Firstyear's blog
In an earlier post, I discussed how Passkeys were single factor and why that was mostly okay. Today, I want to go over the other side of this in more detail - what happens when you have stronger requirements around the Passkeys that can be used in your environment, and how you can assess devices for trustworthiness? TL;DR If you want the "easy-path" answer, where myself and the Kanidm +…
The default FreeBSD upgrade procedure with either distribution sets or package base both operate in the same way - a boot-environment is created of the current system state, and then the running system is manipulated inplace to perform the upgrade. The created boot-environment is there in case of a failure. However, I have grown accustomed to transactional updates be that from Fedora Atomic (yes…
I have once again awoken and chosen to cause a kerfuffle. Now to save you reading the whole post I will give you the conclusion now: Passkeys are single factor, except when they are not. And that mostly doesn't matter. Until it does. You can fight amongst yourselves as to which camp you belong in. Origin of Multi Factor Authentication To understand why Multi Factor Authentication (MFA) is…
Part of my role as a software engineer (and formerly a sysadmin) is that I need to read - and understand standards. As Ben Eater said once in his channel "standards trade clarity for specificity". This has many consequences - some of which we know as people implementing the standard incorrectly due to the lack of clarity (I've made this mistake plenty!). But I think this strive for accuracy…
It's now late into 2025, and just over a year since I wrote my last post on Passkeys. The prevailing dialogue that I see from thought leaders is "addressing common misconceptions" around Passkeys, the implication being that "you just don't understand it correctly" if you have doubts. Clearly I don't understand Passkeys in that case. And yet, I am here to once again say - yep,…
FreeBSD Jails are a really useful way to isolate and run processes in a container under FreeBSD. You can either create thick jails similar which allow different versions of a whole isolated FreeBSD OS, or you can create thin or service jails that share resources and are very lightweight. Regardless, you need to attach a network to your jail so you can expose services. There are a number of ways to…
It is that beautiful time of year where once again MacOS has decided to forget how to search my Mail.app inboxes. There are plenty of reports online about this issue occuring over the last few years and it appears there is no obvious solution - or fix from Apple. What occurs is when you attempt a search in Mail.app's interface, no results are returned and the status area shows as permanently…
After a local security meetup where I presented about Webauthn, I had a really interesting chat with a member about a possible Yubikey management strategy. Normally when you purchase a yubikey it's recommended that you buy two of them - one primary and one backup. But how do you keep them in sync? You have to ensure every key you enroll on the primary is also on the backup! This means you…
While at Everything Open, I got to catch up with Rob N and chat about what we had been working on the last few years. We got chatting about a really interesting issue he was having with a patch for ZFS he'd be working on where he couldn't find what was decrementing a reference counter too far and causing issues. While chatting about this I had the idea "Why not change the amount the…
Common questions we see in the OpenSUSE community are "which distro is the least bloated", "how can I remove bloat", "package X is bloat" etc. For the longest time this has confused me - Linux while sometimes slow, isn't "bloated". So where are all these questions coming from? What is Bloat? It was only recently while watching an older Gamers Nexus video on a prebuilt Dell PC that I realised…
On the 3rd of September, Yubico announced YSA-2024-03, a vulnerability in the infineon cryptograhpic library which may allow private key extraction to be performed. As is tradition, arm chair experts and thought leaders everywhere rushed to have hot takes on the situation, without adequately understanding the way that the attack works and how it fits into Webauthn on a technical level. TL;DR - Do…
Due to a certain motherboard manufacturer having no quality control of their firmware updates, my previous home lab server had 4 of it's 12 DIMM slots fail. This necesitated a rapid replacement of the machine, as I use it heavily for work. While frustrating, rather than lift my existing OpenSUSE Leap install to the new machine, I decided to reinstall - this time, with ZFS as the root…
