Mitchell Riedstra's personal website

Setting up FIDO2 backed SSH keys on MacOS

2023-12-09T20:00:00-05:00

Setting up FIDO2 backed SSH keys on MacOS

Saturday December 9 2023

Setting up FIDO2 backed SSH keys on MacOS

After a recent re-install I had to go through this process again, figuring it out is the most tedious part. Once you know what to do it's not so bad.

Install Homebrew

Then install openssh ( as even on MacOS Sonoma they've disabled the feature in the bundled version of SSH )

$ brew install openssh

And then setup ssh-askpass:

$ brew install theseal/ssh-askpass/ssh-askpass

Update your zsh, or other shell configuration to make sure the environment variables are exported:

export SSH_ASKPASS=ssh-askpass
export SSH_ASKPASS_REQUIRE=force

Then add the following snippet below the environment variables:

#shellcheck disable=SC2120
checkSSHAgent() {
	if [ "$1" = "-k" ] ; then
		pkill -9 ssh-agent
	fi

	ssh_agent_conf="$HOME/.ssh/agent"
	if [ -e "$ssh_agent_conf" ] ; then
		#shellcheck disable=SC1090
		. "$ssh_agent_conf"
	fi
	#shellcheck disable=SC2009
	if ! ps aux | awk '{print $2}' | grep -q "$SSH_AGENT_PID" \
		|| ! [ -e "$ssh_agent_conf" ] \
		|| [ -z "$SSH_AGENT_PID" ] ; \
	then
		ssh-agent -s | grep -v echo > "$ssh_agent_conf"
		#shellcheck disable=SC1090
		. "$ssh_agent_conf"
	fi
}

checkSSHAgent

I prefer to use the above shell function that's more aggressive about checking that the agent is running, rather than relying on it being started at login and the environment variables appropriately inherited.

With that done, you should be able to fire up a new terminal and have SSH working with the Yubikeys, as well as the pop-up window to notify you when to tap the key.

Why Software Engineers don't avoid Complexity

2023-01-07T00:30:00-05:00

Why Software Engineers don't avoid Complexity

Saturday January 7 2023

Why Software Engineers don't avoid Complexity

Most engineering disciplines there's a very solid understanding of complexity, how to manage it, when to reduce it. Enumeration of variables and reducing the state of things you have to worry about.

Automotive technicians do this kind of thing all the time, whether they realize it consciously or not. When troubleshooting they'll go down the list of variables to check, from most likely, to least. That way reducing the set of potential problems. Often, though not always, this leads to an obvious solution.

Software engineering is a bit different, we have complicated, esoteric monstrosities all over the place. Perhaps, the most obvious is the whole stack of web technologies. Every browser, by design slurps down code from wherever you browse the internet and then executes it on your computer -- that is unless you've explicitly configured your browser not to do so. Making matters worse, it's layered upon HTML--which, is hostile to eyes and computers, much like XML. HTML also sucks at its job too, so now we have CSS and the <center></center> HTML tag... does what now? No, no, it's real easy, margin: 0px auto; or something.

I won't belabor the point about software being unnecessarily complex for no reason, others before me have already spent a lot of time on that topic.

The question here is why does it exist? Why isn't simplicity prioritized?

It comes down to incentives for all parties at play, let's enumerate a few:

Customers demand features, management and engineering are downstream of that
Management doesn't see or understand engineering's code
- Management doesn't see code as a liability
Customers likewise, don't see or understand an engineer's code
Engineers often prefer what's familiar and feature-filled
Very little incentive to remove unused code
Very little incentive to complete tasks more efficiently
Very little incentive to make software that's usable in 30+ years
Bravado, in understanding the complexity
Complexity may be seen (by some) as a kind of job security
Consistent emphasis on the short term outlook from all involved

All of these incentives are indeed fixable.

Many of them you can fix by being the engineer who asks questions, makes suggestions and approves only of simplicity.

Some of the others are a broader reflection of where we are at in society, though that's not to say you cannot move the needle a bit.

