Start the YouTube stream. And Lenny, we are starting a little bit, so let's get a few moments to let people in. Okay. I'm now starting the webinar. As soon as I mute and hide myself. I'm here for, welcome everyone. We're just gonna give it a moment for the room to fill up. Thank you for being here. We'll start shortly. We are just waiting for the room to fill up. Thank you. All right. We can get started. Welcome to San Francisco Public Library's virtual presentation. I'm Lenny Matthews, the branch manager at Excelsior Library. And today we have the honor to speak with Carina Gold, co-founder of the Indigenous and Women-Led's Soga Red Table Land Trust, located in the East Bay, the traditional LaShawn-alone land. Before we begin, I wanna briefly share some of the other wonderful programs at SFPL. First, let's start with the land acknowledgement. The San Francisco Public Library acknowledges that we occupy the unceded ancestral homeland of the Ramitush-Aloni peoples who are the original inhabitants of the San Francisco Peninsula. We recognize that we benefit from living and working on their traditional homeland. As uninvited guests, we affirm their sovereign right as first peoples and wish to pay our respects to the ancestors, elders, and relatives of the Ramitush community. All right, happening this coming May, the celebration of Asian-American, Native Hawaiian, and Pacific Islander Heritage Month. There'll be lots of programs at all of the branches, fun activities as well. So be on the lookout for those at your local branches. Specifically happening at the Excelsior Public Library is Beginner's Chair Yoga. So that's happening this Friday, April 28th at 3 p.m. Please join us. Again, at the Excelsior branch, this Saturday, April 29th at 2 p.m. we'll have a workshop, visual poem. With Amy, please join us and make your visual poems come alive through art. We also have team gaming. So please invite your teams out. Friday, May 3rd at 3 p.m. And last but not least, we have film Fridays happening the first Friday of each month. International film shows here at the branch Excelsior. First one starting May 5th at 3.30. Hope to see you soon. The wonderful summer stride. Every summer, we have fun games, activities at every single branch in the San Francisco Public Library. It's about reading, learning, and fun. So please bring your families and join us in this wonderful summer program that we have each year at San Francisco Public Library. Okay, again, today's presentation is with Karina Gold, spokesperson for the Confederate villages of the Sean, mother and activist. Welcome, Karina. Glad to have you. So happy to be here. Thank you so much for the invitation. Porchey Tuhi, Ka'at Lashanka, Ka'at Ra'at Karina. Good afternoon, everyone. My name is Karina Gold. I'm the tribal chair for the Confederated Villages of the Sean Nation. I'm also the co-founder and co-director of the Sigurte Land Trust, the first urban indigenous women led land trust in the country. I'm talking to you from my traditional territory on the East Bay side. One of the territories called Huchun, the territory that I grew up in. And what most people know as Oakland today. And so I'm going to share my screen and I'm going to take you through some history of the Bay area, my ancestors. And then we're going to move into the work that we're doing today in our traditional territories to bring back some of the stuff. My, the language that I talked to you in today is called Chochenyo. And Chochenyo was the first language spoken on the East Bay side of the Bay. In San Francisco, one of the traditional names for that place is called Yolamu. And Ramatush is the language from that area. And so I'll talk a little bit about languages in a minute. Let me share my screen. My great grandfather Jose Guzman was one of the last speakers of the language, the Chochenyo speaking language. And we are reawakening that language again today. So the confederated villages of LaShawn Nation is actually a confederation of tribes that is not just alone. We are Bay Miwok, Plains Miwok, Delta Yocca, and Waco. And our traditional territory encompasses five Bay area counties, Alameda, Contra Costa, San Joaquin, parts of Solano, and Napa along the waterways. Our tribal peoples' sacred site or our most recreation story starts in the very middle of our land business. And this place is called Tiershtak. Tiershtak is a place that we believe that we were created on the very top of. Our ancestors believed that this mountain was so sacred that only very special and few people could go up there at certain times of the year. Today, we find that our sacred mountain and the place that we were created on top of went from a place of creation to being called Mount Diablo, Devos Mountain. In the very short time that people came here to our lands, it changed the whole significance of this place. Imagine your creation story. There are creation stories all around the world of where your people came from, which mountain or lands or waters they were born to. Many people have creation story of Adam and Eve and the Garden of Eden. Imagine if on this earth plane, we found where the Garden of Eden was. We could not even imagine allowing anybody to just go in there whenever they wanted to. But today on our most sacred mountain, the place that we were created on top of, people that came here from all walks of life now find themselves at the very top of our most sacred place, a place that they even named a different name, a place that had been in reverence to our people for thousands of years. I'd like to start this conversation of talking about, talking about, or talking with the conversation with Rowan White. And it talks about my body. It is a cartography of stories of ancestors asking not to be forgotten. We are not a conquered people. But this doesn't just talk about our ancestors as people here. I'd like to think of it as a cartography of stories in the landscape and how the landscape of the Bay Area changed in a very short time. If you can imagine this place that's massive that had water that was flowing all over the place, fresh water, that every creek in the Bay Area, you could drink fresh water. And every creek in the Bay Area had salmon and rainbow trout coming up. And there were shells, shellfish all around it. And that people lived here in reciprocity with grizzly bears, in Tule Elb, in Antelope for thousands and thousands of years. In a very short amount of time, the landscape has changed in the Bay Area that you couldn't imagine huge fields with beautiful flowers and scenes and grasses that our ancestors gave. You couldn't imagine that with all the asphalt and the buildings uptown. But if you look around the Bay Area, everything you see, the skyscrapers, the streets, the cement, all has changed this landscape in less than 200 years. Sometimes we learn about my ancestors in the fourth grade. California Indian history is taught about in fourth grade history. And when I was going to school, they taught about the missions and how things changed many of these folks' guide. There was actually a colonization that happened to California was much different than had happened anywhere else in this country. And I'm gonna talk about some of that stuff. There was actually three waves of genocide, three different governments and people trying to get rid of us on this land, three different consecutive times. And it started out with the mission system. There were 21 missions that were created. But before the missions got here, Spain actually called dips on this land for Spain and the Kremlin about 200 years before they even got here. Imagine this man named Cabrillo coming down the coast of California, seeing the land, not getting off of his ship to come and talk to the native people, to see who they were, to have a war with them moving. Then came down the coast of California and he saw this land and he called dibs on it for Spain and the Kremlin. Now, I often talk to kids about what's calling, what's dibs, right? We all know that if you have a pink box and it has one donut in it and you call dibs on it, that donut is yours. Well, the same happened with this land. Somebody can imagine that somebody's going down calling dibs. I mean, imagine me driving down the street today and I'm driving by your house or apartment and I call dibs on it and say that that's mine now. It's crazy to think about something like that, right? Well, Cabrillo did make it all the way down to San Diego and he died there, but not before claiming this land for Spain. It wasn't until 200 years afterwards that Spain was afraid they were gonna lose the land that Cabrillo had called dibs on it because there were Russians that were working with native people in Northern California in fur tree and they thought they were gonna lose this land. And so in order to hold down this land, they had used this mechanism of missions to hold down the land. They used it consecutively in Mexico and central and South America. They were able to have these missions built and enslaved the native people from the neighboring areas thereby holding down the land that they called dibs on it. And so the first nine of these 21 missions was created by this man named Junipero Cera. He brought in with him, not just the Spanish, the Catholic religion, but he also brought with him Spanish soldiers. They came here and they enslaved the people. They changed things. In fourth grade, you hear about these missions and I often wonder, why don't they teach about missions in fourth grade? It wasn't California at the time, right? But we still are learning about this. This idea that these first settlers came here and the idea is that they brought with them religion and a way of farming and new technology, but they don't talk about the horrific stuff that they bought or that the fact that our ancestors had a spiritual connection to this land for thousands and thousands of years and that no one was hungry or homeless prior to colonization getting here. It was not even a concept in our minds that that could even happen.  