Updating a new ssh key on an exposed server

I recently realized I had exposed my server's ssh keys.  This was a beginner's blunder.

So the question then becomes how do I securely:

1) change delete the old ssh key (so whoever has access will no longer be able to get in)

2) add a fresh new ssh key


To do this I had to first generate a new ssh key on my client, and make sure my ~/.ssh/config file was appropriately pointing to the new key files.

On the server side, just assume someone is logged in.  Type:

   users  | wc -w

If the result is greater than 1, someone else is logged in.  Even if nobody else is logged in, just assume that at any moment someone may attempt to log in.

To kill all other connections, I rebooted the server.  [Maybe there's a better way?]


After reboot, log back in.

Now edit the /etc/passwd file so that the current user you are logged in as cannot log in again.

Change this line:
   ec2-user:x:500:500:EC2 Default User:/home/ec2-user:/bin/bash

to look like this:
  ec2-user:x:500:500:EC2 Default User:/home/ec2-user:/sbin/nologin


Save the file.  [I do all file editing in vi.]


If this worked correctly, you can verify that attempting to login won't work in another shell.  Also verify that scp no longer works.  If these still work as before, then the method I've documented here is not for you.

Verify only 1 user logged in.

[EDIT.140626] Verify /etc/init.d and /etc/rc.local are unchanged (that is, they aren't starting an unexpected script).

At this point you can edit the server's user account ~/.ssh/authorized_keys file to delete the old (exposed) key, and paste in the new public key you generated earlier.

Once the old key is deleted, it's safe to revert the /etc/passwd file back to the way it was, and log in with the new key.

How to Safely Update OSX

EDIT2:

As per http://apple.stackexchange.com/questions/103261/what-solutions-exist-to-rectify-a-corrupt-user-account-in-os-x, I've had temporary success running a terminal:

$ sudo su
$ cp  /Users/<corrupteduser>/Libraries/Cache /somebackupdirectory
$ rm -r /Users/<corrupteduser>/Libraries/Cache/*
$ reboot

After it reboots the account could be logged into and used normally, but trying to close all the apps and reboot resulted in the account being corrupt again.  So it's just a temporary solution.


















EDIT:
Right now, all I can recommend is to create a new user account if you find an account which crashes Finder and appears to be corrupt.  None of the other advice on this post appears to work.  I have yet to try always closing all apps before doing an update.  So far, every time I've done an update in Mountain Lion, my account gets corrupted and will eventually crash Finder.  Even changing the corrupted account name doesn't fix it.


Original Post Below:

I'm somewhat still an OSX newb - and after several occurrences of updating the OS (10.8 Mountain Lion in my case) only to find it in an unusable state, here is what I recommend as an update process.


But first, the reasons why:

1) Even after finding that after an update things where in such a bad state that Finder would repeated crash, logging into a different user account worked fine.

2) All apps and working state in the other account was also still in tact after the update.

So I'm concluding that the user account actually gets corrupted (quite regularly) when running an OSX update.


If you haven't already experienced this - good news!  You can still "do the right thing" so you'll be prepared if it ever does happen.  Here's how to prepare:

1) Create another admin account.  Call it OSupdate or similar.  The purpose of this account is to only do updates from this account, and while doing the update, no other applications will be open (which might be what's causing the account corruption I'm seeing).

2) If possible, create a non-admin account which you normally work from.  This isn't really necessary for this process, but it's more secure than running from an admin account every day.  [Of course, some applications require an admin account, so if this is part of your normal workflow, you can just skip this step.]


CONCLUSION:
If you have the misfortune of a bad OSX update, the first thing to try log into a different user account if they are available, to verify that the account isn't corrupted, rather than the whole OSX install.

For more details:
http://apple.stackexchange.com/questions/103261/what-solutions-exist-to-rectify-a-corrupt-user-account-in-os-x


UPDATE:
Following these steps http://support.apple.com/kb/ht1428 to change my corrupted account name (in an attempt of starting over but still having access to old files), just changing the account name seems to have put that account back into a runnable state.  I'll have to run it for a while before I'm confident that's really the case.

Refactoring is awesome

Today my goal is to read the whole C# book (Programming C# 4.0), in skimming fashion.  I'll miss a lot - but occasionally little nuggets have a way of jumping out.

One of those nuggets is refactoring.

So... sometimes I'm a coding slob.  It's really very embarrassing.  It almost feels like the stack I have in my brain is full, and so I'm not willing to add yet another layer of function calls into the method I'm currently writing, so I wind up with code that looks like this:

void frankslongmethod()
{
    doAction1a();
    doAction1b();

    doAction1c();

    doAction2a();
    doAction2b();
    doAction2c();
}

And you can easily imagine this growing into a hideous monstrosity very quickly.

*** It turns out that Visual Studio and Monodevelop have automated creating functions (and this step is called "refactoring").  You can conveniently select lines of code and right click "refactor" and it will bring up a dialog that lets you name the new function it will generate for you. ***


Afterwards, the code can look like this (depending on what code I selected and how I chose to name it):

void frankslongmethod()
{
   doAction1();

   doAction2();
}

void doAction1()

{

    doAction1a();
    doAction1b();

    doAction1c();

}

void doAction2()
{
    doAction2a();
    doAction2b();
    doAction2c();
}

It's also very slick - the automation process can figure out what arguments need to be passed to the generated functions.  Well worth trying out for yourself.

The beauty of it - my brain stack didn't need to be enlarged.  I just have to take this extra step of cleaning up my code with a refactoring step after I've finished my "write this algorithm as fast as you can" phase.

