11–20 of 56 posts
Btw, some versions of raspberry pi already have hardware random number number generator accessible at /dev/hwrng.
This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…
I'm running smallstep CA in my homelab. While it's nicely done and clearly focuses to the containerized enterprise market, its defaults are very harsh. Take for example the maximum certificate duration. While from a production/security perspective short-lived certificates are great, you don't want to renew certs in your homelab every 24-48hrs. Also, many things just don't support ACME but still benefit from a valid c…
As for the "hours" max interval, this is the result of a design decision in Go's time duration library, dealing with the quirks of our calendaring system.
[0] - https://developers.yubico.com/PGP/YubiKey_5.2.3_Enhancements...
This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…
I continue to find it a bit silly to see "with a raspberry pi" when people just mean "with any random linux box that doesn't need to be very powerful".
It's like listening to NPR, where every smartphone is an iPhone even if it's an Android, you know?
This is littered with so many missteps I don't know where to start. -Complete overkill requiring the use of a YubiKey for key storage and external RNG source - what problems does this solve? For a Yubikey to act as a poor man's HSM you have to store the PIN in plaintext on the disk. So if the device is compromised, they can just issue their own certs. If it's to protect against physical theft of the keys, they'll jus…
> Why do you need ACME in a homelab and can't just hand issue long lived certificates? If there is one thing I hate it is hand issuing certificates. Even for a homelab. SSL just plain sucks and OpenSSLs incantation and especially config files make an already bad problem even worse.
Those people are extremely likely to be using ACME in the wild.
Running it in your homelab makes a lot of sense to me.
Am I missing something, or wouldn't it be better to start with highly random raw data, and hash that to get more bits-per-second?