70
On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu.
NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands.
$ yum ...
55
Yes, you're looking for mkpasswd, which (at least on Debian) is part of the whois package. Don't ask why...
anthony@Zia:~$ mkpasswd -m help
Available methods:
des standard 56 bit DES-based crypt(3)
md5 MD5
sha-256 SHA-256
sha-512 SHA-512
Unfortunately, my version at least doesn't do bcrypt. If your C library does, it should (and the manpage gives a ...
42
If you have no explicit list of ciphers set in ssh_config using the Ciphers keyword, then the default value, according to man 5 ssh_config (client-side) and man 5 sshd_config (server-side), is:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
aes128-gcm@openssh.com,aes256-gcm@openssh.com,
chacha20-poly1305@openssh....
40
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
...
36
You can use the following command:
openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer
36
There is no point in doing multiple passes. Once is enough.
Filling a to-be-encrypted drive with random data mainly has two uses:
get rid of old, unencrypted data
make free space indistuingishable from encrypted data
Usually if you encrypt you don't want anyone to see your data. So chances are, if you had old, unencrypted data on this drive, you want to ...
31
To disable RC4 and use secure ciphers on SSH server, hard-code the following in /etc/ssh/sshd_config
ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
OR if you prefer not to dictate ciphers but merely want to strip out insecure ciphers, run this on the command line instead (in sudo mode):
...
29
I use the following method, which works fairly well:
1) Store your passwords in separate gpg encrypted files. For example ~/.passwd/<accountname>.gpg
2) Create a python extension file with a name of your choosing (e.g., ~/.offlineimap.py), with the following contents:
def mailpasswd(acct):
acct = os.path.basename(acct)
path = "/home/<username&...
27
I think your requirement is valid, but on the other hand it is also difficult, because you are mixing symmetric and asymmetric encryption. Please correct me if I'm wrong.
Reasoning:
The passphrase for your private key is to protect your private key
and nothing else.
This leads to the following situation: You want to
use your private key to encrypt ...
25
For newer versions of ubuntu, for example, 14.04, I found a combination of @dragly and this blogposts' answers very helpful. To paraphrase:
(On server) Install Dropbear
sudo apt-get install dropbear
(On server) Copy and assign permissions for root public/private key login
sudo cp /etc/initramfs-tools/root/.ssh/id_rsa ~/.
sudo chown user:user ~/id_rsa
...
24
You can use the program pdftk to set both the owner and/or user password
pdftk input.pdf output output.pdf owner_pw xyz user_pw abc
where owner_pw and user_pw are the commands to add the passwords xyz and abc respectively (you can also specify one or the other but the user_pw is necessary in order to prohibit opening).
You also might want to override the ...
24
To choose a default key without having to specify --default-key on the command-line every time, create a configuration file (if it doesn't already exist), ~/.gnupg/gpg.conf, and add a line containing
default-key <key-uid>
replacing <key-uid> with the key uid you want to use by default.
23
A guide to do such a setup with BusyBox and Dropbear is shown in this blog post. early-ssh didn't work for me and is apparently not needed anymore.
I have summarized what you need to do in the following. For more details, have a look at the post above:
Install BusyBox and Dropbear on your server
sudo apt-get install dropbear busybox
Update your initramfs ...
23
Use encfs (available as a package on most distributions). To set up:
mkdir ~/.encrypted ~/encrypted
encfs ~/.encrypted ~/encrypted
# enter a passphrase
mv existing-directory ~/encrypted
The initial call to encfs sets up an encrypted filesystem. After that point, every file that you write under ~/encrypted is not stored directly on the disk, it is encrypted ...
answered Jan 8 '12 at 16:32
Gilles 'SO- stop being evil'
593k143 gold badges1216 silver badges1730 bronze badges
23
In a zip file, only file contents is encrypted. File metadata, including file names, is not encrypted. That's a limitation of the file format: each entry is compressed separately, and if encrypted, encrypted separately.
You can use 7-zip instead. It supports metadata encryption (-mhe=on with the Linux command line implementation).
7z a -p -mhe=on Directory....
answered Jun 16 '16 at 7:32
Gilles 'SO- stop being evil'
593k143 gold badges1216 silver badges1730 bronze badges
22
Lines in the known_hosts file are not encrypted, they are hashed. You can't decrypt them, because they're not encrypted. You can't “unhash” them, because that what a hash is all about — given the hash, it's impossible¹ to discover the original string. The only way to “unhash” is to guess the original string and verify your guess.