Rootless Podman on Alpine Linux

2023-01-05T18:30:00-05:00

Rootless Podman on Alpine Linux

Thursday January 5 2023

Rootless Podman on Alpine Linux

While it doesn't work out of the box, setup is failry straightforward:

# apk add podman buildah
# rc-update add cgroups default
# /etc/init.d/cgroups start

Then run this script to setup the sbustitute UID and GIDs:

#!/bin/sh
set -e
# Order of users is important, changing it later can cause headaches
_users="bob
sally
mitch"

IFS='
'

printf "" > /etc/subuid
printf "" > /etc/subgid

uids=65537

n=1
for _user in $_users ; do

echo "$_user:$(( ( n * uids ) + 1 )):$(( ( n * uids ) + uids ))" \
| tee -a /etc/subgid >> /etc/subuid

n=$((n+1))

done

Replacing the _users variable with users of your own users, of course.

You could also reduce uids, if you want less user IDs to be allocated for each user.

UIDs are 32 bit integers on Linux these days, you have as many UIDs as there are IPv4 addresses. ( That is, a bit over four billion )

Alpine Linux on a Laptop How-To

2022-12-31T11:20:39-05:00

Alpine Linux on a Laptop How-To

A few notes before we get started, we're going to partition and install by-hand with minimal help from the installer. This is so you can easily have Alpine co-exist with other operating systems on the same disk, so as long as you have another ef00 and 8e00 partition for it to reside. We won't be using any bootloader tools either, just the kernel's built in EFI stub and efibootmgr to tell the UEFI where to look.

Once your done with the main sections you should have an Xfce desktop, from there you can pick and choose the other pieces, if any, that you want.

Boot into the Alpine Linux ISO:

You will probably want to start form the extended image, though this method works just fine from the standard image as well.

# setup-interfaces
# /etc/init.d/networking start
# setup-apkrepos
# apk add cryptsetup lvm2 gptfdisk xfsprogs btrfs-progs efibootmgr

Now let's partition the disk:

# gdisk /dev/<device>
Command (? for help): n
Partition number (1-128, default 1): 
First sector : 2048
Last sector : +500M
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): ef00
Changed type of partition to 'EFI system partition'

Command (? for help): n
Partition number (2-128, default 2): 
First sector :  <hit enter>
Last sector  :  <hit enter>
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 8e00
Changed type of partition to 'Linux LVM'
Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/<device>.
The operation has completed successfully.
#

Where <device> is probably sda or nvme0n1, but double check. Instead of +500M for the uEFI partition, you could also do 1, or 2gb even if you're going to be sharing /boot with multiple operating systems.

# cryptsetup luksFormat /dev/<device> 

WARNING!
========
This will overwrite data on /dev/<device> irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/<device>: 
Verify passphrase: 
# 
# cryptsetup luksOpen /dev/<device> crypt
Enter passphrase for /dev/<device>: 
# lvm pvcreate /dev/mapper/crypt
  Physical volume "/dev/mapper/crypt" successfully created.
# lvm vgcreate vg /dev/mapper/crypt
  Volume group "vg" successfully created
# lvm lvcreate vg --name root --size=<size>
  Logical volume "root" created.
# lvm lvcreate vg --name home --size=<size>
  Logical volume "home" created.
# mkfs.xfs /dev/vg/root
# mkfs.xfs /dev/vg/home
# mkfs.vfat -f32 /dev/<device>1

I've used xfs above, you can use ext4 or btrfs as well.

