DEV Community: Anshuman

I gave Claude Code five different personalities and run them all at once

Anshuman — Mon, 30 Mar 2026 18:20:35 +0000

Claude Code is already great at what it does. But it does the same thing every time — regardless of whether I’m exploring an idea, writing code, or hunting a bug.

I wanted Claude to think differently depending on the task. Not just follow instructions — actually stay in a specific mindset throughout an entire session.

So I built Clauge.

Five modes, five behaviors

When you create a session in Clauge, you pick a purpose. Claude adapts — and stays that way for the entire conversation.

Brainstorming won’t write a single line of code until you’ve thought through the approach. It pushes back, proposes alternatives, and forces you to decide before building. I stopped building wrong things because of this mode alone.

Development focuses on clean, small, verified changes. No random refactoring. No “let me also improve this while I’m here.”

Code Review gets critical. Real bugs, security gaps, missing edge cases — with file and line references. Not vague suggestions.

PR Review pulls the branch diff and reviews the full PR. I use this before merging anything from my team.

Debugging follows a strict process: reproduce, hypothesize, verify, fix. No guessing.

Parallel sessions on the same project

This is the part I use most. Brainstorming in one session, development in another — same project, same codebase. Sessions are automatically isolated so they don’t step on each other.

Switch between them instantly. Everything stays alive.

The numbers

7MB app. That’s it. Built with Rust + Tauri.
Session and weekly usage limits visible in the menu bar. No more wondering if you’re about to hit your cap.
Sessions organized by project. Expand, collapse, keyboard shortcuts for everything.

Clauge is Free and Open Source,

Try Clauge Today!

💻 Download Clauge
🌟 Star on GitHub

Check out more projects on GitHub

ansxuman (Anshuman) · GitHub

Onto the next one 😎. ansxuman has 19 repositories available. Follow their code on GitHub.

github.com

The Perfect Trio: Wails, Go & Svelte in Action

Anshuman — Tue, 03 Dec 2024 12:11:59 +0000

Tired of juggling your phone or browser just to get your TOTP? Meet Clave — a lightweight, cross-platform desktop authenticator that simplifies secure authentication without the hassle.

Why I Built Clave ?

The frustration of constantly pulling out my phone for TOTPs or being locked into a browser extension pushed me to create a better solution. Existing desktop options were either boring or paid-only for basic features.I explored a few authenticator apps on the App Store. While I found one I liked, it only allowed adding a maximum of three accounts for free. To add more, I had to pay, even though the app offered very limited features.That’s when I decided to build my own app using Wails v3 + GO.

Key Features

Simple, intuitive design for hassle-free experience

Add accounts easily via manual entry or QR code image import

Protect access to your TOTP codes with an additional layer of security using a PIN or Touch ID (macOS only)

Available for macOS, Windows, and Linux

Quick access from system tray for convenience

Easily backup and restore your profiles

Tech Stack

Clave is built with a modern stack for performance and simplicity:

Wails v3: Lightweight framework for building cross-platform desktop apps with Go and web technologies.
Go: Handles native system interactions and provides core application functionality.
SvelteKit: Fast, reactive frontend framework.
Tailwind CSS: Utility-first CSS framework used for building UI components.
TypeScript: Static typing for better code quality and maintainability.

Try Clave Today!

I Created a Developer Portfolio inspired by the macOS interface

Anshuman — Sat, 09 Nov 2024 04:15:24 +0000

Creating portfolio websites has been a long-time hobby of mine, going all the way back to my first site, built and hosted on wapka.mobi in 2009. This time, I wanted to create something unique that incorporates elements I use daily.

The Idea & Inspiration

I’ve always been a fan of Apple product UIs, whether it’s Skeuomorphism, Flat UI, Glassmorphism, etc. I’ve been using MacBook M1 for a while, and I believe macOS offers the best of both worlds — Windows and Linux. I absolutely love its overall UX. With this in mind, I wanted to bring that same refined, intuitive feel to my website, offering a glimpse of my perspective and how I see my machine.

What’s So Unique?

While there are plenty of websites out there based on OS themes, what makes this one stand out?

It’s true that there are many impressive projects that do a great job of mimicking macOS’ user interface, and in some cases, even do a better job. However, this website goes beyond just replicating macOS — it has several unique features.

First, there’s a Desktop Music Widget that streams copyright-free songs, something I personally use to boost productivity. Then, there’s the Project App, which displays my GitHub projects in a distinctive and engaging style. And last but not least, there’s the Note App, which automatically fetch using dev.to api and shows my latest blog posts without needing manual updates.

macOS Theme Portfolio

If you’re interested in exploring the code or want to access the live version of the portfolio, feel free to visit my GitHub or website to see the project in action.

