Recent content in Posts on Christian Rebischke
In the past, I have used Weechat with Weechat and IRC relays. Since, I have switched to ChromeOS, I disabled the IRC relay, because I switched to the Weechat Android App on ChromeOS. Nevertheless, I was never 100% happy with the Weechat relay. The relay usually works via a shared password and access to this relay is equal to SSH access. Hence, I have decided to switch to SSH tunneling. With SSH…
Hello friend, long ago I have ditched Arch Linux for my main operating systems and switched to ChromeOS with Arch Linux in Crostini. For a long time this setup worked fine, until I encountered a few issues with Arch Linux and Yubikeys. In this article, I would like to show you how I setup my Yubikey on Arch Linux running in Crostini within ChromeOS. First, we have to ensure that…
I am a big fan of LUKS encrypted USB sticks. They are easy to make and easy to handle on most Linux systems. ChromeOS is one of these systems, where I had trouble with LUKS encrypted USB sticks or block devices in general. Although ChromeOS is capable to mount a various number of filesystems, it has no idea what to do with a LUKS encrypted USB stick. The first idea most people have is launching a…
I have recently switched to Chrome OS Flex as main operating system. The experience so far is really great. It does everything what it should do. I can browse the internet with it, game with it (in the past Google Stadia, now Xbox Cloud), answer my mails and even work on Arch Linux. Even printing worked pretty much out of the box. What does not work properly at the moment is scanning over wifi…
Hello there. I have not written a new article for quite a time now, but the waiting is finally over. Here comes the article everyone of you ever waited for. Let us install Arch Linux on ChromeOS together. Yihaaaa… (Not quite what you expected? Feel free to drop this article :‘D). If you are reading this, this means you are still here. Nice. So, let us start with a short explanation on…
In this new blog series, I would like to introduce you to the daily adventures of an Arch Linux package maintainer. This time, we will have a look at reproducible package builds. Reproducible package builds are very important for us, as package maintainers, because reproducible package builds create an independently-verifiable path from source to the final package. This means, every Arch Linux…
Hello and welcome to another blog article. Today, I would like to discuss one feature of Go 1.18, that I am interested in. No, this will not be another article about generics. The feature I would like to write about is something that might be under the radar for most people, but it still might be useful. If you ever wrote a CLI app in Go you are very familiar with injecting information during the…
The full configuration for this article can be visited here: https://github.com/shibumi/infra/tree/pulumi-migration This weekend I had finally some time to have a longer glimpse on Hetzner and Pulumi. Pulumi sparked my interest for a pretty long time now after reading Engin’s blog post about pulumi and Microsoft Azure. I tried Pulumi earlier, but I gave up pretty fast, because it had no…
As Arch Linux package maintainer I heavily rely on a secure upstream and a secure source code distribution process. I have spent days or maybe even weeks discussing with maintainers why I rely on a secure upstream and how important signatures on tags, commits or source tarballs are. Many maintainers have started signing their source tarballs after such a discussion, others mentioned problems with…
This article is a short followup to my last article about cosign. I received many questions for my last article. The most common one was: “But wait! If the certificates are only valid for 30 minutes, how are my users supposed to validate my artifacts?” This is very common misconception and to be honest: I ran into the same trap at first. The terms “ephemeral” or…
While reading the cosign-installer I have stumbled upon these lines in the documentation: - name:SigntheimageswithGitHubOIDC**notproductionready**run:cosignsign-oidc-issuerhttps://token.actions.githubusercontent.com${TAGS}env:TAGS:${{steps.docker_meta.outputs.tags}}COSIGN_EXPERIMENTAL:1The shown lines are a step of a Github Action and are still experimental, but very interesting. It allows to sign…
In this article I want to give a short overview over the current state of Arch Linux with respect to cloud native technologies. I would like to show why I think Arch Linux is perfect as a daily driver in the cloud native ecosystem and how the current state of cloud native software in Arch Linux looks like. Reason Nr 1: Security At Arch Linux we take security very seriously. Our newly selected…
Hello and welcome to another article about Kubernetes. In this article we will go through the Kubermatic installation on Hetzner Cloud. But first of all let us go through a few questions: What is Kubermatic and why do I need it? Kubermatic abstracts different Kubernetes clusters and providers for you. It does not matter if you want a cluster on Amazon, Google, Hetzner, vSphere or on-premise. With…
Quite a while ago, Arch Linux has turned on many binary security features via compilation flags (2016)1 or turned off options that are known to help exploit software (debugging symbols, RPATH). Now we have 2021 and Arch Linux made good experience with the additional security options. We made good experience on Arch Linux with the following flags so far: FULL RELRO (Full Relocation Read-Only)2…
Today’s blog article is a more unusual one. If you know me in person you would not connect me to web development, but yet here we are. So, how do I got here? One student at my university has asked me if I could help and have a look on their code. He was working on unit tests with Selenium on a very beginner friendly level. This is how I got more interested in this topic.
