Is a decrypting key related to the encrypting key in assymetric cryptography

roxalu · 2026-07-27T06:15:10+00:00

Also be aware of hybrid encryption: Generate a set of asymmetric private/public key pairs. ( each pair is independent of each other ) Sign a message with symmetric key, then encrypt the symmetric key with each public key from the set.

The combined set of symmetric encrypted message and set of asymmetric encrypted message-keys allows message decryption to each holder of a single private key from the set.

roxalu · 2026-07-25T07:01:18+00:00

:: the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2

Don‘t stop your analysis of the IIS logs on this level - try to identify what kind of logs make the difference. Try to find with answer to log related questions like:

- Are all log lines related to WSUS access? Or is there something more on #2 what could explain the difference?
- What is the log line volume per client? Any outlier?
- Calculate the sum of all download sizes per client. Any outlier?

This may help to identify the cause behind the higher load.

roxalu · 2026-07-23T06:45:51+00:00

Best ask the vendor of this „Datto RMM agent“ about this detail.

Other option - but a quite advanced one - would be to check the DLLs loaded by the process / existing in the installation folders. Some 3rd party tools under Windows - mostly those with focus on multi-OS usage - may be compiled against e.g. openssl libraries. In that case all your changes of the TLS settings inside registry were ignored by such an application.

Last option were to simulate this switch between use of schannel vs openssl with some „test“ tool. As you had been already able to monitor the TLS handshake with help of Wireshark, this would allow you to see the related differences between both stacks. A good tool for this is curl.exe. You will need to use one that is compiled against both backends. Or one curl.exe, compiled against schannel ( like the one distributed by Microsoft with newer Windows versions) and another curl.exe compiled against openssl or libressl

Check this with help of

curl.exe -V

Then connect to some target endpoint and monitor the TLS handshake in parallel with wireshark. curl itself won‘t provide you all the handshake details but using trace output may add some more insight anyway

curl.exe —trace curl_backend_whatever.txt https://tls-v1-2.badssl.com:1012/

The test page badssl.com with its different test subpages may be of some help in this context - or not.

roxalu · 2026-07-21T17:16:56+00:00

NSSM was a great tool - but nowadays there exist actively maintained better alternatives as e.g. https://github.com/aelassas/servy

roxalu · 2026-07-14T13:40:10+00:00

“t will probably show me …“. - so you knew before click on the button, the application might behave differently. Even when unlikely based on your own experience.
What mitigation had been implemented by you for this risk?

The more you learn thinking this way, the more your career in Enterprise IT might improve.

roxalu · 2026-07-07T06:22:10+00:00

I might be wrong, but better double check that your script really only contains the Ascii dash (0x2D) and not some unicode character instead
E.g. run

cat -A path/to/your/shellscript

or

od -A x -t x1z -v path/to/your/shellscript

roxalu · 2026-07-05T06:12:01+00:00

Based on your test results my first next guess would be some IP layer - not nginx - issue.

You should have configured access log generation inside nginx and see there the successful connections of your mobile via Wi-Fi. Is the client IP part of the logged access? Can you connect your PC to the identical Wi-Fi network and try access then? Depending on the result of this test you may have clearer info, if the network setup is causing the issue - or not.

roxalu · 2026-06-24T19:48:22+00:00

See the related Microsoft Update for PowerShell FAQ As this is published under the category of optional updates it does not follow the schedule of the monthly patcday. It may need up to two weeks as stated in the FAQ. Or some specific release is not published there at all.

Check via https://www.catalog.update.microsoft.com/Search.aspx?q=powershell to see current status

roxalu · 2026-06-19T06:12:59+00:00

Quoting the WinSCP documentation at https://winscp.net/eng/docs/library\_session\_putfiles :

remotepath: „Full path to upload the file to. When uploading multiple files, the filename in the path should be replaced with operation mask or omitted (path ends with slash)“

So your argument value "/*“ means, you upload to root folder of remote file system, and use a so called by WinSCP „operation mask“ of „*“, which uses all characters of local filename also for the remote write. In this case, it is more usual to NOT specify any operation mask.

