djoproject's questions

I am looking for a way to make reverse mDNS query on OSX over IPv6 only. I am not interested by solution using IPv4.

The following works on Linux with dig 9.16.1:

dig +short @ff02::fb -p 5353 -x 2001:db8::1

I've installed dig 9.16.7 with homebrew on OSX, that command with the exact same arguments produces a timeout. And there is no sign of the outgoing query on Wireshark.

The following works well on both Linux and OSX:

dig +short @224.0.0.251 -p 5353 -x 192.168.1.23

The binary avahi-resolve-address is not available on OSX and I didn't find a way to make a reverse DNS works with dns-sd.

Here is the operating system version used:

• OSX version: Catalina 10.15.7
• Linux: Ubuntu 20.04

I am looking for a way to retrieve the MAC address of a specific host on a LAN network. I know its IPv6 address. Ideally I would like a way to trigger the Linux Kernel to perform the neighbor solicitation for me, then I could retrieve the host MAC address through the command ip -6 neighbour

Right now, the only way I found to trigger a neighbor solicitation is to try to establish a TCP connection to the host on a random port. But I do not find this solution really pretty:

curl --connect-timeout 1 "http://[fe80::1234%eth0]:12345"

When sending an ICMPv4 echo request to a destination address like 224.0.0.1, it is ignored by Linux hosts receiving the request. The destination MAC address used is 01:00:5e:00:00:01.

The only way to have those Linux hosts answering is to set the Kernel parameter net.ipv4.icmp_echo_ignore_broadcasts to the value 0. Which will instruct the kernel to answer to both multicast and broadcast ICMPv4 requests and open the door to broadcast security threats.

Why is multicast traffic filtered by this parameter ? is there any attack justifying it ?

With ICMPv6 and equivalent destination address like ff02::1, the traffic is not filtered by Linux hosts. Is there a risk that it will be filtered too in the future ? Is there a threat with ICMPv4 that doesn't exist with ICMPv6 ?

Linux hosts:

• Linux distribution: Ubuntu 20.04.1 LTS Focal
• Linux kernel: 5.4.0

When a gpg smartcard (e.g. yubikey) is inserted and contains an authentication key, the key is automatically enrolled by the gpg-agent. That means the key is usable for any ssh operation without needing to add its keygrip inside the file ~/.gnupg/sshcontrol.

Source: Agent-Configuration documentation (look after the last line of text inside the sshcontrol paragraph)

On a specific computer I would like to disable this default behavior without disabling other features provided by the smartcard. I was hoping to be able to disable the authentication key by prepending a '!' to its keygrip inside the sshcontrol file as described into the Agent-Configuration documentation (look after the before last line of text inside the sshcontrol paragraph) e.g:

!BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB 0

But it does not work. With BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB being the keygrip of the authentication key.

Not related to disabling a key, I also tried to enable the confirm flag for the authentication key coming from the smartcard:

BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB 0 confirm

And it does not work either. I am really wondering if the gpg-agent reads the sshcontrol information for smartcard keys.

Settings of my infrastructure:

• GnuPG version 2.2.12
• only RSA 4096 bits keys

I am trying to attach an imported ssh key to an existing primary key. The imported ssh key exists inside ~/.gnupg/private-keys-v1.d/ and is usable through the gpg-agent. When I associate it manually to a primary key, it works perfectly. I am looking for a way to automate the process through a bash script.

For this example:

• AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA is the fingerprint of the primary key
• BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB is the keygrip of the imported ssh key to associate to the primary key

Manual execution (it works):

bob@computer:~$ gpg --expert --edit-key AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
gpg (GnuPG) 2.2.12; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

sec  rsa2048/AAAAAAAAAAAAAAAA
     created: 2020-04-01  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
[ultimate] (1). My name <[email protected]>

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 13
Enter the keygrip: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Sign Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? e

Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? a

Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Authenticate 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y

sec  rsa2048/AAAAAAAAAAAAAAAA
     created: 2020-04-01  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
ssb  rsa4096/8022F3DA9BFC5AC3
     created: 2020-04-01  expires: never       usage: A   
[ultimate] (1). My name <[email protected]>

gpg> save
bob@computer:~$

We can see that the subkey has been successful associated to the primary key. That's the one with the fingerprint 8022F3DA9BFC5AC3.

Now I will show you the two ways I tried to do it automatically through a bash script.

First, I tried with argument --command-fd (it does not work):

{
    echo addkey
    echo 13                                        # Existing key
    echo BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
    echo
    echo S                                         #
    echo E                                         #
    echo A                                         #
    echo Q                                         #
    echo 0                                         # key does not expire
    echo save
} | gpg --expert --command-fd=0 --status-fd=1 --pinentry-mode=loopback --edit-key AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Then I tried with argument --command-file (it does not work):

cat > /tmp/cmd << EOF
addkey
13
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
S
E
A
Q
0
save
EOF

gpg --expert --command-file=/tmp/cmd --status-fd=1 --pinentry-mode=loopback --edit-key AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

None of these two methods works. The prompt 'Enter the keygrip: ' always shows up. I really want to avoid user interaction in this process. I've tried many stream redirection like piping (with command yes), Here Documents, Here Strings, process substitution, etc. Nothing seems to work to inject the keygrip without a human intervention.