Avoiding SSH host key verification failures

 Coping with Computers  No Responses »
Nov 302012
 

While working on a deployment process that automatically updated an ElasticIP to point to a new instance, I got to see a lot of these:

Offending key in /Users/lhn/.ssh/known_hosts:45
RSA host key for xxx.yyy.zzz has changed and you have requested strict checking.
Host key verification failed.

Here is a sed one-liner to delete offending key (on line 45 in this case) from SSH’s known_hosts file.  This is a reasonable thing to do when you know why the host key has changed and don’t expect it to do so very often.

sed -i -e '45d' ~/.ssh/known_hosts

-i is for in-place editing and -e provides the expression, which is to delete line 45.

However, sometimes you expect the host key to change frequently and a better approach to not check or store the host key in the first place. That can be achieved as follows (kudos Peter Leung)

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@some.host

This tells SSH to use always-empty /dev/null as its place to record host keys and to not complain when connecting to host with an unknown key. Thus no host keys are stored or checked.

At the risk of stating the obvious, this does of course side-step SSH’s ability to protect you from man-in-the-middle attacks.

 Posted by at 8:55 pm

Thunderbird mailboxes growing without bounds

 Coping with Computers  No Responses »
Oct 252012
 

The other day I got a low disk space warning because my Thunderbird Inbox had grown to over 100 GB. It turned out my Inbox, Trash, and Sent mailbox folders were all impacted by some bug in which Thunderbird would keep fetching the same messages again and again from the server (IMAP) and appending them to the mailbox file. Compacting the mailbox would recover the disk space, but the mailboxes would start growing again shortly thereafter.

The magic incantation to resolve the problem was some quick succession of compacting the mailbox (right-click -> Compact) and repairing it (right-click -> Properties... -> Repair Folder).  I did have Preferences -> Advanced -> Network & Disk Space -> Compact all folders when it will save over 1 MB in total set, but it wasn’t kicking in.

Upload .m3u playlist to Google Music

 Coping with Computers  1 Response »
Oct 112012
 

Google Music Manager uploads are based on looking for music files in a particular directory. This isn’t helpful if you have a large directory structure of music and want to upload a subset of it. In my case, I want to use Banshee’s smart playlist feature to select songs to upload. Fortunately Banshee has a .m3u playlist export, but this is only half the battle. The other half is to use symlinks to fool Google Music Manager into thinking the songs in the playlist are in its directory.

The following shell command does the trick. It takes input lines in the .m3u of the form <path>/<artist>/<album>/<song> (e.g. ../../../mnt/onion/media/Music/Banshee/Wir Sind Helden/Soundso/01. (Ode) An Die Arbeit.mp3) and makes symlinks of the form <artist>_<album>_<song>.

cat ~/my_playlist.m3u | ruby -ne 'IO.popen(["ln", "-s", "#{$&}", "./#{$2[0..50]}_#{$3[0..50]}_#{$4[0..50]}.#{$5}"]) if $_.strip =~ /^([^#].*)\/([^\/]*)\/([^\/]*)\/([^\/]*)\.([^.\/]*)$/'

For each line ($_) that matches the pattern (not starting with #, having at least the expected number of slashes), execute: ln -s <input line ($&)> <composed filename> . The [0..50] ranges keep filename length manageable.

Thunderbird still displays expunged IMAP messages

 Coping with Computers  12 Responses »
Feb 142012
 

There is lots to be said about the intricacies of IMAP delete flags vs. actual expunging of deleted messages and the confusion caused when something is merely flagged for deletion and the user expected it to be really gone. This post is not about that. Everyone agrees that once a message is expunged, it definitely should be gone. But sometimes expunged messages still display in Thunderbird!

I often observe this:

  1. Delete message on the way to work using K-9 on my phone.
  2. Arrive at work and message is gone from my Inbox in Mail.app
  3. Come home, download new mail in Thunderbird and see an Inbox full of undead messages.

No amount of re-expunging and re-fetching mail helps. Grepping through the server-side Maildir shows the messages really are gone from the folders in which Thunderbird is still showing them.

