Root Access

allquixotic

7:00 PM

@djsmiley2k "business" connections are complete, 100%, horseshit. snake oil.

unless they're laying physical infrastructure in the ground specifically for you, it's bullshit.

djsmiley2k

yeah... that's what i mean

allquixotic

literally the same service as a consumer connection

bertieb

@allquixotic Aye- I have a tiny VPS (H/T to Bob for bringing lowendbox onto my radar many moons ago) for websites which have no business being hosted on a home connection; but for VOIP (mumble after moving away from TS) and game servers I've found the latency not too bad, around 50ms

djsmiley2k

I don't mean noddy stay at home mum business connection

i'm talking 35k/mo business connection

bwDraco

I have three VPSes on Linode.

bertieb

7:01 PM

@djsmiley2k I'll get right on that, you bring the 35k/mo :P

djsmiley2k

;)

bwDraco

One of them is supposed to run a SmokeDetector instance but has been down for a while; I might be able to bring it back online soon. charcoal-se.org

allquixotic

@djsmiley2k if your budget is $35k/month for just your internet connection, your income (the way you're paying for it) is in a completely different class than what I'm talking about; $35k/month is for a business making business income

bertieb

For that, could probably get BT Openreach to dig up everything between here and exchange and also put in FTTP while they're at it

Canadian Luke

@allquixotic I was doing Office 2016, Adobe Reader and Chrome on the Win10's, and doing Active Directory DCs on two servers, a router and gateway on one, and a file server on the other server

allquixotic

7:03 PM

but you could still get a ridiculous amount of power in the cloud for $35k/month

I'm paying $80/mo for 128 GB of RAM on one server, small disks and a meh Ivy Bridge E5 processor

bwDraco

$35K a month is enough to get a "private cloud".

allquixotic

for $35k/month you could get dozens of top-tier servers with terabytes of SSDs, tens of terabytes of total RAM, 100 GBps or so connection

your own rack or three

djsmiley2k

hehe

allquixotic

you could probably get a badge to enter into the facility and look at your servers

djsmiley2k

i can't even afford £10/mo tbh

bertieb

7:04 PM

Makes my £17/year VPS look like a grain of sand next to that beach :P

bwDraco

Currently paying $15/month for three servers.

djsmiley2k

ok, £17/yr is something i could concider

bertieb

@djsmiley2k *£15

djsmiley2k

even better

bwDraco

One handles my website and Firefox Sync, one for a Smokey instance (see charcoal-se.org to learn more), and one as a Linux "cloud desktop".

bertieb

7:05 PM

Could find you the deets if seriously interested

Or even jokingly interested

allquixotic

@bertieb 50 ms ping isn't bad, but if the CPU gets fully utilized the "Server FPS" of the game engine will go down and the quality of play will go down, that's my main concern on a VPS

Canadian Luke

Got you all beat - $6 USD/mo for my VPS!

allquixotic

also that 50 ms is probably within the same country; my server is hundreds of miles away... the point to point ping is bad enough because of geography, I don't want it to be even worse because of a hypervisor and overloaded CPU

Canadian Luke

... 512 Mb of RAM, 20GB storage (on SSDs)...

djsmiley2k

@CanadianLuke over a year, you loose

bertieb

7:06 PM

@allquixotic truedat- my 'server' is an old gaming desktop tho and it's holding up not badly

@CanadianLuke Same ish spec as mine IIRC

Canadian Luke

@djsmiley2k Oh, I misread yours as 17 pounds per month

bertieb

The place I'm with did a Black Friday deal for something quite nice at $5/mo I nearly went for

bwDraco

linode.com

bertieb

Oh wait, not the one I'm with, but another found-via-lowendbox I've been with

I think

I'm pretty sure I have an el-cheapo VPS somewhere that I've forgotten about

allquixotic

oh, the other concern with hosting a server at home? Unwanted heat production. I don't need extra heat in the winter (central A/C takes care of that) and in summer it would make the room it's in unbearably hot, like my desktop already does :/

bertieb

7:10 PM

Another good point! Mine's in a loft, and the heat during the winter is most welcome :D

Canadian Luke

Can't use linode for what I needed... Need to keep data within Canada

bertieb

Hah, I managed to ssh into the VPS I wasn't sure that I had

I guess I still have it (yay?)

