221b | Til

Some banks actually support FIDO2 and hence security keys

2023-03-12T00:00:00+00:00

On my research on FIDO2 security key usage I stumbled upon a bank that actually supports the FIDO2 standard and hence accepts e.g. my YubiKey 5 or SoloKey 2 as an authentication factor.

Git supports commit signatures with OpenSSH keys

2023-02-25T00:00:00+00:00

Through new configuration options in newer GitLab versions I found out about the ability of git to use OpenSSH keys to sign commits and tags. This is a handy feature to proof the ownership of commits in a repository. Especially for my deployment method using ansible it is important that my deployment bot verifies commits using my public key such that a malicious actor can’t simply push commits to my infrastructure repository to gain access to the servers. It’s a nice alternative to OpenPGP that does not require an additional set of keys.

SSH session caching with ControlMaster

2023-02-22T00:00:00+00:00

Today I learned that the OpenSSH client supports maintaining SSH connections in background even after closing the current active terminal session. I found out about this while researching the use of a YubiKey for OpenSSH authentication and private-key management. Every time I connect to a remote host with a key stored on the YubiKey I’m prompted to press the button on the key to authorize the keys usage by the OpenSSH agent. This is inconvenient so I looked into caching opened connections for some time. Here is how to do this.

Not to reboot a LUKS encrypted system from afar, unprepared

2023-01-14T00:00:00+00:00

There is a Workstation in the office which I wanted to upgrade to the latest Fedora Workstation version 37. Right after following the dnf documentation on upgrades and issuing the dnf system-upgrade reboot command I remembered that the Workstation uses LUKS disk encryption and won’t do the upgrade without me entering the passphrase at boot. So how to fix that in the future?

Custom display resolution under Wayland is “interesting”

2023-01-10T00:00:00+00:00

Apparently it is not straight forward to set a custom display resolution under Wayland. Fedora 37 uses Wayland by default and if you, like me, use a monitor and graphics card / driver combination which don’t understand each other very well, you might be screwed. Putting it simply, I’m talking about information from the monitor about it’s resolution(s) not reaching the gnome display settings.

docker on Fedora has conservative ulimits

2023-01-06T00:00:00+00:00

Today I woke up to alert mails from my monitoring that the InfluxDB instance was restarting now and again. Looking into this I found out that it couldn’t open any more files. Apparently docker (moby-engine) on Fedora 37 has a default ulimit on open file descriptors of 1024 (hard and soft), which means inside a docker container processes are not allowed to have more than 1024 files open at a time.

What is /dev/snd in Linux?

2023-01-03T00:00:00+00:00

This is more about my first experience where ChatGPT brought up useful information faster than my search on DuckDuckGo.

How running an OSS AI Assistant on my workstation is super easy!

2023-01-03T00:00:00+00:00

Talking to my notebook, without being creepy talking to myself - although probably being cringy, actually is pretty easy. I just need podman and the official container image of Mycroft AI. I could install it directly into my Linux, but I like it containerized, especially when playing around.

git hooks - pre-commit

2021-05-02T00:00:00+00:00

I just learned how to make effective use of the git hook pre-commit. Based on a blog post Tips for using a git pre-commit hook I composed myself a pre-commit snippet that essentially stashes everything not staged for commit, runs arbitrary tests from a file test.sh and finally restores the stash. A configured git hook will then be executed by git automatically. See the official git hooks documentation for the details and other hooks.

git push options

2021-05-01T00:00:00+00:00

Today I learned that I can influence git push with certain options. This allows me to get more control of over the context of my commits. Depending on the git remote different things are possible. Gitlab, which is my primary git hosting platform, accepts the option -o ci.skip which, well, skips the CI pipeline completely for this push. Another pretty powerful option is ci.variable="=". With this you set environment variables of the pipeline for this push. With rules: on my pipeline jobs I can now control which tests and stages to run, pretty neat! Refer to the Gitlab documentation on Push Options for details.