overview for HTTP_404

1

A fully loaded MD1220 Likes Electricity. (alien.top)

submitted 9 months ago by HTTP_404_NotFound@alien.top to c/homelab@selfhosted.forum

2 comments fedilink

Aren't you scared about loosing your data? by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 2 points 10 months ago

No... I have proper, tested backups.

What service one should NOT self host by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 3 points 10 months ago

Don't host your own email server.

Just trust me.

2

Help! My wordpress site got pwned. What should I do? (alien.top)

submitted 10 months ago by HTTP_404_NotFound@alien.top to c/homelab@selfhosted.forum

14 comments fedilink

The correct answer, Assess the issue, determine the scope of impact, and remediate the initial problem.

Since, I have software which scans files diffs, I can see the vulnerabilities were injected in Late Oct/Early Nov.

So, I restored a backup from a few weeks prior to that date.

After restoring from the backup, I immediately updated all of the plugins/software, and removed the package which introduced the vulnerability.

Now, at this time, you might be concerned with the security of your homelab.

I am not.

Because I treat my external facing services as honeypots which I expected to get PWNED. As such, if the attacker managed to obtain shell access to the target kubernetes container, the impact was limited, because the pod itself, has ZERO network access to anything, except the internet. It can't even talk to my internal DNS server. Nothing.

As well, any authentication attempts on my local network, would have been detected by my Log monitoring platform, which would have delivered me an email, letting me know of authentication attempts on my internal servers.

Since, this is a docker/kubernetes container, I am rest easy knowing there are no persistent file system modifications to the container, as it is not persistent. Since, I restored to a backup before file changes were detected, this is more peace of mind.

So, what did I find?

A lot of php files containing very suspicious exec commands, which should not be present. I find lots of lovely obfuscated code checks, which also suspiciously had lovely eval commands.

Why did I make a post on this?

Because a few times a week, I see a post along the lines of...

"HELP MY LAB GOT PWNED AND MY STUFF IS NOW ENCRYPTED. WHAT SHOULD I DO?!?!?!"

I am making this post- because if you follow the recommended practices of having proper backups (3-2-1) rule, you can recover from these issues without breaking a sweat.

Backups, combined with log/authentication monitoring, gives you peace of mind. Properly securing everything, and restricting network access when possible, keeps things from spreading around your network.

Without the proper ACLs/Rules into place, the attacker could have gained access to my network, in which case, containing the damage would be extremely difficult. This is why having a proper DMZ is still crucial for any publicly exposed services.

Log monitoring software, was able to alert me to the presence of an issue. Without this, there would still be who-knows-what trying to run in my old wordpress site, and I would be none the wiser. Although, granted, it took a few weeks for an alarm to trip, which I have already remediated for the future.

Also, wordpress is a vulnerability magnet. Third time in the last 8 years.

1

Ah, finally got my power consumption under control.... and then this happens. (alien.top)

submitted 10 months ago by HTTP_404_NotFound@alien.top to c/homelab@selfhosted.forum

2 comments fedilink

Found the ultimate Nextcloud / Owncloud replacement! by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 2 points 10 months ago

I FOUND THE ULTIMATE REPLACEMENT.

(Offers basically no solid reasons as to why it is better then Nextcloud).

"mimimi chinese application" LOL

Meanwhile, very top of the githubrepo:

中文版本

OP, are you simping for a random chinese github repo?

Plex users, why? by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 2 points 10 months ago

Why?

Because I picked up a lifetime pass over 10 years ago, long before Jellyfin/Emby was even heard of.

Back then, it worked perfectly fine, and now it works, perfectly fine.

It has a good app on my Rokus/Shields. It just works.

When, it stops working, or they pull something stupid, I have Jellyfin already ready to go.

Until then though, plex reigns king. (Also, I like its interface more then Jellyfin)

Lightweight NVR solution that avoids transcoding and does 24/7 recording without detection by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

I am still a huge fan of Blue Iris.

Yup. It has a price tag. But, in terms of NVR, there isn't another comparable option, for the amount of features it includes.

