Security / Crypto

Question 1

OpenSSL: Generating a private RSA key, size 2048

Answer 1

Generating a private RSA key

openssl genrsa -out key.pem 2048

Question 2

OpenSSL: Generating a private EC key

Answer 2

openssl ecparam -name prime256v1 -genkey -noout -out key.pem

Question 3

my file encryption

Answer 3

openssl aes-256-cbc -pbkdf2 -salt -a -e -in .zshrc -out zshrc_encrypted

Question 4

my file decryption

Answer 4

openssl aes-256-cbc -pbkdf2 -salt -a -d -in zshrc_encrypted -out zshrc_1

Question 5

copy file to remote via ssh

Answer 5

rsync -aPv -e “ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/gitlab_brainloop” ~/Documents/tmp.csv gludwig@10.254.40.16:/home/gludwig/tmp1.csv

Question 6

ssh: Preferred Authentications

Answer 6

~/.ssh/config -> PreferredAuthentications=publickey

ssh -o “PreferredAuthentications=password” username@example.com

Question 7

ssh: detect “Failed SSH login Attempts”

using ‘secure log’ files

Answer 7

egrep “Failed|Failure” /var/log/secure

Question 8

ssh: Disable DNS Lookup On Remote Machine

Answer 8

/etc/ssh/sshd_config

UseDNS=no

Question 9

ssh: how to handle “Too many authentication failures” on cli

Answer 9

ssh -i home_fedora -o IdentitiesOnly=yes gludwig@192.168.188.30

Question 10

add new user - secured it with ssh key - disable password

Answer 10

adduser -c ‘comment’ -d /home/username -G wheel –no-user-group –shell /bin/bash username

ssh-keygen -b 4096 -t ed25519 -f keyname
ssh-keygen -l keyname

cat .ssh/id_rsa.pub | ssh sheena@192.168.0.11 ‘cat&raquo_space; .ssh/authorized_keys’
or
ssh sheena@192.168.0.11 “chmod 700 .ssh; chmod 640 .ssh/authorized_keys”
cat gcp-centos8.pub | ssh -i gcp-centos8 h19900401_gmail_com@34.76.188.251 “sudo mkdir /home/gludwig/.ssh && sudo touch /home/gludwig/.ssh/authorized_keys && sudo chmod -R go= /home/gludwig/.ssh && sudo cat&raquo_space; /home/gludwig/.ssh/authorized_keys && sudo chown gludwig:users /home/gludwig/.ssh/authorized_keys”
or
ssh-copy-id -i ~/.ssh/mykey user@host

sudo vi /etc/ssh/sshd_config
...
PasswordAuthentication no
...
sudo systemctl restart sshd

vi /etc/ssh/sshd_config
PermitRootLogin no
OR
PermitRootLogin without-password
...
systemctl restart sshd

Question 11

check IP and DNS

Answer 11

https://ipleak.net/

Question 12

OpenSSL: Extract the public key from the key pair, which can be used in a certificate

Answer 12

openssl rsa -in key.pem -outform PEM -pubout -out public.pem

Question 13

OpenSSL: get length of rsa key

Answer 13

openssl rsa -in aws-secret.priv -text -noout | grep Private

Question 14

OpenSSL: extract the public key from private EC key

Answer 14

openssl ec -in key.pem -pubout -out public.pem

Question 15

ssh: detect “Failed SSH login Attempts”

using ‘auth log’ file

Answer 15

grep “Failed password” /var/log/auth.log | awk ‘{print $11}’ | uniq -c | sort -nr

Question 16

ssh: detect “Failed SSH login Attempts”

using system journal

Answer 16

journalctl _SYSTEMD_UNIT=sshd.service | egrep “Failed|Failure”

Question 17

openssl:

generate random string to be used e.g. as key

Answer 17

openssl rand -base64 20

Question 18

openssl:

create a certificate signing request

Answer 18

openssl req -new -key admin.key -subj “/CN=admin/O=system:masters” -out admin.csr

Question 19

openssl:

Self sign a csr using its own private key (e.g. creating a CA cert) that is valid for 1000 days

Answer 19

openssl x509 -req -in ca.csr -signkey ca.key -CAcreateserial -out ca.crt -days 1000

Question 20

openssl:

Sign certificate for admin user using CA servers private key that is valid for 1000 days

Answer 20

openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 1000

Question 21

openssl:

create a certificate for “gludwig.pem” from “my.key” in one go that is valid for 1000 days

Answer 21

openssl req -new -key my.key -out gludwig.pem -x509 -days 1000

Question 22

openssl:
create a private key and a certificate in one statement:
- RSA 4096
- certificate with SHA 256
- no password
- 356 days valid

Answer 22

openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out MyCertificate.crt -keyout MyKey.key