Recent content by Frazze

+1 pfSense And instead of RAID-6 you might really want to use RAID-10 instead, I suppose the HP server will have a RAID card that can do RAID-10 if you already have RAID-6. It's much faster performance-wise especially as you want to run a all those different things (db, medical app, storage) on...

I don't think this is possible in a _reasonable_ way with Proxmox. BUT you should take a look at Valve Steams new inhouse streaming feature. It allows you to only need one powerfull PC where all the 'hardcore' GPU/CPU work is done and then the picture of that can be streamed to your TV, to other...

What I think is important is to install fail2ban and add the Proxmox VE Webinterface to be monitored by fail2ban to stop bruteforce password attacks. Install fail2ban and add the following to the config: /etc/fail2ban/jail.local: ##### PROXMOX2: START###### [proxmox2] enabled = true port =...

It's not Firefox selecting the wrong cipher, its just that they think they know better then me what ciphers should used, but thats stupid. If I use Chrome for the same cipher string I posted earlier Chrome goes with the following cipher: AES_128_GCM with DHE_RSA key-exchange & authentification...

Hehe, the problem with fixing it the client side is, there is no way so far to do it in any of the major browsers :). You would have to limit your Firefox to only allow the same cipher suites you would want to use on your Proxmox site for ALL the sites you will visit with your browser. Which of...

here was written crap... sry

I think its better as an option, who knows what strange browsers people use. Maybe make it default on, but as an option imho.

Well you have know it - that's my I posted it here so you can decide and if needed take proper actions :) Any plans regarding the "SSLHonorCipherOrder" idea?

I posted links why it should be required. type "BREACH ssl" into google and see .... Ye well, its a website, in real day usage no one cares and no one can tell the difference if the page sends 140kb (uncompressed) or 40kb (compressed), there should be an option to torn it on or off, it would...

Well, I don't know exactly, that's why I brought this up so you can check for yourself. BUT I know for sure that if you disable http compression you remove the whole problem with all possible scenario. I also don't see the need fpr gzip http compression, it's mostly useless on the webinterface...

Well, there is PoC Code in the wild, I haven't tested it though, like here from the researchers of the BREACH problem: https://github.com/nealharris/BREACH And here the "official" site explaining it a bit: http://breachattack.com/ There is also a part explaining how praticial it is on the site...

Sorry for bringing this thread up again, but I think aside from the already requested "SSLHonorCipherOrder" option we need one more option which is even more important as the Proxmox VE Webinterface currently maybe is vulnerable to the "BREACH" attack (similar to the "CRIME" exploit you already...

Has there been any update on the SSLHonorCipherOrder [ on ] part? So one can enforce a certain ciphers order which should be used? This is an important feature IMHO to force "stupid" browsers (which all seem to be, testet with IE, firefox, chrome) to use the best possible cipher the server has...

Haha yeah, but I am sure Proxmox team doesn't just take RedHat kernel unmodified?

yes, I know, that's why I am writing in this thread, to get some attention by proxmox developers. drivers build on 2.6.32-23-pve, but not on 2.6.32-24-pve anymore, that's the exact problem and it would be nice if developers could take a look at this because r8169 is very well known to make...