Mount the filesystems and install

# modprobe xfs
# mount /dev/vg/root /mnt
# mkdir /mnt/boot /mnt/home
# modprobe vfat
# mount /dev/<device>1 /mnt/boot
# mkdir -p /mnt/etc/apk
# cp -a /etc/apk/keys /mnt/etc/apk/
# cp /etc/apk/repositories /mnt/etc/apk/
# apk -p /mnt --initdb -U add $(cat /etc/apk/world)
# cp /etc/resolv.conf /mnt/etc/
# cd /mnt
# mount -o bind --rbind /dev dev
# mount -o bind --rbind /sys sys
# mount -t proc none proc
# chroot . /bin/ash
# export PS1="(CHROOT)# "
(CHROOT)# apk add linux-lts tzdata
(CHROOT)# apk add wpa_supplicant # If you need wifi
(CHROOT)# grep -E 'xfs|vfat|btrfs|ext4' /proc/mounts >> /etc/fstab
(CHROOT)# echo none /tmp tmpfs rw,defaults 0 0 >> /etc/fstab
(CHROOT)# echo '
auto lo
iface lo inet loopback' > /etc/network/interfaces
(CHROOT)# setup-sshd
(CHROOT)# setup-ntp
(CHROOT)# for svc in devfs dmesg hwdrivers mdev ; do rc-update add $svc sysinit ; done
(CHROOT)# for svc in bootmisc hostname hwclock lvm modules networking \
              seedrng swap sysctl syslog ; do rc-update add $svc boot ; done
(CHROOT)# for svc in acpid crond klogd local ; do rc-update add $svc default ; done
(CHROOT)# sed -i.bak -e's/ext4/ext4 xfs btrfs lvm cryptsetup/' \
            /etc/mkinitfs/mkinitfs.conf
(CHROOT) # mkinitfs $(ls -t /lib/modules | sed 1q) # Note if `ls` is aliased, use `command ls` to avoid a trailing slash
(CHROOT) # efibootmgr -c -p 1 -d /dev/<device>1 -L Alpine -l /vmlinuz-lts \
-u 'initrd=/initramfs-lts cryptroot=/dev/<device>2 cryptdm=crypt root=/dev/vg/root rootfstype=xfs rootflags=rw' \
(CHROOT) # passwd
(CHROOT) # echo "myname" > /etc/hostname
(CHROOT) # exit
# sync && reboot

You may wish to replace cryptroot=/dev/<device>2 with cryptroot=/dev/disk/by-uuid/<uuid> for that particular partition.

Now, if all goes well, you should be able to reboot into your new Alpine Linux system.

# ln -s /usr/share/zoneinfo/America/New_York /etc/localtime
# adduser <username>
# adduser <username> wheel
# apk add doas
# echo "permit :wheel as root" >> /etc/doas.d/wheel.conf
# setup-xorg-base
# apk add xfce4 lightdm lightdm-gtk-greeter dbus xfce4-terminal \
	xfce4-screensaver firefox openssh git gpg gnupg-scdaemon libfido2 \
	openssh-sk-helper pcsc-lite fido2 pulseaudio pulseaudio-alsa \
    alsa-plugins-pulse pavucontrol pinentry-gnome
# adduser <username> plugdev
# adduser <username> gnupg
# adduser <username> audio
# adduser <username> pulse-access
# addgroup autologin
# adduser <username> autologin
# sed -i.bak 's/^#autologin-user=.*/autologin-user=<username>/' /etc/lightdm/lightdm.conf
# /etc/init.d/lightdm start

Now, if all has gone well you should be greeted with a login screen. Once you've logged in the first time, subsequent starts of lightdm will have you automatically logged in. ( Which is fine, considering we have an encrypted root )

From the terminal you can now have the login manager start on boot:

Congrats, you can stop here if you'd like.

$ doas rc-update add lightdm default

(Optional) Switching to the `dwm` window manager

There are a lot of tutorials on dwm out there, I'm not to make one here, just to simply outline how I compile and set it up on Alpine Linux ( and, the process is very similar on most linux distros )

First let's install the required packages:

$ doas apk add build-base xorg-server-dev libxft-dev libxinerama-dev libxrandr-dev

The easiest way to retain automatic login and all of that is to simply add a session to lightdm:

$ git clone https://git.riedstra.dev/x/session
$ cd session
$ make install

Now you have a custom session that can execute your ~/.xinitrc on login, just as if you used startx.

A basic ~/.xinitrc example:

$ echo '#!/bin/sh
# If you'd like, you can source other files here.
# . ~/.kshrc
# Useful if you're running oksh
# export ENV=$HOME/.kshrc
$(eval ssh-agent)
# See https://git.riedstra.dev/x/dmenu for the patch and script
export SSH_ASKPASS=dmenu_askpass
# Add SSH keys if you'd like.
# ssh-add ~/.ssh/keys/<key>
# Optional, compositor. You'll have to install it yourself
picom --config /dev/null &
# Start a program to update the status bar, I just use a short shell
# script with `xsetroot`
status-bar &
# You can use `feh` directly or similar. This is just a shell script that
# sets the wallpaper every 15 seconds, so when I change screen resolutions it
# goes back to normal.
wallpaper ~/.wallpaper.jpg &
# If you want to inherit xfce settings
# xfsettingsd &
# Alternatively you can set the gtk themes and such directly.
# Finally, do not forget that all of the commands above either need to finish
# or fork to the background (`&`) otherwise we don't get here and it appears
# that your login "hangs"
exec dwm' > ~/.xinitrc
$ chmod +x ~/.xinitrc

