January 24, 2014

PIV CAC card list of certificates

Question:
SP 800-73 Part 1 defines four X.509 certificate data objects and there are key references for asymmetric keys given. One assumes that:

Key Reference 9A <==> X.509 Certificate for PIV Authenication
Key Reference 9B <==> X.509 Certificate for Card Authentication
Key Reference 9C <==> X.509 Certificate for Digital Signature
Key Reference 9D <==> X.509 Certificate for Key Management

is this correct?

Furthermore, it is not stated for which of these key pairs the private key is resident on the card and for which key pairs the private key is held outside the card.
Answer:
The correct relationship is as follows:

Key Reference 9A <==> X.509 Certificate for PIV Authentication. The 9A private key is held on the card.

Key Reference 9B: The Card Management Key (aka Card Application Administration Key) is a symmetric key and has no certificate. The 9B symmetric key is held on the card.

Key Reference 9C <==> X.509 Certificate for Digital Signature. The 9B private key is held on the card.

Key Reference 9D <==> X.509 Certificate for Key Management. The 9D private key is held on the card.

Key Reference 9E <==> X.509 Certificate for Card Authentication Key. Note that the Card Authentication Key may be asymmetric or symmetric. It has a certificate only if it is asymmetric. The private or secret 9E key is held on the card.

January 20, 2014

The novel way to build cross compiler tools

http://www.cis.upenn.edu/~milom/cross-compile.html

The reason it is novel is because it takes the target header file and library directly without recompiling them. Therefore this approach is much simpler than the regular from scratch method.

How to Cross-Compile GCC for SPARC Solaris

Computer and Information Sciences Department
University of Pennsylvania
January 2010
To make it easier for my CIS534 students to compile code for our one and only SPARC machine (a 128-thread Niagara T2 box, generously donated by Sun Microsystems), I created a cross-compiler for GCC on x86/Linux to SPARC/Solaris. This page documents how I did it. I'm putting it on-line in case anyone else finds it helpful.

Overview

There are three steps to building the cross compiler:
  1. Specifying the configuration and paths
  2. Finding and installing the proper system header files and libraries
  3. Cross-compiling GNU binutils and GCC

Definitions and Configuration

  • The "host" is the machine on which the compiler executes (x86/Linux in my case). By default, the configure scripts will automatically figure this out.
  • The "target" is the machine on which the output binaries will execute (for SPARC/Solaris in my case, it should be sparc-sun-solaris2.10). This needs to be set explicitly. You can find out the proper target string by executing gcc -dumpmachine.
  • The "prefix" is the instalation prefix where the cross-compiler will be installed.
  • The "sysroot" is the location the cross compiler will look for header files and libraries. The sysroot directory acts as if it is the root of the system,. So, for example, header files go in $SYSROOT/usr/include/ and library files go in $SYSROOT/usr/lib/, etc.
I set these options using environment variables:
setenv TARGET sparc-sun-solaris2.10
setenv PREFIX /mnt/castor/seas_home/c/cis534/public/cross/
setenv SYSROOT $PREFIX/sysroot/
set path = ( $path $PREFIX/bin )

mkdir $PREFIX
mkdir $SYSROOT

System Headers and Libraries

To be able to build and link applications, the cross-compiler needs access to the system header files. As building the compiler also uses some of these files, installing these files needs to be done first. If you have access to the target machine, you can just copy the files into $SYSROOT. Otherwise, you'll need to download the files from the proper distribution. To copy the files, I piped tar through SSH to the SPARC machine (arachnid, in our case), as I could not find an option to get SCP to preserve symbolic links:
cd $SYSROOT
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/include" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/local/include" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /lib" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/lib" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/local/lib" | tar -xvf -
Copying the above directories worked for what I needed to do, but you might also considering copying additional headers and libraries:
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/openwin/include" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/dt/include" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/X11/include" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/openwin/lib" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/dt/lib" | tar -xvf -
ssh milom@arachnid.seas.upenn.edu "tar -cf - /usr/X11/lib" | tar -xvf -

