MSgtRedFox
@MSgtRedFox@infosec.pub
Husband, Father, IT Pro, Air Force
- Comment on Looking for a music solution 2 months ago:
I know this isn’t what you’re looking for, but I got a family plan from Google for music and split it with 6 family members, which is probably the same as apple music I assume.
I don’t have to mess with download anymore.
Lidars is only one I know.
- Comment on Second hand disks? 3 months ago:
Is that’s a pickup line? Lol
- Comment on [deleted] 3 months ago:
Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.
I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.
MS got rid of intune on prem. It’s only Azure service now. I think.
My router is my biggest vuln. Oddly the most important. It’s an enterprise ISR. It’s updated as far as possible. My paranoia ends with the US gov/NSA. I don’t care if they want back door oddly. I don’t want China using me for attack relay however.
Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that’s a level I can’t deal with.
As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.
- Comment on [deleted] 3 months ago:
- Exchange on prem 😳
- Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don’t have to root Android for that. It presents some warnings, appropriate.
- My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.
I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.
Privacy. 🤔
Not much. I have certain traffic go through a VPN to the Internet, but that’s split tunneled.
I use incognito? That doesn’t really do anything, ha.
I’m slowly killing web browser tracking and cookie stuff that group policy allows.
- Comment on [deleted] 3 months ago:
Your working environment sounds gross :)
IT is hard. Finding good IT people is harder in my opinion. Working for a company that is not super squared away with good security and great usability sucks. At least you found some work arounds and are trying to do it well.
- Comment on [deleted] 3 months ago:
Ha, probably. It’s fun to learn stuff though.
Working in this field, almost every company has been beached, IP stolen, etc.
Sometimes your home IP gets hit in an automated scan for a vulnerability and then auto exploited by automation. I’m hoping not to get random chance added to a botnet.
- Comment on [deleted] 3 months ago:
Also laughing because that’s how some companies get owned, IP stolen, etc.
There has to be balance, if your life using their system sucks so hard you can’t do your job or meet production marks, you get creative.
My industry has to prioritize security over productivity. It’s almost impossible to get work done.
- Comment on [deleted] 3 months ago:
Ha yeah.
Id say the same for trellix.
You should try doing things with installs or updating apps when the edr product blocks write access to all temp locations. You have to do an exclusion for every installer, signing cert, or turn it off to install programs.
- Comment on [deleted] 3 months ago:
I’m an enterprise guy, so that’s the explanation for non home use things.
- VPN for anything not my web or certificate revocation distribution point
- Sophos IPS
- sophos utm for web application firewall
- transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don’t inspect medical or banking, other common sense stuff.
- my windows clients are managed by active directory with heavy handed GPOs.
- least priv accounts, different accounts for workstation admin, server, domain, network devices
- security Onion IDS
- separate red forest that has admin accounts for my management access and accounts on devices
- trellix antivirus and global reputation based file monitoring
- I’ve started applying disa STIGs on servers
- site to site VPN with other family member household. They get managed trellix av also.
- my public identity accounts like MS,.Google, etc all need 2fa, token, etc.
I bet this can still get exploited, just would take effort hopefully none does for a home network.
I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.
- Comment on CIA Vault7 WikiLeaks source sentenced 40 years (convicted of possessing child sexual abuse material) 3 months ago:
So, as I’m reading this threat to learn some etiquette myself, infer the ‘user’s not wanting their “local” page to include duplicates’ to mean that when posting to multiple communities, it would be a best practice to only pick one relevant community per server instance?
Like in this case, it was crossed to both: ‘worldnews@lemmy.world’ and ‘world@lemmy.world’
In order to avoid duplicates, only one of those should have been included?
Like community1@server1 community2@server2, etc? If there’s two relevant communities, just pick the best one?
- Comment on The U.S. economy is booming. So why are tech companies laying off workers? 3 months ago:
This corporate cycle isn’t likely to change anytime soon right?
Top tier corps, boards, Cs, ultimately care about share price and growth right?
