Skip to content

Stone

Information

  • stone is a physical machine hosted at ColoClue in Amsterdam
  • It's where our backups are stored.
  • ColoClue is a friendly, but not radical, network association that facilitates colocation and runs the AS: https://coloclue.net/en/
  • The easiest contact is #coloclue on IRCnet (channel key: cluecolo)
  • The physical datacenter is Qupra: https://quprawholesale.com/

Special notes

Since we don't want a compromise of the Puppet Server to be able to escalate to a compromise of our backups, stone must never become puppetised in our standard way, but always only in a masterless setup!

SSH

SSHd

Hostname: stone.tails.net IP: 94.142.244.35 Onion: slglcyvzp2h6bgj5.onion

Host key:

SHA256:p+TQ9IvEGqUMJ5twgb1UweOp6omH4/O1hjwdn4jVk6A root@stone (ED25519)
SHA256:K+V5AbCrVqWq9Sc1gP28mdXk37umWpFn1v/pYjxZie8 root@stone (ECDSA)
SHA256:H/Tw12mi2sVTy/dRhlxy6MTQD2xdI76PyG1RweKz9eM root@stone (RSA)

Rebooting

Dropbear listens on port 443, so:

ssh -p443 root@stone.tails.net

Host keys:

SHA256:t1yihiERodaFoW3aebWlXM/FxGTMllf5bqVgSFcjuRw (ECDSA)
SHA256:gUTcTz4cZhRlK/FiTEUnx+KQWsmzH7sFdAyfl0f8F40 (RSA)
SHA256:7dkq21tFlT8lWFuTXKSDe5Hl+XzWTCmsBOGQRSyptcU (DSS)

Once logged in, simply type:

cryptroot-unlock

If the machine is not up and running within a minute or two, connect to the serial console to have a look what's going on.

OOB

Connect to the VPN

Chameleon doesn't have a serial console, but rather an IPMI interface which is available via ColoClue's VPN.

The first time you connect to the VPN, you first need to install openvpn on your computer and then download the openvpn configuration from the provider:

wget https://noc.coloclue.net/coloclue-oob.zip
unzip -e coloclue-oob.zip

Then start the VPN link:

# openvpn needs to run as root so that it can setup networking correctly
sudo make vpn

Note: you may need root for that.

Username is "groente" and the password is the ColoClue password stored in our password store:

pass tor/hosting/coloclue.net

Access the IPMI web interface

That command should show you the TLS certificate fingerprints to check when you access the IPMI interface via:

Note: connect to the IPMI web interface using the IP, otherwise the browser may not allow you to proceed because of the self-signed certificate.

The IPMI username and password are also in the password-store:

pass tor/oob/stone.tails.net/ipmi

Launch the remote console

To access the console, choose "Remote Control" -> "iKVM/HTML5"

Installation

Base debian install with RAID5, LVM and FDE

apt-get install linux-image-amd64 dropbear puppet git-core shorewall

configured dropbear manually

set up masterless puppet, all further changes are in there