Cross-compiling GNU binutils and GCC

Building binutils and GCC is reasonable straightforward (if everything works), by downloading, unpacking, configuring, running make, and then make install for both:
mkdir /scratch/users/build
cd /scratch/users/build

wget http://ftp.gnu.org/gnu/binutils/binutils-2.20.tar.gz
tar -xvzf binutils-2.20.tar.gz
mkdir build-binutils
cd build-binutils/
../binutils-2.20/configure -target=$TARGET --prefix=$PREFIX -with-sysroot=$SYSROOT -v
make all; make install

wget http://ftp.gnu.org/gnu/gcc/gcc-4.4.2/gcc-4.4.2.tar.gz
tar -xvzf gcc-4.4.2.tar.gz
mkdir build-gcc
cd build-gcc
../gcc-4.4.2/configure --target=$TARGET --with-gnu-as --with-gnu-ld  --prefix=$PREFIX -with-sysroot=$SYSROOT --disable-libgcj --enable-languages=c,c++ -v
make all; make install
You can delete the build directories once the make install has been completed. Also, the above config for GCC will only build C and C++, but you can remove that option if you need to build GCC with support for other languages.

Testing

This will create two sets of binaries. The directory $PREFIX/bin/ will include executables of the form: sparc-sun-solaris2.10-gcc. You should be able to use this to compile a program:
$PREFIX/bin/sparc-sun-solaris2.10-gcc hello.c -o hello
Running file hello should return something like:
ELF 32-bit MSB executable, SPARC32PLUS, V8+ Required, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
Then copy hello over to the SPARC box, and see if it runs. Although it shouldn't be necessary, if it gives dynamic linking errors, you could try setting the LD_LOAD_LIBRARY environment variable.
Update (April 2010): If you're getting dynamic linking errors, particularly with C++, you may need to use the "-R" option when compiling. This option specifies a path the dynamic loader on the target to look for the libraries:
$PREFIX/bin/sparc-sun-solaris2.10-gcc -R $PREFIX/$TARGET/lib/sparcv9/ hello.c -o hello
This assumes the -R path is mounted on the target machine. If not, you may need to copy over those files and adjust the -R path accordingly.

January 16, 2014

serial port to tcp redirection and terminal emulation

Usually, when you connect to a serial port, on Windows, you would use Tera Term, or Putty, (or secureCRT, etc), and on Linux you would use picocom, minicom, etc. All these program do at least two things:

1. connect to a serial device
2. emulate a terminal (VT100, etc)

Now if  you want to remotely access that serial port, and you can use a program to convert the serial data stream to TCP data stream (ser2net/remserial on Linux, com2tcp on Windows). The only thing is that you still need a "terminal emulator" to get full capability (vi, etc) from that console.

One way to do it to use "putty", and use "raw tcp" and make sure you set "local echo" to "off", and "local line editing" to off on the "Terminal" tab of the Settings.


Another way is to run a local tcp-to-com kind of program. On linux, you can use remserial to create a virtual com port, and on Windows I think you can use com2tcp/com0com to do it. But I think using putty  to access it directly is easier.

com2tcp tips

com2tcp can be used on Windows to redirect UART port to TCP port. Here is an example command to do that:

     com2tcp --baud 9600 --ignore-dsr \\.\com1 8888


Note that "--ignore-dsr" is needed most of the times, otherwise com2tcp may close tcp ports when it detects DSR off.

January 15, 2014

kermit file transfer and u-boot

I usually use "picocom" on Linux to talk through a serial line to U-boot. Of course I have used "minicom" before but it seems heavy. There is even "microcom". However, so far I have stayed away from "kermit" just because it seems to be so complicated and not totally free in license.

Now the authors in Columbia University has made it totally free (BSD license), and U-boot supports its file transfer protocol (loadb command) (u-boot does not support ZModem, only Ymodem). I take a look at it.

