And record to the cloud.
Oh no. Oh no.
Welcome folks. This is the November meeting of the St. Louis Linux Users Group. And we had a very special speaker tonight.
Michael Lucas who will tell us about TLS and its implications in today's network world. In the meantime, do we have any announcements or burning problems on anybody's mind that we can solve in 35 s.
Okay. I lost the buttons.
Who's got the button?
I don't know, I can't find the buttons. Where'd all the buttons go?
Yes.
Damn.
Oh help.
And let's see, it looks like James didn't make it either, so. I can't draft him as our official Linux Group MC.
Now. Let me go ahead and share the screen again. And make sure you do a quick run through the.
Of the slides. Okay, this is the St. Louis Linux users group.
No. Where is? He started the special interest group of the Unix group in St.
Louis. And usually it's our meetings are 8 days after the St. Louis Union Shooters Group Journal meeting.
And that may be either the second or third Thursday of each month, depending on how the calendar falls out.
St. Louis Linux Users Group is sponsored by the, Linux group is sponsored by Slug.
And they pay any room for these when we go back to if we ever go back to, face to face meetings.
They provide email and web service for us. All the meetings are, however, free and open to the public and there's no individual membership fee.
The general here is, from 6 to 6 30. Is a rival time for testing your chat.
Your microphone is sound and the screen recording and all that stuff. After that, we start with introductions, announcements, the call for help, archives.
Point out about the archives in our calendar and our mailing list and the sponsored meetings and then it's 6 by 6 45.
Yep, the call for help doesn't go too long. With the presentation topic will be thrown out there.
After the meeting, further discussion is possible. When the on our mailing list or after the presenter, it gets started talking at us.
The recorded chat and the slide works and video and everything go on our archives usually within a few days.
And our chairman is James Conroy. Are you not here or M? Normal MCs, Gary Meyer, who is not here.
Our host, Legal Emer. A vonni tech thankfully he's here cause he turned the machine on.
And I'm here, I'm Stan Reichardt. I do the production. I try to get a lot of things going here.
And whoops, that's strong. And the speaker is not Ken Johnson. I forgot to change that.
We'll have to change it to whatever it is. Anyway, announcements, daylight saving time ended Sunday.
So if you're not here, You're probably late or early. I forget which it is. I can't figure it out.
I've been going all week and I don't know what time it is. We You want to talk about the volunteers needed for upgrade?
Yeah Are all of our services run on a cool little block VM that's been around Debian.
Has been around for, Morty about 10 years now And we're getting bought right together, getting ready to pull the trigger on our 10 to 11 upgrade.
But we've got a couple issues we need to work out. We're trying to figure out what to do with Mailman.
If we can get the upgrade down now or if we should punt. And I'll send it since it is still supported in Debian 11 And if anybody would like to help out, doesn't have to be.
Very you don't have to be very knowledgeable, sometimes as an extra pair of eyes helps to do some research and put notes together.
If you want to actually dig in under the covers and and help out with the keyboard work that's appreciated also.
There is a list that we have called, If you would like to be honored to send email to editor at slug.
Dot org. And we will add your name to the list and that's where we. Maintain all our discussions of the nitty gritty technical work.
It is not a public list. It is a private list so it doesn't show up on the webpage.
Although if you know anything about mailman, you can change the link. On the end of the URL to sysadmin and you can see it anyway.
Okay, okay. 12 days from now, the fourth Tuesday is gonna be the new Linux meeting.
Sometimes it's 5 days after this meeting, but this month it's gonna be 12 days because the way calendar lines out.
After that the first Thursday the following month is going to be the slack, meeting.
Gary wanted to talk about Google. Com, purging accounts that we're not using the last 2 years.
I think a lot of people have, a Google email as a secondary email. If you haven't signed in in the last 2 years, they, they're going to start purging those, those accounts.
That's about it. Stan, one thing I just, I just realized. If you have an Android phone, you have a Google email address.
Because you have to have one to sign up for the Play Store. So don't forget about that.
If you don't want that email to disappear, you better, take action.
I would I would kind of think that if you use the darn thing every day It would that would kind of
But I mean, you may have gotten it to sign up for the Play Store, but never use it.
Oh, okay.
If you saw what I'm saying, you know, there's no reason to use it. If you're forced to get it to use your phone.
Yeah.
So if you're not using it. You know, you could get hit with inactivity. Here's what I'm saying.
Okay, well all this technology is well beyond me. Okay. I guess is that enough of announcements?
I probably.
Yes? Okay, is there maybe a call for help you said 30 s? Yeah. Okay.
Well, that doesn't have to be. I was being facetious, but, you know, we, we can't, we can't stop the war in Gaza, so.
Let's keep it to something we might be able to address.
Okay. Before we get into our actual, presentation, if, if there's no other things going on, I'd like to.
Make sure I mentioned the presentation archives. There's our links on all of our web pages. And if not, you can do wwsloo.
Dot org slice resources, nice presentations and it'll come up to that page. And that's where we record stuff.
Or put the presentations. Either the Zoom recordings. Or if necessary the backup recording that I do.
And I think we've only in the last 3 years, we only had to do that twice. Anyway, it will also have a calendar.
Yeah.
And on our calendar, our sponsored meetings are highlighted in red. And we might display that a little bit later.
And then after that, we did mention the mailing list we have. And that's those are available off of the web pages.
And the one to mention all 3 of the sponsored, special interest groups, the same, this St.
Louis Linux user group is one of them. Where we do Linux oriented presentations primarily. The Slack meeting is where we do configuration workshop and it's hardware and software, agnostic.
We've even had, Phil, one of our primary troubleshooters. We, I can remember he.
He got a, Linux box, printer going for a guy at one of our meetings.
Surprisingly, we can do a lot of help, configuration wise, even remotely, with just what kind of talking people through the troubleshooting process.
And then of course there's the for my new Linux users group. Which is a beginner workshop that we have.
And before we go, well. I'd like to mention the topics here in this meeting are. Primary focused on Linux.
Either personal or enterprise. And hopefully the presenter send any notes or PDFs and scripts and slide work to the editor Schlug.
For inclusion on our archives later on. And it'd be up to the presenter whether he wants the audience to hold questions to the end or not.
And then after he's done, additional discussion is appropriate and we'll keep the meeting open.
Until people get tired of looking at each other. Any other feedback? We're open to questions at this point.
About the general meeting.
Okay, in that case, I'm gonna stop sharing my screen.
Whoop. I don't know what happened here. Wrong button.
Go ahead.
I'm sorry, I do have a question. How do you go about joining the organization?
Well, attending the meetings is essentially Okay, you're considered as a member and you're considered as a member.
After attending 2, meetings in a calendar year, you can actually vote in our February elections.
There's no fee involved. And, so. You show up again, you remember.
Okay, thank you.
Okay. I, you know, I guess, I don't know what else to say about that.
And
Okay.
Oh, Sam, I got a couple of comments. There's also the mailing list.
Pardon me, I just, just got on, so I,
Well, I did that, Gary. You're day late the dollars short, you know.
Okay. That's what I, okay, long it's already been covered. Thank you.
Yeah, okay. You might want to talk about you always want to talk about the calendar though. If you said anything about the calendar.
Let's see, calendar, there is a thing called the Amazon AWS reinvent conference.
It's an annual thing. It is the last week of November. It's a Monday through Friday conference.
I believe it's in Las Vegas. I haven't checked if you can attend online or if it's only physical.
But, it's on our calendar, so if you're interested in AWS, check it out and see how it teach you.
Let me see.
And, and I presume if you find out additional information, you'll put it on the calendar, right?
Yes.
Cause we're constantly updating these things and, you know, from minute to minute it can be updated.
Another thing, totally different. Google announced last summer that inactive Google accounts Gmail accounts, other accounts will be deleted as of December the first, which is 2 weeks away now.
So if you think you have a bunch of old photographs that you've left our archive somewhere out on Google.
Or other things that you've left on Google, old email, you've got 2 weeks. And if that point, Google decides your accounts been inactive for too long, it can disappear.
So that's mentioned. In an email I sent last week to discuss and so check out the details.
I'm I don't know all of Google's rules for what constitutes an active so Yes.
Okay, that's a that's a little bit more than we talked about a little bit earlier.
You should have been here early, Gary.
I know I should have if it wouldn't have been for those large fire trucks with the flashing lights that were blocking my way I would have
You just stop carrying matches, okay?
