Recent content on debugging works! Linux · Code · Security
This is a follow-up of the How to TPM blog post. I read a bit more about FDE on Windows. Windows differs between “device encryption” used on devices running Windows Home edition and BitLocker available only on Windows Pro/Enterprise. Both variations rely on the TPM (binding PCR 7 and 11) and are automatically enabled by default . Technically, the encryption works the same way, but…
The resources of this post can be found on Github . 
 One of my friends had a problem with his laptop: It crashed when screensharing was enabled in a Zoom session. I like to empower people to use Linux, thus I’m also supporting them when they have problems. So I tried to help. 
 It was an old laptop running Ubuntu 22.04 LTS. Before looking into the screenshare issue, we used…
I gave a talk about the current state of full disk encryption at GPN23 (20.06.2025). 
 
			 
		 

 slides (pdf) , submission , media.ccc.de , youtube 
 
 Submission / agenda
 
 
 
 
 In theory, full disk encryption (FDE) just works. You just have to enable it. But in practice, cops get access to a lot of devices, even when they…

 Update 2025/06: Adding feedback I got ( jump ) 
 
 
 Update 2025/07: Follow-up blog post with a bit more insights about Windows FDE ( blog post ) 
 
 
 Update 2026/07: Update smaller things, share some experience at the end ( jump ) 
 
 TLDR : The goal of this text is to make TPMs usable for tech nerds (not only TPM experts). There are a lot of important…
TLDR: I patched i3lock to update a file when I unlock my laptop. I wrote a tool monitoring this file. If it is not modified for a specific time, the daemon executes a kill switch command. As my system does not support hibernation, I implemented my own solution using cryptsetup luksSuspend . The source code can be found on Github . 
 
 On my laptop I wanted to have two security features:…
In general I like the nicolaka/netshoot image for troubleshooting. It has all the tools you need ( ip , curl , …). It’s nice for network debugging used with docker run --network=container:$existing_running_containter . Then you have the same ip/traffic like the container you want to debug. If you’re looking for something like top but for containers, I recommend ctop . Just check…

 Update 2025-04: Fix typos and some smaller clarifications 
 
 So, you’re running Linux with full disk encryption (luks). You feel safe because nobody can access your data. The thing is, if I can modify your boot partition, you’re screwed. Not only can I log your password, but I can also simply deploy a backoor. To show you how easy it is, I will show you my…

 Update 2025/04: Add section “Disk encryption: LUKS + fido2 device” 
Update 2025/04: Add section “Change FIDO2/U2F pin” 
 
 This post shows different use cases for a Yubikey. There are also command line examples in a cheatsheet like manner. I’m using a Yubikey 5C on Arch Linux. If you run into issues, try to use a newer version of ykman (part of…
So, what it firejail? The website says: 
 
 Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.…
Ich sitze gerade im Flixzug und habe wieder das Problem, dass das Internet nicht funktioniert. Auf dem Handy klappt es wie immer problemlos. Was nicht klappt ist die AGBs vom Flixzug zu akzeptieren, um das Internet freigeschaltet zu bekommen. Auf dem Handy poppt einfach ein Browser-Fenster auf, in dem ich auf Akzeptieren klicken kann. Los ging die Debug-Session: 
 Firefox erkennt, dass es im…
I gave a talk at GPN20 about a proof of concept I wrote: an implementation of evil maid attack on devices with an encrypted /boot partition. It covers Linux using GRUB and LUKS. You’ll find the recording on YouTube. For more information and code checkout the Github repository . 
 
			 
		 

 You can also watch it on media.ccc.de .

 Some tools, links and snippets for debugging software on (Arch) Linux
 
 
 
 
 On Arch Linux, we get “unlimited” core dumps. They are stored in the /var/lib/systemd/coredump directory. 
 kmille@linbox:~ ulimit -c
 unlimited
 kmille@linbox:~ cat /proc/sys/kernel/core_pattern
 |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h
…
Some useful commands for network debugging on Linux. 
 
 Wireshark
 
 
 
 
 … on remote host 
 ssh server 'tcpdump -ni any -s0 -U -w - udp port 53' | wireshark -k -i -
 … on remote host over a jump server 
 ssh -J jumpserver server 'tcpdump -ni any -s0 -U -w - udp port 53' | wireshark -k -i -
 … on remote host over a jump server (if…
Why IPsec is hard to debug: 
 
 The fact that you see some plain text, but not all plain text, is the most confusing aspect of IPsec to system administrators, who now believe hey are leaking plain text. 
 
 The better you know how a system works the better you can debug it. So before debugging IPsec read this: 
 
…

 
 Meta
 
 
 
 
 
 There are no hard problems. There is just lack of information about how the system works 
 Remember that the bug is happening for a logical reason 
 Be unreasonably confident in your ability to fix the bug 
 Every error is an opportunity to learn 
 Be aware of the imposter syndrome 
 Get enough sleep and take breaks 
 Try…
So. What’s bpftrace? 
 
 bpftrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). bpftrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level…
tldr : we use Apache Benchmark to send requests to an Apache + PHP-FPM backend while looking at the output of some performance analysis tools. Therefore I captured my terminal with asciinema. On heavy load Linux will queue packets to the Accept Queue. If the queue is full the kernel will drop packets. The source code is available on Github . 
 I recently experienced the following: 
 
…

 Build an example module
 
 
 
 
 Let’s start by write a simple test module. We can try the Hello World example from cyberciti.biz You first have to install the kernel header files with apt-get install kernel-headers-$(uname -r) . 
 Content of hello.c : 
 #include <linux/module.h> 
 #include <linux/kernel.h> 
 
 int init_module ( void )
…
tldr: We take an email and verify the DKIM-Signature step by step using python. We also take care about the signing itself (RSA). The RSA part takes more place than originally planed. The whole code can be found on Github . 
 I recently had an issue with my DKIM signatures. I just got a ‘Signature wrong’ message and couldn’t find out what the problem was. So I decided to take…
I gave a short introduction about web development in Python (flask) at the Jugend hackt event in Berlin. It’s also available on media.ccc.de . The talk was held in German. 
 
			 
		

 Code
 
 
 
 
 
 deezer-downloader - Download music from Deezer with a nice front end 
 riseup-vpn-configurator - a simple command line tool to get RiseupVPN up and running 
 signal-account-switcher - a simple tool to run multiple instances of signal-desktop for Linux, Mac and Windows 
 cryptboot - encrypted boot partition manager with UEFI Secure Boot…