Building Cross-Platform System Services in Go: A Step-by-Step Guide

Anshuman — Sun, 03 Nov 2024 17:33:01 +0000

What Are System Services?

System Services are lightweight programs that operate in the background without a graphical user interface . They start automatically during system boot and run independently.Their lifecycle, which includes operations like start, stop, and restart are managed by Service Control Manager on Windows, systemd on Linux(in most of the destro) and launchd on macOS.

Unlike standard applications, services are designed for continuous operation and are essential for tasks such as monitoring, logging, and other background processes. On linux, these services are generally referred to as daemons, while on macOS, they known as Launch Agents or Daemons.

Why Go for Building System Services?

Creating cross-platform system services demands a language that balances efficiency, usability, and reliability. Go excels in this regard for several reasons:

Concurrency and Performance: Go’s goroutines make it easy to run multiple tasks at once, improving efficiency and speed on different platforms. Coupled with a robust standard library, this minimizes external dependencies and enhances cross-platform compatibility.
Memory Management and Stability: Go’s garbage collection prevents memory leaks, keeping systems stable. Its clear error handling also makes it easier to debug complex services.
Simplicity and Maintainability: Go’s clear syntax simplifies writing and maintaining services . Its capability to produce statically linked binaries results in single executable files that include all necessary dependencies, eliminating the need for separate runtime environments.
Cross-Compilation and Flexibility: Go’s support for cross-compilation allows building executables for various operating systems from a single codebase. With CGO, Go can interact with low-level system APIs, such as Win32 and Objective-C, providing developers the flexibility to leverage native features.

Writing Services in Go

This code walk through assumes that GO is installed on your machine and you have a basic knowledge on GO’s syntax, if not i would highly recommend you to Take A Tour .

Project Overview

go-service/
├── Makefile                 # Build and installation automation
├── cmd/
│   └── service/
│       └── main.go          # Main entry point with CLI flags and command handling
├── internal/
│   ├── service/
│   │   └── service.go       # Core service implementation
│   └── platform/            # Platform-specific implementations
│       ├── config.go        # Configuration constants
│       ├── service.go       # Cross-platform service interface
│       ├── windows.go       # Windows-specific service management
│       ├── linux.go         # Linux-specific systemd service management
│       └── darwin.go        # macOS-specific launchd service management
└── go.mod                   # Go module definition

Step 1: Define Configurations

Initialize the Go module:

go mod init go-service

Define configuration constants in config.go within the internal/platform directory. This file centralizes all configurable values, making it easy to adjust settings.

File: internal/platform/config.go

package platform

import (
    "fmt"
    "io"
    "os"
    "path/filepath"
    "runtime"
)

// Update these constants with your own service configuration details.
// Replace the service name, display name, and description as needed.
// LogFileName is optional and is used to demonstrate an example service core logic
// that appends text to a file periodically.
const (
    ServiceName    = "go-service"
    ServiceDisplay = "Go Service"
    ServiceDesc    = "A service that appends 'Hello World' to a file every 5 minutes."
    LogFileName    = "go-service-log.txt"
)

func GetInstallDir() string {
    switch runtime.GOOS {
    case "darwin":
        return "/usr/local/opt/" + ServiceName
    case "linux":
        return "/opt/" + ServiceName
    case "windows":
        return filepath.Join(os.Getenv("ProgramData"), ServiceName)
    default:
        return ""
    }
}

func copyFile(src, dst string) error {
    source, err := os.Open(src)
    if err != nil {
        return fmt.Errorf("failed to open source file: %w", err)
    }
    defer source.Close()

    destination, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0755)
    if err != nil {
        return fmt.Errorf("failed to create destination file: %w", err)
    }
    defer destination.Close()

    _, err = io.Copy(destination, source)
    return err
}

Key features:

Service Constants which will be used during Platform-Specific Service Configurations.
GetInstallDir() provides appropriate service installation and log file paths for each OS.
copyFile() used during service installation to copy the executable to our specific path provided by GetInstallDir().

Step 2: Defining Core Service Logic

In the internal/service, implement the core functionality for your service.In this example, the service appends "Hello World" to a file in the user's home directory every 5 minutes.

