free
/
freedombone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Modifying documentation to use the control panel

This commit is contained in:
Bob Mottram 2015-11-03 14:31:05 +00:00
parent 108aa7831b
commit 9460b62c01
2 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
doc/EN/installation.org
View File

@ -190,23 +190,21 @@ This is the traditional security model in which you carry your full keyring on a
#+BEGIN_SRC bash
ssh myusername@mydomainname -p 2222
su
freedombone-keydrive -u myusername -d sdb --master yes
exit
exit
control
#+END_SRC
If you are on a Beaglebone Black then use /sda/ rather than /sdb/ for the drive parameter.
Select /Backup and Restore/ then /Backup GPG key to USB (master keydrive)/.
** Fragment keydrives
This breaks your GPG key into a number of fragments and randomly selects one to add to the USB drive. First format a USB drive as a LUKS encrypted drive. In Ubuntu this [[https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage][can be done from the /Disk Utility/ application]]. Plug it into the Freedombone system then from your local machine run the following commands:
#+BEGIN_SRC bash
ssh myusername@mydomainname -p 2222
su
freedombone-keydrive -u myusername -d sdb
exit
exit
control
#+END_SRC
Select /Backup and Restore/ then /Backup GPG key to USB (fragment keydrive)/.
Fragments are randomly assigned and so you will need at least three or four keydrives to have enough fragments to reconstruct your original key in a worst case scenario. You can store fragments for different Freedombone systems on the same encrypted USB drive, so you can help to ensure that your friends can also recover their systems. This might be called "/the web of backups/" or "/the web of encryption/". Since you can only write a single key fragment from your Freedombone system to a given USB drive each friend doesn't have enough information to decrypt your backups or steal your identity, even if they turn evil. This is based on the assumption that it may be difficult to get three or more friends to conspire against you all at once.
* On Client Machines
You can configure laptops or desktop machines which connect to the Freedombone server in the following way. This alters encryption settings to improve overall security.

13
doc/EN/usage.org
View File

@ -36,20 +36,21 @@ For extra security you may also want to add a passphrase to the ssh private key.
cat ~/.ssh/id_rsa.pub
#+END_SRC
Copy the contents of *~/.ssh/id_rsa* and *~/.ssh/id_rsa.pub* to you password manager, together with the private key password if you created one.
ssh to the Freedombone and edit the authorized keys:
Log into your system and open the control panel.
#+BEGIN_SRC bash
ssh username@domain -p 2222
emacs ~/.ssh/authorized_keys
su
control
#+END_SRC
Now copy and paste the contents of *id_rsa.pub* into the authorized_keys file. Save the file and exit. Open another terminal window and try logging in again and you should notice that you are no longer asked for a password, because the ssh key is used instead.
Select /Manage Users/ then /Change user ssh public key/. Copy and paste the public key here, then exit.
It's a good idea to also copy the contents of *~/.ssh/id_rsa* and *~/.ssh/id_rsa.pub* to you password manager, together with the private key password if you created one.
There are advantages and disadvantages to using ssh keys for logins. The advantage is that this is much more secure than a memorised password, but the disadvantage is that you need to carry your ssh keys around and be able to install them on any computer of mobile device that you use. In high security or hostile infosec environments it may not be possible to carry or use USB thumb drives containing your keys and so memorised passwords may be the only available choice.
If you wish to only use ssh keys then log in to the Freedombone and edit */etc/ssh/sshd_config*, then change *PasswordAuthentication* to "no", save and run *service ssh restart*. Any subsequent attempts to log in via a password will then be denied.
If you wish to only use ssh keys then log in to the Freedombone, become the root user and open the control panel with the 'control' command. Select /Security Settings/ then keep hitting enter until you reach the question about allowing password logins. Select "no" for that, then apply the settings. Any subsequent attempts to log in via a password will then be denied.
* Using Email
** A technical note about email transport security