allquixotic

and if all that wasn't good enough, OVH has applied a seemingly permanent 25% off the asking price of my server, so what was already a good deal is now a spectacular deal

so I bought 2 years of service in advance

djsmiley2k

Nice

bertieb

Ah yeah, that's pretty nice; definitely worth hunting/waiting for the deals

allquixotic

7:12 PM

I might spend my income tax refund later this year on a third year so I really have it long time, although I'm not sure if an Ivy Bridge CPU would still be good in 2020

bwDraco

@allquixotic Especially with no INVPCID support.

allquixotic

might have to buy into the current server of a similar price to what I have in 2019

@bwDraco pretty sure Ivy has PCID

bertieb

Hah, Black Friday deal still seems to be active!

Black Friday 2017 5GB OpenVZ

5GB Ram
100 GB Disk Space
2TB Monthly Bandwidth
1Gbps Port
1 IP Address
OpenVZ

$5/mo

But... I don't need any of that really

Canadian Luke

Nice!

bwDraco

Windows needs that particular instruction for optimization, and that's only available since Haswell.

Linux doesn't use it, but a future update might.

allquixotic

7:14 PM

> processor : 7
vendor_id : GenuineIntel
cpu family : 6
model : 62
model name : Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz
stepping : 4
microcode : 0x428
cpu MHz : 1300.347
cache size : 10240 KB
physical id : 0
siblings : 8
core id : 3
cpu cores : 4
apicid : 7
initial apicid : 7
fpu : yes
fpu_exception : yes
cpuid level : 13
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pcl…

> root@kobol:~# ./spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.31

Checking for vulnerabilities against running kernel Linux 4.4.0-109-generic #132-Ubuntu SMP Tue Jan 9 19:52:39 UTC 2018 x86_64
CPU is Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Checking count of LFENCE opcodes in kernel: NO
> STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available)

I may have to go in via IPMI to apply a firmware update to the BIOS to get the new CPU microcode

this is with a fully up to date Ubuntu 16.04 which has already released all available patches

looks like I already have the latest BIOS version

O_O I didn't have the intel-microcode package installed, maybe because it's proprietary software or something

it's now been patched into my initramfs or initrd or whatever they call that now

and rebooting

if the intel-microcode package installs the updated CPU microcode, which then provides support for the SPEC_CTRL MSR, which then (once the kernel uses it) mitigates Spectre... then I guess I don't need to BIOS update, just wait for the kernel patches to Spectre

hypervsir.blogspot.com/2014/11/…

wow, a lot of info there that sort of heralds in what was to come in 2018

@bertieb Also, remember, on January 3 the acronym expansion of VPS changed from Virtual Private Server to Virtual Public server (thanks, Meltdown/Spectre!)

> # ./spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.31

Checking for vulnerabilities against running kernel Linux 4.4.0-109-generic #132-Ubuntu SMP Tue Jan 9 19:52:39 UTC 2018 x86_64
CPU is Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Checking count of LFENCE opcodes in kernel: NO
> STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available)

well that didn't help my vulnerable status, but the microcode update gave me the SPEC_CTRL MSR and CPUID feature bit

> [ 0.000000] microcode: CPU0 microcode updated early to revision 0x42a, date = 2017-12-01

microcode gets updated very early in the kernel boot sequence, before the kernel starts to tick normally

Michael Frank

7:47 PM

My MSI motherboard at home is only vulnerable to Variant 2 by the looks.

allquixotic

@MichaelFrank your Z370?

my Z370M on Windows 10 1709 is fully patched IIRC, both firmware and Windows

Michael Frank

Yea

allquixotic

and due to hardware support minimal perf impact is expected :)

Michael Frank

I haven't applied the latest BIOS update yet.

allquixotic

kinda sad -- the worst-affected systems are servers, not desktops, but my desktop is in better shape for Melt/Spec than my server

bertieb

7:50 PM

@allquixotic Hah :P

allquixotic

at least I've been patched against Meltdown since the day that the update was published

bwDraco

@allquixotic Yeah.

Michael Frank

i has ur ip

bwDraco

lol

All servers are secured FWIW; do we need a mod to redact?