File: internal/service/service.go

Service Structure

type Service struct {
 logFile string
 stop    chan struct{}
 wg      sync.WaitGroup
 started bool
 mu      sync.Mutex
}

Service Creation

func New() (*Service, error) {
 installDir := platform.GetInstallDir()
 if installDir == "" {
  return nil, fmt.Errorf("unsupported operating system: %s", runtime.GOOS)
 }

 logFile := filepath.Join(installDir, "logs", platform.LogFileName)

 return &Service{
  logFile: logFile,
  stop:    make(chan struct{}),
 }, nil
}

Service Lifecycle

The service implements Start and Stop methods for lifecycle management:

// Start the service
func (s *Service) Start(ctx context.Context) error {
 s.mu.Lock()
 if s.started {
  s.mu.Unlock()
  return fmt.Errorf("service already started")
 }
 s.started = true
 s.mu.Unlock()

 if err := os.MkdirAll(filepath.Dir(s.logFile), 0755); err != nil {
  return fmt.Errorf("failed to create log directory: %w", err)
 }

 s.wg.Add(1)
 go s.run(ctx)

 return nil
}

// Stop the service gracefully
func (s *Service) Stop() error {
 s.mu.Lock()
 if !s.started {
  s.mu.Unlock()
  return fmt.Errorf("service not started")
 }
 s.mu.Unlock()

 close(s.stop)
 s.wg.Wait()

 s.mu.Lock()
 s.started = false
 s.mu.Unlock()

 return nil
}

Main Service Loop

func (s *Service) run(ctx context.Context) {
 defer s.wg.Done()
 log.Printf("Service started, logging to: %s\n", s.logFile)

 ticker := time.NewTicker(5 * time.Minute)
 defer ticker.Stop()

 if err := s.writeLog(); err != nil {
  log.Printf("Error writing initial log: %v\n", err)
 }

 for {
  select {
  case <-ctx.Done():
   log.Println("Service stopping due to context cancellation")
   return
  case <-s.stop:
   log.Println("Service stopping due to stop signal")
   return
  case <-ticker.C:
   if err := s.writeLog(); err != nil {
    log.Printf("Error writing log: %v\n", err)
   }
  }
 }
}

The run method handles the core service logic:

Key features:

Interval-based execution using ticker
Context cancellation support
Graceful shutdown handling
Error logging

Log Writing

The service appends “Hello World” with a timestamp every 5 minutes

func (s *Service) writeLog() error {
 f, err := os.OpenFile(s.logFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 if err != nil {
  return fmt.Errorf("failed to open log file: %w", err)
 }
 defer f.Close()

 _, err = f.WriteString(fmt.Sprintf("[%s] Hello World\n", time.Now().Format(time.RFC3339)))
 if err != nil {
  return fmt.Errorf("failed to write to log file: %w", err)
 }
 return nil
}

Step 3: Creating Platform-Specific Service Configurations

The internal/platform directory contains platform-specific configurations to install, uninstall, and manage the service.

macOS (darwin.go)

In darwin.go, define macOS-specific logic for creating a .plist file, which handles service installation and uninstallation using launchctl.

File:internal/platform/darwin.go

package platform

import (
 "fmt"
 "os"
 "os/exec"
 "path/filepath"
)

type darwinService struct{}

const plistTemplate = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>%s</string>
    <key>ProgramArguments</key>
    <array>
        <string>%s</string>
        <string>-run</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
    <key>WorkingDirectory</key>
    <string>%s</string>
</dict>
</plist>`

func (s *darwinService) Install(execPath string) error {
 installDir := GetInstallDir()
 if err := os.MkdirAll(installDir, 0755); err != nil {
  return fmt.Errorf("failed to create installation directory: %w", err)
 }

 // Copy binary to installation directory
 installedBinary := filepath.Join(installDir, "bin", filepath.Base(execPath))
 if err := os.MkdirAll(filepath.Dir(installedBinary), 0755); err != nil {
  return fmt.Errorf("failed to create bin directory: %w", err)
 }

 if err := copyFile(execPath, installedBinary); err != nil {
  return fmt.Errorf("failed to copy binary: %w", err)
 }

 plistPath := filepath.Join("/Library/LaunchDaemons", ServiceName+".plist")
 content := fmt.Sprintf(plistTemplate, ServiceName, installedBinary, installDir)

 if err := os.WriteFile(plistPath, []byte(content), 0644); err != nil {
  return fmt.Errorf("failed to write plist file: %w", err)
 }

 if err := exec.Command("launchctl", "load", plistPath).Run(); err != nil {
  return fmt.Errorf("failed to load service: %w", err)
 }
 return nil
}

func (s *darwinService) Uninstall() error {
 plistPath := filepath.Join("/Library/LaunchDaemons", ServiceName+".plist")

 if err := exec.Command("launchctl", "unload", plistPath).Run(); err != nil {
  return fmt.Errorf("failed to unload service: %w", err)
 }

 if err := os.Remove(plistPath); err != nil {
  return fmt.Errorf("failed to remove plist file: %w", err)
 }
 return nil
}

func (s *darwinService) Status() (bool, error) {
 err := exec.Command("launchctl", "list", ServiceName).Run()
 return err == nil, nil
}

func (s *darwinService) Start() error {
 if err := exec.Command("launchctl", "start", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to start service: %w", err)
 }
 return nil
}

func (s *darwinService) Stop() error {
 if err := exec.Command("launchctl", "stop", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to stop service: %w", err)
 }
 return nil
}

Linux (linux.go)

On Linux, we use systemd to manage the service. Define a .service file and related methods.

