Doublehops

I’ve always been interested in computer security and although it’s something I consciously think about when building web applications, it’s not something I’ve ever giving solid time to solely focus on. However, over the last three months I spent all my spare time in the evenings and on weekends working through the Offensive Security certificate, a certificate that is taught by the developers of the Kali Linux distro.

The certificate is a very hands on approach to learning how to compromise computer systems. Along with a guide that goes into detail many of the ways in which vulnerabilities can be found and exploited, you are given access to a VPN with about two dozen vulnerable machines where you can explore and hone your skills. Starting out by scanning networks and profiling each server by learning its operating system, open ports and applications (and their versions) running on each. I found that it can be a tedious exercise but very interesting at the same time. SQL injection was fun but maybe because I’ve played around with that before and already had a great understanding of how it works. The buffer overflow exploits, although tough, was made much easier than I would have guessed because of the tools available today that make attempts quite transparent.

You quickly learn to write your own scripts to automate things that you find yourself repeating. As a result it improved my skills in both Python and Bash. This mostly to do things like scan a network for webservers or servers had MySQL ports open. I thought that sqlmap was a useful tool as it takes the tedious guess work out of finding applications that are not properly escaping user data before running them through an SQL query. The certificate introduces the student to many useful tools ranging from discovery and exploit execution.

It was an exhausting exercise to take outside of my day job but very rewarding. I learned a lot about a topic that has fascinated me for over 20 years and I can use these new skills to build and test that the applications and environments that I build are as secure as possible. In 2017, I will start working with IoT devices and build the APIs that they will communicate with. These devices will need to be secure and not become part of the growing botnets that we read about. Keeping on top of security issues is an ongoing task that I’m glad to be a part of.

For some years now I’ve been inspired to travel to the United States to attend the Open Source Convention OSCON in Portland. I hoped to learn what new open source tools and resources developers from around the world are using to get their work done.

This year I made the journey and it was well worth it. About 3000 people attended over the five days and they are all so passionate about open source software. Most are developers but all are working with open source software in one way or another. Everyone is very willing to share their skills and experience.

A main focus of the conference was Open Stack (http://www.openstack.org/) which is an open source alternative to Amazon’s cloud services and the primary thing I hoped to learn about when leaving Melbourne. Open Stack is being embraced by many businesses and the founders from NASA have moved on to build their own businesses that use Open Stack technologies. As some speakers discussed there is still a lot of work to do before Open Stack has all the features required to be a complete cloud services platform but it’s looking very promising.

I also got a lot out of talks about PHP, Vim, Twitter’s Bootcamp and system performance tuning.

I also met lots of interesting people. Sitting down to lunch I found myself sitting next to Sebastion Bergman who created PHPUnit and on another day with an Open Stack founder Josh McKenty. I also met some Ubuntu community members and some people behind MySQL (and MariaSQL), Linode, Rackspace and many more.

Everyone is pushing the open source movement in the same direction. Forward. It was a fantastic event and I hope to attend next year. However tomorrow in day one of Defcon which I’m very excited about.

I purchased a Macbook Pro many months ago and tried using it as a development machine for my PHP/MySQL/Nginx projects but I found I hated the lack of a good package manager like Aptitude (apt-get) and my favourite window manager Fluxbox so I ultimately removed Macosx for my preferred platform of Ubuntu/Kubuntu/Debian.

This was great but I now had new frustrations of having no wireless as Apple had sourced a little known Broadcom wireless device (B4331) for their products that had no native drivers for Linux. I had been perseveering for over five months using LAN cables and tethering from my phone whilst waiting for an elegant solution to become available to get the device to work. Up until now, at best there seemed to just be poor and unreliable methods to get the device to work that I couldn’t risk my dev machine on in case it affected my machine too much, like the constant lockups some people experience.

But yesterday I found an article from Raimer Sandner which walked you through installing the driver and avoiding the pitfalls found with the other methods. It took me about 10 minutes to follow the steps and now I’m finally free of wires.

I bought my first Mac several months ago because I travel around the city a lot I wanted something smaller than my older 15 inch laptop. I used Macosx on it for sometime but found development too difficult. I guess I’ve been using Linux for so long now that I am so intune with the way it works, I was lost without it. My two main gripes was no good (from limited effort trying homebrew) package managers and less than ideal window manager. I realised more than ever how much I need Aptitude and Fluxbox to be productive.

