random sub rosa

Set up bind (caching-nameserver) on OpenBSD 4.9

2011-12-24T04:12:00.001-08:00

http://www.nohair.net/news/2011/set-up-dns-on-openbsd-4-9/

ruby installation with rvm on Ubuntu 10.04.3 LTS

2011-10-28T22:44:00.000-07:00

:~# PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/rvm/bin"
:~# apt-get install git-core curl build-essential openssl libssl-dev libyaml-dev libreadline6 libreadline6-dev zlib1g zlib1g-dev
:~# bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer )

#something was broken here during package management above, not sure...
echo "export PATH=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/rvm/bin\"" > >> ./.bashrc

:~# rvm pkg install zlib
:~# rvm install 1.9.2
:~# rvm use 1.9.2
:~# rvm default 1.9.2
:~# rvm all do gem install eventmachine
:~# echo "[[ -s \"/usr/local/rvm/scripts/rvm\" ]] && . \"/usr/local/rvm/scripts/rvm\"" >> ./.profile

root@sssid1:~# ruby -v
ruby 1.9.2p290 (2011-07-09 revision 32553) [i686-linux]
root@sssid1:~#

HTTP Range Header Info

2011-10-13T15:08:00.001-07:00

http://zoompf.com/blog/2010/03/performance-tip-for-http-downloads

how to securely wipe a drive in linux

2011-10-11T16:14:00.000-07:00

option 1
# shred -n 7 -z /dev/sdb

option 2
# dd if=/dev/urandom of=/dev/sdb bs=4096 count=7
# dd if=/dev/zero of=/dev/sdb bs=4096 count=7

clear postfix mail queue

2011-09-30T13:49:00.001-07:00

for f in ` mailq |grep .com -B 2 |grep ^[A-Z0-9]|awk '{print $1}'` ; do postsuper -d $f; done

Also, fun times here:
http://www.postfix.org/docs.html

Comparison of Disk Encryption Software

2011-09-28T17:58:00.000-07:00

http://en.wikipedia.org/wiki/Comparison_of_disk_encryption_software

delete a range of lines from your history

2011-08-31T17:31:00.001-07:00

have you ever pasted a shitload of lines into a terminal? ya, lame. sucks. embarassing.

here is how to get rid of a whole bunch of em all at once.

history -d `echo {675..1081}`

Nagios - ERROR opening session: An empty privacy password was specified.

2011-08-31T16:59:00.001-07:00

in Nagios® Core™ 3.2.3 i got this error when running checks with "check_snmp_load":
"ERROR opening session: An empty privacy password was specified."

on the command line, after executing this:
../libexec/snmp/check_snmp_load.pl -l readpriv -x xxxxxx -X xxxxxx -H hostname -w 3,3,2 -c 4,4,3 -T netsl

i got this:
Argument "v6.0.1" isn't numeric in numeric lt (<) at ./check_snmp_load.pl_old line 348.
Load : 0.00 0.00 0.00 : OK

I changed line 348 from:
my $resultat = (Net::SNMP->VERSION < 4) ?

to:
my $resultat = (Net::SNMP->VERSION lt 4) ?

..works

automatically bring up the openvpn client

2011-08-17T23:50:00.001-07:00

# /etc/rc.local
echo 0 > /proc/sys/net/ipv4/conf/tun0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/ip_forward
/usr/local/sbin/openvpn --config /etc/openvpn/client.conf --daemon &

#i use this to do all kinds of stuff...

clearing a mail queue

2011-08-17T13:15:00.001-07:00

for f in ` mailq |grep hostname.com -B 2 |grep ^[A-Z0-9]|awk '{print $1}'` ; do postsuper -d $f; done

mrepo

2011-08-15T15:25:00.001-07:00

http://dag.wieers.com/home-made/mrepo/

SMTP Codes

2011-08-13T20:50:00.001-07:00

211 - A system status message.
214 - A help message for a human reader follows.
220 - SMTP Service ready.
221 - Service closing.
250 - Requested action taken and completed.
251 - The recipient is not local to the server, but the server will accept and forward the message.
252 - The recipient cannot be VRFYed, but the server accepts the message and attempts delivery.

354 - Start message input and end with .. This indicates that the server is ready to accept the message itself

421 - The service is not available and the connection will be closed.
450 - The requested command failed because the user’s mailbox was unavailable (such as being full). Try again later.
451 - The command has been aborted due to a server error. (on their side)
452 - The command has been aborted because the server has insufficient system storage.

500 - The server could not recognize the command due to a syntax error.
501 - A syntax error was encountered in command arguments.
502 - This command is not implemented.
503 - The server has encountered a bad sequence of commands.
504 - A command parameter is not implemented.
550 - The requested command failed because the user’s mailbox was unavailable (such as not found)
551 - The recipient is not local to the server.
552 - The action was aborted due to exceeded storage allocation.
553 - The command was aborted because the mailbox name is invalid.
554 - The transaction failed for some unstated reason

compare packages between two RHEL systems

2011-08-12T10:44:00.000-07:00

#generate package list on hostname1
rpm -qa --qf "%{NAME}\n" > hostname1.rpm.txt
cat ./hostname1.rpm.txt | sort | uniq > ./hostname1_final.rpm.txt

#generate package list on hostname2
rpm -qa --qf "%{NAME}\n" > hostname2.rpm.txt
cat ./hostname2.rpm.txt | sort | uniq > ./hostname2_final.rpm.txt

#you want the difference between systems - show diffs on the right and trim leading whitespace
sdiff ./hostname1.rpm.txt ./hostname2.rpm.txt | grep '>' | sed -e 's/^[> \t]*//'

#you want the difference between systems - show diffs on the left and trim trailing whitespace
sdiff ./hostname1.rpm.txt ./hostname2.rpm.txt | grep '<' | sed -e 's/[ \t<]*$//'

clearing a mail queue

2011-08-03T14:53:00.000-07:00

#sendmail
sendmail -qS -v subdomain.test.com

#postfix
for f in ` mailq |egrep subdomain.test.com -B 2 |grep ^[A-Z0-9]|awk '{print $1}'` ; do postsuper -d $f; done

GPG key error when updating RHEL 5.x system

2011-07-28T12:09:00.000-07:00

when running a `yum update -y`, i got:

--
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 897da07a

Public key for nash-5.1.19.6-71.el5.i386.rpm is not installed
--

I had to install:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta

then run again.

also, check this:

rpm -qa |grep gpg

if you have multiple of the same gpg keys installed use the following:

rpm -e --allmatches gpg-pubkey*
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta

mdadm notes

2011-07-25T12:21:00.000-07:00

mdadm --remove /dev/md0 /dev/sdb
#pull disk, replace with new one

# you have to fail a disk before you remove it
# however, if the system wont release the raid partner, you need to slide the offending disks out and boot off a good disk.