(besides, it's all in DNS so a dedicated attacker wouldn't find it hard to get the IPs)

Michael Frank

shrug

bwDraco

8:00 PM

The main server's IP is public info because anyone can do an nslookup on fierydragonlord.com.

ArtOfCode

whatcha need redacting?

bwDraco

@ArtOfCode It's nothing. You have a script that picks this up across the chat servers?

ArtOfCode

@bwDraco nah I'm just everywhere

bwDraco

It's trivial for an attacker to get server IPs via DNS or otherwise, and all servers are properly secured anyway.

I'm briefly shutting down my primary server.

I worked with someone who got their DigitalOcean account locked because their server was compromised.

(failed to set a strong password)

Canadian Luke

8:16 PM

@bwDraco Why set a password? Use keys! :-P

bwDraco

Yup.

I wanted to teach him how to use SSH public-key authentication, but he wasn't able to recover access by the time I had other things to do.

Canadian Luke

I have yet to find a well-documented way of implementing keys that a semi-new Linux user can understand

bwDraco

@FleetCommand Can you point me to your user contributions page anyway?

Michael Frank

I need to set up keys on my home server... :|

bwDraco

I'm still occasionally active on Wikipedia so I might be able to give you some hints.

Canadian Luke

8:22 PM

@MichaelFrank Do you know how? or just finding time?

bwDraco

You can appeal blocks FWIW; if this is a ban (which is determined through a more complex community process), you may need to go through ArbCom.

Michael Frank

@CanadianLuke Partly both?

allquixotic

SSH keys are easy

bwDraco

In my experience, the hardest part about being a Wikipedia contributor is discussing more complicated changes to pages. That's why I've mostly shied away from doing anything drastic; most of my edits are simple reversions of vandalism or otherwise disruptive edits (I have special rollback rights).

allquixotic

ssh-keygen -t rsa; type in a key passphrase; yoink the ~/.ssh/id_rsa.pub and append its contents to ~/.ssh/authorized_keys for any accounts you want to login to remotely; transfer ~/.ssh/id_rsa to any machines you want to login from

Ave

8:25 PM

@MichaelFrank same

ToxicFrog

Yeah, for the simple case it's just ssh-keygen and then ssh-copy-id user@server on each client you want to be able to connect from using keys.

Ave

done, home server now has ssh login and password logins disabled

apparently I made a mistake and somehow put ssh-rsa and the actual pubkey in 2 lines

ToxicFrog

oops

bertieb

@Ave But what if you need to access it from a machine you don't have a key on?

(genuine question... I sometimes access from other computers)

ToxicFrog

@bertieb you ssh into one of the machines you do have a key on, and then...

bertieb

8:35 PM

@ToxicFrog I detect a chicken-and-egg problem here :P

allquixotic

@bertieb think of this as the same question as if "what if you need to access it but don't know the password?"

keeping the key with you (or easily retrievable) is the same fundamental problem as memorizing a password, except that one involves an external device and one is reliant on our fallible memories

Michael Frank

s/don't know/can't remember/

bertieb

@allquixotic If you keep it with you, is that not something you have rather than something you know ?

(I forget the exact terminology)

allquixotic

@bertieb it still will have a key passphrase if you encrypt the key, which you should

put a thumb drive with the encrypted key on your (physical) keychain or put it in your (physical) wallet

someone steals the thumb drive, no problem, just change the key when it's next convenient for you, but you still can't get in without the password

effectively SSH 2FA

bertieb

@allquixotic But you still need to carry something around... I guess that's doable

Michael Frank

8:39 PM

Can you not just implement actual SSH 2FA?

With Google Auth or similar?

allquixotic

@MichaelFrank what, via FIDO or U2F or some kind of other TOTP? yes you can, but I don't think it's necessarily any more secure

if you memorize the key passphrase and don't have it written down anywhere, though, an encrypted SSH private key is pretty damn secure and also gets that same "something you have and something you know" bit like 2FA

Michael Frank

Is it less secure though? It seems more convenient, but generally there's a trade off for convenience.

allquixotic

not being "temporal" like a TOTP doesn't really matter

TOTPs are just temporal because it's basically the "something you have" -- at some point you have a device that you have access to that generates your TOTP -- and it doesn't want to be the same all the time to then become "something you know"

