Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

271
active users

shakedown.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#SSH

1 post1 participant0 posts today
Public
John Goerzen

I recently bought a couple of YubiKey security keys. These support FIDO2/U2F, integrate well with #SSH

In researching how to do this, I found a lot of pages online with poor instructions. In many cases, they suggested insecure practices.

It turns out this whole process is quite easy. But I wanted to understand how it worked.

So, I figured it out, set it up myself, and then ut up a new, comprehensive page on my website: complete.org/easily-using-ssh- .

Blog post at changelog.complete.org/archive

www.complete.org · Easily Using SSH with FIDO2/U2F Hardware Security KeysA lot of new hardware security keys (Yubikey, Nitrokey, Titan, etc.) now support FIDO2 (aka U2F aka Webauthn aka Passkey; yes it’s a mess). So does OpenSSH. This spells good news for us, because it is far easier to use than previous hardware security types (eg, PKCS#11 and OpenPGP) with ssh. A key benefit of all this, if done correctly, is that it is actually impossible to access the raw SSH private key, and impossible to use it without the presence of the SK and a human touching it.
Public
IAintShootinMis

Man, #ssh never ceases to amaze me.

Just learned (after 15years on #linux) that you can execute a command on a remote host using the ' ' convention.

E.g.; ssh root@host 'date' will 1) start a connection, 2) execute date on the remote host 3) return the output of date 4) and finally close the connection.

Even better you can pipe things to the command. So echo "dog" | ssh root@1.x.x.x 'wall' will send the word "dog" to all logged in users.

I should have assumed something like this exists

Two terminal windows showing the command in the toot being executed on terminal 1, and be produced as a wall message on terminal 2. (The remote host)
Replied in thread
Public *
Kevin Karhan :verified:

@torproject Q: I wish there was a similar tool test #Bridges, as bridges.torproject.org/scan/ is not that good and I don't want to hammer it with dozens of addresses, cuz at best that's quite antisocial if not possibly trigger responses assuming this is an intelligence gathering operation.

  • Ideally sone standalone binary that one can just give a list of #TorBridge|s in a text file (similar to the way one can just past them in at #TorBrowser) would help.

I.e. 

bridgetest -v4 obfs4 203.0.113.0:80 …

bridgetest -v6 webtunnel [2001:DB8::1]:443 …

bridgetest -list ./tor.bridges.list.private.tsv
  • But maybe #onionprobe already does that. In that case please tell me to "#RTFM!"…

Similarly there needs to be a more granular way to request #TorBridges from #BridgeDB (as it's basically impossible to get #IPv4 #Webtunnel addresses nor is there an option to filter for #ports like :80 & :443 to deal with restrictive #firewalls (i.e. on public #WiFi)…

  • there are flags like ipv6=yes but neither ipv4=yes nor ipv6=no yielded me other resultd than #IPv6 webtunnel bridges…

And before anyone asks: Yes, I do have a "legitimate purpose" as some of my contacts do need Bridges to get beyond a mandatory firewall and/or do use #TorBrowser (through an #SSH tunnel) to circumvent Tor & #VPN blocks and maintain privacy (as many companies do block sometimes entire #Hosters' ASNs due to rampant #scrapers…

bridges.torproject.orgThe Tor Project | Privacy & Freedom OnlineDefend yourself against tracking and surveillance. Circumvent censorship.
Replied in thread
Public
Kevin Karhan :verified:

@shoppingtonz @alternativeto @torproject also every #Tunneling - regardless if #SSH or #VPN or whatever - will inevitably introduce #latency (unless you happen to be customer of a shitty #ISP with horrible #peering and thus can cut down on hops needed, which is AFAIK only a theoretical scenario)...

In fact I stopped using #HEnet #Tunnelbroker and #IPv6-#GIF-Tunneling because it created more issued than it solved on my #IPv4only #Internet connection…

Public *
Royce Williams

Call for volunteer data:

Looking for real sets of hash-protected ssh ~/.ssh/known_hosts files/records, to tune cracking attack stacks on. The bigger the better.

Requirements: the cipher type and the fingerprint are not needed -- just need the hash and salt (first couple of base64 fields).

Individual cracks won't be published. If you want your own cracks, strong proof of ownership required. DM me!

#ssh#HashCracking
Replied in thread
Public *
Kevin Karhan :verified:

@JessTheUnstill @Pibble

And yes, I treat all devices as insecure and would rather invest the time and effort needed get #TechIlliterates up to speed on the #OfflinePGP method!

Given the cheapness of storage (legitimate 1TB microSD cards exist and they ain't 4-digit items!) I'd legitimately look into #OTP #encryption and (IF I had the €€€€€€ to do so!) would even sponsor implementing it in #OpenVPN, #WireGuard and #OpenSSH (for #SSH-Tunmeling).

  • The #US is a #RogueNation with a Rogue Government! The sooner we accept this reality the sooner we can not only adjust to it but act accordingly…

I sincerely wish y'all could legitimately call me a tinfoilhat but so far I've been proven right all the time...

YouTube[English] Pfandleiher on... The offline-pgp-method and why Encrochat, SKY ECC and ANON are failing.By Pfandleiher
Replied in thread
Public
Kevin Karhan :verified:

@Yuki @OS1337 @bjornsdottirs no need to go beyond 1440kB when using mlb instead of #syslinux (which wastes 200kB on it's own!)

  • Also including the #initramfs into the #Kernel can save more due to better compression than two seperate files.

Needless to say the core idea is to be a continuation of #tmsrtbt and a "minimalist #linux distro" as in "#SSH #Terminal #Firmware"...

GitHubGitHub - OS-1337/mlb: Minimal Linux BootloaderMinimal Linux Bootloader. Contribute to OS-1337/mlb development by creating an account on GitHub.
#linux#SSH#terminal
Public
stib

If I have a #codeberg account set up, with a verified #ssh key on my account and the corresponding public and private keys in `~/.ssh/`, is there a way that I can make it so that it doesn't ask me for my keyphrase every time I push? I'm sure VSCode could do this, but since I've switched to #Helix, which doesn't have git built-in I've been manually doing the git stuff.
My knowledge of #cryptography and #git are well and truly at the 'barely enough to get myself into trouble' level.
#AskFedi

ExploreLive feeds
About