networking | Chris Titus Tech

Best NFS Network Drive Settings for Linux

Sat, 25 Apr 2026 00:00:00 GMT

Most people mount NFS shares with a short line and move on. That works, but if you use network storage heavily (media libraries, VMs, homelab backups, project files), your mount options directly affect reliability, boot behavior, and performance.

This guide breaks down a practical high-reliability NFS option set and compares it to a basic mount setup, using Linux nfs-utils mount documentation (man 5 nfs) and systemd mount behavior (man 5 systemd.mount).

Quick Comparison: Basic vs Tuned

Basic fstab entry

nas:/data /mnt/data nfs defaults 0 0

Tuned fstab entry (example)

nas:/data /mnt/data nfs nfsvers=4.1,bg,hard,nofail,noatime,rsize=1048576,wsize=1048576,timeo=600,retrans=5,x-systemd.automount,x-systemd.mount-timeout=90,_netdev 0 0

What changes?

Area	Basic (`defaults`)	Tuned Example
NFS protocol version	Auto-negotiate	Pinned to `4.1`
Failure behavior	Default retry behavior	Explicit `hard` retries forever (safer for data integrity)
Boot experience	May block depending on environment	`nofail` + `x-systemd.automount` helps avoid boot hangs
Network timing	Generic defaults	Explicit `timeo=600,retrans=5`
Throughput tuning	Negotiated defaults	Forces `rsize/wsize` up to 1 MiB cap
Access-time writes	`relatime` typically	`noatime` to reduce metadata writes
Network ordering	Auto-detected for NFS	Explicit `_netdev` dependency

Option-by-Option Breakdown

Reference base: man 5 nfs and man 5 systemd.mount.

`nfsvers=4.1`

What it does: Pins the client to NFSv4.1.
Official behavior: Without nfsvers (or vers), Linux clients typically try newer NFS versions first and negotiate down.
Why use it: Predictability. If server and clients are known-good on 4.1, pinning avoids surprises after updates.
Tradeoff: You lose automatic use of newer protocol features (for example, if 4.2 is supported and useful).

`bg`

What it does: If mount fails/timeouts, mount helper retries in the background.
Official behavior (nfs(5)): Parent returns success while child keeps retrying.
systemd detail (systemd.mount(5)): systemd-fstab-generator translates bg semantics and effectively applies behavior similar to long retries plus fg,nofail handling under systemd job control.
Why use it: Better boot resilience when NAS/network is slow.
Tradeoff: Failure may be less obvious immediately because retries continue in background.

`hard`

What it does: NFS operations retry indefinitely after timeout.
Official behavior: hard is default and strongly preferred for data integrity; soft can return I/O errors and may risk silent corruption in some workflows.
Why use it: Correctness and durability over convenience.
Tradeoff: Apps can hang waiting for server recovery.

`nofail`

What it does: Mount is wanted, not required, during boot.
Official behavior (systemd.mount(5)): Boot continues even if mount is unavailable; unit is not ordered to block boot target completion.
Why use it: Prevent boot failures when NAS is down.
Tradeoff: Service depending on that path may fail later unless you handle dependency checks.

`noatime`

What it does: Disables access-time updates on reads.
Why use it: Reduces metadata traffic and write amplification on busy shares.
Tradeoff: Loses accurate atime semantics for tools/workflows that rely on access timestamps.

`rsize=1048576`

What it does: Sets max read request payload to 1,048,576 bytes (1 MiB).
Official behavior (nfs(5)): Linux NFS client max read payload is 1 MiB; unsupported values are clamped/rounded according to rules.
Why use it: High-throughput sequential read workloads can benefit.
Tradeoff: If network/server path can’t handle large I/O well, negotiated defaults may perform more consistently.

`wsize=1048576`

What it does: Sets max write request payload to 1 MiB.
Official behavior (nfs(5)): Same cap/rounding behavior as rsize.
Why use it: Helps throughput for large sequential writes.
Tradeoff: Same caution as rsize; test with your server/network.

`timeo=600`

What it does: Sets RPC timeout in deciseconds.
Official behavior (nfs(5)): For TCP, 600 means 60 seconds; TCP uses linear backoff and this value is already the standard default for TCP/RDMA.
Why use it: Mainly explicitness/documentation in your fstab.
Tradeoff: Usually redundant for TCP NFS because it matches default behavior.

`retrans=5`

What it does: Number of retries before the client escalates recovery behavior.
Official behavior (nfs(5)): TCP default retry count is lower by default; with hard, the client still continues broader recovery even after retry cycles.
Why use it: More tolerance for transient network stalls before warning/recovery transitions.
Tradeoff: Longer delay before surfacing responsiveness issues.

`x-systemd.automount`

What it does: Creates an automount unit so the share mounts on first access rather than during early boot.
Official behavior (systemd.mount(5)): Generates an automount unit from fstab.
Why use it: Excellent for laptops/desktops/homelabs where network readiness timing is inconsistent.
Tradeoff: First access to the path incurs mount latency.

`x-systemd.mount-timeout=90`

What it does: Limits how long systemd waits for mount command completion.
Official behavior (systemd.mount(5)): fstab-only option that maps to mount job timeout behavior.
Why use it: Prevents very long hangs on dead endpoints.
Tradeoff: Too short a timeout can fail mounts on slow links/startup races.

`_netdev`

What it does: Explicitly marks mount as network-dependent.
Official behavior (systemd.mount(5)): Pulls in network-online ordering and treats mount as remote fs.
Why use it: Makes dependency intent explicit, especially in complex setups/VPN/overlay networks.
Tradeoff: Usually redundant for plain NFS, but helpful for clarity and edge cases.

Final `0 0`

First 0: dump backup utility field (commonly unused, usually 0).
Second 0: fsck order. NFS is network fs and not checked via local fsck, so 0 is correct.

Is the Tuned Line Always Better?

No. A basic entry is fine for light use:

nas:/data /mnt/data nfs defaults,_netdev,nofail 0 0

That is often enough for:

Home media shares
Occasional backups
Non-critical personal files

Use the tuned profile when you care about predictable behavior under failure and want stricter control over boot/mount characteristics.

Practical Recommended Profiles

1) Balanced desktop/laptop

nas:/data /mnt/data nfs nfsvers=4.1,hard,nofail,_netdev,x-systemd.automount,x-systemd.mount-timeout=90 0 0

2) Throughput-focused LAN workstation

nas:/data /mnt/data nfs nfsvers=4.1,hard,noatime,rsize=1048576,wsize=1048576,timeo=600,retrans=5,_netdev,nofail 0 0

3) Minimal and safe

nas:/data /mnt/data nfs defaults,_netdev,nofail 0 0

Verify What Is Actually Active

After mounting, validate effective options (especially negotiated rsize/wsize):

findmnt -t nfs,nfs4
nfsstat -m
cat /proc/mounts | grep ' /mnt/data '

The value in fstab is your request. The effective value can differ after client/server negotiation.

Official Documentation Sources

man 5 nfs (from nfs-utils package on Linux)
man 8 mount.nfs
man 5 systemd.mount (for x-systemd.*, _netdev, and nofail behavior)
Upstream nfs-utils project: https://github.com/stefanha/nfs-utils

Final Thoughts

If you just want a stable setup, start with:

nas:/data /mnt/data nfs defaults,_netdev,nofail 0 0

If you want stronger control over reliability and behavior under failures, your advanced line is a strong baseline, especially with hard, nofail, and x-systemd.automount.

The best NFS config is not the longest one. It is the one you can explain, verify, and maintain.

Securing Your Network: A Comprehensive Guide to Checking and Enhancing Network Security

Tue, 14 Apr 2026 00:00:00 GMT

This article explains how to check to see if your network is secure, and if you have any open ports or services that could be vulnerable to attack. It covers both Windows and Linux operating systems, and provides step-by-step instructions for using various tools to scan your network for vulnerabilities.

Basic Network Scan

To check your network you can use grc.com to perform a basic network scan. It will show if you have any open ports or services that could be exposed to the internet. You can also use tools like Nmap or Wireshark to perform more in-depth scans and analysis of your network traffic.

GRC's ShieldsUP! service is a popular tool for checking the security of your network. It tests for open ports and vulnerabilities that could be exploited by attackers. You can access it at https://www.grc.com/shieldsup.

Note: You should see something like this below

Windows Scan

On Windows, you can use the built-in Command Prompt or PowerShell to check for open ports. The netstat command is commonly used for this purpose. Open Command Prompt and run the following command:

netstat -an

This will display a list of all active connections and listening ports on your system. Look for any entries that show "LISTENING" to identify open ports.

