New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Talk about coincidence! Just when I decided to stop and mask
qemu-guest-agentcompletely on all my VPS, this forum post appears out of nowhere. What perfect timing! Really appreciate the guide, this is exactly the kind of information I was looking for.Thanks for posting this. I just updated my Ansible playbooks. I look forward to your next installment
Feel free to reach out if Houston, Texas is an option for you. Happy to help! dartnode.com/colocation/houston
let me just stop you right there
Hmm? It's a good vessel, right?
get your own identity, mines being used
BEANSUMMERHOST NEXTGEN SHED HOSTING SOLUTIONS LLCAS is realTor and Freedom of speech in general is not allowed on AS206540 - https://as206540.beanman.net/
What about non-free speech in general on your "No Speech Hosting".
Yes we are the worlds first no-speech host, if you can commit to not making any form of speech on our network we may be able to make an arrangement
Speaking of which... I currently have two hosts that I can run tcpdump on and see other tenants' DNS responses and HTTP responses (at about 50 Mbps total), one of which claims to be ISO 27001 certified.
ISO is just guidance... Oh no, you relapsed
On LiteServer I didn’t have to do anything to accomplish this, it was the default and also counted towards my bw quota😂
Please don’t
Maybe then you should set-up a small one for Tor nodes vps only or similar? With first, priority seats for the LET most active users, to not bring too much headache?
Personally am learning by doing, no programming or server background.
Although I would not qualify, i would love to tag along for the learning experience while renting vps/helping tor community along the way
Why not? I've done similar at my work. Only difference is there are no MJJs there (and unlike a hosting project, I expect to make money at work, not lose it!).
Yeah, that was my thought. Maybe even invite-only. Just something to let people play around with.
But again, no specific plans.
*heavy breathing*
Lovely, let's ♟
If you want to test the real merits of this approach you cannot pre select your "customers," you must let it loose in the wild and see how it performs. You need real adversaries.
Very useful post by the way, your karma just got a bump
👍
@VirtFusion maybe you can implement these on VF if not already.
You're always one step ahead, but mentioning you anyway haha.
Meh, I was expecting to be greeted by an emulated SSH interface at shellbox.dev but got a mere SSH themed website instead. What a disappointment!
You can though
ssh shellbox.dev help --jsonThat's a data dump not an interface. They could build an SSH terminal interface for this.
My bad, remove the
--jsonflagGreat, that's what I was expecting. The website is just a glorified manual page for the terminal interface, even better than what I expected.
Thanks!
👍
When tutorial for traffic sniffing? You doing simple tcpdump, right?
A valuable contribution to the community
It's August 2026. People who care can now quickly build a minimal guest agent in Rust that only implements this minimal set of commands, so that you have no chance to shoot yourself in the foot by f*cking up the configuration.
One way to trade performance for more security is to use nested FDE with 2 or more vendors, so that vendors have to collude to decrypt your disks at rest.
It's important to avoid Intel TDX at all cost, as it's broken beyond mitigations. AMD SEV-SNP on Turin (Zen5 or later) with external HSM signers is still OK if you know what you're doing.
Cloud-init could allow host to run any commands inside the guest. If you already use TEEs, you should use UKIs anyway without the possibility of host controlled cloud-init. You can still do secure cloud-init with your own cloud-init servers if you know what're doing.
I was doing
tcpdump -nqi ens3 -Q in "not ip dst $myip and not multicast and not arp". It doesn't sniff relay traffic, it just displays unknown-unicast traffic and leaking L2 management plane traffic.No way! The only way to do that is by vibe-coding it, and it's because of vibe-coding that Rust projects are now often some of the most insecure, despite the language itself being memory safe. It's much better to use the official agent and use its official filtering facility.
Are we talking about open source or closed source FDE? I was thinking LUKS, which uses dm-crypt under the hood. It can't decrypt your disk without you giving it the key.
Yup, but at least Cloudinit is often only present on templates. QEMU Guest Agent, on the other hand, auto-installs even if you install from ISO manually. But yes, Cloudinit is another problem that I'll write about later.
I have August there for a reason. Ask Fable 5 (high to do the coding and xhigh to do the review) to do the work and report back
Host can easily dump guest memory and use
findaesto get your DEKs directly without using LUKS passphrases. They only need to do that once and then decrypt the disks offline at their leisure. Nested LUKS would require coordinated effort from different vendors, assuming the correct setup.Not if you use the official (non-cloud-init) version of the iso or install from netboot. The guest agent is not installed by default, e.g., ubuntu server minimal iso.