Links from 2017-05-25

The remarkable Neal Stephenson interview | Damien Walter

Neal Stephenson – legendary author of speculative fiction –  on Elon Musk and geek culture, the  NSA revelations of Edward Snowden, how negative cultural narratives are killing big science  – and the upbringing that made him the writer he is.

Tagged as: , , , | Author:
[Freitag, 20170526, 05:00 | permanent link | 0 Kommentar(e)


The Future of Work

Seit 4 Monaten testet Finnland das Grundeinkommen — schon jetzt gibt es einen unerwarteten Effekt

Obwohl das Pilotprojekt der Finnen erst vor kurzer Zeit begonnen hat, ist schon ein wichtiger Effekt zu erkennen — viele Teilnehmer sind deutlich weniger gestresst als zu der Zeit, in der sie Arbeitslosengeld erhalten haben.

Elon Musk: Automation Will Force Governments to Introduce Universal Basic Income

Elon Musk believes artificial intelligence that is much smarter than the smartest human on Earth could result in dangerous situations. Musk argues that the government must introduce a universal basic income program in order to compensate for automation

The meaning of life in a world without work

As technology renders jobs obsolete, what will keep us busy? Sapiens author Yuval Noah Harari examines ‘the useless class’ and a new quest for purpose

Oxford-Studie: In 25 Jahren werden 47 Prozent der Jobs verschwunden sein — und auch eurer ist nicht sicher

Auch eine Studie der renommierten University of Oxford stellt nun die Behauptung auf: In den nächsten 25 Jahren werden 47 Prozent der Jobs verschwinden — zumindest in den weit entwickelten Ländern dieser Erde.

Tagged as: , , , | Author:
[Donnerstag, 20170525, 18:42 | permanent link | 0 Kommentar(e)


Happy Towel Day

The Hitchhikers Guide To The Galaxy Wikipedia has the following to say about Towel Day:

Towel Day is celebrated every May 25 as a tribute by fans of the late author Douglas Adams. The commemoration was first held in 2001, two weeks after his death on May 11, and since then has been extended to an annual event. On this day, fans carry a towel with them throughout the day. The towel is a reference to Adams’s popular science fiction comedy series The Hitchhiker’s Guide to the Galaxy.

For this year, I found Douglas Adams reading from The Hitchhiker’s Guide to the Galaxy:

Tagged as: , , , , , , , | Author:
[Donnerstag, 20170525, 12:29 | permanent link | 0 Kommentar(e)


Radicale Calendar Server with Debian 8 (Jessie) and IMAP/SHADOW Authentication via Apache httpd

As I plan to move from a proprietary calendaring to a more „ressource-aware” open source solution, I decided to give Radicale a try. It is open source, appears to be rather pragmatic in its approach to „standards” and has a small footprint in regards to system requirements.

With me running Debian 8 on my server, I decided to stick with the available package and not install „from source”. So a quick „apt-get install radicale” took care of installing the necessary software (do not forget to enable the Radicale daemon in /etc/default/radicale).

The configuration of Radicale is rather straightforward and simple. In regards to transport security, You can reuse an existing TLS certificate (or get a new one from Let’s encrypt). For authentication, you can choose between several options. As I don’t have an LDAP server (yet) and I didn’t want to create a .httpasswd entry for each user, I chose „IMAP”. So Radicale will validate all credentials against the local IMAP server (Dovecot in my case).

The relevant bits and pieces of my /etc/radicale/config file look like this:

# bin to all legacy IP addresses
hosts = 0.0.0.0:5232
 
# SSL flag, enable HTTPS protocol
ssl = True
 
# SSL certificate path
certificate = /etc/ssl/certs/kalender.fullchain.cer
# SSL private key
key = /etc/ssl/private/kalender.key
 
# SSL Protocol used. See python's ssl module for available values
# TLS 1.0 or higher, as I still have to support older Android clients
protocol = ssl.PROTOCOL_TLSv1_2
 
# Ciphers available. See python's ssl module for available ciphers
# OWASP Cipher String 'B' (Broad compatibility)
# Again, more then strictly recommended in 2017 due to older Android devices
ciphers = DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA
 
# Message displayed in the client when a password is needed
realm ="Kalenderserver - Password Required"
 
[auth]
# Authentication method
# Value: None | htpasswd | IMAP | LDAP | PAM | courier | http | remote_user | custom
type = IMAP
 
# IMAP Configuration
imap_hostname = localhost
imap_port = 143
imap_ssl = true
 
[rights]
# Rights backend
# Value: None | authenticated | owner_only | owner_write | from_file | custom
type = owner_only
 
[storage]
# Storage backend
# Value: filesystem | multifilesystem | database | custom
type = filesystem
 
# Folder for storing local collections, created if not present
filesystem_folder = /var/lib/radicale/collections

If you want/need to share your calendar with other users, play around with the [rights] section. For my setup, this was fine.

