Mikal mikalv

How to configure an SSH CA, with visuals

SSH CA

For details, see "Mastering SSH", Second Edition, Chapter 14: Certificate Authorities. Also see 'man ssh-keygen': "ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then trust only the CA key and verify its signature on a certificate rather than trusting many user/host keys. Note that OpenSSH certificates are a different, and much simpler, format to the X.509 certificates used in ssl(8).

Create two CAs

Choose a computer to act as the CA. We'll call this the CA computer (not CA host, since "host" is overloaded here). In this examp

unlocking rootfs via ssh login in initramfs

You can unlock your rootfs on bootup from remote, using ssh to log in to the booting system while it's running with the initramfs mounted.

Setup

For remote unlocking to work, the following packages have to be installed before building the initramfs: dropbear busybox

The file /etc/initramfs-tools/initramfs.conf holds the configuration options used when building the initramfs. It should contain BUSYBOX=y (this is set as the default when the busybox package is installed) to have busybox installed into the initramfs, and should not contain DROPBEAR=n, which would disable installation of dropbear to initramfs. If set to DROPBEAR=y, dropbear will be installed in any case; if DROPBEAR isn't set at all, then dropbear will only be installed in case of an existing cryptroot setup.

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

Log into unifi controller web UI
Go to Settings
Select Routing & Firewall
Select Firewall
Select Groups
Hit "Create new Group"
Enter all your DNS servers here you want to be allowed on the local LAN (Eg, mine is 10.0.1.1 - gateway, 10.0.1.14 - pi-hole)
Name this "Allowed DNS Servers"
Hit OK
SSH into the Gateway - NOT the CloudKey (username/password is whatever you set up)

SKS Keyserver Network Under Attack

This work is released under a Creative Commons Attribution-NoDerivatives 4.0 International License.

Terminological Note

"OpenPGP" refers to the OpenPGP protocol, in much the same way that HTML refers to the protocol that specifies how to write a web page. "GnuPG", "SequoiaPGP", "OpenPGP.js", and others are implementations of the OpenPGP protocol in the same way that Mozilla Firefox, Google Chromium, and Microsoft Edge refer to software packages that process HTML data.

	# Dependencies:
	# {:httpoison, "~> 1.5"},
	# {:floki, "~> 0.21.0"}
	# {:benchee, "~> 1.0"} (Only for benchmarking – not in the script)


	defmodule CrawlQueue do
	use Agent

	def start_link(urls) do

	router id [our IPv4];

	protocol bgp vultr
	{
	local as [our ASN];
	source address [our IPv4 from vultr];
	import all;
	export filter {
	if net ~ [[the IPv4 block we want to announce]] then accept;
	reject;

 defmodule Context do
   @moduledoc false
   defmacro __using__(opts) do
     repo = Keyword.fetch!(opts, :repo)
     quote do
       import Context, only: [context: 1, context: 2]
       Module.put_attribute(__MODULE__, :__repo__, unquote(repo))

	/* ###
	* IP: GHIDRA
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software

	#include <stdio.h>
	#include <stdlib.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <mach/mach.h>
	#include <mach/mach_vm.h>
	#include <dlfcn.h>
	#include <objc/runtime.h>