It looks like a nice serial terminal emulator with file transfer capability. The macro part is really handy. Below is my .kermrc file with two user-defined macros for uploading uboot and kernel images using the kermit protocol in a different baud rate than console baud

cat ~/.kermrc
set line /dev/ttyUSB1
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
set delay 1
connect
define sendb {
        set speed 230400
        output \x0D
        output \x0D
        send u-boot.bin
        input 1 "NEVER"
        set speed 115200
        output \x1B
        output \x0D
}
define sendk {
        set speed 230400
        output \x0D
        output \x0D
        send uImage
        input 1 "NEVER"
        set speed 115200
        output \x1B
        output \x0D
}

January 10, 2014

Qt, embedded Linux, Keyboard map

If you happen to use Qt for your embedded Linux project, and need keyboard support. The following things may be useful.

1. Qt supports keyboard keymap since version 4.6. By default it uses the default keymap,  which has a bug (unfixed as of early 2014) that prevents CAPS LOCK and num lock to work. See details here: https://bugreports.qt-project.org/browse/QTBUG-9843 . You can either patch it using the patch file on that bug report , or use an external keymap file.

2. To use an external keymap file, you need to obtain the Linux keymap file package (http://lct.sourceforge.net/data.html click on "Download" on the left),  untar it, get "keymaps/i386/qwerty/us-latin1.kmap". This file is for the default US keyboard. Use the keymap that matches your keyboard.

3. Qt includes a tool named "kmap2qmap" to convert the above kmap file to a qmap file that Qt applications can uses. You may want to patch the "kmap2qmap" source code to prevent this bug. It's a simple patch. Then run it as "kmap2qmap us-latin1.kmap us.qmap", and you should get the new file "us.qmap". It is safe to ignore the warnings.

4. Put this qmap file in your system, let's assume "/opt/us.qmap", and set the following env variable:
export QWS_KEYBOARD="<driver>:keymap=/opt/us.qmap".  I use a qt keyboard driver plugin in my setup so I don't use the variable, but this is supposed to be how your run it. More details here.

That's it. Now your new keyboard should work. :-) I know, finally!

P.S. this website (and this one) provides good information on keyboard scan code (Set 1, Set 2, Set 3, USB HID, etc)

msed - multiple search and replace on a file from command line

msed is a simple command-line program that search and replace multiple words in a file. You put the words to be searched and replaced in the "Pattern" file, and the run msed with "msed Pattern-file Target-file".

msed does word boundary replacement. Therefore, when you ask it to replace "kit" to "kat", it will respect and not replace "kitty" or "kit0".
msed will output to standard output. You can redirect it to a file.
The code:


#!/usr/bin/php

# Perform multiple search and replace on the target file

function usage(){
    echo "\n" .
         "Usage:  msed   [-r]\n" .
         "pattern-file contains lines of Search and Replace, example\n" .
         "   Pig Dog\n" .
         "   Cat Kitty\n" .
         "-r: reversed pattern file, ie. Replace is first, Search is second\n";
}

if (count($argv)!=3 && count($argv)!=4){
    usage();
    exit(-1);
}

$pfile=$argv[1];
$tfile=$argv[2];
$reverse=false;
if (count($argv)==4){
    $reverse=true;
    fprintf(STDERR,"reversed serach and replace patterns\n");
}

## check files
$pat_str=file_get_contents($pfile);
if ($pat_str===FALSE){
    die("Error opening pattern file $pfile\n");
}
$t_str=file_get_contents($tfile);
if ($t_str===FALSE){
    die("Error opening target file $tfile\n");
}
$pat_arr=explode("\n",$pat_str);
if (count($pat_arr)<1){
    die("Error, no pattern found in file.\n");
}

## read patterns and sort by length
$pat=array("s"=>array(),"r"=>array());
foreach($pat_arr as $pline){
    $pline=trim($pline);
    if (strlen($pline)<1) continue;
    $parts=preg_split('/\s+/',$pline);
    if (count($parts)!=2){
        fprintf(STDERR,"skipping invalid pattern line:$pline\n");
        continue;
    }
    if ($reverse){
        $pat["s"][]="/\b$parts[1]\b/";
        $pat["r"][]=$parts[0];
    }else{
        $pat["s"][]="/\b$parts[0]\b/";
        $pat["r"][]=$parts[1];
    }
}