Linux Scan

On Linux, you can use the netstat command as well, or you can use ss which is a more modern tool. Open a terminal and run the following command:

sudo netstat -tuln

Note: netstat package is in the net-tools package, which may not be installed by default on some Linux distributions. You can install it using your package manager (e.g., sudo apt install net-tools on Debian-based systems).

Newer Systems use ss instead of netstat. You can run the following command to check for open ports:

sudo ss -tuln

This will show you all the TCP and UDP ports that are currently listening on your system. Look for any entries that indicate open ports.

Check for Outside Addresses

From your netstat or ss output, you can identify any external IP addresses that are connected to your system. This can help you detect unauthorized access or potential security threats.

Find what is Running on the Open Ports

Windows:

# PowerShell — replace 8080 with your port
netstat -ano | findstr :8080

# Then look up the PID
tasklist | findstr <PID>

# PowerShell one-liner (shows process name directly)
Get-Process -Id (Get-NetTCPConnection -LocalPort 8080).OwningProcess

Linux:

# ss (modern, preferred)
ss -tulnp | grep :8080

# netstat (older systems)
netstat -tulnp | grep :8080

# lsof — shows process name + PID
lsof -i :8080

# fuser — just the PID
fuser 8080/tcp

Securing a Network

Routers

If you are using a router your ISP provided, I'd recommend getting something like a Ubiquiti unifi gateway or a pfSense box. These devices provide better security features and allow you to have more control over your network. You can set up firewalls, VPNs, and other security measures to protect your network from potential threats.

Ubiquiti = easy to setup and manage but expensive
pfSense = more complex to setup and manage but much cheaper with build your own hardware setups. Or buy a pre-built appliance from Netgate.

Other 3rd party routers like Asus, TP-Link, etc. can be decent but they often have security vulnerabilities and may not receive regular updates. They probably are better than the ISP provided router but I would recommend going with a more reputable brand if you want better security.

Resources for pfSense:

Firewall

DO NOT buy a firewall or internet suite... they are terrible.

Check your windows firewall with wf.msc and make sure it is enabled and properly configured. You can create rules to block incoming connections on specific ports or from specific IP addresses.

For linux I'd recommned using ufw (Uncomplicated Firewall) which is a user-friendly interface for managing iptables. You can enable it with the following commands:

sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing

or configure with a gui like gufw or firewall-config depending on your linux distribution.

3rd Party Firewall Software

App	Description	Link
simplewall	Lightweight WFP-based per-app firewall, no background service required	github.com/henrypp/simplewall
Windows Firewall Control (WFC)	GUI front-end for the built-in Windows Firewall by Malwarebytes, free tier available	binisoft.org/wfc
TinyWall	Lightweight wrapper around Windows Firewall, whitelist-based, very low resource usage	tinywall.pados.hu
OpenSnitch	Application-level outbound firewall, prompts on first connection per app	github.com/evilsocket/opensnitch
ufw / gufw	Uncomplicated Firewall with optional GUI, default on many distros	launchpad.net/ufw
firewalld	Dynamic firewall manager used on Fedora/RHEL/Arch, supports zones	firewalld.org

VPN

VPN is a bandaid and can fix some issues but it is not a replacement for proper network security. It can help protect your data from being intercepted by encrypting your internet traffic, but it does not protect you from vulnerabilities in your network or devices. If you have a VPN, make sure to use a reputable provider.

All "security" influencers pushing VPNs are just trying to make a quick buck. A VPN can be useful in certain situations, but it is not a silver bullet for network security. Focus on securing your network and devices first, and use a VPN as an additional layer of protection if needed.

Check Devices on Your Network

You need to login to your router and check the list of connected devices. This will show you all the devices that are currently connected to your network, including their IP addresses and MAC addresses. Look for any devices that you do not recognize or that should not be on your network. If you find any suspicious devices, you can block them from accessing your network through your router's settings.

ABOVE IS ACTIVE PROTECTION AND YOU MUST KEEP DOING IT TO MAINTAIN SECURITY

Other than above, you can use software like Angry IP Scanner or Advanced IP Scanner to scan your network for connected devices. These tools will show you all the devices that are currently connected to your network, along with their IP addresses and other information. You can use this information to identify any unauthorized devices and take action to secure your network.

Links:

Closing Thoughts

Security is a journey, not a destination. You need to continuously monitor and maintain your network security to protect yourself from potential threats. Regularly check for open ports, update your software and firmware, and be vigilant about any suspicious activity on your network. By taking these steps, you can help ensure that your network remains secure and protected from potential attacks.

Walkthrough Video

Prioritize Ipv4 Over Ipv6 Linux

Fri, 03 Oct 2025 00:00:00 GMT

On many Linux systems, IPv6 is prioritized over IPv4 by default. This can lead to connectivity issues if the network or services you are trying to reach are not fully compatible with IPv6. To prioritize IPv4 over IPv6, you can modify the system's address selection policy.

Setting /etc/gai.conf

gai.conf is the best and in my opinion, the ONLY method you should use for pushing ipv4 ahead of ipv6. Most methods online show sysctl which DISABLES ipv6 and not a recommended way because ipv6 is so integrated in to many networks these days.

Instead change the following file by editing /etc/gai.conf and no restart or systemctl restart commands are needed.

Here is the line to uncomment

precedence ::ffff:0:0/96  100

That's it! Your system will now using ipv4 when it is availible, but can use ipv6 if it isn't.

Verify ipv4 priority

getent ahosts google.com

or simply ping google.com and you will see that ipv4 is shown instead of a ipv6 address at the top. getent is a nice way of verifying that it will default back to ipv6 as it will show ipv6 addresses towards the bottom.

VPN Tier List 2024

Fri, 19 Apr 2024 00:00:00 GMT

Did you know most VPNs are owned by only a few companies? Those companies can even sell your data on top of charging you a subscription fee.

In this post, we'll be looking at the best VPNs for 2024.

Why Use a VPN?

If you are looking for privacy or an encrypted connection on the go, setting up a wireguard or openvpn server is a great way to do that. This established a secure connection to your home network and helps block attacks that could happen on the host network providing you internet in a hotel, coffee shop, or other public setting. Setting these up are free and the best way to protect your privacy while helping your maintain a secure connection.

The next use case for a VPN is torrenting or streaming media from another country (geo-unlock). All VPNs generally are advertised as being able to do this, but make sure the VPN does not LOG any user activities and has servers in the country you want to watch streaming from.

Corporate VPNs and the Big Tech Companies

Kape Technology

ExpressVPN
CyberGhost
Private Internet Access
Intego Privacy Protection

Ziff Davis

IPVanish
StrongVPN
Encrypt.me
SaferVPN
Perimeter 81
FastVPN
Internet Shield VPN by VIPRE
SpeedtestVPN
netDNA

Nord Security

NordVPN
NordLayer
Surfshark VPN

I could go on, but these are the heavy hitters in the market. Most other VPN conglomerates own 5-10 different VPN brands each.

The Best VPNs

These are independent VPNs that are owned by a single company and outside the 14-eyes countries. Mullvad is hosted in Sweden which doesn't have laws to intercept traffic. Likewise, ProtonVPN is hosted in Switzerland which also doesn't have these laws.

Final Tier List

Walkthrough Video

Drivers in Windows

Thu, 11 Apr 2024 00:00:00 GMT

In the vast ecosystem of Windows, managing device drivers can be a complex task, especially when dealing with third-party drivers. Tools like Driver Store Explorer (also known as RAPR), hosted on GitHub, offer a streamlined approach to handling drivers in the Windows driver store.

What is Driver Store Explorer?

Driver Store Explorer [RAPR] is a user-friendly application designed to simplify interactions with the Windows driver store. It supports a range of operations including:

Listing
Adding
Installing
Deleting third-party driver packages

This tool is invaluable for both casual users looking to clean up their driver store and professionals managing multiple systems.

Key Features

Driver Enumeration: Lists all third-party driver packages stored in the driver store, along with the devices associated with each driver. It also allows exporting this list as a CSV file for further analysis.
Driver Management: Facilitates adding new driver packages to the store and deleting old or unused ones, helping in maintaining an optimal system performance.
Offline and Online Store Management: Works with both online (local machine) and offline driver stores, providing flexibility in various scenarios.
Efficiency: Identifies old and potentially unused drivers for deletion, making it easier to free up space and keep the driver store tidy.
User Interface: Features a full-fledged GUI that supports grouping, sorting, and selecting specific columns for a customized view.

