Sanoid on TrueNAS
Posted on March 28, 2024
| Patryk Cisek
syncoid to TrueNAS In my homelab, I have 2 NAS systems:
Linux (Debian) TrueNAS Core (based on FreeBSD) On my Linux box, I use Jim Salter’s sanoid to periodically take snapshots of my ZFS pool. I also want to have a proper backup of the whole pool, so I use syncoid to transfer those snapshots to another machine. Sanoid itself is responsible only for taking new snapshots and pruning old ones you no longer care about.
[Read More]
OpenPGP Paper Backup
Posted on March 15, 2024
| Patryk Cisek
openpgp-paper-backup I’ve been using OpenPGP through GnuPG since early 2000’. It’s an essential part of Debian Developer’s workflow. We use it regularly to authenticate package uploads and votes. Proper backups of that key are really important.
Up until recently, the only reliable option for me was backing up a tarball of my ~/.gnupg offline on a set few flash drives. This approach is better than nothing, but it’s not nearly as reliable as I’d like it to be.
[Read More]
Don't store TOTP in Bitwarden for your online accounts!
Posted on November 18, 2022
| Patryk Cisek
Since I’ve started working in Information Security space, I’ve been talking to a lot of people about the topics related to protecting ones’ identity online. Basically, trying to answer the question: What does it take to sufficiently secure my online accounts? Of course, the meaning of sufficiently is very subjective here, but I’ve always kept it vague to gauge what it means to them specifically.
I did make sure to talk people of various backgrounds – from deeply technical all the way to not technical at all.
[Read More]
Unattended Upgrades Debian
Posted on November 13, 2022
| Patryk Cisek
Unattended Upgrades in Debian Feels like since forever have I been using unattended-upgrades package to automate the Security upgrades on my various Debian Stable based machines.
Default Settings By default unattended-upgrades will install only Security updates. It also will not send any email reports. That is not surprising – well, you have to have email delivery configured and unattended-upgrades needs to know, what email address to send those reports to.
[Read More]
Playing with NitroKey 3 -- PC runner using USBIP
Posted on July 14, 2022
| Patryk Cisek
I’ve been wanting to use my brand new NitroKey 3, but TOTP is not supported yet. So, I’m looking to implement it myself, since firmware and tooling are open-source.
NitroKey 3’s firmware is based on Trussed framework. In essence, it’s been designed so that anyone can implement an independent Trussed application. Each such application is like a module that can be added to Trussed-based product. So if I write a Trussed app, I’d be able to add it to NK3’s firmware.
[Read More]
Automating Let's Encrypt certificates with Gandi LiveDNS
Posted on February 10, 2022
| Patryk Cisek
As a Debian Developer I have a discount on using Gandi and I’ve been using it for quite a long time and have been very happy with it. I’ve been using it for registering domains. For example this blog’s domain is managed by my Gandi account.
Using publicly registered domain in private-only setup In addition to using this DNS registrar for public stuff, like a blog, one can also use it for a domain accessible only within a private network.
[Read More]
How does Google Authenticator work? (Part 3)
Posted on August 13, 2021
| Patryk Cisek
Part 3 is the last part in this short cycle. Here I’ll explain all the details around Time-based One-Time Password algorithm. I’ll finish up by also elaborating on things common to both, HMAC-Based One-Time Password algorithm:
QR Codes used to easily transfer secrets from the server to the Authenticator app Base32 algorithm – used to store non-printable secret in a URI (effectively stored by the QR Codes mentioned above). TOTP One way to avoid the problems with lack of feedback between server and the app would be to shift from using a counter that is increasing with every authentication attempt to a counter based on, for example, a time stamp.
[Read More]
How does Google Authenticator work? (Part 2)
Posted on August 12, 2021
| Patryk Cisek
Authenticator apps like Google Authenticator use 2 authenticaion protocol centered around What you have paradigm. Those algorithms are:
HOTP (HMAC-based One Time Password), and TOTP (Time-based One Time Password). They obviously are different, but both are centered around the same basic idea: using a rolling hash value, that is predictable only to the server and the authenticator app. Additionally, both are using HMAC-SHA-1 for generating those hash values.
In my previous post I explained the gist of the approach used in both algorithms.
[Read More]
How does Google Authenticator work? (Part 1)
Posted on August 10, 2021
| Patryk Cisek
When you’re accessing services over the WEB – let’s pick GMail as an example – a couple of things have to happen upfront:
The server you’re connecting to (GMail in our example) has to get to know who you are. Only after getting to know who you are it’s able to decide what resources you are allowed to access (e.g. your own email inbox, your Calendar, Drive etc.). Step 1 above is called authentication.
[Read More]
Debian on TrueNAS Core under bhyve
Posted on July 28, 2021
| Patryk Cisek
Installing Debian/GNU Linux under bhyve on TrueNAS Core I got myself a TrueNAS Mini X+ couple of months ago. I have it running TrueNAS Core based on FreeBSD. In that system you can run VMs under FreeBSD’s native hypervisor, bhyve. Since there are a couple of quirks around running Debian specifically, I decided to write up a quick article about setting up Debian-based VM there.
The quirks The ones I’ve stumbled upon were:
[Read More]