kintoandar

Attack detection and notification with iptables, psad and notify-send

2012-01-30T18:04:00.001Z

For some time now I've been searching for some way to integrate firewall log alerts into my desktop.

A few years back (before I started to truly enjoy iptables) I was a firestarter user, I even wrote a handy script for it and really liked the notifications it provided.

Nowadays I crave for iptables scripts and can't stand firestarter interface, this became a problem. How could I have an elegant way of being notified of potential threats without depending on email alerts or log watching?

Using conky seemed a cool alternative and its scripting capabilities were indeed a solution for my problem. But soon realized I always keep windows maximized and didn't notice conky on the background, alerts were ignore and the idea buried. Yesterday, as I watched a pop-up notification on my screen another idea just poped (pun intended).

There should be a way to easily parse iptables logs matching them with known attack signatures, and guess what?... There is, it's called psad, and you probably remember me talking about it a few posts ago. Using psad to parse the log files you can be notified of network attacks in real time, the end of the tiresome log surfing after the attack already taken place.

The only thing we're missing is the notification, well, that was easier than I thought because psad can execute a script every time an attack is detected. Keeping this in mind, and using notify-send capabilities, we can have a visual notification spawned by psad upon an attack detection.

Here follows the configurations I've used to turn the idea into reality.

(I've tested it on xubuntu, but this would be identical on other distros)

First the software requirements:

apt-get install iptables-persistent
apt-get install libnotify-bin
apt-get install psad

For the iptables configuration you may use my template and tailor it to you likings.

Edit the psad configuration file /etc/psad/psad.conf and change the following variables accordingly, I'll explain each one of them.

Change USERNAME with your system username.

# This variable is just for future reference, because we want visual notifications, not email
EMAIL_ADDRESSES             USERNAME@machine.lan;

# Here we disable the email notifications
ALERTING_METHODS           noemail;

# Point the following variable to the correct log file (redhat based systems should be /var/log/messages)
IPT_SYSLOG_FILE                  /var/log/syslog;

# DISPLAY and XAUTHORITY are used to define the where and how to connect to the user desktop
# The nofify-send flags:
# -t tells to keep the notification visible until closed by the user
# -i path to an image that will be displayed on the notification
# -c what is the type of the notification
# Then follows the title and the body of the notification, SRCIP is a psad internal variable that hold the source IP of the attacker
EXTERNAL_SCRIPT               DISPLAY=:0.0 XAUTHORITY=/home/USERNAME/.Xauthority notify-send -t 0 -i /usr/share/icons/Tango/scalable/emblems/emblem-important.svg -c network "Firewall Alert" "Intrusion detected from SRCIP";

# You want to always be notified each time an attack is detected, even if it is from the same source
EXEC_EXT_SCRIPT_PER_ALERT   Y;

All done, save the file.

Deploy your iptables rules policy, restart psad daemon, go to another machine on the network and run nmap against your host, for example a simple syn scan without pinging:

nmap -P0 -sS 192.168.1.66

You should now be presented with something like this on your host:

Special thanks to Michael Rash for psad and the one of my favorite books Attack Detection and Response with iptables, psad, and fwsnort.

Version 2.0

2011-11-14T20:58:00.001Z

I used to develop software for a living. Nowadays, being a sysadmin for more than 4 years, my developing skills became rusty as hell.

I won't deny that I still have lots of fun programming some wicked scripts with perl and bash for automating tasks like backups, system checking, log parsing, etc... yet they don’t fulfil my developer cravings anymore.
So I started wondering which would be a good new language to start polishing my development skills, and after a lot of searching I've selected three candidates:

Javascript
Python
Ruby

Python won the challenge, just because it seamed to be the more versatile of the three with the strongest sysadmin background, the network programming potential is overwhelming. Also, I'm very curious about the Twisted event-driven networking engine.

Another thing that has changed over the years were the versioning systems, I've used CVS a couple of times but now it's totally outdated.

The search for a new versioning system to learn was as quick as a google querie, if git is good enough for linux kernel development, it's good enough for a simpleton like me.
And so, nothing like creating a github account to let the games begin.

We've now reached the purpose of this post.

All the scripts on this blog are going to be submitted to github, all the posts with source code will have links to the corresponding files on github.
I hereby promise to update my code as often as time allows me.

May the source be with you and remember:
"The problem with git jokes is everyone has their own version."

Gnome 3 vmware-console with vmware-vmrc fix

2011-06-09T16:44:00.002+01:00

Well, just upgraded my eee to fedora 15 and I have to say it's awesome! Much faster than the older version, I personally recommend you to make the jump.
But like always there were some problems, one of them was the hibernate feature ceasing to work, the other one was vmware console plugin just dying with no apparent reason and no log whatsoever (yes, I still use vmware server, my server processor does not comply with KVM virtualization...).

After a lot of google digging I've was able to find a quick and dirty fix, here is how it's done:

First of all create a folder named vmware-console and move yourself into it:

mkdir vmware-console
cd vmware-console

Get from your vmware server the .xpi package with the console plugin:

wget --no-check-certificate https://vmwareserver:8333/ui/plugin/vmware-vmrc-linux-x86.xpi

Or for the 64bit version:

wget --no-check-certificate https://vmwareserver:8333/ui/plugin/vmware-vmrc-linux-x64.xpi

Unzip the file:

unzip vmware-vmrc-linux-x86.xpi

Create a new file like this:

sudo gedit /usr/bin/vmware-vmrc

Paste the following magic code, and don't forget to change the $PATH_TO_VMRC variable so it points to the folder plugins you've extracted earlier:

#!/bin/bash

# Please define this variable with the path to the plugins folder
PATH_TO_VMRC="/home/user/vmware-console/plugins"

export VMWARE_USE_SHIPPED_GTK=yes
cd $PATH_TO_VMRC
./vmware-vmrc > /dev/null 2>&1 &
cd - > /dev/null 2>&1

Save and close the file and then change it to be executable:

sudo chmod +x /usr/bin/vmware-vmrc

Now try typing on the terminal

vmware-vmrc

Problem solved, you've vmware console back in business!

