makepasswd generating passwords on linux

I was writing a script the other day and had to generate a password and found the nifty tool call makepasswd.

makepasswd is a command that generate true random passwords using /dev/random.

To install you do
sudo apt-get install makepasswd

To generate a password you do

makepasswd

and if you want a 16 character password you do

makepasswd --chars 16

Now you screen me ... now you don't

screen is a little command that I use on a daily basis, it allows you to start a session, execute some commands, disconnect from the session while the command continues and later reconnect to it.

Starting a screen session

To start a screen session you just hit screen. Then you start whatever you need to run. By hitting ctrl+a and followed by d, you detach from your session. You see the session ID when you have exited the screen session, you will need this ID to reconnect to it.

Listing your sessions

If you have multiple sessions and want to have an overview you run screen -ls.

Reattaching to a session

When you come back and want to reattach to a session you do screen -r .

Killing a session from within a session

When you are in a session you can kill it by hitting ctrl+a and then k.

Killing a session from outside a session

When you want to kill a session from outside a screen session you do screen -X -S

Wifipwdump.sh

A small post to tell you about a little script I wrote to troubleshoot an issue I had with a wireless network the other day. Nobody was able to tell me what the WiFi password was thus I had to dump it from a system that was connected.

Since I will most likely not remember how I did it a next time I wrote a little script for it you can find at https://github.com/Xiobe/scripts/blob/master/wifipwdump.sh

Timestamping history

Being an incident response person means sometimes you are also asked some help for troubleshooting things. The other day I was looking at a config and wanted to know what the sysadmin did on his Linux box before calling me in.

After I helped him (it was a typo in a config file) I told him something I only learned half a year ago but I think is pretty handy. You can actually timestamp the commands in the history file.

The magical line is :
echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
I also put it in my Dockerfile with the following instruction:
ENV HISTTIMEFORMAT="%d/%m/%y %T "

Installing Kali2 on an HP Zbook 17

The other day I had to install Kali2 on an HP Zbook 17. Usually it goes without any problems but this one was a harder nut to crack. I usually do the install a couple of times, just to make sure that the process is repeatable for my colleagues if they need to repeat it.

After it got installed sometimes the computer completely froze up. When I tried to shut it down it froze systematically. The problem was thus that troubleshooting was a pain since sometimes it froze.

The solution was actually simple (but usually things are once you have figured it out). At boot you make the boot loader go and boot in recovery mode. I got greeted by a shell instead of the GUI and for some reason I tried immediately to shutdown and that worked without any problem so the actual problem had to do with the GUI.

I restarted the system and I looked at my dmesg output. Hidden in between all other lines, it said acpi had issues. The solution was to edit /etc/default/grub and add to the value for GRUB_CMDLINE_LINUX_DEFAULT the bootoption acpi=off.

To make the changes work the magic word is sudo update-grub and reboot the computer.

After the reboot I got the message "A start job is running for dev-disk-by (...)". The issue was pretty well documented in this blogpost. It is was caused by the swap not having the correct UUID, by simply looking it up with lsblk -f and manually correcting /etc/fstab all problems are gone and the machine runs smoothly.

Adding repositories to your sources.list

Tonight I added a repo to my sources.list but when I ran update I got an error message telling me my system could not trust the content since the GPG key was unknown. If you are regularly confronted with this you will probably know how to handle this but I have been install quite a lot of Linux for people that are totally new to Linux so I am going to use my blog for posting the solution.

When you run the apt-get update it will tell you which key the system isn't sure about. This value will be needed.

1. The first step is to get a copy of the key on your system. I found the following example online to illustrate this: gpg --keyserver pgpkeys.mit.edu --recv-key AED4B06F473041FA

This basically means get a copy of key AED4B06F473041FA from the key server at MIT. MIT is not the only key server in the world but it is a very popular one.

2. Now that the key is on your system you need to add it to apt's key ring:
gpg -a --export AED4B06F473041FA | sudo apt-key add -

Now that the key is known to apt you can run apt-get update again and will not get any errors for that key (may be others, but you got to repeat the procedure). Remember only to add sources that you trust.

The RedHat Network

This week I was asked to upgrade RedHat Enterprise server for a customer. I personally use Ubuntu, and not being part of my company's linux group, it was totally new to me. The reason I blog about this is not because it was technically challenging but it took me quite some effort to figure out how it worked.

When you order a license at RedHat, you need to provide an e-mail address. In my case this was the one of the CIO of my customer. The next thing that happens is that the reseller (my company) receives an e-mail with the confirmation of the purchase and the customer receives an email with a link.

It is very important that the customer clicks this link and fills out the form. During this registration he must choose a customer name and password. Once the account is created you have to run the rhn_register command as root.

This takes you through a script where your server connects to the RHN asks for your customer name and password and gathers information about your system. Once your system is registered you can use the yum package manager to actually upgrade the system.

Securing an LAMP server ... intro

I've been given the opportunity to secure an LAMPserver. I 've never done this before but there is a first time for everything.

This is the layout of the system:
First of course there is OS hardening. I mention it since I've noticed that it isn't done by everyone. It is an Ubuntu server and google was my friend :). There are tons of info out there.

All ports except port 80 will be closed towards the Internet and port 80 will be connected to the web server by using NAT. On the web server the only ports open are HTTPS and SSH.

The server has a firewall and 3 rules:
1. Close every port
2. Allow the HTTPS traffic from the internal network and the Internet
3. Allow SSH trafic from the internal network and the Internet.

I am not happy with the last one, I will change it so that only the admin has access from his laptop but right now it is not my primary concern.

In my next post about securing the a LAMP, I'll be talking about the apache web server. Meanwhile if you have any suggestions or questions just give me a reaction.

Mounting usb-drives with a NTFS lock on it.

Everybody has come across it, your in a hurry and unplug the usb drive before Windows releases the disk. This is how to solve it when you have a linux (or a bootable linux cd) machine.

First you make a directory on which you will mount the disk. For people new to linux this is just a simple directory to which you will attach the disk.

Open yourself a shell prompt and type the following:
mkdir ~/mydisk

This will make your directory in your home directory.

The type the following:
mount -t ntfs-3g /dev/sdg1 ~/mydisk -o force

This will mount the disk presented at the device /dev/sdg1 and attach it to the folder ~/mydisk. For people new to linux I recommend to do some further reading about devices.

My system answers me with :
$LogFile indicates unclean shutdown (0, 0)
WARNING: Forced mount, reset $LogFile.

And I find the disk mounted under ~/mydisk