Best posts made by NashBrydges

Picked up a Dell R720xd for the lab today. Popped-in 16 SSD drives and will be completing setup tomorrow. RAID5 still the go-to for drive setup these days for SSDs? I'd prefer RAID10 but I need the additional drive space from RAID5.

@dbeato said in RAID5 Still The Go-To Setup For SSD?:

Wow, that is a nice LAB and you will have many systems running. That’s a lot of hard drives too. What SSDs will you be using?

They're drives from a previous project I was working on. The drives are Kingston KC400s.

I'm consolidating from a few older 11th gen servers to slightly newer (without breaking the bank).

Comodo has a free RMM option that isn't terrible. I'm just not a fan of the other options on the market as they usually include many features I won't use/need. For my smaller clients, they hardly ever have a domain controller and for most of them, I'll recommend options like JumpCloud for authentication and set PCs to auto-update Windows/MS Office. That doesn't take care of the other installed software but for those instances where I need to manage the entire update cycle, I've used Comodo One RMM. For clients with onsite servers, I'll VPN in on a scheduled basis for scheduled maintenance/updates.

We're clearly not a large MSP so this has worked for us.

Yup, I use it to monitor uptime for a few sites I have running. This was how I discovered how flaky the Azure site hosting was. It kept reporting sites were down. Great notification feature that lets me know when the ping fails.

The R720xd in its new home. The drive indicator lights are all green on the server. OMSA complains about the firmware even though these were purchased from Dell directly.

@dbeato @coliver I use JumpCloud for my team so I was familiar with the free 10 users which is pretty nice for small clients.

Followed these instructions and installed without a hitch! Already have Nextcloud running but it's on Ubuntu. Wanted to give it a try on Fedora. Thanks for this.

As you've listed a bunch of vendors, you're already aware there are a bunch out there but let me ask...

• How is/are your network(s) setup? Are all satellite offices connected back to HQ (hub and spoke) or do they each operate independently? Are there services running either at HQ or other locations that are shared across the other locations? If so, what are they?
• What is your internet speed at each location?
• What will the VPN be used for? Site-to-site VPN or user VPN for road warriors to connect back to HQ? Do you have remote stationary workers (ie: employees that work from home) which is why you want VPN?
• Do you host any web facing services (ie: websites on-premises...etc)?

Palo Alto may be the leader in the field but it's also the most expensive. All of the functions you mention can be had with pfSense so big range in pricing. What's your budget?

Is the unintuitive user interface really the only reason why you want to move away from pfSense? What else are you dissatisfied with?

Btw, some of the products you've listed are not UTMs so is a UTM really what you're after? Cylance for example is an endpoint product.

@black3dynamite said in Install Nextcloud 13.0.0 on Fedora 27:

Last time I check, the default Fedora Server install will only partition enough for its need. But leave the rest untouched.

Looks like you might be right. Cockpit only shows the root and boot mounts for a total of 16GB.

@scottalanmiller said in Securing Linux with Ansible:

@tim_g said in Securing Linux with Ansible:

I made a really good SaltStack state for Linux hardening. Works great, and now pass OpenVAS with flying colours for example.

Where is the ML article about that?

Damn! I can only upvote this once.

The more I think about it, the more I think that backing up the entire VM makes the most since in that it's the simplest approach for the backup. Sticking to only files would likely make the backup process/management more complex (maybe, maybe not) but with a VM backup, I have the option of a full VM restore OR just the files anyway.

I may have just answered my own question. Changed my Google query and found this.

https://www.hdsentinel.com/compatibility_disk_controllers.php

The H710p is on the supported card list. Will have to give this one a try.

@aaronstuder said in Anyone using AdGuard?:

@nashbrydges can you think of a better way to do it?

The problem with this is that it exposes you to a MitM attack. Here is an article about how Kaspersy AV that did this same thing exposed their users to MitM attacks.
https://www.pcworld.com/article/3154608/security/https-scanning-in-kaspersky-antivirus-exposed-users-to-mitm-attacks.html

Lenovo Superfish was an example of HTTPS scanning gone wrong (albeit an extreme example). AdGuard would decrypt your connection and therefore have full access to the session traffic. It inspects this content (reads it) and then encrypts the outgoing connection back to your PC.

