DEV Community: IndyMan

How to easily fix OpenSSH RegreSSHion vulnerability

IndyMan — Wed, 03 Jul 2024 18:48:21 +0000

The regreSSHion vulnerability CVE-2024-6387 is a critical remote unauthenticated code execution (RCE) vulnerability affecting OpenSSH server (sshd) on glibc-based Linux systems. If exploited, this vulnerability can lead to:

Complete system takeover
Installation of malware
Data manipulation and exfiltration
Creation of backdoors for persistent access
Network propagation to other systems within the organization

Exploiting this vulnerability allows attackers to bypass critical security mechanisms and cause significant damage.

Solution for Ubuntu

Check your Ubuntu version

To check your Ubuntu version, run the following command in your terminal:

lsb_release -a

This command will display information about your Ubuntu distribution, including the release name.

How to fix the vulnerability

To fix the regreSSHion vulnerability on your Ubuntu server, follow these steps:

Update the package list and install available updates:

sudo apt update
sudo apt upgrade

Ensure you are running the latest version of OpenSSH for your release:

sudo apt install --only-upgrade openssh-server

👉 If you like this article, you can follow me on Twitter

Check if the fix is installed

Ensure the version at least matches the patched version for your Ubuntu release:

dpkg -l | grep openssh-server

Jammy: 1:8.9p1-3ubuntu0.10
Mantic: 1:9.3p1-1ubuntu3.6
Noble: 1:9.6p1-3ubuntu13.3

Protect your server with automatic updates

Unattended Upgrades is a package on Ubuntu that allows automatic installation of security updates and critical packages without user intervention. This can help ensure that your system is always up-to-date with the latest security patches, including the fix for vulnerabilities like regreSSHion.

If you had unattended upgrades configured on your Ubuntu system, it would have automatically applied the security update for OpenSSH as soon as it was available, thereby mitigating the vulnerability without requiring manual intervention.

How to Set Up Unattended Upgrades

Follow these steps to set up unattended upgrades on your Ubuntu system:

Install Unattended Upgrades:

sudo apt update
sudo apt install unattended-upgrades

Enable Unattended Upgrades:

sudo dpkg-reconfigure --priority=medium unattended-upgrades

Checking If Unattended Upgrades Is Working

To verify that unattended upgrades are functioning correctly:

Check the Status of the Service:

sudo systemctl status unattended-upgrades

Review the Log Files:

Review the logs to see if updates have been applied:

sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.log

By setting up unattended upgrades, you can ensure that critical security updates, like those for the regreSSHion vulnerability, are applied automatically, enhancing the security of your Ubuntu server without manual intervention.

🎯 Find my next blog articles earlier on https://easyselfhost.dev/blog

Umami, simple self-hosted analytics

IndyMan — Tue, 02 Jul 2024 07:11:33 +0000

I was looking for a simple analytics solution because I wasn't satisfied with Google Analytics' footprint on page performance and overall heaviness. After trying various options, I have been using Umami for a few weeks, and I'm very happy with it! Let's see why.

What is Umami?

Umami is an open-source, lightweight, self-hosted alternative to Google Analytics that respects your users' privacy. It is focused on giving you the essential tools you need to track your website traffic, where users are coming from, and what they are doing on your site.

If you're looking for a very complete suite of features, Umami might not be for you, but I wanted a simple, privacy-focused analytics tool, which is why I chose Umami.

Why I Love Umami ❤️

I initially went with Google Analytics, but its SDK was heavy and sent a lot of data to Google. Then, I tried Plausible, which is self-hostable and great, but it was too CPU-heavy for my VPS (using around 30% CPU!). Finally, I found Umami, which is just what I needed! Lightweight for both my VPS and website, easy to use, privacy-focused, and open-source.

👉 Want to see more ? Follow me on Twitter

How to install

Umami's installation process is straightforward, and their documentation is excellent. Essentially, it just requires setting up a database and running a Docker container.

However, if you're looking for an even simpler method, you can use Coolify for a "one-click" install. With Coolify, you simply click on "Install Umami" under resources, and you're good to go!

Umami one-click install with Coolify

Quick look

Let's take a quick look at Umami's dashboard and key features.

As you can see, the interface is pretty minimal yet contains most of the essential information you need. You can see the number of page views, unique visitors, and top referrers. You can also see the most visited pages and the devices your visitors are using.

Tracking custom events

In addition, you can add custom events to track specific actions on your website, such as button clicks or form submissions. This is a great feature to track user interactions and conversions.

My experience

Easy to Use

Let's be honest, some analytics tools are way too powerful and complex for most user needs. Umami, on the other hand, is incredibly user-friendly. The setup was straightforward, and within minutes, I was able to start collecting and analyzing data. It’s got all the essentials without the bloat.

Comprehensive Insights

Despite its simplicity, Umami Analytics provides a wealth of information. From tracking page views and referrers to monitoring user behavior and campaigns, it covers all the bases.

Potential Drawbacks

Of course, no tool is perfect, and Umami Analytics has its limitations. Here are a few things to keep in mind:

Limited Integrations

If you rely heavily on third-party integrations, you might find Umami a bit lacking. It doesn’t have the extensive plugin ecosystem that some other analytics tools boast. However, for many users, its core features are more than sufficient.

Basic Customization

While Umami is easy to use, it doesn’t offer the deep customization options that power users might crave. If you need highly specific data segmentation or complex custom reports, you might need to look elsewhere or complement Umami with other tools.

Wrapping Up: is Umami for you?

