UPDATE : Issues (1,2) below are fixed in the upcoming Ubuntu 26.04 release. No action on (3) yet. OpenVPN since version 2.7, together with the Linux kernel >= 6.16, support OpenVPN with DCO (Data Channel Offloading). This will perform encryption/decryption in kernel space resulting in improved performance and hopefully reduce battery use. Let's look at support for it in the upcoming Linux…
Recently I found out that go.mod is used for more than just specifying the name of the module and its dependencies. The Go version specified in it is also used to determine which Go "feature" flags are enabled by default when building the software. So, when Go modules are disabled, as is done when building packages for Debian/Ubuntu or Fedora/EL, this information is not available. This means that…
Yes, I do realize it is 2024, and that we, well, at least some of us, have "State Of The Art" Multi Factor Authentication (MFA) using WebAuthn , using hardware tokens, or in some cases integrated directly in the OS with passkeys . That being said, let's figure out how YubiKey OTPs work, and whether or not they can still offer any value in 2024. Note that this article is not an endorsement for…
UPDATE : the repository instructions were updated for new releases of Debian/Ubuntu. The builder can now also build for amd64 as well as arm64 in the same repository. The repository listed below contains both architectures. Ubuntu 22.04 LTS is no longer supported as it refused to do a "scratch" build, i.e. start from the official Ubuntu 22.04 installation and try to build up to the last Go 1.26…
It took me quite a while to understand why it was so difficult to get the CI runner for Forgejo "Actions", forgejo-runner working to my satisfaction. Earlier I wrote documentation on how to setup forgejo-runner to work under a standard user account using systemd user services, and podman which turns out to work super smooth! But then, how do you actually write these "workflow" files in a way that…
We'll describe how to set up a simple WireGuard VPN server between two Debian 12 systems. One acting as a "server", and one as a "client". If you follow the steps below, this will survive reboots and aims to be safe to run in production. It can also be used to create a simple WireGuard server test setup on a cheap VM somewhere. Keys WireGuard uses private and public keys using the PrivateKey and…
Configuring WireGuard is not that difficult on OpenBSD, but what misses is a "complete" walkthrough. Also I am trying to fix vpn-daemon to work on OpenBSD. No idea what that would require, but if we first need to get WireGuard working on OpenBSD. The following resources are of great help: hostname.if(5) wg(4) ifconfig(8) All these resources allow for creating a /etc/hostname.wg0 file that contains…
After setting up a VM at Hetzner with IPv6-only and OpenBSD, some configuration was needed to make it work. It being OpenBSD, I tried to find the canonical way. You can install OpenBSD on Hetzner VMs by first choosing a random Linux distribution, then mounting the OpenBSD image and rebooting into it. The sections below will explain how to configure IPv6 after you've booted into the system (with…
As part of my (ongoing) effort to leave GitHub (owned by Microsoft) I wanted to export my account data and delete all repositories and gists. By leaving GitHub I mean that I won't be using it anymore for any development, but keep the account for now to contribute to projects that are currently unable to leave GitHub for whatever reason. GitHub's account export does not include GitHub Gist for some…
This is probably a bad idea as a generic solution for error handling in PHP, but it might have its uses in case you have a function that already has multiple return values. <?php declare(strict_types=1); class Err { private string $err; public function __construct(string $err = '') { $this->err = $err; } public function err(): string { return $this->err; } } function fatalIfErr(?Err $err): void {…
