From 01b6e4bd53b74ac93207e5cb4017ec873221c376 Mon Sep 17 00:00:00 2001 From: nemunaire Date: Mon, 24 Jul 2017 00:40:17 +0200 Subject: [PATCH] Import (and cleanup) previous blog posts --- content/post/kernel_configs.md | 29 +++++++++ content/post/pgp_key.md | 24 ++++++++ content/post/ssh_keys.md | 77 ++++++++++++++++++++++++ static/post/ssh_keys/aton_ed25519.pub | 1 + static/post/ssh_keys/aton_rsa.pub | 1 + static/post/ssh_keys/khonsou_ed25519.pub | 1 + static/post/ssh_keys/ouaset.pub | 1 + static/post/ssh_keys/oupaout.pub | 1 + static/post/ssh_keys/rescue.pub | 1 + static/post/ssh_keys/seth_ed25519.pub | 1 + static/post/ssh_keys/seth_rsa.pub | 1 + 11 files changed, 138 insertions(+) create mode 100644 content/post/kernel_configs.md create mode 100644 content/post/pgp_key.md create mode 100644 content/post/ssh_keys.md create mode 100644 static/post/ssh_keys/aton_ed25519.pub create mode 100644 static/post/ssh_keys/aton_rsa.pub create mode 100644 static/post/ssh_keys/khonsou_ed25519.pub create mode 100644 static/post/ssh_keys/ouaset.pub create mode 100644 static/post/ssh_keys/oupaout.pub create mode 100644 static/post/ssh_keys/rescue.pub create mode 100644 static/post/ssh_keys/seth_ed25519.pub create mode 100644 static/post/ssh_keys/seth_rsa.pub diff --git a/content/post/kernel_configs.md b/content/post/kernel_configs.md new file mode 100644 index 0000000..4d14c67 --- /dev/null +++ b/content/post/kernel_configs.md @@ -0,0 +1,29 @@ +--- +title: Linux kernel configuration +date: !!timestamp '2015-04-20 00:00:00' +update: !!timestamp '2017-07-24 00:18:00' +tags: + - kernel +--- + +My favorite distribution is [Gentoo], for 7 years now. + + + +Here are some of my kernel configurations I use: + +* [Dreamplug]: latest public Grsecurity kernel 4.9 (before, I used precompiled kernels from [Xilka]); +* [Cubieboard 2]: Linux 3.4 [custom branch](https://github.com/cubieboard/linux-sunxi.git) for Allwinner A20 (dual-core ARMv7 Cortex-A7 and Mali400 MP2) + upstream patches on 3.4 not merged in the Allwinner tree; +* [Odroid-C1]: Linux 3.10 [custom branch](https://github.com/hardkernel/linux.git) for the Amlogic S805 (quad-core ARMv7 Cortex-A5 and Mali450) + upstream patches on 3.10 not merged in the Hardkernel tree; +* [Mirabox]: latest public Grsecurity kernel 4.9 for the Marvell Armada 370 (with all available features for the board enabled); +* [Cubox-i 4x4]: latest mainline kernel, currently 4.12; +* [Creator CI20]: Linux 3.18 [custom branch](https://github.com/MIPS/CI20_linux.git) for the Ingenic JZ4780 SoC + upstream patches on 3.18 not merged in the imgtec tree. + +[Gentoo]: http://www.gentoo.org/ +[Dreamplug]: http://www.globalscaletechnologies/p-54-dreamplug-devkit.html +[Xilka]: http://www.xilka.com/sheeva/ +[Odroid-C1]: http://www.hardkernel.com/main/products/prdt_info.php?g_code=G141578608433 +[Cubieboard 2]: http://cubieboard.org/model/cb2/ +[Mirabox]: http://www.globalscaletechnologies/p-58-mirabox-java-devkit.html +[Cubox-i 4x4]: http://www.solid-run.com/product/cubox-i-4x4 +[Creator CI20]: http://store.imgtec.com/uk/product/mips-creator-ci20/ diff --git a/content/post/pgp_key.md b/content/post/pgp_key.md new file mode 100644 index 0000000..b6371bf --- /dev/null +++ b/content/post/pgp_key.md @@ -0,0 +1,24 @@ +--- +title: PGP key +date: !!timestamp '2015-06-29 00:00:00' +update: !!timestamp '2017-07-24 00:45:00' +tags: + - privacy + - cryptography +--- + +My personal PGP key is the following: [0x842807a84573cc96]. + + pub 4096R/4573CC96 2014-06-23 [expires: 2018-07-01] + Key fingerprint = E722 B5B7 3CA7 FA93 5FC1 AA09 8428 07A8 4573 CC96 + uid Pierre-Olivier Mercier + sub 4096R/9D2855C3 2014-06-23 [expires: 2018-07-01] + + + +This key is also available through [OpenPGP DANE], generated by [this script]. + + +[0x842807a84573cc96]: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x842807A84573CC96 +[OpenPGP DANE]: https://www.ietf.org/id/draft-ietf-dane-openpgpkey-06.txt +[this script]: https://gist.github.com/nemunaire/447c989e9f098c679edb diff --git a/content/post/ssh_keys.md b/content/post/ssh_keys.md new file mode 100644 index 0000000..6f105d7 --- /dev/null +++ b/content/post/ssh_keys.md @@ -0,0 +1,77 @@ +--- +title: My private SSH keys managment +date: !!timestamp '2015-02-19 00:00:00' +update: !!timestamp '2017-07-23 22:45:00' +tags: + - cryptography + - ssh +--- + +I always have a different SSH key pair per machine. The aim is to really never +copy my private key from a machine to another over network or USB stick. + + + +## Client keys + +With this approch, if one of my host is compromised and/or my key could have +been exposed, I have only to remove granted access to this key to host or +services (OK, that can be painful to find such services), but I can continue to +use other no-compromised keys to work. + +As you can see on my [github](https://github.com/nemunaire.keys) account, I've +registered several keys, because I don't work from the same machine every time. + +It can sometime be complicated to give me access to machine, but in most case, +I tend to centralize most of my outgoing connections from a single host, which +is in fact my home desktop: oupaout. + +Here is a list of my keys' md5 fingerprints: + +* `assouan` +* [`aton`](aton_ed25519.pub): 0d:89:02:4a:45:51:0c:43:e8:be:2e:99:38:5b:88:0e (ED25519) +* [`aton`](aton_rsa.pub): ee:61:d5:bf:b0:23:93:1a:bb:32:ef:34:10:fb:aa:77 (RSA 4096) +* `bastet` (legacy): 4a:51:80:24:b0:69:7a:59:fc:44:08:29:aa:15:42:5b (RSA 4096) +* EPITA personal rack (legacy): 91:95:bc:4e:e7:b2:5b:9c:7f:71:4a:7d:0a:43:80:17 (RSA 4096) +* EPITA SSH gate (legacy) +* EPITA YACKU laboratory (legacy): 80:7c:8e:42:53:ee:0f:b5:27:d5:63:ab:b4:5a:46 (RSA 4096) +* [`khonsou`](khonsou_ed25519.pub): 0d:89:02:4a:45:51:0c:43:e8:be:2e:99:38:5b:88:0e (ED25519) +* khonsou_old: f5:dc:fd:db:c8:ce:ec:df:33:86:54:58:05:7e:d2:74 (ED25519) +* `montou`: this machine can't be used as outgoing host. +* `nout`: this machine can't be used as outgoing host. +* `nout_old`: e8:69:71:3c:5e:cc:3c:d5:7d:a2:67:30:a9:35:df:24 (RSA 4096) +* [`ouaset`](ouaset.pub): 5e:01:65:8c:ae:9e:6e:f3:a5:88:80:16:fa:bf:d6:ac (ED25519) +* [`oupaout`](oupaout.pub): 30:04:ad:11:57:e0:e9:dc:a2:e0:d2:65:cd:60:9a:ab (ED25519) +* [Rescue key](rescue.pub): 30:15:a7:3f:0b:51:7a:53:7b:47:bd:00:21:55:ee:bd (RSA 4096) +* `satis`: this machine has no key pair yet. +* [`seth`](seth_ed25519.pub): 6a:1f:05:60:fa:6b:32:f3:2d:ba:e3:36:e7:6b:7b:13 (ED25519) +* [`seth`](seth_rsa.pub): 03:a9:3a:3a:e1:e0:99:24:69:15:cb:a5:58:5c:3f:6c (RSA 4096) +* `seth_old`: 97:8c:bc:9a:ec:62:8d:b8:1a:88:b1:0d:d9:62:1a:04 (RSA 4096) + +### Get the fingerprint from a private or public key file + +```sh +ssh-keygen -l -E md5 -f KEY_FILE +``` + + +## Server keys + +The `nemunai.re` domain, contains [SSHFP] records for each physical host. To avoid answering this message without further checks: + + The authenticity of host 'nemunai.re (203.0.113.42)' can't be established. + RSA key fingerprint is 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff. + Are you sure you want to continue connecting (yes/no)? + +you can use the following command: `ssh -o "VerifyHostKeyDNS yes" $HOSTNAME.nemunai.re` + +[SSHFP]: http://tools.ietf.org/html/rfc4255 + + +### Generate SSHFP records + +SSHFP records can be generated with the following command: + +```sh +ssh-keygen -r HOSTNAME +``` diff --git a/static/post/ssh_keys/aton_ed25519.pub b/static/post/ssh_keys/aton_ed25519.pub new file mode 100644 index 0000000..fd353c8 --- /dev/null +++ b/static/post/ssh_keys/aton_ed25519.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFSbCCfFO1+yxogpg1DfCPSQU48oWqYM6/05TYzNhPmc nemunaire@aton diff --git a/static/post/ssh_keys/aton_rsa.pub b/static/post/ssh_keys/aton_rsa.pub new file mode 100644 index 0000000..5433899 --- /dev/null +++ b/static/post/ssh_keys/aton_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwwJxAJ99OK0W6CPV/0aDTFlts9xzEKKc+V8r2f0zaXpxuKSGgeWVOrSFU0nTEOZGlGh5kBIBHlizaeh9Bb5Io0V8Hafljwx/yJ+51czlnyoRZ49VDnufEd+qVW8Up8Kelsro+y+hu9BAcUoPhjlj+QyeUkEO1ytJFFi7LLelXGGHNiM3cYR9ewncy4oDIQNOrSgTrjdHjP2+0Zh0QV92SfX4KAUFfgW2BMhUi5/gk8aLMJQnRNaO2dVtWQoxLf03LEW87oRcnvepZR/IfUkAdjqp2dSQiSKjNUXdKkNSoZ+ErVSm3vTSbx9ju7Rk7i53so4uYIK0gGiGj1XJX8uIH/CllteLu84+ztCX+s4ouUWz0PuZYkm9B9JJ0JpqEdYS5tf7jWagMAvaluCWbHxpCNylzOCfne3Xa9X7vv4Jo0DdDMwQpyKXqa2AxBMPLVJ+hBKSTjkQUZUezfVgNjauIBOwsqwPLifxpMLOXFp2dTD98ZlfruTCOW11Wn2XeQmrVdI12ZPIDFv8ayAxQyAxo0zMQEKU4z0xuTtC+DG9KNKsxjROSWnxT0poWrL9ZZrWduLfAgTerX2HkUZ+ihQMQbAMMVSdg2JdPafW2ZX+ikjD8J/DffOYE0t4UlqucV7Vl/jwKZpcP65nKfFMK1q5oH8QvI7azt+yUHOBIcJCBSQ== nemunaire@alarm diff --git a/static/post/ssh_keys/khonsou_ed25519.pub b/static/post/ssh_keys/khonsou_ed25519.pub new file mode 100644 index 0000000..4e03859 --- /dev/null +++ b/static/post/ssh_keys/khonsou_ed25519.