Surprising absolutely no-one, I as an underachiving white man have opinions on things that are somewhat out of my normal subject matter areas. What is more surprising is that for some reason people want to hear them, so I have been bullied into writing a blog post to answer the general question: "What do I think about filesystems on linux". What Currently Exists? Today in August of 2024 the…
As the maintainer of Rust in openSUSE I am often asked to support build reproducibility in our supply chain. I've spent countless hours researching the problem, and discussing it with security experts to understand details. Thanks to the XZ incident this topic has once again come up, since after any security incident people always use the attention to further their own agendas. As a result,…
A somewhat hidden feature of MacOS is that it has excellent builtin support for PIV (smartcard) authentication. In this guide, we'll go through how to set that up. In this example we'll be using yubikey 5's as our smartcards. This may require you to alter some commands used in this guide. Prerequisites If you are using yubico's piv tool you should install it from yubico's…
At around 11pm last night my partner went to change our lounge room lights with our home light control system. When she tried to login, her account couldn't be accessed. Her Apple Keychain had deleted the Passkey she was using on that site. This is just the icing on a long trail of enshittification that has undermined Webauthn. I'm over it at this point, and I think it's time to…
XZ Ahh, it's that beautiful spontaneous time of year. A major public security incident has occured in opensource. All of the epidemiologist's of 2020 suddenly emerge from their chrysalis once more as a beautiful incarnation of a security expert. The hot takes flow more freely than cocaine at a Liberal party event. My share portfolio doubled in value due to taking a long position on…
SSH Key Authentication Basics SSH (Secure Shell) allows remotely accessing the command line interface (cli) of a remote machine. This is very useful for administration of a machine that may be in a completely different country or building. Because of this SSH is a very attractive target for attackers. Defaults The default is to login with a username and password. ┌───────┐ ┌───────┐ │ │ │ │ │…
Webauthn Attestation and OpenSource Keys Webauthn (Passkeys) are only going to become more important in the future and as this grows, deployments with higher security risks and criticality are going to need to start to understand and embrace attestation of their keys. In their current form, almost all software products and IDM's today allow you to enroll any cryptographic authenticator. It…
Getting Started with PKCS11 PKCS11 is one of those horrible mystery technologies, that just seems to have no good starting place or reference on how to make it work. But it's also a technology that you see commonly around for hardware security modules (HSM), trusted platform modules (TPM) and other high impact cryptographic environments. This makes it an annoying chasm to cross for developers…
SSH Key Storage A kind reader asked me an interesting question the other day. "What do you think of the choice of ssh sk keys between ecdsa and ed25519?". At the same time, within Kanidm we have actually been discussing the different approaches we could take with ssh key handling in the future between ssh cas and ssh sk key attestation, especially once we consider service accounts. As with…
Storage Administration Guide This guide will help you understand, configure and maintain storage on Linux servers. The content of this guide is optimised for reliability and accesibility. This is based not only on my own experiences but observing the experiences of enterprise customers for many years. ⚠️ Warnings ⚠️ Making changes to storage entails risks. Linux and it's storage tools have no…
Starting with Rage on OpenSUSE Rage is a rust implementation of Age, a modern, simple and secure file encryption tool. It is easier to use than other tools like GPG, and being written in a memory safe language it avoids many of the exploits that may occur in C based tools. Installing Rage You can install rage on leap or tumbleweed from zypper zypper install rage-encryption Alternately you can…
About I'm William (Firstyear), a software engineer in Brisbane, Australia. I'm part of the 389 Directory Server team, working for SUSE Labs. I'm always happy to talk LDAP and programming, and am very happy to help out with your issues and queries. I can be contacted about entries on my blog at william at blackhats dot net dot au. If there is anything you would like to see on this…
Using a TPM for SSH keys on OpenSUSE Tumbleweed In some environments it is required to store ssh private keys in a way where they can not be extracted from the machine. Trusted Platform Modules (TPM) are an excellent way to achieve this. While other guides exist online for how to configure this for other distributions, this will focus on OpenSUSE Tumbleweed. Install Packages The following is…