It is 2022, and not everyone is using Let's Encrypt . So occasionally one needs to generate a CSR for use on a web server. Unfortunately, in 2022, it is still not obvious how to do this using EC. The examples are mostly for RSA. So, once and for all I am documenting this here. Hopefully it is safe, and sufficient. We assume that the CA will fill the subjectAltName . Save the following as…
WireGuard is a new, relatively simple VPN technology implemented the "right way". This means, no shortcuts were taken by the developers. Keep it simple was the motto and they were not afraid to do some plumbing. Two examples of this were integrating WireGuard directly in the Linux kernel whilst also updating the kernel's cryptography stack. The other was writing wintun to make tun devices perform…
Every time I install a Debian Desktop (GNOME) in a VM on GNOME Boxes I forget how to get the automatic screen resolution resize thing working in the VM when resizing the GNOME Desktop window. With Fedora (and CentOS) VMs this works out of the box, but not on Debian. It is very easy, but you need to know which package to install. $ sudo apt install spice-vdagent Reboot after installing this package…
Previously , and earlier , we looked at modernizing the TLS configuration of OpenVPN. However, TLS is not the only cryptography used by OpenVPN. There's also the data channel. This post will look into using another data channel encryption algorithm to see whether it can be beneficial for OpenVPN performance and under what circumstances. There are a number of options when choosing a cipher for the…
This blog post is a copy of a blog post I wrote for the eduVPN blog... Last year we decided to investigate the OpenVPN client support of TLSv1.3 and EdDSA (Ed25519). One reason for doing this is, to stay current with algorithm recommendations by experts and move away from RSA . As EdDSA is easier to implement securely and has built-in protections against attacks that other curves, most notably,…
One of the more infurating things about Debian is that they enable mouse support in Vim by default. How do I :q! mouse support in Vim? Turns out to be very easy, but of course there is no documentation on how to do this properly and searching the web results in only wrong answers. What else is new? Put this in ${HOME}/.vimrc and you can again copy/paste text in a sane way using your mouse. set…
For the eduVPN project I'm using two Git servers. My personal one, and GitHub as a mirror of those repositories. For ages now we've had three branches: master , v1 , and v2 . All development currently happens in the v2 branch, and master is lagging behind a lot. On GitHub in the UI you can set the default branch to any other branch, but how to do that on your own Git server with cgit and how to…
This series of blog posts will take you along the process of creating a fully featured, but minimalist PHP template engine from scratch. Why would anyone ever want to do this when there are so many available template engines like Twig , Blade , Smarty and Plates ? Good question! The reasons I came up with are: Wanting to really understand how (modern) template engines work; Avoiding big and…
This blog post is a copy of a blog post I wrote for the eduVPN blog... We decided to investigate what it would take to modernize the cryptography used to establish the TLS control channel with OpenVPN. See our current configuration documentation as used by eduVPN. The reason for looking into this is to get improved security and increased performance , when switching to TLSv1.3 and possibly…
A little while back I read an interesting article on PGP, and how we really should stop using it. Not everyone agrees, but GnuPG already bothered me for quite some time . Even if there is a genuine need for a universal tool for "all things crypto", GnuPG, does not seem to be it. That being said, some proposals in the mentioned blog post recommend people to use (proprietary) centralized services to…
Turns out getting PHP-FPM working on Debian 10 is very easy: $ sudo apt install php-fpm apache2 $ sudo /usr/sbin/a2enconf php7.3-fpm $ sudo /usr/sbin/a2enmod proxy_fcgi $ sudo systemctl restart apache2 $ echo '<?php phpinfo();' | sudo tee /var/www/html/info.php >/dev/null Now info.php is available under the web root, e.g. http://localhost/info.php . That's it!
