RyanZhang's Blog

2025 Year in Review

Sat, 14 Feb 2026 12:29:00 GMT

Ideally, this summary should have been written on January 1st, 2026.

However, at that time, I was in Melbourne, Australia, enjoying a short but much-needed vacation.

The sunshine, the sprawling lawns, and the unfamiliar yet quiet rhythm of the city made it hard to settle down and reflect on the past year. During those few days, I only managed to squeeze in some updates for my inspection tool, Sunchha (https://sunchha.bytesycn.com), and shared a brief introduction on my WeChat official account. The engagement was unexpectedly high, and I am deeply grateful for everyone’s attention and recognition.

Wechat：把巡检交给机器——Sunchha网络设备巡检工具

Since I missed the New Year's Day summary, I decided to save it for the Lunar New Year.

Today is the last working day of the Year of the Snake. I am still at my desk, watching colleagues and friends head off for their holidays early. I feel a hint of envy, but as an engineer, once you choose this path, you must accept its reality—staying at the post is often the norm, not the exception.

From Internship to Professional Identity

Graduating in July 2024, I stepped out of campus like many others—filled with a mix of idealism and passion.

Perhaps because the job market for my major was relatively stable, I had internships before graduating and smoothly transitioned into a role that genuinely interested me. My mentors recognized my potential and offered me more opportunities. Naturally, I began taking on many tasks that were technically beyond my original scope of responsibility.

At the time, I seemed to thrive on that feeling of being "needed."

I still remember a network upgrade project during my internship. For a whole week, we started working at 6 PM right after the regular shift and continued until 10 PM. We replaced every single switch across a five-story office building. The decommissioned Cisco switches were piled so high they almost matched my height.

Was it hard?

I didn't think so—because it was a field I loved. Passion offsets exhaustion.

Transitioning from Networking to Security

After officially joining the workforce, I shifted from the Datacom (Data Communications) field I touched during my internship to becoming a Security Service Engineer.

From late 2024 through the first half of 2025, I was involved in a diverse range of security service projects: Penetration Testing, Code Auditing, Risk Assessment, Major Event Support, Red/Blue Teaming (Attack & Defense Drills), Incident Response, and Phishing Simulations.

I evolved from relying on off-the-shelf tools to writing my own functional modules, building phishing systems, and streamlining information gathering workflows.

While my technical skills grew, the more significant lesson was learning how to communicate with different stakeholders. Some client engineers are technically solid and highly efficient, while others require more patient explanations.

I began to realize that while technical skill is the foundation, communication is a mandatory discipline for an engineer. Even now, I feel there is still much room for improvement.

First Encounter with Large-Scale Private Clouds

In the latter half of 2025, I began working on security and operations for large-scale Private Clouds.

I started from scratch, learning cloud operations and workflows, eventually managing projects like cloud data sanitization. It was a year of rapid growth across multiple domains.

Yet, it was also the year where it felt hardest to stay motivated.

Promises were made and repeatedly unfulfilled, while the workload only increased. In the current economic climate, people often throw around the cynical meme: "If you won't do it, plenty of others will." Perhaps there’s a grain of truth in that, but when effort goes unrecognized for too long, you start to ask: What is the point of persisting?

Eventually, I came to a realization:

It’s not about stopping the effort or "lying flat"—it’s about redirecting that effort toward a direction that truly belongs to you.

Do your job well, but also look for the sky where you truly belong.

Re-examining the Self

I remember a mentor during my internship telling me he hoped that by the time I graduated, I would have a two-page resume filled with solid project experience.

But upon graduation, my resume was still very "clean."

I don't like listing things I only have a superficial understanding of, nor am I willing to exaggerate my abilities. Perhaps this is the most basic tenet of being an engineer: seeking truth from facts. I used to look down on resumes that were fluffed up with buzzwords despite minimal actual knowledge.

By the second half of 2025, I reorganized my experience. I included the projects I truly participated in, was responsible for, and deeply understood. Today, I can finally present a resume that meets my former mentor's expectations—without a drop of "water" (exaggeration).

During the same period, I started focusing on my website and WeChat account. If the knowledge and experience I share can help even a few people, then it’s all worth it.

In this era of rapid AI evolution, human learning speed will likely never catch up with the pace of model iteration.

But don't forget—everything AI learns originates from the real experiences, sincere sharing, and continuous creativity left by humans on the internet.

So, keep writing. Even if it’s slow, as long as it’s authentic, it has value.

A Few Days in Melbourne

At the end of 2025, a senior family member fell ill. According to traditional Chinese values, I shouldn't have traveled far. However, knowing my job was about to change and such an opportunity might not come again, I booked the flight. Three days after the surgery, I flew to Melbourne.

I stayed for six days, which was perhaps the happiest time of my 2025.

I visited the University of Melbourne and took a photo in front of the Old Engineering Building.

During those days, I kept thinking: As engineers, we should use technology to create value, not drown in repetitive labor. Instead of passively reacting to problems, we should actively create tools.

It was in those Melbourne mornings and evenings that I became more determined to refine my inspection system and develop more practical tool platforms.

In the past, the barrier to entry for these things was high. But now, with CodeX, Claude, various AI coding assistants, and automated frameworks, the ecosystem is maturing.

The world is moving much faster than we imagine.

The Boundaries of Work

The most important thing I learned in 2025 wasn't a specific technology, but rather:

Facing my own shortcomings, acknowledging my limitations, and growing within my boundaries.

One shouldn't endlessly hoard tasks; everyone needs personal space.

Technology is a career, but it shouldn't be the entirety of one's life.

Looking Ahead to the Year of the Horse

2025 was a year of growth, anxiety, exhaustion, and distant horizons.

If I were to summarize this year:

Having experienced so much, I still love being an engineer, but I've realized it's time to start growing for myself.

Wishing everyone a Happy New Year for 2026, the Year of the Horse. May your families be happy, and may your paths be smooth and safe.

How to Conduct a Phishing Simulation Exercise

Fri, 19 Dec 2025 18:30:00 GMT

Under the premise of legal authorization, phishing simulations are a vital means of assessing an organization's security awareness and defensive capabilities. This article systematically outlines the methodology and practical approach for a standardized, safe, and controlled phishing exercise conducted in 2025, covering information gathering, attack surface analysis, site cloning, platform selection, and data collection.

Legal Disclaimer

The content of this article is intended solely for legal and compliant cybersecurity learning, research, and the enhancement of defensive capabilities. All operations, examples, and technical methods are strictly limited to environments where explicit authorization has been obtained, including but not limited to personal assets, owned systems, lab environments, or target systems with written consent.

It is strictly forbidden to use any techniques discussed herein for unauthorized penetration testing, malicious attacks, data theft, actual phishing, system disruption, or any other illegal activities.

The user assumes all legal liabilities, financial losses, and other consequences arising from the violation of laws or the use of these techniques beyond the scope of authorization. The author and the publishing platform assume no responsibility or association with such actions.

If you cannot confirm whether the target environment is authorized, please cease all related operations immediately.

Types of Phishing

Social Phishing

Attackers reach out to target employees via commonly used social platforms (IM tools, social media, etc.), impersonating colleagues, partners, or trusted entities. They induce victims to click malicious links, visit fraudulent pages, or download malicious attachments. This type of phishing relies on trust relationships, fabricated emergencies, or incentives. It is highly stealthy and deceptive, often resulting in account compromise or endpoint infection before the victim can verify the sender's identity.

Email Phishing (Spear Phishing)

Email phishing is the most prevalent form of social engineering. Attackers send emails disguised as official notifications, business correspondence, financial statements, system alerts, or HR documents. These emails are often highly sophisticated, mimicking real business templates, writing styles, and sender addresses. They often leverage time sensitivity (e.g., "Urgent Action Required" or "Account Suspension Imminent") to bypass the victim's vigilance.

How to Execute a Phishing Simulation

In professional security services, phishing exercises evaluate an organization’s resilience against social engineering. Since clients may not always provide a complete user list, the process must begin with Attack Surface Analysis.

I. Information Gathering (Attack Surface Analysis)

Without relying on internal client data, one can utilize Open Source Intelligence (OSINT) to analyze the organization's public exposure:

(1) Search Engines & Public Records

Search for entity names, public notices, press releases, and official websites to identify:

Publicly exposed email addresses (e.g., info@, hr@).
Contact numbers and duty desk lines.
Combinations of employee names, titles, and contact info.

(2) Corporate Intelligence Platforms

Using platforms like D&B, Crunchbase, or local corporate registries to assess:

Publicly registered contact details.
Contact persons listed in bidding and tender announcements.
Partner and supply chain relationships (potential lateral risk).

(3) Recruitment & Professional Networks

Job boards and professional social networks often inadvertently expose:

HR/IT/Administrative roles.
Organizational structures and department names.
Employee work email naming conventions (e.g., firstname.lastname@company.com).

Site Cloning & Content Risk Assessment

A key question in security drills is: Can employees identify a "high-fidelity" fraudulent page? The focus is not on the "how-to" of cloning, but on:

Domain Recognition: Can users spot a typo-squatted domain?
Email Security Policies: Are SPF, DKIM, and DMARC enforced?
Environmental Cues: Do employees notice abnormal redirects, SSL certificate warnings, or URL discrepancies?

Developing Phishing Pages/Software

In 2025, cloning web pages is technically trivial. One of the simplest ways to mimic an application or portal is by saving the webpage directly via the browser (Ctrl+S).

However, this method often only saves the primary HTML. CSS, JavaScript, and images often still point to the original site or a third-party CDN. Common issues with this "simple" approach include:

Resource loading failures due to relative paths.
CORS (Cross-Origin Resource Sharing) policies on the original site blocking assets (403 Forbidden).
Broken layouts and non-functional interactive features.

Therefore, a proper clone requires downloading all dependencies locally and correcting reference paths to ensure the page renders correctly in an isolated environment.

Phishing Platforms

Once the target list and cloned pages are ready, you need a data collection and management platform. Mature open-source tools like Gophish are widely used.

However, off-the-shelf platforms often have limitations:

Inability to export raw malicious URLs for manual delivery.
Rigid data fields or collection logic.
Limited customization for complex workflows.

For highly customized or sophisticated simulations, developers often perform secondary development on existing platforms or build lightweight, proprietary collection systems. Technically, a web-based simulation is simply the recording and analysis of HTTP request behaviors and data flow.

