So I mentioned in the Plan for IA240 blog post, I had some other ideas. Ones that I decided to not go with for various reasons.
One to those ideas that I rejected:
Using a tablet, with my cell phone as a tether. I tried using my cellphone in class the first night. It didn't work too well. It was rather slow Googling questions the professor was asking.
I also didn't like the idea for a hand full of reasons. I could be wrong, because I don't understand all the tech.
First the tethering. I have a rooted (running cyanogen mod) cell phone, but every time I tried, I get messages saying the network I have for service is blocking it.
I'm still creating a wireless network that someone could try attacking. Other people wanting to connect. Not saying people would, but hacking wifi isn't that hard, and if they're willing to go after a laptop, why not go easier with a wifi connection.
I've only used Shark for Root sparingly. As I understand it, it can do 3g packet captures. I'm not sure if that's only for the phone it's on, or if it can grab any 3g signal. I also haven't found much documentation on it. I also don't have the equipment to test it properly at this time. Maybe we can set something like that up to EMU's IA Club, where we can play around with it and see what it does.
Just one of the ideas, I tossed to the side. I'll talk about another one some other time.
Showing posts with label linux. Show all posts
Showing posts with label linux. Show all posts
Friday, September 21, 2012
Saturday, September 15, 2012
Plan for IA-240 at Eastern Mi.
** This has been updated:
So one of the classes I'm taking this term is required for my degree. And I have to worry about protecting my computer in it.
The course:
IA 240. The main point of the class, that I took away from the first night, is to learn how to write Analyst reports. The over all goal is to give us the skills required to go work for a government agency. (The program has a lot of students leave and get jobs in the public sector).
The Final:
The professor will assign us something to do an analysis report on at the end of the semester. To teach us on Operational Security, we have to protect our final project from our class mates. He gives extra credit for each student we got information from.
The Problem:
The professor has already said we are required to bring laptops to class, and class mates, as in the past, will try hacking that computer to get your final project. **Update-1: This was said in a warning, not in a you will be hacking each other in this class.
Over all, knowing the above, one really wants to get your hacks in early, get a back door, and be able to come in to the classmates boxes at will. Lots of way to do that. But I'm about not being an easy target. In fact I don't want my system compromised.
Options to protect me:
- Change operating systems every class, either local install, from USB, or DVD / CD.
- Run Backtrack, and use that as the the desktop (not meant for that).
- Run TAILS
- buy dedicated machine, and use nothing on it, doing forensics on it at the end of the semester, and keep nothing on it.
- Be really evil... (run vm or a dedicated box with a sticky honeypot).
The Plan:
I don't have the money for the dedicated machines.
I thought about putting my money where my mouth is and installing Backtrack, on an old hard drive, then harden it. This would fit in with my Linux Hardening applied to BackTrack talk. However don't like the idea of swapping the hardware that often. Trying to hack my class mates would be un-ethical in my eyes anyway.
I don't have an interest in hacking my class mates. Just not being hacked.
So, I've already got Full Disk Encryption, I'm going run with The Amnesic Incognito Live System (TAILS). I'll take an energy hit, the main hard drive won't be touched.
The only thing I have to worry about is saving my work from class (not that I type much in class, I'm more about pen and paper). But if there is something I need to save, I have things for that. I'm using Google's two factor authentication. I also could look into doing File System over SSH. Not sure if I'll have to go that far.
*Update-1: the professor was not giving permission. he was giving a warning.
So one of the classes I'm taking this term is required for my degree. And I have to worry about protecting my computer in it.
The course:
IA 240. The main point of the class, that I took away from the first night, is to learn how to write Analyst reports. The over all goal is to give us the skills required to go work for a government agency. (The program has a lot of students leave and get jobs in the public sector).
The Final:
The professor will assign us something to do an analysis report on at the end of the semester. To teach us on Operational Security, we have to protect our final project from our class mates. He gives extra credit for each student we got information from.
The Problem:
The professor has already said we are required to bring laptops to class, and class mates, as in the past, will try hacking that computer to get your final project. **Update-1: This was said in a warning, not in a you will be hacking each other in this class.
Over all, knowing the above, one really wants to get your hacks in early, get a back door, and be able to come in to the classmates boxes at will. Lots of way to do that. But I'm about not being an easy target. In fact I don't want my system compromised.
Options to protect me:
- Change operating systems every class, either local install, from USB, or DVD / CD.
- Run Backtrack, and use that as the the desktop (not meant for that).
- Run TAILS
- buy dedicated machine, and use nothing on it, doing forensics on it at the end of the semester, and keep nothing on it.
- Be really evil... (run vm or a dedicated box with a sticky honeypot).
The Plan:
I don't have the money for the dedicated machines.
I thought about putting my money where my mouth is and installing Backtrack, on an old hard drive, then harden it. This would fit in with my Linux Hardening applied to BackTrack talk. However don't like the idea of swapping the hardware that often. Trying to hack my class mates would be un-ethical in my eyes anyway.
I don't have an interest in hacking my class mates. Just not being hacked.
So, I've already got Full Disk Encryption, I'm going run with The Amnesic Incognito Live System (TAILS). I'll take an energy hit, the main hard drive won't be touched.
The only thing I have to worry about is saving my work from class (not that I type much in class, I'm more about pen and paper). But if there is something I need to save, I have things for that. I'm using Google's two factor authentication. I also could look into doing File System over SSH. Not sure if I'll have to go that far.
*Update-1: the professor was not giving permission. he was giving a warning.
Wednesday, August 31, 2011
times change
So... I don't know.
I got my VPS up and running finally. Went with Linode. Had several friends speak highly of it. Went with a default Debian Squeeze install. Got it hardened as best I could. Now I'm getting ready to hit it with LAMP.
Linux, Apache, Mysql, PHP.
I was thinking LEMP, (NginX instead of Apache), but since I'm going to be running Drupal, and really want an easy set up (follow the howtos and be working kind), I'm going to skip LEMP. Can always change later.
So what will this VPS be doing?
- Personal website. Blog, resume, photo gallory, email etc. Yes I said blog.
- Offer up a site to my martial arts school. Cheaper and more control than what they are using now. Using a CRM framework (drupal again) should make it easy enough to have updated.
- Maybe a site for the Locksport groups
- shell access for me. Mostly for IRC.