## do search and replacement
$t_str=preg_replace($pat["s"],$pat["r"],$t_str);
echo($t_str);
                

January 9, 2014

Linux USB and USB keyboard driver debugging tips

1. USBMON is your friend. It has very little dependency and is very useful in giving you low level USB packets.  The short but complete and helpful documentation is at: https://www.kernel.org/doc/Documentation/usb/usbmon.txt

2. The USB Made Simple website with details of how USB works. The articles are fairly short so you can read and understand how USB works. Very useful. Site: http://www.usbmadesimple.co.uk/ums_3.htm

3. Linux Device Driver boot (Rev 3) has a good chapter about USB Urbs and the architecture of the USB stack on Linux, giving you a good overall picture of how things work. Site: http://www.makelinux.net/ldd3/chp-13-sect-3

4. Linux Documentation input.txt provides very useful information on Linux handling of USB HID and events. Address: https://www.kernel.org/doc/Documentation/input/input.txt

5. freedesktop.org publishes a tool called 'evtest' that can read events to Linux device /dev/eventX. This can be really useful in viewing raw events. The package has only one C file and no lib dependency. So very easy to compile for your target. Site: http://cgit.freedesktop.org/evtest/

6. TI's Wiki has a good overview of how TI's USB stack fits into the Linux USB stack. Site: http://processors.wiki.ti.com/index.php/DM81xx_AM38XX_USB_User_Guide#Linux_USB_Stack_Architecture

January 2, 2014

RJ11 telephone cables

Technical term:
RJ11, RJ14, and RJ25 all use the same physical connector.

RJ11 has two wires.
RJ14 has 4 wires.
RJ25 has 6 wires.

If you want to buy RJ25 connector/cable, search for the term "6p6c" such as on amazon.com

Another theory:
RJ11 has 4 wires: 6p4c
RJ12 has 6 wires: 6p6c

December 18, 2013

The best grep replacement: ag

http://geoff.greer.fm/2011/12/27/the-silver-searcher-better-than-ack/

It's syntax is pretty much the same as ack, but written in optimized C and is noticeably faster.

December 6, 2013

The Telnet Protocol


The Telnet protocol is often thought of as simply providing a facility for remote logins to computer via the Internet. This was its original purpose although it can be used for many other purposes. It is best understood in the context of a user with a simple terminal using the local telnet program (known as the client program) to run a login session on a remote computer where his communications needs are handled by a telnet server program. It should be emphasised that the telnet server can pass on the data it has received from the client to many other types of process including a remote login server. It is described in RFC854 and was first published in 1983.

The Network Virtual Terminal

Communication is established using the TCP/IP protocols and communication is based on a set of facilities known as a Network Virtual Terminal (NVT). At the user or client end the telnet client program is responsible for mapping incoming NVT codes to the actual codes needed to operate the user's display device and is also responsible for mapping user generated keyboard sequences into NVT sequences.
The NVT uses 7 bit codes for characters, the display device, referred to as a printer in the RFC, is only required to display the "standard" printing ASCII characters represented by 7 bit codes and to recognise and process certain control codes. The 7 bit characters are transmitted as 8 bit bytes with most significant bit set to zero. An end-of-line is transmitted as the character sequence CR (carriage return) followed by LF (line feed). If it is desired to transmit an actual carriage return this is transmitted as a carriage return followed by a NUL (all bits zero) character.
NVT ASCII is used by many other Internet protocols.
The following control codes are required to be understood by the Network Virtual Terminal.

Name code Decimal Value Function
NULL NUL 0 No operation
Line Feed LF 10 Moves the printer to the next print line, keeping the same horizontal position.
Carriage Return CR 13 Moves the printer to the left margin of the current line.
The following further control codes are optional but should have the indicated defined effect on the display.

Name code Decimal Value Function
BELL BEL 7 Produces an audible or visible signal (which does NOT move the print head.
Back Space BS 8 Moves the print head one character position towards the left margin. [On a printing devices this mechanism was commonly used to form composite characters by printing two basic characters on top of each other.]
Horizontal Tab HT 9 Moves the printer to the next horizontal tab stop. It remains unspecified how either party determines or establishes where such tab stops are located.
Vertical Tab VT 11 Moves the printer to the next vertical tab stop. It remains unspecified how either party determines or establishes where such tab stops are located.
Form Feed FF 12 Moves the printer to the top of the next page, keeping the same horizontal position. [On visual displays this commonly clears the screen and moves the cursor to the top left corner.]
The NVT keyboard is specified as being capable of generating all 128 ASCII codes by using keys, key combinations or key sequences.