Sample Collection Code (Go)

The following is a lightweight collector implemented in Go using the Gin framework. It handles UUID-based victim identification and logs data to a local file.

package main

import (
	"encoding/json"
	"fmt"
	"net"
	"net/http"
	"os"
	"strings"
	"time"

	"github.com/gin-gonic/gin"
)

// LoginRequest defines the expected JSON structure
type LoginRequest struct {
	Username  string `json:"username" binding:"required"`
	Password  string `json:"password" binding:"required"`
	Timestamp int64  `json:"timestamp" binding:"required"`
	UUID      string `json:"uuid" binding:"required"`
}

const fixedAuthBase64 = "mysecretkey"

// isMobileUA detects mobile devices based on User-Agent
func isMobileUA(ua string) bool {
	ua = strings.ToLower(ua)
	mobileKeywords := []string{"android", "iphone", "ipod", "ipad", "windows phone", "mobile"}
	for _, kw := range mobileKeywords {
		if strings.Contains(ua, kw) {
			return true
		}
	}
	return false
}

func main() {
	r := gin.Default()
	r.LoadHTMLGlob("templates/*")

	r.GET("/page/:uuid", func(c *gin.Context) {
		uuid := c.Param("uuid")
		userAgent := c.Request.UserAgent()
		isMobile := isMobileUA(userAgent)
		templateName := "desktop.html"
		if isMobile {
			templateName = "mobile.html"
		}
		c.HTML(http.StatusOK, templateName, gin.H{"UUID": uuid})
	})

	r.POST("/api/user", loginHandler)
	r.Run(":30494")
}

func loginHandler(c *gin.Context) {
	// 1. Auth Header Validation
	if c.GetHeader("Auth") != fixedAuthBase64 {
		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "Unauthorized"})
		return
	}

	// 2. Parse Request Body
	var req LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "Invalid Body"})
		return
	}

	// 3. Metadata Collection
	clientIP := getClientIP(c.Request)
	userAgent := c.Request.UserAgent()
	serverTime := time.Now().Format(time.RFC3339)

	// 4. Log Construction
	requestBody, _ := json.MarshalIndent(req, "", "  ")
	logEntry := fmt.Sprintf(
		"===== Request Log =====\nIP: %s\nUA: %s\nTime: %s\nBody:%s\n========================\n\n",
		clientIP, userAgent, serverTime, string(requestBody),
	)

	// 5. File Persistence
	_ = appendToLogFile("./api_logs.txt", logEntry)

	c.JSON(http.StatusOK, gin.H{"code": 200, "message": "Logged successfully"})
}

func getClientIP(r *http.Request) string {
	forwardedFor := r.Header.Get("X-Forwarded-For")
	if forwardedFor != "" {
		ips := strings.Split(forwardedFor, ",")
		return strings.TrimSpace(ips[0])
	}
	ip, _, _ := net.SplitHostPort(r.RemoteAddr)
	return ip
}

func appendToLogFile(filePath, content string) error {
	file, err := os.OpenFile(filePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
	if err != nil {
		return err
	}
	defer file.Close()
	_, err = file.WriteString(content)
	return err
}
}

(Cybersecurity Tools Vol.2) testssl — Comprehensive SSL/TLS Security Testing for Your Site

Mon, 15 Dec 2025 18:00:00 GMT

If you have visited my homepage, you likely know that I am currently a cybersecurity professional.

During recent vulnerability scanning and security hardening tasks, I observed that a significant number of high-frequency vulnerabilities are concentrated in SSL/TLS configurations. These issues include weak cipher suites, deprecated protocol versions, and incomplete certificate chains.

Such issues present two challenges: high manual verification costs and low efficiency, as re-verifying a fix often requires re-running a full vulnerability scan.

To address this, I have integrated testssl.sh into my workflow for rapid, comprehensive, and repeatable SSL/TLS configuration audits.

About testssl.sh

testssl.shis an open-source SSL/TLS security auditing tool designed to evaluate the security configuration of a server at the TLS layer. Key assessment areas include:

Supported SSL/TLS protocol versions.
Security and strength of Cipher Suites.
Common TLS vulnerabilities (e.g., BEAST, POODLE, Heartbleed, etc.).
Certificate validity and Chain of Trust integrity.
Compliance with mainstream security best practices.

The tool does not require any agent deployment on the target server. It is executed locally as a script, making it ideal for security testing, routine inspections, and remediation verification.

Common Commands

1. Outputting SSL/TLS Compliance Results to Console

Suitable for quick troubleshooting of site TLS configuration issues. Results are streamed directly to the terminal:

./testssl.sh -p bytesycn.cn

Parameter Explanation:

-p: Displays the protocols and port information supported by the target.
The tool targets port 443 by default.

2. Generating an HTML Report (Recommended)

In professional environments, generating an HTML report is highly recommended for documentation, comparing "before and after" remediation states, or as evidence for security audits.

./testssl.sh --warnings=batch --html bytesycn.cn

Parameter Explanation:

--warnings=batch: Displays warnings in batch mode to avoid interactive interruptions.
--html: Generates a full security audit report in HTML format.

📄 检测报告示例： bytesycn.cn testssl Audit Report Demo

Usage Best Practices

Run testssl both before and after TLS configuration hardening to compare changes.
Use this tool in conjunction with adjustments to Nginx/Apache SSL configurations for optimal results.
Integrate it into daily security inspections or CI/CD pipelines for periodic automated testing.

Summary

testssl.sh is a lightweight, professional, and highly practical SSL/TLS security auditing tool, specifically suited for:

Cybersecurity Practitioners
Operations / SRE Engineers
Personal Site Owners with high security requirements

If you find yourself repeatedly dealing with TLS vulnerability remediation, adding testssl to your toolkit will save you significant time and effort.

🔗 Related Links:

[1] testssl Project Repository: https://github.com/testssl/testssl.sh

[2] testssl Official Website: https://testssl.sh

From Zero to Production:An Engineer's Journal on Building a Mini-IDC

Mon, 17 Nov 2025 22:55:26 GMT

Disclaimer: This article is for technical sharing purposes only and does not involve any illegal activities.

I’ve wanted to write this for a long time but couldn't find a window in my schedule. This year, some friends and I transformed a self-built house in a small rural town into a "Pseudo-IDC." From server racks and dedicated AC units to enterprise broadband and UPS backups, we’ve got it all. It may not be a Tier 4 facility, but it looks more professional than many SME server rooms. It has been running stably for over half a year.

If you are looking to build your own "homelab-turned-IDC," let's exchange ideas—maybe I can help you skip a few pitfalls.

Ground Rules (The "Shield" Section)

Do not use residential broadband for PCDN or for-profit traffic hosting.

Do not use the network for any unauthorized Penetration Testing or attacks.

Secure your devices to prevent them from becoming Jump Servers for attackers.

The first rule is the ISP's bottom line; the latter two are to keep you on the right side of the law.

Remember: Cybersecurity is built by and for the people—there is no such thing as a small security oversight.

Requirement Analysis

"Data Center" is an abstract term. A Linux box in your bedroom is a data center; a row of 42U racks is also a data center. Our project is a "Pseudo-IDC" positioned in the middle, featuring:

Redundant Network Outbound
Sufficient Compute & Storage Resources
Remote Office Nodes
7×24 Availability

Current assets: Rack, AC, UPS, and Enterprise Broadband—a complete basic ecosystem.

Build Process

1. Server Infrastructure

Our fleet consists entirely of decommissioned Dell PowerEdge servers. Dell is the choice for a reason: as a global giant, their hardware is cost-effective and documentation is easily accessible. We previously tried the Huawei 2288Hv3—which was even cheaper—but Huawei’s documentation is restricted to authorized partners, making it "wild-IDC-unfriendly."

Example Node Configuration:

CPU: 2 × Intel Xeon E5-2680 v4 (2.4GHz, 14C/28T)
RAM: 320GB DDR4 2133MHz REG ECC
Storage: 6 × 4TB SAS
Networking: 4 × 10Gbps SFP+

2. Internal Network (Intranet)

Apart from the Out-of-Band (OOB) Management which still uses 1Gbps RJ45, all other links have been upgraded to OM3 Multi-mode Fiber. With dual-port Link Aggregation (LACP), we hit a theoretical throughput of 20Gbps. For storage nodes, we utilized 40Gbps QSFP links. We initially planned for RoCE (RDMA over Converged Ethernet), but during debugging, we found our core switch would crash whenever Jumbo Frames were enabled. We’ve reverted to standard iSCSI for now.

Core Switch: Cisco Nexus 3000 (N3K) Series

48 × 10Gbps SFP+
4 × 40Gbps QSFP

Nearly half the ports are occupied. We used a mix of Intel SFP+ modules sourced second-hand—definitely a "budget" vibe, but as long as the packets flow, we’re happy.

3. Network Outbound

Static Public IPv4 addresses are a rare commodity in residential settings.

China Telecom: Offers dynamic IPv4 with the best quality, but expensive.
China Unicom: Offers dynamic IPv4 at a reasonable price.
China Mobile: Massive "Carrier-Grade NAT" (but cheap/free).

Luckily, my friend’s family business provided an Enterprise Line (300Mbps Up / 1000Mbps Down), with residential broadband as a backup. For remote access, we use DDNS (via the open-source ddns-go). Compared to writing custom scripts back in 2018, the ecosystem has truly evolved.

4. Remote Connectivity: VPN Tunnels

Since the facility is nearly 100km away, 24/7 on-site presence is impossible. We established several encrypted tunnels for remote management. This setup involves Network Topology, VPN Protocols, Port Forwarding, and SDN (Software-Defined Networking). I’ll write a dedicated deep-dive tutorial on this later.

Currently, the IDC supports:

Automated daily backups for my Cloud VPS.
Off-site data synchronization for my home NAS.
Multiple Database instances.
Local Code Repositories (Git).
Remote Desktop for work.

Monitoring & Operations

The "Wild IDC" is now largely automated. Environmental Monitoring: We leverage the Xiaomi/Mi Home ecosystem (Temperature, Humidity, Power, and Cameras). It’s surprisingly robust for the price.

Server Monitoring: We migrated from Zabbix to Beszel. Zabbix was too "heavy" for a non-professional data center. For network uptime, I wrote a small heartbeat script that pushes alerts via Feishu (Lark) webhooks if the link drops.

Overall, we’ve pieced together a stable and maintainable monitoring system at minimal cost.

End

🫶 The reason for doing this is simple: Passion drives everything. As for the future, perhaps this passion will quietly bloom into something even more practical.

Weekend Getaway in Kinmen

Mon, 03 Nov 2025 19:56:12 GMT

I had planned to visit Kinmen for a long time. Early this year, I had my travel permits and endorsements ready, but a few demanding projects kept me tied down. I procrastinated until the endorsements eventually expired.

One day in September, on a sudden whim, I drove to Wutong Ferry Terminal to renew them. After all, Kinmen is only a 20-minute ferry ride from Xiamen—so close it feels like a "distant land" just across a river. I managed to snag a standby ticket during the National Day holiday and finally set off. I intended to have a "Zen-like" relaxed trip, but the moment I stepped onto the island, my "lone wolf" persona reverted right back to "Special Forces" mode (intensive sightseeing).

Since I didn’t take the earliest ferry, it was already noon by the time I dropped my luggage at the guesthouse. A colleague once warned me: "In Kinmen, arrive on the earliest boat and leave on the last." I did book the last return ferry, but if I had chosen the earliest arrival, I probably would have had to wake up at 3 or 4 AM to pack.

Following the guesthouse owner's recommendation, my first meal was the local Kinmen beef noodles, followed by 50 Lan bubble tea and Monga fried chicken—all staples of the local food scene.

In the past, I rarely sat down for proper meals while traveling. I was like a photographer on a deadline, "checking off" one destination after another. Whether in Wuhan, Changsha, or Japan, I was merely an executor on a "scenic spot assembly line." It wasn't until last year in Dotonbori, Osaka, while waiting two hours in line for a bowl of ramen, that it finally clicked:

Travel shouldn't just be about the scenery; it should be about the flavors, the tempo, and becoming a part of the local life.

The first day was a textbook "Special Forces" itinerary: Chen Jinglan Western-style House → Ever Rich Duty Free → Livestock Research Institute → Juguang Tower → Model Street. It was non-stop.

I had seen a cute little otter plushie on Xiaohongshu and wanted to buy one as a backpack charm for my sister. I scoured several shops on Model Street that evening, but they were all out of stock—the only minor regret of the trip.

At night, the streets of Kinmen were nearly deserted; the sound of the wind replaced the chatter of people. Looking across the water, the CBD of Guanyinshan in Xiamen was brilliantly lit. It’s hard not to feel the weight of the contrast, but looking at this quiet little island, I thought to myself: the people in Kinmen must have their own kind of happiness.

