Ssh

Why I wanted this backed up properly This whole site, every post, the theme, the config, lives in one folder on the T620. Nothing about that folder is protected by anything beyond the disk it sits on. Wanted a real backup, and wanted it copied off the box entirely, not just sitting in a second folder on the same machine. First attempt at excluding the build output Wanted to back up the Hugo source without dragging along the generated public folder or the build cache, since both regenerate automatically from a normal deploy and just bloat the archive for no reason: ...

Simple job. Copy Videos folder from G4 over to JackSparrow2 with rsync. Done this a hundred times. rsync -avP Videos/ tolga@100.xxx.xxx.xxx:/home/tolga/rsync/ protocol version mismatch, is your shell clean? (see the rsync manpage for an explanation) rsync error: protocol incompatibility (code 2) at compat.c(625) [sender=3.4.4] Never seen that one before. Password prompt worked fine, so the connection itself was good. Something after that was the problem. first thing i found SSH’d in normally to have a look and there it was, plain as day. Every time I log into JackSparrow2 I get a full ASCII banner, box drawing characters, the works. Looks great for a normal login. But rsync uses SSH under the hood too, to spawn a remote process, and it does not want anything on that connection except rsync’s own protocol data. Any stray text before the handshake and it falls over exactly like this. So the banner was my first suspect. Went looking in /etc/motd, that’s the Cockpit and Jellyfin links box, not what was printing. Checked /etc/motd.d/, just a Cockpit symlink, nothing there either. Grepped for the actual banner text and found it in /etc/ssh/banner, being force fed on every single SSH connection through a Banner directive sitting in /etc/ssh/sshd_config.d/99-jacksparrow2.conf. That directive does not care whether the session is interactive or not, it just fires. Commented it out, restarted sshd. Ran the rsync again. ...

The hardware I built this on an HP T620 … a thin client, not a real server. Dual-core AMD GX-217GA SoC, the kind of chip that used to sit in front of a cash register or a hospital terminal, not something anyone would call fast. No AES-NI either, which matters more than you’d think once you’re running encrypted traffic through it all day. If you’ve got something like this sitting in a drawer, it’s genuinely enough to run a small personal NAS. Don’t expect it to be quick. Expect it to just work, reliably, once it’s set up right. ...