Link to github: http://git.io/8qD7fg

IRSSI IRC mention notify by email using ssmtp

2011-06-02T15:48:00.001+01:00

I've always been a huge fan of IRSSI client, the provided simplicity and customisation are a major benefit for all IRC users out there.

As it runs inside screen and is designed for permanent availability without downtimes, it's easy to forget to check it for new messages on the connected channels. After looking for something to keep track of my nickname mentions I've found fnotify to be a good candidate to remember me to check for new messages. But fnotify only logs nick mentions to a text file, so I've "improved" it to send a email so that I could always be warned when someone tries to talk to me.

Here is a small modification I've made to the fnotify plugin so it may notify me by email every time my nickname is mentioned on a channel. It uses ssmtp to send email through gmail.

You only have to set 2 variables on the script:

$EMAIL - Your notify email address
$SSMTP - The path to the ssmtp client

[user@gambit ~]$ cat .irssi/scripts/autorun/fnotify.pl

# todo: grap topic changes

use strict;
use vars qw($VERSION %IRSSI);

use Irssi;
$VERSION = '0.0.3';
%IRSSI = (
   authors     => 'Thorsten Leemhuis',
   contact     => 'fedora@leemhuis.info',
   name        => 'fnotify',
   description => 'Write a notification to a file that shows who is talking to you in which channel.',
   url         => 'http://www.leemhuis.info/files/fnotify/',
   license     => 'GNU General Public License',
   changed     => '$Date: 2007-01-13 12:00:00 +0100 (Sat, 13 Jan 2007) $'
);

#--------------------------------------------------------------------
# In parts based on knotify.pl 0.1.1 by Hugo Haas
# http://larve.net/people/hugo/2005/01/knotify.pl
# which is based on osd.pl 0.3.3 by Jeroen Coekaerts, Koenraad Heijlen
# http://www.irssi.org/scripts/scripts/osd.pl
#
# Other parts based on notify.pl from Luke Macken
# http://fedora.feedjack.org/user/918/
#
# ssmtp email notification support added by Joel Bastos
# http://kintoandar.blogspot.com
#
#--------------------------------------------------------------------

# Please set the variables (don't forget to escape "\" the "@" symbol like the example)
my $EMAIL = "myemail\@gmail.com";
my $SSMTP = "/usr/sbin/ssmtp";

#--------------------------------------------------------------------
# Private message parsing
#--------------------------------------------------------------------

sub priv_msg {
   my ($server,$msg,$nick,$address,$target) = @_;
   filewrite($nick." " .$msg );
}

#--------------------------------------------------------------------
# Printing hilight's
#--------------------------------------------------------------------

sub hilight {
    my ($dest, $text, $stripped) = @_;
    if ($dest->{level} & MSGLEVEL_HILIGHT) {
   filewrite($dest->{target}. " " .$stripped );
    }
}

#--------------------------------------------------------------------
# The actual printing
#--------------------------------------------------------------------

sub filewrite {
        my ($text) = @_;
        # FIXME: there is probably a better way to get the irssi-dir...
        my $date = `date` ;
        open(FILE,">>$ENV{HOME}/.irssi/fnotify");
        print FILE $date . $text . "\n\n";
        close (FILE);
        my $mail=`echo "Subject: IRSSI"|cat - $ENV{HOME}/.irssi/fnotify|$SSMTP $EMAIL`;
}

#--------------------------------------------------------------------
# Irssi::signal_add_last / Irssi::command_bind
#--------------------------------------------------------------------

Irssi::signal_add_last("message private", "priv_msg");
Irssi::signal_add_last("print text", "hilight");

Link to github: http://git.io/DY4iaA

Do It Yourself Phone Stand

2011-05-02T16:41:00.003+01:00

For anyone who knows what a Cassette is, here's a cool and cheep phone stand.

I still have a few cassettes laying around so I've put an old Led Zeppelin cassette case to good use.

Android remote filesystem with sshfs

2011-04-27T15:49:00.002+01:00

Well, now that I'm a proud Samsung Galaxy Ace owner and just entered the amazing world of Android, let the hacking begin!

For my first post on Android I'll explain how to mount the SDcard through a ssh filesystem on your netbook using wifi.

The requirements are pretty strait forward, a ~~rooted Android~~ device with sshdroid installed, a netbook with sshfs and both connected using wireless.

After starting sshdroid it will present you the IP and port of the ssh server:

You may connect to your device using the netbook with the provided information:

ssh root@10.0.2.15 -p 2222

(The default password is "admin", I use ssh keys instead as you should too, but I'll not cover that unless someone asks)

Now you're inside Android, you may list the partition table, just to check, by using:

#df

My SDcard is mounted on /mnt/sdcard, this will be useful.
You may exit Android ssh connection by typing:

#exit

On the notebook make a directory to mount the Android SDcard:

mkdir /media/android

and run sshfs mounting the Android SDcard partition (/mnt/sdcard) on the newly created directory (/media/android)

sshfs root@10.0.2.15:/mnt/sdcard /media/android -p 2222

(As before it will ask a password, the default password is "admin")

Leave that shell as is and open another one. Type the following on the new shell:

ls -la /media/android

As you can see you have now access to the SDcard locally with read/write permissions.
When you're done, just unmount the ssh filesystem using:

sudo umount /media/android

Nagios NRPE OSSEC check

2011-01-28T12:34:00.004Z

For some time now I've been testing OSSEC on my own infrastucture, so far it's one of the best IDS software I've implemented. Unfortunately the only method of alerting it has is via mail, being an hardcore Nagios fanatic I've been searching for a way to integrate OSSEC alerts on it.