Finally, fetch and make dwm:

$ git clone https://git.suckless.org/dwm
$ cd dwm
$ doas make clean install

If you'd like my version of dmenu which includes dmenu_askpass for SSH keys:

$ git clone https://git.riedstra.dev/x/dmenu
$ cd dmenu
$ doas make clean install

Now you should be able logout, and login under the custom session and be greeted with dwm.

Some additional packages you may like to add:

$ doas apk add slock xsetroot lm-sensors feh slock st # dmenu, if you didn't install mine

(Optional) System suspend without pm-utils and root/sudo/doas

If you want to be able to quickly suspend, say from dmenu I have a useful c shim for that:

$ doas apk add build-base
$ cd $(mktemp -d)
$ curl https://git.riedstra.dev/mitch/dotfiles/plain/bin/zzz.c > zzz.c
$ # This may be where you wish to read the file you just downloaded :-)
$ cc -o zzz zzz.c
$ export dest=/sbin/zzz
$ doas sh -c "cp zzz $dest && chown root:wheel $dest && chmod 6750 $dest"

Once you're done, zzz should work to suspend the system for any user in the wheel group

If you're interested, you could also clone down the entire git repo and use the makefile in bin/

(Optional) Backlight control without root/sudo/doas

In a similar vein to the zzz program:

$ doas apk add build-base
$ cd $(mktemp -d)
$ curl https://git.riedstra.dev/mitch/dotfiles/plain/bin/backlight.c > backlight.c
$ # This may be where you wish to read the file you just downloaded :-)
$ cc -o backlight backlight.c
$ export dest=/sbin/backlight
$ doas sh -c "cp backlight $dest && chown root:wheel $dest && chmod 6750 $dest"

Once you're done, backlight <percentage> should work to adjsut brightness for any user in the wheel group.

It simply tries to deciver backlights in /sys/class/backlight, out of the box this should work on most intel and amd systems.

If you're interested, you could also clone down the entire git repo and use the makefile in bin/

(Optional) Bluetooth

# apk add bluez bluez-alsa

# rc-update add bluetooth default
# /etc/init.d/bluetooth start

From there interacting with bluetooth is pretty straightforward:

# bluetoothctl
[bluetooth]# scan on
[bluetooth]# pair <MACADDR>
[bluetooth]# connect <MACADDR>
[bluetooth]# scan off
[bluetooth]# <c-d>
#

Optionally you can also issue a trust <MACADDR>, useful for keyboards and such.

Bluetooth audio should work out of the box.

(Optional) Enable Network Manager

From just about any point in our install process you can install NetworkManager if you're having troubple with manual network configuration

# apk add networkmanager networkmanager-tui
# setup-devd udev
# /etc/init.d/networking stop
# /etc/init.d/networkmanager start
# nmtui
# rc-update del networking boot
# rc-update add networkmanager boot

(Optional) Disable SSH

If you're not going to be logging into your system remotely, you might as well disable the SSH service.

# rc-update del sshd default

(Optional) Setup WiFi with `wpa_supplicant`

Create a configuration file:

network={
	ssid="<your network name>"
	scan_ssid=1
	key_mgmt=WPA-PSK
	psk="<your network password>"
}

Then run:

# wpa_supplicant -i wlan0 -c /path/to/conf &

That should spit out a few messages, and return you to your terminal.

From there, get a DHCP lease:

# udhcpc -i wlan0

Now you should be hooked up to the wifi by-hand for now.

Selling out your future to ease the moment

2022-12-29T19:30:00-05:00

Selling out your future to ease the moment

Thursday December 29 2022

Selling out your future to ease the moment

This concept applies to so many aspects of our lives. Debt is the classic example. I won't be covering that one here.

The technical aspect is a lot more subtle -- we all deal with these kinds of problems, and we only have so much time in the day -- so we tell ourselves that we're going to simply do what is expedient rather than what is correct. Perhaps even, not to figure out what was wrong in the first place.