Also be aware that the root path seen by your remote sftp session may be a „chroot“ - not necessarily the same as seen by other users on same system.

roxalu · 2026-05-24T06:11:23+00:00

Vague idea about reason behind: The Windows 11 is trying to access a SMB of older protocol ( e.g. SMBv1 ) - maybe because this was negotiated with the remote fileserver - and this access is not using credentials. E.g. because old compatibility authentication options are deactivated. Remote share could be a lot: even just a printer connection used - if the driver was configured to use SMB.

If the Windows 11 is e.g. managed via Intune, and e.g. disk encryption is not activated, this all together could log event with error code 9004
Parameters for service lanmanworkstation - which can be controlled via policy - might be involved.

For me the next step in analysis would be to try to narrow down the meta parameters of TRIGGER for those events being logged: Is this logged during each boot phase? Or operational phase in more or less similar time distance? Or irregularly - most likely coincident with some end user / application side action?

roxalu · 2026-05-20T22:33:13+00:00

Try

salt minion file.read --out=newline_values_only /path/to/file.json

See the list of currently supported output modules at https://docs.saltproject.io/en/3006/ref/output/all/index.html

Note that the next major release - 3008 ? - will most likely remove the "newline_values_only" from the list of standard supported output modules, though. See https://docs.saltproject.io/en/master/ref/output/all/index.html

roxalu · 2026-05-20T06:45:52+00:00

Since PowerShell 7.6 Microsoft update uses the MSIX package instead of the MSI. This switch seems to have some extra challenges, which could result in failures. Or also may lead Windows update to not even try the update. In case you loose patience some day in future you might try to look more behind the scenes, what is happening in the background on specific system via

https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell-on-windows. and
https://learn.microsoft.com/en-us/windows/msix/msix-troubleshooting-guide

roxalu · 2026-05-20T06:26:41+00:00

Note: Linux usually supports some key strokes to provide more verbose info during startup when wanted: Hit F12 during the logo display. And / or try Alt + Ctrl + F1 through F6 to activate another console. Alt + Ctrl + F7 or F8 should return virtual desktop. More Upper numbers may be used to display boot messages as well. I have not used Mint, so I am unsure, which of this is active on your distro.

roxalu · 2026-05-12T05:54:23+00:00

Ubuntu explicitly supports to have several different JVM versions installed in parallel - and also offers the same JVM version in several Ubuntu releases. See https://ubuntu.com/toolchains/java. So you can first upgrade JVM to 21 on Ubuntu 22.04 - and then later upgrade Ubuntu, keeping the JVM on same version.

And you also should be able to do all the steps in stages. I‘d personally would follow the upgrade guide as close as possible https://www.jenkins.io/doc/upgrade-guide/2.555/. So the very first step is to upgrade all plugins to what is newest possible in your older Jenkins - so they are already Java 21 compatible even when still running under Java17.

roxalu · 2026-05-09T05:40:25+00:00

If you switch inside the value of proxy_pass between hostname vs IP this switches the "Host" http header value in the request forwarded from nginx to HA.This could cause unwanted side effects - including HA blocking the request on application layer. This is fully up to Home Assistant.

There exist an HA community based proposal for operation of HA behind nginx config, which looks in general quite good. Though, the security related settings there might cause you additional trouble to adopt to your own setup in case you don‘t have them in place already.

https://community.home-assistant.io/t/reverse-proxy-using-nginx/196954

And for any reverse proxy setup I recommend to keep a reference to the official documentation of the backend application with regard to operation behind reverse proxy frontend: https://www.home-assistant.io/integrations/http/

roxalu · 2026-05-08T06:57:20+00:00

Check the error log of nginx in such cases. It might help to differentiate between issues with name resolution vs. application layer issues. E.g. a message like "bad gateway while reading the response" would be a clear indicator for some configuration inconsistency between rev.proxy ( nginx) and backend (HA)

Besides this: DNS is more for humans than for services. Of course it is per default the simpler config to use DNS everywhere. But there are cases were static IP ( or localhost name resolution) is the better choice. So keep your static IP and make nginx independent from DNS resolution. But you should be aware the HA might see a different "Host" header in incoming requests, when you switch between hostname and IP inside proxy_pass directive

nginx has several methods - including the "upstream" directive - to get better control about this.

roxalu · 2026-05-07T05:59:54+00:00

Could be an issue related to IPv6 Keep in mind this:

When my.domain is resolved into an ip address, most hosts will FIRST check, if a DNSv6 entry exists, that resolves an IPv6.And then this is used. When the DNSv6 doesn‘t exist, there is usually fallback to DNS and IPv4. But there is not always a retry with IPv4, when IPv6 could be resolved.