If you have a list of host ...
answered Dec 20 '14 at 22:52
Gilles 'SO- stop being evil'
593k143 gold badges1216 silver badges1730 bronze badges
22
The problem with explicitly specifying a cipher list is that you must manually add new ciphers as they come out. Instead, simply list the ciphers you want to remove, prepending the list (not each individual cipher) with a '-' character. So in this case, the Ciphers line should read:
Ciphers -arcfour*
Or if you prefer:
Ciphers -arcfour,arcfour128,...
21
I would prefer to use the openssl utility as it seems to be fairly ubiquitous.
Convert RSA public key and private key to PEM format:
$ openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem
$ openssl rsa -in ~/.ssh/id_rsa -pubout -outform pem > id_rsa.pub.pem
Encrypting a file with your public key:
$ openssl rsautl -encrypt -pubin -inkey id_rsa....
21
You can use openssl to encrypt and decrypt using key based symmetric ciphers. For example:
openssl enc -in foo.bar \
-aes-256-cbc \
-pass stdin > foo.bar.enc
This encrypts foo.bar to foo.bar.enc (you can use the -out switch to specify the output file, instead of redirecting stdout as above) using a 256 bit AES cipher in CBC mode. There are ...
18
Did you delete the /home/me123/.gnupg directory and then it was recreated by gpg? If so, that's likely what is confusing the agent.
Either restart the agent or, more drastically, reboot your machine and try again.
17
One method of annoymizing HTTP traffic from the command line is to use tor. This article discusses the method, titled: How to anonymize the programs from your terminal with torify.
General steps from article
You can install the tor package as follows:
Fedora/CentOS/RHEL
$ sudo yum install tor
Ubuntu/Debian
$ sudo apt-get install tor
Edit this file /...
16
Have a look at the cryptsetup readme for this in /usr/share/doc/cryptsetup/README.remote.gz (Ubuntu package cryptsetup). In there is a full guide to accomplish this. It is similar to dragly's answer, but I think this is a bit more elegant. (Dropbear formatted keys, passing the passphrase via a FIFO rather than a fragile shell script, etc.)
unlocking ...
15
After backing up (step 1) and unmounting (between 2 and 3), run fsck to ensure that the filesystem is healthy:
e2fsck -f /dev/mapper/ExistingExt4
Other than that, the steps are OK.
what should I choose for $SECTORS? Is this step even necessary?
This step is necessary, otherwise the partition would still show up at the old side. This is confirmed with ...
15
You can use the doveadm utility, which is included in the dovecot package.
doveadm pw -s SHA512-CRYPT
Result example:
{SHA512-CRYPT}$6$0JvQ1LLFESzA16.I$JVdKAIq0igudTq06BMqzT9rL1gRawMPwLr9U3/kBMKUqZdONfa0wubC89C35LKl3aE16CRH57BfGb4ygPLggL1
Just cut {SHA512-CRYPT} and you'll get your SHA512 hashed string.
15
Assuming that the drive is /dev/sdb, and the partition you want to check is /dev/sdb1, run this command:
$ blkid /dev/sdb1
the output will change if the partition is encrypted or not:
/dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="crypto_LUKS" #encrypted
/dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="ext4" #not encrypted, fs is ext4
If the partition is not ...
15
Full disk encryption is usually done using the dm-crypt Device Mapper target, with a nested LVM (Logical Volume Manager) inside. So to reset your password you'll have to
Unlock/open the crypto container; this is done using cryptsetup
Activate the logical volumes; vgchange is used for this.
Usually you won't need to care about this. Just let the initrd ...
15
pdftk depends on old libraries, and so is no longer in the repos of Fedora / CentOS. As a replacement, I prefer qpdf
qpdf --encrypt [readpass] [ownerpass] 256 -- [infile].pdf [outfile].pdf
14
Indeed, the page describes setting up a partition, but it's similar for a swapfile:
dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile
The result:
# swapon -s
Filename ...
14
It would appear that the directory ~/.gnupg/private-keys-v1.d (under some circumstances) is not being created or, is created with the wrong permissions.
# mkdir -p ~/.gnupg/private-keys-v1.d
# chmod 700 ~/.gnupg/private-keys-v1.d
Fixed it for me.
14
The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both.
To fix this for existing data specify -md md5 in ...
Only top voted, non community-wiki answers of a minimum length are eligible