They brought with them diseases and pandemics. So we are just now still finding ourselves in a pandemic today. My ancestors went through a pandemic of smallpox and flus and syphilis when the Spanish mission in their soldiers came. And so we find this place that this is a very difficult time. They extracted our people from their lands and their spiritual places and practices away from the way that they conduct themselves in the land. The foods that they ate, they brought in new foods that actually cause harm not only to our ancestors' bodies, but to the landscape. They brought in animals like cows and sheeps and goats and donkeys, these were all grazers that grazed away these beautiful fields that I was talking about, really. Also the medicines that we would have taken in order to make our stomachs better from eating these new foods. No one knew that that was going to happen. But the fact of the matter is that the landscape changed because these new animals were also brought from the typically. Spanish mission period lasted for about 99 years. Devastation, thousands and thousands of our ancestors died as a result of the missions coming and taking the land. My ancestors were directly enslaved at two of these missions, Mission Dolores in San Francisco and Mission San Jose in Freeland, California. My ancestors weren't just enslaved in these missions, but they actually built their own prison systems. So you can sign the fingerprints of our ancestors in the Adobe bricks that created these places. If you find yourself at Mission Dolores in San Francisco and you go into it, on the ceiling, you can see native designs that are painted into the woodwork there. Our ancestors created what I call the first prison industrial complex of California right here. Once you were baptized at these missions, you became the property of the missions. And so you couldn't run away.  And so people soon found out that they did not want to hide out their relatives that were hiding amongst them. It was a very difficult time during the mission period that people also died of heartbreak. Imagine your world being changed in such a short amount of time that you couldn't imagine the devastation happening here. And so people did die of their hearts being broken open. And then the land was stolen the second time. Spain and Mexico went into war and Mexico won its independence from Spain. And so Mexico then stole the land and continued the enslavement of the indigenous people. And my ancestors were enslaved at a ranch show that was given to a soldier in the East Bay. This ranch show is the ranch show that I've now currently live. It's called Huchum. It encompasses Oakland, Alameda, Berkeley, Emeryville, Albany, and Piedmont. This huge piece of land that took six cities was given to one family, the Peralta family. We hear about the Peralta's name all over the Bay, Eric. There's a Peralta college district and there's Peralta street signs and there's Peralta hospitals and there's all kinds of things. Nothing talks about the first nation peoples who were first here. My ancestors built the first Adobe houses for the Peralta family. They lived there for eight years before the Peralta's came and took the land that they were given. Then they forced my family out of the Adobe houses and they went to live in traditional huts along the Greeks and work for the Peralta's for free indentured servitude on their own lands. That didn't last for very long because in 1848, Mexico and America had them and the land was stolen for a third time. And this time instead of creating treaties with Native people as the United States have all across the country, it was about slavery and mass extermination. Let me back up just a little bit because one of the things that I forgot to say was that when the mission in San Francisco was being built, it was being built in 1776, the very same time on the other side of the country they were signing the Declaration of Independence. So the colonization you can see is very different. It did not happen the same. It was not this wave of America coming but it did come in 1848 because someone found a material called gold and when they found that thousands of men found themselves coming here to California. This new land that was stolen away through a war. And so my ancestors, instead of being free on any of this land, these mass exterminations happened. Their first laws of California made it legal to hunt California Native people. This was backed by federal dollars of 1.4 million killing Native people, $5 a head and 25 cents a year that there was bounties on Native people's heads that villages people would live in villages would try to find places to live and to raise their children running from this next wave of genocide. And people couldn't always find gold but they could find Native people and make a living to end the killing. And so with these bounties, many men would go out and hunt the adults. They would gather the children together. They would bring them into town and they would sell off the children to ranchers and miners. $300 for a little girl, $180 for a little girl. They also created vagrancy laws. They made it illegal for a Native person to speak against a white man in a court of law. And so these vagrancy laws made a very convenient for ranchers and miners that were looking for free labor. And although the state of California was conceived as a free state, it was not true. If a rancher or a miner was looking for free labor, they could drag a Native person in front of a justice of the peace, sign a consent for $3 and say that they would house them for up to 25 years, have feed and clothe them and that this person wouldn't work for them for free. So although we'd say that this state was created as a free state, it definitely was not. It was built on the stilling of the land and the labor of Indigenous people. And African people that were brought here from their slave owners as well looking for gold. So we survived all of those things.  And boarding school, sometimes people think of boarding school that you send your kids away to these places where they get a good education. Boarding school was a way for the United States to actually try to assimilate Native kids, right? They would take children away from their families when they were about five years old and send them to these boarding schools, hundreds of miles away from their families. And they would be taught how to do work in factories or as ranchers would work as young girls would be taught how to clean house and become names. My auntie and my uncle went to this boarding school in Chernobyl during the 1940s and were sent to this place until they were about 12 years old. Then they were sent to Indian foster care, which is different than foster care today in some ways, right? We hope that there is a place that if children are taken from their families that they will be reunited if their families are able to do the things they need to do to take care of them. Indian foster care was connected to these boarding schools and they would send these children out when they were about 12 years old to work. And so my auntie told us the story about five or six years ago, we're sitting in her living room and she said, she tells the story to myself and my two cousins who had never heard the story from their room. She told us about going to boarding school and then told us the story about going into foster care in San Leandro.  I took care of their children and they cooked for them, my iron, all of these things that she had learned while she was in boarding school and this nice family wanted to send her to school in the school district of San Leandro. And the school district told this family no that she couldn't go to school because she was tuned on. And so as my cousins and I started to piece together about what time this was. This was about 1950. So the historical trauma isn't that historic. My auntie is still alive. She's the major of our tribe and this happened and it is still a survivance that we are dealing with today. So let's take a deep breath together because that's a lot of stuff, right? And so let's all take a collective deep breath. I like us to take a deep breath because a lot of times folks go to school here in California where they grew up here and they didn't know any of that history and it's a lot to take into our bodies and we went through a lot of emotions. So let's take one more deep breath and let it go. So one of the things that gets taught, it's a misnomer, right? When Spanish first got here, they called us all Coastan, Coastanolds or Costanus. When they first got here, they didn't know the difference between people. They said, oh, they kind of all dress alike.  And that is the name that stuck in history books for a long time. During the 1960s or so, there was a bunch of movements that were happening across the country, especially here in the Bay Area. We had the Black Panther Movement, the Brown Berets. We had the American Indian Movement. There were all of these movements that were being built here. And our people decided they didn't want to be called Costanus or Costanus anymore. And so they took the name LaBeouche, which is still a generic term. We took it from a village site here called LaBeouche and decided to rename themselves. But even that name today is also a generic term. You see, there were actually eight different languages and eight different songs and dances from north to south were different. Each of our creation stories were from different places. We were different nations of people. We all spoke with a particular language, Kharkin by the Kharkinish straight, Chochenyo in the East Bay, Ramatush in San Francisco, Awaswas in Santa Cruz area, Rumson in Monterey area. All of these places were different languages. And within each of those language bases were different tribes. So there was never one tribe in any area ever and there still isn't today. So I like to explain it like this. If you imagine one county, say San Francisco County, and within San Francisco County, there's a lot of different cities. And so each of those cities, they speak the same language for the most part. People speak English to communicate. But each city has its own municipality, its own citizens that it's in charge of, all of those things. The same thing was happening in all of these different territories. And so today we are still, even though our creation story is the same, our language might be the same. We are different tribes even in the same language area. And so the confederate and villages of LaShon we survived all of that stuff. We have lineage is that go back to all five of the tribes that I talked about at the beginning. And so we are a true confederation of all of these people that came into Mission Dolores and Mission San Jose and Freemont. Them intermarried and baptized each other's children and lived together and spoke multiple languages. And we came together and survived all of that and are bringing back our culture and our songs and our religions again. We started this work over almost 30 years ago when we started doing those work, the protecting of our sacred sites were shelters. Nobody knew what shell mountains were. It's not taught about in fourth grade history or high school or college unless you're good in archeology. But in 1909, this man named Nelson who worked for UC Berkeley knew that these shell mountains existed and their importance. And he knew over a hundred years ago that they were going to be destroyed by development that was happening quickly. And he went around the Bay Area and he took down and numbered all of the different places. And as you can see he found 