Getting Started

To start using Driver Store Explorer, download the latest version from the releases page on GitHub. Once downloaded, the application does not require installation and can be run directly, making it a portable tool for various uses.

Practical Applications

Driver Store Explorer is particularly useful in scenarios such as:

System Cleanup: Removing old and unused drivers to free up disk space.
Driver Updates: Adding new driver packages to the store before installation.
Troubleshooting: Identifying and managing drivers associated with problematic devices.

Alternative Driver Management Tools

I personally do NOT recommend any tools if you have internet access and download the OFFICIAL drivers from your manufactures website. I use DriverStoreExplorer to export my drivers and import them into my windows image. However, if you don't have the drivers or can't find them all for your system, use the tools below.

SDIO - Snappy Driver Installer (visit website) is a freeware tool that simplifies the process of installing drivers from the Windows driver store. Its user-friendly interface supports both online and offline driver stores, offering an efficient solution for managing drivers on Windows systems.
3DP Chip Net Downloader (visit website) use an ad-blocker and ONLY grab the NET download to get network driver bundle. This should only be used as a LAST RESORT!
DriverPack Solution (visit website) This is a popular tool that was made in Russia. I do not trust it, but in a pinch it can also do network driver installs. Only use the DriverPack Offline Network Driver Installer.

Conclusion

Driver Store Explorer is a powerful and user-friendly tool that simplifies the management of Windows drivers. Its ability to handle both online and offline driver stores, coupled with a comprehensive set of features, makes it an essential utility for anyone looking to manage drivers on Windows systems efficiently.

Whether you're a professional IT administrator or a casual user wanting to keep your system lean, Driver Store Explorer offers the functionality needed to manage your drivers effectively.

Walkthrough Video

Remove Youtube Shorts

Mon, 08 Jan 2024 00:00:00 GMT

Remove YouTube shorts from your video browsing experience with the following blocklists!

Blocklist

Install ublock origin and use the following filter under "My Filters" in settings.

Sources:

https://github.com/gijsdev/ublock-hide-yt-shorts

! Title: Hide YouTube Shorts
! Description: Hide all traces of YouTube shorts videos on YouTube
! Version: 1.8.0
! Last modified: 2023-01-08 20:02
! Expires: 2 weeks (update frequency)
! Homepage: https://github.com/gijsdev/ublock-hide-yt-shorts
! License: https://github.com/gijsdev/ublock-hide-yt-shorts/blob/master/LICENSE.md

! Hide all videos containing the phrase "#shorts"
youtube.com##ytd-grid-video-renderer:has(#video-title:has-text(#shorts))
youtube.com##ytd-grid-video-renderer:has(#video-title:has-text(#Shorts))
youtube.com##ytd-grid-video-renderer:has(#video-title:has-text(#short))
youtube.com##ytd-grid-video-renderer:has(#video-title:has-text(#Short))

! Hide all videos with the shorts indicator on the thumbnail
youtube.com##ytd-grid-video-renderer:has([overlay-style="SHORTS"])
youtube.com##ytd-rich-item-renderer:has([overlay-style="SHORTS"])
youtube.com##ytd-video-renderer:has([overlay-style="SHORTS"])
youtube.com##ytd-item-section-renderer.ytd-section-list-renderer[page-subtype="subscriptions"]:has(ytd-video-renderer:has([overlay-style="SHORTS"]))

! Hide shorts button in sidebar
youtube.com##ytd-guide-entry-renderer:has-text(Shorts)
youtube.com##ytd-mini-guide-entry-renderer:has-text(Shorts)

! Hide shorts section on homepage
youtube.com##ytd-rich-section-renderer:has(#rich-shelf-header:has-text(Shorts))
youtube.com##ytd-reel-shelf-renderer:has(.ytd-reel-shelf-renderer:has-text(Shorts))

! Hide shorts tab on channel pages
! Old style
youtube.com##tp-yt-paper-tab:has(.tp-yt-paper-tab:has-text(Shorts))
! New style (2023-10)
youtube.com##yt-tab-shape:has-text(/^Shorts$/)

! Hide shorts in video descriptions
youtube.com##ytd-reel-shelf-renderer.ytd-structured-description-content-renderer:has-text("Shorts remixing this video")

! Remove empty spaces in grid
youtube.com##ytd-rich-grid-row,#contents.ytd-rich-grid-row:style(display: contents !important)


!!! MOBILE !!!

! Hide all videos in home feed containing the phrase "#shorts"
m.youtube.com##ytm-rich-item-renderer:has(#video-title:has-text(#shorts))
m.youtube.com##ytm-rich-item-renderer:has(#video-title:has-text(#Shorts))
m.youtube.com##ytm-rich-item-renderer:has(#video-title:has-text(#short))
m.youtube.com##ytm-rich-item-renderer:has(#video-title:has-text(#Short))

! Hide all videos in subscription feed containing the phrase "#shorts"
m.youtube.com##ytm-item-section-renderer:has(#video-title:has-text(#shorts))
m.youtube.com##ytm-item-section-renderer:has(#video-title:has-text(#Shorts))
m.youtube.com##ytm-item-section-renderer:has(#video-title:has-text(#short))
m.youtube.com##ytm-item-section-renderer:has(#video-title:has-text(#Short))

! Hide shorts button in the bottom navigation bar
m.youtube.com##ytm-pivot-bar-item-renderer:has(.pivot-shorts)

! Hide all videos with the shorts indicator on the thumbnail
m.youtube.com##ytm-video-with-context-renderer:has([data-style="SHORTS"])

! Hide shorts sections
m.youtube.com##ytm-rich-section-renderer:has(ytm-reel-shelf-renderer:has(.reel-shelf-title-wrapper:has-text(Shorts)))
m.youtube.com##ytm-reel-shelf-renderer.item:has(.reel-shelf-title-wrapper:has-text(Shorts))

! Hide shorts tab on channel pages
m.youtube.com##.single-column-browse-results-tabs>a:has-text(Shorts)

Walkthrough Video

5 Essential Terminal Utilities

Fri, 18 Nov 2022 00:00:00 GMT

TLDR

Too long didn't read? The perfect solution for long man pages that we just want some quick examples and basic syntax for a command. TLDR is a vital tool to save you time when learning the terminal.

CMatrix

How can you use Linux without using CMatrix... It's hard to be cool without it.

Trash-CLI

This is a life saver after you delete a directory or files in terminal and need to get them back. I highly recommend making the following alias in your ~/.bashrc file.

alias rm='trash -v'

Delete a file and send it to the trash: trash path/to/file
List all files in the trash: trash-list
Interactively restore a file from the trash: trash-restore
Empty the trash: trash-empty
Permanently delete all files in the trash which are older than 10 days: trash-empty 10
Remove all files in the trash, which match a specific blob pattern: trash-rm "*.o"
Remove all files with a specific original location: trash-rm /path/to/file_or_directory

Autojump

This is my most used terminal utility that saves me the most amount of time. The catch to this program is you must have navigated to the directory at least once in terminal first.

Jump to a directory that contains the given pattern: j pattern
Jump to a sub-directory (child) of the current directory that contains the given pattern: jc pattern
Open a directory that contains the given pattern in the operating system file manager: jo pattern
Remove non-existing directories from the autojump database: j --purge
Show the entries in the autojump database: j -s

Progress

Tired of wondering how much longer the cp, mv, dd, tar, cat, and other Linux coreutil functions take? Progress will tell you!

Show the progress of running coreutils: progress
Launch and monitor a single long-running command: command & progress --monitor --pid $!
Include an estimate of time remaining for completion: progress --wait --command rsync

Walkthrough Video

How I Setup My Website

Fri, 07 Oct 2022 00:00:00 GMT

This shows you have I automate my workflows and setup my website for maximum productivity and search

The best part is this is FREE and will produce a website faster than anything on the web. Netlify, my host, didn't charge anything until I was breaking 100GB of bandwidth and 100,000 active users PER MONTH! Now with double those numbers I pay only $19 a month and have 1 TB (Terabyte) of data per month.

The Workflow and Overview

Typically before I start recording any video, I write an outline and publish it on my website. It's almost like a video script, but also a copy paste guide for either a viewer or just someone searching google.

This is done by using a static site generator. There are bunch on the market, but the one that suited my needs the best is Hugo. It has a bunch of themes ready to use out of the box @ https://themes.gohugo.io/ and is extremely modular.