Commands

The telnet protocol also specifies various commands that control the method and various details of the interaction between the client and server. These commands are incorporated within the data stream. The commands are distinguished by the use of various characters with the most significant bit set. Commands are always introduced by a character with the decimal code 255 known as an Interpret as command (IAC) character. The complete set of special characters is

Name Decimal Code Meaning
SE 240 End of subnegotiation parameters.
NOP 241 No operation
DM 242 Data mark. Indicates the position of a Synch event within the data stream. This should always be accompanied by a TCP urgent notification.
BRK 243 Break. Indicates that the "break" or "attention" key was hit.
IP 244 Suspend, interrupt or abort the process to which the NVT is connected.
AO 245 Abort output. Allows the current process to run to completion but do not send its output to the user.
AYT 246 Are you there. Send back to the NVT some visible evidence that the AYT was received.
EC 247 Erase character. The receiver should delete the last preceding undeleted character from the data stream.
EL 248 Erase line. Delete characters from the data stream back to but not including the previous CRLF.
GA 249 Go ahead. Used, under certain circumstances, to tell the other end that it can transmit.
SB 250 Subnegotiation of the indicated option follows.
WILL 251 Indicates the desire to begin performing, or confirmation that you are now performing, the indicated option.
WONT 252 Indicates the refusal to perform, or continue performing, the indicated option.
DO 253 Indicates the request that the other party perform, or confirmation that you are expecting the other party to perform, the indicated option.
DONT 254 Indicates the demand that the other party stop performing, or confirmation that you are no longer expecting the other party to perform, the indicated option.
IAC 255 Interpret as command
There are a variety of options that can be negotiated between a telnet client and server using commands at any stage during the connection.

Common Telnet options:

Decimal code Option Name RFC
0 Transmit Binary 856
1 Echo 857
3 Suppress Go Ahead 858
5 Status 859
6 Timing Mark 860
24 Terminal Type 1091
31 Window Size 1073
32 Terminal Speed 1079
33 Remote Flow Control 1372
34 Linemode 1184
36 Environment Variables 1408
All Telnet options:
Decimal Code Option Name RFC
0 Transmit Binary 856
1 Echo 857
2 Reconnection
3 Suppress Go Ahead 858
4 Approx Message Size Negotiation.
5 Status 859
6 Timing Mark 860
7 Remote Controlled Trans and Echo 563, 726
8 Output Line Width
9 Output Page Size
10 Negotiate About Output Carriage-Return Disposition 652
11 Negotiate About Output Horizontal Tabstops 653
12 NAOHTD, Negotiate About Output Horizontal Tab Disposition 654
13 Negotiate About Output Formfeed Disposition 655
14 Negotiate About Vertical Tabstops 656
15 Negotiate About Output Vertcial Tab Disposition 657
16 Negotiate About Output Linefeed Disposition 658
17 Extended ASCII. 698
18 Logout. 727
19 Byte Macro 735
20 Data Entry Terminal 732,1043
21 SUPDUP 734, 736
22 SUPDUP Output 749
23 Send Location 779
24 Terminal Type 1091
25 End of Record 885
26 TACACS User Identification 927
27 Output Marking 933
28 TTYLOC, Terminal Location Number. 946
29 Telnet 3270 Regime 1041
30 X.3 PAD. 1053
31 NAWS, Negotiate About Window Size. 1073
32 Terminal Speed 1079
33 Remote Flow Control 1372
34 Linemode 1184
35 X Display Location. 1096
36 Environment 1408
37 Authentication 1416, 2941, 2942, 2943,2951
38 Encryption Option 2946
39 New Environment 1572
40 TN3270E 2355
41 XAUTH
42 CHARSET 2066
43 RSP, Telnet Remote Serial Port
44 Com Port Control 2217
45 Telnet Suppress Local Echo
46 Telnet Start TLS
47 KERMIT 2840
48 SEND-URL
49 FORWARD_X
50
-
137
138 TELOPT PRAGMA LOGON
139 TELOPT SSPI LOGON
140 TELOPT PRAGMA HEARTBEAT
141
-
254
255 Extended-Options-List RFC 861
 