File:internal/platform/linux.go


package platform

import (
 "fmt"
 "os"
 "os/exec"
 "path/filepath"
)

type linuxService struct{}

const systemdServiceTemplate = `[Unit]
Description=%s

[Service]
ExecStart=%s -run
Restart=always
User=root
WorkingDirectory=%s

[Install]
WantedBy=multi-user.target
`

func (s *linuxService) Install(execPath string) error {
 installDir := GetInstallDir()
 if err := os.MkdirAll(installDir, 0755); err != nil {
  return fmt.Errorf("failed to create installation directory: %w", err)
 }

 installedBinary := filepath.Join(installDir, "bin", filepath.Base(execPath))
 if err := os.MkdirAll(filepath.Dir(installedBinary), 0755); err != nil {
  return fmt.Errorf("failed to create bin directory: %w", err)
 }

 if err := copyFile(execPath, installedBinary); err != nil {
  return fmt.Errorf("failed to copy binary: %w", err)
 }

 servicePath := filepath.Join("/etc/systemd/system", ServiceName+".service")
 content := fmt.Sprintf(systemdServiceTemplate, ServiceDesc, installedBinary, installDir)

 if err := os.WriteFile(servicePath, []byte(content), 0644); err != nil {
  return fmt.Errorf("failed to write service file: %w", err)
 }

 commands := [][]string{
  {"systemctl", "daemon-reload"},
  {"systemctl", "enable", ServiceName},
  {"systemctl", "start", ServiceName},
 }

 for _, args := range commands {
  if err := exec.Command(args[0], args[1:]...).Run(); err != nil {
   return fmt.Errorf("failed to execute %s: %w", args[0], err)
  }
 }
 return nil
}

func (s *linuxService) Uninstall() error {
 _ = exec.Command("systemctl", "stop", ServiceName).Run()
 _ = exec.Command("systemctl", "disable", ServiceName).Run()

 servicePath := filepath.Join("/etc/systemd/system", ServiceName+".service")
 if err := os.Remove(servicePath); err != nil {
  return fmt.Errorf("failed to remove service file: %w", err)
 }
 return nil
}

func (s *linuxService) Status() (bool, error) {
 output, err := exec.Command("systemctl", "is-active", ServiceName).Output()
 if err != nil {
  return false, nil
 }
 return string(output) == "active\n", nil
}

func (s *linuxService) Start() error {
 if err := exec.Command("systemctl", "start", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to start service: %w", err)
 }
 return nil
}

func (s *linuxService) Stop() error {
 if err := exec.Command("systemctl", "stop", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to stop service: %w", err)
 }
 return nil
}

Windows (windows.go)

For Windows, use the sc command to install and uninstall the service.

File:internal/platform/windows.go

package platform

import (
 "fmt"
 "os"
 "os/exec"
 "path/filepath"
 "strings"
)

type windowsService struct{}

func (s *windowsService) Install(execPath string) error {
 installDir := GetInstallDir()
 if err := os.MkdirAll(installDir, 0755); err != nil {
  return fmt.Errorf("failed to create installation directory: %w", err)
 }

 installedBinary := filepath.Join(installDir, "bin", filepath.Base(execPath))
 if err := os.MkdirAll(filepath.Dir(installedBinary), 0755); err != nil {
  return fmt.Errorf("failed to create bin directory: %w", err)
 }

 if err := copyFile(execPath, installedBinary); err != nil {
  return fmt.Errorf("failed to copy binary: %w", err)
 }

 cmd := exec.Command("sc", "create", ServiceName,
  "binPath=", fmt.Sprintf("\"%s\" -run", installedBinary),
  "DisplayName=", ServiceDisplay,
  "start=", "auto",
  "obj=", "LocalSystem")

 if err := cmd.Run(); err != nil {
  return fmt.Errorf("failed to create service: %w", err)
 }

 descCmd := exec.Command("sc", "description", ServiceName, ServiceDesc)
 if err := descCmd.Run(); err != nil {
  return fmt.Errorf("failed to set service description: %w", err)
 }

 if err := exec.Command("sc", "start", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to start service: %w", err)
 }
 return nil
}

func (s *windowsService) Uninstall() error {
 _ = exec.Command("sc", "stop", ServiceName).Run()
 if err := exec.Command("sc", "delete", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to delete service: %w", err)
 }