That's it. That's it. And lastly, just for the sake of history, on the calendar, I believe in about a week and a half.
It's the fortieth anniversary of back auto buying timeshare. 40 years ago timeshare was a of a big thing and not so much individual or private use.
Of the internet. But just the beginning of getting corporations onto the internet businesses and Mac Auto buying them really put them kind of in a very visible position, so a little bit of St.
Louis history there.
And that's the cow.
Is there some kind of thing coming up next week about some kind of bird?
Family thing.
Gobble, gobble.
It happens in November.
Oh, yeah, yeah. Yeah, I think it's the Tweetie Bird, running away from the road right now.
And road run, running away from the coyote. No, no, it's not it either. I don't know.
It's one of those feathers stories I think. Okay.
Okay. So happy Thanksgiving, everybody. We hope you have a pleasant and wonderful time with family in France.
And appreciate what we got in this country.
Okay.
You know, important thanks to. Stay and Lee and a whole bunch of the other people who always really contribute to this group.
Help pull things together and get videos archived out there. So thank you. All who have been very helpful for a long, long time.
So.
Okay, I think it's time to introduce our main speaker. Do you remember who it is?
Okay. Yeah.
Let's see if I if I could only remember Michael Lewis. But, Michael is a noted author.
Got a nice list of books out there. Notice a number of them are BSD. And a number of our users have been saying that they'd love to hear more BSD talks.
This week. Frequently have more Linux than we do BSD. But, one of the Michael's other pursuits has been this, internet security thing, the transport layer security.
And that's what he's here to talk about tonight. And we're looking forward to it.
A number of people. Who told us that and so I'm gonna turn it over to Michael.
Michael, there we go.
Thanks. Hello, can you still hear me?
Yes, we hear you now.
Yes, we're good.
Okay, I'm
Got to see if I can share this.
Can you see a big blue screen? With a few words on it.
It's kind of wide on our end.
That's okay.
We see. Thanks. Transport layer security at 2023
Okay, and if Zoom says it's white, that's fine. Hi folks, thanks for having me.
Hello.
Hey Mike.
Hey!
I'm gonna ask you. If I was giving this talk. In meat. I would.
Take questions whenever, but since we're online, I'm gonna ask you to hold until the end.
Just because the format is is. A little clunkier than all of us being in a conference room.
Okay, alright.
So.
Okay, I hope you numbered your slides.
Okay.
Numbers are for the week.
Yeah.
Okay.
Okay. Who am I? Why did these people invite me? That stack was from 3 years ago, one copy of every edition of every book I've written.
Yeah. Okay.
Wow.
So, I've had to get a bookcase, but there's nothing quite like that picture, so.
Okay.
I have been using Unix since the late eighties. Mostly a BSD guy.
And I recently. For my sins wrote a book about TLS.
So, what I'm gonna be talking about. What TLS is. What certificates are.
The whole revocation and invalidation thing.
. To walking the westbound lanes of the Baybridge, this arrow highlights where it's all happening
And traffic.
Then. See, SR, ZACHME and related topics. And mostly we're going to be talking web servers.
The tools I'm focusing on are Open SSL or LIBRI SSL.
Which of the command line is indistinguishable. For the most part. And These things were tested on Centos, Debian, 3 BSD and Open BSD.
So, transport layer security. If you've used Linux, if you've used any kind of Unix.
If you have bought things on Amazon, you have seen that little lock on in your browser. And it has said something about a secure website and it Sis-admins, you've probably heard TLS this and that and
I'm gonna start off by saying what it isn't. TLS does not add security.
Whatever that is. I have no idea what the word security means anymore. But TLS ain't it.
It doesn't block intruders. It doesn't keep your credit card secret and it doesn't stop password theft.
These are all things that TLS can play a part in, but it doesn't really do that.
TLS does one specific thing. It encrypts traffic between. A client and a server.
I'm sorry. It does 2 specific things. And it authoritatively identifies the server, the client, or perhaps both.
That's it. Nothing more.
Now TLS has been around for a while. Back in 1994. Netscape, the the company that
Created the Mosaic web browser. And really started the web as we know it today. They decided that they wanted e-commerce to be a thing.
That meant that they had to secure traffic in transit. And the people in house slam together secure sockets layer 1 point oh Thereby demonstrating an important lesson in cryptography.
Any cryptographic protocol developed in house will fail. And it will fail badly.
And you'll notice a year later. They rushed S the cell version 2 out the door. And then they hurried version 3 out.
Basically patching holes as quickly as they were found and they were found very quickly.
Other companies became involved. Discussions about transport layer security. Got more inclusive. And in 99.
TLS version one. Which you could say is the same as SSL version 4, but.
Microsoft categorically refused to sign off on any protocol. Named by Netscape. So fine, TLS it is.
And then we've had these subsequent versions that have come more and more slowly. Now, more than one cryptographer told me that TLS 1.3 from 2,018.
Was the first version that wasn't rushed. And that they considered to have a proper cryptographic design.
So, I see a bunch of gray hair in the audience, which is grand. Any of you remember John Pastel?
One of the. The. Primordial internet architects. He was the guy who Originally assigned IP addresses.
And he kept the list. In a paper notebook in his desk.
When the US government tried to take over the root servers, he sent one email and stopped it cold.
And he had this general rule for the early internet. Be conservative and what you do, be liberal and what you accept from others.
The idea being that We want to work together. We're going to do our best to follow the rules.
But if someone else screws up. They're mail server will try to work with it. And that sounds wonderful.
You know, we all wanna just get along and get on with our jobs and make things happen and get done with it.
And, and that's great for, you know, web servers, HTTP, 0 point 9 or whatever, database engines, older SMTP.
And so long as you don't allow spam, sure, fine, we'll get by.
DNS is a little more if he but still If you don't allow bad things to be done.
We're okay. Older versions of TLS. We treat a little differently. They're, actively bad.
Mainly for something called downgrade attacks. If you if I can convince a server to support a cryptographic method that an intruder can decrypt
Then I'm deliberately weakening the connection. And this is applicable to all kinds of encryption.
Not just TLS. And the only real solution. Is to refuse to accept. We encryption.
For example, suppose I get between Stan and Amazon. And I can convince Amazon to speak SSL version 3 to stand.
Well, I can capture his username and password credit card numbers or whatever. Because SSL 3 is just busted.
Or I could change your order in transit, I could order more things for you, your account is basically mine.
So what does disabling week encryption mean? Well, All versions of TLS except 1.2 and 1.3 are known to be breakable.
They are officially deprecated. Do not use them. Supporting them threatens your customer data.
Your business, everything, and all the privacy. Now, in early 2021, the United the national security agency.
You've probably heard of those people. If you're really good at math, they try to hire you.
They strongly discourage many common TLS 1.2 settings. And the NSA has this distressing tendency.
To predict what's about to be broken by someone else.
Unfortunately. There's no. Government standards compliant, web browser that can speak just TLS 1.3 last I checked.
And we can't really turn off TLS 1.2 on general internet sites. So.
At some point before long you're gonna see it TLS 1.3 or get out.
So.
Encryption. TLS is built on encryption, public key encryption. You have your public key, you have your private key.
And Cryptography is a great hobby. With huge amounts of math. And sysadmins love to argue about it, but.
Now I'm a sissed man and at 1 point I held very strong opinions, but the truth is
I've been doing this for 30 years and the truth is I don't really get to have an opinion.
I could parrot someone else's opinion and hopefully that person knows what they're doing. We have no choice but to trust actual cryptographers.
There's one person who knows that I know who knows how it works on this call but I'm not gonna throw Bob under the bus.
That would be rude. So, and we've got to trust the experts. This is why standards body.
Like Phips exist. Phips moves very slow and plunky. But they're make an effort to give us someone to trust.
In any case, regular assistants should not be hand-tuning ciphers and algorithms.
We're just not equipped for it. A key part of real IT skill. Is admitting what you don't know and not engaging in occult gossip-based IT.
And I bring this up because when I sent the TLS book up for review Half the feedback I got was people.
Arguing about particular bits of cryptography. Without really having the background to do it. This misinformation is rife everywhere and Oh, I've got to tell you we need to trust the people who know the math.
So. The essentials are really you've got to protect your private keys. Use open Ssl's high cyber list.
That includes. What is safe today? And they will update that list when they need to.
If you think your private key has been stolen.
