MSgtRedFox

MSgtRedFox , 4 months ago

I know this isn’t what you’re looking for, but I got a family plan from Google for music and split it with 6 family members, which is probably the same as apple music I assume.

I don’t have to mess with download anymore.

Lidarr is only one I know.

MSgtRedFox , 4 months ago

Is that a pickup line? Lol

MSgtRedFox , 4 months ago

I’m an enterprise guy, so that’s the explanation for non home use things.

• VPN for anything not my web or certificate revocation distribution point
• Sophos IPS
• sophos utm for web application firewall
• transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don’t inspect medical or banking, other common sense stuff.
• heavily vlan segmented with firewall between
• my windows clients are managed by active directory with heavy handed GPOs.
• least priv accounts, different accounts for workstation admin, server, domain, network devices
• security Onion IDS
• separate red forest that has admin accounts for my management access and accounts on devices
• trellix antivirus and global reputation based file monitoring
• I’ve started applying disa STIGs on servers
• site to site VPN with other family member household. They get managed trellix av also.
• my public identity accounts like MS,.Google, etc all need 2fa, token, etc.

I bet this can still get exploited, just would take effort hopefully none does for a home network.

I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

MSgtRedFox , 4 months ago

Ha yeah.

Id say the same for trellix.

You should try doing things with installs or updating apps when the edr product blocks write access to all temp locations. You have to do an exclusion for every installer, signing cert, or turn it off to install programs.

MSgtRedFox , 4 months ago

Also laughing because that’s how some companies get owned, IP stolen, etc.

There has to be balance, if your life using their system sucks so hard you can’t do your job or meet production marks, you get creative.

My industry has to prioritize security over productivity. It’s almost impossible to get work done.

MSgtRedFox , 4 months ago

Ha, probably. It’s fun to learn stuff though.

Working in this field, almost every company has been beached, IP stolen, etc.

Sometimes your home IP gets hit in an automated scan for a vulnerability and then auto exploited by automation. I’m hoping not to get random chance added to a botnet.

MSgtRedFox , 4 months ago

Your working environment sounds gross :)

IT is hard. Finding good IT people is harder in my opinion. Working for a company that is not super squared away with good security and great usability sucks. At least you found some work arounds and are trying to do it well.

MSgtRedFox , 4 months ago

1. Exchange on prem 😳
2. Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don’t have to root Android for that. It presents some warnings, appropriate.
3. My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.

I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.

Privacy. 🤔

Not much. I have certain traffic go through a VPN to the Internet, but that’s split tunneled.

I use incognito? That doesn’t really do anything, ha.

I’m slowly killing web browser tracking and cookie stuff that group policy allows.

MSgtRedFox , 4 months ago

Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.

I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.

MS got rid of intune on prem. It’s only Azure service now. I think.

My router is my biggest vuln. Oddly the most important. It’s an enterprise ISR. It’s updated as far as possible. My paranoia ends with the US gov/NSA. I don’t care if they want back door oddly. I don’t want China using me for attack relay however.

Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that’s a level I can’t deal with.

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

MSgtRedFox , 4 months ago

I have the older Sophos utm, which doesn’t use the Sophos cloud central manager.

I think their new firewall utm can work disconnected, but I don’t know.

Sophos has a home use license that’s free for non business use.

I love companies that do community edition or free home use.

Sophos, Veeam has nfr, Elastiflow has community edition, which is a netflow.

MSgtRedFox , 4 months ago

I think that’s synonymous with “all hail the shareholder”

MSgtRedFox , 4 months ago

This corporate cycle isn’t likely to change anytime soon right?

Top tier corps, boards, Cs, ultimately care about share price and growth right?

Isn’t it tied to their pay incentives? To keep their contracts and incentives, they have to grow or reduce costs.

They make bad choices or bets among the way, no problem, just reduce costs and still meet the metrics. Only people who pay seem to be the workforce, right?

Or am I oversimplifying?

MSgtRedFox , 4 months ago

So, as I’m reading this threat to learn some etiquette myself, I infer the ‘user’s not wanting their “local” page to include duplicates’ to mean that when posting to multiple communities, it would be a best practice to only pick one relevant community per server instance?

Like in this case, it was crossed to both: ‘[email protected]’ and ‘[email protected]’

In order to avoid duplicates, only one of those should have been included?

Like community1@server1 community2@server2, etc? If there’s two relevant communities, just pick the best one?

MSgtRedFox , 4 months ago

For real. Once Google and others started killing DNS lookups in mobile devices, think about how many legacy networks had to get rebuilt.

Maybe we could all just make up our minds.

MSgtRedFox , 4 months ago

Did you ever use HP SIM? I guess it’s not one to one features, but newer. Curious if it’s worth the time.

