ubuntu

I was at the Ubuntu Intrepid Release Party last weekend and I must say I enjoyed it!

X-Tend was very noticeable @ the release party and we gave 3 presentations!

Gert talked about Ubuntu & Games

Guy talked about Ubuntu & Safety

And I Talked about Ubuntu Desktop Tweaking.

For those who would like it, you can download my presentation here.

EDIT: It seems we have been 'articled':

http://www.hasseltlokaal.be/Item/tabid/55/seqAxNewsItem/5428/Default.aspx

I must remember to blog about what I will be attending BEFORE the actual attending happens... :-)

As I was reading my rss feeds I discovered one time password logins via ssh. I read it in a post on Philip's Blog. I found it interesting so decided to try this on a virtual machine as a test. Although it wasn't as simple as Philip's post, it was rather simple. But to help out you guys trying to configure and use it here are my findings:

As this is a rather long post I'm going to use a break for this one time (sorry rssfeed readers! I forgot but I noticed my feed feeds entire blog posts, and not just the part before the break. Good!).

First, I installed opie-server, this is as simple as:

# apt-get install opie-server

Then, to make sure when you login through SSH, the pam_opie module is used, I had to edit /etc/pam.d/sshd as follows:

[...]

# Standard Un*x authentication.
#@include common-auth
auth    sufficient      pam_opie.so
auth    sufficient      pam_unix.so nullok_secure
auth    require         pam_deny.so

[...]

If you do it this way you will still be able to login with your normal password when te OTP(One Time Password) login fails. This may be handy when you have no possibility of calculating the appropriate response to the OTP challenge. If you do not like this behaviour and you want you or your users to be able to authenticate with OTP only you can comment out the pam_unix.so line:

[...]

#auth    sufficient      pam_unix.so nullok_secure

[...]

As after this it was still not working I looked into the /etc/ssh/sshd_config file and found that there was one option that needed to be enabled to make sure that the ssh server knows you will be using challenge response authentication. Edit /etc/ssh/sshd_config:

[...]

ChallengeResponseAuthentication yes

[...]

As a final step restart your ssh server:

/etc/init.d/ssh restart

As of here we can follow the simple step that Philip gave us in his blog post

:

$ opiepasswd -c
Adding bert:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:

ID bert OTP key is 499 mi7400
RIDE LUSH VIE YE BARD LOSE

When issuing opiepasswd -c you will be asked to enter a secret pass phrase, you will have to be able to remember this, but it should be very secret(not like your birthday or something like that).

When we look at the following output:

ID bert OTP key is 499 mi7400
RIDE LUSH VIE YE BARD LOSE

• 'bert' is your unix username, and your OTP ID
• '499' is the sequence (this will count downwards every time a password has been used
  An already used password will be discarded and not usable anymore, hence OTP(One TIme Password) :-)
• 'mi7400' is the challenge string
• 'RIDE LUSH VIE YE BARD LOSE' is the password for this sequence (499) !! spaces included

Now, when ssh'ing to the system, and you have no private key file (because this will still work) you will be prompted the following:

$ ssh bert@minerva
otp-md5 498 mi7400 ext, Response:

On a system where opie-client is installed you can calculate the appropriate response:

$ opiekey 498 mi7400
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
WACK WAIT ALMA HERO WAR KIN

And use this password 'WACK WAIT ALMA HERO WAR KIN' to log in.

Now offcourse the thing about this is that when you got your favorite machine with you (e.g. laptop) you do have your private keys. So there's no need for OTP. And when you need it (e.g. a public computer) you are not always (read: seldom) privileged to install an opie-client to calculate your response. Offcourse you can find online calculators but do you trust them with your passphrase?

Luckely there's a nice solution for this problem:

http://code.google.com/p/j2me-otp/

Thanks to "Marcin Gryszkalis" who posted this comment on Philip's blog post.

This is a java application, so it should work on almost any modern cellphone. I tried this on my Nokia E61i and it works like a charm. (And offcourse, you do always have your cellphone with you!).

A screenshot of the calculator in action:

The only thing I could say about this application is that they chose to call the passphrase "Password" which might be a bit confusing.

So, if you are a bit paranoid, or you just require a very secure authentication mechanism, this works like a charm, is not too difficult to setup and provides you with a handy mobile solution!

I'm really getting tired of all these ubuntu updates. Got to update almost every day... What a hassle, should maybe switch to debian? But then again, when switching to debian I probably wouldn't have the nice latest versions of some nice tools like:

• gnome-do
• awn
• ...

At least not without updating to testing, and when updating to testing I probably would have the hassle of having updates every day. Guess I will have to live with it :-)

After some time using liferea I switched to google reader for a number of reasons including:

Google Reader looked nice, it had a nice user experience, it's accessible from anywhere and not just from one workspace, ...

A while ago I learned from a collegue (gert) that there was a nice package in ubuntu called 'prism' with some other packages like:

• prism-google-reader
• prism-google-calendar
• prism-google-analytics
• ...

Prism is more or less a fully capable web browser but without all the fancy stuff, no plugins, no addons, no bookmarks, no nothing. This makes prism really fast and it is nicely integrated on the desktop as you can see in the next screenshot (though the fact I like the most is that it's far more faster reading posts then google reader in firefox).

Prism is a mozilla project (just like firefox, thunderbird and all the other mozilla projects) and you can find more info at the mozilla site.