0x05 Just work dammit!

So last time I got anonymous FTP access working for both upload and download. Then I disabled it.

Now lets get working on a proper system that is safe enough to leave ‘on’ and that I can access from a random system for uploading and downloading files that need to be transferred.

Sadly, vsftp proved more difficult that it needed to be again. With various flags tripping up my progress every step of the way. I have no doubt that most other ftp servers might have been even more tricky, but vsftp could certainly be more cooperative.

But I got passworded access working for a dedicated username created specifically for this purpose. Downloading works through browsers and upload can be handled even in Windows by using remote folders.

No encryption was implemented however. I could not get this to be accessible from everywhere without needing specialized client programs. No browser, no bash, no windows access. And I need this system to work from any random PC, on any OS, without delay.

So that’s slightly disheartening but not disastrous. But due to the unsafe nature of that system I will need to set up some manner of surveillance later.

I finally got around to write something for this blog too. Publishing some of the delayed posts. About time no?

0x04 Let’s do some cool stuff!

Things are coming along nicely.

We now have a VPS that can only be accessed as a non privileged user, needing a key-file and a very long random-char passphrase.

Now, I’m the kind of guy that wants to be really secure, but then, can I really get mad at someone who successfully beats my security efforts? So I created a banner aimed at the hacker that manages to log in. We’ll see if I get an email some day.

Currently, the VPS is not doing anything. So how about we make it a file server? I would like a fileserver for three specific things:

1. Tightly passworded and encrypted FTP for long term storage.
2. Lightly passworded and preferably encrypted FTP for securely sharing or accessing files from a random machine. Preferably from a browser and without needing any special software.
3. Public, browser accessible, download-only FTP

Sadly. My VPS does not have much storage space so big long term storage is no-go.

The first it turns out comes along with SSH for free! So that was already set up and ready.

The second will have to wait for now…

The third then. When looking around I find a lot of recommendations for vsftp for being easy to set up and secure enough for when you “must use FTP”.

It’s old…

Installing was easy. But configuring it was actually harder than it needed to be. Many flags depend on others being switched on, or were modified greatly by others, so a lot of time was wasted chasing trivial problems.

I spent a few hours getting this working without a password. Then I disabled it. I may turn it on at some point in the future, but for now I do not need it and it would be unwise to leave such access unattended.

But it is there. And if I ever want to publicaly share a file with everyone, no strings attached, then i just need to switch it back on!

0x03 What’s in the name?

Just a lot of VPS stuff today.

I added a local user and gave it sudo rights, created SSH keys, some super hard passwords and phrases, and hardened the SSH server so that no one will be breaking in there in the next ten million years.

Safety first!

The thought crossed my mind that if I get locked out, I would not be able to control my own server besides the on-off switch and would be forced to re-install.

Well… I better not get locked out then! So redundant keys and user accounts will be in order.

But I hear you ask, what’s up with Akiha above?

Well… Let’s just say that she’s my personal equivalent of Tux from now on.

0x02 Rise from your grave!

Let’s unleash the beast!

Not much to say. I set up a new WordPress site.

It’s not the first time, but this time I’m actually doing something with it!

I found the neat theme you see on the front page. Will get to replacing the dummy content eventually. I just have to create some actual content of my own to put in its stead.

Also configured and deployed my VPS. Nothing on there yet tho.

0x01 Wake up and smell the ashes

So where does one even start with re-inventing a system that has been built up incrementally over a period of fifteen or so years?

You need to register for new services. But for that you already need an email address. You could try to set up your own email from home but then you need a domain, which requires an email address…

Catch22. However you slice it you need that email address first…

So how about protonmail huh?

Fully encrypted mailbox where not even the service provider knows the key. That should serve as a good basis for getting started.

Of course I run it with double passwords! You might think I’m being paranoid but I just don’t want to be sorry.

Ok, so we have an email address. How about getting some domains and some systems running.

Since I happen to work at a hosting company, I can get some nice staff discounts as well as perfect transparency for their services. A DNS, a web-server, a linux VPS and two domain names should suffice for now.

0x00 Hello world!

This post marks the start of my new, self-managed IT environment!

What you see here is but the public ‘tip of the iceberg’. Merely an amateurs attempt at making a cool looking page using WordPress. What you don’t see in the background are the new servers, email, file hosting and more that is in the works.

The first goal of this project is to migrate from my current configuration to one that is entirely managed by myself or at least transparent.

Why would I do this? Well, what if a hacker obtained the password to my current email? What would that person be able to see and do? When I started working at a hosting company, I realized just how dependent I am on services over which I have very little control, and just how easy it would be to hijack my accounts or to gain access to the data within them just by using a little bit social engineering or legal pressure. I realized just how vulnerable I am.

“I realized just how vulnerable I am.” -Felix 2017

So, in a continuing effort to learn everything there is to know about IT, and to have 100% supervision over “my stuff”, I decided to start managing my own domains and everything connected to them. Wherever I am not hosting it myself I either have a great deal of supervision, or a great deal of confidence that the service provider is unable to screw me over even if they tried to (Let alone accidentally).