Remove the certificate. Revoke the key. And start over.
Another key point of encryption. Is who to trust. And this is the definitive problem of any encryption scheme.
We basically have 2 competing models. One is called the Web of Trust and this is used by PGP.
And. Don't get me wrong, I would love for PGP to be a solid usable thing, but It requires transitive trust and educated users.
And the older I get, the more I think that if user education was gonna work, it would have worked by now.
Certificate authorities are just easier for users. And TLS is about end user trust. So that's what TLS uses.
A certificate authority is basically a single entity.
That you trust to verify the identities of people hosts and organizations. Oh. Okay.
I'll heckle you once, Michael. It's actually in Chrome, it's a hundred 31 entities and in Mozilla it's a hundred 44.
Okay, Bob would know. I'm not gonna look, it would just make my night worse.
So certificate authority verifies what all these things are and each of them has. What they call a trust anchor certificate.
This is a certificate that They issue and they say. We will sign the entities we verify with this.
And the certificate authority issues. Sir certificates for host and users. To clearing that they have audited.
This entity and verified the identity and they issue a certificate signed with that. Now, client software. Comes with a bundle of these trust anchors, these ultimately trusted certificates.
And there were 6 entities that provide bundles. Microsoft, Apple, Google, Mozilla, Adobe, and Oracle.
Different software. Uses different trust anchor bundles and not all certificate authorities are all in all trust bundles.
If you piss off Oracle. They will drop your certificate and there's nothing you can do about it.
Same for Microsoft and Google, etc. Each of these entities publishes requirements to be included.
And They're all slightly different, of course.
So what most of us use most of the time, cause we have a bunch of Linux and, people here.
And even a few BSD people that followed me in.
Is the open SSL trust bundle. Oh, sorry, the Mozilla bundle that most open SSL installs include.
The Open SSL people generally decided that Mozilla was the least troublesome of all of the bundles.
The catches every operating system has its own way to manage these bundles. If you need to add a certificate.
You can poke around the system and see, oh, here's a directory of certificates.
Let me dump my certificate in there. A lot of sisabins do this. The problem is every Linux distribution.
Bsds unix everyone has their own way to manage this and an upgrade may Overwrite.
The certificate you added. Now, if you're just testing. You can use Open SSLs, minus Ca file option.
To trust a specific search for a specific command.
Sometime for your own edification, grab one of these trust bundles. And look at the contents.
And, my first thought upon doing this is who are these people? Who is the Shanghai Electronic Certification Authority?
All of these governments. Should I trust the US government? Should I trust China? Should someone in China trust the US government?
Nigerian, my main IT involvement in Nigeria sadly has been email asking me for help getting money out of the country.
Should I trust their government? This is
The thing here is these entities need us to trust them. The question is, do we need to trust them?
And this is the root question of the whole Ca model. I'm not gonna belabor it any further, but it's a great argument to have with a bunch of nerds in a bar.
We just love this argument, it seems.
Now you could look at this. And say I'm gonna strip down the Mozilla bundle and I'm gonna get Only the certificate the root certificates I really need and truly trust.
Hello. It's educational, but not exactly useful. Everyone I know who's tried this has given up.
Now, what is useful is you could in your organization Have some of your applications use a custom in-house.
Trust bundle. Suppose you said that every certificate in your organization. The mail server certificate. The LDAP servers and Everything would only use certificates signed by Verasign.
You could remove all the other certificates and leave just the verasign certificates. Trust anchors.
And if any certificate that violated your verasign only policy got installed. It wouldn't work. Now, I've never worked in a company that paranoid.
But it can be done and there are organizations that do that.
I have worked for a company that paranoid, several of them.
Okay. And for those who came in late, the guy who just interjected, Bob Beck is, He's my TLS expert on tap.
He actually knows the math, so.
When we talk about CAs, you'll probably hear about this chain of trust and you may have seen a diagram like this.
The certificate authority has their certificate. And they sign your certificate. And like a client looks at your certificate, sees that it's signed by the route.
But sorry, by the trust anchor. And boom, it trusts it. Yeah, I trust the certificate authority, so I'm gonna trust things that it's signed.
Great.
That's a very early model.
We evolved to something more like this. The true trust anchor is supposed to be very tightly protected
So they, but they have to have people sign certificates. So what they do is they have the actual certificate.
Stored in a vault, underground, protected by rabid wombats. And they have that sign like a day to day certificate that signs actual clients.
And that gets run on the servers and does the work and they let the the trusted people handle it.
This protects the trust anchors private key. Now the thing in this kind of model is You as the sysadmin configuring a web server.
You must include the intermediate certificate. In your server's configuration. The clients will not go out and fetch it.
You, must put that chain file on your server.
Today, you'll see something that looks more like this. Multiple. Trust anchor certificates, signing multiple intermediates.
Signing your certificate.
This is what we call, resiliency or redundancy. If one of the root certificates is breached and revoked.
Or one of the intermediates, which is more likely to be breached and revoked.
There's still a valid path. And so long as the software can find one path, the one trusted root anchor, trust that one trusted.
Root certificate. Everything is fine. You have to include both chain files when you do this.
And, this is where software goes wrong. A few years back. A trust bank or certificate of expired.
Everybody thought it would be fine because They signed their certificates with The newer one as well. Well, it turns out Open SSL couldn't validate that other path.
Everybody had to update their Open SSL installs. Like immediately.
And That seems bad, but it's worse than that. For example, where do new trust anchors come from?
Often their intermediate certificates that get Promoted. And the software must be updated for this forever.
And there's a question, yes, certificates do expire. They all have an expiration date.
You if you are doing anything with TLS, you must commit to updating. Your open SSL or Library SSL or whatever SSL you're using.
Forever.
So these certificate things, what are they?
Well, that certificate is an identity statement. We use x. Dot 509. What just the international telecom telecommunication unions?
Digital certificate standard. It's based on ASN one, the same standard used by SNMP and Telecom.
And I'm not going to say that ASN one is mind meltingly horrible. But I will say that I wanted to write a book on TLS.
And the book on and I wrote them one after the other. So that
I didn't have to load ASN one into my brain to twice. I could do it once and be done.
So you don't really need to know way of send one. But. At times you will see something like this long, horrible string of numbers and periods I've put here and you've got to be able to go aha that's a bit of ASN one that my software doesn't know.
It's time to update. Update yourself to receive it's picked up.
And because we've never met a standard we didn't like. X 509 also pillages the x 500 directory standard.
That you might know from LDAP. And x 500 gives information labels like these OU.
OST and so on. That you and each of those labels. As a specific meeting. And an ASN one identifier.
And a certificate expires. The ones that you get will usually expire every year or every 90 days.
The trust anchors have a much longer lifetime, but they are private keys are also guarded by rapid wombats.
So what's in a certificate? Well, there's a few things in and around it. What most of you have probably done at some point.
Is created a certificate signing request. This is a form that says, please sign me. And you send it to the certificate authority.
Once you have the certificate, this is trash. It includes a public key. But it has a private key file that goes with it.
That that is its mate. That private key is the secret for your certificate. So long as you keep that secret.
People will have a very hard time breaking things encrypted with your certificate. A certificate file itself is an extract of the information in the CSR that is signed.
By the Ca. Then that your server needs both your certificate and the private key.
And yes, if the intruder captures that private key file, they can use the certificate and pretend to be you.
Protect that private key.
No. The main purpose of the certificate. Most of us see is that we get that little lock icon in the browser.
That says this is a secure web page. Again, I don't know what the word secure means.
But significant authorities provide 3 levels of validation.
They can verify it with domain validation. They verify that the entity requesting the certificate. Controls the host that the CERT is for.
If I want a certificate for my website, MWL. Dot I/OI must prove. That I control the host.
Yeah, done. Organization validated.
Verifies that the entity requesting the certificate belongs to the organization. That controls the host the service for.
For example, If I want a certificate. 4. The Ford Motor Company.
Organization validated would say would do the work to verify that I work for Ford. And they would reject the request because I don't.
Extended validation is where they crawl into your personal life. And verify that you are a particular legal entity.
Now the important things about these is one, each level is more expensive than the one before it. And 2, all of them give you the special lock icon.
And do you need these others? Well, are you a bank? Are you a financial institution? Are you subject to regulation that says you must do this?
Other than that, no.
So certificates are also signed with cryptographic algorithms. I'm wait, we have 2 kinds that get used on.