The wind at night was so strong it made the windows rattle incessantly. I barely slept. At 5 AM, I simply got up, hopped on an electric scooter, and rode to the nearest FamilyMart. I ordered a coffee and sat by the window. That moment reminded me of a scene from last autumn, watching fallen leaves outside a Starbucks near the Kyoto Kaikan. I realized then that "unplugging" feels exactly like this—the moment your heart finds stillness in the early morning of a foreign place.

On the second day, I visited National Quemoy University, Shuitou Village, and the Kinmen Bridge. I’ve noticed a habit of mine—whenever I visit a city, I always wander through the local university. Wuhan University, Hunan University, Kyoto University... perhaps we long most for what we feel we lack.

Around 10 AM, while standing by the Kinmen Bridge, I received a call from the guesthouse owner. He told me that ferry services would be suspended after 2:30 PM due to weather.

I had a ticket for the very last boat, so I had to rush back to the pier immediately to try my luck. When I got back to the guesthouse, the staff was already packed and ready to escort me to the pier, but I was still waiting for the owner to return with two bottles of his private-label Kinmen Kaoliang liquor.

When the owner finally arrived, he laughed and said, "You’re really something! The staff was ready to take you away, and here you are still waiting for me to bring the booze."

In the end, thanks to the help of a lady staying at the same guesthouse who was also heading back to Xiamen, I successfully secured a standby spot on an earlier ferry. If I hadn't made it, I might have been stranded in Kinmen for another three or four days.

The trip to Kinmen was actually two weeks ago. My procrastination kicked in late, but the memories remain fresh. After working for so long on various projects and reports, even a brief escape is a form of healing.

Whether it’s a high-intensity "Special Forces" trek or a "Zen-like" slow life, the meaning of travel likely lies in this: allowing yourself to temporarily step out of the inertia of daily life and take a breath of fresh air.

Work is a necessity, but so is living.

PS: More photos of Kinmen are available in my Moments section.

(Cybersecurity Training Vol.1)Security in the Era of Artificial Intelligence

Mon, 03 Nov 2025 12:53:38 GMT

Training is a vital component of cybersecurity. I have accumulated numerous training presentations over the years, reflecting both my professional output and my personal technical pursuits.</br> I firmly believe in the philosophy: "Knowledge originates from practice but reaches excellence through sharing." Information should not be hidden away; only open exchange can drive the collective progress of both individuals and the industry. Therefore, I have decided to launch this series to share my original presentation decks, with the hope of facilitating your professional development.</br> I also invite you to join this initiative: if you have materials (such as PDFs, PPTs, or Word documents) that you are willing to share, please reach out via the WeChat Official Account or email listed at the end of this article. It would be an honor to feature your content here as we build an open-access knowledge base together.

I. PPT Preview

II. Download Links

PDF Version: https://oss-southeast-1.bytesycn.com/files/cyber-security/documents/b15c1d41-64a5-4466-82ed-ae72f36c99eb.pdf

Information Leakage — A Responsibility Software Vendors Must Shoulder

Thu, 16 Oct 2025 19:15:56 GMT

In my experience conducting penetration tests, I’ve observed an awkward phenomenon.

Vulnerabilities leading to information leakage have become almost commonplace. It’s as if an application doesn't feel "legitimately launched" these days unless it has a few data exposure issues under its belt.

However, why must information leakage—a problem that should theoretically be mitigated during the development phase—always wait until a system is in production to be discovered?

During university, we churned out one course project after another, transitioning from C to Java and then to Python. Eventually, I realized that the essence of all software boils down to CRUD operations (Create, Read, Update, Delete) on a database.

The only real difference between a programmer and an average user is that one interacts with a dry SQL console and JSON interfaces, while the other clicks a mouse on a polished Graphical User Interface (GUI).

For many "pseudo-programmers" in college, seeing passwords transmitted in plaintext or ID numbers hardcoded into scripts was business as usual.

Security? Hardly anyone mentioned it. The guiding principle was: "As long as it runs, it’s fine."

Privacy vs. Convenience: The Famous Paradox

Years ago, a certain CEO made a controversial statement:

"Chinese people are more open about privacy. If they can exchange privacy for convenience, safety, or efficiency, they are often willing to do so."

There is some truth to this, but it is equally tragic.

Two or three years ago, while I was still a student, the local police station near my university required us to register for anti-fraud information. To my shock, the link provided led to a site using HTTP (Plaintext Transmission) without SSL encryption—yet the form required sensitive data like ID numbers.

In other words, had I submitted that data over the campus network, any administrator with access to network probes could have intercepted my sensitive information in cleartext.

In a fit of professional indignation, I called the 12345 government service hotline to complain. A few days later, the police station called me back and asked, "How do you think we should fix this? You’re the expert here."

I realized then that many grassroots organizations don't understand technology; they are merely "completing a task," not "building a system."

Consequently, the burden of information leakage ultimately falls back on the programmers.

The Blurred Boundaries of Privacy

In today's digital landscape, registering an account is nearly impossible without a phone number and real-name authentication. Once a leak occurs, your personal identity is often exposed alongside your mobile number. "Doxing" or precision geolocation via a phone number is no longer news.

Many opt for "secondary SIMs" to mitigate risk, but even with the limit of five cards per person, it’s far from enough. If a software requires an ID upload, you can't exactly ask the police for "a few extra identities."

Yet, it is the weight of the law that compels internet service providers to act this way.

The Ministry of Industry and Information Technology (MIIT) requires all websites providing services within China to be filed (ICP Filing). The core purpose is traceability—ensuring that if a problem arises, a specific accountable person can be found. This necessitates real-name systems. From this perspective, software vendors have their hands tied. This is especially true for open forums; you can never predict when a user might post inappropriate content. If the individual cannot be found, the legal liability falls solely on the site operator.

This is precisely why I do not open the comments section on my own blog. It’s not a lack of desire for dialogue, but a choice for security and compliance—reducing risk for myself.

At this point, many ask:

"Isn't an IP address the ID card of the internet? Why do you need personal info if you have the IP?"

While technically true, the total pool of IPv4 addresses is capped at roughly 4.2 billion. They cannot be mapped one-to-one to every user. Because of NAT (Network Address Translation), a single IP often hides hundreds or thousands of devices. Finding a specific person via an IP is like looking for a needle in a haystack. Real-name authentication provides far superior precision.

Furthermore—Data is Wealth.

E-commerce platforms track every click; short-video apps record every second you linger. This behavioral data forms your "User Persona." Algorithms push content based on these preferences to keep you consuming.

The more data they harvest, the greater the profit.

The more data they harvest, the greater the profit.

Why Does Information Leakage Persist?

In my view, there are two fundamental reasons:

1. Data is an Asset: Vendors Want it, but Won't Protect it

Data is used for profiling, analysis, and risk control. Many vendors simply dump data into databases in plaintext—no de-identification, no encryption, sometimes even using default passwords. Large corporations generally care about their reputation, but smaller vendors? There are no guarantees.

2. Weak Security Awareness Among Developers

Many small enterprises prefer fresh graduates—they are inexpensive and compliant. However, many Software Engineering programs have historically lacked systematic cybersecurity curricula. Students prioritize "making it work" over "making it secure." When this habit follows them into the workplace, vulnerabilities are inevitable. Furthermore, when veteran programmers move into management with a "we’ve always done it this way" mindset, they dismiss security proposals as "unnecessary"—until a breach actually happens.

Let the Law be the Baseline for Security

The ultimate solution to information leakage isn't relying on penetration testing to "patch the holes" after the fact. It requires changing the source: Awareness and Accountability.

If security awareness cannot be raised voluntarily, it must be enforced by law.

If there is a violation, there must be a penalty. A fine once is a lesson learned forever.

As the legal scholar Luo Xiang famously said:

"The law is the baseline of morality."

Similarly, the law should be the baseline of security.

Final Thoughts

In recent years, as policies have improved, apps that excessively demand user data and permissions have been delisted. The implementation of centralized digital IDs is a sign of a maturing regulatory system. I hope that one day, enterprises will be truly constrained by law, so that "low-level vulnerabilities" like information leakage disappear entirely from penetration testing reports.

✍️ 最后也欢迎关注我的微信公众号

(Cybersecurity Tools Vol.1) Kscan — A High-Performance Golang Security Scanner

Tue, 14 Oct 2025 01:02:38 GMT

Preface

The [Cybersecurity Tools Series] aims to showcase powerful, user-friendly open-source security tools and provide rapid implementation guides. Please ensure you have explicit authorization or are operating within a sandboxed lab environment before using this tool. Unauthorized security testing may violate local laws; use at your own risk.

TL;DR

Kscan is a lightweight security scanner written in Go. It supports port scanning, fingerprinting, automated brute-forcing, and network segment discovery. With output support for CSV/JSON, it is ideal for rapid asset discovery and weak credential auditing (authorized scenarios only). This article covers quick setup, common commands, usage recommendations, and performance/security considerations.

About Kscan

Kscan is a Golang-based scanner designed for high concurrency and lightweight operations. Its primary use cases include: Asset Discovery (ports/services), HTTP Fingerprinting, Service Vitality Detection, and Automated Brute-forcing (integrated with Hydra). Results can be exported to CSV or JSON for reporting or further data processing.

Project Repository

GitHub: https://github.com/lcvvvv/kscan
License: GPL-3.0

Core Features at a Glance

Port Scanning: Single port, port ranges, or Top N ports.
Fingerprinting: HTTP banner grabbing and service protocol identification.
Network Segment Discovery: Active discovery of intranet segments via the --spy mode.
Automated Brute-forcing: Integrated Hydra engine supporting multiple protocols.
Data Export: CSV and JSON formats compatible with professional delivery standards.

Use Cases

Rapid mapping of security assets (Attack Surface Enumeration).
Categorization of external service fingerprints (Web, Databases, common protocols).
Authorized weak credential testing and auditing.

Quick Installation

Prerequisite: Go environment must be installed.

git clone https://github.com/lcvvvv/kscan.git
cd kscan
go build -o kscan ./cmd/kscan
# Alternatively, use the pre-compiled binary from the GitHub Releases page.

Command Reference

Below are the most frequently used options with brief descriptions:

usage: kscan [-h,--help,--fofa-syntax] (-t,--target,-f,--fofa,--spy) [options]

Core Options:
  -t, --target    Specify target: Single IP, IP range, URL, or file (file:/path)
  -f, --fofa      Fetch targets from FOFA (requires FOFA_EMAIL, FOFA_KEY)
  --spy           Network segment discovery mode (auto-detects internal segments)
  -p, --port      Specify port(s) or range; defaults to Top 400
  -o, --output    Save results to file (CSV supported)
  -oJ             Save results in JSON format
  --proxy         Use proxy (socks5|socks4|http|https)://IP:Port
  --threads       Thread count; default 100, max 2048
  --timeout       Timeout duration (in seconds)
  --hydra         Enable automated brute-forcing (requires --hydra-user/--hydra-pass)
  -Pn             Skip smart vitality detection (slower but more exhaustive)
  -sV             Enable full-probe detection for open ports (Impacts efficiency; use with caution)

Hydra Integration:

  --hydra-user    Username (supports file:username.txt)
  --hydra-pass    Password (supports file:password.txt)
  --hydra-update  Append custom dictionaries to default dictionaries
  --hydra-mod     Restrict brute-force modules (e.g., rdp, ssh, ftp)

Usage Examples (Recommended Syntax)

Asset Mapping (Full Port Scan, CSV Output):

kscan -t targets.txt -p 1-65535 -o output.csv

Credential Auditing (Using custom dictionaries appended to defaults):

kscan -t targets.txt -p 1-65535 --hydra --hydra-user file:user.txt --hydra-pass file:pass.txt --hydra-update -o output.csv

Network Reachability Discovery (Auto-detecting standard A/B/C private segments):

kscan --spy all -o output.csv

High-Concurrency Rapid Scan:

kscan -t 198.51.100.0/24 -p 80,443 --threads 500 -oJ output.json

Best Practices & Performance Optimization

Concurrency & Resources: Increasing --threads boosts speed but consumes more bandwidth and target/local resources. Monitor CPU and network stability; avoid extreme values unless necessary.
Timeout Configuration: For unstable networks, increase --timeout to prevent false negatives in service vitality.
Minimizing False Positives: Before running large-scale fingerprinting with --check, test on a small subset to observe response patterns.
Brute-force Strategy: Only perform credential testing within authorized scopes. Limit the rate and use --hydra-mod to avoid triggering lockouts or alarms.
Data Post-processing: JSON exports are ideal for integration with tools like ELK, Pandas, or Splunk for visualization.