#here you can review the layout
[root@host~]# fdisk -l /dev/sda

Disk /dev/sda: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 * 1 16 128488+ fd Linux raid autodetect
/dev/sdb2 17 1291 10241437+ fd Linux raid autodetect
/dev/sdb3 1292 2566 10241437+ 83 Linux
/dev/sdb4 2567 30401 223584637+ 5 Extended
/dev/sdb5 2567 2827 2096451 fd Linux raid autodetect
/dev/sdb6 2828 2860 265041 fd Linux raid autodetect
/dev/sdb7 2861 30401 221223051 fd Linux raid autodetect

#review the descriptions of the disks

-----------

[root@host ~]# sfdisk -d /dev/sda
# partition table of /dev/sda
unit: sectors

/dev/sda1 : start= 63, size= 256977, Id=fd, bootable
/dev/sda2 : start= 257040, size= 20482875, Id=fd
/dev/sda3 : start= 20739915, size= 20482875, Id=83
/dev/sda4 : start= 41222790, size=449113140, Id= 5
/dev/sda5 : start= 41222853, size= 4192902, Id=fd
/dev/sda6 : start= 45415818, size= 530082, Id=fd
/dev/sda7 : start= 45945963, size=444389967, Id=fd
[root@host ~]# sfdisk -d /dev/sdb

sfdisk: ERROR: sector 0 does not have an msdos signature
/dev/sdb: unrecognized partition table type
No partitions found
-----------

#this command is similar to `sfdisk -l`, but you can use it to copy the layout to the new replacement disk
#its destructive to sdb, be sure you know what you're doing. read man page, right? :)

-----------

[root@host~]# sfdisk -d /dev/sda | sfdisk /dev/sdb
Checking that no-one is using this disk right now ...
OK

Disk /dev/sdb: 30522 cylinders, 255 heads, 63 sectors/track

sfdisk: ERROR: sector 0 does not have an msdos signature
/dev/sdb: unrecognized partition table type
Old situation:
No partitions found
New situation:
Units = sectors of 512 bytes, counting from 0

Device Boot Start End #sectors Id System
/dev/sdb1 * 63 257039 256977 fd Linux raid autodetect
/dev/sdb2 257040 20739914 20482875 fd Linux raid autodetect
/dev/sdb3 20739915 41222789 20482875 83 Linux
/dev/sdb4 41222790 490335929 449113140 5 Extended
/dev/sdb5 41222853 45415754 4192902 fd Linux raid autodetect
/dev/sdb6 45415818 45945899 530082 fd Linux raid autodetect
/dev/sdb7 45945963 490335929 444389967 fd Linux raid autodetect
Successfully wrote the new partition table

Re-reading the partition table ...

If you created or changed a DOS partition, /dev/foo7, say, then use dd(1)
to zero the first 512 bytes: dd if=/dev/zero of=/dev/foo7 bs=512 count=1
(See fdisk(8).)
[root@host~]# sfdisk -d /dev/sdb
# partition table of /dev/sdb
unit: sectors

/dev/sdb1 : start= 63, size= 256977, Id=fd, bootable
/dev/sdb2 : start= 257040, size= 20482875, Id=fd
/dev/sdb3 : start= 20739915, size= 20482875, Id=83
/dev/sdb4 : start= 41222790, size=449113140, Id= 5
/dev/sdb5 : start= 41222853, size= 4192902, Id=fd
/dev/sdb6 : start= 45415818, size= 530082, Id=fd
/dev/sdb7 : start= 45945963, size=444389967, Id=fd

-----------

#check the status of the set
cat /proc/mdstat

#now, add the partition slices back to the set
mdadm --add /dev/md0 /dev/sdb1
mdadm --add /dev/md1 /dev/sdb5
mdadm --add /dev/md3 /dev/sdb6
mdadm --add /dev/md4 /dev/sdb7
mdadm --add /dev/md2 /dev/sdb2

#review
mdadm --detail /dev/md0

#review progress
cat /proc/mdstat

healthy output:

[root@host ~]# cat /proc/mdstat
Personalities : [raid1]
md0 : active raid1 sda1[0] sdb1[1]
128384 blocks [2/2] [UU]

md1 : active raid1 sda5[0] sdb5[1]
2096384 blocks [2/2] [UU]

md3 : active raid1 sda6[0] sdb6[1]
264960 blocks [2/2] [UU]

md4 : active raid1 sda7[0] sdb7[1]
221222976 blocks [2/2] [UU]

md2 : active raid1 sda2[0] sdb2[1]
10241344 blocks [2/2] [UU]

unused devices:

UNhealthy output:

[root@host ~]# cat /proc/mdstat
Personalities : [raid1]
md0 : active raid1 sdb1[1]
128384 blocks [2/2] [_U]

md1 : active raid1 sdb5[1]
2096384 blocks [2/2] [_U]

md3 : active raid1 sdb6[1]
264960 blocks [2/2] [_U]

md4 : active raid1 sdb7[1]
221222976 blocks [2/2] [_U]

md2 : active raid1 sdb2[1]
10241344 blocks [2/2] [_U]

unused devices:

#have a nice day

--------------------------------------------------------
[root@somehost ~]# mdadm --detail /dev/md0
/dev/md0:
Version : 00.90.03
Creation Time : Sat Oct 31 03:08:47 2009
Raid Level : raid1
Array Size : 128384 (125.40 MiB 131.47 MB)
Device Size : 128384 (125.40 MiB 131.47 MB)
Raid Devices : 2
Total Devices : 2
Preferred Minor : 0
Persistence : Superblock is persistent

Update Time : Mon Jul 25 04:48:26 2011
State : clean
Active Devices : 2
Working Devices : 2
Failed Devices : 0
Spare Devices : 0

UUID : xxxxxx:xxxxxxxx:xxxxxxx:dd7a13a5
Events : 0.74

Number Major Minor RaidDevice State
0 8 1 0 active sync /dev/sda1
1 8 17 1 active sync /dev/sdb1
--------------------------------------------------------

nagios check: check_by_ssh!"sudo /bin/cat /proc/mdstat | grep _ /proc/mdstat -c | grep 0 -c

ethtool command

2011-07-21T13:43:00.000-07:00

/sbin/ethtool -s eth0 speed 100 duplex full autoneg off

mail alert when script is finished

2011-07-21T11:38:00.000-07:00

echo y | ./deploy.sh -s xxxx -f '/root/xxxxx.tgz' && mail -s "deployment complete on `hostname`" me@overthere.com < /dev/null

logrotate script

2011-07-18T10:43:00.000-07:00

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

create a list of all packages

2011-07-18T10:40:00.000-07:00

#!/bin/sh

/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \
| /bin/sort > /var/log/rpmpkgs

The idea would be to take a sha1 hash of this file and then check it periodically to be sure that the package list has not changed.

oracle linux links

2011-06-22T15:03:00.000-07:00

http://www.oracle.com/us/technologies/linux/index.htm
http://www.oracle.com/us/technologies/linux/unbreakable-enterprise-kernel-ds-173416.pdf
http://www.oracle.com/us/technologies/linux/ubl-edison-066204.pdf
http://public-yum.oracle.com/

sending logs to splunk

2011-06-14T01:19:00.000-07:00

#* * * * * root lockfile -l5 -s5 /tmp/mysql_error_log.lock && /usr/sbin/logtail /dbhost2_logs/dbhost2.err | /usr/bin/nc -w2 -v dblogs1 10001 && rm -rf /tmp/mysql_error_log.lock > /dev/null 2>&1

#* * * * * root lockfile -l5 -s5 /tmp/messages_log.lock && /usr/sbin/logtail /var/log/messages | /usr/bin/nc -w2 -v dblogs1 10002 && rm -rf /tmp/messages_log.lock > /dev/null 2>&1

top 10 memory hogs

2011-06-13T12:37:00.001-07:00

ps -eo pmem,pid,comm --no-headers | sort -k1 -rn | head -10

unable to build ports in OpenBSD 4.8 - SOLVED

2011-03-23T00:05:00.000-07:00

From root's .profile, comment this out:

...

if [ -x /usr/bin/tset ]; then
if [ X"$XTERM_VERSION" = X"" ]; then
eval `/usr/bin/tset -sQ '-munknown:?vt220' $TERM`
else
eval `/usr/bin/tset -IsQ '-munknown:?vt220' $TERM`
fi
fi

...