This setup should also give you an adequate TLS configuration. There is of course room for improvement, if you know your clients all support TLS 1.2 and modern ciphers. See the OWASP TLS Cipher String Cheat Sheet and bettercrypto.org for details.

Once you restart the Radicale server via sudo service radicale restart you should get a "Radicale works!" message in the browser – if you opened up port 5232 on the firewall.

If you also enabled any form of authentication, the browser or ical/caldav client will prompt you with a „Basic Authentication” prompt for the credentials. If you, like in my case, configured IMAP, you will see in your IMAP log a connection, verifying the credentials you entered.

This is nice, but I did not want to open another port on my firewall for this. So how could I proxy this through my existing Apache httpd? Unfortunately, this is only covered halfway in the documentation.

You do have to create a (new) virtual host (eg. „calendar.example.com”) and configure the python WSGI module as well as authentication. To do so, we need a few modules installed and activated:

sudo apt-get install libapache2-mod-wsgi libapache2-mod-authnz-external pwauth
sudo a2enmod authnz_external
sudo a2enmod wsgi

The Apache httpd config for that virtual host including WSGI setup and authentication via mod-auth-external and pwauth might look like this:

<VirtualHost *:443>
    ServerName calendar.example.com
    
    # WSGI (WSGI is the Web Server Gateway Interface) config for radicale
    # Group "adm" so radicale can write to it's log file in /var/log/radicale
    WSGIDaemonProcess radicale user=radicale group=adm threads=1
    WSGIScriptAlias / /usr/share/radicale/radicale.wsgi
    
    # Add Authentication via pwauth
    <IfModule mod_authnz_external.c>
        AddExternalAuth pwauth /usr/sbin/pwauth
        SetExternalAuthMethod pwauth pipe
    </IfModule>
    
    <Directory /usr/share/radicale>
        WSGIProcessGroup radicale
        WSGIApplicationGroup %{GLOBAL}
        # Pass on authentication data to radicale
        WSGIPassAuthorization On
        AllowOverride None
        
        AuthType Basic
        # This should be the same string as the radicale "realm" value
        AuthName "Kalenderserver - Password Required"
        AuthBasicProvider external
        AuthExternal pwauth
        # Any valid user will be allowed to athenticate.
        # You could restrict this further via authz_unixgroup
        Require valid-user
    </Directory>

With that configuration, Apache will verify access against usernames & passwords in the passwd/shadow files (do NOT use mod_authnz_pam for that!) and will pass the authentication data on to radicale. If you add authz_unixgroup, you could further limit the number of users to the members of a specific group, …

 

As always, I stood on the shoulders of giants in my work on this. So further reading should be:

Do be aware, that Radicale 2, which is currently at RC2, will bring changes (only support for httpasswd auth, …). As I am using Debian stable and do not see any immediate benefits in upgrading Radicale atm., I am rather happy with this setup.

Tagged as: , , , , , , , , | Author:
[Samstag, 20170520, 18:19 | permanent link | 0 Kommentar(e)


Public Speaking 2017

Linuxwochen Wien

2017-05-04..06 Linuxwochen Wien 2017, FH Technikum Wien, Wien

Awwwwww - Advanced Wibbly-Wobbly World Wide Webserver Wizardry

Ein Rückblick auf die Transportverschlüsselung in Webservern, insbesondere nginx und Apache, sowie die Möglichkeiten Inhalte vor der Auslieferung zu komprimieren und bei Proxies und clients zu cachen. Abgerundet wird der Talk durch security relvante HTTP Response Header.

Gemeinsam mit MacLemon.
Slidedeck als PDF

VPNs - Angewandte Verwirrung für Leitweg Tabellen

Die gängigsten VPN Protokolle sowie Nutzungsempfehlungen. Konfigurationsanleitung für OpenVPN 2.3/2.4.1 inkl. sicherer Ciphersuiten für zeitgemäße Verschlüsselung. Die Konfiguration von Clients auf unterschiedlichen Platformen, wie Linux, BSD, Windows und macOS wird behandelt. Im zweiten Teil geht es um die Konfiguration eine IPSec und IKEv2 basierten VPN Servers auf Basis der Scripte von AlgoVPN auf einem eigenen Ubuntu Server. Danach wird die Konfiguration von macOS und iOS Clients gezeigt. Den erwähnten VPN-Anbieter Vergleich findet man unter iThat One Privacy Site.

