83
On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu.
NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands.
$ yum ...
47
If you have no explicit list of ciphers set in ssh_config using the Ciphers keyword, then the default value, according to man 5 ssh_config (client-side) and man 5 sshd_config (server-side), is:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
aes128-gcm@openssh.com,aes256-gcm@openssh.com,
chacha20-poly1305@openssh....
41
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
...
40
Did you delete the /home/me123/.gnupg directory and then it was recreated by gpg? If so, that's likely what is confusing the agent.
Either restart the agent (gpgconf --kill gpg-agent) or, more drastically, reboot your machine and try again.
39
To disable RC4 and use secure ciphers on SSH server, hard-code the following in /etc/ssh/sshd_config
ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
OR if you prefer not to dictate ciphers but merely want to strip out insecure ciphers, run this on the command line instead (in sudo mode):
...
38
You can use the following command:
openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer
38
You can use the program pdftk to set both the owner and/or user password
pdftk input.pdf output output.pdf owner_pw xyz user_pw abc
where owner_pw and user_pw are the commands to add the passwords xyz and abc respectively (you can also specify one or the other but the user_pw is necessary in order to prohibit opening).
You also might want to override the ...
37
There is no point in doing multiple passes. Once is enough.
Filling a to-be-encrypted drive with random data mainly has two uses:
get rid of old, unencrypted data
make free space indistuingishable from encrypted data
Usually if you encrypt you don't want anyone to see your data. So chances are, if you had old, unencrypted data on this drive, you want to ...
35
In a zip file, only file contents is encrypted. File metadata, including file names, is not encrypted. That's a limitation of the file format: each entry is compressed separately, and if encrypted, encrypted separately.
You can use 7-zip instead. It supports metadata encryption (-mhe=on with the Linux command line implementation).
7z a -p -mhe=on Directory....
answered Jun 16 '16 at 7:32
Gilles 'SO- stop being evil'
669k162 gold badges1394 silver badges1897 bronze badges
34
To choose a default key without having to specify --default-key on the command-line every time, create a configuration file (if it doesn't already exist), ~/.gnupg/gpg.conf, and add a line containing
default-key <key-fpr>
replacing <key-fpr> with the id or fingerprint of the key you want to use by default.
29
The problem with explicitly specifying a cipher list is that you must manually add new ciphers as they come out. Instead, simply list the ciphers you want to remove, prepending the list (not each individual cipher) with a '-' character. So in this case, the Ciphers line should read:
Ciphers -arcfour*
Or if you prefer:
Ciphers -arcfour,arcfour128,...
28
For newer versions of ubuntu, for example, 14.04, I found a combination of @dragly and this blogposts' answers very helpful. To paraphrase:
(On server) Install Dropbear
sudo apt-get install dropbear
(On server) Copy and assign permissions for root public/private key login
sudo cp /etc/initramfs-tools/root/.ssh/id_rsa ~/.
sudo chown user:user ~/id_rsa
...
27
Lines in the known_hosts file are not encrypted, they are hashed. You can't decrypt them, because they're not encrypted. You can't “unhash” them, because that what a hash is all about — given the hash, it's impossible¹ to discover the original string. The only way to “unhash” is to guess the original string and verify your guess.
If you have a list of host ...
answered Dec 20 '14 at 22:52
Gilles 'SO- stop being evil'
669k162 gold badges1394 silver badges1897 bronze badges
25
You can use openssl to encrypt and decrypt using key based symmetric ciphers. For example:
openssl enc -in foo.bar \
-aes-256-cbc \
-pass stdin > foo.bar.enc
This encrypts foo.bar to foo.bar.enc (you can use the -out switch to specify the output file, instead of redirecting stdout as above) using a 256 bit AES cipher in CBC mode. There are ...
23
Assuming that the drive is /dev/sdb, and the partition you want to check is /dev/sdb1, run this command:
$ blkid /dev/sdb1
the output will change if the partition is encrypted or not:
/dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="crypto_LUKS" #encrypted
/dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="ext4" #not encrypted, fs is ext4
If the partition is not ...
23
pdftk depends on old libraries, and so is no longer in the repos of Fedora / CentOS. As a replacement, I prefer qpdf
qpdf --encrypt [readpass] [ownerpass] 256 -- [infile].pdf [outfile].pdf
17
You can use the doveadm utility, which is included in the dovecot package.
doveadm pw -s SHA512-CRYPT
Result example:
{SHA512-CRYPT}$6$0JvQ1LLFESzA16.I$JVdKAIq0igudTq06BMqzT9rL1gRawMPwLr9U3/kBMKUqZdONfa0wubC89C35LKl3aE16CRH57BfGb4ygPLggL1
Just cut {SHA512-CRYPT} and you'll get your SHA512 hashed string.
