LINUX Unplugged - Episodes Tagged with “Openssh”

570: RegreSSHion Strikes

Jupiter Broadcasting — Sun, 07 Jul 2024 17:00:00 -0700

We dig into the RegreSSHion bug, debate it's real threat and explore clever tools to build a tasty fried onion around your system.

Sponsored By:

Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!
1Password Extended Access Management: Secure every sign-in for every app on every device.
Core Contributor Membership: Take $1 a month of your membership for a lifetime! Promo Code: summer

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Spokane Meetup - No-Li Brewhouse · JB Events (test deployment)
Plasma/Krunner Docs — Brent's tip: 'https://search.nixos.org/options?query=\{@}' (the '\{@}' is the magic sauce)
autossh — Automatically restart SSH sessions and tunnels
autossh on GitHub
Spokane Meetup — No-Li Brewhouse, Sat, Jul 13, 2024, 4:00 PM
RegreSSHion — Remote Code Execution Vulnerability In OpenSSH Server
regreSSHion — Remote Unauthenticated Code Execution Vulnerability in OpenSSH server.
NixOS Security advisory: OpenSSH CVE-2024-6387 “regreSSHion” – update your servers ASAP
Nasty regreSSHion bug affects around 700K Linux systems
Qualys CVE-2024-6387 Write-up
Letmein: Authenticating port knocker - Written in Rust — Letmein is a simple port knocker with a simple and secure authentication mechanism. It can be used to harden against pre-authentication attacks on services like SSH, VPN, IMAP and many more.
fwknop: Single Packet Authorization > Port Knocking — fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Jeff links: How to run non-nix executables?
pick: stu — TUI (Terminal/Text UI) application for AWS S3

556: The xz Backdoor Exposed 🚨

Jupiter Broadcasting — Sun, 31 Mar 2024 18:00:00 -0700

We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
oss-security mailing list — Backdoor in upstream xz/liblzma leading to ssh server compromise.
Fedora Announcement
Debian Announcement
Ubuntu Announcement
Kali Linux Announcement
Arch Linux Announcement
Gentoo Announcement
openSUSE Tumbleweeed Announcement
NixOS Unstable Discussion
Why does it take two weeks for NixOS to replace xz?
Andres Freund on Mastodon — I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc....
rwmj on Hacker News — Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of its "great new features"
A Microcosm of the interactions in Open Source projects — Make no mistake. This is the way it works. It needs to change.
Devuan GNU/Linux on X — Devuan is not affected by the latest vulnerability caused by systemd.
systemd PR: Dynamically load compression libraries
Matteo Croce on X — I'm the author of such PR. While I absolutely didn't know that libxz had a backdoor, I really think that libraries should be loaded on-demand when rarely used, hence my change :)
Ryan C. Gordon on X — This is probably how the xz thing happened, right?
Jan Wildeboer on the Fediverse — Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO.
Unplugged Core Membership
TXLF is coming up! — April 12 - 13 in Austin, Texas.
LFNW coming up! — April 26 - 28
Mobile Game Ads Are Boosting Podcast Follower Counts — Wondery, iHeart and Lemonada Media are all using a non-public product from MowPod - which gives extra lives and game credits to gamers if they follow shows on Apple Podcasts from game apps.
MowPod's podcast promotion tools: tales from the bar
fortydeux's NixOS Configs
Prism Launcher — An Open Source Minecraft launcher with the ability to manage multiple instances, accounts and mods.
World Backup Day — March 31st — One small accident or failure could destroy all the important stuff you care about.
Updating Our Fiddly Bits | LINUX Unplugged 494

442: Liberty Leaks and Lies

Jupiter Broadcasting — Sun, 23 Jan 2022 18:15:00 -0800

SUSE had an awkward week; we breakdown the very mixed launch of SUSE Liberty Linux.

Plus, we've cracked what's driving Linux Distribution adoption these days.

Sponsored By:

Linode Cloud Hosting: A special offer for all Linux Unplugged Podcast listeners and new Linode customers, visit linode.com/unplugged, and receive $100 towards your new account.

