Nice script to generate a password of 12 character length (on Linux)

#!/bin/sh
# Make a 72-bit password (12 characters, 6 bits per char)
dd if=/dev/urandom count=1 2>/dev/null | base64 | head -1 | cut -c4-15

C function to convert hex to binary

A simple C function to convert hex to binary

#include <ctype.h>

inline int cval(char c) {
        if (c>='a') return c-'a'+0x0a;
        if (c>='A') return c-'A'+0x0a;
        return c-'0';
}

/* return value: number of bytes in out, <=0 if error */
int hex2bin(char *str, unsigned char *out){
        int i;
        for(i = 0; str[i] && str[i+1]; i+=2){
                if (!isxdigit(str[i])&& !isxdigit(str[i+1]))
                                return -1;
                out[i/2] = (cval(str[i])<<4) + cval(str[i+1]);
        }
        return i/2;
}

TLS PSK, TLS SRP, and TLS JPAKE

As of time of this post, there are three common password based authentication for TLS:

1. TLS-PSK (Pre-Shared Key), RFC 4279
2. TLS-SRP (Secure Remote Password), RFC 5054
3. TLS-JPAKE, implemented in OpenSSL, not in RFC (yet)

TLS-PSK uses the pre-shared key to generate the TLS premaster key, which is then used to generate master key and session key. It is the simplest one, but the user has to safeguard the PSK.

TLS-SRP is more secure, in that it only stores a password verifier value, not the password itself. It would be a nice upgrade to replace TLS-PSK. Unfortunately, some rumors about potential patent problems (although the authors of SRP, Stanford University, has grant free-use of the patent) prevent it from being adopted in a large scale. For example, Fedora, and therefore Redhat, removes TLS-SRP from its OpenSSL libraries because of this. (Fedora script that removes SRP from openssl). Given that RHEL is the de-facto standard for enterprise Linux, this makes it hard to use TLS-SRP in commercial environment.

TLS-JPAKE is somewhat similar in what it tries to achieve. However, there does not seem to be a standard RFC for it yet, so inter-operability is a question. Also, according to OpenSSL, J-PAKE is still experimental and not activated as default.

For now, we will have to stick to the old plain TLS-PSK, which is a well-defined standard and has been implemented widely. 

vim tags file search path

add the following to your .vimrc file:

set tags=./tags;

Notice ";" after tags. That's important. That tells Vim to search tags in the current directory, and if not found, search parent directory, and continue up until found. Isn't that great?

TLS PSK server using openssl library

A simple TLS-PSK server program that based on the openssl library. This is based on the s_server app from openssl, removing all the unused parts and merge all code into one simple file.

Source:

Updated with working link:
https://bitbucket.org/tiebingzhang/tls-psk-server-client-example

Java Bouncy Castle TLS PSK example

This is an example how to use the Bouncy Castle library to write a TLS-PSK client. The server was tested with was an openssl server (openssl s_server). Keep in mind that I do not write Java program regularly, so you may find some style/usage not the best.

Source:

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintStream;
import java.net.InetAddress;
import java.net.Socket;
import java.security.SecureRandom;
import java.security.Provider;
import java.security.Security;
import javax.xml.bind.DatatypeConverter;

import org.bouncycastle.asn1.x509.Certificate;
import org.bouncycastle.crypto.tls.AlertLevel;
import org.bouncycastle.crypto.tls.CipherSuite;
import org.bouncycastle.crypto.tls.DefaultTlsClient;
import org.bouncycastle.crypto.tls.ServerOnlyTlsAuthentication;
import org.bouncycastle.crypto.tls.TlsAuthentication;
import org.bouncycastle.crypto.tls.TlsClientProtocol;
import org.bouncycastle.crypto.tls.TlsPSKIdentity;
import org.bouncycastle.crypto.tls.PSKTlsClient;
import org.bouncycastle.util.io.Streams;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

/**
 * A simple test designed to conduct a TLS-PSK handshake with an external TLS server.
 */
public class PSKTlsClientTest
{

 static String convertStreamToString(java.io.InputStream is) {
  java.util.Scanner s = new java.util.Scanner(is).useDelimiter("\\A");
  return s.hasNext() ? s.next() : "";
 }

 static class Z_PSKIdentity implements TlsPSKIdentity {

  void Z_PSKIdentity(){};

  public void skipIdentityHint(){
         System.out.println("skipIdentityHint called\n");
  }

  public void notifyIdentityHint(byte[] PSK_identity_hint){
         System.out.println("notifyIdentityHint called\n");
  }

  public byte[] getPSKIdentity(){
   return "Client_identity".getBytes();
  }

  public byte[] getPSK(){
   return DatatypeConverter.parseHexBinary("1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A");
  }

