Hashing keeps your users info secure.
Credit: Flickr user FutUndBeidl
We’ve been working on this series for a while now (as you can gather from the series links below), and as such have covered a number of different areas:
However, there are a couple of things we wanted to mention before we wrap everything up.
Background:A client of ours (an individual this time — let’s call him Bob) has two PC’s: primary & secondary. His Outlook collects mail from a POP3 server, and deletes mail off the server once it’s done. Bob wants regular (hourly) email backups, so that he still has all his email in the event of a failure on the primary PC. Unfortunately, he is strongly opposed to using cloud-based email (eg Gmail with IMAP, or Hosted Exchange, either of which would have otherwise solved the problem).
We decided upon setting a scheduled task to copy Bob’s Outlook.pst file over the network from primary to secondary PC every hour.
Bob wanted the .pst file to be copied every hour, regardless of whether Outlook is open (and therefore using the file) or not, which means that we needed to use Microsoft’s Volume Shadow Copy Service (VSS) to make a shadow copy of the original. This led to further difficulties:
First of all, I created a mapped drive (T:) to the secondary PC so that the backup could be directed to a specific location. I then wrote a python script which works like so:
This works fine when run manually from the command line, but won’t run at all from Task Scheduler, due to the part in bold above. The solution was to run this as the first part of the Python script, which I found here:
if sys.argv[-1] != ASADMIN:
print "Don't have privileges, trying to get them"
script = os.path.abspath(sys.argv[0]) params = ''.join([script] + sys.argv[1:] + [ASADMIN])
shell.ShellExecuteEx(lpVerb='runas', lpFile=sys.executable, lpParameters=params)
else:
print "Got privileges, running"
main()
The above snippet literally does this: “If I’m not running as admin, run myself as admin.” The downside of this workaround is that it’s virtually impossible to debug, because the STDOUT data from the child process is not sent to the terminal window of the main process — so you can’t SEE ANYTHING.
Now the backups work as planned and Bob can rest easy that his email is safe and secure.
One of the most important tasks when managing a web server is to ensure that content is being delivered to your visitors at a reasonable speed. This is also important when one of your applications uses an internet-based data source. One of our projects relies on frequent calls to a particular web API to gather data. We were experiencing significant delays during testing, and went to work to find the bottleneck. More →
One of our clients has a Linux server. What we want to do is SSH in and set up port forwarding for RDP to a PC that’s inside the network. However, the user should be restricted to only access a certain IP address. For this example, I’m adding an account for Suresh, to access “remotehost.example.com”. He will use this to create a tunnel, forwarding port 3306 to a PC on the remote network.
$ sudo useradd --shell /bin/false --create-home suresh $ sudo passwd suresh
Disconnect, then copy your ssh identity file to the destination server:
$ ssh-copy-id suresh@remotehost.example.com
$ ssh suresh@remotehost.example.com $ suresh@remotehost.example.com's password:
Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic x86_64)
* Documentation: https://help.ubuntu.com/
System information as of Tue Jul 29 19:08:30 NZST 2014
System load: 0.94 Processes: 165
Usage of /: 66.2% of 1.70TB Users logged in: 1
Memory usage: 38% IP address for virbr0: 192.168.1.2
Swap usage: 0%
Graph this data and manage this system at:
https://landscape.canonical.com/
0 packages can be updated.
0 updates are security updates.
-address-via-
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Connection to remotehost.example.com closed.
you@yourpc ~ $
Note that it connects, but immediately severs the connection.
$ sudo nano /etc/ssh/sshd_config
Add the following (Note the indent in the second line. That’s important):
Match User suresh
PasswordAuthentication no
Restart the ssh service for the change to take effect.
$ sudo service ssh restart
If you try to connect without your SSH key, you should now see:
Permission denied (publickey).
Now, to make it so the user can only access a single remote host:
$ sudo nano /home/suresh/.ssh/authorized_keys
You should see one line in there. Pre-pend the line with:
permitopen="{target IP address}:{target port}"
Save and exit the file and give your newly configured SSH access a try
ssh -N suresh@remotehost.example.com
The ‘-N’ option tells the SSH session that you only want to open an SSH tunnel, as opposed to both a tunnel and a terminal session as per normal. Annoyingly you won’t even be returned with a nice ‘Successfully connected’ message (just a hanging process), but if you’re not hit with an error message you can be confident that the connection works.
Now the user can connect for port forwarding to a specific remote PC, but for nothing else.
Every Sunday morning, the data drive from one of our QEMU VM’s is copied to the /mnt/weeklybackup folder. This is an inelegant – but effective – method of performing a backup; it’s simply a brute-force copy of the drive while the server is still running and attached to it. However it’s still enough to access the drive, and have reliable copies of most of the data. (We also use Crashplan Pro for proper versioned backups)
Of course, if you’re taking backups, you’re likely going to need to restore from the backup at some point. This is a quick tutorial on how to mount your QCOW2 virtual drive inside the host system (“Dom0”) — effectively reading the hard drive from a different computer.
