linux

This magazine is from a federated server and may be incomplete. Browse more on the original instance.

Zetta, in Looking to switch to Linux in the somewhat distant future

I started with Zoro which is a windows look alike, tried mint and a few other distros but ultimately landed on Fedora.

Fedora has been great and I haven’t been tempted to leave since trying it out a few years ago.

hottari, in Looking to switch to Linux in the somewhat distant future

Would recommend Fedora Silverblue.

vsis, (edited ) in How safe are my data if my hard drive isn't encrypted?
@vsis@feddit.cl avatar

If the device get stolen, your drive and its files can be easily read.

Other attacks like malware or ransomware are almost the same if the drive is encrypted or not.

Disk encryption is important for laptops and phones because these devices are frequently stolen. For desktop or servers is still good idea, though.

Guenther_Amanita,

Thanks a lot for your answer. How would you encrypt a server? Typing a password every time it boots isn’t possible for me, since I would need a monitor for my headless server.

AdamantiteAdventurer,
@AdamantiteAdventurer@beehaw.org avatar

I use Luks/Tang to unlock the server at boot from another computer that is always on too. If that one is down I’ll need to type it or power the other PC on, but otherwise it auto decrypts for me as long as I’m on the same network.

dime,

One option may be a hardware security key. Here is an example: https://www.endpointdev.com/blog/2022/03/disk-decryption-yubikey/

vsis,
@vsis@feddit.cl avatar

That’s why it’s not always an option.

Some servers have some kind remote console hardware, with their own security issues.

Your “threat model” is important too. Do you expect that server to get stolen? If it happens, is there critical data that should not leak?

Maybe you need to encrypt a directory, and not the whole drive.

Guenther_Amanita,

My threat model isn’t high. Just normal stuff everyone has, but that would be disadvantagely if someone else got them.

It’s more if a precautionary measure. It doesn’t have to be super safe, but better than nothing.

rgb3x3,

Is this for your home? If it is, you don’t really have to worry about someone stealing your desktop. If someone breaks into your home, they’re looking for quick cash and jewelry and TVs. They’re not going to bother stealing your server to dig through files for something usable.

Guenther_Amanita, (edited )

I’ve had quite a bad experience with police for example.

30 cops raided my home because of something trivial (I ordered a bit of non-psychoactive CBD-weed, which is, even in the most restrictive country you can imagine, ridiculous).

Of course, I got the whole experience-pack, including strip searches and confiscating all electronics.

Even though I believe them getting hold of any data wouldn’t have changed much, I’m still glad I had my devices encrypted.

Just knowing they didn’t see my cringy pictures of my teeny-me, where I discovered Snapchat filters, is a big relief. 😅

Yeah… that traumatized me a bit and maybe that’s the reason I’m worrying.

Also, you could never know what will happen in the future. Maybe my GF will turn crazy tomorrow and use those embarrassing pictures against me. Who knows?

I believe everyone should use encryption, even if they don’t have much to hide…

rgb3x3,

Oh that’s a really good point. Don’t trust the cops, keep everything encrypted.

Way safer in those situations.

Frederic, (edited )

If Windows, use BitLocker.

If Linux, use LUKS but you need to enter the passphrase at boot, you can securely put the key in TPM2 I think (à la Windows) but it may be complicated to setup, or just seal the phrase in TPM2 but if you boot on grub you can break grub and replace init with a shell in boot option and have access to the system I think :-/ but a simple crackhead thief would not understand that.

You can also have the key on a USB key, but if on the server and the server get stolen, it’s useless. You can setup a “anywhereUSB” and have your USB key in another room/place, etc, there is others possibilities.

I wanted to unlock with bluetooth but having the bluetooth HW driver and stack in initramfs was nightmarish a little bit :-/

wmassingham,

Either self-encrypting drives (if you trust the OEM encryption) or auto-unlock with keys in the TPM: wiki.archlinux.org/title/Trusted_Platform_Module#…

Ing0R,
eager_eagle, in Xorg – Wayland Transition Thoughts…
@eager_eagle@lemmy.world avatar
EccTM, in Xorg – Wayland Transition Thoughts…

Were there supposed to be “some thoughts, details and resources” posted here? at the moment its just a link to the wayland project logo.

Bitrot, in [Q] Removing/deep cleanup of installed package doesn't work as expected. (remove, purge, autoremove)
@Bitrot@lemmy.sdf.org avatar

It is a very typical way of doing things, you just have to read the output and make sure no important packages are in the list.

Your command should be working. It won’t remove manually installed dependencies but should take care of automatic ones. You can check an individual package with apt show and look at the APT-Manual-Installed field.

deepdive,

Hi thanks for your quick response !

I already checked with apt show emacs and the output clearly shows emacs-gtk as depends on. And while installing the emacs package with: sudo apt-get install emacs it installed a ~400Mo package and all dependencies.