Over the past couple of months helping several people take on learning how to write code, running Linux, or networks the same pattern has come up.

Let's take a common example for people starting out with Linux. Dual booting -- something fraught with issues -- or at least that's what everyone says.

A common problem is, Windows, or Linux, for that matter to stop booting one operating system, or the other. Why? Well, the causes can be varied. For the purposes of exploring the idea at hand, let's say we don't care and just re-install the OS.

What have we said to ourselves in that process? I don't know about you, but re-installing an operating system is not the first thought I have, even if it comes up it certainly isn't a fun idea for me. I think the same holds true for most. You'd much rather just fix the issue at hand, if possible.

If you knew for sure it'd take twenty minutes to fix the issue, I think most people would try to fix it. The problem is, as we all know, it's not likely to take twenty minutes. It may even take you twenty hours the first time. If you know that up front, well, many won't make that time investment.

Say that it does indeed take you twenty hours to troubleshoot that boot issue. For many people that may be two, three, or even four times more time than it'd take to re-install the OS. The choice seems clear at that point -- just re-install the OS.

The re-install is also a hammer of sorts, it's really simple, you know it's going to work -- and, you've probably done it before.

Now, what's not clear, is that the future, specifically your future is not taken into account.

The odds are that if you encountered an issue in which your system couldn't boot due to configuration you're likely to encounter that again if you just re-install.

What happens in that future where you have already invested in your re-install paradigm and your system won't boot again?

For most, this would take the wind out of their sails so-to-speak.

I see this too, with people learning a tool like git, so many would rather just delete the repository and clone it back down and re-do their work rather than learn how to solve a merge conflict.

Again, it might be faster in the moment -- it might only take you 20 minutes to copy over your changes or re-write your code by hand.

It might take you an hour or two to figure out what a git mergetool is, install meld ( that is, if you're not using vimdiff or something ) and figure out how to use it.

Still, one sabotages your future, keeping your handicap, while the other invests in your future working to absolve you of that limitation.

Why do people take this approach to keep their handicaps?

Humans in general seem to invest in what has worked in the past -- regardless of efficiency or practicality.

It takes some serious, conscious, effort to try something new for most. If there's an unknown on the other side of trying that new thing it becomes even more difficult to sell.

To get abstract for a bit, we also see this throughout history. What's the percentage of the population that was able to change the way we live for the better? What's the percentage of the population that brought us the various inventions many of us rely upon on a daily basis? If you don't already know, it's vanishingly small.

Now, I'll recognize that invention also necessitates intelligence to the right tail of the distribution -- but that's not sufficient. Personality factors need to be at play to prevent social pressure from killing anything new, as most wish to preserve the status quo.

The same pressures at play in one's own head regarding their approach are extrapolated upon others with social pressures.

If you consistently try new things, it will make some people mad. They're invested in the way they've done something.

Just think about it for a minute, were the whalers happy when Standard Oil et al came in with a cheaper product? No, probably not. Regardless, the world is better off, a healthier place, and less whales are dead for it, despite their disapproval.

Far more people possess the pre-requisite intelligence for truly great things than are able to apply it to that effect.

Now, don't be your own enemy. Invest in your future, to hell with the social disapproval and delusions about saving time, you have your future to take care of.

Mitchell Riedstra's personal website

Setting up FIDO2 backed SSH keys on MacOS

Setting up FIDO2 backed SSH keys on MacOS

Why Software Engineers don't avoid Complexity

Why Software Engineers don't avoid Complexity

Rootless Podman on Alpine Linux

Rootless Podman on Alpine Linux

Alpine Linux on a Laptop How-To

Alpine Linux on a Laptop How-To

Boot into the Alpine Linux ISO:

Now let's partition the disk:

Mount the filesystems and install

(Optional) Switching to the dwm window manager

(Optional) System suspend without pm-utils and root/sudo/doas

(Optional) Backlight control without root/sudo/doas

(Optional) Bluetooth

(Optional) Enable Network Manager

(Optional) Disable SSH

(Optional) Setup WiFi with wpa_supplicant

Selling out your future to ease the moment

Selling out your future to ease the moment

(Optional) Switching to the `dwm` window manager

(Optional) Setup WiFi with `wpa_supplicant`