Tag Archives: infosec

A simple bash gpg “password safe”

Posted on by

This is definitely not military quality – but if you need a simple way to manage a GPG-encrypted file containing info you want to protect this works pretty well for me. I use this to manage a set of passwords on a trusted machine that I can ssh to.

It assumes you’re using a bash-like shell and have a trusted private key available in the account you’re running it on.


#!/bin/bash

KEYS=""

if [ ! -e "$HOME/private" ]
then
    mkdir -m 700 "$HOME/private"
    umask 77 "$HOME/private/"
fi

# Always delete the unencrypted file at the end of the session. We DO NOT want this hanging around.
trap "rm -f \"$HOME/private/${USER}_private_store.txt\"; chmod 600 \"$HOME/private/${USER}_private_store.txt\"*; exit" INT TERM EXIT

touch "$HOME/private/${USER}_private_store.txt"
chmod 600 "$HOME/private/${USER}_private_store.txt"

gpg --decrypt "$HOME/private/${USER}_private_store.txt.asc" > "$HOME/private/${USER}_private_store.txt"
vim "$HOME/private/${USER}_private_store.txt"

md5sum  "$HOME/private/${USER}_private_store.txt.md5sum.new"

if [ -e "$HOME/private/${USER}_private_store.txt.md5sum" ]
then
    if [ "`cmp "$HOME/private/${USER}_private_store.txt.md5sum.new" "$HOME/private/${USER}_private_store.txt.md5sum"`" == "" ]
    then
        clear
        rm -f "$HOME/private/${USER}_private_store.txt.md5sum.new"
        echo 'No changes, not re-encrypting'
        exit
    fi
fi

mv "$HOME/private/${USER}_private_store.txt.md5sum.new" "$HOME/private/${USER}_private_store.txt.md5sum"

echo 'File has changed. Re-encrypting. . .'
gpg -a --encrypt -r $KEYS "$HOME/private/${USER}_private_store.txt"
clear

First time it runs it’ll create a private directory, start vim, and encrypt the text you enter into vim. On subsequent runs it’ll prompt you for your private key passphrase and repeat the cycle. It won’t re-encrypt if there haven’t been any changes.

I’m betting wordpress messes up the code, so here’s the text file: edit_password_safe.sh.

“Secure” http connections over untrusted networks

Posted on by

Oh, ssh. How I love thee.

So I wanted to log in to wordpress blog with a login page NOT behind an HTTPS connection from an “insecure” network – in this case, it was the MBTA’s commuter rail wifi.

SSH supports SOCKS proxy connections and makes this STUPIDLY simple:

ssh -C -D 8000 name-of-your-proxy-ssh-server.com

“-C” turns on compression, “-D 8000” makes the SOCKS proxy connection on localhost’s port 8000.

Then you need to set your local firefox to use “localhost”, port 8000 as a SOCKS proxy. And bang! You’re proxying securely over an insecure network.

Yeah, yeah, the best solution would be to have the target wordpress use SSL, but not every blog can have a dedicated IP.

mod_passenger error page includes external stylesheet.

Posted on by

No sir, I don’t like it. Not at all.

The default mod_passenger “this app wouldn’t start” page includes an external CSS file:

http://www.modrails.com/error_pages/1.0/error_page.css

which is odd, considering there’s a bunch of inline CSS. I guess it’s to include the images. . . but it also amounts to disclosing something unintentionally. Yuck.