https://www.funtoo.org/api.php?action=feedcontributions&user=B9ace&feedformat=atomFuntoo - User contributions [en]2024-03-28T13:21:50ZUser contributionsMediaWiki 1.36.2https://www.funtoo.org/index.php?title=Funtoo_VMware_Guest_Support&diff=36247Funtoo VMware Guest Support2021-03-18T18:00:47Z<p>B9ace: Copy/paste seems to require gtkmm.</p>
<hr />
<div>[[Image:vmware-workstation-16.png|150px]]<br />
<br />
== Running Funtoo Inside VMware Workstation Pro ==<br />
<br />
{{Important|1=When configuring your VM, it is important to ensure that '''Accelerate 3D graphics''' is enabled under '''Virtual Machine Settings''' -> '''Display'''. This is not enabled by default. This will allow OpenGL/compositing to work properly for responsive graphics and proper operation of modern desktop environments.}}<br />
<br />
== Using a Recent GNOME Stage3 ==<br />
<br />
Starting with GNOME stage3 images dated 2020-12-14 and later, it is now possible to easily set up a Funtoo VM inside VMware Workstation Pro.<br />
<br />
{{c|open-vm-tools}} is enabled by default in the GNOME stage3, so full integration with your host should be active from the start. If using the GNOME stage3, all you need to do is perform a standard GNOME installation by following our [[Install|installation documentation]] and make note of the notice above to '''enable 3D accelerated graphics for your VM''' for the best possible experience.<br />
<br />
== Setting Up a Basic Stage3 for VMware Workstation ==<br />
<br />
When setting up a basic stage3 inside a VMware Workstation VM, the following steps are recommended.<br />
<br />
For better integration with your host, it is recommended that you {{c|emerge open-vm-tools}} and {{c|rc-update add vmware-tools default}} inside your VM. In Funtoo, {{c|vmware-tools}} is safe to run even on a non-VM as it will detect if it's in a virtual environment, and will only start the tools if you are actually running inside VMware.<br />
<br />
When setting up a graphical environment, be sure to {{c|ego profile mix-in +gfxcard-vmware}} and rebuild world ({{c|emerge -auDN @world}}) to ensure the VMware X11 driver and Mesa support is enabled.<br />
<br />
For copy/paste and drag/drop to work between a guest in X and the host, you may need to enable USE=gtkmm for open-vm-tools.<br />
<br />
[[Category:Official Documentation]]</div>B9acehttps://www.funtoo.org/index.php?title=Security&diff=15099Security2015-10-16T21:39:03Z<p>B9ace: /* Wifi */ 1: Obvious typo. WEB may be used, WEP should absolutely not be used. 2: Abbreviations should be uppercase for ease of reading. 3: 1337 speak or leetspeak are established spellings of same concept, "1e3t"... not so much.</p>
<hr />
<div>{{PageNeedsUpdates}}<br />
Security is a complex topic, here we will try to make things easier to decipher, and understand. This page will go from zero to tin foil hat.<br />
<br />
Understanding the concept of nesting is essential when drawing up your security plan. Disable all unnecessary services, uninstall all unnecessary software, disable all unnecessary kernel options, set useflags to -useflag to cut cruft down in sources, pass data through other servers performing specific functions like firewalling, or caching that will obfuscate the source of data. Data integrity requires off site backups so floods, power outages, wars, etc do not compromise your datas existence. Encrypt your drives so if they are physically taken your data is safe. Sign messages with gpg, use ssh instead of telnet, create ssl certificates. Monitor logs for malicious activity. If possible the last layer of security should be once all systems are broken and compromised, do not have anything of value or important going on with the system. separating computing tasks in the network over several computers helps to this end. corporations have email servers, web servers, routers, so on so forth.<br />
<br />
=== Physical Security ===<br />
If someone can take your system, your going to have a bad day. anchor your system to permanent structures, such as rack mounting. have security cameras, and locked doors.<br />
<br />
=== Software Security ===<br />
*install sudo, make a wheel fake root user with an arbitrary name, and disable the root account with 'passwd -e -l'. Use {{c|sudo -i}} to access root, or even setup terminals to run sudo -i when they start, add the fake root user to the root group. Attackers now have to guess the fake root user name also, not just the password.<br />
*install a syslog<br />
*install nftables<br />
*install sshguard and have it watch logs for multiple failed login attempts, and block attackers.<br />
<br />
apparmor, tomoyo, and selinux are mandatory access control systems.<br />
<br />
{{package|sys-auth/pambase}} has use flags for making private temporary directories on a per user basis.<br />
<br />
=== Random Number Generation ===<br />
Random numbers are used for generating ssl keys, gpg keys, ssh keys etc. Predictable numbers, even slightly predictable compromise security. Do not use via or intel hwrngs as /dev/random entropy sources.<br />
<br />
=== Password Security ===<br />
Password cracking systems rely upon you not watching logs, and easily guessable passwords. Use lower case, upper case, numbers, and symbols. 8 positions long takes less than a day to crack, where 16 takes thousands of years, 24 is probably impossible to break in a life time on a single computer.<br />
<br />
The major thing to watch out for is that crackers don't use 1 computer, they use 100 concurrently hammering the attack surface in concert with each other.<br />
<br />
=== Network Security ===<br />
==== Block pings ====<br />
To block pings until reboot:<br />
{{console|body=###i## echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all}}<br />
To permanently block pings:<br />
{{console|body=###i## echo "net.ipv4.icmp_echo_ignore_all = 1" >> /etc/sysctl.conf}}<br />
<br />
==== Wifi ====<br />
Absolutely never use WEP or WPS. Disable them, they're compromised. Make a WPA or WPA2 key that is not a word or easily guessable. 1337 speak is also counting as whole words.<br />
<br />
*https://en.wikipedia.org/wiki/PaX<br />
*https://grsecurity.net/</div>B9ace