Apache 2.4.6 + mod_wsgi + Python 3.6 + Django 2.2.6 on CentOS 7

by

<p class="wp-block-paragraph">There are many how-to’s on installing Apache with mod_wsgi, python 3.x and Django, but nothing worked for me, looks like mod_wsgi libraries installed by default with yum use Python 2.x, and I keep getting the following error message:</p> <p class="wp-block-paragraph">Installing Apache and devel package</p> <p class="wp-block-paragraph">So, I had to compile <strong>mod_wsgi</strong> library from sources, … Read more

Nagios environment variables

by

<p class="wp-block-paragraph">As soon as Nagios is managed by systemd, you have to change the passing environment variables from /etc/sysconfig/nagios to systemd</p> <p class="wp-block-paragraph">Edit the file</p> <p class="wp-block-paragraph">Add <strong>Environment=””</strong> or <strong>EnvironmentFile=””</strong> to [<strong>service</strong>] section</p> <p class="wp-block-paragraph">Restart systemd and nagios</p> <p class="wp-block-paragraph">Check the process environment</p> <p class="wp-block-paragraph">That will pass all variables into Nagios daemon</p> <blockquote class="wp-block-quote is-layout-flow … Read more

Happy Independence Day!

by

<p class="has-medium-font-size wp-block-paragraph">Wishing everybody a wonderful time on this special day in American history. Happy Fourth of July! <strong>God bless America!</strong></p> Wishing everybody a wonderful time on this special day in American history. Happy Fourth of July! God bless America!

Open-Xchange IMAP: STARTTLS failure

by

<p class="wp-block-paragraph">During some experiments with open-sources code, found an issue with STARTTLS on the latest open-xchange appsuite 7.10.1-Rev9</p> <p class="wp-block-paragraph">Something like this:</p> <p class="wp-block-paragraph">Looks like empty vars for SSL protocol and SSL ciphersuites are not working properly, if specify them everything works just fine.</p> <p class="wp-block-paragraph">Hope that helps, thanks!</p> During some experiments with open-sources code, … Read more

Paperkey: How to backup your GnuPG keys on paper

by

To create a backup of your GPG Key, you may use one of the following commands paperkey –secret-key my-secret-key.gpg –output to-be-printed.txt Or using this if you have exported (not armored) GPG Key in file: paperkey –secret-key my-secret-key.gpg –output to-be-printed.txt To restore it you will need a paperkey data in file and you public key. The … Read more

Reset your YubiKey to factory defaults using gpg-connect-agent

by

Reset your YubiKey to factory defaults using gpg-connect-agent yubikey fips 1

I’m using MacOS for my work, so here is how to reset your YubiKey using gpg-connect-agent. This is not a mine solution, I found this a while ago on github, can’t remember who’s is author, so I saved to my notes, just wanted to share it with you.

# Install gnupg if it's not installed yet
VKAFEDZH-M-2R3C:~ vkafedzh$ brew install gnupg

Insert your YubiKey to USB and run the following command:

gpg-connect-agent <<EOF
/hex
scd serialno
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 e6 00 00
scd apdu 00 44 00 00
/echo Yubikey has been successfully reset.
/echo The factory default PINs are 123456 (user) and 12345678 (admin).
EOF

Here is what I have:

Read more

Using YubiKey with GPG

by

Using Yubikey with GPG encryption

Let me try to show my experience in using Yubikey as a Smartcard for storing signing and GPG encryption keys. There are a lot of information in the internet about that, but that my first try in configuring yubikey for such purposes.

Firstly we need to install necessary packages on our mac by doing the following command, I’m using brew:

$ brew install gnupg yubikey-personalization

This will allow us to program our Yubikey.

The next step is we need to create a new keys for further usage.

Generate a key

Let’s do a temporary directory:

export GNUPGHOME=$(mktemp -d)

And create a GPG configuration:

$ cat << EOF > $GNUPGHOME/gpg.conf
use-agent
personal-cipher-preferences AES256 AES192 AES CAST5
personal-digest-preferences SHA512 SHA384 SHA256 SHA224
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
s2k-digest-algo SHA512
s2k-cipher-algo AES256
charset utf-8
fixed-list-mode
no-comments
no-emit-version
keyid-format 0xlong
list-options show-uid-validity
verify-options show-uid-validity
with-fingerprint
EOF

Generate a master key

During creation a new master key, we will need to choose RSA (sign only) key and I would go with 4096 bits. And you’ll be asked to enter a passphrase, try to enter something unique and strong 🙂

VKAFEDZH-M-2R3C:~ val$ gpg --full-generate-key
gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: keybox '/var/folders/yy/bp5hkvxs1px1_f1q_10kzgk40000gn/T/tmp.SRHTb4gb/pubring.kbx' created
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Valerii
Email address: [email protected]
Comment:
You selected this USER-ID:
    "Valerii <[email protected]>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
public and secret key created and signed.

Note that this key cannot be used for encryption.  You may want to use
the command "--edit-key" to generate a subkey for this purpose.
pub   rsa4096/0xA2B71234247579BE 2018-01-28 [SC]
      Key fingerprint = 1A28 A73B A841 4311 FA0A BA28 A4A7 1383 1171 7A99
uid                              Valerii <[email protected]>

Export a new key

export KEYID=0xA2B71234247579BE

Create subkeys

VKAFEDZH-M-2R3C:~ val$ gpg --expert --edit-key $KEYID
gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
sec  rsa4096/0xA2B71234247579BE
     created: 2018-01-28  expires: never       usage: SC
     trust: ultimate      validity: ultimate
[ultimate] (1). Valerii <[email protected]>

During a creating a new subkeys enter the passphrase you entered during making a master key. In the following example I selected to generate a key with expiration in 1 year.

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon Jan 28 14:13:38 2019 EST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec  rsa4096/0xA1289348BA3879AE
     created: 2018-01-28  expires: never       usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa4096/0xA1CDBEFBA21203A4
     created: 2018-01-28  expires: 2019-01-28  usage: S
[ultimate] (1). Valerii <[email protected]>

Next, let’s create n encryption key by selecting RSA (encrypt only) – number 6

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 6
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon Jan 28 14:16:29 2019 EST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec  rsa4096/0xA1289348BA3879AE
     created: 2018-01-28  expires: never       usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa4096/0xA1CDBEFBA21203A4
     created: 2018-01-28  expires: 2019-01-28  usage: S
ssb  rsa4096/0x181FFBA2120AA342
     created: 2018-01-28  expires: 2019-01-28  usage: E
[ultimate] (1). Valerii <[email protected]>

I selected to create 4096 bit RSA encrypt only key which is going to be valid for 365 days only.

And let’s create an authentification key now.

read more…

Read more

Icinga2: LiveStatus Activation/Installation

by

<p>Hey all,</p> <p>Here is a quick note how to install and activate MK Livestatus (Check_MK) API for your Icinga2 installation.</p> <p>More info about livestatus on the official website: <a href="https://mathias-kettner.de/checkmk_livestatus.html">https://mathias-kettner.de/checkmk_livestatus.html</a></p> <p>So, check if it’s already activated:</p> <pre class="EnlighterJSRAW" data-enlighter-theme="minimal"># icinga2 feature list Disabled features: compatlog debuglog gelf graphite influxdb livestatus opentsdb perfdata statusdata syslog Enabled features: … Read more

Icinga2 Director: How to import a server IP from local file

by

Hey all, #shortstory Today I had a pretty interesting task with Icinga2 and Director. The issue was with accessibility to DNS server which was installed in AWS without any public access, so basically it was used only for internal requests. To make story short, the task was to get IP address from local file, hostname … Read more