OpenSSH can use host certificates to verify the host (like SSL certs on a webserver). OpenSSH can also use user certificates to verify the user (like passwords or ssh keys).

Both these types of cert to be used independently of each other.

I've tested using user certificates to authorize user login, since that is what most
people do with keys. People never really verify the host identity.

It works great and it's actually very simple. This will be my new SOP going forward.

Before starting to add hosts and users you need to create a Certificate Authority (CA) - which is actually just a key pair. It's a one-liner.

Every time you create a new host, you just need to copy the same file to it - the public key of the CA. And change one line in sshd_config to allow ssh certificates.

Every time you have a new user on your team who need access to servers, you have to generate a certificate for him. It's a one liner. He will copy the certificate to his own machine. And the ssh client will automatically send the certificate when needed.

Generating certificates is the part that could be automated. You could for instance be given a certificate that expires in 5 minutes. That would allow you to login and stay logged in. But if you need to login again, you need to generate a new certificate.

@jaredbusch and now Im running into this as well. Thank You for your steps!

@siringo said in HP iLO Alerts?:

anyone? someone here must have played with ilo alerts at some point ...

iDRAC, sure, iLO, not so much.

Should just be plug in the proper information for your email service and a valid account to send as.

Nothing is going to work better than buying or building networking gear and building and maintaining a network(s) of your own. Hands on, in an environment where you are free to break things, test things, try things that most businesses don't need, etc. Change things, do it again but in a different way or with different products.

Build a lab that you can brag about and talk to companies about all of the different things that you do.

@jasgot said in Excel Help:

No Need for a bunch of Nested IF= statements.
VLOOKUP is made for this. Although XLOOKUP is the new VLookup.

I did already mention LOOKUP in a couple of posts above.

But the power of the IFS is really when you just have a few different options and put them directly in the formula. Then you don't need a lookup table at all.

The SWITCH makes it even better as that is the equivalent to a case statement.

=SWITCH(F2, "10.0.19043", "21H1", "10.0.19042", "20H2", "10.0.19041", "2004", "10.0.18363", "1909", "10.0.17763", "1809", "OLD!")

@pete-s said in Mattermost –Open source, self-hosted Slack-alternative:

@voip_n00b said in Mattermost –Open source, self-hosted Slack-alternative:

@pete-s said in Mattermost –Open source, self-hosted Slack-alternative:

We use Zoho Cliq's guest chat for that.

Hmmmm.... https://help.zoho.com/portal/en/kb/zoho-cliq/cliq-user-guide/cliq-chats/group-chat/articles/

I can't get that link to work...

If you wanted to know more about guest chat, go here:
https://help.zoho.com/portal/en/kb/zoho-cliq/cliq-user-guide/cliq-chats/cliq-chat/articles/what-is-a-guest-chat

Zoho Cliq is slightly confusing though because external users and guest users are completely different things.

External users are Zoho Cliq users belonging to another organization. So external to your organization. Anyone can sign up though. So if you invite an external user that doesn't have Zoho Cliq, he will receive an invitation to sign up.

Guest users are non-Zoho Cliq users (that haven't signed up for a Zoho account). If you invite a guest users, they will not receive an invitation to sign up, they will receive a login link so they can chat with you.

Yeah, we use those features. It's nice.

I'm using this on my office machine now for personal files. It works great!

@stuartjordan this looks neat, I will try it with Linux.

@skyetel said in Postcards for Slack Beta Invite:

I am looking for 2 or 3 Beta testers who are able to give this a good test and report back on what they find.

You know I will give feedback

@jaredbusch
Glad Assuming the drives could be identified as to what is RAID, could you have removed the redundant set, then progressed with the reset and if it worked, great. If not, then you could have put the redundant set back in and not have lost anything other than the time and knowledge that the drives were indeed encrypted?

One team at the client that I needed to do something for immediately was already using ClickUp.

So the principal there decided to expand that use.

Suggestions were helpful.

@pete-s said in Strangest Airprint issue has me stumped:

@jaredbusch said in Strangest Airprint issue has me stumped:

@frodooftheshire said in Strangest Airprint issue has me stumped:

M477fnw

This is a close to $1000 printer. How old is it though? Printers can work for years, but after a couple, they are typically more expensive to repair than replace once depreciation and your labor time is added in.

Looks like it was introduced late 2015 or so. But it could have a 5 year warranty, in which case it might still be in warranty.

HP don’t have a warranty past 1 year unless you pay for a care pack. It will be known if there is a warranty or not.

@pmoncho said in Taking suggestions about x86 Access replacement:

@scottalanmiller said in Taking suggestions about x86 Access replacement:

@pete-s said in Taking suggestions about x86 Access replacement:

@scottalanmiller said in Taking suggestions about x86 Access replacement:
. And if you swing a dead cat, you whack at least three PHP developers.

I have to remember that phrase. Gruesome but funny.

Thanks for the info and views of PHP. It is nice to hear some positives about PHP as I mostly read about the security issues surrounding the multiple versions of PHP.

Like everything, PHP has had some security issues.
But most likely most of what you are reading comes down to stupid people not patching or stupid “developers” do copy pasta of code thy was poorly done in the first place.

@jaredbusch said in Bring order into IT environment in chaos:

@scottalanmiller said in Bring order into IT environment in chaos:

@pete-s said in Bring order into IT environment in chaos:

@eddiejennings said in Bring order into IT environment in chaos:

I've used DokuWiki in the past for documentation.

Yes, me too. But for this customer I will suggest they get something that is cloud based. And a little more specifically made for the purpose.

I can't find a good cloud based wiki. Either they suck or they are crazy expensive.

That has been my experience also

Confluence is quite good. Free for under 10 users, too.

@laksh1999 You can just export the list from Exchange.
https://www.codetwo.com/kb/export-exchange-mailboxes-list/

@notverypunny said in FIM, FAAM, details & False Positives:

The only commercial product that I've seen that discusses or seems to leverage this is Rapid7's InsightIDR.

Keep in mind that Greylog is a commercial product and is not open source. It used to be open source, now it is not. They claim to be, but they don't qualify.

@syko24 said in FreePBX and Uverse:

Might be something with the ISO image hosted on Vultr.

Definitely not. That's like saying it might be related to the hamburger you had at lunch. There's absolutely no connection.

It's because rebooting the server caused all of the connections to drop and the bad router to partially start over. So it's a problem that's going to come back, you just bought yourself more time.

Fundamentally, your system isn't built for reliable Internet traffic. AT&T is garbage stuff and this is just part of the penalty for being stuck in one of their regions. We have the same problem here in the third world. Vendors don't understand the basics and things like bridge mode can be hard.

@pete-s

It was more, when you would open a shared calendar it might take 5 mins for the whole thing to download… in the meantime you have no idea if there is an appt at a given time.
When I’m online mode there was zero delay

@jaredbusch said in How to best utilize Microsoft 365 File Sharing?:

OD has settings that you can enable to only sync things on demand. They may even be default anymore, been a year+ since I dealt with it.

I believe it is now. It wasn't in my local folder until I manually Sync'd it. Pretty cool feature. Nothing syncs until you tell it to.