Certificates commonly today. RSA is old trustee. It's our friend. We use RSA encryption.
Oh, over the place. The key length dictates the strength. And 2,048 bits is the current standard.
And once you start looking at longer key lengths, you hit points where like, If every atom in the universe is a super computer.
And could root force RSA. Computations. It would take longer than the projected heat death of the universe.
So it could happen, it's not going to. You see DSA is the newest standard.
It doesn't go by key length, but instead uses these things called named elliptic curves.
It's about as strong as RSA, but it takes less computing to validate.
Now, you can use, you can have dual science certificates. Which should you use for the most part I tell people just use our Unless you are.
Targeting small systems like if you want to make a phone do a bunch of validation. Use ECDSA.
It'll keep your battery from being sucked dry.
The common name is the most recognized part of a certificate. Everybody here has seen a common name, CN.
In a certificate.
Now this could be an email address. A user idea, first and last name, a serial number, anything like that.
Yes, you can get a certificate for a particular serial number device.
Now, up until the year 2,000. CN was used to store host names.
You might note that it's a wee bit past the year 2,000. When this was deprecated and yet.
We're still using it.
It's wrong. Some software expects to find a host name there. Because that has kind of stuck around in people's brain.
But we are actively working to exterminate this. And I believe web browsers are starting to no longer check that.
Finally! A quarter century later.
Why would they deprecate this? Well, A CM can have a maximum of 63 characters and domain names can be longer than that.
I have here. Yes, I'm a nerd. I buy. Domain names for really bad reasons.
But the domain, you keep using that word. I do not think it means what you think it means.
Dot com. Israel and live and I wrote this book with the Princess Bride as a motif.
Because I could. So, that will not, dot, dot, dot, dot, all of that.
Will not fit in a CN.
If you're, if you point your client at that. And it's that checking.
For for the modern standard it'll break. So the replacement is called server alternative names or SAN and and we'll get to what that is.
To look at a certificate. Here we have open SSL. Our first command. The sad thing is if you run enough open SSL commands they start to make sense.
I don't recommend achieving that state.
Anyway, the Open SSL x 509 command. Means we're going to work with.
It's 509 certificates. The in. Argument gives you what you're dumping in.
The minus text. Says show it to me in text form. And the no out means skip some of the cryptographic garbage.
And this will spill out. The certificate chain, the identity. Identified entities. Any extensions that are on the certificate and what have you
Now these modern certificate host names are in this thing called subject alternative names, SAN.
And you can specifically pull those out of a certificate. You can. Specifically pull out any piece of information you want from a certificate in a single command.
That's why Open SSL has all of those arguments. You can do everything. Oh So.
As you play with certificates, you may learn of this thing called a wild card certificate.
A certificate that's good for any host in a domain or a sub domain. Like. Asterisk dot MWL. Not I/O.
I could get this one certificate. And install it on all my servers and and be done with this problem.
Isn't that wonderful? Well, except that I have to share the private key across all of those machines.
And one host gets compromised. Everything is compromised and to be blunt, intruders are sneakier than I am paranoid.
I do my best, but
There are a whole lot of hackers out there. A whole lot of worms, a whole lot of people trying to break in the servers.
And there's only one of me.
The same is used for a wild card.
Sorry, we've hit cough season up here in Detroit.
The safest use is to have on small auto deployed systems like, you know. If I had API systems.
That my web service called, I might try it there.
So I've, I've talked about the private key, but what happens? If your private key is stolen, if you think someone Got their hands on it.
Well, the technical term for what you do is revoke the certificate. You contact your Ca and you tell them.
This key has been compromised. And they will flag it as revoked. And they will distribute that information to the clients.
It's they are distributed by 2 different methods. The certificate revocation list. And the online certificate status protocol.
We'll talk about those, but. Now, Firefox and Safari distribute a full list of revoked certificates to their clients.
Cool. Does editing. They only send clients. The revocations that they consider important.
Now I run a small business. I actually have a web store where you can buy. My ebooks direct from me.
Nothing fancy. So. I revoked. My certificate on that side at 1 point.
And then I checked to see. Who showed that certificate as revoked? Firefox and Safari caught on within about a day.
Chrome users never saw it.
So I can't really recommend Chrome for trust.
If your business is small. Or if you're in a country that Google just doesn't pay a lot of attention to.
You've got to assume that Chrome users will never see your revocations. And, and that's just how it is.
So the first method, these certificate revocation lists. The Ca has a file. That contain serial numbers of all the unexpected but revoked certificates.
Now these files might be a megabyte, they could be 75 MB.
Which is not a huge amount if you're on a cable modem.
But a lot of people are not.
The clients cash these for a while, usually 24 h. And this doesn't scale well.
Quants have to download the Ca. Of every certificate authority. That has signed any certificate they validated.
This is a lot of stuff being dragged around that never really gets used. That's why we came up with this online certificate status protocol.
You can check. When you validate a certificate, you can poke. The certificate authority can say, hey, is this still valid?
And the
Certificate authority turns around and says, Yes, here is your digitally signed notification that yes, this is still valid.
And you can catch this for 7 days. So if someone compromises your private key. In immediately after a client does that check, they can fake being you for 7 days.
That's a lot better. Then never.
Now the server. Can make those queries for you. There did attach that digitally signed verification to the certificate.
And when you when your client makes it TLS request. It returns that Oh signed OCSP query with the certificate.
It's called Statement. And the client skip verifying. OCSP with the Ca.
On a staple certificate. No, servers can also. When you first contact them. Set this must staple flag that says Either I give you a staple search.
Or The certificate is invalid.
In general, crows derivatives. Like Safari, you must enable OCSP.
And as far as the nifty must staple thing, Chrome ignores it.
So, if revocations are being ignored, what do we do now? Well, first thing you do is never let your private key be stolen.
However, we all know that prevention eventually fails. So other things that can happen. Short lived certificates.
If you're a bank, you may look at getting name constraint certificate. There's something called Dane where you can verify a certificate finger.
Print over DNS sec. And that's very popular in the email world. You can get a really big stick and beat on vendors.
Who ignore revocations. You can deploy browsers or forks of browsers that enable. OCSP out of the box.
. The trick is finding one of those that doesn't also say mine cryptocurrency in the background.
You can also, if you have the kind of organization, Thank you. You can use a hardware security module.
For your private key.
Okay, so. After all those warnings and caveats. Suppose you still want a certificate. Well, you need a certificate signing request.
That the CSR contains all the information that the Ca must validate. Now there's a friendly open SSL dialogue that gives you a CSR.
That dialogue puts the host name in the CM.
It supports only one host name. We've been trying to kill this for a quarter of a century.
Please don't use it. Having said that, many CAs. Know perfectly well about this dialogue.
And they will copy your CN into. Subject alternative name for you. So, but still, this is obsolete.
We have config files. We have. Command line options. Is skip that dialogue.
And once you figure out how to make a CSR. When you're certificate expires, it would be.
Technically possible to use the previous year's CSR.
I know a lot of people who say, oh, do that, that's fine. And no.
It technically possible horrible practice. The CSR is tied to a specific private key. Are you absolutely certain that K is still secure?
Have standards changed? Csrs are free. T's are free. Creating CSRs can be scripted.
Make a new private key, make a new CSR.
The information in your CSR. Well, The important thing is to only include the information you must validate in that CSR.
A, a, DV, SERT, domain, validated. They're verifying that you control the host.
Only thing you need is the host name. Don't don't bother filling out. Your organization name or any or your state or any of that nobody cares it shouldn't be in the cert anyway just just the domain.
The more heavily checked certificates, you need some organization information in there.
And that includes things like the C represents. Very specific ISO 3 1 6 6 country code.
Do not use the wrong country code. St is your state, locality, your company name, all of that.
I'm gonna suggest that you gather all of the official names before you start scripting. Maybe everybody that you work with knows that the company is called the pit of despair.
We've all worked there, but. If the formal name of your company is the pit of despair, LLC.
That request will be rejected. Get the actual name first.
So if we're looking at config files to make these with. You may as well set up a config file.
You can reuse it. And this you set some key names. You set a couple of options that are standard across CSRs.
Here I've put in CN for common name because some software chokes on it.
But down below, all names.
I filled in the names that I want this host. To use.
To use the file, you, you run this command, this open SSL command. A request dash new key.
RSA dash config in the config file dash out where you want the CSR to go.