17
One method of annoymizing HTTP traffic from the command line is to use tor. This article discusses the method, titled: How to anonymize the programs from your terminal with torify.
General steps from article
You can install the tor package as follows:
Fedora/CentOS/RHEL
$ sudo yum install tor
Ubuntu/Debian
$ sudo apt-get install tor
Edit this file /...
16
Some one-liners:
MySQL (may require you add -u(user) -p):
mysql -NBe "select password('right')"
Python:
python -c 'from hashlib import sha1; print "*" + sha1(sha1("right").digest()).hexdigest().upper()'
Perl:
perl -MDigest::SHA1=sha1_hex -MDigest::SHA1=sha1 -le 'print "*". uc sha1_hex(sha1("right"))'
PHP:
php -r 'echo "*" . strtoupper(sha1(sha1("...
16
Have a look at the cryptsetup readme for this in /usr/share/doc/cryptsetup/README.remote.gz (Ubuntu package cryptsetup). In there is a full guide to accomplish this. It is similar to dragly's answer, but I think this is a bit more elegant. (Dropbear formatted keys, passing the passphrase via a FIFO rather than a fragile shell script, etc.)
unlocking ...
16
It would appear that the directory ~/.gnupg/private-keys-v1.d (under some circumstances) is not being created or, is created with the wrong permissions.
# mkdir -p ~/.gnupg/private-keys-v1.d
# chmod 700 ~/.gnupg/private-keys-v1.d
Fixed it for me.
15
Backup
Reformat
Restore
cryptsetup luksRemoveKey would only remove an encryption key if you had more than one. The encryption would still be there.
The Fedora Installation_Guide Section C.5.3 explains how luksRemoveKey works.
That it's "impossible" to remove the encryption while keeping the contents is just an educated guess. I base that on two things:
...
15
Indeed, the page describes setting up a partition, but it's similar for a swapfile:
dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile
The result:
# swapon -s
Filename ...
15
Full disk encryption is usually done using the dm-crypt Device Mapper target, with a nested LVM (Logical Volume Manager) inside. So to reset your password you'll have to
Unlock/open the crypto container; this is done using cryptsetup
Activate the logical volumes; vgchange is used for this.
Usually you won't need to care about this. Just let the initrd ...
15
cryptsetup luksDump /dev/fedora/01 shows the LVM logical volume to be a LUKS encrypted volume. The output of pvs or pvdisplay would show the partition /dev/sda3 to be a physical volume. Thus you have LUKS over LVM. At a lower level, you have LVM over PC partition.
The output of lsblk confirms this: sda is a disk, sda3 is a partition (which contains an LVM ...
answered Oct 9 '14 at 0:14
Gilles 'SO- stop being evil'
669k162 gold badges1394 silver badges1897 bronze badges
15
I found that running sudo bash and then running ecryptfs-recover-private as root (rather than via sudo) worked. Not sure why it should be any different.
Edit:
TL;DR:
# ecryptfs-unwrap-passphrase /mnt/crypt/.ecryptfs/user/.ecryptfs/wrapped-passphrase - | ecryptfs-add-passphrase --fnek -
< Type your login password here >
Inserted auth tok with ...
14
Encrypting a password is useless when you can't keep it encrypted. The instant you decrypt it, it's vulnerable again.
No matter how cryptographically hard they are, the encryption and decryption methods are right there for anyone to see and copy-paste anyway. That just makes it sillier.
chmod will be a much better defense against snooping than a rube ...
14
The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both.
To fix this for existing data specify -md md5 in ...
13
dd if=/dev/urandom of=/dev/sda, or simply cat /dev/urandom >/dev/sda, isn't the fastest way to fill a disk with random data. Linux's /dev/urandom isn't the fastest cryptographic RNG around. Is there an alternative to /dev/urandom? has some suggestions. In particular, OpenSSL contains a faster cryptographic PRNG:
openssl rand $(</proc/partitions awk '$...
answered Apr 12 '13 at 18:34
Gilles 'SO- stop being evil'
669k162 gold badges1394 silver badges1897 bronze badges
13
The ssh-keygen(1) man page says for the -F hostname option:
Search for the specified hostname in a known_hosts file, listing any occurrences found. This option is useful to find hashed host names or addresses and may also be used in conjunction with the -H option to print found keys in a hashed format.
This seems to be what you want.
Only top voted, non community-wiki answers of a minimum length are eligible
