ssh

vim with rclone on MFA-enabled Nextcloud

I forgot that I enabled MFA on my Nextcloud instance and it broke rclone. This is something the Nextcloud documentation makes clear but neither the instance nor rclone itself will tell you what’s actually wrong or how to fix it.

First, on Nextcloud:

  1. Go to Settings › Security.
  2. Scroll down to the bottom. Enter something descriptive like “rclone” in the entry box, then click Generate App Password.
  3. Nextcloud will display an application-specific password. Leave the screen here. Nextcloud will only display it the one time

You can always start over if you don’t copy it so depending on your password policies you might want to save it in your password manager.

Now, switch over to your shell:

  1. First, kill the current rclone mount: $ fusermount -u /home/nullrend/Nextcloud. Do not just kill the rclone job. Apparently the rclone devs think it’s too hard to implement a rclone umount /mount/dir command or sum’thin’.
  2. Do $ rclone config and delete the current Nextcloud remote endpoint. Much easier to start from scratch.
  3. When you get to the password entry, enter the password given to you by Nextcloud.
  4. Finish the process.

At this point you can save the password on Nextcloud so it actually allows rclone to connect through WebDAV.

To mount the new remote endpoint do something like $ rclone mount endpoint:/ ~/Nextcloud --daemon --dir-cache-time 120m --max-read-ahead 256 --no-modtime --vfs-cache-mode full --vfs-cache-poll-interval 120m. You will need to play with the caching flags depending on what you’re doing and what your needs are.

For my own use case I’m mostly using vim to interact with my vimwiki files so I also often do :set noswapfile to stop vim from bitching about files that are likely open elsewhere.

vim with rclone on MFA-enabled Nextcloud Read More »

Locked out? Good luck

Let’s build and configure a minimal SSH bastion host (jump box) from scratch, using Ubuntu 20.04 LTS.

Source: DIY SSH Bastion Host

This is all well and good except for the bit where the author is clearly invested in using the cloud (i.e. other people’s computers) to run your own infrastructure.

What happens when google locks you out? Or when amazon decides to do the same. Same concern goes for Azure, or any other cloud provider.

Good luck fixing any of that without having to tear down a lot of your own work just to be able to be useful again. I get it, from a developer point of view setting it like this means it’s easy to plug into projects, but from a sysadmin point of view it means you’re going to shoot yourself in the foot sooner rather than later, specially if you missed a little onfiguration detail that lets your server wide open for takeover.

Locked out? Good luck Read More »