 // Clean up installation directory
 installDir := GetInstallDir()
 if err := os.RemoveAll(installDir); err != nil {
  return fmt.Errorf("failed to remove installation directory: %w", err)
 }
 return nil
}
func (s *windowsService) Status() (bool, error) {
 output, err := exec.Command("sc", "query", ServiceName).Output()
 if err != nil {
  return false, nil
 }
 return strings.Contains(string(output), "RUNNING"), nil
}

func (s *windowsService) Start() error {
 if err := exec.Command("sc", "start", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to start service: %w", err)
 }
 return nil
}

func (s *windowsService) Stop() error {
 if err := exec.Command("sc", "stop", ServiceName).Run(); err != nil {
  return fmt.Errorf("failed to stop service: %w", err)
 }
 return nil
}

Step 4: Main File Setup (main.go)

Finally, configure main.go in cmd/service/main.go to handle installation, uninstallation, and starting the service.

File:cmd/service/main.go

package main

import (
 "context"
 "flag"
 "fmt"
 "log"
 "os"
 "os/signal"
 "syscall"
 "time"

 "go-service/internal/platform"
 "go-service/internal/service"
)

func main() {
 log.SetFlags(log.LstdFlags | log.Lmicroseconds)

 install := flag.Bool("install", false, "Install the service")
 uninstall := flag.Bool("uninstall", false, "Uninstall the service")
 status := flag.Bool("status", false, "Check service status")
 start := flag.Bool("start", false, "Start the service")
 stop := flag.Bool("stop", false, "Stop the service")
 runWorker := flag.Bool("run", false, "Run the service worker")
 flag.Parse()

 if err := handleCommand(*install, *uninstall, *status, *start, *stop, *runWorker); err != nil {
  log.Fatal(err)
 }
}

func handleCommand(install, uninstall, status, start, stop, runWorker bool) error {
 platformSvc, err := platform.NewService()
 if err != nil {
  return err
 }

 execPath, err := os.Executable()
 if err != nil {
  return fmt.Errorf("failed to get executable path: %w", err)
 }

 switch {
 case install:
  return platformSvc.Install(execPath)
 case uninstall:
  return platformSvc.Uninstall()
 case status:
  running, err := platformSvc.Status()
  if err != nil {
   return err
  }
  fmt.Printf("Service is %s\n", map[bool]string{true: "running", false: "stopped"}[running])
  return nil
 case start:
  return platformSvc.Start()
 case stop:
  return platformSvc.Stop()
 case runWorker:
  return runService()
 default:
  return fmt.Errorf("no command specified")
 }
}

func runService() error {
 svc, err := service.New()
 if err != nil {
  return fmt.Errorf("failed to create service: %w", err)
 }

 ctx, cancel := context.WithCancel(context.Background())
 defer cancel()

 sigChan := make(chan os.Signal, 1)
 signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

 log.Println("Starting service...")
 if err := svc.Start(ctx); err != nil {
  return fmt.Errorf("failed to start service: %w", err)
 }

 log.Println("Service started, waiting for shutdown signal...")
 <-sigChan
 log.Println("Shutdown signal received, stopping service...")

 if err := svc.Stop(); err != nil {
  return fmt.Errorf("failed to stop service: %w", err)
 }
 log.Println("Service stopped successfully")
 return nil
}

Building and Managing Your Service

To build your service for different operating systems, use the GOOS and GOARCH environment variables. For example, to build for Windows:

GOOS=windows GOARCH=amd64 go build -ldflags "-s -w" -o go-service.exe ./cmd/service

For Linux:

GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" -o go-service ./cmd/service

For macOS:

GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w" -o go-service ./cmd/service

Managing Your Service

Once you have built your service for the respective operating system, you can manage it using the following commands.

Note: Ensure to execute the commands with root privileges, as these actions require elevated permissions on all platforms.

Install the Service: Use the --install flag to install the service.

./go-service --install

Check the Status: To check if the service is running, use:

./go-service --status

Uninstall the Service: If you need to remove the service, use the --uninstall flag:

./go-service --uninstall

Building and Managing Your Service using TaskFile (Optional)

Although you can use Go commands and flags to build and manage the service, I highly recommend using TaskFile. It automates these processes and provides:

Consistent commands across all platforms
Simple YAML-based configuration
Built-in dependency management