 }


    public static void main(String[] args)
        throws Exception
    {

  Z_PSKIdentity pskIdentity = new Z_PSKIdentity();

        Security.addProvider(new BouncyCastleProvider());

        Socket socket = new Socket(InetAddress.getByName("192.168.1.201"), 10443);

        SecureRandom secureRandom = new SecureRandom();
        TlsClientProtocol protocol = new TlsClientProtocol(socket.getInputStream(), socket.getOutputStream(),
            secureRandom);

        MyPSKTlsClient client = new MyPSKTlsClient(pskIdentity);
        protocol.connect(client);

        OutputStream output = protocol.getOutputStream();
        output.write("GET / HTTP/1.1\r\n\r\n".getBytes("UTF-8"));

        InputStream input = protocol.getInputStream();
        System.out.println(convertStreamToString(input));

        protocol.close();
        socket.close();
    }

    static class MyPSKTlsClient
        extends PSKTlsClient
    {

  public MyPSKTlsClient(TlsPSKIdentity id){
   super(id);
  }

        public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Exception cause)
        {
            PrintStream out = (alertLevel == AlertLevel.fatal) ? System.err : System.out;
            out.println("TLS client raised alert (AlertLevel." + alertLevel + ", AlertDescription." + alertDescription + ")");
            if (message != null) {
                out.println(message);
            }
            if (cause != null) {
                cause.printStackTrace(out);
            }
        }

        public void notifyAlertReceived(short alertLevel, short alertDescription)
        {
            PrintStream out = (alertLevel == AlertLevel.fatal) ? System.err : System.out;
            out.println("TLS client received alert (AlertLevel." + alertLevel + ", AlertDescription."
                + alertDescription + ")");
        }

        public TlsAuthentication getAuthentication()
            throws IOException
        {
            return new ServerOnlyTlsAuthentication()
            {
                public void notifyServerCertificate(org.bouncycastle.crypto.tls.Certificate serverCertificate)
                    throws IOException
                {
                    System.out.println("in getAuthentication");
                }
            };
        }
    }
}

The simple Makefile (I installed gnuwin32 so my system has "rm" )

all:
        javac -cp "jce-jdk13-149.jar;." PSKTlsClientTest.java
        jar -cfm tls.jar  manifest.txt PSKTlsClient*.class

run:
        run.bat -jar tls.jar
clean:
        rm -f PskTlsClient*.class PskTlsClient*.jar

The Server side. Keep in mind that openssl s_server by default uses id "Client_identity". The hint is just a hint. It does not change the fact that the serve requires the client to provide the id "Client_identity". Of course this can be changed if you make your own application. So below you can use anything for the psk_hint, or even omit the argument.

$ cat psk_server.sh
openssl s_server \
        -psk 1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A \
        -psk_hint Client_identity\
        -cipher PSK-AES256-CBC-SHA \
        -debug -state -nocert -accept 10443 -tls1 -www

manifest.txt file

Main-Class: PSKTlsClientTest
Class-Path: . jce-jdk13-149.jar

run.bat file (The host is Windows 7)

java -cp "jce-jdk13-149.jar;." %*

network monitoring software review

https://workaround.org/try-zabbix

Simple Golang port scanner

Simple and powerful golang port scanner

https://github.com/Sinute/golang-portScan

Who needs any other port scanner when you can take this one file and compile it to run on both Linux and Windows? And better yet, change the number to workers from 5 to 300 now you can scan an entire /24 network in 3 seconds.

Note that the program seem to have an issue with "\r" and "\n", which suggests that the program may have been developed on a Mac. No problem, simply replace swap "\r" and "\n" in the source  and you are ready to go.

How to extract file from RPM packages without installing it

rpm2cpio myrpmfile.rpm | cpio -idmv

Download Java JRE JDK using wget script

wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F" "http://download.oracle.com/otn-pub/java/jdk/7u4-b20/jdk-7u4-linux-x64.tar.gz"

More Info get http://ivan-site.com/2012/05/download-oracle-java-jre-jdk-using-a-script/

Virtualbox high network latency with multiple CPU Cores

On Virtualbox 4.2, if you assign multiple cores to your VM, and you are running Linux Guest, you may experience high network latency (ssh typing is sporadic even on local GigE network).