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDO/3qKhSUbGYZBVraFo68oScJahRDNQfG+uwDQlLv7g nemunaire@khonsou diff --git a/static/post/ssh_keys/ouaset.pub b/static/post/ssh_keys/ouaset.pub new file mode 100644 index 0000000..9b4cd9b --- /dev/null +++ b/static/post/ssh_keys/ouaset.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBpFOv1s7mVb6XWPOLd1U+jzt5WA04CnuJVmY5TvaMhw nemunaire@ouaset diff --git a/static/post/ssh_keys/oupaout.pub b/static/post/ssh_keys/oupaout.pub new file mode 100644 index 0000000..c96353b --- /dev/null +++ b/static/post/ssh_keys/oupaout.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/Aa53VeE2XWjo/ItqtuLZ9Jd9oHfhzSjPl6KLEqkBS nemunaire@oupaout diff --git a/static/post/ssh_keys/rescue.pub b/static/post/ssh_keys/rescue.pub new file mode 100644 index 0000000..b9af9b5 --- /dev/null +++ b/static/post/ssh_keys/rescue.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA5oAoOMAr8RrsBmOE1kyiD6C5+qbdK0NgSS3ZlNOn4dpkD1w5hmrGwGT4O2P8vCC9o95sLRzvrxkHbs+YZhsz04uxmG4zEgS+x1BZuaQBt1V1hBWk8ldqPfZfAEauPQeQZMdKJfbJKYzecRLWIh2jK1sMx0Vmd3CfU/FwEHdlJh3oTKWFsAlukSYnql2dXG3VMzRpaRyh4uu5wFA+Ya6CE5OjcM4o9/JSfGxErK4fvnSPpbplraKqpKvEqX4XC70u5JCLlWSfJ2Es0nIeQ+0QhYxQt4MsaUCBkFoU10wyaDstWfzE4TiMBmrI+JnrbJiODUxsdoKQGS1ZS2EIP7tUjl9N/Z/x6IAPS4TxMTu9dY+k2hRVvpM1h7vwsTPxINlaoPHeni7TF3M6ksR0chQXtbsKBuCAxOnKKoB13WhQcR60G0hqK/5JSTqYiAG2hwlEJTqqcWuYIlgOpWhyQ8cfbL5Xb5SaZmADp6GOoxJxGbjOrnGMLEPcUPkok6hqt1SgegCTJa1nYmpdzutPCJYy3HCd93L8Uwr/+FBJtAY5Imu6gIgmUW+scOzjZbXRYocjClemYPz/mb7ZSuMT3OfrsqaqZ3IJnXi70l7jH6I3DXY8BOgwQM2zkfPJKWHKPrQfTdhfpBq2Nf/kvQERTfqOWGm7YMa5+dP9NUBGbuCCo8E= nemunaire@ssh diff --git a/static/post/ssh_keys/seth_ed25519.pub b/static/post/ssh_keys/seth_ed25519.pub new file mode 100644 index 0000000..be387cd --- /dev/null +++ b/static/post/ssh_keys/seth_ed25519.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9udkt8V/GFYwa4TMz7XHdedBSTScXxTAdJDdriu/AC nemunaire@seth diff --git a/static/post/ssh_keys/seth_rsa.pub b/static/post/ssh_keys/seth_rsa.pub new file mode 100644 index 0000000..e9978ee --- /dev/null +++ b/static/post/ssh_keys/seth_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDlU/aEbNdDHR2bAmzDY2hIowGfa9oNGyL69tzEK2cpOa+u7PwNzCzWPLytwsO9frOylNtRDiTckbVNdPxMZDkZieeZ5PqWEvWe7hbsh+xds1An2t3tEX6x3QWrxZZo2SNTgck5IqPcufBG+cFxJZlK8pZGkDwGw+x6mHJdLZL2bgMwwvutw1BSF/atF6GLZpztX/y1FM6JQpMCAsrzESoUpDD/Q7BEGb7wCYt+eq/51jUS60g0fC7ob2Xl/nhmnWUkg3U+x/DyY0foqiOMGhSaXdkerfyZMpLCURvH6sOT8EzNzzLRj66Ht8043Vqysoq+pFtj8zyTNVi76QWMkNK7avKXl+rK6dW9zAQidmZcnwPl0qAlkWQjhOgA7xe2TdTM5Yl6HXpmT6T6PHCsIggyCxgCg2ao+ptqPJ4UwvGP2bAz8uLdQp4t+q1hp825o7EtvtnJpJMTksNwOe96iCFjm90O+pmOhLTRVDtgdAknmtIovHnOrZX2zbo1XZHATRx6QOrGwIHU8drSMy878Fd9lb3HVx+595rQ7gh+2Qu87vqk1kZPTFSbn7nMB/l2ROVp4zagXzN8T7Ek3CRP/mIrzyU/3WhOGhbB+bkvWrWRRBnejxQLZkMPl9vAZ5VSNZ2K1OTHasQBy9PaMW5ucd83Jv+jl+xPoJbXsvpzbu6EHw== nemunaire@seth