I manage multi user systems and try to be on top of this and no, privilege escalation with a working public exploit are very rare. There’s quite a lot of CVEs with potential privilege excalation, but most of the time there is no real world exploit. And a large part of those are related to user namespaces in one way or another.

This one is truly scary, at least the immediate mitigation is pretty straightforward.

Traditionally virtual tty 1 through 6 were text terminal. So X used the 7th, that’s why some older forums tells you to go there.

Nowadays, the graphical session manager will spawn on vtty 1, and sessions will dynamically use the others. So on a mostly single user computer, Ctrl+alt+F2 is likely to work. With multiple users, you can actually switch users or come back to the session manager this way.

If you switch to an unused vtty, systemd will spawn a text login prompt. And when you login, some logind dark magic makes the system realize your are entitled to hear the audio output of your application still running on your graphical session.

Valheim uses proton? I’m pretty sure it ran natively a few years back.

If both networks 10.100.100.0/24? And 10.20.20.0/24 share the same level 2 Ethernet segment/vlan/broadcast domain, you don’t even need the third nic, you can setup a secondary IPv4 address on the private nic on the 10.20.20.0/24 network.

I would not call that best practice, but if the number of host on the network is reasonable and you are aware of the security problems created, there’s nothing really wrong with this setup.

Having two nics on the same Ethernet network is actually trickier since you have to do ARP filtering.

I have no experience about what you are trying to achieve, but rdma and related technologies (infiniband, qlogic, sr-iov, ROCE) is not it. These are network technologies that permit high bandwidth/low latency data transfer between hosts. Most of these bypass the IP stack entirely.

Infiniband is a network stack that enable RDMA, it’s only vendor is now NVIDIA which acquired mellanox. Qlogic was another vendor, but it got acquired by Intel that tried to market it as Omnipath, but it was spinned off to Cornelis network.

Sr-iov is a way to share an infiniband card to a virtual machine on the same host.

ROCE is an implementation of the rdma software stack over ethernet instead of infiniband.

The gain would be that an attacker having a foothold on the internal network (by having a physical access or hacking a device on it) would be able to sniff and modify outgoing emails.

I’m a bit sceptical about the performance claim on modern hardware.

That said it’s not a completely unreasonable tradeoff.

I’m not sure about the point of your setup but let’s ignore that :

• Create a vlan “servers” on router B, assign a port (WITHOUT vlan tagging) to this vlan, patch a cable between this port and any port on rouer A
• Put a static IP address 0.x on router B in this vlan
• Enable routing between the default vlan and vlan “servers” on router B .
• Configure router A to not distribute this IP address (by setting up a permanent DHCP lease for example)
• On all your servers put a static route that says : “192.168.20.0/24 via 192.168.0.x”
• If you can setup this route on A, things connected to A will work whether they have the route or not (it’s not a big deal but the routing would be assymetrical)

If you can create a VLAN and a route on A, you can create a distinct “interconnect” VLAN and make all of that nice and clean without the extra static routes on the servers.

Remove the sticker, and remove the leftover glue with an eraser.