Gemeinsam mit MacLemon.
Slidedeck als PDF

SSH Workshop - From Zero to Hero*ine.

Grundlagen für die Benutzung von SSH, insbesondere OpenSSH. Ein zweistündiger Workshop für Einsteiger*innen in die Benutzung von des ssh(1) Commandline Clients.

Gemeinsam mit MacLemon.

Grazer Linuxtage

2017-04-28..29, Grazer Linuxtage 2017, FH Joanneum, Graz

SSH Workshop - From Zero to Hero*ine.

Grundlagen für die Benutzung von SSH, insbesondere OpenSSH. Ein zweistündiger Workshop für Einsteiger*innen in die Benutzung von des ssh(1) Commandline Clients.

Gemeinsam mit MacLemon.

Awwwwww - Advanced Wibbly-Wobbly World Wide Webserver Wizardry

Ein Rückblick auf die Transportverschlüsselung in Webservern, insbesondere nginx und Apache, sowie die Möglichkeiten Inhalte vor der Auslieferung zu komprimieren und bei Proxies und clients zu cachen. Abgerundet wird der Talk durch security relvante HTTP Response Header.

Gemeinsam mit MacLemon.
Slidedeck als PDF

BSides Ljubljana 0x7E1

2017-03-10, BSides Ljubljana 0x7E1, Poligon creative centre, Ljubljana, Slovenia

Peculiar SSH – May we interest you in this particular feature?

We all use SSH on a more or less daily basis. More advanced users even have created a config file for their clients in order to spare some typos. So let us take you on a journey into the more “”peculiar”” features of SSH. From multi-factor authentication to jump hosts all the way to GPG and the use of SmartCards. Let us show you what SSH can do, if you invest some into configuring it.

Together with MacLemon.
Slidedeck as PDF

SSH Workshop - From Zero to Hero*ine.

Securely connecting though several host to a remote server and obfuscating the local configuration will also be part of the workshop. If there is time, we will also look at the server side of things and work through a few possible improvements. This workshops targets beginner to intermediate SSH users. As long as you have a fairly recent command line OpenSSH client, you are welcome no matter what operating system you are using. Basic knowledge of the Linux or BSD command line is required. (navigating the file system, editing files, …). OpenSSH 7.4 or higher recommended!

Together with MacLemon.

Tagged as: , , , | Author:
[Sonntag, 20170507, 23:38 | permanent link | 0 Kommentar(e)


Disclaimer

„Leyrers Online Pamphlet“ ist die persönliche Website von mir, Martin Leyrer. Die hier veröffentlichten Beiträge spiegeln meine Ideen, Interessen, meinen Humor und fallweise auch mein Leben wider.
The postings on this site are my own and do not represent the positions, strategies or opinions of any former, current or future employer of mine.

