sysadmin
tojt est revenu dans l'ordre (et les maj #postgresql, ca marche super !)
#sysadmin
With Apple phasing out AFP in macOS 27 and Time Capsules officially reaching end-of-life, it's time to move network backups to proper SMB.
If you run a FreeBSD server, you can build a fast, rock-solid, and secure Time Machine target powered by ZFS and Samba - neatly isolated inside a FreeBSD jail using Bastille.
https://it-notes.dragas.net/2026/01/28/time-machine-freebsd-jail/
Keep your macOS backups running smoothly via SMBv3 (with full vfs_fruit support) and full dataset quota control on ZFS!
#FreeBSD #macOS #TimeMachine #ZFS #BastilleBSD #Samba #SysAdmin #Backup #OwnYourData #SelfHosted #BSD #RunBSD #OwnYourData
There is a person I've been helping for a while who runs two instances, one #GoToSocial and one #snac.
Yesterday, they suffered severe file system corruption on their device, and I lent them a hand with the recovery. For GoToSocial, they restored the DB from the previous backup and got it running again. For snac, although a few files were lost, no action was necessary... it just started back up and did what it had to do, bringing the instance back to full operation.
This goes to show that when software is well-designed and intentionally kept simple, it's also easier to get back up and running when something goes wrong. In this case, snac's "files-only" approach demonstrated excellent resilience.
Thanks, @grunfink !
#snac2 #snac #ThankYouTuesday #Efficiency #IT #SysAdmin #OwnYourData
EDIT: They replied that their plan is to replace every possible role with AI, including both devs and sysadmins, keeping only a few active contracts for emergencies and to fix issues they can't handle. I informed them of the termination of our working relationship as soon as possible, as the bond of trust has completely broken down. There was no financial hardship justifying the cost reduction they agreed upon with me - it was simply a unwillingness to increase costs, despite paying roughly the same amount for AI provider subscriptions.
A few months ago, a client asked me to shave about €200 a month off our agreement. "We’re trying to cut back on expenses", he said, "to boost our cash flow." I was hesitant, but hey, I agreed.
Fast forward to this morning: one of his team members calls me asking for help because - and I quote - "both Claude and ChatGPT are giving me answers that just don't feel right."
I asked for a little context, only to find out they had upgraded to the top-tier plans for both AIs so they could "solve problems on their own without bothering me."
So, I dropped my client a line: we either revert to our original agreement, or we wrap up this collaboration effective immediately.
Asking me for a discount just to throw far more money at AI subscriptions - only to call me anyway when the bots fail - is, to say the least, a slap (or slop?) in the face.
Do strony nowego projektu dodałem właśnie prosty licznik odwiedzin więc chyba pora na oficjalny start 😉
Zapraszam was do sprawdzenia katalogu narzędzi szanujących waszą #prywatność 🔒 Niewykluczone, że w przyszłości będę chciał dodać również inne usługi. Zatem jeśli macie jakieś propozycje to chętnie poczytam.
Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.
On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.
Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.
The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.
So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.
If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:
location = /api/v1/accounts {
limit_except GET {
deny all;
}
try_files $uri @proxy;
}
This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.
#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub
Customer: "We need to hurry, they breached the old server and we need to set up the new one ASAP!"
Me: "Yeah, it was old and way beyond any kind of updates. You really should have replaced it earlier. If you want, we can build the new one now."
Customer: "Yes, and make sure it is accessible only through the VPN. We want security!"
I go and take a look at the VPN and find out that it is provided by a commercial appliance, I will not mention the brand, running a version and release affected by several serious security issues, and also exposing some completely unnecessary services.
I point this out, and the answer is:
"Well, but the VPN is secure. That’s exactly why we want to use it!"
Do this now! In all your web browsers, go to https://emudhra.we-have-a-problem.com/ and go to the section titled "Does your client still trust the compromised intermediates?" and look at the right-most "Result" column. If any say "❌ Connected", you need to update your SSL/TLS certificates now. This can affect email, banking, software updating, and anything that uses #SSL, #TLS, and #HTTPS.
