paskvilwiki

up: servers & admin

security

last updated 2012-09

password generators

  • PHP (7+) - replace the 16 with the length of the generated password (up to 32 here, raise the 24 for more):
$password = substr(strtr(base64_encode(random_bytes(24)), '+/', '-_'), 0, 16);

or, terminal version:

$ php -r "echo substr(strtr(base64_encode(random_bytes(24)), '+/', '-_'), 0, 16);"
1hlNxRwBr4mCZWQF

update 2026 - this used to be crypt(php_uname() . microtime()), which is predictable - random_bytes() is a proper CSPRNG

  • Bash - replace the 64 with the length of the generated password (no real limit here), and change the character class in tr -d as you please, to control what characters can be contained in the password; the character class presented here is all characters that are treated as a part of the word in terminal (i.e. you can double-click the word and it gets selected as a whole):
$ cat /dev/urandom | tr -d -c "a-zA-Z0-9@#%&\-\_+=:,.?/" | head -c 64; echo
uQ,XGSG4qPtE4.&UQT,jPA#=a8j-mhy+qjQUg:m#s7g1@c2-#J8D-,3zQFd+o_-W

SSH access using pubkeys for authentication

you can make your system's remote login way safer with just 3 simple steps:

  1. create your public-private key pair of files
  2. register your public key on the server you want to access
  3. [optional and recommended] allow only login using the pubkey on the server

Create public-private key pair

to generate the public-private key pair, use ssh-keygen -t ed25519 (or ssh-keygen -t rsa -b 4096 for old servers that don't take Ed25519 keys)

you'll be prompted for where to save the pubkeys, then for a passphrase (either empty, or 5+ letters), repeat if non-empty, and the keys get generated. just as with passwords, it's important to use strong passphrases

you should chmod 600 both key files, and be very careful about them

highly recommended is to hold them in a VeraCrypt volume (the TrueCrypt successor) or the like, if you carry them around. if you need to write down the passphrase somewhere, again, either use VeraCrypt, or a gpg -c encrypted file, or the likes. don't forget, a chain is only as strong as its weakest link

set up the server for key-based login

transfer the created *.pub file (typically called id_ed25519.pub) to the server you want to log into remotely. do not transfer the private part of the pair (typically called id_ed25519)!!

register the key on the server by appending it to the list of authorized keys for the user this key belongs to, like this:

cat id_ed25519.pub >> /home/user/.ssh/authorized_keys

the .ssh/authorized_keys file should of course also be chmod 600, and the /home/user/.ssh folder chmod 700

test it

now, you should be able to log in to the server using

ssh -i privatekey user@server
e.g. ssh -i ~/.ssh/id_ed25519 [email protected]

the server verifies your identity against the public key in authorized_keys - on your side, only the private key (id_ed25519) is needed

fortify the server (optional, root rights required)

once all is up and running, and you've tested the login properly, you may choose to disable password-based login

edit the /etc/ssh/sshd_config file (or /usr/local/etc/sshd_config on BSDs). add/update the following lines:

PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys

then restart ssh - using sudo systemctl restart ssh (or service sshd restart on BSDs)

you may also choose to disable root login, allowing only regular users to log in, and then use sudo to become root. simply add/update in /etc/ssh/sshd_config:

PermitRootLogin no

using rsync together with SSH

using password-based authentication:

$ rsync -avz -e ssh user@server:/remote/dir /this/dir/

using pubkey-based authentication:

$ rsync -avz -e "ssh -i /path/to/id_rsa" user@server:/remote/dir /this/dir/