Using PHP it is quite easy to generate a JSON Web Key (Set) from a PEM encoded (RSA) Public Key. Say, you have this public key: -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsWF+1o9XpJmqwHkBdqOe ToHkPOsRW7JYkuEvjVLpRJLe6BKUh4tjABIaSbkvpQIudEXPmPwAbseSo5GZY9uQ voVVmC0Fizu61ETcZyvYV+575+45A1Ua4zbrdOtHdgo4X529yYu43HQobPRX9514…
While working on Let's Connect! / eduVPN I reached the point of needing to perform a database migration, i.e. modify the database schema. I wanted to add a column to a table. Software exists to do this, e.g. Phinx that seems to be a popular choice. It supports many databases and makes managing migrations easy! One feature was not explicitly mentioned there which I really wanted to have: the…
This post describes how to create a PGP signed software release from your Git project. Setup We want to use tar.xz archives, and not zip or tar.gz , for this to work we need to add a little snippet to ${HOME}/.gitconfig : [tar "tar.xz"] command = xz -c Now, with that out of the way, you can put the following POSIX shell script in ${HOME}/.local/bin/make_release . Make sure you make it "executable"…
Almost two years I wrote a post about using Apache with PHP-FPM on CentOS. Some things have changed (for the better) and also I somehow understand things better now! This post is about configuring Apache with PHP-FPM on CentOS 7. The whole point of this is to increase the performance of running PHP scripts. Even with PHP 5.4, the default on CentOS, you'll see a substantial performance improvement…
The Packagist service is used to make it possible to install PHP dependencies using the Composer tool. It is very much "optimized" for GitHub, but using your own Git server is also supported, although it has some rough edges: Packagist is not able to connect to web servers using the Modern compatibility TLS configuration (issue #918 ); Packagist's update-package hook requires the repository URL to…
This should really be easier. I guess that is why so many software exists to make this "work", adding more bloat in the process. So, I spent some time using only the basic tools to make hosting your own Git repositories work. All software is available in the default repository or EPEL. Everything should also work in Fedora. We'll be using: git cgit The features that should work: work over SSH…
So far, I notices two issues: Using the NDK (r17) does not work because it requires ncurses-compat-libs installed; The emulator won't run because you have to force it to use "system libs" instead of the libraries bundled with the emulator. In slightly related news: you can no longer run the NDK (r17) on CentOS 7 since the requirements for glibc were updated. Good stuff... So to fix the first…
What a mess! This is my $HOME/.gitconfig that seems to make everything work. As my keyring only works with gpg2 and not with gpg you also have to set gpg.program . [user] email = fkooman@tuxed.net name = François Kooman signingKey = 6237BAF1418A907DAA98EAA79C5EDD645A571EB2 [commit] gpgSign = true [gpg] program = /usr/bin/gpg2 [tar "tar.xz"] command = xz -c
About 15 kilometer to the south east of Mostar, after the airport, you'll find Blagaj with its famous Dervish monastery, Blagaj Tekke at the spring of the Buna, Vrelo Bune . Of course, just doing the tourist thing is a bit boring, so why not hike up to the castle (Stejpan Grad) instead? It turns out to be quite easy, although you have to know about the "zigzag way" unless you want to go straight…
One of the great things about traveling is that you have new environments for running. Berlin is very flat, so after arriving in Mostar , and seeing the big hill "Hum" with the big white cross on top, I couldn't wait to run there! After some research, and finding this post by Amy, I decided that it shouldn't be too hard. It is slightly more than 6 kilometer uphill run, starting from the "Župna…
After looking forward to going to Sarajevo so much, it does not disappoint! Except maybe for the pervasive smoking everywhere, indoors, and even in restaurants. It is very hard to find a place where you can relax, sit and have a coffee or enjoy dinner without also breathing in smoke. I am not used to that anymore after being out of the smoke for so many years now! Of course, it does not matter so…
As a response to this post about ditching certificates in TLS, I thought of some other approaches that may improve the situation for the user when dealing with phishing on the "modern" web. I also posted a comment there, but will expand a bit on that here. A possible alternative, without getting rid of certificates right away, could be to reduce the possibility of users being phished using current…
This is both a blast from the past, and mostly a "note to self", as it was surprisingly hard to find how to do this. And now I am not even sure if it is complete, because XML signatures :( Get the metadata: $ curl -L -o md.xml http://mds.edugain.org/ Download the certificate: $ curl -L -O https://technical.edugain.org/mds-2014.cer For now, we just assume the published fingerprint on the site is…
Update : switched to new PPA, from ppa:chris-lea/libsodium to ppa:ondrej/php that contains a newer libsodium that actually has \Sodium\compare . For my OAuth 2.0 server I needed to be able to use libsodium in PHP, unfortunately the images on Travis-CI are still based on Ubuntu precise , or if you want trusty , but they do not contain libsodium-dev which would be needed to install the PECL module…
