Dan Klassen » security

Setting up VPN Connection with gnome Network Manager

Dan — Sat, 06 Dec 2008 04:32:58 +0000

Recently for a project I’ve been working on at the office I had to set up a VPN connection to gain access to the client’s network. They already had vpn set up on their end (thankfully) however, oddly enough I didn’t have a vpn client. I noticed that the gnome Network Manager had a tab for VPN, however the add button was disabled. After a quick google, I found out that you just have to install the packages ‘network-manager-pptp’ and ‘pptp-linux’ to enable it.

sudo apt-get install network-manager-pptp pptp-linux

Did the trick and now it was just a matter of entering the server information, username, password. At this point I was still unable to connect to the network. I double and triple checked my info and it was all right. It turned out I had to enable Point to Point Encryption (makes sense) in the advanced section.

Now, I have a nice little ‘locked’ icon on my network status bar.

VPN Connection in Network Manager

Who knew it would be that easy?

Password Security

Dan — Thu, 29 May 2008 14:30:27 +0000

So, everything requires a password these days right? Whether you’re setting up a new email account, signing up for twitter, or creating a new bank account. How in the world do you remember all of these passwords? Well, I’ve seen the old sticky note on the monitor (in the drawer, under the keyboard, you name it) all too often, and we all know that we shouldn’t use the same password everywhere right? That leaves two options: have an amazing memory (ask my wife, I don’t) or find a way to securely manage your passwords.

Thankfully KeePass (or KeepassX on Linux or Mac OS-X) can help out where my memory lacks. KeePass will provide you with a secure place to store all of you passwords in an encrypted format. From the screenshot you can get a rough idea as to what the interface looks like. When you highlight any of the entries, you can just Ctrl+C to copy the password and paste it into whatever application is asking for it. For websites, there’s even an ‘auto-type’ feature. To use this, you first go to the site you want to log in to, click in the username box, and then open KeePass and click on the entry for the site. Then press Ctrl+V and it will type in your username / password for you. Slick eh?

I’ve also been asked about how to generate secure passwords. If you are going to use something like KeePass, I would recommend using it’s built in password generator tool (take a look to the left). It gives you a few options to configure, and then spits out a nice random password for you. For those of you using Ubuntu (or any variant of linux for that matter) you can use the command line tool pwgen (click to install in Ubuntu or ‘apt-get install pwgen’). After installing run something like:

pwgen -B -N 5 -1

To get a list of passwords similar to:

eiyah7Ei
Aeh3Ooxo
jaW9ahFi
rohxiJ7z
uth9ZieY

The -B parameter tells it to not use ambiguous characters (is it a 0 or an O? l or I?). -N 5 creates 5 for you to choose from and -1 puts them each on their own line to make it easier to pick.

If you don’t have access to either of those tools, or you need something that you’ll have a better shot of remembering, try basing the password off of a phrase or something you’ll remember, and add in a couple twists. Let’s try one here… off the top of my head, the first phrase that came to mind was “an apple a day keeps the doctor away” and the password I came up with is “4pP13/d=!phD”. (4pp13 kinda loos like apple, /d is short for per day, =! is ‘not equals’ in programming, and phD is a doctor.. apple/day equals no doctor). Okay, that may not be the best example, but you get the idea right?

If you are needing to create a password for a remote server, I would recommend looking into ssh keys. Used well they can provide better security and less hassle for you.

Anyone else have any password strategies they’d like to share? Please, please don’t say “my favorite pet’s name” or “my birthday and last 4 digits of my phone number”…

Creating SSH Keys

Dan — Wed, 28 May 2008 04:30:12 +0000

If you need to manage multiple remote servers, you’ve probably had the joy of needing to remember numerous passwords. With ssh keys, you can eliminate the need of typing in a password each time you log into a server via ssh. As an added bonus, the key that will be used will be much (much) longer than any password you would sanely type in.

To utilize ssh keys, you will need to generate a private / public key pair on your local machine. To do this, type:

ssh-keygen -t rsa

to generate a RSA encrypted keyset. When you do this, it will ask you where to save it, just hit enter to use the defaults. The next question will be what passphrase you would like to use. This can be an effective way to double up your security. If you set this, you will need both the key that will be generated, as well as this passphrase to log into the remote server. If you are going for a secure setup, this is most likely the way to go.

After you have create your public and private key (both will be generated using the previous command), take a look at your public key by typing

vi ~/.ssh/id_rsa.pub

Copy the entire contents of this file so we can let the server know to authorize this key. Log into your server as you normally would and then:

vi ~/.ssh/authorized_keys

If the file did not exist already, just create it. This is the default place that OpenSSH will look for authorized keys. Now, paste the content of the key into the end of this file and save it.

Viola, that should do it. Try exiting from the server, and then re-logging in. If you used a passphrase in the initial step, enter that now, otherwise, you should be directly logged in as your user on the server.

This can be quite handy for setting up backup cron jobs between servers, or any other scripts which would normally require a password. Now you can keep the passwords out of the shell scripts and just let them do their thing.