Isn’t it tied to their pay incentives? To keep their contracts and incentives, they have to grow or reduce costs.
They make bad choices or bets among the way, no problem, just reduce costs and still meet the metrics. Only people who pay seem to be the workforce, right?
Or am I oversimplifying?
- Comment on The U.S. economy is booming. So why are tech companies laying off workers? 3 months ago:
I think that’s synonymous with “all hail the shareholder”
- Comment on VPN to home network options 3 months ago:
Doesn’t tailscale retain closed source for the coordination server?
I think nebula mesh is totally open and you can run your own coordination server, lighthouse?
Nebula would need static IP, TS can do that part for $
- Comment on Feedback on Network Design and Proxmox VM Isolation 4 months ago:
You’re correct about vlan.
Think if vlan is a regular switch. Connect stuff, they communicate. Make two vlans in a switch, think of turning your physical switch into two separate switches.
Connect you switches to a router. Don’t want to waste two cables from your switch that’s cut in half? Do trunk port, with vlan tagged.
Lots of videos will explain better.
Best practice is to separate things of different trust levels into different vlans. You can filter and control the traffic between those vlans with your router.
As previously mentioned, in the Enterprise and business world, best practice is to separate and management from VMS and applications. We call this data plane and control plane. You would restrict access to your proxmox for other hypervisor interface from the VMS and applications. For small home setups and funsies, this gets a little complicated, but if it’s your career choice or interest, it’s a good thing to explore.
- Comment on Apple Backdoor Discussion: Security Now 956 Transcript | TWiT.TV 4 months ago:
The analogy of the fire department was a good one. Also a very good point about door locks.
I have similar thoughts about the electronic security alarm in my house when I hear the rare security vendor employee insider threat that broke into someone’s house by turning off the alarm. I still have one though. Like you said, I just chose to mostly trust them based on the hope they’ll internally police themselves out of their self interests to keep a good reputation and make money.
I do wish legislation could force vendors to be very transparent with their privileged access instead of the consumer or user just assuming it. Like a surgeon generals warning, “we made this, so we can unlock it. We are also forced by law to tell you when we’ve done it”. This of course is unrealistic from a national security or investigation standpoint.
Also good points about trust. We have to trust an enormous amount of institutions like banks, public service agencies, etc. Americans are having trust issues with law enforcement as a result of too many issues or abuse.
I wonder how many people care more about the secrets in their phone than their bank account?
I also don’t live in a country where I can reasonably expect the government to spy on me and take my freedom just for criticism, so I guess the stakes aren’t as high. The airdrop cracking in China comes to mind. Plenty of countries are being accused of using spyware against journalists and opponents.
- Comment on "Did you realize that we live in a reality where SciHub is illegal, and OpenAI is not?" 4 months ago:
Ha, yeah I wish a more concrete link could be made between the stance society has taken with smoking and apply it to visual/auditory pollution.
People are allowed to smoke as long as it’s not being forced upon other people (based on they both have equal rights). What about a right not to be bombarded with garbage every minute while you’re in public? I can’t see this going my way…
- Submitted 4 months ago to technology@lemmy.world | 4 comments
- Comment on Browser Certificate Stores and QWACs 4 months ago:
I setup our transparent proxy so we can do interception and IPS. I’m interested/concerned about the ability to use an intermediate ca cert downstream inline somewhere (like a teoco) and if regular consumer desktops would alert on that since their browser would trust the root. We GPO place our intermediate cert in the Windows trusted intermediates. I can’t remember if browsing breaks without doing that.
Not really a concern if there’s other certs/TLS required.in addition to the QWACs cert thought.
I got the impression the easier threat/worry was compromise of a nation CA and issuing illicit duplicate site certs, to then spoof a bank site. Still requires traffic redirection with DNS or routing though I think.
- Comment on Browser Certificate Stores and QWACs 4 months ago:
Another thought I had was regarding interception. Anyone with access to root cert can decrypt the data. My understanding was that these certs were supposed to be counter signing right?
Otherwise, wouldnt any government implementing this just be conducting zero effort surveillance?
- Comment on Alaska flight incident reveals another feature Boeing didn’t inform pilots about - Federal investigators said that Boeing didn’t make pilots aware that when a plane rapidly depressurizes, the cockp... 4 months ago:
Did you Google this, or is this your profession?
- Comment on "Did you realize that we live in a reality where SciHub is illegal, and OpenAI is not?" 4 months ago:
In many discussions I’ve seen, small or independent creators are one of the focuses of loss and protection.
Also there’s the acknowledgement that existing jobs will be reduced, eliminated, or transformed.
How much different is this from the mass elimination of the 50s stereotype secretaries? We used to have rooms full of workers typing memos, then we got computers, copiers, etc.
I know there’s a difference between a creator’s work vs a job/task. I’m more curious if these same conversations came up when the office technological advances put those people out? You could find a ton more examples where advancement or efficiency gains reduced employment.
Should technology advancement be tied to not eliminating jobs or taking away from people’s claim to work?
I know there’s more complexity like greed and profits here.
- Comment on "Did you realize that we live in a reality where SciHub is illegal, and OpenAI is not?" 4 months ago:
Agreed. I hate ads passionately. Ive been able to eliminate every source of ads from inside my house except websites, but I immediately back any site that don’t do simple or reading view.
Every moment of my attention taken by some stupid billboard or hearing tvs at a gas station I had to stop at is a moment I could have been thinking about something better. Or nothing, which sometimes would be nice.
- Comment on China claims it has cracked Apple Airdrop’s encryption to identify senders | CNN Business 4 months ago:
airdropping dick pics in the subway 😆 Imagine the analog version of this… Dudes leaving random dick polaroids…
- Submitted 4 months ago to technology@lemmy.world | 4 comments
- Comment on SALTSTACK with Gitlab? 4 months ago:
Yeah, salt has SSH support and it supposed to be able to deploy without minion/target interaction, but it wasn’t very reliable or I was doing it wrong.
I started with SALT because of Security Onion, open source IDS. Only reason.
SALT can run master less, is that what you were after? Rather than having a single/central manager?
- Comment on Kubernetes? docker-compose? How should I organize my container services in 2024? 4 months ago:
I really enjoy these type of conversations, learn a lot.
Since you’ve gotten lots of good advice on container manager, I’ll encourage your desire for IaC/DevOps CM, etc.
I believe all the leading CM choices support what you’re wanting to do. I can’t guide you on which one to chose, but just browse through the options or functions your favorite does for the Kx container solution you go with.
I use SALT because of Security Onion, and open source IDS. I have all my nix systems being babysat by SALT, and can have a new x-arr media server, NGINX, blog, etc running in the amount of time to deploy the template (I use vSphere) and salt applies the desired state. Back up and restore a mount folder, np. IaC is only limited by your imagination. I have salt also specifying all the containers I have running, defining the config files, etc. Basically poor mans/simpleton kub.
I suspect you already know this, but if there isn’t a module that directly does what you want like running SQL specific functions, you can just have it run programmatic CLI files on the host, or in the container for you.
I am in the process of moving my IaC code from manager file system to Gitlab. I imagine you’d do this from jump street. Have fun.
- Comment on How do you monitor your servers / VPS:es? 4 months ago:
PRTG has a community edition Elastiflow for netflow has free/community edition Grafana and influxdb open source
- Comment on Hosting websites over 4g 4 months ago:
You’re on the right track. As long as wiregurd on the VPS will allow an incoming connection from you home 4g, which will probably be CGNAT, it’ll work. Did you look into running the NGINX reverse on the VPS? I like terminating external stuff on cloud side, then only bring filtered or desired traffic over the tunnel.
- Submitted 4 months ago to selfhosted@lemmy.world | 3 comments
- Comment on Pornhub blocks North Carolina and Montana as porn regulation spreads 4 months ago:
And then you put your phone on cellular and all the Wi-Fi controls are gone.
Google family app does some good.