Recent content on Patryk's blog
If you’d like to have a simple solution for managing all the secrets you’re using in your Ansible Playbooks, keep reading on. Bitwarden’s Secrets Manager provides an Ansible collection , which makes it very easy to use this particular Secrets Manager in Ansible Playbooks. I’ll show you how to set up a free Secrets Manager account in Bitwarden. Then I’ll walk you through the setup in an example…
Secrets Manager for Homelab For a few years, I’ve been managing the configuration of a bunch of self-hosted services using Ansible Playbooks. Each playbook needed at least one secret — the sudo password. Many of them needed to manage more (e.g. SMTP credentials for email notifications). Because I’ve always been paranoid about security, I stored most of those secrets in Ansible Vault, the password…
syncoid to TrueNAS In my homelab, I have 2 NAS systems: Linux (Debian) TrueNAS Core (based on FreeBSD) On my Linux box, I use Jim Salter’s sanoid to periodically take snapshots of my ZFS pool. I also want to have a proper backup of the whole pool, so I use syncoid to transfer those snapshots to another machine. Sanoid itself is responsible only for taking new snapshots and pruning old ones…
openpgp-paper-backup I’ve been using OpenPGP through GnuPG since early 2000’. It’s an essential part of Debian Developer ’s workflow. We use it regularly to authenticate package uploads and votes. Proper backups of that key are really important. Up until recently, the only reliable option for me was backing up a tarball of my ~/.gnupg offline on a set few flash drives. This…
Since I’ve started working in Information Security space, I’ve been talking to a lot of people about the topics related to protecting ones’ identity online. Basically, trying to answer the question: What does it take to sufficiently secure my online accounts? Of course, the meaning of sufficiently is very subjective here, but I’ve always kept it vague to gauge what it means…
Unattended Upgrades in Debian Feels like since forever have I been using unattended-upgrades package to automate the Security upgrades on my various Debian Stable based machines. Default Settings By default unattended-upgrades will install only Security updates. It also will not send any email reports. That is not surprising – well, you have to have email delivery configured and…
I’ve been wanting to use my brand new NitroKey 3 , but TOTP is not supported yet. So, I’m looking to implement it myself, since firmware and tooling are open-source. NitroKey 3’s firmware is based on Trussed framework. In essence, it’s been designed so that anyone can implement an independent Trussed application. Each such application is like a module that can be added to…
As a Debian Developer I have a discount on using Gandi and I’ve been using it for quite a long time and have been very happy with it. I’ve been using it for registering domains. For example this blog’s domain is managed by my Gandi account. Using publicly registered domain in private-only setup In addition to using this DNS registrar for public stuff, like a blog, one can also…
This post is the third in a three-part series. The remaining two: How does Google Authenticator work? (Part 1) How does Google Authenticator work? (Part 2) Part 3 is the last part in this short cycle. Here I’ll explain all the details around T ime-based O ne- T ime P assword algorithm. I’ll finish up by also elaborating on things common to both, H MAC-Based O ne- T ime P assword…
This post is the the second in a three-part series. The remaining two: How does Google Authenticator work? (Part 1) How does Google Authenticator work? (Part 3) Authenticator apps like Google Authenticator use 2 authenticaion protocol centered around What you have paradigm. Those algorithms are: HOTP ( H MAC-based O ne T ime P assword), and TOTP ( T ime-based O ne T ime P assword). They obviously…
This post is the first in a three-part series. The remaining two: How does Google Authenticator work? (Part 2) How does Google Authenticator work? (Part 3) When you’re accessing services over the WEB – let’s pick GMail as an example – a couple of things have to happen upfront: The server you’re connecting to ( GMail in our example) has to get to know who you are. Only…
Installing Debian/GNU Linux under bhyve on TrueNAS Core I got myself a TrueNAS Mini X+ couple of months ago. I have it running TrueNAS Core based on FreeBSD. In that system you can run VMs under FreeBSD’s native hypervisor, bhyve . Since there are a couple of quirks around running Debian specifically, I decided to write up a quick article about setting up Debian-based VM there. The quirks…
I’d like to shed some light at the process of Authentication since it’s a fundamental building block in creating secure tools that need to communicate with other actors over the network. When tools and/or users interact with one another – e.g., through a web browser – both ends of the interactions need a way to make sure, they’re communicating with the right party.…
Your Name (Optional) Your email: I'm using Formspree for delivering emails this from this form. If you don't want to share your email with them, better shoot me an email directly. Your message: Send
My name’s Patryk Cisek and I’m a long time software engineer working in Cybersecurity space. After hours I’m also a member of Debian project. Some of my Open-Source projects: Nitrokey Authenticator - A TOTP Authenticator app for Nitrokey Pro3 / LibremKey USB Security Keys. openpgp-paper-backup - CLI tool for backing up and restoring OpenPGP Secret Keys in a paper form (printed…