It turns out the reason they are still displaying in Thunderbird is mundane client-side index corruption. To clean things up:

  1. Right-click on mailbox
  2. Choose Properties...
  3. Click Repair Folder
  4. Rejoice at tidy mailbox

Fixing predicted runtime on APC UPS after replacing battery

 Coping with Computers  No Responses »
Nov 272011
 

The battery in my APC Back-UPS BR 800 was worn out after years of service, so I bought a replacement from APC.com. However, apcupsd still reported zero runtime and erratic charge and load percentages. I did some manual recalibration attempts (charge fully, discharge completely using constant load). This got my estimated runtime from zero up to a few seconds, but the UPS was still not useful. A couple seconds of power outage would lead to bogus critically low battery readings and trigger automated shutdown. (Despite the fact that it took me about half an hour to complete the run-down under a similar load.)

This evening I was preparing for another recalibration attempt by looking for a way to disable the beeping when power is disconnected. It turns out apctest can disable the alarm. In the process, I noticed apctest can also read and write the battery date. On a whim, I updated the date. And, magic: Merely changing the battery date fixed the reported runtime, charge, and load percentages!

Changing the battery date back to the original value did not bring the bogus readings back. Presumably the behavior is based on dead-reckoning of time elapsed since last battery change rather than any knowledge of what the current date actually is.

A Fruitless Search for a Password Bookmarklet

 Coping with Computers  2 Responses »
Jun 152011
 

Using a bookmarklet to store passwords is appealingly simple. Alas, after doing some digging, I couldn’t find any viable options.

The first concern I came across is that it is important to use a hash algorithm that’s slow (e.g. bcrypt or scrypt). Otherwise it’s too easy to brute-force the master password based on a site password. Suppose a site you visit stores your password in plaintext and gets hacked. That breach then compromises your master password, even though only your site-specific password was revealed.

I couldn’t find a JavaScript implementation of scrypt, but I found a JavaScript bcrypt implementation. Better yet, I found a derivative that tidies up the first one, removing dependencies on e.g. ClipperZ, and wraps it in a simple bookmarklet. SuperGenPass provides a much more user-friendly bookmarklet, so I started gearing up to replace it’s MD5 hashing with bcrypt.

But, alas, SuperGenPass (and any other simple bookmarklet) is not secure in the face of a malicious website that contains JavaScript designed to sniff entry of the master password into the bookmarklet. PwdHash is a browser extension based approach from the Stanford Security Lab designed to combat the weaknesses of the bookmarklet based approach. Their paper, Stronger Password Authentication Using Browser Extensions, is interesting reading and explains a variety of ways to compromise a bookmarklet based approach. PwdHash has already spawned a number of ports to other browsers and mobile devices, but alas they’re all based on prototype code that uses the undesirably fast HMAC-MD5 as the hashing algorithm (even though the paper points out PwdHash is a good candidate for a better hashing algorithm).

I was not able to find any PwdHash derivative that used bcrypt. I did find a simple command-line tool based on scrypt, but that’s not great if you don’t have easy access to your own computer.

Solutions like PassPack offer the potential to solve these problems (extension rather than bookmarklet, use of strong encryption rather than weak hashing), but have an Achilles heel of their own: the service provider has the power to decrypt all your passwords. For now I’ll stick with my moinmoin-client-crypt approach.

UPDATE 2012-05-19: PassPack does not store your packing key on their servers afterall. (LastPass does not either, nor does Clipperz.) But you still must trust them, as they are in a position to insert backdoors into either the browser add-ons or web-based access they provide. This is less of an issue with ClipperZ, since you can run the Community Edition on your own hardware. Some brief comparisons here and here. Also there is some interesting discussion in the comments of the previously linked PassPack critique. Gabriel Weinberg has LastPass amongst his list of services used at DuckDuckGo. LastPass did possibly have a data breach, but they handled it well. Some more details on PassPack’s packing keys and master keys.

Taming Firefox + Adblock with browser.sessionstore.max_concurrent_tabs

 Coping with Computers  No Responses »
Apr 042011
 

I tend to have lots of browser tabs open. Even more so with Firefox 4’s Panorama feature, which I find handy despite the frustrating limitation that tab groups cannot be moved between windows. Alas, having many tabs open is suspected to trigger/exacerbate a Firefox memory leak when Adblock Plus is running. My own informal testing corroborates this.

In Firefox 3.6 I had used BarTab, a great plug-in that allowed unloading tabs without closing them to reclaim memory. Alas, it is not yet compatible with Firefox 4.

But it turns out Firefox 4 has a new setting (called Cascaded Session Restore) that provides a reasonable work-around. In about:config set

browser.sessionstore.max_concurrent_tabs=0

…and then, when closed and re-opened, Firefox will not load any tab until you click on it. Now it’s extremely fast to quit, restart, and continue on with reduced memory usage.