Posts on Limawi Blog https://blog.limawi.io/en-us/posts/ https://blog.limawi.io/logo.png Posts on Limawi Blog https://blog.limawi.io/en-us/posts/ Cloud, DevOps and tools for all of that. en-us Fri, 30 Apr 2021 10:20:21 +0000 On git never store secrets https://blog.limawi.io/en-us/posts/on-git-never-store-secrets/ Fri, 30 Apr 2021 10:20:21 +0000 https://blog.limawi.io/en-us/posts/on-git-never-store-secrets/ I see a bad use in the git world. Even if some projects encourage this behaviour. Be clear on that point: storing secrets on git always is a bad idea.

Remote git flow breaking

If you store a secret on git, you are supposed to store it encrypted (obviously).

To do a versioning you simply use a commit. As the encryption algorithm is non-deterministic (as it should be, it is not a hash), you end up with a blob of encrypted data which is entirely different from the previous commit. It makes impossible to do a compare and the full file is uploaded everytime.

Now, more funny. You want to do a git merge because 2 branches received separate updates on their secrets. As you have to compare 2 entirely different encrypted files, what advantages can offer any merge strategy from git. You definitely will end up screwing up your file and loose the contained secrets.

Local git flow breaking

You could say “this way I manage my secrets with the same flow as my code”. And I shall answer “Really ? Are you really sure on that ?”

So let’s have a look at your local flow, as I already explained that your remote flow is definitely dead.

  • You pull the repo
  • You integrate it into your VSCode or your terminal or any other IDE
  • You change something on the code
  • You commit
  • You pull and push

Okay, now for the secrets.

  • You pull the repo
  • You integrate it into your VSCode or your terminal or any other IDE
  • So far so good
  • Hopefully you installed the tool to decrypt your secrets file
  • You decrypt it (hoping the tool is integrated in your IDE)
  • You change something on it
  • You encrypt it with the same tool or another
  • You double-triple check that you did not leave the unencrypted file somewhere on your workspace
  • you commit with a drop on your forehead and a pain on your stomach
  • you pull
  • you try to figure out how to solve the conflict between your 2 blobs of encrypted file because a new commit on remote already altered the file
  • you commit again hoping you did not screw everything up
  • you push
  • you see afterwards that you commit the unencrypted file as well and secrets are now freely available on the remote
  • you desperately try to reset screwing up the git flow for the whole team
  • you cry

I’m not sure it is the same git flow.

As conclusion, store your secrets in storages made for that. For instance, Hashicorp Vault on your infrastructure and keepassXC locally.

]]> Musics used https://blog.limawi.io/en-us/posts/musics-used/ Sat, 23 Jan 2021 19:28:37 +0000 https://blog.limawi.io/en-us/posts/musics-used/ Here is the list of musics used in our contents with their associated license. Current playlists

Ambiance playlist

 Artist : Almusic34

Title : 432 Hz Space ambiant

Link : https://freemusicarchive.org/music/almusic34/single/432-hz-space-ambientmp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : 432 Hz tuned Landscape 1

Link : https://freemusicarchive.org/music/almusic34/single/432hz-tuned-landscape-1mp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Ov Moi Omm

Title : And Their Domain

Link : https://freemusicarchive.org/music/ov-moi-omm/single/and-their-domain

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : Deep space travel

Link : https://freemusicarchive.org/music/almusic34/single/deep-space-travelmp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : Harmony in the night

Link : https://freemusicarchive.org/music/almusic34/single/harmony-in-the-nightmp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Lex Villena

Title : Origins

Link : https://freemusicarchive.org/music/lex-villena/single/origins

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : Peace landscape 3

Link : https://freemusicarchive.org/music/almusic34/single/peace-landscape-3mp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Ov Moi Omm

Title : Somewhere Above South Eastern Oceans

Link : https://freemusicarchive.org/music/ov-moi-omm/single/somewhere-above-south-eastern-oceans

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : Space ambiant mix4

Link : https://freemusicarchive.org/music/almusic34/single/space-ambient-mix4mp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Ov Moi Omm

Title : The Sabian Star Worshippers

Link : https://freemusicarchive.org/music/ov-moi-omm/single/the-sabian-star-worshippers

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : tranquility

Link : https://freemusicarchive.org/music/almusic34/single/tranquilitymp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : Almusic34

Title : Voices and bells

Link : https://freemusicarchive.org/music/almusic34/single/voices-and-bellsmp3

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Introduction playlist

Artist : Itsensäsyöjät

Title : Introduction beats

Link : https://freemusicarchive.org/music/Itsenssyjt/Elektrique/01-Introduction_beats

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Artist : ROZKOL

Title : Opening Credits

Link : https://freemusicarchive.org/music/ROZKOL/Roadside_Picnic/ROZKOL_-_Roadside_Picnic_-_01_Opening_Credits

License : Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/

Conclusion playlist

Artist : TRG Banks

Title : Evening journey

Link : https://freemusicarchive.org/music/TRG_Banks/The_Rainbows_End/Evening_journey

License : CC0 1.0 Universal (CC0 1.0) Public Domain Dedication https://creativecommons.org/publicdomain/zero/1.0/

Old playlist

License: Creative Commons Attribution 4.0 International (CC BY 4.0)

License : Creative Commons Attribution 3.0 Unported (CC BY 3.0)

]]> How to fix the root flaw in MacOS High Sierra https://blog.limawi.io/en-us/posts/how-to-fix-the-root-flaw-in-macos-high-sierra/ Wed, 29 Nov 2017 11:46:22 +0000 https://blog.limawi.io/en-us/posts/how-to-fix-the-root-flaw-in-macos-high-sierra/ A turkish researcher found a flaw allowing the access to root account without password on MacOS High Sierra. This flaw is critical because easily executable. It can be used locally or remotely if the device has an active VNC protocol (screen sharing activated). This flaw grants access to all device’s permissions. The attacker can do whatever he wants.

Attack surface

The access to the authentication panel to tape the administrator password is the only thing needed. This panel is available from any account on the device (locally or remotely via VNC protocol).

The flaw comes from the mistakenly activated root account on MacOS High Sierra. This root account is an inheritance of the UNIX system from which MacOS is developed. It is present and used in the Linux world but normally is deactivated (available but deactivated) on Mac, replaced with administrator accounts that cannot access system files.

How to protect yourself

You just need to set a password for this root account. Never loose this password.

In command lines from whatever administrator account on the device

  • Open the terminal. The application is available in the folder Applications > Utilities.
  • Enter the following command line then press Enter: sudo passwd -u root
  • A password will be asked, enter the password of your root account then press Enter.
  • Enter the same password to confirm and press Enter again.
  • Your root account is configured with a password.

With the graphic interface

  • Go to the menu > System Preferences.
  • Click Users & Groups (or Accounts).
  • Click the padlock, then enter an administrator name and password.
  • Click Login Options.
  • Click Join (or Edit).
  • Click Open Directory Utility.
  • Click the padlock in the Directory Utility window, then enter an administrator name and password.
  • From the menu bar in Directory Utility, choose Edit > Change Root Password...
  • Enter a root password when prompted.
]]> SSL/TLS and HSTS, what is that ? https://blog.limawi.io/en-us/posts/ssltls-and-hsts-what-is-that/ Thu, 18 May 2017 13:07:01 +0000 https://blog.limawi.io/en-us/posts/ssltls-and-hsts-what-is-that/ Our websites are made safe with https. That means that we use SSL/TLS. But what is that ? And what is the HSTS extension ? The running of SSL/TLS

SSL/TLS is a protocol that provides server identity verification (for instance a web server like Limawi, in that case we speak about https because the protocol to access a web server is called http). This identity verification works with a certificate sent from the server.

Here is the protocol step by step (technical terms are present in the graphs):

  • The client software asks the server its identity
  • The server sends a certificate signed by the certification authority trusted by both the client software and the server to the client software
  • The client software checks if the signature belongs to the certification authority it trusts
  • It sends a request to this certification authority to check if it ensures that the certificate is still valid
  • The client software and the server agree on a session key that will encrypt informations during a limited period (this time passed, another session key will take the place, the details for Limawi are explained in the graphs about the session key)
  • The client software and the server can communicate in a secure way
Diagram displaying the SSL/TLS identity flow

SSL/TLS identity server protocol with Let’s Encrypt

Diagram displaying the SSL/TLS identity flow
Diagram displaying the SSL/TLS session flow

SSL/TLS server session protocol with Let’s Encrypt

Diagram displaying the SSL/TLS session flow

The HSTS extension

The HSTS extension is a http protocol extension (the protocol that loads webpages) reinforcing the SSL/TLS use.

This extension forces the browser to load secure versions of a webpage and all the ressources this page holds (that is to say https versions) in a domain (the base address of a website) that implements it.

If the wanted webpage does not have any secure version, it is not loaded on the browser.

Once the browser accesses a website implementing this extension it keeps in memory that the next webpages wanted on that website must be secured. It can check it even before sending the first request to the website.

A HSTS extension is valid for a limited period and the browser must check at the end of this time if the website always uses this extension to start another period.

Domains (base address of a website) can be preloaded in a database available in your browser. That way the browser knows even before sending the first request of its history to a webpage that it must be secure otherwise it does not load it.

This base is available here: HSTS Preload

With Limawi

With Limawi, the certification authority is Let’s Encrypt.

The session key exchange between the client software and the server is done with the Diffie-Helman protocol that creates a symmetrical session key without exchanging secret elements.

Limawi uses HSTS. The HSTS validity period is 6 months.

References

]]>