- Photo and video exchange site for the parkour group I'm in. Maybe.
I got my VPS up and running finally. Went with Linode. Had several friends speak highly of it. Went with a default Debian Squeeze install. Got it hardened as best I could. Now I'm getting ready to hit it with LAMP.
Linux, Apache, Mysql, PHP.
I was thinking LEMP, (NginX instead of Apache), but since I'm going to be running Drupal, and really want an easy set up (follow the howtos and be working kind), I'm going to skip LEMP. Can always change later.
So what will this VPS be doing?
- Personal website. Blog, resume, photo gallory, email etc. Yes I said blog.
- Offer up a site to my martial arts school. Cheaper and more control than what they are using now. Using a CRM framework (drupal again) should make it easy enough to have updated.
- Maybe a site for the Locksport groups
- shell access for me. Mostly for IRC.
- Photo and video exchange site for the parkour group I'm in. Maybe.
Sunday, July 10, 2011
some days
Last night / this morning was a maintenance window at work. Lots of stuff to do. One call had about 30 people on it.
Now I'm the junior most member on my team. There are still things I don't know how to or can't do. Not that I don't know how. I mean I know how did them at my last job. Just don't know how we do them at this job. Can't because I don't have the needed access. Some of it I'm figuring out how to do work's way.
Anyway. there was an issue with an SSL cert. Really looks like someone sent us the wrong information in the turn up requests, since the same typo was in all of it (DNS and SSL). Anyway that got fixes late last night, but the people who were complaining didn't bother to test it. Ended paging everyone on my team. The one that fixed it asked why I didn't test it. Which I was in the process of doing when the other people said to start making the pages. Really those should come from me, not other people. Anywho. The other guy on my team was able to take care of the DNS stuff. But man was he ranting (and rightfully so).
Then at the very end, I got a huge win. Something wasn't working. Looks like another case of bad info. I was able to fix it. Before I started looking at it I had no clue what to even do. I vaguely knew the problem was related to NAT and Routing.
But I really found the problem falling back on one of my older skills that I love to use. Its kind of funny really because I was mentioning on a forum yesterday how great that skill was.
The skill - Being able to set up, and read a packet capture (sniffing) with TCPDump in real time. Once I found out what the problem was, I fixed it. with about 60 seconds to go in the maintenance window. :)
Now I'm the junior most member on my team. There are still things I don't know how to or can't do. Not that I don't know how. I mean I know how did them at my last job. Just don't know how we do them at this job. Can't because I don't have the needed access. Some of it I'm figuring out how to do work's way.
Anyway. there was an issue with an SSL cert. Really looks like someone sent us the wrong information in the turn up requests, since the same typo was in all of it (DNS and SSL). Anyway that got fixes late last night, but the people who were complaining didn't bother to test it. Ended paging everyone on my team. The one that fixed it asked why I didn't test it. Which I was in the process of doing when the other people said to start making the pages. Really those should come from me, not other people. Anywho. The other guy on my team was able to take care of the DNS stuff. But man was he ranting (and rightfully so).
Then at the very end, I got a huge win. Something wasn't working. Looks like another case of bad info. I was able to fix it. Before I started looking at it I had no clue what to even do. I vaguely knew the problem was related to NAT and Routing.
But I really found the problem falling back on one of my older skills that I love to use. Its kind of funny really because I was mentioning on a forum yesterday how great that skill was.
The skill - Being able to set up, and read a packet capture (sniffing) with TCPDump in real time. Once I found out what the problem was, I fixed it. with about 60 seconds to go in the maintenance window. :)
Wednesday, July 21, 2010
that was fun.
Wrote a shell script for work. Don't do that enough. Could have been done a million and one ways, but I did it this way (see below).
The itch:
Person who maintains the FTP server's user accounts is not a GNU/Linux person. She's asked for help and simplicity in the past for creating user accounts. Need to create the user, the home directory, set the password and set file permissions and file acl permissions.
The solution (slightly modified):
#!/bin/bash
# program to create new ftp users. Creates directory, sets permissions and ACL. Will ask for password.
# password section for Redhat Based systems
# get user name from command line
if [ -z "$1" ]
then
echo "$0: Usage: $0 user-name "
exit 3
fi
name="$1"
# create user account, and directory
useradd -d /FTPDIR/"$name" -s /bin/bash -g 502 "$name"
# get new password for user
echo "enter password for user $name"
read user_password
echo $user_password | passwd --stdin $name
# change ownership of directory
chmod 777 /FTPDIR/"$name"
# set acls for directories
setfacl -R --set u::rwx,g::rwx,o::rwx /FTPDIR/"$name"
setfacl -d -R --set u::rwx,g::rwx,o::rwx /FTPDIR/"$name"
# let user know it's done
echo -e "\n User $name is ready to log in. \n"
The itch:
Person who maintains the FTP server's user accounts is not a GNU/Linux person. She's asked for help and simplicity in the past for creating user accounts. Need to create the user, the home directory, set the password and set file permissions and file acl permissions.
The solution (slightly modified):
#!/bin/bash
# program to create new ftp users. Creates directory, sets permissions and ACL. Will ask for password.
# password section for Redhat Based systems
# get user name from command line
if [ -z "$1" ]
then
echo "$0: Usage: $0 user-name "
exit 3
fi
name="$1"
# create user account, and directory
useradd -d /FTPDIR/"$name" -s /bin/bash -g 502 "$name"
# get new password for user
echo "enter password for user $name"
read user_password
echo $user_password | passwd --stdin $name
# change ownership of directory
chmod 777 /FTPDIR/"$name"
# set acls for directories
setfacl -R --set u::rwx,g::rwx,o::rwx /FTPDIR/"$name"
setfacl -d -R --set u::rwx,g::rwx,o::rwx /FTPDIR/"$name"
# let user know it's done
echo -e "\n User $name is ready to log in. \n"
Saturday, October 24, 2009
well it's decided
So for the last few weeks I've been thinking about rebuilding my laptop with Debian. I wanted to do a reinstall to make some chages.
While trying to upgrade the system today, I broke it. I'm at least backing up some important data by using this walk through to mount my encrypted hard drive.
After the back up is done I'll probably end up taking the thing to work, or waiting until tomorrow do the install.