常见问题（FAQ）

Q：如何仅扫描常见端口？ A：使用 --top 参数，例如 --top 100 扫描TOP100常见端口。

Q：如何关闭 CDN 识别？ A：加参数 -Dn（注意：关闭后可能会对大规模扫描效率产生影响）。

Q：如何提升 Web 指纹识别精度？ A：使用 -sV 做全探针探测，但这会显著减慢扫描速度，适合深度确认时使用。

FAQ

Q: How do I scan only common ports? A: Use the --top parameter, e.g., --top 100 for the most common 100 ports.

Q: How do I disable CDN identification? A: Add the -Dn flag (Note: this may impact the efficiency of large-scale scans).

Q: How can I improve the accuracy of Web fingerprinting? A: Use -sV for full-probe detection. Note that this significantly slows down the scan and is best suited for deep confirmation.

Risk & Compliance Warning (Crucial)

You must use Kscan's scanning and brute-forcing features only under explicit authorization. Scanning or brute-forcing unauthorized targets may constitute a criminal offense. This site assumes no liability for illegal usage.

Conclusion

Kscan is a lightweight, efficient asset discovery tool perfectly suited for rapid mapping and weak credential auditing in authorized environments. When combined with appropriate dictionaries, rate-limiting, and post-processing tools (CSV/JSON), it delivers actionable asset lists and vulnerability insights in a very short timeframe.

Journal-Upgrading My NAS (Network Attached Storage)

Sun, 12 Oct 2025 00:09:11 GMT

Preface

This article is a repost of my original piece on Zhihu, published on March 17, 2022.

My original NAS ran Xpenology. I encountered an issue where the DSM web interface would completely freeze during heavy I/O operations across two hard drives. I decided to switch to TrueNAS (partly to create a new project for myself). Given that TrueNAS relies on the ZFS file system, which benefits significantly from ECC (Error Correction Code) memory to prevent "silent data corruption," I realized my existing Athlon 200GE and A320 motherboard were incompatible. Thus, the upgrade began.

Specifications

Pre-Upgrade Configuration

Component	Model
Motherboard	Colorful A320M-K "Broken Sword"
CPU	AMD Athlon 200GE
Memory	ADATA DDR4 2133 16GB (8GB * 2)
Boot Drive	SanDisk Cruzer Fit 32GB
PSU	Segotep GP600 500W (Full Modular)
Chassis	Invasion X-1 (6-Bay)
NIC (10G)	Mellanox ConnectX-3 10GSFP*2 PCIx4

Post-Upgrade Configuration

Component	Model
Motherboard	ASRock B550M-Pro4
CPU	AMD Athlon 200GE
Memory	Samsung DDR4 2133 ECC 32GB (16GB * 2)
Boot Drive	Intel Optane M10 16GB
PSU	Supermicro 480W Platinum (Modified 1U PSU)
Chassis	Tuopulong NAS-08 (8-Bay, 2022 Revised Edition)
NIC (10G)	Mellanox ConnectX-3 Dual-Port 10G SFP+ (PCIe x8)

Component Selection Logic

About TrueNAS

Selecting the right hardware for TrueNAS is critical. ZFS uses system RAM as a high-speed cache (ARC), making ECC memory essential for mission-critical data integrity. Finding a consumer-grade motherboard that actually supports ECC proved difficult.

Many manufacturers claim ECC support, but it often only means they can "accept" ECC modules in "non-ECC mode." After extensive research, ASRock and ASUS emerged as the best options for true ECC compatibility on consumer platforms. I chose the ASRock B550M-Pro4 because it supports unbuffered ECC memory, offers 6 native SATA ports, dual M.2 slots, and two PCIe x16 slots (one being PCIe 4.0). I sourced a used unit for around 3xx RMB, as new units were significantly more expensive.

Regarding the CPU: the standard Athlon 200GE does not support ECC. However, the PRO series (OEM units) does. I opted for the Athlon Gold Pro 3150G (4C/4T). While these are technically OEM-only parts, they are readily available as "pulls" on the second-hand market.

Old Hardware

New Hardware

Crucial 1TB Cache SSD, Intel Optane 16GB Boot Drive, and the AMD Athlon Gold Pro 3150G.
Micron DDR4 2133MHz 16GB ECC Memory.
Motherboard I/O Shield and ports.
Verification: AIDA64 confirming that ECC is active and functional.

Storage Configuration

I initially configured a RAID-Z array using three 4TB drives, plus one standalone drive. A Crucial 1TB SSD serves as the L2ARC (Cache).

Array Drives: 2x Western Digital (WD40PURX) and 1x Seagate (ST4000VX000). These are all CMR (Conventional Magnetic Recording) drives.
Standalone Drive: Toshiba P300 (SMR - Shingled Magnetic Recording). Due to the performance penalties of SMR in RAID environments, this drive is relegated to running PT (Private Tracker) downloads individually. Pro-Tip: Avoid using drives from the exact same production batch in a single array. If there is a manufacturing defect, they might fail simultaneously—a true "data crematorium."

TrueNAS Environment

Currently, I am running one CentOS VM and about 8-10 Docker containers. Even with 16GB of RAM, the system is nearly at capacity. I am waiting for the second 16GB module to arrive, which should provide much-needed breathing room for the ZFS ARC.

To be continued...

Farewell to Chaos:I Developed a Cable Label Formatting Tool

Wed, 08 Oct 2025 17:39:32 GMT

As a "Jack-of-all-trades" engineer, my career began in network engineering. Although my current primary focus is cybersecurity, I am still frequently dispatched by my company to data centers (DC) for implementation tasks. Consequently, I’ve seen my fair share of data centers...

A brand-new DC is almost perfect upon completion — tidy cabling, standardized layouts, and a sight that brings joy to any visiting supervisor. However, as an organization grows, new equipment is inevitably added. The problem is that these incremental implementations are often handled by different contractors, leading to inconsistent craftsmanship and standards.

Take the most fundamental element: cable labels. Some contractors, seeking shortcuts, skip labeling entirely—as long as the link is up and the network pings, they vanish. While that might feel "efficient" during implementation, it digs a massive hole for future maintenance personnel. At best, you might find a vague label that just says "OOB Management" (Out-of-Band). In a DC with dozens or hundreds of devices, which specific machine is this cable managing?

Therefore, I believe that unifying label formats is an absolute necessity. Any operation involving cabling must be synchronized with proper labeling. This is not just a responsibility to oneself, but a mark of respect for fellow engineers. My advice is simple: Don't be that guy.

However, the reality is that every cable has two ends. How can we generate standardized labels quickly and efficiently? In today’s high-pressure environment, technical prowess is vital, but boosting your efficiency is what truly sets you apart from the crowd.

To solve the issues of efficiency and standardization in cable labeling, I developed a small script in my spare time. Given its size, calling it a "tool" might be a bit of an overstatement. Initially, it was just a command-line script. However, when a college classmate asked to use it recently, I realized that requiring a CLI environment for every run was quite cumbersome. So, I had AI help me draft a frontend interface (admittedly, frontend work is a bit of a headache for me) and deployed it as a web application. Of course, if you prefer local deployment, the full source code is available on GitHub.

Introduction: Cable-Label Tool

This is a straightforward cable label formatting tool designed to quickly generate standardized, unified labels by uploading Excel data.

Online Access

Link: Cable Label Formatting Tool - bytesycn

Access Note: The online service is currently restricted to IP addresses within China (including Hong Kong, Macau, and Taiwan). For security reasons, access from international IPs will be intercepted by Tencent EdgeOne.

Output Sample

Local Deployment

If you prefer to deploy and use it locally, you can access the project's GitHub repository for the source code.

GitHub：https://github.com/hz157/cable-label

git clone https://github.com/hz157/cable-label.git

Instructions

Download Template: Obtain the standard Excel template file first.
Fill in Data: Enter the device information for both ends of the cable and the cable's function into the template.
Upload File: Upload the completed Excel file to the tool page.
Select Style: Choose one of the 9 preset label styles.

I hope this tool helps more engineers suffering from "cable chaos" and helps make our data centers tidier and more standardized!

When MinIO Web Console Vanishes, CLI is King:A Beginner's Guide to mc

Wed, 08 Oct 2025 16:11:32 GMT

MinIO, the open-source object storage giant, has drastically removed the core code of its Web Management Console in community releases following version 20250524. With approximately 110,000 lines of code stripped away, the community is in an uproar, accusing MinIO of "burning bridges"—reaping the benefits of open source only to pull the plug on its most accessible features. As I’ve been developing a private project utilizing MinIO recently, I’ve had to rely on AI and documentation to master the basic commands. Since the Web UI is gone, understanding mc is now essential for permission control and general management. Consider this a guide born out of necessity.

Developer Backlash

What is mc?

Don’t be mistaken—this mc isn't about mining blocks in Minecraft. It stands for MinIO Client. This is the official, incredibly powerful command-line tool and the primary way to interact with a MinIO server. You can install it easily through several methods.

安装

Direct Binary Download (Recommended)

# Download mc for Linux amd64
wget https://dl.min.io/client/mc/release/linux-amd64/mc
# Grant execution permissions
chmod +x mc
# Move to a system PATH directory (e.g., /usr/local/bin/) for global access
sudo mv mc /usr/local/bin/

Docker Installation

# Pull the mc Docker image
docker pull minio/mc
# Run a temporary container to execute a command (e.g., listing a bucket)
docker run minio/mc ls myminio

Command Guide

For a full list of all mc commands, refer to the official documentation. This section covers the most common and critical operations.

Running mc --help displays all available commands. Here are the core categories:

alias      Manage server aliases (configures connection info)
  admin      Manage MinIO servers (users, policies, config, etc.)
  ...        ...
  ls         List buckets and objects
  mb         Make bucket
  cp         Copy objects
  mv         Move/Rename objects
  rm         Remove objects
  cat        Display object content
  head       Display first part of an object
  pipe       Stream from STDIN to an object
  put        Upload local files to a bucket
  mirror     Synchronize local directories to remote buckets (Powerful sync tool)
  du         Summarize disk usage
  diff       Compare differences between two buckets
  find       Search for objects
  ...        ... (Other important commands: policy, user, config, event, ilm, etc.)

