This page contains useful security-related terminal commands tested on Arch Linux. Commands on other Linux-based operating systems or Windows might differ and aren’t included.
- zbarimg + oathtool
Follow us on Mastodon:
The web browser Chromium can be configured by changing so-called switches. This allows you to restrict cipher suites and the TLS version used by Chromium. You could change the configuration in the terminal, however, future updates will overwrite this.
~/.config/chromium-flags.conf and add:
--cipher-suite-blacklist=0x009c,0x009d,0x002f,0x0035,0x000a,0xc013,0xc014(disables weak cipher suites)
--ssl-version-min=tls1.2(disables all TLS versions except TLS 1.2)
Use Qualys’ SSL Client Test to check if all weak cipher suites are disabled.
dig is part of BIND and can be used to check domains for DNSSEC:
dig [domain-name] +multiline
- “status” should be “NOERROR” (“SERVFAIL” means that there is a problem with the DNS server configuration, e.g. DNSSEC configuration is broken)
- “flags” must contain “ad” (authentic data)
dig [domain-name] +multiline +dnssec
- This query sets the “DNSSEC OK” (DO) bit and requests DNSSEC records to be sent, if available
- Look for “RRSIG” resource records
dig [domain-name] +trace
- This query emulates a DNS resolver. It starts from the root of the DNS hierarchy, and works down using iterative DNS queries.
GnuPG is mostly already installed on your machine and can be used for e-mail encryption and signing. You can use it in your terminal, of course.
How to create a GnuPG key
This section describes how to create an Ed25519 key using gpg 2.2.13. If you don’t know your version, open a terminal and enter
- Open your terminal.
gpg --expert --full-generate-key
(9) ECC and ECC
(1) Curve 25519
- Enter validity period, and confirm it by entering
- for e-mail, we recommend
- for Git signing, we recommend
- for internal use, we recommend less than
- for e-mail, we recommend
- Enter your full name
- Enter your e-mail address
- for e-mail, you need to enter your real e-mail address
- for Git signing/internal use, you can enter an arbitrary address (e.g.
- Enter a comment, if needed
- Check everything, and confirm it
- Enter a passphrase, used to locally encrypt your GnuPG key. You must enter this password every time you want to decrypt/sign something.
- After creation, save the location of the revocation certificate. You need the certificate to revoke your key if you lose access to your private GPG key.
- Your new key pair is ready now. Enter
gpg --list-secret-keysto see it.
- You can export your public key by entering
gpg --armor --export [key-id] > my-public-gpg-key.asc
We save our cleartext as
clear.txt. You can also use
echo "your message", of course. The ciphertext is stored as
- Encrypt and sign:
cat clear.txt | gpg -esar [key-id-of-the-recipient] -u [your-key-id] > cipher.txt
- -e means encrypt
- -s means sign
- -a means ASCII format
- -r means encrypt for the following key id of the recipient
- -u means use the following (your) key id for signing
cat cipher.txt | gpg -d > clear.txt
- -d means decrypt
gpg can be used to symmetrically encrypt data, too:
gpg -c --cipher-algo AES256 clear.txt
- -c means symmetrically encrypt
- –cipher-algo AES256 means use AES-256 for encryption
gpg -d ciphertext.gpg > clear.txt
- -d means decrypt
Please note that the key used for encryption/decryption is temporarily cached by your device. When you are running gpg 2.2.7 or newer, you can turn off caching by adding
Well-known tools use imagemagick, so it is likely that imagemagick is already installed on your machine. You can use it to remove metadata from photos:
- Remove metadata:
mogrify -strip [filename]
- -strip means “strip the image of any profiles, comments or these PNG chunks: bKGD, cHRM, EXIF, gAMA, iCCP, iTXt, sRGB, tEXt, zCCP, zTXt and date”
- View metadata:
identify -format '%[EXIF:*]' [filename]
- shows Exif metadata in the file
You can use openssl for many purposes. For example, whenever you need pseudo-random bytes:
- Print bytes to terminal:
openssl rand [number-of-bytes]
- Hex format:
openssl rand -hex [number-of-bytes]
Do you need a password now? Use pwgen:
- Create passwords containing upper-case and lower-case chars, digits and special chars:
pwgen -scyn1 [number-of-characters] [number-of-passwords]
- Create passwords containing upper-case and lower-case chars and digits:
pwgen -scn1 [number-of-characters] [number-of-passwords]
qrencode can be used to transform arbitrary strings into QR codes:
qrencode -o [qr-filename].png "[string]"
- Change the pixel size:
qrencode -o [qr-filename].png -s [pixel-size] "[string]"
The YubiKey Manager can be used to manage most features of a YubiKey. Useful commands are:
ykman oath code: Generate OATH-TOTP codes in your terminal. (Actually, “ykman oath” can replace the Yubico Authenticator.)
ykman config set-lock-code: Configure a 16 bytes long lock code to protect your YubiKey’s configuration.
ykman config [nfc/usb]: Enable/disable features of your YubiKey.
zbarimg + oathtool
- Enable 2FA on the website. Normally, you will see a QR code. Save this QR code.
zbarimg [file-containing-qr-code]to show the string representation of the QR code. This looks like
$ oathtool --base32 --totp "T2LAELPYIS2NGNYE"to get your OTP each time.
- The output is like
WARNING: The secret (e.g. T2LAELPYIS2NGNYE) is a secret! Store it like a password and only use a second device to generate your OTPs. Do not use the device which you use for login! Do not store this secret and the normal password in the same database!