Kind of sucks. But at least I'm not going to be losing data (like my Keypass password file so I can log into thing).
While trying to upgrade the system today, I broke it. I'm at least backing up some important data by using this walk through to mount my encrypted hard drive.
After the back up is done I'll probably end up taking the thing to work, or waiting until tomorrow do the install.
Kind of sucks. But at least I'm not going to be losing data (like my Keypass password file so I can log into thing).
Monday, August 17, 2009
centos install
So I'm rebuilding my RedHat 4es based DNS boxes at work with CentOS 5.3. Partly because I don't have RH support anymore, partly to get the latest security fixes, and lastly because I've been wanting to rebuild them for a while.
CentOS had been giving me problems with installing since Saturday Night (note these are production systems and I had to create 2 new ones to cover the load, which went with no problem last week). Now I'm sure I could have stayed and got it working in an hour or so Saturday night, but 1) I was sick. 2) I didn't have any blank discs and the DVD I was using was scratched up pretty bad.
The load on this one server, kept getting to the point where it would try to install the drivers for the usb-storage. I'm assuming that means the CD-rom drive. And I'll explain why.
Looking around wasn't much use, I was looking for something along the lines of the knoppix cheat sheet. Something that told me all my boot options. But even googling the problem I was having wasn't much use. Until I used linux.google.com.
Someone else had a similar problem with their box, and turning off USB worked for them. However when I did that, my blade no longer saw my cd-rom drive. (The cd-rom drive is connected via ILO, and I've never had this problem before). Re-enable, and tell it to start without the storage driver worked. (linux nousbstorage). However, I was then left with having to do a net based install.
I had to do those for my virtual boxes last week, so no great problem there.
Once again I wonder why I'm doing CentOS installs, but meh. Personally I'd rather do Debian or Gentoo, but this is what the business told me to run.
CentOS had been giving me problems with installing since Saturday Night (note these are production systems and I had to create 2 new ones to cover the load, which went with no problem last week). Now I'm sure I could have stayed and got it working in an hour or so Saturday night, but 1) I was sick. 2) I didn't have any blank discs and the DVD I was using was scratched up pretty bad.
The load on this one server, kept getting to the point where it would try to install the drivers for the usb-storage. I'm assuming that means the CD-rom drive. And I'll explain why.
Looking around wasn't much use, I was looking for something along the lines of the knoppix cheat sheet. Something that told me all my boot options. But even googling the problem I was having wasn't much use. Until I used linux.google.com.
Someone else had a similar problem with their box, and turning off USB worked for them. However when I did that, my blade no longer saw my cd-rom drive. (The cd-rom drive is connected via ILO, and I've never had this problem before). Re-enable, and tell it to start without the storage driver worked. (linux nousbstorage). However, I was then left with having to do a net based install.
I had to do those for my virtual boxes last week, so no great problem there.
Once again I wonder why I'm doing CentOS installs, but meh. Personally I'd rather do Debian or Gentoo, but this is what the business told me to run.
Wednesday, June 24, 2009
Pidgin, Yahoo, and Debian Testing
So like lots of people, I've been having problems with Pidgin and Yahoo, after the upgrade. I followed several "work arounds". However every couple days it stopped working again.
If you followed the blog at all, you know I run Debian Testing right now. Currently, testing doesn't have the latest version of Pidgin that fixes the issue.
Instead of waiting, or changing my source lists, I went to the Debian Package pages and found the files I needed to get it to work.
If someone else wants to use DPKG to install just the files they need, here are the ones I needed:
libpurple0_2.5.7-1_i386.deb
libzephyr4_3.0~beta.2483-2_i386.deb
pidgin-data_2.5.7-1_all.deb
pidgin_2.5.7-1_i386.deb
Libpurple0 and pidgin-data were needed for pidgin. Libzephyr4 was needed for libpurple to install.
If you followed the blog at all, you know I run Debian Testing right now. Currently, testing doesn't have the latest version of Pidgin that fixes the issue.
Instead of waiting, or changing my source lists, I went to the Debian Package pages and found the files I needed to get it to work.
If someone else wants to use DPKG to install just the files they need, here are the ones I needed:
libpurple0_2.5.7-1_i386.deb
libzephyr4_3.0~beta.2483-2_i386.deb
pidgin-data_2.5.7-1_all.deb
pidgin_2.5.7-1_i386.deb
Libpurple0 and pidgin-data were needed for pidgin. Libzephyr4 was needed for libpurple to install.
Wednesday, May 20, 2009
I've been busy, computer stuff.
So one of the things I wanted to do when I created this blog, was make it more professional than my live journal account. That failed. But I do tend to try and cover an array of things here, besides just working out. Which is what lead to those other two posts earlier. The ones about U-verse and Knoppix 6. I took longer entries that I saw people going to via google (in my site tracker report) and made 2 condensed versions so they wouldn't have to hunt through longer posts for them.
Two weeks ago, my laptop at home suffered bad things when I tried to upgrade my installed version of Sidux to the latest version via apt-get dist-upgrade. It resulted in me having no GUI to use. All the data was still on the drive, and as long as I didn't want to do anything that required a Grapical environment, I was ok. Sadly that made surfing the web and watching videos hard.
To fix it, I bought a new hard drive. 320gig for about $70.00 USD + shipping. After installing it, I tried the latest CD ISO of Sidux, only to have it do the same thing up the software upgrade. No GUI. Next I tried Gentoo, after 2 failed installs I said screw it. Then I tried something else, I don't remember, and didn't care for it either, so I tried Gentoo again. 2 more installs later, I finally had a working system. As long as I didn't want to use a GUI. Trying to install the GUI would cause the system to shut down. It'd be in mid compile, and the next thing I know, it's turned off.
So I went back to Debian, haven't ran straight Debian for a while. Set up and encrypted hard drive, which is nice, and Debian so far is the only one I've seen that give the option on install. Of course it took about 5 hours to erase and encrypt the drive. I got a working system, with a GUI, but didn't like that some of the software was old. Debian Lenny had verison .8 something of VLC, and Open Office 2.4. Which trying to upgrade to 3.0 was what caused the problem to start with on the laptop.