and add this:

export TERM=vt100

reinstall openbsd ports

2011-03-23T00:01:00.001-07:00

tar -xvzpf base48.tgz -C/
tar -xvzpf comp48.tgz -C/
tar -xvzpf xbase48.tgz -C/

unix time coolness

2011-03-11T12:28:00.001-08:00

[root@elcap ~]# date
Fri Mar 11 11:26:52 PST 2011

[root@elcap ~]# date +%s
1299871617

[root@elcap ~]# date -R -d @1300000000
Sat, 12 Mar 2011 23:06:40 -0800
[root@elcap ~]#

how many InnoDB rows are read per second in mysql

2011-02-26T00:17:00.000-08:00

mysqladmin extended-status -i 1 -r -p -uroot | grep -e "Com_select"

how to help out heartbeat

2011-02-17T11:03:00.000-08:00

/sbin/arping -q -A -c 1 -I eth0 -s 10.6.1.10 10.6.1.10

quick check of top current process

2011-01-06T13:04:00.001-08:00

top -b -n1 -d 3 | sed 1,7d |head -1

ctrap script

2010-10-08T14:57:00.000-07:00

#!/bin/bash
ctrap(){
echo -ne "\033]0;"puppet"\007"
}
if [ $# -eq 1 ];then
trap ctrap SIGINT
echo -ne "\033]0;"$1"\007"
ssh $1
ctrap
exit 0
fi
ssh $*

mount ntfs in *bsd

2010-09-20T17:21:00.000-07:00

http://lordhendrix.wordpress.com/2008/01/13/mounting-ntfs-to-freebsd-or-unix/

symon/symux/syweb installation on openbsd 4.4

2010-07-30T10:16:00.000-07:00


mkdir /mnt/cdrom

mount /dev/cd0c /mnt/cdrom/

cd /

tar -zxvf /mnt/cdrom/4.4/i386/xbase44.tgz

ldconfig /usr/X11R6/lib /usr/local/lib

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/libart-2.3.20p0.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/png-1.2.28.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/rrdtool-1.2.23p0.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/wget-1.11.3.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/pcre-7.7p0.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/php5-fastcgi-5.2.6.tgz

pkg_add -v http://ftp.openbsd.org/pub/OpenBSD/4.4/packages/i386/php5-mbstring-5.2.6.tgz

echo "env -i PHP_FCGI_CHILDREN=5 PHP_FCGI_MAX_REQUESTS=1000 /usr/local/bin/php-fastcgi -q -c /var/www/conf/ -b 127.0.0.1:8888 &" > /root/run_php-fastcgi.sh && chmod 700 /root/run_php-fastcgi.sh

ln -s /var/www/conf/modules.sample/php5.conf /var/www/conf/modules

ln -fs /var/www/conf/php5.sample/mbstring.ini /var/www/conf/php5/mbstring.ini

mkdir /var/www/tmp



tar zxvf ./syweb-0.59.tar.gz 

tar zxvf ./symon-2.80.tar.gz 

cd symon

make && make install

cp ./symon/symon.conf /etc/symon.conf

cp ./symux/symux.conf /etc/symux.conf

cp ./symon/hifn_test.layout /var/www/symon/

useradd -d /var/empty -L daemon -c 'symon Account' -s /sbin/nologin _symon

/usr/local/libexec/symon

mkdir /var/www/symon /var/www/symon/rrds /var/www/symon/rrds/localhost

#fix up symux.conf here

./symux/c_smrrds.sh all





echo > /etc/symon.conf <#

# Demo configuration for symon. See symon(8) for BNF.

#



monitor { cpu(0),  mem,

          if(lo0),

          pf,

          mbuf,

#         sensor(0),

          proc(sshd),

          if(em0),

          io(wd0)

} stream to 127.0.0.1 2100

EOF





echo > /etc/symux.conf <#

mux 127.0.0.1 2100

     source 127.0.0.1 {

         accept { cpu(0), mem, pf,

               if(em0), 

               if(lo0), 

               io(wd0),

               df(sd0a) }



         datadir "/var/www/symon/rrds/localhost"

     }

EOF

regex for IP addresses

2010-06-17T14:34:00.000-07:00

ifconfig | sed -n ‘/^[A-Za-z0-9]/ {N;/dr:/{;s/.dr://;s/ .//;p;}}’

Storage Foundation / VRTS Licensing Info

2010-05-25T15:55:00.001-07:00

# vxlicrep > report.txt

convert vmdk from thick to thin

2010-05-18T13:43:00.000-07:00

vmkfstools -i /vmfs/volumes/datastore1/somehost/somehost.vmdk /vmfs/volumes/datastore1/somehost/somehost-thin.vmdk -d 'thin' -a lsilogic

# adjust vmx and away you go.

my fave prompt

2010-05-10T12:57:00.001-07:00

PS1='[\t][\u@\h:\w]$ '

backup your failing system hard drive and mount it under ubuntu

2010-04-24T17:24:00.000-07:00

i heard some clicking coming from the hard drive of my openbsd firewall the other day. i have put a lot of time into this thing and i dont want to lose it. I have more hard drives, but i dont want to lose everything on this one. this system run on an an old Dell b733r, PIII w/256MB RAM. I love it. Its Perfect.


#on failing host, do not skip this critical step
disklabel -v wd0c > failing_host_disklabel.info && scp ./failing_host_disklabel.info root@stable_host:.

#on stable host
nc -p 2222 -l | bzip2 -d | dd of=/root/failing_host.img

#on failing host
bzip2 -c /dev/wd0c | nc stable_host 2222

#wait for completion ...

#on stable host

#test to see if image is good
sfdisk -l failing_host.img
sfdisk -d failing_host.img
fdisk -l -u failing_host.img

#take offset from disklabel.info: offset * bytes/sector = [value]
#default value for dd block size (bytes/sector) is 512, adjust as necessary

mount -v -o ro,loop,offset=[value],ufstype=44bsd -t ufs ./failing_host.img /mnt/failing_host

#if it fails and you get a message in dmesg that says: 
#
#[some.date] ufs_read_super: bad magic number
#
# it means you have the wrong offset value

loop-aes-utils, smbfs and Ubuntu

2010-04-14T17:09:00.000-07:00

The following was experienced on Ubuntu Desktop 9.10

if you install loop-aes-utils, and then install smbfs, the cryptoloop.ko is removed from the kernel.

`mount` will give you errors like:

ioctl: LOOP_SET_STATUS: Invalid argument, requested cipher or key length (256 bits) not supported by kernel

`modprobe loop` will give you:

FATAL: Module loop not found

well, not sure what the whole story is, but the following fixes it.

