Proxmox VM snapshots and backups, plus proxsave I assume?

I actually did that. Or well, I was planning to upgrade the Debian version and instead of doing it in place I replaced the drive (kept the old around for a while just in case) and did a clean install. I didn’t make any new backups or moved configs or anything outside what I already had, the system was back to operations faily quickly. The main reason, I have a markdown file describing every configuration and recovery step needed to get a fresh system to a fully working state in case of a disaster, and my test showed that it worked great. It does take a bit of effort to keep it up-to-date, but as shown, really worth it, and it douples as a small wiki for accumulated knowledge. I do wish to play with Ansible at some point if I have the time, but this works for now.

Did you restart the browser/phone in between? Maybe the old cached list was being used? Heard some recommend restarting the phone just to be sure.

Huh?!

Wouldn’t be surprised if the big guys got first dibs before everyone else

Synology had a critical system and PHP package update yesterday, could it be related 🤔

Strange. Are you on Android or iOS?

Proxmox which uses KVM

Firefox showed all green on my phone, same as Chrome. Are tou maybe missing an update? Check the Play Store for updates.

None of my VM require sharing of data, so each gets their own. I don’t currently use ZFS in Proxmox, but do have snapshots and periodic backups to my NAS, so recovery is generally not an issue.

Conceptually, mounting a host storage inside a VM requires the use of either virtiofsd or NFS daemon running on the host (depending whether you mount it as local or network storage), so if either of the two or the underlying filesystem has a vulnerability, it does in theory create an attack surface, which is not ideal. With that said, as I mentioned above, I have not research led this enough, since I haven’t had the need yet, so don’t quote me on that. At the end of the day, it’s all about where you personally draw the line, so if you are fine with that risk and absolutely can’t give up the feature than go for it, it’s your system.

I mean, unattended upgrades has it’s own config file where you can specify when to schedule a reboot (when needed), which you’d usually do in off-hours like 2 AM your local time, so changing the Systemd unit activation time seems like the wrong fix.

Edit: Nevermind, your issue was that the daemons were being rebooted, not the whole system, if I understood that correctly

• Forgejo for private git repos, coz F GitHub (F as in paying respect obviously… :v)
• Portainer, though don’t use much as of late as I got used to the CLI
• qBittorrent for Linux ISOs. No, really, I use it to download Linux ISOs :v
• WireGuard, several instances, some for accessing specific services, one for accessing GeoIP blocked content when traveling
• Vaultwarden for managing passwords
• Home Assistant for managing a couple of sensors
• Nginx Proxy Manager for managing hosts
• TeamSpeak 6, just playing around with the beta for now
• Apache Subversion for private SVN repos
• A handmade C# service for storing some MQTT data into a database
• peaNUT a NUT dashboard for the UPS
• RustDesk for remote management of desktops

As for the hardware:

• A Raspberry pi 4 running Docker containers
• A Dell Wyse 5070 (16GB) running Proxmox with mainly Alpine Linux VMs

If you asked me 2 years ago, I’d say they give a decent level of isolation for cheap, but, at the end of the day, in the eyes of the kernel, containerized processes are just another process running on the same host, just with a different set of privileges. If you have public facing services, or untrusted binaries, I suggest moving those to VMs, local services can stay in containers. This is what I did after Copy Fail and Dirty Frag were discovered. Alpine Linux VMs are pretty lean, so I went with that, and to keep the migration simple, I run the services as containers inside the VMs.

For frequently changing data hourly up to 24, daily up to 7, weekly upto 4, monthly up to 12.

For daily changing data daily up to 7 and etc. as above.

For seldom changing data a backup every 3 days with rotation based on a storage quota, and retention of manually held samples.

Did you read it to the end?

Without root user login, the attacker would have to guess not only the password to the user but also the username (hopefully it’s not something simple like admin), and once you are logged in you can use sudo -i to chage into root, which will require a password, therefore, we also disable password login so if someone does manage to somehow compromise the SSH user, they’d still need the password to become root.

For home Wi-Fi I use a strong password, but that’s because it’s something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.

If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.

Yep, there’s a reason 2FA recovery keys are usually printed and stored safely.

With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.