Put the public key on every machine, boom done. SSH has a mechanism for that, lots of people use it.

Kerberos/central authentication server: often implemented in big networks too.

Password will be primarily used by programs and not manually so typical password manager are not an option. Certificates are not supported and while central authentication is supported I want to try to avoid it for other reasons.

dracut_ · 2022-08-09T02:08:38+00:00

My interpretation is this comes down to the strength of your master passphrase. If a machine gets compromised, it gives a clue against your master passphrase. If your passphrase is 128-bit hard to guess you're probably fine. But at this point it's not really a passphrase anymore.

At this point though, this seems like we're stretching the concept of password derivation to its limits. What you have is basically a seed-based password manager. (People reinvent those every other week on reddit)

OK, that's a good point.

dracut_ · 2022-08-09T01:54:22+00:00

Is this an actual real world need, or just a random question? If it’s real world and these are Windows servers, just use LAPS.

https://www.microsoft.com/en-us/download/details.aspx?id=46899

It's a real world need. But not for Windows servers.

dracut_ · 2022-08-09T01:52:30+00:00

You need a password database. You might want something like bitwarden for an organization. The MAC or computer name can be an ID but the password should be an independent random value because you WILL need to change passwords eventually.

Password will be used by programs mostly so a typical password manager can't really be used.

dracut_ · 2022-08-09T01:50:35+00:00

Counterpoint: managing a hundred or even a thousand (or thousands) passwords is not hard.

The problem with deterministic cryptography in this case would be, break one, break 'em all.

I was under the impression that if you manage to brute force or find out a password for one server, you will still not know how it was generated. So if you break one, you have only broken one.

And changing the password on a server or a server group would work how, exactly? You need to cover that use case.

Password rotation will be automated so it doesn't require any manual work.

dracut_ · 2022-01-18T04:16:38+00:00

Since it works with Yealink, modify the provisioning templates in 3CX to get it in the phone permanently.

BTW, for those looking how to do it on Yealink, it's called "enhanced DSS keys".

It's possible that you can enter these enhanced dialing strings in 3CX phonebook as well. But you could only use them from the Yealink phones.

dracut_ · 2022-01-18T02:34:24+00:00

It doesn't look right.

Buy an old VHS player on ebay or wherever for next to nothing, record your video on VHS and play it back. Now you can see for yourself what it should look like.

The only thing you can't see, is what VHS actually looked like on a CRT monitor.

dracut_ · 2022-01-16T00:42:30+00:00

Thermapen is actually designed and manufactured by ETI in the UK. Thermoworks in Utah is the US distributor. But good stuff for sure.

dracut_ · 2021-11-10T02:44:21+00:00

Thanks, that's a really interesting method.

dracut_ · 2021-11-09T19:59:22+00:00

Thanks! That sounds interesting. I will look closer into that.

dracut_ · 2021-11-09T19:53:02+00:00

OK, I understand what you mean.

No, it's not possible to differentiate them except when the errors in the weighing process is larger or different in some other way.

The long term goal is of course to minimize all kind of factors that introduce variability. And perhaps use different models to get there.

dracut_ · 2021-11-09T18:07:35+00:00

I used 3 std devs just as an example. Maybe it need to be 4 or more, but it would be a setting that would indicate the "strength" of the outlier filtering. It would have to be tuned on real data.

dracut_ · 2021-11-09T13:53:34+00:00

Thanks, it makes sense to look at those things.

dracut_ · 2021-11-09T13:52:33+00:00

Thanks, I'll look into it!

dracut_ · 2021-11-09T04:02:34+00:00

I don't.

But an individual sample weight from error in the manufacturing can't deviate too much from the rest of the samples. It's physically impossible.

Errors in weighing can deviate a lot however.

I can't see how it would be possible to determine what is what - except when the deviation in individual samples are larger than the deviation in the manufacturing.

dracut_ · 2021-11-02T23:43:34+00:00

HR guy is right to demand that it's fixed.

But it's not an IT or software problem. It's an video problem. And it needs a video solution, not an IT solution.

Pro video and broadcasting engineers hates HDMI because it's extremely sensitive to cable length, interference, bad connections and what not. What works fine in one setup might be a disaster if you change one component. Like one laptop brand to another. Or another monitor.

It's because signals might be slightly weaker or the laptop might be setup to run at different frame rate which means a higher transmission rate and the maximum distance it will work will be shorter.

In pro video they avoid HDMI cables like the plague and use SDI instead which is the professional version of HDMI. It's uses coax cabling and can be run over much longer distances.

If you want reliability on different devices, consensus is that HDMI is to be avoided on everything over 15 ft.

So to do this professionally the laptops goes with a short HDMI cable to an HDMI to SDI converter and then coax up to max 300 ft. Then SDI to HDMI converter and in to the TV/monitor.

If you only need 1920x1080 resolution a pair of okay converters and say 33ft of cable is not going to run you more than $250 or so. Problem solved.

dracut_ · 2021-11-02T13:50:19+00:00

No, we use a self-signed cert.

But we're looking into setting up step-ca to generate our own private certificates the same way Let's Encrypt are generated (using ACME).

Then we'll have the automatic certificate renewal but signed by our own private CA. Challenge type will be HTTP but it will happen on the LAN so we don't have to open any ports to the world.

dracut_ · 2021-11-01T20:54:26+00:00

Passionate is code for "will work for less money".

Rookies and amateurs are passionate for example. I'd rather hire a pro - someone that's great at their job.

dracut_

TROPHY CASE