83

On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu. NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands. $ yum ...


47

If you have no explicit list of ciphers set in ssh_config using the Ciphers keyword, then the default value, according to man 5 ssh_config (client-side) and man 5 sshd_config (server-side), is: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, aes128-gcm@openssh.com,aes256-gcm@openssh.com, chacha20-poly1305@openssh....


41

Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one. ...


40

Did you delete the /home/me123/.gnupg directory and then it was recreated by gpg? If so, that's likely what is confusing the agent. Either restart the agent (gpgconf --kill gpg-agent) or, more drastically, reboot your machine and try again.


39

To disable RC4 and use secure ciphers on SSH server, hard-code the following in /etc/ssh/sshd_config ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr OR if you prefer not to dictate ciphers but merely want to strip out insecure ciphers, run this on the command line instead (in sudo mode): ...


38

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer


38

You can use the program pdftk to set both the owner and/or user password pdftk input.pdf output output.pdf owner_pw xyz user_pw abc where owner_pw and user_pw are the commands to add the passwords xyz and abc respectively (you can also specify one or the other but the user_pw is necessary in order to prohibit opening). You also might want to override the ...


37

There is no point in doing multiple passes. Once is enough. Filling a to-be-encrypted drive with random data mainly has two uses: get rid of old, unencrypted data make free space indistuingishable from encrypted data Usually if you encrypt you don't want anyone to see your data. So chances are, if you had old, unencrypted data on this drive, you want to ...


35

In a zip file, only file contents is encrypted. File metadata, including file names, is not encrypted. That's a limitation of the file format: each entry is compressed separately, and if encrypted, encrypted separately. You can use 7-zip instead. It supports metadata encryption (-mhe=on with the Linux command line implementation). 7z a -p -mhe=on Directory....


34

To choose a default key without having to specify --default-key on the command-line every time, create a configuration file (if it doesn't already exist), ~/.gnupg/gpg.conf, and add a line containing default-key <key-fpr> replacing <key-fpr> with the id or fingerprint of the key you want to use by default.


29

The problem with explicitly specifying a cipher list is that you must manually add new ciphers as they come out. Instead, simply list the ciphers you want to remove, prepending the list (not each individual cipher) with a '-' character. So in this case, the Ciphers line should read: Ciphers -arcfour* Or if you prefer: Ciphers -arcfour,arcfour128,...


28

For newer versions of ubuntu, for example, 14.04, I found a combination of @dragly and this blogposts' answers very helpful. To paraphrase: (On server) Install Dropbear sudo apt-get install dropbear (On server) Copy and assign permissions for root public/private key login sudo cp /etc/initramfs-tools/root/.ssh/id_rsa ~/. sudo chown user:user ~/id_rsa ...


27

Lines in the known_hosts file are not encrypted, they are hashed. You can't decrypt them, because they're not encrypted. You can't “unhash” them, because that what a hash is all about — given the hash, it's impossible¹ to discover the original string. The only way to “unhash” is to guess the original string and verify your guess. If you have a list of host ...


25

You can use openssl to encrypt and decrypt using key based symmetric ciphers. For example: openssl enc -in foo.bar \ -aes-256-cbc \ -pass stdin > foo.bar.enc This encrypts foo.bar to foo.bar.enc (you can use the -out switch to specify the output file, instead of redirecting stdout as above) using a 256 bit AES cipher in CBC mode. There are ...


23

Assuming that the drive is /dev/sdb, and the partition you want to check is /dev/sdb1, run this command: $ blkid /dev/sdb1 the output will change if the partition is encrypted or not: /dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="crypto_LUKS" #encrypted /dev/sdb1: UUID="xxxxxxxxxxxx" TYPE="ext4" #not encrypted, fs is ext4 If the partition is not ...


23

pdftk depends on old libraries, and so is no longer in the repos of Fedora / CentOS. As a replacement, I prefer qpdf qpdf --encrypt [readpass] [ownerpass] 256 -- [infile].pdf [outfile].pdf


17

You can use the doveadm utility, which is included in the dovecot package. doveadm pw -s SHA512-CRYPT Result example: {SHA512-CRYPT}$6$0JvQ1LLFESzA16.I$JVdKAIq0igudTq06BMqzT9rL1gRawMPwLr9U3/kBMKUqZdONfa0wubC89C35LKl3aE16CRH57BfGb4ygPLggL1 Just cut {SHA512-CRYPT} and you'll get your SHA512 hashed string.


