Posts made by Pete.S

@EddieJennings said in Redoing Home Network:

@jmoore said in Redoing Home Network:

@EddieJennings said in Redoing Home Network:

@jmoore said in Redoing Home Network:

@Dashrender said in Redoing Home Network:

I've with JB - You should save the money and get an ER-4. The processor is the same.

POE can be done in the switches, so no need for that in the router.
The ER-4 is nearly half the ER-6.

I already ordered the pieces. Thanks for your input though. I needed a router with 4 ports for my 4 rooms plus the incoming port. I plan to use and learn everything about it.

So each room will be its own network?

Each room will have an 8-port switch because everyone has a lot of devices.

And since those switches will be going to a unique port on your router, they'll each be unique subnets (networks).

It's a good idea to have small switches in each room but normally you would do it like this:

If you wanted to have different networks inside the infrastructure, you'd use VLANs.
If you wanted to use PoE devices like security cameras, IP phones etc, you'd do PoE on the access switches.
If you'd want high performance the core switch would have 10 gigabit ports.
APs could also be connected in different places, for instance on the access switches.

@Dashrender said in Redoing Home Network:

@Pete-S said in Redoing Home Network:

@Dashrender said in Redoing Home Network:

I've with JB - You should save the money and get an ER-4. The processor is the same.

POE can be done in the switches, so no need for that in the router.
The ER-4 is nearly half the ER-6.

Isn't POE also better in the switches? I thought Ubiquity used some odd DIY standard for POE, at least in the past.

They still do in some places.

Yeah, you're right. Had a look right now and ER-6P has non-standard PoE. Hopefully no one plugs in the wrong thing in a port that has PoE switched on. My guess is that the purpose with that was to power APs directly and not much else.

99% of Ubiquity's switches (except the lowest cost ones) that has PoE follows the PoE standards (802.3af, 802.3at and 802.3bt).

@JasGot said in Sending Secure E-Mail?:

The dept is engaged in a grant program with the State Department of Environment…, which requires us to include our banking information on every reimbursement application.

Come to think of it, banking information is not really sensitive info, is it? If you send an invoice to anyone, they have your banking information.

The only risk here is a man-in-the-middle attack where banking information is changed on the application while it's being submitted. So that the money is transferred into another account.

So do the company send all their invoices and ordinary mail containing banking info by registered mail in locked containers, so it is secure from end to end?

If not, then email isn't any less secure.

I like the ones where you can change everything and pick out exactly what you want and put it where you want. Because I don't like anyone's default settings.

I used to run Gnome 2, XFCE and LXDE. For users now we put Ubuntu with Gnome 3 on every machine but I haven't actually tried to see if it's still 100% configurable. My guess is that it isn't.

@Dashrender said in Redoing Home Network:

I've with JB - You should save the money and get an ER-4. The processor is the same.

POE can be done in the switches, so no need for that in the router.
The ER-4 is nearly half the ER-6.

Isn't POE also better in the switches? I thought Ubiquity used some odd DIY standard for POE, at least in the past.

@brandon220 said in NAS for Plex use... Again:

@Pete-S I turned off the R410s and 510 last year. I'm currently running a newer "entry-level" server as my VM host. It has a low-end Xeon and maxes out at 32G of RAM. I have been shopping around for a while for a more robust host but can't decide on anything.

The ReadyNAS units were free and new from a relative's business that shut down. They are EOL now and slower than I would like. I plan on a similar setup to what I have now - Plex as a VM and the new storage server as a VM with an NFS share for Plex. I don't believe I will need hardware transcoding for Plex.

Why can't you just put some drives in your VM host and use that as storage? Or do you want a host with more RAM / cores as well?

@marcinozga said in NAS for Plex use... Again:

It really depends how much storage and CPU you need. If you need lots of storage, nothing beats unlimited, and I think only G Suite Business is viable option. I know lots of people host Plex with Hertzner, Vultr is probably attractive option too.

I had a look and it looks like you need 5 minimum users on G Suit Business to get unlimited TBs. If it's $12 per month then that becomes $60 per month. Under a five year period that's $3600.

Not saying it's the same thing but for the exact same money you can buy 9 x 16TB enterprise drives with 5 year warranty. That's about 100 TB of actual storage.