And- its extremely flexible. If you don't want to transcode, it defaults to direct to disk encoding. If you slap in a GPU, or have intel quick sync, it is happy to use it.

If you want object detection, codeproject.ai integrates flawlessly with it, and also works with either CPU/GPU algorithms, or can use a coral TPU.

Normally- I recommend opensource projects- but, Blue Iris is rock solid. Its only real downside, is that it only runs on a windows box. But, there is a docker container which supposedly works for it too.

If I make a self-hosted Mini Cloudflare, will anyone like it? by HTTP_404_NotFound in c/main@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

A mini self-hosted cloudflare.... you mean, like building a reverse proxy? If so... we already have treafik, nginx, haproxy, etc....

Self-hosted, ruins the reason I use cloudflare, completely.

I use cloudflare, because...

DDOS / Attack protection. The bandwidth hits their servers, and not mine. You CANNOT SELF HOST ddos protection, unless you have a MASSIVE amount of bandwidth. Otherwise, it just overwhelms your internet connection. It doesn't matter if the traffic is blocked. It still fills your pipe.
Hiding my private IP / handling my dynamic IP.
Processing my domain's SMTP. You don't want to handle email at your home IP.... its likely blacklisted from major providers.

What do you use to monitor performance of your hosts and containers? by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

Yup. You can do that.

Although- you wouldn't "import" your existing containers. but, you can...

Create manifests for your containers (Kubernetes runs the exact same docker containers). or, find helm charts for your containers.
Import the storage from docker into your new PV/PVCs.

I would, suggest learning kubernetes first though. Learning curve can be rather steep.

Also, rancher + k3s would work perfect for your Pis.

I built a UniFi AI assistant – so you don't have to go through their docs ever again by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 2 points 10 months ago

Q: How can I setup an ipv6 GIF tunnel

A: (Except): UniFi devices do not natively support GIF tunnel

Q: How can I manage static routes on a layer 3 unifi switch.
A: (Excerpt): In addition to routing traffic between VLANs, L3 UniFi Switches offer the following features:
Static Routing: Create static routes to a next-hop IP address or interface.

^ Lie. Static routing is broken on unifi layer 3 switches.

Am I crazy to move to pfSense from OPNsense? by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

I personally, choose to not support companies who are assholes.

And, especially companies who call their open source competition, "Nazis".

Screw netgate.

I want to use a netapp disk shelf as a jbod, how many cables do i need? by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

You only NEED one cable + one controller.

How often are you shutting down your hosts? by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

Only when I swap or upgrade internal hardware.

These run 24/7/365.

Looking to upgrade my internal network to 10gbe and could use some advice. by HTTP_404_NotFound in c/homelab@selfhosted.forum

[-] HTTP_404_NotFound@alien.top 1 points 10 months ago

As somebody who has spent a ton of time messing with both 10/40/100GBe....

https://static.xtremeownage.com/pages/Projects/40G-NAS/

My advice-

use Intel or Mellonax NICs when possible.
10GBase-T (RJ45 / Copper) runs REALLY hot, uses ~9 watts, and the modules are expensive. Use Fiber / DAC / AOC / Twinax when possible. Its cheaper, cooler, more efficient.
Mikrotik switches are fine. Nothing fancy, but, they work. I have one in my 10G network.
Cat6 is perfectly fine for 10G, I have 60 foot runs of it through my house.
Make sure flow-control is enabled on your switches / NICs. Can make drastic differences.

I PERSONALLY use a unifi aggregation switch as my layer 2 10G switch. With 6 of the 8 ports filled, it only draws around 8 watts of energy, and is completely silent. This- is quite fantastic.

I also use a Unifi PRO switch, for 10G routing, which is also silent, and pretty efficient.

Granted, these are a lot more expensive then mikrotik switches. Mikrotik can handle the job just fine.

If noise/power isn't a concern, pick up a brocade icx6610-48-p on ebay. The absolute beef-daddy of switches, for 100$. 16x 10G SFP+, 2x40G QSFP, 48x1G poe.