Fail2ban is just another tool in your toolbox. Defense in depth, as others mentioned.
Fail2ban is primarily a tool to prevent brute force attacks, especially useful for services that don’t do their own throttling. For example I usually put ssh in fail2ban, but if Authelia’s built-in protection is good enough, then use that.
Outside ssh, anything that could be used to brute force credentials should be in fail2ban if they’re exposed: web sites with simple auth, mail, etc.
Glad to hear it saved the day and that you’re trying Linux full time. Love a good success story!
For you or anyone else who want to keep an emergency kit on a USB drive on hand, I recommend checking into Ventoy. With it, you can keep multiple ISOs on a single bootable USB drive and choose which one you want at boot time. Keep an emergency Linux desktop, rescue disks, etc on it and you’ll be good to go. You can easily add more or update existing images just by writing files to the drive. No reformatting required.
Yeah that’s my guess at well. Before I figured it out, I used a VPN connection into my local network (which works through hairpin NAT). I’m not a security expert, but that may be more secure than granting the permissions wholesale.
I had this happen too recently and only for certain apps. Turned out Android has a new permission that was being enforced: “Nearby devices”. Once I granted that to my browser, it could access my LAN again.
I think it’s fair to want a more helpful error message, but that’s not necessarily the purpose for path. There is a real cost to every entry in your $PATH. Not as much as in the world of spinning rust, but some.
There are some completion modules for shells that will suggest misspelled or even installable packages if it can’t find the command. Those are arguably better options.
As for traditional systems, I remember a time where running arbitrary commands, even with an --help argument could be dangerous and we had to set least try ‘man command’ first.
I thought this was how unix always has been? Sbin is for root binaries. It doesn’t make sense to include a bunch of commands you don’t have permission to execute in the path. I remember this being the case back in the 90s and didn’t realize it was no longer the norm.
Agreed. I don’t think I explained myself clearly enough: I want them to have a presence online. Among the reasons being exactly what you’re pointing out. However, I think at least for smaller cities with very little staff, it’s not realistic to ask them to literally self-host it (as in having a server on-prem running it). I would be fine with them outsourcing it or cloud-hosting it under their own domain. A potential solution for the small ones could be something like a state-level hosted service where municipalities can sign up and get their own accounts, for example. That would work even for something like Rittman, Ohio pop. 6,131.
Yep. That’s what I meant. I want them to come to the fediverse but I don’t necessarily want the city’s IT admin to manage it between fighting laser printers.
Not so sure I want them to self host, just based on their track record for security, but I would like them to be more visible.
Also news outlets could benefit from doing this instead of us having to rely on repost automation.
I would also love to see peertube become more competitive to YouTube. It would probably need some kind of revenue sharing model or donation integration for that though.
Your diagram is almost right, but I think it will help to understand more of the details. It’s important to understand the difference between DNS (domain name lookup) and IP routing.
To break your diagram down more, this is what happens when any computer looks up your website:
GET / HTTP/1.1
Host: example.com
...lots more headers...
<blank line>
That’s all very simplified, of course.
As others pointed out, things may seem to work differently from the “inside”, if hairpinning is not available or enabled. This is not related to DNS, but to IP routing. The firewall doing NAT can get confused and not know what to do when an internal request goes to an external IP that it itself has. When it turns that around and routes it back to the internal network, that’s called hairpinning.
One “fix” for this, often used in enterprises, is to use so-called split DNS. All that means is that if you’re asking your internal DNS server for an internal name, it will give you the internal address (192.168.1.123 for example), but an external client would get an external IP.
TL;DR: DNS and IP routing are separate concerns and happen at different parts of the TCP/IP stack.
My motivation for calling for it to be the default was that it’s safer (in terms of data).
Another UX principle is that of least surprise. I think it’s reasonable to assume that most users will expect the copy to be fully complete when the dialog closes, and that they will be surprised when their files are corrupted. Changing the behavior in the desktop to delay closing the dialog until any copying to removable media is complete should not be a controversial change.
We’re seeing an influx of novice users to Linux. I don’t think we need a bunch “Linux ate my files” incidents if it can be avoided by a simple change, which itself can be easily reversed if you didn’t like it.
I would settle for checked-by-default “sync and wait” option. That way I can choose whether to cause a sync or not.
Glad you got it working!
My hypothesis is that it was DNS (channeling Jeff Geerling here). Since Pihole is your DNS (makes sense), it may have recognized that address as its own and given you its IP. By resolving the naming collision, you fixed the problem because the name is now unambiguous.
These problems can happen very easily when you’re using DHCP and sharing a network and domain name between your clients and upstreams, so I think using home.arpa for one and your other domain for the other was a good idea.
What is your DNA setup like? A lot of dhcp clients are set up to register their name in DNS (if allowed). It could be your pihole server is hijacking it.
If you have multiple DNS servers (eg your home router and your lab) them you may not be getting the full picture.
Can you confirm that the DNS actually resolves to the NGINX IP address (and only that address) when you use PiHole’s FQDN? It sounds like it’s bypassing the proxy because it stopped working when you turned 443 off.
I can’t think of a single thing I miss. I use Windows for work and it’s a relief every evening when I can switch to my Linux desktop.
Linux Cons:
Linux Pros:
Workarounds:
Not saying going full time Linux was necessarily easy (I gave up Adobe Lightroom and I can’t play some AAA games) but I have no regrets. It was actually easier than I had feared.
It’s like diet and exercise: it’s not easy to change but you’ll feel a lot better in the end.
I don’t have suggestions, though I could look for some later. Maybe someone with personal experience with them can chime in.
Basically, search for “free online beginner coding classes”. Avoid anything paid for now. There are a lot of scams, but you really don’t need to pay for classes to learn.
Failing that, search YouTube for tutorials, though it helps if you know what you want to do. Start with something simple. For example analyzing a data set, make a simple game, something like that.
Git is just the version control part and there are better clients for git than vscode. What else will you be using it for? E.g., Python code? Web dev?
If you’re completely new to dev you may benefit from some free online courses that are about what you’re looking to do. Most dev classes already use vscode and git, so you will get that part anyway.
For learning, VMs are fine. Spin up as many as you’d like. Install, duplicate, reinstall, delete at will. I would start there.
Then, while you’re learning, set aside since money to get an SBC or mini pc. That will allow you to keep it running as a server continuously. Phones can work for this, but to act as servers you’ll probably need to root them.
Computers are way more expensive than they used to be but within reach for most people if you can save up for it.
Check thrift stores, Facebook, eBay, the usual suspects. Watch out for PCs stripped for RAM and other shenanigans, though.
I wonder what the sampling/reporting issue is? Why Chinese specifically? Are there droves of Chinese gamers flip-flopping between Linux and Windows? That doesn’t seem likely.