Options are agreed by a process of negotiation which results in the client and server having a common view of various extra capabilities that affect the interchange and the operation of applications.
Either end of a telnet dialogue can enable or disable an option either locally or remotely. The initiator sends a 3 byte command of the form

 IAC,<type of operation>,<option>
The response is of the same form.
Operation is one of

Description Decimal Code Action
WILL 251 Sender wants to do something.
WONT 252 Sender doesn't want to do something.
DO 253 Sender wants the other end to do something.
DONT 254 Sender wants the other not to do something.
Associated with each of the these there are various possible responses

Sender Sent Receiver Responds Implication
WILL DO The sender would like to use a certain facility if the receiver can handle it. Option is now in effect
WILL DONT Receiver says it cannot support the option. Option is not in effect.
DO WILL The sender says it can handle traffic from the sender if the sender wishes to use a certain option. Option is now in effect.
DO WONT Receiver says it cannot support the option. Option is not in effect.
WONT DONT Option disabled. DONT is only valid response.
DONT WONT Option disabled. WONT is only valid response.
For example if the sender wants the other end to suppress go-ahead it would send the byte sequence

255(IAC),251(WILL),3

The final byte of the three byte sequence identifies the required action. For some of the negotiable options values need to be communicated once support of the option has been agreed. This is done using sub-option negotiation. Values are communicated via an exchange of value query commands and responses in the following form.

 IAC,SB,<option code number>,1,IAC,SE
and

IAC,SB,<option code>,0,<value>,IAC,SE
For example if the client wishes to identify the terminal type to the server the following exchange might take place

Client   255(IAC),251(WILL),24
Server   255(IAC),253(DO),24
Server   255(IAC),250(SB),24,1,255(IAC),240(SE)
Client   255(IAC),250(SB),24,0,'V','T','2','2','0',255(IAC),240(SE)
The first exchange establishes that terminal type (option number 24) will be handled, the server then enquires of the client what value it wishes to associate with the terminal type. The sequence SB,24,1 implies sub-option negotiation for option type 24, value required (1). The IAC,SE sequence indicates the end of this request. The repsonse IAC,SB,24,0,'V'... implies sub-option negotiation for option type 24, value supplied (0), the IAC,SE sequence indicates the end of the response (and the supplied value). The encoding of the value is specific to the option but a sequence of characters, as shown above, is common.                          

Source: http://pcmicro.com/netfoss/telnet.html

November 22, 2013

Adding Linux PAM

If you have an embedded Linux, but want to add Linux PAM to your system, here are some of the thing I have found out:

What you will need:
1. Linux-PAM package
2. Shadow package (Debian or Linux From Scratch has source)
3. cracklib package (sourceforge)

Linux-pam needs cracklib to test password complexity.

1. compile and install cracklib
CC=ppc-linux-gcc ./configure --host=ppc-linux
make
make install DESTDIR=/home/me/install

2. compile and install linux-pam
LIBS="-lcrack" CFLAGS=-I/home/me/install/usr/local/include LDFLAGS=-L/home/me/install/usr/local/lib/ CC=ppc-linux-gcc ./configure --host=ppc-linux --disable-nis --disable-selinux --disable-regenerate-docu --disable-nls --disable-rpath
make install DESTDIR=/home/me/install
(you may want to change the installed *.la files to point to the right directory. this is bug of libtools)