Then there are the annoyances of other website platforms like WordPress. You need to go on the web and use some terrible web based editor that just is slow and takes a long time. Hugo fixes this by using both GitHub and Netlify for deployment. Netlify will "host, build, and distribute" the content automatically and GitHub will be where you publish when it's ready for the publish stage that Netlify controls.

What this looks like in practice is I issue a hugo new posts/new-post.md, edit it with vim posts/new-post.md, and post it with git commit and push. This allows me to create a page in seconds if I wanted.

The Setup

Install Hugo (I recommend NIX Package Manager)

nix-env -iA nixpkgs.hugo

Do a quick setup that creates the website folder and the needed HUGO framework files with:

hugo new site website

Then we will initialize it with a HUGO theme like so:

cd website
git init
git submodule add https://github.com/zzossig/hugo-theme-zzo.git themes/zzo

I absolutely love the ZZO theme as a beginner. It has some of the best instructions and documentation you will find! https://zzo-docs.vercel.app/zzo/gettingstarted/installation/

Usage and First Steps

The first thing you want to do is look over the sample post in /themes under /themes/examplesite. Under here you will see the structure that HUGO uses and how most of the content ends up in the content directory off of root.

The second thing to note is the /content/posts/ and seeing the examples here. This will show you the sample markdown file and how it's laid out. Change these and make your first post. Once you figure out a good structure for your posts, you can then edit the default template.

For previewing the changes you can open up a new terminal and just type hugo server from the root website directory.

Now I have three different windows that I'm using for the bulk of my workflow:

Chrome Window with https://localhost:1313
IDE for editing my markdown files (vs code, vim, etc.)
Extra terminal window running hugo server for real time updates for the chrome window

Note: You can use terminal inside vs code and with the auto save feature you can see the code get updated on the webpage for every change you make!

Your First Modifications

Remember the big thing with HUGO is everything is modular and everything can be changed, because at the end it is simply outputting a static html file.

Once you figure out how you want your posts structured, change the /archtypes/default.md. This template is what each new post will use. This is where you really increase your efficiency as we often find ourselves writing the same few things on each new post we make.

The next modification will probably comes from adding widgets or sidebar components. Instead of directly modifying the /theme/zzo files you can actually look through the partials directory and create your own /layouts/partials in your root that will take precedence over the ones in the theme directory. More in-depth explanation from the official site https://gohugo.io/functions/partials/include/.

Complex Theme Modifications

In my past Hugo Guide I went into some pretty big theme modifications (adding search, tags, etc.) Read more about that @ https://christitus.com/hugo-guide/

Also if you see something you want to copy from my website, everything is on my public GitHub @ https://github.com/christitustech/website

Adding comments can be done in a multitude of ways, but my absolute favorite instead of using Disqus or commento.io is simply using GitHub to host the comments directly on your website repository! There is an amazing "plugin" that you can add called https://github.com/utterance/utterances which does all the spam filtering and integrates comments BETTER!

Walkthrough Video

Macos on Linux

Mon, 03 Oct 2022 00:00:00 GMT

This shows you all the steps to install a MacOS VM in Linux QEMU using Virtual Machine Manager or virt-manager.

Newer Source, but not as polished: https://github.com/kholia/OSX-KVM Mac KVM Repository: https://github.com/foxlet/macOS-Simple-KVM

Requirements

A modern Linux distribution. E.g. Ubuntu 20.04 LTS 64-bit or later.
QEMU >= 4.2.0
A CPU with Intel VT-x / AMD SVM support is required (grep -e vmx -e svm /proc/cpuinfo)

Installation Preparation

Install QEMU and modify your user using https://christitus.com/vm-setup-in-linux Guide.

Clone this repository on your QEMU system. Files from this repository are used in the following steps.

cd ~
git clone --depth 1 --recursive https://github.com/foxlet/macOS-Simple-KVM
cd macOS-Simple-KVM

Installation Media

This downloads our installation media and I'd recommend using Catalina for compatibility and performance.

./jumpstart.sh --catalina

Note: Modern NVIDIA GPUs are supported on HighSierra but not on later versions of macOS. Recommended PCI Passthrough GPU is 5700XT as this works on Catalina and above. If you go with a 6000 Series Card only certain ones will work on Big Sur and Monterey, but not earlier releases.

Virtual Machine Setup

I recommend using Virtual Machine Manager (virt-manager) as it has a fantastic interface and Simple-KVM does a great job with their setup script. Simply type the following to get the macOS VM setup:

sudo ./make.sh --add

VM Modification

Before we can start out VM we have to have a hard drive to load it. You have two options: physical hard drive passthrough or qcow2 file.

Obviously, the physical drive is considerably faster, but not possible in some instances such as laptops or if you can't afford a secondary drive.

Physical Hard Drive Passthrough

This is pretty simple as you just click Add Hardware -> Storage and then specify your hard drive.

Note: while you can use drive short names /dev/sda I'd recommend using /dev/disk/by-id/HARDDRIVESERIAL as this doesn't ever change.

QCOW2 File for Hard Drive

This is even simpler as you just click Add Hardware -> Storage and create new file. Just make sure you put it on at least a SSD or a nvme drive as it will be super slow if you don't.

Install Process

Boot your machine and select the OS Install Partition on startup.

Use the Disk Utility tool within the macOS installer to partition, and format the virtual disk attached to the macOS VM.

TIP: Using a non-APFS filesystem is recommended.

Go ahead, and install macOS

Post-Installation

Bridge Networking

*First_ find your card interface name

ip a

Example: (Interface name is enp7s0)

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp7s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 24:bb:ee:55:22:33 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.99/24 brd 10.0.0.255 scope global
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
    valid_lft forever preferred_lft forever

Second Update /etc/network/interfaces

source /etc/network/interfaces.d/*
 
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface - old entry
# allow-hotplug enp7s0
# iface enp7s0 inet dhcp

# The primary network interface - new entry
# DEVICENAME = enp7so for this pc and MYUSERNAME need to be $(whoami)
auto br0
iface br0 inet dhcp
  bridge_ports DEVICENAME tap0

auto tap0
iface tap0 inet dhcp
  pre-up tunctl -u MYUSERNAME -t tap0

Lastly Restart the networking service or reboot computer. Then change your VM NIC (Network Hardware) to br0 interface.

sudo systemctl restart networking

Other Considerations

GPU Passthrough (Requires two Graphics Cards) - https://github.com/foxlet/macOS-Simple-KVM/blob/master/docs/guide-passthrough.md
Changing Screen Resolution - https://github.com/foxlet/macOS-Simple-KVM/blob/master/docs/guide-screen-resolution.md
Optimizing System Performance - https://github.com/sickcodes/osx-optimizer
Sound - Two methods, Pass the audio through HDMI if using GPU Passthrough OR Pass through a USB sound card that is macOS compatible
- Note: There is a way to use Voodoo kext or AppleALC, but it will crackle and sound terrible

Walkthrough Video

Auto Mount with SystemD

Thu, 22 Sep 2022 00:00:00 GMT

This shows how to automount remote network drives using systemd and fstab

Automount using systemd

Sometimes partitions can fail to mount on startup and some options are needed to fix this. I've had two instances where it was needed. One was on a slow 6 TB drive that timed out on occation during boot and I had to sudo mount -a to get it to mount

For this a simple option addition in fstab on a local disk looks like this:

x-systemd.after=network-online.target,x-systemd.automount

Next, I had problems with NFS shares not mounting and I had to expand these option to:

x-systemd.after=network-online.target,x-systemd.automount,x-systemd.mount-timeout=30,_netdev

This makes the /etc/fstab entry look like this:

10.0.0.10:/volume2/Images  /media/images nfs x-systemd.after=network-online.target,x-systemd.automount,x-systemd.mount-timeout=30,_netdev 0 0

Source: https://wiki.archlinux.org/title/Fstab#Automount_with_systemd

Robocopy - Copying files the right way in Windows

Wed, 19 Jan 2022 23:39:34 GMT

This guide shows how to copy files in windows when dealing with large volumes of files and very long file paths past 255 characters.

What is Robocopy and Why use it?

Robocopy is a build in command line program that is fantastic at copying files quickly and bypasses many of the downsides of the standard copy process of windows.

The downsides of Window's standard file copy are:

Has to read ALL files being copied BEFORE it will copy the first file
Artificial character limit of 255 that includes the filename and filepath.
GUI limitations for LARGE amounts of files.