None of the solutions I've encountered on the web sufficed, so nothing better than creating my own and sharing it with you.

Well, with little personal time to spare I decided that It would be something quick and dirty, so nothing like a log parser to get the job done.

The idea is pretty simple, ossec-server has an alert.log file that gathers all the events of its agents, each event has an alert level associated with it and the log file is rotated each day.

In my case I just needed to search the log for an alert level equal or higher than 7 (ex: ' integrity checksum changed', 'user missed the password more than one time', etc...) and pass the information to nagios-server in a formatted string like "HOST ALERT_LEVEL CAUSE".

Using NRPE daemon to call the script and ensuring that the message reaches nagios-server, all pieces were in place and my problem solved, here's how it looks on Nagios:

[root@banshee ~]$ cat /etc/scripts/check_ossec.pl

#!/usr/bin/perl

##############
# kintoandar
##############

use strict;
use warnings;

#--------------------------- Variables ------------------------------
# Where is the ossec alert.log?
# (nagios must belong to ossec /etc/group so it can open the log)
my $alert_log="/opt/ossec/logs/alerts/alerts.log";

# What level is critical for you?
my $critical="7";

# What is the OSSEC-Server name?
my $ossec="banshee";

#---------------------------- Parser --------------------------------
my @text=`grep "(level" -B 1 $alert_log`;
my $size=@text;
my @level="";
my $msg="";
my @host="";
my $count=0;
my $num=0;
for ($count=0;$count<$size;$count++){
    if ($text[$count] =~ m/level/){
        @level="";
        @level=split(/$level /, $text[$count]);
        @level=split(/$ ->/, $level[1]);
        if ($level[0] >= $critical){
             chomp ($level[1]);
             if ($text[$count-1] !~ m/$ossec/){
                @host=$text[$count-1];
                @host=split(/ $/, $host[0]);
                @host=split(/$ /, $host[1]);
                $host[0]=uc ($host[0]);
            }else{
                $host[0]=uc ($ossec);
            }
            $num++;
            $msg=$msg."[$host[0] level=$level[0]$level[1]]";
        }
    }
}

#-------------------------- Send to Nagios ---------------------------
if ($msg eq ""){
    print "No security threats found";
    exit 0;
}else{
    print "$num alerts found: $msg";
    exit 2;
}
print "Something is wrong, script went out of bounds?";
exit 1;

Link to github: http://git.io/Vi5Nrg

Conky Config eee Netbook

2010-12-30T15:11:00.004Z

Just remembered how fun it was to tinker with conky scripts, so here is the config I've made for my eee Netbook.

I've tried to arrange it so it would display maximum information on such a small screen, as I mostly use wireless lan I didn't bother with cable interfaces, but you may change it to your likings.

To run it on your system you need the conky package (apt-get install conky || yum install conky) and drop the following config on "~/.conkyrc":

########################
# kintoandar
########################

# Create own window instead of using desktop
own_window yes
own_window_transparent yes
own_window_type override
own_window_hints undecorated,below,skip_taskbar
#background yes

# Use double buffering
double_buffer yes

# fiddle with window
use_spacer right
use_xft yes

# Update interval in seconds
update_interval 5.0

# Minimum size of text area
minimum_size 160 5
maximum_width 160

# Draw shades?
draw_shades no

# Text stuff
draw_outline no # amplifies text if yes
draw_borders no

uppercase no # set to yes if you want all text to be in uppercase

# Stippled borders
#stippled_borders 8

# border margins
#border_margin 4

# border width
#border_width 1

# Default colors and also border colors
default_color white
default_shade_color black
default_outline_color white

own_window_colour brown
own_window_transparent yes

# Text alignment
alignment top_right

# Gap between borders of screen and text
gap_x 20
gap_y 10

# stuff after 'TEXT' will be formatted on screen
override_utf8_locale yes
xftfont Sans:size=8
xftalpha 0.8

TEXT

${offset 0}${color slate grey}Uptime: ${color lightgrey}$uptime
${offset 0}${color slate grey}Load: ${color orange}$loadavg
${offset 0}${color slate grey}Procs: ${color lightgrey}$processes
${offset 0}${color slate grey}CPU:${color lightgrey} $cpu% ${color slate grey}Temp: ${color lightgrey}${acpitemp}ºC
${color orange} ${offset 0}${cpugraph 15,130 666666 bbbbbb}
#
${offset 0}${color slate grey}CPU top:
${offset 0}${color orange} ${top name 1}${top_mem cpu 1}%
${offset 0}${color lightgrey} ${top name 2}${top cpu 2}%
${offset 0}${color lightgrey} ${top name 3}${top cpu 3}%

${offset 0}${color slate grey}Mem top:
${offset 0}${color orange} ${top_mem name 1}${top_mem mem 1}%
${offset 0}${color lightgrey} ${top_mem name 2}${top_mem mem 2}%
${offset 0}${color lightgrey} ${top_mem name 3}${top_mem mem 3}%

${offset 0}${color slate grey}Mem: ${color orange} $memperc% ${color lightgrey}$mem/$memmax
${color orange} ${offset 0}${membar 3,100}
${offset 0}${color slate grey}Swap: ${color orange} $swapperc% ${color lightgrey}$swap/$swapmax
${color orange} ${offset 0}${swapbar 3,100}