Using Drive makes sense in your case but if someone only needs say 10-15 TB, I'm not sure it does. And 10 TB may not sound like a lot but if we are talking about H.264 video it's more than 3000 movies/5000 episodes. Even if you binge watch 5 hours a day, every day, it will take about 3 years to get through it.

@brandon220 said in NAS for Plex use... Again:

I currently have 2 ReadyNas 2100 units with 5 TB. One is primary and the other is a backup copy. They are used strictly as storage for Plex. I am out of space and need more. I can upgrade the drives for more storage space but the NAS is not very fast, taking into consideration that it is an older unit.
My thoughts were to set up a new server with samba to serve Plex, and re-purpose the older NAS units as backup targets for the new "solution". Plex runs as a VM and there is not enough storage on the existing host. I need another solution.

Would a new NAS be a better solution or a linux server with samba shares for movies and music? Is there a better solution?

With a NAS you get the OS they decided on and the hardware they picked.
With a server you can get whatever you want both software and hardware.

A NAS is consumer components all the way through unless it's a high end unit with a high end price.

A server doesn't have to big or bulky or noisy or power hungry just because they commonly are. Plenty of other options around other than an old R710.

And there is also the possibility of assembling something yourself using server components or a mix of server and consumer components. For instance you might want to have remote management capability which you only have on servers but you don't need hot swap power supplies. Perhaps you want hot swap drive bays or you are fine mounting the drives internally. Perhaps you only need 2 or 4 drives for data but you want to have SSDs for running VMs. Or you need 24 drive bays but want it to be low power.

There is also the educational aspect of building and using a server versus a NAS which might matter. While a NAS is plug and play and often cheaper, your ROI might be higher using a server.

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

The system admin can always get the key out of your email and open whatever has been sent.

Completely incorrect as well. The public key can only be used for encryption, not decryption.

Oh, right, okay, having a "duh" moment. So you can send your public key via email, and ANYONE can send you an encrypted email, but ONLY to you. Because you have the private decryption key.

You are right, I follow now. That could work.

No problem. I'm not a crypto guy but we used PGP encrypted email for many years so I know the basic principles.

I've used it, but I was adding in the incorrect assumption that everything had to be done only on the sender's end. Which if you did that, encrypting with PGP and sending the key with it, anyone who intercepted would be able to read. But if the recipient can send the key too, then yeah, obviously that works great.

It's pretty easy to install and use nowadays, especially if you are just a couple of persons. You just install the add-on needed depending on your email client. Then you have to tell it what you want your passphrase to be and it will create your public and private key for you.

All you have to do then is email your public key to whomever you want to be able to receive secure emails from. And they'll do the same.

When you receive a secure email you have to enter your passphrase to read it.

Writing this I think the best way to use this for ordinary business use is to only send encrypted email when you are sending something sensitive, like passwords or stuff like that.

Problem with encrypted email (and also it's strength) is that you can't read it if you don't have your private key and passphrase. But it makes it complicated reading email on different devices and software unless you copy your private key everywhere and enter your passphrase on a number of insecure devices. Which defeats the security aspect of it.

So it works best on desktop clients and if you only encrypt when really needed, you are not much affected by the drawbacks. If you try to read an encrypted email on a devices that doesn't support it you'll just see an attachment that is just gibberish as my earlier post shows.

@scottalanmiller said in Sending Secure E-Mail?:

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

The system admin can always get the key out of your email and open whatever has been sent.

Completely incorrect as well. The public key can only be used for encryption, not decryption.

Oh, right, okay, having a "duh" moment. So you can send your public key via email, and ANYONE can send you an encrypted email, but ONLY to you. Because you have the private decryption key.

You are right, I follow now. That could work.

No problem. I'm not a crypto guy but we used PGP encrypted email for many years so I know the basic principles.

I've used it, but I was adding in the incorrect assumption that everything had to be done only on the sender's end. Which if you did that, encrypting with PGP and sending the key with it, anyone who intercepted would be able to read. But if the recipient can send the key too, then yeah, obviously that works great.

It's pretty easy to install and use nowadays, especially if you are just a couple of persons. You just install the add-on needed depending on your email client. Then you have to tell it what you want your passphrase to be and it will create your public and private key for you.

All you have to do then is email your public key to whomever you want to be able to receive secure emails from. And they'll do the same.