How to use Robocopy

Launch into the Command Prompt or Powershell by right-clicking Start Menu

From this interface you can now run Robocopy.

Basic Syntax:

C:\> robocopy "Source Directory" "Destination Directory" /e /w:5 /r:2 /COPY:DATSOU /DCOPY:DAT /MT

Full syntax can be shown with robocopy /? but be careful with /MIR and move style copies as this can overwrite and erase existing files in the destination directory.

Notable Options with Robocopy

/e - Copy all folders including empty ones
/r - Retry times /r:0 means no retry on failed copy
/w - Wait time /w:0 means no wait between retry on failed copy
/COPYALL OR /COPY:DATSOU - Copy Data, Attributes, Timestamps, Security, Owner, and Auditing Info for files
/DCOPY:DAT - Copy Data,Attributes and Timestamps for Directories (Other Options are E=EAs-Extended Attributes, X=Skip alt data streams, but are almost never used)
/MT:n - Multithread transfer with n threads. Example /MT:4 - Use 4 threads to copy files. If no threads set, it will default to 8.
/MIR - Mirror Source to Destination - WARNING: WILL DELETE ANY FILES THAT DO NOT MATCH IN DESTINATION!
/MOVE - Moves from Source to Destination - WARNING: WILL DELETE ALL FILES FROM SOURCE AFTER COPY!
/LFSM:100M - Operate in Low Free Space Mode with 100 Megabytes. 10M = 10 Megabytes 1G = 1 Gigabyte
/B - Backup Mode - Great for system backups if you are part of Administrator or Backup Users group - NOT RECOMMENDED - Use 3rd party backup software
/ZB - Restartable Backup Mode - Tries to copy files with restartable and if it fails it restarts in backup mode - NOT RECOMMENDED - Use 3rd party backup software
/RH:1700-0900 - Scheduled run between 5PM and 9AM and will pause if it is during "business hours of 9AM-5PM"
/LOG+:C:\robocopy.log - Outputs everything to C:\robocopy.log (Note: if NOT running as admin you need to put this in your user folder C:\Users\username\robocopy.log) the + adds to the file.
/TEE - If using LOG and you also want console output, put the /TEE option in.

I don't recommend using backup, restartable mode, or jobs. Jobs typically miss options and 3rd party solution like veeam are FAR better for backups than robocopy EVER will be.

Walkthrough Video

Hugo Static Site Guide

Wed, 08 Jan 2020 21:59:19 GMT

This article goes over the basics of hugo and guides you through the process of using a static site generator.

Installing Hugo

Arch-Based Users: yay -S hugo
Debian-Based Users: sudo apt install hugo
Note: Debian packages are old and I recommend downloading the latest version of hugo from github

Github Repo for Hugo (Latest Versions and Notes)
Hugo GitHub
Official Site

Create your first site and install a theme using the Quick Start Page.

Common Hugo Commands

hugo - builds static files in the siteroot/public folder
hugo server - runs a test site so you can login to http://127.0.0.1:1313 and see your changes before pushing live
hugo new posts/dir/newpost.md - you can make new posts on the fly with all your templates (see below)

The First Changes

I made several changes when I first switched to HUGO and these were the changes I made.

Theme Modification

I downloaded the the Mainroad Theme and installed it during the Quick Start. Note: My Debian system had an old version of HUGO 0.40 and I had to update before the theme worked.

Changing Theme Widgets

Social Widget

I first started to change the social widget by adding YouTube and Twitch from the following file siteroot/themes/mainroad/layouts/partials/widgets/social.html.
The Most challengeing Part of this was the SVG files used by mainroad. However, once I figured out the SVG format can be edited in a simple text editor and I mirrored the size and types from the existing SVG files they showed up.

Here are the Edits I made to social.html:

{{- with .Site.Params.widgets.social.twitch }}
  <div class="widget-social__item widget__item">
   <a class="widget-social__link widget__link btn" title="Twitch" rel="noopener noreferrer" href="https://twitch.tv/{{ . }}" target="_blank">
    {{ partial "svg/twitch.svg" (dict "class" "widget-social__link-icon") }}
    <span>Twitch Live Streams</span>
   </a>
  </div>
  {{- end }}

Basically after getting the SVG setup and putting the twitch.svg and youtube.svg in this path siteroot/mainroad/layouts/partials/svg I was able to get the Social widget exactly how I wanted.

Tags Widget

Next up was fixing the tags on the sidebar. They were blocky and quite ugly, where I wanted a traditional tag cloud that you see on many other sites to help users navigate your content. So I began looking at other projects that had the proper code. I found the following code snippit:

{{ if not (eq (len $.Site.Taxonomies.tags) 0) }}
    {{ $fontUnit := "rem" }}
    {{ $largestFontSize := 2.0 }}
    {{ $largestFontSize := 2.5 }}
    {{ $smallestFontSize := 1.0 }}
    {{ $fontSpread := sub $largestFontSize $smallestFontSize }}
    {{ $max := add (len (index $.Site.Taxonomies.tags.ByCount 0).Pages) 1 }}
    {{ $min := len (index $.Site.Taxonomies.tags.ByCount.Reverse 0).Pages }}
    {{ $spread := sub $max $min }}
    {{ $fontStep := div $fontSpread $spread }}
<div class="widget-taglist widget">
  <h4 class="widget__title">{{ T "tags_title" }}</h4>
   <div class="widget__content">
    <div id="tag-cloud" style="padding: 5px 15px">
        {{ range $name, $taxonomy := $.Site.Taxonomies.tags }}
            {{ $currentTagCount := len $taxonomy.Pages }}
            {{ $currentFontSize := (add $smallestFontSize (mul (sub $currentTagCount $min) $fontStep) ) }}
            {{ $count := len $taxonomy.Pages }}
            {{ $weigth := div (sub (math.Log $count) (math.Log $min)) (sub (math.Log $max) (math.Log $min)) }}
            {{ $currentFontSize := (add $smallestFontSize (mul (sub $largestFontSize $smallestFontSize) $weigth) ) }}
            <!--Current font size: {{$currentFontSize}}-->
            <a href="{{ "/tags/" | relLangURL }}{{ $name | urlize }}" style="font-size:{{$currentFontSize}}{{$fontUnit}}">{{ $name }}</a>
        {{ end }}
    </div>
  </div>
</div>
{{ end }}

After replacing siteroot/themes/mainroad/layouts/partials/widgets/taglist.html with the following code. The tag cloud was complete.

Header/Footer Modification

Replacing the Header and footer was extremely easy as it is just plain HTML. The files are located in siteroot/themes/mainroad/layouts/partials/header.html or footer.html. You can leave the stock, but I wanted to add a privacy policy and terms of service to be compliant.

Table of Contents Changes

I replaced the title "PAGE CONTENTS" with share buttons using a share-buttons.html I created. This could all be done in the post-toc.html file, but I wanted to keep it modular and not make too many edits to the theme. Here were my changes:

siteroot/themes/mainroad/layouts/partials/post-toc.html

{{ if .Param "toc" }}
<div class="post__toc toc">
 <div class="toc__title">{{ partial "share-buttons.html" . }}</div>
 <div class="toc__menu">
  {{ .TableOfContents }}
 </div>
</div>
{{ end }}

Note: I added the {{ partial "share-buttons.html" . }} to this and removed PAGE CONTENTS text

/siteroot/layouts/partials/share-buttons.html - NEW FILE

{{ $pageurl := .Permalink }}

<style>
#share-buttons {display: inline-block; vertical-align: middle; }
#share-buttons:after {content: ""; display: block; clear: both;}
#share-buttons > div {
position: relative;
text-align: left; 
height: 36px; 
width: 32px; 
float: left; 
text-align: center;
}
#share-buttons > div > svg {height: 16px; fill: #d5d5d5; margin-top: 10px;}
#share-buttons > div:hover {cursor: pointer;}
#share-buttons > div.facebook:hover > svg {fill: #3B5998;}
#share-buttons > div.twitter:hover > svg {fill: #55ACEE;}
#share-buttons > div.linkedin:hover > svg {fill: #0077b5;}
#share-buttons > div.pinterest:hover > svg {fill: #CB2027;}
#share-buttons > div.mail:hover > svg {fill: #7D7D7D;}
#share-buttons > div.instagram:hover > svg {fill: #C73B92;}
#share-buttons > div.facebook > svg {height: 18px; margin-top: 9px;}
#share-buttons > div.twitter > svg {height: 20px; margin-top: 8px;}
#share-buttons > div.linkedin > svg {height: 19px; margin-top: 7px;}
#share-buttons > div.pinterest > svg {height: 20px; margin-top: 9px;}
#share-buttons > div.mail > svg {height: 14px; margin-top: 11px;}
</style>