${offset 0}${color slate grey}/home: ${color lightgrey}${fs_free /home} free
${offset 0} ${color orange} ${fs_bar 3,100 /home}
${offset 0}${color slate grey}/opt: ${color lightgrey}${fs_free /opt} free
${offset 0} ${color orange} ${fs_bar 3,100 /opt}

${offset 0}${color slate grey}IP: ${color lightgrey}${exec ip route list|grep src|awk {'print $9'}}
${offset 0}${color slate grey}Signal: ${color orange}${wireless_link_bar 3,66 wlan0}
${offset 0}$alignc${color slate grey}Up:${color lightgrey}${upspeed wlan0}${offset 0}${color slate grey} Down:${color lightgrey}${downspeed wlan0}
${color orange} ${offset 0}${upspeedgraph wlan0 15,65 666666 bbbbbb}${color orange} ${offset 0}${downspeedgraph wlan0 15,65 666666 bbbbbb}
# dmsg logs, 2 lines
${color slate grey}dmsg:
${color lightgrey}${exec dmesg |tail -n 2}

# Lists the files I'm downloading
${color slate grey}Incoming:
${color lightgrey}${exec ls /media/server2/downloads/rtorrent/ /media/server2/downloads/poweruser/|grep -v server2|grep -v ^$}

Linux screen multiple applications startup

2010-09-04T16:34:00.008+01:00

Screen is one of the most helpful applications you'll ever use.

This post will show the configuration I personally use and how to startup multiple applications on boot.

Here's how my config looks like running irssi:

My config

user@gambit:~$ cat ~/.screenrc

nethack on
defscrollback 10000
hardstatus on
hardstatus alwayslastline
hardstatus string '%{= kG}[ %{G}%H %{g}][%= %{= kw}%?%-Lw%?%{r}(%{W}%n*%f%t%?(%u)%?%{r})%{w}%?%+Lw%?%?%= %{g}][%{B} %m/%d %{W}%c %{g}]'
startup_message off
vbell on

# The applications you want running when screen starts
screen -t DOWNLOADS 0 rtorrent
screen -t IRC 1 irssi

Startup

After configuring your own .screenrc just add on /etc/rc.local the following:

su user -c "screen -d -m -S SomeCoolName"

All done, next time there is a system reboot, screen will start with two applications running in the chosen user space.

Asus eee 1001p Ubuntu How-To

2010-07-04T02:40:00.005+01:00

I've finally give in to temptation and bought a netbook. After allot of searching I've chosen an Asus eee 1001p.
Then come the decision of a suitable OS, almost went with Fedora but the final choice was Ubuntu 10.04.
This post is all about the installation and configuration of the OS and all the tinkering I've had to do to get all (or most) the hardware to work properly.

Wifi Controller

lspci |grep Network
02:00.0 Network controller: Atheros Communications Inc. Device 002c (rev 01)

wget http://linuxwireless.org/download/compat-wireless-2.6/compat-wireless-2.6.tar.bz2
tar xvfj compat-wireless-2.6.tar.bz2
cd compat-wireless-*
./scripts/driver-select ath9k
make
make install
make unload
make wlunload
make btunload
modprobe ath9k

Screen Brightness

To solve the wired brightness bug edit:

vi /etc/default/grub

and change the GRUB_CMDLINE_LINUX_DEFAULT variable adding the following flags:

GRUB_CMDLINE_LINUX_DEFAULT="acpi_osi=Linux acpi_backlight=vendor"

Finally update grub configuration and you're done:

update-grub2

Multi-Touch Configuration
Create a script with your user named multi-touch.sh and add the following:

#!/bin/sh
#
# Synaptics TouchPad 2 finger Scrolling
#

# Set multi-touch emulation parameters
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Synaptics Two-Finger Pressure" 32 8
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Synaptics Two-Finger Width" 32 8
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Two-Finger Scrolling" 8 1
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Synaptics Two-Finger Scrolling" 8 1 1

# Disable edge scrolling
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Synaptics Edge Scrolling" 8 0 0 0

# This will make cursor not to jump if you have two fingers on the touchpad and you list one
# (which you usually do after two-finger scrolling)
xinput set-int-prop "SynPS/2 Synaptics TouchPad" "Synaptics Jumpy Cursor Threshold" 32 110

Add a line to your ~/.bashrc with:

source /path-to/multi-touch.sh

Note: I didn't come up with this script but I've no idea where I've got it.

Book Review: The Art Of Deception

2010-03-29T18:29:00.005+01:00

FBI wanted criminal and the world most known hacker, Kevin Mitnick, writes an exceptional manual on social engineering.

The book is divided into stories, each one full of tips and tricks on how to play misconceived trust to obtain information for the hack in question.

The security chain is as strong as its weakest link. I personally think the human factor of the IT Governance will always be the entry point for the most destructive exploits.

This book can help you understand the importance of personnel role on the security, or lack of it, in the enterprise global IT security plan.

There's no place like 127.0.0.1

2010-03-22T21:53:00.008Z

As previously announced, last Saturday, I attended as a speaker at PortoLinux technical meeting at FEUP.
My main goal was to give an overview of the main services I've on my personal infrastructure, which explains the chosen title "There's no place like 127.0.0.1".