MSgtRedFox , 4 months ago

Running personal active directory hybrid sync with azure, hybrid exchange, a separate red forest for management of vSphere infrastructure, using saltstack for Linux config management. ~50 VMs and containers.

MSgtRedFox , 4 months ago

A story fit for /r/sysadmin:

Had to script and locally/manually uninstall and reinstall custom application on ~25 computers because:

• enterprise policies disable remote scripting/powershell remoting even though it an be enabled securely
• application developer had not finalized silent install
• dev team wont build the automation themsevles.

If you have any form of automated configuration management, you’re blessed :)

MSgtRedFox , 4 months ago

I recommend look into managed, vlan capable switches after you get your firewall figured out. That will allow you to put hosts on different vlans and separate lab stuff from the rest of your home network stuff.

There’s a million videos.

MSgtRedFox , 4 months ago

One of the keys to selecting the solution from the provided answers is if you need this to be publicly trusted.

I use an internal openssl ca root, created intermediate ca for each active directory domain or Forest. Also, I wanted to create internal PKI smart cards with yubikeys and his c1150 cards. For you know, fun.

I didn’t care that other hosts don’t trust my stuff because all my hosts are configured with root ca, and I only use VPN for access.

You want external trust, must do some of the other suggestions. Setting up internal CA is a chore with understanding AIA, CDP points, line of sight to PKI urls for renovation checking, more…

MSgtRedFox , 4 months ago (edited 4 months ago)

This reminds me of the movie hackers.

Is it possible the authors or site isn’t super familiar with cyber security, or the research side?

I’m mean, it’s cyber news, but how is this much different from have I been pwnd?

An I missing something, or was this just a click bait title to scare people?

Edit: so if this was for legit purposes, it should have been secured, otherwise it just contributes it assists with threat actors. I’m guessing this is why the community is upset.

MSgtRedFox , 4 months ago

What do you think about ideology of restricting or criminalizing paying ransoms then?

If paying the criminals was also a criminal offense, aside from companies that would still pay, would that curb the majority?

MSgtRedFox , 4 months ago

Makes sense.

MSgtRedFox , 4 months ago

Google has one too, can’t say whether it’s good or not, sorry.

MSgtRedFox , 4 months ago

Generically, sure. Seems like some highly complex social issues, religion, and hate might have complicated things…

MSgtRedFox , 4 months ago

I can’t imagine the pain and bottomless hatred I’d have if my son was killed in a war, but the name thing keeps me from wanting him to travel anywhere that might be a war zone.

Well, anymore than random places in the US already is…

MSgtRedFox , 4 months ago

New study results:

If you have money, you can pay any number of “research groups” to prove anything that aligns with your beliefs…

Studies also find that sometimes other organizations whose existence is also predicted on your beliefs will back those studies…

Sources: hold on, I’ll pay someone…

/s

MSgtRedFox , 4 months ago

Iraelis accuse Palestinians/Hamas of executing 1400…

MSgtRedFox , 4 months ago

What makes you believe one side’s propaganda over another? Both entities have incentive to illicit sympathy?

MSgtRedFox , 4 months ago

You think she was also a stripper?

MSgtRedFox , 4 months ago

Can someone share personal experiences?

Insert my physical appearance here, but I’ve met any health care professionals who cared about a person’s race. I don’t mean that cared for me, I know a bunch of providers personally.

They did however have plenty of stories of people treating them like shit or like a waitress at a restaurant.

MSgtRedFox , 4 months ago

I’m not sure if you’re being genuine or not; your last sentence makes me lean towards racist, but I’ll give you the benefit of the doubt.

Ha, that’s mighty big of you? 🤔. The necessary? into to your comment says “I read something you said and assume you’re a racist, but I’m not sure based on four short sentences.” I’m guessing you inferred the people I was talking about treating medical staff like shit were all non-whites “like me”?

It’s not that I don’t understand how easy it is to assume or infer things from internet conversations, but would you consider questions help more than statements?

Yes, I was genuinely asking.

It’s very hard to trust any “studies” anymore since with enough money, I feel like you could fund a study to say anything, and get other institutions to back it for the greater good/bad. Does that mean I don’t believe in discrimination or bias, no. That’s why I’d like to get first hand accounts also, knowing there’s less credibility of random lemmy users, it’s still something.

One of comments I read pointed out the study only included patients with insurance. If a significant contributor to quality of care has to do with income, I would want to believe that insurance would reduce that, since the organization is getting paid. I don’t know the back end details of different carriers and what they pay, and whether that would effect the actual care providers. I wouldn’t think a nurse gives a crap how much the patient’s insurance would or wouldn’t cover.

I’ve had pain meds withheld, and I’m the perfect white male that should get everything. I might have assumed care providers tend to think addiction issues with other people more than others.

