Linux on Andreas Happe

Homeserver: Glances and Home Assistant for Monitoring

Wed, 30 Apr 2025 00:00:00 +0000

Now that I have a minimal home server running, I thought it would be good idea to monitor temperature, disk usage and such. The simplest solution that I found was to use Glances and use Home Assistant to store and display the data.

Homeserver: Creating local Proton Drive/Mail Backups

Sun, 27 Apr 2025 00:00:00 +0000

By now, I am using Proton Drive for cloud data storage and Proton Mail as my primary mail service. While I trust Proton with my data, I do not want to rely on them completely. As I have a small server standing around at home, it’s kinda obvious to use it for automatically performing backups of my cloud data.

I try to use systemd services and timers for this, as this makes monitoring and logging quite easy.

This blog post mostly serves as a reminder for me, but maybe it helps someone else as well.

Homeserver: Services Pt. 1

Wed, 09 Apr 2025 00:00:00 +0000

I am running a home server for a while now. I have been using it to host some services that I use regularly. In this post, I will share my experience with some of the services I have set up on my home server.

This initial post will go over local git hosting using gitea, audiobook streaming using audiobookshelf and a self-hosted RSS reader using tt-rss.

Using tailscale on Fedora Silverblue

Mon, 07 Apr 2025 00:00:00 +0000

I am using Fedora Silverblue as one of my main desktops. Recently, I’ve been moving some services to a server behind tailscale but was still using its local IP address when at home at my Silverblue desktop. While doable, using an IP-address with an invalid HTTPS certificate wasn’t that pretty — so why not just access it through tailscale even within the same network, it’s an overlay network overall (so it should do a direct connection between my desktop and the home-server).

Building a little home-server with Linux, TailScale, ProtonVPN, Docker Compose and VM support

Sat, 05 Apr 2025 00:00:00 +0000

I’ve been using a mini-computer as home-server for the last couple of years. Originally, I used it to share files between my computers, but over time more and more services (like RSS-readers, media-libraries, home automation, etc.) were moved on that surprisingly capable mini-server.

I’ve grown up using Linux (well, I was already 16 when Linux became available around here, but you get the gist) so it always felt natural to me to just just use a minimal Linux installation (debian) instead of using some NAS that supports add-on third-party software.

Building a 4G/LTE router+accesspoint using hostapd, network-manager and modemmanager

Fri, 11 Feb 2022 00:00:00 +0000

So I’ve been using a Raspberry Pi 4b+ together with a WaveShare LTE Modem as 4G router/access-point for my home network setup. I do like my hardware to be quiet and thus fan-less, alas the Raspberry Pi 4b+ gets a tad on the warm side. So this was a perfect opportunitiy to play around with an older Raspberry Pi 3b+ which should use approx. 20-25% less power (both, during idle and load) and with “new” software.

Create a new Ubuntu 20.10 Desktop without too much Ubuntiness.

Tue, 13 Oct 2020 00:00:00 +0000

After I’ve bought a new and fast 1TB SSD, it’s time to setup my aging Desktop again. Last time I went with Fedora Core, this time I will try to reduce some of the ubuntu-iness of a Ubuntu 20.10 Desktop for that. After preliminary tests Ubuntu seems to be more resource efficient than Fedora Silverblue and I should be able to remove most of Ubuntu’s problematic packages. Given that my Notebook still runs Fedora Core, I’m also keeping in touch with both the Ubuntu/Debian as well as with the Redhat/Fedora world through that.

Amazing (Physical) Access Control with HID RFID cards

Fri, 04 Jan 2019 00:00:00 +0000

So my company moved to a new building which uses HID RFID cards for access control. These cards are typically white with some sort of numeric code printed on one side of them. I have not included an image of my card due to (later) obvious reasons..

Setting up my Proxmark3 RDV4 reader

Some time ago I joined the Kickstarter for an updated version of the Proxmark3 RFID reader/writer and immediately broke it during the initial flash update. After I was able to unbreak the reader (hint: kill network-manager and modem-manager before trying to flash the new image) this seems to be a good time to test those pesky access cards. Also a huge Thank you! to the Proxmark support team for helping me.