Among other services, I've managed to talk about:

torrentflux
vnstat
xbmc
vmware
webminstats
nrpe
vino-server
synergy
samba/nfs
rsync
cron
ntpd
ssmtp
motion
screen + irssi
hts + htc
squid
no-ip2
apache virtualhosts
awffull
webdav
tomcat alfresco
mod_jk
mod_security
snort
B.A.S.E.
IPtables
fwsnort
psad
IPsec
OpenVPN
ssh ppp vpn
Nagios
NO2DB
nagiosgrapher
OSSEC

If you're interested on the slides used on my presentation, you can find them here.
PortoLinux is a group of open source advocates and technology geeks, where everybody is invited to join in.

PortoLinux Encontro Técnico

2010-03-18T18:49:00.012Z

No próximo Sábado dia 20 terá lugar mais um encontro técnico do PortoLinux.
Este encontro terá um formato diferente do habitual, sendo mais informal (ainda). Como sempre é aberto ao público, e se houver tempo, quem quiser pode apresentar algo.

Vou tentar dar uma visão da infraestrutura que fui construindo em casa, apareçam!

Apresentação	Apresentador
NoMachine / FreeNX	Fernando Pereira
Como (não) fazer apresentações	Manuel Silva
There's no place like 127.0.0.1	Joel Bastos
10 anos de Linux numa pequena empresa	Nuno Dantas

Mais informações na pagina oficial do PortoLinux

Book Review: Linux Firewalls

2010-02-26T18:11:00.002Z

Just finished reading this book and I must recommend it to those who are firewall experts and people interested on the subject.

Giving an overview on iptables, it goes further than the standard "packet allow" or "packet drop" explanation, providing know how on stopping attacks even on the application level of the OSI layers.

The conjunction of iptables, psad and fwsnort builds a bulletproof jacket on your server, no more log digging to understand if a system has been compromised (stop the attack now, ask questions latter).

The language used is easy to understand, and most of all, every explanation has examples, so you can try on the spot what you've just learn.

Something to hang to, and definitely a great acquisition to your library.

Beware the SysAdmin

2010-02-22T12:54:00.003Z

Devotion to duty

source: xkcd

TEDxO'Porto life changing experience

2010-02-21T00:24:00.002Z

What is TEDx?
In the spirit of ideas worth spreading, TED has created a program calledTEDx.
TEDx is a program of local, self-organized events that bring people together to share a TED-like experience. Our event is call TEDx (place), where x=independently organized TED event. At our TEDx (place) event, TEDTalks video and live speakers will combine to spark deep discussion and connection in a small group.
The TED Conference provides general guidance for the TEDx program, but individual TEDx events, including ours, are self-organized.

Today was my birthday and this year for something completely different I attended TEDxO'Porto.

The result was outstanding, best social event I've ever had the pleasure of attending. The mandatory networking between TEDxesters was plain fun, giving a chance of meeting old friends and, who knows, creating new ones. With an excellent choice of speakers, the talks were inspiring, mesmerizing and life changing.

I can't stress enough, this event is as awesome as it is overwhelming!

How To Disk Dump dd

2010-02-16T14:34:00.009Z

Disk Dump is nothing less than a life saviour when we're talking about disk disaster recovery or even data forensics.

Here's a quick list of the main uses for the dd tool.

Create a backup

dd if=/dev/sda of=/opt/backup_sda.img

Restore a backup

dd if=/opt/backup_sda.img of=/dev/sda

Clone a hard disk

dd if=/dev/sdb of=/dev/sdc

Transfer a disk image

dd if=/dev/sdb | ssh root@target "(cat >backup.img)"

Create an iso image of a CD/DVD

dd if=/dev/cdrom of=cdimage.iso

Burn an iso image of a CD/DVD

dd if=cdimage.iso of=/dev/cdrom obs=32k seek=0

Rescue a file that contains bad blocks

dd if=movie.avi of=rescued_movie.avi conv=noerror

Create your own bootloader

dd conv=notrunc if=bootloader of=qemu.img

Create a backup of your MBR

dd if=/dev/sdb of=mbr_backup bs=512 count=1

Restore a backup of your MBR

dd if=mbr_backup of=/dev/sdb bs=512 count=1

Mount dd image of and entire disk

You must use the start number of the partition.

fdisk -u -l disk_image

Disk /mnt/storage/disk_image: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x41172ba5

                  Device Boot      Start         End      Blocks   Id System
/mnt/storage/disk_image1              63       64259       32098+ de Dell Utility
/mnt/storage/disk_image2   *       64260    78108029    39021885    7 HPFS/NTFS
Partition 2 has different physical/logical endings:

phys=(1023, 254, 63) logical=(4861, 254, 63)

Then take the start of the partition that you want to edit 64260 in this case and multiply it by 512 ie 512*64260=32901120

mount -o loop,offset=32901120 -t auto /mnt/storage/disk_image /mnt/drive_image

When the hard disk has errors

Get the dd_rescue tool

dd_rescue /dev/sdb /opt/backup_sdb.img

Network speed test

dd if=/dev/zero bs=1M count=100 | ssh user@machine 'cat > /dev/null'

How to enable VDPAU XBMC 1080p Linux

2009-08-19T14:05:00.013+01:00

After some time tinkering and compiling several XBMC binaries, I've finally got my HTPC decompressing 1080p movies (mkv x264) directly on the GPU. What does this means?

Well, without GPU decompression my processor got 100% on one core 60% on the other (multithread enabled XBMC). This meant sluggish movie play and audio delay, awful experience that prohibits Full HD movie playback.
Using the VDPAU support on XBMC all the work of decompressing the movie goes to the graphics card and you'll have a 10% CPU usage average (sum of both cores).

The stable XBMC from the Ubuntu repositories (apt-get install xbmc) isn't VDPAU enable so you have to cook your own XBMC version.
The following how-to is designed to prevent breaking an previous installation of XBMC. As you can see on the "--prefix=/opt/install/xbmc/" this will not interfere with other XBMC installations.