`modprobe cryptoloop`

resolve IP's of established connections using pfctl

2010-04-05T23:46:00.000-07:00


pfctl -s state | grep 'EST' | grep -v '<-' | awk '{print $6}' | cut -d":" -f1 | xargs dig +short -x

Firefox Autoconfig

2010-03-31T23:59:00.003-07:00

http://mit.edu/~firefox/www/maintainers/autoconfig.html

Install nginx with php-frm and mysql

2010-03-29T07:54:00.000-07:00


#!/bin/sh

sudo apt-get install nginx
cd /tmp
wget http://us.archive.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb53_1.6.dfsg.4~beta1-5ubuntu2_i386.deb
wget http://us.archive.ubuntu.com/ubuntu/pool/main/i/icu/libicu38_3.8-6ubuntu0.2_i386.deb
sudo dpkg -i *.deb
sudo echo "deb http://php53.dotdeb.org stable all" >> /etc/apt/sources.list
sudo apt-get update
sudo apt-get install php5-cli php5-common php5-suhosin php5-mysql php5-curl php-pear php5-imap php5-memcache php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl
sudo apt-get install php5-fpm php5-cgi

echo > /etc/nginx/sites-enabled/default << EOF

server
{    
listen   80;    
server_name  localhost;    
access_log  /var/log/nginx/localhost.access.log; 

## Default location    
location /
{        
root   /var/www/nginx-default;        
index  index.php;    
} 

## Images and static content is treated different    
location ~* ^.+.(jpg|jpeg|gif|css|png|js|ico|xml)$
{      
access_log        off;      
expires           30d;      
root /var/www/nginx-default;    
} 

## Parse all .php file in the /var/www directory    
location ~ .php$
{        
fastcgi_split_path_info ^(.+\.php)(.*)$;        
fastcgi_pass   backend;        
fastcgi_index  index.php;        
fastcgi_param  SCRIPT_FILENAME  /var/www/nginx-default$fastcgi_script_name;        
include fastcgi_params;        
fastcgi_param  QUERY_STRING     $query_string;        
fastcgi_param  REQUEST_METHOD   $request_method;        
fastcgi_param  CONTENT_TYPE     $content_type;        
fastcgi_param  CONTENT_LENGTH   $content_length;        
fastcgi_intercept_errors        on;        
fastcgi_ignore_client_abort     off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout 180;
fastcgi_buffer_size 128k;        
fastcgi_buffers 4 256k;        
fastcgi_busy_buffers_size 256k;        
fastcgi_temp_file_write_size 256k;     } 

## Disable viewing .htaccess & .htpassword    
location ~ /\.ht { deny  all;     }
}
upstream backend {         server 127.0.0.1:9000; }
EOF
/etc/init.d/php5-fpm start
/etc/init.d/nginx start

generate reasonable passwords at the commmand line

2010-03-23T14:29:00.000-07:00


cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 12| head -n 4| grep -i '[!@#$%^&*()_+{}|:<>?=]'

generate strong random passwords at the command line

2010-03-23T14:26:00.000-07:00


cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 12| head -n 4| grep -i '[!@#$%^&*()_+{}|:<>?=]'

remove serverbeach backdoor

2010-03-23T11:51:00.000-07:00

when you lease a server from ServerBeach, they install a backdoor on your server. Here's how to remove it when you choose CentOS or similar redhat type system.

service sbadm stop
chkconfig --del sbadm
rm -f /etc/ssh/.sbadm_config
rm -f /usr/sbin/sbadm
rm -rf /usr/local/webmin-*
rm -f /etc/init.d/sbadm

perl modules

2010-03-22T17:41:00.001-07:00

http://www.cpan.org/modules/by-module/

linux boot disk fun

2010-03-03T02:58:00.000-08:00

note to self. never, ever, ever ...leave the custom linux boot disk you made, with the fancy all-in-one kickstart file, in the cd drive of your laptop and reboot.

do not allow it to persist in your cd drive, for even the most trivial length of time for which it is unnecessary...REMOVE IT.

make a bootable custom rhel install disk

2010-02-09T22:28:00.000-08:00

run from the root of where you have copied the RHEL disk to and your ks.cfg resides.

# mkisofs -o /root/x/rhel43_app.iso -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -R -J -V -T ./

grantaccess.sh

2010-02-02T15:49:00.000-08:00

#!/bin/sh

if [ $# -lt 4 ]; then
echo "syntax: $0 host user time 'reason'"
echo "e.g. grantaccess.sh '0am jan 10' 'reason why'"
exit 1
fi

ssh $1 usermod -U $2
ssh $1 chage -E -1 $2
echo "ssh $1 usermod -L $2 " | at $3
echo "ssh $1 skill -KILL -u $2" | at $3
echo `logname` granted $2 access on $1 till $3 - Reason Given:"$4" | mail -s "Access granted"

BlackBerry Bold "Caller ID" doesnt work

2010-01-19T18:50:00.000-08:00

ok, lets be clear...its not the ANI data that's messed up (aka Caller ID) but its the a security feature of the phone that's keeping the name of the contact resolving on the screen when the phone is locked (also not a default setting of the phone).....which in the case of losing your phone is a great thing. In the case of normal usage, its impractical. My phone locks rather quickly and has a message that helps the finder return it if I lose it.

This thread was difficult to find but outlines the situation. however, the steps given in the thread are a little different for the newest version from AT&T. By default, many of the features in 'Options | Security Options | Encryption' are turned off. I went in there and turned a bunch of stuff on....thinking "Hey, Cool! Security is so great...lets turn it on! Oh, wow...it doesnt work anymore. hmm."

To make the Contact Name show up when the phone is locked and ringing, be sure that the 'Include Contacts' for 'Encryption: Device Memory' is 'No'.

The Bold must do some housekeeping when it locks, memory wiping and so forth. The Contact list is potentially a list containing PII, and its probably a requirement somewhere to make sure that data is at rest when the device is idle. Just guessing here...

list APC properties

2010-01-14T09:55:00.000-08:00

php -i | grep apc

import dshield block list for pf

2010-01-14T01:45:00.000-08:00

/usr/local/bin/wget -q -O - http://feeds.dshield.org/block.txt | egrep -v '#|Start' | awk '{print $1 "/24"}' | sed -n '4,50p;50p' > /etc/pf.blocklist.dshield && pfctl -f /etc/pf.conf

make bootable usb with openbsd 4.6 installer

2010-01-07T17:12:00.000-08:00

# fdisk -iy sd0
# disklabel -E sd0
> d *
> a a
##make install partition 1G
> q
# newfs sd0a
# mkdir /mnt/usb
# cd /mnt/usb
# mount /dev/sd0a /mnt/usb
# ftp ftp.openbsd.org
user: anonymous
password: 123456
ftp> cd pub/OpenBSD/4.6/i386
ftp> mget *
mget INSTALL.i386? a
ftp> exit
# cp /boot /mnt/usb/boot
# /usr/mdec/installboot -v /mnt/usb/boot /usr/mdec/biosboot sd0c
# cp /mnt/usb/bsd /mnt/usb/bsd.old
# cp /mnt/usb/bsd.rd /mnt/usb/bsd
# cd /
# umount /mnt/usb
try it

see also: http://bsdanywhere.org/
see also: https://calomel.org/bootable_openbsd_cd.html

allow tftp under selinux

2009-12-06T13:47:00.000-08:00

For RHEL5:

# audit2allow -a -M mytftp
# semodule -i mytftp.pp
# service xinetd restart

add virtual hard disk to linux

2009-12-06T12:57:00.000-08:00

#in vmware workstation | vm settings
add virtual hard disk to vm

#in vm
fdisk /dev/sdb
n
[ENTER][ENTER]
w
mkfs -t ext3 /dev/sdb1
mkdir /newdir
mount -t ext3 /dev/sdb1 /newdir
echo "/dev/sdb1 /software ext3 defaults 1 1" >> /etc/fstab

See: http://www.matttopper.com/?p=25

remount /

2009-12-06T12:56:00.000-08:00

mount -n -o remount /

tw_cli: 3ware controller commands

2009-12-02T11:58:00.000-08:00

when replacing a failed disk, you must issue a 'maint deleteunit command', as the 'maint remove' command doesnt do what you might think it does. so, pull the drive, insert the new one, issue a rescan commmand, then deleteunit, then rebuild.

the following commands were used to start rebuiding the raid-1 array on a server with a single 8006 controller.

