Home / user-452180

Jelmer Jellema's questions

Martin Hope
Jelmer Jellema
Asked: 2020-09-07 13:24:27 +0800 CST
  • 2

I have a big XFS filesystem containing about 3TB of data. This runs on some network device at our virtual server provider. We created it with the default settings, thus using an internal journal.

Because of the slow response of this device, I would like to try how it runs when the file system does not use the network device for the journal, but the faster connected ssd device.

Is there a way to "move" the XFS journal from internal to external without loosing the data?

linux xfs
Martin Hope
Jelmer Jellema
Asked: 2018-03-06 05:19:29 +0800 CST
  • 17

I was just wondering. We use a lot of SSL certificates. Nowadays, we almost exclusively use letsencrypt (thanks!). The bottom line of these certificates is, that proof of ownership of the domain name(s) on the certificate comes from the power to manipulate either the DNS records or the website under these domains. The DNS proof comes from adding some key (given by letsencrypt) as a TXT record to the DNS.

So, IF it is enough proof to be able to change the DNS records for a domain, why not use self signed certificates with the fingerprint in the DNS?

I would say this gives exactly the same amount of trust as the DNS based procedure of letsencrypt (and other CA's):

  1. Create a self signed CA (just follow the steps of the various how to's)
  2. Create a certificate for some domain(s)
  3. Sign the certificate from step 2 with the CA from step 1. You now have a basic certificate, signed by a non trusted CA
  4. Add a TXT (or dedicated) record to the DNS of each of the domains, stating: we signed the certificate of this domain with this CA. Like: 'CA=-fingerpint of CA-'
  5. A browser downloads the certificate and verifies it by comparing the fingerprint of the CA / the CA certificate with the data in the DNS for the given domain.

This would make it possible to create trusted self signed certificates without third party interference, of the same trust level as any basic SSL certificate. As long as you have access to the DNS, your certificate is valid. One could even add some DNSSEC like encryption, of make a hash out of the CA plus the SOA-record, to make sure the trust disappears on changes in the DNS record.

Has this been considered before?

Jelmer

domain-name-system