• 2 Posts
  • 28 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle




  • Thanks, the Jonsbo N1 actually has five hotswap bays, and I believe you can squeeze in another 3.5" besides the PSU if you have a small PSU. I’ll consider the N3 but I don’t think it will fit where I have my current NAS so I’ll have to replan a bit.

    Yes, I’m thinking about either getting a PCIE SAS HBA to open up the option for SAS drives, or to get an ASM1166 M.2 to 6xSATA.

    You’re right that I’ve focused too much on ECC, I think I’ll see it as nice to have more than something I’d prefer to have.


  • You’re right, I probably don’t need ECC. I’m mostly worried about bit flips in my important data, and as you say, a checksumming FS and RAID will protect against this while the data is in storage. However, it doesn’t protect against bit flips while copying data, for example copying data to backups - but there are other solutions for this, which I should consider.

    Hot swap is nice to have. I haven’t even considered that it wouldn’t be supported by a mobo, I should look into that, thanks. These are the mobos I’m considering for each option:

    N100: Topton N100 motherboard, 4x2.5G, 6xSATA, PCIE x1 https://a.aliexpress.com/_EvVv0k6

    8500G: ASRock B650I Lightning WiFi (Gigabyte A620I AX might be an option, but it has only one M.2 slot so the upgradeability is less)

    13100: ASRock Z790M-ITX Wifi

    The N100 option is cheaper and should be lower power, but as you say I worry about needing another upgrade in a year or so, and this option doesn’t offer much upgradeability so that would mean at least a new mobo and cpu. The other options could accommodate a beefier CPU if needed.


  • Yeah, old Xeons tend to not be very low power, also I don’t think I’ll be able to find one with a mini ITX board to fit it in a compact case. Also, I’d probably need to add a discrete GPU, which adds to the cost and power consumption.

    I want a low power build to limit heat and noise produced in my office room, to limit the electricity bill and as I understood it the case I’m considering also doesn’t have the best thermals, so I don’t want to put a CPU with too high a TDP into it.

    The ReadyNAS 626 actually has a Xeon D-1521, but with a quite low TDP - 45W.

    Regarding budget, I’m aiming for 400-800$. The N100 option, including case and PSU (but not disks) is at the lower end of this, while the 8500G and 13100 options are at the upper end.



  • Ah, so they don’t actually say that they read kernel space. They check the version of all installed packages and checksum the installed DLLs/SOs.

    If the user still has root privileges, this may still not prevent sideloading of kernel modules. Even if it would detect a kernel module that has been sideloaded, I believe it’s possible to write a kernel module that will still be resident after you unload it. This kernel module can then basically do anything without the knowledge of userspace. It could for example easily replace any code running in userspace, and their anticheat would miss that as it doesn’t actually check what code is currently running. Most simply, code could be injected that skips the anticheat.

    Of course, in their model, if a user isn’t given root privileges it seems much harder to do anything, then probably the first thing you’d want to look for is a privilege escalation attack to obtain root privileges. This might not be that hard if they for example run Xorg as it isn’t known to be the most secure - there’s a reason there’s a strong recommendation to not run any graphical UI on servers.

    Another way if you don’t have root is to simply run the code on a system that does but that does have such a kernel module - or perhaps modify the binary itself to skip the anticheat. I don’t see anything preventing that in their scheme.


  • I’m having a hard time understanding how this would work. udev will load kernel modules depending on your hardware, and these modules run in kernel space. Is there an assumption that a kernel module can’t cheat? Or do they have a checksum for each possible kernel module that can be loaded?

    Also, how do they read the kernel space code? Userspace can’t do this afaik. Do they load a custom kernel module to do this? Who says it can’t just be replaced with a module that returns the “right” checksum?