show ver
info
info c0
rescan
info c0
maint deleteunit c0 u1
maint rebuild c0 u0 p1

list pecl modules and info

2009-11-20T09:26:00.000-08:00

You might have to:
`ln -s /usr/local/apache2/bin/apxs /usr/local/bin/apxs`

Then:
`/usr/local/apache2/php/bin/pecl list`
`/usr/local/apache2/php/bin/pecl install apc`
`vi /usr/local/apache2/php/conf/php.ini`
- add 'extension=apc.so'
`/usr/local/apache2/bin/apachectl_admin restart`

list kernel modules

2009-11-19T10:51:00.000-08:00

# modinfo $(cut -d' ' -f1 /proc/modules) | sed '/^dep/s/$/\n/; /^file\|^desc\|^dep/!d'

host firewall for the mac

2009-11-11T10:03:00.000-08:00

#!/bin/sh
#fwrules

IPFW='/sbin/ipfw -q'

$IPFW -f flush
$IPFW add 2000 allow ip from any to any via lo*
$IPFW add 2010 deny log ip from 127.0.0.0/8 to any in
$IPFW add 2020 deny log ip from any to 127.0.0.0/8 in
$IPFW add 2030 deny log ip from 224.0.0.0/3 to any in
$IPFW add 2040 deny log tcp from any to 224.0.0.0/3 in
$IPFW add 2050 allow log tcp from any to any out
$IPFW add 2060 allow tcp from any to any established
$IPFW add 12190 deny log tcp from any to any

Then apply it to the firewall

# sudo ipfw list
# chmod 600 ./rules
# sudo ipfw ./rules

pecl install apc

2009-11-10T11:22:00.003-08:00

make sure that the apxs directory is in the system path.

resize a mounted lvm-managed disk in linux

2009-10-07T11:36:00.000-07:00

I have found many overly-complex and incorrect and/or unnecessary instructions all over the web. So, I made this reference for me, but it may work well for you too. I typically use RHEL4/5 in my data center implementations, so these steps cover lvm managed disk space (which is decent for a simple LAMP stack).

I tend to do the following a lot in vmware products (workstation/esx/esxi).

First, check and note the size of your disks and partitions in your target vm.


[root@host]# df -h

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                      5.8G  665M  4.9G  12% /
/dev/sda1              99M  9.1M   85M  10% /boot
none                  506M     0  506M   0% /dev/shm

[root@host]# sfdisk -s
/dev/sda:   8385898
/dev/sda1:    104391
/dev/sda2:   8281507
/dev/dm-0:   6160384
/dev/dm-1:   2031616

Then, go into the settings of your vm (e.g. through the vi client) and either add another virtual hard disk or increase the size of the existing disk. In my case i simply extended the existing virtual disk from 8G to 16G.

Reboot.

Check to see that the size of /dev/sda has increased.


[root@host]# sfdisk -s
/dev/sda:  16777216
/dev/sda1:    104391
/dev/sda2:   8281507
/dev/dm-0:   6160384
/dev/dm-1:   2031616

[root@host]# sfdisk -l

Disk /dev/sda: 2088 cylinders, 255 heads, 63 sectors/track
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1   *      0+     12      13-    104391   83  Linux
/dev/sda2         13    1043    1031    8281507+  8e  Linux LVM
/dev/sda3          0       -       0          0    0  Empty
/dev/sda4          0       -       0          0    0  Empty

/* If you increased the size of your existing disk, its probably easiest to boot from the gparted-live disk and create a new primary partition in the newly free space, format ext3. */
wget http://downloads.sourceforge.net/project/gparted/gparted-live-stable/0.4.6-1/gparted-live-0.4.6-1.iso?use_mirror=softlayer

reboot

/* check for /dev/sda3, your new parition */


[root@host]# sfdisk -s
/dev/sda:  16777216
/dev/sda1:    104391
/dev/sda2:   8281507
/dev/sda3:   8385930
/dev/dm-0:   6160384
/dev/dm-1:   2031616

/* create the lvm pv reference */


[root@host]# pvcreate /dev/sda3

/* extend the lvm vg reference */


[root@host]# vgextend VolGroup00 /dev/sda3

/* note the free space for your upcoming `lvextend` command */


[root@host]# vgdisplay

  --- Volume group ---
  VG Name               VolGroup00
  System ID             
  Format                lvm2
  Metadata Areas        2
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               2
  Max PV                0
  Cur PV                2
  Act PV                2
  VG Size               15.84 GB
  PE Size               32.00 MB
  Total PE              507
  Alloc PE / Size       250 / 7.81 GB
  Free  PE / Size       257 / 8.03 GB
  VG UUID               L7woQB-ymCv-NeWL-i47M-b5Ua-fOHQ-hM0DXI

/* extend the lvm vg reference */


[root@host]# lvextend -L+8.03G /dev/VolGroup00/LogVol00

/* resize the volume group while its still mounted */


[root@host]# ext2online /dev/VolGroup00/LogVol00

check the following


[root@host]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                       14G  668M   13G   6% /
/dev/sda1              99M  9.1M   85M  10% /boot
none                  506M     0  506M   0% /dev/shm

[root@host]# sfdisk -l

Disk /dev/sda: 2088 cylinders, 255 heads, 63 sectors/track
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1   *      0+     12      13-    104391   83  Linux
/dev/sda2         13    1043    1031    8281507+  8e  Linux LVM
/dev/sda3       1044    2087    1044    8385930   83  Linux
/dev/sda4          0       -       0          0    0  Empty

now, go on with your life.

compare directory trees

2009-08-19T10:26:00.000-07:00

ssh server1 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server1.txt; ssh server2 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server2; comm -3 ./server1 ./server2

slowloris ddos aversion

2009-08-14T16:11:00.000-07:00

use Nginx and openBSD/pf to protect Apache.
http://nginx.net/

here's some configuration help.
https://calomel.org/nginx.html

rpm packages by name only

2009-08-13T14:18:00.000-07:00

rpm -qa --qf "%{NAME}\n" > hostname.rpm.txt

then you can compare to see what is missing.

comm -3 host1.rpm.txt host2.rpm.txt

Slowloris DDOS prevention

2009-08-11T17:13:00.000-07:00

#!/bin/sh

LIMIT=100

COMMAND='netstat -n | egrep '\''tcp.*[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*:(80|443)[ ]*[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*:[0-9]*[ ]*ESTABLISHED
'\'' | awk -F'\''[ \t:]+'\'' '\''{ print $6 }'\'''

eval $COMMAND | sort | uniq -c | while read numconn ip
do
if [ $numconn -gt $LIMIT ]
then
echo "Check ASAP and renable this cron." | mail -s "IP $ip - ($numconn) went over $LIMIT connections on `hostname`" me@someemailaddress.com

sed -i 's/$^\*.*this_script.sh*$/#\1/g' /etc/crontab
# /sbin/iptables -I INPUT -s $ip -j DROP
fi
done

ESXi 4.0 not booting off DVD ISO or Host CD/DVD Device with DVD's

2009-07-22T14:42:00.000-07:00

I had some problems with booting off DVD iso's on nfs shares and DVD's in the Host system CD/DVD reader (which, incidentally is a SATA device, also problematic with ESXi according to some forums I've read). But I was able to get it to boot off the DVD media by burning the DVD iso to a physical disk and placing the disk in my client system DVD reader. Then, I set the boot options to delay by 5000ms, set the boot order in the VM's bios as removable,network,cdrom,hard drive, and then i started the vm. while it was sitting there trying to boot off the network, i used the little CD button above the vm console window to connect my local DVD drive to the vm through the VI4 client. This worked, it was slow but it worked and I was so happy!