So I installed Kubuntu 11.04 and felt at home again. However there were some things that didn’t work they way I needed them to. The touchpad is great and I could never go back to a system that doesn’t have one but with Linux it was way too sensitive. As someone else on the web pointed out, you could move the mouse without actually touching the device. This made typing emails and most typing tasks a real pain because the cursor would jump all over the place. However thanks to Texstar’s post I was able to correct this. I went with solution 4. I found that setting FingerHigh to a value of 50 was better than the recommended 30. Also on another forum I found an option to detect if your palm has brushed the touchpad and ignore the action.

My config now looks like this: /etc/X11/xorg.conf.d/50-synaptics.conf

Section "InputClass"
    Identifier "touchpad catchall"
        Driver "synaptics"
        MatchIsTouchpad "on"
        MatchDevicePath "/dev/input/event*"
        #Option  "Device"        "/dev/input/mouse0"
        Option  "Protocol"      "auto-dev"
        #Option  "LeftEdge"      "1700"
        #Option  "RightEdge"     "5300"
        #Option  "TopEdge"       "1700"
        #Option  "BottomEdge"    "4200"
        Option  "FingerLow"     "25"
        Option  "FingerHigh"    "50"
        Option  "MaxTapTime"    "180"
        Option  "MaxTapMove"    "220"
        Option  "VertScrollDelta" "30"
        Option  "MinSpeed"      "1.48"
        Option  "MaxSpeed"      "2.00"
        Option  "AccelFactor" "0.3830"
        Option  "SHMConfig"     "1"
        Option  "VertTwoFingerScroll"   "1"
        Option  "HorizTwoFingerScroll"  "1"
        Option  "VertEdgeScroll"        "1"
        Option  "HorizEdgeScroll"       "1"
        Option  "TapButton1"            "1"
        Option  "TapButton2"            "3"
        Option  "TapButton3"            "2"
        Option  "PalmDetect"            "1"
EndSection

These settings can also be changed on the fly using synclient.

synclient FingerHigh=40

I found that this set-up helped a lot getting the mouse gestures in Firefox to respond better. Now I’m just waiting on the development of a native driver for the wireless card.

Update: The option that makes the biggest improvement is the PalmDetect. Setting this to 1 stops the touchpad from reacting when you’re plan slides across. The other settings should then be tweaked to suit your needs.

I have been maintaining Debian based Linux servers now for some years and at times I find it frustrating that the latest versions of my favourite packages are not available yet because of the delay in getting the newest version into the selected repository. This leaves you needing to build the program from source.

I recently discovered a project designed to get around this problem. Dotdeb is a repository for Debian systems that have the latest versions of PHP, MySQL, Redis, Apache, Nginx and other common web type packages ready to install or upgrade. With doing little more than adding the Dotdeb repository URL to your sources.list file and updating, the newest version of each package are immediately available.

I love now that I can easily have the most up to date packages with minimal fuss and leaving me with time to get back to development.

To find out more visit the project’s website.

I discovered something completely new over the weekend; running multiple window managers simultaneously in your Linux environment. This came about because of a conflict I encountered between Fluxbox and an application I was trying to run, Bitcoin. It seems that two are somewhat incompatible.

After finding that Bitcoin ran fine in WindowMaker, it was pointed out to me that I could run WindowMaker inside my Fluxbox session by running a second X server. This saves me from having to logout of one window manager to use another, just for the sake of one application. I installed X window server Xephyr which then allowed me to run a second window manager which then allowed WindowMaker within.

Thanks to qole and his forum thread I was able to put the whole thing together with a basic script with a few minor modifications to suit my environment. My modified script follows:

#!/bin/sh
##################################
#Change these two variables to the WM of your choice.
export WMNAME="windowmakerWM"
export WMEXEC="wmaker"
##################################
export DISPLAY=:0
export TSLIB_TSDEVICE=/dev/input/event3
export TSLIB_CALIBFILE=/etc/pointercal
export GTK_MODULES=libgtkstylus.so
export PARWIN=`wmctrl -l | grep -i $WMNAME | awk '{print $1}'`
wmctrl -i -r $PARWIN -b toggle,fullscreen
xinit /bin/su chippy -c 'export DISPLAY=:1; $WMEXEC' -- /usr/bin/Xephyr :1 -br -screen 1000x700x16 -dpi 96 -parent $PARWIN +kb -ac
export DISPLAY=:0

Running this script loads the X server and then runs a WindowMaker session within it. It’s quite like running a virtual machine, however you are not running another instance of an operating system, just another window within your current operating system with all your installed applications and environment as you would expect.

Sometimes I am reminded the power available to Linux and all things open source. This was another example.

WindowMaker running with Fluxbox

This week I attended the Open Source Developers Conference in Melbourne. OSDC is a three day event that is aimed at sharing skills and thoughts on software development using open source technologies and is attended by many developers passionate about open source software. This year I believe there were about 150 attendees from all around Australia and around 60 talks in total.

