malobeo/infrastructure
2
1
Fork 1
Code Issues 40 Pull Requests 4 Actions Projects 3 Releases Wiki Activity

Physical Server security #137

New Issue
Open
opened 2026-02-25 05:02:29 +01:00 by ahtlon · 1 comment
ahtlon commented 2026-02-25 05:02:29 +01:00
Owner
Copy Link

As mentioned in #124, our "server room" isn't really locked down, which means that our hardware could be tampered with even just by visitors.
What are the security implications of this?
Is there a way of preventing random ppl from just plugging in usb's or similar?
Is secure boot a thing on nixos?

As mentioned in #124, our "server room" isn't really locked down, which means that our hardware could be tampered with even just by visitors. What are the security implications of this? Is there a way of preventing random ppl from just plugging in usb's or similar? Is secure boot a thing on nixos?
ahtlon added the Security label 2026-02-25 05:02:29 +01:00
ahtlon added this to the Security project 2026-02-25 05:02:29 +01:00
ahtlon moved this to High Severity in Security on 2026-02-25 05:02:39 +01:00
ahtlon moved this to Medium Severity in Security on 2026-02-25 05:14:39 +01:00
kalipso commented 2026-02-25 13:36:25 +01:00
Owner
Copy Link

We could setup tamper protection.
This was done already with the malobeo laptop and it makes sense to do something similar on fanny.

There is a wiki entry on secure boot: https://wiki.nixos.org/wiki/Secure_Boot

Maybe we could try to physically disable some usb ports.

We could setup [tamper protection](https://mullvad.net/en/help/how-tamper-protect-laptop?page=/en/help/how-tamper-protect-laptop). This was done already with the malobeo laptop and it makes sense to do something similar on fanny. There is a wiki entry on secure boot: https://wiki.nixos.org/wiki/Secure_Boot Maybe we could try to physically disable some usb ports.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Bug/Problem
Lokal
Migration
Module/Disks
Module/Initssh
Request
Security
Service
Updates
bump
nextcloud
No Label Security
Milestone
No items
No Milestone
Projects
Clear projects
No project Security
Assignees
Clear assignees
ahtlon kalipso quinn
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: malobeo/infrastructure#137
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?