425 shell mountains, village sites, cemeteries of our ancestors along the Bay. We had our villages where fresh water met salt water and we buried our ancestors in mounds over thousands and thousands of years using soil and shell placed very intricately and some of them proved to be huge. The largest one of all 425 was the one in Henryville. It was over three stories high and three and a half football fields in Diamond. It was a funerary complex and so there was one large one in smaller ones. It's a long Potemma Scout Creek and for thousands of years it had been a place of ceremony and for trading and for living in a village site. This picture on top shows UC Berkeley taking down our shell mound with a steam shovel in the back. This huge site is still in Henryville but today it sits underneath a moth called the Bay Street moth. Many years ago before EPA laws there were factories that were along the Bay and they would dump arsenic and different kinds of toxins into the ground and every time it would rain all of these toxins would seep into Temescal Creek and out to the Bay causing this big block. It was a brownfield and in 1999 or late 1990s there was this influx of money that came to the Bay area. It was this money, this new money that was caused by the internet worker. It allows us to speak to each other today through this amazing web, right? But in 1999 this was a new technology and huge amounts of money was coming into the Bay area and people were outbidding each other for houses and apartments and so it caused this wave of gentrification. People poor, people were moving out into Antioch and other places in Central Valley. And during that time the city of Henryville wanted to bring commerce back into the city that was dead and they decided to get this money to clean up this brownfield and create a mall on the top of it. They knew what this place was. There was, it was documented there's huge documentation of a shell mound being there. As they pulled down these shell mounds in Berkeley and Henryville, Alameda and other cities they would often use the material to fertilize their backyards to pave the streets of these cities. And so quite literally you can be standing and walking on my ancestors' remains. Thousands and thousands of our ancestor remains were parted up over to New Sea Berkeley where they're still being imported. We tried to stop that development from happening and we went and we asked them to clean it up and to allow it to be an open space for aloning people in general to talk about our history and our resiliency and that there's no place in the Bay area that you can find that one place that talks about the history. It's amazing that you can find all kinds of other people's places and museums or cultural centers but nothing that talks about the first nation people here. And the city of Henryville said, well, that's nice, great idea but we're gonna put this little tiny mound that's supposed to represent thousands of years of your ancestors being here and we'll put it on the corner of aloning street and Aloney Way and Shell Mount Street. And we said, no, that's not good enough. So every day on the day after Thanksgiving for 23 years hundreds of us have been showing up, holding up signs, giving out information, praying with our ancestors, learning about things that are happening in other indigenous cultures around the world. We invite you all to come if you want to. We have not met for a few years because of COVID but we meet there on the corner of Shell Mount Street and Aloney Way the day after Thanksgiving from midnight three o'clock. And if you'd like to come and participate we welcome everyone to come. And 2011, 12 years ago, we took over the sacred sites on the Karkina Street and our Karkina homelands. This place called Saborete. The valve in Balejo is called Glen Cove Park. For 12 and a half years prior to that we had been working to stop development from happening on that land from overhead park lights and parking in barbecue pits. This place that had been had two Shell Mounts on it. A place that our ancestors had ceremony for our salmon coming up the Karkina Street. And the last stronghold of our people before they were taken away to Mission Dolores in San Francisco was the city of Balejo wanted to destroy it and we fought against it. In 2011, the city of Balejo went bankrupt. And in going bankrupt, they gave the park district $30,000 worth of permits for free to go through with the project. We said no and we called people from all walks of life to stand with us as we lit a sacred fire to stop that desecration from happening. We stayed in a prayerful vigil for 109 days, four and a half months, stopping that land from being destroyed. And it was saved. The first cultural easement between two federally recognized tribes, a park district in the city was put into place that allows the tribes to have the same amount of save on that land in the park district in the city. And so today we are still able to go and practice our ceremonies there. People are still there, fishermen's from all walks of life continue to fish off of that place. There's a beautiful little beach there that is wonderful to go and put your feet in.  And in 2015, we stood against the canonization of Nipro Serra. Remember, this was the first guide that brought missions to California. One of those missions was mission to Lauricent San Francisco. This, the Catholic church wanted to make this guy a saint and we fought against it. We said, no way.  And we as California native people and native people across the world could not imagine praying to someone that had brought genocide to our people. We lost that battle. Nipro Serra was made a saint. But during all of these battles, I'm sending thousands of names of petitions to the folks. Books that were written by scholars about what happened during the Catholic mission period. Nothing stopped that. And our voices continued to get stronger. We promised each other that we would tell this truth to history wherever and whenever we could. You see, there was this thing also that allowed them to come to our lands. It was called the Doctrine of Discovery. The Doctrine of Discovery didn't just affect California native people or native people in general. The Doctrine of Discovery said that European folks that were going to different lands could take the land because people that had darker skin color only had half sores. And therefore they didn't know how to take care of that land. And so they could take the land by sore or by the cross. This Doctrine of Discovery was something that allowed for European people to go into other countries and create slavery across the world. So what had didn't just affect us, but it is affecting as still as native people in this country. You would think that this thing was created a long time ago and it's not used. But in 2005, the Supreme Court actually used it against native people in an upstate New York battle. There was native people that were supposed to get a lake return to them along with land. And the Supreme Court said no based on the Doctrine of Discovery. It was actually Ruth Gainbridge that wrote that opinion which is horrifying to me because Ruth did a lot of good work. But this time she got it wrong. The Supreme Court is still using it saying that we don't know what to do with our own land still being paternalistic to native people that are sovereign in their own places. So our work took us all the way around to join that but also to protecting the oldest of all 425 shell mounds that ring the Bay area. This place is on 4th and University in about six years ago, a person that was wanted to develop this land. It looks like a flat parking lot. It's never been developed. It used to have strawberry creek run through the entire site. It was marshland. It had our oldest village site. The very first place that our ancestors ever fished along the Bay or created a shell man. Very first place that children laughed and cried along that waterway. This was the very first place that our ancestors set up a shell man and this place was getting ready to be destroyed about six years ago. The city of Berkeley landmarked this place 25 years ago. They knew that it was existing. It was on Nelson's map. Everybody, nobody could say that it wasn't there except this developer who wanted to put up condoms and all kinds of big box shopping. And we fought against it and we kept zoning board up until 2.8 and listening to commenting. And we went to the heritage commission and did the same thing. And then we had to go to court. And in court, we won the first battle. We liken our city. We connect our sacred site that looks like a parking lot to many people, to people that are protecting their sacred sites and lands all over the world. We connected it to our PR friends that are on Mauna Kea in Hawaii trying to stop a 40 foot telescope. We connected it to the genocide that's happening in West Papua in Kashmir. We connected it to our Palestinian relatives that are fighting for land in Palestine and our relatives that are fighting for a sacred site against miners in Arizona. We connected our places of peace. We had people from the Amazon, chiefs that came and prayed with us, people from Christian and Muslim and Jewish backgrounds all praying together. And during our appeals court, we lost and while we weren't in appeals court, the owner of the land put up a six foot fence with barbed wire encroaching the entire site. This was the very first time that we were not allowed on our own sacred site. Quietly for many years, our people had gone in a parking lot and offered the prayers that we are supposed to offer. You see, this sacred site is a site that is so special to us. It aligns with our cosmology stories. This sacred site lines up with a place called Alcatraz Island. And for us, Alcatraz Island was not an island that we went to visit many years ago. Alcatraz Island, we believe are people when they pass away their spirits sit on that island for four days while we have ceremony on the land. And as the sun is setting on that fourth day, we believe that their spirits lean through the Western gate. But many people now see where the golden gate may choose. This is a sacred place for us. It's a place that we envision people from all walks of life coming together to learn about the history of what happened on this land and the resiliency of our people. Since this time, we've asked people to come and to put up banners and to honor the ancestors that is still beneath this land to put up prayer tithes and to put up artwork. And as people did this, while this fence was the owners of the land came and sent somebody out, gave somebody to put these prayers and these artwork in garbage bags. People from all walks of life have come to work with us. We have had Tibetan chanters and Korean drummers, Aztec dancers, Hawaiian singers. We have had people from all walks of life that have continued to come and put up signs that we understand and the place that we stand upon in order to be as sacred. Through all this work, we started to do this work of thorough sagorite land trust. The sagorite land trust is the first urban indigenous women led land trust in the country. We started this because we had been fighting for sacred sites for many, many years. And when I talk about, we prayed, we did walks. We started in Vallejo and walked to San Jose and up to San Francisco. For four years, we did those walks. 