This is a bug with Virtualbox.

The solution: Change your VM Ethernet type to PCnet. Then it works!

Here is the link to the bug report: https://www.virtualbox.org/ticket/10157

A good Windows SSH/Telnet Server

http://www.kpym.com/

• Free, Open source, 
• works with putty in full color, and full window size
• and command auto complete works well
• what else could I ask for?

linux dummy interface and renaming

In linux, there is a kernel module called "dummy", which allows you to generate dummy network interfaces such as "dummy0", "dummy1", etc.

1. sudo modprobe dummy numdummies=2
2. now you can do "ifconfig dummy0 192.168.1.124" to give it an IP address.
3. you can also rename the dummy interface with the following command:
        ip link set dummy0 name eth3
you need to "down" the interface before running the command above.

With the combination of dummy interfaces and ability to rename dummy interfaces, you can do a lot of fun things with them.

initramfs with boot argument init=/bin/sh

If you use a Linux kernel with initramfs, the boot argument "init=/bin/sh" would not work. The correct one is "rdinit=/bin/sh". Aha. Gotcha.

U-boot environment variables

Just a pointer link:
http://www.denx.de/wiki/DULG/UBootEnvVariables

Add new file type to ack-grep

If you use ack as your grep replacement, and would like to add a new file type, do this:

Create a file at ~/.ackrc with the following line (change Ruby to your file type, and .haml,etc to your actual file extension):

--type-add=ruby=.haml,.rake,.rsel

How to hide/remove OS field in Bugzilla

This method uses javascript to hide the unwanted fields

1. edit template/en/default/global/header.html.tmpl. Search for "global.js". After the line "[% END %]" add the following lines:

    [% starting_js_urls.push('//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js') %]

    [% FOREACH javascript_url = starting_js_urls %]
      [% PROCESS format_js_link %]
    [% END %]
    [% starting_js_urls.push('js/my.js') %]

    [% FOREACH javascript_url = starting_js_urls %]
      [% PROCESS format_js_link %]
    [% END %]

2. create the file js/my.js with the following contents:

$(document).ready(function(){

        $("#os_guess_note").parent().hide();

        $("#field_container_op_sys").parent().hide();

        $("#field_container_rep_platform").parent().hide();

});

This hides three fields: OS, OS comment, and Hardware.

To remove more clutters, use the following js:

$(document).ready(function(){
        $("#os_guess_note").parent().hide();
        $("#field_container_op_sys").parent().hide();
        $("#field_container_rep_platform").parent().hide();
        $("#op_sys").closest("tr").hide();
        $("#bz_url_input_area").closest("tr").hide();
        $("#tag_container").closest("tr").hide();
        $("#dependson").closest("tr").hide();
        $("#blocked_input_area").closest("tr").hide();
        $("#show_dependency_tree_or_graph").closest("tr").hide();
        $("td.bz_section_spacer").closest("tr").hide();
        $(".bz_collapse_expand_comments").closest("td").hide();
        $("div.bz_add_comment").hide();
        $("#xml").hide();

        $("#comment").attr("rows","2");
        $("#attachment_table").hide().before("<button id='tz_bug_edit' style='width:50px'> <b>Edit</b> </button>");
        $("#add_comment").hide();
        $("#tz_bug_edit").prevAll("br").remove();
        $("#tz_bug_edit").click(function(){
                if ($("#attachment_table").is(":visible")){
                        $("#attachment_table").hide();
                        $("#add_comment").hide();
                }else{
                        $("#attachment_table").show();
                        $("#add_comment").show();
                }
                return false;
        });
});
        $("#bz_show_bug_column_1").append($("#bz_show_bug_column_2").html());
        $("#bz_show_bug_column_2").remove();
        $("table.edit_form").css("width","auto").css("float","right").find("th").css("text-align","left");

        $("#changeform").css("min-height","400px");

You can also change skins/standard/global.css to remove hyperlink underline, and change default font:

a {

        text-decoration: none;

}

/* this already exists, just edit it */

body, td, th, input {

    font-family: Verdana, sans-serif;

    font-size: 11pt;

}

GOLANG SSL Server and Client example

https://gist.github.com/spikebike/2232102

Below is my simple static "SSL Proxy" that listens on port 8000, and connects to another machine 10.3.0.124:443, and the proxy logs traffic both ways on screen.

