aboutsummaryrefslogtreecommitdiff
path: root/extra.html
blob: 7c1ebbbbd85a4edc25d620ae63c3d588005f9bd8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
<html lang="en">
  <head>
    <title>Extra Extra</title>
    <link rel="stylesheet" href="style.css">
    <style>
    code {
      border: 1px solid grey;
      border-radius: 3px;
      color: #434C5E;
      padding: 1.5px;
    }
    pre {
      background: #f4f4f4;
      border: 1px solid #grey;
      color: #434C5E;
      padding-top: 20px;
      padding-left: 20px;
      overflow: auto;
    }
    </style>
  </head>
  <body>
    <a style="text-decoration: none;" href="index.html"><--</a>
    <h2>Some bits & bobs</h2>
    Here lives some miscellaneous things I reference one or one hundred
    times and figure they should be gathered somewhere.
    <h3>WPA Supplicant</h3>
    Frequently forgotten usage of the <code>wpa_cli</code> tool
    <pre>
> scan
...
<3>CTRL-EVENT-SCAN-RESULTS
> scan_results # run once above event appears
bssid / freq / sig lvl / flags / ssid
...
> add_network
#
> set_network # ssid "network"
> set_network # psk "psswd"
# or if no password:
> set_network # key_mgmt NONE
> enable_network #
> save_config
    </pre>
    <h3>GPG key signing with Git</h3>
    Sometime ago I spent hours on this. When signing a
    commit, this error would appear
    <pre>
gpg: skipped "Foo Bar <Foo_Bar@baz>": No secret key[GNUPG:] INV_SGNR 9 Foo Bar <Foo_Bar@baz>[GNUPG:] FAILURE sign 17
gpg: signing failed: No secret key
    </pre>
    After much searching I came up empty handed. Finally, one thing
    stood out. The name and email in <code>~/.gitconfig</code> must
    match exactly to the name and email associated with the GPG key
    <pre>
$ gpg --list-secret-keys --keyid-format=long
/home/foo/.gnupg/pubring.kbx
-----------------------------
sec   rsa4096/FC53C827D09C7050 2019-03-24 [SC]
      ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
uid                 [ultimate] <b>Foo Bar &ltFoo_Bar@baz&gt</b>
ssb   rsa4096/2EE67124D597BB00 2019-03-24 [E]

$ head -n 4 .gitconfig
[user]
        <b>name = Foo Bar
	email = Foo_Bar@baz</b>
	signingkey = FC53C827D09C7050
    </pre>
    <h3>SSH agent for password-less login</h3>
    I have numerous machines I frequently log in to and from via SSH. Typing
    in a password every time is tiresome and a password-less key is not
    an option. A solution is an SSH agent running in the background, which
    prompts for a password once at log in, and stores it for the duration
    of the session (until reboot). The following can live in your shell's
    startup file (e.g. <code>~/.zshrc</code>)
    <pre>
if [ ! -S ~/.ssh/ssh_auth_sock ]; then
  eval "$(ssh-agent)"
  ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi
export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock
ssh-add -l > /dev/null || ssh-add
    </pre>
    Then, just copy the needed key between machines with <code>ssh-copy-id -i ~/.ssh/id_xxx.pub name@host</code>
    <h3>Configuration file manager</h3>
    Across the aforementioned machines, I also have various configuration
    files that I like to keep track of for the sake of backing
    them up in case of data loss. I use <a href="https://github.com/TheLocehiliosan/yadm" target="_blank">yadm</a>
    to achieve this. Mostly for it's ease of use (yadm is quite simply
    an alias for git) and minimal system footprint, which consists mostly
    of a git directory living out of sight in <code>~/.local/share/yadm/repo.git</code>.
    Since it's just Git under the hood, a standard <code>.gitignore</code>
    file can be used to ignore which ever files you choose in your home directory.