300 mile walks, 18 miles a day stopping at sacred sites in the Bay Area offering prayers at these sites, parking lots, railroad tracks, schools, bars, apartment building, streets, corners that our ancestors had been built for. We prayed in front of UC Berkeley Hearst Museum that holds 9,000 of our ancestry names asking for them to come home only to realize that because we are not a federally recognized tribe, we had become homeless in our own home. What if Berkeley gave us 9,000 ancestors to rebury? Where would we rebury them? The Lonie people don't own land. There are two people that own a house, my auntie and myself. I have a habitat for the managed house in D. Stoker. So we have been gentrified out we're the first and continue to be. So many of our relatives live in Central Valley because they can't afford to live in their traditional territories. And so we began to dream about what it would look like for indigenous women to take back their leadership roles. Women that have songs for the waters and the medicine plants and our basket materials. Women who take care of giving birth or helping to bring life into this world. Often the ones that are also seeing life taken out of this world. What is our sacred duty as indigenous women to bring this back into balance? Not forgetting our men, our sons, our brothers, our uncles, anybody. But that knowing that colonization always also took them away from their sacred responsibilities. So we began to look at this idea of rematriation to restore a living culture to its rightful place on motherhood or to restore people to a spiritual with life in sacred relationship with their ancestral lands without external interference. As a concept rematriation acknowledges that our ancestors lived on the spiritual relationship with our lands for thousands of years and that we have a sacred duty to maintain that relationship for the benefit of our future generations. Not just our future generations but everyone that now makes this their home. It's our responsibility as good hosts on our land to ensure that there is a future for everyone that lives here, the guests of our lands. But it was important to talk about without external interference because we don't have a land lease, because we don't own any theater. We were finding ourselves having to ask permission from park districts and private land owners to say our prayers, to offer ceremony to gather our traditional foods and medicines because we had no. And so to think about it, this was the land of our people to have to ask somebody else for those basic things was impossible. We have churches and synagogues and mosques and everything else here in our territory but we have no one place in order for us to lay down our elders. This is the first piece of land that was returned to us in 250 years. Not this entire thing. You see where these people are standing. This quarter acre of land was the first piece of land that was returned to us in 250 years since colonization first started. This land sits in deep East Oakland on a dead end street. It is run by Planting Justice which is a nonprofit organization that works with formerly incarcerated men and women, people that have recently migrated and they went to a thing called standing in 2016. And this movement to stop and boil type from going under a river brought thousands of people from all over the world together to pray and to stand against this corporation. And while they were there, they were moved by what had happened and they asked the elders what they should do when they came home. And the elders told them they should work with the first station people to come and stand their ground. And they took that to heart. They had not utilized this quarter acre of land. As a matter of fact, that's quarter of acre of land had trash and transmissions and cement blocks and all kind of stuff on it. But as we sat under this California walnut tree that summer afternoon, they told us that story and it offered us this quarter of acre of land. And Janella LaRose, the co-founder of Security of the Interest and I sat there and looked at each other. And we said that we would on a couple of conditions. We would pay Janella salary to be here to help to clean up this land and to build relationships with the men and women that were taking care of the rest of the land. How weird would it be to walk across this nursery and not have relationships with the people that were taking care of that land. And so we built those relationships. We cleaned up this area. We built a fire pit there. You see this land is also a little different. This culverted waterway is the LaShawn Waterway, the waterway that we are named after as a people. And this freeway, the 880 freeway here is on field. And so people actually created more land by filling it up. This was marshland. About a block from this area underneath the freeway to destroy a shell mound in order to build it. And so this land was very close to, if not on the village site that my ancestors had been for thousands of years. I believe that our ancestors were working with us when this land was returned to us in people's years and dreams to imagine a different world. And what were we gonna do with this first piece of land that we called our home?  And three years ago in May, we put that arbor up. We looked for Redwood Lock, 17, 18 feet tall and all of the longer companies, none of them happened. And through a friend of a friend in Sonoma County, they allowed us to come up and thin their land. There was 10 of us that went up there. None of us knew about cutting down trees, but there was this young African-American man that worked at Planning Justice. He used to work on fire in the fire crews when he was in San Quentin and agreed to be our captain to show us how he had this way of talking to trees. And so we trusted him and went up there to the land and we had elders come up and prayed in each of those trees and asked them to give their lives in order for us to build this. And none of us got hurt. And we pulled down these trees and rolled them onto new haul trucks and brought them down to Oakland, 700 pounds each piece because they were full of water. And we naively thought we would have this arbor up in a month in those Redwood streets, kicked our butts and taught us lessons right here. And people from all walks of life came and they took the bark off and they sanded them down and got the land ready.  And then we put up a men's pole and elders pole and the children's pole and a two-spirit non-binary pole. And all the other poles but the last one are women board leaders. And so this is our ceremonial site. The first one in 250 years on our land a place that is sovereign where we don't have to ask permission to pray. We had gathered hundreds of seeds of white sage and tobacco to give out to welcome this and dance this arbor again and then COVID happened. And we put those plants out and asked people to come and get them safely and wondered what we were going to do. And actually the arbor showed us what to do.  During COVID we had a young man who knew about found out about the arbor while he was behind balls and asked for permission to come and lay down prayers before he went home to his reservation. We had fires there for our relatives that passed away from COVID and other reasons. When I married my daughter in and about this arbor during COVID my grandchildren come and play there and know all of the plants that are there know which ones they can eat and can tell you about them. They have a look in their eyes that's different even though I grew up here raised my children here my grandchildren have a different look in their eyes about this land. They know that they're rooted and connected and they are belong to. And so this arbor has changed us. We are restoring our language and our culture and our way our relationship with plants. Imagine all of the different languages spoken in the Bay Area. Chochenyo is not one of them, but it was created. All languages created from the lands and the waters that they come from. This land and water and air are yearning to hear the language that was created here. And so we're bringing that language back again. People from all walks of life continue to help us to stand for the sacred. I believe that people that come to live in our territory that it's their responsibility that if you live here and to stand alongside of the belonging people that are standing for their sacred places. The land would take care of the land but the land really takes care of us. And I think as human beings we realize how much we needed to land during COVID. How much we wanted and yearn to be growing something. How much we wanted to be out with people and on the land that we were trying to find ways. There was times during COVID that I would look for seeds and the seed distributors were out of seeds because so many people were trying to figure out that connection again. As human beings, we know that we are supposed to be connected with land. That our hands are supposed to bloom in the dirt and we are supposed to sit on land. It helps us emotionally, physically, mentally and spiritually. And finally, Western science caught up with that and said, yeah, that's true, right? We are creating Hamekah as a place where we gather. A place where we can gather as guests, as hosts we wanna be good hosts to our people. And so we've created these places called Hamekahs in all the lands that we take care of. It has fresh water and it has water catchment systems and first aid and food and outdoor kitchen in case of man-made or natural-made disaster. We wanna make sure that these are touchstones in the places that we live, not just for the native people but for everybody in the neighborhood, right? That's how we are good hosts. Good guests, what does that mean to be a good guest? As adults, we all know, we teach our children and our nephews and nieces and grandchildren how to be a good guest. If you're going to somebody's home, you don't touch things that aren't yours. You say, thank you and please, you ask permission, right? But as adults, we forget that we're in somebody else's home and we forget those basic manners. If we could only just remember those basic things we teach our children, we could all get along so much better. We are working with the cities all over the bay in our territories. The city of Berkeley became the first city to change its signage that says, welcome to city Berkeley Gologna Territory. During the George Floyd uprising when we were putting up Black Lives Matters, the two city council members that were African-Americans said, yes, and we will also remember, we are on one territory and put a mural on the street that says that as well. We work with the city of Richmond to create a park called Oakway Park and Oakway means medicine in our language. It's the very first park to create a relationship with us that allows us to grow the medicine plants that we need and to allow us to gather them without asking for permission that we have these. We've worked with this beautiful artist called Wipi and he created these boulders that are amazing that talks about the land and the landscaping people and this boulder, it says, see Wipi Isha and have met him. Water is life when we are still in unity. While all of the crazy racist statues and signages coming down, we worked with the city of Alameda to do the same thing. Alameda had a park called Andrew Jackson Park, the Indian kill. We worked with them and the community to change it to Trochanio Park in recognition of the language that was first created here. Worked with putting a signage in that park and the city of Alameda was the first city to pay Shumi as a part of their budget for two years. The city of Albany followed suit in raising our flag over their city. It's still raised there. It's there all year round. They also changed their signage going into the city and were the second city to pay Shumi. And this last year in December, we were able to work with the city of Oakland after five-year process to have almost four acres of land return to us in the Oakland Hills. In Joaquin Miller Park, in Oakland-owned park, they returned this land so that we can begin to dream about a cultural center to re-engage and take in out invasive plants and putting in plants a way for us to continue to work with the land to make it fire resilient instead of what fire has. We're hoping that this work in partnership with the city of Oakland will open up to other cities to give back land to indigenous students. Thinking about telling our histories of not just the past but the resiliency, creating partnerships of making sure that people know about the lands that they work on can re-engage in the land with their own hands again. A place for the people to restore themselves. This is a small portion of our tribal people. And this is my auntie that I talked about that told us that story. We are still here amongst everybody, trying to do the work that our ancestors gave us to do. But since the beginning of time, we pray that everyone that now lives and works and plays in our territory as fresh air to breathe for the next seven generations as good water to drink for the next seven generations. Good soil to grow our medicines and the foods for the next seven generations. And a rebuilt relationship with fire where we are not afraid of them, but remember that it gives us light and warmth in so much more. Thank you so much, Karina. Thank you for teaching us and reconnecting us back to what we should be doing and how we should be thinking. We are almost at time. Do you feel like you have enough energy for a few questions? Okay. Audience, if you have any questions, drop them in the Q&A. Before I take those, I have a few questions. Can you talk about the importance of the, so, sagorite, I'm not pronouncing. Sagorite. Sagorite land trust being women led. Yeah, I think that it's really important, you know, our, I think when we look at the world right now and what has happened in general, and I talked about it before we opened up this land trust, what it would look like under women's leadership and why. And we look at how land trusts in general, not just native land trusts, most land trusts are run by men. But then if we look farther back in how men have been in charge of land across the world and how that correlates with women and our bodies and how it continues to do that, when we look at how the sacredness has been taken away from the land, how women's leadership has been taken away from the land, how our ability to save or make decisions about our bodies, just like our birth is unable to make decisions about our race, their rape and destruction, that there needs to be a balanced product about that, about being able to take care of each other in a holistic kind of way. I think of even during times of COVID, when you look across the globe, when there was women's leadership that the citizens were taking care of in a more holistic manner than in countries that had men that were in charge, that I think that when you look at this, that we're not talking about throwing away our relatives that are men, but that's really bringing them back into a more balanced way of living and taking care of the next generations. As we began to make decisions about it, and I think that this is really across the board, is that we try to make decisions based on how it's gonna affect the next seven generations that have us. That the things that we make decisions about. Drilling oil in Alaska right now, is that gonna be helpful for those kids that aren't born yet? I don't think so, but I think that we do have the ability together to come together as human beings, that we have the resources to come together as human beings, to get away from our egos and to figure out how do we get ourselves back into alliance with this earth so that we can survive for the next seven generations. And I think that that's what it take when this leadership to do it. And the Seguritate Land Trust is really about lining those things to do that kind of work. Okay, thank you. What do you think the role of public libraries? What could that look like with supporting the Seguritate Land Trust and any efforts surrounding the mission vision? That's a great question, Lenny. Doing programs like this, getting it out is amazing. I think having the ability to bring people into discussions about these important issues locally, right? Because we can't think that, babe, but we can figure out what does it look like locally? Having those resources available to have people be able to go out there. I think that one of the interesting things that happened during COVID was that the state parks were given away permits or day passes, right? And I think that national parks are going to, and they are housed at the parks, I mean, at the libraries, that people could actually do that. I think that's an amazing resource that people don't know about, to get people out there. That if there's land around the libraries that we engage in putting California native plants in there, that we talk about some kind of an education process, that that's a wonderful way for us to engage in the land that's there already. I think that we talk about native history, not just in Native History Month, but that we talk about it all as a thread that goes through everything, right? That it's important for us not to just be pushed into this one little spot because we decided that's what it is, you know? I think that's a couple of things that folks can do. Okay, thank you. And my last one is, can you talk a little bit more about the Shumi tax? Yeah, thank you so much for that. Shumi in our language means a gift. We didn't like the word tax when we first put it together, but people understand what tax means, right? It gives us this idea. We ask people to give this voluntary donation if you work, live, or play in our lands and as a way for us to do this work of rematriation. Some people can't get out and volunteer, but this is a way for them to give back, to begin the healing process between folks that have made their life here and didn't know this history, a way for us to begin to think about how do we take care of this land together? What resources do you have to bring? Shumi allows for that to happen. And so we are very grateful for people that want to participate in Shumi Honor Mark and it's a monthly donation and you can go to the website or it's a yearly donation or a one-time donation, but you can go to the website and there's this platform that was created and you can put in whether you're a owner or a renter of your home, how many bedrooms and it'll actually come up with a suggested donation. And so Shumi is that for us. Okay, thank you. And I have one question in the Q&A from the audience. Idris, could you tell us more about two-spirit folks? Do you know of any equivalent terms in some of the many native languages here? You know, I don't, we are relearning our language. I do know that two-spirit or non-binary folks are existing in every culture around the world, right? And so I know that there is a beautiful two-spirit group in San Francisco that does pow out here from here in February that there is a lot of work that's happening in the Bay Area. There's a great movement of folks that are doing reconnecting and doing medicine work on the lands and different kinds of things. And I'm sure that there are resources on our website about those places. And you can also go to Bates, Bay Area American Indian Spirit, right? There you go, thank you so much for putting that in there. And they have lots of resources there as well. Thank you for that question. That's all of the questions we have. And audience, if you want to learn more, please visit the rep site. So gorteglandtrust.org. Let's thank Karina again for being here. We appreciate your time and your knowledge. And thank you. And don't forget, audience, visit sfpl.org too to learn more about our many programs and activities at the Public Library. Thank you.


Governor Rotimi Akeridolu of Undostata has again explained the need for officers of the Western Nigerian security network codenamed Amotecon Coal to bear arms over non-state actors, saying that the security of life strength stands the protection of pipelines. Akeridolu in a statement released by Chief Press Secretary Richard O'Latunde explained that most of the people, and even some of his colleagues, didn't really understand his position on the oil pipeline surveillance contract. He reinstated the fact that he does not have any issue with the federal government awarding surveillance contracts to anybody, but that the federal government should allow Amoteco to carry sophisticated weapons like those on the awarded pipeline surveillance contracts.


