Spent like 2 hours trying to figure out why my MOTD (via update-motd.d) wasn't showing up when using SSH. Turns out there's a bug in Debian 13 where the 'remote' pam service configuration is missing. My SSH connection was over tailscale, and tailscale execs `login -h` which uses the 'remote' service instead of 'login'. The default pam configuration is empty so `pam_motd.so` is never invoked.
References for the curious:
- https://github.com/tailscale/tailscale/issues/16983
- https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1103923
That's enough computer for today, I think.
Tailscale v1.98.1 released
Tailscale es divino
Spent several hours yesterday setting up Beszel. It looks incredibly slick and Iโm very impressed with how easy they make the setup across several nodes. But the majority of the time setting up was spent on figuring out why the agent on my #synology was connecting over SSH instead of a WebSocket.
Apparently DSM7 disallows outgoing connections for external packages which breaks #Tailscale in subtle ways. Granted, Tailscale does have this documented and provides a solution but this was not easy to troubleshoot. #homelab #selfhosting
Self-hosted Tailscale, Part 2: Ad-blocking DNS
์ด ๊ธ์ Tailscale ๋คํธ์ํฌ ๋ด์์ ์์ฒด ํธ์คํ DNS ์๋ฒ์ธ Blocky๋ฅผ ์ฌ์ฉํด ๊ด๊ณ ๋ฐ ํธ๋์ปค ์ฐจ๋จ, ๋ด๋ถ ์ด๋ฆ ํด์์ ๊ตฌํํ๋ ๋ฐฉ๋ฒ์ ๋ค๋ฃน๋๋ค. ๊ธฐ์กด Cloudflare DNS ๋์ Blocky๋ฅผ ๋์ปค ์ปดํฌ์ฆ ํ๊ฒฝ์ ๋ฐฐํฌํ๊ณ , DNS-over-TLS๋ฅผ ํตํด ์ ์คํธ๋ฆผ DNS์ ์ํธํ๋ ํต์ ์ ์ ์งํ๋ฉฐ, Headscale์ด ํด๋ผ์ด์ธํธ์ DNS ์ค์ ์ ์๋์ผ๋ก ํธ์ํ๋๋ก ๊ตฌ์ฑํฉ๋๋ค. Android์ Private DNS ๊ธฐ๋ฅ๊ณผ์ ์ถฉ๋ ๋ฌธ์ ๋ฅผ ํด๊ฒฐํ๊ณ , ๋คํธ์ํฌ ์ ๋ฐ์ ๊ฑธ์ณ ์ผ๊ด๋ DNS ํํฐ๋ง๊ณผ ๋ด๋ถ ๋๋ฉ์ธ ํด์์ ์ ๊ณตํ๋ ์ค์ฉ์ ์ธ ์ฌ๋ก์ ๋๋ค.
https://blog.fidelramos.net/software/tailscale-2-ad-blocking-dns

In Part 1 I set up Headscale and had every tailnet client use Cloudflare DNS. That works, but it's leaving value on the table: every device that connects to my Tailscale gets whatever DNS servers I set, so I might as well run my own DNS server inside the private โฆ