It just happens, none of this prompts. Now every time I've created a CSR, I immediately wonder if I did it correctly.
Well, there's an open SSL command. To read the request. And print out. What was in it.
You can also generate CSRs without config files at all. Here is a command line that includes all of those alt names and everything.
We take the CSR that's generated. You send it to your certificate authority. Along with a check for whatever outrageous fee they desire.
And they send you back a certificate. Life is good.
Here's one nifty thing I learned.
You take your certificate, you put it in production, everybody gets the lock icon, everybody's happy.
But best practice is to have a new CSR in a new private key every year.
How do you tell? If one of the sysadmins in your organization got lazy. And decided that they just reuse the same private key.
Well, you can tell that. You can also, if you had some file confusion and you've made up the private keys and the certificates and you're not sure which goes to which.
Well, each key pair of private and public keys Have a modulus. Which is a shared numerical value unique to the key.
And there are Open SL commands that you run. To match things together. If I key and a certificate.
Have the same modulus they go together.
And.
So that's the basic on how certificates work.
Let's talk a bit about. How most people use them today. If we were in a room, I would ask people to raise their hands.
If they have used acomy, but I'm going to assume that most of you haven't.
So.
Every sis I know, gripes for decades. That we filled out a form, we generated a number.
We send it off to a certificate authority with a check for a hundred bucks. Back when a hundred bucks was real money.
And. They would run a script and take the money. And mail us a file. That's all they did.
This should be automatable and this shouldn't. Cost nearly so much. Well, over time, certificate prices dropped.
We had $50 search and $10 search and now thanks to this. Then called Acme.
Certificates are free.
The Internet Security Research Group. Founded a free Ca called Let's Encrypt.
And it provides free, 90 days, domain validated, x 5, 9 certificates to anyone who asks.
So for most of us. Who are not banks. Or financial institutions. Or bound wrap by Government regulations that say otherwise.
This is really the way to go.
And here's basically how Acme works for certificates. The client says, I'd like a certificate for the host.
And the Ca says, well, if you control the host. Make this change on the host. The client says, I change the host.
The Ca checks and says why yes you do control it. Send me your CSR. Client sends it in.
Ca sends back a sign certificate. This is all automatic.
And this can be done in a few different ways.
There are 3 common challenges. One is the HTTP challenge, which is put a file name this containing that.
In this folder. On the website. Of that host. There's the DNS challenge which says make a change to the zone.
And there's ALPN. Which says make this change in your TLS protocol.
Well, which should you use is the obvious question. We'll get to questions at the end.
On a single server like if I'm running a web server. Http is a no-brainer.
Most of us use that. If you need a wild card certificate. Most of the 3 CAs only allow DNS challenges.
If you are using load balancers, pools, clustering, all of this stuff, then look into ALPM.
About 2 thirds of the way through your certificates lifetime. Start redoing it. This gives you 30 days about 4 weeks to solve transient issues.
Temporary outages name server failures whatever I just schedule line in Kron and most clients handle this.
And yes to make, act me work, you need a client. Here's the official Let's Encrypt client in Python.
If you run Apache.
MoD Md inside Apache just does acme for you It reads the information out of your config and does it.
Open BSD has this lovely ACME client that just poof, works. It's One of the simplest out there.
For you Linux folks, there's a Docker container. That will just handle like me for you.
I'm happy on Docker containers just because so many people deploy them without knowing what's inside.
But I don't have to fix it, so do what you like.
My favorite cross platform client. Is dehydrated. It runs on a raspberry pi without trouble
So I'm You can get certificates. You can renew them. You can project your traffic in transit.
I'm gonna touch at the end here on just a few. Details of TLS.
That most people don't know exist. I'll start by getting all of your servers up to speaking only.
TLS 1.2 or 1.3. Then look at these.
There is this thing called high our HTTP strict transport security. Hey HSTS. It's an HGP header that says This website only serves pages over TLS.
Please cash this. The client when it makes a request. Transparently rewrites any HTTP requests in the HTTPS, it refuses HTTP from the host name.
It's web only. Now you have to be a little careful. When you are deploying.
HSTS. On a long running website. I deployed it on one of mine.
I said a one year time out. Parts of the website were not available over HTTPS.
And I quickly learned which parts those were. And had to fix that. If it's a brand new site.
Give HSTS. A tried right out of the box, turn it on, set it up correctly from the beginning.
So. When I say get all your servers up to newer TLS versions, how do you know?
Well, you test your server. The first time. I would tell you to go look at SSL Labs.
Dot com. And this looks for bad TLS versions, broken cybers, general misconfiguration.
It only works on public websites. If you work for an organization that actually has intrusion detection.
The SSL Labs TLS tests are indistinguishable. From an intruder probing your website to see what your TLS is set up like.
Because they're the exact same questions. So talk to your security team before giving them some red flags.
It will save you an apology later. Ask me how I know. If you want to do the same test yourself without a, without a remote website.
Test ssl.sh does it for you.
Running your own Ca. Yes, you could run a certificate authority. Many companies do that.
It's just a bunch of scripts. On signing certificates. Now, Open SSL includes a small certificate authority.
As a bunch of scripts. And they clearly label this as demonstration. Do not use in production.
Never exposed to the internet. It's a great thing to learn for like inside your basement lab, but Many people.
See those warnings and decide they don't really matter they do matter do not use. Over and ssl's demonstration Ca.
People have written software that is meant to be exposed to the internet that is meant to be usable on a long term basis.
Get an actual package. All these programs have books. If you need a Ca read them.
Otherwise, if it's in your basement, I would recommend building. That small demo Ca.
The same way I would recommend making a PC and building your own firewall. Do it once, live with it a while to see how it works.
You will learn a huge amount. Some of that will be stuff you wish you didn't know. But, you know, that's this whole business.
One last thing. If any of you are in large organization. There's this thing coming called name constraints.
A big company can buy a certificate that allows them to sign their own search. Now, maybe one of these.
Last time I checked, these were about 10,000 bucks. For some organizations that are operating under
You know, those same regulations and guidelines, it might be cheaper for them. To buy a named constraint Ca and sign their own certificates.
I've talked to people that's true for. And one of the nice thing is that you can Set expiration dates, expiration times.
If you have proper automation, you could say all of our certificates expire in 12 h. We generate new private keys for every new certificate.
If someone steals a private key.
Its usage very limited. And it's lifespan is very short. No. I expect these to get cheaper.
Doing the sort of thing requires reliable automation. You need Ansible or Puppet, something like that or Don't bother.
But over time these are gonna get cheaper and are going to get more and more in reach of smaller and smaller organizations.
So, that's really it. If you want a huge amount of painful detail. Including, the world's most nightmarish openness to sell command.
Thank you, Bob. You can grab the book. And if not,
And, and, and, yeah, Grant mentioned that Open SSL can create constrained search with config files.
Yes, but they won't be trusted. Except perhaps by your basement Ca. So I am gonna stop sharing here.
And Josh G has had his hands up. So I'm gonna ask him what his question is.
I actually don't have a question, Mike. I was one of the Acme users. I raised my hand and forgot.
Yeah. Okay, fair.
Hmm.
I do miss meetings where I can look out over the class and see if you're all. Either stunned in to come in comprehension.
Or bored beyond words.
Good networking.
So I hope. Some of that is useful and please throw out your questions.
Share the screen.
Where are the rats, Thumb Beast?
The rats are in the basement. Or the rats are on the main floor. I'm in the attic.
Well, thank you, Lee.
And
You're welcome. I just have to really respect the ability to not take sides between the ability to not take sides between the BSD versus Linux community there.
I mean, you've served them both very, very well. Okay.
Well, thank you. The the truth is it I waited for 8 years to use the screen to parody for art.
Yeah.
And At TLS, everybody screams.
I'll throw out there when Michael said that the Open SSL commands. Start to make sense.
They actually do. I tech reviewed his book. And reread it after he published it.
And dealing with SSL got easier. What particularly got easier was troubleshooting or what is this sir when What names does it have?
What dates does it have? Oh God, I've got a whole bunch of CERTs.
Weirdly named, I can see the details.
Experience.
You know they have a name for this phenomenon where it starts to make sense and it works better. It's called, they have a name for this.
It's called Stockholm Syndrome.
Oh Yeah
Yeah.
Just point out by the way that Michael said you get that magic lock icon. Those people in chrome are changing that The lock icons going away in new Chrome.