Canadian Luke

Next is learning to use an SSH agent, so that you have NO private keys on your server, but you can still SSH through them to other machines! /thumbsup

allquixotic

a malicious attacker could still get (gain access to) either a physical TOTP generator or an account you have somewhere that generates it for you (like the Google Authenticator on your phone or Enpass or something), just like they could get your encrypted SSH private key from any filesystem you have it on or any system where it's loaded into memory

but they have to also know your password, so in both cases (TOTP or encrypted SSH key) they need to know a password and have something

I think the two methods are basically identical unless decrypting the crypto on your SSH private key becomes practical by some novel attack on the algorithm used

with TOTP they're still submitting a password to your server, so if your server rate limits the number of password attempts, brute forcing is always going to be more or less impractical

so that might be a slight advantage to TOTP + password

Michael Frank

8:46 PM

@CanadianLuke Sounds like a Talk About IT! article. ;)

Canadian Luke

@MichaelFrank It might be... But I know I'll butcher some of the methodology, cause I don't always follow best practices... Like using sudo

We had some in-house training by our resident Linux guru who taught us much more that SSH can do

And we even got a tunnel setup from one of my sites

... for the rest of the computers, I mean, not for just me

bertieb

@CanadianLuke thumbs up is u1f44d btw :D 👍

Canadian Luke

@bertieb Great, how the hell do I type that?

Michael Frank

u1f44d obviously.

bertieb

@CanadianLuke In linux, ctrl+shift+u (release) 1f44d <space/enter>

Canadian Luke

8:50 PM

u1f44d obviously doesn't work

In Windows 10?

bertieb

Alt-x (?)

Been a while since I codepointed in Windows

(Might not work everywhere)

Also drop the u after Alt+x I think

Michael Frank

1f44d

Meh...

I need to go do some work.

bertieb

:(

Canadian Luke

Yea, I'm giving up

bertieb

Sorry. Will experiment when i next have a Win VM up

ISTR issues with higher codepoints

Canadian Luke

8:55 PM

OK. Make sure it gets starred too, so I see it

bertieb

I used to use it for accented letters IIRC

I can't guarantee that but will beg a star from some kind soul if I figure it out ! :p

Ave

@bertieb missed this question, sorry. I also have login with yubikey otp enabled on this machine

so I can just login. I also have a key on my phone that can login to the home server.

DavidPostill

Copy and paste it :)

Ave

psh

copy and pasting is SO 2017

what you need to do is getting your ssh private key tattoo'd to your arm

DavidPostill

@Ave I was referring to 👍. In addition tattoos are so 2017. Just use some kind of implanted RFID chip and a reader :)

Ave

9:08 PM

oh

psh

rfid implants are so 2016

DavidPostill

lol

Ave

just get someone to hypnotise you and engrave your ssh privkey to your mind

DavidPostill

@Ave Hmmph. Not private anymore innit.

Ave

I wonder if that'd even work at all.

any volunteers?

ArtOfCode

sure you can use my 8192-bit key :P

DavidPostill

9:16 PM

lol @avery how long is your arm? :)

Michael Frank

@DavidPostill Something like this... but with many more turns!

bertieb

@Ave Ah np, TIL about yubikeys :)

DavidPostill

> Key transport wasn't so difficult in the 6th century BC, when the first encryption algorithm, called the Caesar cipher, was invented. If you wanted to share a key with someone, you could just tattoo the key onto the shaved head of a slave, wait for his hair to grow back, and then send the recipient of your message the slave.

Locking the bad guys out with asymmetric encryption | Ars Technica

Michael Frank

@DavidPostill whaaaaaaaaaaaaaaat

bertieb

@DavidPostill So catching a slave and shaving his head to discover someone's key was a literal man-in-the-middle attack?

DavidPostill

9:31 PM

@bertieb Yep. But only undiscoverable if you waited for his hair to grow back again before send him on his way :) Big latency issues ...

bertieb

@DavidPostill Dear Suetonius, I'm sorry this slave is late, there were many floods and plagues this season. Yours, ~~Aurelius~~ Atticus

DavidPostill

> Unfortunately, that approach doesn't scale very well. If you want to buy something from Amazon or do some online banking, you probably don't have the time to wait for your slave's hair to grow back, and given the multitude of e-commerce sites out there, you may not even have enough slaves to go around.

bertieb

Not enough slaves? Conquer more border lands!