I told the system to update itself to the Unstable branch, I tend to run something based off Unstable or Testing anyway, and it removed my GUI and wouldn't give it back. I got the Debian Testing Nightly build install, and it installed fine. I told it to install KDE, my preferred GUI. It did. KDE 4. Which was ok, because I wanted to try KDE 4 out.
I don't like KDE 4. It's too Vista like for my tastes. I don't see why they have to chase what Microsoft is putting out for the GUI. I can't turn off Plasma (or if I can, I haven't found out how yet) so I can install non-Plasma themes from the theme site. I don't like the desktop widget. I like to store some files on my desktop. It's the way I am. They're files I refer to regularly, things like what episode is next in a series I'm watching, a list of commands, etc. I don't like the bars at the top of the windows, I'd like to change those. And lastly, I don't care for the slowness. Even scrolling / page up / page down in Ice Weasel (Debian's Firefox fork) is slow. It shouldn't be and wasn't under Gnome.
I'm thinking of installing XFCE and LDXE on the thing and see how those deal. I also have to find a way to get my old data off the old hard drive. I've gotten most of the tweaking done though.
Two weeks ago, my laptop at home suffered bad things when I tried to upgrade my installed version of Sidux to the latest version via apt-get dist-upgrade. It resulted in me having no GUI to use. All the data was still on the drive, and as long as I didn't want to do anything that required a Grapical environment, I was ok. Sadly that made surfing the web and watching videos hard.
To fix it, I bought a new hard drive. 320gig for about $70.00 USD + shipping. After installing it, I tried the latest CD ISO of Sidux, only to have it do the same thing up the software upgrade. No GUI. Next I tried Gentoo, after 2 failed installs I said screw it. Then I tried something else, I don't remember, and didn't care for it either, so I tried Gentoo again. 2 more installs later, I finally had a working system. As long as I didn't want to use a GUI. Trying to install the GUI would cause the system to shut down. It'd be in mid compile, and the next thing I know, it's turned off.
So I went back to Debian, haven't ran straight Debian for a while. Set up and encrypted hard drive, which is nice, and Debian so far is the only one I've seen that give the option on install. Of course it took about 5 hours to erase and encrypt the drive. I got a working system, with a GUI, but didn't like that some of the software was old. Debian Lenny had verison .8 something of VLC, and Open Office 2.4. Which trying to upgrade to 3.0 was what caused the problem to start with on the laptop.
I told the system to update itself to the Unstable branch, I tend to run something based off Unstable or Testing anyway, and it removed my GUI and wouldn't give it back. I got the Debian Testing Nightly build install, and it installed fine. I told it to install KDE, my preferred GUI. It did. KDE 4. Which was ok, because I wanted to try KDE 4 out.
I don't like KDE 4. It's too Vista like for my tastes. I don't see why they have to chase what Microsoft is putting out for the GUI. I can't turn off Plasma (or if I can, I haven't found out how yet) so I can install non-Plasma themes from the theme site. I don't like the desktop widget. I like to store some files on my desktop. It's the way I am. They're files I refer to regularly, things like what episode is next in a series I'm watching, a list of commands, etc. I don't like the bars at the top of the windows, I'd like to change those. And lastly, I don't care for the slowness. Even scrolling / page up / page down in Ice Weasel (Debian's Firefox fork) is slow. It shouldn't be and wasn't under Gnome.
I'm thinking of installing XFCE and LDXE on the thing and see how those deal. I also have to find a way to get my old data off the old hard drive. I've gotten most of the tweaking done though.
Knoppix 6 and SSH
I've noticed a few trends in my visitor lists. One is people looking for information about Knoppix version 6 and ssh.
As I've said before I like my Gnu/Linux a little harder. I installed Knoppix 6 on a laptop at work and ssh was not included. No server, no client.
It is included on the Live CD, and can be ran from the live cd. However when I did the install, it was not there. To get it, I had to do the following:
root@Microknoppix:~# apt-cache search ssh
root@Microknoppix:~# apt-get install openssh-client
The above commands are tested from the live cd. On an installed system your milage may vary.
*EDIT - 2010/04/22
I've revisited this. Running Knoppix on VirtualBox.
Knoppix 6.2, LXDE. Click the desktop menu button, and under preferences Start SSH.
Aptitude had the ssh server listed when I searched for ssh, with the sourcelist that was installed from the LiveCD
As I've said before I like my Gnu/Linux a little harder. I installed Knoppix 6 on a laptop at work and ssh was not included. No server, no client.
It is included on the Live CD, and can be ran from the live cd. However when I did the install, it was not there. To get it, I had to do the following:
root@Microknoppix:~# apt-cache search ssh
root@Microknoppix:~# apt-get install openssh-client
The above commands are tested from the live cd. On an installed system your milage may vary.
*EDIT - 2010/04/22
I've revisited this. Running Knoppix on VirtualBox.
Knoppix 6.2, LXDE. Click the desktop menu button, and under preferences Start SSH.
Aptitude had the ssh server listed when I searched for ssh, with the sourcelist that was installed from the LiveCD
Friday, May 8, 2009
computer stuff
So yesterday, because I really wanted my laptop to run Open Office 3, instead of Open Office 2.4, I upgraded my distro. I run Sidux, which is a mash of Debian testing and Debian unstable.
Turns out that they've upgraded the Xserver software, and in the course of the upgrade things got broke on my box. If I want to access my laptop as a text only console device, with no gui, it's fine. However I use my laptop as my everyday computer.
I finally ordered the new hard drive I wanted for the laptop. 320 gig, 7200rpm I should get it Tuesday. Problem is I don't know what I want to run on it as my OS. The reason I went with Sidux to begin with, was because it was the only distro that supported my wireless card at the time. However there are things about it I don't like.
Here are the choices:
Sidux - not happy with some of the changes they made / some programs they use (like ceni)
Knoppix - Used to be great, but I don't think it's the linux swiss army knife. New installer isn't that great either. Doesn't work unless you use the FS they want you to. I like ext3, but I can't use it with there install. there was other issues I had with it to.
Debian - It's nice, and I think a great base, but come on 4 DVDs for an install? Seriously. Ok downloaded the netinst cd. But No live cd, so I can't make sure things work before installing
Gentoo - I've only "successfully" installed it once, and even then I didn't have a GUI. It was on work's laptop.
