csamsel

# set community name, change for maximum security
[root@oxygen-vmhost:~] esxcli system snmp set --communities public
# activate snmp
[root@oxygen-vmhost:~] esxcli system snmp set --enable true
# firewall policy defaults to deny
[root@oxygen-vmhost:~] esxcli network firewall ruleset set --ruleset-id snmp --allowed-all false
# allow specific ip range
[root@oxygen-vmhost:~] esxcli network firewall ruleset allowedip add --ruleset-id snmp --ip-address 192.168.2.0/24
# activate firewall rule set
[root@oxygen-vmhost:~] esxcli network firewall ruleset set --ruleset-id snmp --enabled true

csamsel

# parted /dev/sda
GNU Parted 3.2
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) rm 3
(parted) p
Model: VMware Virtual disk (scsi)
Disk /dev/sda: 32.2GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

csamsel

listen_addresses = ['127.0.0.1:5300']
...
dnscrypt_servers = false
doh_servers = true
...
cache = false

...

server_names = ['cloudflare', 'cloudflare-ipv6']

csamsel

server=127.0.0.1#5300
no-resolv
no-poll
dnssec
dnssec-check-unsigned
conf-file=/usr/share/dnsmasq/trust-anchors.conf
domain-needed
expand-hosts
no-negcache
local-ttl=600

csamsel

Keybase proof

I hereby claim:

• I am csamsel on github.
• I am csamsel (https://keybase.io/csamsel) on keybase.
• I have a public key ASDHrm4CEkXQuramKWPKoiKtLQ3uQwSVlMwUW54NSAGNCwo

To claim this, I am signing this object:

csamsel

for i in sdb sdc sdd sde
do
  # activate TLER
  smartctl -q errorsonly -l scterc,70,70 /dev/$i
  # disable NCQ
  echo 1 > /sys/block/$i/device/queue_depth
done

csamsel

assumptions:
/dev/sd[bcde]1 in Linux md (/dev/md0) RAID5/RAID6 mounted as /storage.
Less space used then capacity of one drive.

1.
stop all services accessing the array first.
Remounting the array ro might be a good idea (mount /dev/md0 -o remount,ro).

2.
remove one disk from array

csamsel

openssl rsa -outform der -in privkey.pem -out privkey.key
openssl x509 -outform der -in fullchain.pem -out fullchain.crt
openssl x509 -outform der -in cert.pem -out cert.crt

csamsel

certbot certonly --manual --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory -d *.domain.tld

csamsel

find -L /etc/runlevels -type l -delete