PinePhone Security - Revision history

Fxc: stub entries

2023-02-20T16:39:31Z

stub entries

← Older revision		Revision as of 16:39, 20 February 2023
Line 55:		Line 55:

	as root on your PinePhone and either restart the sshd service, or reboot your device		as root on your PinePhone and either restart the sshd service, or reboot your device

	~~== Hardening ==~~

	~~== Hardware ==~~

	~~=== USB ===~~

	~~== Validation ==~~
	~~=== dm-verity ===~~

	[[Category:PinePhone]]		[[Category:PinePhone]]

Fxc at 16:39, 20 February 2023

2023-02-20T16:39:18Z

← Older revision		Revision as of 16:39, 20 February 2023
Line 1:		Line 1:
	{{under construction}}		{{under construction}}

	~~TODO intro~~

	== Encryption ==		== Encryption ==
Line 66:		Line 64:
	== Validation ==		== Validation ==
	=== dm-verity ===		=== dm-verity ===

			[[Category:PinePhone]]

Fxc: fixes

2023-01-15T11:23:00Z

fixes

← Older revision		Revision as of 11:23, 15 January 2023
Line 9:		Line 9:
	=== Full-Disk Encryption ===		=== Full-Disk Encryption ===

	Full-disk encryption encrypts the entire disk (except for the boot bits). Currently some ~~OSes~~ such as postmarketOS and Mobian offer an installation image, which have the option to encrypt the entire disk. Some ~~OSes~~, such as postmarketOS (via pmbootstrap) and Arch Arm also offer an installation script for an fully encrypted installation.		Full-disk encryption encrypts the entire disk (except for the boot bits). Currently some operating systems such as postmarketOS and Mobian offer an installation image, which have the option to encrypt the entire disk. Some operating systems, such as postmarketOS (via pmbootstrap) and Arch Arm also offer an installation script for an fully encrypted installation.

	Decryption is done at boot after entering the encryption password via an on-screen keyboard (Osk-sdl).		Decryption is done at boot after entering the encryption password via an on-screen keyboard (Osk-sdl).

DeepThot: /* SSH */ again attempted to reformat

2022-10-13T05:14:29Z

SSH: again attempted to reformat

DeepThot: /* SSH */

2022-10-13T05:12:55Z

SSH

← Older revision		Revision as of 05:12, 13 October 2022
Line 56:		Line 56:
	'''sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config'''		'''sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config'''

	in a root terminal on your PinePhone and either restart the sshd service, or reboot your device		In a root terminal on your PinePhone and either restart the sshd service, or reboot your device

	== Hardening ==		== Hardening ==

DeepThot: /* SSH */ attempted to fix my horrible formatting

2022-10-13T05:11:24Z

SSH: attempted to fix my horrible formatting

← Older revision		Revision as of 05:11, 13 October 2022
Line 22:		Line 22:

	To generate a key pair for ssh, open a terminal on your local computer, and type		To generate a key pair for ssh, open a terminal on your local computer, and type

	'''ssh-keygen'''		'''ssh-keygen'''

Line 36:		Line 37:

	Now enabled, you can copy over your public key either manually, or via		Now enabled, you can copy over your public key either manually, or via
	'''ssh-copy-id $username@$ipaddress''' replacing the variables "$username" and "$ipaddress" with the appropriate values, e.g user@192.168.1.15
			'''ssh-copy-id $username@$ipaddress'''

			replacing the variables "$username" and "$ipaddress" with the appropriate values, e.g user@192.168.1.15


	You may see a message similar to this		You may see a message similar to this

	'''Output		'''Output
	The authenticity of host '192.168.1.15 (192.168.1.15)' can't be established.		The authenticity of host '192.168.1.15 (192.168.1.15)' can't be established.
Line 48:		Line 53:

	finally, to disable password authentication, type		finally, to disable password authentication, type
	'''sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config''' in a root terminal on your PinePhone and either restart the sshd service, or reboot your device
			'''sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config'''

			in a root terminal on your PinePhone and either restart the sshd service, or reboot your device

	== Hardening ==		== Hardening ==

DeepThot: /* SSH */ Added section on generating with key-pairs

2022-10-13T05:09:51Z

SSH: Added section on generating with key-pairs

@@ Line 21: / Line 21: @@
 For safety reasons it is highly recommended to only use SSH in combination with keys, instead of simple numeric passwords.
-TODO: simply how-to of creating and copying SSH keys + certain SSH settings
+To generate a key pair for ssh, open a terminal on your local computer, and type
 == Hardening ==

