I finally put enough of a bow-tie on bdsh that I can use it as a daily tool. WOO HOO! I have long wanted a dsh which did a few additional things, and now I have them. In honor of dsh's backronym ambiguity, I am not sure if bdsh is "better (distributed|dancer's) shell", "Brian's (distributed|dancer's) shell", or "BreakDancer's Shell". Regardless, I am super happy with this little tool :-) So, what…
I have teenage kids, and they are possibly dorkier than me, which is awesome. Since the pandemic, we have had a D&D game going, off and on, with some of their friends and friends' parents. It's been super fun. I am, however, the perma-DM. I am 99% fine with this, as I love the world building aspects which the DM gets to lean more heavily into than players. Sometime this past year I started doing…
The two fun problems in computer science: cache invalidation, naming things, and off-by-one errors. Today I want to talk about the first one. I've been working on Epithet , an SSH certificate authority Really, an agent, a CA, and policy server that makes certificate-based authentication easy. Part of the system involves a "discovery" endpoint where clients learn which hosts the CA handles. The…
Kong is my go-to CLI parser in go, so I used it for epithet . It has pretty good built-in configuration handling, I appreciate how it lines up config values with CLI flags by basically treating config as a serialized tree of it's structs. This is great for simple things, but for epithet I needed slightly more complex mapping, with dynamic keys (user identities) and such. I wanted to keep the core…
The Goal We want to set up a real epithet system, end to end, and use it. Because everything is self hosted, there are a number of steps: Install epithet on your local Mac Configure an SSO provider Set up CA and Policy services Configure the epithet agent Create a cloud-init config for new VMs to rely on the CA Actually SSH to the VM! Run epithet as a daemon Cleaning up config and playing around…
I last talked about epithet two years ago, in 2023 , when I started kicking around ideas to make it general purpose. I'm pleased with how it's turned out, so I want to start talking about some of the design decisions. I dare not document it yet, for fear someone may use it, but that's probably coming. Even though it never had a proper 1.0, I am calling this v2 in my head as it is not at all…
I'm replacing my general/util server at home and want to manage VMs on the new host with vm-bhyve . Setting it up is well documented, but running linux VMs still steers folks towards grub, which is not really great. These are just my notes (for later, after I forget) on using cloud images and uefi. This is a supplement to the docs, not a replacement! I created a template, creatively named…
I live by Alfred as a launcher and all around insta-utility thing. I also live by whatever terminal I am currently using. Switching from Terminal.app to iTerm.app was easy enough in Alfred, just need to hit the down arrow after trying to launch it 2-3 times and it picks up that ⌘-spc t e r means iTerm.app not Terminal.app and we're off to the races. This works as iTerm nicely has t e r in it, so…
I've been lucky enough to get into the Ghostty beta, and am very happy with it o far. I ran into one real hiccup, and I know I'll forget how I fixed it when I set up my next laptop, so leaving a note for myself (and anyone else who hits it). Ghostty uses a custom terminfo, xterm-ghostty , and does not install it to the system or user, but specifies a…
Since Bob asked , I'm cleaning up a system to make using short-lived ssh certificates easy, simple, and secure. The gist is to use a custom ssh-agent which, in turn, uses some modern authn service (OIDC, Keycloak, Okta, Google Sign-In, etc) to authenticate you. It then passes that auth token up to a CA which relies on a policy service to verify the auth token and respond with cert params (time,…
There are lots of tutorials out there, but I want to compile my notes so if I walk away from playing with them again for a few years, I can pick it up again! SSH Keys for different things are all the same (modulo chosen algo type) User keys, host keys, CA keys -- they are all the same. Don't let ssh-keygen docs, with all of its options and whatnot, convince you otherwise. Use…
I do some volunteer sysadmining for a local non-profit, mostly network management and related things. Between there, and my home setup, I have gradually moved from defaulting to Ubuntu back towards FreeBSD over the last year. Nothing wrong with Ubuntu, but I kept finding FreeBSD to simply be a little bit easier and a lot better documented . For a dev box, I'll stick with linux—all the tooling…
I recently redid the DNS on my home network, moving from dnsmasq to Unbound and NSD . Unbound acts as the DNS server the network uses, and Unbound hosts losts local zones for my search domains. For reasons, this is really across two sites: our home, and a barn we own a few miles away. Because I am a dork, I have things at both sites :-) My network controller has a built in DNS server which assigns…
I cannot let 2023 go past without writing anything given it is 20 years of this blog, but an update to Hugo broke things, and getting it to work was just annoying. So I got frustrated enough making Hugo do what I wanted that I ported over to Zola and here we go, I am able to update again! Along the way I took a moment to add all the posts from my original blosxom based blog to the archive , which…
Jumped out of order from my earlier checklist and set up some automagic build and deploy. I'd wanted an excuse to try out CodePipeline , so this was it! So, how does this blog work? It is deployed to an S3 bucket ( skife.org ) with CloudFront in front of it. CloudFront is set up to use the free SNI certs to provide TLS. Previously, I pushed manually via s3cmd , which worked well with some…
I've attempted to wake this blog up a couple times, but between Jekyll changing, Pygments changing, and whatnot, it has been more pain than any given post seemed worth. I've recently had three folks independently chastise me for no longer writing, however, and three is a magic number. So, this is basically just a test post as I try converting over to Hugo . Jekyll resisted hard enough that I…