Edit: You can also go to https://bgp.tools/ and see if it says "Your SSL/TLS stack is accepting certificates from a #CertificateAuthority tree that is totally #compromised" I think/hope that browsers and operating systems will auto update certificates ASAP but don't do anything private until you're sure they're updated #IMHO!
#sysadmin #cybersecurity #security #privacy #CA #eMudhra #certificates
Client: "To access our VPN,m you need to install our VPN client".
Ok...let's try... "This installer will install 636 MB of stuff on your computer".
To access a...VPN?
No comment...
RE: https://m.ai6yr.org/@ai6yr/117533401914036933
And this, folks, is why every #sysadmin you know is absolutely hating life right now and actively reconsidering their career choices.
Quelqu'un a vu des erreurs "451 4.7.500 Server busy" depuis les serveurs mail microsoft ce matin ?
#sysadmin #mail #microsoft
Suite à la mise à jour de notre outil de sauvegarde nous nous sommes rendus compte de quelques aléas techniques.Dis moi que tu n'as pas de sauvegarde sans me dire que tu n'as pas de sauvegarde...
#sysadmin
I got a call from someone I don't know.
"Hi. We have a FreeBSD server. It's been working perfectly for years, but it hasn't been updated since then. We asked AI to update it, but now it won't boot anymore. It didn't even make a backup before starting. The AI keeps trying things, everything is down, and we've already spent over €500 in tokens. Can you help us?"
"Sure. €500, plus the time it'll take me to try to fix it. Assuming it can still be fixed and nothing important has been deleted."
"That much?"
Some silence.
"Well, I hope AI takes your job away!" And he hung up.
Believing that autopilot automatically makes you an invulnerable professional pilot will ruin far more people than job losses will.
I don't know if AI will take my job away, but it's already cost them €500 and, probably, their server.
I'm just demonstrating to myself (and the world that):
- SmartOS (so illumos based OSes) can run on an 1 euro per month vps (that's the price I pay, not the current price)
So yes, ZFS loves ram. But doesn't need that much ram to run, especially on illumos
#IT #SysAdmin #Testing #illumos
Ok, looks like this is the week of funny experiences.
Customer: "I had an AI check our server and it says the SSH port is open and that's not very secure."
Me: "Yes, you asked us to open it so you could access the server via SFTP (actually, you wanted FTP, but we discussed it a bit and found this compromise). Don't worry, it's only accessible from your IP and you land in a dedicated FreeBSD jail. From there, you can only access the 'exchange' directory on your server, where you can upload and download files without affecting the application."
(NB: I had suggested a VPN, but they declined because it was too complicated.)
Customer: "Yes, but maybe it's still insecure. Can't we close it?"
Me: "No, unless you want to lose access to that directory."
Customer: "Ok, thanks."
One hour later:
Customer: "Hi, I think we've found a solution. We've just created an app (!!!) with AI that lets us access the files anyway, but more securely than SSH (!!!). Can we install that and close SSH? Oh, and not in the dedicated jail, but directly in the application's jail, because it needs access to the application's files."
Me: "Frankly, I trust SSH in a dedicated jail, restricted by the firewall, a lot more. I don't think this is a good idea."
Customer: "Ok, thanks."
Half an hour later:
Customer: "Ok, now it's secure. I had another AI check it and it found some security issues, but it fixed them all. Can you install it and disable SSH?"
Me: "I strongly advise against it. I can see problems coming."
Customer: "Ok, thanks."
One hour later, my phone rings.
Their internal IT guy (who has access to the machine, which, after all, belongs to them) had given the AI the login credentials to go ahead with the operation.
Except the AI had managed to lock itself out via the firewall, without even starting the app. And now they couldn't get back in.
Fortunately, I had my own access, via VPN, to a separate jail that the AI hadn't touched (or even considered).
Customer: "SORRYSORRYSORRYSORRYSORRY! From now on, we do things your way."
Well, at least it ended well.
PS: The customer knows I'm sharing this story and agreed to it.