So why doesn’t sudo apt remove --purge --autoremove emacs removes everything ? I thought this command would be the exact opposite of sudo apt install package-name

Bitrot, (edited )
@Bitrot@lemmy.sdf.org avatar

Ah, I can duplicate this behavior too. I think it is probably related to emacs being a metapackage. It does not include emacs itself but forces the install of emacs-gtk. In my mind removing the metapackage should allow you to autoremove dependencies, but people have broken their systems badly with this behavior so it may have been changed or it’s stuck behind some configuration option.

Removing emacs-gtk itself will work as you expect. You can also install emacs-nox for a cli-only one that is smaller.

Edit: there is a setting called APT::Never-MarkAuto-Sections that by default includes meta packages and I think is the cause of this.

deepdive,

Thank you very much for your enlighten answer :D !

Removing emacs-gtk itself will work as you expect

Yes that’s what I found out with apt show emacs-gtk, it shows all the dependencies but I found it quiet odd behavior (lack of knowledge).

I wasn’t aware of metapackages, something new to put into my knowledge database.

Edit: While writing my replay and searching through the web and my console, even though I wouldn’t have had understood it while reading it… It actually tells me in the description that emacs is a metapackage… Bad reading skills :/ sorry about that !

Description: GNU Emacs editor (metapackage) GNU Emacs is the extensible self-documenting text editor. This is a metapackage that will always depend on the latest recommended Emacs variant (currently emacs-gtk).


If you don’t mind I have a last question. Imagine I want to remove docker-ce, which depends on iptables among others, if I sudo apt remove --purge --autoremove docker-ce, this isn’t going to remove iptables and break my system right? Because it’s used by other packages, system… I guess, no?

I think a more general question would be how can I be sure I not going to fuck my system while removing packages? Maybe I’m to paranoïd and today it’s relatively safe to do so, compared to years ago??

Thank you :)

Bitrot,
@Bitrot@lemmy.sdf.org avatar

If something else depends on it then it shouldn’t be removed, it’s only removing things that are not used elsewhere.

Usually just reading through the packages it’s listing and double check what it’s doing is enough. If something is removing a ton of gnome and you’re not trying to remove gnome, that would be an issue. If something is trying to remove the kernel (unless it’s an old kernel) or grub that’s also worth digging into. I’ve never run into problems with it, I don’t think it’s common these days.

PseudoSpock, in S3 Sleep on AMD always freezing the Desktop
@PseudoSpock@lemmy.dbzer0.com avatar

Microsoft has pushed OEM’s to stop supporting S3 in bios, instead wanting hybrid sleep. Microsoft wants this because hybrid sleep allows waking for sending telemetry to Microsoft all the dang time, like cell phones do. I curse the day they did this.

Pantherina,

Wtf this really sucks.

b0gl, in Looking to switch to Linux in the somewhat distant future

I use Nobara which comes with drivers for Nvidia and stuff just works. It’s very noob friendly.

tkf, in Best practices in mounting NAS shares?
@tkf@infosec.pub avatar

I’m curious, what file system do you use to mount your share? (SMB, SSHFS, WebDAV, NFS…?) I’ve never managed to get decent performance on a remote-mounted directory because of the latency, even on a local network, and this becomes an issue with large directories

NotAnArdvark,

Agreed on the latency issues. I tested SMB and NFS once and found them to be pretty much the same in that regard.

I’m interested to test iSCSI, as for some reason I think it might be better designed for latency.

dan, (edited )
@dan@upvote.au avatar

If you want the lowest latency, you could try NBD. It’s a block protocol but with less overhead compared to iSCSI. github.com/NetworkBlockDevice/nbd/tree/master

Like iSCSI, it exposes a disk image file, or a raw partition if you’d like (by using something like /dev/sda3 or /dev/mapper/foo as the file name). Unlike iSCSI, it’s a fairly basic protocol (the API is literally only 9 commands). iSCSI is essentially just regular SCSI over the network.

NFS and SMB have to deal with file locks, multiple readers and writers concurrently accessing the same file, permissions, etc. That can add a little bit of overhead. With iSCSI and NBD, it assumes only one client is using the file (because it’s impossible for two clients to use the same disk image at the same time - it’ll get corrupted) and it’s just reading and writing raw data.

Rockslide0482,

main thing to note is that NFS is an object based storage (acts like a share) where iSCSI is block based (acts like a disk). You’d really only use iSCSI for things like VM disks, 1:1 storage, etc. For home use cases unless you’re selfhosting (and probably even then) you’re likely gonna be better off with NFS.

if you were to do iSCSI I would recommend its own VLAN. NFS technically should be isolated too, but I currently run NFS over my main VLAN, so do what ya gotta do

phx,

Yeah, there are a few limitations to each. NFS, for example, doesn’t play nicely with certain options if you’re using a filesystem overlay (overlays), which can be annoying when using it for PXE environments. It does however allow you to mount in several remote machines simultaneously, which I don’t think iSCSI would play nicely with.

SMB though has user-based authentication built in, watch can be quite handy esp if you’re not into setting up a whole Kerberos stack in order to use that functionality with NFS.

