Tagged: ssh
13 posts · browse all tags
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
SSH Deep Dive Part 1: Keys, Clients, and Getting Connected on Windows, macOS, and Linux
Why key-based auth beats a password, generating and installing a key, and the real differences between the OpenSSH client on Windows, macOS, and Linux. Part 1 of 3, followed by the config file/agent/multiplexing and -L/-R/-D/-J.
-
SSH Deep Dive Part 2: The Config File, Agent Forwarding, and Multiplexing
Turning `ssh -i ~/.ssh/id_ed25519 [email protected]` into `ssh myhost`: the ~/.ssh/config file, per-host settings, ssh-agent so a passphrase isn't typed on every connection, and connection multiplexing to skip the handshake entirely.
-
SSH Deep Dive Part 3: Tunnels and Jump Hosts, -L, -R, -D, and -J
Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.
-
Sn1per Deep Dive Part 7: Verified With Root
Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.
-
Netmiko in Practice: From a Show-Command Script to a Repeatable Audit Tool
A working network engineer's guide to Netmiko — starting from a small repo of mine that runs show commands across a JSON inventory, and extending it into something you can use as a real audit tool with structured output, concurrency, secure credentials, and a sane dry-run for config changes.
-
SSH Hardening Beyond the Basics: Certificate Authorities, Bastion Patterns, and Session Auditing
A production-grade SSH setup that goes beyond disabling password auth — running your own SSH CA with short-lived user and host certificates, ProxyJump bastions, ForceCommand restrictions, and recording sessions with tlog and auditd.