Having the Xdebug PHP extension always loaded slows down Composer and Phan . But I do want to have Xdebug enabled for generating code coverage reports using PHPUnit . It took me some time to figure this out, and it is not so hard. First step: install the Xdebug extension, on Fedora: $ sudo dnf -y install php-pecl-xdebug Edit the file /etc/php.d/15-xdebug.ini to disable loading the extension:…
There are so many misleading, confusing and extremely complicated instructions on how to create a bootable Windows USB stick on Linux that is not funny anymore. This is mostly a "note to self" on how to do this. Microsoft conveniently provides official Windows ISO files that you can use to perform fresh installations of Windows on PCs of relatives that you need to clean up. You don't even need to…
Yesterday I closed my Skype account. In an attempt to reduce the number of services I use for communicating. It was getting out of hand. At last count there were at least 10 ways in which people can contact me. Madness! To close your Skype account you actually have to contact "Skype Live Support". There is no quick way to close your account. Reading this I got curious and decided to go through the…
The audio quality of the Bose SoundTouch 10 is pretty good. However, a number of things bug me, not just with the SoundTouch, but with "IoT devices" in general: You need to use a proprietary app on Android, iOS or Windows to set everything up; You need to register for an account and provide personal information; Without account you can't do much with the device; It is not clear what kind of…
Doing a new round of tests for OpenVPN client support I decided to test how well Fedora 24 Beta and Ubuntu 16.04 work. They both have NetworkManager 1.2 which brings a lot of improvements to the OpenVPN plugin, particularly when importing configurations. Particularly I was testing the way imports from eduvpn , a managed VPN service worked. It turned out it works pretty well, with a minor issue…
I want to respond in more detail to the response to my Tweet to @ownClouders earlier. I wrote: Relevant for the @ownClouders and Debian/Fedora packaging discussion: http://enricozini.org/blog/2014/debian/debops/ This article is written by a software developer who takes Debian as a base operating system and develops his software targeting Debian stable. It brings him many benefit like "free"…
There is lots of crappy information out there about deploying PHP with Apache, or nginx. It is really hard to distill what is really a safe configuration and what works. Combining this with a safe TLS configuration nears the impossible. PHP-FPM Configuring PHP-FPM is not that difficult, actually, one could keep the defaults and that will work pretty well. $ sudo dnf -y install php-fpm I only…
Update (2015-08-12) : see private-messaging-brainstorming for a discussion on the topic of private messaging. It is in a way quite similar to the proposal below of "Inbox", but without OAuth. Introduction This post will describe some typical features for a group communication platform with code name Phubble . As an example we will organize a birthday party for Alice. This post will describe what…
Introduction Currently an OAuth client is supposed to know the Authorization Server (AS) that is used by a particular Resource Server (RS). This blog post proposes a discovery mechanism where the client only needs to know the location of the RS. The RS chooses the AS it will use. There is no point for the client to know what the AS is beforehand. It can also change at any point at the RS's…
I've been playing around with OpenWrt and Freifunk . There are special OpenWrt images for Freifunk. They are slightly modified vanilla OpenWrt images. They include for instance OpenVPN . The interesting approach here is that all traffic from the access point will be routed over the VPN, thus eliminating the liability for the provider of the access point: the traffic of the users on the Freifunk…
Update (2015-07-21): fix the link to the Apache configuration file. This document will not explain why to use HTTPS for your site, but assume you are already convinced :-) Certificate Authority So if you want to do HTTPS everyone focuses only on the certificate and the costs, but the costs seem to be going down or reach zero in some cases, although that can be treacherous in some cases, like…
Finally I managed to get het Nitrokey working with IndieCert. It is not as smooth as expected and requires a fair bit of work, but here you can find the steps required. Requirements The documentation for Nitrokey seems scattered or lacking a bit. Below I will describe what to do on the latest Fedora (21) release. PCSC You need to install two packages to get started and recognize the Nitrokey: $…
Update (2015-03-06) : Aaron Parecki replied to this proposal here . I agree with his reply as it turns out IndieAuth is also used for authorization in addition to authentication. Introduction This post proposes a few minimal changes to the IndieAuth protocol as well as their rationale. These changes were inspired by creating an alternative but mostly compatible IndieAuth implementation called…
More feedback is required before this document can be considered finished. See "Issues" section below. Authenticating to web servers with a client certificate, installed in the user's browser, is unfortunately not widely used. They are convenient and safe to use once the initial hurdle of installing them is taken. There is now a Proof of Concept instance! Check it out here ! The main benefit is…