Setting Up Task

First, check if Task is installed:

task --version

If not present, install using:

macOS

brew install go-task/tap/go-task

Linux

sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d

Windows

# Using Scoop
scoop install task

# Using Chocolatey
choco install go-task

Task Configuration

Create a Taskfile.yml in your project root:

version: '3'

vars:
  BINARY_NAME: go-service
  BUILD_DIR: build

tasks:
  build:
    desc: Build the service binary for current platform
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - go build -v -ldflags "-s -w" -o {{.BUILD_DIR}}/{{.BINARY_NAME}} ./cmd/service

  build:windows:
    desc: Build for Windows
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - GOOS=windows GOARCH=amd64 go build -v -ldflags "-s -w" -o {{.BUILD_DIR}}/{{.BINARY_NAME}}.exe ./cmd/service

  build:linux:
    desc: Build for Linux
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - GOOS=linux GOARCH=amd64 go build -v -ldflags "-s -w" -o {{.BUILD_DIR}}/{{.BINARY_NAME}} ./cmd/service

  build:darwin-amd64:
    desc: Build for macOS (Intel)
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - GOOS=darwin GOARCH=amd64 go build -v -ldflags "-s -w" -o {{.BUILD_DIR}}/{{.BINARY_NAME}}-amd64 ./cmd/service

  build:darwin-arm64:
    desc: Build for macOS (Apple Silicon)
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - GOOS=darwin GOARCH=arm64 go build -v -ldflags "-s -w" -o {{.BUILD_DIR}}/{{.BINARY_NAME}}-arm64 ./cmd/service

  build:darwin:
    desc: Build for macOS (Universal Binary)
    cmds:
      - task: build:darwin-amd64
      - task: build:darwin-arm64
      - mkdir -p {{.BUILD_DIR}}
      - lipo -create -output {{.BUILD_DIR}}/{{.BINARY_NAME}} {{.BUILD_DIR}}/{{.BINARY_NAME}}-amd64 {{.BUILD_DIR}}/{{.BINARY_NAME}}-arm64
      - rm {{.BUILD_DIR}}/{{.BINARY_NAME}}-amd64 {{.BUILD_DIR}}/{{.BINARY_NAME}}-arm64

  build:all:
    desc: Build for all platforms
    cmds:
      - task: build:windows
      - task: build:linux
      - task: build:darwin

  install:
    desc: Install the service
    deps: [build]
    cmds:
      - sudo ./{{.BUILD_DIR}}/{{.BINARY_NAME}} -install

  uninstall:
    desc: Uninstall the service
    cmds:
      - sudo ./{{.BUILD_DIR}}/{{.BINARY_NAME}} -uninstall

  start:
    desc: Start the service
    cmds:
      - sudo ./{{.BUILD_DIR}}/{{.BINARY_NAME}} -start

  stop:
    desc: Stop the service
    cmds:
      - sudo ./{{.BUILD_DIR}}/{{.BINARY_NAME}} -stop

  status:
    desc: Check service status
    cmds:
      - ./{{.BUILD_DIR}}/{{.BINARY_NAME}} -status

  clean:
    desc: Clean build artifacts
    cmds:
      - rm -rf {{.BUILD_DIR}}

  default:
    desc: Show available tasks
    cmds:
      - task --list

Using Task Commands

Service management (requires root/administrator privileges):

sudo task install       # Install service
task status             # Check status
sudo task uninstall     # Remove service

Build for your platform:

task build

Cross-platform builds:

task windows   # Windows build
task linux     # Linux build
task darwin    # macOS build

List all available tasks:

task --list

Conclusion

By following this structured approach, you can create a clean and modular service in Go that works seamlessly across multiple platforms. Each platform’s specifics are isolated in their respective files, and the main.go file remains straightforward and easy to maintain.

For the complete code, please refer to my Go service repository on GitHub.

Is Fail2ban Enough to Secure Your Linux Server?

Anshuman — Thu, 24 Oct 2024 03:15:45 +0000

In today’s digital landscape, securing your systems is more critical than ever. If you’re running public-facing services like SSH, you might wonder if Fail2ban is necessary. In this post, we’ll dive into what Fail2ban is, why it’s worth considering, its drawbacks, and additional best practices to strengthen your overall security posture.

What is Fail2ban?

Fail2ban is a tool that scans log files for suspicious activity, like excessive failed login attempts, and blocks potentially harmful IP addresses. This free service protects Linux systems from brute force attacks by temporarily rejecting IPs exhibiting suspicious behavior, thereby reducing the risk of unauthorized access.

Why Consider Fail2ban?

