Ronald Ip iphoting

Better SSH Authorized Keys Management

A seemingly common problem that people encounter is how to handle all of your users authorized_keys file.

People struggle over management, ensuring that users only have specific keys in the authorized_keys file or even a method for expiring keys. A centralized key management system could help provide all of this functionality with a little scripting.

One piece of functionality overlooked in OpenSSH is the AuthorizedKeysCommand configuration keyword. This configuration allows you to specify a command that will run during login to retrieve a users public key file from a remote source and perform validation just as if the authorized_keys file was local.

Here is an example directory structure for a set of users with SSH public keys that can be shared out via a web server:

Workarounds for Netflix and the blocking of Hurricane Electric IPv6 tunnels

The dreaded "You seem to be using an unblocker or proxy." error message. Cool story bro.

This gist was essentially created out of my own rant about Netflix being hostile to IPv6 tunnel services since June 2016. You are welcome to read my opinion on the matter, this is the more technical side to the issue and how to combat it within your own network.

Since I wrote this, various GitHub users have contributed their thoughts and ideas which has been incorporated into this gist. Thank you to everyone who have contributed their own methods and implementations.

The problem

Netflix now treats IPv6 tunnel brokers (such as Hurricane Electric) as proxy servers. A while ago it became apparent to users and Netflix that somewhat by accident, IPv6 tunnel users were being served content outside of their geolocation because of the way Netflix was identifyi

Netflix and direct bypass rules using WPAD

If your like me you might already use a VPN to route your traffic through. The problem is some sites just don't like VPN services and will actively block you from using them without disabling or bypassing it.

Netflix is a prime example of a website that does not like VPN services, because they are seen as a way to circumvent the geo-restrictions imposed on the content library offered.

Below are WPAD rules I use to essentially send Netflix traffic directly and avoid any VPN errors/dreaded unknown error network messages. Error messages that Netflix throws back at you related to VPN usage when streaming might include:

"You seem to be using an unblocker or proxy"
VPN/proxy error M7111-1331-5059

	#!/usr/bin/env ruby
	#
	# A simple numerical PIN generator.
	# For passphrases, use pwqgen.rb.
	#
	# Usage:
	# gem install docopt
	# ./pin_gen.rb --help
	#

	#!/usr/bin/env python2
	"""
	Author: takeshix <takeshix@adversec.com>
	PoC code for CVE-2014-0160. Original PoC by Jared Stafford (jspenguin@jspenguin.org).

	Supportes all versions of TLS and has STARTTLS support for SMTP,POP3,IMAP,FTP and XMPP.
	"""

	import sys,struct,socket
	from argparse import ArgumentParser

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\i8042prt\Parameters]
	"PollingIterations"=dword:00002ee0
	"PollingIterationsMaximum"=dword:00002ee0
	"ResendIterations"=dword:00000003
	"LayerDriver JPN"="kbd101.dll"
	"OverrideKeyboardIdentifier"="PCAT_101KEY"
	"OverrideKeyboardType"=dword:00000007
	"OverrideKeyboardSubtype"=dword:00000000

	# The blog post that started it all: https://neocities.org/blog/the-fcc-is-now-rate-limited
	#
	# Current known FCC address ranges:
	# https://news.ycombinator.com/item?id=7716915
	#
	# Confirm/locate FCC IP ranges with this: http://whois.arin.net/rest/net/NET-165-135-0-0-1/pft
	#
	# In your nginx.conf:

	location / {

	#!/bin/bash
	# Modified Pi-hole script to generate a generic hosts file
	# for use with dnsmasq's addn-hosts configuration
	# original : https://github.com/jacobsalmela/pi-hole/blob/master/gravity-adv.sh

	# The Pi-hole now blocks over 120,000 ad domains
	# Address to send ads to (the RPi)
	piholeIP="192.168.1.1"

	outlist='./final_blocklist.txt'

	#!/bin/bash
	# https://blog.filippo.io/cleaning-up-my-gopath-with-homebrew/

	set -euo pipefail

	if [[ $# -lt 1 ]] \|\| [[ "$1" =~ -h\|--help ]] ; then
	echo "Usage: brew-go-get github.com/foo/bar ..."
	exit 1
	fi

	# create $HOME/.chefdk
	chef gem update json
	CHEF_RUBY_VERS=$(ls /opt/chefdk/embedded/lib/ruby/ \| grep '[0-9]')

	CHEFDK="/opt/chefdk/embedded"
	CHEFDK_USER="$HOME/.chefdk/gem/ruby/$CHEF_RUBY_VERS"
	RVM_GEMS="$HOME/.rvm/gems"
	RVM_RUBIES="$HOME/.rvm/rubies"
	RUBY_NAME="ext-chefdk-ruby"