When you receive a secure email you have to enter your passphrase to read it.

@scottalanmiller said in Sending Secure E-Mail?:

@Pete-S said in Sending Secure E-Mail?:

@scottalanmiller said in Sending Secure E-Mail?:

The system admin can always get the key out of your email and open whatever has been sent.

Completely incorrect as well. The public key can only be used for encryption, not decryption.

Oh, right, okay, having a "duh" moment. So you can send your public key via email, and ANYONE can send you an encrypted email, but ONLY to you. Because you have the private decryption key.

You are right, I follow now. That could work.

No problem. I'm not a crypto guy but we used PGP encrypted email for many years so I know the basic principles.

This is what PGP encrypted email looks like. Like all email it's just plain text. Before this section is the usual email headers. So the "To:" and "From:" and "Subject:" is not encrypted but the email content itself is.

This is an OpenPGP/MIME encrypted message (RFC 4880 and 3156)
--xhndWJKlxj2H7EcRFNi37V5EBuMbJO6xj
Content-Type: application/pgp-encrypted
Content-Description: PGP/MIME version identification

Version: 1

--xhndWJKlxj2H7EcRFNi37V5EBuMbJO6xj
Content-Type: application/octet-stream; name="encrypted.asc"
Content-Description: OpenPGP encrypted message
Content-Disposition: inline; filename="encrypted.asc"

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.12 (GNU/Linux)

