Mastouille

David Sardari<a href="https://fosstodon.org/@Gentoo_eV" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Gentoo_eV</a> Given that I get a KVM console in time, I will demonstrate my installation guide (<a href="https://gentoo.duxsco.de/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gentoo.duxsco.de/</a>) in English using a <a href="https://fedifreu.de/tags/Hetzner" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hetzner</a> dedicated server.<ul><li>What? Beyond Secure Boot – Measured Boot on Gentoo Linux?</li><li>When? Saturday, 2024-10-19 at 18:00 UTC (20:00 CEST)</li><li>Where? Video call via BigBlueButton: <a href="https://bbb.gentoo-ev.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bbb.gentoo-ev.org/</a></li></ul>The final setup will feature:<ul><li><a href="https://fedifreu.de/tags/SecureBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecureBoot</a>: All EFI binaries and unified kernel images are signed.</li><li><a href="https://fedifreu.de/tags/MeasuredBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MeasuredBoot</a>: <a href="https://fedifreu.de/tags/clevis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#clevis</a> and <a href="https://fedifreu.de/tags/tang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tang</a> will be used to check the system for manipulations via <a href="https://fedifreu.de/tags/TPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TPM</a> 2.0 PCRs and for remote LUKS unlock (you don't need tty).</li><li>Fully encrypted: Except for ESPs, all partitions are <a href="https://fedifreu.de/tags/LUKS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LUKS</a> encrypted.</li><li><a href="https://fedifreu.de/tags/RAID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RAID</a>: Except for ESPs, <a href="https://fedifreu.de/tags/btrfs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#btrfs</a> and <a href="https://fedifreu.de/tags/mdadm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mdadm</a> based <a href="https://fedifreu.de/tags/RAID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RAID</a> are used for all partitions.</li><li>Rescue System: A customised <a href="https://fedifreu.de/tags/SystemRescue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SystemRescue</a> (<a href="https://www.system-rescue.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.system-rescue.org/</a>) supports SSH logins and provides a convenient chroot.sh script.</li><li>Hardened <a href="https://fedifreu.de/tags/Gentoo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gentoo</a> <a href="https://fedifreu.de/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> for a highly secure, high stability production environment.</li><li>If enough time is left at the end, <a href="https://fedifreu.de/tags/SELinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SELinux</a> which provides Mandatory Access Control using type enforcement and role-based access control</li></ul>

EddAfter a request on the <a href="https://mastodon.eddmil.es/tags/selfhosted" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosted</a> community on Lemmy, I wrote up how I use LUKS, Clevis, and Tang to give me network-bound encryption. This means that I can restart my servers as long as they're on my home network without worrying about having to log in to decrypt the drive, but if someone breaks in and steals my servers and turns them on anywhere else, the data on them is safe. <a href="https://i.am.eddmil.es/clevistang/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://i.am.eddmil.es/clevistang/</a><a href="https://mastodon.eddmil.es/tags/selfhosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosting</a> <a href="https://mastodon.eddmil.es/tags/encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encryption</a> <a href="https://mastodon.eddmil.es/tags/LUKS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LUKS</a> <a href="https://mastodon.eddmil.es/tags/clevis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#clevis</a> <a href="https://mastodon.eddmil.es/tags/tang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tang</a>

Recherches récentes

Options de recherche

Administré par :

Statistiques du serveur :

#clevis