Just today I installed Tailscale on a VPS and was wondering why it could discover all machines on my tailnet. Even though I specifically didn’t give it any grants or ACL rules. Turns out, new machines have permissions of the authorizing user when first authorized. These devices were added by me so they assume my identity. — Alex from Tailscale In other words, tailscale on a machine without tags can do everything user can do. Limited only by the capabilities of the Tailscale client software. Luckily, it doesn’t include being able to edit the ACL. ...
Indieweb
Today I found out about indieweb, webmentions and nownownow. Turns out I’m not even close to finishing setting up the blog. Nice.
Hardening #2 - Netdata and Tailscale
I decided to add some monitoring to the server. You don’t have to tell me — I already know I don’t need it. There aren’t any visitors, just an occasional bot trying to get in via SSH or RDP. I already know this from analytics and nginx/sshd logs. But now I have a bunch of dashboards that rub it in In any case, any monitoring is better than none at all. Hard to argue with that. ...
Hardening the Blog #1 - Rate limiting and fail2ban
I got the cheapest VPS for this site. Currently the blog itself is hosted by GitLab Pages but analytics and comments are on a VPS that I maintain1. It got me thinking, as compute resources are very limited, what would be the best way to protect the server from malicous users, DOS attacks, DDOS attacks, etc? At work everything is usually behind a firewall, load-balancers of different kinds, and public IP address of the server is never exposed. On top of that, everything’s always already setup when I come around. ...
Debug DNS Leak
I was surprised today to find out that Firefox was using my ISP’s DNS server — even though I had a local Pi-hole set up to use Cloudflare’s 1.1.1.1. It was my mistake. When I set up Pi-hole in my router’s DHCP settings, I forgot about DHCPv6. Once I added the local IPv6 address of my Pi-hole as the DNS server for DHCPv6, my ISP’s DNS server stopped showing up in the test. ...
[Wi-Fi name] has no internet access
Let’s say you have a Samsung phone. You connect to a Wi-Fi network and get a notification saying: [Wi-Fi name] has no internet access This could happen because your phone isn’t getting DNS responses for certain domains, such as: www.google.com google.com connectivitycheck.gstatic.com play.googleapis.com www.goooooooooooooooooooooooooooooooooooooooooooooooooooooooooogle.com (not a joke) …and a few others. You can find the full list by capturing the DNS queries your phone makes when connecting to Wi-Fi. ...
#1
There’s nothing yet but hopefully this will change soon.