<span style="color: silver;">Share on: </span><div id="share-buttons">
<div class="facebook" title="Share this on Facebook" onclick="window.open('http://www.facebook.com/share.php?u={{ $pageurl }}');"><svg viewBox="0 0 1792 1792" xmlns="http://www.w3.org/2000/svg"><path d="M1343 12v264h-157q-86 0-116 36t-30 108v189h293l-39 296h-254v759h-306v-759h-255v-296h255v-218q0-186 104-288.5t277-102.5q147 0 228 12z"/></svg></div>
<div class="twitter" title="Share this on Twitter" onclick="window.open('http://twitter.com/home?status={{ $pageurl }}');"><svg viewBox="0 0 1792 1792" xmlns="http://www.w3.org/2000/svg"><path d="M1684 408q-67 98-162 167 1 14 1 42 0 130-38 259.5t-115.5 248.5-184.5 210.5-258 146-323 54.5q-271 0-496-145 35 4 78 4 225 0 401-138-105-2-188-64.5t-114-159.5q33 5 61 5 43 0 85-11-112-23-185.5-111.5t-73.5-205.5v-4q68 38 146 41-66-44-105-115t-39-154q0-88 44-163 121 149 294.5 238.5t371.5 99.5q-8-38-8-74 0-134 94.5-228.5t228.5-94.5q140 0 236 102 109-21 205-78-37 115-142 178 93-10 186-50z"/></svg></div>
<div class="linkedin" title="Share this on Linkedin" onclick="window.open('https://www.linkedin.com/shareArticle?mini=true&url={{ $pageurl }}&title=&summary=&source=');"><svg viewBox="0 0 1792 1792" xmlns="http://www.w3.org/2000/svg"><path d="M477 625v991h-330v-991h330zm21-306q1 73-50.5 122t-135.5 49h-2q-82 0-132-49t-50-122q0-74 51.5-122.5t134.5-48.5 133 48.5 51 122.5zm1166 729v568h-329v-530q0-105-40.5-164.5t-126.5-59.5q-63 0-105.5 34.5t-63.5 85.5q-11 30-11 81v553h-329q2-399 2-647t-1-296l-1-48h329v144h-2q20-32 41-56t56.5-52 87-43.5 114.5-15.5q171 0 275 113.5t104 332.5z"/></svg></div>
{{ if .Params.image }}<div class="pinterest" title="Share this on Pinterest" onclick="window.open('https://pinterest.com/pin/create/button/?url=&media={{ .Params.image }}&description=');"><svg viewBox="0 0 1792 1792" xmlns="http://www.w3.org/2000/svg"><path d="M256 597q0-108 37.5-203.5t103.5-166.5 152-123 185-78 202-26q158 0 294 66.5t221 193.5 85 287q0 96-19 188t-60 177-100 149.5-145 103-189 38.5q-68 0-135-32t-96-88q-10 39-28 112.5t-23.5 95-20.5 71-26 71-32 62.5-46 77.5-62 86.5l-14 5-9-10q-15-157-15-188 0-92 21.5-206.5t66.5-287.5 52-203q-32-65-32-169 0-83 52-156t132-73q61 0 95 40.5t34 102.5q0 66-44 191t-44 187q0 63 45 104.5t109 41.5q55 0 102-25t78.5-68 56-95 38-110.5 20-111 6.5-99.5q0-173-109.5-269.5t-285.5-96.5q-200 0-334 129.5t-134 328.5q0 44 12.5 85t27 65 27 45.5 12.5 30.5q0 28-15 73t-37 45q-2 0-17-3-51-15-90.5-56t-61-94.5-32.5-108-11-106.5z"/></svg></div>{{ end }}
<div class="mail" title="Share this through Email" onclick="window.open('mailto:?&body={{ $pageurl }}');"><svg viewBox="0 0 1792 1792" xmlns="http://www.w3.org/2000/svg"><path d="M1792 710v794q0 66-47 113t-113 47h-1472q-66 0-113-47t-47-113v-794q44 49 101 87 362 246 497 345 57 42 92.5 65.5t94.5 48 110 24.5h2q51 0 110-24.5t94.5-48 92.5-65.5q170-123 498-345 57-39 100-87zm0-294q0 79-49 151t-122 123q-376 261-468 325-10 7-42.5 30.5t-54 38-52 32.5-57.5 27-50 9h-2q-23 0-50-9t-57.5-27-52-32.5-54-38-42.5-30.5q-91-64-262-182.5t-205-142.5q-62-42-117-115.5t-55-136.5q0-78 41.5-130t118.5-52h1472q65 0 112.5 47t47.5 113z"/></svg></div>
</div>

Adding AdSense and Custom Scripts to All Pages

To add specific scripts to all pages, such as AdSense, you will need to modify siteroot/themes/mainroad/_defaults/baseof.html. I added the following before the </head> of this file to populate AdSense. You could put Analytics in here as well, but it isn't needed since mainroad theme has the option in config.toml. Here are my modifications:

baseof.html

{{- if not .Site.IsServer }}
  {{ template "_internal/google_analytics_async.html" . }}
  {{ partial "adsense-auto.html" . }}
 {{- end }}
</head>

*siteroot/layouts/partials/adsense-auto.html_ - NEW FILE

<script data-ad-client="ca-pub-000000000000000" async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

_Note: Make sure to use your ca-pub-IDGOESHERE

Configuration of config.toml

In your siteroot you will see this file that you will need to configure. Most users will simply edit this and away they go. Everything in this file worked pretty darn well. There was a couple spots that tripped me up which I will go over now.

BaseURL

Make sure you fill this out completely. I messed up the automated sitemap.xml because I simply put / instead of my entire address. This is what I have in the file now: baseURL = "https://christitus.com/"

Analytics, Social, and Title/Description

All of these options worked perfectly and I had no issues.

[menu]

  [[menu.main]]
    identifier = "home"
    name = "Home"
    pre = "<i class='fa fa-heart'></i>"
    url = "/"
    weight = -110

  [[menu.main]]
    name = "Donate"
    post = ""
    pre = "<i class='fa fa-road'></i>"
    url = "https://www.patreon.com/christitustech"
    weight = -105

  [[menu.main]]
    name = "Remote Support"
    post = ""
    pre = "<i class='fa fa-road'></i>"
    url = "https://download.teamviewer.com/download/TeamViewerQS.exe"
    weight = -100

Note: I added external site links and a proper home button

Templates to Optimze My Workflow

This is where HUGO really shines and saves me a TON of time compared to WordPress and the like. Simply modifying the siteroot/archetypes/default.md file to put all the things I normally have in a post. Here is what I use:

default.md

---
title: "{{ replace .Name "-" " " | title }}"

date: {{ .Date }}
url: /{{ .Name }}/
image: images/2020-thumbs/{{ .Name }}.webp
categories:
  - Linux
  - Windows
  - Networking
tags:
  - Ubuntu
draft: true
---
<!--more-->

Now everytime I run hugo new posts/newpost.md it will fill in the Title, date, custom url, thumbnail, add the more directive for list view, and my closing phrase.

Video Walkthrough

Conclusion

This has changed my life and has made it so I can make posts like this one for people to follow. This entire post took me about an hour to write and would have take twice as long if I were to do it in WordPress.

How To Setup a VPN Kill Switch Server

Mon, 02 Dec 2019 05:31:59 GMT

This will show you how to set up a VPN Kill Switch so all traffic will come from that server. For this server, I am using CentOS, but you can easily use Ubuntu server if you are more familiar with that.

