Our Salt state core/sshd does not set PubkeyAcceptedAlgorithms, so ssh-rsa (SHA-1) is blocked by default — this has been the case since OpenSSH 8.8 (released 2021-09-26, see https://www.openssh.com/txt/release-8.8).

Jun 14 2026, 14:58 · security, Python, Eglide, Servers, Operations sprints (Echoes in the Void)

Apr 22 2026

yousra added a revision to T2318: Restart Salt minion service after configuration change: D4092: Add DNS SOA serial validation pre-commit hook.

Apr 22 2026, 22:06 · security, Vault, Salt

yousra added a comment to T2318: Restart Salt minion service after configuration change.

The error occured is (T2315) :

Apr 22 2026, 11:19 · security, Vault, Salt

dereckson updated subscribers of T2318: Restart Salt minion service after configuration change.

Apr 22 2026, 11:14 · security, Vault, Salt

dereckson moved T2318: Restart Salt minion service after configuration change from Backlog to Bug and issues on the Salt board.

Apr 22 2026, 11:14 · security, Vault, Salt

dereckson triaged T2318: Restart Salt minion service after configuration change as Normal priority.

Apr 22 2026, 11:14 · security, Vault, Salt

Apr 3 2026

dereckson triaged T2297: Serve HTTP 3 traffic as Normal priority.

Apr 3 2026, 19:54 · Alkane, security, Servers

Mar 25 2026

dereckson moved T1513: Propagate certificate to Openfire server from Backlog to Let's Encrypt - acme.sh on the TLS certificates board.

Mar 25 2026, 09:32 · TLS certificates, XMPP, security, Servers

dereckson moved T1602: Provision ACME DNS credentials for core domains on each servers from Backlog to Let's Encrypt - acme.sh on the TLS certificates board.

Mar 25 2026, 09:31 · TLS certificates, Operations sprints (Ignite Alkane Propulsion), security, Servers

dereckson moved T1342: Let's encrypt on Debian use logrotate from Backlog to Let's Encrypt - legacy on the TLS certificates board.

Mar 25 2026, 09:31 · TLS certificates, security, Servers, Eglide, Salt

dereckson moved T2112: Renew Vault web server certificate automatically from Backlog to Let's Encrypt - acme.sh on the TLS certificates board.

Mar 25 2026, 09:31 · TLS certificates, security, Servers

dereckson moved T2155: Review rotation for acme.sh logs from Backlog to Let's Encrypt - acme.sh on the TLS certificates board.

Mar 25 2026, 09:30 · TLS certificates, Restricted Project, security, Servers

Mar 23 2026

dereckson merged task T1524: Monitor sudo files on servers into T2286: Detect configuration drift by computing difference between Salt states and deployed.

Mar 23 2026, 09:09 · Eglide, security, Servers

dereckson closed T1524: Monitor sudo files on servers as Wontfix.

With Salt, sudo files content are now managed from rOPS.

Mar 23 2026, 09:09 · Eglide, security, Servers

Mar 22 2026

dereckson triaged T2107: j'aimerais avoir une présence permanente sur internet as Wishlist priority.

Mar 22 2026, 23:58 · Eglide, security

dereckson added a comment to T1861: Configure static IPv6 on WindRiver.

Next: configure DNS records

Mar 22 2026, 19:08 · security, Servers, IPv6

dereckson changed the visibility for T2143: Hash Tomcat credentials.

Mar 22 2026, 19:04 · Servers, Nasqueron Docker deployment squad, security

dereckson shifted T2143: Hash Tomcat credentials from the Restricted Space space to the S1 Nasqueron space.

Mar 22 2026, 19:03 · Servers, Nasqueron Docker deployment squad, security

dereckson closed T2143: Hash Tomcat credentials as Resolved.

Mar 22 2026, 19:02 · Servers, Nasqueron Docker deployment squad, security

dereckson moved T1109: Switch all OAuth GitHub applications to Nasqueron organization accounts from Backlog to Infra on the Auth Grove board.

Mar 22 2026, 18:30 · Auth Grove, User-Dereckson, security, Nasqueron Operations Squad

dereckson triaged T1109: Switch all OAuth GitHub applications to Nasqueron organization accounts as Normal priority.

Mar 22 2026, 18:29 · Auth Grove, User-Dereckson, security, Nasqueron Operations Squad

dereckson placed T1513: Propagate certificate to Openfire server up for grabs.

Mar 22 2026, 18:21 · TLS certificates, XMPP, security, Servers

dereckson triaged T1513: Propagate certificate to Openfire server as Normal priority.

Mar 22 2026, 18:21 · TLS certificates, XMPP, security, Servers

Mar 21 2026

dereckson added a parent task for T1513: Propagate certificate to Openfire server: T2043: Switch to acme.sh instead of certbot.

Mar 21 2026, 10:32 · TLS certificates, XMPP, security, Servers

dereckson updated subscribers of T1513: Propagate certificate to Openfire server.

Will need to be revisited when we switch to acme.sh.

Mar 21 2026, 10:31 · TLS certificates, XMPP, security, Servers

Mar 20 2026

dereckson triaged T2281: [irssi] Secure proxy module with TLS connection as Wishlist priority.

Mar 20 2026, 21:51 · security, upstream, IRC, C

dereckson updated the title for P390 Anubis default botPolicies.yaml from botPolicies.yaml to Anubis default botPolicies.yaml.

Mar 20 2026, 20:03 · security, Nasqueron Docker deployment squad, Servers

Feb 5 2026

dereckson closed T2210: fullchain.pem isn't automatically generated by acme.sh as Resolved by committing rOPSc9cb237e5e18: Automate acme.sh install-cert cmd.