My profession has come a long way. Someone with fucked up points of view on race joined my team a while ago. They got sorted out real fast. I saw and experienced that those ideas wouldn’t be tolerated at all. Instantly shutdown.

I suppose that’s not the case everywhere.

MSgtRedFox , 4 months ago

Well said, I appreciate your wisdom. And yes, was legit asking for perspective.

It’s pretty cool when we can get ideas and perspectives from all over the world from people in these Internet services, it’s just hard to interpret people’s intent sometimes.

MSgtRedFox , 4 months ago

I’m having a hard time imagining that someone would withhold pain management assuming the patient can just handle more pain or because they’re tough. To me, that would be insane. I’m not saying it’s not happening, I just can’t understand.

MSgtRedFox , 4 months ago

This is frustrating. The person that cuts my hair is self employed. They don’t have insurance, so medical care other than emergency is basically just toughing it out or calling in favors from their medpro clients.

I’d think most of us are favor of catastrophic dept prevention due to medical emergency, so that was a good start. Still not offording regular visits or getting a prescription for something easily treated is frustrating in a first world nation economy.

As long as you stay super poor and make no effort to fix your situation, you can get Medicaid/care. So we have that going for us…

MSgtRedFox , 4 months ago

Lol🤔

MSgtRedFox , 4 months ago

Hey, the navy needs to keep their button pushing skills sharp /s

MSgtRedFox , 4 months ago (edited 4 months ago)

I’m pretty sure ww3 was already started by stuxnet. Have you not seen the news lately regarding cyber crime/espionage/attacks?

MSgtRedFox , 4 months ago

darknetdiaries.com

This is a podcast that will cover some of the biggest ones.

If you don’t want to listen to a dork podcast since they can be long, short version is: cisoseries.com/…/cyber-security-headlines/

MSgtRedFox , 4 months ago

OPM was hacked a while ago all us gov with clearance taken

Chinese hacked Google and Microsoft to help them with zero day development, since Chinese have the source code now

Chinese hacked Microsoft and got us gov office 365 emails

Russia and China hack everything and everyone to steal intellectual property.

Russia has conducted cyber attacks against the places they invade.

If you Google cyber attacks, you’ll get endless results

MSgtRedFox , 4 months ago

Just a quick warning: life gets a lot more complex when you look at things holistically instead of tiny headline slices.

If you challenge us to put things into more context, you’re going to hurt our brains…

/s

MSgtRedFox , 4 months ago

Doesn’t tailscale retain closed source for the coordination server?

I think nebula mesh is totally open and you can run your own coordination server, lighthouse?

Nebula would need static IP, TS can do that part for $

MSgtRedFox , 4 months ago

So why do people live there?

All I ever heard is how absurd the cost of living is in Cali, is the weather really that good?

MSgtRedFox , 4 months ago

Well, it sounds like basic living there is way higher than anywhere else, so maybe?

MSgtRedFox , 4 months ago

Makes sense. I certainly wouldn’t want to move because of greedy BS either.

I guess the trade off is higher costs for everything.

MSgtRedFox , 4 months ago

Yeah, I get it…I know it doesn’t come through a simple text question, but I wasn’t born yesterday 😉

I wasn’t really asking from the standpoint of every single person’s circumstances from the well off to the impoverished. It was more of what would you do if there was choice.

I know people who were behind on rent, scraped enough gas money to just drive ina direction and found themselves somewhere they could make under the table money to get started in another place.

That’s a hard and scary thing to do. If you have a family, almost impossible unless you’re on the edge.

MSgtRedFox , 5 months ago

You’re correct about vlan.

Think of vlan is a regular switch. Connect stuff, they communicate. Make two vlans in a switch, think of turning your physical switch into two separate switches.

Connect you switches to a router. Don’t want to waste two cables from your switch that’s cut in half? Do trunk port, with vlan tagged.

Lots of videos will explain better.

Best practice is to separate things of different trust levels into different vlans. You can filter and control the traffic between those vlans with your router.

As previously mentioned, in the Enterprise and business world, best practice is to separate and management from VMS and applications. We call this data plane and control plane. You would restrict access to your proxmox for other hypervisor interface from the VMS and applications. For small home setups and funsies, this gets a little complicated, but if it’s your career choice or interest, it’s a good thing to explore.

Key terms you can research: data plane, control plane, out of band management, air gapped.

MSgtRedFox OP , 4 months ago

Agreed. There is SCAP, but it only covers some, and it’s STIG/federal based.

MSgtRedFox , 4 months ago

I’m not sure there’s a brand out there that’s safe at this point, but I don’t think I would buy HP consumer products regardless of the price. At some point. Though to counter, it seems any company will do whatever the customers/regulators will let them get away with, especially if people keep buying them.