Category: Security (Page 3 of 4)

OAuth2 Basic Authentication Header (RFC7649)

February 3, 2020 / ron / 0 Comments

An authorization header on HTTP requests with the following syntax:

Authorization: Basic Base64(FormURLEncode(<USERNAME>):FormURLEncode(<PASSWORD>))

Example

Token	Value
USERNAME	sample
PASSWORD	p5$$word

The actual authorization header would be the following:

Authorization: Basic c2FtcGxlOnA1JTI0JTI0d29yZA==

Related
Basic Authentication (RFC7617)

Basic Authentication (RFC7617)

February 3, 2020 / ron / 0 Comments

An authorization header on HTTP requests with the following syntax:

Authorization: Basic Base64(<USERNAME>:<PASSWORD>)

Example

Token	Value
USERNAME	sample
PASSWORD	p5$$word

The actual authorization header would be the following:

Authorization: Basic c2FtcGxlOnA1JCR3b3Jk

Sign a File with Detached ASCII Signature

December 2, 2019 / ron / 0 Comments

Use the following command to create a detached ASCII signature:

gpg --armor --output <ASC_FILE> --detach-sig <FILE_TO_SIGN>

Verify the file with detached ASCII signature.

Using Detach ASCII Signature to Verify a File

December 2, 2019 / ron / 0 Comments

Import Keys from Keyserver

Run the following command:

gpg --receive-keys <KEY_ID>

Showing the Fingerprints

Run the following command:

gpg --fingerprint <KEY_ID>

Verifying a File with ASCII Key

Download the detach asc <ASC_FILE> file associated to the file.
Download the signed file <SIGNED_FILE> file.
Use the following command for verification:
```
gpg --verify <ASC_FILE> <SIGNED_FILE>
```

Generating PGP Keys with Gpg4win

December 2, 2019 / ron / 0 Comments

Pre-requisite

Gpg4win (i.e from https://www.gpg4win.org/).

Generating Keys

Run the following command:
```
gpg --full-gen-key
```

Type 1 and press enter for the following question:

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection?

Press enter for the following question:

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)

Press enter for the following question:

Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0)

Type y and press enter for the following question:

Key does not expire at all
Is this correct? (y/N)

Fill in the Real name appropriately and press enter.
Fill in the Email address appropriately and press enter.
The Comment is optional but don't forget to press enter.

Type o and press enter for the following question:

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?

Fill-in the passphrase appropriately.

The output will be ending with something like the following:

pub   rsa2048 2019-11-27 [SC]
      8C99E30527B112D1CB6D646FE86A4FE7189AADC9
uid                      Real Name <real_email@email.com>
sub   rsa2048 2019-11-27 [E]

The second line is the PGP key ID. Thus from the output above. The key id is:

8C99E30527B112D1CB6D646FE86A4FE7189AADC9

Exporting Your Private Key

The my-secret-key.pgp file generated by this command can be use for signing your binaries.

Run the following command:

gpg --export-secret-keys <KEY_ID> > my-secret-key.pgp

DO NOT SHARE THIS FILE OR COMMIT TO YOUR REPOSITORY.

Publishing Your Public Key

Run the following command:

gpg --send-key <EMAIL_ADDRESS>

Use the email address you've used from generating the key.

Alternative way of Publishing your Public Key

Generate an ASCII-armored PGP key using the following command:
```
gpg --armor --export <EMAIL_ADDRESS>
```
Use the email address you've used from generating the key.

The preceding command is exporting your public key in ascii format.
Copy and paste the generated public ID to the following address: http://hkps.pool.sks-keyservers.net/#submit
Click the Submit this key to the keyserver! button.

Validating your Published Public Key

You can validate the upload public key by placing your <EMAIL_ADDRESS> as a Search String from the following address: http://hkps.pool.sks-keyservers.net/#extract.

This will only work if you submit your keys using the preceding section.
Click the Do the search! button.

Listing the Entries of a Java Keystore

November 14, 2019 / ron / 0 Comments

Use the following command to list the entries of a Java keystore:

The keytool is normally found in $JAVA_HOME/jre/bin (i.e. the $JAVA_HOME variable is where you’ve installed JDK).

keytool -list -v -keystore <KEYSTORE_FILE> -storepass <KEYSTORE_PASSWORD>

Include the -a <ALIAS> parameter to just display a single certificate.

Token	Description
KEYSTORE_FILE	The target key store file (e.g. cacerts* found in $JAVA_HOME/jre/lib/security)*
KEYSTORE_PASSWORD	The password for accessing the keystore (i.e. the default is changeit)

Importing a Certificate to Java Keystore

November 14, 2019 / ron / 0 Comments

Use the following command in importing a certificate to Java keystore:

The keytool is normally found in $JAVA_HOME/jre/bin (i.e. the $JAVA_HOME variable is where you've installed JDK).

keytool -importcert -alias <ALIAS> -v -keystore <KEYSTORE_FILE> -file <INPUT_FILE> -storepass <KEYSTORE_PASSWORD>

Token	Description
ALIAS	Alias name of the entry to process
KEYSTORE_FILE	The target key store file (e.g. cacerts* found in $JAVA_HOME/jre/lib/security)*
INPUT_FILE	Input file name (i.e. certificate file like cer, crt* or pem)*
KEYSTORE_PASSWORD	The password for accessing the keystore (i.e. the default is changeit)

Schedule Certbot-Auto to Auto Renew Weekly with NGINX

October 10, 2019 / ron / 0 Comments

Create the file in /etc/cron.weekly/certbot-renewal using the following command
```
sudo vi /etc/cron.weekly/certbot-renewal
```

Place in the following in the file and save it:

#!/bin/sh

/usr/sbin/certbot-auto renew --no-bootstrap --no-self-upgrade --post-hook "service nginx restart"

Change the mode of file to 755 using the following command:
```
sudo chmod 755 /etc/cron.weekly/certbot-renewal
```

Installing Let’s Encrypt Certbot-Auto

October 10, 2019 / ron / 0 Comments

Change the directory to /usr/sbin

Download certbot-auto using the following command:

sudo wget https://dl.eff.org/certbot-auto -O /usr/sbin/certbot-auto

Change the mode of certbot-auto to 755 using the following command:
```
sudo chmod 755 /usb/sbin/certbot-auto
```

Unban an IP Banned by Fail2Ban

October 10, 2019 / ron / 0 Comments

Use the following command:

sudo fail2ban-client set <JAIL_NAME> unbanip <IP_ADDRESS>

Where:

JAIL_NAME

The name of the jail.

Use the following command to find-out what jail names you have:

sudo fail2ban-client status

IP_ADDRESS

The IP address that was banned.

Category: Security (Page 3 of 4)

OAuth2 Basic Authentication Header (RFC7649)

Basic Authentication (RFC7617)

Sign a File with Detached ASCII Signature

Using Detach ASCII Signature to Verify a File

Import Keys from Keyserver

Showing the Fingerprints

Verifying a File with ASCII Key

Generating PGP Keys with Gpg4win

Pre-requisite

Generating Keys

Exporting Your Private Key

Publishing Your Public Key

Alternative way of Publishing your Public Key

Validating your Published Public Key

Listing the Entries of a Java Keystore

Importing a Certificate to Java Keystore

Schedule Certbot-Auto to Auto Renew Weekly with NGINX

Installing Let’s Encrypt Certbot-Auto

Unban an IP Banned by Fail2Ban

Recent Posts

Recent Comments

Archives

Categories

Meta