irmadlad

Monitoring firewall logs would show calls to suspicious IPs and domains after you pulled the Docker container. A MiTM attack is usually conducted between two communicating parties, rather than inside the server itself. The attacker intercepts traffic as it travels across a network or service path. MiTM are not always done exterior of the server, but usually. Strong ciphers are your friend. Although MiTM and PIC events can overlap, a PIC is usually an attacker gaining unauthorized access to a system. A PIC compromise occurs outside the public facing server, through a stolen administrator password, compromised developer workstation, exposed API key, or hijacked cloud account. Securing API, devices, frequent password rotation are good practices. Again, not always exterior of the server, but usually.

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

I don’t run a complex setup as it seems you do, but if I pull a new Docker container, I closely monitor my pfsense firewall logs. A lot of times, I’ll deploy a recently released container on a small test server and just observe as I run it through it’s paces. Also, I like containers that have a rather established history. I look at things like stars, how they handle bug complaints, etc. Even when updates come out, unless it’s a dire security patch, I’ll wait until all the early adopters work out the bugs and do my work for me. Early adopters are a valuable resource.

I guess you could say it all comes down to calculated risk.

capitalist mindset

I’m a capitalist. I run three bonafide, tax paying businesses. They allow me to live moderately comfortable. Money makes the world go 'round. I’ll never be a billionaire, but I do love me some money. Sure, the best things in life may be free, but the grocery store isn’t giving away groceries.

Don’t take it to seriously

Too late. LOL Thank you for sharing.

Opensense is often bound by single-core operations depending on where a network packet may plumb itself through the kernel

When would this become an issue? Pfsense is about the same way as far as single-core operations, tho IDS/IPS like Suricata can utilize multiple threads. My standalone pfsense box sits between my modem and the rest of the network. I haven’t noticed any sluggishness or stuttering. Throughput seems quite reasonable, and supports a diverse group of devices attached to the network.

Well, there you go. I’m glad I plowed the field and saved you the embarrassment. LOL

Pay no attention to the old fart yammering on. I’m surprised I didn’t throw in a couple ‘well, back in my day’. lol I hope you get it all worked out tho.

Ahh, I missed that. So that would explain all the downvotes with no explanations why. Thank you for bringing that to my attention.

I don’t run Jellyfin, so take this as is. From what I understand tho, Jellyfin does take a fair amount of resources to run in an ideal situation. Meaning it takes some RAM for multiple simultaneous transcodes, several users, large libraries, etc. A lot of the cheaper Stick PCs come with less than stellar specs. The Stick PC I just randomly picked because it was 8 GB RAM is a MeLE Business Grade PCG02 Fanless N100 Mini Stick PC 8GB. IT retails for $350 USD. For half of that price, you could opt for an SFF Optiplex, bump the DDR3 RAM to max the mobo, and DDR3 is fairly cheap, and still have resources to run other Docker containers if you wanted. For example I run an Optiplex SFF with the i7-4790 chip and 32 GB DDR3 RAM. Currently I have 53 total containers running and it really doesn’t break a sweat. Total cost of the box plus RAM was about $175 USD.

If you are going for the portability aspect, that’s where I think a Stick PC would function best. All that being said, you have options just depending on what your criteria are for running Jellyfin.

Image

I’m an expert at nothing, but I would imagine that different VPN like WireGuard have different detectable signatures, much like different browsers have different signatures that can be detected. Also, for commercial VPNs, the IPs that the VPN company uses are easily identifiable.

I’m just yanking your chain bro. Glad you are enjoying your self hosting journey. Rock on wid yo’ bad self.

Congrats on the improved lifestyle now. I wouldn’t say you have wasted hours. More so that you have invested in your privacy and data retention.

firefox: image: jlesage/firefox container_name: firefox ports: - “5808:5800” environment: - TZ=America/Chicago - PUID=1000 - PGID=1000 #- VNC_PASSWORD=${VNC_PASSWORD} - DARK_MODE=1 - WEB_AUDIO=1 - WEB_FILE_MANAGER=1 - WEB_FILE_MANAGER_ALLOWED_PATHS=ALL - WEB_HOST_CLIPBOARD_SYNC=1 volumes: - ./firefox/config:/config:rw - /SWAP:/downloads shm_size: “2gb” restart: unless-stopped networks: - web

My Dick Tracy decoder ring is on the fritz. I think it says ‘My hovercraft is full of eels’.

Some guy hid a prompt injection in his legal filing that encouraged the court’s AI to rule in his favor (fortunately, the court confirmed it does not use AI for these reviews)

‘E’ for effort nonetheless. That’s pretty funny.

I don’t care if you don’t like it.

I like your style bro. If you don’t like it, you can go the way you came. Pretty damn refreshing. ^5

Damn the torpedoes, full steam ahead!

No shit. I still have a 5090 still stuck in my throat. $8k for a tape drive, hell, I could have got two 5090s.

That sucks. Personally, I wouldn’t selfhost financial applications. I don’t need that headache with my money or someone else’s either. I hope you find a solution.

No worries. I use Square for my businesses, but they are not self hosted. They do take their skim off the top, but that’s a cost of doing business.

That’s all I got bro. I tried.

There seems to be quite a few of them

I also found piprapay.com

Payram?

Throw the second switch!

Image

Btop is my favorite top of all the tops. I run it regularly just to scope how things are processing.

What are you trying to observe? Just the server and applications? Traffic?

Netata will give you just about every metric you could possibly use for a server. However and anecdotally, netdata seems to spawn a ton of zombie processes (github.com/netdata/netdata/issues/20565) which was quite annoying.

If you’re going for server traffic observability , I recommend ntopng. It’s pretty comprehensive.

The mouse did not survive interrogation. Also mouse not pictured.

I thought it was the huge heat sink that looks like it extends past the side plane of the cover. Reminds me of something I did with a CoolAir Cosmos tower. I mounted two 300 cfm fans over each CPU and took the side panel, neatly cut out the area around the fans, then 3d printed a scoop, with a slot for filtration, to fit on the side panel and allow the fans to breathe.

The part I quoted was one of their many tries. It seems now, after changing out the solar panel and battery, that they have greatly improved over 95.2%.

Well, the article did go on to provide better stats once they changed out the panel and battery:

Since then, the uptime has been 100% (March to September 2020), even though we have added a lot of content by making the website multilingual. This is due to the larger (brand new) battery but also to the better orientation of the smaller solar panel. The battery’s capacity will decline over time, so the higher storage capacity will make it last longer. If the uptime remains 100% through the winter 2020/2021, we will probably downgrade to a 20W solar panel.

At current HDD prices, that’d buy a lot of beer.

Over a period of roughly one year (351 days, from 12 December 2018 to 28 November 2019) the server was up for 95.26% of the time. This means that we were offline for 399 hours (which corresponds to 16.64 days).

Not bad at all really, at least for non-mission critical sites. I have solar and I really like it. Solar power on two barns, and a lot of my security cams run on solar. I’m not sure if it’s the formatting of this site, or the grainy pictures, but it oddly reminds me of the Trojan Room coffee pot.