In today’s article I would like to shine some light on my local terminal setup. My setup consists of ZSH and Alacritty. ZSH or the Z shell is an extended variant of the Bourne again shell (bash). It comes with a few useful features and extensions. Many people use the ZSH mostly for nice shell prompts or tab completion. This article will be about more advanced features, like custom shortcuts.…
Hi, there. Today’s article will be a rather short article. In this article I would like to showcase Go 1.16 new embed package. If you are familiar with Go you might know embedding functionality already from famous other libraries like go-bindata. The problem with go-bindata has been that upstream vanished one day and then multiple forks appeared and every company or person was doing their…
A year ago I wrote about my Wayland setup on Linux. This year I would like to give you a small update on how I am going with Wayland on Arch Linux and how it is my daily driver at home and work. The setup itself stayed pretty much the same: Operating System: Arch Linux Window Manager: Sway Status bar: Heavily customized Barista bar Screenshots: Bash script utilizing Grim + Slurp Screen recordings:…
Hello and welcome to my little Kubernetes on Hetzner tutorial for the first half of 2021. This tutorial will help you bootstrapping a Kubernetes Cluster on Hetzner with KubeOne. I am writing this small tutorial, because I had some trouble to bootstrap a cluster on Hetzner with KubeOne. But first of all let us dive into the question why we even need KubeOne and how does KubeOne helps. KubeOne is a…
Intro I spent the last three to four months working on the open source project in-toto as part of my Google Summer of Code stipend at the Cloud Native Computing Foundation (CNCF). Followers of my blog might have already read about in-toto. If you do not know the project, I suggest you have a look on my introduction to in-toto. The introduction article has been written as part of my Google Summer…
Recently I have installed Arch Linux on a shiny new Lenovo Thinkpad T14 AMD. This blog article shall mainly be a reminder for me for the future, but feel free to use anything useful in it. I did not install Arch Linux for a long time (nearly over 8 years, lol). Therefore I never saw a need to automate an Arch Linux installation. I am aware, that there are solutions for automated Arch Linux…
It is nearly a year since my last blog article about Wayland on Linux. Thus I thought it is time for an update on how my desktop with sway developed. What happened? I changed my file sharing scripts I moved from rofi to bemenu I changed my scripts, that were based on rofi For my file sharing scripts I introduced a new helper script with the generic name share.
For many months I had a weird issue with displaying PDFs in chrome on my website. I always thought this is a browser issue and would be fixed soon, but actually it was an issue with my Content Security Policy (CSP). If you ever stumbled upon my CV you might have looked on this: Finally I could fix this, after finding this Chrome issue here:…
Today I would like to talk about supply chains. I am participating as package maintainer for several years for now and supply chains are one of the key factors that were on my mind the most. As package maintainer I try to ensure, that all users can be certain, that they are actually using what the project owners had in their minds. This only works with a secure supply chain. This secure supply…
This article will be rather short. I just wanted to highlight something, that not much people know. This could be helpful for network diagnostics or capture-the-flag games. If you ever find yourself in the situation to identify a device’s OS only by it’s IP address, you can try just pinging the device. The TTL (Time-To-Live) will give you an hint about the OS. You can use the following…
Prolog My server went down today. So I’ve decided to write a little postmortem for me, so that I will hopefully learn from my server outage. This is also a nice moment to learn how Google writes postmortems: https://landing.google.com/sre/sre-book/chapters/postmortem/#id-YAJuMt7iQW Overview Date: 2020-04-29 Status: Complete, action items in progress Impact: The following of my components…
In this, hopefully short, article I want to summarize what I’ve did for changing the expiration date of my GPG key on my Yubikey. This tutorial is for all people who has generated their GPG key on their laptop and then transferred it to the Yubikey. If you’ve generated the GPG key pair on the Yubikey, you will not need this. We need to differentiate between two cases: Changing the…
Hey, this is going to be a short blog article. A few days ago I had a friend at my place who asked for the Wifi password. So I presented my 32 char WPA2 key and we all got very frustrated, because we had to type it in manually. After typing the key in, I thought there must be a better solution for tackling this problem, like generating a QR code.
