9·
7 hours agoProxmox
- based on KVM
- relatively easy to install
- big community and lots of how-to guides
- well-documented hardware pass through
- minimal install (no cups, no extraneous software)
- 0 Posts
- 163 Comments
Joined 3 years ago
Cake day: June 16th, 2023
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
Really great article.
I was a bit critical of your last post on kernel init stuff, but this one is well laid out and gets quickly to the material at hand: all applications make the same system calls.
Keep it up, I’m going to follow this.
I’m agreeing with you. Is there something unclear in my comment?
deleted by creator
I agree, personally.
And the absence of as many formal modding tools is, I believe, a reflection that many other Linux gamers think this as well.
You’re talking about modding in general, which is pretty similar in Linux to windows, besides some obligatory learning about Wine/Proton contexts. Hint: just use protontricks and install your windows mods that way.
But what you are actually asking is “why hasn’t someone else made a nice, easy tool for modding like I had on windows?”
And the answer to that is:
No one is stopping you from making it.
Welcome to Linux. You wanted freedom, you got it.
My LDAP PTSD is coming back…
I’ll make the following LDAP assumptions:
- LDAP directory is configured and available
- LDAP uri is configured and a lookup on system level is working and returns the correct POSIX uid/gid with LDAP query
- no POSIX conflicts on the client (no object in passwd has uid/uid 11004) I can assume this because the fail over is root
- LDAP search base is configured and returns expected POSIX values
And I’ll make the following postgres assumptions:
- pg_hba.conf is configured for LDAP server address, port, and search base
- postgres can instantiate and connect to its dbs using LDAP with ldap
Finally, I’ll assume that your nfsv4 mount is active and that POSIX operations work at Pam - level tests.
The line
group: files [SUCCESS=merge] sss [SUCCESS=merge] systemdSeems weird to me; either you add success clause to both uid and gid, or none, but not one and not the other.
This would also hint that Pam has not been updated to use LDAP.
That’s where I’d start.
Side note: LDAP is by default unencrypted on the wire, so to complete this exercise, you may want to setup secrecy on the server. This is especially important for db creds.
I just tried a few fonts on my old Kobo, as I’ve done a few times here and there, and I always end up back with a serif font. I’m not sure why, but I have suspicion that reading paperbacks and newspapers before ereaders existed has trained me to read faster with serif fonts.
Context, man.
If you’re looking for something, use more words. If you’re x11/Wayland trolling, this is weak.
Sure, but if the compromise stays within its own app, like for a browser, sandboxing won’t help.
The bulk, and I mean like 95% of the compromises I see are normal employees clicking on things that “look legit”.
Excel is now wrapped in a browser. Discord, almost all work apps are all wrapped in a browser. So you can be completely locked down between apps like grapheneos, but if you are choosing to open links, no amount of sandboxing is going to save you.
This is why we deploy knowbe4 and proofpoint, cause people are a liabilities, even to themselves.
Sure, but op chose to follow a link. You can be sandboxed to high heaven and still get pwned if you make choices like that. Discord is particularly rife with this.
OK, I’ll bite… How exactly?
Yep.
I was hoping not to sound too harsh, I’ll have to work on that.
You aren’t going to like this:
Because if you got yourself pwned by a malicious link in discord, your account highjacked, etc., then having discord in a vm, container, chroot, jail, or whatever won’t help you on the server-side api abuse that got you pwned. In this case, you yourself should have been more vigilant.
From your article, and with respect, I think its nice you’re thinking more about security, but you’re mixing up quite a few concepts, and you should probably make smaller moves toward security that you actually understand, instead of going all-in on qubes with only a vague concept of the difference between sandboxing and paravirtualization.
The idea itself is fine (not getting into how not cool it is that a vendor holds the key to your bitlocker-encrypted disk once secure boot is turned on).
But so is WEP for WiFi, but no one uses that anymore because it’s considered compromised.
some are
65% of all TPM keys is “some”, I suppose. But that’s not the issue. Keys leak, it happens. The more troubling part is that Microsoft will cheerfully use the leaked key on your affected TPM and you’ll get the “safe” check mark in your next audit.
And this was warned about in 2011 when it started rolling out.
As for FUD, I don’t have a “fear” angle here. I can’t tell you how to live your life, use secure boot if you feel safe doing so.
I don’t understand… Your motivation for a secure operating system was from an incident where you were nearly social engineered? How will a “more secure” os help you with that?
If everyone has a copy of my passwords and authenticator keys, that wouldn’t suddenly make 2 factor auth a compromised idea.
Not sure how this relates. If you’re saying it was a good idea at the outset, then sure… If the keys hadn’t almost all been leaked by AMI and Phoenix. MS was supposed to have created a Microsoft Certified hardware vendor program for this, which fell apart pretty quickly.
Secure Boot is a joke, both practically (there are many, many tools in use to bypass it) and in my professional circles, it is considered obsolete like WEP. My audit controls for Secure Boot demand that an endpoint management solution like InTune is deployed.
You don’t have to take my word for it, obviously. I’m not trying to tell you how to live your life.
Secure Boot keys are considered compromised.
If you are recommending secure boot as a security measure, you should stop doing so.
Nice, and good job.
With respect:
- You are describing the init process, after the boot stuff is done. Not sure if you meant that or not.
- vmlinuz is the bootable kernel image distinct from the kernel itself. It contains the compressed bootable ELF kernel image (which itself contains bvmlinuz) and gzip decompress function, bsetup code, bbootsect system.map, and a handful of commands for the kernel image to bootstrap itself.
- Kernel space doesn’t stop once user space is allocated memory and initialized, they both run at the same time. Maybe I read that wrong, but it didn’t seem right to me.
I want to be careful here not to discourage you, this is great exploration!
I realize I’m handing out unsolicited advice here, but when I was first learning about Unix/Linux kernels in the Solaris and HP/UX days, the thing that helped the process “click” for me was compiling a kernel and building an ELF. And if you’re going to continue on this journey (which I hope you do), you should probably read a bit on memory segmentation and broadly about assembly instructions.
Good luck!
Proxmox has no desktop by default. You can install it, add a desktop environment, but it will be less hassle to just use Debian as the desktop and install proxmox on top of that.
Ultimately, it’s all Linux or Unix. You can install qemu/KVM and libvirt on just about anything.
You can pretty much just pick your distribution and then add KVM on top of that, it will get you a long way before you need to use anything with more features.
A lot of people like to keep their hypervisor separate from their daily driver, but you can totally just fire up VMs and containers on your dd if that works for you.