Please look at the following links to gather more information:
VDPAU Info
Capable Cards

My Software/Hardware Specs

Distro: Ubuntu 8.04.3 LTS
Kernel: 2.6.24-24-generic
Driver: Nvidia Driver Used

MSI Geforce 9400GT 512Mb
Intel Pentium Dual CPU E2160 @ 1.80GHz
2 x 1Gb DDR2 - 667 Mhz

This instructions must be run as root:

sudo su -
apt-get install subversion make g++ gcc gawk pmount libtool nasm automake cmake gperf unzip bison libsdl-dev libsdl-image1.2-dev libsdl-gfx1.2-dev libsdl-mixer1.2-dev libsdl-sound1.2-dev libfribidi-dev liblzo2-dev libfreetype6-dev libsqlite3-dev libogg-dev libasound-dev python-sqlite libglew-dev libcurl4-gnutls-dev x11proto-xinerama-dev libxinerama-dev libxrandr-dev libxrender-dev libmad0-dev libogg-dev libvorbis-dev libsmbclient-dev libmysqlclient15-dev libpcre3-dev libdbus-1-dev libhal-dev libhal-storage-dev libjasper-dev libfontconfig-dev libbz2-dev libboost-dev libfaac-dev libenca-dev libxt-dev libxtst-dev libxmu-dev libpng12-dev libjpeg-dev libpulse-dev mesa-utils libcdio-dev libsamplerate-dev libmms-dev

cd /root
wget "http://launchpad.net/libmms/trunk/0.4/+download/libmms-0.4.tar.gz"
tar -zxvf libmms-0.4.tar.gz
cd libmms-0.4
./configure --prefix=/usr
make
make install

No root privileges needed for the following (but they can be used nonetheless):

mkdir /opt/install/xbmc -p
cd /opt/install/xbmc
svn checkout https://xbmc.svn.sourceforge.net/svnroot/xbmc/branches/linuxport/XBMC
cd XBMC
./configure --enable-vdpau --prefix=/opt/install/xbmc/
make
make install

# If all went without problems:
rm -rf /opt/install/xbmc/XBMC

You can now run as your user:

/opt/install/xbmc/bin/xbmc

On XBMC go to:

Settings > Video > Player > Render

And choose:

VDPAU

Give it a try and have fun ;)

PortoLinux Encontro Técnico

2009-07-03T13:28:00.017+01:00

Tal como em todos os outros, este encontro é completamente gratuito, aberto ao público em geral e informal/descontraído.

11 de Julho de 2009, pelas 9h, na Escola Artística de Soares dos Reis.

Temas

Edição de documentos com LaTeX
Design para programadores
Segurança em redes
Ferramentas de apoio ao ensino

Local

Escola Artística de Soares dos Reis, Rua Major David Magno, 139 (Porto)

Programa

Título	Apresentador
Uma Pequena Introdução ao LaTeX	José Neta
LaTeX para Humanos	Tiago Sousa
Design para programadores open-source:	José Mota
Firewalls para os comuns mortais com IPCOP	Marco Pinheiro
iTalc- gestão e controlo da sala de aula	Hélder Santos

Apresentação @ IPP - ESTGF

2009-06-21T12:13:00.002+01:00

No passado dia 17 de Junho fui convidado pela ESTGF a preparar uma apresentação para demonstrar o que de melhor é feito pelos seus antigos alunos no mundo profissional.

O evento correu de forma descontraída contando com uma audiência de cerca de 100 pessoas.
No seguinte link é possível encontrar o programa do primeiro dia de Informática na ESTGF.

Optei por fornecer informação relevante sobre serviços e tecnologias que diariamente uso, podendo deste modo motivar o estudo das mesmas pelos alunos presentes. Dediquei ainda algum tempo na apresentação de dois projectos de grande porte implementados por mim na minha actual empresa, envolvendo know-how em:
- Alfresco
- Liferay
- Tomcat
- Apache
- CentOS
- Iptables
- Advanced Routing

Fica aqui a apresentação utilizada para quem tiver interesse na mesma.

Firestarter Firewall Switch

2008-09-22T21:53:00.005+01:00

If you use Firestarter you know the huge bummer that is restarting your settings upon a change of the working interface.
Here's a little script I've made to automatically change the running network interfaces on the firewall. Enjoy ;)
Note: My interfaces are eth0 and wlan0, make the correct modifications to comply with your requirements.

#!/bin/sh

while true; do
INTERFACE=0

ifconfig eth0 |grep -q "inet addr"
if [ $? = 0 ];
then
sed -i 's/wlan0/\eth0/' /etc/firestarter/configuration
else
sed -i 's/eth0/\wlan0/' /etc/firestarter/configuration
INTERFACE=1
fi

iptables -L |grep -q DROP
if [ $? != 0 ];
then firestarter -s > /dev/null
if [ $INTERFACE = 0 ];
then
echo "$(date) -- firestarter running on eth0" >> /var/log/messages
else
echo "$(date) -- firestarter running on wlan0" >> /var/log/messages
fi
fi

sleep 5

done

Live USB system rescue cd

2008-09-08T11:43:00.005+01:00

Here's a fool prof tutorial on how to create a dual partition liveusb system rescue pen drive:

(pen drive == /dev/sdb)

sudo fdisk /dev/sdb

* n to create a new partition
* p to make it primary
* 1 so it is the first primary partition
* Accept the default or type 1 to start from the first cylinder
* +200M to make it 200 Meg big
* a to toggle the partition active for boot
* 1 to choose the 1 partition
* t to change the partition type
* 6 to set it to FAT16