Essential Commands Detail

Alias Management

Setting a Connection (alias):

mc alias set ALIAS HOST ACCESSKEY SECRETKEY
# Example: Connecting to a local MinIO instance
mc alias set myminio http://localhost:9000 minioadmin minioadmin

List all configured aliases:

mc alias list

Remove an existing alias:

mc alias remove ALIAS

Administration (admin)

Check Server Information:

mc admin info ALIAS
# Example: Check status for myminio
mc admin info myminio

User Management:

# Add a user
mc admin user add ALIAS ACCESSKEY SECRETKEY
# Example: Add user AK:test SK:123456 to myminio
mc admin user add myminio test 123456

# Disable a user
mc admin user disable ALIAS USERNAME

# Enable a user
mc admin user enable ALIAS USERNAME

# View user info
mc admin user info ALIAS USERNAME

# List all users
mc admin user ls ALIAS

# Remove a user
mc admin user rm ALIAS USERNAME

PBAC (Policy-Based Access Control) Management:

# Create a policy
mc admin policy create ALIAS POLICYNAME POLICYPATH
# Example: Create "listmybuckets" policy using a local JSON file
mc admin policy create myminio listmybuckets /tmp/listmybuckets.json

# Attach an IAM policy to a MinIO user or group
mc admin policy attach ALIAS POLICY [POLICY...] [--user USER | --group GROUP]
# Example: Bind the "listmybuckets" policy to user "test" on myminio
mc admin policy attach myminio listmybuckets test

# List all policies
mc admin policy ls ALIAS

# View policy details
mc admin policy info ALIAS POLICYNAME

# List entities (users/groups) associated with a policy
mc admin policy entities ALIAS [--user value] [--group value] [--policy value]

# Delete a policy
mc admin policy rm ALIAS POLICYNAME

OpenSSH Security Upgrade Guide:Detailed Online and Offline Solutions

Wed, 24 Sep 2025 21:11:41 GMT

Critical Warnings

Before performing an OpenSSH upgrade in any production environment, you MUST prepare a rollback plan. This includes, but is not limited to: VM snapshots, VM cloning, or documenting executed commands for manual reversion.

Prerequisites

OpenSSL (May be omitted if the current version is compatible)
OpenSSH Source Package

Upgrade Procedures

Online upgrades via package managers are generally straightforward. However, for offline compilation, ensure your current SSH session remains active. If the connection is severed during the process, you will be unable to establish a new SSH session until the upgrade is complete, necessitating the use of Telnet or VNC—methods that significantly increase the difficulty of recovery.

1. Online Environment

Upgrading in a connected environment is relatively simple. While you can use package managers like apt, dnf, or yum, these repositories often lag behind the latest releases. To install the latest version, manual compilation from source is still required.

Ubuntu/Debian

# Update package index
sudo apt update
# Check for upgradable OpenSSH versions (Optional)
apt list --upgradable openssh-*
# Upgrade OpenSSH client and server
sudo apt install --only-upgrade openssh-client openssh-server
# Restart SSH service
sudo systemctl restart sshd
# Verify service status and port listening
sudo systemctl status sshd
sudo netstat -tunlp | grep :22

RHEL7/CentOS7

# Check for available updates
sudo yum check-update
# Upgrade OpenSSH components
sudo yum update openssh openssh-server openssh-clients
# Restart and verify service
sudo systemctl restart sshd
sudo netstat -tunlp | grep :22

RHEL8/CentOS8+/RockyLinux9+

# Refresh repository metadata
sudo dnf makecache
# Upgrade SSH components
sudo dnf upgrade openssh openssh-server openssh-clients
# Reload and verify service
sudo systemctl reload sshd
sudo netstat -tunlp | grep :22

2. Isolated Environment (Offline)

Important Recommendations

Recommended versions (as of September 2025):

OpenSSL: 1.1.1w or 3.x (depending on OS compatibility)
OpenSSH: 10.0p1 or later

Download links are provided at the end of this article.

Pre-upgrade Preparation

# Create a dedicated workspace
mkdir /opt/ssh_upgrade && cd /opt/ssh_upgrade

# Secure backup of existing configurations and binaries
cp -a /etc/ssh /etc/ssh_backup_$(date +%F)
cp -a /etc/init.d/sshd /etc/init.d/sshd_backup
cp -a /usr/bin/openssl /usr/bin/openssl_backup
cp -a /etc/pam.d/sshd /etc/pam.d/sshd_backup

# Backup critical library dependencies
ldd $(which sshd) | awk 'NF == 4 {print $3}' | xargs -I {} cp -a {} /opt/lib_backup/

Uninstall Legacy OpenSSH Service

# For Yum-based systems
yum -y remove openssh openssh-server openssh-clients openssh-askpass
# Alternative for RPM
rpm -e --nodeps openssh openssh-server openssh-clients
# For Apt-based systems
apt purge -y openssh-server openssh-client

Install OpenSSL (Optional)

Omit this step if your current OpenSSL version meets the requirements of the new OpenSSH version.

tar -zxvf openssl-3.2.4.tar.gz
cd openssl-3.2.4

# Optimize compilation parameters
./config --prefix=/usr/local/openssl \
         --openssldir=/usr/local/openssl \
         shared zlib -Wl,-rpath=/usr/local/openssl/lib

make && make install

# Update symbolic links
ln -sf /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -sf /usr/local/openssl/include/openssl /usr/include/openssl

# Refresh library cache
echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf
ldconfig -v | grep -i openssl

# Verify version
openssl version -a

Install OpenSSH

tar -zxvf openssh-10.6p1.tar.gz
cd openssh-10.6p1

# Configure with necessary modules (PAM and Zlib support)
./configure --prefix=/usr \
            --sysconfdir=/etc/ssh \
            --with-ssl-dir=/usr/local/openssl \
            --with-pam \
            --with-zlib

make -j$(nproc)
make install

# Verify binary compatibility and version
ldd /usr/sbin/sshd
ssh -V

Modify sshd Configuration

vi /etc/ssh/sshd_config

# Ensure the following critical configurations are set
Port 22
ListenAddress 0.0.0.0
PermitRootLogin prohibit-password
PasswordAuthentication yes
UsePAM yes

Start the Service

systemctl start sshd
# Verify if the service is running correctly
systemctl status sshd

🔗 Related Links

[1] Alibaba Cloud OpenSSH Mirror:: https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable

[2] OpenSSL: https://www.openssl.org/source

Multiplayer Gaming Guide:Building a Virtual LAN with N2N

Thu, 11 Sep 2025 00:11:32 GMT

EasyN2N (also known as 'Little Yellow Duck') is a virtual networking tool specifically optimized for multiplayer gaming. Theoretically, N2N supports any game that allows LAN-based multiplayer. According to data from Bugxia, successfully tested titles include: the CS series, Red Alert 2/3, StarCraft, Warcraft III, DOTA, ARK: Survival Evolved, Civilization VI, Stellaris, Meteor Butterfly Sword, Human: Fall Flat, Worms, Left 4 Dead 1 & 2, Minecraft, Torchlight 2, and Age of Empires II.

Client Download

EasyN2N (N2N Launcher) v3.1.2

Server-Side Installation Guide

Manual Installation

# For Ubuntu, Debian, etc.
apt-get install libzstd -y
wget https://github.com/ntop/n2n/releases/download/3.0/n2n-3.0.0-1038.x86_64.rpm
rpm -i n2n-3.0.0-1038.x86_64.rpm
# Run supernode: Listen on port 9527, define IP range, run in foreground
supernode -p 9527 -a 192.168.255.0-192.168.255.0/24 -f

# For CentOS, OpenEuler, RockyLinux, etc.
yum install libzstd -y
wget https://github.com/ntop/n2n/releases/download/3.0/n2n-3.0.0-1038.x86_64.rpm
rpm -i n2n-3.0.0-1038.x86_64.rpm
supernode -p 9527 -a 192.168.255.0-192.168.255.0/24 -f

One-Click Installation Script

I have developed an automation script to simplify the deployment. Execute the following command:

wget https://script.bytesycn.com/p2p/n2n-install.sh && chmod +x n2n-server.sh && ./n2n-server.sh

Verification

Use the netstat -tunlp command to verify if the program is actively listening on port 9527.

N2N Client Usage Tutorial

After launching the software, enter the IP address and port of your N2N Server. Since DHCP (Auto-IP Assignment) has been configured on the server side, you can leave the Virtual IP field blank. Alternatively, you can manually assign an IP within the same subnet (requires basic networking knowledge). Ensure the Group Name is identical for all participants; think of the Group Name as a "Room Number"—entering the same name puts everyone in the same virtual space.

Launch EasyN2N.
nter the Supernode IP and Port (e.g., 43.163.81.102:9527).
Leave the Virtual IP blank (as DHCP is enabled) or set a static IP within the subnet.
Set a unique Group Name (shared with your friends).
Click the Start button.

Once the server status displays a green checkmark and the Virtual IP is successfully assigned, the connection is established.

Once connected, you can enjoy a low-latency, virtual LAN gaming experience.

Important Notes

Firewall Settings: If using a Cloud VPS, ensure the OS firewall (iptables/firewalld) is disabled or configured to allow the N2N port. You must also open the port in the cloud provider's Security Group (the script uses 9527/TCP & UDP).
Consistency: Ensure all clients use the exact same Group Name.
Latency: Choose a server location that is geographically central to all players to minimize Latency and Jitter.

Security Inspection Headache? Here’s the Ultimate High-Risk Port & Forbidden File Upload Checklist!

Wed, 03 Sep 2025 21:00:15 GMT

Does the mere mention of a major security audit or "heavy protection period" trigger anxiety? Unsure which ports to close or how to harden Web security? Don't panic. We’ve compiled the ultimate solution: a centralized summary of all high-risk ports and forbidden file extensions. This is the only reference guide you'll ever need.

I. Critical High-Risk Port Checklist

Core Principle: Attack Surface Reduction—if it’s not essential, shut it down.

While most modern firewalls utilize a "Default Deny" (Reject All) baseline, many administrators add an "Any-to-Any" permit rule at the top just to save time.

As an engineer who recently entered the field, I’ve seen this "shortcut" far too often.

Let's be clear: open policies might feel convenient now, but they lead to forensic nightmares later. Don't wait for a breach to regret your choices. We strongly recommend checking and closing the following ports immediately for public access.

1.1 Remote Access Ports

Port	Protocol	Purpose
22	TCP	SSH
23	TCP	TELNET
3389	TCP	RDP
5900-5904	TCP	VNC

Database Ports

1.2.1 Relational Databases (RDBMS)

Port	Protocol	Purpose
1433	TCP	Microsoft SQL
1521	TCP	Oracle DB
3306	TCP	MySQL/MariaDB
5432	TCP	PostgreSQL
50000	TCP	IBM DB2
5236	TCP	Dameng (DM)
54321	TCP	Kingbase
5866	TCP	HighGo
30100	TCP	GaussDB
2881-2882/2886	TCP	OceanBase

1.2.2 NoSQL Databases

Port	Protocol	Purpose
6379	TCP	Redis
27017/27018	TCP	MongoDB
9042	TCP	Cassandra
9200	TCP	Elasticsearch
5984	TCP	CouchDB
16000	TCP	HBase
8091	TCP	Couchbase
8086	TCP	InfluxDB
9042	TCP	ScyllaDB

1.2.3 Graph & Vector Databases

Port	Protocol	Purpose
7687	TCP	Neo4j
8529	TCP	ArangoDB
14240	TCP	TigerGraph
8080	TCP	DGraph

1.2.4 Database Management Tools

Port	Protocol	Purpose
80/443	TCP	phpMyAdmin
80/443	TCP	pgAdmin
80/443	TCP	Adminier
8080	TCP	Bytebase

1.3 File Sharing & Protocol Ports

Port	Protocol	Purpose
21	TCP	FTP
139/445	TCP	SMB
593	TCP	AFP
2049	TCP	NFS

1.4 Critical Middleware & Vulnerable Services

Port	Protocol	Purpose
135/136/137/138	TCP/UDP	Windows RPC
139/445	TCP/UDP	SMB
161	TCP/UDP	SNMP

1.5 Other Vulnerable Services

Port	Protocol	Purpose
8848	TCP	Nacos
3888/2181	TCP	Zookpeer
9001	TCP	Supervisor
7077	TCP	Spark
9092	TCP	Kafka
7001	TCP	WebLogic

II. Forbidden File Upload Extension Checklist

Weak file type validation is equivalent to handing over system execution privileges. The fundamental rule: Validate not just the extension, but also the file content (Magic Bytes) and MIME type.