hQEMA6dGE3LaIUOQAQf8DGIYe/G72AkcY0M3+s2xfbe+JNax3gpPXtDUpxQVPbIF
emRbZZUgOR5NVd7oZ+/ezO2r455HVG2Ar12cA88tk9i86XOOFAhaO1Ib7nTpKAS+
Um9EbsfO1kqS1qmIJIaDOV6hSfSssxDVEj5SMhvDhH/s3As/0Xo3q3+5CqahOxPF
/xeanqndpWqyusmJTQzmE3RZhqtErIB9oaMzBNyx1KZ3fhrxGdsSX1wNYpalelGu
wJBKZGsfxr0BPL+jb/UDXLNtf1QdNLkSTLpqtHYb8aNNLaDOTMo2CnLKaqSMpAbR
e1sBAYxqPchwMPKT9zo60Z+OqRUcUC1dTi6SahiKD4UBDAPaVPPT71S0wgEH/iIC
0eh4w7flugfSP/pBylcCb3Ud3MyjRmHEepG90kkFa/PP2Wxybe7R/080Sj5910Es
BZBDn8f/Eg6w1/VNp+FMc/28NU460Gkw0TSWjWSNpwl0W3TMgszvS+ug+P3uxyfx
JH00ho+59nRJPaxrDX4rIZl5/1DRVhjWudGLzEU9sAg7/CTusloBhsP2wWXgMXxP
mwF69uNptRmAgoVjTOBJgfC3wJO3Vmt8Ml8VLV57lL3T6KbRuiYABNICD+2eSgUc
bY6xo4Cvz/EINKTHWzTiSaSRrVkf6J6QMRVFNfnCMW4esGfY+W2bAysHfyD0w754
pOhKx+eewM9qUV9JRjrS6gFDgkjNq7G/ps9O6RaY8MZ2TYFapEdDSjvxzDbBjRqL
Zp3gkIC5TVhSA2IkgDa0ddm9+kW7oKsyVtW6YunsUGALs9WZthY6cAOThVT3JmOb
t0M3lNtlByzqWYKuzP1ZJKkGui1Vi1K0OPRZ1cSXhwsYzQD72bAqJxh2SLVcqix2
GpybtuR/K6vHonDCj6F/ISKCSTnJZSptPd81H0DLU3AubHhwRs5hkvsAAhr0XcXW
m57s7CsEUVSeowXfT+qSYglB7UaNjKkkhPSGhxOIlEKcPndNH4kElKknghesu17Q
3+ajidIJTAe6oZ61t1OOMOU2Qw2a9H7OvYHWTWSl5RhrcDTTrTlkeWavmZwa3Nsa
9OH1N5m4EzbcYGTJdZOVTZM4ViX1XHNHENkdAUHItmrs7DqXSxuUrQGJ0W6IYRfV
3A+IRkTvd6wrA9ju5J0RqF0xvhHr4gXAUgiVau0Fkxo3UiTvonpe5Jvm2yRA9v/x
YAefEXGSmGpLfAbwteT6BSViYhg/Mwi5uoSxwbUUy43uBVFXo9cDqIWlATp/GvgU
pxpoflT9RdyhugoKyFJ+3fCv32Rm+G/tJKxN5snnoEeIFSj5FVgPJKyrcyiKwJg2
wvE/OCg/+Nvqyx5LnVna2N5mOfO3fqZeBpq2bnH1Auq57s1ftFJGC+7IxWZKZUFa
Tbl/KpjIhLQojSiThB+yg5cMfnZ0+xYxD8EfWFuiLWgZwQJO8CJs62QXzlP6qwjm
g13UFfzpa+994lcRfZ1UzwEXb6Mk6NS/2nwkkDrztAhKKJtLNGx/R4wC9qloi4gl
0FDQcmOBkSwYJXxUzIxu8WCKVrLDFHKyI0eG4o4h3swUnAgGpvmX3Z7ECFanDY0s
jlKG7gY7zcagAycsrVVl66tAFlPAGlTHWM43RrgvYKudlImnJBp2ZPYsG4xqn7cR
ED/RhDuAGRLXy+HzL028TSJUiIet48eOD2zAmMd8EQpuT4QBFs+KL9lsTzmbCCcH
lpJJxReWmAi3501zcvJUaOsfeG+prhlZg3WSIboisu5s82tCl4SURztIRwfTGl3a
IjxENi16vchVfAIIDqwAHFyQrA5fmgjsASFukf+HArOezksxd9EQmgeQYUc1Au98
h0zphTEkvkI4jlwP2upUXkYMTRZj5Rqr0US9T+TkArtbI/f4NDtKEfzlDv2v63p/
UwmSetfR7g0U1OMZbogewb1PM8vGorneUv+tKU7feTZhWmMe6qyWVpsWO1du9i3k
LlaWS6m72DCjXuiAl1X3BApWIdQxgeQdfQ/QxM1Z1Vk2ooBIzARzQ+rZa2A9xzVh
x+s4wZOEAD0sFzYoMr2OZMfA5dySwaz/5/aNR+vL3DbpLEvAnQAj6wZLoHTKuR3N
Ofw0DvTZDVd1yYPTkG28L0B42ZySGfFSzlebJHcuNCH2mLgUb0XJiVO5s3kaADqE
E2nQzrdHgBjodVGO+bnfXlzEySVVTSVQt/yXx7YhxBk+MIXq1JEwAFYLS745sgZc
2lQDhvCcT327mgV5h+CHwYbQM1ZGOrPnia3RzSWTPNiphBqcZe129fD+3zlbdrkC
spcsSGfK1OysgGsectehQ6LjE2eASktzxQmS8ViNxnoum4Y2Ce60ED49M1ApGJ1J
MRaJdcgRkLEihA/K6PndHnjfawQwP2kQX/j9q4vCNfLCm+SP6SdLsWRSQuvRGT4q
+Fx9+qX+znjWVOYZzeIrtv64a0lJtJGrnaPoKez5yR0TN/r9qv6PB/3N/np6bLQG
0u0col+lnPgxVC8oxbR/6Ev9sAfVmHUw04IpO9QBw5zaLapIlMdL1TonzxVs552F
LFo7fAcjVc7E/cxfYrvXkBG5PhNHbMDsYaVA5XyvOkNhv0vkqyPatK0BIyttVy+F
0DSAdFB2SVlEkcKLPd6ciY5wpufwH63wnj80TpS4jZJl/0DMLkcpiU6xuYrN5Ibs
9UVTpcT/J7/jvbPaCpDmHzaGNDOVCcpS/YGrla6nKY14lwI/XHXrF/5MFGVki/Hp
sIbNWcbRTQDzNlcp2Z7D0APArt7HN4AwiuEo/GXMC8sKAJjIIAg4mjhbBlEmIvLh
z65wNWwqqmYvuerIMDYlIvPry749CSrJ2Q8H4LfA3nRl0gY/twW5O2IEoHnhx/x/
vvJCy+WRJnUaMvCR/JI2Pt2ZkEUFLDe1t5TGlrYhEP5G6m85AXuaSCFHZNJ8TZB8
DodR7quOLAbTLGmCpXrMfKpyaczbjj8hnqstT7/sCo1M0LHbBdFPpDcVmF0H1CW4
10Vx/NdrY998eE84ryocgSdgkloTiUeMYUwIFYo2FwnfkXe6/3+5RATlr17sCrXE
kaEp73F/FhSeN18d3baiCcvWfkVW2hmyM48AgZRcDzjIOXeQnqwZ03YB1nt4DLK8
6jGivw+1JFVjbDonodGSvZX5eirTR+2xQiXBvZuhlpmLNY9Y0T8YtScicc8eQ2m7
YhSw07/vawW+yg89po/MIj2WL5/m2EmfRxQWL6phv/Ee4JUogvmOiKbgKG/W84+v
4Q==
=m2A7
-----END PGP MESSAGE-----