To generate key.pem and cert.pem, you can use openssl, or use go team's simple program included in go package: http://golang.org/src/pkg/crypto/tls/generate_cert.go

package main
import (
        "io"
        "log"
        "net"
        "fmt"
        "os"
        "crypto/tls"
        "crypto/rand"
)

func checkError(err error) {
        if err != nil {
                fmt.Fprintf(os.Stderr, "Fatal error: %s", err.Error())
                os.Exit(1)
        }
}

/* slower, by we can print/log everything */
func myrawcopy(dst,src net.Conn) (written int64, err error) {
    buf := make([]byte, 32*1024)
    for {
        nr, er := src.Read(buf)
        if nr > 0 {
                        fmt.Printf("%s",string(buf[0:nr]));
            nw, ew := dst.Write(buf[0:nr])
            if nw > 0 {
                written += int64(nw)
            }
            if ew != nil {
                err = ew
                break
            }
            if nr != nw {
                err = io.ErrShortWrite
                break
            }
        }
        if er == io.EOF {
            break
        }
        if er != nil {
            err = er
            break
        }
    }
    return written, err
}

func myiocopy(dst net.Conn, src net.Conn){
        myrawcopy(dst, src)
        //io.Copy(dst,src);
        dst.Close();
        src.Close();
}

func handleclient(c net.Conn){
        config := tls.Config{InsecureSkipVerify: true}
        conn, err := tls.Dial("tcp", "10.3.0.124:443", &config)
        checkError(err)

        go myiocopy(conn,c)

        //io.Copy(c, conn)
        myrawcopy(c, conn)
        c.Close()
        conn.Close();
}

func main() {
        cert, err := tls.LoadX509KeyPair("cert.pem", "key.pem")
        if err != nil {
                log.Fatalf("server: loadkeys: %s", err)
        }
        config := tls.Config{Certificates: []tls.Certificate{cert}}
        config.Rand = rand.Reader
        service := "0.0.0.0:8000"
        listener, err := tls.Listen("tcp", service, &config)
        if err != nil {
                log.Fatalf("server: listen: %s", err)
        }
        log.Printf("server: listening on %s for https, connects to https://10.3.0.124:443",service)
        for {
                conn, err := listener.Accept()
                if err != nil {
                        log.Printf("server: accept: %s", err)
                        break
                }
                defer conn.Close()
                log.Printf("server: accepted from %s", conn.RemoteAddr())
                go handleclient(conn)
        }
}

Free - Remote Desktop Control Software

To sum it up: 

For business, Use LogMeIn for unattended, Join.me for attended.

For personal: Use TeamViewer.

The first and highest rated product in the unattended category is LogMeIn. This is a web-based service that's extremely easy to set up and use and can be accessed from any PC with a browser. The free version won't allow file transfer or remote printing but is a great solution for accessing your remote data as well as file sharing. Registration is required before using the product. It is really meant to be an 'install and leave it' kind of tool and not for the 'quick connect to help a friend' scenario. I still very much believe that the features and speed of LogMeIn are unmet by any other product and worth the extra hassle if you have access to the other machine(s) or means to connect remotely and install it. It is free for personal and commercial use.

Next is TeamViewer. It is very reliable, allows both attended and unattended control and has great features. There is a portable version of the viewer if you want to use an application or they also have a web-based control site that requires no installation to remotely control computers. The web-based version uses HTML and Flash, so it is usable even if the browser or firewall doesn't allow Java or ActiveX. TeamViewer is a commercial product and is only free  for personal use. Any commercial use is prohibited by the TeamViewer use policy.

The fastest solution in the attended category is Join.me. Its small 1 MB download and simple security code make it very quick to establish a remote session.

The last solution in this category is Mikogo. Mikogo is not the fastest nor is it the most reliable, but it offers the most features of any of the solutions in this article. It is a full-featured solution comparable to the commercial Citrix GotoMeeting product with features such as presenter switching, remote control, white board sharing, file sharing and session recording.

Source: http://www.techsupportalert.com/best-free-remote-access-software.htm

To open a page in a frame using javascript

"javascript:top.frames['framename'].location = 'filename.html';return true;"