Not being considered: Anything Redhat based. I use Redhat, Centos, and Fedora at work, I just don't care for them that much. Ubuntu, same reason, even though I don't use it at work.
Until I get the new drive, I'll be running a live cd. I've got a few to play with the next few days. It'll be nice to clean some of the crap off the box to.
Turns out that they've upgraded the Xserver software, and in the course of the upgrade things got broke on my box. If I want to access my laptop as a text only console device, with no gui, it's fine. However I use my laptop as my everyday computer.
I finally ordered the new hard drive I wanted for the laptop. 320 gig, 7200rpm I should get it Tuesday. Problem is I don't know what I want to run on it as my OS. The reason I went with Sidux to begin with, was because it was the only distro that supported my wireless card at the time. However there are things about it I don't like.
Here are the choices:
Sidux - not happy with some of the changes they made / some programs they use (like ceni)
Knoppix - Used to be great, but I don't think it's the linux swiss army knife. New installer isn't that great either. Doesn't work unless you use the FS they want you to. I like ext3, but I can't use it with there install. there was other issues I had with it to.
Debian - It's nice, and I think a great base, but come on 4 DVDs for an install? Seriously. Ok downloaded the netinst cd. But No live cd, so I can't make sure things work before installing
Gentoo - I've only "successfully" installed it once, and even then I didn't have a GUI. It was on work's laptop.
Not being considered: Anything Redhat based. I use Redhat, Centos, and Fedora at work, I just don't care for them that much. Ubuntu, same reason, even though I don't use it at work.
Until I get the new drive, I'll be running a live cd. I've got a few to play with the next few days. It'll be nice to clean some of the crap off the box to.
Monday, April 13, 2009
I love finding new tools
TCPview, and netactview. They do the same thing, but one does it in Windows, the other does it in Linux.
Going through firewall logs Friday I found a box trying to hit Akamai Technologies' servers faster than once a second. Like 2 or 3 a second. The box lives on a part of the network with restricted outside access.
There was so much chatter in the logs I was looking at, it looked like it was the only box. The reason it caught my eye to start with was they all had Deny statements with them. Not knowing what the box was doing, we pulled it off the network. There have been infected user boxes before, from surfing sites that were a no no.
The other Network Engineer / Windows Admin today tossed TCPview on the box, it's basically a gui for netstat. Constantly updates in the window, and uses color codes too. However the box had been swept, put back on the network and updated.
I looked at the logs, thinking maybe the issue was a software update (as far as we know the sweep came back clean, the person who did the the sweep is off today), I saw several other boxes. Joking the other guy and I walked back to the area saying it's probably Adobe. Toss TCPview on it, and low, it is adobe updater.
I liked the tool. So I looked, turns out that netactview does the same thing in Linux. Very Nice.
I could do the same thing with netstat, but I hate watching text scroll by.
Going through firewall logs Friday I found a box trying to hit Akamai Technologies' servers faster than once a second. Like 2 or 3 a second. The box lives on a part of the network with restricted outside access.
There was so much chatter in the logs I was looking at, it looked like it was the only box. The reason it caught my eye to start with was they all had Deny statements with them. Not knowing what the box was doing, we pulled it off the network. There have been infected user boxes before, from surfing sites that were a no no.
The other Network Engineer / Windows Admin today tossed TCPview on the box, it's basically a gui for netstat. Constantly updates in the window, and uses color codes too. However the box had been swept, put back on the network and updated.
I looked at the logs, thinking maybe the issue was a software update (as far as we know the sweep came back clean, the person who did the the sweep is off today), I saw several other boxes. Joking the other guy and I walked back to the area saying it's probably Adobe. Toss TCPview on it, and low, it is adobe updater.
I liked the tool. So I looked, turns out that netactview does the same thing in Linux. Very Nice.
I could do the same thing with netstat, but I hate watching text scroll by.
Thursday, March 26, 2009
from knoppix to gentoo
I'm so displeased with the knoppix install (the knoppix 5.3 install left me displeased last week), that I'm going to give Gentoo 2008.0 a run.
I've had problems with getting Gentoo to install in the past on other boxes, but that's half the fun.
I've had problems with getting Gentoo to install in the past on other boxes, but that's half the fun.
Maybe I like my Gnu/Linux harder
Edit: If you found this page searching for knoppix 6 and ssh, please go to this post.
So I was excited when Knoppix released version 6. I was expecting great things.
The one thing I wasn't expecting was a great disappointment. I installed Knoppix6 on the work laptop this week. They said they wanted to go back to the smaller cd architecture over the DVD one. I thought that was a great idea.
However I think a fresh install should include a few simple things.
Knoppix 6, boots and goes straight to a gui. No login, no nothing. Even if this was a home box, I would want someone to have to login to the box, not just drop them in a directory for everyone. Since this is a laptop, I'd want a login for even more reason. I do different thing than other people that use the laptop. It's a shared resource for the team. I don't want them accessing something I'm doing when it's not finished. Something that has always been an issue I've had when working on scripts. It won't be finished, people try to run it, and break things as a result.
SSH is a common tool in the Nix world. At least I, and an developer I talked to today think so. What's the point of a Nix box that doesn't have SSH installed? Sure it doesn't have to be automatically started when the box boots, so you can make config changes the first time. But eventually auto start would be the goal. I use ssh to talk to other boxes. If I hadn't had a external net connection (like where I was Tuesday, when I broke the network) I wouldn't have been able to download ssh and install it. (Luckily this laptop is set for dual boot, and I could do things from Windows with Putty).
I created the user account I wanted. The first of 4 I'm making. It's the generic backdoor account for the department. The people who are going to have access to the laptop will each get their own accounts at some point. However su is aliased as sudo su. Which is great for the default knoppix user, but my account (net-eng) wasn't in the sudoer's file. And wouldn't let me into su. Of course I got around this by using the full path, but still.
net-eng@Microknoppix:~$ which su
net-eng@Microknoppix:~$ type su
su is aliased to `sudo su'
I'll set my own aliases thanks.
The system has limited packages, yes I know they wanted to save size, but half the reason of using a distro is got get packages on the install. If you're not going to include packages then why bother? Then there is the case of the live cd. It gives you cheat codes for boot, kde, gnome etc. But when I tried kde, nothing happened. Seriously it feels like it has the functionality of a Windows install. Other cheats, like kiosk mode wouldn't start for me either.