Dachalife: /* SSH */

2021-09-27T17:50:55Z

SSH

← Older revision		Revision as of 17:50, 27 September 2021
Line 17:		Line 17:
	== SSH ==		== SSH ==

	An open SSH port is a typical gateway for attackers on any device exposed to the public Internet. Exposed devices might be attacked within minutes after being exposed. Typically such attacks try default passwords such as "12345", potentially putting the user at risk after connecting the phone ~~via unprotected WiFis~~ or mobile Internet.		An open SSH port is a typical gateway for attackers on any device exposed to the public Internet. Exposed devices might be attacked within minutes after being exposed. Typically such attacks try default passwords such as "12345", potentially putting the user at risk after connecting the phone to an open/unsecured access point, activating mobile data or mobile Internet.

	For safety reasons it is highly recommended to only use SSH in combination with keys, instead of simple numeric passwords.		For safety reasons it is highly recommended to only use SSH in combination with keys, instead of simple numeric passwords.

Dachalife: /* Encryption */

2021-09-27T17:44:21Z

Encryption

← Older revision		Revision as of 17:44, 27 September 2021
Line 5:		Line 5:
	== Encryption ==		== Encryption ==

	While encryption alone is not sufficient to protect sensitive data, it is an important tool to safeguard ~~the~~ data in certain attack vectors.		While encryption alone is not sufficient to protect sensitive data, it is an important tool to safeguard data in certain attack vectors.

	=== Full-Disk Encryption ===		=== Full-Disk Encryption ===

Fxc: more

2021-03-26T14:11:37Z

← Older revision		Revision as of 14:11, 26 March 2021
Line 20:		Line 20:

	For safety reasons it is highly recommended to only use SSH in combination with keys, instead of simple numeric passwords.		For safety reasons it is highly recommended to only use SSH in combination with keys, instead of simple numeric passwords.

			TODO: simply how-to of creating and copying SSH keys + certain SSH settings

			== Hardening ==

			== Hardware ==

			=== USB ===

	== Validation ==		== Validation ==
	=== dm-verity ===		=== dm-verity ===

	~~== Hardening ==~~

← Older revision		Revision as of 05:14, 13 October 2022
Line 23:		Line 23:
	To generate a key pair for ssh, open a terminal on your local computer, and type		To generate a key pair for ssh, open a terminal on your local computer, and type

	~~'''~~ssh-keygen~~'''~~		ssh-keygen

	It will ask you where to save the key pair. By default, this is in ~./ssh . Usually it's best to keep it in the default location. If you have previously generated a key pair, it will ask you if you wish to overwrite your existing one. You probably do not want to do this, as you will no longer be able to use your existing key pair for authentication.		It will ask you where to save the key pair. By default, this is in ~./ssh . Usually it's best to keep it in the default location. If you have previously generated a key pair, it will ask you if you wish to overwrite your existing one. You probably do not want to do this, as you will no longer be able to use your existing key pair for authentication.
Line 38:		Line 38:
	Now enabled, you can copy over your public key either manually, or via		Now enabled, you can copy over your public key either manually, or via

	~~'''~~ssh-copy-id $username@$ipaddress~~'''~~		ssh-copy-id $username@$ipaddress

	replacing the variables "$username" and "$ipaddress" with the appropriate values, e.g user@192.168.1.15		replacing the variables "$username" and "$ipaddress" with the appropriate values, e.g user@192.168.1.15
Line 45:		Line 45:
	You may see a message similar to this		You may see a message similar to this

	~~'''~~Output		Output
	The authenticity of host '192.168.1.15 (192.168.1.15)' can't be established.		The authenticity of host '192.168.1.15 (192.168.1.15)' can't be established.
	ECDSA key fingerprint is fd:fd:d4:f9:57:fe:23:44:e1:55:00:bd:d6:6d:42:fe.		ECDSA key fingerprint is fd:fd:d4:f9:57:fe:23:44:e1:55:00:bd:d6:6d:42:fe.
	Are you sure you want to continue connecting (yes/no)? ~~'''~~		Are you sure you want to continue connecting (yes/no)?

	This will happen anytime you connect to a new host. Type "yes" and hit enter.		This will happen anytime you connect to a new host. Type "yes" and hit enter.
Line 54:		Line 54:
	finally, to disable password authentication, type		finally, to disable password authentication, type

	~~'''~~sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config~~'''~~		sed -i -E 's/#?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

	~~In a~~ root ~~terminal~~ on your PinePhone and either restart the sshd service, or reboot your device		as root on your PinePhone and either restart the sshd service, or reboot your device

	== Hardening ==		== Hardening ==