2.1 System Executables & Scripts

Risk: These can execute commands directly on the server or client side; they are the highest risk category.

Windows: .exe, .msi, .com, .scr, .bat, .cmd, .ps1, .vbs, .vbe
Linux: .sh
Genera: .jar

2.2 Web Executable Scripts

Risk: If uploaded to a web directory, accessing these files triggers code execution, leading to a WebShell and total server compromise.

PHP: .php, .php3, .php4, .php5, .php6, .php7, .phtml, .phps, .phar
ASP.NET: .asp, .aspx, .asa, .asax, .ascx, .ashx, .asmx
JSP: .jsp, .jspx, .jspf
Other: .py, .pl, .cgi, .cfm, .cfml

2.3 Configuration & Exploitation Files

Risk: Used to overwrite configurations, leak info, or launch XSS/XXE attacks.

Apache: .htaccess (Can override server rules to execute arbitrary files).
Configs: .ini, .conf, .config：(May contain sensitive credentials).
Markup:
- .xml: Risk of XXE (XML External Entity) injection.
- .html, .htm, .svg：Can embed JavaScript for XSS attacks.

nwipe Tutorial:Secure Data Sanitization via Open-Source Tooling

Fri, 22 Aug 2025 23:33:13 GMT

I. What is nwipe?

nwipe [1] is an open-source command-line tool specifically designed to securely and thoroughly erase data from storage devices, including Hard Disk Drives (HDDs) and Solid State Drives (SSDs). It is a fork and the modernized successor of the well-known legacy tool DBAN (Darik's Boot and Nuke).

Its core objective is to ensure that original data cannot be recovered by any software or hardware forensic methods before disposing of, reselling, or recycling storage media. This is achieved by overwriting the disk with multiple passes of random or specific patterns, thereby protecting privacy and security.

Project Repository: https://github.com/martijnvanbrummelen/nwipe

II. Key Features of nwipe

Fully Free and Open Source: The transparent code allows for public auditing, ensuring no backdoors exist and making it a trusted tool for security-conscious users.

Support for Multiple Erasure Standards: It includes internationally recognized algorithms to meet various security compliance levels, such as: - DoD 5220.22-M: The U.S. Department of Defense standard (3 or 7 passes). - Gutmann: A classical method proposed by Peter Gutmann (35 passes). While effective for legacy hardware, it may be excessive for modern SSDs. - PRNG Stream: Uses a pseudo-random number generator for multiple overwrite passes (customizable). - Verify Only: A rapid mode that checks if sectors are readable without erasing them, useful for detecting bad sectors.

OS Independent: nwipe is typically integrated into various Live Linux Distributions (e.g., Parted Magic, SystemRescue) or can be made into a bootable USB drive. This allows it to run independently of the host OS, enabling the erasure of the system drive itself while bypassing file locks and permission issues.

Automation & Batch Processing: Supports command-line arguments, allowing for scripted automated batch erasure—ideal for data centers or environments handling large volumes of drives.

Detailed Logging & Reporting: Recent versions of nwipe generate comprehensive logs, including serial numbers, models, erasure methods, timestamps, and verification results (PASS/FAIL), which are crucial for audits and compliance.

Broad Hardware Compatibility: Supports storage devices connected via multiple interfaces, including SATA, SAS, PCIe/NVMe, and USB.

III. Installing nwipe

Prerequisites

A Linux-based OS (To wipe an entire device, it is recommended to use a Live OS via external media like a USB drive).
A computer or server capable of recognizing your drives (SAS, SATA, SSD, NVMe, etc.).

Step-by-Step Installation

Enter the OS: Any Linux distro works. For full-device erasure, I recommend SystemRescue [2], a Live OS for Linux recovery that comes pre-loaded with nwipe.
Package Manager Installation:

Note: Package managers might not provide the latest version. For PDF reporting, nwipe version ≥ 0.35 is required.

Package Manager Installation👇

# For Ubuntu/Debian:
apt-get update -y 
apt-get install nwipe -y

# For CentOS/OpenEuler/RockyLinux:
yum update -y
yum install install nwipe -y 

# dnf 
dnf update -y
dnf install install nwipe -y

Manual Compilation (For the latest version):

wget https://github.com/martijnvanbrummelen/nwipe/archive/refs/tags/v0.38.tar.gz
tar -xzf v0.38.tar.gz
cd nwipe-0.38/
./autogen.sh
./configure
make
sudo make install

Verify Installation: Run nwipe --version.

root@ubuntu:~# nwipe --version
nwipe version 0.38
root@ubuntu:~#

IV. How to Perform Data Destruction with nwipe

Demonstration conducted on a VMware Virtual Machine running Ubuntu Server.

Execute sudo nwipe to enter the ncurses-based interface.
Select Storage Media: Use Up/Down arrows to navigate and Space to select (the target will be marked as "wipe").

Press M to select the Erase Method. Use arrows and press Enter to confirm.

Press V to select the Verification Mode. By default, it verifies the last pass; you can disable this to increase speed.

Press S to start. As this is an irreversible operation, a security prompt will appear. You must press Shift + S (capital S) to initiate the wipe.

Once complete, press CTRL + C to exit. nwipe will generate a report in the current directory (v0.35+).

Finally, export the PDF report for your records.

🔗 Related Links:

[1] nwipe Project Repository: https://github.com/martijnvanbrummelen/nwipe

[2] systemrescue Official Website: https://www.system-rescue.org/

Data Sanitization:An Overview of Technologies and Standards

Tue, 19 Aug 2025 20:35:12 GMT

Data Sanitization refers to the process of completely erasing data from storage media through physical or logical means, rendering it unrecoverable to prevent sensitive information leakage. This technology is widely utilized by government agencies and enterprises across various carriers including HDDs, magnetic tapes, optical discs, and paper documents. The choice of sanitization method must strictly adhere to the medium type, storage principles, and data sensitivity level.

I. Storage Media: Principles and Characteristics

1. Hard Disk Drive (HDD)

Principle: Data is stored on magnetic tracks of spinning platters and read/written via magnetic heads.
Sanitization Challenges: Conventional deletion operations (e.g., OS file deletion) only remove file system metadata (like FAT tables or MFT records); the actual data remains on the tracks. Achieving irreversible erasure requires methods such as multiple-pass overwriting, degaussing, or physical destruction.
Recommended Methods: Multiple-pass overwriting, Degaussing, Physical shredding.

2. Solid State Drive (SSD) / NVMe Drive

Principle: Data is stored in NAND flash cells and managed by a controller using FTL (Flash Translation Layer) for read/write operations and wear leveling.
Sanitization Challenges:
- FTL Interference: Traditional overwriting is inefficient on SSDs. The FTL maps overwrite operations to new empty blocks, leaving original data blocks marked as "invalid" but not immediately erased until Garbage Collection occurs. This leads to data remanence.
- Lifetime Degradation: Flash cells have finite P/E (Program/Erase) Cycles. Excessive overwriting significantly shortens the SSD's lifespan.
Recommended Methods: Controller-based Secure Erase (SE) or Sanitize commands (e.g., ATA/NVMe standards). These reset all cells (including over-provisioned space) to factory defaults via internal discharge, ensuring data is unrecoverable with minimal wear. Physical destruction is also highly reliable.

II. Data Overwriting Standards (Mainly for HDD)

1. OnePass (Single Pass)

A single full-disk write of a fixed pattern (e.g., 0x00, 0xFF) or random data.

Pros: Fast.
Security: Low.
Use Case: Non-sensitive data requiring rapid clearance.

2. GA/T 1143-2014 (China)

Technical requirements for data destruction software products.

Single Pass: Same as OnePass.
3-Pass Method: 1st pass: Fixed character (e.g., 0x00); 2nd pass: Complement (e.g., 0xFF); 3rd pass: Random characters.
7-Pass Method: Alternates between fixed characters, complements, single-character patterns, and random characters across seven cycles.
Use Case: High-sensitivity data where maximum unrecoverability is required.

3. DoD 5220.22-M (USA)

The U.S. Department of Defense standard upon which most global standards are derived.

Short (3-Pass): 0x00, 0xFF, Random.
Standard (ECE/7-Pass): A more rigorous sequence including multiple passes of 0x00, 0xFF, and random data.
Security: Extremely high; designed to overcome the magnetic remanence effect.

4. IEEE Std 2883-2022

Requires at least two passes: Fixed character followed by its complement, with a verification step involving a random sampling of ≥5% of the addressable space.

Crucial Note: Multiple-pass standards (DoD, GA/T) are designed specifically for the physical characteristics of HDDs. They are not recommended for SSDs/NVMe drives due to FTL mechanisms, wear issues, and inefficiency compared to Secure Erase commands.

III. Data Sanitization Standards (Mainly for SSD)

NIST SP 800-88 Purge / Secure Erase (SE)

Principle: Sends specific instructions (e.g., NVMe Format NVM with Sanitize) to the controller. The controller resets the voltage levels of all NAND cells (including over-provisioned areas), returning the drive to its factory "out-of-box" state.
Advantages: - Thorough: Clears all physical blocks, including those hidden from the OS.
- Fast: Significantly faster than multi-pass overwriting.
- Low Wear: Minimal impact on P/E cycles.
Requirements: Requires hardware/firmware support. BIOS/UEFI or drive passwords must be disabled before execution.

IV. Common Data Sanitization Tools

AOMEI Partition Assistant Supported Standards: OnePass, DoD 5220.22-M, Gutmann (35-pass), etc.

Pros: User-friendly GUI.
Cons: Requires Windows or WinPE.

nwipe Supported Standards: Various patterns (DoD, Gutmann, etc.).

Pros: Open-source CLI tool for Linux Live environments; version 0.35+ supports generating PDF erasure - certificates for audit compliance.

DiskGenius

Pros: Reliable sector-level operations with a GUI.
Cons: Limited sanitization algorithms compared to specialized tools.

RAID/HBA Hardware Erase Utilizes the onboard processor of modern RAID or HBA cards to send erase commands directly to connected drives. It is OS-independent and efficient.

V. Summary and Recommendations

Medium Differentiation is Key: - HDD: Use multi-pass standards (GA/T 1143 3/7-pass, DoD 5220.22-M) or degaussing for sensitive data.

SSD/NVMe: Prioritize controller-based Secure Erase or Sanitize (NIST SP 800-88 Purge). Avoid multi-pass overwriting.

Ultimate Security: Physical shredding remains the "Gold Standard" for end-of-life media.
Verification: For high-compliance environments, use tools that support Erasure Verification (IEEE 2883) and generate Audit Certificates.

🔗 Standard Downloads: [1] GA/T 1143-2014 Standard: https://std.samr.gov.cn/hb/search/stdHBDetailed?id=8B1827F21EEBBB19E05397BE0A0AB44A

A Guide to Offline Security Appliance Updates:A Collection of Vendor Download Portals (Continuously Updated)

Sun, 20 Jul 2025 23:19:21 GMT

In practical O&M (Operations & Maintenance), many security appliances—such as firewalls, IDS/IPS, and Anti-DDoS systems—are deployed in intranet or air-gapped environments. These devices cannot directly connect to the internet to update signature databases or system patches; instead, offline update packages must be downloaded and imported manually. Since vendor download pages are often fragmented or difficult to locate (and frequently require authentication), I have compiled this list of offline update portals for major security vendors to simplify centralized discovery and maintenance. This content will be continuously updated—feel free to bookmark, share, or contribute.