How Hype Will Turn Your Security Key Into Junk In the last few months there has been a lot of hype about "passkeys" and how they are going to change authentication forever. But that hype will come at a cost. Obsession with passkeys are about to turn your security keys (yubikeys, feitian, nitrokeys, ...) into obsolete and useless junk. It all comes down to one thing - resident keys. What is a…
Why are PBKDF2-SHA256 and PBKDF2_SHA256 different in 389-ds? In a mailing list discussion recently it came up about what password hash format should you use in 389-ds. Confusingly we have two PBKDF2 SHA256 implementations, which has a bit of history. Too Lazy, Didn't Read Use PBKDF2-SHA256. (hyphen, not underscore). What's PBKDF2 anyway? Passwords are a shared-knowledge secret, so…
Why Decentralised ID Won't Work Thanks to a number of high profile and damaging security incidents in Australia people have once again been discussing Decentralised ID (DID). As someone who has spent most of the career working on identity management, I'm here to tell you why it will not work . What Is Decentralised ID Trying To Do? To understand what DID is trying to achieve we have to…
Where to start with linux authentication? Recently I was asked about where someone could learn how linux authentication works as a "big picture" and how all the parts communicate. There aren't too many great resources on this sadly, so I've decided to write this up. Who ... are you? The first component in linux identity is NSS or nsswitch (not to be confused with NSS the cryptography…
Exploring Webauthn Use Cases Webauthn is viewed by many people and companies as the future of authentication on the internet and within our workplaces. It has the support of many device manufacturers, browser vendors and authentication providers. But for Webauthn's lofty goals and promises, as a standard it has many fractured parts. Many of the features it claims at best don't work, at…
Enable caBLE on your iPhone for testing caBLE allows a nearby device (such as your iPhone) to be used an a webauthn authenticator. Given my work on WebauthnRS I naturally wanted to test this! When I initially tried to test caBLE with webauthn via my iPhone, I recieved an error that the operation wasn't available at this time. There was no other information available. Debugging After some…
Documentation PR's Welcome - Why Docs Are Not A Beginner Friendly Task Recently I was reporting a usability issue with a library, mainly related to it's confusing or absent documentation. A friend of mine saw the exchange and commented (quite accurately) that it went along the lines of: Me: This library should improve it's documentation Project: PR's welcome Me: I can't…
How CTAP2.0 made UserVerification even more confusing I have previously written about how Webauthn introduces a false sense of security with how it manages UserVerification (UV) by default. To summarise, when you request "preferred" which means "perform UV if possible", it can be bypassed since relying parties's (RP) do not check if UV was actually performed, and Webauthn makes no…
Nextcloud - Unable to Open Photos Library I noticed since macos 11.6.2 that Nextcloud has been unable to sync my photos library. Looking into this error in Console.app I saw: error kernel System Policy: Nextcloud(798) deny(1) file-read-data /Users/william/Pictures/Photos Library.photoslibrary It seems that Nextcloud is not sandboxed which means that macos enforces stricter…
Transactional Operations in Rust Earlier I was chatting to Yoshua, the author of this async cancellation blog about the section on halt-safety. The blog is a great read so I highly recommend it! The section on halt-safety is bang on correct too, but I wanted to expand on this topic further from what they have written. Memory Safety vs Application Safety Yoshua provides the following code example…
Results from the OpenSUSE 2021 Rust Survey From September the 8th to October the 7th, OpenSUSE has helped me host a survey on how developers are using Rust in their environments. As the maintainer of the Rust packages in SUSE and OpenSUSE it was important for me to get a better understanding of how people are using Rust so that we can make decisions that match how the community is working. First,…
Gnome 3 compare to MacOs An assertion I have made in the past is that to me "Gnome 3 feels like MacOs with rough edges". After some discussions with others, I'm finally going to write this up with examples. It's worth pointing out that in my opinion, Gnome 3 is probably still the best desktop experience on Linux today for a variety of reasons - it's just that for me, these rough…
StartTLS in LDAP LDAP as a protocol is a binary protocol which uses ASN.1 BER encoded structures to communicate between a client and server, to query directory information (ie users, groups, locations, etc). When this was created there was little consideration to security with regard to person-in-the-middle attacks (aka mitm: meddler in the middle, interception). As LDAP has become used not just…
