starkzarn

joined 2 years ago
[–] starkzarn 2 points 9 hours ago

Okay this is excellent content, thank you!

I went through and fiddled with some more stuff to try and get this working to no avail. However, it inspired me to take apart netboot.xyz a bit more, and I was able to grab an efi and get next boot to load the efi file. It took me too long to realize you need the console tty arguments as part of the boot cmdline to get it working interactively, but after I got there I got it netbooted. Sadly though, it almost immediately runs into an OOM condition and thus isn't practical on a free tier x86 asset. It would probably work on an aarch64 node, but I already have my allotted arm node spun up and working so I don't have a free one to practice with.

Solid write-up though, thank you for putting that together!

[–] starkzarn 2 points 16 hours ago (2 children)

The "gotcha" with Oracle free tier is that you can't install from arbitrary media, so the typical netboot.xyz or any iPXE workflow is out. No console access, no pre-bootloader access, nothing.

I've been fiddling with kexec, but it doesn't seem like a supported method of loading the lkrn file from netboot...

This is super interesting to me, so by all means, if you have the kung-fu to show how this works I would happily read through that!

[–] starkzarn 2 points 19 hours ago (1 children)

Interesting. I've had two instances running for over 2 years and haven't noticed that. It might be that I just don't notice it though. I'm not scrutinizing it much.

[–] starkzarn 3 points 19 hours ago (4 children)

I am not well versed with kexec but I always understood it to be a kernel reboot without power cycling the "metal." Please enlighten us with an example! I don't see how you'd replace the entire userspace (and possibly filesystem) with simply kexec.

[–] starkzarn 10 points 21 hours ago (3 children)

Certainly! As others have said, don't hang anything worth value on it without an out of band backup strategy, they're famous for unscrupulously deleting things with no warning. Oracle is a miserable company.

Free is free though!

 

Decided to write up a quick post on a hacky workaround I came up with for custom distros Oracle free tier and thought I'd share. Don't rely on Oracle, but definitely do leverage as much of their free compute as you can for non-critical workloads!

[–] starkzarn 2 points 2 weeks ago

Mullvad Leta is the way

[–] starkzarn 2 points 3 weeks ago

I would recommend giscus over discus, but yes, certainly a valid approach!

[–] starkzarn 2 points 4 weeks ago* (last edited 3 weeks ago) (2 children)

I have been pleased with giscus on my blog (http://roguesecurity.dev/ ) Its powered via github discussions.

[–] starkzarn 2 points 1 month ago

XMPP is the way! I recently dove in as a replacement to matrix and have really enjoyed it.

[–] starkzarn 1 points 1 month ago

Agreed, prosody is great! I've been doing some experimenting with ejabberd and it seems more enterprise-ready, but I haven't found anything that is discernable as far as feature advantages.

[–] starkzarn 1 points 1 month ago

Sounds like a great opportunity to breath some life into it! If you really have the itch for IRC, there's a slidge bridge to connect IRC to XMPP!

[–] starkzarn 1 points 1 month ago (2 children)

Agreed! Runtime environment management is so much nicer with modern containerization. You or ally can't overstate how much better it is to have app stack state be entirely divorced from OS state. I'm very pleased they're back on the bandwagon as well.

Stand up a server and come join our MUC!

 

cross-posted from: https://infosec.pub/post/36118098

Take control of your data, join the tech chat. Host an XMPP server and leverage end-to-end encryption for your personal data

 

Take control of your data, join the tech chat. Host an XMPP server and leverage end-to-end encryption for your personal data

30
Systemd Service Hardening (roguesecurity.dev)
submitted 3 months ago by starkzarn to c/linux@lemmy.world
 

cross-posted from: https://infosec.pub/post/32937284

This one is a little self-hosting specific, and more casual Linux best practices, but I've got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

1
Systemd Service Hardening (roguesecurity.dev)
submitted 3 months ago by starkzarn to c/linux@lemmy.ml
 

cross-posted from: https://infosec.pub/post/32937284

This one is a little self-hosting specific, and more casual Linux best practices, but I've got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

131
Systemd Service Hardening (roguesecurity.dev)
 

This one is a little self-hosting specific, and more casual Linux best practices, but I've got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

 

cross-posted from: https://infosec.pub/post/32151664

This is a generic metrics post to leverage a spare ESP32 meshtastic node to ingest metrics into Grafana! We've had some congestion issues due to poor config in my area, and this has helped me pinpoint which nodes are causing the biggest problems, and block them at my repeater.

 

This is a generic metrics post to leverage a spare ESP32 meshtastic node to ingest metrics into Grafana! We've had some congestion issues due to poor config in my area, and this has helped me pinpoint which nodes are causing the biggest problems, and block them at my repeater.

 
 

This one is less focused on self-hosting a homelab service, but I thought might be interesting for the homelabbers here. I got into this hobby through my career in cybersecurity, and decided to write up a little post about a tool I frequently use, mitmproxy!

view more: next ›