Security on Morten Linderud

SSH CA with device and identity attestation: ssh-tpm-ca-authority

Sat, 31 Aug 2024 18:00:00 +0200

The past year I have been hacking around on tools utilizing TPMs, and one of the features I have been interested to learn more about is the device attestation features.

After being a bit inspired by some ideas from people at work, the hackerspace and toots on mastodon, I figure out a SSH certificate authority would be a cool small project to hack on. Last year I wrote an SSH agent with TPM bound keys so this would nicely fit into the existing tooling.

Store ssh keys inside the TPM: ssh-tpm-agent

Wed, 04 Oct 2023 19:00:00 +0200

After writing age-plugin-tpm a friend of mine at the hackerspace was super excited to finally have easy file encryption with TPM sealed keys, all without having to rely on gnupg. “This is great!” he said.

“I wish I could have my SSH keys sealed in a TPM just as easily”.

We should have left it at that.

I shouldn’t have replied with a random assortment of facts like “I know google/go-tpm now”, or “but Go has a ssh-agent protocol implementation” followed-up with “Filippo has already implemented yubikey-agent, it can’t be that hard”. So I wound up writing a new ssh agent.

Store age identities inside the TPM: age-plugin-tpm

Mon, 17 Jul 2023 18:00:00 +0200

The past year I have been trying to learn more about the Trusted Platform Module (TPM). This is a small device found on most modern laptops that has several cool security features like key creation, sealing and attestation, however I have been struggling to find a small project where I can learn more about it.

To my surprised I learned a couple of months ago that nobody has written a TPM plugin for age!

PAM Bypass: when null(is not)ok

Tue, 24 Nov 2020 20:00:00 +0200

The Problem

Someone enters an IRC support channel and proclaims their dovecot server has been hacked and a non existing user sends spam email from their server. The initial reaction might be something along the lines of

Wat ಠ_ಠ

With the following assumption that the user clearly did something wrong. Hosting email is difficult after all. I don’t quite recall how rest of the support went, but it was solved and the root cause was not found. However, we keep on rolling! Then someone posts about a similar incident on r/archlinux.