When I'm doing an install, I'd like to be asked who I want to use the computer, and be able to create an account on the install. Not be given a generic one of the maintainer's choice (the knoppix account in this case). I want to have the setting options. I want to put the name and password I want. As far as I can tell, there is no knowing the knoppix user password. And it doesn't ask for it when you sudo, because it has the no password option set.
Secondly I work in an environment where I have more than one computer. For the last 2 years, because of the previous usefulness of knoppix, I've been pushing to move some of the boxes to that. But when they all install to Microknoppix as the host name, and don't ask for any kind of domain information, it makes setting the systems up slower. Because now I'll have multiple with the same name and lack of domain information, I'll have to touch the boxes multiple times to get them set up.
Lastly, the new simpler 0wn installer forces you to use the reiserfs system. Personally I like EXT3. Just what I prefer. I'm not the only one in that camp either. One of our clients is requesting that all the drives we send to them, with their data on them are the EXT3 format.
But there is more to 0wn being useless than just that. I preconfigured the laptop with an EXT3 and a NTFS partition, since it is dual boot. 0wn couldn't see the EXT3 partition. It has an option to start gparted to modify the table but it would never load, it looks like it's not installed / not on the live-cd. Pre-configuring reiserfs didn't work either, the automatic option couldn't find it, and it wasn't showing a list of drives. Running 0wn from the command line did work, and I was able to get cfdisk to run, instead of gparted even though I used the gparted option. Then it saw the reiserfs partition no problem.
I used to think that knoppix was one of the most useful distros out there. It lived up to it's claim to be the swiss army knife of linux distros. I can also understand the developer's desire to shrink the growth down some. However, they've gone too far and the distro is no longer a swiss army knife in my book.
I loved the kiosk mode, I've used older versions as emergency web servers, nfs servers, and to make disk images when I had to do forensics work (which I'm not an expert on). I got a few co-workers to start using it too. One even went out and bought the Knoppix Hacks book (second edition). The problem is, Knoppix 6 just doesn't live up to what it's previous versions were, at least in my book.
So I was excited when Knoppix released version 6. I was expecting great things.
The one thing I wasn't expecting was a great disappointment. I installed Knoppix6 on the work laptop this week. They said they wanted to go back to the smaller cd architecture over the DVD one. I thought that was a great idea.
However I think a fresh install should include a few simple things.
- a login screen
- ssh pre-installed (maybe not turned on but at least installed)
- su working like a proper su, not an alias for sudo su.
- a system that doesn't make me feel like I'm using a windows want to be.
- the ability to create a user account and host name on set up.
- the ability to use the file system of my choosing.
Knoppix 6, boots and goes straight to a gui. No login, no nothing. Even if this was a home box, I would want someone to have to login to the box, not just drop them in a directory for everyone. Since this is a laptop, I'd want a login for even more reason. I do different thing than other people that use the laptop. It's a shared resource for the team. I don't want them accessing something I'm doing when it's not finished. Something that has always been an issue I've had when working on scripts. It won't be finished, people try to run it, and break things as a result.
SSH is a common tool in the Nix world. At least I, and an developer I talked to today think so. What's the point of a Nix box that doesn't have SSH installed? Sure it doesn't have to be automatically started when the box boots, so you can make config changes the first time. But eventually auto start would be the goal. I use ssh to talk to other boxes. If I hadn't had a external net connection (like where I was Tuesday, when I broke the network) I wouldn't have been able to download ssh and install it. (Luckily this laptop is set for dual boot, and I could do things from Windows with Putty).
I created the user account I wanted. The first of 4 I'm making. It's the generic backdoor account for the department. The people who are going to have access to the laptop will each get their own accounts at some point. However su is aliased as sudo su. Which is great for the default knoppix user, but my account (net-eng) wasn't in the sudoer's file. And wouldn't let me into su. Of course I got around this by using the full path, but still.
net-eng@Microknoppix:~$ which su
net-eng@Microknoppix:~$ type su
su is aliased to `sudo su'
I'll set my own aliases thanks.
The system has limited packages, yes I know they wanted to save size, but half the reason of using a distro is got get packages on the install. If you're not going to include packages then why bother? Then there is the case of the live cd. It gives you cheat codes for boot, kde, gnome etc. But when I tried kde, nothing happened. Seriously it feels like it has the functionality of a Windows install. Other cheats, like kiosk mode wouldn't start for me either.
When I'm doing an install, I'd like to be asked who I want to use the computer, and be able to create an account on the install. Not be given a generic one of the maintainer's choice (the knoppix account in this case). I want to have the setting options. I want to put the name and password I want. As far as I can tell, there is no knowing the knoppix user password. And it doesn't ask for it when you sudo, because it has the no password option set.
Secondly I work in an environment where I have more than one computer. For the last 2 years, because of the previous usefulness of knoppix, I've been pushing to move some of the boxes to that. But when they all install to Microknoppix as the host name, and don't ask for any kind of domain information, it makes setting the systems up slower. Because now I'll have multiple with the same name and lack of domain information, I'll have to touch the boxes multiple times to get them set up.
Lastly, the new simpler 0wn installer forces you to use the reiserfs system. Personally I like EXT3. Just what I prefer. I'm not the only one in that camp either. One of our clients is requesting that all the drives we send to them, with their data on them are the EXT3 format.
But there is more to 0wn being useless than just that. I preconfigured the laptop with an EXT3 and a NTFS partition, since it is dual boot. 0wn couldn't see the EXT3 partition. It has an option to start gparted to modify the table but it would never load, it looks like it's not installed / not on the live-cd. Pre-configuring reiserfs didn't work either, the automatic option couldn't find it, and it wasn't showing a list of drives. Running 0wn from the command line did work, and I was able to get cfdisk to run, instead of gparted even though I used the gparted option. Then it saw the reiserfs partition no problem.
I used to think that knoppix was one of the most useful distros out there. It lived up to it's claim to be the swiss army knife of linux distros. I can also understand the developer's desire to shrink the growth down some. However, they've gone too far and the distro is no longer a swiss army knife in my book.