Firstly, disclaimer: we’re not responsible for anything that happens on your system, even if you follow this guide perfectly. In particular, make sure that there is no longer an active machine connected to the image – I have no idea what would happen, but I don’t trust it.
On the host, I run the following commands:
sudo mkdir /mnt/qcow sudo qemu-nbd --connect=/dev/nbd0 /mnt/weeklybackup/data.qcow2 [1] sudo mount /dev/nbd0p1 /mnt/qcow cd /mnt/qcow
——————————————————-
[1] EDIT (Aug 18, 2014):
You may need to run the following command before running the connect command if you encounter this error:
'Failed to open /dev/nbd0: No such file or directory/build/buildd/qemu-2.0.0+dfsg/nbd.c:nbd_receive_request():L638: read failed'.
This command uses modprobe to load the nbd module if module loading is not done automatically:
sudo modprobe nbd max_part=16 [2]
——————————————————-
The first line uses the qemu-nbd (QEMU Disk Network Block Device Server) to connect the virtual disk image, data.qcow2, to mount point /dev/nbd0. It should also be noted that you need to use the full path when specifying the qcow image, regardless of where you run the terminal command from (i.e. just entering data.qcow2 while situated inside /mnt/weeklybackup won’t work).
From there on it’s a simple case of mounting the correct drive partition (as you can see, all it requires is adding p# to your NBD path, where # is the partition number) at mount point /mnt/qcow and moving in to it.
There you go! Direct access to browse files on a virtual hard drive!
[2] EDIT (Sep 25, 2014): Adding nbd deletion methods and updated modprobe line
umount /mnt qemu-nbd -d /dev/nbd0 # And then to unload nbd from memory sudo rmmod nbd
When securing passwords, the effectiveness of the hashing algorithm must also be taken into consideration. Passwords these days should be hashed using AT LEAST the SHA-256 message digest, which produces a much stronger hash than the now-defunct MD5. The main reason for this is that the SHA-256 method produces a hash that is twice the size of its older counterpart (256 bits as opposed to 128 for MD5). More data contained within a hash means a greater number of possible combinations and greater protection from rainbow tables and brute-force attacks.
SHA-256 is a member of the SHA-2 family, which has become more popular after flaws were discovered in the SHA-1 family back in 2005. However, it does have a major drawback, that we touched on in the previous article: SHA-2 is fast, and that’s not what we want. More →
sudo apt-get update sudo apt-get install gir1.2-spice-client-gtk-3.0 python-gtk-vnc libglib2.0-bin python-ipaddr libvirt-glib-1.0-dev
You can then download and unzip the 1.01 tarball with the following command:
wget http://virt-manager.org/download/sources/virt-manager/virt-manager-1.0.1.tar.gz -O - | tar -xz
Finally, switch to the virt-manager folder. The python setup script caused some problems so I found it best to ignore that for now, and instead just run the ‘virt-manager’ executable.
cd virt-manager-1.0.1 sudo ./virt-manager
Now you’re running virt-manager 1.0.1, instead of 0.95 — which gives you a couple more options (and a few more bugs, too)!
Computerworld released an interesting article not too long ago, which mentioned that recent market trends had seen demand for custom servers grow by a whopping 47.2% in the final quarter of last year, while demand for servers from more well-established vendors fell by 4.4% in the same period. This poses an interesting question: what exactly is the worth in going with a custom server for your business, and is it a better option than going with the large & established “traditional” vendors?
I’ve had the problem a few times, where a Brother laser printer seems to misunderstand the alignment or margins on a page. This results in the left margin being too far towards the middle of the page, and the right margin being beyond the printable page area, making the page quite unbalanced.
Brother HL-2240D
For me, this problem manifested even with the official Brother Linux drivers for my printer.
Turns out this is actually a problem with CUPS itself, not the print driver. There’s a confirmed bug for this issue, filed against CUPS here: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1184663
A quick & tidy workaround for this issue is to manually override the print renderer for the printer, like so:
lpadmin -p PRINTER-NAME -o pdftops-renderer-default=pdftops
You’ll need to change “PRINTER-NAME” to reflect the name of your printer.
If this fixed your problem, please subscribe to the bug report so the package maintainers prioritise it.
I found this fix through an AskUbuntu question here: http://askubuntu.com/a/349800
If you’ve been following my posts lately, you’ll have seen that I’m quite keen on encryption and privacy, particularly following the ongoing Snowden revelations, and the 2013 GCSB furore here in New Zealand.
So I went out and purchased my favourite flavour of super-robust USB drive, the beautiful Corsair Survivor 3.0, and proceeded to install Linux Mint on it with LUKS full-disk encryption. You can see an overview of how I did this at my blog post here: http://www.gravitycomputing.co.nz/installing-linux-mint-usb-drive/
But there was a problem. When the system prompted me for the password to unlock my newly-encrypted drive, the password prompt wouldn’t take any input. In fact, the keyboard was completely unresponsive, even though it worked fine in the BIOS!