--xhndWJKlxj2H7EcRFNi37V5EBuMbJO6xj--

@scottalanmiller said in Sending Secure E-Mail?:

If they could exchange keys, of course, but there is a reason that we'd already pointed out that this didn't meet the criteria right away.

It's because you are thinking about symmetric encryption.

From wikipedia:

Symmetric encryption
"The overarching problem with symmetrical cryptography, or single-key cryptography, is that it requires a secret key to be communicated through trusted couriers, diplomatic bags, or any other secure communication channel. If two parties cannot establish a secure initial key exchange, they won't be able to communicate securely without the risk of messages being intercepted and decrypted by a third party who acquired the key during the initial key exchange."

Asymmetric encryption
Public-key cryptography uses a two-key system, consisting of the public and the private keys, where messages are encrypted with one key and decrypted with another. It depends on the selected cryptographic algorithm which key—public or private—is used for encrypting messages, and which for decrypting. For example, in RSA, the private key is used for decrypting messages, while in the Digital Signature Algorithm (DSA), the private key is used for encrypting them. The public key can be sent over non-secure channels or shared in public; the private key is only available to its owner.

@scottalanmiller said in Sending Secure E-Mail?:

It ends up doing nothing more than TLS already does, but with a lot more manual work.

Completely wrong as well. TLS is just transport encryption. When it's not in transport, it's not encrypted.

@scottalanmiller said in Sending Secure E-Mail?:

The system admin can always get the key out of your email and open whatever has been sent.

Completely incorrect as well. The public key can only be used for encryption, not decryption.

@scottalanmiller said in Sending Secure E-Mail?:

you have to exchange keys outside of email

Sorry Scott, but that is completely incorrect. The public key is public.

These are some of the software and services that support encrypted mail with GPG/PGP inside the mail client.
https://www.openpgp.org/software/

It's an open standard: https://tools.ietf.org/html/rfc4880

@JasGot said in Sending Secure E-Mail?:

@JaredBusch Thanks. Not much more to it beyond what I thought. I was hoping someone would know of a solution that could work.

GPG/PGP works exactly like you want.

It's asymmetric encryption. If you wanted to send a secure email to me, you need my public key. Since it's public I can send it to you in an email and I could post it online. Whatever.

When you send a secure email to me you encrypt it with my public key. To be able to view the email I need two things - my private key and my passphrase. None of those are available to anyone else.

The email is stored on the email server as it was sent - fully encrypted. And so is it on my computer. So a sysadmin with access to the email server can't do anything. A sysadmin with full admin rights on my computer could get my private key. But not the passphrase. So can't do anything with the encrypted email.

Emails can also be signed. Which means that using your public key, I can verify that the email you sent me actually came from you and nobody else.

This is exactly what happens when you download software from repositories like ubuntu, debian etc. The package manager need the public key of the repository to verify that the packages are from there and not some shady individual.

@JaredBusch said in Help setting up routing:

It is all source and destination NAT rules. This is very basic actual "routing" knowledge.

That's a good description. It doesn't require that you set up any routes as such.

It's the use of a routing network that can be confusing. But it just means that the public IPs end up being routed to the WAN interface over the private routing subnet. Doesn't require any special config to be done in the router.

@Dashrender said in Help setting up routing:

Static assignment 125.25.25.1 - 172.16.16.200.11
Static assignment 125.25.25.2 - 172.16.16.200.12
Static assignment 125.25.25.3 - 172.16.16.200.13
Static assignment 125.25.25.4 - 172.16.16.200.14
Static assignment 125.25.25.5 - 172.16.16.200.15
Static assignment 125.25.25.6 - 172.16.16.200.x (all others)

So you mean 1:1 NAT on the first 5 public IPs and 1:many on the .6 IP?

