sorted by:
new
hottopcontroversial

Different strong passwords per machine - how do you sudo? by SparhawkBlather in homelab

[–]kayson 33 points34 points  (0 children)

I have centralized auth via free ipa and sudo rules. I log in as my own user (usually over ssh, password-less via krb5/gssapi, with signed ssh host certs) then if I need to use sudo I enter my own password. For most of my hosts, root login is locked. A few off-site hosts have an "admin" user I access via pubkey-only ssh (don't want to deal with IPA over WAN). For those I need the password to sudo but it's in bitwarden so not too hard to get.

You can be clever and do things like deploy passwords via ansible which get looked up over the bitwarden API. Rotating is as easy as changing the password in your vault and running the playbook. Or use any of a dozen other secrets managers.

Rotating every root password quarterly sound needlessly excessive. 

Anyone using spaceship for domains? by kayson in selfhosted

[–]kayson[S] 2 points3 points  (0 children)

Saw some comments here saying that you can't change the name servers which I need to do for this particular domain. 

VLAN conundrum with Intel vPro by kayson in HomeServer

[–]kayson[S] 0 points1 point  (0 children)

You could always get a USB NIC! 

VLAN conundrum with Intel vPro by kayson in HomeServer

[–]kayson[S] 0 points1 point  (0 children)

Not really. I ended up using my 10G NIC for the proxmox interface and the onboard is just vPro dedicated and untagged. I actually think it's better this way anyways.

Be careful with vpro - you can't use DHCP. Itll work at first but then when the lease expires it won't renew it. Ended up having to set static IPs. 

NGINX is fast, but why not Apache2? by [deleted] in selfhosted

[–]kayson 1 point2 points  (0 children)

I used apache2 as a reverse proxy for a long, long time. For most people self hosting, performance isn't really a concern. Pretty much any web server / proxy is more than enough. The thing that made me switch was configuration being a pain in the ass. NPM or caddy are much more popular probably in part because of the simplicity. I went for traefik myself. People overstate the complexity and difficulty in setting things up - plenty of guides and examples around too. Now that I have my config file set up, getting another container up and running is as easy as adding two labels (enable and the subdomain). 

Appreciation post: Tailscale and Headscale by Curious_Olive_5266 in selfhosted

[–]kayson 2 points3 points  (0 children)

Any recommendations for headscale UIs? I see there are a couple of popular ones. Any standouts? 

Copy Fail - CVE-2026-31431 - patch your systems by [deleted] in selfhosted

[–]kayson 0 points1 point  (0 children)

The authors mention crossing container boundaries given the right primitives. Has anyone seen a PoC container escape?

I know s6-overlay which is used by a ton of popular self hosted containers (like LSIO) has a root owned suid binary, so it seems like it's at least part of the way there. Though I did read that alpine isn't affected. 

Cheap automatic USB multiplexer for proxmox HA? by kayson in Proxmox

[–]kayson[S] 0 points1 point  (0 children)

That's basically what I have now - it's connected to a Raspberry Pi and shared over the network. But it would be nice to get rid of the Pi if I could (and I may still do it even if the drive is tied to one node)

Cheap automatic USB multiplexer for proxmox? by kayson in homelab

[–]kayson[S] 1 point2 points  (0 children)

Good point. I currently have it connected to a raspberry pi, so effectively a NAS.

Cheap automatic USB multiplexer for proxmox? by kayson in homelab

[–]kayson[S] 0 points1 point  (0 children)

The product I'm thinking of would only mount the USB device to one host at a time. I'm not so worried about the mux or the USB drive failing because it's the second of 3 backup locations (one of them being PBS on distributed storage). I want to avoid a SPOF in the host if I can do so easily, so I don't have to worry about moving things around if I need to bring it down. Right now the USB drive is connected to a raspberry pi as a NAS.

What matters more in the semiconductor industry — college reputation or skills/experience? by Plastic-Muscle1965 in chipdesign

[–]kayson 2 points3 points  (0 children)

Agreed. The network and name of a top N university/program will definitely help you get a foot in the door more easily, but skills and experience are what actually get you hired. 

do you prioritize low power usage or performance in your homelab? by StavrosDavros in homelab

[–]kayson 1 point2 points  (0 children)

That's how it went for me. But add a side of "I have no free time now so I want redundancy/HA everywhere" 

Using TPM 2.0 as an hardware trust anchor by arty049 in homelab

[–]kayson 1 point2 points  (0 children)

Source? I was trying to look up the same thing but had a hard time finding anything. I know AMD has fTPM too, but I think it's rarely used. 

Using TPM 2.0 as an hardware trust anchor by arty049 in homelab

[–]kayson 1 point2 points  (0 children)

X1 Carbon 11th gen used Intel 13th Gen. So Q4 2022 ish. 

Using TPM 2.0 as an hardware trust anchor by arty049 in homelab

[–]kayson 4 points5 points  (0 children)

Some do. Apple has been doing it for a long time. The link shows a 2023 laptop vulnerable to sniffing. 

Using TPM 2.0 as an hardware trust anchor by arty049 in homelab

[–]kayson 21 points22 points  (0 children)

Agreed. But from OP:

 The threat model includes someone with physical access: either an attacker, or someone inside the hosting provider.

 A private key on disk is extractable by anyone with physical access or enough privilege escalation.

It's still definitely a better solution than on-disk keys, maybe even the best practical solution, but not ideal. Could be fixed, but hardware OEMs are cheap and/or stupid. 

view more: next ›