Easy Setup & Free: Fail2ban is easy to install and configure, requiring minimal expertise. As a free, open-source tool, it provides an accessible and cost-effective way to enhance server security without added software costs.
Customizable Configuration: The tool provides extensive customization options. You can tailor it to monitor specific services, set the ban duration, or even whitelist trusted IPs, allowing you to adapt it to your unique security needs.
Brute Force Protection: It’s particularly effective at preventing brute force attacks by automatically banning IP addresses that show malicious behavior, such as repeated login failures.
Efficient Resource Usage: Fail2ban bans attackers at the firewall level, which helps reduce the load on your server by preventing malicious traffic from consuming resources.
Alerts and Notifications: Integration with notification services means you can get real-time alerts when suspicious activity is detected, helping you stay informed and responsive.

Cons of Fail2ban

While Fail2ban has undeniable benefits, it’s important to consider its limitations:

False Positives: One downside is that Fail2ban might mistakenly block legitimate users, especially if they mistype their passwords multiple times in quick succession. This can disrupt user access and create frustration.
Limited Protection Scope: Fail2ban is primarily designed to mitigate brute force attacks, but it won’t protect your system from more sophisticated threats like exploitation of vulnerabilities or zero-day attacks.
IP-based Blocking: IP addresses can be easily spoofed or changed. In cases where attackers use dynamic IP addresses or botnets, Fail2ban’s IP-based blocking becomes less effective.
Maintaining IP Lists: The constant management of blocked IP lists can become cumbersome, especially on larger networks or systems that experience frequent attacks. Long-term blocking might even result in performance degradation.

Best Practices to Enhance SSH Security

Although Fail2ban is a solid first line of defense, it should be used in conjunction with other security best practices to provide comprehensive protection for your SSH server. Here are five key practices you should adopt:

Configure Two-Factor Authentication (2FA): Strengthen security by requiring additional layer of security, ensuring that even if passwords are compromised, unauthorized access is still blocked. For a detailed guide, check out my post here.
Change Default SSH Options: Modify default settings such as the SSH port (avoid port 22) and disable root logins to reduce the risk of common attacks. Disabling password-based authentication altogether and enforcing SSH key or certificate-based authentication can further harden your setup.
Authenticate Clients Using SSH Certificates: SSH key management can be a challenge, especially at scale. SSH certificates simplify the process and enhance security by verifying identities through certificates rather than just raw public keys.
Use a Bastion Host: Employing a bastion host as an intermediary server for all SSH connections allows you to focus security efforts on a single point, thus better controlling and auditing access to your internal systems.

Conclusion

Fail2ban is a valuable tool for mitigating brute force attacks, but relying on it alone leaves room for vulnerabilities. By combining Fail2ban with best practices like MFA , you can create a more comprehensive defense. For a deeper dive into setting up MFA on Linux, check out my detailed guide here.

How to Secure SSH on Any Linux Server using PAM and Google Authenticator

Anshuman — Sun, 20 Oct 2024 08:37:42 +0000

By default, SSH relies on passwords for authentication, though most security guidelines recommend switching to SSH keys for stronger protection. However, despite being more secure, SSH keys still represent only a single factor of authentication. The SSH session involves your computer’s terminal sending data through an encrypted tunnel to the remote server.

Just as hackers can guess passwords, they can also steal SSH keys, and with that single credential, they can potentially gain unauthorized access to your remote systems.

Prerequisites

Linux Machine (For this demonstration, we will use Raspberry Pi OS, which is based on Debian.)
A smartphone or tablet with any OATH-TOTP app like Google Authenticator(iOS/Android), Microsoft Authenticator(iOS/Android),etc

Step 1 — Installing Google’s PAM

In this step, we will install and configure Google’s PAM module which stands for Pluggable Authentication Module. It is an authentication framework used on Linux systems to verify users’ identities.

Google has developed a PAM module that generates time-based one-time passwords (TOTP), fully compatible with any OATH-TOTP app, such as Google Authenticator(iOS/Android), Microsoft Authenticator(iOS/Android),etc . Before proceeding with the installation, make sure your system is up to date. Use the following commands based on your Linux distribution:

For Ubuntu/Debian:

sudo apt-get update

Next, install the PAM:

sudo apt-get install libpam-google-authenticator

For RHEL/CentOS 8/Fedora (using dnf):

sudo dnf update -y

Next, install the PAM:

sudo dnf install google-authenticator qrencode-libs -y

For RHEL/CentOS 7 (using yum):

sudo yum update -y

Next, install the PAM:

sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum install google-authenticator

Step 2 — Configure Google Authenticator to generate OTP codes

Execute the following command to start the configuration process:

google-authenticator

After you run the command, it will prompt a series of questions. For most, simply answer “y” (yes), unless you require a different setting.

This PAM supports both time-based and counter-based tokens. Counter-based tokens increment with each use, while time-based tokens change after a set interval. Since apps like Google Authenticator expect time-based tokens, select “y” for yes.