Revising my lazy http/https interception setup

Fri, 23 Nov 2018 00:00:00 +0000

Lazily creating an HTTP/HTTPS interception proxy with network-manager and mitmproxy

Fun Hacking Stuff ahead

Tue, 23 Oct 2018 00:00:00 +0000

Recently I’ve found an old post-it with guidelines I wrote myself a couple of years back, two of those stood out:

make mistakes
don’t buy stupid stuff

Seems like I haven’t been the most consistent person back then. The post-it got discovered during a clean-up session of my flat, the same session brought up the following stupidly-bought-and-never-used gadgets:

one BBC micro:bit that should be able to capture Bluetooth Low Energy transmissions
one Proxmark 3 RV4 that should be able to do some nifty RFID stuff (and that I was recently able to fix)
one Realtek Software-Defined Radio USB Stick (rtl-sdr)..

My new year’s resolution (or rather near-future resolution) is to do /something/ hackery with that stuff. Suggestions more than welcome.

GnuPG/PGP and Evolution/Seahorse Private Key Woes

Thu, 01 Dec 2016 00:00:00 +0000

I have a quite simple setup: Fedora 23 on my Desktop, Ubuntu 16.04 on my Notebook and a YubiKey thrown into the mix.

I do have my normal GnuPG key DD436203 that I’m using. There’s also an old and revoked key 3F5D00B6 with which I was testing my YubiKey with (note to myself: don’t use an YubiKey-crested private key as you cannot backup it). My main key offers an ElGamal 2048bit subkey – which does not work with the Yubikey (as that only supports 2048bit RSA). So I ’ve added a new subkey on my laptop.

How (NOT) to hide OpenVPN behind HTTPS/SSL

Thu, 01 Dec 2016 00:00:00 +0000

Update 2017: Sadly I found out (thanks due to the comments on this blog post) that using port-share does not encapsulates subsequent traffic in normal TLS. So using this method will not fool Deep-Package Inspection Firewalls. If you need to mask all your traffic, this is not an option – you might need to investigate stunnel, information can be found here, here or here. I assume, that the higher success rate of this method could be related to some firewalls checking the target of the initial https request. This would yield a normal website with this setup and might be enough to fool some websites.

Firejail: Chroot on Speed

Thu, 25 Feb 2016 00:00:00 +0000

Firejail describes itself as a SUID program that reduces the risk of security breaches by restricing the running environment of running programs. We’ll just call it chroot or jail (for the BSDers out there).

So, it’s SUID?

First things first: it’s SUID, so if there’s an error within the firejail binary an attacker can gain root rights. This comes with the territory. How large is Firejail and how many dependencies does it have? It’s written in C and:

pathogen vs vundle

Wed, 18 Feb 2015 00:00:00 +0000

Pathogen was the first vim plugin management system that I’ve known of. The contender is Vundle which seems to be inspired in it’s configuration syntax (and name) by Ruby’s Bundler.

So let’s compare those two.

Pathogen

Pathogen’s workings are quite easy to grasp: each plugin is a directory within “~/.vim/bundle/”; pathogen traverses through the plugin list and includes each one of them. Let’s see a sample directory:

[~/.vim]$ ls -l bundle/
drwxr-xr-x  5 andy andy 4096 Sep  8 22:20 ag
drwxr-xr-x  5 andy andy 4096 Sep  8 22:20 ctrlp.vim
drwxr-xr-x  7 andy andy 4096 Sep  8 22:22 syntastic
drwxr-xr-x 13 andy andy 4096 Sep  8 22:23 ultisnips
drwxr-xr-x  7 andy andy 4096 Sep  8 22:26 vim-airline
...

It gets really powerful when you store you ~/.vim directory within a git repository and share it between multiple computers. If you use git submodules for each plugin you even get versioned plugins for free.