(ISTR something about the Roman economy necessitating a gradual expansion like that, which over-extended them and ultimately lead to the decline and fall )

Could be grossly misremembering

DavidPostill

Not to mention the cost of laser tattoo removal so the slaves head can be reused ...

Ave

@DavidPostill oh I just go by @ave now

just measured. 45.5cm

bertieb

9:44 PM

For a privkey tattoo?

DavidPostill

10:01 PM

@Ave Apologies. That was muscle memory :/

Ave

totally okay

@bertieb no, that's how long my arm is, excluding hand, including upper arm

bertieb

@Ave Ah!

Canadian Luke

So I think I almost have my Win10 Golden Image ready! One last SysPrep and Capture, then I'll deploy and see if everything is working

If this works, I won't have to touch the image for a LONG time...

Bob

morn

@CanadianLuke about 6 months? :P

Canadian Luke

Hopefully longer

I'm at the ONE site that does not want to do a 5-year cycle... One of the stipulations of getting the district to kick in half the costs is that the schools can only have one additional computer purchase during the 5 year period...

So they ordered laptops for the Winter break... For most staff but not all... And the old staff laptops (that are already 6 years old) are going to students for their mobile lab -.-

But after fighting for almost a month, I finally went to the FOG forums, and learned how to do the imaging PROPERLY in Windows 10... It's quite a process without MDT and Microsoft's stack

So now I have an image in a hyper visor (so I can take snapshots!), and no drivers injected. I tell the unattend.xml file to look in a certain folder for drivers. After FOG deploys the image, it looks at the computer model (based on what the system reports back), and copies the drivers into a folder on the hard drive. First boot up, it installs the drivers for that system! Then it carries on with the rest of the setup. It's at the point where it logs into the domain by itself!

It's a lot more involved with the Start Menu and Taskbar than it was with Windows 7, but I am finally happy! I had ONE bug, it's fixed now, and I'm capturing the image now

Canadian Luke

10:25 PM

According to my FOG logs, this is the 11th time I've captured the image

Michael Frank

10:37 PM

Silly Europeans! Just had what seemed to be a simple solution shutdown cause GDPR!

Bob

@CanadianLuke how'd you do the start menu layout? cause if you do it wrong it gets lost on upgrade (and new user)

Canadian Luke

Just like how the BOFH would do it... Set so that a small charge of electricity goes through the keyboard when the user clicks it! /sarcasm

I laid out the Office apps in one section, then a section for Internet browsers, our grading program, and our email program (not Outlook)

Taskbar is unlocked and bare, so the user can customize it (I really don't care). Store is disabled (as per our district's policy)

But Start Menu is locked down tight! No changes unless I push out a new LayoutModification.xml file

And if the XML file is not perfectly laid out... Then Explorer just constantly crashes! So it's read only :)

Michael Frank

11:06 PM

So apparently there's such a thing as DDR3L...

And it's different from DDR3.

Canadian Luke

Right

Bob

@CanadianLuke ah, that sounds about right

Canadian Luke

11:19 PM

That's how it looks for new users

bwDraco

11:35 PM

Feb 2 '17 at 13:08, by bwDraco

Also, make sure you actually installed 1.35V DDR3L memory! Fourth-generation (Haswell) Intel Core processors require 1.35V memory. If it's 1.5V DDR3 memory you just added, it's out of spec for your system's processor (and may also cause any existing low-voltage memory to run at full voltage). This means your power consumption will go way up and you may even shorten the processor's lifespan. — bwDraco 6 mins ago

4

A: What does the 1Rx8 mean vs. 2Rx8 for RAM and are they compatible?

These modules aren't compatible with each other. PC3 is standard voltage (1.5 V) DDR3 memory, while PC3L is DDR3L low-voltage (1.35 V) memory. Newer Intel processors (since fourth-generation Haswell) require DDR3L memory; regular DDR3 modules are out of specification for these processors and ca...

Michael Frank

@bwDraco Yea, that's exactly what I have going on here. :|

Ramhound

@CanadianLuke FOG?

Transcript for