If you had a closer look on my domain you’ve might checked my MX records: ❯ resolvectl query -t mx shibumi.dev shibumi.dev IN MX 10 mxext2.mailbox.org shibumi.dev IN MX 10 mxext1.mailbox.org shibumi.dev IN MX 20 mxext3.mailbox.org Yes, I have to admit I don’t host my own mail infrastructure. I think this is too toilsome and I have better things to do, like writing this blog article. In…
I’ve received plenty of feedback for my last blog article on how I handle dotfiles, hence I’ve decided that I want to give a glimpse on how others are managing their dotfiles. Another way of handling dotfiles is using GNU stow as explained here: http://brandon.invergo.net/news/2012-05-26-using-gnu-stow-to-manage-your-dotfiles.html With GNU stow it’s possible to store your…
In this article I want to show how I handle my dotfiles and why I think it’s the best way to handle them. I tried different approaches for handling dotfiles in the past: puppet ansible home made shell script magic maybe a few more I don’t remember, because i didn’t use them so much. So what’s wrong with puppet or ansible? Don’t get me wrong, I love config management…
I made a few significant changes on my blog. First, I have a new Caddyfile for Caddy: {experimental_http3}www.nullday.de,www.nspawn.org,www.shibumi.dev{redir*https://{http.request.host.labels.1}.{http.request.host.labels.0}{path}}nullday.de{redir*https://shibumi.dev{path}}nspawn.org,shibumi.dev{file_serverroot*/srv/www/{host}/public/header{Strict-Transport-Security"max-age=31536000;…
I’ve just pushed a first step for managing my infrastructure via Hashicorps Terraform. In this article I want to speak about this first step and I want to give a glimpse into the future for it. My infrastructure is hosted in Hetzner Cloud (there is luckily a terraform provider for it). DNS will be talked about in a later blog article. I usually store my passwords in a gopass password store,…
You may have heard about the problems with recent PGP key server implementations. I don’t want to reiterate the technical challenges with recent PGP key server implementations. I think there are enough explanations for this in the Web. So let us focus on preventing the problems. One possible solution around this problem is self-hosting your own WKD server. WKD stands for Web Key Directory.…
Hello everybody, I’ve just moved my blog to a domain. The new domain is called https://shibumi.dev/. Why a new domain? Well, I think this domain suits me better. It reflects my nickname on platforms like https://github.com/, IRC, and various others. Also, all dev domains have HSTS enabled on default for even more security and I’ve switched my domain registrar from Hetzner to…
The Arch Linux DevOps team uses a combination of Ansible and Terraform to manage their hosts. If you want to have a look on their infrastructure repository, you can do so via this link: https://git.archlinux.org/infrastructure.git/tree/ The combination of Ansible and Terraform works quite well for Arch Linux, the only subject we are missing is proper testing. I want to present a small proof of…
Think about the following scenario. You have a client at home and you have a server. The server permits ssh connections only from the wireguard network (eg. 10.0.0.0/24). You have wireguard configured and running on your client, but you don’t want to route all traffic through wireguard. You actually just want to access the server via wireguard and route all other traffic normally through…
If you ever come to the need of a simple bandwidth test for your server or client, you can setup a bandwidth test via iperf3. For starting an iperf3 server, just use iperf3 -s: ❯ iperf3 -s ----------------------------------------------------------- Server listening on 5201 ----------------------------------------------------------- Accepted connection from 139.174.228.245, port 33133 [ 5] local…
The Wireguard VPN doesn’t isolate clients on default. If you want to enable client isolation, you can do so via the following iptables rules: iptables -I FORWARD -i wg0 -o wg0 -j REJECT --reject-with icmp-adm-prohibited ip6tables -I FORWARD -i wg0 -o wg0 -j REJECT --reject-with icmp6-admin-prohibited If you want relax the rules for certain clients you can do as follows (where 10.10.10.3…