Umami is a fantastic tool for those who value privacy and simplicity without compromising on insights. Whether you’re managing a personal blog, an online store, or a corporate website, it’s worth giving Umami a shot.

Find my next blog articles earlier on https://easyselfhost.dev/blog

Easy image management for MDX blogs

IndyMan — Thu, 27 Jun 2024 13:28:15 +0000

Writing a blog should be a seamless and enjoyable process. However, I found myself constantly frustrated with the high-friction workflow involved in adding images to my MD(X) blog files. The process typically involved several tedious steps:

Copy the image to the clipboard.
Use the VSCode "paste image" extension to paste the image into the repository root
Move the file to the public/static directory.
Rename the file.
Go to the MDX file, use the Image component, and point it to /static/imagename.

This process was not only time-consuming but also detracted from the pleasure of writing articles. So I went looking for CMS solutions, which I didn't know much about but felt promising.

👉 Want to see more ? Follow me on Twitter

Exploring CMS Solutions

I explored several CMS solutions, including:

Ghost
Strapi
CraftCMS

While these platforms offered a lot of functionality, they introduced new challenges. For instance, you often need to pay for cloud hosting or manage self-hosting, which involves dealing with backups for both content (usually in a database) and media files (images and videos). Additionally, integrating the CMS content into a Next.js app requires making API calls, which adds complexity to the build process and necessitates environment variable configuration and deployment triggers.

My Experience with Ghost

Ghost provided an excellent WYSIWYG editor and robust metadata management, but it had significant drawbacks for my use case:

Headless CMS Limitations: Ghost is designed to expose a website, and while you can set it to "private mode," this causes the API to stop returning metadata (keywords, images) for articles. This seems like a bug and was a deal-breaker for me.
Inconsistent API Responses: Occasionally, the API would return an empty list of blogs, resulting in builds with an empty "Blog" section. Rebuilding the app would sometimes fix this, but after several failed builds, I lost confidence in this approach.

Ultimately, I missed the simplicity of having content and assets colocated with my app. A straightforward GitHub repository setup, without the need for complex environment variables, API calls or backups felt better suited to my needs.

Automating the Image Management Process

Fed up with the manual steps involved in image management, I decided to automate the process. My goal was to create a simple script that would:

Run directly from my Next.js project using npm run <myscript>.
Prompt for an image name and path, with default values.
Paste the image from the clipboard to the desired destination.
Generate the JSX code boilerplate pointing to the image.
Copy the generated JSX to my clipboard.

Developing the Script

I created a scripts/pasteimg.ts file and began writing the script, leveraging GPT to expedite the process. One challenge was getting GPT to handle "taking the image from the clipboard," as it initially suggested using clipboardy, which isn't compatible with images.

Fortunately, I discovered the npm package save-clipboard-image, which uses OSX native commands and perfectly fit my needs.

After spending a few minutes troubleshooting errors related to ESM modules while trying to run the script with ts-node, a recommendation to use tsx resolved the issue instantly.

The Final Result

Here's a demonstration of the script in action:

And the code behind it:

Note: Only works on MacOS, you'll need to adjust the script for Windows or Linux.

import { saveClipboardImage } from "save-clipboard-image";
import inquirer from "inquirer";
import * as path from "path";
import * as fs from "fs";
import clipboardy from "clipboardy";

const NEXT_STATIC_DIR = "/static";
const NEXT_STATIC_PATH = path.join(process.cwd(), "/public", NEXT_STATIC_DIR);

async function run() {
  // Ask for the image name
  const { imageName } = await inquirer.prompt({
    name: "imageName",
    type: "input",
    message: "Enter the name of the image (without extension):",
    validate: (input: string) =>
      input.trim() !== "" ? true : "Image name cannot be empty",
  });

  // Ask for the path with a default value
  const { subdir } = await inquirer.prompt({
    name: "subdir",
    type: "input",
    message: "Enter the target directory:",
    default: "",
  });

  const fullTargetDirectory = path.join(NEXT_STATIC_PATH, subdir);

  // Ensure the directory exists
  if (!fs.existsSync(fullTargetDirectory)) {
    fs.mkdirSync(fullTargetDirectory, { recursive: true });
  }

  // Save the image from the clipboard
  try {
    await saveClipboardImage(fullTargetDirectory, imageName);
  } catch (error) {
    // No image in clipboard, explain and exit
    console.error("No image found in clipboard, please copy an image first.");
    return;
  }

  // Construct the full path
  const fullImagePath = path.join(fullTargetDirectory, `${imageName}.png`);

  const relativeImagePath = path.join(NEXT_STATIC_DIR, imageName + ".png");

  const jsxCode = `
<Image
  src="${relativeImagePath}"
  alt="${imageName}"
  width={500}
  height={200}
  className="text-center shadow rounded-md"
/>`;

  // Copy the generated JSX code to the clipboard using clipboardy
  clipboardy.writeSync(jsxCode);

  // Log success in terminal + summary (image path and JSX code)
  console.log("Image saved successfully!");
  console.log(`Image path: ${fullImagePath}`);
  console.log(`JSX code copied to clipboard: ${jsxCode}`);
}

run();

Conclusion

I'm thrilled with this custom script. It significantly simplifies the process of adding images to my blog, allowing me to focus on writing. Next.js takes care of optimizing the images for various screen sizes, and by committing both the content and media to the same repository, I no longer worry about backups or synchronization issues.

Find my next blogs earlier on https://easyselfhost.dev/blog