    By default, yadm only manages files within your home directory. While not
    conventional, it can also be used to track system-level files by creating
    an alias like <code>sysyadm="sudo yadm --yadm-dir /etc/yadm --yadm-data /etc/yadm/data"</code>,
    then used like normal.
    <pre>
# sysyadm init -w /
# sysyadm add foo.conf
# sysyadm commit -m "foo"
    </pre>
    <h3>Hardware security key for authentication on Linux</h3>
    Typing in a rather long password each time I log into my computer
    or need to complete a privileged task can be bothersome. A couple
    years ago I came across <a href="https://github.com/solokeys" target="_blank">solokeys</a>,
    which are fully open source hardware and firmware security keys. I
    chose to build the <a href="https://github.com/solokeys/solo-hw" target="_blank">Solo 1</a>
    (or five because that's the MOQ from most PCB manufacturers). Note,
    at the time of writing this, the <a href="https://github.com/solokeys/solo1-cli" target="_blank">solo1-cli</a>
    tool is currently broken with the latest FIDO2 library, meaning
    it must be installed explicitly at 0.9.3.
    <pre>
$ pip install solo1
$ pip install fido2==0.9.3
    </pre>
    After building, I didn't use it much, as many services don't support
    security keys quite yet, or required a paid subscription (I'm looking
    at you, Bitwarden). Come a few months ago, I found <a href="https://github.com/Yubico/pam-u2f" target="_blank">Yubico's PAM for U2F</a>. This is a PAM module to provide authentication from a U2F device.
    To use this, first ensure the <code>CONFIG_HIDRAW</code> and
    <code>CONFIG_USB_HIDDEV</code> options are set in your kernel.
    Next, obtain the module via package manager or compiling from source
    and generate the authorisation mapping with your key inserted. The
    created directory must be named <code>Yubico</code>, even if not
    using a Yubico key. It can be overridden in <a href="https://github.com/Yubico/pam-u2f/blob/main/util.h#L14" target="_blank">util.h</a>
    if you so choose.
    <pre>
$ mkdir ~/.config/Yubico
$ pamu2fcfg > ~/.config/Yubico/u2f_keys
Enter PIN for /dev/hidraw2:
    </pre>
    Assuming all has been successful, you can configure PAM services
    to use the device. The following configures doas to utilise the
    U2F module in the <code>/etc/pam.d/doas</code> file. The same line
    can be added in other files where needed (eg. display manager,
    <code>system-local-login</code>, etc.)
    <pre>
auth sufficient pam_u2f.so cue pinverification=0
auth include system-auth
...
    </pre>
    Above, <b>sufficient</b> indicates that authentication from the device
    alone is enough to fully authenticate. Use <b>required</b> instead
    if you want both password and device authentication to be required.
    <b>cue</b> simply displays a prompt to press the button on the device
    when needed to authenticate. <b>pinverification=0</b> disables the need
    to entre the passphrase associated with your security key. Note, this
    means your system can be accessed only with your key, and no password entry
    of any type. Set the parameter to 1 if you'd like otherwise. Another
    thing of interest was locking/unlocking my system automatically when
    the key is removed/inserted, respectively. This can be achieved via
    a custom udev rule that executes a script when a device matching
    our key's VID/PID is plugged in. This script will use <a href="https://pamtester.sourceforge.net" target="_blank">pamtester</a>
    to test for authentication success.
    <pre>
#!/bin/bash
if [ "$1" == "lock" ]; then
    # lock system
else
    if [ echo "" | pamtester login <user> authenticate ]; then
        # kill lock program
    fi
fi
exit 0
    </pre>
    Now, a custom udev rule that lives in <code>/etc/udev/rules.d/70-solokey.rules</code>
    and looks for a matching VID/PID and executes this script when
    found with the appropriate argument.
    <pre>
ACTION::"remove", ENV{DEVTYPE}::"usb_device", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh lock"
ACTION::"add", ENV{DEVTYPE}::"usb_device", ENV{ID_BUS}::"usb", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh unlock"
    </pre>
  </body>
</html>