Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TinySSH is a small SSH server using NaCl, TweetNaCl

github.com

Post reply on HN
Print view View original

91–100 of 128 posts

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#91

Post by crote »

forty wrote: post #44
bretthoerner wrote: post #32

tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…

Question: when remotely unlock the boot disk via ssh, how do you make sure the boot has not been compromised and that you are not just sending the password to the bad guys? At some point I wanted to do something with utrablue [1], to work over network rather than Bluetooth, but then it was in go and I got lazy suddenly :) [1] https://github.com/ANSSI-FR/ultrablue

In theory this should be a perfect match for TPM-powered secure booting: your machine starts every time with a clean TPM, which validates the BIOS into it, which validates the bootloader into it, which validates the kernel into it, which derives an RSA private key from the resulting TPM state. If an attacker compromises it, it'll present the wrong host key and you get a big fat error message.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#92

Post by teddyh »

bretthoerner wrote: post #32

tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…

There’s a non-interactive solution to rebooting safely with encrypted disks: Mandos https://www.recompile.se/mandos>

Reboot your server while you sleep!

Disclosure: I am a co-author of Mandos.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#93

Post by jethro_tell »

teddyh wrote: post #92
bretthoerner wrote: post #32

tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…

There’s a non-interactive solution to rebooting safely with encrypted disks: Mandos https://www.recompile.se/mandos > Reboot your server while you sleep! Disclosure: I am a co-author of Mandos.

This is really cool. I'm going to give this a try!

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#94

Post by jethro_tell »

bretthoerner wrote: post #38
jethro_tell wrote: post #35

Earlier quoted context omitted.

I use normal opensshd for this. No reason to support two ssh daemons when you can do it with one. The difference in size on your init image is minimal and you probably aren't even trying to optimize for space there. If you don't know the size of your rd off the top of your head then it almost certainly doesn't matter.

All fair, I guess I just landed on mkinitcpio-tinyssh first and it was my introduction to the idea, and only took a few seconds to setup. I'll switch to openssh if I ever have issues, but this has been working fine for many years, so I'm no rush.

Makes sense. Probably more work to go off the beaten path then to maintain two configs

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#95

Post by jethro_tell »

bretthoerner wrote: post #46
forty wrote: post #44

Earlier quoted context omitted.

Question: when remotely unlock the boot disk via ssh, how do you make sure the boot has not been compromised and that you are not just sending the password to the bad guys? At some point I wanted to do something with utrablue [1], to work over network rather than Bluetooth, but then it was in go and I got lazy suddenly :) [1] https://github.com/ANSSI-FR/ultrablue

> how do you make sure the boot has not been compromised and that you are not just sending the password to the bad guys? In my case, I can't. This is a NAS in my house and this is mostly to prevent me from having to go to another room and plug in a monitor and keyboard. (Also, I've done this from across the country after a power outage.) The threat vectors I'm protecting against are I guess mostly theft of the entire…

This is mostly me but the case that's the most common is that a disk can't be wiped because its dead. Gotta do that before hand.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#97

Post by [deleted] »

makeworld wrote: post #60
fanf2 wrote: post #48

Earlier quoted context omitted.

Not for that reason. The copyleft trolls that Doctorow wrote about are using a termination clause in attribution-required CC licences. (Remember, there are lots of different CC licences with varying requirements on licensees.) CC0 doesn’t impose requirements on licensees nor does it have a termination clause, so it isn’t affected by these trolls. However, CC0 is not good as a software license. It is explicitly restri…

0BSD and MIT-0 don't mention patents explicitly though, few licenses do. I only know of two: https://blueoakcouncil.org/list

[deleted]

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#98

Post by skissane »

jvanderbot wrote: post #47
gkbrk wrote: post #43

Earlier quoted context omitted.

Is that necessarily a bug? If you use Disney content without a license they won't give you a 30-day period to keep mis-using it. Same with using Oracle software. Why should people who create CC content provide such a grace period?

Validity of the post aside, there are real-world examples of this license being abused by third parties. Given the cost is very low to just change the license, I think it might be worth considering.

To be clear, the issue we are talking about here does not exist for the CC0 license TinySSH is using. CC0 lacks a termination clause, it wouldn't make sense for it to have one. It only exists for other CC licenses, like the (earlier versions of) CC-BY(-NC/-SA).

CC0 has other issues – some people (e.g. Red Hat Legal) are concerned about its language explicitly excluding patent and trademark rights, and think that is legally inferior to other public domain declarations (such as The Unlicense) which don't mention that topic at all.

In a declaration/license in which patents and trademarks go unmentioned, if the original author sues you on those grounds, you can try to argue that by releasing the software they gave you an implied patent/trademark license – that argument may or may not win in Court, but at least it has a chance. With language in the declaration/license explicitly excluding patents and trademarks (like CC0 has), that argument is likely dead-on-arrival.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#99

Post by skissane »

fanf2 wrote: post #48
jvanderbot wrote: post #39

The license is "CC0 1.0 Universal" In light of this post outlining a bug in early CC licenses: https://doctorow.medium.com/a-bug-in-early-creative-commons-... Discussed here: https://news.ycombinator.com/item?id=39610509 Does this need updating? EDIT: based on some discussion, it does need updating, but not for the reason I thought. I filed a suggestion here: https://github.com/janmojzis/tinyssh/issues/85

Not for that reason. The copyleft trolls that Doctorow wrote about are using a termination clause in attribution-required CC licences. (Remember, there are lots of different CC licences with varying requirements on licensees.) CC0 doesn’t impose requirements on licensees nor does it have a termination clause, so it isn’t affected by these trolls. However, CC0 is not good as a software license. It is explicitly restri…

> It’s better to use 0BSD or MIT-0 instead, which grant permission to use the software without weird exceptions.

0BSD and MIT-0 are zero attribution ultra-permissive copyright licenses, aka public domain-equivalent copyright licenses.

CC0 is a public domain declaration with a fallback copyright license for jurisdictions (such as Germany) which don't recognise public domain declarations.

There is a big technical difference between the two, in some jurisdictions (such as the US) – CC0 puts something in the public domain, MIT-0/0BSD technically doesn't. A real difference in theory, maybe not much in practice.

If the author really cares about the public domain part, something like Unlicense is a better option than MIT-0/0BSD – an actual public domain dedication, without the patent/trademarkconcerns which exist regarding CC-0.

If they want to make the maximum possible number of people happy, they could even use disjunctive licensing, e.g. CC-0 OR Unlicense OR MIT-0

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#100

Post by justin_oaks »

slug wrote: post #83
bretthoerner wrote: post #32

tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…

For debian/ubuntu users, there's also dropbear-initramfs package with same functionality (works with any fs luks/ext4/lvm/zfs/etc). https://packages.debian.org/bookworm/dropbear-initramfs https://packages.ubuntu.com/jammy/dropbear-initramfs

I've used this for several years now. It works well and is relatively easy to set up.
Post reply on HN