Deployment Tools: Puppet

I've started looking at Puppet as the next gen tool for system deployments. Check it out.

http://reductivelabs.com/trac/puppet/wiki/DocumentationStart

It leaves cfengine and others in the dust...

List all Perl Modules

perl -MFile::Find=find -MFile::Spec::Functions -Tlwe "find { wanted => sub { print canonpath $_ if /\.pm\z/ }, no_chdir => 1 }, @INC"

Passmark Health Check

curl https://localhost:443/pmws_server/healthCheck -k

Running VMware ACE Player as a Windows Service

First, read this. I wasnt able to use the resource kit tools because Macrosh@ft wont allow you to redistribute their tools. So, we instead bought a tool that offered an OEM license. If you dont know what ACE is, its vmware's option pack for VMware Workstation. Its basically a bunch of security features and packaging options, meaning, you can build vm and then package it up and install it on another system. I wanted to use it because I wanted to make sure the server could not be copied and run somewhere else by anyone except the people I choose and authorize.

One of the features in an ACE policy is that allows you to run a script or executable instead of enter a password when the vm is started. The VMware ACE Player, interestingly enough, will accept a string from STDOUT of this script or exe in order to attempt the decryption of the encrytion key thats used to read the vmdk files as the vm runs. Using FireDaemon and the FireDaemon features of Pre-Post Service commands, I was able to use vmrun.exe stop command to shut down the vm when the host system is rebooted. I also made lanmanworkstation a service that the Firedaemon service depends on. This way, the vm is not started until the network is full up on the host system...other people have mentioned using this technique and it seemed like a good one.

The executeable, written in VC++ STL, accepts two args, a meaningful 9 digit number and a secret. If either of these args fail a number of tests performed on them, the exe quietly exits. If the args pass, a SHA512 hash (using openssl) is performed and a 64 character string is printed out to STDOUT. Its this string that the vmplayer.exe uses to encrypt/decrypt the AES keys that encrypt/decrypt the vmdk's when the vm starts.

These files, the exe and the openssl libs (dll's) and the VC manifest and their dll's and any other script and stuff you want to use in the Firedaemon service configuration, reside in the "ACE Resources" directory, under the parent directory of the vm Master.

Also, i got snagged by this: each time a package is built, the packager drops an ace.sig file into the "ACE Resources" directory of the package it generates. Make sure this ace.sig file doesnt get copied back into the Master "ACE Resources" directory. If it does, all the packages that you make will have this invalid file in there. Its easy to get into this situation when you delete the files in that directory in order to make a test package that may be updated with a policy update package, which would contain the authentication module and scripts. VMware should fix this by checking for this file and deleting it from within the Master's dir structure each time the packager runs, but it doesn't at this time. Anyhow, there is a policy option called Resource Signing that does check this file, and if its set to check it, which it is by default, the activation of the package (or policy update) will fail.

There was one more terribly annoying thing with setting up the service. When I attempted to shutdown or reboot the host system (unforced), the vmplayer.exe would abort the shutdown/reboot operation and display a modal dialog box that says "virtual machine is in use." I got around this by using AutoIT, a freeware application that allows you to create a simple script to operate windows and applications. So far its been a breeze and a very sensible and intuitive scripting language. Good docs help a lot too. Anyhow, this script ran as a Firedaemon pre-service and sits there waiting for that stupid dialog box to activate. It checks for this window every 250ms. Then, when the shutdown sequence starts, it gets rid of the dialog box and reboots the host system. Pretty slick.

Its too bad vmware says they wont support ACE vm's anytime soon on ESX or VMware Server. It would be pretty simple to get this working and I think that vm volumes that remain encrypted on-disk at all times solves a very difficult security challenge in operating system virtualization. no longer can someone make a copy of your entire filesystem and mount it somewhere else.

How to view pflog

Viewing the pflog file:
# tcpdump -n -e -ttt -r /var/log/pflog

A real-time display of logged packets:
# tcpdump -n -e -ttt -i pflog0

 

Install a package manager in MacOSX (Darwin Ports) and install GnuPG port

First, get the package manager:

$ wget http://www.portcode.com/darwinports/DarwinPorts-1.5.0-10.4.dmg
or
$ curl http://www.portcode.com/darwinports/DarwinPorts-1.5.0-10.4.dmg -O

Mount dmg image and install, then open a Terminal window:

$ sudo port -d selfupdate
$ cd /opt/local/var/macports/

$ port search gnupg
$ sudo port install gnupg
Password:
$ gpg --gen-key

conf file is: ~/.gnupg*, add keyservers, change your default fingerprint, and other stuff there.

Deep Water Swell for Northern California

http://cdip.ucsd.edu/?nav=recent⊂=nowcast&units=metric&tz=UTC&pub=public&xitem=sf

Geologic Overlays of Northern California for Google Earth

http://geomaps.wr.usgs.gov/sfgeo/geologic/downloads.html

Squid Fact Sheet

http://www.tonmo.com/science/public/giantsquidfacts.php

Change runlevel Settings for a Group of Services

The following command changes all services set to run at runlevel 5 and sets them to off.

chkconfig --list | grep 5:on | awk '{ print $1 }' | \
 while read LINE; do chkconfig --level 12345 $LINE off; done

Network Access Control

Enterasys has a mature and unmatched product offering, today.

http://www.enterasys.com/products/index.aspx

 

Fact Sheet NSA Suite B Cryptography [08dec2008]

Key length recommendations from the NSA for companies making products for Gov't use.

http://www.keylength.com/en/6/

 

Apache Worker vs. Prefork

This is a good post.

http://www.camelrichard.org/apache-prefork-vs-worker

Good Hints:
Worker is superior in 2+ cpu applications
Compile PHP5 after installing Apache