Many companies do this type of https inspection via their network filtering devices or UTMs but in each case, that inspection device can read your content in order to perform the inspection.

@hobbit666 said in Install BookStack on Fedora 27:

Woop installed and ready to use.

(Does it matter i have no idea what half those commands did, but yet i have a working system )

I guess that was the point of the post, was to make it crazy simple. I suppose whether it matters if you have no idea or not depends on whether you want to learn what those commands do or not

The only change that I do that isn't really covered anywhere in any documentation I've seen is to change the favicon. I replace the Nexcloud one with mine just to complete the theming.

@bnrstnr said in Dynamic DNS with CloudFlare:

@nashbrydges I thought somebody already said this, but I cant find it. The only bad part about the CNAME method if you're using a free account on no-ip, then you have to login to their site and confirm that you're still using the DDNS every 30 days, which is a PITA. Setup the script with a cron job and never have to worry about checking in on no-ip or afraid.org every n days.

That's correct, if you have the free account with No-IP you have to reconfirm every 30 days. I have the paid account so that's not a problem. It doesn't expire.

Sorry can't help but...damn! A price list that's 130 pages?

No size limitations but this explains it better.

https://www.veeam.com/veeam_agent_windows_2_1_editions_comparison_ds.pdf

Veeam Windows Agent does block level backup but if it is being linked to an existing Veeam B&R Repository, there might be search indexes that are built during backup. I remember reading some best-practice documentation about their catalog but only related to VM backups. Not sure if you're poiting Veeam Windows Agent to a B&R or just to storage.

Anyone else run into this issue? I just completed a simple update and now service fails to start.

dnf -y update

[root@bookstack-fedora ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/httpd.service.d
           └─php-fpm.conf
   Active: failed (Result: exit-code) since Mon 2018-03-05 12:51:18 EST; 1min 31s ago
     Docs: man:httpd.service(8)
  Process: 651 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 651 (code=exited, status=1/FAILURE)
   Status: "Reading configuration..."

Mar 05 12:51:18 bookstack-fedora systemd[1]: Starting The Apache HTTP Server...
Mar 05 12:51:18 bookstack-fedora httpd[651]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using ::1. Set
Mar 05 12:51:18 bookstack-fedora systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
Mar 05 12:51:18 bookstack-fedora systemd[1]: Failed to start The Apache HTTP Server.
Mar 05 12:51:18 bookstack-fedora systemd[1]: httpd.service: Unit entered failed state.
Mar 05 12:51:18 bookstack-fedora systemd[1]: httpd.service: Failed with result 'exit-code'.

Nothing else has changed. Even after reboot still get this error.

Error log shows this:

[Mon Mar 05 12:39:04.290603 2018] [core:notice] [pid 656:tid 140047618265088] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon Mar 05 12:39:04.294838 2018] [suexec:notice] [pid 656:tid 140047618265088] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using ::1. Set the 'ServerName' directive globally to suppress this message
[Mon Mar 05 12:39:04.438012 2018] [lbmethod_heartbeat:notice] [pid 656:tid 140047618265088] AH02282: No slotmem from mod_heartmonitor
[Mon Mar 05 12:39:04.443196 2018] [http2:warn] [pid 656:tid 140047618265088] AH02951: mod_ssl does not seem to be enabled
[Mon Mar 05 12:39:04.489771 2018] [mpm_event:notice] [pid 656:tid 140047618265088] AH00489: Apache/2.4.29 (Fedora) configured -- resuming normal operations
[Mon Mar 05 12:39:04.489819 2018] [core:notice] [pid 656:tid 140047618265088] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
[Mon Mar 05 12:49:37.356049 2018] [mpm_event:notice] [pid 656:tid 140047618265088] AH00492: caught SIGWINCH, shutting down gracefully
AH00015: Unable to open logs

ServerName is set in the config file. Always has been since I've had this setup.