首页 » 标签："服务器"

海光KVM虚拟化兼容性实测

2025-03-31 作者： Fisherworks

两台浪潮海光，CS5620H2和CS5820H2，前者装两片海光5380，后者单片海光7390。做完KVM虚拟化后，实测vm兼容性（cpu设为host）情况如下，供参考。

CentOS 7启动完成后随机崩溃，journal说这cpu哥们没支持过。精神续作Rocky Linux 8启动过程中崩溃。Rocky 9可以正常工作，只是journal说这硬件Unmaintained，说白了就是责任自负。Rocky9 stress一直表现正常。
Debian 11和12都没啥，只是journal里说这是hygon就继续工作了，stress表现正常。11上我用incus容器带了wine，进容器后用wine运行一个win x86 cli app也正常。
Ubuntu用的不多，下载一个22.04 qcow2走cloud init启动一下，跟Debian表现基本一致，就不继续stress了。
openEuler 22.03也一切正常，stress表现正常。
Arch没有细测，手头有个2022的qcow2，cloud init起来后pacman能运行，就没有继续，毕竟能拿Arch做生产环境服务的应该不是主流…吧。
Win7启动就蓝屏（报错5D），Win10启动正常，因为日常工作完全不用win，所以没有继续测。

PVE web portal hardening

2025-01-09 作者： Fisherworks

本文：配置fail2ban实现PVE web登录入口的暴破防护。

On a Proxmox VE host accessible to the public internet, using fail2ban to protect SSH away from malicious traffic is fairly common, but what about the web management portal?

I’ve got a blog post talking about that, which seems promising. However it’s already version 8.x, I’m learning something about journald, and so far it’s good to me – I don’t want reinstall the rsyslog just for this, then how can I get it work? Let’s find out.

WHAT HAPPENED

Daily routine, check the system journal with something like journalctl --since='yesterday' .

Jan 09 16:29:23 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:29:26 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:31:33 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:31:35 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:33:44 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:33:45 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:35:54 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:35:56 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:38:04 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:38:05 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:40:14 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:40:16 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:42:25 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:42:27 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:44:35 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:44:37 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:46:46 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:46:48 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:48:56 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:48:58 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:29:23 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:29:26 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:31:33 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:31:35 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:33:44 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:33:45 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:35:54 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:35:56 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:38:04 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:38:05 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:40:14 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:40:16 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:42:25 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:42:27 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:44:35 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:44:37 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:46:46 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:46:48 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:48:56 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:48:58 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

CUSTOMIZED CONF FOR FAIL2BAN

The filter rule of /etc/fail2ban/filter.d/pvedaemon.conf .

[DEFAULT]
_daemon = pvedaemon

[Definition]
failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*
ignoreregex =
journalmatch = _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon

[DEFAULT]

_daemon = pvedaemon

[Definition]

failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*

ignoreregex =

journalmatch = _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon

Then enable the jail in /etc/fail2ban/jail.local .

#... below the sshd conf, add this for pve daemon
[pvedaemon]
enabled = true
port = https,http,8006
filter = pvedaemon
backend = systemd

#... others

#... below the sshd conf, add this for pve daemon

[pvedaemon]

enabled = true

port = https,http,8006

filter = pvedaemon

backend = systemd

#... others

CHECK THE RESULT

Restart the fail2ban service, here it goes.

$ fail2ban-client status pvedaemon
Status for the jail: pvedaemon
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	2
|  `- Journal matches:	_SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	162.19.61.xxx

$ fail2ban-client status pvedaemon

Status for the jail: pvedaemon

|- Filter

| |- Currently failed: 0

| |- Total failed: 2

| `- Journal matches: _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon

`- Actions

|- Currently banned: 1

|- Total banned: 1

`- Banned IP list: 162.19.61.xxx

Then we can also check the iptables -nvL and fail2ban.log for some more detail – try it by yourself, could be interesting.