You may know this problem: You are using a laptop for work and for private stuff and you don’t want that your private traffic gets leaked when you activate your company/university VPN. I solved this problem via using systemd-nspawn containers for routing certain applications (like webbrowsers) through a specific VPN. First you need a systemd-nspawn container. On Arch Linux you can achieve…
Nginx has been my webserver of choice for several years now. But I had always some issues with nginx that bothered me for quite a while: Weak defaults (no TLS on default, weak ciphers, no OSCP stapling on default, …) The configuration is very verbose (this doesn’t need to be something bad) New technologies like (QUIC or zstd compression need ages until their are available in…
Many users don’t modify their pacman.conf file. Either because they think there is not so much to configure or because they are afraid to break something. In this short article I want to highlight some nice options, that make my daily use with Arch Linux a lot easier. First of all, here is my pacman.conf without comments: [options] HoldPkg = pacman glibc Architecture = auto IgnorePkg = Color…
In this short blog article we revisit traefik and add password authentication to our reverse proxy example.Password authentication means we use a (user,password) tuple for the login. We don’t want to safe our password in clear text, therefore we need to encrypt it. At this moment, traefik supports three hash algorithms: MD5, SHA1, BCrypt. Two of them are considered to be broken, hence you…
A few days ago I had the joy to configure a reverse proxy. My first thoughts went to Nginx or Apache, but I forced myself to destroy the filter bubble and get in touch with some new software. Therefore I had a lookon traefik. traefik is written in Golang and can act as reverse proxy and loadbalancer. So let’s talk about a specific use case. I have the following services that I want to make…
In this small article I am going to explain how to setup a small systemd service for notifications in case of failing systemd services. You’ll need the following software for it: systemd a mail transfer agent (postfix, qmail, exim, name your poison) sendmail (or any other application that can send mails) I chose sendmail. First create /usr/local/bin/systemd-mail: #!/bin/bash sendmail -i -t…
I was very happy with my HMAC challenge-response solution for my Yubikey, but when I wanted to configure my i3 status bar to show the current state of the key I ran into issues. The problem was that I couldn’t see the state for the HMAC challenge. Watching the state (shall I press a button now to activate the key) for GPG worked fine, but I had trouble with the HMAC challenge.
In this small article I want to explain how to use your Yubikey as 2-factor device for logins on Linux. I used the “Yubikey 5” for this article. If you use an older one, some option will maybe not work. Make sure to read https://developers.yubico.com/yubikey-personalization/Manuals/ykpersonalize.1.html before reading further. You need the following Arch Linux packages for this…
Did you ever run into the problem, that a random process on your hosts is running amok and killing other processes? If so, you know how painful it is to find the process. But there is a solution for it: systemtap. Just install systemtap on your system, write a small stap script for it and run it, and it will show you the evil process: #!/usr/bin/stap # sigkill.stp # Copyright (C) 2007 Red Hat,…
I use zsh for a pretty long time now. It began with zsh + grml configuration, went over the famous powerlevel9k (where I helped implementing a few features like svn support) and currently ended with my own zsh configuration: Hikari-ZSH I have to admit I have been quite happy with powerlevel9k. It had a rich feature set and I have been in love with all these shiny UTF-8 icons and powerline…
I guess everybody knows that X11 aka Xorg is a pain in the ass and a security nightmare. Therefore it shouldn’t be such a suprise that I think about switching to Wayland for a long time now. And it looks like it’s finally the day, where I can switch to wayland without effects on my convenience. TL;DR here is the link to my dotfiles with the whole configuration:…