🚀 Update Center Directory

Vendor	Offline Update Portal	Login Required	Last Updated
Huawei	https://isecurity.huawei.com/	✅	2025-07-20
Sangfor	https://support.sangfor.com.cn/	✅	2025-07-20
Nsfocus	https://update.nsfocus.com/	✅	2025-07-20
Hillstone	https://update1.hillstonenet.com/<br>https://update2.hillstonenet.com/<br>http://sec-cloud.hillstonenet.com/	✅	2025-07-20
Qianxin	https://ngfwup.sg.qianxin.com/offline/download/	✅	2025-07-20
Venustech	https://venustech.download.venuscloud.cn/	✅	2025-07-20
Topsec	https://knowledge.topsec.com.cn/	✅	2025-07-20
Chaitin	https://product-support.chaitin.cn/	✅	2025-07-20
DBAPPSecurity	https://bbs.dbappsecurity.com.cn/<br>http://www.websaas.com.cn/	✅	2025-07-20

💡 Note: ✅ indicates that account authentication is required to access the page or download content.

📮 Contributions & Feedback

If you find that any links have changed, expired, or if you have information regarding other vendors' offline updates, please feel free to contribute. You can reach me via:

Email：📧 admin@bytesycn.com

🛠️ Maintenance Plan

This page will be audited and updated periodically. If your organization or clients have specific vendor update requirements not listed here, please leave a comment, and I will do my best to include them.

Is InfiniBand's "Infinite Bandwidth" Truly Infinite? 🤔

Sun, 06 Jul 2025 23:30:00 GMT

Preface

Recently, my friend and I decided to upgrade the storage for our 'DataCenter' (essentially a cluster of servers). Our goal was clear: deploy a centralized storage system featuring both All-Flash and Hybrid-Flash tiers to provide mount services for virtualization nodes, aiming for an "enterprise-grade" feel.

While purchasing a turnkey solution like Huawei’s OceanStor Dorado would be the simplest route, this setup is primarily for personal tinkering and occasional testing. Therefore:

Open-source solutions are our destiny!

为啥选开源？别问，问就是预算有限（qiong）！# 手动狗头

⚡️ Calculating Theoretical All-Flash Throughput

Assuming a single SSD has a R/W speed of ~500MB/s (~5Gbps), a 6-disk RAID 5 array theoretically yields:

Write: 500MB/s * (6-1) ≈ 2.5GB/s (Parity overhead may reduce actual performance).
Read: 550MB/s * 6 ≈ 3.3GB/s (Significantly exceeding 10Gbps).

While a RAID 0 array would be even faster, our "retired" storage server is limited by a 12Gbps SAS RAID card. To go higher, we would need to move to direct PCIe paths (NVMe), which is currently beyond our budget. Thus, we set 10Gbps as our baseline requirement for the transmission medium.

Transmission Media

10Gbps media is now ubiquitous: Fiber optics, DAC (Direct Attach Copper) cables, or even high-quality Cat6A Ethernet for short distances. We previously stockpiled some "gray market" gear, such as Mellanox CX341 40Gbps NICs. We initially considered a Peer-to-Peer (P2P) connection, but with three compute nodes, the NIC requirements for the storage server became impractical.

To remain cost-effective, we acquired a used Cisco Nexus 3064PQ-10GX (48x10G SFP+ ports + 4x40G QSFP ports). A dedicated switch perfectly solves the multi-node connectivity issue.

Storage System

Consumer-grade NAS OSs aren't quite built for this level of performance. We settled on TrueNAS—it’s open-source, free, and provides robust support for All-Flash/Hybrid-Flash tiers backed by the powerful ZFS file system.

<div align="center"> <img src="https://oss-southeast-1.bytesycn.com/images/2025/07/06/12pwinq.png" width="50%"> <p style="font-size: 14px; color: gray;">TrueNas</p> </div>

Network Architecture:

Compute Nodes: Connected via 10Gbps NICs.
Storage Server: Connected via 40Gbps NICs.

While this creates a high-speed storage fabric, a new problem arises: with 50-60 VMs running simultaneously, concurrent I/O could easily saturate the 10Gbps bandwidth. Furthermore, the low-power CPUs we chose for the storage server would struggle with the TCP/IP stack overhead.

The Solution? RDMA.

Our Mellanox NICs are famous for RDMA (Remote Direct Memory Access). This technology bypasses the CPU, moving data directly between the NIC and memory with extreme efficiency and ultra-low latency.

Introduction to RDMA & InfiniBand

Before discussing RDMA, we must address its foundation: InfiniBand (IB).

<div align="center"> <img src="https://oss-southeast-1.bytesycn.com/images/2025/07/06/12eh0a7.jpg" width="30%"> <p style="font-size: 14px; color: gray;">InfiniBand Trade Association</p> </div>

InfiniBand is a high-performance, low-latency communication protocol widely used in Supercomputing, Data Centers, and AI training clusters. The "magic" of RDMA is primarily realized through this fabric.

The name "InfiniBand" suggests "Infinite Bandwidth." While technically hyperbole, it refers to its massive throughput and extreme scalability, which effectively shatters the performance ceilings of traditional Ethernet. At SC24, NVIDIA showcased the ConnectX-8, boasting single-port speeds of 800Gbps—enough to transfer a Blu-ray movie in one second.

<div align="center"> <img src="https://oss-southeast-1.bytesycn.com/images/2025/07/06/12gjlpt.png" width="50%"> <p style="font-size: 14px; color: gray;">ConnectX-8 <sup>1</sup></p> </div>

✅ Advantages of InfiniBand:

1. Ultra-High Bandwidth

Ideal for HPC and AI model training where Terabytes of data are moved constantly.

2. Ultra-Low Latency + Zero-Copy

This is the primary differentiator from standard Ethernet:

RDMA Support: Direct memory-to-memory transfer.
Kernel Bypass: Data bypasses the CPU and OS kernel.
Minimal CPU Overhead: Latency is measured in sub-microseconds, compared to the tens of microseconds found in traditional Ethernet.

🧱 Disadvantages:

RoCE (RDMA over Converged Ethernet) allows IB protocols to run on traditional Ethernet hardware, which mitigates cost, but still requires specific NIC and software support.

1. Closed Ecosystem and Cost

IB isn't just a cable; it’s a proprietary ecosystem requiring:

Dedicated IB Switches.
IB HCA (Host Channel Adapters).
Specific software stacks (OpenFabrics Enterprise Distribution - OFED). 🧾 造价高是一大门槛，尤其是中小规模部署时性价比并不理想，不过好嘴RoCE的推出让IB网络可以在传统以太网络上跑，利用现有的高速以太网络硬件，不过还是需要IB网卡以及IB网络所支持软件支持。

Metric	InfiniBand	iWARP (TCP-based)	RoCE (Ethernet-based)
Performance	Best	Lower (TCP overhead)	Comparable to IB
Cost	High	Medium	Low
Switch Type	Dedicated IB Switch	Ethernet Switch	Ethernet Switch

上表数据来自华为支持<sup>2</sup>

2. Lack of Native Interoperability

InfiniBand does not use the standard IP protocol suite. It has its own addressing and flow control. To connect an IB fabric to an Ethernet network, you need an IB-Ethernet Gateway for protocol translation.

✍️ Final Thoughts

RDMA and InfiniBand are "performance-at-any-cost" solutions. However, with the rise of AI and Cloud Computing, many enterprise scenarios are hitting the limits of traditional Ethernet. In applications requiring High Bandwidth + High Concurrency + Ultra-Low Latency, IB is becoming essential.

From a technical perspective, IB isn't for everyone due to:

High Capital Expenditure (CAPEX): Switches and HCAs are expensive.
Operational Complexity: It requires specialized knowledge to maintain.

When should you consider InfiniBand?

Deploying AI training/inference clusters with multiple GPU nodes (A100/H100).
Using distributed storage (e.g., Ceph) where latency is critical.
Massive data distribution systems requiring maximum throughput.

🔗 link:

[1] https://nvdam.widen.net/s/pxsjzhgw6j/connectx-datasheet-connectx-8-supernic-3231505

[2] https://support.huawei.com/enterprise/zh/doc/EDOC1100203347

VMware ESXi VM "Redo Log Corrupted"? Don't Panic, Here’s How to Resurrect It! 🚑

Thu, 03 Jul 2025 22:02:10 GMT

Hey there 👋, back with another post! As some of you may know (or maybe I haven't mentioned it yet), a friend and I run a small virtualization cluster in a remote rural area. It hosts most of our self-developed applications and testing environments. Everything was running smoothly until we ran into a challenge: the local power grid is somewhat unstable. Frequent, sudden power outages often cause hard shutdowns across our cluster. After a recent improper power-off, our Reverse Proxy VM—which handles all external mapping—completely went on strike. Upon booting, it kept throwing the error: "The redo log is corrupted!" 🤯

Because this cluster strictly follows a small-enterprise network architecture—with clearly defined DMZ, Tunnel, and Trust zones—there are only one or two zones capable of external mapping. Once this reverse proxy went down, several of our external-facing services were effectively "cut off." A timely fix was non-negotiable.

🙋 The Issue Looked Like This:

The redo log of 'xxxxxx.vmdk' is corrupted. If the problem persists, discard the redo log.

Seeing this prompt left me momentarily stunned. Only one thought crossed my mind: We’re in trouble. 🥶

Troubleshooting Approach

VMDK? It must be disk-related! 💾

Since the error explicitly mentioned VMDK, it was highly probable that the VM's virtual disks were the culprit. I recalled that this VM had several existing snapshots, so I immediately attempted a disk consolidation. The result? Well... it didn't do much. 🤷 The VM remained stagnant and refused to boot.

When you're faced with a mission-critical VM that won't start and you don't have a fresh backup, the rule of thumb is to try every possible method (ideally after securing whatever data you can). In my case, I decided to Delete All Snapshots!

After confirming the deletion and watching the progress bar reach 100%, a minor miracle happened: the "striking" reverse proxy VM successfully booted up! 🎉🎉🎉 Back to "business" as usual; the world suddenly felt right again! 🥳

🚨 Pro-Tip (A Must-Read for Production Environments!! Critical!!!) 🚨

If you are managing vSphere VMs in a production environment, I strongly recommend cloning the VM to create a full backup before performing any destructive operations! This ensures you have a rollback path to avoid further data loss.

As for our "home lab" setup—well, we can afford to be a bit more adventurous. 😅 At worst, I’d just have to redeploy the VM and reconfigure everything from scratch. It’s a tedious process, but certainly better than having no service at all!

PicImpact Upload Failures with Cloudflare R2? Here’s the Fix.

Wed, 02 Jul 2025 01:02:38 GMT

PicImpact is a self-hosted photography showcase platform built on Next.js and Hono.js. Its interface is elegant and functional—perfect for those who love customizing their tech stack but don't want to build a frontend from scratch. 🙋‍♂️

📌 Project Resources

🌐 GitHub: https://github.com/besscroft/PicImpact
📖 Documentation:

https://pic-docs.ziyume.com
🪪 License: MIT

🪄 Why Choose PicImpact?

I was searching for a sleek image hosting template for my photography site, Moments. PicImpact stood out for its clean UI and Docker support—a perfect "one-and-done" solution.

🚫 Why not local deployment? <br>Don't ask. I just didn't want to deal with the overhead of a local Node.js environment... 💀

🐳 Docker Deployment Experience

The deployment is incredibly smooth. As long as your PostgreSQL instance is ready (either local or a managed cloud DB), you just run the following command, and you're airborne:

docker run -d --name picimpact \
  -p 3000:3000 \
  -e DATABASE_URL="postgresql://[USER]:[PASSWORD]@[HOST]:[PORT]/[DB_NAME]" \
  -e BETTER_AUTH_SECRET="npx auth secret or a random string" \
  besscroft/picimpact:latest

🧨 The Obstacle...