[And of course we can discuss this is taking an extra call - but that might even be handled by the compiler at run-time, so no worries for now.  If you're hitting that wall, it's a problem that can be addressed - the more serious problem is reducing cognitive load on new programmers trying to understand what the code does.]

Unity3d Build Target Switch Avoidance with Git

To avoid the time for a build target switch (which going from OSX to iOS is very long), I recommend duplicating the whole git repository in another directory.  Like this:

./MyProject.git.iOS/MyProject

./MyProject.git.OSXtarget/MyProject

You can run a git clone from a remote, or you can do a git clone from your local hard drive:

Franks-MacBook-Pro:MyProject.git.OSXtarget frank$ git clone ../MyProject.git.iOS/MyProject

Cloning into 'MyProject'...

done.

Checking connectivity... done

Checking out files: 100% (3828/3828), done.

Franks-MacBook-Pro:MyProject.git.OSXtarget frankbraker$ ls

MyProject

Franks-MacBook-Pro:MyProject.git.OSXtarget frankbraker$ cd MyProject/

Franks-MacBook-Pro:MyProject frankbraker$ ls

Assets Heapshots ProjectSettings

If your .gitignore is set up as per HowToSetUp.gitignoreForUnity3D the clone will be missing library files, it will take some time when you first open the project to import assets, and some plugin menus may be missing.  I don't know the deep mojo, but I'll religiously close and reopen, close and reopen again, and the plugin menus eventually show up.

The beauty is, if you make changes here, just check them in, push, and you can pull from your other target repository to get those changes, and the target switch time is much faster.

I also noticed push wants to push to your local drive (which didn't work for me).  I had to set up a remote as in the original target's git directory.

How to clear the screen in cygwin

alias cls='echo -e "\033c"'

Recovering files from a crashed Mac

[Edit]  The original post assume you were running OSX 10.7 (Lion).

OSX 10.8 (Mountain Lion) will not let you boot from a Linux CD (at least not for me).  So now what?

Method 0: Use the terminal for copying files.  If you boot to the recover utilities (which are part of the Mountain Lion disk as a separate partition - boot up with the option key depressed), there's a Utilities pull-down with "terminal".  It's not that bad as long as you know:

- /Volumes/USBXXX/* has the USB drive you plugged in

- /Volumes/MacintoshXXX/* has your hard-drive files you want to recover

- /Volumes/MacintoshXXX/Users/frankbraker_or_whatever_your_username_is/.* has your hidden files and directories (use ls -a to see them)

- /Volumes/MacintoshXXX/Users/frankbraker_or_whatever_your_username_is/* has everything else

- /Volumes/MacintoshXXX/Users/frankbraker_or_whatever_your_username_is/Library/Keychains has your keychain files

- XCode 5.0 automatically generates provisioning… and "of that which we cannot speak, we must remain silent" Ludwig Wittgenstein.

- cp -r sourcepath/* destpath/.  copies directories recursively


For example, this will back up all your .ssh config files:

mkdir /Volumes/USBXXX/.ssh

cp -r /Volumes/MacintoshXXX/Users/frank/.ssh/* /Volumes/USBXXX/.ssh/.


This was all off the top of my head… buyer beware!  :)






//---------------------------------- ORIGINAL POST BELOW ------------------------------

Scenario:  My Mac won't boot anymore and the disk utilities say the disk can't be repaired, and that I should recover all the files that I can before formatting and reinstalling the OS.  But how to recover the files?


Method 1: Firewire

1) Spend money for a Firewire cable.

2) Boot the Mac with the "t" key depressed which puts it into external HD mode

3) Copy files (watch this video if you're interested: http://www.youtube.com/watch?v=bVRx6R6hs9Q

Method 2: Linux boot disk

0) Wonder why you have an OSX installation USB drive, but it can't boot to copy files.  Maybe it does if you know the secret handshake?

1) Plug in an external drive large enough.

2) Boot with a Linux CD.

     a) Before your Mac is toast: burn the CD from here: http://www.linuxmint.com/download.php

     b) After your Mac is toast: while powering up, press the "option" key and select the CD.  I recommend Linux Mint because it doesn't require that much command line knowledge to use effectively.

3) Open a file browser.  If you try to navigate to the Mac drive, it will work until you get to user files (which are "protected").  But you can open folders as admin (in a pull-down menu right clicking on the folder).

4) The file browser works fine for copying, and especially for compressing large folders onto the external drive (because I want .zip rather than .tar or .gz, although those are available too).


Alternatively, once you've opened a folder as admin, open a folder with a terminal (same pull-down menu) - the terminal will be open as admin (red "mint" username), and disabled commands now work:

cp -r folder/* /media/<external drive name such as "4D84-911B">/folder/.

Diffing all files in all subdirectories

Note to self... to diff all the files in all subdirectories in cygwin, type:

$ cd /cygdrive/c/d1

$ dir2=/cygdrive/c/d2; out1=/cygdrive/c/outfile.out; rm "$out1"; for dir1 in $(find . -type d); do ( for file in ${dir1}/*; do echo "${dir1}/${file}">> "$out1"; echo "${dir2}/${file}">> "$out1"; diff "${dir1}/${file}" "${dir2}/${file}" >> "$out1"; done ); done;

based on: http://askubuntu.com/questions/111495/how-to-diff-multiple-files-across-directories

There's probably some fancy tool that does this too, like windiff or something.  This way is pretty noisy.