Actually in the main reason the funny thing reason I'm gonna bring it up is the main reason they are is exactly what Michael said.
He can't and doesn't understand what security means. And the lock I can people every time they they every time they looked at it people would say well that means it's secure.
What does that mean? We don't know and Michael's a pretty smart guy and even he doesn't know.
So they've just flipped it around. It now looks normal if you have HTTPS and it has a nice little red.
This is bad if you have HTTP.
That's not bad. Oh, Stan has his hand up like a gentleman.
Early on you said something on one of the slides you said I didn't see the the whole phrase.
Hi list, what's the high list? Watch it.
Open SSL has The ability to specify which ciphers you want to use.
What algorithms do you want your site to support? And you can go in and you can name. Ciphers like you know, the Open BSD folks used to use Blowfish.
That must be a good algorithm. So I'm gonna put that on my list. Assessments should really not be making that call.
Cause we don't know what the heck we're doing. But Open SSL, each release has this macro called high in all capital letters.
And you can use that in the place of a list of ciphers. And it says.
Use only the algorithms that this release of Open SSL. Things are okay.
Thank you. Appreciate the definitions. And explanation.
Sure. I really don't. This
Yeah, Michael, the, the chat. The Zoom chat has like about 24 entries in it.
Huh? Oh god, yeah, I saw it on the corner of my eye, but.
So maybe just, I mean, it's probably easy for you to, to, read, I hope, but the first one in there.
You certificates expire.
Oh yeah. Yes. Yeah, I did touch on that in the talk.
And,
The
Oh, I will be sharing PDFs on the slide. On the meetings being recorded. Excellent.
I'd like, I can. If it's okay with you, I will put the link on my web page so people can.
See the talk.
Sure, excellent. Excellent.
Excellent.
We in in the past.
Does the alpaca attack come into play more with wild cardards? Well, Bob would know.
In as a point of reference or understanding in the past we have actually taken down recording because the speaker didn't feel it was a good enough quality.
Oh.
So, you know. I mean, and excellent. Discussion and presentation.
Well, thank you. I mean, if the if the recording turns out staticy because Zoom is having a bad night.
I just put label the link as you know Zoom is full of crap. And they did their best and here we are.
Like a true essay.
Yeah. Everybody on this call is doing the best they can with what they have and knows that.
This business is terrible. Computers were a mistake. It's a miracle that anything works.
And one day, some dude who is maintaining a critical product project that nobody quite really lies about is gonna die.
And the entire internet will crash.
I just hope to have retired before that.
Hello.
Okay. We should never have trusted Silicon.
Like an opportunity, a lot of consulting money.
Yeah. So are the Acme Ca servers in the trust? Yes, the Acme CAs are trusted by everyone.
By all of the major bundles.
That wasn't always true, but it has been for a number of years now.
And is it true?
Yes. Will AI replace certificates? Oh, God, no.
So the Acme solution is great for, okay. For internal devices.
Yes, you can use Acme for internal devices. There's a couple ways. I know someone Who set up a public web server with all of his internal device names?
Hello.
And copies that into his network and however, The DNS based challenge is for exactly that use case.
The catches you have to know DNS. Which is increasingly a dark art. I'm afraid.
Know a guy who wrote a book.
Yeah.
No, no, you could know a guy who wrote a very narrowly. Specific book on a teeny use case.
I'll jump in on your on your use the DNS challenge that's a good one.
Hello.
For the solution or you then want to use Identify your internal sites. That are trusted by a public.
. If you are the kind of company that puts a wants to put a private Ca into your company's clients.
So that they are deliberately not trusted by the public web. Then your only choice if you want to automate and use something like Acme is to run your own Ca with Acme in front of it.
I did post a link in the chat to GitHub to something called Boulder. Boulder is the software that lets encrypt uses.
So they have released their software stack.
And you, you might know, you know, So, the obvious reference of course is Wily Coyote.
Getting crushed by his own schemes and I'm not saying that's what let's encrypt hat in mind.
That is why it is.
But naming their software boulder does rather That they Do exactly what they're doing.
Okay.
I've run into some weird issues using DNS. Authentication for internal things like you can get.
Search from Let's Encrypt or whomever for your Drag for your server.
The problem is rotating that certificate on that internal thing. Becomes problematic. And something that was bought on a grant.
8 years ago and still has another 9 years of service life on it. Does not know how to do an ACME client.
So rolling those, or yeah, search every 90. 80 days, however often. Becomes a problem. So yes, you can get internals.
For through let's encrypt in the likes. You're gonna regret it.
Well, The deploying certificates remain as a problem for the sysadm.
No, the whole point of Acme. Being or the whole point of Acme providing 90 day search.
Is to force you to automate.
A job that you do once a year.
It's actually not so much to force you to automate. It's to get rid of all certificate revocation mechanisms eventually because they're all terrible.
And they they don't work. And people think when they don't.
And they are. No. I hope I made that clear that you're basically doomed.
But as a sysadmin, a job that you do once a year. Is easy to neglect.
It's easy to think, oh, I'm. I don't need to script that.
I'll just look it up again next year and then you scramble to find the information and, and know.
With an ACME client, it just happens.
And ACME clients have improved. Since Let's Encrypt's original release.
Oh God, yes, I would.
There is nothing wrong with Searchbot.
I would not encourage you to investigate it. If you do not need a giant Python client for something that's implemented in a couple 100 lines of shell.
By other clients.
What's the good option to serve both for using Lots of
Well, the one I recommend for cross, okay. My favorite overall. Is Open BSD ZACHMI client.
It's just poof done. If you're running a patchy. They have a MoD MD that goes directly in Apache.
And does it for you. That's lovely. If you need to generate CERT files through a an add-on client.
I prefer dehydrated.
I know a bunch of people like acme.sh. But the, Acme.
Dot SH author. Sometimes changes things behind the scene without bothering to tell people. Like he switched at 1 point from let's encrypt to a different.
3 Ca. Which there may be solid technical reasons for it, but tell me.
That's a kind of big change. If I was using something like CAA records that said I only issue certificates from this Ca.
I'm sorry, I only use certificates issued by this Ca. That would bite me.
Yep.
Michael. I'm a, Acme Dash client user, Open BSD and you mentioned something in your talk today.
I had not considered. So I've been a let's encrypt users since they're insect and public announcements.
And I moved over to Acme Client once it was available and I love it. He said that I don't think it will do what you have asked me to do of it, which is to change my private key annually.
I have never changed it.
Well.
Your Bug and Acme client.
I'm sorry, Bob.
You're correct. It's a bug in Acme client. It won't do it unless you go change it yourself.
Right, it's not a bug, it's just it's not missing feature that is I am now responsible for.
Yeah, it should just do it and it doesn't.
Yeah. Thanks.
Well, I guess this is the point where we all look at Bob. Meaningfully. That's another place where zoom fails overall saw being in the same room, cause Bob could like feel the glare.
So you still handle that, please.
Yeah.
Anything else?
Did you read that draft I sent you so you can start writing the next TLS book where everything changes?
I hate you.
Okay.
Michael, or if you can recommend.
I hate you and all that you stand for.
What's you figure everything out and write version 2 of the book? Let me know.
Yeah, yeah. Don't worry, you'll hear the screen.
The screen was pretty good when I sent him the sent him the thing to make getting to make an acne request to let's encrypt with an over 64 character CN.
It doesn't work, but did used to. I think they may have fixed it.
Yeah.
Question.
So yeah, and yes, as someone commented. Yes, someone at Microsoft every year forgets to renew us a x 509 search.
Every year.
Every big company, someone does it.
No, that's just everything. Every company. Some of it every company. Every year forgets and something breaks and somebody goes, oh yeah, we forgot about that.
Yep.
Broadening out from the technical to somewhat to the personal. I'm taking it that your your primary job in life is an author.
Yeah.
And I always am fascinated when there's an author who obviously has A great deal of technical experience.
And so have you previously then less of an author and more of a line employee for some large company or organization.
I was a full-time sysadmin until 2015.
Okay.
The company well
I spent decades climbing the ladder. Like you're supposed to do. And at 1 point I was Western Hemisphere Network Lead for an automotive supplier.
G can.
And you know, in our culture, that's what you're supposed to do.
But I realize that I hated the job.
I loved playing with the tech, but everything to do with the actual job was stupid.
Yeah.