3. compile shadow
LIBS="-lpam -lpamc" CFLAGS=-I/home/tzhang/install/usr/include LDFLAGS=-L/home/tzhang/install/lib64/ CC=ppc-linux-gcc ./configure --host=ppc-linux  --with-libpam --without-selinux  --without-sha-crypt --without-nscd --disable-shadowgrp
make

you will need to transfer the following files to your target (as you go along, you may need more modules):
/lib64/
/lib64/security
/lib64/security/pam_unix.so
/lib64/security/pam_cracklib.so
/lib64/libcrack.so.2


and then: 
useradd
passwd
login


create the following files under /etc/pam.d/
/etc/pam.d/system-auth
/etc/pam.d/passwd
/etc/pam.d/other

also login.defs:
-bash-3.00# cat /etc/login.defs
ENV_SUPATH  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ENV_PATH    PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
MAIL_DIR        /var/mail

and this one:
-bash-3.00# cat /etc/default/useradd
SHELL=/bin/sh

make sure you have at least an empty shadow file 
$ touch /etc/shadow

PAM is used when adding user, changing password, login, etc. You can also hook your application to PAM authentication.

November 21, 2013

TI Sitara DM816x UART BOOT

On silicon revision 1.0 and 1.1, the BOOTROM operates at baud rate 32452.
On silicon revision >=2.0, the baud rate is 64904 baud

November 20, 2013

busybox password hash algorithm

Busybox has a command "passwd" and take an argument "-a ALG", but it does not tell you which "ALG" should be. Well, here it is:

1. "des"
2. "md5"
3. "sha256"
4. "sha512"

How to add jquery to any webpage without using a browser plugin

Option 1
Copy the following code to your browser's javascript console (under developer tools) and run it:
var body = document.getElementsByTagName("body")[0];
var script = document.createElement('script');
script.type = "text/javascript";
script.src = "http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js";
body.appendChild(script);

Option 2
Go to: http://code.jquery.com/jquery-latest.min.js and copy the entire code to run in your javascript console.

To check, run the following in your javascript console:

$("body").length

And you should get 1.

November 18, 2013

C code to detect link connected/disconnected using RTNETLINK

RTNETLINK documentation is not very good. Here is an example of how to detect interface disconnected/disconnected using it. If you want to detect interface up and down, just check the flag IFF_UP instead of IFF_RUNNING.

  https://gist.github.com/tiebingzhang/aafc2953b430d5586bd1135cad85100f

November 8, 2013

How to compile Net-SNMP 5.7.2 for Windows on Linux using MinGW

Here is how to compile Net-SNMP 5.7.2 for Windows on Linux using MinGW.

In my setup, the host is Fedora Linux 19 64-bit.

1. Install MinGW:
sudo  yum install mingw32-binutils mingw32-cpp mingw32-filesystem mingw32-gcc mingw32-gcc-c++ mingw32-runtime mingw32-w32api
2. Get snmp-5.7.2 source code and untar it
3. configure it:
CC=i686-w64-mingw32-gcc ./configure --host=mingw32  --with-ar=i686-w64-mingw32-ar \
--without-perl-modules --disable-embedded-perl   \
--disable-mib-loading  --with-openssl=internal  --enable-mini-agent --with-out-transports="Callback Unix TCP" \
--disable-manuals --disable-shared
Option 1
1. Comment out RANLIB in all Makefiles
find . -name Makefile | xargs sed -i 's/^RANLIB.*/RANLIB=echo'
2.
 make -j 20 

3. Manually do ranlib
find . -name "*.a" | xargs i686-w64-mingw32-ranlib
4.
 make -j 20 
8. More manual ranlib
find . -name "*.a" | xargs i686-w64-mingw32-ranlib
5. continue to make
make -j 20
This time it should make all the way to the end. That's it.

P.S.
I tried to directly set RANLIB in Makefile to be i686-w64-mingw32-ranlib, but then it tries to ranlib the *.la files and fail. If you know a way to directly set RANLIB in Makefiles and compile successfully, please let me know by leaving a comment below.

Option 2 
1. Point ranlib to mingw ranlib in all Makefiles
mkdir -p $HOME/bin; cd $HOME/bin;
cat <<EOF >myranlib
#!/bin/sh
echo Running 686-ranlib $*
i686-w64-mingw32-ranlib  $*
exit 0;
EOF
chmod +x myranlib
ln -sf ranlib myranlib
find . -name Makefile | xargs sed -i '1s/^/PATH := $(HOME)\/bin:$(PATH)\n/'

2.
 make -j 20 

This time it should make all the way to the end. That's it.