intermediate level. So target audience would be people who have already executed an SSH command at one point in their developer or administrative lifetime, but have not delved deeper into the possibilities of SSH. So that's the target audience I'm trying to reach. If you already know more about the SSH config file, of course you're free to stay. Maybe there's a little nugget of knowledge that you haven't seen yet or haven't heard yet, but otherwise you probably will be bored just so that you want. So yes, the hashtag if you want to tweet or toot or whatever, it would be msh2022, and the slides will be available later on on my website as well as in the far plan, or the schedule, sorry, wrong event. I'm getting confused. I'm getting old. Before we start, just one word on command line syntax. I have a lot of command line examples. I'm also doing some live demos, so just let me know if the font is too small or something. I can modify a few things. In order to make it more readable for you in the slides, I'm following the POSIX 2017 standard that a new line followed by a backslash shall be interpreted as a line continuation. To give you an example of that, the command ls minus a minus l minus t slash temp could also be written as ls backslash new line minus a backslash new line, et cetera, et cetera. The right-hand notation is just more readable on slides. You can just compress it into one line once you execute them. Right. So should we get into it? I think we should, because otherwise I'm running out of time, but I think we're good on that. That's your usual command, right? That's what you do. If you do SSH on a machine, you have the command SSH, then you have the username, the et sign, and then the host that you want to reach. Once you enter that, whoops, not yet. Once you enter that, the server prompts you for the password or even wants to verify the fingerprint of the server and then asks you for the password.  You type this in over and over and over again. It's a little bit boring. If you're using SCP, for example, to copy files again, you have to execute SCP username and host name, then it asks for the password. That's rather boring and repetitive. Let's see if we can do something about that. This is, of course, the easy example. It could be a lot worse if you have a system administrator who's heavily into HP Lovecraft-inspired server names. You get server names like these, and I think you don't want to type this more than once, right? I mean, that's just calling for problems. Fortunately, this is by the way the god of Tzikronosh, and it's one of the greater old ones, in case you wonder. The thing or the SSH feature that we are going to use, and which I will spend a lot of time on, is called SSH config. So if you do a man5 SSH config, this is the information you will get. I mean, this is a lot more condensed than the man page. Basically, you can configure your SSH command, of course, through the command line options, username and host, and a few other commands and parameters. You can use a user configuration file. So this is a configuration that is applicable to four and to each user. Each user can have his or her own config file, and of course, as a system administrator, you can also provide a system-wide configuration file for the SSH client. In this talk, I'm going to focus on the user configuration file, which is hosted in the user's home page, which is symbolized by the tilde, and it's in a hidden directory called .ssh, and it's called config, surprisingly. What can we do in that config file? For one thing, we can define hostname aliases. So in case of the name of an elder god or something like that, you can just define the host demo, and then specify one or more hostnames it applies to. Oh, the other one. No, sorry, the other way around. So you have one hostname, your target, the server you want to reach is ssh-server.example.com, and with the host statement, you can give it one or more aliases, which is useful, which cuts down on the characters you have to type at the command line quite heavily, and you can not only have one aliase for the same hostname, but you can have several aliases for the same hostname, so you can have demo, d1, or popocut, the petal, if that's more your thing to type. And so instead of ssh-server.example.com, I just type ssh-d1, and that cuts down tremendously on the number of characters I have to type to reach that server. Furthermore, the hostname also has a nice feature to use a wildcard to support grouping similar hostnames. So if I have SMTP, IMAP, and WWW hostnames that are all connecting to the same or resolved to the same machine, I could use the %h feature to use the aliases as the hostname in the fully qualified domain name of the hostname parameter. Right, so that already... So instead of ssh-server.example.com, we can just type ssh-demo. So that's one thing we can cut down on typing. The other thing we can cut down on typing is, of course, the username. So I still have to type ssh-username at host or at alias. Fortunately, the config file also has a user directive, so I can specify a username I want to use for that particular host or alias, which cuts down on the amount of type tremendously. So compare these two statements. The first one is the one I showed you at the beginning. It's ssh-username at hostname, and now I just have to type ssh-demo, and everything I specified in my config file is therefore applied and I don't have to type it myself. So this is all sounds good, but let me show you how this actually works. So I am on my server, on my client, and I want to configure my ssh-config. So I start my preferred editor, and I'm going to my... Let's see if I can type while everyone is watching, and there will be a config file. So I'm using an editor, not an operating system like Emacs, and this is what we just talked about. I have my target server, which has the hostname of ssh-server-example.com, and I define two aliases here. One is demo, the second one is bastion, which I will need in a later example, and I specify my username for this setup, in this case LIDAR, and if everything works as I expect, I should now be able to do a ssh-demo, and I'm connected to the server, and I ask me for my password, and I'm connected to my server. So that would be, as I said before, a tremendous cut-down on the number of characters that we have to type, and as we are all system admins or developers, we want to cut down on the stuff we actually have to do. We much more prefer to wait for the compiler to compile or to the file transfer to complete. Right. So as you noticed, this cuts down on the connectivity, but the server is still asking for a password. So how can we fix this? Well, there's something called ssh-public-key authentication. So that helps us. It uses basically the public-private-key setup that we already know from TLS or other protocols to use keys to authenticate against the ssh-server so it don't have to provide my password every time I want to connect to a server. Additionally, the ssh-public-key authentication improves security considerably and also offers additional usability benefits like single sign-on across multiple ssh-servers. And another neat feature I will show you in a little bit once we got this all set up. The one thing you have to remember for SMMT-Crypto3, you probably know, but I want to emphasize this as I'm targeting maybe new developers or new system administrators, is there are two keys in play with SMMT-Crypto3. There's a public-key and there's a private-key. The public-key you can share with everyone. Sharing is caring. Share your public-key as much as you like. There's no problem with that. Put it on the server. Post it on your website. Send it through fax if you live in Germany. It's fine. On the other hand, the private-key is something you keep to yourself. That should reside on your laptop. That should reside on your PC. And you should not hand that out. You should not put it in a Git repository. You should not put it on a cloud store. This is your private-key and your private-key only, and it should not be shared. If it happens, create a new one. My preview just went out. Okay. This one is working. Okay. No worries. All right. We could do... So basically what it does is the server and the client exchange a few messages encrypting with the public-key. So as a user, if you want to use private-public-key cryptography to log into an SSH server, you have to copy... One time you have to copy your public-key to the server so the server knows your public-key. Once the server knows your public-key, it can then send you during the initiation of the connection. It will send the client a message encrypted with the public-key of the client. The client can therefore decrypt that message with its private-key. It will encrypt an answer that also includes the message that the server sent with the private-key of the client and with the public-key of the server, sends it back to the server and the server decrypts it with its private-key and checks that the messages were transmitted without change, therefore authenticating the client and allowing you to start to work. This is all working under the hood. It's using the Diffie-Hellman-key exchange so we know that it's secure and safe and it's properly implemented, at least in the more used distributions. It's really simple and it's a few commands and you're on your own way to go. What do you need for public-private-key cryptography or public-private-key SSH authentication? You need a key, of course. You need two keys, a public-key and a private-key. The command to create that would be, come on, SSH-keygan. SSH-keygan has quite a lot of parameters. These are the ones I regularly use and I usually recommend. You have the command SSH-keygan or key generator and then you're specifying the type of public-private-key cryptography that you want to use. In this case, I'm using Curve 25519. Oh, it's raining. It's 25519, which is an elliptic curve which creates highly secure but very small keys. This is really a nice feature if you're working with embedded systems and stuff like that. You're happily using an elliptic curve cryptography. Of course, you could also still use RSA keys. They're just 40,000-bit length. It's fine and works as well. They're just a little bit bigger. All modern systems usually support ED25519, so it's good. The A option is a pet-peaf of mine you can leave it out if you want to. That's basically defining the number of rounds that the algorithm computes when it creates the key. The higher number will result in a slower passphrase verification process, but it will increase your resistance to brute force password cracking of the private key in case it gets stolen. A security feature in case your private key gets accidentally uploaded to GitHub or something like that. I think we have to turn up the volume because the rain is getting really loud, thank you. The minus F option is there to specify the file name where you want to save your private key and your public key. You specify a file name, and the extensions will be added as needed. In this case, and I usually do that, I save it into my home directory, into the SSH directory, and I named it in this case demo.ed25519 because I do