Install packages

sudo apt install openvpn ufw -y
*Note: use apt instead of dnf on Ubuntu or Debian Servers

Set Static IP

sudo nmtuisudo nmcli connection down eth0 && sudo nmcli connection up eth0

Download OVPN Files

My recommendation for a public VPN provider at the time of writing was ExpressVPN. However, you can use these instructions on ANY VPN that provides ovpn files which any reputable VPN provider has.

mv ~/Downloads/client.ovpn /etc/openvpn/test.conf

Service creation

ls /lib/systemd/system/
*Check for openvpn-client@ or openvpn@
sudo systemctl start openvpn@test

Disable ipv6 and Secure System

sudo nano /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 net.ipv6.conf.lo.disable_ipv6=1

sudo sysctl -p

Verify Ipv6 is disabled
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
sudo sysctl --all | grep disable_ipv6

Firewall ufw blocks – VPN Kill Switch

sudo nano /etc/default/ufw

IPV6=no

Whitelist Local Area Network
sudo ufw allow in to 192.168.1.0/24
sudo ufw allow out to 192.168.1.0/24
Block All Incoming and Outgoing Traffic by Default
sudo ufw default deny outgoing
sudo ufw default deny incoming
Whitelist VPN Port for VPN Establishment
sudo ufw allow out to any port 1194 proto udp
*check port by doing head /etc/openvpn/expressvpn.conf
Whitelist VPN Tunnel
sudo ufw allow out on tun0 from any to any
sudo ufw allow in on tun0 from any to any
Enable Firewall
sudo ufw enable

External Program Setup on Server

X11 Forwarding

Transmission daemon
sudo apt install transmission-daemon
sudo systemctl stop transmission-daemon
sudo nano /etc/transmission-daemon/settings.json
*enable rpc and whitelist, add blocklist
sudo systemctl start transmission-daemon

Full Video Walkthrough

How to Secure A Web Server

Thu, 10 Oct 2019 13:37:49 GMT

In this article, I show you all the steps needed to secure a web server and improve your security. I recommend doing all of these things on every installation. Also, just because you secure your server doesn’t mean you can neglect it. I highly recommend monitoring it and adjusting security as needed. Monitoring is required for proper security in my opinion.

Secure A Web Server Steps

Install UFW

sudo apt-get update  
sudo apt-get install ufw  
sudo ufw limit 22/tcp  
sudo ufw allow 80/tcp  
sudo ufw allow 443/tcp  
sudo ufw enable

Verify
sudo ufw status

Do Global blocks

sudo ufw default deny incoming  
sudo ufw default allow outgoing

Change SSH to Key

Remote Machine: ssh-keygen -t rsa

Transfer to Server

Method 1

Transfer pub ssh key to server

scp ~/.ssh/id_rsa.pub user@server.com:~
cat ~/id_rsa.pub >> ~/.ssh/authorized_keys

Method 2

Copy key and place in authorized_key file in one command
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server.com

Secure a Web Server Disabling Password Auth through SSH

Change the following lines in /etc/sshd_config

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
PermitRootLogin no

Edit /etc/sysctl.conf

Enable security features

Prevent IP Spoof /etc/host.conf

Change File to mirror below:

order bind,hosts
multi on
nospoof on

Install Fail2Ban

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check Listening Ports

netstat -tunlp

You will now have completed the basics of a secure web server!

Video Walkthrough

How to Setup a VPN Server and Clients Using OpenVPN

Sat, 21 Sep 2019 04:45:08 GMT

In this article, I go over how to setup a VPN Server and clients using OpenVPN. this will cover the setup process of the remote machine and then connecting to it via both Linux and Windows client machines.

OpenVPN Server Setup

This is the Installation script I use to setup a secure OpenVPN Server
https://github.com/angristan/openvpn-install

Run the following script as root or add sudo to the install.sh script
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
AUTO_INSTALL=y ./openvpn-install.sh

you will need to enable the OpenVPN service to auto-start so the VPN stays up after reboot.
sudo systemctl enable openvpn

Troubleshooting

TUN is not available
-Certain VPS servers do not have TUN enabled by default. Create the follow script and run it on startup to fix this issue.

-Create /usr/sbin/enabletun.sh
#!/bin/bash mkdir /dev/net mknod /dev/net/tun c 10 200 chmod 0666 /dev/net/tun

-Mark /usr/sbin/enabletun.sh executable
chmod +x /usr/sbin/enabletun.sh

-Run this script on startup by adding the following to /etc/rc.local
/usr/sbin/tunscript.sh || exit 1
exit 0

Client Setup

Linux Client Setup

Install OpenVPN for Network Manager
Debian-Based sudo apt install network-manager-openvpn
Arch-Based sudo pacman -S networkmanager-openvpn
Gnome-Based DEs sudo apt install network-manager-openvpn-gnome

Copy OVPN file to /etc/openvpn/client/client.ovpn
Test client configuration in Terminal:
sudo openvpn /etc/openvpn/client/client.ovpn

Network manager Import VPN Connection: client.ovpn
Note: Certificates stored in ~/.local/share/networkmanagement/certificates

Connect via your Network Manager

Linux Client Troubleshooting

Verify TLS key file is enabled and created. This is a known issue on KDE desktops. If it isn’t make sure to create it using the last TLS portion of the ovpn file.

Windows Client Setup

Download OpenVPN client for your Windows @ https://openvpn.net/community-downloads/

Copy your client.ovpn from the server (WinSCP to connect and copy) and place the file in C:\Program Files\OpenVPN\config

Run the program and right click the icon in the tray and connect

Video Walkthrough

The Ultimate SSH Guide

Wed, 18 Sep 2019 21:55:20 GMT

This is an SSH guide to help you set up, configure, connect, and transfer files using SSH.

Setup SSH

Install SSH on your system

Debian-Based

sudo apt install openssh-server -y

CentOS/Fedora

sudo yum -y install openssh-server

Arch

sudo pacman -S openssh

Run SSH server on startup

sudo systemctl start ssh
sudo systemctl enable ssh

**Note: sshd instead of ssh for arch

Configure SSH

Make sure ufw isn’t blocking ssh and enable it for passthrough.

sudo ufw allow ssh
sudo ufw limit ssh
sudo ufw enable  
sudo ufw status

Options for /etc/ssh/sshd_config

PasswordAuthentication yes/no * No should be used when facing the internet and key authentication must be used for security

AllowTcpForwarding yes
X11Forwarding yes
* This is used to forward GUI programs (Xming required for Windows)

AllowUsers Fred Wilma
DenyUsers Dino Pebbles
* Block and Allow certain users

Security of a SSH Server

It should be noted that if you open up your firewall and port forward port 22 on a standard SSH server install… you will probably be hacked. This is extremely reckless and should never be done. I highly recommend doing ALL of the following measures if opening up SSH to the outside world.

First, obscure the SSH port by changing it in the sshd_config file
# Change Default port 22 to 2222
Port 2222

Second, disable Password Authentication and use ssh keys instead. This is a complex procedure and recommend using the following script to optimize the encryption and setup process.
https://github.com/angristan/openvpn-install

Third, verify you are using tar-pitting or rate limiting on your SSH port. This will prevent brute force attacks
ufw limit proto tcp from any port 2222
*Note this can also be done via iptables and it needs to be modified to your SSH port.

Connect via SSH

Linux terminal

ssh username@serverip

Windows

PuTTY https://putty.org/ (ssh program)

Xming required for X11 forwarding https://sourceforge.net/projects/xming/

Verify X11 Forwarding in PuTTY options

Video Walkthrough SSH Access

Transfer Files via SSH

The difference between SFTP and SCP by default are one is interactive and the other isn’t. SCP is faster, but can’t be resumed where SFTP and slower and can be.

Linux

Use the native file browser, in the location bar type the following:
sftp://192.168.1.10

Using the terminal

Syntax: scp source destination
Remote PC Syntax: username@serverip:/path/to/file

Example: scp localfile username@serverip:/remote/server/path

Windows File Transfer

WinSCP is my recommended transfer tool. https://winscp.net/eng/index.php

pscp.exe for command line. https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Disable Windows Firewall Properly

Sat, 06 Oct 2018 17:20:22 GMT

This walkthrough goes over how to Disable Windows Firewall while not affecting other programs that rely on this service. It’s important that you DO NOTdisable the service, due to the fact it can cause issues with Microsoft Office and other products.

Steps to bypass firewall

Launch Windows Defender Firewall with Advanced Security (Start -> Run -> wf.msc)
Click Inbound Rules
Select “New Rule”
Custom rule
All Programs
Leave Any and All Ports
Any IP Address for both
Allow the connection
Check Domain, Private, and Public
Name “Allow All”

Video Guide

Finishing Up

By doing this you allow all traffic inbound to this computer, consequently, all outbound traffic is already allowed by default. Therefore, certain programs and services that depend on windows firewall can function properly. In conclusion, this is a far superior way of disabling the built-in firewall in windows without affecting other programs.