Search

RSS Feed RSS Feed

Tag Cloud

2007, 2007, a-trust, a.trust, a.trust, a1, accessability, accessability, acta, advent, advent, age, amazon, ankündigung, apache, apache, apple, apple, audio, audio, austria, austria, backup, backup, barcamp, bba, bba, big brother awards, birthday, birthday, blog, blog, blogging, book, book, books, books, browser, browser, Browser_-_Firefox, Browser_-_Firefox, buch, bürgerkarte, bürgerkarte, cars, cartoon, cartoon, ccc, ccc, cfp, cfp, christmas, christmas, cloud, cloud, collection, computer, computer, computing, concert, conference, conference, copyright, copyright, database, date, date, datenschutz, datenschutz, debian, debian, delicious, demokratie, demokratie, design, design, desktop, desktop, deutsch, deutsch, deutschland, deutschland, dev, developer, developer, digitalks, digitalks, dilbert, dilbert, disobay, disobay, dna, dna, dns, Doctor Who, documentation, documentation, Domino, domino, domino, Douglas Adams, download, download, drm, drm, dsk, dsk, dvd, e-card, e-government, e-government, e-mail, e-mail, e-voting, E71, Ein_Tag_im_Leben, Ein_Tag_im_Leben, email, email, eu, eu, event, event, exchange, exchange, Extensions, Extensions, fail, fail, feedback, feedback, film, firefox, firefox, flightexpress, food, food, foto, foto, fsfe, fun, fun, future, future, games, gaming, gaming, geek, geek, geld, geld, gleichberechtigung, gleichberechtigung, google, google, graz, graz, grüne, grüne, grüninnen, hack, hack, hacker, handtuch, handy, handy, hardware, hardware, HHGTTG, history, history, how-to, howto, hp, hp, html, html, humor, humor, ibm, IBM, ibm, ical, ical, image, image, innovation, innovation, intel, intel, internet, internet, internet explorer, internet explorer, iphone, iphone, ipod, ipod, isp, isp, it, IT, it, java, javascript, job, job, journalismus, keyboard, keyboard, knowledge, knowledge, konzert, language, language, laptop, laptop, law, law, lego, lenovo, lenovo, life, life, links, links, linux, Linux, linux, Linux, linuxwochen, linuxwochen, linuxwochenende, linuxwochenende, living, living, lol, london, london, lost+found, lost+found, Lotus, lotus, lotus, Lotus Notes, lotus notes, lotus notes, Lotus Notes, LotusNotes, lotusnotes, LotusNotes, lotusphere, Lotusphere, lotusphere, Lotusphere2006, lotusphere2007, lotusphere2007, lotusphere2008, Lotusphere2008, lotusphere2008, lustig, lustig, m3_bei_der_Arbeit, m3_bei_der_Arbeit, mac, mail, mail, marketing, marketing, mathematik, mathematik, media, media, medien, medien, metalab, metalab, microsoft, Microsoft, Microsoft, microsoft, mITtendrin, mITtendrin, mobile, mobile, mood, mood, movie, movie, mp3, mp3, multimedia, multimedia, music, music, musik, musik, männer, nasa, netwatcher, netwatcher, network, netzpolitik, news, news, nokia, Notes, notes, notes, Notes+Domino, Notes+Domino, office, office, online, online, OOXML, open source, open source, openoffice, openoffice, opensource, opensource, orf, orf, orlando, orlando, os, os, outlook, outlook, patents, pc, pc, pdf, pdf, perl, perl, personal, personal, php, php, picture, picture, pictures, podcast, podcast, politics, politik, politik, pr, press, press, press, presse, presse, privacy, privacy, privatsphäre, privatsphäre, productivity, productivity, programming, programming, protest, qtalk, qtalk, quintessenz, quote, quote, quotes, quotes, radio, rant, rant, rant, recherche, recherche, recht, recht, release, release, review, review, rezension, rezension, rss, rss, science, science, search, search, security, security, server, server, sf, sf, shaarli, Show-n-tell thursday, sicherheit, sicherheit, silverlight, silverlight, SnTT, SnTT, social media, software, software, sony, sony, sound, sound, space, space, spam, spam, sprache, sprache, sprache, spö, ssh, ssh, ssl, standards, standards, storage, storage, story, story, stupid, stupid, summerspecial, summerspecial, summerspecial, sun, sun, sysadmin, talk, talk, technology, technology, The Hitchhikers Guide to the Galaxy, theme, theme, thinkpad, thinkpad, tip, tip, tipp, tipp, tools, tools, topgear, topgear, torrent, torrent, towel, towel, Towel Day, Towel Day, TowelDay, travel, travel, truth, truth, tv, tv, twitter, twitter, ubuntu, ubuntu, uk, uk, unix, unix, update, update, usa, usa, vds, video, video, video, videoüberwachung, videoüberwachung, vienna, vienna, vim, Vim, vim, vista, vista, vorratsdatenspeicherung, vortrag, vortrag, wahl, wahl, wcm, wcm, wcm, web, web, web 2.0, web 2.0, web2.0, web2.0, web20, Web20, web20, webdesign, webdesign, werbung, werbung, wien, wien, wiener linien, wikileaks, windows, windows, windows, windows 7, windows 7, wired, wishlist, wishlist, wissen, wissen, Wissen_ist_Macht, Wissen_ist_Macht, wlan, wlan, work, work, wow, wow, wtf, wtf, Wunschzettel, wunschzettel, Wunschzettel, wunschzettel, www, www, xbox, xbox, xml, xml, xp, xp, zensur, zensur, zukunft, zukunft, zune, zune, österreich, österreich, österreich, österreich, övp, övp, übersetzung, übersetzung, überwachung, überwachung

AFK Readinglist