Okay.
Okay, the manufacturing system was controlled by a system here in Detroit.
And I got a memo discussing the new plant that was going in in Uruguay.
That was going to need to tell net over our private network. To Detroit.
And and work the menu system and They had priced the the local Plant manager had priced A fiber line?
A T one and a 56 K line.
This is very expensive in Uruguay.
All of it. So. I came back and said, well, there is this thing called the speed of light.
The 56 K copper line is not going to do it.
Sorry, it was not T one, it was the, the 2 megabit. Over some fiber like thing.
I said you're gonna have to at least do the 2 megabit.
And I walked away having given my The benefit of my experience. 6 months later they came back and said the 56 K line doesn't work.
Yeah.
And you will make it work because I am a vice president.
Yeah.
I said thank you very much and I turned in my notice.
Man of his part.
And a friend of mine had been offering to hire me for years. They said when you come to your senses, will only pay you half as much.
But I promise to not be stupid.
And they promise to actually listen to what you said, right?
Well, the boss was a nerd.
Yeah.
And yes, I took the 50% pay cut and never felt better. When that company folded And in 2015 I had to decide am I going back to corporate stupidity.
Or am I gonna or am I too old for that shit?
Cause I had an alternative the books were selling. And yes, I could. Any day I don't feel like writing.
I tell myself that's fine. I know recruiters in this business. I could pick up a phone.
And by 3 o'clock that afternoon. I could be on a conference call with a stupid customer solving a stupid problem over stupid matters.
And suddenly I'm writing.
Oh
Oh, the words are coming!
Okay.
Well, Michael, I must say since we're getting a little field from the TLS matter.
That's fine.
I have been reading your books for God what? Probably close to 15 years. I have enjoyed every one of them.
Thank you.
And I am very happy that you found a sane pursuit of happiness with Theo and his crowd.
Instead of the corporate in addition to the corporate world.
Yeah.
Michael, you have not given enough credit for yourself for some of the ways you write your books.
In that you lab things. You find bugs, you submit bugs, you see the bugs patch, you talk about it in your book.
I, you do. I lot that is way more than just. Authoring.
Well, here's the thing. It's my job to speak the truth. I am I do not write a book to deliver a sunshine animal.
If you know, I'm gonna pick on Bob because he's here. If I report and open SSL bug to Bob.
Sorry, if I support a liberate TLS bug. To Bob.
No, actually no, because that's the portable version. I won't care about that either.
Go along, Bob.
If I, if If I report great TLS bug in open BSD to Bob
And he ignores it. That's important for people to know.
That how does the how does the software author respond to bugs? Now I try to choose to only write about projects.
And that. Actually respond to legit well-reported books.
There is a tool I'm using for the mail book I'm writing right now.
Yeah, yeah, Bob, I know.
I'm stopping my video so I stopped laughing.
Yep, I
And it's it's the best tool I've found for the job and it's been abandoned since 2015.
But it still does the work. So I'm having to put some caveats in it. And what I'm really hoping and I post on social media now and then, you know, if someone wanted to make the world a better place, they could like update this tool.
Cause it would be straightforward. And nobody has fallen for it yet.
But yeah, that's important. I am not going to recommend you do.
The only reason I'm recommending that tool is because it's a shell script. An assistant man can look at a shell script.
And easily remove. Things that are not relevant anymore.
Yeah, if you have a list of domain names. And one of them is say Twitter.
Dot com.
I don't know that we're getting mail from Twitter anymore. I think it's all x.
Dot com now.
So.
Yeah, you gotta know what you're getting into.
And and everything in computing may be horrible. But I'd like to offer the least awful path.
So, thank you, Grant, but it's, really the bare minimum that should be done.
I wish more would more people would.
Yeah, well, you know.
Like maybe Bob would fix some bugs.
Yeah.
Well, in Bob's defense, I reported a bug to him. And he went oh shit it's a bug
And Next snapshot. It wasn't a bug anymore.
Okay.
I mean, most developers. Love legit but reports. Oh, what was it? Oh!
Yes,
If I did OCSP on one virtual host. But not the others. On that. Web server.
TLS the x 509 certificates on those other sites choked and died
And yeah, Bob fixed it.
You know, developers love real bug reports.
Especially ones that don't start with. Dear Idiot
So yeah, we've gone a field, but anything else, whatever.
Winds TLS Mastery, 2 point.
Roughly St. Never's Day.
Yeah.
I actually gave him the preview of what he needs to handle to write it.
And the answer, what do I need to handle the write it? The answer to that seems to be drugs, a lot of drugs.
Okay.
So I see, one of your books is about add. Is there anything you can tell me about Ed?
I don't know hardly anything about it that.
It's the
Well, Ed is. The standard editor.
It's one of those you must be this trawled to use this computer thing and Since you brought it up Let me see here.
I think we were we were frozen there for a minute.
Oh, sorry. I'm looking and I don't see a copy. And so. Oh wait.
John, could you repeat your question?
I have
I have many times gotten quotes for a book. Like, I think I got Bob to give me a quote for an Open BSD book and what happened, but this.
Yes. Oh, it's backwards. Dang it. Okay, get a mirror.
Oh, it's right.
You can see. That is a quote from Ken Thompson. Co-creator of Unix.
Okay.
On the back of the ed book.
Oh.
Now, N is.
If you work on real hardware. Particularly, Ed is vital.
Okay.
You're speaking of the editor. Ed, correct?
Because if everything else fails. You still have that. The editor ed.
Unfortunately, that's not true anymore.
There's some distributions that are deigning to not included.
Well, then they're not Unix.
It's that simple.
Oh, You know, Unix according to Michael Lucas. Okay.
No. No, no.
Simple Venn diagram of. Of free and open source. Systems that use the.
Asterisk and IX and Ed must be included.
Yep.
Actually, it's not according to Michael Lucas. It's according to a standard called POSIX.
I don't care about POSIX.
Most people don't.
Which, which, which, which most, which most Linux distributions don't actually follow.
Yup. So yeah, but that's another goal argument best had in a bar where we can actually start to throw drinks and
Yeah. Disturb the neighbors. But yes, Ed is some. Understanding Ed will teach you.
About why Unix is the way it is.
It will also if I follow your book because I've read it and tried many of the exercises in it.
It will explain to you why you don't understand regular expressions and never will.
Okay. Well, yes.
Now I'm perplexed. I've not read.
It will it will also make you a better VI user.
See, Reg X's and VI and VIM are my jam. So.
It will also if you ever wanted a scriptable VI.
That's it.
Do you go into the statement you just made? On Linux and contemporary BSDs. Much of the same thing could be done with said the streaming editor.
Often, yes. There's many ways. To
To solve that problem.
The truth is I would use Pearl.
Okay.
But if you need I've worked on systems. Where it would literally take an act of Congress.
To add a piece of software to them.
And one of the glories of eunuchs. Is that The tools are there. You may not know how to use them.
You may not know why.
Say. The left bracket. Is a shell command not built into the shell. It's like slash bin slash left bracket.
Why is that a command? Well? Because you can use it.
And. You go through.
And look at.
You probably don't want to do this on a Linux system. But a more classical Unix.
That has a distinction between like user bin and user local bin. You know the core system versus add-ons and you see 20 or 30 programs in slash bin or slash.
That are considered the core. Go study each of those programs separately.
And you will realize that
This is a powerful operating system. Without Python. Without Pearl.
You can do a huge amount with it.
So.
Yeah.
Was that the regular version of Ed Mastery or the Mainly McMahon face?
Oh, this is the regular version. If you are willing to pay me. And extra 20 bucks to not be exposed to feminine pronouns.
You don't get a Ken Thompson quote. See.
Oh.
You don't rate that.
So if I read the SSH mastery book, will I learn why there's this weird green thing on the front of it?
Yeah.
Oh, yes, yes, open SSH. Is done by the Open BSD people.
And that is their blowfish. As the Mona Lisa.
Wow, nice.
Yeah, Open SSH is at it is pure open BSD. It may be the most widely installed Linux, program on a Linux system.
But no, that's Open BSD.
I wonder if it rivals Java for the most installed thing.
Java? Well? It might. And for the record.
I would like to say that monocultures are bad. Please compete with Open SSH.
It's not as bad as it used to be. But, we need some diversity and interoperability there.
Oh, some of the.
Would you think the interoperability part there?
I'm sorry.