References: 1 2

完整阅读本篇»

Pi 5b运行Proxmox VE

2024-12-09 作者： Fisherworks

使用Proxmox-Port，成功在Pi 5b上搞起PVE。

其上又装了个Arch、Rocky9和WoA（Windows on Arm），把host和三个vm都塞进一张32G tf卡，加之WoA的一些特定配置，过程是崎岖了一点，但结果还是显而易见的 —— 这一天还是来了，PVE on aarch64。

Arm Linux KVM再带Linux vm是蛮有实际意义的，家里已经用了两年多了（外加incus容器），只不过那块RK3399没搞pve，用的是更传统的libvirt。

pi 5b走kvm虚拟化运行arch和win两台vm

得益于树莓派5b不错的性能，简单操作一下WoA，体验上也不再是行为艺术。至于WoA本身是不是行为艺术，只能说高通的X Elite明显还是拖不动微软的意兴阑珊，不由得让人想起当年Nokia、木马哥和Win Phone的那场爱恨情仇。

完整阅读本篇»

Linux桌面有望日常办公？

2024-05-23 作者： Fisherworks

嗯，别的不说了，原生wechat（读文、图片视频传输、小程序）已经完全可用，视频也没问题。

linux原生版wechat，AUR-bwrap

飞书通过flatpak装的，音视频共享桌面OK；腾讯会议叫wemeet，初步测试共享桌面也是正常工作。WPS的话，也是用的AUR来的一个版本，除了粗体显示问题需要一些技术解决外，编辑文档流畅可用。

原生版Kingsoft WPS和飞书lark

基于Wine（flatpak+PlayOnLinux）的Win32 Office 2010和Photoshop CS6，为了中文显示着实费了点劲（字体和注册表），如果只是英文版的话简直不要太容易。

Win32版Office 2010和Photoshop CS6

走flatpak安装的kdenlive，第一次用，操作上不大习惯，但查一下资料还是能慢慢用起来。

PS：虽然flatpak的沙盒机制带上kde导致顶栏跟gnome不大一致，但这个沙盒封装了依赖感觉也不错的说，并且flatpak还能重设语言（与Arch不一致）。

通过flatpak安装Kdenlive

完整阅读本篇»

orange pi zero3功耗测试

2024-05-04 作者： Fisherworks

友提：玩具随意，商用慎重。

自从特殊时期的缺芯影响，如雨后春笋般萌发的国pi，周边生态肉眼可见的好起来；虽然差距依然明显，但显见差距逐步缩小，这里边主要有以下几个因素的助力：

第三方OS如Armbian、DietPi等，对瑞芯微、全志乃至不少RISC-V主控的支持和持续维护。
树莓派自己的新产品定位倾向，更加注重性能而非性价比，目标桌面应用而非嵌入式应用。
Intel对市场格局的认识，暂停挤牙膏，迅速推出全E核的N系列cpu，功耗控制优异，性价比同样不俗。
产业链受国际形势的影响，大家在新产品硬件选型时，不免要考虑在内。

入手一片香橙派zero3 2GB版，4核A53 1.51GHz，纯看参数的应该介于树莓派3b和4b之间。

普遍情况下，相比性能，我测硬件往往在意可靠性。所以别的不扯，先跑一周压测吧。

只是，鉴于嵌入式硬件基本都是flash存储，所以硬盘（tf或emmc）就不压了，除非专门测试存储介质寿命，否则多压几天就不剩啥了。

完整阅读本篇»

RK3566流畅运行X64 win应用？

2024-04-05 作者： Fisherworks

Well, Windows x64 binaries now mostly seem to be working well on Wine (x64, Dynarec for ARM64) on Incus/LXC containers on Armbian aarch64 on an ARM SBC like RasPi or its counterparts with Rockchip RK3xxx series processors.

Btw, let’s celebrate the 1st LTS release of Incus, version 6.0.

在Linux平台使用wine运行win32程序？

Wine项目距今30多年历史了，完全不稀奇。

如果是跑在Linux arm64/aarch64上呢？

也还好……纯软件转译x86指令集，应该跑的像幻灯片吧？之前你不是KVM装过一次Win7 x64，玩成了行为艺术咩？

如果是一张价钱不足100块的RK3566 sbc，先跑Armbian，其上跑incus（lxc）容器，再跑Wine x64，最后运行Win64程序，然后我说除了启动慢点儿（毕竟emmc就那点io），运行还蛮流畅，您怎么想？

完整阅读本篇»

海光KVM虚拟化兼容性实测

PVE web portal hardening

WHAT HAPPENED

CUSTOMIZED CONF FOR FAIL2BAN

CHECK THE RESULT

Pi 5b运行Proxmox VE

Linux桌面有望日常办公？

orange pi zero3功耗测试

RK3566流畅运行X64 win应用？

关于Fisherworks

最近文章

功能

本站友链

实时天气

2025年四月
一	二	三	四	五	六	日
« 3月
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30