List installed perl modules

2009-07-09T11:18:00.001-07:00

perl -MCPAN -e 'print CPAN::Shell->r '

convert unix time to local time

2009-06-15T08:32:00.000-07:00

date -R -d @1245049200

-R requests that date output in RFC 2822 format
-d requests that date output the date based on a string that follows

Set up SNMP v3 on Cisco IOS

2009-06-08T18:16:00.000-07:00

conf t
snmp-server group group_name v3 priv
snmp-server group group_name v3 priv read secure_ro write secure_rw access 5
snmp-server view secure_ro internet included
snmp-server view secure_rw mgmt included
snmp-server user snmp_user iksecure v3 auth md5 auth_password priv des56 priv_password

access-list 5 permit host x.x.x.x
access-list 5 deny any log

show snmp group
show snmp user

Create a CA and a Signed Cert

2009-05-13T10:20:00.001-07:00

To make certificate authority:

mkdir CA
cd CA
mkdir certs crl newcerts private
echo "01" > serial
cp /dev/null index.txt
cp /usr/local/openssl/openssl.cnf.sample openssl.cnf
vi openssl.cnf   (set values)
openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf

To make a new certificate:

cd CA        (same directory created above)
openssl req -nodes -new -x509 -keyout newreq.pem -out newreq.pem -days 365 -config openssl.cnf

(certificate and private key in file newreq.pem) To sign new certificate with certificate authority:

cd CA        (same directory created above)
openssl x509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
openssl ca -config openssl.cnf -policy policy_anything -out newcert.pem -infiles tmp.pem
rm -f tmp.pem

(newcert.pem contains signed certificate, newreq.pem still contains unsigned certificate and private key)

Installing sshfs on RHEL5

2009-05-12T17:36:00.000-07:00

installing sshfs on rhel5
yum install kernel-devel gcc
wget http://downloads.sourceforge.net/fuse/fuse-2.7.4.tar.gz
tar xvf fuse-2.7.4.tar.gz
cd fuse-2.7.4
./configure
make
make install
modprobe fuse
echo "modprobe fuse" > /etc/sysconfig/modules/fuse.modules
ls -la
wget http://dag.wieers.com/rpm/packages/fuse-sshfs/fuse-sshfs-1.9-1.el5.rf.i386.rpm
wget http://dag.wieers.com/rpm/packages/fuse/fuse-2.7.3-1.el5.rf.i386.rpm
rpm -Uvh ./fuse-2.7.3-1.el5.rf.i386.rpm
rpm -Uvh ./fuse-sshfs-1.9-1.el5.rf.i386.rpm

Remove nameserver references from resolv.conf

2009-05-12T14:27:00.000-07:00

sed -i 'N;$!P;$!D;$d' /etc/resolv.conf

Howto Shrink a VM

2009-05-12T10:53:00.000-07:00

First, run a script similar to the following, one for each significant mountpoint as defined in /etc/fstab

#!/bin/sh

cd /
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /tmp
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /home
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /var
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /usr
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill

# Delete this script

rm -rf /usr/local/jboss/server/default/log/*
cd /root/tools
rm -rf shrink.sh

Then shutdown the vm and close vmware workstation.
Run the following command at the Windows Command Interpreter.

vmware-vdiskmanager -k <path to vmdk>

chroot tor in openBSD

2009-04-14T23:10:00.000-07:00

https://wiki.torproject.org/noreply/TheOnionRouter/OpenbsdChrootedTor

config check

2009-04-14T22:18:00.000-07:00

#!/bin/sh
#written and tested on openbsd 4.4
#pf.master contains the last known good sha1 of pf.conf

MASTER=`cat ./pf.master`
DGST=`ssh fwmon@192.168.43.132 'sudo sha1 /etc/pf.conf | cut -d" " -f 4'`

#echo $DGST
#echo $MASTER

if [[ "${MASTER}X" == "${DGST}X" ]] ; then

#notify that unscheduled config has changed
#insert incident details into security db
echo "fw Config Secure"

else

#insert incident details into security db
echo "fw Config Breached"

fi

sed && awk one-liners

2009-04-14T09:17:00.000-07:00

These guides are great. Thanks to all who compiled them.

Famous sed one-liners Explained, Part I
Famous sed one-liners Explained, Part II
Famous sed one-liners Explained, Part III

Famous awk one-liners Explained, Part I
Famous awk one-liners Explained, Part II
Famous awk one-liners Explained, Part III

Convert Windows CR/LF to Unix newlines

2009-04-08T23:25:00.000-07:00

sed 's/.$//'

sed 's/^M$//'

Delete lines from a file by line number with sed

2009-04-08T21:34:00.000-07:00

Today i decided to make a new monitoring tool, and I needed to make a list of all permutations of 3 in a set of 22. The set happens to be hostnames of a private Tor network. Order is important, as forming 3-hop circuits through Tor is sequential, which is why i need permutations instead of combination's.

22 * 21 * 20 = 9240 permutations

Crap, I'm not really up on my combinatorial number theory, I guess I'll have to hack it up.

First I used an excel plugin to generate all the permutations.

But this ended up giving me 1408 invalid permutations, because the mix of sets had 10647 results. I copied the results into a text file and counted the number of lines as well as obtained the line numbers of the invalid permutations using this script:
----------
#!/bin/sh

tornames=("tornode01" "tornode02" "tornode03" "tornode04" "tornode05" \
"tornode06" "tornode07" "tornode08" "tornode09" "tornode10" \
"tornode11" "tornode12" "tornode13" "tornode14" "tornode15" \
"tornode16" "tornode17" "tornode18" "tornode19" "tornode20" \
"tornode21" "tornode22")

for i in ${tornames[*]};
do
while read line; do echo $line|tr " " "\n"|grep $i |wc -l; done < ./vc_list.bak > ./lines.$i
grep -rn '3\|2' ./lines.$i | cut -d: -f1 > ./lines.$i.ln
done
----------

It saved a bunch of files for me as: lines.[hostname], containing a number on each line indicating the number of times the hostname appears on each line.
Then it grep'd out the lines with a 2 or a 3, asking grep to return the line number, and cut the line number from the output to a file named: lines.[hostname].ln

Then at the command line I did this:

# cat ./lines.*.ln > line.numbers.all
# sed 's/.*/&d/g' ./line.numbers.all > ./delete.sed
# sed -f delete.sed ./file.master >> file.trimmed

Using a sed delete file...finally I had my 9240 valid permutations:

# cat ./file.trimmed | wc
9240 27720 254520

Next I want to make this text list into an array that I can `source` into the monitoring script as an array.

# rsync ./file.trimmed ./perms_array.sh
sed -i -e 's/^\./perms_array.sh

Almost done, I just need to fill in the array number with another sed expression.

# sed = ./perms_array.sh | sed 'N; s/^// ; s/\nperms\[// ; s/^/perms\[/' > \
./perms_array.final.sh

and now to put quotes around the array value:

# sed -e 's/\=/\=\"/' < ./perms_array.final > ./perms_array.final.new && rsync ./perms_array.final.tmp ./perms_array.final
# sed -e 's/$/\"/' < ./perms_array.final > ./perms_array.final.new && rsync ./perms_array.final.tmp ./perms_array.final

here's what the file looks like:

perms[1]="tornode01 tornode02 tornode03"
perms[2]="tornode01 tornode04 tornode05"
perms[3]="tornode01 tornode06 tornode07"
...

Now I can move on to write an essentially simple script that performs the test of all possible virtual circuits.

oops

2009-03-31T11:14:00.000-07:00

Today I was trying to move a file into the home directory of the current user, like this:

# mv /home/otheruser/somefile ~

Interestingly enough, after doing this for the last 15 years, I fat-fingered it like this:

# mv /home/otheruser/somefile !

CRAP!
Guess what, my file was deleted.
Btw, Mac OSX doesnt behave like this. I assume *BSD, Solaris and other high-quality systems dont as well. Pooor Linux.