Initially, I used Alist as the storage backend, but I was bottlenecked by my home broadband's limited upload speed 🥲. So, I pivoted to Cloudflare's R2—the generous "Saint" of free object storage.

However, after configuration, the upload process went haywire:

The UI popup showed a "Success" checkmark ☑️, but the image status below displayed Upload.failed
The Browser Console was a gallery of errors:
1. ERR_NAME_NOT_RESOLVED
2. ERR_SSL_VERSION_OR_CIPHER_MISMATCH
3. ERR_FAILED
4. has been blocked by CORS policy: ... No 'Access-Control-Allow-Origin' header

Is it successful? The R2 dashboard was empty. Is it a failure? The frontend insisted it was "Success." I felt like I had triggered every possible error in the PicImpact library 🤦‍♂️. Eventually, I narrowed it down to a CORS configuration issue.

🛠️ Setting Up Cloudflare R2

Cloudflare R2 offers 10GB of free monthly storage with no egress fees. Note that CF nodes are primarily overseas, so latency may vary. For higher performance in China, consider Tencent COS or Alibaba OSS.

Access R2 Storage
Create a Bucket.
Bucket Parameters

You can choose any location, as latency is similar. However, ensure you select the Standard storage class to stay within the free tier.😯

Custom Domain

You must use a domain whose Nameservers (NS) point to Cloudflare.

CRITICAL: Configure CORS Policy

This is the dealbreaker. If you miss this, you’ll end up wasting hours like I did.～

CORS Policy Sample: Note that AllowedHeaders is mandatory; R2’s default generator often omits it.

[
  {
    "AllowedOrigins": [
      "http://localhost:3000"
    ],
    "AllowedMethods": [
      "GET",
      "HEAD",
      "PUT",
      "POST",
      "DELETE"
    ],
    "AllowedHeaders": [
      "*"
    ]
  }
]

Create API Tokens

As a security professional, I strongly advocate for the Principle of Least Privilege.

Avoid creating "Account API Tokens" if possible; a specific User API Token scoped only to the required bucket is much safer.

Save API Credentials

These credentials (Access Key ID, Secret Access Key, and Account ID) appear only once. You will need the S3 API info for PicImpact.

🔗 Integrating PicImpact with CF-R2

Navigate to the PicImpact dashboard: Storage Config -> Cloudflare R2 -> Edit.
Fill in the Details:

r2_accesskey_id: Your Access Key ID.
r2_accesskey_secret: Your Secret Access Key.
r2_account_id: The prefix of your S3 endpoint (e.g., if the endpoint is https://123456.r2.cloudflarestorage.com, use 123456).
r2_bucket: Your bucket name.
r2_storage_folder: Path prefix. If using the root, leave blank. Do not start with a slash (/).
r2_public_domain: Your custom domain from step 4. Must include the protocol (e.g., https://abc.com).
r2_direct_download: Usually set to false.

Success: You're now ready to showcase your work!

✅ Final Thoughts

PicImpact is a fantastic project with an elegant UI. While the documentation doesn't provide a "step-by-step" for every storage provider, that's the beauty of open-source—the joy of tinkering.

The "False Success" caused by CORS is particularly misleading. If you’re struggling with PicImpact + CF-R2, remember:

Check the Console errors first.
Verify your CORS headers (especially AllowedHeaders).
Confirm that files are actually landing in the bucket dashboard.

Hopefully, this guide saves you some hair-pulling! 🤯

Insights into Pre-Exercise Preparations for Cyber Offensive and Defensive Drills

Sat, 28 Jun 2025 21:33:19 GMT

In recent years, cyber offensive and defensive drills (often referred to as 'Red Teaming/Blue Teaming' or 'Real-world Combat Drills') have become increasingly normalized, institutionalized, and large-scale. This trend is driven by national-level emphasis on cybersecurity and data governance. With the implementation of the Cybersecurity Law and the Data Security Law of the People's Republic of China, combat-readiness requirements and legal compliance responsibilities have been elevated to unprecedented heights.

Consequently, thorough preparation is essential not only for legal compliance but also for securing core business stability. This article conducts a preliminary discussion on how to effectively execute these preparations.

Security Equipment Selection and Deployment Strategy

A robust network environment is the foundation of effective defense. Equipment selection should be closely aligned with an organization's business scale, risk appetite, compliance requirements, and budgetary constraints. Below are typical configuration recommendations:

Protection Level	Core Equipment Configuration	Budget	Use Case Description
Baseline	Next-Generation Firewall (NGFW)	💰	Small organizations with few systems and low risk. NGFW provides basic access control, stateful inspection, and simple Web protection.
Standard	NGFW + Network Traffic Analysis (NTA) Probe (integrated with SOC/SIEM)	💰💰	Recommended baseline. NGFW handles perimeter defense; NTA provides full network visibility and deep analysis via traffic mirroring; the platform handles centralized monitoring and threat correlation.。
Advanced	NGFW + NTA + Intrusion Prevention System (IPS)	💰💰💰	Focused protection for critical business zones. IPS provides deep packet inspection (DPI) and real-time blocking of known exploits, forming defense-in-depth with the NGFW.
Comprehensive	NGFW + NTA + IPS + SWG + Endpoint Detection & Response (EDR)	💰💰💰💰💰	Large institutions or high-risk industries. Integrates perimeter, internal monitoring, application-layer defense, endpoint security, and auditing for a "Cloud-Network-Edge-Endpoint" defense-in-depth architecture.

Focusing on Core Protections

1. Pragmatic Choices for Small-Scale Scenarios:

For small enterprises with limited resources, "stacking" equipment is not necessary. A single, well-configured Next-Generation Firewall (NGFW) can meet fundamental needs. Modern NGFWs integrate several legacy standalone functions:

Secure Web Gateway (SWG) capabilities: Auditing and controlling internal user web activities.
Web Application Firewall (WAF) features: Defending against SQL Injection, XSS, and remote command execution.
Encrypted Tunnel Identification: Detecting and controlling VPNs or hidden proxy channels.

2. The Value of the Standard Configuration: NTA + Situational Awareness (SOC)

In standard configurations, we strongly recommend deploying Network Traffic Analysis (NTA) probes at key network junctions (usually core switching areas) linked to a centralized platform.

Global Visibility: Probes capture traffic via mirroring, providing a "God’s-eye view" of internal lateral movement that perimeter logs simply cannot see.
Defense-in-Depth Supplement: While NGFWs have IPS features, their focus is the perimeter. Probes and dedicated IPS units in core zones provide internal lines of defense.
Objective Evaluation of Endpoint Security: While free security software provides basic malware protection, it lacks centralized management and advanced threat detection. Professional EDR provides deep behavioral monitoring and threat hunting. The value of NTA is that even if endpoint protection is bypassed, it independently captures traces of lateral movement, Command and Control (C2) communication, and data exfiltration at the network layer.

Normalized Security Policies: "Automatic Transmission" for Defense

In large-scale drills, the "Old School" tactics of the Red Team remain largely unchanged: credential stuffing/weak passwords and the exploitation of N-day vulnerabilities. However, do not underestimate automated "script kiddies" who use scanners to bombard targets with PoC (Proof of Concept) exploits. If security policies are misconfigured (e.g., 'Allow All'), the defense system becomes a VIP pass for attackers.

说实话，见过不少地方的安全设备配置，策略写得那叫一个“大气磅礴”——any to any permit（允许所有流量通行）！这哪是安全设备，简直是给攻击者开的VIP通道嘛。合规是基础，但安全供应商交付时，起码得把那些“高危必杀技”策略给配上并开启吧？特别起码是untrust to trust区域要拒绝掉，这可是基础中的基础！

🛡️ Strategy 1: Enable the "IPS Engine" on your NGFW

Many NGFWs have their Intrusion Prevention System (IPS) capabilities disabled or set to "Detect Only" due to performance concerns. During drills, you must enable "Block" mode for all traffic policies. This acts as the first automated barrier against known exploits and malicious scanning.

🚫 Strategy 2: Harden High-Risk Ports

Minimal exposure is the goal. Use a Whitelist (Specific Trusted Source IPs) whenever possible. If a port must be open to the world, ensure the underlying service is fully hardened. Below is a "Blacklist" of ports that should generally be blocked at the perimeter unless absolutely necessary:

Port	Service
20-21	FTP
22	SSH
23	Telnet
25	SMTP
69	TFTP
135-139	RPC
161-162	SNMP
445	SMB
3389	RDP
5900-5904	VNC
6379	Redis
7001	WebLogic
8848	Nacos

Note: These blocks should be implemented at the Perimeter Firewall to stop threats outside the internal network.

🚫 Strategy 3: Thwart DNSLog Probing

Attackers use public DNSLog services to verify Out-of-Band (OOB) vulnerabilities. You can set domain filtering rules on Perimeter Gateway Devices to block queries to known DNSLog suffixes (e.g., *.dnslog.cn, *.burpcollaborator.net).

Why the Perimeter? To prevent attackers from bypassing internal DNS servers by manually setting their DNS to 8.8.8.8. This serves as an effective "Noise Reduction" measure, though sophisticated attackers may use custom, private DNSLog domains.

Disabling Automatic DNS Log Probing in Burp Suite

Fri, 27 Jun 2025 22:08:38 GMT

Burp Suite is a Java-based, cross-platform penetration testing tool for web applications. It is widely used for intercepting, modifying, and replaying HTTP requests, supporting features like packet capture, manual request tampering, and brute-force attacks. However, when Burp Suite starts, it actively initiates DNSLOG probing. These automated requests can be flagged as suspicious activity by security infrastructure like STA (Security Traffic Analysis) probes or IDS/IPS systems.

Configuration Steps

1、Burp -> Setting

2、Project -> Collaborator

Change the setting from "Use the default Collaborator server" to "Don’t use Burp Collaborator".

Installing Docker & Docker Compose(China)

Sat, 14 Jun 2025 15:59:54 GMT

This guide covers both online and air-gapped (offline) installation methods for Docker and Docker Compose on Linux systems. It is intended for users who need to deploy in restricted intranet environments or environments without external internet access.

🌐 Online Installation

Method 1: Official Script & Manual Compose Download

curl -fsSL https://get.docker.com -o get-docker.shsh 
get-docker.sh
sudo apt-get install libffi-dev libssl-dev。
curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

Method 2: Using Mirror Scripts (Optimized for specific regions)

bash <(curl -sSL https://linuxmirrors.cn/docker.sh)

📦 Offline Installation (Air-gapped)

Download Binaries Download the required packages on a machine with internet access:

# Docker Static Binary
wget https://download.docker.com/linux/static/stable/x86_64/docker-24.0.6.tgz

# Docker Compose Binary
wget https://github.com/docker/compose/releases/download/1.29.2/docker-compose-Linux-x86_64

Extract and Install Docker Transfer the files to the target machine, then execute:

tar -xvzf docker-24.0.6.tgz
sudo cp docker/* /usr/bin/

Configure Systemd Service Create a service unit file to manage the Docker daemon:

sudo tee /etc/systemd/system/docker.service > /dev/null <<EOF
[Unit]
Description=Docker Application Container Engine
After=network.target

[Service]
ExecStart=/usr/bin/dockerd
Restart=always

[Install]
WantedBy=multi-user.target
EOF

# Reload configuration and enable the service
sudo systemctl daemon-reload
sudo systemctl enable docker
sudo systemctl start docker

Install Docker Compose

sudo mv docker-compose-Linux-x86_64 /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

Verify Installation

docker -v
docker-compose -v