Capybara for automating Pen-Tests

Tue, 09 Sep 2014 00:00:00 +0000

After a successful penetration test a re-test is performed. The common approach is that the customer fixes the code and I perform the necessary steps to confirm that that initial security breach was closed. Sometimes it takes the customer a couple of tries to achieve that.

Most security problems (XSS, CSRF, SQLi) can easily be automated tested, but I had problems automating server-side authentication and authorization problems. The test would have to emulate multiple parallel user sessions. The tests mostly consists of one session trying to access the resources of another user session.

Migrating to Middleman

Tue, 09 Sep 2014 00:00:00 +0000

My blog has a history of migrations. It started as wordpress, then was converted Octopress. After Octopress was missing update-love and jekyll started to be actively maintained again it switched over to jekyll. And now, it finally is based upon Middleman.

Sorry for any inconvinient bugs or layout errors that will happen during the migration.

Why have I switched to middleman?

as I’m a RoR devleoper it seems better suited for me. Jekyll always seemed to be the choice for “web designer that need to add some dynamic content” while middleman seems to incorporate the “web developer that needs some blog”-attitude
nice integration with bundler
existing plugins for deployment. This replaced a lot of custom cruft that I had to initially write for myself when I was using jekyll

While in there I’ve switched from bootstrap to bourbon/neat/bitters. Let’s see how this works out. Wouldn’t mind the framework to be called Islay though.

Using a (host) reverse-proxy together with LXC application servers

Fri, 25 Apr 2014 00:00:00 +0000

How to combine an reverse proxy (nginx) running on the host with virtualized aplication workers

How to convert an KVM image into a LXC container

Mon, 07 Apr 2014 00:00:00 +0000

How to use convert an KVM image into a LXC container

How to use virt-install to install new virtual machines within libvirt/kvm

Sat, 22 Mar 2014 00:00:00 +0000

How to use virt-install to install new virtual machines within libvirt/kvm

Rogue Access Point and SSL Man-in-the-Middle the easy way

Thu, 20 Mar 2014 00:00:00 +0000

How to setup an rogue access point and do ssl interception using KDE and BURP

How-to setup a rogue access point with a transparent HTTP(s) proxy

Mon, 24 Feb 2014 00:00:00 +0000

How to setup a rogue access point with a transparent HTTP(s) proxy

How to use FakeS3 for S3 testing

Tue, 24 Dec 2013 00:00:00 +0000

How to setup the Fake S3 gem to create a local fake S3 server (for testing purposes)

Linux: How to force an application to use a given VPN tunnel

Sun, 20 Oct 2013 00:00:00 +0000

wicked_pdf allows generating PDFs from ruby on rails, for free!

Git with transparent encryption

Thu, 10 Oct 2013 00:00:00 +0000

Using encryption to make git handle un-trusted remote storage server

Secure Online Data Backup using Duplicity

Thu, 27 Jun 2013 00:00:00 +0000

Encrypted incremental backup to clouds/ssh hosts using duplicity

Avoiding Internet/Network Surveillance

Mon, 10 Dec 2012 00:00:00 +0000

How to encrypt most of your communication data on the internet

Linux: How to encrypt your data on hard drives, USB sticks, etc.

Sun, 02 Dec 2012 00:00:00 +0000

How to transparently encrypt hard drives/USB sticks/etc.

Linux: How to forward port 3000 to port 80

Sun, 18 Nov 2012 00:00:00 +0000

Howto forward port 3000 to port 80 under Linux.

Postgres: Howto change owner for all tables

Sun, 11 Nov 2012 00:00:00 +0000

Howto change owner of all tables of a database (in postgresql)

Moving OctoPress to Amazon S3 and CloudFront

Sat, 03 Nov 2012 00:00:00 +0000

Moving OctoPress to Amazon S3 is easy, but how's the performance?

A full-powered shoebox-sized Desktop

Sun, 28 Oct 2012 00:00:00 +0000

Building a mini-ITX high-performance desktop that would fit into a shoebox