it. What I would highly recommend is to always, if you're using SSH key again, to always add a comment with the minus capital C option, because if you have multiple keys, figuring out which key belongs to what and which key applies to which server or to which customer can get quite tedious, so having a comment reminding me, oh, I created this for MCH, okay, I can delete it, or oh, I still need it or whatever. So having a comment in the key is always a very nice feature. So let's, no, let's, before we look at it, let's do this. Again, I have my command line and I create a key. As I said before, I have it here in the parallel syntax and here in the command line, I'm just using one line. You should always have a passphrase on your key. And of course, if you type in public, you never type the password correctly again twice. See, okay, three times a charm. Not talking and typing at the same time helps. And once the computer has finished its computations, you get an output like this, and let me show you a little bit more about that output. So that's the output, basically. And the first thing it is, it's telling you, okay, I'm creating an ED25519 key pair and it asks you for a passphrase. As said before, you should always have a passphrase that should no private key without a passphrase except for some very special circumstances where you should really know what you're doing. As we're talking about intermediate level setups, you should always have a passphrase for an SSH key. Once SSH key has finished its work, it also can generate, it tells us it generated two files. The demo ED25519 file, that's your private key. If it has the extension .pub, that's your public key. Please don't mix them up. Please don't upload the private key to GitHub or GitLab or another of these sites. These files are actually text files, so you can take a look at them. So let's take a look at the public file. The public file begins with the information which encryption algorithm, which asymmetric option did we choose? We chose ED25519. Then there's the key information. Again, this is the public key. You can share this freely. And the nice thing about it is at the end of the public key, the command gets added. So if you add this to a server, the administrator also has an option to see whose key is this, why is it there, so choose a proper command and it will your life and the life of your administrator a lot easier. I'm doing this here as it's a demo setup and I scratch it, but you should never do this in public. You can also, of course, take a look at the private key, which basically looks like this and resides on your client. Anyone with a copy of the public key can encrypt data for you, but only you, if you own the private key, can decrypt. So these authorized keys for you are really your thing and you should handle your private key very carefully. On the other hand, the public private key pair is free. They're free to generate. You've seen this takes literally a few seconds to generate once you have the command down. So please, please, please create more than one key. If you connect to different servers, if you connect to different customer servers, for example, have at least a key pair for each customer. If you're connecting to GitHub and to GitLab, please create a public private key pair for GitHub and a separate one for GitLab. Because what happens if you lose one of these keys? If you only have one public private key pair, all of the systems are compromised. If you have a public private key pair for each customer or for each service that you're going to use or for each server even that you're going to connect to, only that server is affected and only you have to make the system administrator of that server aware. There's nothing for... I'm doing a lot of consulting work. There's nothing more embarrassing than to tell the customer, look, I lost the key pair for access to another customer's servers, but your servers are also affected because they use the same public private key pair. That's not a nice thing to communicate. They are free. It doesn't cost much. A great one for each server, for each customer or each service you connect to. Sorry. So, that was the creation of the key pair. Just give me a second. I already mentioned that in order for this to work, we have to copy the public key and only the public key to the server we want to connect to. So, there are several options to do that. You can copy it through the clipboard. You can transfer it as a file, but that's a nice thing. There's also a command for it. So, there's SSH copy ID, which will allow you to copy the public key to a server that you want that public key copied to. Again, it's the same syntax as for all other services, and that, see, I missed the server name there. I will show you in the demo how this actually looks. And where do you copy this? So, SSH copy ID basically takes care of everything. You just tell it, take this public key file, copy it to that server. You don't have to think about directories, file names, et cetera. If you want to do it manually, you need to copy the demo.ed25519.pub public key file to the server into your home directory, into the .ssh directory and into the authorized keys file. This authorized keys file, if it does not exist, needs special permissions. So, if that file does not have 644 file permissions, the whole thing will not work. Again, SSH copy ID will take care of that for you and will create that for you so you don't have to think about that. That's why I'd like to prefer the SSH copy ID command over the manual creation of that file, and also in newer versions. So, if you're on, they'd be an old stable, probably not, but in newer releases, the SSH copy ID file also makes sure that you're not copying the private key to the server, so it's a nice security feature as well. Right. So, let's see if we can do that in my demo environment as well. So, again, the command here, is this readable or should I make it bigger? It's good. Okay. Great. The command is, again, SSH copy ID minus I and the ID file, the public ID file you want to copy, and then the target in the Now System demo. The nice thing about having a config file that we created earlier is these aliases that we created there apply to all SSH-related commands. We can use the same aliases for SCP, for SSH copy ID, and all the other stuff, so it's really nice. In this case, demo is our allies for Lyra at ssh-example.example.com, and it says, okay, yeah, I found the public key file. I'm attempting to log in. Of course, the public key is not uploaded yet, so it still asks me for the password. And remember, please enter Lyra at ssh-server.example.com's password. I enter that, and it tells me, hooray, successfully I connected to the server, I uploaded the public key to the server, and let's try again to log in. So, SSH demo, why is it asking for the password? It shouldn't ask for the password.  We still need to tell SSH that it should use the ID file to add the private key to connect to the server. So, let's try again, specifying the identity file that we want to use. Come on. I'm on the server. Thank you, that's a usual mistake I make. Yes, correct. Thanks for staying with me. Awesome. So, third attempt, third time's a charm. Yes, and now it's not asking, and if you look closely, it's not asking for the user's password, it's asking for the passphrase of the private key, which is a different thing, right? Yeah, and it's connected to the server. Hooray, thankfully. So, we now basically have established that we can, let me just log out here again, because otherwise... That wasn't good. That was one log out too many. Yep, all good. So, that's basically, we were basically verifying that the public-private-key authentication was successful. Of course, the next thing would be to modify our configuration file so that we don't have to pass the identity file, the private key, as a parameter while calling the SSH command. So, let's do that quickly, and that would be these two lines. Not SSH. Config. Let's do it properly. And we just add two additional lines. The preferred authentication's public key, it's basically just speeding up things. So, I'm telling the SSH client, don't even bother with username, password, just try public-key authentication and nothing else. And with the line identity file, I specify the file that I want to use for client authentication, public-private-key authentication. And if I save that, and now what I had in mind should work. So, we have the username, the target host, and the identity file that we want to use in the config. And again, it's asking for the passphrase, and I'm able to log in. Yes, Ray. Awesome. It's nice when something works. Again, preferred authentication's public key to speed things up and the identity file to use in that case. And again, public-private-keys are free. They are easy to generate, use a different identity file for each service or for each server that you want to connect to. And we said before SSH demo, and we don't have to type that much, which is awesome. Ray. Next question that usually comes up when I give this talk is, yeah, but we haven't improved anything. We still have to type in something. We don't care if it's the username or the password for the user or the passphrase for the private key. Yes, that's true. But there is a solution for that. So, we are now at the stage where we have public-private-key authentication to the server enabled, which is, of course, more secure, et cetera, et cetera. But how can we work around the issue that I still have to enter a passphrase for the key? And again, it's the passphrase for the key, not the user's password. Well, there's something called SSH agent. And SSH agent is a small program that runs on your machine, creates a socket, and waits for SSH to request the private key unencrypted to do its work. This is very, very convenient, so you basically start SSH agent, you do an SSH add to add that key to the agent. The agent keeps that key in memory and makes it available to the SSH client in case you want to connect to a server. So you only have to present the passphrase once. And after that, the second, third, fifth time, it does not ask for the passphrase of the private key again. That's the hardcore, low-level, command-line-only option. If you're using a graphical user interface, if you're using GNOME key ring or Kvalet, or if you're using a Mac, the SSH agent functionality is usually incorporated into these tools. So if you're using the GNOME desktop, usually the GNOME key ring decrypts or opens has all your SSH private keys unlocked. That was the word I was looking for, unlocked as soon as you log into your operating systems desktop. On macOS, that's the same for the key ring. You log into the macOS and all the SSH client certificates are unlocked once you're unlocked into the system. If you have high-secure