Afterward, a lot of output will appear, including a large QR code. Use your authenticator app to scan the QR code or manually enter the secret key. If the QR code is too large to scan, you can use the URL above the QR code to view a smaller version.

Once added, you’ll see a six-digit code in your app that refreshes every 30 seconds. Enter that code in the terminal and press Enter.

Note: Be sure to save the secret key, verification code, and recovery codes in a secure location, such as a password manager. The recovery codes are your only way to regain access if you lose access to your TOTP app.

The remaining questions inform the PAM on how to function. Simply answer “yes” (y), unless you require a different setting.

Step 3 — Configuring OpenSSH for MFA

When making ssh changes, don’t close the your original SSH session.Instead, open a second session to test, this will help in preventing accidental lockout.

Start by backing up the sshd configuration file, so that in case anything goes wrong , you can revert back to the original config.

sudo cp /etc/pam.d/sshd /etc/pam.d/sshd.bak

Now open the sshd configuration file using nano or any edior of your choice.

sudo nano /etc/pam.d/sshd

Append the following line to the end of the file,save and close the file.

auth required pam_google_authenticator.so nullok
auth required pam_permit.so

Next, we will configure SSH to support this type of authentication.

Similarly like what we did for /etc/pam.d/sshd, create a backup of the file:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Now, open the SSH configuration file for editing

sudo nano /etc/ssh/sshd_config

Locate the ChallengeResponseAuthentication option and set its value to "yes." If you're using OpenSSH 8.7p1 or later , then look for KbdInteractiveAuthentication instead and set that to "yes." as ChallengeResponseAuthentication option is deprecated in OpenSSH 8.7p1 and above.

In OpenSSH 8.7p1 and above, ChallengeResponseAuthentication has been replaced with KbdInteractiveAuthentication.

In OpenSSH < 8.7p1

Save and close the file, then restart SSH to reload the configuration file

sudo systemctl restart sshd.service

Step 4— Enabling SSH Support for MFA

Warning: If you haven’t set up SSH keys, skip Step — 4. Enabling the following setting will block your access to your linux machine through SSH, as it requires public key authentication.

MFA won’t function if you’re using an SSH key. To enable SSH support for MFA, reopen the sshd configuration file:

sudo nano /etc/ssh/sshd_config

Add the following line at the end of the file. This specifies the required authentication methods for SSH. We indicate that users must provide an SSH key and either a password or a verification code (or all three):

AuthenticationMethods publickey,password publickey,keyboard-interactive

This setup ensures that:

publickey,password: The user must provide their SSH key followed by their password.
publickey,keyboard-interactive: Alternatively, the user must provide their SSH key followed by MFA (such as Google Authenticator).

Moment of Truth: Logging In with MFA

Now, attempt to log into the server again using a different terminal session or window. This time, SSH should prompt you for your verification code. Enter the code to complete the login.

In this tutorial, you implemented 2FA across two devices (computer and phone) for your server. This approach significantly improves security by making it much more difficult for unauthorized users to gain SSH access.

How to configure password in Amazon ec2 instance

Anshuman — Mon, 27 Jun 2022 18:21:06 +0000

In this tutorial, I have added the configurations required for ec2 user password authentication for AWS ec2 Linux instances.
As by default ec2 instance don't have any password .Follow these simple steps to configure password in your linux instance .

Note:- It is not recommended to configure password in cloud instances unless required .Private key-based authentication is always the safest way to access cloud instances.

Step 1: Log in to the linux machine using ssh client of your choice using the private key.

For Windows machines, you can use putty for connecting to the instance. Click here to know how to use putty on Windows .
If you are using Mac or Linux, you can use the following command to connect to the instance.

ssh -i your-key.pem username@(public-ip-address)

Step 2: Enter the following command to open sshd_config file

sudo nano /etc/ssh/sshd_config

Step 3: Find the line containing “PasswordAuthentication” parameter and change its value from “no” to “yes“

Step 4: Now press ctrl + x button and then click on Y button to save the changes

Step 5: Setup ec2 user password using the “passwd” command along with the username.

You need to enter the password twice. For example, if you want to set up a password for “centos” user, use the following command.

sudo passwd centos

In AWS, different ec2 instances have different usernames. Following are the default usernames of some popular ec2 instances.

Instance	Username
Ubuntu	ubuntu
Redhat Linux	ec2-user
Amazon Linux	ec2-user
CentOS	centos
Debian	admin or root

Step 6: Now, restart the “sshd” service using the following command.

sudo service sshd restart

Step 7: Once the "sshd" service is restarted successfully , you can log out and log in using the password you set for the user.
For example,

ssh ubuntu@34.10.100.1

I hope this "How to configure password in Amazon ec2 instance" article helps. Let me know in the comment section if you face any errors.