On my debian server, I have trivy to scan containers and I use clamav to scan files now and again but clamav uses up a lot of ram and its not a mailserver so I’m planning on uninstalling it.

On desktops I use virus total to scan PDFs or small files and stick to foss software

I have something similar . I have WG on the host to access my services and gluetun in a container using openvpn for specific services.

In my case I have the host wg pass through connections to the outside via iptables rules but I’m not forwarding the connection to gluetun. I have the ip of my server as my ip.

In your case as you want a commercial vpn ip as your exit ip you would need to use iptables to pass traffic between the 2 networks .

No issues at the moment but need to update a few containers when I get the chance. I also need to set up contacts sync in radicale for the address book and integrate it with Thunderbird and davdroid.

In the near term I’ve been working on a plan to make sure my keepass db is accessible to my SO and family in the event of my demise. I recently lost a dear friend and had to gain access to his stuff for his family, luckily he didn’t have the linux partition encrypted so I got a recovery shell then remounted the disk and changed the password and could then also mount the windows partition once I logged in.

It made me think as all my stuff is encrypted and there is no way someone would guess it nor crack it so I’m writing documentation and leaving it with family members.

The documentation explains how to use keepass and who to contact for support. Im leaving the db with family members and the password with a select few people that dont have the db. My SO will have access to all the info too.

I’ll update the db periodically and give them a newer version but keep the same password

I encourage you all to consider this too.

Instead you report them

I do the same with adguard home, it works fine and like you say valid https for all services.

Syncthing ?

I’m due a backup and other than that I hope nothing breaks

Sure if you browse by github but in my use of the site over the years I go to the repo from the webpage of the project or from another source such as a link from a blog or something.

13 containers currently. I have thought about adding some more stuff such as bazarr and more but I need to be in the humor for it.

R.I.P

Adguard home

Connect it to your PC or laptop and do a netinstall. Configure SSHD and a static ip. Plugin the disk to your server and then connect via ssh to admin it.

You could also set your laptop or PC to boot from the attached disk in the bios to test the services you want to start are starting

Happy to help 😉

Syncthing can do direct sync if you give the ip address to each node and you can disable relay servers .

Kdeconnect works great too if you are using linux and android

Yeah this is a much better approach

You could just poll it every few minutes via a cronjob and only send a notification if the numbers have increased.

Personally I use miniflux too in docker but I dont have a need for notifications.

Could you just poll the miniflux db directly ?

On laptops yes, on my server no. Most of the data is photo backups and linux ISOs form over the years.

I’m curious to know about the distro maintainers that were running bleeding edge with this exploit present. How do we know the bad actors didn’t compromise their systems in the interim ?

The potential of this would have been catastrophic had it made its way into the stable versions, they could have for example accessed the build server for tor or tails or signal and targeted the build processes . not to mention banks and governments and who knows what else… Scary.

I’m hoping things change and we start looking at improving processes in the whole chain. I’d be interested to see discussions in this area.

I think the fact they targeted this package means that other similar packages will be attacked. A good first step would be identifying those packages used by many projects and with one or very few devs even more so if it has root access. More Devs means chances of scrutiny so they would likely go for packages with one or few devs to improve the odds of success.

I also think there needs to be an audit of every package shipped in the distros. A huge undertaking , perhaps it can be crowdsourced and the big companies FAAGMN etc should heavily step up here and set up a fund for audits .

What do you think could be done to mitigate or prevent this in future ?