When you use AWS (Amazon Web Services) and need to access your EC2 machines, you have a few options. I think most people end up using the in-browser terminal console or the aws cli to connect to their machines, or opening the ssh port add keys there to directly connect using ssh. In most professional (production) environments this is blocked (for several good reasons). There is however a nice way to be able to connect to your machine with an ssh client through the aws ssm command line interface. Let me take you through the mechanics and then give you a nice script and config example which allows you to use ssh as if you were living in the good old days 🙂
Category: Software
The podcast problem (fixed)
I love to listen to podcasts in the car. It has a lot of benefits over other media types, has less commercials, and there is some pretty good content out there. Documentaries, stories, news, perfect for listening on your commute. There is one big downside to podcasts though, particularly with the podcasts produced by people who have no experience with audio. So I went on a mission to solve this.
Post-quantum key exchange
If you see this warning when connecting to a server through ssh:
** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html
Then follow michabbb’s guide on how to enable post-quantum key exchange in ssh. Don’t worry, you don’t have to generate new keys. Please please do not disable the warnings, Solution 1 is NOT a solution. Do the right thing.
On your (MacOS) client machine (your local laptop) you need to tell your client to prefer post-quantum algorithms. Edit ~/.ssh/config and make sure your Host entry contains a KexAlgorithms line like this:
Host *
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
On a (MacOS) server you need to tell the sshd deamon to prefer post-quantum algorithms. To help you quickly do this:
sudo tee /etc/ssh/sshd_config.d/post-quantum.conf >/dev/null <<'EOF' # Enable post-quantum key exchange algorithms KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 EOF sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
Then validate that it worked on your next ssh session. If not, check that both machines (client and server) contain these fixes and are up-to-date. Read michabbb’s article for more tips and a better explanation.
Stay safe!
Addictive Intelligence
The past months were hectic. Artificial Intelligence has changed my daily work faster than I expected. In just a few weeks, it went from a fun experiment to something that reshaped how I “write” software, how I think, and even how tired my brain feels at the end of the day. It brings cool new possibilities, but also new challenges. I thought I’d write some of it down for future reference.
How to tail a json log file
Many applications nowadays output json formatted log files so that they can be scraped by the newest hippest monitoring cluster (think of Splunk, Elastic Filebeat, etc). That is of course very nice and I applaud that kind of observability, but sometimes you are just on the machine fighting with a service that does not want to start, or you just want to monitor it a bit more realtime, or you just are not the browser type. Luckily there is a realatively easy trick to this.
Are you de-skilling?
This week a colleage of mine shared an interesting video describing AI (mainly Suno) as problematic to the musical industry in the sense that musicians will become less and less skilled in making truly original music. It coins the term “de-skilling”, which perfectly captures something I also see in the software development area, even though it is beautifully hidden by the “impressive results”.
European alternatives to AWS/Azure/GoogleCloud
This article lists a rough feature comparison between currently available European cloud providers and their American counterparts. European cloud is available and abundant. Stackit, OVHcloud, Scaleway, IONOS, Exoscale, Upcloud are all parties you should have on your radar when building critical infrastructure for European clients. The US is proving to be less and less reliable as an IT partner. You’ve got to move.
Read More “European alternatives to AWS/Azure/GoogleCloud” »
Add iptables to your node-exporter metrics
This time quick and simple trick to make your node_exporter report on the number of blocked and allowed packets by iptables. It involves a tiny script, and a small configuration change to the node_exporter. Here we go:
Querying Classicpress database for page hits
Now that I am running classicpress, I miss the statistics that I received at wordpress.org. I don’t want to install third party cookies or other adware stuff, so I was looking to see how to solve that completely locally. Here’s how I got it working, withouts ads, all local, for free.
When munin df does not list all disks
I am a great fan of using munin for monitoring my servers and I have quite an extensive setup that even sends me Telegram messages when something is wrong.
This weekend I ran into an interesting problem with a backupserver where the ‘df’ plugin on the node did not want to list the backup disk, and I’ve spent quite some time trying to figure out what the problem was.