Now we have out first partition set up, let's create the second one:

* n to create yet again a new partition
* p to make it primary
* 2 to be the second partition
* Accept the default by typing Enter
* Accept the default to make your partition as big as possible
* Finally, type w to write the change to your usb pendrive

sudo mkfs.vfat -F 16 -n boot /dev/sdb1
sudo mkfs.vfat -F 32 -n usb_drive /dev/sdb2

(You can get the systemrescuecd here)

mount -oloop /opt/iso/systemrescuecd-*.iso /media/iso/

cp -af /media/iso/* /media/boot/
rm -rf /media/boot/syslinux
mv /media/boot/isolinux/isolinux.cfg /media/boot/isolinux/syslinux.cfg
sed -i -e 's/scandelay=1/scandelay=5/g' /media/boot/isolinux/syslinux.cfg
mv /media/boot/isolinux /media/boot/syslinux

umount /media/boot
syslinux /dev/sdb1
sync

Evolution is upon us

2008-04-04T00:04:00.000+01:00

Think about it!

Media Center Wars

2008-01-06T05:31:00.000Z

This video shows the various aspects of the media center edition (MCE) software from micro$oft and Linux. I'm a little bias to provide an opinion, so, watch and make your own conclusions ;)
.

Cool Ubuntu know how

2008-01-05T15:45:00.001Z

One interesting thing is that in Red Hat based distributions the "run levels" configuration utility is chkconfig but in Ubuntu (Debian) the utility is sysv-rc-conf.

--

If you have mute sound problems in Quake III Arena, try using these commands as root, this one before playing the game:

echo "quake3.x86 0 0 direct" > /proc/asound/card0/pcm0p/oss

After exiting the game:

echo "quake3.x86 0 0 disable" > /proc/asound/card0/pcm0c/oss

--

Sound problems in Pidgin?
In the [ Preferences > Sounds > Method ] choose command and write on the Sound command text box:
aplay %s
That's it, try it now!

Custom LiveCD

2008-01-05T04:59:00.000Z

Howto Forge has a great article up on how you can make your own custom Ubuntu LiveCD with Remastersys:

“This guide shows how you can create a Live-CD from your Ubuntu Gutsy Gibbon or Linux Mint 4.0 system with a tool called remastersys. Remastersys is available in the Linux Mint romeo repository. You can customize your Ubuntu/Linux Mint system and then let remastersys create an iso image of it which you can then burn onto a CD/DVD.”

Check out the tutorial here

Sysadmin tough job

2008-01-03T11:18:00.003Z

The web server is down
Based on real life events

Linux is sexy

2008-01-03T00:00:00.004Z

who | grep -l blonde | date; cd~; unzip; touch; finger; mount; gasp; yes; uptime; unmount; sleep

Cheat Sheets

2008-01-02T18:34:00.002Z

Cá ficam os ditos "auxiliares de memória", sim porque o copianço nunca matou ninguém, embora já tenha dado ZERO a muita boa gente :p

Linux
Vim
Google
Firefox
Thunderbird

Open Source Software

2008-01-02T17:06:00.001Z

Para todos que pretendam envergar no caminho do bem, fica aqui um site de referência de software Open Source de qualidade.

Open Source Living

Usem e abusem...
That the source be with you!

Reembolso Windows (Asus)

2008-01-02T12:23:00.003Z

Cá fica o relato da minha saga em busca do valor do "micro$oft windows XP home" que veio com o portátil. A mim não serviu de muito mas poderá servir para alguém que se queira dar ao "trabalho" de exigir os seus direitos!

Reembolso do WinXP

Pergunta:

Boa tarde, o sistema operativo "Win XP Home" que foi "obrigatoriamente" comprado com o meu portátil nunca foi usado, como tal o CD continua lacrado. Sou utilizador de linux e não vejo qualquer razão para pagar uma copia do windows se esta não é usufruida. Após diversas conversas com o apoio tecnico da microsoft fui informado que o fornecedor do equipamento é o responsável pela devolução do dinheiro empregue na compra do sistema operativo (SO). Venho por este meio solicitor o reembolso da quantia paga pelo SO e gostaria de saber como proceder.

Continuação de boa tarde e agradeço desde já a atenção dispensada.

Resposta:

WTM200607141953299923 Re: Notebook M6A 2006-07-14 20:17:23

Estimado Cliente

Vimos pelo presente meio solicitar que entre em contacto com o nosso centro de suporte atravès do nr 808 789 888,no sentido de lhe tentarmos resolucionar o problema.

Mto Atenciosamente

Asus Tsd

Pergunta:

Seguindo as indicações que obtive na pagina anterior liguei para o número do centro de suporte 808 789 888, as informações que lá obtive de nada serviram e fiquei de receber um email da assistencia técnica no presente dia, o que não aconteceu!

Será que existe alguma forma de me esclarecer sem andar em circulos?

Boa tarde e melhores cumprimentos.

Resposta:

WTM20060725353501582 Re: Notebook M6A 2006-07-25 04:16:56

Estimado Cliente,

A microsoft nada tem a ver com o que vai ou não com o seu portatil, a asus compra milhoes de licenças de Windows á microsoft, e depois oferece essas mesmas licenças aos seus clientes, não temos porque devolver dinheiro de ofertas.

Mto Atenciosamente

Acib Tsd

Asus Rock Solid Heart Touching

Pergunta:

No entanto, se o WinXP é uma oferta porque é que vem discriminado na factura do portátil, ao contrário por exemplo do rato e mala? Já agora qual é a explicação para a "oferta" do WinXP Professional ser mais cara que a "oferta" do WinXP Home?

