Jens 2001db8

Self-hosted Stalwart mail server

Self-hosted Stalwart mail server

PostgreSQL

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Gemini Lake Hardware-accelerated Transcoding

This is for a used Wyse 5070 I recently purchased, having the J5005 CPU and a huge 8 GB RAM all running on AlmaLinux 9.1. Why AlmaLinux? Because I'm partial to RHEL-based systems with its focus on stability, that's all. Unfortunately the downside is that oftentimes new software isn't readily available.

I want to unlock the ability to perform hardware-accelerated transcoding in ffmpeg so I can use it in Tdarr as a decent remote transcoding node.

Intel ARK - Pentium Silver J5005 shows that the CPU has Quick Sync Video support, and as such supports some form of hardware video acceleration.

The CPU is Gemini Lake and uses Intel UHD Graphics 605, which is Gen 9.5 according to the ffmpeg wiki. The machine should be able

Hacks

Some hacks around using NVIDIA GPU for Jellyfin Container with QNAP

Make sure you have NVIDIA driver installed already

Check NVIDIA Driver Path

find /share/ -name "NVIDIA_GPU_DRV"

↗️ This gist has been transferred to tailscale-dev/deck-tailscale

Initial checks

Start by checking that there aren't any previous ssh keys inside the FIDO2 authenticator of your YubiKey. You can check if they exist by running the command below:

nix shell nixpkgs#yubikey-manager -c ykman fido credentials list

If the command above outputs a string mentioning "ssh" or "openssh", then you have already got a key generated and store on your YubiKey.

Evaluating additional authentication factors

Before generating a new ssh key to store on your YubiKey you must consider which additional required authentication factors you want to use. Below you can see a table with the available factors and their corresponding command:

Intro

Out of the box, my SMB performance on macOS 12.3.1 would top out at around 20MB/s in short ~5 second bursts, which was absolutely horrendous, slow to navigate in Finder and slugish to interact with.

Since making these changes, I now get sustained ~80-100MB/s+ and instant Finder navigation which is superb and how things should be out-of-the-box (OOTB)!

May 2023 update: As of Ventura, the SMB issues were just horribly inconsistent and hard to maintain. Something in the combination of Unraid, macOS and SMB just doesn't play nice. I ended up binning NFS/SMB all together and heading to a locally hosted Nextcloud instance for file syncing, then using SFTP/Ansible Git flow for editing files within appdata.

Sources

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Proxmox - Email Alerts Setup (gmail)

SSH into proxmox node and become root user. Run the following commands to download extra software dependencies we'll need.
```
apt update
apt install -y libsasl2-modules mailutils
```
Enable 2FA for the gmail account that will be used by going to security settings

	#!/bin/sh

	echo Disabling vpnagentd...
	sudo launchctl disable system/com.cisco.anyconnect.vpnagentd

	echo Tearing down vpnagentd...
	sudo launchctl bootout system /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist

	echo Deactivating Cisco AnyConnect Socket Filter Extension...
	/Applications/Cisco/Cisco\ AnyConnect\ Socket\ Filter.app/Contents/MacOS/Cisco\ AnyConnect\ Socket\ Filter -deactivateExt