Getting started with Yew NOTE This post is really out dated now, there are easier ways to start. See the yew official docs as this process has gotten much easier! Yew is a really nice framework for writing single-page-applications in Rust, that is then compiled to wasm for running in the browser. For me it has helped make web development much more accessible to me, but getting started with it…
Compiler Bootstrapping - Can We Trust Rust? Recently I have been doing a lot of work for SUSE with how we package the Rust compiler. This process has been really interesting and challenging, but like anything it's certainly provided a lot of time for thought while waiting for my packages to build. The Rust package in OpenSUSE has two methods of building the compiler internally in it's…
Open Source Enshrines the Wrong Privilege Within Open Source/Free Software, we repeatedly see a set of behaviours - hostile or toxic project owners, abusive relationships, aggression towards users, and complete disregard to users of the software. Some projects have risen above this and advanced the social behaviours in their communities, but these are still the minority of projects. Many…
Time Machine on Samba with ZFS Time Machine is Apple's in-built backup system for MacOS. It's probably the best consumer backup option, which really achieves "set and forget" backups. It can backup to an external hard disk on a dock, an Apple Time Machine (wireless access point), or a custom location based on SMB shares. Since I have a fileserver at home, I use this as my Time Machine…
Against Packaging Rust Crates Recently the discussion has once again come up around the notion of packaging Rust crates as libraries in distributions. For example, taking a library like serde and packaging it to an RPM. While I use RPM as the examples here it applies equally to other formats. Proponents of crate packaging want all Rust applications to use the "distributions" versions of a crate.…
Getting Started Packaging A Rust CLI Tool in SUSE OBS Distribution packaging always seems like something that is really difficult or hard to do, but the SUSE Open Build Service makes it really easy to not only build packages, but to then contribute them to Tumbleweed. Not only that, OBS can also build for Fedora, CentOS and more. Getting Started You'll need to sign up to service - there is a…
Webauthn UserVerificationPolicy Curiosities Recently I received a pair of interesting bugs in Webauthn RS where certain types of authenticators would not work in Firefox, but did work in Chromium. This confused me, and I couldn't reproduce the behaviour. So like any obsessed person I ordered myself one of the affected devices and waited for Australia Post to lose it, find it, lose it again,…
Rust, SIMD and target-feature flags This year I've been working on concread and one of the ways that I have improved it is through the use of packed_simd for parallel key lookups in hashmaps. During testing I saw a ~10% speed up in Kanidm which heavily relies on concread, so great, pack it up, go home. ...? Or so I thought. Recently I was learning to use Ghidra with a friend, and as a thought…
Deploying sccache on SUSE sccache is a ccache/icecc-like tool from Mozilla, which in addition to working with C and C++, is also able to help with Rust builds. Adding the Repo A submission to Factory (tumbleweed) has been made, so check if you can install from zypper: zypper install sccache If not, sccache is still part of devel:tools:building so you will need to add the repo to use sccache.…
How a Search Query is Processed in Kanidm Databases from postgres to sqlite, mongodb, and even LDAP all need to take a query and turn that into a meaningful result set. This process can often seem like magic, especially when you consider an LDAP server is able to process thousands of parallel queries, with a database spanning millions of entries and still can return results in less than a…
Using SUSE Leap Enterprise with Docker It's a little bit annoying to connect up all the parts for this. If you have a SLE15 system then credentials for SCC are automatically passed into containers via secrets. But if you are on a non-SLE base, like myself with MacOS or OpenSUSE you'll need to provide these to the container in another way. The documentation is a bit tricky to search and…
Windows Hello in Webauthn-rs Recently I've been working again on webauthn-rs , as a member of the community wants to start using it in production for a service. So far the development of the library has been limited to the test devices that I own, but now this pushes me toward implementing true fido compliance. A really major part of this though was that a lot of their consumers use windows,…