SNMPv3 Quickstart

2009-03-20T09:50:00.000-07:00

i DONT claim this to be complete or authoritative. But, with these quick steps i was able to get snmpv3 working, a generally avoided version of a widely used protocol, and a fog to many sysadmins i've worked with. I'm sick of reading 10 pages of prose to get the steps i need to move securely forward in my projects.

0) yum install net-snmp.i386 net-snmp-libs.i386

1) Run snmpconf -i to create snmpd.conf and snmp.conf
- sudo /usr/bin/snmpconf -i

Notes:
- if you're regenerating the files at some point, cd into /etc/snmp, then run `snmpconf -i`. snmpconf looks in the local dir for files first before looking elsewhere. The resultant files are still saved to /usr/local/share/snmp/
- when creating snmp.conf, complete section 3: 2-10
- when creating snmpd.conf, complete section 4: 1-3
- when creating a new user while configuring snmpd.conf, choose 'priv' for the minimum security level. you can also restrict the user to a specific branch of the OID tree here as well.

2) Copy these files to /etc/snmp

rsync -av /usr/local/share/snmp/snmp.conf /etc/snmp/
rsync -av /usr/local/share/snmp/snmpd.conf /etc/snmp/

3) Run net-snmp-config to actually create snmpv3 user, here is the correct syntax...

net-snmp-config --create-snmpv3-user [-ro] [-A authpass] [-X privpass] [-a MD5|SHA] [-x DES|AES] [username]

Here's my command that corresponds to my previous configuration of snmp.conf and the test snmpget command further below in step 5:

net-snmp-config --create-snmpv3-user -ro -A authpass -X privpass -a SHA -x AES rouser

Note: the manpage for net-snmp-config has the X and x incorrectly in their example of create-snmpv3-user. The help cruft (for net-snmp-config --help) shows it correctly. I tried to create a read-write user (with -rw), but it didnt work. I dont change system parameters through snmp anyways, so it doesnt matter to me. Maybe the absence of [-ro] creates a read-write user? seems like ro should be the default unless -rw is specified. ???

4) Restart snmpd service

5) Make test snmpv3 request

snmpget -v 3 -n "" -u rouser -a SHA -A "authpass" -x AES -X "privpass" -l authPriv localhost system.sysUpTime.0

Notes:
- The `-l authPriv` argument specifies that the request should be both signed (-a SHA) and encrypted (-x AES).
- The command above can be greatly simplfied because most of these options have been declared in the snmp.conf.

install a perl module

2009-03-19T11:49:00.000-07:00

perl -MCPAN -e 'install Net::SNMP'

or

perl -MCPAN -w -e 'shell'

CPAN> install Net::SNMP

Deployment Tools: Puppet

2009-03-12T19:21:00.000-07:00

I've started looking at Puppet as the next gen tool for system deployments. Check it out.

http://reductivelabs.com/trac/puppet/wiki/DocumentationStart

It leaves cfengine and others in the dust...

List all Perl Modules

2009-03-11T15:38:00.001-07:00

perl -MFile::Find=find -MFile::Spec::Functions -Tlwe "find { wanted => sub { print canonpath $_ if /\.pm\z/ }, no_chdir => 1 }, @INC"

Passmark Health Check

2009-02-23T17:11:00.000-08:00


curl https://localhost:443/pmws_server/healthCheck -k

Running VMware ACE Player as a Windows Service

2009-02-20T18:30:00.000-08:00

First, read this. I wasnt able to use the resource kit tools because Macrosh@ft wont allow you to redistribute their tools. So, we instead bought a tool that offered an OEM license. If you dont know what ACE is, its vmware's option pack for VMware Workstation. Its basically a bunch of security features and packaging options, meaning, you can build vm and then package it up and install it on another system. I wanted to use it because I wanted to make sure the server could not be copied and run somewhere else by anyone except the people I choose and authorize.

One of the features in an ACE policy is that allows you to run a script or executable instead of enter a password when the vm is started. The VMware ACE Player, interestingly enough, will accept a string from STDOUT of this script or exe in order to attempt the decryption of the encrytion key thats used to read the vmdk files as the vm runs. Using FireDaemon and the FireDaemon features of Pre-Post Service commands, I was able to use vmrun.exe stop command to shut down the vm when the host system is rebooted. I also made lanmanworkstation a service that the Firedaemon service depends on. This way, the vm is not started until the network is full up on the host system...other people have mentioned using this technique and it seemed like a good one.

The executeable, written in VC++ STL, accepts two args, a meaningful 9 digit number and a secret. If either of these args fail a number of tests performed on them, the exe quietly exits. If the args pass, a SHA512 hash (using openssl) is performed and a 64 character string is printed out to STDOUT. Its this string that the vmplayer.exe uses to encrypt/decrypt the AES keys that encrypt/decrypt the vmdk's when the vm starts.

These files, the exe and the openssl libs (dll's) and the VC manifest and their dll's and any other script and stuff you want to use in the Firedaemon service configuration, reside in the "ACE Resources" directory, under the parent directory of the vm Master.

Also, i got snagged by this: each time a package is built, the packager drops an ace.sig file into the "ACE Resources" directory of the package it generates. Make sure this ace.sig file doesnt get copied back into the Master "ACE Resources" directory. If it does, all the packages that you make will have this invalid file in there. Its easy to get into this situation when you delete the files in that directory in order to make a test package that may be updated with a policy update package, which would contain the authentication module and scripts. VMware should fix this by checking for this file and deleting it from within the Master's dir structure each time the packager runs, but it doesn't at this time. Anyhow, there is a policy option called Resource Signing that does check this file, and if its set to check it, which it is by default, the activation of the package (or policy update) will fail.

There was one more terribly annoying thing with setting up the service. When I attempted to shutdown or reboot the host system (unforced), the vmplayer.exe would abort the shutdown/reboot operation and display a modal dialog box that says "virtual machine is in use." I got around this by using AutoIT, a freeware application that allows you to create a simple script to operate windows and applications. So far its been a breeze and a very sensible and intuitive scripting language. Good docs help a lot too. Anyhow, this script ran as a Firedaemon pre-service and sits there waiting for that stupid dialog box to activate. It checks for this window every 250ms. Then, when the shutdown sequence starts, it gets rid of the dialog box and reboots the host system. Pretty slick.

Its too bad vmware says they wont support ACE vm's anytime soon on ESX or VMware Server. It would be pretty simple to get this working and I think that vm volumes that remain encrypted on-disk at all times solves a very difficult security challenge in operating system virtualization. no longer can someone make a copy of your entire filesystem and mount it somewhere else.

How to view pflog

2009-02-04T22:14:00.000-08:00

Viewing the pflog file:
# tcpdump -n -e -ttt -r /var/log/pflog

A real-time display of logged packets:
# tcpdump -n -e -ttt -i pflog0

Install a package manager in MacOSX (Darwin Ports) and install GnuPG port

2009-01-27T09:13:00.000-08:00

First, get the package manager:

$ wget http://www.portcode.com/darwinports/DarwinPorts-1.5.0-10.4.dmg
or
$ curl http://www.portcode.com/darwinports/DarwinPorts-1.5.0-10.4.dmg -O

Mount dmg image and install, then open a Terminal window:

$ sudo port -d selfupdate
$ cd /opt/local/var/macports/

$ port search gnupg
$ sudo port install gnupg
Password:
$ gpg --gen-key

conf file is: ~/.gnupg*, add keyservers, change your default fingerprint, and other stuff there.