Support LINUX Unplugged

Links:

Pictures of Brent's Server Cabinet Built — Some pics of the sweet server cabinet @brentgervais built this last weekend at the @jupitersignal studio.
Jupiter Broadcasting Meetup
Flathub to verify first-party apps and allow developers to collect monies — Flathub is going to gain a way to process and verify apps from first-party teams. As in, developers who directly publish their app and manage the Flatpak package process for Flathub.
SUSE Liberty Linux Announced For Mixed Linux Environments — SUSE Liberty Linux is a new technology and support offering that provides customers a unified support experience for managing their heterogeneous IT environments.
SUSE announces something for those who miss the old CentOS: Liberty Linux — SUSE Liberty Linux is a new technology and support offering that provides customers a unified support experience for managing their heterogeneous IT environments.
Consistent-Lab-5595 comments on Suse Liberty Linux announcement - Is this a RHEL or CentOS clone ?
New Features in Linux Mint 20.3 ‘Una’ Cinnamon Edition — Linux Mint 20.3 is a long term support release which will be supported until 2025.
Edge ISO available for Linux Mint 20.3 — This image is made for people whose hardware is too new to boot the 5.4 LTS kernel included in Linux Mint 20.3. It ships with kernel 5.13.0-25 instead.
mainline: A continuation of the free version of ukuu. — A tool for installing the latest Linux kernels on Ubuntu-based distributions.
All Roads Lead to Arch: The Evolution of Linux Distros Used for Gaming Over Time — Ubuntu used to be a juggernaut, a staple in the world of Linux Gaming. Ubuntu was the default go-to distro for many users for probably a decade. It’s still an important distro at almost 20% share in our graph, but it’s not the first one anymore.
Linux Desktop Gaming Product Manager
Canonical hiring a Desktop Gaming Product Manager for Ubuntu Linux
Fountain podcast app
Pick: ssh-tools — Making SSH more convenient.

421: Server Savior Squad

Jupiter Broadcasting — Tue, 31 Aug 2021 16:30:00 -0700

A surprise server outage at the studio requires we jump into action with a few last-minute solutions and deploy one of our favorite open-source tools.

Plus some community news, handy picks, emails, and more. It's a special edition of the Unplugged show.

Special Guest: Brent Gervais.

Sponsored By:

Support LINUX Unplugged

Links:

SCO v. IBM settlement deal is done — Documents filed in the Bankruptcy Court for the District of Delaware last week suggest a settlement payment of just $14.25 million will see the matter closed.
ChrisLAS on Twitter — "My spot to record in Arizona today."
Ventoy Adds a Web GUI — Ventoy now ships with a web-based graphical user interface since version 1.0.36.
Ventoy — Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHD(x)/EFI files.
“Apps For GNOME” Launches To Highlight GNOME Apps — There hasn't been a comprehensive, modern, user-friendly web-site for outlining all of the GNOME apps and inviting participation until now with this Apps for GNOME.
Apps for GNOME — Discover the best Apps for GNOME.
nebula — A scalable overlay networking tool with a focus on performance, simplicity and security.
TheOrangeOne's Blog — Nebula mesh network - an introduction.
Jon the Nice Guy's Blog — Nebula Offline Certificate Management with a Raspberry Pi using Bash.
Nebula-Cert-Maker — A script that allows you to create new host certificates and keys.
Gardiner Bryant on YouTube — I wasn't prepared for how much growth System76 has experienced in the year and a half since my last visit.
Stickers | Jupiter Broadcasting Garage Sale
Pick: psst — Fast and multi-platform Spotify client with native GUI.

342: Shrimps have SSHells

Jupiter Broadcasting — Tue, 25 Feb 2020 19:00:00 -0800

A radical new way to do SSH authentication, special guest Jeremy Stott joins us to discuss Zero Trust SSH.

Plus community news, a concerning issue for makers, an Arch server follow up, and more.

Special Guests: Alex Kretzschmar, Brent Gervais, Jeremy Stott, Martin Wimpress, and Neal Gompa.

Support LINUX Unplugged

Links:

330: 'Tis the SSHession

Jupiter Broadcasting — Tue, 03 Dec 2019 18:15:00 -0800

Give the gift of remote support with our neat SSH trick. Also, Cassidy from elementary OS joins us to discuss what's great about their new release.

Plus we'll share some gadget gift ideas, and what we're building for the holidays.

Special Guests: Alex Kretzschmar and Cassidy James Blaede.

Support LINUX Unplugged

Links: