checked on my phone, there are a few system users with !* as their password, from what i can tell ! blocks all logins and is not bypassed by this exploit, but their shell is set to /sbin/nologin anyways.

The default firewall rules of nura block ssh from mobile data, so only wifi and usb connections would be affected if at all.

Everyone should disable ssh password auth anyways, using the phones often short pin for ssh is not secure.

mitsubishi’s ac/heat pumps, that have a cn105 connector (the connector is on each indoor unit; it should also work for the water tank indoor unit) can be integrated with esphome, but you have to connect each indoor unit seperatly. If you run jysty cable from each indoor unit to a central point you can use 1 esp32 for 2 indoor units. From my experience it works very well, but i have my esp on wired ethernet.

I don’t have the water heater indoor unit, so that’s part of my air indoor unit esphome config:

logger:
  baud_rate: 0

external_components:
  - source: github://echavet/MitsubishiCN105ESPHome
    refresh: 0s

climate:
  - platform: cn105
    id: hvac_eg
    name: "HVAC EG"

    horizontal_vane_select:
      icon: 'mdi:arrow-left-right'
      name: EG Horizontal Vane
    vertical_vane_select:
      icon: 'mdi:arrow-up-down'
      name: EG Vertical Vane

    supports:
      fan_mode: ["AUTO", "DIFFUSE", "LOW", "MEDIUM", "HIGH"]
      swing_mode: ["OFF", "VERTICAL", "HORIZONTAL", "BOTH"]

    uart_id: hvac_eg_uart

    update_interval: 500ms

sensor:
  - platform: uptime
    name: Uptime

uart:
  - id: hvac_eg_uart
    rx_pin: 5
    tx_pin: 17
    baud_rate: 2400

it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password

thats what I meant. I was referring to setting PasswordAuthentication to no in the sshd_config.

just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

You could use a different homeserver like tuwunel (a conduit fork), which is wayy easier to setup than the official one.

Does it show up as an interface in ip a? If it doesn’t it usually means, that you don’t have drivers for it / the drivers aren’t in mainline, but sometimes it’s the usb role switching of the phone being stuck in peripheral mode (a reboot with the adapter plugged in usually fixes it).

Depending on what you want to do with the phone and how permanent the connection is, an alternative method would be to connect it to the router with a usb cable. Enable the usb debug connection on in pmbootstrap when building the image (it might be possible to do this on the phone too) and set up routing on the router and add an ip address and a default route to the debug interface on the phone, it should behave as if it were a normal network card (but with a dhcp server running on it).

I’m sorry I didn’t read that you posted on this before before finishing this, I’m way too tired qwq

These prices are terrible, even for Europe.

You can basically do it like luks does, but encrypting the files separately with gocryptfs, but like with all file encryption, you’re leaking directory structure.

The performance drop from virtualizing nics shouldn’t be nearly as big. How are you passing the vlans to the VM? are you passing all over one virtio nic or one virtio nic for each.

The setup I ran for multiple years was basicly a bridge interface on the host for each vlan and a seperate virtio nic to the opnsense VM for each, I got almost 10 gbit/s like that with 8gigs of ram for opnsense and 4 or 8 cores (I cant remember) with hyperthreading of a 2nd gen epyc. I didn’t do any optimisations for virtio.