Mounting XFS

Somebody I know recently had troubles with his NAS and needed to turn in the NAS device but wanted to recover his data. According to the information he was able to gather it was an XFS file system.

He had little to no linux knowledge but to recover he made a Ubuntu machine and asked my help to mount his drive. I didn't have any previous experience with XFS so here is how we did it:

The device showed up in the system as sdb3.

1. sudo mkdir /media/nadisk
2. sudo mount -o inode64 -t xfs /dev/sdb3 /media/nadisk

After this he was able to get his data back and bring his NAS device back to the store :)

Symantec Endpoint Protection 11.0.6 MR2 and the internal database

I had the case where I did an implementation of SEP 11.0.6 MR2 and the internal database grew too big. Thanks to my pervious life as a DBA I was able to interprete the logs and discovered a couple of problems:



1. The cache size for the database was set to 65536K as well for the lower as upper limit.

The cache size for a database varies on the size, but there is no direct parameter where you can influence this.



2. No unique index or primary key for table "a_table_in_the_database" in database "sem5".



3. Performance warning: Database file "...\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" consists of 9468 disk fragments.



Just for info, the internal database of Symantec is a Sybase database, so it is very similar to MS SQL 2000.


I openend a case at Symantec Support and after the classic "gather the logs" round we finally concentrated on the database.


Step zero was of course run dbvalidator.cmd ("...\Program Files\Symantec\Symantec Endpoint Protection Manager\Tools") and this showed that the database was still ok to use.


The first step was making a backup with the "Backup and Restore" tool that comes with the installation. The next step was to open "services.msc" and stop the Symantec Endpoint protection Manager services and stop/start the Symantec database service. The database backup was written as a zip file to "...\Program Files\Symantec\Symantec Endpoint Protection Manager\data\backup\"


To shrink the database I needed to execute the following command:

'...\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\Win32\dbunload -c "uid=dba;pwd=your_install_db_pwd" -ar '. The -c specifies the connection parameters and the -ar means rebuild and replace.


I asked the engineer if the shrink tool is possible to use on the MS SQL database but according to the engineer this was not the case.

The database was back to a normal size and the server disk was happy again.

Error 404 ... we are watching you.

The other day I helped out with the coding of a php page for error 404 handling in a Joomla framework. The idea was that when a 404 is generated the event would be logged for analysis.

The results where pretty boring, GoogleBot who scanned the website for pages that didn't exist anymore ... so nothing special to report until I got this one:

Page:/[a path on the server]/index.php
Browser:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de;rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 Request Method: GET Request
Request URI: /en/components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile.php

The remote IP addresses where 188.61.137.55 and 195.191.54.46. A lookup on MaxMind Geoip shows us that 188.61.137.55 is an IP address in Aarau, Switzerland (ISP: Bluewin) and 195.191.54.46 is an IP in Latvia (ISP:Sia Venditore).

It was clear that this scan was part of some scanner but why the website on which my code is running is targetted is still unclear to me. The ozio gallery2 was never installed on this joomla installation.

A google search for the websites with a url containing the string "/en/components/com_oziogallery2" gave me a list of 13.500 possible exploitable sites. A look at exploit db gave us immediately an insight what the attacker was up to.

So my lessons learned from this is :

1. Modify the error 404 page in any framework so you can find interesting data.

2. I have proof that any website is scanned and there has not to be any particular reason. This was an eye opener to the person who asked me to code the page.

Educating the public ... but don't tell them the wrong info

The Belgian media is covering the Wikileaks story like in every other country. One of the things on our national television news website that caught my attention was the spectacular title "IT Security Expert: Cyber war is actually very simple".

You can't hear the question to the IT security specialist but what he basically explains is a DDoS attack. What he explains is correct but I am quite disappointed in the journalist. I personally think that it is a good thing to make the public aware of what is happening in the world and how attacks are carried out but choosing this title was over the top.

Fun with SSL

I am working on a project where mutual authentication with SSL has to be done between a Apache mod_proxy and some proxy server at a third party.

I personally did not designed or built the system and after doing an upgrade of httpd one of the instances did not restart when I told it to. It went down and said SSL is already loaded ... fail.

The idea of this server is to listen to tcp/443 and based on the URI redirect to a virtual host running on a specific port. These virtual hosts do some mod_rewrite magic and inject the SSL certificate and then connect to the third party. According to the project manager this can only be done with mod_proxy and no other proxy would allow you to do this.

I tried to restart the other virtual hosts and they went down and up without any problems. So it was just the httpd listening on port 443 that was not coming up.

Since Google is your friend when you got an error message that basically just tells you "sorry, SSL is already in use". I looked at a couple of forum posts and it was pretty clear immediately that it had something to do with the http.conf file.

In the httpd.conf file there was an include directive to load all .conf files from a conf.d directory. So analyzing them one by one I figured out that one of them contained the instructions to load the mod_ssl.so and of course there was the mod_ssl configuration file which loads mod_ssl.so as well.

Once I commented out the lines in the other file everything was back up and running.

The RedHat Network

This week I was asked to upgrade RedHat Enterprise server for a customer. I personally use Ubuntu, and not being part of my company's linux group, it was totally new to me. The reason I blog about this is not because it was technically challenging but it took me quite some effort to figure out how it worked.

When you order a license at RedHat, you need to provide an e-mail address. In my case this was the one of the CIO of my customer. The next thing that happens is that the reseller (my company) receives an e-mail with the confirmation of the purchase and the customer receives an email with a link.

It is very important that the customer clicks this link and fills out the form. During this registration he must choose a customer name and password. Once the account is created you have to run the rhn_register command as root.

This takes you through a script where your server connects to the RHN asks for your customer name and password and gathers information about your system. Once your system is registered you can use the yum package manager to actually upgrade the system.

Bleachbit

Today I discovered the existance of bleachbit. Bleachbit is a nifty little tool that helps you clean up personal info in linux.