The talks covered everything from best practices in version control, Perl 6, PHP frameworks and CMSs, mobile application development and much more.

It was great to see what others are doing with and getting out of open source software. I was most amazed by Ben Martin’s talk about his project called Libferris. Libferris is a virtual file system which can mount vastly different things that can then be accessed from the shell. The types of things that can be mounted are LDAP, Evolution, images, Flicker, Youtube, PostgreSQL, RDP documents, the DOM in Firefox and MP3 files. This allows the extraction of data available to the shell or custom applications.

Another highlight was the closing keynote by Damian Conroy. This was a talk that lasted an hour and was exhausting to listen to as it was complex and fast, yet extremely compelling. Damian effectively used the general theory of relativity, quantum mechanics and perl to find prime numbers. The idea and implementation is completely amazing and I suggest everyone watches the video to see for yourself (shown at the bottom of this post.

All in all everyone was very impressed with the event and took a lot away from it. Sharing a beer at the end of each day was a great way to meet other like minded people and discuss what we learnt throughout the day. I am already looking forward to next years event which will be held in Canberra.

Damien Conway’s closing keynote speech – Temporally Quaquaversal Virtual Nanomachine Programming In Multiple Topologically…

This year I started purchasing Linux Format magazine which is produced in the UK. It’s expensive in Australia at $19.95 an issue but it’s very informative and I enjoy reading away from the computer. The target audience is people that use Linux from day to day and want to get more out of it.

There are great tutorials  and reviews of many applications. There’s always several articles that draw my attention that I feel I must read.

From the Linux Format website, I discovered they also produce a podcast once a fortnight. The podcast is equally as informative but in a light hearted way. It is very entertaining. You learn a lot about what is happening in the world of Linux and it’s great to get a personal insight into the people that produce the magazine. My personal favourite segments are the discovery of the week and the challenges they create for themselves. For example, in one podcast hey challenged each other to work only from the shell for a fortnight.

For anyone interested in Linux I suggest you listen to their podcast at TuxRadar to see what I mean.

The most frustrating thing with Linux is getting the video to work properly. This week I upgraded all the packages on my system and now X refuses to start. This happens all the time and you need to manually fix it each time. It’s never easy or straight forward.

The Nvidia driver installer available from the their website does not seem to work with *ubuntu systems. This is because they require Linux to be at running level 3 to install, but it seems that *ubuntu don’t have run level 3 like traditional systems.

After many hours of searching I came across a tool called Envyng. Envyng will prompt you for a few questions and then install and download the selected driver. Better still, you can run Envyng from within X.

For *buntu based systems, install Envyng with the following command:

sudo apt-get install envyng-core envyng-qt

Then to install the Nvidia or ATI driver, run the following command:

envyng -t

You will be presented with a list of options to install or remove drivers for either chipset and then which version of the driver you would like to install. If you install an incorrect driver and X doesn’t start a descriptive error in the Xorg log file will indicate which driver you should install.

Envyng install options

It is very painless.

For more information, refer to the blog post at Reformed Musings.

Fluxbox has been my window manager of choice for the last 18 months after switching from Window Maker and last week I discovered some great shortcuts by looking through the ~/.fluxbox/keys file. I haven’t seen these shortcuts discussed anywhere and because they make the most common window tasks extremely fast and easy, I thought I should share them.

Moving and resizing windows

• Moving a window – A window can be dragged around that screen by holding Mod1 (Alt key) and left clicking anywhere on the window. This avoids moving the mouse to the title bar each time.
• Resizing a window – You can resize a window by pressing Mod1 (Alt key) and right clicking on the window to resize that window. The resizing occurs from the nearest corner from where you clicked.

Tabs in windows

The windows also allow tabs. By middle clicking the title bar, you can drag the title bar of one window into the title bar of another window, creating a tab. You can move between the tabs by either clicking on the tab or by holding Mod4 (Windows key) and pressing a number on the keyboard. Eg. 1 for the first tab, 2 for the second, etc…

Example of window tabs in Fluxbox

Extra: Switching between workspaces

I remap my keys file so that I can easily switch between my four workspaces. By modifying the config like below (in ~/.fluxbox/keys) I can now press Mod1 (Alt)+1 to goto workspace 1 and Mod1 (Alt)+2 to goto workspace 2.

# move to a specific workspace
Mod1 1 :Workspace 1
Mod1 2 :Workspace 2
Mod1 3 :Workspace 3
Mod1 4 :Workspace 4

Windows can be moved to other workspaces by left clicking on the window (dragging the window slightly) and moving to a new workspace. The window will move with you.