E sobretudo, se alguem se deu ao trabalho de ler a EULA do WinXP Home, pode encontrar o seguinte:

"YOU AGREE TO BE BOUND BY THE TERMS OF THIS EULA BY INSTALLING, COPYING, OR OTHERWISE USING THE SOFTWARE. IF YOU DO NOT AGREE, DO NOT INSTALL, COPY, OR USE THE SOFTWARE; YOU MAY RETURN IT TO YOUR PLACE OF PURCHASE FOR A FULL REFUND"

Eu discordo completamente com esta licença, dai nunca ter instalado este sistema operativo.

Em conclusão, se não sabem como me fornecer uma ajuda satisfatoria, peço um endereço, postal ou electrónico, para enviar uma queixa formal e fundamentada à Asus Internacional.

Lamento o vosso tempo despendido, mas apenas acho injusto pagar por algo que não usei, uso, ou irei usar.

Resposta:

WTM200607252014501177 Re: Notebook M6A 2006-07-25 20:37:56

Estimado cliente,

Os nossos produtos são vendidos por completo, ou seja, incluem todos os componentes e acessórios incluidos neles de fábrica. Não é possível, só porque não lhe agrada um dos componentes, remover o mesmo de devolver-lhe o dinheiro. Se assim fosse então agora os nossos clientes iriam pedir a removação dos touchpads dos nossos portáteis visto que já teriam um rato em casa e não precisariam do touchpad.

Além do mais quando comprou o portátil concerteza foi informado das características do mesmo e que incluem o Windows que lhe foi fornecido. Se não concorda com o pacote deveria ter considerado a compra do produto, não será agora, depois de comprar, que vai reclamar indicando que não precisa de algo que comprou.

Gostava de saber se quando vai comprar um carro pode pedir para lhe retirarem as jantes e retirarem o valor das mesmas no preço de compra. Acho que não faz qualquer sentido. E mesmo que fosse possível, que não é, teria que ser pedido ANTES de proceder à aquisição, não depois de já ter comprado e utilizado o produto.

Atenção que o Windows que possui faz parte integrante do portátil que comprou, e não pode ser considerado um acessório opcional.

Atenciosamente,

ASUS TSD

Pergunta:

Caro Bruno Rodrigues,

O meu problema, em particular, está com a licença que vem com o meu Windows e o facto de eu não a aceitar, não tendo nada contra a Asus, que honestamente continuo a considerar uma das melhores no ramo. Contudo o facto de não aceitar essa licença implica uma devolução da quantia paga pelo sistema operativo, o que está claro na mesma.

Disseram que o WinXP é oferta, contudo existe a opção, em alguns notebooks com exactamente as mesmas características, de escolher entre a versão Professional e Home Edition o que faz variar o preço do portátil, continuam a considerar isso uma “oferta”?

Gostava de saber o que faria se depois de comprar um carro, e partindo do princípio que não fuma, quando se lembrar de abrir o cinzeiro (o que normalmente não é imediato), encontrar lá um aviso que diga que é obrigado a fumar para utilizar esse mesmo acessório ou então pode pedir reembolso dessa peça caso não a use.

Peço mais uma vez que me indiquem o endereço da Asus Internacional para apresentar uma reclamação formal.

Atenciosamente me despeço.

P.S. Os touchpads não vêm com uma licença abusiva e restritiva que é obrigatório aceitar para serem utilizados.

Resposta:

Estimado Cliente,

O mesmo posso dizer em relação ao motor de um carro o sr. pode mudar o motor de cilindrada cavalos etc mas não pode pedir um carro sem motor ou pode?
como lhe disse o portatil se for submetido á garantia sem o sistema operativo original será cobrada a reparação.

Mto Atenciosamente
Acib Tsd
Asus Rock Solid Heart Touching

Pergunta:

Continuação do caso em http://kintoandar.paginas.sapo.pt/

Boa tarde,

Em resposta ao último e-mail que recebi que mais uma vez não respondeu ao que era pedido e que em nada ajudou, tenho a dizer o seguinte:

1-Adoraria discutir mecânica convosco mas a minha área de conhecimento é Engenharia Informática.

2-Se perco a garantia do hardware no caso deixar de usar o Windows em detrimento de outro sistema operativo (ex. Linux ou Free Unix), implica à Asus adoptar uma politica monopolista que não acredito que faça, se o fizer deverá constar das condições de garantia, o que não acontece. Além disso, como é descrito do ponto 6.10 do certificado de garantia, o software nem sequer é abrangido pela mesma.

3-Em relação à questão da “oferta” do Windows ser mentira, como nada disseram, parto do princípio que quem cala consente.

4-Seguiu um pedido de reclamação para o Instituto de Defesa ao Consumidor e pela TERCEIRA vez peço o endereço da Asus Internacional para encaminhar a mesma queixa.

Atenciosamente me despeço.

Resposta:

Estimado Cliente,
Neste caso penso que deveria ter pensado nesta questão antes de ter comprado o portatil se a loja onde comprou o portatil lhe quiser devolver muito bem a Asus não lhe vai a devolver o dinheiro.

Mto Atenciosamente
Acib Tsd
Asus Rock Solid Heart Touching

Pergunta:

Tendo em conta que apenas consigo ler a licença do Windows quando o tento instalar, que na minha realidade só acontece depois de comprar o portátil, é um tanto ou quanto dificil prever o futuro.

Apenas agora tentei instalar o WinXP, como tal dei comigo a ler uma licença que discordo é obvio que não poderia reclamar antes.

Espero pelo endereço da Asus Internacional.

Obrigado por tudo e continuação de um bom trabalho.