How To: List what Procs are using the Lib in Linux

LsOF

Find the Procs

After upgrading an important package in Linux -or other Unix variant- that provides a library used by many other processes. Instead of restarting the server for the new lib to take effect, the procs can be restarted -or HUPed- individually.

Before we begin, lsof needs to be installed.
# RHEL / CentOS
~$ yum install lsof

# Debian / Ubuntu
~$ apt-get install lsof

In the following example, we list what processes are using the libcrypto library in Raspbian.
~$ lsof /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 551 root mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
ntpd 2321 ntp mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
sshd 6643 root mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
sshd 6649 meow mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
openvpn 30044 nobody mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0

Next, the affected processes can be restarted:
~$ service [SERVICENAME] restart
~$ systemctl restart [SERVICENAME]
~$ kill -HUP 31337

How To: TOTP 2FA Linux SSH Using Google-Authenticator

Lock Tux

Using only a username and password for authentication is no longer secure. With user-database dumps reaching millions of exposed, albeit hashed and salted, passwords. Secure authentication should include not only something you know, but also something you have (in your pocket… always).

There have been several OTP and general 2FA solutions for Linux. From SMS (Text-me-a-password) to Yubikeys. There exists a Free (so far) TOTP (Time-Based One Time Password) solution from Google, called Google Authenticator.

Google Authenticator for iOS

It uses an App called Authenticator for iOS (and Android i presume) to “show” you the tokens, who live for 30 seconds each. There exists an even more awesome package for Debian and Ubuntu called google-authenticator, which allows you to easily set it up! The package also includes the necessary PAM module.

I have made the following steps on a Raspberry Pi, running Raspian.

  1. Install Google Authenticator
    pi@awesomebox ~ $ sudo apt-get install libpam-google-authenticator
  2. Run Google Authenticator
    pi@awesomebox ~ $ google-authenticator
    Do you want authentication tokens to be time-based (y/n) y
    ...BIG
    ......FANCY
    .........QR-CODE
    Your new secret key is: ZZZZZZZZZZZZZZZZ
    Your verification code is 123456
    Your emergency scratch codes are:
    11111111
    22222222
    33333333
    44444444
    55555555
  3. Scan the QR-CODE on screen with the Authenticator App
    Scanning...
  4. Answer yes (y)
    Do you want me to update your "/home/pi/.google_authenticator" file (y/n) y
    Do you want to disallow multiple uses of the same authentication token? (y/n) y
    By default, tokens are good for 30 seconds and in order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. Do you want to do so (y/n) y
    Do you want to enable rate-limiting (y/n) y
  5. Add PAM module
    pi@awesomebox ~ $ sudo echo "auth required pam_google_authenticator.so" >> /etc/pam.d/sshd
  6. Enable “Challenge-Response Authentication” in SSH
    pi@awesomebox ~ $ sudo vi /etc/ssh/sshd_config
    Change entry ChallengeResponseAuthentication from no to yes.
  7. Restard SSH
    pi@awesomebox ~ $ service ssh restart
  8. Test it out
    Open up a new terminal window and ssh to your box as you normally would
    user@lazybox ~ $ ssh pi@awesomebox
    Password: [Enter password]
    Verification code: [Enter TOTP-token from App]

Happy TOTP-ing :)