requirements, if you have requirements for a high-secure environment, you want to rethink this, and maybe you will have to enter the passphrase every time. And in my advanced, advanced, advanced talk, we can also take a look at storing the private, the passphrase on a Fighter 2 device or use Fighter 2 and other stuff to do two-factor authentication, too many tools in there. But for now, let's take a look at SSH agent again if you're using a graphical user interface on your laptop and of course 2022 is the year of Linux on the desktop. So let's do that. Yes, one more thing on the SSH agent. You can, if you add a key to that SSH agent runs in the background and waits for a connect. And if you add your private key to SSH agent, you can give an option of minus C, which will instruct SSH agent to prompt you, do you really want to use that key now? This is their stopgap to make it a little bit more secure. But again, if you have high-security requirements, you might want to rethink the usage of SSH agent. So again, SSH agent is running in the background and I need to add my private key identities to that agent. So there's a command for it called SSH add. If you give it, if you don't, if you only give it the file name, it will add that key to the SSH agent key ring, minus D removes it, and as I said before, minus C will prompt you for usage every time you want to use it. So to connect without a passphrase, we're almost there. We only have to add our private key to the SSH agent. I think that's good. Oh, I really have to type this. Oh, my God. Let's do it again. SSH add minus E. Ah, the choice of switching between German and American keyboards. Yeah. And... So basically, I'm telling SSH add at the file, demo.ed25519, which is my private key to the SSH agent. Ah, yes. Hooray. Thank you, demo gods. Yeah, I know what the problem is. Let me just... Because I exited out of the session, so I lost all the... Let me first switch to the proper keyboard and then it's easier for me to type. I can type this from you, but apparently that was unsuccessful. Right, so let's try again. SSH add. Yes, and it's asking me for my passphrase. Finally, it works. Every command with SSH requires you to minus I if you specify the ID for the private key except for SSH add. So, SSH agent now knows about this private key and I already committed my passphrase, so the unlocked private key is now stored in the SSH agent memory. And if I do an SSH demo, we should see no password. Yay! One more thing. The nice thing about SSH is once you have this configured and running, what you, for example, could do is an SCP. So, SCP is copy, right? It's file copy. It's like a local copy, but over the net. And I want to copy something from the server to my local machine. So, I give it the alias. Again, the config file works here as well. And then I say, okay, I want something from ETC and now I do a double tap on the tap, on the tap key, the tabulator key, and I get remote tap completion, which is very nice and very convenient because I can't remember the paths and the file names. I'm old. I don't want to think about those. So, once you have public private key authentication set up, you will get remote auto completion, which, in my personal opinion, is worth the hassle to set it up once. Really, it's really, really, really cool, right? So, that was one of the benefits of having public private key authentication. Yeah, let's skip that. One thing I wanted to mention, ooh, need to speed up a little bit. One thing I wanted to mention is this is also available on Windows. So, if you're using Putty, you have basically three commands. You have PuttyGAN, which is your keyGAN for Windows. You have your Putty agent, which is your SSH agent, and you have Putty, which is your SSH client. And with PuttyGAN, what you have to keep in mind is there is a button there to say, which says, save public key. But that is saved in a proprietary format. What you need in order to get public private key going is actually the public key text that is displayed in the top of the Putty key generator. That's the thing you want on the server to actually work if you're connecting to an open SSH server. Other than that, it's completely the same at the bottom. You can specify which key to generate RSA, or in our case, 825519. And you will get a private key. You want to save the private key in this case. And if you start Putty agent, you can add keys here. Again, it's the same as in Linux, but you have fancy buttons and user interface for that. And within Putty, if you go to Connections SSH Auth for authentication, so it's a very convoluted navigation, you can actually specify the private key you want to use, and then you get the same functionality, the same benefits as on Linux if you have to use Windows because your customer only supports Windows as a desktop. There's also more. There's more SSH config magic. What you have to keep in mind for SSH config files is for each parameter, the first value obtained will be used. So you want the more specific stuff on top, and you want the more general stuff at the bottom of the file. Because it's not going to take the last thing, it's going to take the first thing it finds. If you specify something else below, SSH doesn't care about that. So you want more specific stuff at the top, general defaults at the end. How does that look like? So in this example, if I connect to... If I want to connect to a server like Web.prod.example.com, it will take my prod ID private file, the last one at the bottom. But for one server, which is unicorn.prod.example.com, it will not take the prod ID at the bottom, because I have a more specific thing above that, and it will take the pink fluffy ID as the private key for that particular server. And for all the servers that are within the test.example.com domain, it takes the test ID private file. This is something you can easily set up. And again, more general stuff at the bottom, more specific stuff at the top. To give you another example, this is again something from my demo here. We have our demo host entry with the host name and username and preferred authentication. Then we could have several more host entries, and then we have a catch all that is host asterisks, and that's basically setting additional stuff. What I usually want to have is compression, yes, because I have to connect to servers in the US and Asia, so compression does help. And the identities only is also a nice thing, because otherwise SSH will just try every identity file it finds to connect to the server, and you will get errors, and with identities only, it will only use the identity file specified in the host entry to use to connect to the thing. I do have to speed up a little bit. What you could also do is within the .ssh directory, you could have conf.d directory, where you can have multiple files, so you can separate the configuration out for each customer or each server you want to configure, and it pulls those in alphabetic order. Last thing I want to touch on, and that's why I'm skipping this a little bit, is bestian or chump host. What do I mean by that? You have your client, you have something called a chump host or a bestian host that is connected to the internet, and you have the actual server where you want to work on or where you have to do some work on that is not reachable from the internet directly or from your client directly, so you have to go through that chump or bestian host. What you usually do is your ssh into the bestian host, then you're logged in at the bestian host and from there, ssh to the target host, so basically what you do is ssh demo or bestian, let's keep it with demo, right? And then you do, where is it? Yeah, and then your ssh further on, and then your ssh further on to, and I'm using the same username here, I like to explicitly specify my usernames, target.local, which is a machine I can't reach from my client, target, of course, and I'm on my internal server, so that's what you usually do and it's quite cumbersome because you have to log in and log in and log in and log in. Server client, here I'm correct. So what you can actually do is you can specify something called a chump host, so with the option minus capital G, you can define a chump host or a chump host alias that you want to use to get to the target machine. So I want to connect to target.local, but I'm telling ssh to use bestian as an intermediate, as a chump host. Of course, everything that you can specify on the command line, you can also put into the config file. So in this case, I have my specification of my demo host alias and I have an alias for internal, and in there, in the host internal, I can specify proxy chump and the alias and with that, it knows, okay, if I just enter ssh internal, it will automatically use the bestian host to connect to that machine. So, do I have this prepared? No, that's bad. Just give me a sec. There we are. Yeah. So on my client.ssh config, I'll add this and if I go there, so I now enter the bestian host, so if I do an ssh target.local, no, just local, I created an alias. Internal, thank you. I created an alias called internal and it tells me, yeah, you're connecting for the first time, yeah, that's fine. And I haven't configured public-private key authentication for that as well. The nice thing if you configure it that way is that the first connection gets tunneled through the ssh. So you connect to the bestian host and then you connect through that connection to the internal server. So if you pass on the identity file, the ssh agent can talk directly to your internal servers. You don't need agent forwarding and everything else, which is a lot more secure than having agent forwarding running on that bestian host. But of course, it also works with password authentication. Again, if you have an older ssh configuration, you can also fall back to the proxy command. I'm just leaving this here in the slides as a reference. Please, please, please, please use the jump host directive. Use the minus j option. Do not use minus a or agent forwarding anymore. It's insecure. You shouldn't use it. It's outdated. The jump host is the better option. I will skip that. You can read on that if you want to. And that concludes my short and rather long talk. Thank you very much for your participation and have a great day. Let's do one. Thank you. The demo cards are not kind, but it helps to see that you make mistakes. We all make mistakes and then we correct them when we learn. We've probably got time for one or two questions . Good morning. Is it possible with the jump host to also forward local and remote sessions? Yes. You can figure it the same way. As usual. That would be my advanced talk. Maybe next year. Next time. I'm still around. I'm helping with tear down . If you have any questions, feel free to approach me. I will be around. Thanks very much.