System Administration
Week 8, HTTPS & TLS
After discussing HTTP in the previous week and seeing how we used STARTTLS in the context of #SMTP, we are now quickly reviewing HTTPS, TLS, and the WebPKI. While we don't have a video segment for this, here are slides, including this handy diagram illustrating the CSR process:
For many years, I’ve been silent - but I’ve been doing a lot. Some of it I’ve shared, some I will.
One project has already been partially revealed: ITNBlog, my Python-based static site generator that’s been quietly building my blog for a while now. I haven’t (yet) published the code - it’s not exactly beautiful (I’m no coder, and it’s not a daemon, it just spits out HTML) - but there’s some info here: https://itnblog.dragas.net
But there’s another “program” (though calling it that says a lot about my approach 
), which I started back in 2015 for personal use - and I’ve been using it ever since. Over the years, I’ve expanded and reshaped it so much that it’s grown into something big. Big enough that some people might raise an eyebrow at how it’s structured. But it works. And considering everything, it’s efficient enough. Plus, it has a little bonus that I think some of you will appreciate.
I’ve used it for years on macOS and FreeBSD. This morning, I re-tested it on OpenBSD - and it ran flawlessly, thanks to the OS’s rock-solid stability. It also works on Linux, and I plan to try it again on NetBSD - though I’m pretty sure it’ll be fine there too.
I’m considering releasing it before ITNBlog - but I’d like some time to review it properly. Still, I think it’s coming soon… and it might be a curious little surprise 
Stay tuned!
Celebrating 22 years today since @SteveBellovin solved the problem of internet security in one fell swoop with the publication of RFC3514.
A fancy tool to check disk usage! 
(replace df)
- Progress bar
- Shows tabled results
- Colors according to space left
alias dufl = duf --only local
System Administration
Week 8, The Simple Mail Transfer Protocol
Shared by a student of mine: Email vs Capitalism, or, Why We Can't Have Nice Things, a talk given by Dylan Beattie at NDC Oslo 2023. Covers a lot of our materials and adds some additional context.
System Administration
Week 8, The Simple Mail Transfer Protocol, Part III
In this video, we look at ways to combat Spam. In the process, we learn about email headers, the Sender Policy Framework (#SPF), DomainKeys Identified Mail (#DKIM), and Domain-based Message Authentication, Reporting and Conformance (#DMARC). #SMTP doesn't seem quite so simple any more...
Intéressante technique pour l’authentification #SSH basée sur des clés récupérées dynamiquement : https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ #sysadmin
System Administration
Week 8, The Simple Mail Transfer Protocol, Part II
In this video, we observe the incoming mail on our MTA, look at how STARTTLS can help protect information in transit, how MTA-STS can help defeat a MitM performing a STARTTLS-stripping attack, and how DANE can be used to verify the authenticity of the mail server's certificate.
Hey Mastodon, question for my #sysadmin and #DevOps types. Has anyone used #Pester and #PSScriptAnalyzer to set up unit testing for test driven development, particularly on (relatively) simple scripts like you might use for application detection, installation, and uninstallation from a system like #SCCM #Intune or #ManageEngine ?
Apologies for the buzzword bingo, but I’m trying to reach folks who may be following the hashtags, but not necessarily have a connection otherwise.
This is one of those post-migration mornings when you wait for the phone to ring because someone might have had/have a problem, but you hope it doesn't ring because that would mean no one has had any issues. So far, everything is fine. 
Hey #Linux newbs
You're probably spending a lot of time beating your head against stubborn errors that just won't go away, and feeling very down and frustrated about it. Statistically speaking, based on my own experience becoming "expert" at this, you're probably feeling this way a lot of the time, and that is not for no reason.
You're probably also wondering when you no longer will have to spend hours hitting yourself in the head with a hammer. How many years of this intense pain will it require?
Well, I'm here to assure you, it never ends. You never stop having this happen. I just spent an hour fighting a samba share to let me write to the shared drive. I did everything friggin right. It was just like the first time I tried to do this. I even did everything "correctly" this time, created a special user for the credentials, made sure it had group writing access by joining it to my user's group... still, permission denied every time I try to create a file.
So turns out that I added james to the movieUser group, rather than adding the movieUser to the james group. all it needed, an hour ago, was that I put those two words in the correct order in my usermod command.
So basically, as you sit there stewing in anger and befuddlement, let this be the moment that you realize that the developers of this chimera are all apes doing whatever they want, and therefore, it is entirely impossible to become an actual "expert" at this, because whatever you take the time to become expert at will be immediately deprecated and moved on from in favour of some other, equivalent drek with whollly different command structures and conventions.
Or you'll just flip a group/user assignment and spend an hour beating your head against your own idiocy.
Either way, the skill you are actually building up is not technical, but emotional: You are learning to feel this incoherent rage and urge to quit, to let it have its way with you, but to continue working through it and trying new things until it does what you tell it to do, even as you feel this horrific emotional state.
That's it, that's the trick to becoming an elite #sysadmin. You forego movies and sports events with your friends, you forego watching that movie or show, you eliminate all fun and sunshine from your life, and you spend all the time you can get putting yourself into this rage, until you don't notice the rage anymore.
Now you are l33t, and vaguely resemble an angry goblin most of the time. One of us! One of us! One of us!
2.5 Admins 240: 30 DVI Cables
The key differences between throughput and latency – and when they matter, the tech that we’d keep if we stopped working in IT, and avoiding bitrot with rsync backups.
Another round of “hey, your server is down!” drama from the "we need moar kubernetes!" crowd.
“I can’t reach your server, it must be down.”
I connect. Everything’s fine.
A few emails later, I ask to access the container. The dev says he can’t - doesn’t know how. He’s a nice guy, though, so he gives me the credentials.
I log in and find the issue: someone pushed a workload to production (cue Kubernetes! Moooaaarrr powaaaarrr! We have the cloud! Who needs sysadmins anymore?!) with DNS set to 192.168.1.1.
Of course, it fell to me to investigate, because the dev couldn’t even get a shell inside his container. And it's ok, as he's a dev - and just wants to be a dev.
Once I pointed it out, they rebuilt the container with the correct config and - TADA! - everything worked again.
Then he went to check other workloads (for other clients, not managed by me) that had been having issues for weeks... Same problem.
It was DNS.
But it wasn't DNS.
Is there any OSS or FOSS e-mail client, for Linux or Windows that has native ActiveSync support (not EWS)? 
I can't seem to find any, and considering it's been around "for a while", I would have thought there would be some (yes, I'm aware of all the fabulous *DAV variants, thanks).
(I mean, there are plenty of e-mail servers that run on Linux, for example, that has server-side support for it.)
I think the best way to learn linux, is to DO SOMETHING with linux. So here's step one. BUILD A HOME LAB!
In this video I'm taking an old Dell laptop, and turning it into a Linux based Hypervisor. Think that sounds complicated? It doesn't have to be! Check it out here:
Citizen Lab is looking for Systems and Security Administrator
The System and Security Administrator will manage and oversee the use of all information technology in The Citizen Lab; design UNIX and Linux network infrastructure; develop, maintain, and monitor network security policies; ensure all workstations and related components are kept operationally effective and secure; oversee administration and security of on-site and off-site servers, websites and web servers; provide training in computer security tools and practices to staff; and collaborate on IT purchases by providing recommendations, cost estimates and tracking expenses.
See full description and apply here: https://citizenlab.ca/2025/03/job-opportunity-systems-and-security-administrator/
@citizenlab
#citizenlab #job_offer #sysadmin #networkadministrator
#getfedihired #fedijobs