BTW, network is 125.25.25.0/29 and not 125.25.25.6/29.

@IRJ said in Issues installing vagrant-libvirt plugin on Ubuntu 20.04:

Got it working. Apparently I missed this step

apt-get install libxslt-dev libxml2-dev libvirt-dev zlib1g-dev ruby-dev

It's interesting that those packages were not pulled in automatically by the package manager.
I guess the dependency was implicit.

@IRJ said in Issues installing vagrant-libvirt plugin on Ubuntu 20.04:

@stacksofplates said in Issues installing vagrant-libvirt plugin on Ubuntu 20.04:

Do you have a /usr/share/vagrant-plugins/plugins.d/vagrant-libvirt.json file?

Yes

{
  "vagrant-libvirt": {
    "ruby_version":"2.5.1",
    "vagrant_version":"2.0.2",
    "gem_version":"",
    "require":"",
    "sources":[]
  }
}

Isn't 2.0.2 old as dirt? 2.2.9 is the current version.

A remote code execution vulnerability affecting Netgear home routers was disclosed in June. Netgear will not release fixes for 45 of the affected router models, identifying them as “outside the security support period.” Proof-of-concept exploit code for the stack buffer overflow vulnerability has been released.

https://www.theregister.com/2020/07/30/netgear_abandons_45_routers_vuln_patching/

@manxam said in Patching configuration files:

@Pete-S : Does that not rely on always having the same context around the lines to patch though?
I.E. You will always have to have PasswordAuthentication directly preceding PermitRootLogin followed by RandomBlockOfText in order to find and patch PermitRootLogin?
I may be wrong, but I thought that if you added another config entry between PasswordAuthentication and PermitRootLogin that the patch would fail.

I'm not sure exactly what happens. I may have to run some tests to see.

I have an ER-X sitting in a box that I want to deploy.

It's for a home office. One port to WAN, one to LAN, one to WiFi AP, one to 4G router (backup).
Besides the usual stuff I also need to set up an IPsec site-to-site.

I haven't set one of these up before but I know you guys do this all the time.
Any recommendations on how I should get up to speed on this? What should be my first step? Where do I start?

Contextual patching is the answer to my question. It will look at the lines before and after each change so it can apply a patch even if the location inside the file is not the same.

# compare files and find what out what has changed
diff -c oldfile newfile > changes.patch

# apply the same patch to another file
patch -i changes.patch anotherfile

You can also diff & patch entire directory trees in one command.
For example all the files under /etc/

@scottalanmiller said in Miscellaneous Tech News:

@jmoore said in Miscellaneous Tech News:

Will have to do some reading to see what's changed in last few years. I admit I have not kept up with it.

BtrFS has been the "future" filesystem for Linux for years. But it's not been far enough along for most places to put into production yet. It's just getting to that point, now. That's why it is going to desktops, but not servers, at this point. This is the stage prior to it starting to replace XFS and EXT4 in production servers.

It's Facebook that have had problems with scaling xfs and invested a lot in btrfs.
As you said, Fedora users are just beta testers for real production use. Consider it production ready when it ends up in RHEL.

I read this a couple of weeks ago. Has some more info: https://lwn.net/Articles/824855/

@JaredBusch said in Patching configuration files:

@Pete-S said in Patching configuration files:

I need something better than manual editing for servers that are not hooked up to ansible or salt.

add them to salt/ansible.

You're right. It seems like that is easier than trying to figure out how to use diff & patch.

@travisdh1 said in Patching configuration files:

@Pete-S That is what things like salt and Ansible are for. You tell the main server what programs should be installed/running, and config files. It manages the servers for you from there.

Yes, I know and it's a good point. However I need something better than manual editing for servers that are not hooked up to ansible or salt.

I often do the same changes in config files many times. But I'd like to automate it.

For example I like to be able to ssh directly into the root account on internal servers. So I have to go and add/change PermitRootLogin in sshd_config. And so on and so forth.

How do I use diff and patch so that my patch files works even if the config files look slightly different, perhaps an additional line or two somewhere? Or do I need some other tool for that?