I loved the kiosk mode, I've used older versions as emergency web servers, nfs servers, and to make disk images when I had to do forensics work (which I'm not an expert on). I got a few co-workers to start using it too. One even went out and bought the Knoppix Hacks book (second edition). The problem is, Knoppix 6 just doesn't live up to what it's previous versions were, at least in my book.
Tuesday, February 10, 2009
The usb version is faster
So yesterday at work, I killed my computer. I recovered it this morning. but because recovery could cause loss of data, I backed the box up first yesterday... Everything was still on the hard drive, but I deleted this tiny little partition that was needed to boot.
Last week we got a laptop in from a former sales associate. I don't know if I should laugh or feel insulted. He decided to "wipe" his hard drive before sending the company laptop back. One that he had his username, password, and EBAY account information taped too.
Anyway, I said last week I could recover it. One of the help desk people came over today and said that she was told to give it to me.
30 seconds after booting the thing with a USB Key with Linux (Knoppix) Installed, I was staring at the guy's data. Stupid users...
Seriously though, if you're going to delete your data, at least make it a challenge to get back. Do what I do, at least whipe the partition out. Deleting one boot file, not even worth the time really.
I started recovery on the laptop, but the fans were not running and it overheated. So I've re-did the boot with an external hard drive attached, and well the usb was faster to boot.
Last week we got a laptop in from a former sales associate. I don't know if I should laugh or feel insulted. He decided to "wipe" his hard drive before sending the company laptop back. One that he had his username, password, and EBAY account information taped too.
Anyway, I said last week I could recover it. One of the help desk people came over today and said that she was told to give it to me.
30 seconds after booting the thing with a USB Key with Linux (Knoppix) Installed, I was staring at the guy's data. Stupid users...
Seriously though, if you're going to delete your data, at least make it a challenge to get back. Do what I do, at least whipe the partition out. Deleting one boot file, not even worth the time really.
I started recovery on the laptop, but the fans were not running and it overheated. So I've re-did the boot with an external hard drive attached, and well the usb was faster to boot.
Wednesday, November 12, 2008
cisco load balancer
So I have a content switch module in one of my switches. It's used for Load Balancing of services across multiple servers. Think multiple servers for 1 web page, all the servers are mirrored so you get the same content, it just spreads the pain around to 4 servers instead of having 1 server to do all the work.
So I'm renumbering 4 of the servers. We're actually upgrading some of the content to virtual servers, but leaving some stuff behind on the old server. It was a case of a new product not having a home and sharing the load on the servers, with out creating a virtual server.
Anyway like I said, renumbering servers. Set up the firewall to point the traffic to the load balancer. Set the server up to pass traffic. I already have one up and running this is the second one. I spent roughly 2 to 3 hours trying to figure out why this thing couldn't get a network connection. It could talk to the other servers on the same vlan / network, but moving across to the other vlans and networks (where the firewall comes into play) it wouldn't.
Change ip addresses, same problem. Change gateways to the DMZ instead of the LB, and it would get a net connection. Double check the firewall routing. It still didn't work.
Then I thought, ok, the only thing I haven't done is put it into a server farm yet, on the CSM. As soon as I did that, it started working. Why the LB, needs to know what server farm something belongs to before it starts passing traffic I have no idea. I think it's a bad design though. I can see why they'd do it that way. That way you don't have things pointing to the load balancer that aren't being balanced. But when you're just setting up a box, you don't want it to be balanced, you want it to work.
Meh
So I'm renumbering 4 of the servers. We're actually upgrading some of the content to virtual servers, but leaving some stuff behind on the old server. It was a case of a new product not having a home and sharing the load on the servers, with out creating a virtual server.
Anyway like I said, renumbering servers. Set up the firewall to point the traffic to the load balancer. Set the server up to pass traffic. I already have one up and running this is the second one. I spent roughly 2 to 3 hours trying to figure out why this thing couldn't get a network connection. It could talk to the other servers on the same vlan / network, but moving across to the other vlans and networks (where the firewall comes into play) it wouldn't.
Change ip addresses, same problem. Change gateways to the DMZ instead of the LB, and it would get a net connection. Double check the firewall routing. It still didn't work.
Then I thought, ok, the only thing I haven't done is put it into a server farm yet, on the CSM. As soon as I did that, it started working. Why the LB, needs to know what server farm something belongs to before it starts passing traffic I have no idea. I think it's a bad design though. I can see why they'd do it that way. That way you don't have things pointing to the load balancer that aren't being balanced. But when you're just setting up a box, you don't want it to be balanced, you want it to work.
Meh
Monday, October 27, 2008
Micro Center USB Flash drives
I like flash drives I really do. I'm thinking of getting some new ones. Because I've "lost" a couple. So I went to the Micro Center website, and pulled up their current ones. Search was USB Flash Drives. The store branded ones work great, and are fairly cheap.... I paid $30.00 for 8 gigabits either earlier this year, or late last year. I don't remember which.
The 16gb ones are now $30.00. I think I'm going to go and buy a bunch. Maybe I'll buy some more 8 gig ones too, for $15.00 each.
For Christmas this year, I'm thinking of giving everyone on my team at work the same thing. 2 USB drives. One with a linux install, I'm thinking damn small linux, and the other one with True Crypt and Portable Apps.
The 16gb ones are now $30.00. I think I'm going to go and buy a bunch. Maybe I'll buy some more 8 gig ones too, for $15.00 each.
For Christmas this year, I'm thinking of giving everyone on my team at work the same thing. 2 USB drives. One with a linux install, I'm thinking damn small linux, and the other one with True Crypt and Portable Apps.
Wednesday, July 16, 2008
A little more on FuseSMB.cache
For some reason my post on FuseSMB.cache seems to be popular. Not sure why, but when searching on google, it's on the front page. However The top link for
Linux Mint Forum is even better.
Basically it's creating a version of microsoft's network neighborhood under /home/usename/Network
There is a way to turn it off, I suggest going to the above link.
Linux Mint Forum is even better.
Basically it's creating a version of microsoft's network neighborhood under /home/usename/Network
There is a way to turn it off, I suggest going to the above link.
Wednesday, May 21, 2008
it's been a while
I'd love to say I have been spending the last month playing with my great new CCNA lab, but I haven't been. It's sitting on a chair in my front room right now. I have almost everything I need. All I have to get is a rack, a shelf, a pdu (perfer a switched pdu), and a PC to rule it all (which is sitting half a part on my kitchen table and floor, changing cases).