17

One method of annoymizing HTTP traffic from the command line is to use tor. This article discusses the method, titled: How to anonymize the programs from your terminal with torify. General steps from article You can install the tor package as follows: Fedora/CentOS/RHEL $ sudo yum install tor Ubuntu/Debian $ sudo apt-get install tor Edit this file /...


16

Some one-liners: MySQL (may require you add -u(user) -p): mysql -NBe "select password('right')" Python: python -c 'from hashlib import sha1; print "*" + sha1(sha1("right").digest()).hexdigest().upper()' Perl: perl -MDigest::SHA1=sha1_hex -MDigest::SHA1=sha1 -le 'print "*". uc sha1_hex(sha1("right"))' PHP: php -r 'echo "*" . strtoupper(sha1(sha1("...


16

Have a look at the cryptsetup readme for this in /usr/share/doc/cryptsetup/README.remote.gz (Ubuntu package cryptsetup). In there is a full guide to accomplish this. It is similar to dragly's answer, but I think this is a bit more elegant. (Dropbear formatted keys, passing the passphrase via a FIFO rather than a fragile shell script, etc.) unlocking ...


16

It would appear that the directory ~/.gnupg/private-keys-v1.d (under some circumstances) is not being created or, is created with the wrong permissions. # mkdir -p ~/.gnupg/private-keys-v1.d # chmod 700 ~/.gnupg/private-keys-v1.d Fixed it for me.


15

Backup Reformat Restore cryptsetup luksRemoveKey would only remove an encryption key if you had more than one. The encryption would still be there. The Fedora Installation_Guide Section C.5.3 explains how luksRemoveKey works. That it's "impossible" to remove the encryption while keeping the contents is just an educated guess. I base that on two things: ...


15

Indeed, the page describes setting up a partition, but it's similar for a swapfile: dd if=/dev/urandom of=swapfile.crypt bs=1M count=64 loop=$(losetup -f) losetup ${loop} swapfile.crypt cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile mkswap /dev/mapper/swapfile swapon /dev/mapper/swapfile The result: # swapon -s Filename ...


15

Full disk encryption is usually done using the dm-crypt Device Mapper target, with a nested LVM (Logical Volume Manager) inside. So to reset your password you'll have to Unlock/open the crypto container; this is done using cryptsetup Activate the logical volumes; vgchange is used for this. Usually you won't need to care about this. Just let the initrd ...


15

cryptsetup luksDump /dev/fedora/01 shows the LVM logical volume to be a LUKS encrypted volume. The output of pvs or pvdisplay would show the partition /dev/sda3 to be a physical volume. Thus you have LUKS over LVM. At a lower level, you have LVM over PC partition. The output of lsblk confirms this: sda is a disk, sda3 is a partition (which contains an LVM ...


15

I found that running sudo bash and then running ecryptfs-recover-private as root (rather than via sudo) worked. Not sure why it should be any different. Edit: TL;DR: # ecryptfs-unwrap-passphrase /mnt/crypt/.ecryptfs/user/.ecryptfs/wrapped-passphrase - | ecryptfs-add-passphrase --fnek - < Type your login password here > Inserted auth tok with ...


14

Encrypting a password is useless when you can't keep it encrypted. The instant you decrypt it, it's vulnerable again. No matter how cryptographically hard they are, the encryption and decryption methods are right there for anyone to see and copy-paste anyway. That just makes it sillier. chmod will be a much better defense against snooping than a rube ...


14

The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both. To fix this for existing data specify -md md5 in ...


13

dd if=/dev/urandom of=/dev/sda, or simply cat /dev/urandom >/dev/sda, isn't the fastest way to fill a disk with random data. Linux's /dev/urandom isn't the fastest cryptographic RNG around. Is there an alternative to /dev/urandom? has some suggestions. In particular, OpenSSL contains a faster cryptographic PRNG: openssl rand $(</proc/partitions awk '$...


13

The ssh-keygen(1) man page says for the -F hostname option: Search for the specified hostname in a known_hosts file, listing any occurrences found. This option is useful to find hashed host names or addresses and may also be used in conjunction with the -H option to print found keys in a hashed format. This seems to be what you want.


Only top voted, non community-wiki answers of a minimum length are eligible