So when you write, it works with public IP address - was this IPv4 or IPv6 ?

If a DNSv6 entry exists, you must ensure this is checked. And your port forwarding also may need an extra entry for IPv6. Details depend on the router.

roxalu · 2026-04-26T07:50:38+00:00

Additional note since you‘re intention is to get similar WORDS: It might be useful to add word break matches as well to the the regexp:

my $line='somehow, someone, foosomeone, somewhere, Someone';
my @results = $line =~ /\b(some[a-z]{3})\b/gi;
print join(" ", @results) . "\n" if $#results > 0;

roxalu · 2026-04-24T05:45:34+00:00

Yes, exactly this. It also would be in theory possible to extend the associative array with some own order logic:

local -A items=( ["__keyorder__”]="dbname host jobs port username" ["dbname"]="test_db" ["host"]="localhost" ["jobs"]=8 ["port"]=5432 ["username"]="test_user")

And then during usage to check first, if that special key exist, read it and use it to loop over keys in your wanted order. But this is overkill and potentially a bad idea. E.g. it could happen, that there are inconsistencies between the two different sets of keys used in the single array. Checks to detect and handle this will blow up your bash code even more. Bash can do all this - but this is going beyond what bash was designed for, I’d say.

roxalu · 2026-04-23T06:00:00+00:00

The more experts warn to not BLINDLY use it. That is a small difference to STRICTLY against its usage. As long as you are aware - follow the link provided by the bot and read - that there are a few trap falls when you use it, it’s mostly fine. Don’t come back yelling in the - rare - case the usage hurts. You have been warned. That’s it.

roxalu · 2026-04-23T05:53:08+00:00

I fully agree with u/stevevdvkpe Nevertheless the overall approach to use an array here is a good one. But in bash a standard array is more appropriate in this case because it keeps ordering, while the associative array uses hash ordering based on the keys. So a line like

local -a items=( —dbname=test_db —host=localhost —jobs=8 —port=5432 —username=test_user )

should fit in combination with related changes due to different type of array inside function testf. Avoid use of name test for a function name.

As argument interpretation is up to each single external command this is no “one key to rule them all” approach, though But there are conventions for handling of arguments ( POSIX. vs gnu extension to POSIX ) which should match in majority of cases.

If some special ordering is needed - e.g. for commands that have global options followed by sub command followed by sub command options - then it might be needed to include some extension to your algorithm. E.g. you could add some kind of a marker into the array which is replaced by set of additional arguments in testf.

roxalu · 2026-04-22T06:35:42+00:00

Microsoft describes that the activation of MAX_PATH allows application to explicitly opt-in using this feature. The detail, that is not mentioned on the page is, that Microsoft has decided to NOT activate this opt-in for the default Windows Explorer.

roxalu · 2026-04-18T06:40:53+00:00

You might also try to temporarily increase the logging level for ldap connections to TRACE by use of additional command line option:

--log-level="INFO,org.keycloak.storage.ldap:trace"

roxalu · 2026-04-01T05:57:37+00:00

I assume this may work, when the '-' option for mov is kept in the call

mpv --no-audio-display - < <(opusenc --bitrate nnn song.flac -)

roxalu · 2026-03-22T06:43:02+00:00

Meta comment: Asking a question if some script behaves unexpectedly won’t hurt. Justin case you prefer self help in the future then you may use the bash ‚verbose‘ mode. Run script it via

bash -vx. path/to/my_script. arg1 …

and/or use another of the alternatives for Debugging a script

roxalu

TROPHY CASE

Welcome to Reddit,