SpaceCadet,
@SpaceCadet@feddit.nl avatar

I’ve found that NFS gives me the best performance and the least issues. For my use cases, single user where throughput is more important than latency, it’s indistinguishable from a local disk. It basically goes as fast as my gigabit NIC allows, which is more or less the maximum throughput of the hard disks as well.

A benefit of NFS over SMB is that you can just use Unix ownerships and permissions. I do make sure to synchronize UIDs and GIDs across my devices because I could never get idmapping to work with my NAS.

2xsaiko,
@2xsaiko@discuss.tchncs.de avatar

idmapping

idmap only works with Kerberos auth, but iirc I didn’t have to set anything up specifically for it. Though I’ve also never really had to test it since my UIDs match coincidentally, I just tested with the nfsidmap command.

starlord, in What's the best way to remote into a linux machine?

SSH or RustDesk

ShortN0te,

RustDesk

With the shit they pulled on ‘fixing’ wayland support i would not recommend using their code ever.

github.com/rustdesk/rustdesk/blob/…/linux.rs#L411…

starlord,

Interesting. I found RustDesk recommended as an alternative to AnyDesk. Do you have alternate suggestions?

SciPiTie,

Do you have any context links? That sed looks like something I’d do after 20h not finding the issue at first glance…

velox_vulnus,

That is definitely not going to work on Guix or NixOS lol.

optissima, in Power Management Bugs Hold Up Some Linux Laptops Due To Regulatory Requirements
corship, in Which Desktop / Window Manager is most secure?

You really should press Ctrl+alt+f3 on your lock screen and get your mind blown.

Pantherina,

That leaves the desktop running in a parallel session

corship, (edited )

I think you missed the point. Switch the tty to realize your de is irrelevant in regards to security, because you don’t even need one…

Pantherina,

Wait until you want to watch a video, look at a photo, play a game or view a PDF lol

musicmatze,
@musicmatze@lemmy.ml avatar

You can do all these things on a framebuffer. Ok, maybe the game thing is a bit of a hassle, but the other stuff is totally doable.

corship,

What the duck has this to do with anything.

The entire point is that your DE has NO security features at all, those come ALL from the underlying system such as PAM for example, managing the authentication and such.

These stupid strawmans “huhr dur watch a video”

Besides that I’ll just answer the straw man argument anyway because it’s even stupid if you take it seriously YES YOU CAN ACTUALLY LAUNCH GUI (such as a game) DIRECTLY FROM TTY.

And I quote

LoL

Pantherina,

Learned something, thanks

sibloure,

I would love to only use the computer in tty but would be hard to edit images in GIMP. Or do you still launch GUI apps directly from tty? Most websites are an abomination viewed through lynx or similar.

corship,

What the duck has this to do with anything.

The entire point is that your DE has NO security features at all, those come ALL from the underlying system such as PAM for example, managing the authentication and such.

These stupid strawmans “huhr dur watch a video”

Besides that I’ll just answer the straw man argument anyway because it’s even stupid if you take it seriously YES YOU DO ACTUALLY LAUNCH GUI DIRECTLY FROM TTY.

sibloure,

Sorry I don’t understand what this means. I am not a computer whiz but just like the simplicity of typing things versus navigating menus.

far_university1990, in Sway-MÜSLI: Sway – Minimal Ültrafast Status Line

𝕯𝖎𝖊𝖘𝖊 𝕶𝖔𝖒𝖒𝖊𝖓𝖙𝖆𝖗𝖘𝖊𝖐𝖙𝖎𝖔𝖓 𝖎𝖘𝖙 𝖓𝖚𝖓 𝕰𝖎𝖌𝖊𝖓𝖙𝖚𝖒 𝖉𝖊𝖗 𝕭𝖚𝖓𝖉𝖊𝖘𝖗𝖊𝖕𝖚𝖇𝖑𝖎𝖐 𝕯𝖊𝖚𝖙𝖘𝖈𝖍𝖑𝖆𝖓𝖉

PlexSheep,

Grüße aus der BRD

Dirk,
@Dirk@lemmy.ml avatar

Guten Tag!

Knusper,

Ültrafast

Wenn beim Angelsächsischen mal wieder das Sächsische durchkommt…

palordrolap, in Can't import OVA file or unpack it with tar

"UNEXPECTED_EOS" is almost certainly "unexpected end of stream", that is, the file is missing the end or there's data corruption and the unpacker has interpreted the bad data as meaning the file should be longer than it is.

Redownload the file, or try to download it using a different tool (e.g. wget or curl rather than a browser). If that still gets a truncated file, try a different source / mirror.

PrivateNoob,

Yeah you’re right. I’ve download git-lfs and it probably works now. Thank you for your help!

jsh, in openSUSE Logo Contest Concludes With Winners Selected

I…

  • All
  • Subscribed
  • Moderated
  • Favorites
  • linux@lemmy.ml
  • localhost
  • All magazines
  • Loading…
    Loading the web debug toolbar…
    Attempt #