4 ms·

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.

andyonthewings 8y ago
> I'm afraid to link it here because the traffic might kill my puny box. Setup Cloudflare, which is free and easy to use. Or, just post an Internet Archive wayback machine copy of your post would be good enough.
- askmike 8y ago
  Given that he: > I wrote a blog post on this recently, using only open-source tools that don't come from big corps. I doubt he wants to use CloudFlare ;)
  - Spivak 8y ago
    Philosophically is using CloudFlare or whatever CDN any worse that using the normal internet infrastructure in terms of software freedom?
    - askmike 8y ago
      Definitely, all traffic is readable by CloudFlare. Whereas if you have your own SSL certs everything going through the "normal internet infrastructure" is encrypted (in theory your webhost is able to get to it, but definitely not as easily - and this is only an issue if you rent a server). On top of that there are many arguments against CloudFlare when it comes to an open and decentralized internet. EDIT: didn't read the Philosophically in your comment. CloudFlare does many things against an open internet, for a long time they blocked (or required excessive captchas) for all TOR users.
mises 8y ago
Unless you're hitting a database for every connection, even a puny box ought to be fine.
- alias_neo 8y ago
  Static site, no DBs. Link's posted so let's see!
  - mises 8y ago
    Looks great. If it's static, try using netlify and cloudflare; I've used cloudflare with great success for years, and I just tried netlify (works great & free).
jlgaddis 8y ago
> I'm afraid to link it here because the traffic might kill my puny box. So what if it does? Presumably it isn't a "critical" host so the worst that could happen is, what, no one can read what your blog posts for a little while? Eventually, the traffic will go away and things will go back to normal, yeah? I assume that (part of) the reason for writing your blog post was so that others could read it. Yet, by not posting the link, you are ensuring that we don't -- even though pretty much all of us in this comment thread are the target audience. Alternatively, as someone else mentioned, there are things like the Internet Archive. (FWIW, several years ago, a page on my blog was linked by The Atlantic one morning and shortly thereafter it also hit the front page of (IIRC) both Reddit and HN. The only way I figured out that "something was up" was due to the huge number of "new follower" notifications I was getting from Twitter as I was driving to work. At the time, I was running WordPress on a little VPS with 1 CPU core and 768 MB of RAM and it handled the ~115,000 page views just fine that day -- although I did have caching and such in place. YMMV.)
- alias_neo 8y ago
  You make many valid points there. Here's the link, let's see what happens: Caveat lector: This is a "beginner" guide targeted at Raspberry Pi users, ignore the Pi related parts. I intend to publish a second part about using keys instead of passwords. https://2byt.es/post/totp/ https://2byt.es/post/totp/ The blog content is open source on GitHub so feel free to raise issues if necessary.
  - e12e 8y ago
    Nice walk-through. Re:bandwidth worries, for this crowd, you probably just link to: https://github.com/2bytes/website/blob/master/content/post/totp.md https://github.com/2bytes/website/blob/master/content/post/t... I doubt hn will take down github...
    - alias_neo 8y ago
      I had considered that, but as someone else else pointed out, what have I got to lose if it's taken down? At least with links to my blog I can use the access logs for an idea of which articles people find interesting (I don't do other metrics/analytics due to my philosophy). At the moment I'm trying to build a new box to host this on but it seems Caddy has broken source builds (again) and I need plugins for my Git hooks and Hugo build. Searching around for an alternative. Edit: and thanks for the compliment.

andyonthewings 8y ago

> I'm afraid to link it here because the traffic might kill my puny box. Setup Cloudflare, which is free and easy to use. Or, just post an Internet Archive wayback machine copy of your post would be good enough.

askmike 8y ago
Given that he: > I wrote a blog post on this recently, using only open-source tools that don't come from big corps. I doubt he wants to use CloudFlare ;)
- Spivak 8y ago
  Philosophically is using CloudFlare or whatever CDN any worse that using the normal internet infrastructure in terms of software freedom?
  - askmike 8y ago
    Definitely, all traffic is readable by CloudFlare. Whereas if you have your own SSL certs everything going through the "normal internet infrastructure" is encrypted (in theory your webhost is able to get to it, but definitely not as easily - and this is only an issue if you rent a server). On top of that there are many arguments against CloudFlare when it comes to an open and decentralized internet. EDIT: didn't read the Philosophically in your comment. CloudFlare does many things against an open internet, for a long time they blocked (or required excessive captchas) for all TOR users.

mises 8y ago

Unless you're hitting a database for every connection, even a puny box ought to be fine.

alias_neo 8y ago
Static site, no DBs. Link's posted so let's see!
- mises 8y ago
  Looks great. If it's static, try using netlify and cloudflare; I've used cloudflare with great success for years, and I just tried netlify (works great & free).

jlgaddis 8y ago

> I'm afraid to link it here because the traffic might kill my puny box. So what if it does? Presumably it isn't a "critical" host so the worst that could happen is, what, no one can read what your blog posts for a little while? Eventually, the traffic will go away and things will go back to normal, yeah? I assume that (part of) the reason for writing your blog post was so that others could read it. Yet, by not posting the link, you are ensuring that we don't -- even though pretty much all of us in this comment thread are the target audience. Alternatively, as someone else mentioned, there are things like the Internet Archive. (FWIW, several years ago, a page on my blog was linked by The Atlantic one morning and shortly thereafter it also hit the front page of (IIRC) both Reddit and HN. The only way I figured out that "something was up" was due to the huge number of "new follower" notifications I was getting from Twitter as I was driving to work. At the time, I was running WordPress on a little VPS with 1 CPU core and 768 MB of RAM and it handled the ~115,000 page views just fine that day -- although I did have caching and such in place. YMMV.)

alias_neo 8y ago
You make many valid points there. Here's the link, let's see what happens: Caveat lector: This is a "beginner" guide targeted at Raspberry Pi users, ignore the Pi related parts. I intend to publish a second part about using keys instead of passwords. https://2byt.es/post/totp/ https://2byt.es/post/totp/ The blog content is open source on GitHub so feel free to raise issues if necessary.
- e12e 8y ago
  Nice walk-through. Re:bandwidth worries, for this crowd, you probably just link to: https://github.com/2bytes/website/blob/master/content/post/totp.md https://github.com/2bytes/website/blob/master/content/post/t... I doubt hn will take down github...
  - alias_neo 8y ago
    I had considered that, but as someone else else pointed out, what have I got to lose if it's taken down? At least with links to my blog I can use the access logs for an idea of which articles people find interesting (I don't do other metrics/analytics due to my philosophy). At the moment I'm trying to build a new box to host this on but it seems Caddy has broken source builds (again) and I need plugins for my Git hooks and Hugo build. Searching around for an alternative. Edit: and thanks for the compliment.