November 7, 2013

Tshark decode and dump packets

Suppose you have the captured file, just use the following command to dump the first frame:

tshark -r ~/hcm_stigs/snmp.pcapng -Y frame.number==1 -Vx

-V: decode and print packet details
-x: print packet payload in Hex
-Y frame.number==1: only decode the first frame

November 5, 2013

SNMP V3 password to key algorithm implementation in GoLang

package main
import (
    "fmt"
    "io"
    "crypto/md5"
    "crypto/sha1"
)

func  password_to_key( password string, engineID string, hash_alg string) {
        h := sha1.New()
        if hash_alg=="MD5" {
                h = md5.New()
        }

        count := 0;
        plen:=len(password);
        repeat := 1048576/plen;
        remain := 1048576%plen;
        for count < repeat {
                io.WriteString(h,password);
                count++;
        }
        if remain > 0 {
                io.WriteString(h,string(password[:remain]));
        }
        ku := string(h.Sum(nil))
        fmt.Printf("ku=% x\n", ku)

        h.Reset();
        io.WriteString(h,ku);
        io.WriteString(h,engineID);
        io.WriteString(h,ku);
        localKey:=h.Sum(nil);
        fmt.Printf("localKey=% x\n", localKey)

        return;
}

func main(){
        password_to_key("maplesyrup","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02","MD5");
        password_to_key("maplesyrup","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02","SHA1");
}

November 1, 2013

Conference Call Systems

GoToMeeting and Webex are mainstream ones. I used GoToMeeting and like it.



Others:
 - FreeConference
 - FreeConferenceCallHD

More others:

So for those out there who may not know that alternatives exist, here are six options to use instead of GoToMeeting and WebEx:

1. AnyMeeting

AnyMeeting has been one of the quieter players in the web conferencing sector, but it’s solid service that has been pushing forward on the innovation front. Just two weeks ago, it announced that it had added WebRTC technology to its product so you don’t have to use Adobe Flash on some browsers. It has more than 400,000 users across its free and paid offerings.

2. FuzeBox

FuzeBox offers HD video and audio conferencing across quite a few platforms, including PC, Mac, iPhone, iPad, and Android phones and tablets. While you still have to download the apps, the software is cleaner and more intuitive than WebEx and GoToMeeting — so much so that FuzeBox counts big names like Amazon, eBay, Disney, NASA, Evernote, Verizon Wireless, and Spotify as customers.

3. Google Hangouts

Yes, Google Hangouts doesn’t exactly scream business. But so what? Hangouts offers the capability to chat with up to 10 people on a video call for free. You may also collaborate on Drive documents while you talk on a Hangout. This is an especially attractive offer for all the small businesses out there that don’t want to pay for more software and for enterprises that already use Google Apps.

4. Join.me

LogMeIn’s Join.me service is one of the strongest up-and-comers in the web-conferencing field. In my own tests, it works much faster than WebEx and GoToMeeting, but in most cases you do have to download the app once to start a meeting. If you are a participant on a call, however, you can join a meeting without a download — all the call organizer has to do is send you a link.

5. MeetingBurner

We talked with MeetingBurner last year and haven’t heard too much from the company since, but I recently spoke with CEO John Rydell, and he assures me his startup is very much alive and kicking. MeetingBurner uses the power of the cloud to make sure participants can hop on a call or webinar quickly without downloading software. You can host conference calls for up to 10 people for free without showing you ads, and if you need to conduct calls with even more attendees, it undercuts WebEx and GoToMeeting’s prices.

6. Zoom

Zoom was founded in 2011 by folks from Cisco and WebEx who wanted to make a better video conferencing product. It offers HD video or voice conferences for up to 25 people, and it supports meetings on the web, Mac, Windows, iOS, and Android. It also includes a few extra nifty features that aren’t found on many competitors, including screen sharing from iPhone and iPad, a private cloud deployment option, and sharing a computer’s audio feed during screen sharing.


Source: http://venturebeat.com/2013/08/27/lets-dump-webex-and-gotomeeting-for-hosting-web-conferences/