Moving Unifi Access Point to another Unifi Controller

Thu, 21 Jun 2018 15:57:35 GMT

This walkthrough goes over moving Unifi access point to another Unifi controller. To remove APs from a Unifi Controller you need to reset the APs and then either discover them or manually SSH set-inform the devices.

First Reset the AP

Use Terminal or SSH (Either in existing Controller -> Manage Device -> Open Terminal or Putty)
- Type: syswrapper.sh restore-default
  OR
- Reset the Unifi AP by the old paperclip method if you can’t putty or use existing controller

Second discover device or manually set-inform

On the new controller try to discover the now factory reset APs and with any luck they will show up. However in big environments I typically can never get them to be discovered so I will show you the manual method.

Find the IP of the AP (You can easily grab this by looking at old controller OR using advanced IP Scanner. Note: match MAC address if scanning)

Putty into the AP (Launch Putty type IP, and Username/Password is factory ubnt/ubnt)
- set-inform http://ip-of-controller:8080/inform
Adopt AP in new controller webpage
- Type AGAIN: set-inform http://ip-of-controller:8080/inform

We are now done moving Unifi access point on to the new Controller, and as a result, will be in the device list. From here you will be able to manage it, upgrade firmware, and do all the configuration options needed.

How to choose DNS Server by benchmarking them

Thu, 09 Mar 2017 17:35:18 GMT

By default, your DNS Server is set to your ISP’s DNS and this SLOWS down your internet, due to the fact, they are poorly managed and have horrid performance. This shows you how to choose the fastest DNS Server, but results will vary depending on the location. Running this benchmark will tell you which ones are the best to use.

Finding the Fastest

Go to https://www.grc.com/dns/benchmark.htm and download the benchmark tool. From the list make sure you put in all your DNS Servers you want to test. Level3, Google, OpenDNS, and the usual suspects are already in there. I also recommend right-clicking and removing the dead or stale DNS Server. I tossed in free DNS Filtering servers like Norton ConnectSafe and Comodo Secure DNS as well. These performed the worst in speed tests and I recommend not using them in a business environment. If you need DNS filtering and have the budget using OpenDNS (Cisco Umbrella) is going to be your best bet.

Here are my results, Enjoy!

Red = Cached Time, Green = Uncached Time, and Blue = dotcom Time
Grey Dots = Filters bad domain names by default, Green Dots = No filtering

Updating LDAP Credentials for Netscaler VPX 1000

Sat, 12 Nov 2016 15:13:18 GMT

This article shows you how to update LDAP credentials on the Netscaler VPX 1000. It goes over logging in, editing virtual server, and applying settings.

Login to the NetScaler Device

Default User: nsroot Pass: nsroot (or password you changed it to)

Go to Netscaler gateway virtual server controlling your logins

Click on LDAP Policy and select Edit Server

Update the credentials under connection settings, and also test the new settings

Encore Bandit II/III Connection Instructions

Thu, 17 Mar 2016 14:52:31 GMT

These steps will show you how to connect to the encore bandit devices. I recently configured both a bandit II and a bandit III device for using a VPN over satellite. The devices are configured through a 9-pin serial port they call the “Supervisory Port”. I use a basic serial to USB adapter and putty to connect. All the white papers for this device are good, but the setup and login are not as clear as you would think, that said, below are the following steps I used to connect. Refer to Encore's BANDIT II/III Expanded Configuration Guide for the complete device documentation.

Steps for connection

Hook Serial Adapter to your PC Please Note the COM port
Run Putty and select Serial for Connection
Type default username and password (encore!1) for both
Configure Device according to Quick Setup

Ideas

Wed, 14 Nov 2012 00:00:00 GMT

Current Ideas for Videos and Articles

[ ] ZFS, couple that with Sanoid and Syncoid
[ ] Tiling Window Manager for Windows - https://github.com/LGUG2Z/komorebi
[ ] TrueNAS Scale
[ ] Hyprland Window Manager for Wayland - https://github.com/hyprwm/Hyprland
[ ] Setting Up Linux Gaming
[ ] Live Stream Radio Browser Program (Strimio)
[ ] DSTask - https://github.com/naggie/dstask
[ ] Portainer.io
[ ] PiKVM (https://pikvm.org/)https://pikvm.org/
[ ] KVM / QEMU full tutorial
[ ] Zerotier - BestVPN
[ ] Darling - MacOS Emulation https://www.darlinghq.org/
[ ] plex server setup linux
[ ] Enable GPO in Win 10 Home https://www.itechtics.com/enable-gpedit-windows-10-home/#Method_1_Enable_Group_Policy_Editor_in_Windows_10_Home_using_GPEdit_Installer
[ ] automount drives systemd
[ ] rEFInd Bootloader
[ ] snapdrop.net - Share files between devices
[ ] WinGet and Windows Terminal
[ ] https://mycroft.ai - Open Source Home Assistant
[ ] Samba Advanced Video
[ ] Github config save
[ ] systemd-services on startup cleanup
[ ] debtap install deb packages on arch - rpm2cpio - alien
[ ] https://github.com/dreamer/luxtorpeda/ - Gaming native
[ ] OpenHABian
[ ] Startup Programs and managing them
[ ] Live USB Environments
[ ] jellyfin
[ ] Adding Android Libraries / Davik Virtualization
[ ] Quibble Windows Bootloader - https://github.com/maharmstone/quibble
[ ] Kodachi
[ ] Linux Users and Groups
[ ] Grafana Zabbix Monitoring
[ ] Alienvault OSSIM
[ ] resize filesystem
[ ] URXVT
[ ] Ranger
[ ] Vagrant
[ ] Arch CHROOT Repair
[ ] alpine linux - The 100MB Linux
[ ] Kubernetes Initial Setup
[ ] DEX Linux
[ ] Making a workstation to load images on PCs - FOG Project
[ ] Linux Screen Command
[ ] Firejail
[ ] Chroot from USB drive
[ ] Debloat Linux
[ ] Linux Firewall - UFW
[ ] Privacytools.io
[ ] Add SSD or Hard Drive to VM
[ ] pulse effects and pulse equalizer
[ ] PxE and TFTP Servers
[ ] Update MOTD for on Servers
[ ] Using the grep command
[ ] LAMP Stack on Ubuntu
[ ] SMB4k
[ ] Docker
[ ] Redhat Line of Products (Insights / Ansible / OpenShift)
[ ] Snaps and Flatpacks

networking | Chris Titus Tech

Best NFS Network Drive Settings for Linux

Quick Comparison: Basic vs Tuned

Basic fstab entry

Tuned fstab entry (example)

What changes?

Option-by-Option Breakdown

nfsvers=4.1

bg

hard

nofail

noatime

rsize=1048576

wsize=1048576

timeo=600

retrans=5

x-systemd.automount

x-systemd.mount-timeout=90

_netdev

Final 0 0

Is the Tuned Line Always Better?

Practical Recommended Profiles

1) Balanced desktop/laptop

2) Throughput-focused LAN workstation

3) Minimal and safe

Verify What Is Actually Active

Official Documentation Sources

Final Thoughts

Securing Your Network: A Comprehensive Guide to Checking and Enhancing Network Security

Basic Network Scan

Windows Scan

Linux Scan

Check for Outside Addresses

Find what is Running on the Open Ports

Securing a Network

Routers

Firewall

3rd Party Firewall Software

VPN

Check Devices on Your Network

Closing Thoughts

Walkthrough Video

Prioritize Ipv4 Over Ipv6 Linux

Setting /etc/gai.conf

Verify ipv4 priority

VPN Tier List 2024

Why Use a VPN?

Corporate VPNs and the Big Tech Companies

The Best VPNs

Final Tier List

Walkthrough Video

Drivers in Windows

What is Driver Store Explorer?

Key Features

Getting Started

Practical Applications

Alternative Driver Management Tools

Conclusion

Walkthrough Video

Remove Youtube Shorts

Blocklist

Walkthrough Video

5 Essential Terminal Utilities

TLDR

CMatrix

Trash-CLI

Autojump

Progress

Walkthrough Video

How I Setup My Website

The Workflow and Overview

The Setup

Usage and First Steps

Your First Modifications

Complex Theme Modifications

Walkthrough Video

Macos on Linux

Requirements

Installation Preparation

Installation Media

`nfsvers=4.1`

`bg`

`hard`

`nofail`

`noatime`

`rsize=1048576`

`wsize=1048576`

`timeo=600`

`retrans=5`

`x-systemd.automount`

`x-systemd.mount-timeout=90`

`_netdev`

Final `0 0`