Deep Water Swell for Northern California

2009-01-05T23:26:00.000-08:00

http://cdip.ucsd.edu/?nav=recent⊂=nowcast&units=metric&tz=UTC&pub=public&xitem=sf

Geologic Overlays of Northern California for Google Earth

2009-01-05T12:19:00.000-08:00

http://geomaps.wr.usgs.gov/sfgeo/geologic/downloads.html

Squid Fact Sheet

2009-01-05T09:20:00.000-08:00

http://www.tonmo.com/science/public/giantsquidfacts.php

Change runlevel Settings for a Group of Services

2008-12-16T08:12:00.000-08:00

The following command changes all services set to run at runlevel 5 and sets them to off.

chkconfig --list | grep 5:on | awk '{ print $1 }' | \
 while read LINE; do chkconfig --level 12345 $LINE off; done

Network Access Control

2008-12-14T13:32:00.000-08:00

Enterasys has a mature and unmatched product offering, today.

http://www.enterasys.com/products/index.aspx

Fact Sheet NSA Suite B Cryptography [08dec2008]

2008-12-14T13:05:00.000-08:00

Key length recommendations from the NSA for companies making products for Gov't use.

http://www.keylength.com/en/6/

Apache Worker vs. Prefork

2008-12-05T13:22:00.000-08:00

This is a good post.

http://www.camelrichard.org/apache-prefork-vs-worker

Good Hints:
Worker is superior in 2+ cpu applications
Compile PHP5 after installing Apache

Restoring Hard Links to Protected Files in Linux

2008-12-04T11:43:00.000-08:00

I got this syslog message today:

Dec 4 9:47:56 [hostname] restorecond: Will not restore a file with more than one hard link (/etc/resolv.conf) Invalid argument

Here is how I resolved it:

$ sudo ls -i /etc/resolv.conf # find innode
[inode number] /etc/resolv.conf

$ sudo find /etc -inum [inode number] # find hard links
$ /usr/sbin/lsof | grep resolv.conf # check if file is open
$ mv /etc/sysconfig/networking/profiles/default/resolv.conf ~ # move
$ sudo restorecon /etc/resolv.conf # set selinux defaults
$ sudo ln /etc/resolv.conf /etc/sysconfig/networking/profiles/default/resolv.conf #recreate hard link

DDOS Incident Cheat Sheet

2008-12-03T11:40:00.000-08:00

This is very well put together:

http://www.zeltser.com/network-os-security/ddos-incident-cheat-sheet.pdf

Using SSH Remote and Local Tunnels

2008-12-02T15:25:00.000-08:00

The following example demonstrates how to use Remote and Local SSH tunneling to access a service on your highly secure home computer (that's not exposed explicitly through a firewall at your home) from a remote location.

For example:

On Home Computer, before traveling:
ssh -R 44444:localhost:22 user@remote.computer.ip.address

On Remote Computer, after arriving at work:
ssh -L 22222:localhost:44444 user@remote.computer.ip.address (possibly rfc1918 ip)
ssh user@localhost -p22222

Wa la, you now have a SSH session to your home computer from work.

LHC VR Coolness

2008-11-23T19:21:00.000-08:00

http://www.petermccready.com/portfolio/07041601.html

SSH Remote Command Execution

2008-11-19T08:27:00.000-08:00

The following example allows you to execute a command on a remote system and return the results of the command without a shell session.

Simply include the command immediately after the normal ssh session request. Here's an easy one for a periodic secure rule integrity check on openBSD using pf.

ssh someuser@ip.add.re.ss 'pfctl -s rules | openssl sha1'

How to set up Apache, MySQL and PHP on FreeBSD

2008-11-17T08:44:00.000-08:00


# cd /usr/ports/www/apache13-modssl
# make install
# echo 'apache_enable ="YES"' >> /etc/rc.conf
# echo 'apache_flags ="-DSSL"' >> /etc/rc.conf
# echo 'mysql_enable ="YES"' >> /etc/rc.conf
# /usr/local/etc/rc.d/mysql-server start
# mysqladmin -u root password newpassword
# cd /usr/ports/www/mod_php4
# make install clean
# cd /usr/ports/lang/php4-extensions
# make install clean
# vi /usr/local/etc/apache/httpd.conf
AddType application/x- httpd-php . php
AddType application/x- httpd-php-source . phps
# /usr/local/etc/rc.d/apache.sh start


# whoami
root
# cd ~
# openssl genrsa -des3 -out server.key 1024
# openssl req -new -key server.key -out server.csr 
# openssl x509 -req -days 365 \
     -in /root/server.csr \
     -signkey /root/server.key \
     -out /root/server.crt
# cp ~/ ./server.key /usr/local/etc/apache/ssl.key/
# cp ~/ ./server.crt /usr/local/etc/apache/ssl.crt/

random sub rosa

Set up bind (caching-nameserver) on OpenBSD 4.9

ruby installation with rvm on Ubuntu 10.04.3 LTS

HTTP Range Header Info

how to securely wipe a drive in linux

clear postfix mail queue

Comparison of Disk Encryption Software

delete a range of lines from your history

Nagios - ERROR opening session: An empty privacy password was specified.

automatically bring up the openvpn client

clearing a mail queue

mrepo

SMTP Codes

compare packages between two RHEL systems

clearing a mail queue

GPG key error when updating RHEL 5.x system

mdadm notes

ethtool command

mail alert when script is finished

logrotate script

create a list of all packages

oracle linux links

sending logs to splunk

top 10 memory hogs

unable to build ports in OpenBSD 4.8 - SOLVED

reinstall openbsd ports

unix time coolness

how many InnoDB rows are read per second in mysql

how to help out heartbeat

quick check of top current process

ctrap script

mount ntfs in *bsd

symon/symux/syweb installation on openbsd 4.4

regex for IP addresses

ifconfig | sed -n ‘/^[A-Za-z0-9]/ {N;/dr:/{;s/.*dr://;s/ .*//;p;}}’

Storage Foundation / VRTS Licensing Info

convert vmdk from thick to thin

my fave prompt

backup your failing system hard drive and mount it under ubuntu

loop-aes-utils, smbfs and Ubuntu

resolve IP's of established connections using pfctl

Firefox Autoconfig

Install nginx with php-frm and mysql

generate reasonable passwords at the commmand line

generate strong random passwords at the command line

remove serverbeach backdoor

perl modules

linux boot disk fun

make a bootable custom rhel install disk

grantaccess.sh

BlackBerry Bold "Caller ID" doesnt work

list APC properties

import dshield block list for pf

make bootable usb with openbsd 4.6 installer

allow tftp under selinux

add virtual hard disk to linux

remount /

tw_cli: 3ware controller commands

list pecl modules and info

list kernel modules

host firewall for the mac

pecl install apc

resize a mounted lvm-managed disk in linux

compare directory trees

slowloris ddos aversion

rpm packages by name only

Slowloris DDOS prevention

ESXi 4.0 not booting off DVD ISO or Host CD/DVD Device with DVD's

List installed perl modules

convert unix time to local time

Set up SNMP v3 on Cisco IOS

Create a CA and a Signed Cert

Installing sshfs on RHEL5

Remove nameserver references from resolv.conf

Howto Shrink a VM

chroot tor in openBSD

config check

sed && awk one-liners

Convert Windows CR/LF to Unix newlines

Delete lines from a file by line number with sed

ifconfig | sed -n ‘/^[A-Za-z0-9]/ {N;/dr:/{;s/.dr://;s/ .//;p;}}’