However, due to projects at work, I'm back to studying Xen. The last book I had sucked. In fact it sucked so bad that all the errata I submitted has yet to show up. I will not be wasting my time with that book anymore, and probably will just toss it into the recycle bin the next time I find it.
I recently purchased Running Xen: A Hands-On Guide to the Art of Virtualization. It's really good. I mean really really good. I did have some problem with the Xen 3.0.3-0 LiveCD, but that's not the book's fault. I am also seriously telling everyone I know in computers to buy this book.
Other things I have worked on...
Well once again, I remind everyone in the department why you want physical security on the servers, not just software. I've had 5 boxes, from a company the people I work for bought out, that had to have data or other things accessed. 4 of the 5 went down easy with TRK. We just reset the administrator password, that's right I get paid to crack boxes. The last one we had to do a little different. We really needed the data off of it, and it turns out that KDE based linux distros (at least the 2 we tried) don't handle ntfs mounts very well maybe it's just something in the debian tree, I'll have to check more later. However Fedora 8 (gnome desktop)got the data no problem did. Even if it is taking all day to copy the data over to our usb drive (probably could have done a network drop faster but I was teaching the windows admin how to use the stuff, and he went with the usb drive).
I recently got to build out a system to move the large amounts of data we get from customers to our network in what we hope will be a faster way. Get the drive, take it out of it's usb case, put it into a removable SATA tray and copy it up to the share at gb speeds (after they get the line ran next week, so for now it will be 100mb speed). It's been a pain in my but to get the system up, problems with the Nix distros I wanted to install, bios updates, things breaking when I install the drivers. It went from being a Linux box, to a Win2k3 to an XP-64bit box. I'm hoping XP will work since intel's excuse is it's meant to be a desktop box. It has to be up and running by morning though, which is why I'm still at work at almost 22:30 edt.
Today I also got to design an 8TB storage system. I'm hoping it will work, I'll find out in a week or so when the hardware comes in. 8 sata drives, 1 ide drive (os), lots of memory and FreeNAS
However, due to projects at work, I'm back to studying Xen. The last book I had sucked. In fact it sucked so bad that all the errata I submitted has yet to show up. I will not be wasting my time with that book anymore, and probably will just toss it into the recycle bin the next time I find it.
I recently purchased Running Xen: A Hands-On Guide to the Art of Virtualization. It's really good. I mean really really good. I did have some problem with the Xen 3.0.3-0 LiveCD, but that's not the book's fault. I am also seriously telling everyone I know in computers to buy this book.
Other things I have worked on...
Well once again, I remind everyone in the department why you want physical security on the servers, not just software. I've had 5 boxes, from a company the people I work for bought out, that had to have data or other things accessed. 4 of the 5 went down easy with TRK. We just reset the administrator password, that's right I get paid to crack boxes. The last one we had to do a little different. We really needed the data off of it, and it turns out that KDE based linux distros (at least the 2 we tried) don't handle ntfs mounts very well maybe it's just something in the debian tree, I'll have to check more later. However Fedora 8 (gnome desktop)got the data no problem did. Even if it is taking all day to copy the data over to our usb drive (probably could have done a network drop faster but I was teaching the windows admin how to use the stuff, and he went with the usb drive).
I recently got to build out a system to move the large amounts of data we get from customers to our network in what we hope will be a faster way. Get the drive, take it out of it's usb case, put it into a removable SATA tray and copy it up to the share at gb speeds (after they get the line ran next week, so for now it will be 100mb speed). It's been a pain in my but to get the system up, problems with the Nix distros I wanted to install, bios updates, things breaking when I install the drivers. It went from being a Linux box, to a Win2k3 to an XP-64bit box. I'm hoping XP will work since intel's excuse is it's meant to be a desktop box. It has to be up and running by morning though, which is why I'm still at work at almost 22:30 edt.
Today I also got to design an 8TB storage system. I'm hoping it will work, I'll find out in a week or so when the hardware comes in. 8 sata drives, 1 ide drive (os), lots of memory and FreeNAS
Friday, March 28, 2008
FuseSMB.cache
Tuesday night I had to bring a new external server online. While checking the firewall logs I saw something interesting. There was a box on our internal network trying to ping it. So I started checking the log for just that ip address. It was pinging the whole network.
Of course it was failing since we deny pings from our users space. But it was interesting. I was left wondering if someone's box was infected and trying to map our network and spread the disease.
So looking into it more, it turned out to be a Linux Mint box in Engineering. So I had to get a copy of Linux Mint. After several attempts, I was able to finally get a copy, and took it to work yesterday. When I ran it, it wasn't doing it.
So I had the electrical engineer do a TCPDump icmp on his box (which I could have done sooner, but I wanted to see if I could replicate the traffic I was seeing). He left it running for about 2 minutes and saw that it was doing all the boxes on the network. A quick netstat -ep saw it was something called fusesmb.cache.
More looking, at it, it's a way for Samba to be mounted via fuse to the file system and replicate the function of microsoft's network neighborhood. Neat little program, but I wish it didn't ping spam the network.
EDIT*
This seems to be popular (at least comes up in google searchs, according to sitemeter a bit) for a quicker and cleaner answer go to this more recent post
Of course it was failing since we deny pings from our users space. But it was interesting. I was left wondering if someone's box was infected and trying to map our network and spread the disease.
So looking into it more, it turned out to be a Linux Mint box in Engineering. So I had to get a copy of Linux Mint. After several attempts, I was able to finally get a copy, and took it to work yesterday. When I ran it, it wasn't doing it.
So I had the electrical engineer do a TCPDump icmp on his box (which I could have done sooner, but I wanted to see if I could replicate the traffic I was seeing). He left it running for about 2 minutes and saw that it was doing all the boxes on the network. A quick netstat -ep saw it was something called fusesmb.cache.
More looking, at it, it's a way for Samba to be mounted via fuse to the file system and replicate the function of microsoft's network neighborhood. Neat little program, but I wish it didn't ping spam the network.
EDIT*
This seems to be popular (at least comes up in google searchs, according to sitemeter a bit) for a quicker and cleaner answer go to this more recent post
Subscribe to:
Posts (Atom)