Feb 5 2026, 22:53 · TLS certificates, security, Mail

DorianWinty added a revision to T2210: fullchain.pem isn't automatically generated by acme.sh: D3906: Automate acme.sh install-cert cmd.

Feb 5 2026, 22:04 · TLS certificates, security, Mail

dereckson claimed T2210: fullchain.pem isn't automatically generated by acme.sh.

Patched it live.

Feb 5 2026, 21:48 · TLS certificates, security, Mail

dereckson updated subscribers of T2210: fullchain.pem isn't automatically generated by acme.sh.

Feb 5 2026, 19:52 · TLS certificates, security, Mail

dereckson triaged T2210: fullchain.pem isn't automatically generated by acme.sh as High priority.

Feb 5 2026, 19:52 · TLS certificates, security, Mail

Feb 3 2026

dereckson closed T2198: Create new account for duranzed for Samy as Resolved.

Feb 3 2026, 18:57 · security, Servers

dereckson added a revision to T2198: Create new account for duranzed for Samy: D3899: Add duranzed to shell users.

Feb 3 2026, 18:57 · security, Servers

dereckson reassigned T2198: Create new account for duranzed for Samy from dereckson to Duranzed.

Feb 3 2026, 18:56 · security, Servers

dereckson renamed T2198: Create new account for duranzed for Samy from SSH pubkey to add to Create new account for duranzed for Samy.

Feb 3 2026, 18:56 · security, Servers

Nov 10 2025

dereckson added a comment to T2183: Detect legacy SHA-1 RSA keys.

Bruteforce attack scenario possible, so we're only interested by usernames defined in users.sls, not by "root" (can't login by SSH) or generic accounts like "docker" (doesn't exist):

Nov 10 2025, 01:57 · security, Python, Eglide, Servers, Operations sprints (Echoes in the Void)

dereckson updated the task description for T2183: Detect legacy SHA-1 RSA keys.

Nov 10 2025, 01:55 · security, Python, Eglide, Servers, Operations sprints (Echoes in the Void)

dereckson updated the task description for T2183: Detect legacy SHA-1 RSA keys.

Nov 10 2025, 01:47 · security, Python, Eglide, Servers, Operations sprints (Echoes in the Void)

dereckson updated the task description for T2183: Detect legacy SHA-1 RSA keys.

Nov 10 2025, 01:16 · security, Python, Eglide, Servers, Operations sprints (Echoes in the Void)

Oct 25 2025

dereckson moved T1145: Don't truncate passwords from Backlog to General bug & features on the C board.

Oct 25 2025, 23:15 · C, security, Odderon

dereckson moved T1292: userlist.db is saved in 644 from Backlog to Network / System on the C board.

Oct 25 2025, 23:15 · C, good-first-issue, security, Odderon

dereckson added a project to T1145: Don't truncate passwords: C.

Oct 25 2025, 23:12 · C, security, Odderon

dereckson added a project to T1292: userlist.db is saved in 644: C.

Oct 25 2025, 23:12 · C, good-first-issue, security, Odderon

Oct 24 2025

dereckson added a comment to T2155: Review rotation for acme.sh logs.

Same issue for rhyne-wyse.log. Configuration was copied from acme.sh one.

Oct 24 2025, 23:05 · TLS certificates, Restricted Project, security, Servers

dereckson closed T2132: Propagate acme.sh certificate so Dovecot can read it as Resolved.

Oct 24 2025, 19:33 · TLS certificates, security, Mail, Restricted Project

Oct 20 2025

dereckson added a parent task for T2155: Review rotation for acme.sh logs: T2043: Switch to acme.sh instead of certbot.

Oct 20 2025, 23:06 · TLS certificates, Restricted Project, security, Servers

dereckson triaged T2155: Review rotation for acme.sh logs as Normal priority.

Oct 20 2025, 22:52 · TLS certificates, Restricted Project, security, Servers

dereckson added a project to T2154: IPv6 support for ns1.nasqueron.org: security.

Oct 20 2025, 22:49 · Servers, IPv6, DNS

Oct 13 2025

dereckson moved T2143: Hash Tomcat credentials from Backlog to Pending review on the Nasqueron Docker deployment squad board.

Oct 13 2025, 22:43 · Servers, Nasqueron Docker deployment squad, security

dereckson moved T2143: Hash Tomcat credentials from Backlog to Pending review on the Servers board.

Oct 13 2025, 22:43 · Servers, Nasqueron Docker deployment squad, security

dereckson moved T2143: Hash Tomcat credentials from Backlog to Pending review on the security board.

Oct 13 2025, 22:43 · Servers, Nasqueron Docker deployment squad, security

dereckson added a comment to T2143: Hash Tomcat credentials.

Credentials have been hashed directly in Vault, so we don't need to manipulate cleartext password with Salt.
Salt updated the tomcat-users.xml accordingly.

Oct 13 2025, 22:42 · Servers, Nasqueron Docker deployment squad, security

dereckson added a revision to T2143: Hash Tomcat credentials: D3755: Configure Tomcat server explicitly.

Oct 13 2025, 20:47 · Servers, Nasqueron Docker deployment squad, security

dereckson added a revision to T2143: Hash Tomcat credentials: D3754: Use target name instead of generic name for orbeon.xml.

Oct 13 2025, 20:27 · Servers, Nasqueron Docker deployment squad, security

dereckson triaged T2143: Hash Tomcat credentials as High priority.

Oct 13 2025, 20:24 · Servers, Nasqueron Docker deployment squad, security