Would you defend the need some interoperability there because I'm taking that as you know of something with.
Open SSH that is not as interoperable as you would like.
Okay.
Hi, I'm not aware of anything at this time. When you point out incompatibilities.
They jump on the open SSH people jump on them like starting dogs on raw meat.
One of the reasons. That's things like NFS have. Data round for so long.
Is because of events like interrupt.
Where everybody, every vendor got together. And they tested their NFS as against each other. To make sure it all still worked.
Someday. Somebody will figure out something.
That attacks open SSH and it would be nice to have an alternative. Why open SSH figures it out it would be nice if 90% of the servers on the internet weren't running the same SSH Damon, please.
People who've found problems with SSH Damons all the time.
Yeah.
Yes.
Or old, but old versions.
They just had to not be open SSH. They tend to be the other implementation. There are actually a number of other SSH implementations out there.
The reason they're not popular is they tend to well, they just tend to have problems.
They tend to.
And or they want money for.
Yeah.
I guess I'm the writer, so I'll use my vocabulary here. They tend to suck.
Yeah.
Yeah. Yes. Yeah. Yeah.
Yeah, I, I would love a better one. I'm gonna move this camera now.
Okay.
I, this is Gary, by the way, at, I want to apologize. One of our attendees here, Sam, I believe it was, pointed out that in Meetup, at one time, the day of this meeting was incorrect.
And so I apologize to Sam and anyone else. Was confused by that. I think we caught it the day.
That incorrect date went out there. But as one of our members who is here in the meeting says
Gary be honest, meet up sucks.
Yeah, okay, good. I didn't have to.
I'm a positive influence on the group. Excellent.
So, so anyway, I apologize that we didn't catch that mistake, more quickly, hopefully it didn't badly affect anyone else.
So. I do have a question here. Obviously, Michael, you've been involved in many different aspects of sysadmin.
And, I've kind of found that the area of networking it's kind of special within sisadmin.
I mean, there are some guys who are Very good sis admins until they get to networking and they absolutely hate not working or some of them think they love not working but obviously they don't quite have a grasp on not working.
Do you have a field, a description better than I on on that? How do you describe those people?
Well, what I would tell those people. Is to go to their nearest bookstore. And grab a copy of networking for systems administrators.
By Michael Lucas. That it's written for exactly those people and the e-book is 10 bucks.
Here's the thing.
I'm a network administrator cannot be assisted. You have people who are who dabble in both like me, but I'm insane.
Yeah.
Generally.
And if you get. If you get to the point where you need to dabble in the network administrator.
Then you buy the Michael Lucas book. Also by Michael Lucas, which is called Cisco Routers for the Desperate.
Yeah.
It is actually The Michael Lucas technical book that I use the most
No!
Oh, oh, I'm so sorry.
Yeah.
Here's the thing. They're 2 different jobs or 2 different mindsets. I mean, assisted men cannot understand how a network administrator doesn't have logs.
I'm in how, how do you operate a network without that? How are you working a computer without that?
Yeah.
Meanwhile. From the from the network admins point of view. There is a culture and system administration.
That says blame the network. It didn't work. Well, it had to be the network. I don't know.
And basically. The place where they intersect.
Is the network stack?
If you can take it as a network administrator. If, oh yes, the firewall, there's always the firewall.
Unless it's DS.
As a network administrator. I would get 2 kinds of calls. One. What's wrong with the network?
And my answer to that call is almost always nothing.
The other kind of call I would get is, hey. I am.
I have a client that's trying to reach my server on port 4 4 3 and TCP dump shows the packets are not arriving.
That second call, I will pick up immediately. Because the person who says that an entirely different category. Of sysadmin.
Then the person who just wants to know what's wrong with the network. That second person I can work with, I can resolve a problem and it will be fast.
Or at least identification will be fast. Filing the change request with the firewall administrator is a whole separate thing.
. But you know, we can identify what's happening. We can work together 3 min done.
And yeah, that is why I wrote this book. Because you know, the network equipment is fluid, servers are fluid, just keeping up on what you're doing is a full-time job.
But TCP IP is pretty stable.
Yes, you've had to update your skills for IPv 6. That's been the major change.
In. In decades.
You know, the, does not need to know Windows scaling.
They don't need to know. The difference between beckon and second.
But if they can have a conversation about ports and say, hey, I don't have a link light.
One, hey, I can work with that.
So yeah, I would tell all sysadmins. Of all the books I've written.
This is the one that I've heard from more network administrators than ever any other book. And most of them have said, thank you for that book.
I have slept so many sysadmins with it.
Cause it learning that really will help you.
Oh, anything else?
My, again, Michael, I gotta, I gotta say for sure that I've, had a bang up time this evening.
It's been great talking to you. Great listening to you. I'm gonna have to run out and get get some of the books I missed.
Okay.
Okay. Is this I put a link to my bookstore in the chat?
Sure, sure. Please do. I mean, at 10 bucks a piece, at least we know you're making most of profit.
Yeah, it the bookstore
Oh, his publishing company and distributor scalp him.
Well. I don't have my books in a bookstore unless they cut me a fair deal.
Which is why the new Open BSD file systems book is not on Amazon.
Yeah, so I wonder how small, companies like ours can afford to sell on Amazon with all the different ways they figure out they come up with the dinghy.
Yep. I have a blog post. So I'm not gonna dig up.
Okay, good.
But there's my website you can poke around. I have an RSS feed.
I post 1 min of a work in progress every week. So if you want to know what I'm working on.
Oh!
That's the easiest way.
Whose button?
And this week, this week it was baseball.
Yeah, it's been mail server for a few weeks, but. Today it was Orc Baseball.
I'm looking forward to that story, sir.
Oh, thank you. I, were you on the Ork Kickstarter?
Yes, sir.
Okay, then you get it.
I'm looking forward to it. Thank you.
My pleasure. Thank thank you for back in book.
I gotta go. Good night.
Yep, and I it is. It may be a quarter to 9 there, but it's a quarter to 10 here.
So.
All right. Michael from everyone I know a few people have already dropped off and and giving you thanks there in the chat but from all of us thank you very very much as Lee said it's wonderful to actually have a face and a voice put with the books from all these years.
And it's really been a great, enlightening evening. We really, really appreciate it. Hopefully, hopefully we can get you come back sometime.
So.
You can just ask this was fun.
Right.
Before you, your put where people can follow you because you actually answer questions on social media. I don't know why, especially my questions.
There is my mastodon handle. I am no longer on Twitter because Elon Musk is an all right dipshit.
Yeah.
Facebook is useless to a small. Business like mine. So the that's the best way to get me.
Fantastic.
Thank you.
So I had fun talking with you. Thank you for the invite. And listening to me, Babylon, about one of the horrible things in computing.
And thank you to everyone in the congregation, the audience. Group here. We've loved having you all tonight and Of course, we've got our discussed mailing list.
A lot of the post meeting conversations go on there and you're always welcome any of you to come to any of our meetings here in the future and Stan's got his finger up.
At least we not forget Jonathan Drews. Did the invite to Michael Lucas and we really appreciate what Jonathan did for us because he you are a wonderful speaker.
Speaker for our group. And I. This has been one of the best. Presentations I've seen in a long time.
Thank you.
Well, thank you. That's nice to hear.
I second motion.
I don't want to come back every month, but If there's another topic I did a book on and you'd like me to talk about it.
And drop me a note. I could come by 2 3 times a year easy.
Thank you. Thank you, thank you. And certainly if there's ever anything that just suddenly pops in your mind and you say dang I need to talk to somebody about this on zoom this week is just let us know So, all right.
Okay, will do. You all have a good night.
Have a good one.
Thank you, Michael. Yeah. Bye now. The rest of you, we can leave the chat room open for a bit and for those who don't feel the immediate need to.
To buck out of you're welcome to just swap more stories or ask each other Just what odd thing you've seen online today or various software questions and so yeah we can we can accommodate that for a while longer here if anybody just wants chip chat.
Life beckons. Have a good evening.
Thank you, Grant.
I question, Lee, should we? Stop the recording.
Yeah, Gary, you want to do a book end and we can. And a book and for our recording.
This has been the St. Louis log, the St. Louis Linux user group meeting on Thursday, November the sixteenth, 2023.
Our speaker this evening was Michael Lucas. It was about, his his book on transport layer security to 2,023 GLS 2,023 And, it's one of our 4.
Monthly meetings