Restoring Hard Links to Protected Files in Linux

I got this syslog message today:

Dec 4 9:47:56 [hostname] restorecond: Will not restore a file with more than one hard link (/etc/resolv.conf) Invalid argument

Here is how I resolved it:

$ sudo ls -i /etc/resolv.conf # find innode
[inode number] /etc/resolv.conf

$ sudo find /etc -inum [inode number] # find hard links
$ /usr/sbin/lsof | grep resolv.conf # check if file is open
$ mv /etc/sysconfig/networking/profiles/default/resolv.conf ~ # move
$ sudo restorecon /etc/resolv.conf # set selinux defaults
$ sudo ln /etc/resolv.conf /etc/sysconfig/networking/profiles/default/resolv.conf #recreate hard link

 

DDOS Incident Cheat Sheet

This is very well put together:

http://www.zeltser.com/network-os-security/ddos-incident-cheat-sheet.pdf

 

Using SSH Remote and Local Tunnels

The following example demonstrates how to use Remote and Local SSH tunneling to access a service on your highly secure home computer (that's not exposed explicitly through a firewall at your home) from a remote location.

For example:

On Home Computer, before traveling:
ssh -R 44444:localhost:22 user@remote.computer.ip.address

On Remote Computer, after arriving at work:
ssh -L 22222:localhost:44444 user@remote.computer.ip.address (possibly rfc1918 ip)
ssh user@localhost -p22222

Wa la, you now have a SSH session to your home computer from work.

 

LHC VR Coolness

http://www.petermccready.com/portfolio/07041601.html

SSH Remote Command Execution

The following example allows you to execute a command on a remote system and return the results of the command without a shell session.

Simply include the command immediately after the normal ssh session request. Here's an easy one for a periodic secure rule integrity check on openBSD using pf.

ssh someuser@ip.add.re.ss 'pfctl -s rules | openssl sha1'

 

How to set up Apache, MySQL and PHP on FreeBSD

# cd /usr/ports/www/apache13-modssl
# make install
# echo 'apache_enable ="YES"' >> /etc/rc.conf
# echo 'apache_flags ="-DSSL"' >> /etc/rc.conf
# echo 'mysql_enable ="YES"' >> /etc/rc.conf
# /usr/local/etc/rc.d/mysql-server start
# mysqladmin -u root password newpassword
# cd /usr/ports/www/mod_php4
# make install clean
# cd /usr/ports/lang/php4-extensions
# make install clean
# vi /usr/local/etc/apache/httpd.conf
AddType application/x- httpd-php . php
AddType application/x- httpd-php-source . phps
# /usr/local/etc/rc.d/apache.sh start


# whoami
root
# cd ~
# openssl genrsa -des3 -out server.key 1024
# openssl req -new -key server.key -out server.csr 
# openssl x509 -req -days 365 \
     -in /root/server.csr \
     -signkey /root/server.key \
     -out /root/server.crt
# cp ~/ ./server.key /usr/local/etc/apache/ssl.key/
# cp ~/ ./server.crt /usr/local/etc/apache/ssl.crt/

 

Migrating from VMWare ESX 3.5 to VMWare Server 2.0 with VMWare Converter 3.0.3

The following is a brief account of how I got my vm's up and running in VMWare Server 2.0 that were originally running in ESX.

Short Story: I was able to load the vm into Workstation 5.5.5, fix the problems and bring it up in VMWare Server 2.0. Read on if you want a tiny bit more detail, there's not much to it.

In many cases I have encountered, sometimes you can't convert a ESX vm straight to VMWare Server 2.0. Some post-conversion modification is necessary. A number of VMWare forum threads elude to this fact, but I have found no further information on what it specifically entails. The OS's I have had the most problems with are CentOS and OpenBSD. The test image that I initially did when I was reviewing the possibility of this migration was a Win2k3 Standard image, and I was able to convert and run it with no problems.

In the specific conversion I attempted, the conversion process of the CentOS vm appeared successful. What I mean by this is that a vmx and vmdk file were generated. However, when I was going through the wizard, I encountered the following "Warning: Cannot configure the source image.". The vmdk file size seemed reasonable and the vmx file seemed like it was missing a few lines. I transferred these files from the win2k3 VMCS server, where I ran the VMWare Converter 3.0.3 software, to their new home, a win2k3 server with VMWare Server 2.0. I "Added a Virtual Machine to Inventory" in the VMWare Server 2.0 interface and the vm was reported to have been registered Successfully, but the vm showed up as "Unknown" in the inventory list, the controls to start the vm were greyed out, and no errors appeared to be logged or displayed anywhere.

Frustrating.

So, I tried bringing the vm up on another system that had VMWare Workstation 5.5.5 on it. An error was thrown, stating that the ide reference was incorrect and it thoughtfully suggested a change, which I made and worked. Then I was able to bring the image up and successfully reconfigured it for the new network environment it would call home. I shut the image down, copied it back the target host with VMWare Server 2.0 and successfully registered and ran the image. One last thing I needed to do was answer a question from the VMWare Server 2.0 before startup would occur. It was hidden on a pop-down on the Console tab, and wanted to know whether I had "moved it" or "copied it".

Tips:
Be sure to delete any snapshots the vm had, otherwise there may be problems later. Though, I have converted images successfully ignoring this step. The other bit that might be useful to know is that I was not able to successfully migrate any vm to VMWare Server 2.0 when selecting VMWare Workstation 6.x as the destination image format using VMWare Converter 3.0.3.

Another solution would be to avoid all these gui tools and export the VMDK with vmkfstools, then transfer the vmdk and create a new VM pointing to the VMDK. :)