Posts

Introduction WireGuard released their official iOS app today, and I wasted no time jumping on setting up a WireGuard server at home (based mostly on this guide). This is not going to be a tutorial, but instead, I’m going to talk about why WireGuard is a game-changer. OpenVPN drawbacks For years, I’ve used OpenVPN to connect back to my home network. Don’t get me wrong, OpenVPN is great, especially compared to dated, insecure alternatives like PPTP or L2TP/IPSec. But, for all its merits, OpenVPN has some drawbacks: ...

Introduction In March of 2018, Let’s Encrypt (the free Certificate Authority) announced they added support for wildcard certificates through the upgraded ACMEv2 protocol. I’ve been hosting most of my services on subdirectories (e.g., loganmarchione.com/rss) but have been wanting to move them to subdomains (e.g., rss.loganmarchione.com), and thought this was the perfect chance to do just that. What are wildcard certificates? Wildcard certificates cover any subdomain of a specific domain. For example, I own loganmarchione.com. Because of this, I can create services as subdomains of that domain. For example: ...

Introduction In my last post, I talked about setting up an ODROID-HC2 as a NAS using OpenMediaVault. I have that up and running, and I’ve also written a few scripts to backup my data to a few of the SMB shares. Now, I need to get that data shipped offsite to an external location to cover my 3-2-1 backup strategy: 3 backups 2 different types of media 1 backup offsite Software My cloud storage provider of choice is B2. I’ve written about them in the past and have generally had good luck with them, so I’d like to keep using them. ...

Introduction I’ve been doing some work on my homelab that I haven’t documented here. I recently decommissioned my Raspberry Pi 3 that was running my Unifi controller, Dokuwiki, and Network UPS Tools (NUT). I replaced the RPi3 with an Intel i3 NUC with 12GB RAM and a Crucial 2.5" SSD. I chose to use Proxmox as the hypervisor on the NUC because it is open source, has a well-proven record, and has a low learning curve. At the time of this writing, I’m running five KVM virtual machines: ...

Winners An update: Comments are locked as-of 12:05pm Eastern time. I received 363 comments, but 4 were mine, so 359 comments gives you a 1-in-359 chance of winning (.27%). Congrats to the two winners, Dan and Michael! I’ll be emailing you shortly! -Logan Introduction Since 2014, I’ve been blogging about security, open source, Linux, and routers. Since then, I’ve hit the 1000 comment mark (although technically, some comments are my own replies to your comments). To thank my readers, I’m giving away two Raspberry Pi 3 Complete Starter Kit (32 GB Edition) by CanaKit. ...

Hey! Listen! This post is part of a series on the Ubiquiti EdgeRouter Lite. Check them all out! Date URL Part 2019-06-28 Migrating away from the Ubiquiti EdgeRouter Lite Migrated to a Netgate SG-1100 2019-02-03 EdgeRouter CNAME records Setup CNAME records 2017-10-03 Dyn DDNS on EdgeRouter Setup DynDNS 2017-04-25 DuckDNS on EdgeRouter Setup DuckDNS 2017-01-08 Ubiquiti EdgeRouter serial console settings Serial console settings 2016-11-29 Ubiquiti UniFi controller setup on Raspberry Pi 3 Install UniFi Controller 2016-08-30 EdgeRouter Lite Dnsmasq setup Setup dnsmasq 2016-06-13 EdgeRouter Lite software upgrade Firmware upgrade 2016-05-12 EdgeRouter Lite OpenVPN setup OpenVPN server setup 2016-04-29 Ubiquiti EdgeRouter Lite setup Initial setup Introduction In the past, I’ve posted about my DuckDNS dynamic DNS settings, and mentioned I use Dyn as well. My Dyn setup is documented below. ...

Introduction While creating CAA records, I found myself needing a new DNS provider. During that process, I thought it would be a good idea to document what it take to host a website and how the internet works (in a very limited sense). To host a website on the public internet, you need three things: domain name DNS record(s) web host Typically, most domain registrars offer basic DNS support. In addition, most web hosts also offer basic DNS support. However, you can (and probably should) have these three services hosted at three separate companies (you don’t want all your eggs in one basket). ...

Introduction Certification Authority Authorization (CAA) is a new DNS record specifying which Certificate Authorities (CAs) are allowed to issue certificates for a domain. Introduced by RFC 6844, CAA protects websites by only allowing certificates to be issued by specific CAs. If an attacker were to take over a website, they would only be able to obtain a certificate from a CA specified in DNS CAA records, limiting the damage they could do. While CAA records aren’t going to completely stop certificate misuse, they are easy to implement and are part of a larger security plan. ...

Introduction Recently, I’ve been thinking more and more about backups for my small (but growing) homelab. The golden rule is to follow the 3-2-1 method for backups: 3 backups 2 different types of media 1 backup offsite Current setup Currently, I keep an encrypted external HDD at home and another at work. Every couple weeks, I perform a backup to both and rotate the drives (this covers a 2-1-1 backup). ...

Hey! Listen! This post is part of a series on the Ubiquiti EdgeRouter Lite. Check them all out! Date URL Part 2019-06-28 Migrating away from the Ubiquiti EdgeRouter Lite Migrated to a Netgate SG-1100 2019-02-03 EdgeRouter CNAME records Setup CNAME records 2017-10-03 Dyn DDNS on EdgeRouter Setup DynDNS 2017-04-25 DuckDNS on EdgeRouter Setup DuckDNS 2017-01-08 Ubiquiti EdgeRouter serial console settings Serial console settings 2016-11-29 Ubiquiti UniFi controller setup on Raspberry Pi 3 Install UniFi Controller 2016-08-30 EdgeRouter Lite Dnsmasq setup Setup dnsmasq 2016-06-13 EdgeRouter Lite software upgrade Firmware upgrade 2016-05-12 EdgeRouter Lite OpenVPN setup OpenVPN server setup 2016-04-29 Ubiquiti EdgeRouter Lite setup Initial setup Introduction I’ve been using Dyn for my dynamic DNS for years. However, after the 2016 Dyn DDoS, I’ve decided to add a second dynamic DNS service provider, in case Dyn goes down again. ...